diff --git a/.env.example b/.env.example
index e6f2403..9aedbf9 100644
--- a/.env.example
+++ b/.env.example
@@ -22,8 +22,8 @@
 # Delay before checking bandwidth downgrade (seconds)
 #DOWNGRADE_START_CHECK=1800
 
-# Relay server port
-#HBBS_PORT=21117
+# Relay server port (hbbr)
+#HBBR_PORT=21117
 
 # ============================
 # HBBS (Rendezvous / Signal Server)
@@ -85,7 +85,7 @@
 # Gin mode (release/debug/test)
 #RUSTDESK_API_GIN_MODE=release
 
-# Language for API responses (en, ru, fr, es, ko)
+# Language for API responses (en, ru, zh-CN)
 #RUSTDESK_API_LANG=en
 
 # Enable web client (1=on, 0=off)
@@ -120,16 +120,16 @@
 #RUSTDESK_API_POSTGRESQL_DBNAME=postgres
 #RUSTDESK_API_POSTGRESQL_SSLMODE=disable
 
-# RustDesk server addresses (announced to clients)
+# RustDesk server endpoints (announced to clients; keep explicit ports where required)
 #RUSTDESK_API_RUSTDESK_ID_SERVER=
 #RUSTDESK_API_RUSTDESK_RELAY_SERVER=
 #RUSTDESK_API_RUSTDESK_API_SERVER=
 #RUSTDESK_API_RUSTDESK_WS_HOST=
 
-# Path to the public key file (generated by hbbs on first run)
+# Current public-key file contract: use the file generated by hbbs on first run.
 #RUSTDESK_API_KEY_FILE=/data/id_ed25519.pub
 
-# Encryption key (same as HBBS KEY)
+# Legacy raw key compatibility only; new deployments must use RUSTDESK_API_KEY_FILE.
 #RUSTDESK_API_RUSTDESK_KEY=
 
 # Enable personal API (1=on, 0=off)
@@ -152,7 +152,7 @@
 #RUSTDESK_API_REDIS_ADDR=
 #RUSTDESK_API_REDIS_PASSWORD=
 
-# Cache type (memory/redis)
+# Cache type (memory/file/redis)
 #RUSTDESK_API_CACHE_TYPE=memory
 
 # Proxy for outgoing connections (OAuth etc.)
@@ -163,15 +163,20 @@
 # Custom Client Builder
 # ============================
 
-# Build agents use shared Docker volumes for job tickets.
-# Build output is written to rdgen-data:/output/{build_id}/
-# No additional env vars are required for basic operation.
+# Manual/historical file-queue material only (not the current provider-dispatch
+# build path): old agents used the shared Docker volume for job tickets and wrote
+# output below rdgen-data:/output/{build_id}/. No additional env vars are required
+# for the current provider-backed operation.
 
 # Secret encryption key for data at rest (BUGS.md B-008).
 # Encrypts the GitHub PAT, the workflow PayloadKey and permanent_password
 # (stored inside custom_json) in the database with AES-256-GCM.
 # Read directly from the environment (NOT via the RUSTDESK_API_ prefix).
-# Use a long random value; keep it stable (rotating it makes existing
-# encrypted rows unreadable). If unset, secrets are stored in plaintext.
+# Use a long random value.
+# Existing ciphertext requires the same key; key rotation is unsupported.
+# Legacy plaintext rows remain readable; saving them again encrypts them when
+# the key exists. If unset, new non-empty
+# secret writes and secret-bearing Custom Builder operations are rejected rather
+# than stored as plaintext.
 # Must NOT reuse WORKFLOW_PAYLOAD_KEY (that one is shared with GitHub).
 #SECRET_ENCRYPTION_KEY=
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..0532d99
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,133 @@
+name: Build
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "api/**"
+      - "admin-ui/**"
+      - "server/**"
+      - "libs/**"
+      - "go.mod"
+      - "go.work"
+      - "go.work.sum"
+      - "docker/**"
+      - ".dockerignore"
+      - "Dockerfile"
+      - "docker-compose.yml"
+      - "docker-compose.yaml"
+      - "compose.yml"
+      - "compose.yaml"
+      - ".github/workflows/**"
+  pull_request:
+    paths:
+      - "api/**"
+      - "admin-ui/**"
+      - "server/**"
+      - "libs/**"
+      - "go.mod"
+      - "go.work"
+      - "go.work.sum"
+      - "docker/**"
+      - ".dockerignore"
+      - "Dockerfile"
+      - "docker-compose.yml"
+      - "docker-compose.yaml"
+      - "compose.yml"
+      - "compose.yaml"
+      - ".github/workflows/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: Go checks
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        working-directory: api
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: api/go.mod
+          cache: true
+          cache-dependency-path: |
+            api/go.sum
+            go.work.sum
+      - run: go test ./...
+      - run: go vet ./...
+      - run: go build -o /tmp/deskforge-apimain ./cmd/apimain.go
+
+  admin-ui:
+    name: Admin UI build
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        working-directory: admin-ui
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 20
+      - run: npm ci
+      - run: npm run build
+
+  rust:
+    name: Rust checks
+    runs-on: ubuntu-24.04
+    env:
+      DATABASE_URL: sqlite:///tmp/deskforge-sqlx.sqlite3
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: rustup toolchain install 1.92.0 --profile minimal --component rustfmt
+      - run: cargo +1.92.0 fmt --all -- --check
+        working-directory: server
+      - run: cargo +1.92.0 fmt --all -- --check
+        working-directory: libs/hbb_common
+      - name: Prepare SQLx SQLite schema
+        run: |
+          python3 - <<'PY'
+          import sqlite3
+
+          with sqlite3.connect("/tmp/deskforge-sqlx.sqlite3") as connection:
+              connection.executescript(
+                  """
+                  create table if not exists peer (
+                      guid blob primary key not null,
+                      id varchar(100) not null,
+                      uuid blob not null,
+                      pk blob not null,
+                      created_at datetime not null default(current_timestamp),
+                      user blob,
+                      status tinyint,
+                      note varchar(300),
+                      info text not null
+                  ) without rowid;
+                  create unique index if not exists index_peer_id on peer (id);
+                  create index if not exists index_peer_user on peer (user);
+                  create index if not exists index_peer_created_at on peer (created_at);
+                  create index if not exists index_peer_status on peer (status);
+                  """
+              )
+      - run: cargo +1.92.0 check --locked
+        working-directory: server
+      - run: cargo +1.92.0 test --locked
+        working-directory: server
+
+  docker:
+    name: Docker build
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: docker build -f docker/Dockerfile -t deskforge:ci .
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
new file mode 100644
index 0000000..269bdf6
--- /dev/null
+++ b/.github/workflows/build_test.yml
@@ -0,0 +1,77 @@
+name: Build Test
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  focused:
+    name: Focused monorepo validation
+    runs-on: ubuntu-24.04
+    env:
+      DATABASE_URL: sqlite:///tmp/deskforge-sqlx.sqlite3
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: api/go.mod
+          cache: true
+          cache-dependency-path: |
+            api/go.sum
+            go.work.sum
+      - name: Go tests and vet
+        working-directory: api
+        run: |
+          go test ./...
+          go vet ./...
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 20
+      - name: Admin UI build
+        working-directory: admin-ui
+        run: |
+          npm ci
+          npm run build
+      - run: rustup toolchain install 1.92.0 --profile minimal --component rustfmt
+      - name: Rust format check
+        working-directory: server
+        run: cargo +1.92.0 fmt --all -- --check
+      - name: Shared Rust format check
+        working-directory: libs/hbb_common
+        run: cargo +1.92.0 fmt --all -- --check
+      - name: Prepare SQLx SQLite schema
+        run: |
+          python3 - <<'PY'
+          import sqlite3
+
+          with sqlite3.connect("/tmp/deskforge-sqlx.sqlite3") as connection:
+              connection.executescript(
+                  """
+                  create table if not exists peer (
+                      guid blob primary key not null,
+                      id varchar(100) not null,
+                      uuid blob not null,
+                      pk blob not null,
+                      created_at datetime not null default(current_timestamp),
+                      user blob,
+                      status tinyint,
+                      note varchar(300),
+                      info text not null
+                  ) without rowid;
+                  create unique index if not exists index_peer_id on peer (id);
+                  create index if not exists index_peer_user on peer (user);
+                  create index if not exists index_peer_created_at on peer (created_at);
+                  create index if not exists index_peer_status on peer (status);
+                  """
+              )
+          PY
+      - name: Rust check
+        working-directory: server
+        run: cargo +1.92.0 check --locked
+      - name: Rust tests
+        working-directory: server
+        run: cargo +1.92.0 test --locked
diff --git a/AGENTS.md b/AGENTS.md
index 3f8e360..59d9248 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,7 +10,7 @@ Everything in one Docker image via s6-overlay.
 - **Rust servers** (`server/`): hbbs (ID/signaling, TCP/UDP 21116) + hbbr (relay, TCP 21117)
 - **Go API** (`api/`): Gin on port 21114. GORM (SQLite/MySQL/PostgreSQL). JWT, LDAP, OIDC.
 - **Admin UI** (`admin-ui/`): Vue 3 + Element Plus. Served at `/admin/`. REST + WebSocket.
-- **rdgen** (`rdgen/`): vendored reference workflow (not a service).
+- **rdgen** (`rdgen/`): vendored historical/reference workflow material (not a service; frozen).
 - **Shared lib** (`libs/hbb_common`): Rust crate shared between hbbs and hbbr.
 
 ## Tech stack
@@ -18,7 +18,7 @@ Everything in one Docker image via s6-overlay.
 | Component     | Stack                                                             |
 | ------------- | ----------------------------------------------------------------- |
 | Rust (server) | 2021 edition, axum 0.5, sqlx 0.6, tokio, sodiumoxide, openssl    |
-| Go (api)      | 1.23, gin 1.9, gorm 1.25, swag, cobra/viper, jwt, ldap, OIDC     |
+| Go (api)      | 1.25, gin 1.9, gorm 1.25, swag, cobra/viper, jwt, ldap, OIDC     |
 | Admin UI      | Vue 3.5, Element Plus 2.8, Vite 6, Pinia 2.2, vue-router 4, axios|
 | Python (rdgen)| Django (vendored reference, not a service)                      |
 | Infra         | Docker + s6-overlay, docker compose                               |
@@ -49,14 +49,26 @@ admin-ui/        — Vue 3 admin panel
 ├── src/styles/  — SCSS (design tokens, light/dark)
 └── src/utils/   — auth, request, export, i18n (en/ru/zh_CN)
 
-rdgen/           — vendored reference workflow (patches, generator-*.yml)
-libs/hbb_common/ — shared Rust library (submodule)
+rdgen/           — ❄️ frozen vendored historical/reference workflow material (patches, generator-*.yml)
+libs/hbb_common/ — tracked shared Rust library in DeskForge (not a submodule here)
 docker/          — Dockerfile + compose + entrypoint scripts
-github-build/    — active CI workflow for client builds
-win-builder/     — ❄️ frozen standalone Windows builder
-offline-kit/     — ❄️ frozen sovereign build kit
+github-build/    — reference/documentation only; no executable workflow copies
+win-builder/     — ❄️ frozen manual/historical-only standalone builder
+offline-kit/     — ❄️ frozen dependency-freeze tool; verification is incomplete
 ```
 
+DeskForge tracks `libs/hbb_common/` directly. The configured RustDesk fork has its
+own `libs/hbb_common` git submodule, currently recorded against upstream
+`rustdesk/hbb_common`; its local state is dirty and unpublished, so clean fork
+provenance is an explicit reproducibility gate. The fork's `.github/workflows/` files
+are the sole executable source for active client-build workflows; `github-build/` and
+`rdgen/` are reference/frozen material only. No current repository `vendor/` tree,
+`rustdesk-deps/` archive, or client-release directory is tracked here.
+The published RustDesk client source/ref is 1.4.8 and the published DeskForge API
+schema is `DatabaseVersion` 272. The local uncommitted corrective worktree targets
+API schema 282; that local schema target is not published or live-provider evidence.
+MySQL/PostgreSQL migration and read/write coverage remain unverified.
+
 ## Build / dev commands
 
 ### Docker (primary)
@@ -65,7 +77,7 @@ offline-kit/     — ❄️ frozen sovereign build kit
 cd docker
 docker compose build          # full build
 docker compose up -d          # start
-docker compose -f docker-compose-dev.yaml up -d   # dev
+cd ../api && docker compose -f docker-compose-dev.yaml up -d   # dev API stack
 ```
 
 ### Rust
@@ -77,7 +89,12 @@ cd server && cargo build --release && cargo clippy && cargo test
 ### Go
 
 ```bash
-cd api && go build -o release/apimain cmd/apimain.go && go vet ./... && go test ./...
+cd api && go build -o release/apimain cmd/apimain.go
+# Full local checks:
+GOWORK=off go vet ./...
+GOWORK=off go test ./...
+# Redis integration tests and benchmarks are opt-in. Configure
+# DESKFORGE_TEST_REDIS_ADDR to run them; no live Redis endpoint is assumed.
 ```
 
 ### Admin UI
@@ -91,6 +108,8 @@ cd admin-ui && npm install && npm run dev && npm run build
 | Variable | Purpose | Used by |
 |----------|---------|---------|
 | `RELAY` | Relay server address | Rust hbbr |
+| `HBBR_PORT` | Relay server port | Rust hbbr |
+| `HBBS_PORT` | ID/Rendezvous server port | Rust hbbs |
 | `ENCRYPTED_ONLY` | Only encrypted connections | Rust |
 | `MUST_LOGIN` | Require login before connect | Rust |
 | `RUSTDESK_API_RUSTDESK_ID_SERVER` | ID server address | Go API |
@@ -98,9 +117,13 @@ cd admin-ui && npm install && npm run dev && npm run build
 | `RUSTDESK_API_RUSTDESK_API_SERVER` | API server URL | Go API |
 | `RUSTDESK_API_KEY_FILE` | Path to public key file | Go API |
 | `RUSTDESK_API_JWT_KEY` | JWT secret key | Go + Rust |
-| `RUSTDESK_API_GORM_TYPE` | sqlite/mysql/postgres | Go API |
+| `RUSTDESK_API_GORM_TYPE` | sqlite/mysql/postgresql | Go API |
 | `RUSTDESK_API_LANG` | en/ru/zh-CN | Go + UI |
-| `SECRET_CRYPT_KEY` | AES-GCM key for secrets at rest | Go API |
+| `SECRET_ENCRYPTION_KEY` | AES-GCM key for secrets at rest | Go API |
+
+New non-empty secret writes and secret-bearing Custom Builder operations require this
+key and are rejected rather than stored as plaintext when it is missing. Legacy plaintext
+rows remain readable; saving them again encrypts them when the key exists.
 
 ## Key integration points
 
@@ -109,7 +132,7 @@ cd admin-ui && npm install && npm run dev && npm run build
 - Go reads public key from `RUSTDESK_API_KEY_FILE` (`/data/id_ed25519.pub`)
 - Go connects to hbbs/hbbr via `RUSTDESK_API_RUSTDESK_ID_SERVER`/`RUSTDESK_API_RUSTDESK_RELAY_SERVER`
 - JWT: Go generates, Rust validates (`jwt.rs`)
-- WebSocket bridge: port 21118
+- WebSocket bridge: port 21118; relay WebSocket: port 21119
 
 ### Admin UI ↔ Go API
 
@@ -121,6 +144,12 @@ cd admin-ui && npm install && npm run dev && npm run build
 ## Agent constraints
 
 - Do not modify upstream directly (`rustdesk/rustdesk-server`, `lejianwen/rustdesk-api`) — only forks.
+- Active third-party upstream dependencies remain in the Rust/Go manifests; a complete
+  upstream-independent or offline dependency bundle is not currently verified.
+- The combined DeskForge distribution is identified as AGPL-3.0 for the covered work;
+  separate API/UI/reference components retain their applicable upstream licenses and notices.
+  The license inventory is incomplete; no signatures or attestations are recorded, and no
+  full sovereignty claim is made.
 - Keep Docker entrypoint scripts in sync with the services they supervise.
 - Never log or commit secrets.
 - Document env vars in README + docker-compose.
@@ -136,7 +165,9 @@ cd admin-ui && npm install && npm run dev && npm run build
 
 - **Clean layered (Go):** Controller → Service → Model. Do not mix layers.
 - **Embedded UI:** Go embeds `admin-ui/dist/` and `web/`.
-- **Multi-DB:** GORM, no raw SQL.
+- **Configured multi-DB:** GORM with SQLite/MySQL/PostgreSQL drivers, no raw SQL;
+  SQLite is locally exercised, while MySQL/PostgreSQL migration and read/write
+  coverage remain unverified.
 - **OAuth/LDAP:** configured via admin panel → DB. Falls back to local users.
 - **Server commands:** allowlist in `serverCmd.go`.
 
@@ -151,4 +182,4 @@ cd admin-ui && npm install && npm run dev && npm run build
 
 ## New upstream version workflow
 
-See [PLAN.md §7](PLAN.md#7-workflow-new-upstream-rustdesk-client-release).
+See [PLAN.md §7](PLAN.md#7-historical-fork-maintenance-notes-for-a-new-upstream-rustdesk-client-release).
diff --git a/BUGS.md b/BUGS.md
index f2b7ef5..02c986f 100644
--- a/BUGS.md
+++ b/BUGS.md
@@ -3,54 +3,64 @@
 > Tracker for issues found in the build-custom-agent end-to-end flow.
 > Backend: `api/http/controller/admin/custom_build.go`, `api/service/custom_build.go`,
 > `api/service/github_build_config.go`. Frontend: `admin-ui/src/views/custom-client/index.vue`,
-> `admin-ui/src/views/server/github-build.vue`. Workflow: `github-build/rustqs-windows-min-test.yml`.
+> `admin-ui/src/views/server/github-build.vue`. Active Windows workflow source: branch
+> `rustqs/workflows`, workflow `.github/workflows/rustqs-windows.yml`, artifact
+> `rustqs-windows`; local `github-build/` workflow files are reference material only.
 >
 > Status legend: `[ ]` open · `[x]` fixed · `[~]` partial · `[skip]` won't fix (owner decision).
 >
-> Last audit: 2026-06-23 (fixed items removed; tracker lists only open work).
+> Last audit: 2026-06-23. Current file contents are a bounded tracker snapshot:
+> 1 fixed, 4 partial, and 1 open entry; older aggregate counts remain in dated
+> changelog history.
+> Current-state reconciliation: 2026-08-10. Historical findings below are labeled
+> where the current provider-only path supersedes the old queue behavior; no live
+> provider or clean-build evidence is implied. Older branch and workflow names below
+> are retained as historical records and do not describe the current executable path.
 
 ---
 
-## Architectural mismatch with PLAN.md §3
+## Historical architectural mismatch with PLAN.md §3
 
-PLAN.md declares the standalone / Docker build agents **frozen as fallback** (§8.3, §8.4).
-Reality: `custom_build.go::submitBuild` still routes every non-Windows platform — and even
-`windows-x86` and Windows when GitHub config is absent — into the file queue
-(`/rdgen-data/jobs/{id}.json`). Owner decision (2026-06-20):
+The original audit recorded a mismatch with the standalone / Docker build agents marked
+**frozen as fallback** (§8.3, §8.4). The current source now checks provider readiness
+before persistence and does not route production submissions into the file queue. The
+queue scripts remain frozen historical material. Owner decision (2026-06-20):
 
-1. Treat Docker `build-linux` and `build-win` containers as **frozen manual fallback**, not the
+1. Treat Docker `build-linux` and `build-win` containers as **frozen manual/historical-only** material, not the
    default route. They stay on disk but should not be started by `docker compose up`.
 2. Remove `windows-x86` (32-bit) as a build target everywhere — UI option, form defaults,
    any router branches. 2026; not worth maintaining.
-3. Build a **GitHub Actions workflow for Linux + Android** mirroring the windows-min-test
-   pipeline, and re-route `submitBuild` accordingly. Until those workflows ship, non-Windows
-   platforms should be hidden in the UI to stop users from creating phantom builds.
+3. Keep the fork-owned Linux + Android workflow mappings, but do not re-expose those
+   platforms until PR11 has real end-to-end evidence. Until then, non-Windows platforms
+   remain gated in the UI/API to prevent phantom builds.
 
 The bugs below are grouped by where they leak into user-visible breakage.
 
 ---
 
-## CRITICAL — workflow is silently broken end-to-end
-
-### [~] B-001 · File-queue jobs never propagate `done` status back to the DB
-**Deferred on branch `fix/build-custom-agent` (2026-06-20):** UI now restricts platforms to
-Windows-via-GitHub (B-013), so the file-queue path is unreachable from the default flow
-even though `submitBuild` still has the branch. `docker/docker-compose.yml` moved
-`build-linux` and `build-win` services behind a `fallback` profile so they don't start by
-default. Full fix (status mirror) only matters once Linux/Android workflows land (B-012),
-at which point we'd rather route them through GitHub too.
-
-**Where:** `api/http/controller/admin/custom_build.go:172-201` (writes job),
-`docker/entrypoint-linux.sh:37,49,76,...` and `docker/entrypoint-win.sh:33,45,210` (write `output_dir/status`).
-**Symptom:** Linux/Android (and Windows when GitHub config is missing) builds sit at
-`Status=pending` forever. `DownloadByKey` returns HTTP 409. The Download button never appears
-in the UI (`v-if="row.status === 'done'"`, `custom-client/index.vue:306`).
+## Historical critical finding — workflow was silently broken end-to-end
+
+### [~] B-001 · Historical file-queue jobs do not propagate `done` status back to the DB
+**Current state:** provider readiness is checked before a production build row is persisted,
+so the file-queue path is not a production fallback. `docker/docker-compose.yml` keeps
+`build-linux` and `build-win` behind a `fallback` profile. The frozen scripts still have
+the status-mirror limitation if an operator runs them manually; no live provider evidence
+is implied by this closure boundary.
+
+**Current path:** `api/http/controller/admin/custom_build.go:1246-1261` dispatches
+production builds through the configured provider; the old queue references remain
+only in the frozen scripts below. **Historical queue locations:**
+`docker/entrypoint-linux.sh:37,49,76,...` and `docker/entrypoint-win.sh:33,45,210`
+write `output_dir/status`.
+**Historical symptom:** Linux/Android (and Windows when GitHub config was missing) builds
+sat at `Status=pending` forever. `DownloadByKey` returned HTTP 409. The Download button
+did not appear in the UI (`v-if="row.status === 'done'"`, `custom-client/index.vue:306`).
 **Root cause:** no Go-side watcher reads `/rdgen-data/output/{id}/status`. The build agent's
 status file is dead-letter.
 **Fix path (per owner direction):**
-- Short term: hide all non-Windows-via-GitHub options in the UI (B-002, B-013).
-- Long term: replace the file queue for the supported platforms with GitHub Actions dispatch
-  (linux/android workflows, B-012).
+- Current: keep all non-Windows-via-GitHub options gated in the UI/API (B-002, B-013).
+- Future: enable Linux/Android only after fork workflow, artifact, embedding, and download
+  evidence is recorded under B-012/PR11.
 
 ## LOW — dead code / cleanup
 
@@ -80,6 +90,12 @@ Left in place because it's a documented capability URL and may have third-party
 ## STRUCTURAL — to enable B-001/B-002/B-013 fixes
 
 ### [~] B-012 · Build Linux + Android GitHub Actions workflows
+**Current state:** the API has fork-owned filename mappings, but its production capability
+gate rejects Linux and Android until PR11 validates the complete workflow and artifact path.
+No live provider/workflow run or clean build is recorded in the current canonical plan.
+
+**Historical audit record:**
+
 **Backend:** merged (PR #44 backend routing: `submitBuild` dispatches `platform=linux`/`android`
 by workflow constant; `tryGithubDispatch` picks `rustqs-linux.yml`/`rustqs-android.yml`;
 `pollAndDownload` selects artifact by platform).
@@ -88,6 +104,8 @@ by workflow constant; `tryGithubDispatch` picks `rustqs-linux.yml`/`rustqs-andro
 and `rustqs/min-test` (execution) — all three are indexed (HTTP 200):
 `rustqs-windows-min-test.yml`, `rustqs-linux.yml`, `rustqs-android.yml`.
 Filenames in Go constants match fork filenames exactly.
+These deployment observations are historical; they are not current provider-run,
+artifact, package, or support evidence.
 
 **Critical dependency:** `bridge.yml` must also exist on both branches — all three
 `rustqs-*.yml` reference it as a reusable workflow. Without it, dispatch succeeds
@@ -96,11 +114,15 @@ but the run fails with a parse error (422).
 Still open:
 - validate `rustqs-linux.yml` and `rustqs-android.yml` on real Actions runs (build steps:
   vcpkg/flutter/build.py/packaging/artifact paths — need CI iteration like windows-min-test did)
-- Android `custom_.txt` embedding is best-effort, needs verification
+- Android `custom_.txt` runtime-path and fail-closed packaging checks have local static
+  evidence; no live APK/package/install/runtime evidence exists
 - re-expose Linux/Android in the UI (B-013) behind a feature flag once runs are green
 
-**Where:** `github-build/rustqs-linux.yml`, `github-build/rustqs-android.yml`. Reference templates:
+**Where (active source):** the configured RustDesk fork's
+`.github/workflows/rustqs-linux.yml` and `.github/workflows/rustqs-android.yml`.
+**Historical/reference templates:** former local `github-build/` workflow references and
 `rdgen/.github/workflows/generator-linux.yml`, `rdgen/.github/workflows/generator-android.yml`.
+The `github-build/` and `rdgen/` workflow material is not the executable source.
 **Symptoms (historical):** before the push, dispatch returned HTTP 404 because workflow files
 were not on `master` (default branch); submit went to the deprecated file queue (B-001).
 Resolved by pushing workflow files to both `master` and `rustqs/min-test`.
@@ -119,7 +141,10 @@ can create/alter peers and inject audit entries. `/api/shared-peer` also does an
 `(*j)["share_token"].(string)` assertion (`webClient.go:57`) → 500 on missing token.
 **Fix:** needs RustDesk protocol design confirmation (the PC client hits these before auth).
 
-### [ ] AU-L-010 · Hardcoded version list in Custom Client UI
+### [x] AU-L-010 · Hardcoded version list in Custom Client UI
+Resolved in the current source by the provider-derived version catalog; unavailable
+provider catalog data returns an empty/error state rather than an obsolete hardcoded
+version fallback. Live provider catalog evidence remains unverified.
 
 ## rdgen generator — open findings (consolidated from the removed `AUDIT.md`)
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 71d0ef7..0566f5f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Current-state reconciliation — 2026-08-10
+- The published RustDesk client source/ref is **1.4.8** and the published DeskForge API
+  schema is `DatabaseVersion` **272**. The local uncommitted corrective worktree targets
+  API schema 282; that local schema target is not a current published-schema claim.
+  Older 1.4.7/272 references in the dated entries below remain historical release/schema notes.
+- The current custom-client path is owned-fork dispatch, provider polling, exact artifact
+  retrieval, and local validation/publication. Runner callbacks, local file-queue fallback,
+  and sole-artifact selection are not current production behavior.
+- Dispatch `return_run_details=true` plus an exact HTTP 200 run-details response is the
+  project/provider contract under test. Standard 204 is intentionally unsupported because
+  it does not provide an accepted exact run correlation; normal GitHub operation is not verified.
+- Windows is the only production capability admitted by the API gate. Linux/Android
+  workflow mappings exist but remain gated pending PR11 evidence; no live provider run or
+  clean-environment build proof is claimed.
+- Canonical plan state: PR9 is `verified-with-notes`; PR10 and PR11 remain
+  `in-progress`, while PR12 is `verified-with-notes` for docs only. This does not claim
+  live provider execution, clean builds, platform support, sovereignty, or release publication.
+- Follow-up verification on 2026-08-11: `GOWORK=off go vet ./...` and
+  `GOWORK=off go test ./...` pass after test-only cache diagnostics and opt-in Redis
+  test changes. Redis integration tests and benchmarks run only when
+  `DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded.
+  MySQL/PostgreSQL, live provider, and the other release/build gates remain unverified.
+
 ### Fixed (custom-client: relay_server port stripping + api-server key)
 - **custom-client: relay_server port stripped on blur, submit, and prefill** — now consistent
   with `host`: hostname only, no port. The client appends default relay port (21117) automatically.
@@ -40,7 +63,11 @@ across three migration steps; `AutoMigrate` is idempotent so all schema addition
   37 Rust test-code alerts dismissed as test-only. (PRs #24, #25, #26, #28, #29)
 - **api + admin-ui: encrypted secrets at rest** — `CustomBuild`, `CustomPreset`,
   `GithubBuildConfig` now store sensitive fields wrapped with AES-GCM via
-  `api/utils/secretcrypt`. Key from `SECRET_CRYPT_KEY` env var; absence fails closed at boot.
+  `api/utils/secretcrypt`. Uses the canonical `SECRET_ENCRYPTION_KEY` env var.
+  Without it, new non-empty secret writes and secret-bearing Custom Builder operations
+  are rejected rather than stored as plaintext. Legacy plaintext remains readable, and
+  re-saving encrypts it when the key exists. Existing ciphertext requires the same key;
+  key rotation is unsupported.
 - **api: OAuth delete guard** — last-enabled OAuth provider cannot be deleted while
   `oauth-only` registration is on (would lock the system out).
 - **rdgen: production startup guard** — refuses to boot with default `SECRET_KEY` /
@@ -52,13 +79,13 @@ across three migration steps; `AutoMigrate` is idempotent so all schema addition
 - **api: capability-URL TTL** — public download links (`/build/k/{key}` and
   `/build/dl/{key}`) now return 410 Gone after expiry; check centralized in
   `findBuildByDownloadKey`. (B-006)
-- **api: GitHub artifact name fallback** — `DownloadArtifact` falls back to the sole
-  artifact of the run if the expected name doesn't match, so renaming the workflow no
-  longer breaks `tryGithubDownload`. (AU-L-011)
-- **api: Linux + Android via GitHub Actions** — `submitBuild` routes `platform=linux` and
-  `platform=android` to `rustqs-linux.yml` / `rustqs-android.yml` workflow_dispatch when
-  GitHub config is present, matching the Windows path (B-012). Artifact name is now
-  dynamic (`rustdesk-min-test-{windows,linux,android}`).
+- **Historical implementation note (superseded): api: GitHub artifact name fallback** —
+  the former `DownloadArtifact` behavior fell back to the sole artifact of the run when
+  the expected name did not match. The current path requires exact artifact identity.
+  (AU-L-011)
+- **Historical implementation note (superseded): api: Linux + Android via GitHub Actions** —
+  routing and platform-specific artifact naming were added, but current production
+  capability remains gated until PR11 evidence validates the complete path. (B-012)
 - **admin-ui: build history auto-refresh** — the custom-client list polls every 5 s while
   any row is in `pending`/`running`, stops when all are terminal — no manual reload.
 - **admin-ui: dispatch test payload** — `Test dispatch` button on `github-build.vue` now
@@ -108,7 +135,8 @@ across three migration steps; `AutoMigrate` is idempotent so all schema addition
   AU-M-022, AU-L-007/010/011/015 carried forward).
 
 ### Reference
-- See `BUGS.md` for the current tracker (25 fixed, 4 partial, 2 open).
+- Historical tracker snapshot (2026-06-22): 25 fixed, 4 partial, 2 open. The
+  current bounded `BUGS.md` snapshot contains 1 fixed, 4 partial, and 1 open entry.
 - See PR #30 for the batch-merge detail and the DatabaseVersion conflict resolution.
 
 ---
@@ -323,12 +351,13 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
   succeeded in about 33 minutes. Final artifact: **one file `rustqs.exe`, 23.2 MB**
   instead of a small launcher plus a DLL folder. Exe metadata is `rustqs` and `custom_.txt`
   is packed inside the self-extracting exe.
-- First attempt [27462157839](https://github.com/bashrusakh/rustdesk/actions/runs/27462157839)
+- **Historical implementation note (superseded):** First attempt
+  [27462157839](https://github.com/bashrusakh/rustdesk/actions/runs/27462157839)
   failed almost immediately with `bad decrypt` in `Resolve build config` because
   `WORKFLOW_PAYLOAD_KEY` in the fork had diverged from local
   `offline-kit/artifacts/workflow-payload.key`. Open inputs were used as a temporary bypass to
-  validate §8.10. Remaining TODO: resync the key, either from the UI (`Push to GitHub Secrets`) or
-  by replacing the local file.
+  validate §8.10; the active workflow no longer permits that fallback. Remaining TODO at the
+  time: resync the key, either from the UI (`Push to GitHub Secrets`) or by replacing the local file.
 
 ### Fixed (Docker build)
 - Added root **`.dockerignore`** to exclude `node_modules/`, `.git/`, `data/`, `rdgen-data/`,
@@ -360,9 +389,10 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
   Axios request with a 95-minute timeout and shows `Build running...` -> success/failure.
 
 ### Fixed (GitHub fork cleanup)
-- Removed **10 upstream workflows** from `bashrusakh/rustdesk@master`:
+- Historical cleanup removed **10 upstream workflows** from `bashrusakh/rustdesk@master`:
   `bridge.yml`, `ci.yml`, `clear-cache.yml`, `fdroid.yml`, `flutter-build.yml`, `flutter-ci.yml`,
   `flutter-nightly.yml`, `flutter-tag.yml`, `playground.yml`, `wf-cliprdr-ci.yml`.
+  These are deleted legacy references, not active workflow evidence.
   Kept only the needed ones: `rustqs-windows-min-test.yml` and `third-party-RustDeskTempTopMostWindow.yml`.
 - Restored **`bridge.yml`** after cleanup because `rustqs-windows-min-test.yml` uses it as a reusable workflow.
   Without it, dispatch failed with HTTP 422 / workflow parse error. Restored from upstream `rustdesk/rustdesk@1.4.7`.
@@ -375,6 +405,11 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
 
 ## [0.4.0] - 2026-06-11
 
+> **Historical/superseded release entry (2026-06-11):** The offline-kit, SMB
+> builder, and L1 sovereignty statements below describe that dated state only.
+> They are not current proof of offline completeness, active SMB operation,
+> upstream independence, or sovereignty; see the current-state reconciliation above.
+
 ### Changed (Architecture - Sovereign Build Strategy)
 - Fully rewrote **`PLAN.md`** as the single source of truth. It now documents the sovereign build model
   (3 levels of independence: sources / build / toolchain), fork map (`rustdesk` + `hbb_common` +
@@ -400,7 +435,9 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
 - Captured the full list of Windows `vcpkg` dependencies from `vcpkg.json`: `aom`, `libjpeg-turbo`,
   `opus`, `libvpx`, `libyuv`, `mfx-dispatch`, **`ffmpeg`** (`amf`/`nvcodec`/`qsv` for `hwcodec`).
 
-### Done (Offline kit frozen)
+### Done (Offline kit frozen — historical/superseded, 2026-06-11)
+> This dated offline-kit record is historical/superseded and is not current proof of
+> offline completeness, release readiness, upstream independence, or sovereignty.
 - Ran `freeze.sh` on 2026-06-11 in `docker-build-linux-1`. Frozen into `rustdesk-cache` volume:
   1.4.7 bundle, `vendor` (2.7G, all `rustdesk-org/*` + `hbb_common`), Flutter engine,
   Flutter SDK for win+linux, `vcpkg` at baseline, Rust 1.75.0 MSI. Manifest with sha256 stored in `artifacts/MANIFEST.txt`.
@@ -423,7 +460,9 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
 - Added `.gitignore` to exclude secrets (private key `id_ed25519`, DB, `data/`, `.env`), build output,
   `node_modules`, `offline-kit/artifacts`, `.claude/`. Secret scan found no leaks in source.
 
-### Changed (Windows builder: container -> native, owner decision)
+### Changed (Windows builder: container -> native, owner decision — historical/superseded, 2026-06-11)
+> The SMB queue and standalone builder described here are historical/frozen material,
+> not the current provider-backed API workflow.
 - Final decision: build the Windows client **natively** on a separate Windows Server, no Docker.
 - API <-> agent channel is an **SMB job queue folder**. Linux hosts Samba, Windows mounts it.
 - Added `win-builder/setup.ps1` (toolchain, `-KitPath` support), `win-builder/agent.ps1`
@@ -443,10 +482,13 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
 - Generated 43-char `WORKFLOW_PAYLOAD_KEY` and stored it in fork GitHub Secrets.
   Important pitfall: `gh secret set ... --body -` via pipe adds a trailing newline under PowerShell,
   causing `bad decrypt` on the runner. Fix: use `--body $secret` without a pipe.
-- Refactored the workflow to take `enc_payload` and resolve it through `Resolve build config`
-  (OpenSSL AES-256-CBC + PBKDF2 + `jq` -> env vars), while still supporting open inputs as fallback.
+- **Historical implementation note (superseded):** Refactored the workflow to take
+  `enc_payload` and resolve it through `Resolve build config` (OpenSSL AES-256-CBC + PBKDF2 +
+  `jq` -> env vars), while the then-current version still supported open inputs as a fallback.
+  The active workflow now accepts only authenticated `DFP1` payloads.
 - Migrated L1/L2/L3 steps from `inputs.X` to `RQS_*` env vars and masked sensitive values with `::add-mask::`.
-- Verified with successful runs for both open-inputs and encrypted payload.
+- **Historical validation note (superseded):** Verified successful runs for both open-inputs
+  and encrypted payload. This does not validate the current DFP1-only path.
 
 **§8.8.5 Go API - SCAFFOLD**
 - Added `model/github_build_config.go`: singleton with `Token`, `PayloadKey`, and safe view.
@@ -468,7 +510,8 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
   `pollAndDownload` loop (30-second poll, 90-minute timeout).
 - On success it downloads `rustdesk-min-test-windows.zip`, unpacks it, stores `{appname}.exe` + DLLs +
   `custom_.txt` into `/rdgen-data/output/{id}/`, and updates `CustomBuild.Status`.
-- Falls back to file-queue mode for Linux/Android.
+- **Historical implementation note (superseded):** the earlier API fell back to
+  file-queue mode for Linux/Android; the current production path fails closed instead.
 
 **Self review §8.8.5**
 - Prevented panic in background goroutine `pollAndDownload` via `defer recover()`.
@@ -519,10 +562,11 @@ The work surfaced four real bugs that would have broken the actual GUI build flo
   (Hyper-V VM / physical / cloud), long paths, antivirus exclusions, SMB, service agent,
   first end-to-end test, and security.
 
-### Verified / Fixed (offline-kit)
-- Proved **L1 sovereignty**: `cargo metadata --offline` on the vendored tree resolves all 1049 crates
+### Verified / Fixed (offline-kit — historical/superseded; not current proof)
+- **Historical L1 claim (superseded):** `cargo metadata --offline` on the vendored tree resolved all 1049 crates
   from `vendor` with no network access.
-- Rebuilt and verified the **bundle** on full history (70M). Clone-back on tag 1.4.7 succeeded.
+- **Historical bundle check (superseded):** rebuilt and verified the **bundle** on full history (70M).
+  Clone-back on the dated 1.4.7 tag succeeded.
   Fixed the earlier shallow-clone defect (`remote did not send all necessary objects`).
 
 ### Notes
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 276eee9..52003fb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -111,8 +111,11 @@ Co-Authored-By: Claude <noreply@anthropic.com>
 
 ## License & attribution (AGPL-3.0)
 
-DeskForge is distributed under **AGPL-3.0** (because `server/` is AGPL-3.0 and it's
-the strongest copyleft in the bundle).
+The covered DeskForge distribution is identified as **AGPL-3.0** because `server/` is
+AGPL-3.0 and is the strongest copyleft in the covered bundle. This does not relicense
+separate or independent components; preserve each component's applicable license and
+notice. The license inventory is incomplete; no signatures or attestations are recorded,
+and no full sovereignty claim is made.
 
 When you add new files derived from upstream sources:
 
@@ -132,12 +135,21 @@ To run the server stack:
 
 ```bash
 cd docker
-docker compose build server     # rebuilds Go code; admin-ui needs pre-built dist
-docker compose up -d server
-docker compose logs -f server
+docker compose build rustdesk  # build the combined server image
+docker compose up -d rustdesk
+docker compose logs -f rustdesk
 ```
 
-For the GitHub-based Windows client builder workflow — see [PLAN.md](PLAN.md) §8.8.
+For GitHub-based client-build workflow maintenance, the configured RustDesk fork's
+`.github/workflows/` files are the sole active executable workflow source. See
+[PLAN.md](PLAN.md) §7 for the historical maintenance notes. `github-build/` is
+frozen reference/documentation material only, and `rdgen/` is frozen vendored
+historical/reference material; neither is an active workflow source.
+
+The published RustDesk client source/ref is 1.4.8 and the published DeskForge API
+schema is `DatabaseVersion` 272. The local uncommitted corrective worktree targets
+API schema 282; that local schema target is not published. Live provider execution and
+MySQL/PostgreSQL migration/read/write coverage remain unverified.
 
 ## What goes where
 
@@ -148,9 +160,15 @@ For the GitHub-based Windows client builder workflow — see [PLAN.md](PLAN.md)
 | `admin-ui/` | Vue 3 admin panel. MIT. |
 | `libs/` | Shared Rust libs. |
 | `docker/` | Dockerfiles + compose. |
-| `github-build/` | Workflow + docs for building Windows client via GitHub Actions. |
-| `win-builder/` | Native Windows build agent (fallback path, frozen). |
-| `offline-kit/` | Frozen toolchain + sources (sovereign build kit). |
-| `rdgen/` | Vendored reference: rdgen workflow patches (not running as a service). GPL-3.0. |
+| `github-build/` | Frozen reference/documentation for fork workflows; no executable workflow copies. |
+| `win-builder/` | Frozen manual/historical-only Windows build material; not the API path. |
+| `offline-kit/` | Frozen dependency-freeze tool; verification and license inventory are incomplete, with no signature/attestation or full-sovereignty claim. |
+| `rdgen/` | Frozen vendored historical/reference workflow material, not the active source; not running as a service. GPL-3.0. |
 | `PLAN.md` | Single source of truth for the project plan. |
 | `CHANGELOG.md` | Chronological log of changes. |
+
+The current repository has no tracked `vendor/` tree, `rustdesk-deps/` archive, or
+client-release directory. Rust and Go manifests still use active third-party upstream
+dependencies, and the configured RustDesk fork's `hbb_common` submodule is currently
+upstream-referenced, dirty, and unpublished; upstream independence and MySQL/PostgreSQL
+cross-database support therefore remain unverified.
diff --git a/NOTICE b/NOTICE
index b61240e..19a6860 100644
--- a/NOTICE
+++ b/NOTICE
@@ -20,7 +20,10 @@ This product includes software developed by:
   https://github.com/bryangerlach/rdgen
   Used as reference: build workflow patches (not as a running service).
 
-The combined work is distributed under AGPL-3.0 (because server/ is AGPL-3.0).
-Per-component LICENSE files retained in their respective subdirectories.
+The covered DeskForge work is identified as AGPL-3.0 because `server/` is AGPL-3.0.
+This does not relicense separate or independent components; their applicable licenses
+and notices remain in force. The current license inventory is incomplete, with no
+signatures or attestations recorded and no full sovereignty claim.
+Per-component LICENSE files are retained in their respective subdirectories.
 
 This is a modified version. Original RustDesk: https://github.com/rustdesk/rustdesk
diff --git a/PLAN.md b/PLAN.md
index 97a8e40..0d0f7f8 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -1,21 +1,51 @@
 # PLAN.md — DeskForge: Single Source of Truth
 
-> Last updated: 2026-06-28
+> Last updated: 2026-08-11
 > Related: [CHANGELOG.md](CHANGELOG.md) · [BUGS.md](BUGS.md) · [CONTRIBUTING.md](CONTRIBUTING.md)
 
+> **Evidence labels (2026-08-10):** The published RustDesk client source/ref is
+> 1.4.8 and the published DeskForge API schema is `DatabaseVersion` 272. The local
+> uncommitted corrective worktree targets API schema 282; that local schema target is
+> not a public current-schema or release claim.
+> The current API path is provider dispatch → exact run/artifact retrieval → local
+> validation and publication. Runner callbacks, local file-queue fallback, and
+> sole-artifact selection are not current production behavior. Windows is the only
+> production capability admitted by the API gate; Linux/Android remain gated pending
+> PR11 evidence. The dispatch contract under test requires
+> `return_run_details=true` and an exact HTTP 200 run-details response containing
+> the run identity; standard 204 is intentionally unsupported because it cannot
+> correlate the exact run. No normal GitHub operation is verified. The Go API owns
+> port 21114; Rust services use 21115–21119, with relay WebSocket on 21119; current
+> production Compose exposure remains
+> 21114–21118. No live provider run or clean-environment build proof is claimed.
+> Workflow approval requires a provider-derived verified annotated tag, the
+> aggregate of all applicable active protected-tag rulesets with effective update
+> and deletion protections, no bypass actors, and rejection of tag/branch label
+> collisions. The local gate is not
+> live-provider evidence. Its pending → building identity write is atomic, but
+> provider dispatch and that database write are not an end-to-end atomic
+> transaction: there is no durable outbox or distributed lease for the
+> post-dispatch database-failure window.
+
 ---
 
 ## 0. Project goal
 
 Self-hosted RustDesk server (hbbs/hbbr + API + admin panel) + **custom client builder**
-that works without `rustdesk/rustdesk`, `rustdesk-org/*`, or `rustdesk.com`.
+that is intended to reduce dependence on `rustdesk/rustdesk`, `rustdesk-org/*`, and
+`rustdesk.com`; current source manifests still reference active third-party upstream
+repositories, so full upstream independence is not verified.
 
-**Active client build path:** GitHub Actions in the rustdesk fork. `win-builder/`
-and `linux-build` are frozen fallbacks.
+**Active client build path:** the API dispatches an owned workflow in the
+configured RustDesk fork, polls the provider run, downloads the exact artifact
+through the provider API, then validates, extracts, and publishes it locally.
+`github-build/` and `rdgen/` are reference/documentation material only;
+`win-builder/` and `linux-build` are manual/historical-only builders outside the
+production API path.
 
 GitHub-first because:
 - free Windows runners
-- fork is ready, min-test is green
+- fork workflow is configured; the min-test result below is historical
 - standalone requires a separate Windows Server, not deployed
 
 ---
@@ -25,46 +55,94 @@ GitHub-first because:
 ```
 bashrusakh/
 ├── DeskForge              ← this repo (server, api, admin, docker)
-├── rustdesk               ← fork of rustdesk/rustdesk, tag 1.4.7 → 1.4.8
-│   ├── vendor/            ← cargo vendor (L1, ~20 rustdesk-org deps)
-│   ├── .github/workflows/ ← rustqs-windows-min-test.yml, rustqs-linux.yml, rustqs-android.yml
-│   └── releases/          ← offline-assets-1.4.7 (engine, usbmmidd, drivers)
-├── hbb_common             ← fork of rustdesk/hbb_common (required submodule)
-└── rustdesk-deps/         ← archive of ~20 rustdesk-org repos (L1 backup)
+├── rustdesk               ← owned RustDesk fork and active workflow source
+│   └── .github/workflows/ ← rustqs-windows.yml, rustqs-linux.yml, rustqs-android.yml
+└── libs/hbb_common        ← tracked shared source in DeskForge; not a submodule here
 ```
 
-**Current versions:** fork at 1.4.7 (tag), workflow updated for 1.4.8 (chore/bump-client-1.4.8).
+**Published client source/ref:** 1.4.8, aligned with `offline-kit/versions.env`. The
+local uncommitted corrective worktree targets API schema 282; the published DeskForge
+schema remains `DatabaseVersion` 272.
+The configured RustDesk fork's `libs/hbb_common` is a separate git submodule currently
+recorded against upstream `rustdesk/hbb_common`; its local checkout is dirty and
+unpublished. Active RustDesk and DeskForge manifests also reference third-party upstream
+repositories/modules. Provider-side live execution and clean-build proof are not recorded
+here. On 2026-08-11, `GOWORK=off go vet ./...` and `GOWORK=off go test ./...`
+passed after test-only cache diagnostics and opt-in Redis test changes. Redis
+integration tests and benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is
+configured; no live Redis run is recorded. MySQL/PostgreSQL, live provider, and
+the other release/build gates remain unverified. DeskForge does not currently track a repository `vendor/` tree, client-release
+directory, or `rustdesk-deps/` archive.
+
+The combined DeskForge distribution is identified as AGPL-3.0 for the covered work;
+separate or independent API/UI/reference components retain their applicable upstream
+licenses and notices. The license inventory is incomplete; no signatures or attestations
+are recorded, and no full sovereignty claim is made. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
 
 ---
 
 ## 2. Architecture
 
-### Active path (GitHub Actions)
+### Current path (GitHub Actions)
 
 ```
 admin-ui (Custom Client form)
-   ↓ POST /custom_build
+   ↓ custom-build request
 Go API (DeskForge)
-   ↓ workflow_dispatch + enc_payload (AES-256-CBC + PBKDF2)
-GitHub Actions [rustdesk fork, windows-2022]
+   ↓ workflow_dispatch + authenticated DFP1 enc_payload (AES-256-CBC + PBKDF2 + HMAC)
+GitHub Actions [configured RustDesk fork, owned platform workflow]
    ↓ L1: config.rs (server + key)
    ↓ L2: custom_.txt (permanent password, allowCustom patch)
    ↓ L3: branding (rustqs, portable-packer)
-   ↓ POST /api/save_custom_client (encrypted)
-Go API → /rdgen-data/output/{id}/ → admin-ui Download
+provider run ← Go API polls provider status
+provider artifact API → Go API downloads the exact artifact
+Go API validates/extracts/publishes locally → admin-ui Download
 ```
 
 **Security:** password never published — `enc_payload`, decrypted inside runner via
-GitHub Secret `WORKFLOW_PAYLOAD_KEY`. Binary goes to your server, not a public release.
-
-### Fallback (frozen, do not deploy)
+GitHub Secret `WORKFLOW_PAYLOAD_KEY`. The runner does not callback to the API;
+the API retrieves the artifact through the provider API and publishes it locally,
+not to a public release.
+
+### Workflow approval and schema evidence
+
+Before a provider-backed build can run, the API accepts only a provider-derived
+verified annotated tag. The provider must report an accepted verification reason,
+the aggregate of all applicable active protected tag rulesets for that label with
+effective update and deletion protections, and no bypass actors. A tag/branch
+collision with the same label is
+rejected. The API rechecks the provider policy and exact workflow contents at the
+resolved immutable commit before dispatch; raw refs, SHAs, credentials, and
+workflow internals are not normal UI inputs.
+
+The published DeskForge schema is `DatabaseVersion` **272**. This uncommitted
+corrective worktree targets local schema **282**, which is not published or live-
+provider evidence. The additive fields are **280**
+(`workflow_ref_approved`, approval status), **281**
+(`workflow_ref_provider_verified`, provider-policy status), and **282**
+(`workflow_ref_approval_sha`, the provider-resolved approval commit). Legacy
+metadata-only configuration saves remain compatible with plaintext secret rows:
+they can preserve legacy values without `SECRET_ENCRYPTION_KEY`; new or replaced
+non-empty secret writes require the key, and a resave with the key encrypts legacy
+plaintext values.
+
+Focused fake-transport and SQLite checks do not prove live GitHub/provider
+approval, dispatch, polling, or artifact delivery. Dispatch requires the exact
+HTTP 200 run-details contract (`return_run_details=true`), not a standard 204 or
+latest-run inference. The local identity write is atomic, but no durable outbox
+or distributed lease makes provider dispatch plus the database write one atomic
+operation; a post-dispatch database failure remains a documented limitation.
+
+### Historical/frozen builders (not used by the current API)
 
 ```
 admin-ui → Go API → jobs/{id}.json → SMB share → standalone Windows builder
                                                    or Docker linux-build
 ```
 
-Not active: `win-builder/` untested (no Windows host), `build-linux` behind `--profile fallback`.
+These local-queue builders are not a production fallback for the current API.
+They remain only as historical/frozen material and must not be treated as an
+alternative workflow source.
 
 ---
 
@@ -72,14 +150,16 @@ Not active: `win-builder/` untested (no Windows host), `build-linux` behind `--p
 
 | Component                      | Status         | Notes                                |
 | ------------------------------ | -------------- | ------------------------------------ |
-| hbbs/hbbr (Rust)               | ✅ running     | ports 21114-21118                    |
+| hbbs/hbbr (Rust)               | ✅ running     | ports 21115-21119; relay WebSocket is 21119 |
 | Go API                         | ✅ running     | users, address book, OAuth, LDAP, audit |
 | Admin UI (Vue 3)               | ✅ running     | 16 pages, 3 locales, DataTable, FilterBar |
-| GitHub build (Windows)         | ✅ active      | min-test green, 3 layers, encryption |
-| GitHub build (Linux)           | 🟡 draft       | workflow exists, not CI-validated    |
-| GitHub build (Android)         | 🟡 draft       | workflow exists, not CI-validated    |
-| win-builder standalone         | ❄️ frozen      | do not deploy, no Windows host       |
-| linux-build (Docker)           | ❄️ frozen      | manual fallback, `--profile fallback`  |
+| GitHub build (Windows)         | 🟡 implemented | API path is provider-backed; no current live provider/clean-build proof |
+| GitHub build (Linux)           | 🟡 gated       | workflow mapping exists; production capability remains disabled    |
+| GitHub build (Android)         | 🟡 gated       | workflow mapping exists; production capability remains disabled    |
+| `github-build/`                | 📘 reference   | documentation only; no executable workflow copies                |
+| `rdgen/`                       | 📘 reference   | vendored historical/reference material, not the active source      |
+| win-builder standalone         | ❄️ frozen      | manual/historical only; not API path |
+| linux-build (Docker)           | ❄️ frozen      | manual/historical only; not API path |
 | offline-kit                    | ❄️ frozen      | re-freeze when client version changes |
 
 ---
@@ -92,33 +172,42 @@ Not active: `win-builder/` untested (no Windows host), `build-linux` behind `--p
 | L2    | quick-support password| `custom_.txt` (signature checked — `allowCustom.py` patch removes check) |
 | L3    | branding (rustqs)     | `Cargo.toml`, `Runner.rc`, portable-packer (`libs/portable/generate.py`) |
 
-Full recipe: `rdgen/.github/workflows/generator-windows.yml` (vendored reference).
+Historical reference: `rdgen/.github/workflows/generator-windows.yml`.
+It is not the executable workflow source and must not be copied into the fork.
 
 ---
 
 ## 5. ✅ Completed milestones
 
-- [x] Forks of rustdesk + hbb_common (1.4.7)
-- [x] Offline kit: L1+L3, 11 artifacts, 5 GB (frozen)
-- [x] GitHub min-test Windows: green, ~33 min, single-binary rustqs.exe
-- [x] Go API: workflow_dispatch, poll, download, capability-URL TTL
+- [x] Published RustDesk client source/ref is 1.4.8; local corrective API schema target is
+      `DatabaseVersion 282`, while the published DeskForge schema remains 272
+- [x] Offline-kit freeze/verify tooling and local artifact set retained; real-kit
+      verification remains blocked under PR10
+- [x] GitHub min-test Windows: historical green run, ~33 min, single-binary rustqs.exe
+- [x] Go API: provider workflow dispatch and polling; provider API artifact download;
+      local validation, extraction, publication, and capability-URL TTL
 - [x] Admin UI redesign: design tokens, DataTable, AppDialog, FilterBar, 16 pages
 - [x] Security: encrypted-at-rest (AES-GCM), OAuth delete guard, audit, TTL
 - [x] Rust server: atomic blocklist, aur-fix, JWT
-- [x] Database: ~272 migrations, SQLite/MySQL/PostgreSQL
+- [x] Local schema target: `DatabaseVersion 282`; SQLite exercised locally,
+      MySQL/PostgreSQL configured but migration/read-write support remains unverified
 
 ---
 
 ## 6. Open roadmap
 
-- [ ] **Linux + Android GitHub workflows** — CI validation + platform picker in UI
+- [ ] **Linux + Android capability validation** — live workflow/artifact evidence + guarded platform picker
 - [ ] **Full client rebrand** — About, URLs, icons — in workflow, not in the fork
 - [ ] **Smoke test** for built binary (`--version`)
 - [ ] **Ballast cleanup** — remove MinGW leftovers, test containers
 
 ---
 
-## 7. Workflow: new upstream rustdesk-client release
+## 7. Historical fork maintenance notes for a new upstream rustdesk-client release
+
+The steps below are historical maintenance notes for the owned RustDesk fork. They are not
+the DeskForge build execution path; active workflow files live only in that
+fork. Do not copy workflow files from `github-build/` or `rdgen/`.
 
 When `rustdesk/rustdesk` publishes a new tag (e.g. 1.5.0), follow these steps:
 
@@ -147,7 +236,7 @@ git commit -m "chore: point hbb_common to v1.5.0"
 git push origin v1.5.0
 ```
 
-### 7.3. Update vendor
+### 7.3. Update vendor (historical procedure; not current repository state)
 
 ```bash
 # On a machine with Rust:
@@ -156,7 +245,8 @@ git add vendor/ && git commit -m "chore: vendor deps for v1.5.0"
 git push origin v1.5.0
 ```
 
-Or if vendor is too heavy — upload `vendor-1.5.0.tar.gz` as a release asset.
+Or if vendor is too heavy — historically, upload `vendor-1.5.0.tar.gz` as a release
+asset. DeskForge does not currently contain that vendor tree or release asset.
 
 ### 7.4. Update offline-kit
 
@@ -166,7 +256,7 @@ cd DeskForge/offline-kit
 bash freeze.sh source vendor engine
 ```
 
-### 7.5. Update offline-assets release
+### 7.5. Update offline-assets release (historical operator procedure)
 
 ```bash
 # Upload engine/usbmmidd/driver to the fork:
@@ -176,13 +266,14 @@ gh release create offline-assets-1.5.0 --repo bashrusakh/rustdesk \
     artifacts/rustdesk_printer_driver_v4-1.4.zip artifacts/printer_driver_adapter.zip
 ```
 
-> **Note:** After publishing the release, version `1.5.0` will automatically appear in the admin UI
-> (the `GET /api/admin/custom_build/versions` endpoint fetches fork releases tagged
-> `offline-assets-*`). No hardcoded values in UI or YAML need to be changed.
+> **Note:** After publishing the release, the version catalog can expose it in
+> the admin UI when the configured repository contains the matching
+> `offline-assets-*` release and source tag. The catalog is repository-derived;
+> there is no hardcoded repository or obsolete version fallback list.
 
 ### 7.6. Adapt workflow
 
-Compare upstream `build-for-windows-flutter` with `rustqs-windows-min-test.yml`:
+Compare upstream `build-for-windows-flutter` with `rustqs-windows.yml`:
 - New system dependencies?
 - Changed `build.py` flags?
 - Changed `config.rs` / `custom_.txt` format?
@@ -192,35 +283,12 @@ Port changes to the fork workflow.
 > **Important:** `bridge.yml` must stay **without `inputs.version`** — same as upstream.
 > Bridge and build must work from the same code (the fork). Do not add `repository:` to checkout.
 
-### 7.7. Deploy workflows to fork (3 branches)
+### 7.7. Workflow ownership
 
-Workflow files live on three fork branches. After changes, update all:
-
-```bash
-# 1) rustqs/min-test — execution (all dispatches go here)
-git checkout rustqs/min-test
-cp /path/to/DeskForge/github-build/rustqs-*.yml .github/workflows/
-cp /path/to/DeskForge/rdgen/.github/workflows/bridge.yml .github/workflows/
-git add .github/workflows/
-git commit -m "feat: update rustqs-* workflows for v1.5.0"
-git push origin rustqs/min-test
-
-# 2) master — API discovery (workflow must exist on default branch)
-git checkout master
-cp /path/to/DeskForge/github-build/rustqs-*.yml .github/workflows/
-cp /path/to/DeskForge/rdgen/.github/workflows/bridge.yml .github/workflows/
-git add .github/workflows/
-git commit -m "feat: update rustqs-* workflows for v1.5.0"
-git push origin master
-
-# 3) rustqs/master-workflows — mirror (backup for upstream sync)
-git checkout rustqs/master-workflows
-cp /path/to/DeskForge/github-build/rustqs-*.yml .github/workflows/
-cp /path/to/DeskForge/rdgen/.github/workflows/bridge.yml .github/workflows/
-git add .github/workflows/
-git commit -m "feat: update rustqs-* workflows for v1.5.0"
-git push origin rustqs/master-workflows
-```
+The `.github/workflows/` files in the owned RustDesk fork are the sole
+executable source. `github-build/` is reference/documentation only, and the
+vendored `rdgen` workflows are historical/reference material. Maintain active
+workflow logic in the fork; do not create deployment copies in this repository.
 
 ### 7.8. Verify
 
@@ -244,12 +312,14 @@ git push origin rustqs/master-workflows
 | Entity                  | What it is                                           | Where stored                          |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------- |
 | `offline-kit/`          | Scripts (`freeze.sh`) + config (`versions.env`)      | In git, in this repo                  |
-| `offline-kit/artifacts/`| Output of freeze.sh: vendor.tar.gz, engine, SDK, MSI | Locally, **not in git**               |
-| `offline-assets-{tag}`  | GitHub Release with binaries for CI                  | GitHub Releases of the rustdesk fork  |
-
-**Why:** without this insurance, if `rustdesk/rustdesk` gets deleted or `rustdesk.com`
-goes down, building a custom client becomes impossible. The kit freezes everything
-while upstream is still available.
+| `offline-kit/artifacts/`| Local freeze output (ignored/untracked)              | Local operator storage only           |
+| `offline-assets-{tag}`  | Provider-side asset naming convention                | Availability and release proof unverified |
+
+**Why:** without this insurance, loss of upstream source or services can block a custom
+client build. The kit is frozen local operator material; active third-party upstream
+dependencies remain in the source manifests, and its current incomplete verification
+does not prove upstream independence, sovereignty, a network-denied full build, a
+signature, or release readiness.
 
 ---
 
diff --git a/README.md b/README.md
index 073a58d..52a45f0 100644
--- a/README.md
+++ b/README.md
@@ -12,13 +12,13 @@ git clone https://github.com/bashrusakh/DeskForge.git
 cd DeskForge/docker
 # docker-compose.yml: replace your-server, your-secret-jwt-key-change-this
 docker compose up -d
-# Get the public key:
-docker compose logs | grep "Public Key"
+# Read the public key from the mounted server data path:
+docker compose exec rustdesk cat /data/id_ed25519.pub
 ```
 
 **Admin:** `http://your-server:21114/admin/` — login `admin`, password in logs.
 
-**RustDesk client:** ID Server `your-server:21116`, Relay `:21117`, API `http://your-server:21114`, Key — from logs.
+**RustDesk client:** ID Server `your-server:21116`, Relay `your-server:21117`, API `http://your-server:21114`, Key — paste the public-key contents returned by `docker compose exec rustdesk cat /data/id_ed25519.pub`; the file is at `/data/id_ed25519.pub` inside the container.
 
 ---
 
@@ -31,6 +31,15 @@ docker compose logs | grep "Public Key"
 | 21116 | TCP/UDP  | ID Server (hbbs) |
 | 21117 | TCP      | Relay Server (hbbr) |
 | 21118 | TCP      | WebSocket        |
+| 21119 | TCP      | Relay WebSocket (hbbr) |
+
+The protocol uses 21119 for the relay WebSocket path. The production Compose
+file currently publishes 21114–21118; expose 21119 separately when that public
+WebSocket path is required.
+
+The published RustDesk client source/ref is 1.4.8 and the published DeskForge API
+schema is `DatabaseVersion` 272. The local uncommitted corrective worktree targets
+API schema 282; that local schema target is not published or live-provider evidence.
 
 ---
 
@@ -39,6 +48,8 @@ docker compose logs | grep "Public Key"
 | Variable                           | Purpose                           |
 | ---------------------------------- | --------------------------------- |
 | `RELAY`                              | Relay server address              |
+| `HBBR_PORT`                          | Relay server port                 |
+| `HBBS_PORT`                          | ID/Rendezvous server port         |
 | `ENCRYPTED_ONLY`                     | Encrypted connections only        |
 | `MUST_LOGIN`                         | Require login before connect      |
 | `RUSTDESK_API_RUSTDESK_ID_SERVER`    | ID server (hbbs)                  |
@@ -46,9 +57,19 @@ docker compose logs | grep "Public Key"
 | `RUSTDESK_API_RUSTDESK_API_SERVER`   | API server URL                    |
 | `RUSTDESK_API_KEY_FILE`              | Path to public key file           |
 | `RUSTDESK_API_JWT_KEY`              | JWT secret                        |
-| `RUSTDESK_API_GORM_TYPE`            | sqlite / mysql / postgres         |
+| `RUSTDESK_API_GORM_TYPE`            | sqlite / mysql / postgresql       |
 | `RUSTDESK_API_LANG`                 | en / ru / zh-CN                   |
-| `SECRET_CRYPT_KEY`                  | AES-GCM key for secrets at rest   |
+| `SECRET_ENCRYPTION_KEY`             | AES-GCM key for secrets at rest |
+| `SOURCE_DATE_EPOCH`                 | Trusted Docker build timestamp (optional) |
+
+New non-empty secret writes and secret-bearing Custom Builder operations require this
+key and are rejected rather than stored as plaintext when it is missing. Legacy plaintext
+rows remain readable; saving them again encrypts them when the key exists.
+
+Rust build metadata uses `SOURCE_DATE_EPOCH` when supplied. Without it, active
+builds use the deterministic value `unknown`; wall-clock metadata is available
+only for explicitly non-reproducible local debug builds with
+`RUSTDESK_NON_REPRODUCIBLE_DEBUG=1`.
 
 ---
 
@@ -56,17 +77,27 @@ docker compose logs | grep "Public Key"
 
 **Server (Rust + Go):** user CRUD, JWT, OAuth (GitHub/Google/OIDC), LDAP, groups, tags,
 address book (personal + shared with collections), peer-UUID binding, audit (login/connection/file-transfer),
-server commands with persistence and audit log, encrypted-at-rest secrets, SQLite/MySQL/PostgreSQL,
-captcha + brute-force protection.
+server commands with persistence and audit log, encrypted-at-rest secrets, and configured
+SQLite/MySQL/PostgreSQL drivers. SQLite is locally exercised; MySQL/PostgreSQL migration and
+read/write coverage remain unverified. Captcha and brute-force protection are also included.
 
 **Admin UI (Vue 3):** Login, Dashboard, Devices, Users, Groups, Tags, OAuth, Server Config,
 Audit, Custom Client Builder, Profile, My Workspace, Guest Sharing.
 3 locales (en/ru/zh_CN). Light/Dark/Auto themes.
 Shared UI: DataTable, AppDialog, AppDrawer, FilterBar, ActionsToolbar.
 
-**Custom client:** GitHub Actions → rustdesk fork → `rustqs.exe` (Windows).
-Builds with your server, key, permanent password. Single-binary via portable-packer (23 MB).
-Linux/Android — in development.
+**Custom client:** the API dispatches an owned workflow in the configured RustDesk
+fork and retrieves the exact provider artifact for local validation/publication.
+The published client source/ref is **1.4.8**. The local uncommitted corrective
+worktree targets API schema `DatabaseVersion 282`; the published DeskForge schema
+remains 272.
+Windows is the only capability admitted today;
+Linux and Android mappings remain gated pending PR11 evidence. No live provider
+run or clean-environment build is claimed. Local workflow manifests, bridge/helper
+source, Android app-ID/runtime-path checks, and package assertions are static evidence
+only; no APK/package/install/runtime evidence exists.
+The local schema target is `DatabaseVersion 282`; the published DeskForge schema is
+272, and SQLite-only checks do not establish cross-database verification.
 
 **Not implemented (vs RustDesk Pro):** 2FA, RBAC, session recording, device policy, remote script,
 HA, backup/restore.
@@ -85,38 +116,79 @@ HA, backup/restore.
 server/          — Rust hbbs/hbbr (signal + relay)
 api/             — Go REST API (Gin + GORM)
 admin-ui/        — Vue 3 + Element Plus admin panel
-libs/hbb_common/ — shared Rust library (submodule)
+libs/hbb_common/ — tracked shared Rust library in DeskForge
 docker/          — Dockerfile + compose + entrypoint
-github-build/    — active client build workflow
-win-builder/     — ❄️ FROZEN: standalone Windows builder
-offline-kit/     — ❄️ FROZEN: dependency freeze tool (insurance against upstream death)
-rdgen/           — vendored reference workflow (not a service)
+github-build/    — reference/documentation for fork workflows (no executable copies)
+win-builder/     — ❄️ FROZEN: manual/historical-only standalone builder
+offline-kit/     — ❄️ FROZEN: dependency-freeze tool; current verification is incomplete
+rdgen/           — ❄️ FROZEN: vendored historical/reference workflow material
 ```
 
+The configured RustDesk fork's `.github/workflows/` files are the sole executable
+source for active client builds. `github-build/` and `rdgen/` contain reference or
+frozen material only.
+
+The repository does not currently contain a `vendor/` tree, `rustdesk-deps/` archive,
+or current client-release directory. The RustDesk fork and DeskForge server manifests
+still reference active third-party upstream repositories/modules; upstream independence
+is therefore a goal and boundary, not a verified current property.
+
 ---
 
 ## Building
 
 ```bash
 cd docker
-docker compose build          # full build
-docker compose up -d          # start
+docker compose build rustdesk # full server image
+docker compose up -d rustdesk # start the rustdesk service
+```
+
+For client-build workflow maintenance, edit and validate the configured fork's
+`.github/workflows/` files. `github-build/` contains reference documentation only;
+it is not a deployment source. For the API development stack:
+
+```bash
+cd api
+docker compose -f docker-compose-dev.yaml up -d
+```
+
+### Go verification
+
+The broad local checks pass with the workspace disabled:
+
+```bash
+cd api
+GOWORK=off go vet ./...
+GOWORK=off go test ./...
 ```
 
+Redis integration tests and benchmarks are opt-in and run only when
+`DESKFORGE_TEST_REDIS_ADDR` is configured. No live Redis run is recorded;
+MySQL/PostgreSQL, live provider, and the other release/build gates remain
+unverified.
+
 ---
 
 ## Forks (for custom client builds)
 
-- [`bashrusakh/rustdesk`](https://github.com/bashrusakh/rustdesk) — fork of rustdesk/rustdesk @ 1.4.7
-- [`bashrusakh/hbb_common`](https://github.com/bashrusakh/hbb_common) — fork of rustdesk/hbb_common
+- [`bashrusakh/rustdesk`](https://github.com/bashrusakh/rustdesk) — owned RustDesk fork at published client source/ref 1.4.8; local corrective API schema target is 282
+- [`bashrusakh/hbb_common`](https://github.com/bashrusakh/hbb_common) — intended fork of
+  `rustdesk/hbb_common`; the configured RustDesk fork currently records the upstream
+  `rustdesk/hbb_common` submodule, and its local checkout is dirty/unpublished, so clean
+  fork provenance is not verified
 
-See [PLAN.md §7](PLAN.md#7-workflow-new-upstream-rustdesk-client-release) for the upstream update workflow.
+See [PLAN.md §7](PLAN.md#7-historical-fork-maintenance-notes-for-a-new-upstream-rustdesk-client-release) for the upstream update workflow.
 
 ---
 
 ## License
 
-AGPL-3.0 (server) + MIT (api/admin-ui). See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+The combined DeskForge distribution is identified as **AGPL-3.0** for the covered
+DeskForge work. This does not relicense separate or independent components: component-level
+notices and upstream licenses remain documented in [LICENSE](LICENSE) and [NOTICE](NOTICE),
+and the API/admin UI retain their upstream MIT notices where applicable. The license
+inventory is incomplete; no signatures or attestations are recorded, and no full
+sovereignty claim is made.
 
 Based on:
 - [rustdesk/rustdesk-server](https://github.com/rustdesk/rustdesk-server) (AGPL-3.0)
diff --git a/admin-ui/src/api/custom_client.js b/admin-ui/src/api/custom_client.js
index f756f4f..3023336 100644
--- a/admin-ui/src/api/custom_client.js
+++ b/admin-ui/src/api/custom_client.js
@@ -23,9 +23,10 @@ export function remove (data) {
   })
 }
 
-export function detailByKey (key) {
+export function download (id) {
   return request({
-    url: '/custom_build/public/detailByKey/' + key,
+    url: `/custom_build/download/${id}`,
+    responseType: 'blob',
   })
 }
 
diff --git a/admin-ui/src/api/github_build_config.js b/admin-ui/src/api/github_build_config.js
index 4fe1a65..d663b66 100644
--- a/admin-ui/src/api/github_build_config.js
+++ b/admin-ui/src/api/github_build_config.js
@@ -8,6 +8,18 @@ export function save (data) {
   return request({ url: '/github_build_config/save', method: 'post', data })
 }
 
+export function getWorkflowTags () {
+  return request({ url: '/github_build_config/workflow_tags' })
+}
+
+export function approveWorkflowRef (workflowTag) {
+  return request({
+    url: '/github_build_config/approve_workflow_ref',
+    method: 'post',
+    data: { confirm: true, workflow_tag: workflowTag },
+  })
+}
+
 export function generateKey () {
   return request({ url: '/github_build_config/generate_key', method: 'post' })
 }
@@ -20,10 +32,6 @@ export function syncSecret () {
   return request({ url: '/github_build_config/sync_secret', method: 'post' })
 }
 
-export function syncPat () {
-  return request({ url: '/github_build_config/sync_pat', method: 'post' })
-}
-
 export function dispatchTest () {
   // B-009: confirm=true — это реальный билд (тратит минуты Actions), не дешёвый чек.
   return request({ url: '/github_build_config/dispatch_test', method: 'post', data: { confirm: true } })
diff --git a/admin-ui/src/api/user.js b/admin-ui/src/api/user.js
index 2e40595..bc5e3e7 100644
--- a/admin-ui/src/api/user.js
+++ b/admin-ui/src/api/user.js
@@ -8,6 +8,16 @@ export function login (data) {
   })
 }
 
+export function logout () {
+  return request({
+    url: '/logout',
+    method: 'post',
+    timeout: 5000,
+    skipErrorMessage: true,
+    skipAuthRedirect: true,
+  })
+}
+
 export function current () {
   return request({
     url: '/user/current',
diff --git a/admin-ui/src/components/changePwdDialog.vue b/admin-ui/src/components/changePwdDialog.vue
index b3a19d6..3d11556 100644
--- a/admin-ui/src/components/changePwdDialog.vue
+++ b/admin-ui/src/components/changePwdDialog.vue
@@ -116,8 +116,8 @@
     ElMessageBox.alert(T('OperationSuccess'), T('ChangePassword'), {
       autofocus: true,
       confirmButtonText: 'OK',
-      callback: (action) => {
-        userStore.logout()
+      callback: async (action) => {
+        await userStore.logout()
         router.push('/login')
       },
     })
diff --git a/admin-ui/src/layout/components/setting/index.vue b/admin-ui/src/layout/components/setting/index.vue
index 30ce037..aec28bb 100644
--- a/admin-ui/src/layout/components/setting/index.vue
+++ b/admin-ui/src/layout/components/setting/index.vue
@@ -47,14 +47,29 @@
   import { ref } from 'vue'
   import { T } from '@/utils/i18n'
   import ThemeSwitch from '@/components/ui/ThemeSwitch.vue'
+  import { useRouter } from 'vue-router'
+  import { ElMessage } from 'element-plus'
 
   const userStore = useUserStore()
   const user = userStore
   const appStore = useAppStore()
+  const router = useRouter()
+  let logoutPromise = null
 
   const logout = () => {
-    userStore.logout()
-    window.location.reload()
+    if (logoutPromise) {
+      return logoutPromise
+    }
+
+    logoutPromise = (async () => {
+      const logoutSucceeded = await userStore.logout()
+      await router.replace('/login')
+      if (!logoutSucceeded) {
+        ElMessage.error(T('LogoutFailed'))
+      }
+    })()
+
+    return logoutPromise
   }
 
   const changePwdVisible = ref(false)
diff --git a/admin-ui/src/permission.js b/admin-ui/src/permission.js
index 6730570..31e6aa6 100644
--- a/admin-ui/src/permission.js
+++ b/admin-ui/src/permission.js
@@ -36,7 +36,7 @@ router.beforeEach(async (to, from, next) => {
     if (!userStore.route_names.length) {
       const info = await userStore.info()
       if (!info) {
-        userStore.logout()
+        await userStore.logout()
         next(`/login?redirect=${to.path}`)
       } else {
         next({ ...to, replace: true })
diff --git a/admin-ui/src/store/user.js b/admin-ui/src/store/user.js
index a647e77..833bc29 100644
--- a/admin-ui/src/store/user.js
+++ b/admin-ui/src/store/user.js
@@ -1,10 +1,12 @@
 import { defineStore, acceptHMRUpdate } from 'pinia'
-import { current, login } from '@/api/user'
-import { setToken, removeToken, setCode, removeCode } from '@/utils/auth'
+import { current, login, logout as logoutRequest } from '@/api/user'
+import { getToken, setToken, removeToken, setCode, removeCode } from '@/utils/auth'
 import { useRouteStore } from '@/store/router'
 import { useAppStore } from '@/store/app'
 import { oidcAuth, oidcQuery } from '@/api/login'
 
+let pendingLogout = null
+
 export const useUserStore = defineStore({
   id: 'user',
   state: () => ({
@@ -18,10 +20,32 @@ export const useUserStore = defineStore({
   }),
 
   actions: {
-    logout () {
-      removeToken()
-      removeCode()
-      this.$reset()
+    async logout () {
+      if (pendingLogout) {
+        return pendingLogout
+      }
+
+      const token = this.token || getToken()
+      pendingLogout = (async () => {
+        let revoked = true
+        try {
+          if (token) {
+            await logoutRequest()
+          }
+        } catch (_) {
+          // Local cleanup is the fallback when the server cannot revoke the session.
+          revoked = false
+        } finally {
+          removeToken()
+          removeCode()
+          localStorage.removeItem('user_info')
+          this.$reset()
+          pendingLogout = null
+        }
+        return revoked
+      })()
+
+      return pendingLogout
     },
 
     saveUserData (userData) {
diff --git a/admin-ui/src/utils/auth.js b/admin-ui/src/utils/auth.js
index 0a6d674..40fdb35 100644
--- a/admin-ui/src/utils/auth.js
+++ b/admin-ui/src/utils/auth.js
@@ -12,7 +12,8 @@ export function setToken (token) {
 }
 
 export function removeToken () {
-  return localStorage.removeItem(TokenKey)
+  localStorage.removeItem(TokenKey)
+  return localStorage.removeItem('wc-option:local:access_token')
 }
 
 // 设置 code，并存储当前时间戳（单位：毫秒）
diff --git a/admin-ui/src/utils/i18n/en.json b/admin-ui/src/utils/i18n/en.json
index 882ba62..a657a90 100644
--- a/admin-ui/src/utils/i18n/en.json
+++ b/admin-ui/src/utils/i18n/en.json
@@ -5,6 +5,9 @@
   "Logout": {
     "One": "Logout"
   },
+  "LogoutFailed": {
+    "One": "Session revocation failed; you were signed out locally."
+  },
   "Register": {
     "One": "Register"
   },
@@ -56,6 +59,72 @@
   "Platform": {
     "One": "Platform"
   },
+  "PlatformWindows": {
+    "One": "Windows 64-bit"
+  },
+  "PlatformLinuxUnavailable": {
+    "One": "Linux x64 — experimental / unavailable (PR11)"
+  },
+  "PlatformAndroidUnavailable": {
+    "One": "Android arm64 — experimental / unavailable (PR11)"
+  },
+  "ProductionPlatformUnavailable": {
+    "One": "This platform is experimental and unavailable for production builds until PR11 evidence is complete."
+  },
+  "WorkflowApprovalTitle": {
+    "One": "Workflow approval"
+  },
+  "WorkflowApprovalDescription": {
+    "One": "Build workflows require a provider-derived, verified annotated tag and current live-provider evidence before approval."
+  },
+  "WorkflowApprovalProtectedExplanation": {
+    "One": "The provider must confirm an active protected-tag policy for this label: updates and deletions are explicitly blocked, no bypass actors are present, and no branch has the same label. The provider must also verify the annotated tag and exact workflow at its resolved commit. Only the tag label is selectable; refs, SHAs, credentials, and workflow internals are never entered here. Local checks alone do not prove approval."
+  },
+  "WorkflowApprovalState": {
+    "One": "Approval state"
+  },
+  "WorkflowApprovalStatusApprovalRequired": {
+    "One": "Approval required"
+  },
+  "WorkflowApprovalStatusProviderPolicyUnverified": {
+    "One": "Provider policy unverified"
+  },
+  "WorkflowApprovalStatusApproved": {
+    "One": "Approved"
+  },
+  "WorkflowApprovalTagLabel": {
+    "One": "Verified workflow tag"
+  },
+  "WorkflowApprovalTagPlaceholder": {
+    "One": "Choose a provider-verified tag"
+  },
+  "WorkflowApprovalCurrentTag": {
+    "One": "Current approved tag: {param}"
+  },
+  "WorkflowApprovalLoading": {
+    "One": "Loading provider-verified tags..."
+  },
+  "WorkflowApprovalLoadError": {
+    "One": "Provider-verified workflow tags could not be loaded."
+  },
+  "WorkflowApprovalConfigError": {
+    "One": "Workflow approval state could not be loaded."
+  },
+  "WorkflowApprovalEmpty": {
+    "One": "No provider-verified workflow tags are available."
+  },
+  "WorkflowApprovalRetry": {
+    "One": "Retry"
+  },
+  "WorkflowApprovalApprove": {
+    "One": "Approve selected tag"
+  },
+  "WorkflowApprovalApproving": {
+    "One": "Approving..."
+  },
+  "WorkflowApprovalRequestFailed": {
+    "One": "Approval was not recorded. Try again after reviewing the provider status."
+  },
   "Status": {
     "One": "Status"
   },
@@ -736,8 +805,11 @@
   "Host": {
     "One": "Host"
   },
-  "HostnameOnlyHint": {
-    "One": "Hostname only, no port. Client appends the default port automatically."
+  "HostEndpointHint": {
+    "One": "Optional. Accepts a hostname or IP address with an optional port. RustDesk uses port 21116 only when the port is omitted."
+  },
+  "HostEndpointPlaceholder": {
+    "One": "e.g. your-server.com or your-server.com:21116 (default when omitted)"
   },
   "ApiServer": {
     "One": "API Server"
@@ -745,6 +817,12 @@
   "RelayServer": {
     "One": "Relay Server"
   },
+  "RelayEndpointHint": {
+    "One": "Optional. Accepts a hostname or IP address with an optional port. RustDesk uses port 21117 only when the port is omitted."
+  },
+  "RelayEndpointPlaceholder": {
+    "One": "e.g. your-server.com or your-server.com:21117 (default when omitted)"
+  },
   "Key": {
     "One": "Key"
   },
@@ -871,6 +949,12 @@
   "Building": {
     "One": "Building"
   },
+  "Downloading": {
+    "One": "Downloading"
+  },
+  "Extracting": {
+    "One": "Extracting"
+  },
   "Done": {
     "One": "Done"
   },
diff --git a/admin-ui/src/utils/i18n/ru.json b/admin-ui/src/utils/i18n/ru.json
index fe677ee..60e561a 100644
--- a/admin-ui/src/utils/i18n/ru.json
+++ b/admin-ui/src/utils/i18n/ru.json
@@ -5,6 +5,9 @@
   "Logout": {
     "One": "Выход"
   },
+  "LogoutFailed": {
+    "One": "Не удалось отозвать сессию; локальный выход выполнен."
+  },
   "Register": {
     "One": "Регистрация"
   },
@@ -56,6 +59,72 @@
   "Platform": {
     "One": "Платформа"
   },
+  "PlatformWindows": {
+    "One": "Windows 64-bit"
+  },
+  "PlatformLinuxUnavailable": {
+    "One": "Linux x64 — экспериментальная / недоступна (PR11)"
+  },
+  "PlatformAndroidUnavailable": {
+    "One": "Android arm64 — экспериментальная / недоступна (PR11)"
+  },
+  "ProductionPlatformUnavailable": {
+    "One": "Эта платформа экспериментальна и недоступна для production-сборок до подтверждения в PR11."
+  },
+  "WorkflowApprovalTitle": {
+    "One": "Подтверждение workflow"
+  },
+  "WorkflowApprovalDescription": {
+    "One": "Для одобрения workflow требуется полученный от провайдера проверенный аннотированный тег и актуальное подтверждение от провайдера."
+  },
+  "WorkflowApprovalProtectedExplanation": {
+    "One": "Провайдер должен подтвердить действующую политику защиты тега для этой метки: обновление и удаление явно запрещены, обходных участников нет, а ветка с такой же меткой отсутствует. Он также должен проверить аннотированный тег и точный workflow на разрешённом коммите. Выбирается только метка тега; refs, SHA, учётные данные и внутренние данные workflow здесь не вводятся. Одних локальных проверок недостаточно для одобрения."
+  },
+  "WorkflowApprovalState": {
+    "One": "Состояние подтверждения"
+  },
+  "WorkflowApprovalStatusApprovalRequired": {
+    "One": "Требуется подтверждение"
+  },
+  "WorkflowApprovalStatusProviderPolicyUnverified": {
+    "One": "Политика провайдера не подтверждена"
+  },
+  "WorkflowApprovalStatusApproved": {
+    "One": "Подтверждено"
+  },
+  "WorkflowApprovalTagLabel": {
+    "One": "Подтверждённый workflow-тег"
+  },
+  "WorkflowApprovalTagPlaceholder": {
+    "One": "Выберите подтверждённый провайдером тег"
+  },
+  "WorkflowApprovalCurrentTag": {
+    "One": "Текущий подтверждённый тег: {param}"
+  },
+  "WorkflowApprovalLoading": {
+    "One": "Загрузка подтверждённых провайдером тегов..."
+  },
+  "WorkflowApprovalLoadError": {
+    "One": "Не удалось загрузить подтверждённые провайдером workflow-теги."
+  },
+  "WorkflowApprovalConfigError": {
+    "One": "Не удалось загрузить состояние подтверждения workflow."
+  },
+  "WorkflowApprovalEmpty": {
+    "One": "Нет доступных подтверждённых провайдером workflow-тегов."
+  },
+  "WorkflowApprovalRetry": {
+    "One": "Повторить"
+  },
+  "WorkflowApprovalApprove": {
+    "One": "Подтвердить выбранный тег"
+  },
+  "WorkflowApprovalApproving": {
+    "One": "Подтверждение..."
+  },
+  "WorkflowApprovalRequestFailed": {
+    "One": "Подтверждение не записано. Проверьте состояние провайдера и повторите попытку."
+  },
   "Status": {
     "One": "Статус"
   },
@@ -571,6 +640,12 @@
   "StartBuild": {
     "One": "Запустить сборку"
   },
+  "Downloading": {
+    "One": "Загрузка артефакта"
+  },
+  "Extracting": {
+    "One": "Распаковка артефакта"
+  },
   "VersionListLoading": {
     "One": "Список версий загружается, подождите..."
   },
@@ -606,5 +681,17 @@
   },
   "Upload": {
     "One": "Загрузить"
+  },
+  "HostEndpointHint": {
+    "One": "Необязательное поле. Принимает имя хоста или IP-адрес с необязательным портом. RustDesk использует порт 21116 только если порт не указан."
+  },
+  "HostEndpointPlaceholder": {
+    "One": "например, your-server.com или your-server.com:21116 (по умолчанию, если порт не указан)"
+  },
+  "RelayEndpointHint": {
+    "One": "Необязательное поле. Принимает имя хоста или IP-адрес с необязательным портом. RustDesk использует порт 21117 только если порт не указан."
+  },
+  "RelayEndpointPlaceholder": {
+    "One": "например, your-server.com или your-server.com:21117 (по умолчанию, если порт не указан)"
   }
 }
diff --git a/admin-ui/src/utils/i18n/zh_CN.json b/admin-ui/src/utils/i18n/zh_CN.json
index 2f9e36e..07931ea 100644
--- a/admin-ui/src/utils/i18n/zh_CN.json
+++ b/admin-ui/src/utils/i18n/zh_CN.json
@@ -5,6 +5,9 @@
   "Logout": {
     "One": "退出登录"
   },
+  "LogoutFailed": {
+    "One": "会话撤销失败；已在本地退出登录。"
+  },
   "Register": {
     "One": "注册"
   },
@@ -56,6 +59,72 @@
   "Platform": {
     "One": "平台"
   },
+  "PlatformWindows": {
+    "One": "Windows 64 位"
+  },
+  "PlatformLinuxUnavailable": {
+    "One": "Linux x64 — 实验性 / 暂不可用（PR11）"
+  },
+  "PlatformAndroidUnavailable": {
+    "One": "Android arm64 — 实验性 / 暂不可用（PR11）"
+  },
+  "ProductionPlatformUnavailable": {
+    "One": "此平台为实验性平台，在 PR11 完成验证前不可用于生产构建。"
+  },
+  "WorkflowApprovalTitle": {
+    "One": "Workflow 审批"
+  },
+  "WorkflowApprovalDescription": {
+    "One": "审批需要服务商提供的、已验证的注释标签，以及当前实时服务商证据。"
+  },
+  "WorkflowApprovalProtectedExplanation": {
+    "One": "服务商必须确认该标签受到有效的受保护标签策略约束：明确禁止更新和删除、没有绕过参与者，并且不存在同名分支。服务商还必须验证注释标签及其解析到的确切 workflow 提交。这里只能选择标签名称；不能输入 ref、SHA、凭据或 workflow 内部信息。仅有本地检查不足以证明审批。"
+  },
+  "WorkflowApprovalState": {
+    "One": "审批状态"
+  },
+  "WorkflowApprovalStatusApprovalRequired": {
+    "One": "需要审批"
+  },
+  "WorkflowApprovalStatusProviderPolicyUnverified": {
+    "One": "服务商策略未验证"
+  },
+  "WorkflowApprovalStatusApproved": {
+    "One": "已审批"
+  },
+  "WorkflowApprovalTagLabel": {
+    "One": "已验证的 workflow 标签"
+  },
+  "WorkflowApprovalTagPlaceholder": {
+    "One": "选择服务商验证的标签"
+  },
+  "WorkflowApprovalCurrentTag": {
+    "One": "当前已审批标签：{param}"
+  },
+  "WorkflowApprovalLoading": {
+    "One": "正在加载服务商验证的标签..."
+  },
+  "WorkflowApprovalLoadError": {
+    "One": "无法加载服务商验证的 workflow 标签。"
+  },
+  "WorkflowApprovalConfigError": {
+    "One": "无法加载 workflow 审批状态。"
+  },
+  "WorkflowApprovalEmpty": {
+    "One": "没有可用的服务商验证 workflow 标签。"
+  },
+  "WorkflowApprovalRetry": {
+    "One": "重试"
+  },
+  "WorkflowApprovalApprove": {
+    "One": "审批所选标签"
+  },
+  "WorkflowApprovalApproving": {
+    "One": "审批中..."
+  },
+  "WorkflowApprovalRequestFailed": {
+    "One": "审批未记录。请查看服务商状态后重试。"
+  },
   "Status": {
     "One": "状态"
   },
@@ -584,6 +653,12 @@
   "StartBuild": {
     "One": "开始构建"
   },
+  "Downloading": {
+    "One": "正在下载构建产物"
+  },
+  "Extracting": {
+    "One": "正在解压构建产物"
+  },
   "VersionListLoading": {
     "One": "版本列表加载中，请稍候..."
   },
@@ -619,5 +694,17 @@
   },
   "Upload": {
     "One": "上传"
+  },
+  "HostEndpointHint": {
+    "One": "可选字段。支持主机名或 IP 地址，可选择是否指定端口。仅在未指定端口时，RustDesk 使用默认端口 21116。"
+  },
+  "HostEndpointPlaceholder": {
+    "One": "例如 your-server.com 或 your-server.com:21116（未填写端口时使用默认端口）"
+  },
+  "RelayEndpointHint": {
+    "One": "可选字段。支持主机名或 IP 地址，可选择是否指定端口。仅在未指定端口时，RustDesk 使用默认端口 21117。"
+  },
+  "RelayEndpointPlaceholder": {
+    "One": "例如 your-server.com 或 your-server.com:21117（未填写端口时使用默认端口）"
   }
 }
diff --git a/admin-ui/src/utils/request.js b/admin-ui/src/utils/request.js
index fc173a1..a409181 100644
--- a/admin-ui/src/utils/request.js
+++ b/admin-ui/src/utils/request.js
@@ -60,6 +60,34 @@ service.interceptors.response.use(
    * You can also judge the status by HTTP Status Code
    */
   response => {
+    // Binary downloads do not use the normal JSON response envelope.
+    if (response.config.responseType === 'blob') {
+      const contentType = response.headers?.['content-type'] || ''
+      if (!contentType.includes('application/json')) {
+        return response
+      }
+
+      // Auth/API failures can still arrive as a JSON envelope with HTTP 200.
+      // Parse those responses so a failed download is not saved as a .zip file.
+      return response.data.text().then(text => {
+        const res = JSON.parse(text)
+        if (res.code !== 0) {
+          ElMessage({
+            message: res.message || 'error',
+            type: 'error',
+            duration: 5 * 1000,
+          })
+
+          if (res.code === 403) {
+            removeToken()
+            window.location.reload()
+          }
+          return Promise.reject(res)
+        }
+        return response
+      }).catch(error => Promise.reject(error))
+    }
+
     const res = response.data
 
     // for the endpoint /login-options
@@ -70,13 +98,15 @@ service.interceptors.response.use(
 
     // if the custom code is not 20000, it is judged as an error.
     if (res.code !== 0) {
-      ElMessage({
-        message: res.message || 'error',
-        type: 'error',
-        duration: 5 * 1000,
-      })
+      if (!response.config.skipErrorMessage) {
+        ElMessage({
+          message: res.message || 'error',
+          type: 'error',
+          duration: 5 * 1000,
+        })
+      }
 
-      if (res.code === 403) {
+      if (res.code === 403 && !response.config.skipAuthRedirect) {
         removeToken()
         window.location.reload()
       }
@@ -90,11 +120,13 @@ service.interceptors.response.use(
       && error.message.indexOf('timeout') > -1) {
       error.message = 'Connection Time Out!'
     }
-    ElMessage({
-      message: error.message,
-      type: 'error',
-      duration: 5 * 1000,
-    })
+    if (!error.config?.skipErrorMessage) {
+      ElMessage({
+        message: error.message,
+        type: 'error',
+        duration: 5 * 1000,
+      })
+    }
     return Promise.reject(error)
   },
 )
diff --git a/admin-ui/src/views/custom-client/index.vue b/admin-ui/src/views/custom-client/index.vue
index cf3dbff..29b0bea 100644
--- a/admin-ui/src/views/custom-client/index.vue
+++ b/admin-ui/src/views/custom-client/index.vue
@@ -26,22 +26,24 @@
           <el-col :span="8">
             <el-form-item :label="T('Platform')">
               <!--
-                Windows x64 is validated end-to-end (GitHub Actions). Linux/Android route
-                to GitHub Actions too (B-012) but their workflows are still EXPERIMENTAL
-                drafts pending a green CI run — builds may fail until validated.
-                32-bit Windows and macOS are not supported (PLAN.md §8.15).
+                Windows x64 is validated end-to-end (GitHub Actions). Linux/Android remain
+                typed legacy values, but are unavailable for production builds pending PR11
+                evidence. 32-bit Windows and macOS are not supported (PLAN.md §8.15).
               -->
               <el-select v-model="form.platform" style="width:100%">
-                <el-option label="Windows 64Bit" value="windows" />
-                <el-option label="Linux x64 (experimental)" value="linux" />
-                <el-option label="Android arm64 (experimental)" value="android" />
+                <el-option :label="T('PlatformWindows')" value="windows" />
+                <el-option :label="T('PlatformLinuxUnavailable')" value="linux" disabled />
+                <el-option :label="T('PlatformAndroidUnavailable')" value="android" disabled />
               </el-select>
+              <div v-if="!productionPlatformReady" class="version-hint version-hint--error" role="alert">
+                {{ T('ProductionPlatformUnavailable') }}
+              </div>
             </el-form-item>
           </el-col>
           <el-col :span="8">
             <el-form-item :label="T('Version')">
               <el-select v-model="form.version" style="width:100%">
-                <el-option v-for="v in versions" :key="v" :label="v" :value="v" />
+                <el-option v-for="v in versions" :key="v.version" :label="v.version" :value="v.version" />
               </el-select>
             </el-form-item>
           </el-col>
@@ -56,10 +58,12 @@
         <el-row :gutter="20">
           <el-col :span="8">
             <el-form-item :label="T('Host')">
-              <el-input v-model="form.server_ip" placeholder="e.g. your-server.com" @blur="stripServerPort">
+              <el-input v-model="form.server_ip" :placeholder="T('HostEndpointPlaceholder')">
                 <template #append>
-                  <el-tooltip :content="T('HostnameOnlyHint')" placement="top">
-                    <el-icon><InfoFilled /></el-icon>
+                  <el-tooltip :content="T('HostEndpointHint')" placement="top" :trigger="['hover', 'focus']">
+                    <button type="button" class="endpoint-hint-trigger" :aria-label="T('HostEndpointHint')">
+                      <el-icon aria-hidden="true"><InfoFilled /></el-icon>
+                    </button>
                   </el-tooltip>
                 </template>
               </el-input>
@@ -79,10 +83,12 @@
         <el-row :gutter="20">
           <el-col :span="8">
             <el-form-item :label="T('RelayServer')">
-              <el-input v-model="form.relay_server" placeholder="e.g. your-server.com" @blur="stripRelayPort">
+              <el-input v-model="form.relay_server" :placeholder="T('RelayEndpointPlaceholder')">
                 <template #append>
-                  <el-tooltip :content="T('HostnameOnlyHint')" placement="top">
-                    <el-icon><InfoFilled /></el-icon>
+                  <el-tooltip :content="T('RelayEndpointHint')" placement="top" :trigger="['hover', 'focus']">
+                    <button type="button" class="endpoint-hint-trigger" :aria-label="T('RelayEndpointHint')">
+                      <el-icon aria-hidden="true"><InfoFilled /></el-icon>
+                    </button>
                   </el-tooltip>
                 </template>
               </el-input>
@@ -281,7 +287,7 @@
         </el-row>
 
         <el-form-item>
-          <el-button type="primary" @click="submitBuild" :loading="submitting" :disabled="!versionsReady || submitting">{{ T('StartBuild') }}</el-button>
+          <el-button type="primary" @click="submitBuild" :loading="submitting" :disabled="!versionsReady || !productionPlatformReady || submitting">{{ T('StartBuild') }}</el-button>
           <el-button @click="resetForm">{{ T('Reset') }}</el-button>
           <span v-if="versionsState === 'loading'" class="version-hint version-hint--loading">{{ T('VersionListLoading') }}</span>
           <span v-else-if="versionsState === 'empty'" class="version-hint version-hint--empty">{{ T('VersionListEmpty') }}</span>
@@ -315,7 +321,7 @@
           <el-tag v-else :type="statusType(row.status)" size="small">{{ T(statusLabel(row.status)) }}</el-tag>
         </template>
         <template #actions="{ row }">
-          <el-button v-if="row.status === 'done'" type="success" size="small" @click="downloadBuild(row)">{{ T('Download') }}</el-button>
+          <el-button v-if="row.status === 'done'" type="success" size="small" :loading="downloadingBuildId === row.id" @click="downloadBuild(row)">{{ T('Download') }}</el-button>
           <el-button type="danger" size="small" @click="deleteBuild(row)">{{ T('Delete') }}</el-button>
         </template>
       </data-table>
@@ -331,12 +337,13 @@
 
 <script>
 import { defineComponent, ref, reactive, computed, onMounted, onUnmounted, watch } from 'vue'
-import { list, create, remove, getVersions } from '@/api/custom_client'
+import { list, create, remove, download, getVersions } from '@/api/custom_client'
 import { list as listPresets, create as createPreset, remove as removePreset } from '@/api/custom_preset'
 import { all as fetchConfig } from '@/api/config'
 import { upload as uploadFile } from '@/api/file'
 import { ElMessage, ElMessageBox } from 'element-plus'
 import { T } from '@/utils/i18n'
+import { downBlob } from '@/utils/file'
 import { InfoFilled } from '@element-plus/icons-vue'
 import PageHeader from '@/components/ui/PageHeader.vue'
 import PageSection from '@/components/ui/PageSection.vue'
@@ -354,7 +361,7 @@ export default defineComponent({
   setup () {
     const form = reactive({
       platform: 'windows',
-      version: '1.4.8',
+      version: '',
       app_name: '',
       server_ip: '',
       key: '',
@@ -393,13 +400,10 @@ export default defineComponent({
       privacy_screen_url: '',
     })
 
-    const stripPort = (host) => host ? host.replace(/:\d+$/, '').trim() : ''
-    const stripServerPort = () => { form.server_ip = stripPort(form.server_ip) }
-    const stripRelayPort = () => { form.relay_server = stripPort(form.relay_server) }
-
     const builds = ref([])
     const loading = ref(false)
     const submitting = ref(false)
+    const downloadingBuildId = ref(null)
     // versionsState: 'loading' | 'ready' | 'empty' | 'error'.
     // Заменяет versionsLoading (был boolean) — нужно различать
     // "ещё грузится" и "загрузилось, но пусто/ошибка", чтобы:
@@ -409,24 +413,44 @@ export default defineComponent({
     const versionsState = ref('loading')
     const versionsReady = computed(() => versionsState.value === 'ready')
     const versionsLoading = computed(() => versionsState.value === 'loading')
+    // Linux/Android remain valid persisted enum values for legacy presets, but
+    // the backend production capability gate keeps them unavailable until PR11.
+    const productionPlatformReady = computed(() => form.platform === 'windows')
     const page = ref(1)
     const pageSize = ref(10)
     const total = ref(0)
     const versions = ref([])
+    // One component guard for all async state operations. Per-operation generations
+    // let the initial requests run in parallel while invalidating older refreshes.
+    const requestGenerations = Object.create(null)
+    const lifecycleGuard = {
+      mounted: false,
+      start (key) {
+        requestGenerations[key] = (requestGenerations[key] || 0) + 1
+        return requestGenerations[key]
+      },
+      isCurrent (key, generation) {
+        return lifecycleGuard.mounted && requestGenerations[key] === generation
+      },
+    }
 
     // B-017: при silent=true не дёргаем спиннер — для фонового поллинга.
     const loadBuilds = async (silent = false) => {
+      if (!lifecycleGuard.mounted) return null
+      const generation = lifecycleGuard.start('builds')
       if (!silent) loading.value = true
       try {
         const res = await list({ page: page.value, page_size: pageSize.value })
+        if (!lifecycleGuard.isCurrent('builds', generation)) return generation
         builds.value = res.data.list || []
         total.value = res.data.total || 0
       } catch (e) {
-        console.error(e)
+        if (lifecycleGuard.isCurrent('builds', generation)) console.error(e)
       } finally {
-        if (!silent) loading.value = false
+        if (lifecycleGuard.isCurrent('builds', generation) && !silent) loading.value = false
       }
-      ensurePolling()
+      if (lifecycleGuard.isCurrent('builds', generation)) ensurePolling()
+      return generation
     }
 
     // B-017: история билдов не обновлялась сама — строки висели в pending/building,
@@ -435,7 +459,7 @@ export default defineComponent({
     const POLL_MS = 12000
     let pollTimer = null
     const hasActiveBuilds = () =>
-      builds.value.some((b) => b.status === 'pending' || b.status === 'building')
+      builds.value.some((b) => ['pending', 'building', 'downloading', 'extracting'].includes(b.status))
     const stopPolling = () => {
       if (pollTimer) {
         clearInterval(pollTimer)
@@ -443,26 +467,37 @@ export default defineComponent({
       }
     }
     const ensurePolling = () => {
+      if (!lifecycleGuard.mounted) return
       if (!hasActiveBuilds()) {
         stopPolling()
         return
       }
       if (pollTimer) return
       pollTimer = setInterval(async () => {
-        await loadBuilds(true)
-        if (!hasActiveBuilds()) stopPolling()
+        if (!lifecycleGuard.mounted) {
+          stopPolling()
+          return
+        }
+        const generation = await loadBuilds(true)
+        if (generation !== null && lifecycleGuard.isCurrent('builds', generation) && !hasActiveBuilds()) stopPolling()
       }, POLL_MS)
     }
-    onUnmounted(stopPolling)
+    onUnmounted(() => {
+      lifecycleGuard.mounted = false
+      stopPolling()
+    })
 
     const presets = ref([])
     const selectedPresetId = ref(null)
     const loadPresets = async () => {
+      if (!lifecycleGuard.mounted) return
+      const generation = lifecycleGuard.start('presets')
       try {
         const res = await listPresets({ page: 1, page_size: 100 })
+        if (!lifecycleGuard.isCurrent('presets', generation)) return
         presets.value = res.data.list || []
       } catch (e) {
-        console.error(e)
+        if (lifecycleGuard.isCurrent('presets', generation)) console.error(e)
       }
     }
 
@@ -476,11 +511,17 @@ export default defineComponent({
       if (!preset) return
       try {
         const cfg = JSON.parse(preset.custom_json || '{}')
+        // Secret-bearing custom_json fields are intentionally omitted by the
+        // API safe view. Never retain a previously entered password when a
+        // preset is selected; the administrator must enter it explicitly for
+        // the next build.
+        form.permanent_password = ''
         for (const f of PRESET_FIELDS) {
           if (f in cfg && cfg[f] !== undefined) form[f] = cfg[f]
         }
-        form.relay_server = stripPort(form.relay_server)
         // platform/version/app_name live on the preset record, not in custom_json
+        // Keep legacy Linux/Android state visible for migration safety; the
+        // disabled option and productionPlatformReady guard keep it blocked.
         if (preset.platform) form.platform = preset.platform
         if (preset.version) {
           // Преcет применяется только когда версия действительно доступна:
@@ -495,7 +536,7 @@ export default defineComponent({
           if (versionsLoading.value) {
             form.version = preset.version
           } else if (versionsState.value === 'ready') {
-            form.version = versions.value.includes(preset.version) ? preset.version : defaultVersion(preset.version)
+            form.version = versions.value.some((entry) => entry.version === preset.version) ? preset.version : defaultVersion(preset.version)
           } else {
             form.version = defaultVersion(preset.version)
           }
@@ -518,7 +559,6 @@ export default defineComponent({
         const name = await ElMessageBox.prompt(T('PresetName'), T('SaveAsPreset'), { inputPlaceholder: 'My Preset' })
         if (!name || !name.value) return
         // Derived from PRESET_FIELDS so submit + save preset stay in sync.
-        form.relay_server = stripPort(form.relay_server)
         const customPayload = {}
         for (const f of PRESET_FIELDS) customPayload[f] = form[f]
         const customJson = JSON.stringify(customPayload)
@@ -573,6 +613,10 @@ export default defineComponent({
     }
 
     const submitBuild = async () => {
+      if (!productionPlatformReady.value) {
+        ElMessage.warning(T('ProductionPlatformUnavailable'))
+        return
+      }
       if (versionsState.value !== 'ready') {
         // Различаем loading / empty / error, чтобы пользователь понимал, чего ждать.
         const key = versionsState.value === 'loading'
@@ -583,8 +627,6 @@ export default defineComponent({
         ElMessage.warning(T(key))
         return
       }
-      form.server_ip = stripPort(form.server_ip)
-      form.relay_server = stripPort(form.relay_server)
       submitting.value = true
       try {
         // Derived from PRESET_FIELDS so submit + save preset stay in sync.
@@ -663,14 +705,27 @@ export default defineComponent({
       form.privacy_screen_url = ''
     }
 
-    const downloadBuild = (row) => {
-      window.open(`/api/admin/custom_build/public/download/${row.download_key}`, '_blank')
+    const downloadBuild = async (row) => {
+      if (downloadingBuildId.value === row.id) return
+      downloadingBuildId.value = row.id
+      try {
+        const res = await download(row.id)
+        const disposition = res.headers?.['content-disposition'] || ''
+        const filename = disposition.match(/filename="?([^";]+)"?/i)?.[1] || `custom-build-${row.id}.zip`
+        downBlob(res.data, filename)
+      } catch (e) {
+        console.error(e)
+      } finally {
+        downloadingBuildId.value = null
+      }
     }
 
     const statusType = (s) => {
       switch (s) {
         case 'pending': return 'info'
         case 'building': return 'warning'
+        case 'downloading': return 'warning'
+        case 'extracting': return 'warning'
         case 'done': return 'success'
         case 'failed': return 'danger'
         default: return 'info'
@@ -681,67 +736,85 @@ export default defineComponent({
       switch (s) {
         case 'pending': return 'Pending'
         case 'building': return 'Building'
+        case 'downloading': return 'Downloading'
+        case 'extracting': return 'Extracting'
         case 'done': return 'Done'
         case 'failed': return 'Failed'
         default: return s
       }
     }
 
-    const defaultVersion = (current = form.version) =>
-      versions.value.includes(current) ? current : (versions.value[0] || '')
-    onMounted(async () => {
-      loadBuilds()
-      loadPresets()
-      versionsState.value = 'loading'
-      // Run getVersions and fetchConfig in parallel — server defaults must apply
-      // immediately even if GitHub API is slow/unreachable.
-      const versionsPromise = (async () => {
-        try {
-          const res = await getVersions()
-          const data = res?.data || {}
-          const list = data.versions || []
-          versions.value = list
-          if (data.error) {
-            versionsState.value = 'error'
-          } else {
-            versionsState.value = list.length > 0 ? 'ready' : 'empty'
-          }
-        } catch (e) {
-          console.warn('getVersions failed:', e)
-          ElMessage.error(T('VersionListError'))
-          versions.value = []
+    const defaultVersion = (current = form.version) => {
+      const selected = versions.value.find((entry) => entry.version === current)
+      return selected ? selected.version : (versions.value[0]?.version || '')
+    }
+
+    const loadVersions = async () => {
+      if (!lifecycleGuard.mounted) return
+      const generation = lifecycleGuard.start('versions')
+      try {
+        const res = await getVersions()
+        if (!lifecycleGuard.isCurrent('versions', generation)) return
+        const data = res?.data || {}
+        const list = data.versions || []
+        versions.value = list
+        if (data.error) {
           versionsState.value = 'error'
-        } finally {
-          // Keep form.version aligned with the available options only when versions are available.
-          if (versionsState.value === 'ready') {
-            form.version = defaultVersion(form.version)
-          }
+        } else {
+          versionsState.value = list.length > 0 ? 'ready' : 'empty'
         }
-      })()
+      } catch (e) {
+        if (!lifecycleGuard.isCurrent('versions', generation)) return
+        console.warn('getVersions failed:', e)
+        ElMessage.error(T('VersionListError'))
+        versions.value = []
+        versionsState.value = 'error'
+      } finally {
+        // Keep form.version aligned with the available options only when versions are available.
+        if (lifecycleGuard.isCurrent('versions', generation) && versionsState.value === 'ready') {
+          form.version = defaultVersion(form.version)
+        }
+      }
+    }
 
+    const loadConfig = async () => {
+      if (!lifecycleGuard.mounted) return
+      const generation = lifecycleGuard.start('config')
       try {
         const res = await fetchConfig()
+        if (!lifecycleGuard.isCurrent('config', generation)) return
         if (res?.data) {
           // B-016: заполняем ТОЛЬКО пустые поля. Пресет (loadPresets/onPresetSelect)
           // может примениться раньше, чем резолвится fetchConfig — нельзя затирать
           // уже выставленные им значения серверными дефолтами.
           const cfg = res.data
-          if (!form.server_ip) form.server_ip = stripPort(cfg.id_server || '')
+          if (!form.server_ip) form.server_ip = cfg.id_server || ''
           if (!form.key) form.key = cfg.key || ''
           if (!form.api_server) form.api_server = cfg.api_server || ''
-          if (!form.relay_server) form.relay_server = stripPort(cfg.relay_server || '')
+          if (!form.relay_server) form.relay_server = cfg.relay_server || ''
         }
       } catch (e) {
-        console.warn('fetchConfig failed:', e)
+        if (lifecycleGuard.isCurrent('config', generation)) console.warn('fetchConfig failed:', e)
       }
+    }
+
+    onMounted(async () => {
+      lifecycleGuard.mounted = true
+      loadBuilds()
+      loadPresets()
+      versionsState.value = 'loading'
+      // Run getVersions and fetchConfig in parallel — server defaults must apply
+      // immediately even if GitHub API is slow/unreachable.
+      const versionsPromise = loadVersions()
+      await loadConfig()
       // Wait for version list to settle (may already be done).
       await versionsPromise
     })
 
     return {
-      form, builds, loading, submitting, versionsState, versionsReady, versionsLoading,
+      form, builds, loading, submitting, downloadingBuildId, versionsState, versionsReady, versionsLoading, productionPlatformReady,
       page, pageSize, total, versions,
-      submitBuild, deleteBuild, resetForm, downloadBuild, stripServerPort, stripRelayPort,
+      submitBuild, deleteBuild, resetForm, downloadBuild,
       statusType, statusLabel, T,
       presets, selectedPresetId, onPresetSelect, saveCurrentAsPreset, deletePreset, uploadImage,
     }
@@ -765,6 +838,24 @@ export default defineComponent({
   &--error   { color: var(--el-color-danger); }
 }
 
+.endpoint-hint-trigger {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 2px;
+  border: 0;
+  border-radius: 4px;
+  background: transparent;
+  color: inherit;
+  cursor: help;
+  font: inherit;
+
+  &:focus-visible {
+    outline: 2px solid var(--el-color-primary);
+    outline-offset: 2px;
+  }
+}
+
 .build-history {
   :deep(.el-pagination) {
     justify-content: flex-end;
diff --git a/admin-ui/src/views/server/github-build.vue b/admin-ui/src/views/server/github-build.vue
index af28853..64f7ee7 100644
--- a/admin-ui/src/views/server/github-build.vue
+++ b/admin-ui/src/views/server/github-build.vue
@@ -7,19 +7,104 @@
         pulse="warning"
     />
 
-    <page-section title="Workflow settings" subtitle="Repository, workflow, branch, PAT, and encrypted payload key.">
+    <page-section title="GitHub provider settings" subtitle="Configured repository, PAT, and encrypted payload key.">
 
-      <el-form ref="formRef" :model="form" label-position="top" v-loading="loading">
-        <el-form-item label="Repository (owner/name)">
-          <el-input v-model="form.repo" placeholder="bashrusakh/DeskForge" />
-        </el-form-item>
+      <section
+        class="workflow-approval"
+        :aria-busy="loading || workflowTagsState === 'loading' || approving"
+        aria-labelledby="workflow-approval-title"
+      >
+        <div class="workflow-approval__header">
+          <div>
+            <h2 id="workflow-approval-title" class="workflow-approval__title">{{ T('WorkflowApprovalTitle') }}</h2>
+            <p class="workflow-approval__description">{{ T('WorkflowApprovalDescription') }}</p>
+          </div>
+          <div class="workflow-approval__status" aria-live="polite">
+            <span class="workflow-approval__status-label">{{ T('WorkflowApprovalState') }}</span>
+            <el-tag :type="workflowRefStatusType" role="status">{{ workflowRefStatusLabel }}</el-tag>
+          </div>
+        </div>
 
-        <el-form-item label="Workflow filename">
-          <el-input v-model="form.workflow_filename" placeholder="rustqs-windows-min-test.yml" />
-        </el-form-item>
+        <el-alert
+          id="workflow-approval-protection"
+          type="info"
+          :closable="false"
+          show-icon
+        >
+          {{ T('WorkflowApprovalProtectedExplanation') }}
+        </el-alert>
 
-        <el-form-item label="Branch">
-          <el-input v-model="form.branch" placeholder="master or rustqs/min-test" />
+        <el-alert v-if="configError" type="error" :closable="false" show-icon>
+          <span>{{ T('WorkflowApprovalConfigError') }}</span>
+          <el-button class="workflow-approval__retry" size="small" @click="load">
+            {{ T('WorkflowApprovalRetry') }}
+          </el-button>
+        </el-alert>
+
+        <loading-state
+          v-else-if="workflowTagsState === 'loading'"
+          :title="T('WorkflowApprovalLoading')"
+        />
+
+        <el-alert v-else-if="workflowTagsState === 'error'" type="error" :closable="false" show-icon>
+          <span>{{ T('WorkflowApprovalLoadError') }}</span>
+          <el-button class="workflow-approval__retry" size="small" @click="load">
+            {{ T('WorkflowApprovalRetry') }}
+          </el-button>
+        </el-alert>
+
+        <empty-state
+          v-else-if="workflowTagsState === 'empty'"
+          :title="T('WorkflowApprovalEmpty')"
+        >
+          <template #actions>
+            <el-button size="small" @click="load">
+              {{ T('WorkflowApprovalRetry') }}
+            </el-button>
+          </template>
+        </empty-state>
+
+        <div v-else class="workflow-approval__controls">
+          <label class="workflow-approval__label" for="workflow-tag-select">
+            {{ T('WorkflowApprovalTagLabel') }}
+          </label>
+          <el-select
+            id="workflow-tag-select"
+            v-model="selectedWorkflowTag"
+            class="workflow-approval__select"
+            :aria-describedby="'workflow-approval-protection'"
+            :aria-label="T('WorkflowApprovalTagLabel')"
+            :placeholder="T('WorkflowApprovalTagPlaceholder')"
+            :disabled="approving"
+          >
+            <el-option
+              v-for="option in workflowTags"
+              :key="option.tag"
+              :label="option.label"
+              :value="option.tag"
+            />
+          </el-select>
+          <p v-if="currentWorkflowTag" class="workflow-approval__current">
+            {{ T('WorkflowApprovalCurrentTag', { param: currentWorkflowTag }) }}
+          </p>
+          <el-alert v-if="approvalError" class="workflow-approval__feedback" type="error" :closable="false" show-icon>
+            {{ T('WorkflowApprovalRequestFailed') }}
+          </el-alert>
+          <el-button
+            class="workflow-approval__action"
+            type="primary"
+            :loading="approving"
+            :disabled="!selectedWorkflowTag"
+            @click="onApproveWorkflowRef"
+          >
+            {{ approving ? T('WorkflowApprovalApproving') : T('WorkflowApprovalApprove') }}
+          </el-button>
+        </div>
+      </section>
+
+      <el-form ref="formRef" :model="form" label-position="top" v-loading="loading">
+        <el-form-item label="Repository (owner/name)">
+          <el-input v-model="form.repo" placeholder="owner/rustdesk-fork" />
         </el-form-item>
 
         <el-form-item label="GitHub Token (PAT)">
@@ -49,7 +134,6 @@
           </div>
           <el-button size="small" @click="onGenerate" :loading="generating">Generate new key</el-button>
           <el-button size="small" @click="onSyncSecret" :loading="syncing">Push to GitHub Secrets</el-button>
-          <el-button size="small" @click="onSyncPat" :loading="syncingPat">Sync PAT to CI</el-button>
           <div v-if="generatedKey" class="generated-key">
             <strong>New key (will be auto-pushed to GitHub Secrets if you click "Push" above, or copy manually):</strong>
             <el-input v-model="generatedKey" readonly>
@@ -81,7 +165,9 @@
           <div v-if="dispatchResult.message">{{ dispatchResult.message }}</div>
           <div v-if="dispatchResult.run_id">
             Run id={{ dispatchResult.run_id }}
-            · <a :href="runUrl(dispatchResult.run_id)" target="_blank">Open in GitHub</a>
+            <template v-if="dispatchResult.html_url">
+              · <a :href="dispatchResult.html_url" target="_blank">Open in GitHub</a>
+            </template>
           </div>
         </el-alert>
       </el-form>
@@ -90,10 +176,13 @@
 </template>
 
 <script setup>
-import { ref, onMounted, reactive } from 'vue'
+import { ref, onMounted, reactive, computed } from 'vue'
 import * as api from '@/api/github_build_config'
+import { T } from '@/utils/i18n'
 import PageHeader from '@/components/ui/PageHeader.vue'
 import PageSection from '@/components/ui/PageSection.vue'
+import LoadingState from '@/components/ui/LoadingState.vue'
+import EmptyState from '@/components/ui/EmptyState.vue'
 
 const loading = ref(false)
 const saving = ref(false)
@@ -101,14 +190,18 @@ const testing = ref(false)
 const dispatching = ref(false)
 const generating = ref(false)
 const syncing = ref(false)
-const syncingPat = ref(false)
+const approving = ref(false)
 const syncResult = ref(null)
+const workflowTags = ref([])
+const workflowTagsState = ref('loading')
+const configError = ref(false)
+const approvalError = ref(false)
+const selectedWorkflowTag = ref('')
+const currentWorkflowTag = ref('')
 
-const info = reactive({ has_token: false, has_payload_key: false })
+const info = reactive({ has_token: false, has_payload_key: false, workflow_ref: '', workflow_ref_approved: false, workflow_ref_status: 'approval-required' })
 const form = reactive({
   repo: '',
-  workflow_filename: '',
-  branch: '',
   token: '',
   payload_key: '',
 })
@@ -116,32 +209,100 @@ const generatedKey = ref('')
 const testResult = ref(null)
 const dispatchResult = ref(null)
 
-function runUrl (runId) {
-  return form.repo ? `https://github.com/${form.repo}/actions/runs/${runId}` : '#'
-}
-
 async function load () {
   loading.value = true
+  configError.value = false
+  approvalError.value = false
+  workflowTagsState.value = 'loading'
+  workflowTags.value = []
+  selectedWorkflowTag.value = ''
+  currentWorkflowTag.value = ''
+  info.workflow_ref = ''
+  info.workflow_ref_approved = false
+  info.workflow_ref_status = 'approval-required'
+  let configLoaded = false
   try {
     const res = await api.get()
     const d = res.data || res
-    form.repo = d.repo || 'bashrusakh/DeskForge'
-    form.workflow_filename = d.workflow_filename || 'rustqs-windows-min-test.yml'
-    form.branch = d.branch || 'rustqs/min-test'
+    form.repo = d.repo || ''
     info.has_token = !!d.has_token
     info.has_payload_key = !!d.has_payload_key
+    applyApprovalState(d)
+    configLoaded = true
+
+    const tagsRes = await api.getWorkflowTags()
+    const tagsData = tagsRes.data || tagsRes
+    workflowTags.value = Array.isArray(tagsData.tags)
+      ? tagsData.tags.filter(option => option && typeof option.tag === 'string' && typeof option.label === 'string')
+      : []
+    workflowTagsState.value = workflowTags.value.length > 0 ? 'ready' : 'empty'
+    selectCurrentWorkflowTag()
+  } catch (e) {
+    workflowTagsState.value = 'error'
+    configError.value = !configLoaded
   } finally {
     loading.value = false
   }
 }
 
+function applyApprovalState (data) {
+  info.workflow_ref = data.workflow_ref || ''
+  info.workflow_ref_approved = !!data.workflow_ref_approved
+  info.workflow_ref_status = ['approval-required', 'provider-policy-unverified', 'approved'].includes(data.workflow_ref_status)
+    ? data.workflow_ref_status
+    : (info.workflow_ref_approved ? 'provider-policy-unverified' : 'approval-required')
+  currentWorkflowTag.value = info.workflow_ref
+}
+
+function selectCurrentWorkflowTag () {
+  selectedWorkflowTag.value = workflowTags.value.some(option => option.tag === currentWorkflowTag.value)
+    ? currentWorkflowTag.value
+    : ''
+}
+
+async function onApproveWorkflowRef () {
+  if (!selectedWorkflowTag.value) return
+  approving.value = true
+  approvalError.value = false
+  try {
+    const res = await api.approveWorkflowRef(selectedWorkflowTag.value)
+    const d = res.data || res
+    applyApprovalState(d)
+    selectCurrentWorkflowTag()
+  } catch (e) {
+    approvalError.value = true
+  } finally {
+    approving.value = false
+  }
+}
+
+const workflowRefStatusLabel = computed(() => {
+  switch (info.workflow_ref_status) {
+    case 'approved':
+      return T('WorkflowApprovalStatusApproved')
+    case 'provider-policy-unverified':
+      return T('WorkflowApprovalStatusProviderPolicyUnverified')
+    default:
+      return T('WorkflowApprovalStatusApprovalRequired')
+  }
+})
+
+const workflowRefStatusType = computed(() => {
+  switch (info.workflow_ref_status) {
+    case 'approved':
+      return 'success'
+    case 'provider-policy-unverified':
+      return 'warning'
+    default:
+      return 'info'
+  }
+})
+
 async function onSave () {
   saving.value = true
   try {
     await api.save({
       repo: form.repo,
-      workflow_filename: form.workflow_filename,
-      branch: form.branch,
       token: form.token,
       payload_key: form.payload_key,
     })
@@ -182,19 +343,6 @@ async function onSyncSecret () {
   }
 }
 
-async function onSyncPat () {
-  syncingPat.value = true
-  syncResult.value = null
-  try {
-    const res = await api.syncPat()
-    syncResult.value = res.data || res
-  } catch (e) {
-    syncResult.value = { ok: false, message: e.message || String(e) }
-  } finally {
-    syncingPat.value = false
-  }
-}
-
 async function onTest () {
   testing.value = true
   testResult.value = null
@@ -226,8 +374,29 @@ onMounted(load)
 
 <style scoped>
 .hint { color: var(--color-muted); font-size: 0.9em; }
+.workflow-approval { margin-bottom: 24px; }
+.workflow-approval__header { display: flex; gap: 20px; align-items: flex-start; justify-content: space-between; margin-bottom: 16px; }
+.workflow-approval__title { margin: 0; color: var(--color-text); font-size: 18px; }
+.workflow-approval__description, .workflow-approval__current { color: var(--color-muted); font-size: 0.9em; line-height: 1.5; }
+.workflow-approval__description { margin: 4px 0 0; }
+.workflow-approval__status { display: flex; flex-direction: column; align-items: flex-end; gap: 6px; flex-shrink: 0; }
+.workflow-approval__status-label, .workflow-approval__label { color: var(--color-muted); font-size: 0.85em; font-weight: 600; }
+.workflow-approval__controls { margin-top: 18px; }
+.workflow-approval__label { display: block; margin-bottom: 6px; }
+.workflow-approval__select { width: min(100%, 420px); }
+.workflow-approval__current { margin: 8px 0 0; }
+.workflow-approval__feedback { margin-top: 16px; }
+.workflow-approval__retry { margin-left: 12px; }
+.workflow-approval__action { display: block; margin-top: 16px; }
 .hint-text { color: var(--color-muted); font-size: 0.85em; margin-top: 4px; }
 .generated-key { margin-top: 12px; padding: 12px; background: var(--color-code-bg); border-radius: 12px; }
 .warn { color: var(--color-danger); margin-top: 4px; font-size: 0.85em; }
 code { background: var(--color-code-bg); padding: 1px 4px; border-radius: 6px; }
+
+@media (max-width: 640px) {
+  .workflow-approval__header { flex-direction: column; gap: 12px; }
+  .workflow-approval__status { align-items: flex-start; }
+  .workflow-approval__select { width: 100%; }
+  .workflow-approval__retry { display: block; margin: 10px 0 0; }
+}
 </style>
diff --git a/api/.github/workflows/build.yml b/api/.github/workflows/build.yml
deleted file mode 100644
index 6b7cb00..0000000
--- a/api/.github/workflows/build.yml
+++ /dev/null
@@ -1,392 +0,0 @@
-name: Build
-
-on:
-  workflow_dispatch:
-    inputs:
-      BASE_IMAGE_NAMESPACE:
-        description: 'Base image namespace (Default: Your Github username)'
-        required: false
-        default: ''
-      DOCKERHUB_IMAGE_NAMESPACE:
-        description: 'Docker Hub image namespace (Default: Your Github username)'
-        required: false
-        default: ''
-      GHCR_IMAGE_NAMESPACE:
-        description: 'GitHub Container Registry image namespace (Default: Your Github username)'
-        required: false
-        default: ''
-      SKIP_DOCKER_HUB:
-        description: 'Set to true to skip pushing to Docker Hub (default: false)'
-        required: false
-        default: 'false'
-      SKIP_GHCR:
-        description: 'Set to true to skip pushing to GHCR (default: false)'
-        required: false
-        default: 'false'
-      WEBCLIENT_SOURCE_LOCATION:
-        description: 'Web Client API Repository'
-        required: true
-        default: 'https://github.com/lejianwen/rustdesk-api-web'
-  push:
-    tags:
-      - 'v*.*.*'  # 当推送带有版本号的 tag（例如 v1.0.0）时触发工作流
-      - 'test*'
-
-env:
-  LATEST_TAG: latest
-  WEBCLIENT_SOURCE_LOCATION: ${{ github.event.inputs.WEBCLIENT_SOURCE_LOCATION || 'https://github.com/lejianwen/rustdesk-api-web' }}
-  BASE_IMAGE_NAMESPACE: ${{ github.event.inputs.BASE_IMAGE_NAMESPACE || github.actor }}
-  DOCKERHUB_IMAGE_NAMESPACE: ${{ github.event.inputs.DOCKERHUB_IMAGE_NAMESPACE || github.actor }}
-  GHCR_IMAGE_NAMESPACE: ${{ github.event.inputs.GHCR_IMAGE_NAMESPACE || github.actor }}
-  SKIP_DOCKER_HUB: ${{ github.event.inputs.SKIP_DOCKER_HUB || 'false' }}
-  SKIP_GHCR: ${{ github.event.inputs.SKIP_GHCR || 'false' }}
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - { platform: "amd64", goos: "linux", file_ext: "tar.gz" }
-          - { platform: "arm64", goos: "linux", file_ext: "tar.gz" }
-          - { platform: "armv7l", goos: "linux", file_ext: "tar.gz" }
-          - { platform: "amd64", goos: "windows", file_ext: "zip" }
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/checkout@v4
-        with:
-          repository: lejianwen/rustdesk-api-web
-          path: rustdesk-api-web
-          ref: master
-
-      - name: Set up Go environment
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.23'  # 选择 Go 版本
-
-      - name: Set up npm
-        uses: actions/setup-node@v2
-        with:
-          node-version: '20'
-
-      - name: build rustdesk-api-web
-        working-directory: rustdesk-api-web
-        run: |
-          npm install
-          npm run build
-          mkdir -p ../resources/admin/
-          cp -ar dist/* ../resources/admin/
-
-      - name: tidy
-        run: go mod tidy
-
-      - name: Get tag version
-        run: |
-          TAG_VERSION="${GITHUB_REF##*/}"
-          VERSION="${TAG_VERSION#v}" 
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-
-      - name: Write version to resources/version
-        run:  echo $VERSION > resources/version
-
-      - name: swag
-        run: |
-          go install github.com/swaggo/swag/cmd/swag@latest
-          swag init -g cmd/apimain.go --output docs/api --instanceName api --exclude http/controller/admin
-          swag init -g cmd/apimain.go --output docs/admin --instanceName admin --exclude http/controller/api
-
-      - name: Build for ${{ matrix.job.goos }}-${{ matrix.job.platform }}
-        run: |
-          mkdir release -p
-          cp -ar resources release/
-          cp -ar docs release/
-          cp -ar conf release/
-          mkdir -p release/data
-          mkdir -p release/runtime
-          if [ "${{ matrix.job.goos }}" = "windows" ]; then
-            sudo apt-get install gcc-mingw-w64-x86-64 zip -y
-            GOOS=${{ matrix.job.goos }} GOARCH=${{ matrix.job.platform }} CC=x86_64-w64-mingw32-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain.exe ./cmd/apimain.go
-            echo @echo off > release/start.bat
-            echo cmd /c \"%~dp0apimain.exe\" >> release/start.bat
-            zip -r ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}} ./release
-          else
-            if [ "${{ matrix.job.platform }}" = "arm64" ]; then
-                wget https://musl.ljw.red/aarch64-linux-musl-cross.tgz
-                tar -xf aarch64-linux-musl-cross.tgz
-                export PATH=$PATH:$PWD/aarch64-linux-musl-cross/bin
-                GOOS=${{ matrix.job.goos }} GOARCH=${{ matrix.job.platform }} CC=aarch64-linux-musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain ./cmd/apimain.go
-            elif [ "${{ matrix.job.platform }}" = "armv7l" ]; then
-                wget https://musl.ljw.red/armv7l-linux-musleabihf-cross.tgz
-                tar -xf armv7l-linux-musleabihf-cross.tgz
-                export PATH=$PATH:$PWD/armv7l-linux-musleabihf-cross/bin
-                GOOS=${{ matrix.job.goos }} GOARCH=arm GOARM=7 CC=armv7l-linux-musleabihf-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain ./cmd/apimain.go
-            else
-              sudo apt-get install musl musl-dev musl-tools -y
-              GOOS=${{ matrix.job.goos }} GOARCH=${{ matrix.job.platform }} CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain ./cmd/apimain.go
-            fi
-            tar -czf ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}} ./release
-          fi
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.goos }}-${{ matrix.job.platform }}
-          path: |
-            ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}}
-
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Generate Changelog
-        if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
-        run: npx changelogithub # or changelogithub@0.12 if ensure the stable result
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-  deb-package:
-    name: debian package - ${{ matrix.job.platform }}
-    needs: build
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - { platform: "amd64", goos: "linux", debian_platform: "amd64", crossbuild_package: ""}
-          - { platform: "arm64", goos: "linux", debian_platform: "arm64", crossbuild_package: "crossbuild-essential-arm64" }
-          - { platform: "armv7l", goos: "linux", debian_platform: "armhf", crossbuild_package: "crossbuild-essential-armhf" }
-    steps:
-
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Create packaging env
-        run: |
-          sudo apt update
-          DEBIAN_FRONTEND=noninteractive sudo apt install -y devscripts build-essential debhelper pkg-config ${{ matrix.job.crossbuild_package }}
-          mkdir -p debian-build/${{ matrix.job.platform }}/bin
-
-      - name: Get tag version
-        id: get_tag
-        run: |
-          TAG_VERSION="${GITHUB_REF##*/}"
-          VERSION="${TAG_VERSION#v}" 
-          echo "TAG_VERSION=$TAG_VERSION" >> $GITHUB_ENV
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-
-      - name: Update changelog
-        run: |
-          DATE=$(date -R)
-          sed -i "1i rustdesk-api-server (${VERSION}) stable; urgency=medium\n\n  * Automatically generated release for version ${VERSION}.\n\n -- GitHub Actions <actions@github.com>  ${DATE}\n" debian/changelog
-
-      - name: Download binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.goos }}-${{ matrix.job.platform }}
-          path: .
-
-      - name: Unzip binaries
-        run: |
-          mkdir -p ${{ matrix.job.platform }}
-          tar -xzf ${{ matrix.job.goos }}-${{ matrix.job.platform }}.tar.gz -C ${{ matrix.job.platform }}
-
-      - name: Build package for ${{ matrix.job.platform }} arch
-        run: |
-          mv ${{ matrix.job.platform }}/release/apimain debian-build/${{ matrix.job.platform }}/bin/rustdesk-api 
-          mv ${{ matrix.job.platform }}/release/resources/admin resources
-          chmod -v a+x debian-build/${{ matrix.job.platform }}/bin/*
-          mkdir -p data
-          cp -vr debian systemd conf data resources runtime debian-build/${{ matrix.job.platform }}/
-          cat debian/control.tpl | sed 's/{{ ARCH }}/${{ matrix.job.debian_platform }}/' > debian-build/${{ matrix.job.platform }}/debian/control
-          cd debian-build/${{ matrix.job.platform }}/
-          debuild -i -us -uc -b -a${{ matrix.job.debian_platform}}
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.debian_platform }}
-          path: |
-            debian-build/*.deb
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            debian-build/rustdesk-api-server_*_${{ matrix.job.debian_platform }}.deb
-
-  docker:
-    name: Push Docker Image
-    needs: build
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - { platform: "amd64", goos: "linux",  docker_platform: "linux/amd64" }
-          - { platform: "arm64", goos: "linux",  docker_platform: "linux/arm64" }
-          - { platform: "armv7l", goos: "linux",  docker_platform: "linux/arm/v7" }
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Log in to Docker Hub
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}  # Only log in if SKIP_DOCKER_HUB is false
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
-      - name: Log in to GitHub Container Registry
-        if: ${{ env.SKIP_GHCR == 'false' }}  # Only log in if GHCR push is enabled
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract version from tag
-        id: vars
-        run: |
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          else
-            echo "TAG=latest" >> $GITHUB_ENV  # Default to 'latest' if not a tag
-          fi
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v4
-        with:
-          images: ${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api
-
-      - name: Download binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.goos }}-${{ matrix.job.platform }}
-          path: ./
-
-      - name: Unzip binaries
-        run: |
-          mkdir -p ${{ matrix.job.platform }}
-          tar -xzf ${{ matrix.job.goos }}-${{ matrix.job.platform }}.tar.gz -C ${{ matrix.job.platform }}
-
-      - name: Build and push Docker image to Docker Hub ${{ matrix.job.platform }}
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}  # Only run this step if SKIP_DOCKER_HUB is false
-        uses: docker/build-push-action@v5
-        with:
-          context: "."
-          file: ./Dockerfile
-          platforms: ${{ matrix.job.docker_platform }}
-          push: true
-          provenance: false
-          build-args: |
-            BUILDARCH=${{ matrix.job.platform }}
-          tags: |
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.LATEST_TAG }}-${{ matrix.job.platform }},
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-${{ matrix.job.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Build and push Docker image to GHCR ${{ matrix.job.platform }}
-        if: ${{ env.SKIP_GHCR == 'false' }}  # Only run this step if SKIP_GHCR is false
-        uses: docker/build-push-action@v5
-        with:
-          context: "."
-          file: ./Dockerfile
-          platforms: ${{ matrix.job.docker_platform }}
-          push: true
-          provenance: false
-          build-args: |
-            BUILDARCH=${{ matrix.job.platform }}
-          tags: |
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.LATEST_TAG }}-${{ matrix.job.platform }},
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-${{ matrix.job.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  #
-  docker-manifest:
-    name: Push Docker Manifest
-    needs: docker
-    runs-on: ubuntu-latest
-    steps:
-      - name: Extract version from tag
-        id: vars
-        run: |
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          else
-            echo "TAG=latest" >> $GITHUB_ENV  # Default to 'latest' if not a tag
-          fi
-
-      - name: Log in to Docker Hub
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}  # Only log in if Docker Hub push is enabled
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
-      - name: Log in to GitHub Container Registry
-        if: ${{ env.SKIP_GHCR == 'false' }}  # Only log in if GHCR push is enabled
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create and push manifest Docker Hub (:version)
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}
-        uses: Noelware/docker-manifest-action@v0.2.3
-        with:
-          base-image: ${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}
-          extra-images: ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-amd64,
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-armv7l,
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-arm64
-          push: true
-
-      - name: Create and push manifest GHCR (:version)
-        if: ${{ env.SKIP_GHCR == 'false' }}
-        uses: Noelware/docker-manifest-action@v0.2.3
-        with:
-          base-image: ghcr.io/${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}
-          extra-images: ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-amd64,
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-armv7l,
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-arm64
-          push: true
-          amend: true
-
-      - name: Create and push manifest Docker Hub (:latest)
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}
-        uses: Noelware/docker-manifest-action@v0.2.3
-        with:
-          base-image: ${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api:latest
-          extra-images: ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:latest-amd64,
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:latest-armv7l,
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:latest-arm64
-          push: true
-
-      - name: Create and push manifest GHCR (:latest)
-        if: ${{ env.SKIP_GHCR == 'false' }}
-        uses: Noelware/docker-manifest-action@v0.2.3
-        with:
-          base-image: ghcr.io/${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api:latest
-          extra-images: ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:latest-amd64,
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:latest-armv7l,
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:latest-arm64
-          push: true
-          amend: true
\ No newline at end of file
diff --git a/api/.github/workflows/build_test.yml b/api/.github/workflows/build_test.yml
deleted file mode 100644
index 32bbf5f..0000000
--- a/api/.github/workflows/build_test.yml
+++ /dev/null
@@ -1,337 +0,0 @@
-name: Build Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      BASE_IMAGE_NAMESPACE:
-        description: 'Base image namespace (Default: Your Github username)'
-        required: false
-        default: ''
-      DOCKERHUB_IMAGE_NAMESPACE:
-        description: 'Docker Hub image namespace (Default: Your Github username)'
-        required: false
-        default: ''
-      GHCR_IMAGE_NAMESPACE:
-        description: 'GitHub Container Registry image namespace (Default: Your Github username)'
-        required: false
-        default: ''
-      SKIP_DOCKER_HUB:
-        description: 'Set to true to skip pushing to Docker Hub (default: false)'
-        required: false
-        default: 'false'
-      SKIP_GHCR:
-        description: 'Set to true to skip pushing to GHCR (default: false)'
-        required: false
-        default: 'false'
-      WEBCLIENT_SOURCE_LOCATION:
-        description: 'Web Client API Repository'
-        required: true
-        default: 'https://github.com/lejianwen/rustdesk-api-web'
-
-env:
-  LATEST_TAG: latest
-  WEBCLIENT_SOURCE_LOCATION: ${{ github.event.inputs.WEBCLIENT_SOURCE_LOCATION || 'https://github.com/lejianwen/rustdesk-api-web' }}
-  BASE_IMAGE_NAMESPACE: ${{ github.event.inputs.BASE_IMAGE_NAMESPACE || github.actor }}
-  DOCKERHUB_IMAGE_NAMESPACE: ${{ github.event.inputs.DOCKERHUB_IMAGE_NAMESPACE || github.actor }}
-  GHCR_IMAGE_NAMESPACE: ${{ github.event.inputs.GHCR_IMAGE_NAMESPACE || github.actor }}
-  SKIP_DOCKER_HUB: ${{ github.event.inputs.SKIP_DOCKER_HUB || 'false' }}
-  SKIP_GHCR: ${{ github.event.inputs.SKIP_GHCR || 'false' }}
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - { platform: "amd64", goos: "linux", file_ext: "tar.gz" }
-          - { platform: "arm64", goos: "linux", file_ext: "tar.gz" }
-          - { platform: "armv7l", goos: "linux", file_ext: "tar.gz" }
-          - { platform: "amd64", goos: "windows", file_ext: "zip" }
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - uses: actions/checkout@v4
-        with:
-          repository: lejianwen/rustdesk-api-web
-          path: rustdesk-api-web
-          ref: master
-
-      - name: Set up Go environment
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.23'  # 选择 Go 版本
-
-      - name: Set up npm
-        uses: actions/setup-node@v2
-        with:
-          node-version: '20'
-
-      - name: build rustdesk-api-web
-        working-directory: rustdesk-api-web
-        run: |
-          npm install
-          npm run build
-          mkdir -p ../resources/admin/
-          cp -ar dist/* ../resources/admin/
-
-      - name: tidy
-        run: go mod tidy
-
-      - name: swag
-        run: |
-          go install github.com/swaggo/swag/cmd/swag@latest
-          swag init -g cmd/apimain.go --output docs/api --instanceName api --exclude http/controller/admin
-          swag init -g cmd/apimain.go --output docs/admin --instanceName admin --exclude http/controller/api
-
-      - name: Build for ${{ matrix.job.goos }}-${{ matrix.job.platform }}
-        run: |
-          mkdir release -p
-          cp -ar resources release/
-          cp -ar docs release/
-          cp -ar conf release/
-          mkdir -p release/data
-          mkdir -p release/runtime
-          if [ "${{ matrix.job.goos }}" = "windows" ]; then
-            sudo apt-get install gcc-mingw-w64-x86-64 zip -y
-            GOOS=${{ matrix.job.goos }} GOARCH=${{ matrix.job.platform }} CC=x86_64-w64-mingw32-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain.exe ./cmd/apimain.go
-            echo @echo off > release/start.bat
-            echo cmd /c \"%~dp0apimain.exe\" >> release/start.bat
-            zip -r ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}} ./release
-          else
-            if [ "${{ matrix.job.platform }}" = "arm64" ]; then
-                wget https://musl.ljw.red/aarch64-linux-musl-cross.tgz
-                tar -xf aarch64-linux-musl-cross.tgz
-                export PATH=$PATH:$PWD/aarch64-linux-musl-cross/bin
-                GOOS=${{ matrix.job.goos }} GOARCH=${{ matrix.job.platform }} CC=aarch64-linux-musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain ./cmd/apimain.go
-            elif [ "${{ matrix.job.platform }}" = "armv7l" ]; then
-                wget https://musl.ljw.red/armv7l-linux-musleabihf-cross.tgz
-                tar -xf armv7l-linux-musleabihf-cross.tgz
-                export PATH=$PATH:$PWD/armv7l-linux-musleabihf-cross/bin
-                GOOS=${{ matrix.job.goos }} GOARCH=arm GOARM=7 CC=armv7l-linux-musleabihf-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain ./cmd/apimain.go
-            else
-              sudo apt-get install musl musl-dev musl-tools -y
-              GOOS=${{ matrix.job.goos }} GOARCH=${{ matrix.job.platform }} CC=musl-gcc CGO_LDFLAGS="-static" CGO_ENABLED=1 go build -ldflags "-s -w" -o ./release/apimain ./cmd/apimain.go
-            fi
-            tar -czf ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}} ./release
-          fi
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.goos }}-${{ matrix.job.platform }}
-          path: |
-            ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}}
-
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            ${{ matrix.job.goos}}-${{ matrix.job.platform }}.${{matrix.job.file_ext}}
-          tag_name: test
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  deb-package:
-    name: debian package - ${{ matrix.job.platform }}
-    needs: build
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - { platform: "amd64", goos: "linux", debian_platform: "amd64", crossbuild_package: ""}
-          - { platform: "arm64", goos: "linux", debian_platform: "arm64", crossbuild_package: "crossbuild-essential-arm64" }
-          - { platform: "armv7l", goos: "linux", debian_platform: "armhf", crossbuild_package: "crossbuild-essential-armhf" }
-    steps:
-
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Create packaging env
-        run: |
-          sudo apt update
-          DEBIAN_FRONTEND=noninteractive sudo apt install -y devscripts build-essential debhelper pkg-config ${{ matrix.job.crossbuild_package }}
-          mkdir -p debian-build/${{ matrix.job.platform }}/bin
-
-      - name: Download binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.goos }}-${{ matrix.job.platform }}
-          path: .
-
-      - name: Unzip binaries
-        run: |
-          mkdir -p ${{ matrix.job.platform }}
-          tar -xzf ${{ matrix.job.goos }}-${{ matrix.job.platform }}.tar.gz -C ${{ matrix.job.platform }}
-
-      - name: Build package for ${{ matrix.job.platform }} arch
-        run: |
-          mv ${{ matrix.job.platform }}/release/apimain debian-build/${{ matrix.job.platform }}/bin/rustdesk-api 
-          chmod -v a+x debian-build/${{ matrix.job.platform }}/bin/*
-          mkdir -p data
-          cp -vr debian systemd conf data resources runtime debian-build/${{ matrix.job.platform }}/
-          cat debian/control.tpl | sed 's/{{ ARCH }}/${{ matrix.job.debian_platform }}/' > debian-build/${{ matrix.job.platform }}/debian/control
-          cd debian-build/${{ matrix.job.platform }}/
-          debuild -i -us -uc -b -a${{ matrix.job.debian_platform}}
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.debian_platform }}
-          path: |
-            debian-build/*.deb
-
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: test
-          files: |
-            debian-build/rustdesk-api-server_*_${{ matrix.job.debian_platform }}.deb
-
-  docker:
-    name: Push Docker Image
-    needs: build
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - { platform: "amd64", goos: "linux",  docker_platform: "linux/amd64" }
-          - { platform: "arm64", goos: "linux",  docker_platform: "linux/arm64" }
-          - { platform: "armv7l", goos: "linux",  docker_platform: "linux/arm/v7" }
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Log in to Docker Hub
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}  # Only log in if SKIP_DOCKER_HUB is false
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
-      - name: Log in to GitHub Container Registry
-        if: ${{ env.SKIP_GHCR == 'false' }}  # Only log in if GHCR push is enabled
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract version from tag
-        id: vars
-        run: |
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          else
-            echo "TAG=test" >> $GITHUB_ENV  # Default to 'test' if not a tag
-          fi
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v4
-        with:
-          images: ${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api
-
-      - name: Download binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: rustdesk-api-${{ matrix.job.goos }}-${{ matrix.job.platform }}
-          path: ./
-
-      - name: Unzip binaries
-        run: |
-          mkdir -p ${{ matrix.job.platform }}
-          tar -xzf ${{ matrix.job.goos }}-${{ matrix.job.platform }}.tar.gz -C ${{ matrix.job.platform }}
-
-      - name: Build and push Docker image to Docker Hub ${{ matrix.job.platform }}
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}  # Only run this step if SKIP_DOCKER_HUB is false
-        uses: docker/build-push-action@v5
-        with:
-          context: "."
-          file: ./Dockerfile
-          platforms: ${{ matrix.job.docker_platform }}
-          push: true
-          provenance: false
-          build-args: |
-            BUILDARCH=${{ matrix.job.platform }}
-          tags: |
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-${{ matrix.job.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Build and push Docker image to GHCR ${{ matrix.job.platform }}
-        if: ${{ env.SKIP_GHCR == 'false' }}  # Only run this step if SKIP_GHCR is false
-        uses: docker/build-push-action@v5
-        with:
-          context: "."
-          file: ./Dockerfile
-          platforms: ${{ matrix.job.docker_platform }}
-          push: true
-          provenance: false
-          build-args: |
-            BUILDARCH=${{ matrix.job.platform }}
-          tags: |
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-${{ matrix.job.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  #
-  docker-manifest:
-    name: Push Docker Manifest
-    needs: docker
-    runs-on: ubuntu-latest
-    steps:
-      - name: Extract version from tag
-        id: vars
-        run: |
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          else
-            echo "TAG=test" >> $GITHUB_ENV  # Default to 'test' if not a tag
-          fi
-
-      - name: Log in to Docker Hub
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}  # Only log in if Docker Hub push is enabled
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
-
-      - name: Log in to GitHub Container Registry
-        if: ${{ env.SKIP_GHCR == 'false' }}  # Only log in if GHCR push is enabled
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create and push manifest Docker Hub (:version)
-        if: ${{ env.SKIP_DOCKER_HUB == 'false' }}
-        uses: Noelware/docker-manifest-action@v0.2.3
-        with:
-          base-image: ${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}
-          extra-images: ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-amd64,
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-armv7l,
-            ${{ env.DOCKERHUB_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-arm64
-          push: true
-
-      - name: Create and push manifest GHCR (:version)
-        if: ${{ env.SKIP_GHCR == 'false' }}
-        uses: Noelware/docker-manifest-action@v0.2.3
-        with:
-          base-image: ghcr.io/${{ env.BASE_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}
-          extra-images: ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-amd64,
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-armv7l,
-            ghcr.io/${{ env.GHCR_IMAGE_NAMESPACE }}/rustdesk-api:${{ env.TAG }}-arm64
-          push: true
-          amend: true
diff --git a/api/.gitignore b/api/.gitignore
index 2f130c7..3aa0dbd 100644
--- a/api/.gitignore
+++ b/api/.gitignore
@@ -2,7 +2,6 @@
 runtime/*
 !runtime
 !runtime/cache/.gitkeep
-go.sum
 resources/admin
 release
-data/rustdeskapi.db
\ No newline at end of file
+data/rustdeskapi.db
diff --git a/api/Dockerfile b/api/Dockerfile
index c2482da..037bca7 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 ARG BUILDARCH
 WORKDIR /app
diff --git a/api/Dockerfile.dev b/api/Dockerfile.dev
index e9ce3f4..06c4276 100644
--- a/api/Dockerfile.dev
+++ b/api/Dockerfile.dev
@@ -1,10 +1,13 @@
 # Use build arguments for Go version and architecture
-ARG GO_VERSION=1.22
+ARG GO_VERSION=1.25.0
 ARG BUILDARCH=amd64
 
 # Stage 1: Builder Stage
-# FROM golang:${GO_VERSION}-alpine AS builder
-FROM crazymax/xgo:${GO_VERSION} AS builder-backend
+FROM golang:${GO_VERSION}-alpine AS builder-backend
+
+ENV GOTOOLCHAIN=local
+
+RUN apk add --no-cache gcc musl-dev
 
 # Set up working directory
 WORKDIR /app
@@ -15,7 +18,8 @@ COPY . .
 # use --mount=type=cache,target=/go/pkg/mod to cache the go mod
 # Step 2: Download dependencies
 RUN --mount=type=cache,target=/go/pkg/mod \
-    go mod tidy && go mod download && go install github.com/swaggo/swag/cmd/swag@latest
+    go mod download && \
+    go build -mod=readonly -o /usr/local/bin/swag github.com/swaggo/swag/cmd/swag
 
 # Step 3: Run swag build script
 RUN --mount=type=cache,target=/go/pkg/mod \
diff --git a/api/README.md b/api/README.md
index 9960082..50db157 100644
--- a/api/README.md
+++ b/api/README.md
@@ -5,7 +5,7 @@ Embeds admin-ui dist (Vue 3) and web client. Gin + GORM, port 21114.
 
 ## Stack
 
-Go 1.23 · Gin 1.9 · GORM 1.25 · JWT · LDAP · OIDC · Swag
+Go 1.25 · Gin 1.9 · GORM 1.25 · JWT · LDAP · OIDC · Swag
 
 ## Databases
 
@@ -37,11 +37,255 @@ SQLite / MySQL / PostgreSQL — `RUSTDESK_API_GORM_TYPE`.
 
 Details: [AGENTS.md](../AGENTS.md).
 
+## Build handoff provenance
+
+The admin build handoff exports deterministic non-secret file metadata and
+immutable source/workflow identity. `custom_.txt` is never exported. The stored
+publication digest may nevertheless include its private configuration bytes as
+part of the service-owned output proof; that digest is metadata, not disclosure
+of the file contents.
+
+## Custom-build API contracts
+
+The API is mounted under `/api`. The Swagger source annotations use the existing
+`/admin/...` paths with `/api` supplied by the Swagger `basePath`; the concrete HTTP
+paths below include the full `/api` prefix.
+
+### Admin handoff manifest
+
+`GET /api/admin/custom_build/manifest/{id}` (`@Security token`)
+
+- Returns the `response.Response` envelope with `data` as the redacted
+  `service.BuildHandoffManifest`.
+- `X-DeskForge-Manifest-SHA256` is lowercase hexadecimal SHA-256 over the exact
+  response body bytes sent on the wire, including the response envelope. It is not
+  a signature and is not the stored publication digest.
+- The stored `published_digest` covers the service-owned canonical published
+  output (including private `custom_.txt` when present). It has a distinct scope
+  from both the manifest response-byte digest and the public ZIP digest.
+- HTTP errors are `400` for an invalid ID, `409` when a completed verified handoff
+  is unavailable, and `500` for an internal handoff failure. Unknown records retain
+  the legacy HTTP 200 error envelope used by the controller.
+
+### Public capability routes
+
+These routes require no admin token. Possession of the opaque `key` is the
+capability. New capability keys use `download-key-ttl`; when unset or invalid,
+newly created builds use a seven-day TTL. Legacy rows with an expiry of `0` remain
+unexpired.
+
+`GET /api/admin/custom_build/public/detailByKey/{key}`
+
+- Returns `response.Response` with redacted `data` as `model.CustomBuildPublic`.
+- `409` means the build is not publicly ready; `410` means the capability has
+  expired. Unknown keys retain the controller's legacy HTTP 200 error envelope.
+
+`GET /api/admin/custom_build/public/download/{key}`
+
+- Returns the exact redacted ZIP bytes with `Content-Type: application/zip`.
+- `X-DeskForge-Archive-SHA256` hashes the actual ZIP bytes served by this response,
+  not the JSON detail, not a provider asset digest, and not the stored publication
+  digest.
+- `X-DeskForge-Archive-SHA256-Scope` states that same exact-archive scope and
+  explicitly distinguishes it from the stored publication digest.
+- Other response headers include the exact `Content-Length` and an attachment
+  `Content-Disposition` filename. Errors are `408` for cancellation/timeouts,
+  `409` for unavailable completion/output provenance, `410` for expiry, and `500`
+  for packaging or validation failure. Unknown keys retain the legacy HTTP 200
+  error envelope.
+
+Neither digest is a signature. These contracts document the service/provider
+boundary only: there is no signature, attestation, or live provider execution/
+approval claim in this documentation.
+
+### Protected verified-tag approval
+
+`GET /api/admin/github_build_config/workflow_tags` (`@Security token`)
+
+- Returns `response.Response` with `data.tags` containing only safe
+  `service.WorkflowTagOption` values derived from the configured provider.
+- Raw refs, raw SHAs, provider verification objects, PATs, and payload keys are
+  not normal client inputs or response values. Provider/configuration failures are
+  reported as `500`, `502`, or `503` according to the controller classification.
+
+`POST /api/admin/github_build_config/approve_workflow_ref` (`@Security token`)
+
+Request body:
+
+```json
+{"confirm": true, "workflow_tag": "<label selected from workflow_tags>"}
+```
+
+Approval requires all of the following at the provider boundary:
+
+- a provider-derived annotated tag with `verified=true` and an accepted provider
+  verification reason;
+- positive protection evidence for that exact tag from the supported modern
+  ruleset surface, with no bypass actor and no tag/branch collision;
+- the owned workflow is present and ready at the provider-resolved commit.
+
+The successful response is `response.Response` with `data` as the secret-free
+`model.GithubBuildConfigSafe`. Invalid selectors or approval requests return
+`400`; provider/configuration failures return `500`, `502`, or `503`. The legacy
+validation envelope for malformed JSON or `confirm != true` remains HTTP 200 with
+a nonzero response code.
+
+This is a contract description, not live-provider evidence. No live GitHub/provider
+approval, dispatch, run, artifact, signature, or attestation claim is made.
+
+## Swagger source and generated output
+
+The controller comments are the source Swagger annotation updates for these routes.
+The generated Swagger documents under `api/docs/**` are synchronized with those
+source annotations and are regenerated from them when the annotations change.
+
+## Workflow protection evidence
+
+Workflow-ref approval requires a provider-derived, verified annotated tag and
+one modern provider-verified ruleset surface for the exact tag label. The modern
+ruleset surface is authoritative and the only supported protection surface;
+initial list, later page, detail, policy, and contract failures all fail closed:
+
+- modern `GET /repos/{owner}/{repo}/rulesets?targets=tag&includes_parents=true`, bounded to
+  three pages and 256 rulesets, discovers candidate IDs only. DeskForge then
+  consumes `GET /repos/{owner}/{repo}/rulesets/{id}?includes_parents=true` and
+  validates the repository-scoped detail metadata (`name`, `source`, and
+  `source_type` in `Repository`, `Organization`, or `Enterprise`; documented
+  `created_at` and `updated_at` values are type-checked when present). The
+  repository-scoped `includes_parents=true` response establishes applicability
+  at the provider boundary. DeskForge requires `conditions.ref_name` for tag
+  matching and does not independently evaluate `repository_name`,
+  `repository_id`, or `repository_property` selectors. The separate
+  organization authoring endpoint, `POST /orgs/{org}/rulesets`, uses repository
+  selectors to define where a ruleset applies; that create-schema requirement
+  must not be imposed on repository-scoped inherited detail responses. Unknown
+  condition fields and malformed condition values fail closed. Excludes win.
+  `tag_name_pattern` is validated only as rule metadata; it is not the ref
+  selector, and no `fnmatch` rule is required for selection. For tag rules,
+  `update` without parameters is valid; when parameters are present they must
+  be a strict object containing the boolean
+  `update_allows_fetch_and_merge`. Null, empty, malformed, or unknown parameter
+  objects fail closed. Branch-target rules continue to require that parameter.
+  Every applicable ruleset must expose `bypass_actors: []` and
+  `current_user_can_bypass: "never"`; any applicable bypass actor or other
+  current-user bypass mode rejects approval. Effective `update` and `deletion`
+  rules may be split across matching rulesets. Other documented known rules are
+  neutral or stronger additions, while unknown or malformed rules fail closed.
+  Inherited parent rulesets use the same checks;
+- the provider must reject a tag/branch collision for the same label, and the
+  tag's verification must report `verified=true` with the accepted provider
+  verification reason. Raw SHA selectors are not approval inputs.
+
+The former tag-protection LIST compatibility path is **CONFIRMED OBSOLETE**:
+the GitHub.com provider is hard-wired to `https://api.github.com`, DeskForge has
+no configurable GHES base URL or provider, and current GitHub documentation marks
+that legacy surface as closing down/removed. A GHES installation may have a
+historical `enabled`/`pattern` schema, but it is separate context rather than a
+DeskForge capability. A mismatch, absent evidence, any bypass actor, or
+an active applicable ruleset without effective update and deletion protection
+never proves protection.
+
+### Recorded ruleset provider evidence
+
+The endpoint distinction follows the [organization ruleset creation
+documentation](https://docs.github.com/en/rest/orgs/rules#create-an-organization-repository-ruleset),
+the [repository ruleset detail documentation](https://docs.github.com/en/rest/repos/rules#get-a-repository-ruleset),
+and the [tag protection LIST documentation](https://docs.github.com/en/rest/repos/tags#get-all-tag-protection-states-for-a-repository).
+
+On 2026-08-14, an authenticated observation of `github/docs` returned the
+following summary from the repository-scoped list endpoint:
+
+```text
+GET https://api.github.com/repos/github/docs/rulesets?targets=tag&includes_parents=true&per_page=100
+=> id=18281681, target=tag, source_type=Organization, source=github, enforcement=active
+```
+
+The summary did not contain conditions, rules, or bypass metadata. The matching
+repository-scoped detail was:
+
+```text
+GET https://api.github.com/repos/github/docs/rulesets/18281681?includes_parents=true
+```
+
+It was ruleset `18281681` (`Enterprise Tags`) with
+`conditions.ref_name` only and these exact include patterns:
+
+```text
+refs/tags/enterprise-[0-9].*-freeze
+refs/tags/enterprise-[0-9].[0-9].[0-9]
+refs/tags/enterprise-[0-9].[0-9].[0-9][0-9]
+refs/tags/enterprise-[0-9].[0-9][0-9].[0-9]
+refs/tags/enterprise-[0-9].[0-9][0-9].[0-9][0-9]
+refs/tags/enterprise-[0-9].*.pre[0-9]
+refs/tags/enterprise-[0-9].*.pre[0-9][0-9]
+refs/tags/enterprise-[0-9].*.gm[0-9]
+refs/tags/enterprise-[0-9].*.gm[0-9][0-9]
+refs/tags/enterprise-[0-9].*.rc[0-9]
+refs/tags/enterprise-[0-9].*.rc[0-9][0-9]
+```
+
+Its rules were `deletion`, `non_fast_forward`, `creation`, and `update` with
+no parameters; `created_at` was `2026-06-30T07:19:50.340+11:00`,
+`updated_at` was `2026-06-30T07:20:37.936+11:00`, and
+`current_user_can_bypass` was `never`. `bypass_actors` was omitted because the
+observing token lacked write access. DeskForge therefore uses
+`bypass_actors: []` as the positive write-authorized contract fixture and fails
+closed when the field is omitted. This observation is provider evidence, not a
+completed live approval, dispatch, or release claim. Initial and later ruleset
+list failures, detail failures, policy failures, and contract failures remain
+failures.
+
+The stored PAT must have the provider's repository Metadata read, Contents read,
+Actions read, and Administration write permissions for the read-only checks.
+GitHub's Get repository ruleset endpoint only returns `bypass_actors` when the
+caller has write access to the ruleset, so Administration read is insufficient;
+the elevated permission is required to observe bypass actors and fail closed.
+Dispatch also requires Actions write. Secret synchronization additionally
+requires the repository Secrets write permission. Exact fine-grained PAT
+availability and permissions are repository/provider settings, not proven by
+local fake-transport tests.
+
+This policy is a provider-boundary contract, not live-provider evidence: the
+worktree has focused fake-transport coverage but no live GitHub/provider
+approval, dispatch, run, or artifact pass. Dispatch requires the provider's
+exact HTTP 200 run-details response with `return_run_details=true`; a standard
+204 response and latest-run inference are unsupported. The local pending →
+building identity write is atomic, but there is no durable outbox or distributed
+lease coordinating provider dispatch with that database write. A provider
+dispatch can therefore succeed while the local write fails; no end-to-end
+atomic-dispatch claim is made.
+
+## Schema and secret compatibility evidence
+
+The published DeskForge API schema is `DatabaseVersion` **272**. The current
+uncommitted corrective worktree targets local schema **282** and is not published
+or live-provider evidence. The additive workflow-approval fields are:
+
+- **280** — `workflow_ref_approved`, the persisted approval status;
+- **281** — `workflow_ref_provider_verified`, the persisted provider-policy
+  verification status;
+- **282** — `workflow_ref_approval_sha`, the provider-resolved commit recorded
+  for the approved tag.
+
+`AutoMigrate` keeps legacy rows readable. Legacy plaintext PAT/payload-key
+metadata remains readable, and metadata-only configuration saves preserve those
+legacy values without requiring `SECRET_ENCRYPTION_KEY`. New or replaced
+non-empty secret writes require that key; when it is available, resaving a
+legacy row encrypts its plaintext secrets. Secret values are never returned in
+the safe configuration view.
+
 ## Quick start
 
 ```bash
 cd api
 go build -o release/apimain cmd/apimain.go
-go vet ./...
-go test ./...
+# Broad local checks:
+GOWORK=off go vet ./...
+GOWORK=off go test ./...
 ```
+
+Both broad checks pass after test-only cache diagnostics and opt-in Redis test
+changes. Redis integration tests and benchmarks run only when
+`DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded.
+MySQL/PostgreSQL, live provider, and the other release/build gates remain
+unverified.
diff --git a/api/build.sh b/api/build.sh
index a4474c7..0bf0b03 100644
--- a/api/build.sh
+++ b/api/build.sh
@@ -1,6 +1,7 @@
 #!/bin/sh
 
 set -e
+export GOTOOLCHAIN=local
 # Automatically get the current environment's GOARCH; if not defined, use the detected system architecture
 GOARCH=${GOARCH:-$(go env GOARCH)}
 DOCS="true"
@@ -20,7 +21,7 @@ if [ -n "${DOCS}" ]; then
     # Check if swag is installed
     if ! command -v swag &> /dev/null; then
         echo "swag command not found. Please install it using:"
-        echo "go install github.com/swaggo/swag/cmd/swag@latest"
+        echo "go install github.com/swaggo/swag/cmd/swag@v1.16.3"
         echo "Skipping Swagger documentation generation due to missing swag tool."
     else
         echo "Generating Swagger documentation..."
@@ -43,4 +44,4 @@ cp -ar conf release/
 mkdir -p release/data
 mkdir -p release/runtime
 
-echo "Build and setup completed successfully."
\ No newline at end of file
+echo "Build and setup completed successfully."
diff --git a/api/cmd/apimain.go b/api/cmd/apimain.go
index 249639b..639bdc5 100644
--- a/api/cmd/apimain.go
+++ b/api/cmd/apimain.go
@@ -1,4 +1,4 @@
-package main
+package main
 
 import (
 	"fmt"
@@ -7,6 +7,8 @@ import (
 	"time"
 
 	"github.com/go-redis/redis/v8"
+	"github.com/spf13/cobra"
+	"gorm.io/gorm"
 	"rustdesk-server/api/config"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http"
@@ -20,20 +22,33 @@ import (
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
 	"rustdesk-server/api/utils"
-	"github.com/spf13/cobra"
 )
 
-// DatabaseVersion bumped to 272 in 2026-06-21 to add the `server_cmd_states`
-// table for persisting admin server-command state across restarts (BUGS.md
-// AU-C-001). Earlier bumps: 271 `server_cmd_audits` (AU-S-001), 270
+// DatabaseVersion bumped to 282 in 2026-08-11 to persist the exact provider
+// resolved SHA captured by immutable workflow-tag approval. Earlier bump: 281
+// persisted workflow-ref provider
+// policy status alongside the operator approval attestation. Earlier bump: 280
+// persisted workflow-ref approval
+// status. Earlier bump: 279 in 2026-08-10 to persist validated producer
+// manifest provenance for deterministic handoff exports. Earlier bump: 278
+// persisted the exact workflow
+// dispatch selector separately from the resolved execution SHA. Earlier bump:
+// 277 added release asset provenance.
+// Earlier bump: 276 added the service-generated
+// publication digest on custom builds. Earlier bump: 275 added the publication
+// marker. Earlier bump: 274 added immutable
+// version/build-ref identity fields on `custom_builds` (PR5 / Phase 5). Earlier bump: 273 added
+// immutable GitHub build provenance fields (PR4 / Phase 4). Earlier bumps: 272
+// `server_cmd_states` for persisting admin server-command state across
+// restarts (BUGS.md AU-C-001), 271 `server_cmd_audits`, 270
 // `download_key_expires_at` on `custom_builds` for capability-URL expiry
 // (B-006), 269 `github_run_id` for restart-safe GitHub Actions polling (B-003).
 // AutoMigrate is idempotent so all tables/columns are still created.
-const DatabaseVersion = 272
+const DatabaseVersion = 282
 
 // @title API
 // @version 1.0
-// @description 
+// @description
 // @basePath /api
 // @securityDefinitions.apikey token
 // @in header
@@ -45,8 +60,8 @@ const DatabaseVersion = 272
 var rootCmd = &cobra.Command{
 	Use:   "apimain",
 	Short: "RUSTDESK API SERVER",
-	PersistentPreRun: func(cmd *cobra.Command, args []string) {
-		InitGlobal()
+	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+		return InitGlobal()
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		global.Logger.Info("API SERVER START")
@@ -116,7 +131,7 @@ func main() {
 	}
 }
 
-func InitGlobal() {
+func InitGlobal() error {
 
 	global.Viper = config.Init(&global.Config, global.ConfigPath)
 
@@ -215,7 +230,9 @@ func InitGlobal() {
 		BanDuration:      30 * time.Minute,
 	})
 	global.LoginLimiter.RegisterProvider(utils.B64StringCaptchaProvider{})
-	DatabaseAutoUpdate()
+	if err := DatabaseAutoUpdate(); err != nil {
+		return err
+	}
 
 	// Возобновить поллинг in-flight GitHub-сборок после рестарта (BUGS.md B-003).
 	// Запускается ПОСЛЕ AutoMigrate — иначе колонки github_run_id может ещё не быть.
@@ -223,9 +240,10 @@ func InitGlobal() {
 	// AU-C-001: переприменяем сохранённые server-команды (relay/aur/ml/blocklist),
 	// иначе они откатываются к env/файлам при рестарте.
 	admin.ReplayServerCmds()
+	return nil
 }
 
-func DatabaseAutoUpdate() {
+func DatabaseAutoUpdate() error {
 	version := DatabaseVersion
 
 	db := global.DB
@@ -250,7 +268,7 @@ func DatabaseAutoUpdate() {
 			sqlDBWithoutDB, err := dbWithoutDB.DB()
 			if err != nil {
 				global.Logger.Errorf(" *sql.DB : %v", err)
-				return
+				return err
 			}
 			defer func() {
 				if err := sqlDBWithoutDB.Close(); err != nil {
@@ -261,19 +279,23 @@ func DatabaseAutoUpdate() {
 			err = dbWithoutDB.Exec("CREATE DATABASE IF NOT EXISTS " + dbName + " DEFAULT CHARSET utf8mb4").Error
 			if err != nil {
 				global.Logger.Error(err)
-				return
+				return err
 			}
 		}
 	}
 
 	if !db.Migrator().HasTable(&model.Version{}) {
-		Migrate(uint(version))
+		if err := Migrate(uint(version)); err != nil {
+			return err
+		}
 	} else {
 		//version
 		var v model.Version
 		db.Last(&v)
 		if v.Version < uint(version) {
-			Migrate(uint(version))
+			if err := Migrate(uint(version)); err != nil {
+				return err
+			}
 		}
 
 		// 245
@@ -295,38 +317,51 @@ func DatabaseAutoUpdate() {
 			db.Exec("update oauths set issuer = 'https://accounts.google.com' where op = 'google' and issuer is null")
 		}
 	}
+	return nil
+}
 
+func migrateSchemaAndRecordVersion(db *gorm.DB, version uint, migrate func(*gorm.DB) error) error {
+	if err := migrate(db); err != nil {
+		return fmt.Errorf("auto migrate: %w", err)
+	}
+	if err := db.Create(&model.Version{Version: version}).Error; err != nil {
+		return fmt.Errorf("record database version %d: %w", version, err)
+	}
+	return nil
 }
-func Migrate(version uint) {
+
+func Migrate(version uint) error {
 	global.Logger.Info("Migrating....", version)
-	err := global.DB.AutoMigrate(
-		&model.Version{},
-		&model.User{},
-		&model.UserToken{},
-		&model.Tag{},
-		&model.AddressBook{},
-		&model.Peer{},
-		&model.Group{},
-		&model.UserThird{},
-		&model.Oauth{},
-		&model.LoginLog{},
-		&model.ShareRecord{},
-		&model.AuditConn{},
-		&model.AuditFile{},
-		&model.AddressBookCollection{},
-		&model.AddressBookCollectionRule{},
-		&model.ServerCmd{},
-		&model.DeviceGroup{},
-		&model.CustomBuild{},
-		&model.CustomPreset{},
-		&model.GithubBuildConfig{},
-		&model.ServerCmdAudit{},
-		&model.ServerCmdState{},
-	)
+	err := migrateSchemaAndRecordVersion(global.DB, version, func(db *gorm.DB) error {
+		return db.AutoMigrate(
+			&model.Version{},
+			&model.User{},
+			&model.UserToken{},
+			&model.Tag{},
+			&model.AddressBook{},
+			&model.Peer{},
+			&model.Group{},
+			&model.UserThird{},
+			&model.Oauth{},
+			&model.LoginLog{},
+			&model.ShareRecord{},
+			&model.AuditConn{},
+			&model.AuditFile{},
+			&model.AddressBookCollection{},
+			&model.AddressBookCollectionRule{},
+			&model.ServerCmd{},
+			&model.DeviceGroup{},
+			&model.CustomBuild{},
+			&model.CustomPreset{},
+			&model.GithubBuildConfig{},
+			&model.ServerCmdAudit{},
+			&model.ServerCmdState{},
+		)
+	})
 	if err != nil {
 		global.Logger.Error("migrate err :=>", err)
+		return err
 	}
-	global.DB.Create(&model.Version{Version: version})
 
 	var vc int64
 	global.DB.Model(&model.Version{}).Count(&vc)
@@ -361,5 +396,5 @@ func Migrate(version uint) {
 		}
 		global.DB.Create(admin)
 	}
-
+	return nil
 }
diff --git a/api/cmd/apimain_test.go b/api/cmd/apimain_test.go
new file mode 100644
index 0000000..acf1e35
--- /dev/null
+++ b/api/cmd/apimain_test.go
@@ -0,0 +1,34 @@
+package main
+
+import (
+	"errors"
+	"testing"
+
+	"rustdesk-server/api/model"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestMigrateSchemaAndRecordVersionFailsClosed(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := db.AutoMigrate(&model.Version{}); err != nil {
+		t.Fatalf("create version table: %v", err)
+	}
+	wantErr := errors.New("schema migration failed")
+	if err := migrateSchemaAndRecordVersion(db, DatabaseVersion, func(*gorm.DB) error {
+		return wantErr
+	}); !errors.Is(err, wantErr) {
+		t.Fatalf("migrateSchemaAndRecordVersion() error = %v, want %v", err, wantErr)
+	}
+	var count int64
+	if err := db.Model(&model.Version{}).Count(&count).Error; err != nil {
+		t.Fatalf("count database versions: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("database version count = %d, want 0 after migration failure", count)
+	}
+}
diff --git a/api/conf/config.yaml b/api/conf/config.yaml
index f82069f..57beb32 100644
--- a/api/conf/config.yaml
+++ b/api/conf/config.yaml
@@ -1,15 +1,15 @@
 lang: "en"
 app:
-  web-client: 1  # 1: 0:
-  register: false #
-  register-status: 1 #  1: 2:
+  web-client: 1  # 1: enabled; 0: disabled
+  register: false # allow self-registration when true
+  register-status: 1 # 1: enabled user; 2: disabled pending admin approval
   captcha-threshold: 3 #   <0:disabled, 0 always, >0:enabled
   ban-threshold: 0 # 0:disabled, >0:enabled
-  show-swagger: 0 # 1: 0:
+  show-swagger: 0 # 1: enabled; 0: disabled
   token-expire: 168h
   web-sso: true #web auth sso
   disable-pwd-login: false #
-  api-base: "" # public URL where build agents can fetch uploaded images, e.g. http://your-server:21114
+  api-base: "" # reserved public base URL; provider-backed builds do not use agent callbacks
   download-key-ttl: 168h # custom-build download capability URL lifetime (BUGS.md B-006); <=0 => 7d default
 
 admin:
@@ -18,11 +18,11 @@ admin:
   hello: ""
   # ID Server and Relay Server ports
   id-server-port: 21116  # ID Server port (for server cmd)
-  relay-server-port: 21117 # ID Server port (for server cmd)
+  relay-server-port: 21117 # Relay server port (for server cmd)
 gin:
   api-addr: "0.0.0.0:21114"
-  mode: "release" #release,debug,test
-  resources-path: 'resources'  #
+  mode: "release" # release, debug, or test
+  resources-path: 'resources'  # embedded/static resource directory
   trust-proxy: ""
 gorm:
   type: "sqlite"
@@ -49,10 +49,10 @@ rustdesk:
   relay-server: "192.168.1.66:21117"
   api-server: "http://127.0.0.1:21114"
   key: ""
-  key-file: "/data/id_ed25519.pub"
+  key-file: "/data/id_ed25519.pub" # current contract: hbbs-generated public key file
   personal: 1
   webclient-magic-queryonline: 0
-  ws-host: ""  #eg: wss://192.168.1.3:4443
+  ws-host: ""  # public WebSocket host, e.g. wss://192.168.1.3:4443
 logger:
   path: "./runtime/log.txt"
   level: "info" #trace,debug,info,warn,error,fatal
diff --git a/api/config/rustdesk.go b/api/config/rustdesk.go
index c93cf8f..dff49b3 100644
--- a/api/config/rustdesk.go
+++ b/api/config/rustdesk.go
@@ -1,12 +1,18 @@
 package config
 
 import (
+	"encoding/base64"
+	"errors"
+	"fmt"
 	"os"
+	"strings"
+	"unicode"
 )
 
 const (
 	DefaultIdServerPort    = 21116
 	DefaultRelayServerPort = 21117
+	rustDeskPublicKeyBytes = 32
 )
 
 type Rustdesk struct {
@@ -21,20 +27,124 @@ type Rustdesk struct {
 	//webclient-magic-queryonline
 	WebclientMagicQueryonline int    `mapstructure:"webclient-magic-queryonline"`
 	WsHost                    string `mapstructure:"ws-host"`
+	keyLoadErr                error
 }
 
-func (rd *Rustdesk) LoadKeyFile() {
+// PublicKeyConfigurationError reports a key-file/configuration problem without
+// exposing key material. A missing key is allowed during process startup, but
+// callers entering a custom-build capability must handle this error.
+type PublicKeyConfigurationError struct {
+	Path   string
+	Reason string
+	Cause  error
+}
+
+func (e *PublicKeyConfigurationError) Error() string {
+	if e.Path != "" {
+		return fmt.Sprintf("public key %q is unavailable: %s", e.Path, e.Reason)
+	}
+	return "public key is unavailable: " + e.Reason
+}
+
+func (e *PublicKeyConfigurationError) Unwrap() error { return e.Cause }
+
+// NormalizePublicKey removes only the line terminator emitted by the
+// RustDesk server's id_ed25519.pub file. Other whitespace remains material and
+// is rejected by ValidatePublicKeyMaterial.
+func NormalizePublicKey(value string) string {
+	return strings.TrimRight(value, "\r\n")
+}
+
+// ValidatePublicKeyMaterial validates the public-key format consumed by the
+// RustDesk client: canonical padded standard base64 encoding of a 32-byte
+// Ed25519 public key. The key bytes are never included in the returned error.
+func ValidatePublicKeyMaterial(value string) error {
+	value = NormalizePublicKey(value)
+	if value == "" {
+		return &PublicKeyConfigurationError{Reason: "public key is missing"}
+	}
+	if strings.TrimSpace(value) == "" {
+		return &PublicKeyConfigurationError{Reason: "public key is whitespace-only"}
+	}
+	for _, char := range value {
+		if unicode.IsControl(char) {
+			return &PublicKeyConfigurationError{Reason: "public key contains unsafe control characters"}
+		}
+	}
+	decoded, err := base64.StdEncoding.DecodeString(value)
+	if err != nil {
+		return &PublicKeyConfigurationError{Reason: "public key is not valid RustDesk base64"}
+	}
+	if len(decoded) != rustDeskPublicKeyBytes || base64.StdEncoding.EncodeToString(decoded) != value {
+		return &PublicKeyConfigurationError{Reason: "public key must be canonical base64 for 32 bytes"}
+	}
+	return nil
+}
+
+func (rd *Rustdesk) LoadKeyFile() error {
+	rd.keyLoadErr = nil
 	// Load key file
 	if rd.Key != "" {
-		return
+		rd.Key = NormalizePublicKey(rd.Key)
+		if rd.Key == "" {
+			rd.keyLoadErr = &PublicKeyConfigurationError{Reason: "configured value is empty"}
+			return rd.keyLoadErr
+		}
+		return nil
 	}
 	if rd.KeyFile != "" {
 		// Load key from file
 		b, err := os.ReadFile(rd.KeyFile)
 		if err != nil {
-			return
+			rd.keyLoadErr = &PublicKeyConfigurationError{Path: rd.KeyFile, Reason: "file cannot be read", Cause: err}
+			return rd.keyLoadErr
+		}
+		// The generated public-key file is line-oriented. Remove only its
+		// record terminator; internal content and other whitespace remain part
+		// of the value for the BuildSpec boundary to validate.
+		rd.Key = NormalizePublicKey(string(b))
+		if rd.Key == "" {
+			rd.keyLoadErr = &PublicKeyConfigurationError{Path: rd.KeyFile, Reason: "file is empty"}
+			return rd.keyLoadErr
+		}
+		return nil
+	}
+	return nil
+}
+
+// RequirePublicKey is the capability-time check. It intentionally does not
+// make startup fail for deployments that configure the key later.
+func (rd *Rustdesk) RequirePublicKey() error {
+	if rd == nil {
+		return &PublicKeyConfigurationError{Reason: "configuration is missing"}
+	}
+	if rd.keyLoadErr != nil {
+		return rd.keyLoadErr
+	}
+	rd.Key = NormalizePublicKey(rd.Key)
+	if rd.Key == "" {
+		if rd.KeyFile != "" {
+			return &PublicKeyConfigurationError{Path: rd.KeyFile, Reason: "key file did not provide a key"}
+		}
+		return &PublicKeyConfigurationError{Reason: "no key or key-file is configured"}
+	}
+	if err := ValidatePublicKeyMaterial(rd.Key); err != nil {
+		if rd.KeyFile != "" {
+			var keyErr *PublicKeyConfigurationError
+			if errors.As(err, &keyErr) {
+				keyErr.Path = rd.KeyFile
+			}
 		}
-		rd.Key = string(b)
-		return
+		return err
+	}
+	return nil
+}
+
+// KeyLoadError exposes the non-secret load result for diagnostics/tests while
+// keeping key bytes out of error values.
+func (rd *Rustdesk) KeyLoadError() error {
+	if rd == nil {
+		return errors.New("rustdesk configuration is missing")
 	}
+	return rd.keyLoadErr
 }
diff --git a/api/config/rustdesk_test.go b/api/config/rustdesk_test.go
new file mode 100644
index 0000000..cc0b6d6
--- /dev/null
+++ b/api/config/rustdesk_test.go
@@ -0,0 +1,111 @@
+package config
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadKeyFileRemovesOnlyTrailingLineEndings(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "id_ed25519.pub")
+	if err := os.WriteFile(path, []byte("public\nkey\r\n"), 0600); err != nil {
+		t.Fatalf("write key file: %v", err)
+	}
+
+	rd := Rustdesk{KeyFile: path}
+	rd.LoadKeyFile()
+	if rd.Key != "public\nkey" {
+		t.Fatalf("loaded key = %q, want only trailing CR/LF removed", rd.Key)
+	}
+}
+
+func TestLoadKeyNormalizesConfiguredTrailingLineEndings(t *testing.T) {
+	const valid = "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM="
+	rd := Rustdesk{Key: valid + "\r\n"}
+	rd.LoadKeyFile()
+	if rd.Key != valid {
+		t.Fatalf("configured key = %q, want trailing CR/LF removed", rd.Key)
+	}
+	if err := rd.RequirePublicKey(); err != nil {
+		t.Fatalf("RequirePublicKey() error = %v, want normalized RustDesk key accepted", err)
+	}
+}
+
+func TestLoadKeyFileFailsClosedOnlyAtCapabilityTime(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		setup   func(*Rustdesk)
+		wantErr string
+	}{
+		{name: "missing file", setup: func(rd *Rustdesk) { rd.KeyFile = filepath.Join(t.TempDir(), "missing.pub") }, wantErr: "file cannot be read"},
+		{name: "empty file", setup: func(rd *Rustdesk) {
+			rd.KeyFile = filepath.Join(t.TempDir(), "empty.pub")
+			if err := os.WriteFile(rd.KeyFile, []byte("\r\n"), 0600); err != nil {
+				t.Fatal(err)
+			}
+		}, wantErr: "file is empty"},
+		{name: "empty configured value", setup: func(rd *Rustdesk) { rd.Key = "\r\n" }, wantErr: "configured value is empty"},
+		{name: "not configured", setup: func(*Rustdesk) {}, wantErr: "no key or key-file is configured"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			rd := Rustdesk{}
+			test.setup(&rd)
+			if err := rd.LoadKeyFile(); err != nil && !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("LoadKeyFile() error = %v, want %q", err, test.wantErr)
+			}
+			err := rd.RequirePublicKey()
+			var keyErr *PublicKeyConfigurationError
+			if !errors.As(err, &keyErr) || !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("RequirePublicKey() error = %T %v, want PublicKeyConfigurationError containing %q", err, err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestValidatePublicKeyMaterialUsesRustDeskEd25519Base64Format(t *testing.T) {
+	const valid = "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM="
+	for _, test := range []struct {
+		name    string
+		value   string
+		wantErr string
+	}{
+		{name: "valid", value: valid},
+		{name: "valid trailing line endings", value: valid + "\r\n"},
+		{name: "missing", value: "", wantErr: "missing"},
+		{name: "whitespace-only", value: " \t\r\n", wantErr: "whitespace-only"},
+		{name: "control", value: valid[:10] + "\x00" + valid[10:], wantErr: "control"},
+		{name: "malformed base64", value: "not-a-rustdesk-key", wantErr: "base64"},
+		{name: "wrong decoded length", value: "cHVibGljLWtleQ==", wantErr: "32 bytes"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidatePublicKeyMaterial(test.value)
+			if test.wantErr == "" {
+				if err != nil {
+					t.Fatalf("ValidatePublicKeyMaterial() error = %v, want valid key", err)
+				}
+				return
+			}
+			var keyErr *PublicKeyConfigurationError
+			if !errors.As(err, &keyErr) || !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("ValidatePublicKeyMaterial() error = %T %v, want PublicKeyConfigurationError containing %q", err, err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestRequirePublicKeyFailsClosedForMalformedConfiguredMaterial(t *testing.T) {
+	for _, value := range []string{" \t", "public\x00key", "public-key", "cHVibGljLWtleQ=="} {
+		t.Run(value, func(t *testing.T) {
+			rd := Rustdesk{Key: value}
+			if err := rd.LoadKeyFile(); err != nil {
+				t.Fatalf("LoadKeyFile() error = %v, want deferred capability validation", err)
+			}
+			var keyErr *PublicKeyConfigurationError
+			if err := rd.RequirePublicKey(); !errors.As(err, &keyErr) {
+				t.Fatalf("RequirePublicKey() error = %T %v, want typed public-key error", err, err)
+			}
+		})
+	}
+}
diff --git a/api/docker-compose-dev.yaml b/api/docker-compose-dev.yaml
index b4ab5d2..8e866e5 100644
--- a/api/docker-compose-dev.yaml
+++ b/api/docker-compose-dev.yaml
@@ -1,3 +1,7 @@
+# LEGACY API-only compose example (not the current combined stack).
+# Current key contract: mount the hbbs-generated public key at
+# /data/id_ed25519.pub and use RUSTDESK_API_KEY_FILE; the obsolete raw-key
+# placeholder is intentionally not used here.
 services:
   rustdesk-api:
     build: 
@@ -11,14 +15,17 @@ services:
     container_name: rustdesk-api
     environment:
       - TZ=Asia/Shanghai
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-}
       - RUSTDESK_API_RUSTDESK_ID_SERVER=192.168.1.66:21116
       - RUSTDESK_API_RUSTDESK_RELAY_SERVER=192.168.1.66:21117
       - RUSTDESK_API_RUSTDESK_API_SERVER=http://127.0.0.1:21114
-      - RUSTDESK_API_RUSTDESK_KEY=123456789
+      - RUSTDESK_API_KEY_FILE=/data/id_ed25519.pub
     ports:
       - 21114:21114
     volumes:
       - ./data/rustdesk/api:/app/data #
       - ./conf:/app/conf # config
+      # Mount the server data directory read-only when the builder needs the key:
+      # - ../data/server:/data:ro
       # - ./resources:/app/resources # 
     restart: unless-stopped
diff --git a/api/docker-compose.override.yaml b/api/docker-compose.override.yaml
index e953f66..b57eae2 100644
--- a/api/docker-compose.override.yaml
+++ b/api/docker-compose.override.yaml
@@ -1,12 +1,17 @@
+# LEGACY API-only compose override (not the current combined stack).
+# Current key contract: mount the hbbs-generated public key at
+# /data/id_ed25519.pub and use RUSTDESK_API_KEY_FILE; the obsolete raw-key
+# placeholder is intentionally not used here.
 services:
   rustdesk-api:
     ports:
       - 21114:21114
     environment:
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-}
       - RUSTDESK_API_RUSTDESK_ID_SERVER=192.168.1.66:21116
       - RUSTDESK_API_RUSTDESK_RELAY_SERVER=192.168.1.66:21117
       - RUSTDESK_API_RUSTDESK_API_SERVER=http://127.0.0.1:21114
-      - RUSTDESK_API_RUSTDESK_KEY=123456789
+      - RUSTDESK_API_KEY_FILE=/data/id_ed25519.pub
       - RUSTDESK_API_RUSTDESK_PERSONAL=1
       - RUSTDESK_API_JWT_KEY=test-jwt-key-12345
       - RUSTDESK_API_LANG=en
@@ -15,3 +20,5 @@ services:
       - ./resources:/app/resources
       - ./data/rustdesk/api:/app/data
       - ./conf:/app/conf
+      # Mount the server data directory read-only when the builder needs the key:
+      # - ../data/server:/data:ro
diff --git a/api/docker-compose.yaml b/api/docker-compose.yaml
index ecfd140..80d9f45 100644
--- a/api/docker-compose.yaml
+++ b/api/docker-compose.yaml
@@ -1,17 +1,24 @@
+# LEGACY API-only compose example (not the current combined stack).
+# Current key contract: mount the hbbs-generated public key at
+# /data/id_ed25519.pub and use RUSTDESK_API_KEY_FILE; the obsolete raw-key
+# placeholder is intentionally not used here.
 services:
   rustdesk-api:
     image: rustdesk-server/api
     container_name: rustdesk-api
     environment:
       - TZ=Asia/Shanghai
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-}
       - RUSTDESK_API_RUSTDESK_ID_SERVER=192.168.1.66:21116
       - RUSTDESK_API_RUSTDESK_RELAY_SERVER=192.168.1.66:21117
       - RUSTDESK_API_RUSTDESK_API_SERVER=http://127.0.0.1:21114
-      - RUSTDESK_API_RUSTDESK_KEY=123456789
+      - RUSTDESK_API_KEY_FILE=/data/id_ed25519.pub
     ports:
       - 21114:21114
     volumes:
       - ./data/rustdesk/api:/app/data # database
       # - ./conf:/app/conf # config
       # - ./resources:/app/resources # 
-    restart: unless-stopped
\ No newline at end of file
+      # Mount the server data directory read-only when the builder needs the key:
+      # - ../data/server:/data:ro
+    restart: unless-stopped
diff --git a/api/docs/admin/admin_docs.go b/api/docs/admin/admin_docs.go
index 7fbbe8d..25d2e65 100644
--- a/api/docs/admin/admin_docs.go
+++ b/api/docs/admin/admin_docs.go
@@ -22,7 +22,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "批量创建地址簿",
                 "consumes": [
                     "application/json"
                 ],
@@ -30,12 +29,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "批量创建地址簿",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Address book batch-create form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -48,19 +46,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -72,14 +58,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/address_book/create": {
+        "/admin/address_book/batchCreateFromPeers": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿",
+                "description": "Admin-only batch creation of address-book entries from existing peers.",
                 "consumes": [
                     "application/json"
                 ],
@@ -87,17 +73,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "创建地址簿",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Peer IDs and address-book destination payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
+                            "$ref": "#/definitions/admin.BatchCreateFromPeersForm"
                         }
                     }
                 ],
@@ -105,19 +90,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -129,14 +102,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/address_book/delete": {
+        "/admin/address_book/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -144,12 +116,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿删除",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Address book entry form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -174,14 +145,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/address_book/detail/{id}": {
-            "get": {
+        "/admin/address_book/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -189,35 +159,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿详情",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Address book entry deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.AddressBookForm"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -236,7 +195,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -244,38 +202,37 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the address book list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of entries per address book page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "用户id",
+                        "description": "id",
                         "name": "user_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
+                        "description": "Filter for address books owned by the current user",
                         "name": "is_my",
                         "in": "query"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted address-book list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -285,7 +242,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookList"
+                                            "$ref": "#/definitions/model.AddressBookSafeList"
                                         }
                                     }
                                 }
@@ -301,14 +258,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/address_book/share": {
+        "/admin/address_book/shareByWebClient": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿分享",
+                "description": "Authenticated web-client share route; requires the admin API token but not AdminPrivilege.",
                 "consumes": [
                     "application/json"
                 ],
@@ -316,12 +273,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿分享",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Web client address book sharing form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -353,7 +309,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -361,12 +316,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿编辑",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Address book entry update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -379,19 +333,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -410,7 +352,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "创建地址簿名称",
                 "consumes": [
                     "application/json"
                 ],
@@ -418,12 +359,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "创建地址簿名称",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Address book collection form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -436,19 +376,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -467,7 +395,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿名称删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -475,12 +402,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称删除",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Address book collection deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -512,7 +438,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿名称详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -520,9 +445,8 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称详情",
                 "parameters": [
                     {
                         "type": "integer",
@@ -536,19 +460,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -567,7 +479,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿名称列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -575,31 +486,30 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the address book collection list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of collections per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
+                        "description": "Filter for collections owned by the current user",
                         "name": "is_my",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "用户id",
+                        "description": "id",
                         "name": "user_id",
                         "in": "query"
                     }
@@ -639,7 +549,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿名称编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -647,12 +556,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称编辑",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Address book collection update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -665,19 +573,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -696,7 +592,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "创建地址簿规则",
                 "consumes": [
                     "application/json"
                 ],
@@ -704,12 +599,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "创建地址簿规则",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Address book collection rule form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -722,19 +616,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -753,7 +635,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿规则删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -761,12 +642,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则删除",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Address book collection rule deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -798,7 +678,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿规则详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -806,9 +685,8 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则详情",
                 "parameters": [
                     {
                         "type": "integer",
@@ -853,7 +731,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿规则列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -861,37 +738,36 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the collection-rule list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of collection rules per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
+                        "description": "Filter for rules owned by the current user",
                         "name": "is_my",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "用户id",
+                        "description": "id",
                         "name": "user_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "地址簿集合id",
+                        "description": "id",
                         "name": "collection_id",
                         "in": "query"
                     }
@@ -908,7 +784,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollectionList"
+                                            "$ref": "#/definitions/model.AddressBookCollectionRuleList"
                                         }
                                     }
                                 }
@@ -931,7 +807,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "地址簿规则编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -939,12 +814,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则编辑",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Address book collection rule update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -957,19 +831,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -988,7 +850,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "链接日志批量删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -996,12 +857,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "链接日志"
+                    ""
                 ],
-                "summary": "链接日志批量删除",
                 "parameters": [
                     {
-                        "description": "链接日志",
+                        "description": "Audit connection log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1033,7 +893,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "链接日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -1041,12 +900,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "链接日志"
+                    ""
                 ],
-                "summary": "链接日志删除",
                 "parameters": [
                     {
-                        "description": "链接日志信息",
+                        "description": "Audit connection deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1078,7 +936,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "链接日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -1086,31 +943,30 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "链接日志"
+                    ""
                 ],
-                "summary": "链接日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for audit connection records",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of audit connection records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "目标设备",
+                        "description": "Peer ID filter for audit connections",
                         "name": "peer_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "来源设备",
+                        "description": "Source peer ID filter for audit connections",
                         "name": "from_peer",
                         "in": "query"
                     }
@@ -1150,7 +1006,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "文件日志批量删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -1158,12 +1013,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "文件日志"
+                    ""
                 ],
-                "summary": "文件日志批量删除",
                 "parameters": [
                     {
-                        "description": "文件日志",
+                        "description": "Audit file log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1195,7 +1049,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "文件日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -1203,12 +1056,11 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "文件日志"
+                    ""
                 ],
-                "summary": "文件日志删除",
                 "parameters": [
                     {
-                        "description": "文件日志信息",
+                        "description": "Audit file deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1240,7 +1092,6 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "文件日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -1248,31 +1099,30 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "文件日志"
+                    ""
                 ],
-                "summary": "文件日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for audit file records",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of audit file records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "目标设备",
+                        "description": "Peer ID filter for audit file records",
                         "name": "peer_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "来源设备",
+                        "description": "Source peer ID filter for audit file records",
                         "name": "from_peer",
                         "in": "query"
                     }
@@ -1305,24 +1155,73 @@ const docTemplateadmin = `{
                 }
             }
         },
+        "/admin/captcha": {
+            "get": {
+                "description": "Public pre-authentication route; a challenge is returned only when the client IP requires CAPTCHA verification.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Get an admin login CAPTCHA",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/admin/config/admin": {
+            "get": {
+                "description": "Public pre-authentication route returning the admin title and, when a valid api-token is supplied, the personalized greeting.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "ADMIN"
+                ],
+                "summary": "Get public admin configuration",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/config/all": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "ADMIN服务配置",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only configuration used by the admin panel.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "ADMIN"
                 ],
-                "summary": "ADMIN服务配置",
+                "summary": "Get all admin configuration",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1346,7 +1245,7 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "APP服务配置",
+                "description": "APP",
                 "consumes": [
                     "application/json"
                 ],
@@ -1356,7 +1255,7 @@ const docTemplateadmin = `{
                 "tags": [
                     "ADMIN"
                 ],
-                "summary": "APP服务配置",
+                "summary": "APP",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1380,7 +1279,7 @@ const docTemplateadmin = `{
                         "token": []
                     }
                 ],
-                "description": "服务配置,给webclient提供api-server",
+                "description": ",webclientapi-server",
                 "consumes": [
                     "application/json"
                 ],
@@ -1390,7 +1289,7 @@ const docTemplateadmin = `{
                 "tags": [
                     "ADMIN"
                 ],
-                "summary": "RUSTDESK服务配置",
+                "summary": "RUSTDESK",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1407,14 +1306,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/device_group/create": {
+        "/admin/custom_build/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建设备群组",
+                "description": "Admin-only build request. The display version and platform are user-selected capabilities; provider workflow refs, release identity, and dispatch details are resolved server-side.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1422,23 +1321,23 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "创建设备群组",
+                "summary": "Create a custom build",
                 "parameters": [
                     {
-                        "description": "设备群组信息",
+                        "description": "Custom-build request",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.DeviceGroupForm"
+                            "$ref": "#/definitions/admin.CustomBuildForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted queued custom-build envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -1448,15 +1347,33 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.DeviceGroup"
+                                            "$ref": "#/definitions/model.CustomBuildSafe"
                                         }
                                     }
                                 }
                             ]
                         }
                     },
+                    "400": {
+                        "description": "Invalid custom-build request",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "412": {
+                        "description": "Workflow reference approval is required",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Custom build could not be queued",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "Build provider or encryption configuration is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1464,14 +1381,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/device_group/delete": {
+        "/admin/custom_build/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备群组删除",
+                "description": "Admin-only deletion of a custom-build record and its published artifacts.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1479,29 +1396,29 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "设备群组删除",
+                "summary": "Delete a custom build",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-build identifier",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.DeviceGroupForm"
+                            "$ref": "#/definitions/admin.CustomBuildForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Custom build deleted",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Custom build could not be deleted",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1509,28 +1426,25 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/device_group/detail/{id}": {
+        "/admin/custom_build/download/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备群组详情",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only download by build ID. BackendUserAuth and AdminPrivilege authorize the request; the build must have a complete immutable publication proof. The response is the exact redacted ZIP bytes served by this response, not the stored publication output digest and not a signature.",
                 "produces": [
-                    "application/json"
+                    "application/zip"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "设备群组详情",
+                "summary": "Download a completed custom build by ID",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "ID",
+                        "description": "Completed custom build ID",
                         "name": "id",
                         "in": "path",
                         "required": true
@@ -1538,25 +1452,61 @@ const docTemplateadmin = `{
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted custom-build ZIP archive",
+                        "schema": {
+                            "type": "file"
+                        },
+                        "headers": {
+                            "Content-Disposition": {
+                                "type": "string",
+                                "description": "Attachment filename"
+                            },
+                            "Content-Length": {
+                                "type": "string",
+                                "description": "Exact ZIP response length in bytes"
+                            },
+                            "X-DeskForge-Archive-SHA256": {
+                                "type": "string",
+                                "description": "SHA-256 of the exact ZIP bytes served by this response"
+                            },
+                            "X-DeskForge-Archive-SHA256-Scope": {
+                                "type": "string",
+                                "description": "Digest scope; distinct from the stored publication digest"
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid build ID",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Group"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "403": {
+                        "description": "Administrator authentication or privilege is required",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "408": {
+                        "description": "Download request was cancelled or timed out",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "409": {
+                        "description": "Build completion or output provenance is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "416": {
+                        "description": "Range requests are not supported",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "ZIP packaging or validation failed",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1564,41 +1514,38 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/device_group/list": {
+        "/admin/custom_build/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only paginated list. The response uses the redacted CustomBuildSafeList view; provider credentials and storage-only identity fields are not serialized.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomBuild"
                 ],
-                "summary": "群组列表",
+                "summary": "List custom builds",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of builds per page",
                         "name": "page_size",
                         "in": "query"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted custom-build list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -1608,7 +1555,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.GroupList"
+                                            "$ref": "#/definitions/model.CustomBuildSafeList"
                                         }
                                     }
                                 }
@@ -1616,7 +1563,7 @@ const docTemplateadmin = `{
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Custom-build list is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1624,38 +1571,33 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/device_group/update": {
-            "post": {
+        "/admin/custom_build/manifest/{id}": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备群组编辑",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only redacted handoff data. The BuildHandoffManifest contains no secrets, raw custom configuration, filesystem paths, or signature claim. The published digest covers stored canonical output and is distinct from the SHA-256 header over these response bytes.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "设备群组编辑",
+                "summary": "Export a completed custom-build handoff manifest",
                 "parameters": [
                     {
-                        "description": "群组信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.DeviceGroupForm"
-                        }
+                        "type": "integer",
+                        "description": "Completed custom build ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted build handoff envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -1665,15 +1607,33 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/service.BuildHandoffManifest"
                                         }
                                     }
                                 }
                             ]
+                        },
+                        "headers": {
+                            "X-DeskForge-Manifest-SHA256": {
+                                "type": "string",
+                                "description": "SHA-256 of the exact response body bytes"
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid build ID",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "409": {
+                        "description": "Completed handoff is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Handoff is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1681,33 +1641,52 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/file/oss_token": {
+        "/admin/custom_build/public/detailByKey/{key}": {
             "get": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "获取ossToken",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Public capability route with no authentication. The key expires according to download-key-ttl; an expired key returns 410. The response uses the public CustomBuildPublic view and omits download_key, provider refs, and secrets.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "文件"
+                    "CustomBuild"
+                ],
+                "summary": "Read a completed custom build by capability key",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Opaque build capability key",
+                        "name": "key",
+                        "in": "path",
+                        "required": true
+                    }
                 ],
-                "summary": "获取ossToken",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Public build detail envelope without download_key",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.CustomBuildPublic"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "409": {
+                        "description": "Build is not publicly ready",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "410": {
+                        "description": "Capability key has expired",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1715,42 +1694,76 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/file/upload": {
-            "post": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "上传文件到本地",
-                "consumes": [
-                    "multipart/form-data"
-                ],
+        "/admin/custom_build/public/download/{key}": {
+            "get": {
+                "description": "Public capability route with no authentication. The key expires according to download-key-ttl; an expired key returns 410. The response is the exact redacted ZIP bytes served by this response, not the stored publication output digest and not a signature.",
                 "produces": [
-                    "application/json"
+                    "application/zip"
                 ],
                 "tags": [
-                    "文件"
+                    "CustomBuild"
                 ],
-                "summary": "上传文件到本地",
+                "summary": "Download a completed custom build by capability key",
                 "parameters": [
                     {
-                        "type": "file",
-                        "description": "上传文件示例",
-                        "name": "file",
-                        "in": "formData",
+                        "type": "string",
+                        "description": "Opaque build capability key",
+                        "name": "key",
+                        "in": "path",
                         "required": true
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted custom-build ZIP archive",
+                        "schema": {
+                            "type": "file"
+                        },
+                        "headers": {
+                            "Content-Disposition": {
+                                "type": "string",
+                                "description": "Attachment filename"
+                            },
+                            "Content-Length": {
+                                "type": "string",
+                                "description": "Exact ZIP response length in bytes"
+                            },
+                            "X-DeskForge-Archive-SHA256": {
+                                "type": "string",
+                                "description": "SHA-256 of the exact ZIP bytes served by this response"
+                            },
+                            "X-DeskForge-Archive-SHA256-Scope": {
+                                "type": "string",
+                                "description": "Digest scope; distinct from the stored publication digest"
+                            }
+                        }
+                    },
+                    "408": {
+                        "description": "Download request was cancelled or timed out",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "409": {
+                        "description": "Build completion or output provenance is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "410": {
+                        "description": "Capability key has expired",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "416": {
+                        "description": "Range requests are not supported",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "ZIP packaging or validation failed",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1758,14 +1771,51 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/group/create": {
+        "/admin/custom_build/versions": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only provider capability list. Only display versions and release labels are returned; provider refs and commit SHAs remain server-side.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "CustomBuild"
+                ],
+                "summary": "List available custom-build versions",
+                "responses": {
+                    "200": {
+                        "description": "Available version options, with error state",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.versionsResponse"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/custom_preset/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建群组",
+                "description": "Administrators with AdminPrivilege may save a custom preset; provider-derived build references are resolved server-side.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1773,17 +1823,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "创建群组",
+                "summary": "Create a custom preset",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-preset payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.GroupForm"
+                            "$ref": "#/definitions/admin.CustomPresetForm"
                         }
                     }
                 ],
@@ -1799,7 +1849,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/model.CustomPresetSafe"
                                         }
                                     }
                                 }
@@ -1815,14 +1865,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/group/delete": {
+        "/admin/custom_preset/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组删除",
+                "description": "Administrators with AdminPrivilege may delete their own custom preset.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1830,17 +1880,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组删除",
+                "summary": "Delete a custom preset",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-preset identifier",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.GroupForm"
+                            "$ref": "#/definitions/admin.CustomPresetForm"
                         }
                     }
                 ],
@@ -1860,28 +1910,25 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/group/detail/{id}": {
+        "/admin/custom_preset/detail/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组详情",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Administrators with AdminPrivilege may read their own redacted custom preset.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组详情",
+                "summary": "Get a custom preset",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "ID",
+                        "description": "Custom preset ID",
                         "name": "id",
                         "in": "path",
                         "required": true
@@ -1899,7 +1946,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/model.CustomPresetSafe"
                                         }
                                     }
                                 }
@@ -1915,34 +1962,31 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/group/list": {
+        "/admin/custom_preset/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Administrators with AdminPrivilege receive a paginated redacted custom-preset list.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组列表",
+                "summary": "List custom presets",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of presets per page",
                         "name": "page_size",
                         "in": "query"
                     }
@@ -1959,7 +2003,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.GroupList"
+                                            "$ref": "#/definitions/model.CustomPresetSafeList"
                                         }
                                     }
                                 }
@@ -1975,14 +2019,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/group/update": {
+        "/admin/custom_preset/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组编辑",
+                "description": "Administrators with AdminPrivilege may update their own custom preset; provider-derived build references are resolved server-side.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1990,17 +2034,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组编辑",
+                "summary": "Update a custom preset",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-preset update payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.GroupForm"
+                            "$ref": "#/definitions/admin.CustomPresetForm"
                         }
                     }
                 ],
@@ -2016,7 +2060,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/model.CustomPresetSafe"
                                         }
                                     }
                                 }
@@ -2032,52 +2076,26 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/login": {
-            "post": {
+        "/admin/dashboard/health": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Authenticated server health and bandwidth data for the admin dashboard.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
-                ],
-                "summary": "登录",
-                "parameters": [
-                    {
-                        "description": "登录信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/github_com_lejianwen_rustdesk-api_v2_http_request_admin.Login"
-                        }
-                    }
+                    "Dashboard"
                 ],
+                "summary": "Get server health",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/admin.LoginPayload"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -2089,46 +2107,44 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/login-options": {
-            "post": {
-                "description": "登录选项",
-                "consumes": [
-                    "application/json"
+        "/admin/dashboard/stats": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
                 ],
+                "description": "Authenticated dashboard counters for users, peers, groups, and logins.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    "Dashboard"
                 ],
-                "summary": "登录选项",
+                "summary": "Get dashboard statistics",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "type": "array",
-                            "items": {
-                                "type": "string"
-                            }
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
                         "description": "Internal Server Error",
                         "schema": {
-                            "$ref": "#/definitions/response.ErrorResponse"
+                            "$ref": "#/definitions/response.Response"
                         }
                     }
                 }
             }
         },
-        "/admin/login_log/batchDelete": {
+        "/admin/device_group/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志批量删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -2136,17 +2152,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志批量删除",
                 "parameters": [
                     {
-                        "description": "登录日志",
+                        "description": "Device group form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.LoginLogIds"
+                            "$ref": "#/definitions/admin.DeviceGroupForm"
                         }
                     }
                 ],
@@ -2154,7 +2169,19 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.DeviceGroup"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -2166,14 +2193,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/login_log/delete": {
+        "/admin/device_group/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -2181,17 +2207,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志删除",
                 "parameters": [
                     {
-                        "description": "登录日志信息",
+                        "description": "Device group deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.LoginLog"
+                            "$ref": "#/definitions/admin.DeviceGroupForm"
                         }
                     }
                 ],
@@ -2211,14 +2236,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/login_log/detail/{id}": {
+        "/admin/device_group/detail/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -2226,9 +2250,8 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志详情",
                 "parameters": [
                     {
                         "type": "integer",
@@ -2250,7 +2273,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.LoginLog"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -2266,14 +2289,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/login_log/list": {
+        "/admin/device_group/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -2281,27 +2303,20 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the device-group list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of device groups per page",
                         "name": "page_size",
                         "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
-                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -2316,7 +2331,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.LoginLogList"
+                                            "$ref": "#/definitions/model.GroupList"
                                         }
                                     }
                                 }
@@ -2332,43 +2347,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/logout": {
-            "post": {
-                "description": "登出",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "登录"
-                ],
-                "summary": "登出",
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    }
-                }
-            }
-        },
-        "/admin/my/address_book/create": {
+        "/admin/device_group/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿",
                 "consumes": [
                     "application/json"
                 ],
@@ -2376,17 +2361,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
+                    ""
                 ],
-                "summary": "创建地址簿",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Device group update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
+                            "$ref": "#/definitions/admin.DeviceGroupForm"
                         }
                     }
                 ],
@@ -2402,7 +2386,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -2418,35 +2402,24 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book/delete": {
+        "/admin/file/notify": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿删除",
+                "description": "Authenticated upload callback used after the object-storage provider verifies the request.",
                 "consumes": [
-                    "application/json"
+                    "multipart/form-data"
                 ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
-                ],
-                "summary": "地址簿删除",
-                "parameters": [
-                    {
-                        "description": "地址簿信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
-                        }
-                    }
+                    "File"
                 ],
+                "summary": "Confirm an uploaded file",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -2463,14 +2436,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book/list": {
+        "/admin/file/oss_token": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿列表",
+                "description": "ossToken",
                 "consumes": [
                     "application/json"
                 ],
@@ -2478,46 +2451,14 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
-                ],
-                "summary": "地址簿列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
-                        "name": "user_id",
-                        "in": "query"
-                    }
+                    ""
                 ],
+                "summary": "ossToken",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookList"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -2529,52 +2470,36 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book/update": {
+        "/admin/file/upload": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿编辑",
                 "consumes": [
-                    "application/json"
+                    "multipart/form-data"
                 ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
+                    ""
                 ],
-                "summary": "地址簿编辑",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
-                        }
+                        "type": "file",
+                        "description": "Multipart file to upload",
+                        "name": "file",
+                        "in": "formData",
+                        "required": true
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -2586,14 +2511,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection/create": {
+        "/admin/github_build_config/approve_workflow_ref": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿名称",
+                "description": "Admin confirmation for a provider-derived, verified, protected workflow tag. The workflow_tag must be selected from workflow_tags; raw refs and SHAs are not accepted. The response is the secret-free GithubBuildConfigSafe view.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2601,23 +2526,23 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
+                    "GithubBuildConfig"
                 ],
-                "summary": "创建地址簿名称",
+                "summary": "Approve a provider-derived workflow tag",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Confirm and provider-derived workflow tag label",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollection"
+                            "$ref": "#/definitions/admin.WorkflowRefApprovalForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Safe GitHub build configuration envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -2627,15 +2552,33 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.GithubBuildConfigSafe"
                                         }
                                     }
                                 }
                             ]
                         }
                     },
+                    "400": {
+                        "description": "Invalid selector or approval request",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Workflow approval failed",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "502": {
+                        "description": "Provider rejected or could not verify the workflow tag",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2643,14 +2586,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection/delete": {
+        "/admin/github_build_config/dispatch_test": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿名称删除",
+                "description": "Admin-only provider mutation that dispatches the configured Windows workflow with server-derived parameters after explicit confirmation. The response contains provider run metadata, not credentials.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2658,29 +2601,43 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
+                    "GithubBuildConfig"
                 ],
-                "summary": "地址簿名称删除",
+                "summary": "Dispatch a GitHub smoke-test build",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Explicit build confirmation",
                         "name": "body",
                         "in": "body",
-                        "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollection"
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "boolean"
+                            }
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Provider workflow dispatch metadata",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "412": {
+                        "description": "Workflow reference approval is required",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "502": {
+                        "description": "Provider rejected the workflow dispatch",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2688,59 +2645,36 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection/list": {
-            "get": {
+        "/admin/github_build_config/generate_key": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿名称列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only operation that creates and stores a new workflow payload key. The generated key is returned once so it can be copied to the provider secret store; later configuration reads are secret-free.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
-                ],
-                "summary": "地址簿名称列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    }
+                    "GithubBuildConfig"
                 ],
+                "summary": "Generate a workflow payload key",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Generated workflow payload key",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollectionList"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Payload key could not be generated",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "Secret encryption is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2748,38 +2682,24 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection/update": {
-            "post": {
+        "/admin/github_build_config/get": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿名称编辑",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only secret-free GitHub build configuration view. Credentials are represented only by has_token and has_payload_key flags.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
-                ],
-                "summary": "地址簿名称编辑",
-                "parameters": [
-                    {
-                        "description": "地址簿名称信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollection"
-                        }
-                    }
+                    "GithubBuildConfig"
                 ],
+                "summary": "Get GitHub build configuration",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Secret-free GitHub build configuration envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -2789,7 +2709,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.GithubBuildConfigSafe"
                                         }
                                     }
                                 }
@@ -2797,7 +2717,7 @@ const docTemplateadmin = `{
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "GitHub build configuration is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2805,14 +2725,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/create": {
+        "/admin/github_build_config/save": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿规则",
+                "description": "Admin-only configuration update. Repository is user-authored; workflow selectors and resolved provider identities remain system/provider-derived. Empty secrets preserve stored values, and the response is secret-free.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2820,23 +2740,23 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
+                    "GithubBuildConfig"
                 ],
-                "summary": "创建地址簿规则",
+                "summary": "Save GitHub build configuration",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "GitHub build configuration",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollectionRule"
+                            "$ref": "#/definitions/admin.GithubBuildConfigForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Secret-free GitHub build configuration envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -2846,15 +2766,27 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.GithubBuildConfigSafe"
                                         }
                                     }
                                 }
                             ]
                         }
                     },
+                    "400": {
+                        "description": "Invalid configuration request",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "GitHub build configuration could not be saved",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "Secret encryption is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2862,44 +2794,36 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/delete": {
+        "/admin/github_build_config/sync_secret": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿规则删除",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only provider mutation that synchronizes the stored workflow payload key to the configured GitHub Actions secret. The key is not returned.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
-                ],
-                "summary": "地址簿规则删除",
-                "parameters": [
-                    {
-                        "description": "地址簿规则信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollectionRule"
-                        }
-                    }
+                    "GithubBuildConfig"
                 ],
+                "summary": "Sync the workflow payload key",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Workflow payload key synchronized",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "502": {
+                        "description": "Provider rejected the secret update",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2907,59 +2831,61 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/list": {
-            "get": {
+        "/admin/github_build_config/test": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿规则列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only read-only provider connectivity check. The stored PAT is used server-side and is never returned.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
+                    "GithubBuildConfig"
                 ],
-                "summary": "地址簿规则列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "是否是我的",
-                        "name": "is_my",
-                        "in": "query"
+                "summary": "Test GitHub provider access",
+                "responses": {
+                    "200": {
+                        "description": "Provider access is available",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
                     },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
-                        "name": "user_id",
-                        "in": "query"
+                    "502": {
+                        "description": "Provider rejected the configured credentials or repository",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
                     },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/github_build_config/workflow_tags": {
+            "get": {
+                "security": [
                     {
-                        "type": "integer",
-                        "description": "地址簿集合id",
-                        "name": "collection_id",
-                        "in": "query"
+                        "token": []
                     }
                 ],
+                "description": "Admin-only capability catalog. Each WorkflowTagOption is a safe provider-derived label; credentials, raw refs, SHAs, and provider verification objects remain server-side. Approval must select one of these options.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "GithubBuildConfig"
+                ],
+                "summary": "List provider-derived workflow tag options",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Safe workflow tag options under data.tags",
                         "schema": {
                             "allOf": [
                                 {
@@ -2969,7 +2895,13 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollectionList"
+                                            "type": "object",
+                                            "additionalProperties": {
+                                                "type": "array",
+                                                "items": {
+                                                    "$ref": "#/definitions/service.WorkflowTagOption"
+                                                }
+                                            }
                                         }
                                     }
                                 }
@@ -2977,7 +2909,19 @@ const docTemplateadmin = `{
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Workflow tag options are unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "502": {
+                        "description": "Provider rejected or returned invalid workflow data",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2985,14 +2929,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/update": {
+        "/admin/group/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿规则编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -3000,17 +2943,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则编辑",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Group form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollectionRule"
+                            "$ref": "#/definitions/admin.GroupForm"
                         }
                     }
                 ],
@@ -3026,7 +2968,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -3042,59 +2984,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/login_log/batchDelete": {
-            "post": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "登录日志批量删除",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "我的登录日志"
-                ],
-                "summary": "登录日志批量删除",
-                "parameters": [
-                    {
-                        "description": "登录日志",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.LoginLogIds"
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    }
-                }
-            }
-        },
-        "/admin/my/login_log/delete": {
+        "/admin/group/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -3102,17 +2998,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的登录日志"
+                    ""
                 ],
-                "summary": "登录日志删除",
                 "parameters": [
                     {
-                        "description": "登录日志信息",
+                        "description": "Group deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.LoginLog"
+                            "$ref": "#/definitions/admin.GroupForm"
                         }
                     }
                 ],
@@ -3132,14 +3027,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/login_log/list": {
+        "/admin/group/detail/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3147,27 +3041,15 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的登录日志"
+                    ""
                 ],
-                "summary": "登录日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
-                        "in": "query"
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
                     }
                 ],
                 "responses": {
@@ -3182,7 +3064,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.LoginLogList"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -3198,14 +3080,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/peer/list": {
+        "/admin/group/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3213,45 +3094,20 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的设备"
+                    ""
                 ],
-                "summary": "设备列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the group list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of groups per page",
                         "name": "page_size",
                         "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "时间",
-                        "name": "time_ago",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "主机名",
-                        "name": "hostname",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "uuids 用逗号分隔",
-                        "name": "uuids",
-                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -3266,7 +3122,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.PeerList"
+                                            "$ref": "#/definitions/model.GroupList"
                                         }
                                     }
                                 }
@@ -3282,14 +3138,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/share_record/batchDelete": {
+        "/admin/group/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "批量删除我的分享记录",
                 "consumes": [
                     "application/json"
                 ],
@@ -3297,17 +3152,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的"
+                    ""
                 ],
-                "summary": "批量删除我的分享记录",
                 "parameters": [
                     {
-                        "description": "id",
+                        "description": "Group update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                            "$ref": "#/definitions/admin.GroupForm"
                         }
                     }
                 ],
@@ -3315,7 +3169,19 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Group"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -3327,14 +3193,9 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/share_record/delete": {
+        "/admin/login": {
             "post": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "分享记录删除",
+                "description": "Public pre-authentication route for administrator credentials; it returns the admin access-token payload on success.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3342,17 +3203,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的分享记录"
+                    "Auth"
                 ],
-                "summary": "分享记录删除",
+                "summary": "Log in to the admin panel",
                 "parameters": [
                     {
-                        "description": "分享记录信息",
+                        "description": "Admin login credentials payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.ShareRecordForm"
+                            "$ref": "#/definitions/rustdesk-server_api_http_request_admin.Login"
                         }
                     }
                 ],
@@ -3360,7 +3221,19 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -3372,47 +3245,25 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/share_record/list": {
+        "/admin/login-options": {
             "get": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "分享记录列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Public pre-authentication route returning registration, password-login, CAPTCHA, and OIDC-provider capabilities.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的分享记录"
-                ],
-                "summary": "分享记录列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    }
+                    "Auth"
                 ],
+                "summary": "Get admin login options",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Public admin login capabilities",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "400": {
+                        "description": "Login options could not be read",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -3420,14 +3271,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/tag/create": {
+        "/admin/login_log/batchDelete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -3435,17 +3285,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的标签"
+                    ""
                 ],
-                "summary": "创建标签",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Login log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/admin.LoginLogIds"
                         }
                     }
                 ],
@@ -3453,19 +3302,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3477,14 +3314,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/tag/delete": {
+        "/admin/login_log/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -3492,17 +3328,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签删除",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Login log deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/model.LoginLog"
                         }
                     }
                 ],
@@ -3522,14 +3357,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/tag/list": {
+        "/admin/login_log/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3537,31 +3371,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的标签"
+                    ""
                 ],
-                "summary": "标签列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the login-log list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of login-log records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
-                        "name": "is_my",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
+                        "description": "ID",
                         "name": "user_id",
                         "in": "query"
                     }
@@ -3578,7 +3405,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.TagList"
+                                            "$ref": "#/definitions/model.LoginLogList"
                                         }
                                     }
                                 }
@@ -3594,14 +3421,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/my/tag/update": {
+        "/admin/logout": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签编辑",
+                "description": "Clears the supplied admin access token when it identifies a current user; the route is registered before the admin authentication middleware.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3609,37 +3436,14 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "我的标签"
-                ],
-                "summary": "标签编辑",
-                "parameters": [
-                    {
-                        "description": "标签信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
-                        }
-                    }
+                    "Auth"
                 ],
+                "summary": "Log out of the admin panel",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3651,14 +3455,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/oauth/create": {
+        "/admin/my/address_book/batchCreateFromPeers": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建Oauth",
+                "description": "Personal batch creation of address-book entries from the current user's peers.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3666,17 +3470,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "创建Oauth",
                 "parameters": [
                     {
-                        "description": "Oauth信息",
+                        "description": "Peer IDs and address-book destination payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.OauthForm"
+                            "$ref": "#/definitions/admin.BatchCreateFromPeersForm"
                         }
                     }
                 ],
@@ -3684,19 +3487,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Oauth"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3708,14 +3499,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/oauth/delete": {
+        "/admin/my/address_book/batchUpdateTags": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth删除",
+                "description": "Authenticated users may update tags on their own address-book entries.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3723,17 +3514,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    "AddressBook"
                 ],
-                "summary": "Oauth删除",
+                "summary": "Update personal address-book tags",
                 "parameters": [
                     {
-                        "description": "Oauth信息",
+                        "description": "Address-book tag update payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.OauthForm"
+                            "$ref": "#/definitions/admin.BatchUpdateTagsForm"
                         }
                     }
                 ],
@@ -3753,14 +3544,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/oauth/detail/{id}": {
-            "get": {
+        "/admin/my/address_book/create": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -3768,35 +3558,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "Oauth详情",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Personal address book entry form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.AddressBookForm"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Oauth"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3808,14 +3587,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/oauth/list": {
-            "get": {
+        "/admin/my/address_book/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3823,40 +3601,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "Oauth列表",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
+                        "description": "Personal address book entry deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.AddressBookForm"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.OauthList"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3868,14 +3630,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/oauth/update": {
-            "post": {
+        "/admin/my/address_book/list": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -3883,80 +3644,31 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "Oauth编辑",
                 "parameters": [
                     {
-                        "description": "Oauth信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.OauthForm"
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.OauthList"
-                                        }
-                                    }
-                                }
-                            ]
-                        }
+                        "type": "integer",
+                        "description": "Page number for the personal address book list",
+                        "name": "page",
+                        "in": "query"
                     },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
+                    {
+                        "type": "integer",
+                        "description": "Number of personal address book entries per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
                     }
-                }
-            }
-        },
-        "/admin/oidc/auth": {
-            "post": {
-                "description": "OidcAuth",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "Oauth"
-                ],
-                "summary": "OidcAuth",
-                "responses": {}
-            }
-        },
-        "/admin/oidc/auth-query": {
-            "get": {
-                "description": "OidcAuthQuery",
-                "consumes": [
-                    "application/json"
                 ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "Oauth"
-                ],
-                "summary": "OidcAuthQuery",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted personal address-book list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -3966,7 +3678,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/admin.LoginPayload"
+                                            "$ref": "#/definitions/model.AddressBookSafeList"
                                         }
                                     }
                                 }
@@ -3982,14 +3694,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/peer/batchDelete": {
+        "/admin/my/address_book/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "批量设备删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -3997,17 +3708,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "批量设备删除",
                 "parameters": [
                     {
-                        "description": "设备id",
+                        "description": "Personal address book entry update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerBatchDeleteForm"
+                            "$ref": "#/definitions/admin.AddressBookForm"
                         }
                     }
                 ],
@@ -4027,14 +3737,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/peer/create": {
+        "/admin/my/address_book_collection/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建设备",
                 "consumes": [
                     "application/json"
                 ],
@@ -4042,17 +3751,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "创建设备",
                 "parameters": [
                     {
-                        "description": "设备信息",
+                        "description": "Personal address book collection form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerForm"
+                            "$ref": "#/definitions/model.AddressBookCollection"
                         }
                     }
                 ],
@@ -4060,19 +3768,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Peer"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4084,14 +3780,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/peer/delete": {
+        "/admin/my/address_book_collection/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4099,17 +3794,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "设备删除",
                 "parameters": [
                     {
-                        "description": "设备信息",
+                        "description": "Personal address book collection deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerForm"
+                            "$ref": "#/definitions/model.AddressBookCollection"
                         }
                     }
                 ],
@@ -4129,69 +3823,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/peer/detail/{id}": {
-            "get": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "设备详情",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "设备"
-                ],
-                "summary": "设备详情",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Peer"
-                                        }
-                                    }
-                                }
-                            ]
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    }
-                }
-            }
-        },
-        "/admin/peer/list": {
+        "/admin/my/address_book_collection/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -4199,45 +3837,20 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "设备列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the personal address book collection list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of personal address book collections per page",
                         "name": "page_size",
                         "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "时间",
-                        "name": "time_ago",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "主机名",
-                        "name": "hostname",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "uuids 用逗号分隔",
-                        "name": "uuids",
-                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -4252,7 +3865,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.PeerList"
+                                            "$ref": "#/definitions/model.AddressBookCollectionList"
                                         }
                                     }
                                 }
@@ -4268,14 +3881,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/peer/update": {
+        "/admin/my/address_book_collection/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -4283,17 +3895,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "设备编辑",
                 "parameters": [
                     {
-                        "description": "设备信息",
+                        "description": "Personal address book collection update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerForm"
+                            "$ref": "#/definitions/model.AddressBookCollection"
                         }
                     }
                 ],
@@ -4301,19 +3912,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Peer"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4325,14 +3924,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/share_record/batchDelete": {
+        "/admin/my/address_book_collection_rule/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "批量分享记录",
                 "consumes": [
                     "application/json"
                 ],
@@ -4340,17 +3938,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "分享记录"
+                    ""
                 ],
-                "summary": "批量分享记录",
                 "parameters": [
                     {
-                        "description": "id",
+                        "description": "Personal address book collection rule form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                            "$ref": "#/definitions/model.AddressBookCollectionRule"
                         }
                     }
                 ],
@@ -4370,14 +3967,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/share_record/delete": {
+        "/admin/my/address_book_collection_rule/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "分享记录删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4385,17 +3981,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "分享记录"
+                    ""
                 ],
-                "summary": "分享记录删除",
                 "parameters": [
                     {
-                        "description": "分享记录信息",
+                        "description": "Personal address book collection rule deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.ShareRecordForm"
+                            "$ref": "#/definitions/model.AddressBookCollectionRule"
                         }
                     }
                 ],
@@ -4415,14 +4010,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/share_record/list": {
+        "/admin/my/address_book_collection_rule/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "分享记录列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -4430,26 +4024,37 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "分享记录"
+                    ""
                 ],
-                "summary": "分享记录列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
+                        "description": "Page number for personal address book collection rules",
+                        "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页码",
-                        "name": "page",
+                        "description": "Number of personal collection rules per page",
+                        "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
+                        "description": "Filter for rules owned by the current user",
+                        "name": "is_my",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "collection_id",
                         "in": "query"
                     }
                 ],
@@ -4457,7 +4062,19 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.AddressBookCollectionRuleList"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -4469,14 +4086,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/tag/create": {
+        "/admin/my/address_book_collection_rule/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -4484,17 +4100,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "创建标签",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Personal address book collection rule update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/model.AddressBookCollectionRule"
                         }
                     }
                 ],
@@ -4502,19 +4117,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4526,14 +4129,44 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/tag/delete": {
+        "/admin/my/groupUsers": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated users receive only the group and user entries allowed for personal sharing.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "List shareable users and groups",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/my/login_log/batchDelete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4541,17 +4174,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签删除",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Personal login-log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/admin.LoginLogIds"
                         }
                     }
                 ],
@@ -4571,14 +4203,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/tag/detail/{id}": {
-            "get": {
+        "/admin/my/login_log/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -4586,35 +4217,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签详情",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Personal login-log deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.LoginLog"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4626,14 +4246,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/tag/list": {
+        "/admin/my/login_log/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -4641,31 +4260,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the personal login-log list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of personal login-log records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
-                        "name": "is_my",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
+                        "description": "ID",
                         "name": "user_id",
                         "in": "query"
                     }
@@ -4682,7 +4294,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.TagList"
+                                            "$ref": "#/definitions/model.LoginLogList"
                                         }
                                     }
                                 }
@@ -4698,14 +4310,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/tag/update": {
+        "/admin/my/peer/batchDelete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -4713,17 +4324,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签编辑",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Personal peer ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/admin.PeerBatchDeleteForm"
                         }
                     }
                 ],
@@ -4731,19 +4341,7 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4755,14 +4353,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/changeCurPwd": {
+        "/admin/my/peer/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "修改当前用户密码",
                 "consumes": [
                     "application/json"
                 ],
@@ -4770,17 +4367,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "修改当前用户密码",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "Personal peer deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.ChangeCurPasswordForm"
+                            "$ref": "#/definitions/admin.PeerForm"
                         }
                     }
                 ],
@@ -4800,14 +4396,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/create": {
-            "post": {
+        "/admin/my/peer/list": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建管理员",
                 "consumes": [
                     "application/json"
                 ],
@@ -4815,18 +4410,44 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "创建管理员",
                 "parameters": [
                     {
-                        "description": "管理员信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.UserForm"
-                        }
+                        "type": "integer",
+                        "description": "Page number for the personal peer list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of personal peers per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Last-online time offset filter",
+                        "name": "time_ago",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Hostname filter",
+                        "name": "hostname",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "uuids ",
+                        "name": "uuids",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -4841,7 +4462,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.User"
+                                            "$ref": "#/definitions/model.PeerList"
                                         }
                                     }
                                 }
@@ -4857,14 +4478,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/current": {
-            "get": {
+        "/admin/my/share_record/batchDelete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "当前用户",
                 "consumes": [
                     "application/json"
                 ],
@@ -4872,26 +4492,24 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "id",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                        }
+                    }
                 ],
-                "summary": "当前用户",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/admin.LoginPayload"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4903,14 +4521,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/delete": {
+        "/admin/my/share_record/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员编删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4918,17 +4535,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员删除",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "Personal share record deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserForm"
+                            "$ref": "#/definitions/admin.ShareRecordForm"
                         }
                     }
                 ],
@@ -4948,14 +4564,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/detail/{id}": {
+        "/admin/my/share_record/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -4963,21 +4578,25 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员详情",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Page number for personal share records",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of personal share records per page",
+                        "name": "page_size",
+                        "in": "query"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted personal share-record list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -4987,7 +4606,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.User"
+                                            "$ref": "#/definitions/model.ShareRecordSafeList"
                                         }
                                     }
                                 }
@@ -5003,14 +4622,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/list": {
-            "get": {
+        "/admin/my/tag/create": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -5018,27 +4636,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员列表",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "账户",
-                        "name": "username",
-                        "in": "query"
+                        "description": "Personal tag form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
                     }
                 ],
                 "responses": {
@@ -5053,7 +4661,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.UserList"
+                                            "$ref": "#/definitions/model.Tag"
                                         }
                                     }
                                 }
@@ -5069,14 +4677,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/myOauth": {
-            "get": {
+        "/admin/my/tag/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "我的授权",
                 "consumes": [
                     "application/json"
                 ],
@@ -5084,12 +4691,80 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "我的授权",
-                "responses": {
-                    "200": {
-                        "description": "OK",
+                "parameters": [
+                    {
+                        "description": "Personal tag deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/my/tag/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the personal tag list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of personal tags per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Filter for tags owned by the current user",
+                        "name": "is_my",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
                         "schema": {
                             "allOf": [
                                 {
@@ -5099,10 +4774,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "type": "array",
-                                            "items": {
-                                                "$ref": "#/definitions/admin.UserOauthItem"
-                                            }
+                                            "$ref": "#/definitions/model.TagList"
                                         }
                                     }
                                 }
@@ -5118,14 +4790,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/update": {
+        "/admin/my/tag/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -5133,17 +4804,16 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员编辑",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "Personal tag update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserForm"
+                            "$ref": "#/definitions/admin.TagForm"
                         }
                     }
                 ],
@@ -5159,7 +4829,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.User"
+                                            "$ref": "#/definitions/model.Tag"
                                         }
                                     }
                                 }
@@ -5175,14 +4845,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user/updatePassword": {
+        "/admin/oauth/bind": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "修改密码",
+                "description": "Authenticated users receive a short-lived binding code and provider URL.",
                 "consumes": [
                     "application/json"
                 ],
@@ -5190,17 +4860,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    "Oauth"
                 ],
-                "summary": "修改密码",
+                "summary": "Start OAuth binding",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "OAuth provider binding payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserPasswordForm"
+                            "$ref": "#/definitions/admin.BindOauthForm"
                         }
                     }
                 ],
@@ -5208,7 +4878,22 @@ const docTemplateadmin = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "type": "object",
+                                            "additionalProperties": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -5220,14 +4905,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user_token/batchDelete": {
+        "/admin/oauth/bindConfirm": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录凭证批量删除",
+                "description": "Authenticated users attach the confirmed OAuth identity to their account.",
                 "consumes": [
                     "application/json"
                 ],
@@ -5235,17 +4920,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录凭证"
+                    "Oauth"
                 ],
-                "summary": "登录凭证批量删除",
+                "summary": "Complete OAuth binding",
                 "parameters": [
                     {
-                        "description": "登录凭证信息",
+                        "description": "OAuth confirmation payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserTokenBatchDeleteForm"
+                            "$ref": "#/definitions/admin.OauthConfirmForm"
                         }
                     }
                 ],
@@ -5265,14 +4950,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user_token/delete": {
+        "/admin/oauth/confirm": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录凭证删除",
+                "description": "Authenticated users confirm a short-lived OAuth handoff before binding.",
                 "consumes": [
                     "application/json"
                 ],
@@ -5280,17 +4965,17 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录凭证"
+                    "Oauth"
                 ],
-                "summary": "登录凭证删除",
+                "summary": "Confirm OAuth binding",
                 "parameters": [
                     {
-                        "description": "登录凭证信息",
+                        "description": "OAuth confirmation payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.UserToken"
+                            "$ref": "#/definitions/admin.OauthConfirmForm"
                         }
                     }
                 ],
@@ -5310,14 +4995,14 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "/admin/user_token/list": {
-            "get": {
+        "/admin/oauth/create": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录凭证列表",
+                "description": "Oauth",
                 "consumes": [
                     "application/json"
                 ],
@@ -5325,27 +5010,18 @@ const docTemplateadmin = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录凭证"
+                    "Oauth"
                 ],
-                "summary": "登录凭证列表",
+                "summary": "Oauth",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
-                        "in": "query"
+                        "description": "Oauth",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.OauthForm"
+                        }
                     }
                 ],
                 "responses": {
@@ -5360,7 +5036,7 @@ const docTemplateadmin = `{
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.UserTokenList"
+                                            "$ref": "#/definitions/model.Oauth"
                                         }
                                     }
                                 }
@@ -5375,156 +5051,2855 @@ const docTemplateadmin = `{
                     }
                 }
             }
-        }
-    },
-    "definitions": {
-        "admin.AddressBookForm": {
-            "type": "object",
-            "required": [
-                "id"
-            ],
-            "properties": {
-                "alias": {
-                    "type": "string"
-                },
-                "collection_id": {
-                    "type": "integer"
-                },
-                "forceAlwaysRelay": {
-                    "type": "boolean"
-                },
-                "hash": {
-                    "type": "string"
-                },
-                "hostname": {
-                    "type": "string"
-                },
-                "id": {
-                    "type": "string"
-                },
-                "loginName": {
-                    "type": "string"
-                },
-                "online": {
-                    "type": "boolean"
-                },
-                "password": {
-                    "type": "string"
-                },
-                "platform": {
-                    "type": "string"
-                },
-                "rdpPort": {
-                    "type": "string"
-                },
-                "rdpUsername": {
-                    "type": "string"
-                },
-                "row_id": {
-                    "type": "integer"
-                },
-                "sameServer": {
-                    "type": "boolean"
-                },
-                "tags": {
-                    "type": "array",
-                    "items": {
-                        "type": "string"
+        },
+        "/admin/oauth/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
                     }
-                },
-                "user_id": {
-                    "type": "integer"
-                },
-                "user_ids": {
-                    "type": "array",
-                    "items": {
-                        "type": "integer"
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "description": "Oauth",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.OauthForm"
+                        }
                     }
-                },
-                "username": {
-                    "type": "string"
-                }
-            }
-        },
-        "admin.AuditConnLogIds": {
-            "type": "object",
-            "required": [
-                "ids"
-            ],
-            "properties": {
-                "ids": {
-                    "type": "array",
-                    "items": {
-                        "type": "integer"
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
                     }
                 }
             }
         },
-        "admin.AuditFileLogIds": {
-            "type": "object",
-            "required": [
-                "ids"
-            ],
-            "properties": {
-                "ids": {
-                    "type": "array",
-                    "items": {
-                        "type": "integer"
+        "/admin/oauth/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
                     }
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Oauth"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/info": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated OAuth handoff lookup by short-lived code.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Get cached OAuth handoff data",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "OAuth handoff code",
+                        "name": "code",
+                        "in": "query",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the OAuth provider list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of OAuth providers per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.OauthList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/unbind": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated users remove one OAuth provider binding from their account.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Unbind OAuth provider",
+                "parameters": [
+                    {
+                        "description": "OAuth provider unbinding payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UnBindOauthForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "description": "Oauth",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.OauthForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.OauthList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oidc/auth": {
+            "post": {
+                "description": "Public pre-authentication route returning the state code and provider URL for the admin OIDC flow.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Start admin OIDC authorization",
+                "responses": {
+                    "200": {
+                        "description": "Authorization state code and provider URL",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "type": "object",
+                                            "additionalProperties": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "400": {
+                        "description": "OIDC authorization could not be started",
+                        "schema": {
+                            "$ref": "#/definitions/response.ErrorResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oidc/auth-query": {
+            "get": {
+                "description": "Public pre-authentication route exchanging the OIDC state code and provider callback values for an admin login payload.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Complete admin OIDC authorization",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "400": {
+                        "description": "OIDC authorization query failed",
+                        "schema": {
+                            "$ref": "#/definitions/response.ErrorResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/batchDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "id",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerBatchDeleteForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/create": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Peer form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Peer"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Peer deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Peer"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the peer list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of peers per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Last-online time offset filter",
+                        "name": "time_ago",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Hostname filter",
+                        "name": "hostname",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "uuids ",
+                        "name": "uuids",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.PeerList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/simpleData": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated peer version lookup used by the admin panel.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Peer"
+                ],
+                "summary": "Get peer version data",
+                "parameters": [
+                    {
+                        "description": "Peer ID lookup payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.SimpleDataQuery"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.PeerList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Peer update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Peer"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdAuditList": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only paginated audit history for server-command executions.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "List server-command audit records",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of audit records per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.ServerCmdAuditList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdCreate": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Create a server command",
+                "parameters": [
+                    {
+                        "description": "Server command payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.ServerCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Delete a server command",
+                "parameters": [
+                    {
+                        "description": "Server command identifier",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.ServerCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdList": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only paginated list of built-in and configured server commands.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "List server commands",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of commands per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.ServerCmdList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdUpdate": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Update a server command",
+                "parameters": [
+                    {
+                        "description": "Server command update payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.ServerCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/sendCmd": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only command execution against the selected ID or relay server.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Send a server command",
+                "parameters": [
+                    {
+                        "description": "Server command request",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.RustdeskCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/share_record/batchDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "id",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/share_record/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Share record deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.ShareRecordForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/share_record/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "user_id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Page number for share records",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of share records per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Redacted share-record list envelope",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.ShareRecordSafeList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/create": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Tag form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Tag"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Tag deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Tag"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the tag list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of tags per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Filter for tags owned by the current user",
+                        "name": "is_my",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.TagList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Tag update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Tag"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/changeCurPwd": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Current user password change form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.ChangeCurPasswordForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/changePwd": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User password update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserPasswordForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/create": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.User"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/current": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.User"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/groupUsers": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only group and user picker data.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "List users grouped by group",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the user list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of users per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Username filter",
+                        "name": "username",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.UserList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/myOauth": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "type": "array",
+                                            "items": {
+                                                "$ref": "#/definitions/admin.UserOauthItem"
+                                            }
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/register": {
+            "post": {
+                "description": "Public registration route; the server decides whether the new account is enabled immediately.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "Register a user",
+                "parameters": [
+                    {
+                        "description": "User registration payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.RegisterForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.User"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/updateCurrent": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated users may update only their nickname and email.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "Update the current user profile",
+                "parameters": [
+                    {
+                        "description": "Current user profile update payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UpdateCurrentForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/batchDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User-token ID batch deletion payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserTokenBatchDeleteForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User-token deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.UserToken"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the user-token list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of user tokens per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Redacted user-token list envelope",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.UserTokenSafeList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        }
+    },
+    "definitions": {
+        "admin.AddressBookForm": {
+            "type": "object",
+            "required": [
+                "id"
+            ],
+            "properties": {
+                "alias": {
+                    "type": "string"
+                },
+                "collection_id": {
+                    "type": "integer"
+                },
+                "forceAlwaysRelay": {
+                    "type": "boolean"
+                },
+                "hash": {
+                    "type": "string"
+                },
+                "hostname": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "string"
+                },
+                "loginName": {
+                    "type": "string"
+                },
+                "online": {
+                    "type": "boolean"
+                },
+                "password": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "rdpPort": {
+                    "type": "string"
+                },
+                "rdpUsername": {
+                    "type": "string"
+                },
+                "row_id": {
+                    "type": "integer"
+                },
+                "sameServer": {
+                    "type": "boolean"
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "user_id": {
+                    "type": "integer"
+                },
+                "user_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.AuditConnLogIds": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.AuditFileLogIds": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.BatchCreateFromPeersForm": {
+            "type": "object",
+            "properties": {
+                "collection_id": {
+                    "type": "integer"
+                },
+                "peer_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "admin.BatchUpdateTagsForm": {
+            "type": "object",
+            "properties": {
+                "row_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
+        "admin.BindOauthForm": {
+            "type": "object",
+            "required": [
+                "op"
+            ],
+            "properties": {
+                "op": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.ChangeCurPasswordForm": {
+            "type": "object",
+            "required": [
+                "new_password",
+                "old_password"
+            ],
+            "properties": {
+                "new_password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                },
+                "old_password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                }
+            }
+        },
+        "admin.CustomBuildForm": {
+            "type": "object",
+            "required": [
+                "name",
+                "platform",
+                "version"
+            ],
+            "properties": {
+                "app_name": {
+                    "type": "string"
+                },
+                "custom_json": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.CustomPresetForm": {
+            "type": "object",
+            "required": [
+                "name",
+                "platform",
+                "version"
+            ],
+            "properties": {
+                "app_name": {
+                    "type": "string"
+                },
+                "custom_json": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.DeviceGroupForm": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.GithubBuildConfigForm": {
+            "type": "object",
+            "properties": {
+                "payload_key": {
+                    "type": "string"
+                },
+                "repo": {
+                    "type": "string"
+                },
+                "token": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.GroupForm": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "type": {
+                    "type": "integer"
+                }
+            }
+        },
+        "admin.LoginLogIds": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.LoginPayload": {
+            "type": "object",
+            "properties": {
+                "avatar": {
+                    "type": "string"
+                },
+                "email": {
+                    "type": "string"
+                },
+                "nickname": {
+                    "type": "string"
+                },
+                "route_names": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "token": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.OauthConfirmForm": {
+            "type": "object",
+            "required": [
+                "code"
+            ],
+            "properties": {
+                "code": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.OauthForm": {
+            "type": "object",
+            "required": [
+                "client_id",
+                "client_secret",
+                "oauth_type"
+            ],
+            "properties": {
+                "auto_register": {
+                    "type": "boolean"
+                },
+                "client_id": {
+                    "type": "string"
+                },
+                "client_secret": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "issuer": {
+                    "type": "string"
+                },
+                "oauth_type": {
+                    "type": "string"
+                },
+                "op": {
+                    "type": "string"
+                },
+                "pkce_enable": {
+                    "type": "boolean"
+                },
+                "pkce_method": {
+                    "description": "PkceMethod is constrained to S256/plain when set. When pkce_enable is\ntrue the field is required so the runtime layer can pick a hashing\nstrategy without falling back to a hidden default. When pkce_enable is\nfalse/nil it is ignored and may be empty.",
+                    "type": "string",
+                    "enum": [
+                        "S256",
+                        "plain"
+                    ]
+                },
+                "scopes": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.PeerBatchDeleteForm": {
+            "type": "object",
+            "required": [
+                "row_ids"
+            ],
+            "properties": {
+                "row_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.PeerForm": {
+            "type": "object",
+            "properties": {
+                "alias": {
+                    "type": "string"
+                },
+                "cpu": {
+                    "type": "string"
+                },
+                "group_id": {
+                    "type": "integer"
+                },
+                "hostname": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "string"
+                },
+                "memory": {
+                    "type": "string"
+                },
+                "os": {
+                    "type": "string"
+                },
+                "row_id": {
+                    "type": "integer"
+                },
+                "username": {
+                    "type": "string"
+                },
+                "uuid": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.PeerShareRecordBatchDeleteForm": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.RegisterForm": {
+            "type": "object",
+            "required": [
+                "confirm_password",
+                "password",
+                "username"
+            ],
+            "properties": {
+                "confirm_password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                },
+                "email": {
+                    "description": "validate:\"required,email\"",
+                    "type": "string"
+                },
+                "password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                },
+                "username": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 2
+                }
+            }
+        },
+        "admin.RustdeskCmd": {
+            "type": "object",
+            "properties": {
+                "cmd": {
+                    "type": "string"
+                },
+                "option": {
+                    "type": "string"
+                },
+                "target": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.ShareByWebClientForm": {
+            "type": "object",
+            "required": [
+                "id",
+                "password",
+                "password_type"
+            ],
+            "properties": {
+                "expire": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "string"
+                },
+                "password": {
+                    "type": "string"
+                },
+                "password_type": {
+                    "description": "once,fixed",
+                    "type": "string",
+                    "enum": [
+                        "once",
+                        "fixed"
+                    ]
+                }
+            }
+        },
+        "admin.ShareRecordForm": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "admin.SimpleDataQuery": {
+            "type": "object",
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
+        "admin.TagForm": {
+            "type": "object",
+            "required": [
+                "color",
+                "name"
+            ],
+            "properties": {
+                "collection_id": {
+                    "type": "integer"
+                },
+                "color": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.ChangeCurPasswordForm": {
+        "admin.UnBindOauthForm": {
             "type": "object",
             "required": [
-                "new_password",
-                "old_password"
+                "op"
             ],
             "properties": {
-                "new_password": {
+                "op": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.UpdateCurrentForm": {
+            "type": "object",
+            "properties": {
+                "email": {
                     "type": "string",
-                    "maxLength": 32,
-                    "minLength": 4
+                    "maxLength": 128
                 },
-                "old_password": {
+                "nickname": {
                     "type": "string",
-                    "maxLength": 32,
-                    "minLength": 4
+                    "maxLength": 128
                 }
             }
         },
-        "admin.DeviceGroupForm": {
+        "admin.UserForm": {
             "type": "object",
             "required": [
-                "name"
+                "group_id",
+                "status",
+                "username"
             ],
             "properties": {
+                "avatar": {
+                    "type": "string"
+                },
+                "email": {
+                    "description": "validate:\"required,email\" email",
+                    "type": "string"
+                },
+                "group_id": {
+                    "type": "integer"
+                },
                 "id": {
                     "type": "integer"
                 },
-                "name": {
+                "is_admin": {
+                    "type": "boolean"
+                },
+                "nickname": {
+                    "description": "Password string           ` + "`" + `json:\"password\" validate:\"required,gte=4,lte=20\"` + "`" + `",
+                    "type": "string"
+                },
+                "remark": {
+                    "type": "string"
+                },
+                "status": {
+                    "minimum": 0,
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/model.StatusCode"
+                        }
+                    ]
+                },
+                "username": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 2
+                }
+            }
+        },
+        "admin.UserOauthItem": {
+            "type": "object",
+            "properties": {
+                "op": {
                     "type": "string"
+                },
+                "status": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.GroupForm": {
+        "admin.UserPasswordForm": {
             "type": "object",
             "required": [
-                "name"
+                "id",
+                "password"
             ],
             "properties": {
                 "id": {
                     "type": "integer"
                 },
-                "name": {
-                    "type": "string"
-                },
-                "type": {
-                    "type": "integer"
+                "password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
                 }
             }
         },
-        "admin.LoginLogIds": {
+        "admin.UserTokenBatchDeleteForm": {
             "type": "object",
             "required": [
                 "ids"
@@ -5538,381 +7913,434 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "admin.LoginPayload": {
+        "admin.WorkflowRefApprovalForm": {
             "type": "object",
             "properties": {
-                "avatar": {
-                    "type": "string"
+                "confirm": {
+                    "type": "boolean"
                 },
-                "email": {
+                "workflow_tag": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.versionOption": {
+            "type": "object",
+            "properties": {
+                "assets_release": {
                     "type": "string"
                 },
-                "nickname": {
+                "version": {
                     "type": "string"
+                }
+            }
+        },
+        "admin.versionsResponse": {
+            "type": "object",
+            "properties": {
+                "error": {
+                    "type": "boolean"
                 },
-                "route_names": {
+                "versions": {
                     "type": "array",
                     "items": {
-                        "type": "string"
+                        "$ref": "#/definitions/admin.versionOption"
                     }
+                }
+            }
+        },
+        "model.AddressBookCollection": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "created_at": {
+                    "type": "string"
                 },
-                "token": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
                     "type": "string"
                 },
-                "username": {
+                "updated_at": {
                     "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.OauthForm": {
+        "model.AddressBookCollectionList": {
+            "type": "object",
+            "properties": {
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.AddressBookCollection"
+                    }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.AddressBookCollectionRule": {
             "type": "object",
             "required": [
-                "client_id",
-                "client_secret",
-                "oauth_type"
+                "collection_id",
+                "rule",
+                "to_id",
+                "type"
             ],
             "properties": {
-                "auto_register": {
-                    "type": "boolean"
-                },
-                "client_id": {
-                    "type": "string"
+                "collection_id": {
+                    "type": "integer"
                 },
-                "client_secret": {
+                "created_at": {
                     "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "issuer": {
-                    "type": "string"
-                },
-                "oauth_type": {
-                    "type": "string"
+                "rule": {
+                    "description": "0:  1:  2:   3:",
+                    "type": "integer",
+                    "maximum": 3,
+                    "minimum": 1
                 },
-                "op": {
-                    "type": "string"
+                "to_id": {
+                    "type": "integer"
                 },
-                "pkce_enable": {
-                    "type": "boolean"
+                "type": {
+                    "description": "1:  2:",
+                    "type": "integer",
+                    "maximum": 2,
+                    "minimum": 1
                 },
-                "pkce_method": {
+                "updated_at": {
                     "type": "string"
                 },
-                "scopes": {
-                    "type": "string"
+                "user_id": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.PeerBatchDeleteForm": {
+        "model.AddressBookCollectionRuleList": {
             "type": "object",
-            "required": [
-                "row_ids"
-            ],
             "properties": {
-                "row_ids": {
+                "list": {
                     "type": "array",
                     "items": {
-                        "type": "integer"
+                        "$ref": "#/definitions/model.AddressBookCollectionRule"
                     }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.PeerForm": {
+        "model.AddressBookSafe": {
             "type": "object",
             "properties": {
-                "cpu": {
+                "alias": {
                     "type": "string"
                 },
-                "group_id": {
+                "collection": {
+                    "$ref": "#/definitions/model.AddressBookCollection"
+                },
+                "collection_id": {
                     "type": "integer"
                 },
+                "created_at": {
+                    "type": "string"
+                },
+                "forceAlwaysRelay": {
+                    "type": "boolean"
+                },
                 "hostname": {
                     "type": "string"
                 },
                 "id": {
                     "type": "string"
                 },
-                "memory": {
+                "loginName": {
+                    "type": "string"
+                },
+                "online": {
+                    "type": "boolean"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "rdpPort": {
+                    "type": "string"
+                },
+                "rdpUsername": {
                     "type": "string"
                 },
-                "os": {
+                "row_id": {
+                    "type": "integer"
+                },
+                "sameServer": {
+                    "type": "boolean"
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "updated_at": {
                     "type": "string"
                 },
-                "row_id": {
+                "user_id": {
                     "type": "integer"
                 },
                 "username": {
                     "type": "string"
-                },
-                "uuid": {
-                    "type": "string"
-                },
-                "version": {
-                    "type": "string"
                 }
             }
         },
-        "admin.PeerShareRecordBatchDeleteForm": {
+        "model.AddressBookSafeList": {
             "type": "object",
-            "required": [
-                "ids"
-            ],
             "properties": {
-                "ids": {
+                "list": {
                     "type": "array",
                     "items": {
-                        "type": "integer"
+                        "$ref": "#/definitions/model.AddressBookSafe"
                     }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.ShareByWebClientForm": {
+        "model.AuditConn": {
             "type": "object",
-            "required": [
-                "id",
-                "password",
-                "password_type"
-            ],
             "properties": {
-                "expire": {
+                "action": {
+                    "type": "string"
+                },
+                "close_time": {
                     "type": "integer"
                 },
-                "id": {
+                "conn_id": {
+                    "type": "integer"
+                },
+                "created_at": {
                     "type": "string"
                 },
-                "password": {
+                "from_name": {
+                    "type": "string"
+                },
+                "from_peer": {
                     "type": "string"
                 },
-                "password_type": {
-                    "description": "只能是once,fixed",
-                    "type": "string",
-                    "enum": [
-                        "once",
-                        "fixed"
-                    ]
-                }
-            }
-        },
-        "admin.ShareRecordForm": {
-            "type": "object",
-            "properties": {
                 "id": {
                     "type": "integer"
                 },
-                "user_id": {
+                "ip": {
+                    "type": "string"
+                },
+                "peer_id": {
+                    "type": "string"
+                },
+                "session_id": {
+                    "type": "string"
+                },
+                "type": {
                     "type": "integer"
+                },
+                "updated_at": {
+                    "type": "string"
+                },
+                "uuid": {
+                    "type": "string"
                 }
             }
         },
-        "admin.TagForm": {
+        "model.AuditConnList": {
             "type": "object",
-            "required": [
-                "color",
-                "name"
-            ],
             "properties": {
-                "collection_id": {
-                    "type": "integer"
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.AuditConn"
+                    }
                 },
-                "color": {
+                "page": {
                     "type": "integer"
                 },
-                "id": {
+                "page_size": {
                     "type": "integer"
                 },
-                "name": {
-                    "type": "string"
-                },
-                "user_id": {
+                "total": {
                     "type": "integer"
                 }
             }
         },
-        "admin.UserForm": {
+        "model.AuditFile": {
             "type": "object",
-            "required": [
-                "group_id",
-                "status",
-                "username"
-            ],
             "properties": {
-                "avatar": {
+                "created_at": {
                     "type": "string"
                 },
-                "email": {
-                    "description": "validate:\"required,email\" email不强制",
+                "from_name": {
                     "type": "string"
                 },
-                "group_id": {
-                    "type": "integer"
+                "from_peer": {
+                    "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "is_admin": {
-                    "type": "boolean"
+                "info": {
+                    "type": "string"
                 },
-                "nickname": {
-                    "description": "Password string           ` + "`" + `json:\"password\" validate:\"required,gte=4,lte=20\"` + "`" + `",
+                "ip": {
                     "type": "string"
                 },
-                "status": {
-                    "minimum": 0,
-                    "allOf": [
-                        {
-                            "$ref": "#/definitions/model.StatusCode"
-                        }
-                    ]
+                "is_file": {
+                    "type": "boolean"
                 },
-                "username": {
-                    "type": "string",
-                    "maxLength": 32,
-                    "minLength": 2
-                }
-            }
-        },
-        "admin.UserOauthItem": {
-            "type": "object",
-            "properties": {
-                "op": {
+                "num": {
+                    "type": "integer"
+                },
+                "path": {
                     "type": "string"
                 },
-                "status": {
-                    "type": "integer"
-                }
-            }
-        },
-        "admin.UserPasswordForm": {
-            "type": "object",
-            "required": [
-                "id",
-                "password"
-            ],
-            "properties": {
-                "id": {
+                "peer_id": {
+                    "type": "string"
+                },
+                "type": {
                     "type": "integer"
                 },
-                "password": {
-                    "type": "string",
-                    "maxLength": 32,
-                    "minLength": 4
+                "updated_at": {
+                    "type": "string"
+                },
+                "uuid": {
+                    "type": "string"
                 }
             }
         },
-        "admin.UserTokenBatchDeleteForm": {
+        "model.AuditFileList": {
             "type": "object",
-            "required": [
-                "ids"
-            ],
             "properties": {
-                "ids": {
+                "list": {
                     "type": "array",
                     "items": {
-                        "type": "integer"
+                        "$ref": "#/definitions/model.AuditFile"
                     }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
-        "github_com_lejianwen_rustdesk-api_v2_http_request_admin.Login": {
+        "model.CustomBuildPublic": {
             "type": "object",
-            "required": [
-                "password",
-                "username"
-            ],
             "properties": {
-                "captcha": {
+                "app_name": {
                     "type": "string"
                 },
-                "captcha_id": {
-                    "type": "string"
+                "download_key_expires_at": {
+                    "type": "integer"
                 },
-                "password": {
+                "file_size": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
                     "type": "string"
                 },
                 "platform": {
                     "type": "string"
                 },
-                "username": {
+                "status": {
+                    "type": "string"
+                },
+                "version": {
                     "type": "string"
                 }
             }
         },
-        "model.AddressBook": {
+        "model.CustomBuildSafe": {
             "type": "object",
             "properties": {
-                "alias": {
+                "app_name": {
                     "type": "string"
                 },
-                "collection": {
-                    "$ref": "#/definitions/model.AddressBookCollection"
-                },
-                "collection_id": {
-                    "type": "integer"
+                "build_log": {
+                    "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
-                "forceAlwaysRelay": {
-                    "type": "boolean"
-                },
-                "hash": {
+                "custom_json": {
                     "type": "string"
                 },
-                "hostname": {
-                    "type": "string"
+                "download_key_expires_at": {
+                    "type": "integer"
                 },
-                "id": {
-                    "type": "string"
+                "file_size": {
+                    "type": "integer"
                 },
-                "loginName": {
-                    "type": "string"
+                "github_artifact_id": {
+                    "type": "integer"
                 },
-                "online": {
-                    "type": "boolean"
+                "github_artifact_name": {
+                    "type": "string"
                 },
-                "password": {
+                "github_html_url": {
                     "type": "string"
                 },
-                "platform": {
+                "github_provider": {
                     "type": "string"
                 },
-                "rdpPort": {
+                "github_ref": {
                     "type": "string"
                 },
-                "rdpUsername": {
+                "github_repo": {
                     "type": "string"
                 },
-                "row_id": {
+                "github_run_id": {
                     "type": "integer"
                 },
-                "sameServer": {
-                    "type": "boolean"
-                },
-                "tags": {
-                    "type": "array",
-                    "items": {
-                        "type": "string"
-                    }
-                },
-                "updated_at": {
+                "github_run_url": {
                     "type": "string"
                 },
-                "user_id": {
-                    "type": "integer"
-                },
-                "username": {
+                "github_source_sha": {
                     "type": "string"
-                }
-            }
-        },
-        "model.AddressBookCollection": {
-            "type": "object",
-            "required": [
-                "name"
-            ],
-            "properties": {
-                "created_at": {
+                },
+                "github_workflow": {
                     "type": "string"
                 },
                 "id": {
@@ -5921,21 +8349,30 @@ const docTemplateadmin = `{
                 "name": {
                     "type": "string"
                 },
+                "platform": {
+                    "type": "string"
+                },
+                "status": {
+                    "type": "string"
+                },
                 "updated_at": {
                     "type": "string"
                 },
                 "user_id": {
                     "type": "integer"
+                },
+                "version": {
+                    "type": "string"
                 }
             }
         },
-        "model.AddressBookCollectionList": {
+        "model.CustomBuildSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AddressBookCollection"
+                        "$ref": "#/definitions/model.CustomBuildSafe"
                     }
                 },
                 "page": {
@@ -5949,54 +8386,45 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.AddressBookCollectionRule": {
+        "model.CustomPresetSafe": {
             "type": "object",
-            "required": [
-                "collection_id",
-                "rule",
-                "to_id",
-                "type"
-            ],
             "properties": {
-                "collection_id": {
-                    "type": "integer"
+                "app_name": {
+                    "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
+                "custom_json": {
+                    "type": "string"
+                },
                 "id": {
                     "type": "integer"
                 },
-                "rule": {
-                    "description": "0: 无 1: 读 2: 读写  3: 完全控制",
-                    "type": "integer",
-                    "maximum": 3,
-                    "minimum": 1
-                },
-                "to_id": {
-                    "type": "integer"
+                "name": {
+                    "type": "string"
                 },
-                "type": {
-                    "description": "1: 个人 2: 群组",
-                    "type": "integer",
-                    "maximum": 2,
-                    "minimum": 1
+                "platform": {
+                    "type": "string"
                 },
                 "updated_at": {
                     "type": "string"
                 },
                 "user_id": {
                     "type": "integer"
+                },
+                "version": {
+                    "type": "string"
                 }
             }
         },
-        "model.AddressBookList": {
+        "model.CustomPresetSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AddressBook"
+                        "$ref": "#/definitions/model.CustomPresetSafe"
                     }
                 },
                 "page": {
@@ -6010,57 +8438,85 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.AuditConn": {
+        "model.DeviceGroup": {
             "type": "object",
             "properties": {
-                "action": {
+                "created_at": {
                     "type": "string"
                 },
-                "close_time": {
+                "id": {
                     "type": "integer"
                 },
-                "conn_id": {
-                    "type": "integer"
+                "name": {
+                    "type": "string"
                 },
+                "updated_at": {
+                    "type": "string"
+                }
+            }
+        },
+        "model.GithubBuildConfigSafe": {
+            "type": "object",
+            "properties": {
                 "created_at": {
                     "type": "string"
                 },
-                "from_name": {
-                    "type": "string"
+                "has_payload_key": {
+                    "type": "boolean"
                 },
-                "from_peer": {
-                    "type": "string"
+                "has_token": {
+                    "type": "boolean"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "ip": {
+                "repo": {
                     "type": "string"
                 },
-                "peer_id": {
+                "updated_at": {
                     "type": "string"
                 },
-                "session_id": {
+                "workflow_ref": {
                     "type": "string"
                 },
-                "type": {
+                "workflow_ref_approved": {
+                    "type": "boolean"
+                },
+                "workflow_ref_status": {
+                    "type": "string"
+                },
+                "workflow_ref_trust_status": {
+                    "type": "string"
+                }
+            }
+        },
+        "model.Group": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string"
+                },
+                "id": {
                     "type": "integer"
                 },
-                "updated_at": {
+                "name": {
                     "type": "string"
                 },
-                "uuid": {
+                "type": {
+                    "type": "integer"
+                },
+                "updated_at": {
                     "type": "string"
                 }
             }
         },
-        "model.AuditConnList": {
+        "model.GroupList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AuditConn"
+                        "$ref": "#/definitions/model.Group"
                     }
                 },
                 "page": {
@@ -6074,57 +8530,57 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.AuditFile": {
+        "model.LoginLog": {
             "type": "object",
             "properties": {
-                "created_at": {
+                "client": {
+                    "description": "webadmin,webclient,app,",
                     "type": "string"
                 },
-                "from_name": {
+                "created_at": {
                     "type": "string"
                 },
-                "from_peer": {
+                "device_id": {
                     "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "info": {
-                    "type": "string"
-                },
                 "ip": {
                     "type": "string"
                 },
-                "is_file": {
-                    "type": "boolean"
-                },
-                "num": {
+                "is_deleted": {
                     "type": "integer"
                 },
-                "path": {
-                    "type": "string"
-                },
-                "peer_id": {
+                "platform": {
+                    "description": "windows,linux,mac,android,ios",
                     "type": "string"
                 },
                 "type": {
-                    "type": "integer"
+                    "description": "account,oauth",
+                    "type": "string"
                 },
                 "updated_at": {
                     "type": "string"
                 },
+                "user_id": {
+                    "type": "integer"
+                },
+                "user_token_id": {
+                    "type": "integer"
+                },
                 "uuid": {
                     "type": "string"
                 }
             }
         },
-        "model.AuditFileList": {
+        "model.LoginLogList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AuditFile"
+                        "$ref": "#/definitions/model.LoginLog"
                     }
                 },
                 "page": {
@@ -6138,50 +8594,52 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.DeviceGroup": {
+        "model.Oauth": {
             "type": "object",
             "properties": {
+                "auto_register": {
+                    "description": "RedirectUrl  string ` + "`" + `json:\"redirect_url\"` + "`" + `",
+                    "type": "boolean"
+                },
+                "client_id": {
+                    "type": "string"
+                },
                 "created_at": {
                     "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "name": {
+                "issuer": {
                     "type": "string"
                 },
-                "updated_at": {
+                "oauth_type": {
                     "type": "string"
-                }
-            }
-        },
-        "model.Group": {
-            "type": "object",
-            "properties": {
-                "created_at": {
+                },
+                "op": {
                     "type": "string"
                 },
-                "id": {
-                    "type": "integer"
+                "pkce_enable": {
+                    "type": "boolean"
                 },
-                "name": {
+                "pkce_method": {
                     "type": "string"
                 },
-                "type": {
-                    "type": "integer"
+                "scopes": {
+                    "type": "string"
                 },
                 "updated_at": {
                     "type": "string"
                 }
             }
         },
-        "model.GroupList": {
+        "model.OauthList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.Group"
+                        "$ref": "#/definitions/model.Oauth"
                     }
                 },
                 "page": {
@@ -6195,57 +8653,69 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.LoginLog": {
+        "model.Peer": {
             "type": "object",
             "properties": {
-                "client": {
-                    "description": "webadmin,webclient,app,",
+                "alias": {
+                    "type": "string"
+                },
+                "cpu": {
                     "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
-                "device_id": {
+                "group_id": {
+                    "type": "integer"
+                },
+                "hostname": {
                     "type": "string"
                 },
                 "id": {
-                    "type": "integer"
+                    "type": "string"
                 },
-                "ip": {
+                "last_online_ip": {
                     "type": "string"
                 },
-                "is_deleted": {
+                "last_online_time": {
                     "type": "integer"
                 },
-                "platform": {
-                    "description": "windows,linux,mac,android,ios",
+                "memory": {
                     "type": "string"
                 },
-                "type": {
-                    "description": "account,oauth",
+                "os": {
                     "type": "string"
                 },
+                "row_id": {
+                    "type": "integer"
+                },
                 "updated_at": {
                     "type": "string"
                 },
+                "user": {
+                    "$ref": "#/definitions/model.User"
+                },
                 "user_id": {
                     "type": "integer"
                 },
-                "user_token_id": {
-                    "type": "integer"
+                "username": {
+                    "type": "string"
                 },
                 "uuid": {
                     "type": "string"
+                },
+                "version": {
+                    "type": "string"
                 }
             }
         },
-        "model.LoginLogList": {
+        "model.PeerList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.LoginLog"
+                        "$ref": "#/definitions/model.Peer"
                     }
                 },
                 "page": {
@@ -6259,54 +8729,77 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.Oauth": {
+        "model.ServerCmd": {
             "type": "object",
             "properties": {
-                "auto_register": {
-                    "type": "boolean"
-                },
-                "client_id": {
+                "alias": {
                     "type": "string"
                 },
-                "client_secret": {
+                "cmd": {
                     "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
+                "explain": {
+                    "type": "string"
+                },
                 "id": {
                     "type": "integer"
                 },
-                "issuer": {
+                "option": {
                     "type": "string"
                 },
-                "oauth_type": {
+                "target": {
                     "type": "string"
                 },
-                "op": {
+                "updated_at": {
+                    "type": "string"
+                }
+            }
+        },
+        "model.ServerCmdAudit": {
+            "type": "object",
+            "properties": {
+                "created_at": {
                     "type": "string"
                 },
-                "pkce_enable": {
-                    "type": "boolean"
+                "id": {
+                    "type": "integer"
                 },
-                "pkce_method": {
+                "ip": {
+                    "type": "string"
+                },
+                "method": {
                     "type": "string"
                 },
-                "scopes": {
+                "params": {
+                    "type": "string"
+                },
+                "path": {
+                    "type": "string"
+                },
+                "status": {
+                    "type": "integer"
+                },
+                "updated_at": {
                     "type": "string"
                 },
-                "updated_at": {
+                "user_id": {
+                    "type": "integer"
+                },
+                "username": {
                     "type": "string"
                 }
             }
         },
-        "model.OauthList": {
+        "model.ServerCmdAuditList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.Oauth"
+                        "$ref": "#/definitions/model.ServerCmdAudit"
                     }
                 },
                 "page": {
@@ -6320,66 +8813,56 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.Peer": {
+        "model.ServerCmdList": {
             "type": "object",
             "properties": {
-                "cpu": {
-                    "type": "string"
-                },
-                "created_at": {
-                    "type": "string"
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.ServerCmd"
+                    }
                 },
-                "group_id": {
+                "page": {
                     "type": "integer"
                 },
-                "hostname": {
-                    "type": "string"
-                },
-                "id": {
-                    "type": "string"
+                "page_size": {
+                    "type": "integer"
                 },
-                "last_online_ip": {
+                "total": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.ShareRecordSafe": {
+            "type": "object",
+            "properties": {
+                "created_at": {
                     "type": "string"
                 },
-                "last_online_time": {
+                "expire": {
                     "type": "integer"
                 },
-                "memory": {
-                    "type": "string"
+                "id": {
+                    "type": "integer"
                 },
-                "os": {
+                "peer_id": {
                     "type": "string"
                 },
-                "row_id": {
-                    "type": "integer"
-                },
                 "updated_at": {
                     "type": "string"
                 },
-                "user": {
-                    "$ref": "#/definitions/model.User"
-                },
                 "user_id": {
                     "type": "integer"
-                },
-                "username": {
-                    "type": "string"
-                },
-                "uuid": {
-                    "type": "string"
-                },
-                "version": {
-                    "type": "string"
                 }
             }
         },
-        "model.PeerList": {
+        "model.ShareRecordSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.Peer"
+                        "$ref": "#/definitions/model.ShareRecordSafe"
                     }
                 },
                 "page": {
@@ -6399,10 +8882,6 @@ const docTemplateadmin = `{
                 1,
                 2
             ],
-            "x-enum-comments": {
-                "COMMON_STATUS_DISABLED": "通用状态 禁用",
-                "COMMON_STATUS_ENABLE": "通用状态 启用"
-            },
             "x-enum-varnames": [
                 "COMMON_STATUS_ENABLE",
                 "COMMON_STATUS_DISABLED"
@@ -6418,7 +8897,7 @@ const docTemplateadmin = `{
                     "type": "integer"
                 },
                 "color": {
-                    "description": "color 是flutter的颜色值,从0x00000000 到 0xFFFFFFFF; 前两位表示透明度，后面6位表示颜色, 可以转成rgba",
+                    "description": "color flutter,0x00000000  0xFFFFFFFF; ，6, rgba",
                     "type": "integer"
                 },
                 "created_at": {
@@ -6482,6 +8961,9 @@ const docTemplateadmin = `{
                 "nickname": {
                     "type": "string"
                 },
+                "remark": {
+                    "type": "string"
+                },
                 "status": {
                     "$ref": "#/definitions/model.StatusCode"
                 },
@@ -6514,6 +8996,32 @@ const docTemplateadmin = `{
             }
         },
         "model.UserToken": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string"
+                },
+                "device_id": {
+                    "type": "string"
+                },
+                "device_uuid": {
+                    "type": "string"
+                },
+                "expired_at": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "updated_at": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.UserTokenSafe": {
             "type": "object",
             "properties": {
                 "created_at": {
@@ -6542,13 +9050,13 @@ const docTemplateadmin = `{
                 }
             }
         },
-        "model.UserTokenList": {
+        "model.UserTokenSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.UserToken"
+                        "$ref": "#/definitions/model.UserTokenSafe"
                     }
                 },
                 "page": {
@@ -6581,6 +9089,231 @@ const docTemplateadmin = `{
                     "type": "string"
                 }
             }
+        },
+        "rustdesk-server_api_http_request_admin.Login": {
+            "type": "object",
+            "required": [
+                "password",
+                "username"
+            ],
+            "properties": {
+                "captcha": {
+                    "type": "string"
+                },
+                "captcha_id": {
+                    "type": "string"
+                },
+                "password": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffAsset": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "provider_digest": {
+                    "type": "string"
+                },
+                "verification_scope": {
+                    "type": "string"
+                },
+                "verification_status": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffManifest": {
+            "type": "object",
+            "properties": {
+                "artifact_id": {
+                    "type": "integer"
+                },
+                "artifact_name": {
+                    "type": "string"
+                },
+                "build_id": {
+                    "type": "integer"
+                },
+                "digest_scope": {
+                    "type": "string"
+                },
+                "export_route": {
+                    "type": "string"
+                },
+                "handoff_contract": {
+                    "type": "string"
+                },
+                "manifest_schema": {
+                    "type": "string"
+                },
+                "output_files": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/service.BuildHandoffOutputFile"
+                    }
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "producer_report": {
+                    "$ref": "#/definitions/service.BuildHandoffProducerReport"
+                },
+                "provider": {
+                    "type": "string"
+                },
+                "publication_recorded_at": {
+                    "type": "integer"
+                },
+                "publication_timestamp": {
+                    "type": "integer"
+                },
+                "published_digest": {
+                    "type": "string"
+                },
+                "published_digest_scope": {
+                    "type": "string"
+                },
+                "release_assets": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/service.BuildHandoffAsset"
+                    }
+                },
+                "release_id": {
+                    "type": "integer"
+                },
+                "release_repository": {
+                    "type": "string"
+                },
+                "release_tag": {
+                    "type": "string"
+                },
+                "repository": {
+                    "type": "string"
+                },
+                "run_head_sha": {
+                    "type": "string"
+                },
+                "run_html_url": {
+                    "type": "string"
+                },
+                "run_id": {
+                    "type": "integer"
+                },
+                "run_url": {
+                    "type": "string"
+                },
+                "schema": {
+                    "type": "string"
+                },
+                "schema_version": {
+                    "type": "integer"
+                },
+                "source_sha": {
+                    "type": "string"
+                },
+                "source_tag": {
+                    "type": "string"
+                },
+                "status": {
+                    "type": "string"
+                },
+                "verification_result": {
+                    "type": "string"
+                },
+                "verification_scope": {
+                    "type": "string"
+                },
+                "verification_status": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                },
+                "workflow_path": {
+                    "type": "string"
+                },
+                "workflow_repository": {
+                    "type": "string"
+                },
+                "workflow_selector": {
+                    "type": "string"
+                },
+                "workflow_sha": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffOutputFile": {
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string"
+                },
+                "sha256": {
+                    "type": "string"
+                },
+                "size": {
+                    "type": "integer"
+                }
+            }
+        },
+        "service.BuildHandoffProducerReport": {
+            "type": "object",
+            "properties": {
+                "source_tree_sha": {
+                    "type": "string"
+                },
+                "submodules": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/service.BuildHandoffSubmodule"
+                    }
+                },
+                "verification_result": {
+                    "type": "string"
+                },
+                "verification_scope": {
+                    "type": "string"
+                },
+                "verification_status": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffSubmodule": {
+            "type": "object",
+            "properties": {
+                "commit_sha": {
+                    "type": "string"
+                },
+                "path": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.WorkflowTagOption": {
+            "type": "object",
+            "properties": {
+                "label": {
+                    "type": "string"
+                },
+                "tag": {
+                    "type": "string"
+                }
+            }
         }
     },
     "securityDefinitions": {
@@ -6603,8 +9336,8 @@ var SwaggerInfoadmin = &swag.Spec{
 	Host:             "",
 	BasePath:         "/api",
 	Schemes:          []string{},
-	Title:            "管理系统API",
-	Description:      "接口",
+	Title:            "API",
+	Description:      "",
 	InfoInstanceName: "admin",
 	SwaggerTemplate:  docTemplateadmin,
 	LeftDelim:        "{{",
diff --git a/api/docs/admin/admin_swagger.json b/api/docs/admin/admin_swagger.json
index 6e4df7e..67f8e0e 100644
--- a/api/docs/admin/admin_swagger.json
+++ b/api/docs/admin/admin_swagger.json
@@ -1,8 +1,7 @@
 {
     "swagger": "2.0",
     "info": {
-        "description": "接口",
-        "title": "管理系统API",
+        "title": "API",
         "contact": {},
         "version": "1.0"
     },
@@ -15,7 +14,6 @@
                         "token": []
                     }
                 ],
-                "description": "批量创建地址簿",
                 "consumes": [
                     "application/json"
                 ],
@@ -23,12 +21,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "批量创建地址簿",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Address book batch-create form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -41,19 +38,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -65,14 +50,14 @@
                 }
             }
         },
-        "/admin/address_book/create": {
+        "/admin/address_book/batchCreateFromPeers": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿",
+                "description": "Admin-only batch creation of address-book entries from existing peers.",
                 "consumes": [
                     "application/json"
                 ],
@@ -80,17 +65,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "创建地址簿",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Peer IDs and address-book destination payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
+                            "$ref": "#/definitions/admin.BatchCreateFromPeersForm"
                         }
                     }
                 ],
@@ -98,19 +82,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -122,14 +94,13 @@
                 }
             }
         },
-        "/admin/address_book/delete": {
+        "/admin/address_book/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -137,12 +108,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿删除",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Address book entry form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -167,14 +137,13 @@
                 }
             }
         },
-        "/admin/address_book/detail/{id}": {
-            "get": {
+        "/admin/address_book/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -182,35 +151,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿详情",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Address book entry deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.AddressBookForm"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -229,7 +187,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -237,38 +194,37 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the address book list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of entries per address book page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "用户id",
+                        "description": "id",
                         "name": "user_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
+                        "description": "Filter for address books owned by the current user",
                         "name": "is_my",
                         "in": "query"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted address-book list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -278,7 +234,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookList"
+                                            "$ref": "#/definitions/model.AddressBookSafeList"
                                         }
                                     }
                                 }
@@ -294,14 +250,14 @@
                 }
             }
         },
-        "/admin/address_book/share": {
+        "/admin/address_book/shareByWebClient": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿分享",
+                "description": "Authenticated web-client share route; requires the admin API token but not AdminPrivilege.",
                 "consumes": [
                     "application/json"
                 ],
@@ -309,12 +265,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿分享",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Web client address book sharing form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -346,7 +301,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -354,12 +308,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿"
+                    ""
                 ],
-                "summary": "地址簿编辑",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Address book entry update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -372,19 +325,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -403,7 +344,6 @@
                         "token": []
                     }
                 ],
-                "description": "创建地址簿名称",
                 "consumes": [
                     "application/json"
                 ],
@@ -411,12 +351,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "创建地址簿名称",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Address book collection form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -429,19 +368,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -460,7 +387,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿名称删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -468,12 +394,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称删除",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Address book collection deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -505,7 +430,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿名称详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -513,9 +437,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称详情",
                 "parameters": [
                     {
                         "type": "integer",
@@ -529,19 +452,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -560,7 +471,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿名称列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -568,31 +478,30 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the address book collection list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of collections per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
+                        "description": "Filter for collections owned by the current user",
                         "name": "is_my",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "用户id",
+                        "description": "id",
                         "name": "user_id",
                         "in": "query"
                     }
@@ -632,7 +541,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿名称编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -640,12 +548,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿名称"
+                    ""
                 ],
-                "summary": "地址簿名称编辑",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Address book collection update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -658,19 +565,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -689,7 +584,6 @@
                         "token": []
                     }
                 ],
-                "description": "创建地址簿规则",
                 "consumes": [
                     "application/json"
                 ],
@@ -697,12 +591,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "创建地址簿规则",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Address book collection rule form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -715,19 +608,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -746,7 +627,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿规则删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -754,12 +634,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则删除",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Address book collection rule deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -791,7 +670,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿规则详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -799,9 +677,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则详情",
                 "parameters": [
                     {
                         "type": "integer",
@@ -846,7 +723,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿规则列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -854,37 +730,36 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the collection-rule list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of collection rules per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
+                        "description": "Filter for rules owned by the current user",
                         "name": "is_my",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "用户id",
+                        "description": "id",
                         "name": "user_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "地址簿集合id",
+                        "description": "id",
                         "name": "collection_id",
                         "in": "query"
                     }
@@ -901,7 +776,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollectionList"
+                                            "$ref": "#/definitions/model.AddressBookCollectionRuleList"
                                         }
                                     }
                                 }
@@ -924,7 +799,6 @@
                         "token": []
                     }
                 ],
-                "description": "地址簿规则编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -932,12 +806,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则编辑",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Address book collection rule update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -950,19 +823,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -981,7 +842,6 @@
                         "token": []
                     }
                 ],
-                "description": "链接日志批量删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -989,12 +849,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "链接日志"
+                    ""
                 ],
-                "summary": "链接日志批量删除",
                 "parameters": [
                     {
-                        "description": "链接日志",
+                        "description": "Audit connection log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1026,7 +885,6 @@
                         "token": []
                     }
                 ],
-                "description": "链接日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -1034,12 +892,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "链接日志"
+                    ""
                 ],
-                "summary": "链接日志删除",
                 "parameters": [
                     {
-                        "description": "链接日志信息",
+                        "description": "Audit connection deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1071,7 +928,6 @@
                         "token": []
                     }
                 ],
-                "description": "链接日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -1079,31 +935,30 @@
                     "application/json"
                 ],
                 "tags": [
-                    "链接日志"
+                    ""
                 ],
-                "summary": "链接日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for audit connection records",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of audit connection records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "目标设备",
+                        "description": "Peer ID filter for audit connections",
                         "name": "peer_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "来源设备",
+                        "description": "Source peer ID filter for audit connections",
                         "name": "from_peer",
                         "in": "query"
                     }
@@ -1143,7 +998,6 @@
                         "token": []
                     }
                 ],
-                "description": "文件日志批量删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -1151,12 +1005,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "文件日志"
+                    ""
                 ],
-                "summary": "文件日志批量删除",
                 "parameters": [
                     {
-                        "description": "文件日志",
+                        "description": "Audit file log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1188,7 +1041,6 @@
                         "token": []
                     }
                 ],
-                "description": "文件日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -1196,12 +1048,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "文件日志"
+                    ""
                 ],
-                "summary": "文件日志删除",
                 "parameters": [
                     {
-                        "description": "文件日志信息",
+                        "description": "Audit file deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1233,7 +1084,6 @@
                         "token": []
                     }
                 ],
-                "description": "文件日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -1241,31 +1091,30 @@
                     "application/json"
                 ],
                 "tags": [
-                    "文件日志"
+                    ""
                 ],
-                "summary": "文件日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for audit file records",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of audit file records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "目标设备",
+                        "description": "Peer ID filter for audit file records",
                         "name": "peer_id",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "来源设备",
+                        "description": "Source peer ID filter for audit file records",
                         "name": "from_peer",
                         "in": "query"
                     }
@@ -1298,24 +1147,73 @@
                 }
             }
         },
+        "/admin/captcha": {
+            "get": {
+                "description": "Public pre-authentication route; a challenge is returned only when the client IP requires CAPTCHA verification.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Auth"
+                ],
+                "summary": "Get an admin login CAPTCHA",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/admin/config/admin": {
+            "get": {
+                "description": "Public pre-authentication route returning the admin title and, when a valid api-token is supplied, the personalized greeting.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "ADMIN"
+                ],
+                "summary": "Get public admin configuration",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/config/all": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "ADMIN服务配置",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only configuration used by the admin panel.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "ADMIN"
                 ],
-                "summary": "ADMIN服务配置",
+                "summary": "Get all admin configuration",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1339,7 +1237,7 @@
                         "token": []
                     }
                 ],
-                "description": "APP服务配置",
+                "description": "APP",
                 "consumes": [
                     "application/json"
                 ],
@@ -1349,7 +1247,7 @@
                 "tags": [
                     "ADMIN"
                 ],
-                "summary": "APP服务配置",
+                "summary": "APP",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1373,7 +1271,7 @@
                         "token": []
                     }
                 ],
-                "description": "服务配置,给webclient提供api-server",
+                "description": ",webclientapi-server",
                 "consumes": [
                     "application/json"
                 ],
@@ -1383,7 +1281,7 @@
                 "tags": [
                     "ADMIN"
                 ],
-                "summary": "RUSTDESK服务配置",
+                "summary": "RUSTDESK",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1400,14 +1298,14 @@
                 }
             }
         },
-        "/admin/device_group/create": {
+        "/admin/custom_build/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建设备群组",
+                "description": "Admin-only build request. The display version and platform are user-selected capabilities; provider workflow refs, release identity, and dispatch details are resolved server-side.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1415,23 +1313,23 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "创建设备群组",
+                "summary": "Create a custom build",
                 "parameters": [
                     {
-                        "description": "设备群组信息",
+                        "description": "Custom-build request",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.DeviceGroupForm"
+                            "$ref": "#/definitions/admin.CustomBuildForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted queued custom-build envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -1441,15 +1339,33 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.DeviceGroup"
+                                            "$ref": "#/definitions/model.CustomBuildSafe"
                                         }
                                     }
                                 }
                             ]
                         }
                     },
+                    "400": {
+                        "description": "Invalid custom-build request",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "412": {
+                        "description": "Workflow reference approval is required",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Custom build could not be queued",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "Build provider or encryption configuration is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1457,14 +1373,14 @@
                 }
             }
         },
-        "/admin/device_group/delete": {
+        "/admin/custom_build/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备群组删除",
+                "description": "Admin-only deletion of a custom-build record and its published artifacts.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1472,29 +1388,29 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "设备群组删除",
+                "summary": "Delete a custom build",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-build identifier",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.DeviceGroupForm"
+                            "$ref": "#/definitions/admin.CustomBuildForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Custom build deleted",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Custom build could not be deleted",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1502,28 +1418,25 @@
                 }
             }
         },
-        "/admin/device_group/detail/{id}": {
+        "/admin/custom_build/download/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备群组详情",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only download by build ID. BackendUserAuth and AdminPrivilege authorize the request; the build must have a complete immutable publication proof. The response is the exact redacted ZIP bytes served by this response, not the stored publication output digest and not a signature.",
                 "produces": [
-                    "application/json"
+                    "application/zip"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "设备群组详情",
+                "summary": "Download a completed custom build by ID",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "ID",
+                        "description": "Completed custom build ID",
                         "name": "id",
                         "in": "path",
                         "required": true
@@ -1531,25 +1444,61 @@
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted custom-build ZIP archive",
+                        "schema": {
+                            "type": "file"
+                        },
+                        "headers": {
+                            "Content-Disposition": {
+                                "type": "string",
+                                "description": "Attachment filename"
+                            },
+                            "Content-Length": {
+                                "type": "string",
+                                "description": "Exact ZIP response length in bytes"
+                            },
+                            "X-DeskForge-Archive-SHA256": {
+                                "type": "string",
+                                "description": "SHA-256 of the exact ZIP bytes served by this response"
+                            },
+                            "X-DeskForge-Archive-SHA256-Scope": {
+                                "type": "string",
+                                "description": "Digest scope; distinct from the stored publication digest"
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid build ID",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Group"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "403": {
+                        "description": "Administrator authentication or privilege is required",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "408": {
+                        "description": "Download request was cancelled or timed out",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "409": {
+                        "description": "Build completion or output provenance is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "416": {
+                        "description": "Range requests are not supported",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "ZIP packaging or validation failed",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1557,41 +1506,38 @@
                 }
             }
         },
-        "/admin/device_group/list": {
+        "/admin/custom_build/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only paginated list. The response uses the redacted CustomBuildSafeList view; provider credentials and storage-only identity fields are not serialized.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomBuild"
                 ],
-                "summary": "群组列表",
+                "summary": "List custom builds",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of builds per page",
                         "name": "page_size",
                         "in": "query"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted custom-build list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -1601,7 +1547,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.GroupList"
+                                            "$ref": "#/definitions/model.CustomBuildSafeList"
                                         }
                                     }
                                 }
@@ -1609,7 +1555,7 @@
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Custom-build list is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1617,38 +1563,33 @@
                 }
             }
         },
-        "/admin/device_group/update": {
-            "post": {
+        "/admin/custom_build/manifest/{id}": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备群组编辑",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only redacted handoff data. The BuildHandoffManifest contains no secrets, raw custom configuration, filesystem paths, or signature claim. The published digest covers stored canonical output and is distinct from the SHA-256 header over these response bytes.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "设备群组"
+                    "CustomBuild"
                 ],
-                "summary": "设备群组编辑",
+                "summary": "Export a completed custom-build handoff manifest",
                 "parameters": [
                     {
-                        "description": "群组信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.DeviceGroupForm"
-                        }
+                        "type": "integer",
+                        "description": "Completed custom build ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted build handoff envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -1658,15 +1599,33 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/service.BuildHandoffManifest"
                                         }
                                     }
                                 }
                             ]
+                        },
+                        "headers": {
+                            "X-DeskForge-Manifest-SHA256": {
+                                "type": "string",
+                                "description": "SHA-256 of the exact response body bytes"
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Invalid build ID",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "409": {
+                        "description": "Completed handoff is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Handoff is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1674,33 +1633,52 @@
                 }
             }
         },
-        "/admin/file/oss_token": {
+        "/admin/custom_build/public/detailByKey/{key}": {
             "get": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "获取ossToken",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Public capability route with no authentication. The key expires according to download-key-ttl; an expired key returns 410. The response uses the public CustomBuildPublic view and omits download_key, provider refs, and secrets.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "文件"
+                    "CustomBuild"
+                ],
+                "summary": "Read a completed custom build by capability key",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Opaque build capability key",
+                        "name": "key",
+                        "in": "path",
+                        "required": true
+                    }
                 ],
-                "summary": "获取ossToken",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Public build detail envelope without download_key",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.CustomBuildPublic"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "409": {
+                        "description": "Build is not publicly ready",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "410": {
+                        "description": "Capability key has expired",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1708,42 +1686,76 @@
                 }
             }
         },
-        "/admin/file/upload": {
-            "post": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "上传文件到本地",
-                "consumes": [
-                    "multipart/form-data"
-                ],
+        "/admin/custom_build/public/download/{key}": {
+            "get": {
+                "description": "Public capability route with no authentication. The key expires according to download-key-ttl; an expired key returns 410. The response is the exact redacted ZIP bytes served by this response, not the stored publication output digest and not a signature.",
                 "produces": [
-                    "application/json"
+                    "application/zip"
                 ],
                 "tags": [
-                    "文件"
+                    "CustomBuild"
                 ],
-                "summary": "上传文件到本地",
+                "summary": "Download a completed custom build by capability key",
                 "parameters": [
                     {
-                        "type": "file",
-                        "description": "上传文件示例",
-                        "name": "file",
-                        "in": "formData",
+                        "type": "string",
+                        "description": "Opaque build capability key",
+                        "name": "key",
+                        "in": "path",
                         "required": true
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted custom-build ZIP archive",
+                        "schema": {
+                            "type": "file"
+                        },
+                        "headers": {
+                            "Content-Disposition": {
+                                "type": "string",
+                                "description": "Attachment filename"
+                            },
+                            "Content-Length": {
+                                "type": "string",
+                                "description": "Exact ZIP response length in bytes"
+                            },
+                            "X-DeskForge-Archive-SHA256": {
+                                "type": "string",
+                                "description": "SHA-256 of the exact ZIP bytes served by this response"
+                            },
+                            "X-DeskForge-Archive-SHA256-Scope": {
+                                "type": "string",
+                                "description": "Digest scope; distinct from the stored publication digest"
+                            }
+                        }
+                    },
+                    "408": {
+                        "description": "Download request was cancelled or timed out",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "409": {
+                        "description": "Build completion or output provenance is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "410": {
+                        "description": "Capability key has expired",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "416": {
+                        "description": "Range requests are not supported",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "ZIP packaging or validation failed",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -1751,14 +1763,51 @@
                 }
             }
         },
-        "/admin/group/create": {
+        "/admin/custom_build/versions": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only provider capability list. Only display versions and release labels are returned; provider refs and commit SHAs remain server-side.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "CustomBuild"
+                ],
+                "summary": "List available custom-build versions",
+                "responses": {
+                    "200": {
+                        "description": "Available version options, with error state",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.versionsResponse"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/custom_preset/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建群组",
+                "description": "Administrators with AdminPrivilege may save a custom preset; provider-derived build references are resolved server-side.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1766,17 +1815,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "创建群组",
+                "summary": "Create a custom preset",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-preset payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.GroupForm"
+                            "$ref": "#/definitions/admin.CustomPresetForm"
                         }
                     }
                 ],
@@ -1792,7 +1841,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/model.CustomPresetSafe"
                                         }
                                     }
                                 }
@@ -1808,14 +1857,14 @@
                 }
             }
         },
-        "/admin/group/delete": {
+        "/admin/custom_preset/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组删除",
+                "description": "Administrators with AdminPrivilege may delete their own custom preset.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1823,17 +1872,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组删除",
+                "summary": "Delete a custom preset",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-preset identifier",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.GroupForm"
+                            "$ref": "#/definitions/admin.CustomPresetForm"
                         }
                     }
                 ],
@@ -1853,28 +1902,25 @@
                 }
             }
         },
-        "/admin/group/detail/{id}": {
+        "/admin/custom_preset/detail/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组详情",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Administrators with AdminPrivilege may read their own redacted custom preset.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组详情",
+                "summary": "Get a custom preset",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "ID",
+                        "description": "Custom preset ID",
                         "name": "id",
                         "in": "path",
                         "required": true
@@ -1892,7 +1938,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/model.CustomPresetSafe"
                                         }
                                     }
                                 }
@@ -1908,34 +1954,31 @@
                 }
             }
         },
-        "/admin/group/list": {
+        "/admin/custom_preset/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Administrators with AdminPrivilege receive a paginated redacted custom-preset list.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组列表",
+                "summary": "List custom presets",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of presets per page",
                         "name": "page_size",
                         "in": "query"
                     }
@@ -1952,7 +1995,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.GroupList"
+                                            "$ref": "#/definitions/model.CustomPresetSafeList"
                                         }
                                     }
                                 }
@@ -1968,14 +2011,14 @@
                 }
             }
         },
-        "/admin/group/update": {
+        "/admin/custom_preset/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "群组编辑",
+                "description": "Administrators with AdminPrivilege may update their own custom preset; provider-derived build references are resolved server-side.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1983,17 +2026,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    "CustomPreset"
                 ],
-                "summary": "群组编辑",
+                "summary": "Update a custom preset",
                 "parameters": [
                     {
-                        "description": "群组信息",
+                        "description": "Custom-preset update payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.GroupForm"
+                            "$ref": "#/definitions/admin.CustomPresetForm"
                         }
                     }
                 ],
@@ -2009,7 +2052,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.Group"
+                                            "$ref": "#/definitions/model.CustomPresetSafe"
                                         }
                                     }
                                 }
@@ -2025,52 +2068,26 @@
                 }
             }
         },
-        "/admin/login": {
-            "post": {
+        "/admin/dashboard/health": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Authenticated server health and bandwidth data for the admin dashboard.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
-                ],
-                "summary": "登录",
-                "parameters": [
-                    {
-                        "description": "登录信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/github_com_lejianwen_rustdesk-api_v2_http_request_admin.Login"
-                        }
-                    }
+                    "Dashboard"
                 ],
+                "summary": "Get server health",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/admin.LoginPayload"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -2082,46 +2099,44 @@
                 }
             }
         },
-        "/admin/login-options": {
-            "post": {
-                "description": "登录选项",
-                "consumes": [
-                    "application/json"
+        "/admin/dashboard/stats": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
                 ],
+                "description": "Authenticated dashboard counters for users, peers, groups, and logins.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    "Dashboard"
                 ],
-                "summary": "登录选项",
+                "summary": "Get dashboard statistics",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "type": "array",
-                            "items": {
-                                "type": "string"
-                            }
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
                         "description": "Internal Server Error",
                         "schema": {
-                            "$ref": "#/definitions/response.ErrorResponse"
+                            "$ref": "#/definitions/response.Response"
                         }
                     }
                 }
             }
         },
-        "/admin/login_log/batchDelete": {
+        "/admin/device_group/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志批量删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -2129,17 +2144,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志批量删除",
                 "parameters": [
                     {
-                        "description": "登录日志",
+                        "description": "Device group form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.LoginLogIds"
+                            "$ref": "#/definitions/admin.DeviceGroupForm"
                         }
                     }
                 ],
@@ -2147,7 +2161,19 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.DeviceGroup"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -2159,14 +2185,13 @@
                 }
             }
         },
-        "/admin/login_log/delete": {
+        "/admin/device_group/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -2174,17 +2199,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志删除",
                 "parameters": [
                     {
-                        "description": "登录日志信息",
+                        "description": "Device group deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.LoginLog"
+                            "$ref": "#/definitions/admin.DeviceGroupForm"
                         }
                     }
                 ],
@@ -2204,14 +2228,13 @@
                 }
             }
         },
-        "/admin/login_log/detail/{id}": {
+        "/admin/device_group/detail/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -2219,9 +2242,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志详情",
                 "parameters": [
                     {
                         "type": "integer",
@@ -2243,7 +2265,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.LoginLog"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -2259,14 +2281,13 @@
                 }
             }
         },
-        "/admin/login_log/list": {
+        "/admin/device_group/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -2274,27 +2295,20 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录日志"
+                    ""
                 ],
-                "summary": "登录日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the device-group list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of device groups per page",
                         "name": "page_size",
                         "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
-                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -2309,7 +2323,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.LoginLogList"
+                                            "$ref": "#/definitions/model.GroupList"
                                         }
                                     }
                                 }
@@ -2325,43 +2339,13 @@
                 }
             }
         },
-        "/admin/logout": {
-            "post": {
-                "description": "登出",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "登录"
-                ],
-                "summary": "登出",
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    }
-                }
-            }
-        },
-        "/admin/my/address_book/create": {
+        "/admin/device_group/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿",
                 "consumes": [
                     "application/json"
                 ],
@@ -2369,17 +2353,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
+                    ""
                 ],
-                "summary": "创建地址簿",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
+                        "description": "Device group update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
+                            "$ref": "#/definitions/admin.DeviceGroupForm"
                         }
                     }
                 ],
@@ -2395,7 +2378,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -2411,35 +2394,24 @@
                 }
             }
         },
-        "/admin/my/address_book/delete": {
+        "/admin/file/notify": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿删除",
+                "description": "Authenticated upload callback used after the object-storage provider verifies the request.",
                 "consumes": [
-                    "application/json"
+                    "multipart/form-data"
                 ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
-                ],
-                "summary": "地址簿删除",
-                "parameters": [
-                    {
-                        "description": "地址簿信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
-                        }
-                    }
+                    "File"
                 ],
+                "summary": "Confirm an uploaded file",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -2456,14 +2428,14 @@
                 }
             }
         },
-        "/admin/my/address_book/list": {
+        "/admin/file/oss_token": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿列表",
+                "description": "ossToken",
                 "consumes": [
                     "application/json"
                 ],
@@ -2471,46 +2443,14 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
-                ],
-                "summary": "地址簿列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
-                        "name": "user_id",
-                        "in": "query"
-                    }
+                    ""
                 ],
+                "summary": "ossToken",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookList"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -2522,52 +2462,36 @@
                 }
             }
         },
-        "/admin/my/address_book/update": {
+        "/admin/file/upload": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿编辑",
                 "consumes": [
-                    "application/json"
+                    "multipart/form-data"
                 ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿"
+                    ""
                 ],
-                "summary": "地址簿编辑",
                 "parameters": [
                     {
-                        "description": "地址簿信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.AddressBookForm"
-                        }
+                        "type": "file",
+                        "description": "Multipart file to upload",
+                        "name": "file",
+                        "in": "formData",
+                        "required": true
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBook"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -2579,14 +2503,14 @@
                 }
             }
         },
-        "/admin/my/address_book_collection/create": {
+        "/admin/github_build_config/approve_workflow_ref": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿名称",
+                "description": "Admin confirmation for a provider-derived, verified, protected workflow tag. The workflow_tag must be selected from workflow_tags; raw refs and SHAs are not accepted. The response is the secret-free GithubBuildConfigSafe view.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2594,23 +2518,23 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
+                    "GithubBuildConfig"
                 ],
-                "summary": "创建地址簿名称",
+                "summary": "Approve a provider-derived workflow tag",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Confirm and provider-derived workflow tag label",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollection"
+                            "$ref": "#/definitions/admin.WorkflowRefApprovalForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Safe GitHub build configuration envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -2620,15 +2544,33 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.GithubBuildConfigSafe"
                                         }
                                     }
                                 }
                             ]
                         }
                     },
+                    "400": {
+                        "description": "Invalid selector or approval request",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Workflow approval failed",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "502": {
+                        "description": "Provider rejected or could not verify the workflow tag",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2636,14 +2578,14 @@
                 }
             }
         },
-        "/admin/my/address_book_collection/delete": {
+        "/admin/github_build_config/dispatch_test": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿名称删除",
+                "description": "Admin-only provider mutation that dispatches the configured Windows workflow with server-derived parameters after explicit confirmation. The response contains provider run metadata, not credentials.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2651,29 +2593,43 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
+                    "GithubBuildConfig"
                 ],
-                "summary": "地址簿名称删除",
+                "summary": "Dispatch a GitHub smoke-test build",
                 "parameters": [
                     {
-                        "description": "地址簿名称信息",
+                        "description": "Explicit build confirmation",
                         "name": "body",
                         "in": "body",
-                        "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollection"
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "boolean"
+                            }
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Provider workflow dispatch metadata",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "412": {
+                        "description": "Workflow reference approval is required",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "502": {
+                        "description": "Provider rejected the workflow dispatch",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2681,59 +2637,36 @@
                 }
             }
         },
-        "/admin/my/address_book_collection/list": {
-            "get": {
+        "/admin/github_build_config/generate_key": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿名称列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only operation that creates and stores a new workflow payload key. The generated key is returned once so it can be copied to the provider secret store; later configuration reads are secret-free.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
-                ],
-                "summary": "地址簿名称列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    }
+                    "GithubBuildConfig"
                 ],
+                "summary": "Generate a workflow payload key",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Generated workflow payload key",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollectionList"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Payload key could not be generated",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "Secret encryption is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2741,38 +2674,24 @@
                 }
             }
         },
-        "/admin/my/address_book_collection/update": {
-            "post": {
+        "/admin/github_build_config/get": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿名称编辑",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only secret-free GitHub build configuration view. Credentials are represented only by has_token and has_payload_key flags.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿名称"
-                ],
-                "summary": "地址簿名称编辑",
-                "parameters": [
-                    {
-                        "description": "地址簿名称信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollection"
-                        }
-                    }
+                    "GithubBuildConfig"
                 ],
+                "summary": "Get GitHub build configuration",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Secret-free GitHub build configuration envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -2782,7 +2701,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.GithubBuildConfigSafe"
                                         }
                                     }
                                 }
@@ -2790,7 +2709,7 @@
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "GitHub build configuration is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2798,14 +2717,14 @@
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/create": {
+        "/admin/github_build_config/save": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建地址簿规则",
+                "description": "Admin-only configuration update. Repository is user-authored; workflow selectors and resolved provider identities remain system/provider-derived. Empty secrets preserve stored values, and the response is secret-free.",
                 "consumes": [
                     "application/json"
                 ],
@@ -2813,23 +2732,23 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
+                    "GithubBuildConfig"
                 ],
-                "summary": "创建地址簿规则",
+                "summary": "Save GitHub build configuration",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "GitHub build configuration",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollectionRule"
+                            "$ref": "#/definitions/admin.GithubBuildConfigForm"
                         }
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Secret-free GitHub build configuration envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -2839,15 +2758,27 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.GithubBuildConfigSafe"
                                         }
                                     }
                                 }
                             ]
                         }
                     },
+                    "400": {
+                        "description": "Invalid configuration request",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "GitHub build configuration could not be saved",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "Secret encryption is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2855,44 +2786,36 @@
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/delete": {
+        "/admin/github_build_config/sync_secret": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿规则删除",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only provider mutation that synchronizes the stored workflow payload key to the configured GitHub Actions secret. The key is not returned.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
-                ],
-                "summary": "地址簿规则删除",
-                "parameters": [
-                    {
-                        "description": "地址簿规则信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollectionRule"
-                        }
-                    }
+                    "GithubBuildConfig"
                 ],
+                "summary": "Sync the workflow payload key",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Workflow payload key synchronized",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "502": {
+                        "description": "Provider rejected the secret update",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2900,59 +2823,61 @@
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/list": {
-            "get": {
+        "/admin/github_build_config/test": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿规则列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Admin-only read-only provider connectivity check. The stored PAT is used server-side and is never returned.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
+                    "GithubBuildConfig"
                 ],
-                "summary": "地址簿规则列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "是否是我的",
-                        "name": "is_my",
-                        "in": "query"
+                "summary": "Test GitHub provider access",
+                "responses": {
+                    "200": {
+                        "description": "Provider access is available",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
                     },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
-                        "name": "user_id",
-                        "in": "query"
+                    "502": {
+                        "description": "Provider rejected the configured credentials or repository",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
                     },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/github_build_config/workflow_tags": {
+            "get": {
+                "security": [
                     {
-                        "type": "integer",
-                        "description": "地址簿集合id",
-                        "name": "collection_id",
-                        "in": "query"
+                        "token": []
                     }
                 ],
+                "description": "Admin-only capability catalog. Each WorkflowTagOption is a safe provider-derived label; credentials, raw refs, SHAs, and provider verification objects remain server-side. Approval must select one of these options.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "GithubBuildConfig"
+                ],
+                "summary": "List provider-derived workflow tag options",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Safe workflow tag options under data.tags",
                         "schema": {
                             "allOf": [
                                 {
@@ -2962,7 +2887,13 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollectionList"
+                                            "type": "object",
+                                            "additionalProperties": {
+                                                "type": "array",
+                                                "items": {
+                                                    "$ref": "#/definitions/service.WorkflowTagOption"
+                                                }
+                                            }
                                         }
                                     }
                                 }
@@ -2970,7 +2901,19 @@
                         }
                     },
                     "500": {
-                        "description": "Internal Server Error",
+                        "description": "Workflow tag options are unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "502": {
+                        "description": "Provider rejected or returned invalid workflow data",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "503": {
+                        "description": "GitHub provider configuration or transport is unavailable",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -2978,14 +2921,13 @@
                 }
             }
         },
-        "/admin/my/address_book_collection_rule/update": {
+        "/admin/group/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "地址簿规则编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -2993,17 +2935,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的地址簿规则"
+                    ""
                 ],
-                "summary": "地址簿规则编辑",
                 "parameters": [
                     {
-                        "description": "地址簿规则信息",
+                        "description": "Group form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.AddressBookCollectionRule"
+                            "$ref": "#/definitions/admin.GroupForm"
                         }
                     }
                 ],
@@ -3019,7 +2960,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.AddressBookCollection"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -3035,59 +2976,13 @@
                 }
             }
         },
-        "/admin/my/login_log/batchDelete": {
-            "post": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "登录日志批量删除",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "我的登录日志"
-                ],
-                "summary": "登录日志批量删除",
-                "parameters": [
-                    {
-                        "description": "登录日志",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.LoginLogIds"
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    }
-                }
-            }
-        },
-        "/admin/my/login_log/delete": {
+        "/admin/group/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -3095,17 +2990,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的登录日志"
+                    ""
                 ],
-                "summary": "登录日志删除",
                 "parameters": [
                     {
-                        "description": "登录日志信息",
+                        "description": "Group deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.LoginLog"
+                            "$ref": "#/definitions/admin.GroupForm"
                         }
                     }
                 ],
@@ -3125,14 +3019,13 @@
                 }
             }
         },
-        "/admin/my/login_log/list": {
+        "/admin/group/detail/{id}": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录日志列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3140,27 +3033,15 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的登录日志"
+                    ""
                 ],
-                "summary": "登录日志列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
-                        "in": "query"
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
                     }
                 ],
                 "responses": {
@@ -3175,7 +3056,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.LoginLogList"
+                                            "$ref": "#/definitions/model.Group"
                                         }
                                     }
                                 }
@@ -3191,14 +3072,13 @@
                 }
             }
         },
-        "/admin/my/peer/list": {
+        "/admin/group/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3206,45 +3086,20 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的设备"
+                    ""
                 ],
-                "summary": "设备列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the group list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of groups per page",
                         "name": "page_size",
                         "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "时间",
-                        "name": "time_ago",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "主机名",
-                        "name": "hostname",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "uuids 用逗号分隔",
-                        "name": "uuids",
-                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -3259,7 +3114,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.PeerList"
+                                            "$ref": "#/definitions/model.GroupList"
                                         }
                                     }
                                 }
@@ -3275,14 +3130,13 @@
                 }
             }
         },
-        "/admin/my/share_record/batchDelete": {
+        "/admin/group/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "批量删除我的分享记录",
                 "consumes": [
                     "application/json"
                 ],
@@ -3290,17 +3144,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的"
+                    ""
                 ],
-                "summary": "批量删除我的分享记录",
                 "parameters": [
                     {
-                        "description": "id",
+                        "description": "Group update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                            "$ref": "#/definitions/admin.GroupForm"
                         }
                     }
                 ],
@@ -3308,7 +3161,19 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Group"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -3320,14 +3185,9 @@
                 }
             }
         },
-        "/admin/my/share_record/delete": {
+        "/admin/login": {
             "post": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "分享记录删除",
+                "description": "Public pre-authentication route for administrator credentials; it returns the admin access-token payload on success.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3335,17 +3195,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的分享记录"
+                    "Auth"
                 ],
-                "summary": "分享记录删除",
+                "summary": "Log in to the admin panel",
                 "parameters": [
                     {
-                        "description": "分享记录信息",
+                        "description": "Admin login credentials payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.ShareRecordForm"
+                            "$ref": "#/definitions/rustdesk-server_api_http_request_admin.Login"
                         }
                     }
                 ],
@@ -3353,7 +3213,19 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -3365,47 +3237,25 @@
                 }
             }
         },
-        "/admin/my/share_record/list": {
+        "/admin/login-options": {
             "get": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "分享记录列表",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Public pre-authentication route returning registration, password-login, CAPTCHA, and OIDC-provider capabilities.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "我的分享记录"
-                ],
-                "summary": "分享记录列表",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    }
+                    "Auth"
                 ],
+                "summary": "Get admin login options",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Public admin login capabilities",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "400": {
+                        "description": "Login options could not be read",
                         "schema": {
                             "$ref": "#/definitions/response.Response"
                         }
@@ -3413,14 +3263,13 @@
                 }
             }
         },
-        "/admin/my/tag/create": {
+        "/admin/login_log/batchDelete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -3428,17 +3277,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的标签"
+                    ""
                 ],
-                "summary": "创建标签",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Login log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/admin.LoginLogIds"
                         }
                     }
                 ],
@@ -3446,19 +3294,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3470,14 +3306,13 @@
                 }
             }
         },
-        "/admin/my/tag/delete": {
+        "/admin/login_log/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -3485,17 +3320,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签删除",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Login log deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/model.LoginLog"
                         }
                     }
                 ],
@@ -3515,14 +3349,13 @@
                 }
             }
         },
-        "/admin/my/tag/list": {
+        "/admin/login_log/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3530,31 +3363,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的标签"
+                    ""
                 ],
-                "summary": "标签列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the login-log list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of login-log records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
-                        "name": "is_my",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
+                        "description": "ID",
                         "name": "user_id",
                         "in": "query"
                     }
@@ -3571,7 +3397,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.TagList"
+                                            "$ref": "#/definitions/model.LoginLogList"
                                         }
                                     }
                                 }
@@ -3587,14 +3413,14 @@
                 }
             }
         },
-        "/admin/my/tag/update": {
+        "/admin/logout": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签编辑",
+                "description": "Clears the supplied admin access token when it identifies a current user; the route is registered before the admin authentication middleware.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3602,37 +3428,14 @@
                     "application/json"
                 ],
                 "tags": [
-                    "我的标签"
-                ],
-                "summary": "标签编辑",
-                "parameters": [
-                    {
-                        "description": "标签信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
-                        }
-                    }
+                    "Auth"
                 ],
+                "summary": "Log out of the admin panel",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3644,14 +3447,14 @@
                 }
             }
         },
-        "/admin/oauth/create": {
+        "/admin/my/address_book/batchCreateFromPeers": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建Oauth",
+                "description": "Personal batch creation of address-book entries from the current user's peers.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3659,17 +3462,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "创建Oauth",
                 "parameters": [
                     {
-                        "description": "Oauth信息",
+                        "description": "Peer IDs and address-book destination payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.OauthForm"
+                            "$ref": "#/definitions/admin.BatchCreateFromPeersForm"
                         }
                     }
                 ],
@@ -3677,19 +3479,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Oauth"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3701,14 +3491,14 @@
                 }
             }
         },
-        "/admin/oauth/delete": {
+        "/admin/my/address_book/batchUpdateTags": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth删除",
+                "description": "Authenticated users may update tags on their own address-book entries.",
                 "consumes": [
                     "application/json"
                 ],
@@ -3716,17 +3506,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    "AddressBook"
                 ],
-                "summary": "Oauth删除",
+                "summary": "Update personal address-book tags",
                 "parameters": [
                     {
-                        "description": "Oauth信息",
+                        "description": "Address-book tag update payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.OauthForm"
+                            "$ref": "#/definitions/admin.BatchUpdateTagsForm"
                         }
                     }
                 ],
@@ -3746,14 +3536,13 @@
                 }
             }
         },
-        "/admin/oauth/detail/{id}": {
-            "get": {
+        "/admin/my/address_book/create": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -3761,35 +3550,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "Oauth详情",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Personal address book entry form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.AddressBookForm"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Oauth"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3801,14 +3579,13 @@
                 }
             }
         },
-        "/admin/oauth/list": {
-            "get": {
+        "/admin/my/address_book/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -3816,40 +3593,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "Oauth列表",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
+                        "description": "Personal address book entry deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.AddressBookForm"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.OauthList"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -3861,14 +3622,13 @@
                 }
             }
         },
-        "/admin/oauth/update": {
-            "post": {
+        "/admin/my/address_book/list": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "Oauth编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -3876,80 +3636,31 @@
                     "application/json"
                 ],
                 "tags": [
-                    "Oauth"
+                    ""
                 ],
-                "summary": "Oauth编辑",
                 "parameters": [
                     {
-                        "description": "Oauth信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.OauthForm"
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.OauthList"
-                                        }
-                                    }
-                                }
-                            ]
-                        }
+                        "type": "integer",
+                        "description": "Page number for the personal address book list",
+                        "name": "page",
+                        "in": "query"
                     },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
+                    {
+                        "type": "integer",
+                        "description": "Number of personal address book entries per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
                     }
-                }
-            }
-        },
-        "/admin/oidc/auth": {
-            "post": {
-                "description": "OidcAuth",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "Oauth"
-                ],
-                "summary": "OidcAuth",
-                "responses": {}
-            }
-        },
-        "/admin/oidc/auth-query": {
-            "get": {
-                "description": "OidcAuthQuery",
-                "consumes": [
-                    "application/json"
                 ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "Oauth"
-                ],
-                "summary": "OidcAuthQuery",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted personal address-book list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -3959,7 +3670,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/admin.LoginPayload"
+                                            "$ref": "#/definitions/model.AddressBookSafeList"
                                         }
                                     }
                                 }
@@ -3975,14 +3686,13 @@
                 }
             }
         },
-        "/admin/peer/batchDelete": {
+        "/admin/my/address_book/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "批量设备删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -3990,17 +3700,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "批量设备删除",
                 "parameters": [
                     {
-                        "description": "设备id",
+                        "description": "Personal address book entry update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerBatchDeleteForm"
+                            "$ref": "#/definitions/admin.AddressBookForm"
                         }
                     }
                 ],
@@ -4020,14 +3729,13 @@
                 }
             }
         },
-        "/admin/peer/create": {
+        "/admin/my/address_book_collection/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建设备",
                 "consumes": [
                     "application/json"
                 ],
@@ -4035,17 +3743,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "创建设备",
                 "parameters": [
                     {
-                        "description": "设备信息",
+                        "description": "Personal address book collection form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerForm"
+                            "$ref": "#/definitions/model.AddressBookCollection"
                         }
                     }
                 ],
@@ -4053,19 +3760,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Peer"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4077,14 +3772,13 @@
                 }
             }
         },
-        "/admin/peer/delete": {
+        "/admin/my/address_book_collection/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4092,17 +3786,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "设备删除",
                 "parameters": [
                     {
-                        "description": "设备信息",
+                        "description": "Personal address book collection deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerForm"
+                            "$ref": "#/definitions/model.AddressBookCollection"
                         }
                     }
                 ],
@@ -4122,69 +3815,13 @@
                 }
             }
         },
-        "/admin/peer/detail/{id}": {
-            "get": {
-                "security": [
-                    {
-                        "token": []
-                    }
-                ],
-                "description": "设备详情",
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "设备"
-                ],
-                "summary": "设备详情",
-                "parameters": [
-                    {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Peer"
-                                        }
-                                    }
-                                }
-                            ]
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/response.Response"
-                        }
-                    }
-                }
-            }
-        },
-        "/admin/peer/list": {
+        "/admin/my/address_book_collection/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -4192,45 +3829,20 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "设备列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the personal address book collection list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of personal address book collections per page",
                         "name": "page_size",
                         "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "时间",
-                        "name": "time_ago",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "主机名",
-                        "name": "hostname",
-                        "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "uuids 用逗号分隔",
-                        "name": "uuids",
-                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -4245,7 +3857,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.PeerList"
+                                            "$ref": "#/definitions/model.AddressBookCollectionList"
                                         }
                                     }
                                 }
@@ -4261,14 +3873,13 @@
                 }
             }
         },
-        "/admin/peer/update": {
+        "/admin/my/address_book_collection/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "设备编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -4276,17 +3887,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "设备"
+                    ""
                 ],
-                "summary": "设备编辑",
                 "parameters": [
                     {
-                        "description": "设备信息",
+                        "description": "Personal address book collection update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerForm"
+                            "$ref": "#/definitions/model.AddressBookCollection"
                         }
                     }
                 ],
@@ -4294,19 +3904,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Peer"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4318,14 +3916,13 @@
                 }
             }
         },
-        "/admin/share_record/batchDelete": {
+        "/admin/my/address_book_collection_rule/create": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "批量分享记录",
                 "consumes": [
                     "application/json"
                 ],
@@ -4333,17 +3930,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "分享记录"
+                    ""
                 ],
-                "summary": "批量分享记录",
                 "parameters": [
                     {
-                        "description": "id",
+                        "description": "Personal address book collection rule form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                            "$ref": "#/definitions/model.AddressBookCollectionRule"
                         }
                     }
                 ],
@@ -4363,14 +3959,13 @@
                 }
             }
         },
-        "/admin/share_record/delete": {
+        "/admin/my/address_book_collection_rule/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "分享记录删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4378,17 +3973,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "分享记录"
+                    ""
                 ],
-                "summary": "分享记录删除",
                 "parameters": [
                     {
-                        "description": "分享记录信息",
+                        "description": "Personal address book collection rule deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.ShareRecordForm"
+                            "$ref": "#/definitions/model.AddressBookCollectionRule"
                         }
                     }
                 ],
@@ -4408,14 +4002,13 @@
                 }
             }
         },
-        "/admin/share_record/list": {
+        "/admin/my/address_book_collection_rule/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "分享记录列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -4423,26 +4016,37 @@
                     "application/json"
                 ],
                 "tags": [
-                    "分享记录"
+                    ""
                 ],
-                "summary": "分享记录列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
+                        "description": "Page number for personal address book collection rules",
+                        "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页码",
-                        "name": "page",
+                        "description": "Number of personal collection rules per page",
+                        "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
+                        "description": "Filter for rules owned by the current user",
+                        "name": "is_my",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "collection_id",
                         "in": "query"
                     }
                 ],
@@ -4450,7 +4054,19 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.AddressBookCollectionRuleList"
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -4462,14 +4078,13 @@
                 }
             }
         },
-        "/admin/tag/create": {
+        "/admin/my/address_book_collection_rule/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -4477,17 +4092,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "创建标签",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Personal address book collection rule update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/model.AddressBookCollectionRule"
                         }
                     }
                 ],
@@ -4495,19 +4109,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4519,14 +4121,44 @@
                 }
             }
         },
-        "/admin/tag/delete": {
+        "/admin/my/groupUsers": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated users receive only the group and user entries allowed for personal sharing.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "List shareable users and groups",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/my/login_log/batchDelete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4534,17 +4166,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签删除",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Personal login-log ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/admin.LoginLogIds"
                         }
                     }
                 ],
@@ -4564,14 +4195,13 @@
                 }
             }
         },
-        "/admin/tag/detail/{id}": {
-            "get": {
+        "/admin/my/login_log/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -4579,35 +4209,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签详情",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Personal login-log deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.LoginLog"
+                        }
                     }
                 ],
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4619,14 +4238,13 @@
                 }
             }
         },
-        "/admin/tag/list": {
+        "/admin/my/login_log/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -4634,31 +4252,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the personal login-log list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "页大小",
+                        "description": "Number of personal login-log records per page",
                         "name": "page_size",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "是否是我的",
-                        "name": "is_my",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户id",
+                        "description": "ID",
                         "name": "user_id",
                         "in": "query"
                     }
@@ -4675,7 +4286,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.TagList"
+                                            "$ref": "#/definitions/model.LoginLogList"
                                         }
                                     }
                                 }
@@ -4691,14 +4302,13 @@
                 }
             }
         },
-        "/admin/tag/update": {
+        "/admin/my/peer/batchDelete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "标签编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -4706,17 +4316,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "标签"
+                    ""
                 ],
-                "summary": "标签编辑",
                 "parameters": [
                     {
-                        "description": "标签信息",
+                        "description": "Personal peer ID batch deletion payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.TagForm"
+                            "$ref": "#/definitions/admin.PeerBatchDeleteForm"
                         }
                     }
                 ],
@@ -4724,19 +4333,7 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/model.Tag"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4748,14 +4345,13 @@
                 }
             }
         },
-        "/admin/user/changeCurPwd": {
+        "/admin/my/peer/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "修改当前用户密码",
                 "consumes": [
                     "application/json"
                 ],
@@ -4763,17 +4359,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "修改当前用户密码",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "Personal peer deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.ChangeCurPasswordForm"
+                            "$ref": "#/definitions/admin.PeerForm"
                         }
                     }
                 ],
@@ -4793,14 +4388,13 @@
                 }
             }
         },
-        "/admin/user/create": {
-            "post": {
+        "/admin/my/peer/list": {
+            "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "创建管理员",
                 "consumes": [
                     "application/json"
                 ],
@@ -4808,18 +4402,44 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "创建管理员",
                 "parameters": [
                     {
-                        "description": "管理员信息",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/admin.UserForm"
-                        }
+                        "type": "integer",
+                        "description": "Page number for the personal peer list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of personal peers per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Last-online time offset filter",
+                        "name": "time_ago",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Hostname filter",
+                        "name": "hostname",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "uuids ",
+                        "name": "uuids",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -4834,7 +4454,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.User"
+                                            "$ref": "#/definitions/model.PeerList"
                                         }
                                     }
                                 }
@@ -4850,14 +4470,13 @@
                 }
             }
         },
-        "/admin/user/current": {
-            "get": {
+        "/admin/my/share_record/batchDelete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "当前用户",
                 "consumes": [
                     "application/json"
                 ],
@@ -4865,26 +4484,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "id",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                        }
+                    }
                 ],
-                "summary": "当前用户",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "allOf": [
-                                {
-                                    "$ref": "#/definitions/response.Response"
-                                },
-                                {
-                                    "type": "object",
-                                    "properties": {
-                                        "data": {
-                                            "$ref": "#/definitions/admin.LoginPayload"
-                                        }
-                                    }
-                                }
-                            ]
+                            "$ref": "#/definitions/response.Response"
                         }
                     },
                     "500": {
@@ -4896,14 +4513,13 @@
                 }
             }
         },
-        "/admin/user/delete": {
+        "/admin/my/share_record/delete": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员编删除",
                 "consumes": [
                     "application/json"
                 ],
@@ -4911,17 +4527,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员删除",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "Personal share record deletion form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserForm"
+                            "$ref": "#/definitions/admin.ShareRecordForm"
                         }
                     }
                 ],
@@ -4941,14 +4556,13 @@
                 }
             }
         },
-        "/admin/user/detail/{id}": {
+        "/admin/my/share_record/list": {
             "get": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员详情",
                 "consumes": [
                     "application/json"
                 ],
@@ -4956,21 +4570,25 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员详情",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
+                        "description": "Page number for personal share records",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of personal share records per page",
+                        "name": "page_size",
+                        "in": "query"
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Redacted personal share-record list envelope",
                         "schema": {
                             "allOf": [
                                 {
@@ -4980,7 +4598,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.User"
+                                            "$ref": "#/definitions/model.ShareRecordSafeList"
                                         }
                                     }
                                 }
@@ -4996,14 +4614,13 @@
                 }
             }
         },
-        "/admin/user/list": {
-            "get": {
+        "/admin/my/tag/create": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -5011,27 +4628,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员列表",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "账户",
-                        "name": "username",
-                        "in": "query"
+                        "description": "Personal tag form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
                     }
                 ],
                 "responses": {
@@ -5046,7 +4653,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.UserList"
+                                            "$ref": "#/definitions/model.Tag"
                                         }
                                     }
                                 }
@@ -5062,14 +4669,13 @@
                 }
             }
         },
-        "/admin/user/myOauth": {
-            "get": {
+        "/admin/my/tag/delete": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "我的授权",
                 "consumes": [
                     "application/json"
                 ],
@@ -5077,12 +4683,80 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "我的授权",
-                "responses": {
-                    "200": {
-                        "description": "OK",
+                "parameters": [
+                    {
+                        "description": "Personal tag deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/my/tag/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the personal tag list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of personal tags per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Filter for tags owned by the current user",
+                        "name": "is_my",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
                         "schema": {
                             "allOf": [
                                 {
@@ -5092,10 +4766,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "type": "array",
-                                            "items": {
-                                                "$ref": "#/definitions/admin.UserOauthItem"
-                                            }
+                                            "$ref": "#/definitions/model.TagList"
                                         }
                                     }
                                 }
@@ -5111,14 +4782,13 @@
                 }
             }
         },
-        "/admin/user/update": {
+        "/admin/my/tag/update": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "管理员编辑",
                 "consumes": [
                     "application/json"
                 ],
@@ -5126,17 +4796,16 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    ""
                 ],
-                "summary": "管理员编辑",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "Personal tag update form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserForm"
+                            "$ref": "#/definitions/admin.TagForm"
                         }
                     }
                 ],
@@ -5152,7 +4821,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.User"
+                                            "$ref": "#/definitions/model.Tag"
                                         }
                                     }
                                 }
@@ -5168,14 +4837,14 @@
                 }
             }
         },
-        "/admin/user/updatePassword": {
+        "/admin/oauth/bind": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "修改密码",
+                "description": "Authenticated users receive a short-lived binding code and provider URL.",
                 "consumes": [
                     "application/json"
                 ],
@@ -5183,17 +4852,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    "Oauth"
                 ],
-                "summary": "修改密码",
+                "summary": "Start OAuth binding",
                 "parameters": [
                     {
-                        "description": "用户信息",
+                        "description": "OAuth provider binding payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserPasswordForm"
+                            "$ref": "#/definitions/admin.BindOauthForm"
                         }
                     }
                 ],
@@ -5201,7 +4870,22 @@
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/response.Response"
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "type": "object",
+                                            "additionalProperties": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    }
+                                }
+                            ]
                         }
                     },
                     "500": {
@@ -5213,14 +4897,14 @@
                 }
             }
         },
-        "/admin/user_token/batchDelete": {
+        "/admin/oauth/bindConfirm": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录凭证批量删除",
+                "description": "Authenticated users attach the confirmed OAuth identity to their account.",
                 "consumes": [
                     "application/json"
                 ],
@@ -5228,17 +4912,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录凭证"
+                    "Oauth"
                 ],
-                "summary": "登录凭证批量删除",
+                "summary": "Complete OAuth binding",
                 "parameters": [
                     {
-                        "description": "登录凭证信息",
+                        "description": "OAuth confirmation payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/admin.UserTokenBatchDeleteForm"
+                            "$ref": "#/definitions/admin.OauthConfirmForm"
                         }
                     }
                 ],
@@ -5258,14 +4942,14 @@
                 }
             }
         },
-        "/admin/user_token/delete": {
+        "/admin/oauth/confirm": {
             "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录凭证删除",
+                "description": "Authenticated users confirm a short-lived OAuth handoff before binding.",
                 "consumes": [
                     "application/json"
                 ],
@@ -5273,17 +4957,17 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录凭证"
+                    "Oauth"
                 ],
-                "summary": "登录凭证删除",
+                "summary": "Confirm OAuth binding",
                 "parameters": [
                     {
-                        "description": "登录凭证信息",
+                        "description": "OAuth confirmation payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/model.UserToken"
+                            "$ref": "#/definitions/admin.OauthConfirmForm"
                         }
                     }
                 ],
@@ -5303,14 +4987,14 @@
                 }
             }
         },
-        "/admin/user_token/list": {
-            "get": {
+        "/admin/oauth/create": {
+            "post": {
                 "security": [
                     {
                         "token": []
                     }
                 ],
-                "description": "登录凭证列表",
+                "description": "Oauth",
                 "consumes": [
                     "application/json"
                 ],
@@ -5318,27 +5002,18 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录凭证"
+                    "Oauth"
                 ],
-                "summary": "登录凭证列表",
+                "summary": "Oauth",
                 "parameters": [
                     {
-                        "type": "integer",
-                        "description": "页码",
-                        "name": "page",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "页大小",
-                        "name": "page_size",
-                        "in": "query"
-                    },
-                    {
-                        "type": "integer",
-                        "description": "用户ID",
-                        "name": "user_id",
-                        "in": "query"
+                        "description": "Oauth",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.OauthForm"
+                        }
                     }
                 ],
                 "responses": {
@@ -5353,7 +5028,7 @@
                                     "type": "object",
                                     "properties": {
                                         "data": {
-                                            "$ref": "#/definitions/model.UserTokenList"
+                                            "$ref": "#/definitions/model.Oauth"
                                         }
                                     }
                                 }
@@ -5368,156 +5043,2855 @@
                     }
                 }
             }
-        }
-    },
-    "definitions": {
-        "admin.AddressBookForm": {
-            "type": "object",
-            "required": [
-                "id"
-            ],
-            "properties": {
-                "alias": {
-                    "type": "string"
-                },
-                "collection_id": {
-                    "type": "integer"
-                },
-                "forceAlwaysRelay": {
-                    "type": "boolean"
-                },
-                "hash": {
-                    "type": "string"
-                },
-                "hostname": {
-                    "type": "string"
-                },
-                "id": {
-                    "type": "string"
-                },
-                "loginName": {
-                    "type": "string"
-                },
-                "online": {
-                    "type": "boolean"
-                },
-                "password": {
-                    "type": "string"
-                },
-                "platform": {
-                    "type": "string"
-                },
-                "rdpPort": {
-                    "type": "string"
-                },
-                "rdpUsername": {
-                    "type": "string"
-                },
-                "row_id": {
-                    "type": "integer"
-                },
-                "sameServer": {
-                    "type": "boolean"
-                },
-                "tags": {
-                    "type": "array",
-                    "items": {
-                        "type": "string"
+        },
+        "/admin/oauth/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
                     }
-                },
-                "user_id": {
-                    "type": "integer"
-                },
-                "user_ids": {
-                    "type": "array",
-                    "items": {
-                        "type": "integer"
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "description": "Oauth",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.OauthForm"
+                        }
                     }
-                },
-                "username": {
-                    "type": "string"
-                }
-            }
-        },
-        "admin.AuditConnLogIds": {
-            "type": "object",
-            "required": [
-                "ids"
-            ],
-            "properties": {
-                "ids": {
-                    "type": "array",
-                    "items": {
-                        "type": "integer"
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
                     }
                 }
             }
         },
-        "admin.AuditFileLogIds": {
-            "type": "object",
-            "required": [
-                "ids"
-            ],
-            "properties": {
-                "ids": {
-                    "type": "array",
-                    "items": {
-                        "type": "integer"
+        "/admin/oauth/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
                     }
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Oauth"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/info": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated OAuth handoff lookup by short-lived code.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Get cached OAuth handoff data",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "OAuth handoff code",
+                        "name": "code",
+                        "in": "query",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the OAuth provider list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of OAuth providers per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.OauthList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/unbind": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated users remove one OAuth provider binding from their account.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Unbind OAuth provider",
+                "parameters": [
+                    {
+                        "description": "OAuth provider unbinding payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UnBindOauthForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oauth/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Oauth",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Oauth",
+                "parameters": [
+                    {
+                        "description": "Oauth",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.OauthForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.OauthList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oidc/auth": {
+            "post": {
+                "description": "Public pre-authentication route returning the state code and provider URL for the admin OIDC flow.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Start admin OIDC authorization",
+                "responses": {
+                    "200": {
+                        "description": "Authorization state code and provider URL",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "type": "object",
+                                            "additionalProperties": {
+                                                "type": "string"
+                                            }
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "400": {
+                        "description": "OIDC authorization could not be started",
+                        "schema": {
+                            "$ref": "#/definitions/response.ErrorResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/oidc/auth-query": {
+            "get": {
+                "description": "Public pre-authentication route exchanging the OIDC state code and provider callback values for an admin login payload.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Complete admin OIDC authorization",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "400": {
+                        "description": "OIDC authorization query failed",
+                        "schema": {
+                            "$ref": "#/definitions/response.ErrorResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/batchDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "id",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerBatchDeleteForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/create": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Peer form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Peer"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Peer deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Peer"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the peer list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of peers per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Last-online time offset filter",
+                        "name": "time_ago",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Hostname filter",
+                        "name": "hostname",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "uuids ",
+                        "name": "uuids",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.PeerList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/simpleData": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated peer version lookup used by the admin panel.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Peer"
+                ],
+                "summary": "Get peer version data",
+                "parameters": [
+                    {
+                        "description": "Peer ID lookup payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.SimpleDataQuery"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.PeerList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/peer/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Peer update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Peer"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdAuditList": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only paginated audit history for server-command executions.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "List server-command audit records",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of audit records per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.ServerCmdAuditList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdCreate": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Create a server command",
+                "parameters": [
+                    {
+                        "description": "Server command payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.ServerCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Delete a server command",
+                "parameters": [
+                    {
+                        "description": "Server command identifier",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.ServerCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdList": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only paginated list of built-in and configured server commands.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "List server commands",
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of commands per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.ServerCmdList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/cmdUpdate": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Update a server command",
+                "parameters": [
+                    {
+                        "description": "Server command update payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.ServerCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/rustdesk/sendCmd": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only command execution against the selected ID or relay server.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Rustdesk"
+                ],
+                "summary": "Send a server command",
+                "parameters": [
+                    {
+                        "description": "Server command request",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.RustdeskCmd"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/share_record/batchDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "id",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.PeerShareRecordBatchDeleteForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/share_record/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Share record deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.ShareRecordForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/share_record/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "user_id",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Page number for share records",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of share records per page",
+                        "name": "page_size",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Redacted share-record list envelope",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.ShareRecordSafeList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/create": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Tag form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Tag"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Tag deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Tag"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the tag list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of tags per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Filter for tags owned by the current user",
+                        "name": "is_my",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "id",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.TagList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/tag/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Tag update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.TagForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.Tag"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/changeCurPwd": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "Current user password change form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.ChangeCurPasswordForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/changePwd": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User password update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserPasswordForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/create": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.User"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/current": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/admin.LoginPayload"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/detail/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.User"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/groupUsers": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Admin-only group and user picker data.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "List users grouped by group",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the user list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of users per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Username filter",
+                        "name": "username",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.UserList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/myOauth": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "type": "array",
+                                            "items": {
+                                                "$ref": "#/definitions/admin.UserOauthItem"
+                                            }
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/register": {
+            "post": {
+                "description": "Public registration route; the server decides whether the new account is enabled immediately.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "Register a user",
+                "parameters": [
+                    {
+                        "description": "User registration payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.RegisterForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/update": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User update form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.User"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user/updateCurrent": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "description": "Authenticated users may update only their nickname and email.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "Update the current user profile",
+                "parameters": [
+                    {
+                        "description": "Current user profile update payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UpdateCurrentForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/batchDelete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User-token ID batch deletion payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/admin.UserTokenBatchDeleteForm"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/delete": {
+            "post": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "description": "User-token deletion form payload",
+                        "name": "body",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/model.UserToken"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/admin/user_token/list": {
+            "get": {
+                "security": [
+                    {
+                        "token": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    ""
+                ],
+                "parameters": [
+                    {
+                        "type": "integer",
+                        "description": "Page number for the user-token list",
+                        "name": "page",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Number of user tokens per page",
+                        "name": "page_size",
+                        "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "ID",
+                        "name": "user_id",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Redacted user-token list envelope",
+                        "schema": {
+                            "allOf": [
+                                {
+                                    "$ref": "#/definitions/response.Response"
+                                },
+                                {
+                                    "type": "object",
+                                    "properties": {
+                                        "data": {
+                                            "$ref": "#/definitions/model.UserTokenSafeList"
+                                        }
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        }
+    },
+    "definitions": {
+        "admin.AddressBookForm": {
+            "type": "object",
+            "required": [
+                "id"
+            ],
+            "properties": {
+                "alias": {
+                    "type": "string"
+                },
+                "collection_id": {
+                    "type": "integer"
+                },
+                "forceAlwaysRelay": {
+                    "type": "boolean"
+                },
+                "hash": {
+                    "type": "string"
+                },
+                "hostname": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "string"
+                },
+                "loginName": {
+                    "type": "string"
+                },
+                "online": {
+                    "type": "boolean"
+                },
+                "password": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "rdpPort": {
+                    "type": "string"
+                },
+                "rdpUsername": {
+                    "type": "string"
+                },
+                "row_id": {
+                    "type": "integer"
+                },
+                "sameServer": {
+                    "type": "boolean"
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "user_id": {
+                    "type": "integer"
+                },
+                "user_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.AuditConnLogIds": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.AuditFileLogIds": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.BatchCreateFromPeersForm": {
+            "type": "object",
+            "properties": {
+                "collection_id": {
+                    "type": "integer"
+                },
+                "peer_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "admin.BatchUpdateTagsForm": {
+            "type": "object",
+            "properties": {
+                "row_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
+        "admin.BindOauthForm": {
+            "type": "object",
+            "required": [
+                "op"
+            ],
+            "properties": {
+                "op": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.ChangeCurPasswordForm": {
+            "type": "object",
+            "required": [
+                "new_password",
+                "old_password"
+            ],
+            "properties": {
+                "new_password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                },
+                "old_password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                }
+            }
+        },
+        "admin.CustomBuildForm": {
+            "type": "object",
+            "required": [
+                "name",
+                "platform",
+                "version"
+            ],
+            "properties": {
+                "app_name": {
+                    "type": "string"
+                },
+                "custom_json": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.CustomPresetForm": {
+            "type": "object",
+            "required": [
+                "name",
+                "platform",
+                "version"
+            ],
+            "properties": {
+                "app_name": {
+                    "type": "string"
+                },
+                "custom_json": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.DeviceGroupForm": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.GithubBuildConfigForm": {
+            "type": "object",
+            "properties": {
+                "payload_key": {
+                    "type": "string"
+                },
+                "repo": {
+                    "type": "string"
+                },
+                "token": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.GroupForm": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "type": {
+                    "type": "integer"
+                }
+            }
+        },
+        "admin.LoginLogIds": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.LoginPayload": {
+            "type": "object",
+            "properties": {
+                "avatar": {
+                    "type": "string"
+                },
+                "email": {
+                    "type": "string"
+                },
+                "nickname": {
+                    "type": "string"
+                },
+                "route_names": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "token": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.OauthConfirmForm": {
+            "type": "object",
+            "required": [
+                "code"
+            ],
+            "properties": {
+                "code": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.OauthForm": {
+            "type": "object",
+            "required": [
+                "client_id",
+                "client_secret",
+                "oauth_type"
+            ],
+            "properties": {
+                "auto_register": {
+                    "type": "boolean"
+                },
+                "client_id": {
+                    "type": "string"
+                },
+                "client_secret": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "issuer": {
+                    "type": "string"
+                },
+                "oauth_type": {
+                    "type": "string"
+                },
+                "op": {
+                    "type": "string"
+                },
+                "pkce_enable": {
+                    "type": "boolean"
+                },
+                "pkce_method": {
+                    "description": "PkceMethod is constrained to S256/plain when set. When pkce_enable is\ntrue the field is required so the runtime layer can pick a hashing\nstrategy without falling back to a hidden default. When pkce_enable is\nfalse/nil it is ignored and may be empty.",
+                    "type": "string",
+                    "enum": [
+                        "S256",
+                        "plain"
+                    ]
+                },
+                "scopes": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.PeerBatchDeleteForm": {
+            "type": "object",
+            "required": [
+                "row_ids"
+            ],
+            "properties": {
+                "row_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.PeerForm": {
+            "type": "object",
+            "properties": {
+                "alias": {
+                    "type": "string"
+                },
+                "cpu": {
+                    "type": "string"
+                },
+                "group_id": {
+                    "type": "integer"
+                },
+                "hostname": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "string"
+                },
+                "memory": {
+                    "type": "string"
+                },
+                "os": {
+                    "type": "string"
+                },
+                "row_id": {
+                    "type": "integer"
+                },
+                "username": {
+                    "type": "string"
+                },
+                "uuid": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.PeerShareRecordBatchDeleteForm": {
+            "type": "object",
+            "required": [
+                "ids"
+            ],
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
+                }
+            }
+        },
+        "admin.RegisterForm": {
+            "type": "object",
+            "required": [
+                "confirm_password",
+                "password",
+                "username"
+            ],
+            "properties": {
+                "confirm_password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                },
+                "email": {
+                    "description": "validate:\"required,email\"",
+                    "type": "string"
+                },
+                "password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
+                },
+                "username": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 2
+                }
+            }
+        },
+        "admin.RustdeskCmd": {
+            "type": "object",
+            "properties": {
+                "cmd": {
+                    "type": "string"
+                },
+                "option": {
+                    "type": "string"
+                },
+                "target": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.ShareByWebClientForm": {
+            "type": "object",
+            "required": [
+                "id",
+                "password",
+                "password_type"
+            ],
+            "properties": {
+                "expire": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "string"
+                },
+                "password": {
+                    "type": "string"
+                },
+                "password_type": {
+                    "description": "once,fixed",
+                    "type": "string",
+                    "enum": [
+                        "once",
+                        "fixed"
+                    ]
+                }
+            }
+        },
+        "admin.ShareRecordForm": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "admin.SimpleDataQuery": {
+            "type": "object",
+            "properties": {
+                "ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
+        "admin.TagForm": {
+            "type": "object",
+            "required": [
+                "color",
+                "name"
+            ],
+            "properties": {
+                "collection_id": {
+                    "type": "integer"
+                },
+                "color": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.ChangeCurPasswordForm": {
+        "admin.UnBindOauthForm": {
             "type": "object",
             "required": [
-                "new_password",
-                "old_password"
+                "op"
             ],
             "properties": {
-                "new_password": {
+                "op": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.UpdateCurrentForm": {
+            "type": "object",
+            "properties": {
+                "email": {
                     "type": "string",
-                    "maxLength": 32,
-                    "minLength": 4
+                    "maxLength": 128
                 },
-                "old_password": {
+                "nickname": {
                     "type": "string",
-                    "maxLength": 32,
-                    "minLength": 4
+                    "maxLength": 128
                 }
             }
         },
-        "admin.DeviceGroupForm": {
+        "admin.UserForm": {
             "type": "object",
             "required": [
-                "name"
+                "group_id",
+                "status",
+                "username"
             ],
             "properties": {
+                "avatar": {
+                    "type": "string"
+                },
+                "email": {
+                    "description": "validate:\"required,email\" email",
+                    "type": "string"
+                },
+                "group_id": {
+                    "type": "integer"
+                },
                 "id": {
                     "type": "integer"
                 },
-                "name": {
+                "is_admin": {
+                    "type": "boolean"
+                },
+                "nickname": {
+                    "description": "Password string           `json:\"password\" validate:\"required,gte=4,lte=20\"`",
+                    "type": "string"
+                },
+                "remark": {
+                    "type": "string"
+                },
+                "status": {
+                    "minimum": 0,
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/model.StatusCode"
+                        }
+                    ]
+                },
+                "username": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 2
+                }
+            }
+        },
+        "admin.UserOauthItem": {
+            "type": "object",
+            "properties": {
+                "op": {
                     "type": "string"
+                },
+                "status": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.GroupForm": {
+        "admin.UserPasswordForm": {
             "type": "object",
             "required": [
-                "name"
+                "id",
+                "password"
             ],
             "properties": {
                 "id": {
                     "type": "integer"
                 },
-                "name": {
-                    "type": "string"
-                },
-                "type": {
-                    "type": "integer"
+                "password": {
+                    "type": "string",
+                    "maxLength": 32,
+                    "minLength": 4
                 }
             }
         },
-        "admin.LoginLogIds": {
+        "admin.UserTokenBatchDeleteForm": {
             "type": "object",
             "required": [
                 "ids"
@@ -5531,381 +7905,434 @@
                 }
             }
         },
-        "admin.LoginPayload": {
+        "admin.WorkflowRefApprovalForm": {
             "type": "object",
             "properties": {
-                "avatar": {
-                    "type": "string"
+                "confirm": {
+                    "type": "boolean"
                 },
-                "email": {
+                "workflow_tag": {
+                    "type": "string"
+                }
+            }
+        },
+        "admin.versionOption": {
+            "type": "object",
+            "properties": {
+                "assets_release": {
                     "type": "string"
                 },
-                "nickname": {
+                "version": {
                     "type": "string"
+                }
+            }
+        },
+        "admin.versionsResponse": {
+            "type": "object",
+            "properties": {
+                "error": {
+                    "type": "boolean"
                 },
-                "route_names": {
+                "versions": {
                     "type": "array",
                     "items": {
-                        "type": "string"
+                        "$ref": "#/definitions/admin.versionOption"
                     }
+                }
+            }
+        },
+        "model.AddressBookCollection": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "created_at": {
+                    "type": "string"
                 },
-                "token": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
                     "type": "string"
                 },
-                "username": {
+                "updated_at": {
                     "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.OauthForm": {
+        "model.AddressBookCollectionList": {
+            "type": "object",
+            "properties": {
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.AddressBookCollection"
+                    }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.AddressBookCollectionRule": {
             "type": "object",
             "required": [
-                "client_id",
-                "client_secret",
-                "oauth_type"
+                "collection_id",
+                "rule",
+                "to_id",
+                "type"
             ],
             "properties": {
-                "auto_register": {
-                    "type": "boolean"
-                },
-                "client_id": {
-                    "type": "string"
+                "collection_id": {
+                    "type": "integer"
                 },
-                "client_secret": {
+                "created_at": {
                     "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "issuer": {
-                    "type": "string"
-                },
-                "oauth_type": {
-                    "type": "string"
+                "rule": {
+                    "description": "0:  1:  2:   3:",
+                    "type": "integer",
+                    "maximum": 3,
+                    "minimum": 1
                 },
-                "op": {
-                    "type": "string"
+                "to_id": {
+                    "type": "integer"
                 },
-                "pkce_enable": {
-                    "type": "boolean"
+                "type": {
+                    "description": "1:  2:",
+                    "type": "integer",
+                    "maximum": 2,
+                    "minimum": 1
                 },
-                "pkce_method": {
+                "updated_at": {
                     "type": "string"
                 },
-                "scopes": {
-                    "type": "string"
+                "user_id": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.PeerBatchDeleteForm": {
+        "model.AddressBookCollectionRuleList": {
             "type": "object",
-            "required": [
-                "row_ids"
-            ],
             "properties": {
-                "row_ids": {
+                "list": {
                     "type": "array",
                     "items": {
-                        "type": "integer"
+                        "$ref": "#/definitions/model.AddressBookCollectionRule"
                     }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.PeerForm": {
+        "model.AddressBookSafe": {
             "type": "object",
             "properties": {
-                "cpu": {
+                "alias": {
                     "type": "string"
                 },
-                "group_id": {
+                "collection": {
+                    "$ref": "#/definitions/model.AddressBookCollection"
+                },
+                "collection_id": {
                     "type": "integer"
                 },
+                "created_at": {
+                    "type": "string"
+                },
+                "forceAlwaysRelay": {
+                    "type": "boolean"
+                },
                 "hostname": {
                     "type": "string"
                 },
                 "id": {
                     "type": "string"
                 },
-                "memory": {
+                "loginName": {
+                    "type": "string"
+                },
+                "online": {
+                    "type": "boolean"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "rdpPort": {
+                    "type": "string"
+                },
+                "rdpUsername": {
                     "type": "string"
                 },
-                "os": {
+                "row_id": {
+                    "type": "integer"
+                },
+                "sameServer": {
+                    "type": "boolean"
+                },
+                "tags": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "updated_at": {
                     "type": "string"
                 },
-                "row_id": {
+                "user_id": {
                     "type": "integer"
                 },
                 "username": {
                     "type": "string"
-                },
-                "uuid": {
-                    "type": "string"
-                },
-                "version": {
-                    "type": "string"
                 }
             }
         },
-        "admin.PeerShareRecordBatchDeleteForm": {
+        "model.AddressBookSafeList": {
             "type": "object",
-            "required": [
-                "ids"
-            ],
             "properties": {
-                "ids": {
+                "list": {
                     "type": "array",
                     "items": {
-                        "type": "integer"
+                        "$ref": "#/definitions/model.AddressBookSafe"
                     }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
-        "admin.ShareByWebClientForm": {
+        "model.AuditConn": {
             "type": "object",
-            "required": [
-                "id",
-                "password",
-                "password_type"
-            ],
             "properties": {
-                "expire": {
+                "action": {
+                    "type": "string"
+                },
+                "close_time": {
                     "type": "integer"
                 },
-                "id": {
+                "conn_id": {
+                    "type": "integer"
+                },
+                "created_at": {
                     "type": "string"
                 },
-                "password": {
+                "from_name": {
+                    "type": "string"
+                },
+                "from_peer": {
                     "type": "string"
                 },
-                "password_type": {
-                    "description": "只能是once,fixed",
-                    "type": "string",
-                    "enum": [
-                        "once",
-                        "fixed"
-                    ]
-                }
-            }
-        },
-        "admin.ShareRecordForm": {
-            "type": "object",
-            "properties": {
                 "id": {
                     "type": "integer"
                 },
-                "user_id": {
+                "ip": {
+                    "type": "string"
+                },
+                "peer_id": {
+                    "type": "string"
+                },
+                "session_id": {
+                    "type": "string"
+                },
+                "type": {
                     "type": "integer"
+                },
+                "updated_at": {
+                    "type": "string"
+                },
+                "uuid": {
+                    "type": "string"
                 }
             }
         },
-        "admin.TagForm": {
+        "model.AuditConnList": {
             "type": "object",
-            "required": [
-                "color",
-                "name"
-            ],
             "properties": {
-                "collection_id": {
-                    "type": "integer"
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.AuditConn"
+                    }
                 },
-                "color": {
+                "page": {
                     "type": "integer"
                 },
-                "id": {
+                "page_size": {
                     "type": "integer"
                 },
-                "name": {
-                    "type": "string"
-                },
-                "user_id": {
+                "total": {
                     "type": "integer"
                 }
             }
         },
-        "admin.UserForm": {
+        "model.AuditFile": {
             "type": "object",
-            "required": [
-                "group_id",
-                "status",
-                "username"
-            ],
             "properties": {
-                "avatar": {
+                "created_at": {
                     "type": "string"
                 },
-                "email": {
-                    "description": "validate:\"required,email\" email不强制",
+                "from_name": {
                     "type": "string"
                 },
-                "group_id": {
-                    "type": "integer"
+                "from_peer": {
+                    "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "is_admin": {
-                    "type": "boolean"
+                "info": {
+                    "type": "string"
                 },
-                "nickname": {
-                    "description": "Password string           `json:\"password\" validate:\"required,gte=4,lte=20\"`",
+                "ip": {
                     "type": "string"
                 },
-                "status": {
-                    "minimum": 0,
-                    "allOf": [
-                        {
-                            "$ref": "#/definitions/model.StatusCode"
-                        }
-                    ]
+                "is_file": {
+                    "type": "boolean"
                 },
-                "username": {
-                    "type": "string",
-                    "maxLength": 32,
-                    "minLength": 2
-                }
-            }
-        },
-        "admin.UserOauthItem": {
-            "type": "object",
-            "properties": {
-                "op": {
+                "num": {
+                    "type": "integer"
+                },
+                "path": {
                     "type": "string"
                 },
-                "status": {
-                    "type": "integer"
-                }
-            }
-        },
-        "admin.UserPasswordForm": {
-            "type": "object",
-            "required": [
-                "id",
-                "password"
-            ],
-            "properties": {
-                "id": {
+                "peer_id": {
+                    "type": "string"
+                },
+                "type": {
                     "type": "integer"
                 },
-                "password": {
-                    "type": "string",
-                    "maxLength": 32,
-                    "minLength": 4
+                "updated_at": {
+                    "type": "string"
+                },
+                "uuid": {
+                    "type": "string"
                 }
             }
         },
-        "admin.UserTokenBatchDeleteForm": {
+        "model.AuditFileList": {
             "type": "object",
-            "required": [
-                "ids"
-            ],
             "properties": {
-                "ids": {
+                "list": {
                     "type": "array",
                     "items": {
-                        "type": "integer"
+                        "$ref": "#/definitions/model.AuditFile"
                     }
+                },
+                "page": {
+                    "type": "integer"
+                },
+                "page_size": {
+                    "type": "integer"
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
-        "github_com_lejianwen_rustdesk-api_v2_http_request_admin.Login": {
+        "model.CustomBuildPublic": {
             "type": "object",
-            "required": [
-                "password",
-                "username"
-            ],
             "properties": {
-                "captcha": {
+                "app_name": {
                     "type": "string"
                 },
-                "captcha_id": {
-                    "type": "string"
+                "download_key_expires_at": {
+                    "type": "integer"
                 },
-                "password": {
+                "file_size": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
                     "type": "string"
                 },
                 "platform": {
                     "type": "string"
                 },
-                "username": {
+                "status": {
+                    "type": "string"
+                },
+                "version": {
                     "type": "string"
                 }
             }
         },
-        "model.AddressBook": {
+        "model.CustomBuildSafe": {
             "type": "object",
             "properties": {
-                "alias": {
+                "app_name": {
                     "type": "string"
                 },
-                "collection": {
-                    "$ref": "#/definitions/model.AddressBookCollection"
-                },
-                "collection_id": {
-                    "type": "integer"
+                "build_log": {
+                    "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
-                "forceAlwaysRelay": {
-                    "type": "boolean"
-                },
-                "hash": {
+                "custom_json": {
                     "type": "string"
                 },
-                "hostname": {
-                    "type": "string"
+                "download_key_expires_at": {
+                    "type": "integer"
                 },
-                "id": {
-                    "type": "string"
+                "file_size": {
+                    "type": "integer"
                 },
-                "loginName": {
-                    "type": "string"
+                "github_artifact_id": {
+                    "type": "integer"
                 },
-                "online": {
-                    "type": "boolean"
+                "github_artifact_name": {
+                    "type": "string"
                 },
-                "password": {
+                "github_html_url": {
                     "type": "string"
                 },
-                "platform": {
+                "github_provider": {
                     "type": "string"
                 },
-                "rdpPort": {
+                "github_ref": {
                     "type": "string"
                 },
-                "rdpUsername": {
+                "github_repo": {
                     "type": "string"
                 },
-                "row_id": {
+                "github_run_id": {
                     "type": "integer"
                 },
-                "sameServer": {
-                    "type": "boolean"
-                },
-                "tags": {
-                    "type": "array",
-                    "items": {
-                        "type": "string"
-                    }
-                },
-                "updated_at": {
+                "github_run_url": {
                     "type": "string"
                 },
-                "user_id": {
-                    "type": "integer"
-                },
-                "username": {
+                "github_source_sha": {
                     "type": "string"
-                }
-            }
-        },
-        "model.AddressBookCollection": {
-            "type": "object",
-            "required": [
-                "name"
-            ],
-            "properties": {
-                "created_at": {
+                },
+                "github_workflow": {
                     "type": "string"
                 },
                 "id": {
@@ -5914,21 +8341,30 @@
                 "name": {
                     "type": "string"
                 },
+                "platform": {
+                    "type": "string"
+                },
+                "status": {
+                    "type": "string"
+                },
                 "updated_at": {
                     "type": "string"
                 },
                 "user_id": {
                     "type": "integer"
+                },
+                "version": {
+                    "type": "string"
                 }
             }
         },
-        "model.AddressBookCollectionList": {
+        "model.CustomBuildSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AddressBookCollection"
+                        "$ref": "#/definitions/model.CustomBuildSafe"
                     }
                 },
                 "page": {
@@ -5942,54 +8378,45 @@
                 }
             }
         },
-        "model.AddressBookCollectionRule": {
+        "model.CustomPresetSafe": {
             "type": "object",
-            "required": [
-                "collection_id",
-                "rule",
-                "to_id",
-                "type"
-            ],
             "properties": {
-                "collection_id": {
-                    "type": "integer"
+                "app_name": {
+                    "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
+                "custom_json": {
+                    "type": "string"
+                },
                 "id": {
                     "type": "integer"
                 },
-                "rule": {
-                    "description": "0: 无 1: 读 2: 读写  3: 完全控制",
-                    "type": "integer",
-                    "maximum": 3,
-                    "minimum": 1
-                },
-                "to_id": {
-                    "type": "integer"
+                "name": {
+                    "type": "string"
                 },
-                "type": {
-                    "description": "1: 个人 2: 群组",
-                    "type": "integer",
-                    "maximum": 2,
-                    "minimum": 1
+                "platform": {
+                    "type": "string"
                 },
                 "updated_at": {
                     "type": "string"
                 },
                 "user_id": {
                     "type": "integer"
+                },
+                "version": {
+                    "type": "string"
                 }
             }
         },
-        "model.AddressBookList": {
+        "model.CustomPresetSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AddressBook"
+                        "$ref": "#/definitions/model.CustomPresetSafe"
                     }
                 },
                 "page": {
@@ -6003,57 +8430,85 @@
                 }
             }
         },
-        "model.AuditConn": {
+        "model.DeviceGroup": {
             "type": "object",
             "properties": {
-                "action": {
+                "created_at": {
                     "type": "string"
                 },
-                "close_time": {
+                "id": {
                     "type": "integer"
                 },
-                "conn_id": {
-                    "type": "integer"
+                "name": {
+                    "type": "string"
                 },
+                "updated_at": {
+                    "type": "string"
+                }
+            }
+        },
+        "model.GithubBuildConfigSafe": {
+            "type": "object",
+            "properties": {
                 "created_at": {
                     "type": "string"
                 },
-                "from_name": {
-                    "type": "string"
+                "has_payload_key": {
+                    "type": "boolean"
                 },
-                "from_peer": {
-                    "type": "string"
+                "has_token": {
+                    "type": "boolean"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "ip": {
+                "repo": {
                     "type": "string"
                 },
-                "peer_id": {
+                "updated_at": {
                     "type": "string"
                 },
-                "session_id": {
+                "workflow_ref": {
                     "type": "string"
                 },
-                "type": {
+                "workflow_ref_approved": {
+                    "type": "boolean"
+                },
+                "workflow_ref_status": {
+                    "type": "string"
+                },
+                "workflow_ref_trust_status": {
+                    "type": "string"
+                }
+            }
+        },
+        "model.Group": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string"
+                },
+                "id": {
                     "type": "integer"
                 },
-                "updated_at": {
+                "name": {
                     "type": "string"
                 },
-                "uuid": {
+                "type": {
+                    "type": "integer"
+                },
+                "updated_at": {
                     "type": "string"
                 }
             }
         },
-        "model.AuditConnList": {
+        "model.GroupList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AuditConn"
+                        "$ref": "#/definitions/model.Group"
                     }
                 },
                 "page": {
@@ -6067,57 +8522,57 @@
                 }
             }
         },
-        "model.AuditFile": {
+        "model.LoginLog": {
             "type": "object",
             "properties": {
-                "created_at": {
+                "client": {
+                    "description": "webadmin,webclient,app,",
                     "type": "string"
                 },
-                "from_name": {
+                "created_at": {
                     "type": "string"
                 },
-                "from_peer": {
+                "device_id": {
                     "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "info": {
-                    "type": "string"
-                },
                 "ip": {
                     "type": "string"
                 },
-                "is_file": {
-                    "type": "boolean"
-                },
-                "num": {
+                "is_deleted": {
                     "type": "integer"
                 },
-                "path": {
-                    "type": "string"
-                },
-                "peer_id": {
+                "platform": {
+                    "description": "windows,linux,mac,android,ios",
                     "type": "string"
                 },
                 "type": {
-                    "type": "integer"
+                    "description": "account,oauth",
+                    "type": "string"
                 },
                 "updated_at": {
                     "type": "string"
                 },
+                "user_id": {
+                    "type": "integer"
+                },
+                "user_token_id": {
+                    "type": "integer"
+                },
                 "uuid": {
                     "type": "string"
                 }
             }
         },
-        "model.AuditFileList": {
+        "model.LoginLogList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.AuditFile"
+                        "$ref": "#/definitions/model.LoginLog"
                     }
                 },
                 "page": {
@@ -6131,50 +8586,52 @@
                 }
             }
         },
-        "model.DeviceGroup": {
+        "model.Oauth": {
             "type": "object",
             "properties": {
+                "auto_register": {
+                    "description": "RedirectUrl  string `json:\"redirect_url\"`",
+                    "type": "boolean"
+                },
+                "client_id": {
+                    "type": "string"
+                },
                 "created_at": {
                     "type": "string"
                 },
                 "id": {
                     "type": "integer"
                 },
-                "name": {
+                "issuer": {
                     "type": "string"
                 },
-                "updated_at": {
+                "oauth_type": {
                     "type": "string"
-                }
-            }
-        },
-        "model.Group": {
-            "type": "object",
-            "properties": {
-                "created_at": {
+                },
+                "op": {
                     "type": "string"
                 },
-                "id": {
-                    "type": "integer"
+                "pkce_enable": {
+                    "type": "boolean"
                 },
-                "name": {
+                "pkce_method": {
                     "type": "string"
                 },
-                "type": {
-                    "type": "integer"
+                "scopes": {
+                    "type": "string"
                 },
                 "updated_at": {
                     "type": "string"
                 }
             }
         },
-        "model.GroupList": {
+        "model.OauthList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.Group"
+                        "$ref": "#/definitions/model.Oauth"
                     }
                 },
                 "page": {
@@ -6188,57 +8645,69 @@
                 }
             }
         },
-        "model.LoginLog": {
+        "model.Peer": {
             "type": "object",
             "properties": {
-                "client": {
-                    "description": "webadmin,webclient,app,",
+                "alias": {
+                    "type": "string"
+                },
+                "cpu": {
                     "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
-                "device_id": {
+                "group_id": {
+                    "type": "integer"
+                },
+                "hostname": {
                     "type": "string"
                 },
                 "id": {
-                    "type": "integer"
+                    "type": "string"
                 },
-                "ip": {
+                "last_online_ip": {
                     "type": "string"
                 },
-                "is_deleted": {
+                "last_online_time": {
                     "type": "integer"
                 },
-                "platform": {
-                    "description": "windows,linux,mac,android,ios",
+                "memory": {
                     "type": "string"
                 },
-                "type": {
-                    "description": "account,oauth",
+                "os": {
                     "type": "string"
                 },
+                "row_id": {
+                    "type": "integer"
+                },
                 "updated_at": {
                     "type": "string"
                 },
+                "user": {
+                    "$ref": "#/definitions/model.User"
+                },
                 "user_id": {
                     "type": "integer"
                 },
-                "user_token_id": {
-                    "type": "integer"
+                "username": {
+                    "type": "string"
                 },
                 "uuid": {
                     "type": "string"
+                },
+                "version": {
+                    "type": "string"
                 }
             }
         },
-        "model.LoginLogList": {
+        "model.PeerList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.LoginLog"
+                        "$ref": "#/definitions/model.Peer"
                     }
                 },
                 "page": {
@@ -6252,54 +8721,77 @@
                 }
             }
         },
-        "model.Oauth": {
+        "model.ServerCmd": {
             "type": "object",
             "properties": {
-                "auto_register": {
-                    "type": "boolean"
-                },
-                "client_id": {
+                "alias": {
                     "type": "string"
                 },
-                "client_secret": {
+                "cmd": {
                     "type": "string"
                 },
                 "created_at": {
                     "type": "string"
                 },
+                "explain": {
+                    "type": "string"
+                },
                 "id": {
                     "type": "integer"
                 },
-                "issuer": {
+                "option": {
                     "type": "string"
                 },
-                "oauth_type": {
+                "target": {
                     "type": "string"
                 },
-                "op": {
+                "updated_at": {
+                    "type": "string"
+                }
+            }
+        },
+        "model.ServerCmdAudit": {
+            "type": "object",
+            "properties": {
+                "created_at": {
                     "type": "string"
                 },
-                "pkce_enable": {
-                    "type": "boolean"
+                "id": {
+                    "type": "integer"
                 },
-                "pkce_method": {
+                "ip": {
+                    "type": "string"
+                },
+                "method": {
                     "type": "string"
                 },
-                "scopes": {
+                "params": {
+                    "type": "string"
+                },
+                "path": {
+                    "type": "string"
+                },
+                "status": {
+                    "type": "integer"
+                },
+                "updated_at": {
                     "type": "string"
                 },
-                "updated_at": {
+                "user_id": {
+                    "type": "integer"
+                },
+                "username": {
                     "type": "string"
                 }
             }
         },
-        "model.OauthList": {
+        "model.ServerCmdAuditList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.Oauth"
+                        "$ref": "#/definitions/model.ServerCmdAudit"
                     }
                 },
                 "page": {
@@ -6313,66 +8805,56 @@
                 }
             }
         },
-        "model.Peer": {
+        "model.ServerCmdList": {
             "type": "object",
             "properties": {
-                "cpu": {
-                    "type": "string"
-                },
-                "created_at": {
-                    "type": "string"
+                "list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/model.ServerCmd"
+                    }
                 },
-                "group_id": {
+                "page": {
                     "type": "integer"
                 },
-                "hostname": {
-                    "type": "string"
-                },
-                "id": {
-                    "type": "string"
+                "page_size": {
+                    "type": "integer"
                 },
-                "last_online_ip": {
+                "total": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.ShareRecordSafe": {
+            "type": "object",
+            "properties": {
+                "created_at": {
                     "type": "string"
                 },
-                "last_online_time": {
+                "expire": {
                     "type": "integer"
                 },
-                "memory": {
-                    "type": "string"
+                "id": {
+                    "type": "integer"
                 },
-                "os": {
+                "peer_id": {
                     "type": "string"
                 },
-                "row_id": {
-                    "type": "integer"
-                },
                 "updated_at": {
                     "type": "string"
                 },
-                "user": {
-                    "$ref": "#/definitions/model.User"
-                },
                 "user_id": {
                     "type": "integer"
-                },
-                "username": {
-                    "type": "string"
-                },
-                "uuid": {
-                    "type": "string"
-                },
-                "version": {
-                    "type": "string"
                 }
             }
         },
-        "model.PeerList": {
+        "model.ShareRecordSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.Peer"
+                        "$ref": "#/definitions/model.ShareRecordSafe"
                     }
                 },
                 "page": {
@@ -6392,10 +8874,6 @@
                 1,
                 2
             ],
-            "x-enum-comments": {
-                "COMMON_STATUS_DISABLED": "通用状态 禁用",
-                "COMMON_STATUS_ENABLE": "通用状态 启用"
-            },
             "x-enum-varnames": [
                 "COMMON_STATUS_ENABLE",
                 "COMMON_STATUS_DISABLED"
@@ -6411,7 +8889,7 @@
                     "type": "integer"
                 },
                 "color": {
-                    "description": "color 是flutter的颜色值,从0x00000000 到 0xFFFFFFFF; 前两位表示透明度，后面6位表示颜色, 可以转成rgba",
+                    "description": "color flutter,0x00000000  0xFFFFFFFF; ，6, rgba",
                     "type": "integer"
                 },
                 "created_at": {
@@ -6475,6 +8953,9 @@
                 "nickname": {
                     "type": "string"
                 },
+                "remark": {
+                    "type": "string"
+                },
                 "status": {
                     "$ref": "#/definitions/model.StatusCode"
                 },
@@ -6507,6 +8988,32 @@
             }
         },
         "model.UserToken": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string"
+                },
+                "device_id": {
+                    "type": "string"
+                },
+                "device_uuid": {
+                    "type": "string"
+                },
+                "expired_at": {
+                    "type": "integer"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "updated_at": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "integer"
+                }
+            }
+        },
+        "model.UserTokenSafe": {
             "type": "object",
             "properties": {
                 "created_at": {
@@ -6535,13 +9042,13 @@
                 }
             }
         },
-        "model.UserTokenList": {
+        "model.UserTokenSafeList": {
             "type": "object",
             "properties": {
                 "list": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/model.UserToken"
+                        "$ref": "#/definitions/model.UserTokenSafe"
                     }
                 },
                 "page": {
@@ -6574,6 +9081,231 @@
                     "type": "string"
                 }
             }
+        },
+        "rustdesk-server_api_http_request_admin.Login": {
+            "type": "object",
+            "required": [
+                "password",
+                "username"
+            ],
+            "properties": {
+                "captcha": {
+                    "type": "string"
+                },
+                "captcha_id": {
+                    "type": "string"
+                },
+                "password": {
+                    "type": "string"
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffAsset": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "integer"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "provider_digest": {
+                    "type": "string"
+                },
+                "verification_scope": {
+                    "type": "string"
+                },
+                "verification_status": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffManifest": {
+            "type": "object",
+            "properties": {
+                "artifact_id": {
+                    "type": "integer"
+                },
+                "artifact_name": {
+                    "type": "string"
+                },
+                "build_id": {
+                    "type": "integer"
+                },
+                "digest_scope": {
+                    "type": "string"
+                },
+                "export_route": {
+                    "type": "string"
+                },
+                "handoff_contract": {
+                    "type": "string"
+                },
+                "manifest_schema": {
+                    "type": "string"
+                },
+                "output_files": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/service.BuildHandoffOutputFile"
+                    }
+                },
+                "platform": {
+                    "type": "string"
+                },
+                "producer_report": {
+                    "$ref": "#/definitions/service.BuildHandoffProducerReport"
+                },
+                "provider": {
+                    "type": "string"
+                },
+                "publication_recorded_at": {
+                    "type": "integer"
+                },
+                "publication_timestamp": {
+                    "type": "integer"
+                },
+                "published_digest": {
+                    "type": "string"
+                },
+                "published_digest_scope": {
+                    "type": "string"
+                },
+                "release_assets": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/service.BuildHandoffAsset"
+                    }
+                },
+                "release_id": {
+                    "type": "integer"
+                },
+                "release_repository": {
+                    "type": "string"
+                },
+                "release_tag": {
+                    "type": "string"
+                },
+                "repository": {
+                    "type": "string"
+                },
+                "run_head_sha": {
+                    "type": "string"
+                },
+                "run_html_url": {
+                    "type": "string"
+                },
+                "run_id": {
+                    "type": "integer"
+                },
+                "run_url": {
+                    "type": "string"
+                },
+                "schema": {
+                    "type": "string"
+                },
+                "schema_version": {
+                    "type": "integer"
+                },
+                "source_sha": {
+                    "type": "string"
+                },
+                "source_tag": {
+                    "type": "string"
+                },
+                "status": {
+                    "type": "string"
+                },
+                "verification_result": {
+                    "type": "string"
+                },
+                "verification_scope": {
+                    "type": "string"
+                },
+                "verification_status": {
+                    "type": "string"
+                },
+                "version": {
+                    "type": "string"
+                },
+                "workflow_path": {
+                    "type": "string"
+                },
+                "workflow_repository": {
+                    "type": "string"
+                },
+                "workflow_selector": {
+                    "type": "string"
+                },
+                "workflow_sha": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffOutputFile": {
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string"
+                },
+                "sha256": {
+                    "type": "string"
+                },
+                "size": {
+                    "type": "integer"
+                }
+            }
+        },
+        "service.BuildHandoffProducerReport": {
+            "type": "object",
+            "properties": {
+                "source_tree_sha": {
+                    "type": "string"
+                },
+                "submodules": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/service.BuildHandoffSubmodule"
+                    }
+                },
+                "verification_result": {
+                    "type": "string"
+                },
+                "verification_scope": {
+                    "type": "string"
+                },
+                "verification_status": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.BuildHandoffSubmodule": {
+            "type": "object",
+            "properties": {
+                "commit_sha": {
+                    "type": "string"
+                },
+                "path": {
+                    "type": "string"
+                }
+            }
+        },
+        "service.WorkflowTagOption": {
+            "type": "object",
+            "properties": {
+                "label": {
+                    "type": "string"
+                },
+                "tag": {
+                    "type": "string"
+                }
+            }
         }
     },
     "securityDefinitions": {
@@ -6588,4 +9320,4 @@
             "in": "header"
         }
     }
-}
+}
\ No newline at end of file
diff --git a/api/docs/admin/admin_swagger.yaml b/api/docs/admin/admin_swagger.yaml
index 978b9c8..60c8320 100644
--- a/api/docs/admin/admin_swagger.yaml
+++ b/api/docs/admin/admin_swagger.yaml
@@ -63,6 +63,39 @@ definitions:
     required:
     - ids
     type: object
+  admin.BatchCreateFromPeersForm:
+    properties:
+      collection_id:
+        type: integer
+      peer_ids:
+        items:
+          type: integer
+        type: array
+      tags:
+        items:
+          type: string
+        type: array
+      user_id:
+        type: integer
+    type: object
+  admin.BatchUpdateTagsForm:
+    properties:
+      row_ids:
+        items:
+          type: integer
+        type: array
+      tags:
+        items:
+          type: string
+        type: array
+    type: object
+  admin.BindOauthForm:
+    properties:
+      op:
+        type: string
+    required:
+    - op
+    type: object
   admin.ChangeCurPasswordForm:
     properties:
       new_password:
@@ -77,6 +110,44 @@ definitions:
     - new_password
     - old_password
     type: object
+  admin.CustomBuildForm:
+    properties:
+      app_name:
+        type: string
+      custom_json:
+        type: string
+      id:
+        type: integer
+      name:
+        type: string
+      platform:
+        type: string
+      version:
+        type: string
+    required:
+    - name
+    - platform
+    - version
+    type: object
+  admin.CustomPresetForm:
+    properties:
+      app_name:
+        type: string
+      custom_json:
+        type: string
+      id:
+        type: integer
+      name:
+        type: string
+      platform:
+        type: string
+      version:
+        type: string
+    required:
+    - name
+    - platform
+    - version
+    type: object
   admin.DeviceGroupForm:
     properties:
       id:
@@ -86,6 +157,15 @@ definitions:
     required:
     - name
     type: object
+  admin.GithubBuildConfigForm:
+    properties:
+      payload_key:
+        type: string
+      repo:
+        type: string
+      token:
+        type: string
+    type: object
   admin.GroupForm:
     properties:
       id:
@@ -123,6 +203,13 @@ definitions:
       username:
         type: string
     type: object
+  admin.OauthConfirmForm:
+    properties:
+      code:
+        type: string
+    required:
+    - code
+    type: object
   admin.OauthForm:
     properties:
       auto_register:
@@ -142,6 +229,14 @@ definitions:
       pkce_enable:
         type: boolean
       pkce_method:
+        description: |-
+          PkceMethod is constrained to S256/plain when set. When pkce_enable is
+          true the field is required so the runtime layer can pick a hashing
+          strategy without falling back to a hidden default. When pkce_enable is
+          false/nil it is ignored and may be empty.
+        enum:
+        - S256
+        - plain
         type: string
       scopes:
         type: string
@@ -161,6 +256,8 @@ definitions:
     type: object
   admin.PeerForm:
     properties:
+      alias:
+        type: string
       cpu:
         type: string
       group_id:
@@ -191,6 +288,37 @@ definitions:
     required:
     - ids
     type: object
+  admin.RegisterForm:
+    properties:
+      confirm_password:
+        maxLength: 32
+        minLength: 4
+        type: string
+      email:
+        description: validate:"required,email"
+        type: string
+      password:
+        maxLength: 32
+        minLength: 4
+        type: string
+      username:
+        maxLength: 32
+        minLength: 2
+        type: string
+    required:
+    - confirm_password
+    - password
+    - username
+    type: object
+  admin.RustdeskCmd:
+    properties:
+      cmd:
+        type: string
+      option:
+        type: string
+      target:
+        type: string
+    type: object
   admin.ShareByWebClientForm:
     properties:
       expire:
@@ -200,7 +328,7 @@ definitions:
       password:
         type: string
       password_type:
-        description: 只能是once,fixed
+        description: once,fixed
         enum:
         - once
         - fixed
@@ -217,6 +345,13 @@ definitions:
       user_id:
         type: integer
     type: object
+  admin.SimpleDataQuery:
+    properties:
+      ids:
+        items:
+          type: string
+        type: array
+    type: object
   admin.TagForm:
     properties:
       collection_id:
@@ -233,12 +368,28 @@ definitions:
     - color
     - name
     type: object
+  admin.UnBindOauthForm:
+    properties:
+      op:
+        type: string
+    required:
+    - op
+    type: object
+  admin.UpdateCurrentForm:
+    properties:
+      email:
+        maxLength: 128
+        type: string
+      nickname:
+        maxLength: 128
+        type: string
+    type: object
   admin.UserForm:
     properties:
       avatar:
         type: string
       email:
-        description: validate:"required,email" email不强制
+        description: validate:"required,email" email
         type: string
       group_id:
         type: integer
@@ -249,6 +400,8 @@ definitions:
       nickname:
         description: Password string           `json:"password" validate:"required,gte=4,lte=20"`
         type: string
+      remark:
+        type: string
       status:
         allOf:
         - $ref: '#/definitions/model.StatusCode'
@@ -290,66 +443,28 @@ definitions:
     required:
     - ids
     type: object
-  github_com_lejianwen_rustdesk-api_v2_http_request_admin.Login:
+  admin.WorkflowRefApprovalForm:
     properties:
-      captcha:
-        type: string
-      captcha_id:
-        type: string
-      password:
-        type: string
-      platform:
-        type: string
-      username:
+      confirm:
+        type: boolean
+      workflow_tag:
         type: string
-    required:
-    - password
-    - username
     type: object
-  model.AddressBook:
+  admin.versionOption:
     properties:
-      alias:
-        type: string
-      collection:
-        $ref: '#/definitions/model.AddressBookCollection'
-      collection_id:
-        type: integer
-      created_at:
-        type: string
-      forceAlwaysRelay:
-        type: boolean
-      hash:
-        type: string
-      hostname:
-        type: string
-      id:
-        type: string
-      loginName:
-        type: string
-      online:
-        type: boolean
-      password:
-        type: string
-      platform:
-        type: string
-      rdpPort:
+      assets_release:
         type: string
-      rdpUsername:
+      version:
         type: string
-      row_id:
-        type: integer
-      sameServer:
+    type: object
+  admin.versionsResponse:
+    properties:
+      error:
         type: boolean
-      tags:
+      versions:
         items:
-          type: string
+          $ref: '#/definitions/admin.versionOption'
         type: array
-      updated_at:
-        type: string
-      user_id:
-        type: integer
-      username:
-        type: string
     type: object
   model.AddressBookCollection:
     properties:
@@ -388,14 +503,14 @@ definitions:
       id:
         type: integer
       rule:
-        description: '0: 无 1: 读 2: 读写  3: 完全控制'
+        description: '0:  1:  2:   3:'
         maximum: 3
         minimum: 1
         type: integer
       to_id:
         type: integer
       type:
-        description: '1: 个人 2: 群组'
+        description: '1:  2:'
         maximum: 2
         minimum: 1
         type: integer
@@ -409,11 +524,65 @@ definitions:
     - to_id
     - type
     type: object
-  model.AddressBookList:
+  model.AddressBookCollectionRuleList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.AddressBookCollectionRule'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  model.AddressBookSafe:
+    properties:
+      alias:
+        type: string
+      collection:
+        $ref: '#/definitions/model.AddressBookCollection'
+      collection_id:
+        type: integer
+      created_at:
+        type: string
+      forceAlwaysRelay:
+        type: boolean
+      hostname:
+        type: string
+      id:
+        type: string
+      loginName:
+        type: string
+      online:
+        type: boolean
+      platform:
+        type: string
+      rdpPort:
+        type: string
+      rdpUsername:
+        type: string
+      row_id:
+        type: integer
+      sameServer:
+        type: boolean
+      tags:
+        items:
+          type: string
+        type: array
+      updated_at:
+        type: string
+      user_id:
+        type: integer
+      username:
+        type: string
+    type: object
+  model.AddressBookSafeList:
     properties:
       list:
         items:
-          $ref: '#/definitions/model.AddressBook'
+          $ref: '#/definitions/model.AddressBookSafe'
         type: array
       page:
         type: integer
@@ -506,35 +675,79 @@ definitions:
       total:
         type: integer
     type: object
-  model.DeviceGroup:
+  model.CustomBuildPublic:
     properties:
-      created_at:
+      app_name:
         type: string
+      download_key_expires_at:
+        type: integer
+      file_size:
+        type: integer
       id:
         type: integer
       name:
         type: string
-      updated_at:
+      platform:
+        type: string
+      status:
+        type: string
+      version:
         type: string
     type: object
-  model.Group:
+  model.CustomBuildSafe:
     properties:
+      app_name:
+        type: string
+      build_log:
+        type: string
       created_at:
         type: string
+      custom_json:
+        type: string
+      download_key_expires_at:
+        type: integer
+      file_size:
+        type: integer
+      github_artifact_id:
+        type: integer
+      github_artifact_name:
+        type: string
+      github_html_url:
+        type: string
+      github_provider:
+        type: string
+      github_ref:
+        type: string
+      github_repo:
+        type: string
+      github_run_id:
+        type: integer
+      github_run_url:
+        type: string
+      github_source_sha:
+        type: string
+      github_workflow:
+        type: string
       id:
         type: integer
       name:
         type: string
-      type:
-        type: integer
+      platform:
+        type: string
+      status:
+        type: string
       updated_at:
         type: string
+      user_id:
+        type: integer
+      version:
+        type: string
     type: object
-  model.GroupList:
+  model.CustomBuildSafeList:
     properties:
       list:
         items:
-          $ref: '#/definitions/model.Group'
+          $ref: '#/definitions/model.CustomBuildSafe'
         type: array
       page:
         type: integer
@@ -543,7 +756,101 @@ definitions:
       total:
         type: integer
     type: object
-  model.LoginLog:
+  model.CustomPresetSafe:
+    properties:
+      app_name:
+        type: string
+      created_at:
+        type: string
+      custom_json:
+        type: string
+      id:
+        type: integer
+      name:
+        type: string
+      platform:
+        type: string
+      updated_at:
+        type: string
+      user_id:
+        type: integer
+      version:
+        type: string
+    type: object
+  model.CustomPresetSafeList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.CustomPresetSafe'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  model.DeviceGroup:
+    properties:
+      created_at:
+        type: string
+      id:
+        type: integer
+      name:
+        type: string
+      updated_at:
+        type: string
+    type: object
+  model.GithubBuildConfigSafe:
+    properties:
+      created_at:
+        type: string
+      has_payload_key:
+        type: boolean
+      has_token:
+        type: boolean
+      id:
+        type: integer
+      repo:
+        type: string
+      updated_at:
+        type: string
+      workflow_ref:
+        type: string
+      workflow_ref_approved:
+        type: boolean
+      workflow_ref_status:
+        type: string
+      workflow_ref_trust_status:
+        type: string
+    type: object
+  model.Group:
+    properties:
+      created_at:
+        type: string
+      id:
+        type: integer
+      name:
+        type: string
+      type:
+        type: integer
+      updated_at:
+        type: string
+    type: object
+  model.GroupList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.Group'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  model.LoginLog:
     properties:
       client:
         description: webadmin,webclient,app,
@@ -589,11 +896,10 @@ definitions:
   model.Oauth:
     properties:
       auto_register:
+        description: RedirectUrl  string `json:"redirect_url"`
         type: boolean
       client_id:
         type: string
-      client_secret:
-        type: string
       created_at:
         type: string
       id:
@@ -628,6 +934,8 @@ definitions:
     type: object
   model.Peer:
     properties:
+      alias:
+        type: string
       cpu:
         type: string
       created_at:
@@ -674,14 +982,107 @@ definitions:
       total:
         type: integer
     type: object
+  model.ServerCmd:
+    properties:
+      alias:
+        type: string
+      cmd:
+        type: string
+      created_at:
+        type: string
+      explain:
+        type: string
+      id:
+        type: integer
+      option:
+        type: string
+      target:
+        type: string
+      updated_at:
+        type: string
+    type: object
+  model.ServerCmdAudit:
+    properties:
+      created_at:
+        type: string
+      id:
+        type: integer
+      ip:
+        type: string
+      method:
+        type: string
+      params:
+        type: string
+      path:
+        type: string
+      status:
+        type: integer
+      updated_at:
+        type: string
+      user_id:
+        type: integer
+      username:
+        type: string
+    type: object
+  model.ServerCmdAuditList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.ServerCmdAudit'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  model.ServerCmdList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.ServerCmd'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
+  model.ShareRecordSafe:
+    properties:
+      created_at:
+        type: string
+      expire:
+        type: integer
+      id:
+        type: integer
+      peer_id:
+        type: string
+      updated_at:
+        type: string
+      user_id:
+        type: integer
+    type: object
+  model.ShareRecordSafeList:
+    properties:
+      list:
+        items:
+          $ref: '#/definitions/model.ShareRecordSafe'
+        type: array
+      page:
+        type: integer
+      page_size:
+        type: integer
+      total:
+        type: integer
+    type: object
   model.StatusCode:
     enum:
     - 1
     - 2
     type: integer
-    x-enum-comments:
-      COMMON_STATUS_DISABLED: 通用状态 禁用
-      COMMON_STATUS_ENABLE: 通用状态 启用
     x-enum-varnames:
     - COMMON_STATUS_ENABLE
     - COMMON_STATUS_DISABLED
@@ -692,8 +1093,7 @@ definitions:
       collection_id:
         type: integer
       color:
-        description: color 是flutter的颜色值,从0x00000000 到 0xFFFFFFFF; 前两位表示透明度，后面6位表示颜色,
-          可以转成rgba
+        description: color flutter,0x00000000  0xFFFFFFFF; ，6, rgba
         type: integer
       created_at:
         type: string
@@ -735,6 +1135,8 @@ definitions:
         type: boolean
       nickname:
         type: string
+      remark:
+        type: string
       status:
         $ref: '#/definitions/model.StatusCode'
       updated_at:
@@ -756,6 +1158,23 @@ definitions:
         type: integer
     type: object
   model.UserToken:
+    properties:
+      created_at:
+        type: string
+      device_id:
+        type: string
+      device_uuid:
+        type: string
+      expired_at:
+        type: integer
+      id:
+        type: integer
+      updated_at:
+        type: string
+      user_id:
+        type: integer
+    type: object
+  model.UserTokenSafe:
     properties:
       created_at:
         type: string
@@ -774,11 +1193,11 @@ definitions:
       user_id:
         type: integer
     type: object
-  model.UserTokenList:
+  model.UserTokenSafeList:
     properties:
       list:
         items:
-          $ref: '#/definitions/model.UserToken'
+          $ref: '#/definitions/model.UserTokenSafe'
         type: array
       page:
         type: integer
@@ -796,61 +1215,1284 @@ definitions:
     properties:
       code:
         type: integer
-      data: {}
-      message:
-        type: string
-    type: object
-info:
-  contact: {}
-  description: 接口
-  title: 管理系统API
-  version: "1.0"
-paths:
-  /admin/address_book/batchCreate:
-    post:
-      consumes:
+      data: {}
+      message:
+        type: string
+    type: object
+  rustdesk-server_api_http_request_admin.Login:
+    properties:
+      captcha:
+        type: string
+      captcha_id:
+        type: string
+      password:
+        type: string
+      platform:
+        type: string
+      username:
+        type: string
+    required:
+    - password
+    - username
+    type: object
+  service.BuildHandoffAsset:
+    properties:
+      id:
+        type: integer
+      name:
+        type: string
+      provider_digest:
+        type: string
+      verification_scope:
+        type: string
+      verification_status:
+        type: string
+    type: object
+  service.BuildHandoffManifest:
+    properties:
+      artifact_id:
+        type: integer
+      artifact_name:
+        type: string
+      build_id:
+        type: integer
+      digest_scope:
+        type: string
+      export_route:
+        type: string
+      handoff_contract:
+        type: string
+      manifest_schema:
+        type: string
+      output_files:
+        items:
+          $ref: '#/definitions/service.BuildHandoffOutputFile'
+        type: array
+      platform:
+        type: string
+      producer_report:
+        $ref: '#/definitions/service.BuildHandoffProducerReport'
+      provider:
+        type: string
+      publication_recorded_at:
+        type: integer
+      publication_timestamp:
+        type: integer
+      published_digest:
+        type: string
+      published_digest_scope:
+        type: string
+      release_assets:
+        items:
+          $ref: '#/definitions/service.BuildHandoffAsset'
+        type: array
+      release_id:
+        type: integer
+      release_repository:
+        type: string
+      release_tag:
+        type: string
+      repository:
+        type: string
+      run_head_sha:
+        type: string
+      run_html_url:
+        type: string
+      run_id:
+        type: integer
+      run_url:
+        type: string
+      schema:
+        type: string
+      schema_version:
+        type: integer
+      source_sha:
+        type: string
+      source_tag:
+        type: string
+      status:
+        type: string
+      verification_result:
+        type: string
+      verification_scope:
+        type: string
+      verification_status:
+        type: string
+      version:
+        type: string
+      workflow_path:
+        type: string
+      workflow_repository:
+        type: string
+      workflow_selector:
+        type: string
+      workflow_sha:
+        type: string
+    type: object
+  service.BuildHandoffOutputFile:
+    properties:
+      name:
+        type: string
+      sha256:
+        type: string
+      size:
+        type: integer
+    type: object
+  service.BuildHandoffProducerReport:
+    properties:
+      source_tree_sha:
+        type: string
+      submodules:
+        items:
+          $ref: '#/definitions/service.BuildHandoffSubmodule'
+        type: array
+      verification_result:
+        type: string
+      verification_scope:
+        type: string
+      verification_status:
+        type: string
+    type: object
+  service.BuildHandoffSubmodule:
+    properties:
+      commit_sha:
+        type: string
+      path:
+        type: string
+    type: object
+  service.WorkflowTagOption:
+    properties:
+      label:
+        type: string
+      tag:
+        type: string
+    type: object
+info:
+  contact: {}
+  title: API
+  version: "1.0"
+paths:
+  /admin/address_book/batchCreate:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book batch-create form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.AddressBookForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book/batchCreateFromPeers:
+    post:
+      consumes:
+      - application/json
+      description: Admin-only batch creation of address-book entries from existing
+        peers.
+      parameters:
+      - description: Peer IDs and address-book destination payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.BatchCreateFromPeersForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book/create:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book entry form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.AddressBookForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book/delete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book entry deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.AddressBookForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for the address book list
+        in: query
+        name: page
+        type: integer
+      - description: Number of entries per address book page
+        in: query
+        name: page_size
+        type: integer
+      - description: id
+        in: query
+        name: user_id
+        type: integer
+      - description: Filter for address books owned by the current user
+        in: query
+        name: is_my
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Redacted address-book list envelope
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AddressBookSafeList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book/shareByWebClient:
+    post:
+      consumes:
+      - application/json
+      description: Authenticated web-client share route; requires the admin API token
+        but not AdminPrivilege.
+      parameters:
+      - description: Web client address book sharing form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.ShareByWebClientForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book/update:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book entry update form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.AddressBookForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection/create:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book collection form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollection'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection/delete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book collection deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollection'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection/detail/{id}:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for the address book collection list
+        in: query
+        name: page
+        type: integer
+      - description: Number of collections per page
+        in: query
+        name: page_size
+        type: integer
+      - description: Filter for collections owned by the current user
+        in: query
+        name: is_my
+        type: integer
+      - description: id
+        in: query
+        name: user_id
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AddressBookCollectionList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection/update:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book collection update form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollection'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection_rule/create:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book collection rule form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollectionRule'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection_rule/delete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book collection rule deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollectionRule'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection_rule/detail/{id}:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AddressBookCollectionRule'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection_rule/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for the collection-rule list
+        in: query
+        name: page
+        type: integer
+      - description: Number of collection rules per page
+        in: query
+        name: page_size
+        type: integer
+      - description: Filter for rules owned by the current user
+        in: query
+        name: is_my
+        type: integer
+      - description: id
+        in: query
+        name: user_id
+        type: integer
+      - description: id
+        in: query
+        name: collection_id
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AddressBookCollectionRuleList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/address_book_collection_rule/update:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Address book collection rule update form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollectionRule'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/audit_conn/batchDelete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Audit connection log ID batch deletion payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.AuditConnLogIds'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/audit_conn/delete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Audit connection deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AuditConn'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/audit_conn/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for audit connection records
+        in: query
+        name: page
+        type: integer
+      - description: Number of audit connection records per page
+        in: query
+        name: page_size
+        type: integer
+      - description: Peer ID filter for audit connections
+        in: query
+        name: peer_id
+        type: integer
+      - description: Source peer ID filter for audit connections
+        in: query
+        name: from_peer
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AuditConnList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/audit_file/batchDelete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Audit file log ID batch deletion payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.AuditFileLogIds'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/audit_file/delete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Audit file deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AuditFile'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/audit_file/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for audit file records
+        in: query
+        name: page
+        type: integer
+      - description: Number of audit file records per page
+        in: query
+        name: page_size
+        type: integer
+      - description: Peer ID filter for audit file records
+        in: query
+        name: peer_id
+        type: integer
+      - description: Source peer ID filter for audit file records
+        in: query
+        name: from_peer
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AuditFileList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/captcha:
+    get:
+      description: Public pre-authentication route; a challenge is returned only when
+        the client IP requires CAPTCHA verification.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      summary: Get an admin login CAPTCHA
+      tags:
+      - Auth
+  /admin/config/admin:
+    get:
+      description: Public pre-authentication route returning the admin title and,
+        when a valid api-token is supplied, the personalized greeting.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      summary: Get public admin configuration
+      tags:
+      - ADMIN
+  /admin/config/all:
+    get:
+      description: Admin-only configuration used by the admin panel.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Get all admin configuration
+      tags:
+      - ADMIN
+  /admin/config/app:
+    get:
+      consumes:
+      - application/json
+      description: APP
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: APP
+      tags:
+      - ADMIN
+  /admin/config/server:
+    get:
+      consumes:
+      - application/json
+      description: ',webclientapi-server'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: RUSTDESK
+      tags:
+      - ADMIN
+  /admin/custom_build/create:
+    post:
+      consumes:
+      - application/json
+      description: Admin-only build request. The display version and platform are
+        user-selected capabilities; provider workflow refs, release identity, and
+        dispatch details are resolved server-side.
+      parameters:
+      - description: Custom-build request
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.CustomBuildForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Redacted queued custom-build envelope
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.CustomBuildSafe'
+              type: object
+        "400":
+          description: Invalid custom-build request
+          schema:
+            $ref: '#/definitions/response.Response'
+        "412":
+          description: Workflow reference approval is required
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Custom build could not be queued
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: Build provider or encryption configuration is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Create a custom build
+      tags:
+      - CustomBuild
+  /admin/custom_build/delete:
+    post:
+      consumes:
+      - application/json
+      description: Admin-only deletion of a custom-build record and its published
+        artifacts.
+      parameters:
+      - description: Custom-build identifier
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.CustomBuildForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Custom build deleted
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Custom build could not be deleted
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Delete a custom build
+      tags:
+      - CustomBuild
+  /admin/custom_build/download/{id}:
+    get:
+      description: Admin-only download by build ID. BackendUserAuth and AdminPrivilege
+        authorize the request; the build must have a complete immutable publication
+        proof. The response is the exact redacted ZIP bytes served by this response,
+        not the stored publication output digest and not a signature.
+      parameters:
+      - description: Completed custom build ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
+      - application/zip
+      responses:
+        "200":
+          description: Redacted custom-build ZIP archive
+          headers:
+            Content-Disposition:
+              description: Attachment filename
+              type: string
+            Content-Length:
+              description: Exact ZIP response length in bytes
+              type: string
+            X-DeskForge-Archive-SHA256:
+              description: SHA-256 of the exact ZIP bytes served by this response
+              type: string
+            X-DeskForge-Archive-SHA256-Scope:
+              description: Digest scope; distinct from the stored publication digest
+              type: string
+          schema:
+            type: file
+        "400":
+          description: Invalid build ID
+          schema:
+            $ref: '#/definitions/response.Response'
+        "403":
+          description: Administrator authentication or privilege is required
+          schema:
+            $ref: '#/definitions/response.Response'
+        "408":
+          description: Download request was cancelled or timed out
+          schema:
+            $ref: '#/definitions/response.Response'
+        "409":
+          description: Build completion or output provenance is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+        "416":
+          description: Range requests are not supported
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: ZIP packaging or validation failed
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Download a completed custom build by ID
+      tags:
+      - CustomBuild
+  /admin/custom_build/list:
+    get:
+      description: Admin-only paginated list. The response uses the redacted CustomBuildSafeList
+        view; provider credentials and storage-only identity fields are not serialized.
+      parameters:
+      - description: Page number
+        in: query
+        name: page
+        type: integer
+      - description: Number of builds per page
+        in: query
+        name: page_size
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Redacted custom-build list envelope
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.CustomBuildSafeList'
+              type: object
+        "500":
+          description: Custom-build list is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: List custom builds
+      tags:
+      - CustomBuild
+  /admin/custom_build/manifest/{id}:
+    get:
+      description: Admin-only redacted handoff data. The BuildHandoffManifest contains
+        no secrets, raw custom configuration, filesystem paths, or signature claim.
+        The published digest covers stored canonical output and is distinct from the
+        SHA-256 header over these response bytes.
+      parameters:
+      - description: Completed custom build ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      produces:
       - application/json
-      description: 批量创建地址簿
+      responses:
+        "200":
+          description: Redacted build handoff envelope
+          headers:
+            X-DeskForge-Manifest-SHA256:
+              description: SHA-256 of the exact response body bytes
+              type: string
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/service.BuildHandoffManifest'
+              type: object
+        "400":
+          description: Invalid build ID
+          schema:
+            $ref: '#/definitions/response.Response'
+        "409":
+          description: Completed handoff is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Handoff is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Export a completed custom-build handoff manifest
+      tags:
+      - CustomBuild
+  /admin/custom_build/public/detailByKey/{key}:
+    get:
+      description: Public capability route with no authentication. The key expires
+        according to download-key-ttl; an expired key returns 410. The response uses
+        the public CustomBuildPublic view and omits download_key, provider refs, and
+        secrets.
       parameters:
-      - description: 地址簿信息
-        in: body
-        name: body
+      - description: Opaque build capability key
+        in: path
+        name: key
         required: true
-        schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+        type: string
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Public build detail envelope without download_key
           schema:
             allOf:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBook'
+                  $ref: '#/definitions/model.CustomBuildPublic'
               type: object
+        "409":
+          description: Build is not publicly ready
+          schema:
+            $ref: '#/definitions/response.Response'
+        "410":
+          description: Capability key has expired
+          schema:
+            $ref: '#/definitions/response.Response'
+      summary: Read a completed custom build by capability key
+      tags:
+      - CustomBuild
+  /admin/custom_build/public/download/{key}:
+    get:
+      description: Public capability route with no authentication. The key expires
+        according to download-key-ttl; an expired key returns 410. The response is
+        the exact redacted ZIP bytes served by this response, not the stored publication
+        output digest and not a signature.
+      parameters:
+      - description: Opaque build capability key
+        in: path
+        name: key
+        required: true
+        type: string
+      produces:
+      - application/zip
+      responses:
+        "200":
+          description: Redacted custom-build ZIP archive
+          headers:
+            Content-Disposition:
+              description: Attachment filename
+              type: string
+            Content-Length:
+              description: Exact ZIP response length in bytes
+              type: string
+            X-DeskForge-Archive-SHA256:
+              description: SHA-256 of the exact ZIP bytes served by this response
+              type: string
+            X-DeskForge-Archive-SHA256-Scope:
+              description: Digest scope; distinct from the stored publication digest
+              type: string
+          schema:
+            type: file
+        "408":
+          description: Download request was cancelled or timed out
+          schema:
+            $ref: '#/definitions/response.Response'
+        "409":
+          description: Build completion or output provenance is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+        "410":
+          description: Capability key has expired
+          schema:
+            $ref: '#/definitions/response.Response'
+        "416":
+          description: Range requests are not supported
+          schema:
+            $ref: '#/definitions/response.Response'
         "500":
-          description: Internal Server Error
+          description: ZIP packaging or validation failed
           schema:
             $ref: '#/definitions/response.Response'
+      summary: Download a completed custom build by capability key
+      tags:
+      - CustomBuild
+  /admin/custom_build/versions:
+    get:
+      description: Admin-only provider capability list. Only display versions and
+        release labels are returned; provider refs and commit SHAs remain server-side.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Available version options, with error state
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/admin.versionsResponse'
+              type: object
       security:
       - token: []
-      summary: 批量创建地址簿
+      summary: List available custom-build versions
       tags:
-      - 地址簿
-  /admin/address_book/create:
+      - CustomBuild
+  /admin/custom_preset/create:
     post:
       consumes:
       - application/json
-      description: 创建地址簿
+      description: Administrators with AdminPrivilege may save a custom preset; provider-derived
+        build references are resolved server-side.
       parameters:
-      - description: 地址簿信息
+      - description: Custom-preset payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+          $ref: '#/definitions/admin.CustomPresetForm'
       produces:
       - application/json
       responses:
@@ -861,7 +2503,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBook'
+                  $ref: '#/definitions/model.CustomPresetSafe'
               type: object
         "500":
           description: Internal Server Error
@@ -869,21 +2511,22 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建地址簿
+      summary: Create a custom preset
       tags:
-      - 地址簿
-  /admin/address_book/delete:
+      - CustomPreset
+  /admin/custom_preset/delete:
     post:
       consumes:
       - application/json
-      description: 地址簿删除
+      description: Administrators with AdminPrivilege may delete their own custom
+        preset.
       parameters:
-      - description: 地址簿信息
+      - description: Custom-preset identifier
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+          $ref: '#/definitions/admin.CustomPresetForm'
       produces:
       - application/json
       responses:
@@ -897,16 +2540,15 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿删除
+      summary: Delete a custom preset
       tags:
-      - 地址簿
-  /admin/address_book/detail/{id}:
+      - CustomPreset
+  /admin/custom_preset/detail/{id}:
     get:
-      consumes:
-      - application/json
-      description: 地址簿详情
+      description: Administrators with AdminPrivilege may read their own redacted
+        custom preset.
       parameters:
-      - description: ID
+      - description: Custom preset ID
         in: path
         name: id
         required: true
@@ -921,7 +2563,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBook'
+                  $ref: '#/definitions/model.CustomPresetSafe'
               type: object
         "500":
           description: Internal Server Error
@@ -929,31 +2571,22 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿详情
+      summary: Get a custom preset
       tags:
-      - 地址簿
-  /admin/address_book/list:
+      - CustomPreset
+  /admin/custom_preset/list:
     get:
-      consumes:
-      - application/json
-      description: 地址簿列表
+      description: Administrators with AdminPrivilege receive a paginated redacted
+        custom-preset list.
       parameters:
-      - description: 页码
+      - description: Page number
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of presets per page
         in: query
         name: page_size
         type: integer
-      - description: 用户id
-        in: query
-        name: user_id
-        type: integer
-      - description: 是否是我的
-        in: query
-        name: is_my
-        type: integer
       produces:
       - application/json
       responses:
@@ -964,7 +2597,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookList'
+                  $ref: '#/definitions/model.CustomPresetSafeList'
               type: object
         "500":
           description: Internal Server Error
@@ -972,82 +2605,93 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿列表
+      summary: List custom presets
       tags:
-      - 地址簿
-  /admin/address_book/share:
+      - CustomPreset
+  /admin/custom_preset/update:
     post:
       consumes:
       - application/json
-      description: 地址簿分享
+      description: Administrators with AdminPrivilege may update their own custom
+        preset; provider-derived build references are resolved server-side.
       parameters:
-      - description: 地址簿信息
+      - description: Custom-preset update payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.ShareByWebClientForm'
+          $ref: '#/definitions/admin.CustomPresetForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.CustomPresetSafe'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿分享
+      summary: Update a custom preset
       tags:
-      - 地址簿
-  /admin/address_book/update:
-    post:
-      consumes:
+      - CustomPreset
+  /admin/dashboard/health:
+    get:
+      description: Authenticated server health and bandwidth data for the admin dashboard.
+      produces:
       - application/json
-      description: 地址簿编辑
-      parameters:
-      - description: 地址簿信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Get server health
+      tags:
+      - Dashboard
+  /admin/dashboard/stats:
+    get:
+      description: Authenticated dashboard counters for users, peers, groups, and
+        logins.
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBook'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿编辑
+      summary: Get dashboard statistics
       tags:
-      - 地址簿
-  /admin/address_book_collection/create:
+      - Dashboard
+  /admin/device_group/create:
     post:
       consumes:
       - application/json
-      description: 创建地址簿名称
       parameters:
-      - description: 地址簿名称信息
+      - description: Device group form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollection'
+          $ref: '#/definitions/admin.DeviceGroupForm'
       produces:
       - application/json
       responses:
@@ -1058,7 +2702,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.DeviceGroup'
               type: object
         "500":
           description: Internal Server Error
@@ -1066,21 +2710,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建地址簿名称
       tags:
-      - 地址簿名称
-  /admin/address_book_collection/delete:
+      - ""
+  /admin/device_group/delete:
     post:
       consumes:
       - application/json
-      description: 地址簿名称删除
       parameters:
-      - description: 地址簿名称信息
+      - description: Device group deletion form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollection'
+          $ref: '#/definitions/admin.DeviceGroupForm'
       produces:
       - application/json
       responses:
@@ -1094,14 +2736,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿名称删除
       tags:
-      - 地址簿名称
-  /admin/address_book_collection/detail/{id}:
+      - ""
+  /admin/device_group/detail/{id}:
     get:
       consumes:
       - application/json
-      description: 地址簿名称详情
       parameters:
       - description: ID
         in: path
@@ -1118,7 +2758,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.Group'
               type: object
         "500":
           description: Internal Server Error
@@ -1126,64 +2766,21 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿名称详情
       tags:
-      - 地址簿名称
-  /admin/address_book_collection/list:
+      - ""
+  /admin/device_group/list:
     get:
       consumes:
       - application/json
-      description: 地址簿名称列表
       parameters:
-      - description: 页码
+      - description: Page number for the device-group list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of device groups per page
         in: query
         name: page_size
         type: integer
-      - description: 是否是我的
-        in: query
-        name: is_my
-        type: integer
-      - description: 用户id
-        in: query
-        name: user_id
-        type: integer
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
-          schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBookCollectionList'
-              type: object
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/response.Response'
-      security:
-      - token: []
-      summary: 地址簿名称列表
-      tags:
-      - 地址簿名称
-  /admin/address_book_collection/update:
-    post:
-      consumes:
-      - application/json
-      description: 地址簿名称编辑
-      parameters:
-      - description: 地址簿名称信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/model.AddressBookCollection'
       produces:
       - application/json
       responses:
@@ -1194,7 +2791,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.GroupList'
               type: object
         "500":
           description: Internal Server Error
@@ -1202,21 +2799,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿名称编辑
       tags:
-      - 地址簿名称
-  /admin/address_book_collection_rule/create:
+      - ""
+  /admin/device_group/update:
     post:
       consumes:
       - application/json
-      description: 创建地址簿规则
       parameters:
-      - description: 地址簿规则信息
+      - description: Device group update form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollectionRule'
+          $ref: '#/definitions/admin.DeviceGroupForm'
       produces:
       - application/json
       responses:
@@ -1227,7 +2822,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.Group'
               type: object
         "500":
           description: Internal Server Error
@@ -1235,21 +2830,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建地址簿规则
       tags:
-      - 地址簿规则
-  /admin/address_book_collection_rule/delete:
+      - ""
+  /admin/file/notify:
     post:
       consumes:
-      - application/json
-      description: 地址簿规则删除
-      parameters:
-      - description: 地址簿规则信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/model.AddressBookCollectionRule'
+      - multipart/form-data
+      description: Authenticated upload callback used after the object-storage provider
+        verifies the request.
       produces:
       - application/json
       responses:
@@ -1263,298 +2851,332 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则删除
+      summary: Confirm an uploaded file
       tags:
-      - 地址簿规则
-  /admin/address_book_collection_rule/detail/{id}:
+      - File
+  /admin/file/oss_token:
     get:
       consumes:
       - application/json
-      description: 地址簿规则详情
-      parameters:
-      - description: ID
-        in: path
-        name: id
-        required: true
-        type: integer
+      description: ossToken
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBookCollectionRule'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则详情
+      summary: ossToken
       tags:
-      - 地址簿规则
-  /admin/address_book_collection_rule/list:
-    get:
+      - ""
+  /admin/file/upload:
+    post:
       consumes:
-      - application/json
-      description: 地址簿规则列表
+      - multipart/form-data
       parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 是否是我的
-        in: query
-        name: is_my
-        type: integer
-      - description: 用户id
-        in: query
-        name: user_id
-        type: integer
-      - description: 地址簿集合id
-        in: query
-        name: collection_id
-        type: integer
+      - description: Multipart file to upload
+        in: formData
+        name: file
+        required: true
+        type: file
       produces:
       - application/json
       responses:
         "200":
           description: OK
-          schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBookCollectionList'
-              type: object
+          schema:
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则列表
       tags:
-      - 地址簿规则
-  /admin/address_book_collection_rule/update:
+      - ""
+  /admin/github_build_config/approve_workflow_ref:
     post:
       consumes:
       - application/json
-      description: 地址簿规则编辑
+      description: Admin confirmation for a provider-derived, verified, protected
+        workflow tag. The workflow_tag must be selected from workflow_tags; raw refs
+        and SHAs are not accepted. The response is the secret-free GithubBuildConfigSafe
+        view.
       parameters:
-      - description: 地址簿规则信息
+      - description: Confirm and provider-derived workflow tag label
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollectionRule'
+          $ref: '#/definitions/admin.WorkflowRefApprovalForm'
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Safe GitHub build configuration envelope
           schema:
             allOf:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.GithubBuildConfigSafe'
               type: object
+        "400":
+          description: Invalid selector or approval request
+          schema:
+            $ref: '#/definitions/response.Response'
         "500":
-          description: Internal Server Error
+          description: Workflow approval failed
+          schema:
+            $ref: '#/definitions/response.Response'
+        "502":
+          description: Provider rejected or could not verify the workflow tag
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: GitHub provider configuration or transport is unavailable
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则编辑
+      summary: Approve a provider-derived workflow tag
       tags:
-      - 地址簿规则
-  /admin/audit_conn/batchDelete:
+      - GithubBuildConfig
+  /admin/github_build_config/dispatch_test:
     post:
       consumes:
       - application/json
-      description: 链接日志批量删除
+      description: Admin-only provider mutation that dispatches the configured Windows
+        workflow with server-derived parameters after explicit confirmation. The response
+        contains provider run metadata, not credentials.
       parameters:
-      - description: 链接日志
+      - description: Explicit build confirmation
         in: body
         name: body
-        required: true
         schema:
-          $ref: '#/definitions/admin.AuditConnLogIds'
+          additionalProperties:
+            type: boolean
+          type: object
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Provider workflow dispatch metadata
           schema:
             $ref: '#/definitions/response.Response'
-        "500":
-          description: Internal Server Error
+        "412":
+          description: Workflow reference approval is required
+          schema:
+            $ref: '#/definitions/response.Response'
+        "502":
+          description: Provider rejected the workflow dispatch
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: GitHub provider configuration or transport is unavailable
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 链接日志批量删除
+      summary: Dispatch a GitHub smoke-test build
       tags:
-      - 链接日志
-  /admin/audit_conn/delete:
+      - GithubBuildConfig
+  /admin/github_build_config/generate_key:
     post:
-      consumes:
-      - application/json
-      description: 链接日志删除
-      parameters:
-      - description: 链接日志信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/model.AuditConn'
+      description: Admin-only operation that creates and stores a new workflow payload
+        key. The generated key is returned once so it can be copied to the provider
+        secret store; later configuration reads are secret-free.
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Generated workflow payload key
           schema:
             $ref: '#/definitions/response.Response'
         "500":
-          description: Internal Server Error
+          description: Payload key could not be generated
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: Secret encryption is unavailable
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 链接日志删除
+      summary: Generate a workflow payload key
       tags:
-      - 链接日志
-  /admin/audit_conn/list:
+      - GithubBuildConfig
+  /admin/github_build_config/get:
     get:
-      consumes:
-      - application/json
-      description: 链接日志列表
-      parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 目标设备
-        in: query
-        name: peer_id
-        type: integer
-      - description: 来源设备
-        in: query
-        name: from_peer
-        type: integer
+      description: Admin-only secret-free GitHub build configuration view. Credentials
+        are represented only by has_token and has_payload_key flags.
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Secret-free GitHub build configuration envelope
           schema:
             allOf:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AuditConnList'
+                  $ref: '#/definitions/model.GithubBuildConfigSafe'
               type: object
         "500":
-          description: Internal Server Error
+          description: GitHub build configuration is unavailable
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 链接日志列表
+      summary: Get GitHub build configuration
       tags:
-      - 链接日志
-  /admin/audit_file/batchDelete:
+      - GithubBuildConfig
+  /admin/github_build_config/save:
     post:
       consumes:
       - application/json
-      description: 文件日志批量删除
+      description: Admin-only configuration update. Repository is user-authored; workflow
+        selectors and resolved provider identities remain system/provider-derived.
+        Empty secrets preserve stored values, and the response is secret-free.
       parameters:
-      - description: 文件日志
+      - description: GitHub build configuration
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.AuditFileLogIds'
+          $ref: '#/definitions/admin.GithubBuildConfigForm'
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Secret-free GitHub build configuration envelope
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.GithubBuildConfigSafe'
+              type: object
+        "400":
+          description: Invalid configuration request
           schema:
             $ref: '#/definitions/response.Response'
         "500":
-          description: Internal Server Error
+          description: GitHub build configuration could not be saved
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: Secret encryption is unavailable
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 文件日志批量删除
+      summary: Save GitHub build configuration
       tags:
-      - 文件日志
-  /admin/audit_file/delete:
+      - GithubBuildConfig
+  /admin/github_build_config/sync_secret:
     post:
-      consumes:
+      description: Admin-only provider mutation that synchronizes the stored workflow
+        payload key to the configured GitHub Actions secret. The key is not returned.
+      produces:
       - application/json
-      description: 文件日志删除
-      parameters:
-      - description: 文件日志信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/model.AuditFile'
+      responses:
+        "200":
+          description: Workflow payload key synchronized
+          schema:
+            $ref: '#/definitions/response.Response'
+        "502":
+          description: Provider rejected the secret update
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: GitHub provider configuration or transport is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Sync the workflow payload key
+      tags:
+      - GithubBuildConfig
+  /admin/github_build_config/test:
+    post:
+      description: Admin-only read-only provider connectivity check. The stored PAT
+        is used server-side and is never returned.
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Provider access is available
           schema:
             $ref: '#/definitions/response.Response'
-        "500":
-          description: Internal Server Error
+        "502":
+          description: Provider rejected the configured credentials or repository
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: GitHub provider configuration or transport is unavailable
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 文件日志删除
+      summary: Test GitHub provider access
       tags:
-      - 文件日志
-  /admin/audit_file/list:
+      - GithubBuildConfig
+  /admin/github_build_config/workflow_tags:
     get:
+      description: Admin-only capability catalog. Each WorkflowTagOption is a safe
+        provider-derived label; credentials, raw refs, SHAs, and provider verification
+        objects remain server-side. Approval must select one of these options.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Safe workflow tag options under data.tags
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  additionalProperties:
+                    items:
+                      $ref: '#/definitions/service.WorkflowTagOption'
+                    type: array
+                  type: object
+              type: object
+        "500":
+          description: Workflow tag options are unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+        "502":
+          description: Provider rejected or returned invalid workflow data
+          schema:
+            $ref: '#/definitions/response.Response'
+        "503":
+          description: GitHub provider configuration or transport is unavailable
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: List provider-derived workflow tag options
+      tags:
+      - GithubBuildConfig
+  /admin/group/create:
+    post:
       consumes:
       - application/json
-      description: 文件日志列表
       parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 目标设备
-        in: query
-        name: peer_id
-        type: integer
-      - description: 来源设备
-        in: query
-        name: from_peer
-        type: integer
+      - description: Group form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.GroupForm'
       produces:
       - application/json
       responses:
@@ -1565,7 +3187,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AuditFileList'
+                  $ref: '#/definitions/model.Group'
               type: object
         "500":
           description: Internal Server Error
@@ -1573,14 +3195,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 文件日志列表
       tags:
-      - 文件日志
-  /admin/config/admin:
-    get:
+      - ""
+  /admin/group/delete:
+    post:
       consumes:
       - application/json
-      description: ADMIN服务配置
+      parameters:
+      - description: Group deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.GroupForm'
       produces:
       - application/json
       responses:
@@ -1594,63 +3221,82 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: ADMIN服务配置
       tags:
-      - ADMIN
-  /admin/config/app:
+      - ""
+  /admin/group/detail/{id}:
     get:
       consumes:
       - application/json
-      description: APP服务配置
+      parameters:
+      - description: ID
+        in: path
+        name: id
+        required: true
+        type: integer
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.Group'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: APP服务配置
       tags:
-      - ADMIN
-  /admin/config/server:
+      - ""
+  /admin/group/list:
     get:
       consumes:
       - application/json
-      description: 服务配置,给webclient提供api-server
+      parameters:
+      - description: Page number for the group list
+        in: query
+        name: page
+        type: integer
+      - description: Number of groups per page
+        in: query
+        name: page_size
+        type: integer
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.GroupList'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: RUSTDESK服务配置
       tags:
-      - ADMIN
-  /admin/device_group/create:
+      - ""
+  /admin/group/update:
     post:
       consumes:
       - application/json
-      description: 创建设备群组
       parameters:
-      - description: 设备群组信息
+      - description: Group update form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.DeviceGroupForm'
+          $ref: '#/definitions/admin.GroupForm'
       produces:
       - application/json
       responses:
@@ -1661,7 +3307,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.DeviceGroup'
+                  $ref: '#/definitions/model.Group'
               type: object
         "500":
           description: Internal Server Error
@@ -1669,116 +3315,127 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建设备群组
       tags:
-      - 设备群组
-  /admin/device_group/delete:
+      - ""
+  /admin/login:
     post:
       consumes:
       - application/json
-      description: 设备群组删除
+      description: Public pre-authentication route for administrator credentials;
+        it returns the admin access-token payload on success.
       parameters:
-      - description: 群组信息
+      - description: Admin login credentials payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.DeviceGroupForm'
+          $ref: '#/definitions/rustdesk-server_api_http_request_admin.Login'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/admin.LoginPayload'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      security:
-      - token: []
-      summary: 设备群组删除
+      summary: Log in to the admin panel
       tags:
-      - 设备群组
-  /admin/device_group/detail/{id}:
+      - Auth
+  /admin/login-options:
     get:
+      description: Public pre-authentication route returning registration, password-login,
+        CAPTCHA, and OIDC-provider capabilities.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Public admin login capabilities
+          schema:
+            $ref: '#/definitions/response.Response'
+        "400":
+          description: Login options could not be read
+          schema:
+            $ref: '#/definitions/response.Response'
+      summary: Get admin login options
+      tags:
+      - Auth
+  /admin/login_log/batchDelete:
+    post:
       consumes:
       - application/json
-      description: 设备群组详情
       parameters:
-      - description: ID
-        in: path
-        name: id
+      - description: Login log ID batch deletion payload
+        in: body
+        name: body
         required: true
-        type: integer
+        schema:
+          $ref: '#/definitions/admin.LoginLogIds'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Group'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备群组详情
       tags:
-      - 设备群组
-  /admin/device_group/list:
-    get:
+      - ""
+  /admin/login_log/delete:
+    post:
       consumes:
       - application/json
-      description: 群组列表
       parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
+      - description: Login log deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.LoginLog'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.GroupList'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 群组列表
       tags:
-      - 群组
-  /admin/device_group/update:
-    post:
+      - ""
+  /admin/login_log/list:
+    get:
       consumes:
       - application/json
-      description: 设备群组编辑
       parameters:
-      - description: 群组信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/admin.DeviceGroupForm'
+      - description: Page number for the login-log list
+        in: query
+        name: page
+        type: integer
+      - description: Number of login-log records per page
+        in: query
+        name: page_size
+        type: integer
+      - description: ID
+        in: query
+        name: user_id
+        type: integer
       produces:
       - application/json
       responses:
@@ -1789,7 +3446,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.Group'
+                  $ref: '#/definitions/model.LoginLogList'
               type: object
         "500":
           description: Internal Server Error
@@ -1797,14 +3454,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备群组编辑
       tags:
-      - 设备群组
-  /admin/file/oss_token:
-    get:
+      - ""
+  /admin/logout:
+    post:
       consumes:
       - application/json
-      description: 获取ossToken
+      description: Clears the supplied admin access token when it identifies a current
+        user; the route is registered before the admin authentication middleware.
       produces:
       - application/json
       responses:
@@ -1818,20 +3475,22 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 获取ossToken
+      summary: Log out of the admin panel
       tags:
-      - 文件
-  /admin/file/upload:
+      - Auth
+  /admin/my/address_book/batchCreateFromPeers:
     post:
       consumes:
-      - multipart/form-data
-      description: 上传文件到本地
+      - application/json
+      description: Personal batch creation of address-book entries from the current
+        user's peers.
       parameters:
-      - description: 上传文件示例
-        in: formData
-        name: file
+      - description: Peer IDs and address-book destination payload
+        in: body
+        name: body
         required: true
-        type: file
+        schema:
+          $ref: '#/definitions/admin.BatchCreateFromPeersForm'
       produces:
       - application/json
       responses:
@@ -1845,54 +3504,47 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 上传文件到本地
       tags:
-      - 文件
-  /admin/group/create:
+      - ""
+  /admin/my/address_book/batchUpdateTags:
     post:
       consumes:
       - application/json
-      description: 创建群组
+      description: Authenticated users may update tags on their own address-book entries.
       parameters:
-      - description: 群组信息
+      - description: Address-book tag update payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.GroupForm'
+          $ref: '#/definitions/admin.BatchUpdateTagsForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Group'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建群组
+      summary: Update personal address-book tags
       tags:
-      - 群组
-  /admin/group/delete:
+      - AddressBook
+  /admin/my/address_book/create:
     post:
       consumes:
       - application/json
-      description: 群组删除
       parameters:
-      - description: 群组信息
+      - description: Personal address book entry form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.GroupForm'
+          $ref: '#/definitions/admin.AddressBookForm'
       produces:
       - application/json
       responses:
@@ -1906,66 +3558,62 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 群组删除
       tags:
-      - 群组
-  /admin/group/detail/{id}:
-    get:
+      - ""
+  /admin/my/address_book/delete:
+    post:
       consumes:
       - application/json
-      description: 群组详情
       parameters:
-      - description: ID
-        in: path
-        name: id
+      - description: Personal address book entry deletion form payload
+        in: body
+        name: body
         required: true
-        type: integer
+        schema:
+          $ref: '#/definitions/admin.AddressBookForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Group'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 群组详情
       tags:
-      - 群组
-  /admin/group/list:
+      - ""
+  /admin/my/address_book/list:
     get:
       consumes:
       - application/json
-      description: 群组列表
       parameters:
-      - description: 页码
+      - description: Page number for the personal address book list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of personal address book entries per page
         in: query
         name: page_size
         type: integer
+      - description: id
+        in: query
+        name: user_id
+        type: integer
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Redacted personal address-book list envelope
           schema:
             allOf:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.GroupList'
+                  $ref: '#/definitions/model.AddressBookSafeList'
               type: object
         "500":
           description: Internal Server Error
@@ -1973,108 +3621,130 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 群组列表
       tags:
-      - 群组
-  /admin/group/update:
+      - ""
+  /admin/my/address_book/update:
     post:
       consumes:
       - application/json
-      description: 群组编辑
       parameters:
-      - description: 群组信息
+      - description: Personal address book entry update form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.GroupForm'
+          $ref: '#/definitions/admin.AddressBookForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Group'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 群组编辑
       tags:
-      - 群组
-  /admin/login:
+      - ""
+  /admin/my/address_book_collection/create:
     post:
       consumes:
       - application/json
-      description: 登录
       parameters:
-      - description: 登录信息
+      - description: Personal address book collection form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/github_com_lejianwen_rustdesk-api_v2_http_request_admin.Login'
+          $ref: '#/definitions/model.AddressBookCollection'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/admin.LoginPayload'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录
       tags:
-      - 登录
-  /admin/login-options:
+      - ""
+  /admin/my/address_book_collection/delete:
     post:
       consumes:
       - application/json
-      description: 登录选项
+      parameters:
+      - description: Personal address book collection deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollection'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            items:
-              type: string
-            type: array
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
-            $ref: '#/definitions/response.ErrorResponse'
-      summary: 登录选项
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
       tags:
-      - 登录
-  /admin/login_log/batchDelete:
+      - ""
+  /admin/my/address_book_collection/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for the personal address book collection list
+        in: query
+        name: page
+        type: integer
+      - description: Number of personal address book collections per page
+        in: query
+        name: page_size
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.AddressBookCollectionList'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/my/address_book_collection/update:
     post:
       consumes:
       - application/json
-      description: 登录日志批量删除
       parameters:
-      - description: 登录日志
+      - description: Personal address book collection update form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.LoginLogIds'
+          $ref: '#/definitions/model.AddressBookCollection'
       produces:
       - application/json
       responses:
@@ -2088,21 +3758,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志批量删除
       tags:
-      - 登录日志
-  /admin/login_log/delete:
+      - ""
+  /admin/my/address_book_collection_rule/create:
     post:
       consumes:
       - application/json
-      description: 登录日志删除
       parameters:
-      - description: 登录日志信息
+      - description: Personal address book collection rule form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.LoginLog'
+          $ref: '#/definitions/model.AddressBookCollectionRule'
       produces:
       - application/json
       responses:
@@ -2116,59 +3784,59 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志删除
       tags:
-      - 登录日志
-  /admin/login_log/detail/{id}:
-    get:
+      - ""
+  /admin/my/address_book_collection_rule/delete:
+    post:
       consumes:
       - application/json
-      description: 登录日志详情
       parameters:
-      - description: ID
-        in: path
-        name: id
+      - description: Personal address book collection rule deletion form payload
+        in: body
+        name: body
         required: true
-        type: integer
+        schema:
+          $ref: '#/definitions/model.AddressBookCollectionRule'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.LoginLog'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志详情
       tags:
-      - 登录日志
-  /admin/login_log/list:
+      - ""
+  /admin/my/address_book_collection_rule/list:
     get:
       consumes:
       - application/json
-      description: 登录日志列表
       parameters:
-      - description: 页码
+      - description: Page number for personal address book collection rules
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of personal collection rules per page
         in: query
         name: page_size
         type: integer
-      - description: 用户ID
+      - description: Filter for rules owned by the current user
+        in: query
+        name: is_my
+        type: integer
+      - description: id
         in: query
         name: user_id
         type: integer
+      - description: id
+        in: query
+        name: collection_id
+        type: integer
       produces:
       - application/json
       responses:
@@ -2179,7 +3847,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.LoginLogList'
+                  $ref: '#/definitions/model.AddressBookCollectionRuleList'
               type: object
         "500":
           description: Internal Server Error
@@ -2187,14 +3855,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志列表
       tags:
-      - 登录日志
-  /admin/logout:
+      - ""
+  /admin/my/address_book_collection_rule/update:
     post:
       consumes:
       - application/json
-      description: 登出
+      parameters:
+      - description: Personal address book collection rule update form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.AddressBookCollectionRule'
       produces:
       - application/json
       responses:
@@ -2206,54 +3879,67 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 登出
+      security:
+      - token: []
       tags:
-      - 登录
-  /admin/my/address_book/create:
+      - ""
+  /admin/my/groupUsers:
+    post:
+      description: Authenticated users receive only the group and user entries allowed
+        for personal sharing.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: List shareable users and groups
+      tags:
+      - User
+  /admin/my/login_log/batchDelete:
     post:
       consumes:
       - application/json
-      description: 创建地址簿
       parameters:
-      - description: 地址簿信息
+      - description: Personal login-log ID batch deletion payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+          $ref: '#/definitions/admin.LoginLogIds'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBook'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建地址簿
       tags:
-      - 我的地址簿
-  /admin/my/address_book/delete:
+      - ""
+  /admin/my/login_log/delete:
     post:
       consumes:
       - application/json
-      description: 地址簿删除
       parameters:
-      - description: 地址簿信息
+      - description: Personal login-log deletion form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+          $ref: '#/definitions/model.LoginLog'
       produces:
       - application/json
       responses:
@@ -2267,24 +3953,22 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿删除
       tags:
-      - 我的地址簿
-  /admin/my/address_book/list:
+      - ""
+  /admin/my/login_log/list:
     get:
       consumes:
       - application/json
-      description: 地址簿列表
       parameters:
-      - description: 页码
+      - description: Page number for the personal login-log list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of personal login-log records per page
         in: query
         name: page_size
         type: integer
-      - description: 用户id
+      - description: ID
         in: query
         name: user_id
         type: integer
@@ -2298,7 +3982,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookList'
+                  $ref: '#/definitions/model.LoginLogList'
               type: object
         "500":
           description: Internal Server Error
@@ -2306,21 +3990,89 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿列表
       tags:
-      - 我的地址簿
-  /admin/my/address_book/update:
+      - ""
+  /admin/my/peer/batchDelete:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: Personal peer ID batch deletion payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.PeerBatchDeleteForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/my/peer/delete:
     post:
       consumes:
       - application/json
-      description: 地址簿编辑
       parameters:
-      - description: 地址簿信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/admin.AddressBookForm'
+      - description: Personal peer deletion form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.PeerForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
+  /admin/my/peer/list:
+    get:
+      consumes:
+      - application/json
+      parameters:
+      - description: Page number for the personal peer list
+        in: query
+        name: page
+        type: integer
+      - description: Number of personal peers per page
+        in: query
+        name: page_size
+        type: integer
+      - description: Last-online time offset filter
+        in: query
+        name: time_ago
+        type: integer
+      - description: ID
+        in: query
+        name: id
+        type: string
+      - description: Hostname filter
+        in: query
+        name: hostname
+        type: string
+      - description: 'uuids '
+        in: query
+        name: uuids
+        type: string
       produces:
       - application/json
       responses:
@@ -2331,7 +4083,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBook'
+                  $ref: '#/definitions/model.PeerList'
               type: object
         "500":
           description: Internal Server Error
@@ -2339,54 +4091,45 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿编辑
       tags:
-      - 我的地址簿
-  /admin/my/address_book_collection/create:
+      - ""
+  /admin/my/share_record/batchDelete:
     post:
       consumes:
       - application/json
-      description: 创建地址簿名称
       parameters:
-      - description: 地址簿名称信息
+      - description: id
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollection'
+          $ref: '#/definitions/admin.PeerShareRecordBatchDeleteForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBookCollection'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建地址簿名称
       tags:
-      - 我的地址簿名称
-  /admin/my/address_book_collection/delete:
+      - ""
+  /admin/my/share_record/delete:
     post:
       consumes:
       - application/json
-      description: 地址簿名称删除
       parameters:
-      - description: 地址簿名称信息
+      - description: Personal share record deletion form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollection'
+          $ref: '#/definitions/admin.ShareRecordForm'
       produces:
       - application/json
       responses:
@@ -2400,20 +4143,18 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿名称删除
       tags:
-      - 我的地址簿名称
-  /admin/my/address_book_collection/list:
+      - ""
+  /admin/my/share_record/list:
     get:
       consumes:
       - application/json
-      description: 地址簿名称列表
       parameters:
-      - description: 页码
+      - description: Page number for personal share records
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of personal share records per page
         in: query
         name: page_size
         type: integer
@@ -2421,46 +4162,13 @@ paths:
       - application/json
       responses:
         "200":
-          description: OK
-          schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.AddressBookCollectionList'
-              type: object
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/response.Response'
-      security:
-      - token: []
-      summary: 地址簿名称列表
-      tags:
-      - 我的地址簿名称
-  /admin/my/address_book_collection/update:
-    post:
-      consumes:
-      - application/json
-      description: 地址簿名称编辑
-      parameters:
-      - description: 地址簿名称信息
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/model.AddressBookCollection'
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
+          description: Redacted personal share-record list envelope
           schema:
             allOf:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.ShareRecordSafeList'
               type: object
         "500":
           description: Internal Server Error
@@ -2468,21 +4176,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿名称编辑
       tags:
-      - 我的地址簿名称
-  /admin/my/address_book_collection_rule/create:
+      - ""
+  /admin/my/tag/create:
     post:
       consumes:
       - application/json
-      description: 创建地址簿规则
       parameters:
-      - description: 地址簿规则信息
+      - description: Personal tag form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollectionRule'
+          $ref: '#/definitions/admin.TagForm'
       produces:
       - application/json
       responses:
@@ -2493,7 +4199,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.Tag'
               type: object
         "500":
           description: Internal Server Error
@@ -2501,21 +4207,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建地址簿规则
       tags:
-      - 我的地址簿规则
-  /admin/my/address_book_collection_rule/delete:
+      - ""
+  /admin/my/tag/delete:
     post:
       consumes:
       - application/json
-      description: 地址簿规则删除
       parameters:
-      - description: 地址簿规则信息
+      - description: Personal tag deletion form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollectionRule'
+          $ref: '#/definitions/admin.TagForm'
       produces:
       - application/json
       responses:
@@ -2529,35 +4233,29 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则删除
       tags:
-      - 我的地址簿规则
-  /admin/my/address_book_collection_rule/list:
+      - ""
+  /admin/my/tag/list:
     get:
       consumes:
       - application/json
-      description: 地址簿规则列表
       parameters:
-      - description: 页码
+      - description: Page number for the personal tag list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of personal tags per page
         in: query
         name: page_size
         type: integer
-      - description: 是否是我的
+      - description: Filter for tags owned by the current user
         in: query
         name: is_my
         type: integer
-      - description: 用户id
+      - description: id
         in: query
         name: user_id
         type: integer
-      - description: 地址簿集合id
-        in: query
-        name: collection_id
-        type: integer
       produces:
       - application/json
       responses:
@@ -2568,7 +4266,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollectionList'
+                  $ref: '#/definitions/model.TagList'
               type: object
         "500":
           description: Internal Server Error
@@ -2576,21 +4274,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则列表
       tags:
-      - 我的地址簿规则
-  /admin/my/address_book_collection_rule/update:
+      - ""
+  /admin/my/tag/update:
     post:
       consumes:
       - application/json
-      description: 地址簿规则编辑
       parameters:
-      - description: 地址簿规则信息
+      - description: Personal tag update form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.AddressBookCollectionRule'
+          $ref: '#/definitions/admin.TagForm'
       produces:
       - application/json
       responses:
@@ -2601,7 +4297,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.AddressBookCollection'
+                  $ref: '#/definitions/model.Tag'
               type: object
         "500":
           description: Internal Server Error
@@ -2609,49 +4305,57 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 地址簿规则编辑
       tags:
-      - 我的地址簿规则
-  /admin/my/login_log/batchDelete:
+      - ""
+  /admin/oauth/bind:
     post:
       consumes:
       - application/json
-      description: 登录日志批量删除
+      description: Authenticated users receive a short-lived binding code and provider
+        URL.
       parameters:
-      - description: 登录日志
+      - description: OAuth provider binding payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.LoginLogIds'
+          $ref: '#/definitions/admin.BindOauthForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  additionalProperties:
+                    type: string
+                  type: object
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志批量删除
+      summary: Start OAuth binding
       tags:
-      - 我的登录日志
-  /admin/my/login_log/delete:
+      - Oauth
+  /admin/oauth/bindConfirm:
     post:
       consumes:
       - application/json
-      description: 登录日志删除
+      description: Authenticated users attach the confirmed OAuth identity to their
+        account.
       parameters:
-      - description: 登录日志信息
+      - description: OAuth confirmation payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/model.LoginLog'
+          $ref: '#/definitions/admin.OauthConfirmForm'
       produces:
       - application/json
       responses:
@@ -2665,78 +4369,50 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志删除
+      summary: Complete OAuth binding
       tags:
-      - 我的登录日志
-  /admin/my/login_log/list:
-    get:
+      - Oauth
+  /admin/oauth/confirm:
+    post:
       consumes:
       - application/json
-      description: 登录日志列表
+      description: Authenticated users confirm a short-lived OAuth handoff before
+        binding.
       parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 用户ID
-        in: query
-        name: user_id
-        type: integer
+      - description: OAuth confirmation payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.OauthConfirmForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.LoginLogList'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录日志列表
+      summary: Confirm OAuth binding
       tags:
-      - 我的登录日志
-  /admin/my/peer/list:
-    get:
+      - Oauth
+  /admin/oauth/create:
+    post:
       consumes:
       - application/json
-      description: 设备列表
+      description: Oauth
       parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 时间
-        in: query
-        name: time_ago
-        type: integer
-      - description: ID
-        in: query
-        name: id
-        type: string
-      - description: 主机名
-        in: query
-        name: hostname
-        type: string
-      - description: uuids 用逗号分隔
-        in: query
-        name: uuids
-        type: string
+      - description: Oauth
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.OauthForm'
       produces:
       - application/json
       responses:
@@ -2747,7 +4423,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.PeerList'
+                  $ref: '#/definitions/model.Oauth'
               type: object
         "500":
           description: Internal Server Error
@@ -2755,21 +4431,21 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备列表
+      summary: Oauth
       tags:
-      - 我的设备
-  /admin/my/share_record/batchDelete:
+      - Oauth
+  /admin/oauth/delete:
     post:
       consumes:
       - application/json
-      description: 批量删除我的分享记录
+      description: Oauth
       parameters:
-      - description: id
+      - description: Oauth
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.PeerShareRecordBatchDeleteForm'
+          $ref: '#/definitions/admin.OauthForm'
       produces:
       - application/json
       responses:
@@ -2783,21 +4459,50 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 批量删除我的分享记录
+      summary: Oauth
       tags:
-      - 我的
-  /admin/my/share_record/delete:
-    post:
+      - Oauth
+  /admin/oauth/detail/{id}:
+    get:
       consumes:
       - application/json
-      description: 分享记录删除
+      description: Oauth
       parameters:
-      - description: 分享记录信息
-        in: body
-        name: body
+      - description: ID
+        in: path
+        name: id
         required: true
-        schema:
-          $ref: '#/definitions/admin.ShareRecordForm'
+        type: integer
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.Oauth'
+              type: object
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: Oauth
+      tags:
+      - Oauth
+  /admin/oauth/info:
+    get:
+      description: Authenticated OAuth handoff lookup by short-lived code.
+      parameters:
+      - description: OAuth handoff code
+        in: query
+        name: code
+        required: true
+        type: string
       produces:
       - application/json
       responses:
@@ -2811,20 +4516,20 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 分享记录删除
+      summary: Get cached OAuth handoff data
       tags:
-      - 我的分享记录
-  /admin/my/share_record/list:
+      - Oauth
+  /admin/oauth/list:
     get:
       consumes:
       - application/json
-      description: 分享记录列表
+      description: Oauth
       parameters:
-      - description: 页码
+      - description: Page number for the OAuth provider list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of OAuth providers per page
         in: query
         name: page_size
         type: integer
@@ -2834,99 +4539,114 @@ paths:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.OauthList'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 分享记录列表
+      summary: Oauth
       tags:
-      - 我的分享记录
-  /admin/my/tag/create:
+      - Oauth
+  /admin/oauth/unbind:
     post:
       consumes:
       - application/json
-      description: 创建标签
+      description: Authenticated users remove one OAuth provider binding from their
+        account.
       parameters:
-      - description: 标签信息
+      - description: OAuth provider unbinding payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.TagForm'
+          $ref: '#/definitions/admin.UnBindOauthForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Tag'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建标签
+      summary: Unbind OAuth provider
       tags:
-      - 我的标签
-  /admin/my/tag/delete:
+      - Oauth
+  /admin/oauth/update:
     post:
       consumes:
       - application/json
-      description: 标签删除
+      description: Oauth
       parameters:
-      - description: 标签信息
+      - description: Oauth
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.TagForm'
+          $ref: '#/definitions/admin.OauthForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.OauthList'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 标签删除
+      summary: Oauth
       tags:
-      - 标签
-  /admin/my/tag/list:
-    get:
+      - Oauth
+  /admin/oidc/auth:
+    post:
       consumes:
       - application/json
-      description: 标签列表
-      parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 是否是我的
-        in: query
-        name: is_my
-        type: integer
-      - description: 用户id
-        in: query
-        name: user_id
-        type: integer
+      description: Public pre-authentication route returning the state code and provider
+        URL for the admin OIDC flow.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Authorization state code and provider URL
+          schema:
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  additionalProperties:
+                    type: string
+                  type: object
+              type: object
+        "400":
+          description: OIDC authorization could not be started
+          schema:
+            $ref: '#/definitions/response.ErrorResponse'
+      summary: Start admin OIDC authorization
+      tags:
+      - Oauth
+  /admin/oidc/auth-query:
+    get:
+      description: Public pre-authentication route exchanging the OIDC state code
+        and provider callback values for an admin login payload.
       produces:
       - application/json
       responses:
@@ -2937,62 +4657,52 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.TagList'
+                  $ref: '#/definitions/admin.LoginPayload'
               type: object
-        "500":
-          description: Internal Server Error
+        "400":
+          description: OIDC authorization query failed
           schema:
-            $ref: '#/definitions/response.Response'
-      security:
-      - token: []
-      summary: 标签列表
+            $ref: '#/definitions/response.ErrorResponse'
+      summary: Complete admin OIDC authorization
       tags:
-      - 我的标签
-  /admin/my/tag/update:
+      - Oauth
+  /admin/peer/batchDelete:
     post:
       consumes:
       - application/json
-      description: 标签编辑
       parameters:
-      - description: 标签信息
+      - description: id
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.TagForm'
+          $ref: '#/definitions/admin.PeerBatchDeleteForm'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Tag'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 标签编辑
       tags:
-      - 我的标签
-  /admin/oauth/create:
+      - ""
+  /admin/peer/create:
     post:
       consumes:
       - application/json
-      description: 创建Oauth
       parameters:
-      - description: Oauth信息
+      - description: Peer form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.OauthForm'
+          $ref: '#/definitions/admin.PeerForm'
       produces:
       - application/json
       responses:
@@ -3003,7 +4713,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.Oauth'
+                  $ref: '#/definitions/model.Peer'
               type: object
         "500":
           description: Internal Server Error
@@ -3011,21 +4721,19 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建Oauth
       tags:
-      - Oauth
-  /admin/oauth/delete:
+      - ""
+  /admin/peer/delete:
     post:
       consumes:
       - application/json
-      description: Oauth删除
       parameters:
-      - description: Oauth信息
+      - description: Peer deletion form payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.OauthForm'
+          $ref: '#/definitions/admin.PeerForm'
       produces:
       - application/json
       responses:
@@ -3039,14 +4747,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: Oauth删除
       tags:
-      - Oauth
-  /admin/oauth/detail/{id}:
+      - ""
+  /admin/peer/detail/{id}:
     get:
       consumes:
       - application/json
-      description: Oauth详情
       parameters:
       - description: ID
         in: path
@@ -3063,7 +4769,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.Oauth'
+                  $ref: '#/definitions/model.Peer'
               type: object
         "500":
           description: Internal Server Error
@@ -3071,23 +4777,37 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: Oauth详情
       tags:
-      - Oauth
-  /admin/oauth/list:
+      - ""
+  /admin/peer/list:
     get:
       consumes:
       - application/json
-      description: Oauth列表
       parameters:
-      - description: 页码
+      - description: Page number for the peer list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of peers per page
         in: query
         name: page_size
         type: integer
+      - description: Last-online time offset filter
+        in: query
+        name: time_ago
+        type: integer
+      - description: ID
+        in: query
+        name: id
+        type: string
+      - description: Hostname filter
+        in: query
+        name: hostname
+        type: string
+      - description: 'uuids '
+        in: query
+        name: uuids
+        type: string
       produces:
       - application/json
       responses:
@@ -3098,7 +4818,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.OauthList'
+                  $ref: '#/definitions/model.PeerList'
               type: object
         "500":
           description: Internal Server Error
@@ -3106,21 +4826,20 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: Oauth列表
       tags:
-      - Oauth
-  /admin/oauth/update:
+      - ""
+  /admin/peer/simpleData:
     post:
       consumes:
       - application/json
-      description: Oauth编辑
+      description: Authenticated peer version lookup used by the admin panel.
       parameters:
-      - description: Oauth信息
+      - description: Peer ID lookup payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.OauthForm'
+          $ref: '#/definitions/admin.SimpleDataQuery'
       produces:
       - application/json
       responses:
@@ -3131,7 +4850,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.OauthList'
+                  $ref: '#/definitions/model.PeerList'
               type: object
         "500":
           description: Internal Server Error
@@ -3139,25 +4858,20 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: Oauth编辑
+      summary: Get peer version data
       tags:
-      - Oauth
-  /admin/oidc/auth:
+      - Peer
+  /admin/peer/update:
     post:
       consumes:
       - application/json
-      description: OidcAuth
-      produces:
-      - application/json
-      responses: {}
-      summary: OidcAuth
-      tags:
-      - Oauth
-  /admin/oidc/auth-query:
-    get:
-      consumes:
-      - application/json
-      description: OidcAuthQuery
+      parameters:
+      - description: Peer update form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.PeerForm'
       produces:
       - application/json
       responses:
@@ -3168,88 +4882,87 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/admin.LoginPayload'
+                  $ref: '#/definitions/model.Peer'
               type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: OidcAuthQuery
+      security:
+      - token: []
       tags:
-      - Oauth
-  /admin/peer/batchDelete:
-    post:
-      consumes:
-      - application/json
-      description: 批量设备删除
+      - ""
+  /admin/rustdesk/cmdAuditList:
+    get:
+      description: Admin-only paginated audit history for server-command executions.
       parameters:
-      - description: 设备id
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/admin.PeerBatchDeleteForm'
+      - description: Page number
+        in: query
+        name: page
+        type: integer
+      - description: Number of audit records per page
+        in: query
+        name: page_size
+        type: integer
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.ServerCmdAuditList'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 批量设备删除
+      summary: List server-command audit records
       tags:
-      - 设备
-  /admin/peer/create:
+      - Rustdesk
+  /admin/rustdesk/cmdCreate:
     post:
       consumes:
       - application/json
-      description: 创建设备
       parameters:
-      - description: 设备信息
+      - description: Server command payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.PeerForm'
+          $ref: '#/definitions/model.ServerCmd'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Peer'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建设备
+      summary: Create a server command
       tags:
-      - 设备
-  /admin/peer/delete:
+      - Rustdesk
+  /admin/rustdesk/cmdDelete:
     post:
       consumes:
       - application/json
-      description: 设备删除
       parameters:
-      - description: 设备信息
+      - description: Server command identifier
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.PeerForm'
+          $ref: '#/definitions/model.ServerCmd'
       produces:
       - application/json
       responses:
@@ -3263,19 +4976,20 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备删除
+      summary: Delete a server command
       tags:
-      - 设备
-  /admin/peer/detail/{id}:
+      - Rustdesk
+  /admin/rustdesk/cmdList:
     get:
-      consumes:
-      - application/json
-      description: 设备详情
+      description: Admin-only paginated list of built-in and configured server commands.
       parameters:
-      - description: ID
-        in: path
-        name: id
-        required: true
+      - description: Page number
+        in: query
+        name: page
+        type: integer
+      - description: Number of commands per page
+        in: query
+        name: page_size
         type: integer
       produces:
       - application/json
@@ -3287,7 +5001,7 @@ paths:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.Peer'
+                  $ref: '#/definitions/model.ServerCmdList'
               type: object
         "500":
           description: Internal Server Error
@@ -3295,98 +5009,68 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备详情
+      summary: List server commands
       tags:
-      - 设备
-  /admin/peer/list:
-    get:
+      - Rustdesk
+  /admin/rustdesk/cmdUpdate:
+    post:
       consumes:
       - application/json
-      description: 设备列表
       parameters:
-      - description: 页码
-        in: query
-        name: page
-        type: integer
-      - description: 页大小
-        in: query
-        name: page_size
-        type: integer
-      - description: 时间
-        in: query
-        name: time_ago
-        type: integer
-      - description: ID
-        in: query
-        name: id
-        type: string
-      - description: 主机名
-        in: query
-        name: hostname
-        type: string
-      - description: uuids 用逗号分隔
-        in: query
-        name: uuids
-        type: string
+      - description: Server command update payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/model.ServerCmd'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.PeerList'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备列表
+      summary: Update a server command
       tags:
-      - 设备
-  /admin/peer/update:
+      - Rustdesk
+  /admin/rustdesk/sendCmd:
     post:
       consumes:
       - application/json
-      description: 设备编辑
+      description: Admin-only command execution against the selected ID or relay server.
       parameters:
-      - description: 设备信息
+      - description: Server command request
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.PeerForm'
+          $ref: '#/definitions/admin.RustdeskCmd'
       produces:
       - application/json
       responses:
         "200":
           description: OK
           schema:
-            allOf:
-            - $ref: '#/definitions/response.Response'
-            - properties:
-                data:
-                  $ref: '#/definitions/model.Peer'
-              type: object
+            $ref: '#/definitions/response.Response'
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 设备编辑
+      summary: Send a server command
       tags:
-      - 设备
+      - Rustdesk
   /admin/share_record/batchDelete:
     post:
       consumes:
       - application/json
-      description: 批量分享记录
       parameters:
       - description: id
         in: body
@@ -3407,16 +5091,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 批量分享记录
       tags:
-      - 分享记录
+      - ""
   /admin/share_record/delete:
     post:
       consumes:
       - application/json
-      description: 分享记录删除
       parameters:
-      - description: 分享记录信息
+      - description: Share record deletion form payload
         in: body
         name: body
         required: true
@@ -3435,24 +5117,22 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 分享记录删除
       tags:
-      - 分享记录
+      - ""
   /admin/share_record/list:
     get:
       consumes:
       - application/json
-      description: 分享记录列表
       parameters:
-      - description: 用户ID
+      - description: ID
         in: query
         name: user_id
         type: integer
-      - description: 页码
+      - description: Page number for share records
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of share records per page
         in: query
         name: page_size
         type: integer
@@ -3460,25 +5140,28 @@ paths:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Redacted share-record list envelope
           schema:
-            $ref: '#/definitions/response.Response'
+            allOf:
+            - $ref: '#/definitions/response.Response'
+            - properties:
+                data:
+                  $ref: '#/definitions/model.ShareRecordSafeList'
+              type: object
         "500":
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 分享记录列表
       tags:
-      - 分享记录
+      - ""
   /admin/tag/create:
     post:
       consumes:
       - application/json
-      description: 创建标签
       parameters:
-      - description: 标签信息
+      - description: Tag form payload
         in: body
         name: body
         required: true
@@ -3502,16 +5185,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建标签
       tags:
-      - 标签
+      - ""
   /admin/tag/delete:
     post:
       consumes:
       - application/json
-      description: 标签删除
       parameters:
-      - description: 标签信息
+      - description: Tag deletion form payload
         in: body
         name: body
         required: true
@@ -3530,14 +5211,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 标签删除
       tags:
-      - 标签
+      - ""
   /admin/tag/detail/{id}:
     get:
       consumes:
       - application/json
-      description: 标签详情
       parameters:
       - description: ID
         in: path
@@ -3562,28 +5241,26 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 标签详情
       tags:
-      - 标签
+      - ""
   /admin/tag/list:
     get:
       consumes:
       - application/json
-      description: 标签列表
       parameters:
-      - description: 页码
+      - description: Page number for the tag list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of tags per page
         in: query
         name: page_size
         type: integer
-      - description: 是否是我的
+      - description: Filter for tags owned by the current user
         in: query
         name: is_my
         type: integer
-      - description: 用户id
+      - description: id
         in: query
         name: user_id
         type: integer
@@ -3605,16 +5282,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 标签列表
       tags:
-      - 标签
+      - ""
   /admin/tag/update:
     post:
       consumes:
       - application/json
-      description: 标签编辑
       parameters:
-      - description: 标签信息
+      - description: Tag update form payload
         in: body
         name: body
         required: true
@@ -3638,16 +5313,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 标签编辑
       tags:
-      - 标签
+      - ""
   /admin/user/changeCurPwd:
     post:
       consumes:
       - application/json
-      description: 修改当前用户密码
       parameters:
-      - description: 用户信息
+      - description: Current user password change form payload
         in: body
         name: body
         required: true
@@ -3666,16 +5339,40 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 修改当前用户密码
       tags:
-      - 用户
+      - ""
+  /admin/user/changePwd:
+    post:
+      consumes:
+      - application/json
+      parameters:
+      - description: User password update form payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.UserPasswordForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      tags:
+      - ""
   /admin/user/create:
     post:
       consumes:
       - application/json
-      description: 创建管理员
       parameters:
-      - description: 管理员信息
+      - description: User form payload
         in: body
         name: body
         required: true
@@ -3699,14 +5396,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 创建管理员
       tags:
-      - 用户
+      - ""
   /admin/user/current:
     get:
       consumes:
       - application/json
-      description: 当前用户
       produces:
       - application/json
       responses:
@@ -3725,16 +5420,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 当前用户
       tags:
-      - 用户
+      - ""
   /admin/user/delete:
     post:
       consumes:
       - application/json
-      description: 管理员编删除
       parameters:
-      - description: 用户信息
+      - description: User deletion form payload
         in: body
         name: body
         required: true
@@ -3753,14 +5446,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 管理员删除
       tags:
-      - 用户
+      - ""
   /admin/user/detail/{id}:
     get:
       consumes:
       - application/json
-      description: 管理员详情
       parameters:
       - description: ID
         in: path
@@ -3785,24 +5476,41 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 管理员详情
       tags:
-      - 用户
+      - ""
+  /admin/user/groupUsers:
+    post:
+      description: Admin-only group and user picker data.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - token: []
+      summary: List users grouped by group
+      tags:
+      - User
   /admin/user/list:
     get:
       consumes:
       - application/json
-      description: 管理员列表
       parameters:
-      - description: 页码
+      - description: Page number for the user list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of users per page
         in: query
         name: page_size
         type: integer
-      - description: 账户
+      - description: Username filter
         in: query
         name: username
         type: integer
@@ -3824,14 +5532,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 管理员列表
       tags:
-      - 用户
+      - ""
   /admin/user/myOauth:
-    get:
+    post:
       consumes:
       - application/json
-      description: 我的授权
       produces:
       - application/json
       responses:
@@ -3852,16 +5558,41 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 我的授权
       tags:
-      - 用户
+      - ""
+  /admin/user/register:
+    post:
+      consumes:
+      - application/json
+      description: Public registration route; the server decides whether the new account
+        is enabled immediately.
+      parameters:
+      - description: User registration payload
+        in: body
+        name: body
+        required: true
+        schema:
+          $ref: '#/definitions/admin.RegisterForm'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/response.Response'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      summary: Register a user
+      tags:
+      - User
   /admin/user/update:
     post:
       consumes:
       - application/json
-      description: 管理员编辑
       parameters:
-      - description: 用户信息
+      - description: User update form payload
         in: body
         name: body
         required: true
@@ -3885,21 +5616,20 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 管理员编辑
       tags:
-      - 用户
-  /admin/user/updatePassword:
+      - ""
+  /admin/user/updateCurrent:
     post:
       consumes:
       - application/json
-      description: 修改密码
+      description: Authenticated users may update only their nickname and email.
       parameters:
-      - description: 用户信息
+      - description: Current user profile update payload
         in: body
         name: body
         required: true
         schema:
-          $ref: '#/definitions/admin.UserPasswordForm'
+          $ref: '#/definitions/admin.UpdateCurrentForm'
       produces:
       - application/json
       responses:
@@ -3913,16 +5643,15 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 修改密码
+      summary: Update the current user profile
       tags:
-      - 用户
+      - User
   /admin/user_token/batchDelete:
     post:
       consumes:
       - application/json
-      description: 登录凭证批量删除
       parameters:
-      - description: 登录凭证信息
+      - description: User-token ID batch deletion payload
         in: body
         name: body
         required: true
@@ -3941,16 +5670,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录凭证批量删除
       tags:
-      - 登录凭证
+      - ""
   /admin/user_token/delete:
     post:
       consumes:
       - application/json
-      description: 登录凭证删除
       parameters:
-      - description: 登录凭证信息
+      - description: User-token deletion form payload
         in: body
         name: body
         required: true
@@ -3969,24 +5696,22 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录凭证删除
       tags:
-      - 登录凭证
+      - ""
   /admin/user_token/list:
     get:
       consumes:
       - application/json
-      description: 登录凭证列表
       parameters:
-      - description: 页码
+      - description: Page number for the user-token list
         in: query
         name: page
         type: integer
-      - description: 页大小
+      - description: Number of user tokens per page
         in: query
         name: page_size
         type: integer
-      - description: 用户ID
+      - description: ID
         in: query
         name: user_id
         type: integer
@@ -3994,13 +5719,13 @@ paths:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Redacted user-token list envelope
           schema:
             allOf:
             - $ref: '#/definitions/response.Response'
             - properties:
                 data:
-                  $ref: '#/definitions/model.UserTokenList'
+                  $ref: '#/definitions/model.UserTokenSafeList'
               type: object
         "500":
           description: Internal Server Error
@@ -4008,9 +5733,8 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - token: []
-      summary: 登录凭证列表
       tags:
-      - 登录凭证
+      - ""
 securityDefinitions:
   BearerAuth:
     in: header
diff --git a/api/docs/api/api_docs.go b/api/docs/api/api_docs.go
index 94d7706..79bc7c4 100644
--- a/api/docs/api/api_docs.go
+++ b/api/docs/api/api_docs.go
@@ -17,7 +17,6 @@ const docTemplateapi = `{
     "paths": {
         "/": {
             "get": {
-                "description": "首页",
                 "consumes": [
                     "application/json"
                 ],
@@ -25,9 +24,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "首页"
+                    ""
                 ],
-                "summary": "首页",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -51,7 +49,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "地址列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -59,9 +56,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址"
+                    ""
                 ],
-                "summary": "地址列表",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -83,7 +79,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "地址更新",
                 "consumes": [
                     "application/json"
                 ],
@@ -91,12 +86,11 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址"
+                    ""
                 ],
-                "summary": "地址更新",
                 "parameters": [
                     {
-                        "description": "地址表单",
+                        "description": "Address book request form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -128,7 +122,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "添加地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -136,9 +129,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "添加地址",
                 "parameters": [
                     {
                         "type": "string",
@@ -162,14 +154,15 @@ const docTemplateapi = `{
                         }
                     }
                 }
-            },
-            "delete": {
+            }
+        },
+        "/ab/peer/update/{guid}": {
+            "put": {
                 "security": [
                     {
                         "BearerAuth": []
                     }
                 ],
-                "description": "删除地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -177,9 +170,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "删除地址",
                 "parameters": [
                     {
                         "type": "string",
@@ -205,14 +197,13 @@ const docTemplateapi = `{
                 }
             }
         },
-        "/ab/peer/update/{guid}": {
-            "put": {
+        "/ab/peer/{guid}": {
+            "delete": {
                 "security": [
                     {
                         "BearerAuth": []
                     }
                 ],
-                "description": "更新地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -220,9 +211,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "更新地址",
                 "parameters": [
                     {
                         "type": "string",
@@ -255,7 +245,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -263,19 +252,18 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "地址列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Current page number for address book peers",
                         "name": "current",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Page size for address book peers",
                         "name": "pageSize",
                         "in": "query"
                     },
@@ -309,7 +297,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "个人地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -317,9 +304,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "个人地址",
                 "parameters": [
                     {
                         "description": "string valid",
@@ -353,7 +339,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "设置",
                 "consumes": [
                     "application/json"
                 ],
@@ -361,9 +346,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "设置",
                 "parameters": [
                     {
                         "description": "string valid",
@@ -397,7 +381,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "共享",
                 "consumes": [
                     "application/json"
                 ],
@@ -405,19 +388,18 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "共享地址簿",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Current page number for shared profiles",
                         "name": "current",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Page size for shared profiles",
                         "name": "pageSize",
                         "in": "query"
                     }
@@ -445,7 +427,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -453,9 +434,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签添加",
                 "parameters": [
                     {
                         "type": "string",
@@ -488,7 +468,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -496,9 +475,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签重命名",
                 "parameters": [
                     {
                         "type": "string",
@@ -531,7 +509,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -539,9 +516,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签修改颜色",
                 "parameters": [
                     {
                         "type": "string",
@@ -574,7 +550,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -582,9 +557,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签删除",
                 "parameters": [
                     {
                         "type": "string",
@@ -617,7 +591,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -625,9 +598,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签",
                 "parameters": [
                     {
                         "type": "string",
@@ -655,7 +627,6 @@ const docTemplateapi = `{
         },
         "/audit/conn": {
             "post": {
-                "description": "审计连接",
                 "consumes": [
                     "application/json"
                 ],
@@ -663,12 +634,11 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "审计"
+                    ""
                 ],
-                "summary": "审计连接",
                 "parameters": [
                     {
-                        "description": "审计连接",
+                        "description": "Audit connection form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -695,7 +665,6 @@ const docTemplateapi = `{
         },
         "/audit/file": {
             "post": {
-                "description": "审计文件",
                 "consumes": [
                     "application/json"
                 ],
@@ -703,12 +672,11 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "审计"
+                    ""
                 ],
-                "summary": "审计文件",
                 "parameters": [
                     {
-                        "description": "审计文件",
+                        "description": "Audit file form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -734,13 +702,13 @@ const docTemplateapi = `{
             }
         },
         "/currentUser": {
-            "get": {
+            "post": {
                 "security": [
                     {
-                        "token": []
+                        "BearerAuth": []
                     }
                 ],
-                "description": "用户信息",
+                "description": "Returns the authenticated user for Rust client API requests.",
                 "consumes": [
                     "application/json"
                 ],
@@ -748,9 +716,9 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    "User"
                 ],
-                "summary": "用户信息",
+                "summary": "Get the current Rust client user",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -774,7 +742,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "机器",
                 "consumes": [
                     "application/json"
                 ],
@@ -782,25 +749,24 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    ""
                 ],
-                "summary": "设备",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the group list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Number of groups per page",
                         "name": "pageSize",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "状态",
+                        "description": "Group status filter",
                         "name": "status",
                         "in": "query"
                     },
@@ -829,7 +795,6 @@ const docTemplateapi = `{
         },
         "/heartbeat": {
             "post": {
-                "description": "心跳",
                 "consumes": [
                     "application/json"
                 ],
@@ -837,9 +802,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "首页"
+                    ""
                 ],
-                "summary": "心跳",
                 "responses": {
                     "200": {
                         "description": "OK"
@@ -855,7 +819,6 @@ const docTemplateapi = `{
         },
         "/login": {
             "post": {
-                "description": "登录",
                 "consumes": [
                     "application/json"
                 ],
@@ -863,12 +826,11 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    ""
                 ],
-                "summary": "登录",
                 "parameters": [
                     {
-                        "description": "登录表单",
+                        "description": "Login credentials payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -895,7 +857,6 @@ const docTemplateapi = `{
         },
         "/login-options": {
             "get": {
-                "description": "登录选项",
                 "consumes": [
                     "application/json"
                 ],
@@ -903,9 +864,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    ""
                 ],
-                "summary": "登录选项",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -927,7 +887,11 @@ const docTemplateapi = `{
         },
         "/logout": {
             "post": {
-                "description": "登出",
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
                 "consumes": [
                     "application/json"
                 ],
@@ -935,9 +899,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    ""
                 ],
-                "summary": "登出",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -954,9 +917,113 @@ const docTemplateapi = `{
                 }
             }
         },
+        "/oauth/callback": {
+            "get": {
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
+                "produces": [
+                    "text/html"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Handle the OIDC provider callback",
+                "responses": {
+                    "200": {
+                        "description": "Rendered OAuth success or failure HTML page",
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
+                        "schema": {
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oauth/login": {
+            "get": {
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
+                "produces": [
+                    "text/html"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Handle the OIDC provider callback",
+                "responses": {
+                    "200": {
+                        "description": "Rendered OAuth success or failure HTML page",
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
+                        "schema": {
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oauth/msg": {
+            "get": {
+                "description": "Returns JavaScript with localized title and message assignments when the corresponding query parameters are supplied.",
+                "produces": [
+                    "application/javascript"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Get localized OAuth message script",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Localization language",
+                        "name": "lang",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized title message ID",
+                        "name": "title",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized body message ID",
+                        "name": "msg",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "JavaScript response",
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                }
+            }
+        },
         "/oidc/auth": {
             "post": {
-                "description": "OidcAuth",
+                "description": "Starts OIDC authorization and returns the provider URL with the state code used by the follow-up query.",
                 "consumes": [
                     "application/json"
                 ],
@@ -966,16 +1033,19 @@ const docTemplateapi = `{
                 "tags": [
                     "Oauth"
                 ],
-                "summary": "OidcAuth",
+                "summary": "Start OIDC authorization",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Authorization state code and provider URL",
                         "schema": {
-                            "$ref": "#/definitions/api.LoginRes"
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "string"
+                            }
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "400": {
+                        "description": "OIDC authorization could not be started",
                         "schema": {
                             "$ref": "#/definitions/response.ErrorResponse"
                         }
@@ -985,17 +1055,14 @@ const docTemplateapi = `{
         },
         "/oidc/auth-query": {
             "get": {
-                "description": "OidcAuthQuery",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Exchanges the OIDC state code and provider callback values for the Rust client login response.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "Oauth"
                 ],
-                "summary": "OidcAuthQuery",
+                "summary": "Complete OIDC authorization",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1003,8 +1070,8 @@ const docTemplateapi = `{
                             "$ref": "#/definitions/api.LoginRes"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "400": {
+                        "description": "OIDC authorization query failed",
                         "schema": {
                             "$ref": "#/definitions/response.ErrorResponse"
                         }
@@ -1014,28 +1081,103 @@ const docTemplateapi = `{
         },
         "/oidc/callback": {
             "get": {
-                "description": "OauthCallback",
-                "consumes": [
-                    "application/json"
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
+                "produces": [
+                    "text/html"
+                ],
+                "tags": [
+                    "Oauth"
                 ],
+                "summary": "Handle the OIDC provider callback",
+                "responses": {
+                    "200": {
+                        "description": "Rendered OAuth success or failure HTML page",
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
+                        "schema": {
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oidc/login": {
+            "get": {
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
                 "produces": [
-                    "application/json"
+                    "text/html"
                 ],
                 "tags": [
                     "Oauth"
                 ],
-                "summary": "OauthCallback",
+                "summary": "Handle the OIDC provider callback",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Rendered OAuth success or failure HTML page",
                         "schema": {
-                            "$ref": "#/definitions/api.LoginRes"
+                            "type": "string"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
                         "schema": {
-                            "$ref": "#/definitions/response.ErrorResponse"
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oidc/msg": {
+            "get": {
+                "description": "Returns JavaScript with localized title and message assignments when the corresponding query parameters are supplied.",
+                "produces": [
+                    "application/javascript"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Get localized OAuth message script",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Localization language",
+                        "name": "lang",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized title message ID",
+                        "name": "title",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized body message ID",
+                        "name": "msg",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "JavaScript response",
+                        "schema": {
+                            "type": "string"
                         }
                     }
                 }
@@ -1048,7 +1190,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "机器",
                 "consumes": [
                     "application/json"
                 ],
@@ -1056,25 +1197,24 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    ""
                 ],
-                "summary": "机器",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the peer list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Number of peers per page",
                         "name": "pageSize",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "状态",
+                        "description": "Peer status filter",
                         "name": "status",
                         "in": "query"
                     },
@@ -1102,13 +1242,13 @@ const docTemplateapi = `{
             }
         },
         "/server-config": {
-            "get": {
+            "post": {
                 "security": [
                     {
-                        "token": []
+                        "BearerAuth": []
                     }
                 ],
-                "description": "服务配置,给webclient提供api-server",
+                "description": "Returns the ID server, public key, and the current user's web-client peers.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1118,7 +1258,7 @@ const docTemplateapi = `{
                 "tags": [
                     "WEBCLIENT"
                 ],
-                "summary": "服务配置",
+                "summary": "Get web-client server configuration",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1136,13 +1276,13 @@ const docTemplateapi = `{
             }
         },
         "/server-config-v2": {
-            "get": {
+            "post": {
                 "security": [
                     {
-                        "token": []
+                        "BearerAuth": []
                     }
                 ],
-                "description": "服务配置,给webclient提供api-server",
+                "description": "Returns the ID server and public key for the authenticated web-client request.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1152,7 +1292,7 @@ const docTemplateapi = `{
                 "tags": [
                     "WEBCLIENT_V2"
                 ],
-                "summary": "服务配置",
+                "summary": "Get web-client server configuration v2",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1171,7 +1311,7 @@ const docTemplateapi = `{
         },
         "/shared-peer": {
             "post": {
-                "description": "分享的peer",
+                "description": "peer",
                 "consumes": [
                     "application/json"
                 ],
@@ -1181,7 +1321,7 @@ const docTemplateapi = `{
                 "tags": [
                     "WEBCLIENT"
                 ],
-                "summary": "分享的peer",
+                "summary": "peer",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1200,7 +1340,6 @@ const docTemplateapi = `{
         },
         "/sysinfo": {
             "post": {
-                "description": "提交系统信息",
                 "consumes": [
                     "application/json"
                 ],
@@ -1210,10 +1349,9 @@ const docTemplateapi = `{
                 "tags": [
                     "System"
                 ],
-                "summary": "提交系统信息",
                 "parameters": [
                     {
-                        "description": "系统信息表单",
+                        "description": "Peer request form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1240,7 +1378,6 @@ const docTemplateapi = `{
         },
         "/sysinfo_ver": {
             "post": {
-                "description": "获取系统版本信息",
                 "consumes": [
                     "application/json"
                 ],
@@ -1250,7 +1387,6 @@ const docTemplateapi = `{
                 "tags": [
                     "System"
                 ],
-                "summary": "获取系统版本信息",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1267,6 +1403,40 @@ const docTemplateapi = `{
                 }
             }
         },
+        "/user/info": {
+            "get": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "Returns the authenticated user for Rust client API requests.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "Get the current Rust client user",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.UserPayload"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/users": {
             "get": {
                 "security": [
@@ -1274,7 +1444,6 @@ const docTemplateapi = `{
                         "BearerAuth": []
                     }
                 ],
-                "description": "用户列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -1282,25 +1451,24 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    ""
                 ],
-                "summary": "用户列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the user list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Number of users per page",
                         "name": "pageSize",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "状态",
+                        "description": "User status filter",
                         "name": "status",
                         "in": "query"
                     },
@@ -1344,7 +1512,6 @@ const docTemplateapi = `{
         },
         "/version": {
             "get": {
-                "description": "版本",
                 "consumes": [
                     "application/json"
                 ],
@@ -1352,9 +1519,8 @@ const docTemplateapi = `{
                     "application/json"
                 ],
                 "tags": [
-                    "首页"
+                    ""
                 ],
-                "summary": "版本",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1593,7 +1759,7 @@ const docTemplateapi = `{
                     "type": "integer"
                 },
                 "color": {
-                    "description": "color 是flutter的颜色值,从0x00000000 到 0xFFFFFFFF; 前两位表示透明度，后面6位表示颜色, 可以转成rgba",
+                    "description": "color flutter,0x00000000  0xFFFFFFFF; ，6, rgba",
                     "type": "integer"
                 },
                 "created_at": {
@@ -1683,8 +1849,8 @@ var SwaggerInfoapi = &swag.Spec{
 	Host:             "",
 	BasePath:         "/api",
 	Schemes:          []string{},
-	Title:            "管理系统API",
-	Description:      "接口",
+	Title:            "API",
+	Description:      "",
 	InfoInstanceName: "api",
 	SwaggerTemplate:  docTemplateapi,
 	LeftDelim:        "{{",
diff --git a/api/docs/api/api_swagger.json b/api/docs/api/api_swagger.json
index 9b50955..cffc30c 100644
--- a/api/docs/api/api_swagger.json
+++ b/api/docs/api/api_swagger.json
@@ -1,8 +1,7 @@
 {
     "swagger": "2.0",
     "info": {
-        "description": "接口",
-        "title": "管理系统API",
+        "title": "API",
         "contact": {},
         "version": "1.0"
     },
@@ -10,7 +9,6 @@
     "paths": {
         "/": {
             "get": {
-                "description": "首页",
                 "consumes": [
                     "application/json"
                 ],
@@ -18,9 +16,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "首页"
+                    ""
                 ],
-                "summary": "首页",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -44,7 +41,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "地址列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -52,9 +48,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址"
+                    ""
                 ],
-                "summary": "地址列表",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -76,7 +71,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "地址更新",
                 "consumes": [
                     "application/json"
                 ],
@@ -84,12 +78,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址"
+                    ""
                 ],
-                "summary": "地址更新",
                 "parameters": [
                     {
-                        "description": "地址表单",
+                        "description": "Address book request form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -121,7 +114,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "添加地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -129,9 +121,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "添加地址",
                 "parameters": [
                     {
                         "type": "string",
@@ -155,14 +146,15 @@
                         }
                     }
                 }
-            },
-            "delete": {
+            }
+        },
+        "/ab/peer/update/{guid}": {
+            "put": {
                 "security": [
                     {
                         "BearerAuth": []
                     }
                 ],
-                "description": "删除地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -170,9 +162,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "删除地址",
                 "parameters": [
                     {
                         "type": "string",
@@ -198,14 +189,13 @@
                 }
             }
         },
-        "/ab/peer/update/{guid}": {
-            "put": {
+        "/ab/peer/{guid}": {
+            "delete": {
                 "security": [
                     {
                         "BearerAuth": []
                     }
                 ],
-                "description": "更新地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -213,9 +203,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "更新地址",
                 "parameters": [
                     {
                         "type": "string",
@@ -248,7 +237,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -256,19 +244,18 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "地址列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Current page number for address book peers",
                         "name": "current",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Page size for address book peers",
                         "name": "pageSize",
                         "in": "query"
                     },
@@ -302,7 +289,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "个人地址",
                 "consumes": [
                     "application/json"
                 ],
@@ -310,9 +296,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "个人地址",
                 "parameters": [
                     {
                         "description": "string valid",
@@ -346,7 +331,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "设置",
                 "consumes": [
                     "application/json"
                 ],
@@ -354,9 +338,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "设置",
                 "parameters": [
                     {
                         "description": "string valid",
@@ -390,7 +373,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "共享",
                 "consumes": [
                     "application/json"
                 ],
@@ -398,19 +380,18 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "共享地址簿",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Current page number for shared profiles",
                         "name": "current",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Page size for shared profiles",
                         "name": "pageSize",
                         "in": "query"
                     }
@@ -438,7 +419,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -446,9 +426,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签添加",
                 "parameters": [
                     {
                         "type": "string",
@@ -481,7 +460,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -489,9 +467,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签重命名",
                 "parameters": [
                     {
                         "type": "string",
@@ -524,7 +501,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -532,9 +508,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签修改颜色",
                 "parameters": [
                     {
                         "type": "string",
@@ -567,7 +542,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -575,9 +549,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签删除",
                 "parameters": [
                     {
                         "type": "string",
@@ -610,7 +583,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "标签",
                 "consumes": [
                     "application/json"
                 ],
@@ -618,9 +590,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "地址[Personal]"
+                    "[Personal]"
                 ],
-                "summary": "标签",
                 "parameters": [
                     {
                         "type": "string",
@@ -648,7 +619,6 @@
         },
         "/audit/conn": {
             "post": {
-                "description": "审计连接",
                 "consumes": [
                     "application/json"
                 ],
@@ -656,12 +626,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "审计"
+                    ""
                 ],
-                "summary": "审计连接",
                 "parameters": [
                     {
-                        "description": "审计连接",
+                        "description": "Audit connection form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -688,7 +657,6 @@
         },
         "/audit/file": {
             "post": {
-                "description": "审计文件",
                 "consumes": [
                     "application/json"
                 ],
@@ -696,12 +664,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "审计"
+                    ""
                 ],
-                "summary": "审计文件",
                 "parameters": [
                     {
-                        "description": "审计文件",
+                        "description": "Audit file form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -727,13 +694,13 @@
             }
         },
         "/currentUser": {
-            "get": {
+            "post": {
                 "security": [
                     {
-                        "token": []
+                        "BearerAuth": []
                     }
                 ],
-                "description": "用户信息",
+                "description": "Returns the authenticated user for Rust client API requests.",
                 "consumes": [
                     "application/json"
                 ],
@@ -741,9 +708,9 @@
                     "application/json"
                 ],
                 "tags": [
-                    "用户"
+                    "User"
                 ],
-                "summary": "用户信息",
+                "summary": "Get the current Rust client user",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -767,7 +734,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "机器",
                 "consumes": [
                     "application/json"
                 ],
@@ -775,25 +741,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    ""
                 ],
-                "summary": "设备",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the group list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Number of groups per page",
                         "name": "pageSize",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "状态",
+                        "description": "Group status filter",
                         "name": "status",
                         "in": "query"
                     },
@@ -822,7 +787,6 @@
         },
         "/heartbeat": {
             "post": {
-                "description": "心跳",
                 "consumes": [
                     "application/json"
                 ],
@@ -830,9 +794,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "首页"
+                    ""
                 ],
-                "summary": "心跳",
                 "responses": {
                     "200": {
                         "description": "OK"
@@ -848,7 +811,6 @@
         },
         "/login": {
             "post": {
-                "description": "登录",
                 "consumes": [
                     "application/json"
                 ],
@@ -856,12 +818,11 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    ""
                 ],
-                "summary": "登录",
                 "parameters": [
                     {
-                        "description": "登录表单",
+                        "description": "Login credentials payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -888,7 +849,6 @@
         },
         "/login-options": {
             "get": {
-                "description": "登录选项",
                 "consumes": [
                     "application/json"
                 ],
@@ -896,9 +856,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    ""
                 ],
-                "summary": "登录选项",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -920,7 +879,11 @@
         },
         "/logout": {
             "post": {
-                "description": "登出",
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
                 "consumes": [
                     "application/json"
                 ],
@@ -928,9 +891,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "登录"
+                    ""
                 ],
-                "summary": "登出",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -947,9 +909,113 @@
                 }
             }
         },
+        "/oauth/callback": {
+            "get": {
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
+                "produces": [
+                    "text/html"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Handle the OIDC provider callback",
+                "responses": {
+                    "200": {
+                        "description": "Rendered OAuth success or failure HTML page",
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
+                        "schema": {
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oauth/login": {
+            "get": {
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
+                "produces": [
+                    "text/html"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Handle the OIDC provider callback",
+                "responses": {
+                    "200": {
+                        "description": "Rendered OAuth success or failure HTML page",
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
+                        "schema": {
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oauth/msg": {
+            "get": {
+                "description": "Returns JavaScript with localized title and message assignments when the corresponding query parameters are supplied.",
+                "produces": [
+                    "application/javascript"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Get localized OAuth message script",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Localization language",
+                        "name": "lang",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized title message ID",
+                        "name": "title",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized body message ID",
+                        "name": "msg",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "JavaScript response",
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                }
+            }
+        },
         "/oidc/auth": {
             "post": {
-                "description": "OidcAuth",
+                "description": "Starts OIDC authorization and returns the provider URL with the state code used by the follow-up query.",
                 "consumes": [
                     "application/json"
                 ],
@@ -959,16 +1025,19 @@
                 "tags": [
                     "Oauth"
                 ],
-                "summary": "OidcAuth",
+                "summary": "Start OIDC authorization",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Authorization state code and provider URL",
                         "schema": {
-                            "$ref": "#/definitions/api.LoginRes"
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "string"
+                            }
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "400": {
+                        "description": "OIDC authorization could not be started",
                         "schema": {
                             "$ref": "#/definitions/response.ErrorResponse"
                         }
@@ -978,17 +1047,14 @@
         },
         "/oidc/auth-query": {
             "get": {
-                "description": "OidcAuthQuery",
-                "consumes": [
-                    "application/json"
-                ],
+                "description": "Exchanges the OIDC state code and provider callback values for the Rust client login response.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "Oauth"
                 ],
-                "summary": "OidcAuthQuery",
+                "summary": "Complete OIDC authorization",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -996,8 +1062,8 @@
                             "$ref": "#/definitions/api.LoginRes"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "400": {
+                        "description": "OIDC authorization query failed",
                         "schema": {
                             "$ref": "#/definitions/response.ErrorResponse"
                         }
@@ -1007,28 +1073,103 @@
         },
         "/oidc/callback": {
             "get": {
-                "description": "OauthCallback",
-                "consumes": [
-                    "application/json"
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
+                "produces": [
+                    "text/html"
+                ],
+                "tags": [
+                    "Oauth"
                 ],
+                "summary": "Handle the OIDC provider callback",
+                "responses": {
+                    "200": {
+                        "description": "Rendered OAuth success or failure HTML page",
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
+                        "schema": {
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oidc/login": {
+            "get": {
+                "description": "Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.",
                 "produces": [
-                    "application/json"
+                    "text/html"
                 ],
                 "tags": [
                     "Oauth"
                 ],
-                "summary": "OauthCallback",
+                "summary": "Handle the OIDC provider callback",
                 "responses": {
                     "200": {
-                        "description": "OK",
+                        "description": "Rendered OAuth success or failure HTML page",
                         "schema": {
-                            "$ref": "#/definitions/api.LoginRes"
+                            "type": "string"
                         }
                     },
-                    "500": {
-                        "description": "Internal Server Error",
+                    "302": {
+                        "description": "Redirect to the admin OAuth binding or app route",
                         "schema": {
-                            "$ref": "#/definitions/response.ErrorResponse"
+                            "type": "string"
+                        },
+                        "headers": {
+                            "Location": {
+                                "type": "string",
+                                "description": "Admin OAuth binding or app redirect target"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/oidc/msg": {
+            "get": {
+                "description": "Returns JavaScript with localized title and message assignments when the corresponding query parameters are supplied.",
+                "produces": [
+                    "application/javascript"
+                ],
+                "tags": [
+                    "Oauth"
+                ],
+                "summary": "Get localized OAuth message script",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Localization language",
+                        "name": "lang",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized title message ID",
+                        "name": "title",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Localized body message ID",
+                        "name": "msg",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "JavaScript response",
+                        "schema": {
+                            "type": "string"
                         }
                     }
                 }
@@ -1041,7 +1182,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "机器",
                 "consumes": [
                     "application/json"
                 ],
@@ -1049,25 +1189,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    ""
                 ],
-                "summary": "机器",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the peer list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Number of peers per page",
                         "name": "pageSize",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "状态",
+                        "description": "Peer status filter",
                         "name": "status",
                         "in": "query"
                     },
@@ -1095,13 +1234,13 @@
             }
         },
         "/server-config": {
-            "get": {
+            "post": {
                 "security": [
                     {
-                        "token": []
+                        "BearerAuth": []
                     }
                 ],
-                "description": "服务配置,给webclient提供api-server",
+                "description": "Returns the ID server, public key, and the current user's web-client peers.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1111,7 +1250,7 @@
                 "tags": [
                     "WEBCLIENT"
                 ],
-                "summary": "服务配置",
+                "summary": "Get web-client server configuration",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1129,13 +1268,13 @@
             }
         },
         "/server-config-v2": {
-            "get": {
+            "post": {
                 "security": [
                     {
-                        "token": []
+                        "BearerAuth": []
                     }
                 ],
-                "description": "服务配置,给webclient提供api-server",
+                "description": "Returns the ID server and public key for the authenticated web-client request.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1145,7 +1284,7 @@
                 "tags": [
                     "WEBCLIENT_V2"
                 ],
-                "summary": "服务配置",
+                "summary": "Get web-client server configuration v2",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1164,7 +1303,7 @@
         },
         "/shared-peer": {
             "post": {
-                "description": "分享的peer",
+                "description": "peer",
                 "consumes": [
                     "application/json"
                 ],
@@ -1174,7 +1313,7 @@
                 "tags": [
                     "WEBCLIENT"
                 ],
-                "summary": "分享的peer",
+                "summary": "peer",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1193,7 +1332,6 @@
         },
         "/sysinfo": {
             "post": {
-                "description": "提交系统信息",
                 "consumes": [
                     "application/json"
                 ],
@@ -1203,10 +1341,9 @@
                 "tags": [
                     "System"
                 ],
-                "summary": "提交系统信息",
                 "parameters": [
                     {
-                        "description": "系统信息表单",
+                        "description": "Peer request form payload",
                         "name": "body",
                         "in": "body",
                         "required": true,
@@ -1233,7 +1370,6 @@
         },
         "/sysinfo_ver": {
             "post": {
-                "description": "获取系统版本信息",
                 "consumes": [
                     "application/json"
                 ],
@@ -1243,7 +1379,6 @@
                 "tags": [
                     "System"
                 ],
-                "summary": "获取系统版本信息",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1260,6 +1395,40 @@
                 }
             }
         },
+        "/user/info": {
+            "get": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "Returns the authenticated user for Rust client API requests.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "User"
+                ],
+                "summary": "Get the current Rust client user",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.UserPayload"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/response.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/users": {
             "get": {
                 "security": [
@@ -1267,7 +1436,6 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "用户列表",
                 "consumes": [
                     "application/json"
                 ],
@@ -1275,25 +1443,24 @@
                     "application/json"
                 ],
                 "tags": [
-                    "群组"
+                    ""
                 ],
-                "summary": "用户列表",
                 "parameters": [
                     {
                         "type": "integer",
-                        "description": "页码",
+                        "description": "Page number for the user list",
                         "name": "page",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "每页数量",
+                        "description": "Number of users per page",
                         "name": "pageSize",
                         "in": "query"
                     },
                     {
                         "type": "integer",
-                        "description": "状态",
+                        "description": "User status filter",
                         "name": "status",
                         "in": "query"
                     },
@@ -1337,7 +1504,6 @@
         },
         "/version": {
             "get": {
-                "description": "版本",
                 "consumes": [
                     "application/json"
                 ],
@@ -1345,9 +1511,8 @@
                     "application/json"
                 ],
                 "tags": [
-                    "首页"
+                    ""
                 ],
-                "summary": "版本",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -1586,7 +1751,7 @@
                     "type": "integer"
                 },
                 "color": {
-                    "description": "color 是flutter的颜色值,从0x00000000 到 0xFFFFFFFF; 前两位表示透明度，后面6位表示颜色, 可以转成rgba",
+                    "description": "color flutter,0x00000000  0xFFFFFFFF; ，6, rgba",
                     "type": "integer"
                 },
                 "created_at": {
diff --git a/api/docs/api/api_swagger.yaml b/api/docs/api/api_swagger.yaml
index a654e33..8303ad4 100644
--- a/api/docs/api/api_swagger.yaml
+++ b/api/docs/api/api_swagger.yaml
@@ -146,8 +146,7 @@ definitions:
       collection_id:
         type: integer
       color:
-        description: color 是flutter的颜色值,从0x00000000 到 0xFFFFFFFF; 前两位表示透明度，后面6位表示颜色,
-          可以转成rgba
+        description: color flutter,0x00000000  0xFFFFFFFF; ，6, rgba
         type: integer
       created_at:
         type: string
@@ -194,15 +193,13 @@ definitions:
     type: object
 info:
   contact: {}
-  description: 接口
-  title: 管理系统API
+  title: API
   version: "1.0"
 paths:
   /:
     get:
       consumes:
       - application/json
-      description: 首页
       produces:
       - application/json
       responses:
@@ -214,14 +211,12 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 首页
       tags:
-      - 首页
+      - ""
   /ab:
     get:
       consumes:
       - application/json
-      description: 地址列表
       produces:
       - application/json
       responses:
@@ -235,15 +230,13 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 地址列表
       tags:
-      - 地址
+      - ""
     post:
       consumes:
       - application/json
-      description: 地址更新
       parameters:
-      - description: 地址表单
+      - description: Address book request form payload
         in: body
         name: body
         required: true
@@ -262,14 +255,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 地址更新
       tags:
-      - 地址
-  /ab/peer/add/{guid}:
+      - ""
+  /ab/peer/{guid}:
     delete:
       consumes:
       - application/json
-      description: 删除地址
       parameters:
       - description: guid
         in: path
@@ -289,13 +280,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 删除地址
       tags:
-      - 地址[Personal]
+      - '[Personal]'
+  /ab/peer/add/{guid}:
     post:
       consumes:
       - application/json
-      description: 添加地址
       parameters:
       - description: guid
         in: path
@@ -315,14 +305,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 添加地址
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/peer/update/{guid}:
     put:
       consumes:
       - application/json
-      description: 更新地址
       parameters:
       - description: guid
         in: path
@@ -342,20 +330,18 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 更新地址
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/peers:
     post:
       consumes:
       - application/json
-      description: 地址
       parameters:
-      - description: 页码
+      - description: Current page number for address book peers
         in: query
         name: current
         type: integer
-      - description: 每页数量
+      - description: Page size for address book peers
         in: query
         name: pageSize
         type: integer
@@ -376,14 +362,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - BearerAuth: []
-      summary: 地址列表
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/personal:
     post:
       consumes:
       - application/json
-      description: 个人地址
       parameters:
       - description: string valid
         in: body
@@ -403,14 +387,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - BearerAuth: []
-      summary: 个人地址
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/settings:
     post:
       consumes:
       - application/json
-      description: 设置
       parameters:
       - description: string valid
         in: body
@@ -430,20 +412,18 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - BearerAuth: []
-      summary: 设置
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/shared/profiles:
     post:
       consumes:
       - application/json
-      description: 共享
       parameters:
-      - description: 页码
+      - description: Current page number for shared profiles
         in: query
         name: current
         type: integer
-      - description: 每页数量
+      - description: Page size for shared profiles
         in: query
         name: pageSize
         type: integer
@@ -460,14 +440,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - BearerAuth: []
-      summary: 共享地址簿
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/tag/{guid}:
     delete:
       consumes:
       - application/json
-      description: 标签
       parameters:
       - description: guid
         in: path
@@ -487,14 +465,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 标签删除
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/tag/add/{guid}:
     post:
       consumes:
       - application/json
-      description: 标签
       parameters:
       - description: guid
         in: path
@@ -514,14 +490,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 标签添加
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/tag/rename/{guid}:
     put:
       consumes:
       - application/json
-      description: 标签
       parameters:
       - description: guid
         in: path
@@ -541,14 +515,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 标签重命名
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/tag/update/{guid}:
     put:
       consumes:
       - application/json
-      description: 标签
       parameters:
       - description: guid
         in: path
@@ -568,14 +540,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 标签修改颜色
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /ab/tags/{guid}:
     post:
       consumes:
       - application/json
-      description: 标签
       parameters:
       - description: guid
         in: path
@@ -595,16 +565,14 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 标签
       tags:
-      - 地址[Personal]
+      - '[Personal]'
   /audit/conn:
     post:
       consumes:
       - application/json
-      description: 审计连接
       parameters:
-      - description: 审计连接
+      - description: Audit connection form payload
         in: body
         name: body
         required: true
@@ -621,16 +589,14 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 审计连接
       tags:
-      - 审计
+      - ""
   /audit/file:
     post:
       consumes:
       - application/json
-      description: 审计文件
       parameters:
-      - description: 审计文件
+      - description: Audit file form payload
         in: body
         name: body
         required: true
@@ -647,14 +613,13 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 审计文件
       tags:
-      - 审计
+      - ""
   /currentUser:
-    get:
+    post:
       consumes:
       - application/json
-      description: 用户信息
+      description: Returns the authenticated user for Rust client API requests.
       produces:
       - application/json
       responses:
@@ -667,25 +632,24 @@ paths:
           schema:
             $ref: '#/definitions/response.Response'
       security:
-      - token: []
-      summary: 用户信息
+      - BearerAuth: []
+      summary: Get the current Rust client user
       tags:
-      - 用户
+      - User
   /device-group/accessible:
     get:
       consumes:
       - application/json
-      description: 机器
       parameters:
-      - description: 页码
+      - description: Page number for the group list
         in: query
         name: page
         type: integer
-      - description: 每页数量
+      - description: Number of groups per page
         in: query
         name: pageSize
         type: integer
-      - description: 状态
+      - description: Group status filter
         in: query
         name: status
         type: integer
@@ -706,14 +670,12 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - BearerAuth: []
-      summary: 设备
       tags:
-      - 群组
+      - ""
   /heartbeat:
     post:
       consumes:
       - application/json
-      description: 心跳
       produces:
       - application/json
       responses:
@@ -723,16 +685,14 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 心跳
       tags:
-      - 首页
+      - ""
   /login:
     post:
       consumes:
       - application/json
-      description: 登录
       parameters:
-      - description: 登录表单
+      - description: Login credentials payload
         in: body
         name: body
         required: true
@@ -749,14 +709,12 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: 登录
       tags:
-      - 登录
+      - ""
   /login-options:
     get:
       consumes:
       - application/json
-      description: 登录选项
       produces:
       - application/json
       responses:
@@ -770,14 +728,12 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: 登录选项
       tags:
-      - 登录
+      - ""
   /logout:
     post:
       consumes:
       - application/json
-      description: 登出
       produces:
       - application/json
       responses:
@@ -789,33 +745,109 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: 登出
+      security:
+      - BearerAuth: []
       tags:
-      - 登录
+      - ""
+  /oauth/callback:
+    get:
+      description: Renders the success/failure HTML result pages or redirects to the
+        admin OAuth binding/app route. The same handler is registered for all four
+        callback aliases below.
+      produces:
+      - text/html
+      responses:
+        "200":
+          description: Rendered OAuth success or failure HTML page
+          schema:
+            type: string
+        "302":
+          description: Redirect to the admin OAuth binding or app route
+          headers:
+            Location:
+              description: Admin OAuth binding or app redirect target
+              type: string
+          schema:
+            type: string
+      summary: Handle the OIDC provider callback
+      tags:
+      - Oauth
+  /oauth/login:
+    get:
+      description: Renders the success/failure HTML result pages or redirects to the
+        admin OAuth binding/app route. The same handler is registered for all four
+        callback aliases below.
+      produces:
+      - text/html
+      responses:
+        "200":
+          description: Rendered OAuth success or failure HTML page
+          schema:
+            type: string
+        "302":
+          description: Redirect to the admin OAuth binding or app route
+          headers:
+            Location:
+              description: Admin OAuth binding or app redirect target
+              type: string
+          schema:
+            type: string
+      summary: Handle the OIDC provider callback
+      tags:
+      - Oauth
+  /oauth/msg:
+    get:
+      description: Returns JavaScript with localized title and message assignments
+        when the corresponding query parameters are supplied.
+      parameters:
+      - description: Localization language
+        in: query
+        name: lang
+        type: string
+      - description: Localized title message ID
+        in: query
+        name: title
+        type: string
+      - description: Localized body message ID
+        in: query
+        name: msg
+        type: string
+      produces:
+      - application/javascript
+      responses:
+        "200":
+          description: JavaScript response
+          schema:
+            type: string
+      summary: Get localized OAuth message script
+      tags:
+      - Oauth
   /oidc/auth:
     post:
       consumes:
       - application/json
-      description: OidcAuth
+      description: Starts OIDC authorization and returns the provider URL with the
+        state code used by the follow-up query.
       produces:
       - application/json
       responses:
         "200":
-          description: OK
+          description: Authorization state code and provider URL
           schema:
-            $ref: '#/definitions/api.LoginRes'
-        "500":
-          description: Internal Server Error
+            additionalProperties:
+              type: string
+            type: object
+        "400":
+          description: OIDC authorization could not be started
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: OidcAuth
+      summary: Start OIDC authorization
       tags:
       - Oauth
   /oidc/auth-query:
     get:
-      consumes:
-      - application/json
-      description: OidcAuthQuery
+      description: Exchanges the OIDC state code and provider callback values for
+        the Rust client login response.
       produces:
       - application/json
       responses:
@@ -823,47 +855,100 @@ paths:
           description: OK
           schema:
             $ref: '#/definitions/api.LoginRes'
-        "500":
-          description: Internal Server Error
+        "400":
+          description: OIDC authorization query failed
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: OidcAuthQuery
+      summary: Complete OIDC authorization
       tags:
       - Oauth
   /oidc/callback:
     get:
-      consumes:
-      - application/json
-      description: OauthCallback
+      description: Renders the success/failure HTML result pages or redirects to the
+        admin OAuth binding/app route. The same handler is registered for all four
+        callback aliases below.
       produces:
-      - application/json
+      - text/html
       responses:
         "200":
-          description: OK
+          description: Rendered OAuth success or failure HTML page
           schema:
-            $ref: '#/definitions/api.LoginRes'
-        "500":
-          description: Internal Server Error
+            type: string
+        "302":
+          description: Redirect to the admin OAuth binding or app route
+          headers:
+            Location:
+              description: Admin OAuth binding or app redirect target
+              type: string
           schema:
-            $ref: '#/definitions/response.ErrorResponse'
-      summary: OauthCallback
+            type: string
+      summary: Handle the OIDC provider callback
+      tags:
+      - Oauth
+  /oidc/login:
+    get:
+      description: Renders the success/failure HTML result pages or redirects to the
+        admin OAuth binding/app route. The same handler is registered for all four
+        callback aliases below.
+      produces:
+      - text/html
+      responses:
+        "200":
+          description: Rendered OAuth success or failure HTML page
+          schema:
+            type: string
+        "302":
+          description: Redirect to the admin OAuth binding or app route
+          headers:
+            Location:
+              description: Admin OAuth binding or app redirect target
+              type: string
+          schema:
+            type: string
+      summary: Handle the OIDC provider callback
+      tags:
+      - Oauth
+  /oidc/msg:
+    get:
+      description: Returns JavaScript with localized title and message assignments
+        when the corresponding query parameters are supplied.
+      parameters:
+      - description: Localization language
+        in: query
+        name: lang
+        type: string
+      - description: Localized title message ID
+        in: query
+        name: title
+        type: string
+      - description: Localized body message ID
+        in: query
+        name: msg
+        type: string
+      produces:
+      - application/javascript
+      responses:
+        "200":
+          description: JavaScript response
+          schema:
+            type: string
+      summary: Get localized OAuth message script
       tags:
       - Oauth
   /peers:
     get:
       consumes:
       - application/json
-      description: 机器
       parameters:
-      - description: 页码
+      - description: Page number for the peer list
         in: query
         name: page
         type: integer
-      - description: 每页数量
+      - description: Number of peers per page
         in: query
         name: pageSize
         type: integer
-      - description: 状态
+      - description: Peer status filter
         in: query
         name: status
         type: integer
@@ -884,14 +969,14 @@ paths:
             $ref: '#/definitions/response.Response'
       security:
       - BearerAuth: []
-      summary: 机器
       tags:
-      - 群组
+      - ""
   /server-config:
-    get:
+    post:
       consumes:
       - application/json
-      description: 服务配置,给webclient提供api-server
+      description: Returns the ID server, public key, and the current user's web-client
+        peers.
       produces:
       - application/json
       responses:
@@ -904,15 +989,16 @@ paths:
           schema:
             $ref: '#/definitions/response.Response'
       security:
-      - token: []
-      summary: 服务配置
+      - BearerAuth: []
+      summary: Get web-client server configuration
       tags:
       - WEBCLIENT
   /server-config-v2:
-    get:
+    post:
       consumes:
       - application/json
-      description: 服务配置,给webclient提供api-server
+      description: Returns the ID server and public key for the authenticated web-client
+        request.
       produces:
       - application/json
       responses:
@@ -925,15 +1011,15 @@ paths:
           schema:
             $ref: '#/definitions/response.Response'
       security:
-      - token: []
-      summary: 服务配置
+      - BearerAuth: []
+      summary: Get web-client server configuration v2
       tags:
       - WEBCLIENT_V2
   /shared-peer:
     post:
       consumes:
       - application/json
-      description: 分享的peer
+      description: peer
       produces:
       - application/json
       responses:
@@ -945,16 +1031,15 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 分享的peer
+      summary: peer
       tags:
       - WEBCLIENT
   /sysinfo:
     post:
       consumes:
       - application/json
-      description: 提交系统信息
       parameters:
-      - description: 系统信息表单
+      - description: Peer request form payload
         in: body
         name: body
         required: true
@@ -971,14 +1056,12 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: 提交系统信息
       tags:
       - System
   /sysinfo_ver:
     post:
       consumes:
       - application/json
-      description: 获取系统版本信息
       produces:
       - application/json
       responses:
@@ -990,24 +1073,43 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.ErrorResponse'
-      summary: 获取系统版本信息
       tags:
       - System
+  /user/info:
+    get:
+      consumes:
+      - application/json
+      description: Returns the authenticated user for Rust client API requests.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/api.UserPayload'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/response.Response'
+      security:
+      - BearerAuth: []
+      summary: Get the current Rust client user
+      tags:
+      - User
   /users:
     get:
       consumes:
       - application/json
-      description: 用户列表
       parameters:
-      - description: 页码
+      - description: Page number for the user list
         in: query
         name: page
         type: integer
-      - description: 每页数量
+      - description: Number of users per page
         in: query
         name: pageSize
         type: integer
-      - description: 状态
+      - description: User status filter
         in: query
         name: status
         type: integer
@@ -1035,14 +1137,12 @@ paths:
             $ref: '#/definitions/response.ErrorResponse'
       security:
       - BearerAuth: []
-      summary: 用户列表
       tags:
-      - 群组
+      - ""
   /version:
     get:
       consumes:
       - application/json
-      description: 版本
       produces:
       - application/json
       responses:
@@ -1054,9 +1154,8 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/response.Response'
-      summary: 版本
       tags:
-      - 首页
+      - ""
 securityDefinitions:
   BearerAuth:
     in: header
diff --git a/api/go.sum b/api/go.sum
new file mode 100644
index 0000000..b7cf55a
--- /dev/null
+++ b/api/go.sum
@@ -0,0 +1,1061 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
+cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
+cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
+cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
+cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
+cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
+cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
+cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
+cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
+cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
+cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
+cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
+cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
+cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
+cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
+cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
+cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
+cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
+cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
+cloud.google.com/go v0.93.3 h1:wPBktZFzYBcCZVARvwVKqH1uEj+aLXofJEtrb4oOsio=
+cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
+cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
+cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
+cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
+cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
+cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
+cloud.google.com/go/bigquery v1.8.0 h1:PQcPefKFdaIzjQFbiyOgAqyx8q5djaE7x9Sqe712DPA=
+cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
+cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
+cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
+cloud.google.com/go/datastore v1.1.0 h1:/May9ojXjRkPBNVrq+oWLqmWCkr4OU5uRY29bu0mRyQ=
+cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/firestore v1.6.0 h1:dMIWvm+3O0E3DM7kcZPH0FBQ94Xg/OMkdTNDaY9itbI=
+cloud.google.com/go/firestore v1.6.0/go.mod h1:afJwI0vaXwAG54kI7A//lP/lSPDkQORQuMkv56TxEPU=
+cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
+cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
+cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
+cloud.google.com/go/pubsub v1.3.1 h1:ukjixP1wl0LpnZ6LWtZJ0mX5tBmjp1f8Sqer8Z2OMUU=
+cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
+cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
+cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
+cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
+cloud.google.com/go/storage v1.10.0 h1:STgFzyU5/8miMl0//zKh2aQeTyeaUH3WN9bSUiJ09bA=
+cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9 h1:VpgP7xuJadIUuKccphEpTJnWhS2jkQyMt6Y7pJCD7fY=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802 h1:1BDTz0u9nC3//pOCMdNH+CiXJVYJh5UQNCOBG7jbELc=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
+github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
+github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/antonfisher/nested-logrus-formatter v1.3.1 h1:NFJIr+pzwv5QLHTPyKz9UMEoHck02Q9L0FP13b/xSbQ=
+github.com/antonfisher/nested-logrus-formatter v1.3.1/go.mod h1:6WTfyWFkBc9+zyBaKIqRrg/KwMqBbodBjgbHjDz7zjA=
+github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e h1:QEF07wC0T1rKkctt1RINW/+RMTVmiwxETico2l3gxJA=
+github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da h1:8GUt8eRujhVEGZFFEjBj46YV4rDjvGrNxb0KMWYkL2I=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
+github.com/bytedance/sonic v1.8.0 h1:ea0Xadu+sHlu7x5O3gKhRpQ1IKiMrSiHttPF0ybECuA=
+github.com/bytedance/sonic v1.8.0/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
+github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chenzhuoyu/base64x v0.0.0-20211019084208-fb5309c8db06/go.mod h1:DH46F32mSOjUmXrMHnKwZdA8wcEefY7UVqBKYGjpdQY=
+github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 h1:qSGYFH7+jGhDF8vLC+iwCD4WpbV1EBDSzWkJODFLams=
+github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583jCggY9gE99b6G5LEC39OIiVsWj+R97kbl5odCEk=
+github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4 h1:ta993UF76GwbvJcIo3Y68y/M3WxlpEHPWIGDkJYwzJI=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403 h1:cqQfy1jclcSy/FwLjemeg3SR1yaINm74aQyupQ0Bl8M=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed h1:OZmjad4L3H8ncOIR8rnb5MREYqG8ixi5+WbeUsquF0c=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/coreos/go-oidc/v3 v3.12.0 h1:sJk+8G2qq94rDI6ehZ71Bol3oUHy63qNYmkiSjrc/Jo=
+github.com/coreos/go-oidc/v3 v3.12.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
+github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
+github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9 h1:uDmaGzcdjhF4i/plgjmEsriH11Y0o7RKapEf/LDaM3w=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0 h1:dulLQAYQFYtG5MTplgNGHWuV2D+OBD+Z8lmDBmbLg+s=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/protoc-gen-validate v0.1.0 h1:EQciDnbrYxy13PgWoY8AqoxGiPrpgBZ1R8UNe3ddc+A=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.9.0 h1:8xPHl4/q1VyqGIPif1F+1V3Y3lSmrq01EabUW3CoW5s=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI=
+github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
+github.com/fvbock/endless v0.0.0-20170109170031-447134032cb6 h1:6VSn3hB5U5GeA6kQw4TwWIWbOhtvR2hmbBJnTOtqTWc=
+github.com/fvbock/endless v0.0.0-20170109170031-447134032cb6/go.mod h1:YxOVT5+yHzKvwhsiSIWmbAYM3Dr9AEEbER2dVayfBkg=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gin-contrib/gzip v0.0.6 h1:NjcunTcGAj5CO1gn4N8jHOSIeRFHIbn51z6K+xaN4d4=
+github.com/gin-contrib/gzip v0.0.6/go.mod h1:QOJlmV2xmayAjkNS2Y8NQsMneuRShOU/kjovCXNuzzk=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.9.0 h1:OjyFBKICoexlu99ctXNR2gg+c5pKrKMuyjgARg9qeY8=
+github.com/gin-gonic/gin v1.9.0/go.mod h1:W1Me9+hsUSyj3CePGrd1/QrKJMSJ1Tu/0hFEH89961k=
+github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
+github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1 h1:QbL/5oDUmRBzO9/Z7Seo6zf912W/a6Sr4Eu0G/3Jho0=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4 h1:WtGNWLvXpe6ZudgnXrq0barxBImvnnJoMEhXAzcbM0I=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
+github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
+github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU=
+github.com/go-ldap/ldap/v3 v3.4.10/go.mod h1:JXh4Uxgi40P6E9rdsYqpUtbW46D9UTjJ9QSwGRznplY=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.19.6 h1:UBIxjkht+AWIgYzCDSv2GN+E/togfwXUJFRTWhl2Jjs=
+github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
+github.com/go-openapi/spec v0.20.4 h1:O8hJrt0UMnhHcluhIdUgCLRWyM2x7QkBXRvOs7m+O1M=
+github.com/go-openapi/spec v0.20.4/go.mod h1:faYFR1CvsJZ0mNsmsphTMSoRrNV3TEDoAM7FOEWeq8I=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.15 h1:D2NRCBzS9/pEY3gP9Nl8aDqGUcPFrwG2p+CNFrLyrCM=
+github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k=
+github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
+github.com/go-redis/redis/v8 v8.11.4 h1:kHoYkfZP6+pe04aFTnhDH6GDROa5yJdHJVNxV3F46Tg=
+github.com/go-redis/redis/v8 v8.11.4/go.mod h1:2Z2wHZXdQpCDXEGzqMockDpNyYvi2l4Pxt6RJr792+w=
+github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc=
+github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/goccy/go-json v0.10.0 h1:mXKd9Qw4NuzShiRlOXKews24ufknHO7gx30lsDyokKA=
+github.com/goccy/go-json v0.10.0/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/godbus/dbus/v5 v5.0.4 h1:9349emZab16e7zQvpmsbtjc18ykshndd8y2PG3sgJbA=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
+github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
+github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
+github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.3 h1:fHPg5GQYlCeLIPB9BZqMVR5nR9A+IM5zcgeTdjMYmLA=
+github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.2.1 h1:d8MncMlErDFTwQGBK1xhv026j9kqhvw1Qv9IbWT1VLQ=
+github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gax-go/v2 v2.1.0 h1:6DWmvNpomjL1+3liNSZbVns3zsYzzCjm6pRBO1tLeso=
+github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
+github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/hashicorp/consul/api v1.10.1 h1:MwZJp86nlnL+6+W1Zly4JUuVn9YHhMggBirMpHGD7kw=
+github.com/hashicorp/consul/api v1.10.1/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
+github.com/hashicorp/consul/sdk v0.8.0 h1:OJtKBtEjboEZvG6AOUdh4Z1Zbyu0WcxQ0qatRrZHTVU=
+github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
+github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.1 h1:dH3aiDG9Jvb5r5+bYHsikaOUIpcM0xvgMXVoDkXMzJM=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-hclog v0.12.0 h1:d4QkX8FRTYaKaCZBoXYY8zJX2BXjWxurN/GA2tkrmZM=
+github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
+github.com/hashicorp/go-immutable-radix v1.0.0 h1:AKDB1HM5PWEA7i4nhcpwOrO2byshxBjXVn/J/3+z5/0=
+github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-msgpack v0.5.3 h1:zKjpN5BK/P5lMYrLmBHdBULWbJ0XpYR+7NGzqkZzoD4=
+github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
+github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-sockaddr v1.0.0 h1:GeH6tui99pF4NJgfnhp+L6+FfobzVW3Ah46sLo0ICXs=
+github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
+github.com/hashicorp/go-syslog v1.0.0 h1:KaodqZuhUoZereWVIYmpUgZysurB1kBLX2j0MwMrUAE=
+github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
+github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
+github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/mdns v1.0.1 h1:XFSOubp8KWB+Jd2PDyaX5xUd5bhSP/+pTDZVDMzZJM8=
+github.com/hashicorp/mdns v1.0.1/go.mod h1:4gW7WsVCke5TE7EPeYliwHlRUyBtfCwuFwuMg2DmyNY=
+github.com/hashicorp/memberlist v0.2.2 h1:5+RffWKwqJ71YPu9mWsF7ZOscZmwfasdA8kbdC7AO2g=
+github.com/hashicorp/memberlist v0.2.2/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
+github.com/hashicorp/serf v0.9.5 h1:EBWvyu9tcRszt3Bxp3KNssBMP1KuHWyO51lz9+786iM=
+github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639 h1:mV02weKRL81bEnm8A0HT1/CAelMQDBuQIfLw8n+d6xI=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
+github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jstemmer/go-junit-report v0.9.1 h1:6QPYqodiu3GuPL+7mfx+NwDdp2eTkp9IfEUpgAwUN0o=
+github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/kisielk/errcheck v1.5.0 h1:e8esj/e4R+SAOwFwN+n3zr0nYeCyeweozKfO23MvHzY=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pty v1.1.1 h1:VkoXIwSboBpnk99O/KFauAEILuNHv5DVFKZMBN/gUgw=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/magiconair/properties v1.8.5 h1:b6kJs+EmPFMYGkow9GiUyCyOvIwYetYJ3fSaWak/Gls=
+github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-sqlite3 v1.14.23 h1:gbShiuAP1W5j9UOksQ06aiiqPMxYecovVGwmTxWtuw0=
+github.com/mattn/go-sqlite3 v1.14.23/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/miekg/dns v1.1.26 h1:gPxPSwALAeHJSjarOs00QjVdV9QoBvc1D2ujQUr5BzU=
+github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
+github.com/mitchellh/cli v1.1.0 h1:tEElEatulEHDeedTxwckzyYMA5c86fbmNIUL1hBIiTg=
+github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.4.2 h1:6h7AQ0yhTcIsmFmnAwQls75jp2Gzs4iB8W7pjMO+rqo=
+github.com/mitchellh/mapstructure v1.4.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mojocn/base64Captcha v1.3.6 h1:gZEKu1nsKpttuIAQgWHO+4Mhhls8cAKyiV2Ew03H+Tw=
+github.com/mojocn/base64Captcha v1.3.6/go.mod h1:i5CtHvm+oMbj1UzEPXaA8IH/xHFZ3DGY3Wh3dBpZ28E=
+github.com/nicksnyder/go-i18n/v2 v2.4.0 h1:3IcvPOAvnCKwNm0TB0dLDTuawWEj+ax/RERNC+diLMM=
+github.com/nicksnyder/go-i18n/v2 v2.4.0/go.mod h1:nxYSZE9M0bf3Y70gPQjN9ha7XNHX7gMc814+6wVyEI4=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.16.0 h1:6gjqkI8iiRHMvdccRJM8rVKjCWk6ZIm6FTm3ddIe4/c=
+github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c h1:Lgl0gzECD8GnQ5QCWA8o6BtfL6mDH5rQgM4/fX3avOs=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pelletier/go-toml v1.9.4 h1:tjENF6MfZAg8e4ZmZTeWaWiT2vXtsoO6+iuOjFhECwM=
+github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
+github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.10.1 h1:VasscCm72135zRysgrJDKsntdmPN+OuU3+nnHYA9wyc=
+github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4 h1:gQz4mCbXsO+nc9n1hCxHcGA3Zx3Eo+UHZoInFGUIXNM=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/rogpeppe/fastuuid v1.2.0 h1:Ppwyp6VYCF1nvBTXL3trRso7mXMlRrw9ooo375wvi2s=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f h1:UFr9zpz4xgTnIE5yIMtWAMngCdZ9p/+q6lTbgelo80M=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/sagikazarmark/crypt v0.1.0 h1:AyO7PGna28P9TMH93Bsxd7m9QC4xE6zyGQTXCo7ZrA8=
+github.com/sagikazarmark/crypt v0.1.0/go.mod h1:B/mN0msZuINBtQ1zZLEQcegFJJf9vnYIR88KRMEuODE=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.6.0 h1:xoax2sJ2DT8S8xA2paPFjDCScCNeWsg75VG0DLRreiY=
+github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
+github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
+github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
+github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.9.0 h1:yR6EXjTp0y0cLN8OZg1CRZmOBdI88UcGkhgyJhu6nZk=
+github.com/spf13/viper v1.9.0/go.mod h1:+i6ajR7OX2XaiBkrcZJFK21htRk7eDeLg7+O6bhUPP4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
+github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
+github.com/swaggo/files v1.0.1 h1:J1bVJ4XHZNq0I46UU90611i9/YzdrF7x92oX1ig5IdE=
+github.com/swaggo/files v1.0.1/go.mod h1:0qXmMNH6sXNf+73t65aKeB+ApmgxdnkQzVTAj2uaMUg=
+github.com/swaggo/gin-swagger v1.6.0 h1:y8sxvQ3E20/RCyrXeFfg60r6H0Z+SwpTjMYsMm+zy8M=
+github.com/swaggo/gin-swagger v1.6.0/go.mod h1:BG00cCEy294xtVpyIAHG6+e2Qzj/xKlRdOqDkvq0uzo=
+github.com/swaggo/swag v1.16.3 h1:PnCYjPCah8FK4I26l2F/KQ4yz3sILcVUN3cTlBFA9Pg=
+github.com/swaggo/swag v1.16.3/go.mod h1:DImHIuOFXKpMFAQjcC7FG4m3Dg4+QuUgUzJmKjI/gRk=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.2.9 h1:rmenucSohSTiyL09Y+l2OCk+FrMxGMzho2+tjr5ticU=
+github.com/ugorji/go/codec v1.2.9/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
+github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
+github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.etcd.io/etcd/api/v3 v3.5.0 h1:GsV3S+OfZEOCNXdtNkBSR7kgLobAa/SO6tCxRa0GAYw=
+go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
+go.etcd.io/etcd/client/pkg/v3 v3.5.0 h1:2aQv6F436YnN7I4VbI8PPYrBhu+SmrTaADcf8Mi/6PU=
+go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/v2 v2.305.0 h1:ftQ0nOOHMcbMS3KIaDQ0g5Qcd6bhaBrQT6b89DfwLTs=
+go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
+go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
+go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
+go.opentelemetry.io/proto/otlp v0.7.0 h1:rwOQPCuKAKmwGKq2aVNnYIibI6wnV7EvzgfTCzcdGg8=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/zap v1.17.0 h1:MTjgFu6ZLKvY6Pvaqk97GlxNBuMpV4Hy/3P6tRGlI2U=
+go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
+golang.org/x/arch v0.0.0-20210923205945-b76863e36670 h1:18EFjUmQOcUvxNYSkA6jO9VAiXCnxFY6NyDX0bHDmkU=
+golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
+golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
+golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6 h1:QE6XYQK6naiK1EPAe1g/ILLxN5RBoH5xkJk3CqlMI/Y=
+golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.13.0 h1:3cge/F/QTkNLauhf2QoE9zp+7sr+ZcL4HnoZmdwg9sg=
+golang.org/x/image v0.13.0/go.mod h1:6mmbMOeV28HuMTgA6OSRkdXKYw/t5W9Uwn2Yv1r3Yxk=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
+golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG1In4gJY5YRhtpDNeDeHWs=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
+golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
+golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210420072515-93ed5bcd2bfe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457 h1:zf5N6UOrA487eEFacMePxjXAJctxKmyjKUsjA11Uzuk=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
+golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
+google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
+google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
+google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
+google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
+google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
+google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
+google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
+google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
+google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
+google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
+google.golang.org/api v0.56.0 h1:08F9XVYTLOGeSQb3xI9C0gXMuQanhdGed0cWFhDozbI=
+google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
+google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
+google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
+google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
+google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
+google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
+google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
+google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71 h1:z+ErRPu0+KS02Td3fOAgdX+lnPDh/VyaABEJPD4JRQs=
+google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
+google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.40.0 h1:AGJ0Ih4mHjSeibYkFGh1dD9KJ/eOtZ93I6hoHhukQ5Q=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0 h1:M1YKkFIboKNieVO5DLUEVzQfGwJD30Nv2jfUgzb5UcE=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/ini.v1 v1.63.2 h1:tGK/CyBg7SMzb60vP1M03vNZ3VDu3wGQJwn7Sxi9r3c=
+gopkg.in/ini.v1 v1.63.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/mysql v1.5.7 h1:MndhOPYOfEp2rHKgkZIhJ16eVUIRf2HmzgoPmh7FCWo=
+gorm.io/driver/mysql v1.5.7/go.mod h1:sEtPWMiqiN1N1cMXoXmBbd8C6/l+TESwriotuRRpkDM=
+gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
+gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
+gorm.io/driver/sqlite v1.5.6 h1:fO/X46qn5NUEEOZtnjJRWRzZMe8nqJiQ9E+0hi+hKQE=
+gorm.io/driver/sqlite v1.5.6/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
+gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
+gorm.io/gorm v1.25.10 h1:dQpO+33KalOA+aFYGlK+EfxcI5MbO7EP2yYygwh9h+s=
+gorm.io/gorm v1.25.10/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+honnef.co/go/tools v0.0.1-2020.1.4 h1:UoveltGrhghAA7ePc+e+QYDHXrBps2PqFZiHkGR/xK8=
+honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/pdf v0.1.1 h1:k1MczvYDUvJBe93bYd7wrZLLUEcLZAuF824/I4e5Xr4=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
+rsc.io/quote/v3 v3.1.0 h1:9JKUTTIUgS6kzR9mK1YuGKv6Nl+DijDNIc0ghT58FaY=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/api/http/controller/admin/addressBook.go b/api/http/controller/admin/addressBook.go
index 8f7cded..ba78e3b 100644
--- a/api/http/controller/admin/addressBook.go
+++ b/api/http/controller/admin/addressBook.go
@@ -1,51 +1,41 @@
-package admin
+package admin
 
 import (
 	"encoding/json"
 	_ "encoding/json"
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 	"strconv"
 )
 
 type AddressBook struct {
 }
 
-// Detail 
-// @Tags 
-// @Summary 
-// @Description 
-// @Accept  json
-// @Produce  json
-// @Param id path int true "ID"
-// @Success 200 {object} response.Response{data=model.AddressBook}
-// @Failure 500 {object} response.Response
-// @Router /admin/address_book/detail/{id} [get]
-// @Security token
+// Detail is retained for internal callers but is not registered by the router.
 func (ct *AddressBook) Detail(c *gin.Context) {
 	id := c.Param("id")
 	iid, _ := strconv.Atoi(id)
 	t := service.AllService.AddressBookService.InfoByRowId(uint(iid))
 	if t.RowId > 0 {
-		response.Success(c, t)
+		response.Success(c, t.Safe())
 		return
 	}
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 	return
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
-// @Success 200 {object} response.Response{data=model.AddressBook}
+// @Param body body admin.AddressBookForm true "Address book entry form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book/create [post]
 // @Security token
@@ -84,14 +74,14 @@ func (ct *AddressBook) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// BatchCreate 
-// @Tags 
-// @Summary 
-// @Description 
+// BatchCreate
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
-// @Success 200 {object} response.Response{data=model.AddressBook}
+// @Param body body admin.AddressBookForm true "Address book batch-create form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book/batchCreate [post]
 // @Security token
@@ -147,17 +137,17 @@ func (ct *AddressBook) BatchCreate(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the address book list"
+// @Param page_size query int false "Number of entries per address book page"
 // @Param user_id query int false "id"
-// @Param is_my query int false ""
-// @Success 200 {object} response.Response{data=model.AddressBookList}
+// @Param is_my query int false "Filter for address books owned by the current user"
+// @Success 200 {object} response.Response{data=model.AddressBookSafeList} "Redacted address-book list envelope"
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book/list [get]
 // @Security token
@@ -192,17 +182,17 @@ func (ct *AddressBook) List(c *gin.Context) {
 	for _, ab := range res.AddressBooks {
 		abCIds = append(abCIds, ab.CollectionId)
 	}
-	response.Success(c, res)
+	response.Success(c, res.Safe())
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
-// @Success 200 {object} response.Response{data=model.AddressBook}
+// @Param body body admin.AddressBookForm true "Address book entry update form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book/update [post]
 // @Security token
@@ -239,13 +229,13 @@ func (ct *AddressBook) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
+// @Param body body admin.AddressBookForm true "Address book entry deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book/delete [post]
@@ -276,15 +266,15 @@ func (ct *AddressBook) Delete(c *gin.Context) {
 }
 
 // ShareByWebClient
-// @Tags 
-// @Summary 
-// @Description 
+// @Tags
+// @Summary
+// @Description Authenticated web-client share route; requires the admin API token but not AdminPrivilege.
 // @Accept  json
 // @Produce  json
-// @Param body body admin.ShareByWebClientForm true ""
+// @Param body body admin.ShareByWebClientForm true "Web client address book sharing form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
-// @Router /admin/address_book/share [post]
+// @Router /admin/address_book/shareByWebClient [post]
 // @Security token
 func (ct *AddressBook) ShareByWebClient(c *gin.Context) {
 	f := &admin.ShareByWebClientForm{}
@@ -316,6 +306,17 @@ func (ct *AddressBook) ShareByWebClient(c *gin.Context) {
 	})
 }
 
+// BatchCreateFromPeers
+// @Tags
+// @Summary
+// @Description Admin-only batch creation of address-book entries from existing peers.
+// @Accept  json
+// @Produce  json
+// @Param body body admin.BatchCreateFromPeersForm true "Peer IDs and address-book destination payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/address_book/batchCreateFromPeers [post]
+// @Security token
 func (ct *AddressBook) BatchCreateFromPeers(c *gin.Context) {
 	f := &admin.BatchCreateFromPeersForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
diff --git a/api/http/controller/admin/addressBookCollection.go b/api/http/controller/admin/addressBookCollection.go
index 761b0b5..cbe6449 100644
--- a/api/http/controller/admin/addressBookCollection.go
+++ b/api/http/controller/admin/addressBookCollection.go
@@ -1,27 +1,27 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 	"strconv"
 )
 
 type AddressBookCollection struct {
 }
 
-// Detail 
-// @Tags 
-// @Summary 
-// @Description 
+// Detail
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param id path int true "ID"
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection/detail/{id} [get]
 // @Security token
@@ -37,14 +37,14 @@ func (abc *AddressBookCollection) Detail(c *gin.Context) {
 	return
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollection true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollection true "Address book collection form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection/create [post]
 // @Security token
@@ -72,15 +72,15 @@ func (abc *AddressBookCollection) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param is_my query int false ""
+// @Param page query int false "Page number for the address book collection list"
+// @Param page_size query int false "Number of collections per page"
+// @Param is_my query int false "Filter for collections owned by the current user"
 // @Param user_id query int false "id"
 // @Success 200 {object} response.Response{data=model.AddressBookCollectionList}
 // @Failure 500 {object} response.Response
@@ -100,14 +100,14 @@ func (abc *AddressBookCollection) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollection true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollection true "Address book collection update form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection/update [post]
 // @Security token
@@ -135,13 +135,13 @@ func (abc *AddressBookCollection) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollection true ""
+// @Param body body model.AddressBookCollection true "Address book collection deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection/delete [post]
diff --git a/api/http/controller/admin/addressBookCollectionRule.go b/api/http/controller/admin/addressBookCollectionRule.go
index ceb2d79..daa1c0b 100644
--- a/api/http/controller/admin/addressBookCollectionRule.go
+++ b/api/http/controller/admin/addressBookCollectionRule.go
@@ -1,31 +1,31 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 	"strconv"
 )
 
 type AddressBookCollectionRule struct {
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param is_my query int false ""
+// @Param page query int false "Page number for the collection-rule list"
+// @Param page_size query int false "Number of collection rules per page"
+// @Param is_my query int false "Filter for rules owned by the current user"
 // @Param user_id query int false "id"
 // @Param collection_id query int false "id"
-// @Success 200 {object} response.Response{data=model.AddressBookCollectionList}
+// @Success 200 {object} response.Response{data=model.AddressBookCollectionRuleList}
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection_rule/list [get]
 // @Security token
@@ -47,10 +47,10 @@ func (abcr *AddressBookCollectionRule) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Detail 
-// @Tags 
-// @Summary 
-// @Description 
+// Detail
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param id path int true "ID"
@@ -69,14 +69,14 @@ func (abcr *AddressBookCollectionRule) Detail(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollectionRule true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollectionRule true "Address book collection rule form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection_rule/create [post]
 // @Security token
@@ -145,14 +145,14 @@ func (abcr *AddressBookCollectionRule) CheckForm(t *model.AddressBookCollectionR
 	return "", true
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollectionRule true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollectionRule true "Address book collection rule update form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection_rule/update [post]
 // @Security token
@@ -185,13 +185,13 @@ func (abcr *AddressBookCollectionRule) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollectionRule true ""
+// @Param body body model.AddressBookCollectionRule true "Address book collection rule deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/address_book_collection_rule/delete [post]
diff --git a/api/http/controller/admin/audit.go b/api/http/controller/admin/audit.go
index f6ecbcf..65e8327 100644
--- a/api/http/controller/admin/audit.go
+++ b/api/http/controller/admin/audit.go
@@ -19,10 +19,10 @@ type Audit struct {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param peer_id query int false ""
-// @Param from_peer query int false ""
+// @Param page query int false "Page number for audit connection records"
+// @Param page_size query int false "Number of audit connection records per page"
+// @Param peer_id query int false "Peer ID filter for audit connections"
+// @Param from_peer query int false "Source peer ID filter for audit connections"
 // @Success 200 {object} response.Response{data=model.AuditConnList}
 // @Failure 500 {object} response.Response
 // @Router /admin/audit_conn/list [get]
@@ -51,7 +51,7 @@ func (a *Audit) ConnList(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body model.AuditConn true ""
+// @Param body body model.AuditConn true "Audit connection deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/audit_conn/delete [post]
@@ -87,7 +87,7 @@ func (a *Audit) ConnDelete(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AuditConnLogIds true ""
+// @Param body body admin.AuditConnLogIds true "Audit connection log ID batch deletion payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/audit_conn/batchDelete [post]
@@ -118,10 +118,10 @@ func (a *Audit) BatchConnDelete(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param peer_id query int false ""
-// @Param from_peer query int false ""
+// @Param page query int false "Page number for audit file records"
+// @Param page_size query int false "Number of audit file records per page"
+// @Param peer_id query int false "Peer ID filter for audit file records"
+// @Param from_peer query int false "Source peer ID filter for audit file records"
 // @Success 200 {object} response.Response{data=model.AuditFileList}
 // @Failure 500 {object} response.Response
 // @Router /admin/audit_file/list [get]
@@ -150,7 +150,7 @@ func (a *Audit) FileList(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body model.AuditFile true ""
+// @Param body body model.AuditFile true "Audit file deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/audit_file/delete [post]
@@ -186,7 +186,7 @@ func (a *Audit) FileDelete(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AuditFileLogIds true ""
+// @Param body body admin.AuditFileLogIds true "Audit file log ID batch deletion payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/audit_file/batchDelete [post]
diff --git a/api/http/controller/admin/build_manifest_test.go b/api/http/controller/admin/build_manifest_test.go
new file mode 100644
index 0000000..97e223a
--- /dev/null
+++ b/api/http/controller/admin/build_manifest_test.go
@@ -0,0 +1,273 @@
+package admin
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/nicksnyder/go-i18n/v2/i18n"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/text/language"
+	"rustdesk-server/api/global"
+	"rustdesk-server/api/http/middleware"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestCustomBuildManifestRequiresAdminPrivilege(t *testing.T) {
+	previousServices := service.AllService
+	previousLogger, previousLocalizer := global.Logger, global.Localizer
+	t.Cleanup(func() {
+		service.AllService = previousServices
+		global.Logger = previousLogger
+		global.Localizer = previousLocalizer
+	})
+	global.Localizer = testManifestLocalizer
+	global.Logger = logrus.New()
+	service.AllService = &service.Service{UserService: &service.UserService{}}
+
+	for _, tc := range []struct {
+		name string
+		user *model.User
+	}{
+		{name: "missing user"},
+		{name: "non-admin", user: &model.User{IsAdmin: boolPointer(false)}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := newManifestRouter(tc.user)
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(http.MethodGet, "/api/admin/custom_build/manifest/1", nil)
+			router.ServeHTTP(recorder, request)
+
+			if recorder.Code != http.StatusOK {
+				t.Fatalf("unauthorized HTTP status = %d, want legacy 200 envelope", recorder.Code)
+			}
+			var envelope struct {
+				Code int `json:"code"`
+			}
+			if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+				t.Fatalf("unauthorized response JSON: %v", err)
+			}
+			if envelope.Code != 403 {
+				t.Fatalf("unauthorized response code = %d, want 403", envelope.Code)
+			}
+		})
+	}
+}
+
+func TestCustomBuildManifestEndpointReturnsVerifiedRedactedManifest(t *testing.T) {
+	withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousGlobalDB, previousServiceDB := global.DB, service.DB
+	previousServices := service.AllService
+	previousLogger, previousLocalizer := global.Logger, global.Localizer
+	t.Cleanup(func() {
+		global.DB = previousGlobalDB
+		service.DB = previousServiceDB
+		service.AllService = previousServices
+		global.Logger = previousLogger
+		global.Localizer = previousLocalizer
+		_ = sqlDB.Close()
+	})
+	global.DB = db
+	service.DB = db
+	global.Logger = logrus.New()
+	global.Localizer = testManifestLocalizer
+	service.AllService = &service.Service{
+		UserService:        &service.UserService{},
+		CustomBuildService: &service.CustomBuildService{},
+	}
+	build := newAdminCompleteManifestBuild(t)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create complete build: %v", err)
+	}
+
+	router := newManifestRouter(&model.User{IsAdmin: boolPointer(true)})
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodGet, "/api/admin/custom_build/manifest/101", nil)
+	router.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("manifest HTTP status = %d, body=%s", recorder.Code, recorder.Body.String())
+	}
+	var envelope struct {
+		Code int                          `json:"code"`
+		Data service.BuildHandoffManifest `json:"data"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+		t.Fatalf("manifest response JSON: %v", err)
+	}
+	if envelope.Code != 0 {
+		t.Fatalf("manifest response code = %d, body=%s", envelope.Code, recorder.Body.String())
+	}
+	if envelope.Data.BuildID != build.Id || envelope.Data.PublishedDigest != build.PublishedDigest || envelope.Data.ArtifactID != build.GithubArtifactID {
+		t.Fatalf("manifest identity = %#v, want build=%d digest=%q artifact=%d", envelope.Data, build.Id, build.PublishedDigest, build.GithubArtifactID)
+	}
+	if len(envelope.Data.ReleaseAssets) != 4 || envelope.Data.ReleaseAssets[0].ProviderDigest == "" {
+		t.Fatalf("manifest release assets = %#v, want exact provider digests", envelope.Data.ReleaseAssets)
+	}
+	for _, forbidden := range []string{"PAT-secret", "payload-secret", "server-key-secret", "/rdgen-data"} {
+		if strings.Contains(recorder.Body.String(), forbidden) {
+			t.Fatalf("manifest response contains forbidden value %q: %s", forbidden, recorder.Body.String())
+		}
+	}
+	if strings.Contains(recorder.Body.String(), "\"name\":\"custom_.txt\"") {
+		t.Fatalf("manifest response exposed secret-bearing output entry: %s", recorder.Body.String())
+	}
+	bodyDigest := sha256.Sum256(recorder.Body.Bytes())
+	if got := recorder.Header().Get("X-DeskForge-Manifest-SHA256"); got != hex.EncodeToString(bodyDigest[:]) {
+		t.Fatalf("manifest response SHA header = %q, want hash of actual response bytes %x", got, bodyDigest)
+	}
+	repeat := httptest.NewRecorder()
+	router.ServeHTTP(repeat, httptest.NewRequest(http.MethodGet, "/api/admin/custom_build/manifest/101", nil))
+	if repeat.Code != http.StatusOK || string(repeat.Body.Bytes()) != string(recorder.Body.Bytes()) {
+		t.Fatalf("repeated manifest response changed: first=%s second=%s", recorder.Body.Bytes(), repeat.Body.Bytes())
+	}
+	if repeat.Header().Get("X-DeskForge-Manifest-SHA256") != recorder.Header().Get("X-DeskForge-Manifest-SHA256") {
+		t.Fatalf("repeated manifest response checksum changed: first=%q second=%q", recorder.Header().Get("X-DeskForge-Manifest-SHA256"), repeat.Header().Get("X-DeskForge-Manifest-SHA256"))
+	}
+}
+
+func TestCustomBuildManifestEndpointFailsClosedForPartialBuild(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousGlobalDB, previousServiceDB := global.DB, service.DB
+	previousServices := service.AllService
+	previousLogger, previousLocalizer := global.Logger, global.Localizer
+	t.Cleanup(func() {
+		global.DB = previousGlobalDB
+		service.DB = previousServiceDB
+		service.AllService = previousServices
+		global.Logger = previousLogger
+		global.Localizer = previousLocalizer
+		_ = sqlDB.Close()
+	})
+	global.DB = db
+	service.DB = db
+	global.Logger = logrus.New()
+	global.Localizer = testManifestLocalizer
+	service.AllService = &service.Service{
+		UserService:        &service.UserService{},
+		CustomBuildService: &service.CustomBuildService{},
+	}
+	legacy := &model.CustomBuild{IdModel: model.IdModel{Id: 102}, Status: model.CustomBuildStatusDone, Platform: "windows"}
+	if err := db.Create(legacy).Error; err != nil {
+		t.Fatalf("create legacy build: %v", err)
+	}
+	router := newManifestRouter(&model.User{IsAdmin: boolPointer(true)})
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/api/admin/custom_build/manifest/102", nil))
+	if recorder.Code != http.StatusConflict {
+		t.Fatalf("partial manifest HTTP status = %d, body=%s; want conflict", recorder.Code, recorder.Body.String())
+	}
+	if strings.Contains(recorder.Body.String(), "custom_json") || strings.Contains(recorder.Body.String(), "filesystem") {
+		t.Fatalf("partial manifest response exposed implementation details: %s", recorder.Body.String())
+	}
+}
+
+func newManifestRouter(user *model.User) *gin.Engine {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	group := router.Group("/api/admin")
+	if user != nil {
+		group.Use(func(c *gin.Context) {
+			c.Set("curUser", user)
+			c.Next()
+		})
+	}
+	manifestGroup := group.Group("/custom_build").Use(middleware.AdminPrivilege())
+	manifestGroup.GET("/manifest/:id", (&CustomBuild{}).Manifest)
+	return router
+}
+
+func testManifestLocalizer(_ string) *i18n.Localizer {
+	return i18n.NewLocalizer(i18n.NewBundle(language.English), "en")
+}
+
+func boolPointer(value bool) *bool {
+	return &value
+}
+
+func newAdminCompleteManifestBuild(t *testing.T) *model.CustomBuild {
+	t.Helper()
+	build := &model.CustomBuild{
+		IdModel:         model.IdModel{Id: 101},
+		Status:          model.CustomBuildStatusDone,
+		Platform:        "windows",
+		AppName:         "rustqs",
+		Version:         "1.2.3",
+		BuildRef:        strings.Repeat("b", 40),
+		SourceTag:       "1.2.3",
+		AssetsRelease:   "offline-assets-1.2.3",
+		AssetsReleaseID: 101,
+		AssetsReleaseAssets: `[{
+"id":101,"name":"windows-x64-release.zip","digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111"},{
+"id":102,"name":"usbmmidd_v2.zip","digest":"sha256:2222222222222222222222222222222222222222222222222222222222222222"},{
+"id":103,"name":"rustdesk_printer_driver_v4-1.4.zip","digest":"sha256:3333333333333333333333333333333333333333333333333333333333333333"},{
+"id":104,"name":"printer_driver_adapter.zip","digest":"sha256:4444444444444444444444444444444444444444444444444444444444444444"}]`,
+		GithubProvider:        "github",
+		GithubRepo:            "owner/repo",
+		GithubWorkflow:        "rustqs-windows.yml",
+		WorkflowSelector:      "rustqs/workflows",
+		GithubRef:             strings.Repeat("a", 40),
+		GithubSourceSha:       strings.Repeat("a", 40),
+		GithubArtifactName:    "rustqs-windows",
+		GithubArtifactID:      1001,
+		GithubRunId:           1001,
+		GithubRunUrl:          "https://api.github.com/repos/owner/repo/actions/runs/1001",
+		GithubHtmlUrl:         "https://github.com/owner/repo/actions/runs/1001",
+		PublicationRecordedAt: 1700000000,
+		CustomJson:            `{"permanent_password":"PAT-secret"}`,
+	}
+	root := service.BuildOutputDir
+	outputDir := root(build.Id)
+	if err := os.MkdirAll(outputDir, 0700); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	for name, contents := range map[string]string{
+		"rustqs.exe":  "exe",
+		"helper.dll":  "dll",
+		"custom_.txt": "PAT-secret",
+	} {
+		if err := os.WriteFile(filepath.Join(outputDir, name), []byte(contents), 0600); err != nil {
+			t.Fatalf("write output %q: %v", name, err)
+		}
+	}
+	exeHash := sha256.Sum256([]byte("exe"))
+	producerManifest := service.ProducerManifest{
+		Schema:               service.ProducerManifestSchema,
+		ManifestSchema:       service.ProducerManifestSchema,
+		SchemaVersion:        service.ProducerManifestVersion,
+		Platform:             build.Platform,
+		AppName:              build.AppName,
+		OutputFilenames:      []string{"rustqs.exe"},
+		SourceSHA:            build.BuildRef,
+		WorkflowSHA:          build.GithubRef,
+		WorkflowRef:          build.WorkflowSelector,
+		Version:              build.Version,
+		SourceTreeSHA:        strings.Repeat("c", 40),
+		Submodules:           []service.ProducerManifestSubmodule{},
+		DigestScope:          service.ProducerManifestDigestScope,
+		VerificationScope:    service.ProducerManifestVerificationScope,
+		VerificationResult:   service.ProducerManifestVerificationResult,
+		PublicationTimestamp: build.PublicationRecordedAt,
+		HandoffContract:      service.ProducerManifestHandoffContract,
+		Files:                []service.ProducerManifestFile{{Name: "rustqs.exe", Size: 3, SHA256: hex.EncodeToString(exeHash[:])}},
+	}
+	producerManifestJSON, err := producerManifest.StoredJSON()
+	if err != nil {
+		t.Fatalf("producer manifest: %v", err)
+	}
+	build.ProducerManifestJSON = producerManifestJSON
+	digest, err := service.PublishedOutputDigest(build)
+	if err != nil {
+		t.Fatalf("PublishedOutputDigest() error = %v", err)
+	}
+	build.PublishedDigest = digest
+	return build
+}
diff --git a/api/http/controller/admin/config.go b/api/http/controller/admin/config.go
index d773593..fd7401b 100644
--- a/api/http/controller/admin/config.go
+++ b/api/http/controller/admin/config.go
@@ -1,12 +1,12 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"os"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"os"
 	"strings"
 )
 
@@ -49,7 +49,15 @@ func (co *Config) AppConfig(c *gin.Context) {
 	})
 }
 
-// AllConfig 
+// AllConfig
+// @Tags ADMIN
+// @Summary Get all admin configuration
+// @Description Admin-only configuration used by the admin panel.
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/config/all [get]
+// @Security token
 func (co *Config) AllConfig(c *gin.Context) {
 	response.Success(c, &gin.H{
 		"id_server":    global.Config.Rustdesk.IdServer,
@@ -67,16 +75,14 @@ func (co *Config) AllConfig(c *gin.Context) {
 	})
 }
 
-// AdminConfig ADMIN
+// AdminConfig returns public admin branding, with optional authenticated greeting data.
 // @Tags ADMIN
-// @Summary ADMIN
-// @Description ADMIN
-// @Accept  json
+// @Summary Get public admin configuration
+// @Description Public pre-authentication route returning the admin title and, when a valid api-token is supplied, the personalized greeting.
 // @Produce  json
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/config/admin [get]
-// @Security token
 func (co *Config) AdminConfig(c *gin.Context) {
 
 	u := &model.User{}
diff --git a/api/http/controller/admin/custom_build.go b/api/http/controller/admin/custom_build.go
index 4d41550..8a01613 100644
--- a/api/http/controller/admin/custom_build.go
+++ b/api/http/controller/admin/custom_build.go
@@ -2,19 +2,24 @@ package admin
 
 import (
 	"archive/zip"
-	"bytes"
 	"context"
-	"encoding/base64"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"os"
+	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
@@ -25,74 +30,608 @@ import (
 
 type CustomBuild struct{}
 
+type validatedZipEntry struct {
+	name        string
+	destination string
+}
+
+func failCustomBuildRead(c *gin.Context, err error) {
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
+		return
+	}
+	if global.Logger != nil {
+		global.Logger.Errorf("custom build read failed: %s", service.GithubErrorDetail(err))
+	}
+	response.FailStatus(c, http.StatusInternalServerError, 101, "custom build is unavailable")
+}
+
+type buildProgressUpdater func(service.BuildProgress) error
+type githubPollClock struct {
+	now  func() time.Time
+	wait func(time.Duration)
+}
+
+const (
+	buildPersistenceAttempts     = 3
+	buildPersistenceRetryDelay   = 10 * time.Millisecond
+	artifactCleanupRetryAttempts = 3
+	maxBuildLogBytes             = service.MaxBuildLogBytes
+	buildOutputTempTTL           = 24 * time.Hour
+)
+
+var (
+	artifactMaxZipEntries         int64  = 4096
+	artifactMaxFileBytes          uint64 = 512 << 20
+	artifactMaxAggregateBytes     uint64 = 1 << 30
+	artifactMaxCompressionRatio   uint64 = 1000
+	downloadArchiveMaxOutputBytes int64  = 512 << 20
+	downloadArchiveMaxFileBytes   int64  = 512 << 20
+	downloadArchiveMaxSourceBytes int64  = 1 << 30
+	downloadArchiveMaxFiles       int    = 4096
+	downloadArchiveDigestScope           = "sha256 covers the exact redacted public ZIP archive bytes served by this response; it is distinct from the stored publication digest"
+	downloadArchiveSlots                 = make(chan struct{}, 2)
+	removeArtifactArchive                = os.Remove
+	scheduleArtifactCleanupRetry         = scheduleArtifactCleanupRetryDefault
+	artifactCleanupRetryDelay            = time.Minute
+	downloadArchiveSnapshotHook          = func() {}
+)
+
+var scheduleGithubPollRetry func(buildID uint, runID int64)
+
+// Kept as a seam for hermetic publication tests; production semantics remain
+// the shared /rdgen-data/output/{buildID} location.
+var customBuildOutputDir = service.BuildOutputDir
+
+type githubPollOwnership struct {
+	mu     sync.Mutex
+	active map[uint]chan struct{}
+}
+
+func newGithubPollOwnership() *githubPollOwnership {
+	return &githubPollOwnership{active: make(map[uint]chan struct{})}
+}
+
+func (o *githubPollOwnership) claim(buildID uint) (func(), bool) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	if _, exists := o.active[buildID]; exists {
+		return nil, false
+	}
+	done := make(chan struct{})
+	o.active[buildID] = done
+	return func() {
+		o.mu.Lock()
+		if current, exists := o.active[buildID]; exists && current == done {
+			delete(o.active, buildID)
+			close(done)
+		}
+		o.mu.Unlock()
+	}, true
+}
+
+func (o *githubPollOwnership) wait(buildID uint, timeout time.Duration) bool {
+	o.mu.Lock()
+	done, active := o.active[buildID]
+	o.mu.Unlock()
+	if !active {
+		return true
+	}
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+	select {
+	case <-done:
+		return true
+	case <-timer.C:
+		return false
+	}
+}
+
+func (o *githubPollOwnership) acquire(ctx context.Context, buildID uint) (func(), error) {
+	for {
+		if release, claimed := o.claim(buildID); claimed {
+			return release, nil
+		}
+		o.mu.Lock()
+		done := o.active[buildID]
+		o.mu.Unlock()
+		if done == nil {
+			continue
+		}
+		select {
+		case <-done:
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
+
+// This guard is intentionally process-local. A cross-process lease would
+// require a schema/expiry contract and is outside this corrective diff.
+var activeGithubPolls = newGithubPollOwnership()
+
+type githubPollRetryKey struct {
+	buildID uint
+	runID   int64
+}
+
+// This is deliberately process-local and bounded to one scheduled retry per
+// build/run. It is not a durable outbox or a distributed scheduler; a restart
+// or another API process still requires the normal ResumePendingPolls hook.
+var scheduledGithubPollRetries = struct {
+	sync.Mutex
+	keys map[githubPollRetryKey]struct{}
+}{
+	keys: make(map[githubPollRetryKey]struct{}),
+}
+
+func startGithubPoll(ct *CustomBuild, buildID uint, runID int64) bool {
+	release, claimed := activeGithubPolls.claim(buildID)
+	if !claimed {
+		return false
+	}
+	go func() {
+		defer release()
+		ct.pollAndDownload(buildID, runID)
+	}()
+	return true
+}
+
+func schedulePollRetryAfterPersistence(buildID uint, runID int64) {
+	if buildID == 0 || runID <= 0 {
+		return
+	}
+	key := githubPollRetryKey{buildID: buildID, runID: runID}
+	scheduledGithubPollRetries.Lock()
+	_, alreadyScheduled := scheduledGithubPollRetries.keys[key]
+	if !alreadyScheduled {
+		scheduledGithubPollRetries.keys[key] = struct{}{}
+	}
+	scheduledGithubPollRetries.Unlock()
+	if alreadyScheduled {
+		return
+	}
+	if scheduleGithubPollRetry != nil {
+		scheduleGithubPollRetry(buildID, runID)
+		return
+	}
+	scheduleGithubPollRetryDefault(buildID, runID)
+}
+
+func clearScheduledGithubPollRetry(buildID uint, runID int64) {
+	key := githubPollRetryKey{buildID: buildID, runID: runID}
+	scheduledGithubPollRetries.Lock()
+	delete(scheduledGithubPollRetries.keys, key)
+	scheduledGithubPollRetries.Unlock()
+}
+
+func runScheduledGithubPollRetry(buildID uint, runID int64, start func() bool) {
+	if !activeGithubPolls.wait(buildID, 2*time.Minute) {
+		clearScheduledGithubPollRetry(buildID, runID)
+		if global.Logger != nil {
+			global.Logger.Warnf("poll retry for build %d/run %d was not started because the active poll did not release", buildID, runID)
+		}
+		return
+	}
+	// The scheduled attempt owns the retry lifecycle from this point. Clear the
+	// pending marker before starting the poll so a persistence failure from this
+	// attempt can schedule one later retry; defer also clears it on failure.
+	clearScheduledGithubPollRetry(buildID, runID)
+	defer clearScheduledGithubPollRetry(buildID, runID)
+	if !start() && global.Logger != nil {
+		global.Logger.Debugf("poll retry for build %d/run %d was skipped because another poll is active", buildID, runID)
+	}
+}
+
+func scheduleGithubPollRetryDefault(buildID uint, runID int64) {
+	go func() {
+		timer := time.NewTimer(time.Minute)
+		defer timer.Stop()
+		<-timer.C
+		runScheduledGithubPollRetry(buildID, runID, func() bool {
+			return startGithubPoll(&CustomBuild{}, buildID, runID)
+		})
+	}()
+}
+
+// persistBuildMutation is the single bounded persistence/recovery boundary for
+// asynchronous build state. It deliberately retries the exact same mutation;
+// it never queues a fallback job or invents a provider identity. A caller that
+// cannot persist a terminal/done state must leave the row non-done so a later
+// resume can retry it.
+func persistBuildMutation(buildID uint, operation string, mutation func() error) error {
+	var lastErr error
+	for attempt := 1; attempt <= buildPersistenceAttempts; attempt++ {
+		if err := mutation(); err == nil {
+			return nil
+		} else {
+			lastErr = err
+		}
+		if attempt < buildPersistenceAttempts {
+			time.Sleep(buildPersistenceRetryDelay)
+		}
+	}
+	if global.Logger != nil {
+		global.Logger.Errorf("build %d: %s persistence exhausted after %d attempts; row remains recoverable and non-done: %s", buildID, operation, buildPersistenceAttempts, service.GithubErrorDetail(lastErr))
+	}
+	return fmt.Errorf("build %d %s persistence retries exhausted: %w", buildID, operation, lastErr)
+}
+
+func persistPollMutation(buildID uint, runID int64, operation string, mutation func() error) error {
+	err := persistBuildMutation(buildID, operation, mutation)
+	if err != nil {
+		schedulePollRetryAfterPersistence(buildID, runID)
+	}
+	return err
+}
+
+func persistBuildProgressWith(updater buildProgressUpdater, b *model.CustomBuild) error {
+	return persistBuildProgressWithRun(updater, b, b.GithubRunId)
+}
+
+func persistBuildProgressWithRun(updater buildProgressUpdater, b *model.CustomBuild, expectedRunID int64) error {
+	return persistPollMutation(b.Id, expectedRunID, "progress", func() error {
+		if err := updater(service.BuildProgress{
+			BuildID:            b.Id,
+			ExpectedRunID:      expectedRunID,
+			ExpectedArtifactID: b.GithubArtifactID,
+			Status:             b.Status,
+			BuildLog:           b.BuildLog,
+			FileSize:           b.FileSize,
+		}); err != nil {
+			var persistenceErr *service.BuildProgressPersistenceError
+			if errors.As(err, &persistenceErr) {
+				return err
+			}
+			return &service.BuildProgressPersistenceError{BuildID: b.Id, Cause: err}
+		}
+		return nil
+	})
+}
+
+func persistPendingFailureWith(updater buildProgressUpdater, b *model.CustomBuild) error {
+	return persistBuildMutation(b.Id, "pending failure", func() error {
+		if err := updater(service.BuildProgress{
+			BuildID:  b.Id,
+			Status:   b.Status,
+			BuildLog: b.BuildLog,
+			FileSize: b.FileSize,
+		}); err != nil {
+			var persistenceErr *service.BuildProgressPersistenceError
+			if errors.As(err, &persistenceErr) {
+				return err
+			}
+			return &service.BuildProgressPersistenceError{BuildID: b.Id, Cause: err}
+		}
+		return nil
+	})
+}
+
+func persistBuildProgress(b *model.CustomBuild, expectedRunID int64) error {
+	return persistBuildProgressWithRun(service.AllService.CustomBuildService.UpdateProgress, b, expectedRunID)
+}
+
+func recordPublishedOutput(buildID uint, expectedRunID, expectedArtifactID int64) error {
+	return recordPublishedOutputWithManifest(buildID, expectedRunID, expectedArtifactID, service.ProducerManifest{})
+}
+
+func recordPublishedOutputWithManifest(buildID uint, expectedRunID, expectedArtifactID int64, producerManifest service.ProducerManifest) error {
+	return persistPollMutation(buildID, expectedRunID, "publication", func() error {
+		var err error
+		if producerManifest.SchemaVersion == 0 {
+			err = service.AllService.CustomBuildService.RecordPublishedOutput(buildID, expectedRunID, expectedArtifactID)
+		} else {
+			err = service.AllService.CustomBuildService.RecordPublishedOutput(buildID, expectedRunID, expectedArtifactID, producerManifest)
+		}
+		if err != nil {
+			var persistenceErr *service.BuildProgressPersistenceError
+			if errors.As(err, &persistenceErr) {
+				return err
+			}
+			return &service.BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+		}
+		return nil
+	})
+}
+
+func persistPendingFailure(b *model.CustomBuild) error {
+	return persistPendingFailureWith(service.AllService.CustomBuildService.UpdatePendingFailure, b)
+}
+
+func persistNoRunFailure(b *model.CustomBuild) error {
+	return persistBuildMutation(b.Id, "no-run legacy failure", func() error {
+		if err := service.AllService.CustomBuildService.UpdateNoRunFailure(service.BuildProgress{
+			BuildID:  b.Id,
+			Status:   b.Status,
+			BuildLog: b.BuildLog,
+			FileSize: b.FileSize,
+		}); err != nil {
+			var persistenceErr *service.BuildProgressPersistenceError
+			if errors.As(err, &persistenceErr) {
+				return err
+			}
+			return &service.BuildProgressPersistenceError{BuildID: b.Id, Cause: err}
+		}
+		return nil
+	})
+}
+
+func persistCompletedBuildWith(updater buildProgressUpdater, b *model.CustomBuild, expectedRunID int64) error {
+	if err := persistPollMutation(b.Id, expectedRunID, "completion", func() error {
+		if err := updater(service.BuildProgress{
+			BuildID:            b.Id,
+			ExpectedRunID:      expectedRunID,
+			ExpectedArtifactID: b.GithubArtifactID,
+			Status:             b.Status,
+			BuildLog:           b.BuildLog,
+			FileSize:           b.FileSize,
+		}); err != nil {
+			var persistenceErr *service.BuildProgressPersistenceError
+			if errors.As(err, &persistenceErr) {
+				return err
+			}
+			return &service.BuildProgressPersistenceError{BuildID: b.Id, Cause: err}
+		}
+		return nil
+	}); err != nil {
+		b.Status = model.CustomBuildStatusBuilding
+		return err
+	}
+	return nil
+}
+
+func boundedBuildLog(existing, message string) string {
+	return service.BoundBuildLog(existing, message)
+}
+
+func failActiveGithubBuild(buildID uint, expectedRunID int64, reason string) {
+	b, err := service.AllService.CustomBuildService.Info(buildID)
+	if err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("custom build %d read failed while persisting terminal poll state: %s", buildID, service.GithubErrorDetail(err))
+		}
+		return
+	}
+	if b.Id == 0 || b.GithubRunId != expectedRunID || !isActiveGithubBuildStatus(b.Status) {
+		return
+	}
+	b.Status = model.CustomBuildStatusFailed
+	b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+	if persistErr := persistBuildProgress(b, expectedRunID); persistErr != nil && global.Logger != nil {
+		global.Logger.Errorf("custom build %d failed to persist terminal poll state: %s", buildID, service.GithubErrorDetail(persistErr))
+	}
+}
+
+// recoverRecordedPublishedBuild finalizes only an already verified publication
+// whose marker and digest were durably stored before completion persistence
+// failed. Missing or mismatched proof is deliberately not upgraded to done.
+func recoverRecordedPublishedBuild(buildID uint, expectedRunID int64) (bool, error) {
+	build, err := service.AllService.CustomBuildService.Info(buildID)
+	if err != nil {
+		return false, fmt.Errorf("read custom build %d: %w", buildID, err)
+	}
+	if build.Id == 0 || build.GithubRunId != expectedRunID || !isActiveGithubBuildStatus(build.Status) {
+		return false, nil
+	}
+	if build.GithubArtifactID <= 0 {
+		return false, errors.New("stored publication proof has no exact artifact identity")
+	}
+	size, err := service.AllService.CustomBuildService.ValidateRecordedPublishedOutput(buildID, expectedRunID, build.GithubArtifactID)
+	if err != nil {
+		return false, err
+	}
+	build.FileSize = size
+	build.Status = model.CustomBuildStatusDone
+	build.BuildLog = boundedBuildLog(build.BuildLog, "reused validated final artifact")
+	if err := persistCompletedBuildWith(service.AllService.CustomBuildService.UpdateProgress, build, expectedRunID); err != nil {
+		return true, err
+	}
+	return true, nil
+}
+
+func cleanupArtifactArchive(buildID uint, archivePath string) {
+	if err := removeArtifactArchive(archivePath); err == nil || errors.Is(err, os.ErrNotExist) {
+		service.ReleaseGithubArtifactTemp(archivePath)
+		return
+	} else {
+		if global.Logger != nil {
+			global.Logger.Errorf("custom build %d failed to remove temporary archive: %s", buildID, service.GithubErrorDetail(err))
+		}
+		scheduleArtifactCleanupRetry(buildID, archivePath)
+	}
+}
+
+func scheduleArtifactCleanupRetryDefault(buildID uint, archivePath string) {
+	go func() {
+		defer service.ReleaseGithubArtifactTemp(archivePath)
+		for attempt := 1; attempt <= artifactCleanupRetryAttempts; attempt++ {
+			time.Sleep(artifactCleanupRetryDelay)
+			err := removeArtifactArchive(archivePath)
+			if err == nil || errors.Is(err, os.ErrNotExist) {
+				return
+			}
+			if global.Logger != nil {
+				global.Logger.Errorf("custom build %d temporary archive cleanup retry %d/%d failed: %s", buildID, attempt, artifactCleanupRetryAttempts, service.GithubErrorDetail(err))
+			}
+		}
+	}()
+}
+
 // defaultWindowsArtifactName — имя GitHub-артефакта, который продюсит
-// windows-min-test workflow. Вынесено из inline-строки (BUGS.md AU-L-011);
-// DownloadArtifact дополнительно умеет взять единственный артефакт рана, если
-// имя не совпало, так что смена воркфлоу не ломает скачивание.
-const defaultWindowsArtifactName = "rustdesk-min-test-windows"
-
-// defaultLinuxWorkflowFilename — имя GitHub-workflow для Linux-сборки (B-012).
-// Файл запушен в форк как .github/workflows/rustqs-linux.yml на rustqs/min-test.
-// Пока константа; вынести в GithubBuildConfig когда workflow будет green.
-const defaultLinuxWorkflowFilename = "rustqs-linux.yml"
-
-// defaultAndroidWorkflowFilename — имя GitHub-workflow для Android-сборки (B-012).
-// Файл запушен в форк как .github/workflows/rustqs-android.yml на rustqs/min-test.
-// Пока константа; вынести в GithubBuildConfig когда workflow будет green.
-const defaultAndroidWorkflowFilename = "rustqs-android.yml"
-
-// List — пагинированный список custom-билдов (admin).
+// rustqs-windows workflow. Вынесено из inline-строки (BUGS.md AU-L-011).
+const defaultWindowsArtifactName = "rustqs-windows"
+
+func artifactNameForPlatform(platform string) string {
+	switch platform {
+	case "linux":
+		return "rustdesk-min-test-linux"
+	case "android":
+		return "rustdesk-min-test-android"
+	default:
+		return defaultWindowsArtifactName
+	}
+}
+
+// List returns the paginated redacted custom-build list for administrators.
+// @Tags CustomBuild
+// @Summary List custom builds
+// @Description Admin-only paginated list. The response uses the redacted CustomBuildSafeList view; provider credentials and storage-only identity fields are not serialized.
+// @Produce json
+// @Param page query int false "Page number"
+// @Param page_size query int false "Number of builds per page"
+// @Success 200 {object} response.Response{data=model.CustomBuildSafeList} "Redacted custom-build list envelope"
+// @Failure 500 {object} response.Response "Custom-build list is unavailable"
+// @Router /admin/custom_build/list [get]
+// @Security token
 func (ct *CustomBuild) List(c *gin.Context) {
 	q := &admin.CustomBuildQuery{}
 	if err := c.ShouldBindQuery(q); err != nil {
 		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
-	res := service.AllService.CustomBuildService.List(uint(q.Page), uint(q.PageSize))
-	response.Success(c, res)
+	res, err := service.AllService.CustomBuildService.List(uint(q.Page), uint(q.PageSize))
+	if err != nil {
+		failCustomBuildRead(c, err)
+		return
+	}
+	response.Success(c, res.Safe())
 }
 
 // Versions — список версий RustDesk, доступных для custom-сборки. На ошибке
 // GitHub API возвращает 200 + пустой массив, чтобы UI мог показать empty/error
 // state, а не 5xx (BUGS.md AU-L-016).
 type versionsResponse struct {
-	Versions []string `json:"versions"`
-	Error    bool     `json:"error"`
+	Versions []versionOption `json:"versions"`
+	Error    bool            `json:"error"`
+}
+
+// versionOption keeps the normal user contract capability-based. Provider
+// refs/SHA values stay server-side and are resolved again at the create
+// boundary; the UI only receives a display version and safe release metadata.
+type versionOption struct {
+	Version       string `json:"version"`
+	AssetsRelease string `json:"assets_release"`
 }
 
+// @Tags CustomBuild
+// @Summary List available custom-build versions
+// @Description Admin-only provider capability list. Only display versions and release labels are returned; provider refs and commit SHAs remain server-side.
+// @Produce json
+// @Success 200 {object} response.Response{data=versionsResponse} "Available version options, with error state"
+// @Router /admin/custom_build/versions [get]
+// @Security token
 func (ct *CustomBuild) Versions(c *gin.Context) {
 	ctx, cancel := context.WithTimeout(c.Request.Context(), 15*time.Second)
 	defer cancel()
 	versions, err := service.AllService.GithubBuildConfigService.GetAvailableVersions(ctx)
 	if err != nil {
-		global.Logger.Warnf("GetAvailableVersions failed: %v", err)
-		response.Success(c, versionsResponse{Versions: []string{}, Error: true})
+		global.Logger.Warnf("GetAvailableVersions failed: %s", service.GithubErrorDetail(err))
+		response.Success(c, versionsResponse{Versions: []versionOption{}, Error: true})
 		return
 	}
-	response.Success(c, versionsResponse{Versions: versions, Error: false})
+	options := make([]versionOption, 0, len(versions))
+	for _, version := range versions {
+		options = append(options, versionOption{
+			Version:       version.DisplayVersion,
+			AssetsRelease: version.AssetsRelease.TagName,
+		})
+	}
+	response.Success(c, versionsResponse{Versions: options, Error: false})
 }
 
 // Detail — admin endpoint: полная запись custom-билда по id.
 func (ct *CustomBuild) Detail(c *gin.Context) {
 	id := c.Param("id")
 	iid, _ := strconv.Atoi(id)
-	u := service.AllService.CustomBuildService.Info(uint(iid))
+	u, err := service.AllService.CustomBuildService.Info(uint(iid))
+	if err != nil {
+		failCustomBuildRead(c, err)
+		return
+	}
 	if u.Id > 0 {
-		response.Success(c, u)
+		response.Success(c, u.Safe())
 		return
 	}
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 }
 
-// Create — admin endpoint: создать custom-билд и поставить его в очередь.
+// Manifest returns the admin-only, secret-free operator handoff for a
+// completed build. The response is canonical JSON data, not a filesystem
+// export or a newly generated ZIP container; published_digest covers the
+// service-owned canonical output that was already proven before completion.
+//
+// @Tags CustomBuild
+// @Summary Export a completed custom-build handoff manifest
+// @Description Admin-only redacted handoff data. The BuildHandoffManifest contains no secrets, raw custom configuration, filesystem paths, or signature claim. The published digest covers stored canonical output and is distinct from the SHA-256 header over these response bytes.
+// @Produce json
+// @Param id path int true "Completed custom build ID"
+// @Success 200 {object} response.Response{data=service.BuildHandoffManifest} "Redacted build handoff envelope"
+// @Header 200 {string} X-DeskForge-Manifest-SHA256 "SHA-256 of the exact response body bytes"
+// @Failure 400 {object} response.Response "Invalid build ID"
+// @Failure 409 {object} response.Response "Completed handoff is unavailable"
+// @Failure 500 {object} response.Response "Handoff is unavailable"
+// @Router /admin/custom_build/manifest/{id} [get]
+// @Security token
+func (ct *CustomBuild) Manifest(c *gin.Context) {
+	parsedID, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil || parsedID == 0 {
+		failCustomValidation(c, errors.New("invalid custom build id"))
+		return
+	}
+	manifest, err := (&service.BuildManifestService{}).ForBuild(uint(parsedID), time.Now().UTC())
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			failCustomBuildRead(c, err)
+			return
+		}
+		if global.Logger != nil {
+			global.Logger.Warnf("custom build %d handoff unavailable", parsedID)
+		}
+		response.FailStatus(c, http.StatusConflict, 101, "custom build handoff is unavailable")
+		return
+	}
+	body, err := json.Marshal(response.Response{Code: 0, Message: "success", Data: manifest})
+	if err != nil {
+		response.FailStatus(c, http.StatusInternalServerError, 101, "custom build handoff is unavailable")
+		return
+	}
+	digest := sha256.Sum256(body)
+	// This header covers the exact redacted JSON response bytes, not the
+	// service-owned publication digest and not a signature.
+	c.Header("X-DeskForge-Manifest-SHA256", hex.EncodeToString(digest[:]))
+	c.Data(http.StatusOK, "application/json; charset=utf-8", body)
+}
+
+// Create queues an administrator-selected custom build after resolving its
+// provider-owned build identity.
 // Валидирует version формат ДО персиста (защита от command injection в
 // workflow shell — see utils.ValidateBuildVersion).
+// @Tags CustomBuild
+// @Summary Create a custom build
+// @Description Admin-only build request. The display version and platform are user-selected capabilities; provider workflow refs, release identity, and dispatch details are resolved server-side.
+// @Accept json
+// @Produce json
+// @Param body body admin.CustomBuildForm true "Custom-build request"
+// @Success 200 {object} response.Response{data=model.CustomBuildSafe} "Redacted queued custom-build envelope"
+// @Failure 400 {object} response.Response "Invalid custom-build request"
+// @Failure 412 {object} response.Response "Workflow reference approval is required"
+// @Failure 500 {object} response.Response "Custom build could not be queued"
+// @Failure 503 {object} response.Response "Build provider or encryption configuration is unavailable"
+// @Router /admin/custom_build/create [post]
+// @Security token
 func (ct *CustomBuild) Create(c *gin.Context) {
 	f := &admin.CustomBuildForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
 		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
+	if f.BuildRef != "" {
+		failCustomValidation(c, fmt.Errorf("build_ref is system-derived and cannot be supplied"))
+		return
+	}
+	if !validateCustomPlatform(c, f.Platform) {
+		return
+	}
 	errList := global.Validator.ValidStruct(c, f)
 	if len(errList) > 0 {
 		response.Fail(c, 101, errList[0])
@@ -114,35 +653,124 @@ func (ct *CustomBuild) Create(c *gin.Context) {
 
 	// Reject unsafe version early; keeps DB clean and gives the caller a clear error.
 	if !utils.ValidateBuildVersion(b.Version) {
-		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+": invalid version format: "+b.Version)
+		failCustomValidation(c, fmt.Errorf("invalid version format: %s", b.Version))
+		return
+	}
+	if err := utils.RequireSecretEncryptionForCustomBuilderJSON(b.CustomJson); err != nil {
+		if failCustomServiceError(c, err) {
+			return
+		}
+		response.FailStatus(c, http.StatusServiceUnavailable, 101, "secret encryption is not configured")
+		return
+	}
+	if err := service.RequireConfiguredPublicKey(); err != nil {
+		var providerErr *service.GithubProviderConfigurationError
+		if errors.As(err, &providerErr) {
+			response.FailStatus(c, http.StatusServiceUnavailable, 101, "GitHub build provider is not configured")
+			return
+		}
+		response.FailStatus(c, http.StatusServiceUnavailable, 101, "configured public key is unavailable")
+		return
+	}
+
+	prepareCtx, prepareCancel := context.WithTimeout(c.Request.Context(), 20*time.Second)
+	prepared, err := service.AllService.GithubBuildConfigService.PrepareBuild(prepareCtx, b.Platform, b.Version)
+	prepareCancel()
+	if err != nil {
+		var capabilityErr *service.ProductionCapabilityUnavailableError
+		if errors.As(err, &capabilityErr) {
+			failGithubConfigError(c, err)
+			return
+		}
+		var providerErr *service.GithubProviderConfigurationError
+		if errors.As(err, &providerErr) {
+			failGithubConfigError(c, err)
+			return
+		}
+		var approvalErr *service.WorkflowRefApprovalError
+		if errors.As(err, &approvalErr) {
+			response.FailStatus(c, http.StatusPreconditionFailed, 101, "workflow reference approval is required")
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
 
-	err := service.AllService.CustomBuildService.Create(b)
+	normalized, err := service.AllService.CustomBuildService.CreateNormalizedWithIdentity(b, prepared.Identity)
 	if err != nil {
+		if failCustomServiceError(c, err) {
+			return
+		}
 		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
 		return
 	}
 
-	ct.submitBuild(b)
+	if err := ct.submitBuild(b, prepared.Config, normalized.DispatchParams); err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		response.Fail(c, 101, "GitHub workflow dispatch failed")
+		return
+	}
 
-	response.Success(c, b)
+	response.Success(c, b.Safe())
 }
 
-// Delete — admin endpoint: удалить custom-билд (запись + артефакты).
+// Delete removes an administrator-owned custom-build record and its artifacts.
+// @Tags CustomBuild
+// @Summary Delete a custom build
+// @Description Admin-only deletion of a custom-build record and its published artifacts.
+// @Accept json
+// @Produce json
+// @Param body body admin.CustomBuildForm true "Custom-build identifier"
+// @Success 200 {object} response.Response "Custom build deleted"
+// @Failure 500 {object} response.Response "Custom build could not be deleted"
+// @Router /admin/custom_build/delete [post]
+// @Security token
 func (ct *CustomBuild) Delete(c *gin.Context) {
 	f := &admin.CustomBuildForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
 		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
-	ex := service.AllService.CustomBuildService.Info(f.Id)
+	ex, err := service.AllService.CustomBuildService.Info(f.Id)
+	if err != nil {
+		failCustomBuildRead(c, err)
+		return
+	}
+	if ex.Id == 0 {
+		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
+		return
+	}
+	release, err := activeGithubPolls.acquire(c.Request.Context(), ex.Id)
+	if err != nil {
+		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
+		return
+	}
+	defer release()
+	// The row may have been deleted or changed while Delete waited for the
+	// in-flight poll to release the same process-local lifecycle guard.
+	ex, err = service.AllService.CustomBuildService.Info(f.Id)
+	if err != nil {
+		failCustomBuildRead(c, err)
+		return
+	}
 	if ex.Id == 0 {
 		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 		return
 	}
-	err := service.AllService.CustomBuildService.Delete(ex)
+	err = service.AllService.CustomBuildService.Delete(ex)
 	if err != nil {
+		var cleanupPending *service.CustomBuildCleanupPending
+		if errors.As(err, &cleanupPending) {
+			if global.Logger != nil {
+				global.Logger.Warnf("custom build %d deleted from database; artifact cleanup remains pending: %s", ex.Id, service.GithubErrorDetail(err))
+			}
+			// Preserve HTTP/UI deletion success after the irreversible DB delete,
+			// but expose the filesystem warning without requiring a new API shape.
+			response.Success(c, gin.H{"cleanup_pending": true})
+			return
+		}
 		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
 		return
 	}
@@ -165,6 +793,20 @@ func findBuildByDownloadKey(key string) (*model.CustomBuild, int, bool) {
 	return &build, 200, true
 }
 
+// DetailByKey returns a redacted build view through a public capability URL.
+// No authentication is required; the opaque key is the capability and is
+// subject to the configured download-key-ttl (default seven days for newly
+// created builds). Expired keys return HTTP 410.
+//
+// @Tags CustomBuild
+// @Summary Read a completed custom build by capability key
+// @Description Public capability route with no authentication. The key expires according to download-key-ttl; an expired key returns 410. The response uses the public CustomBuildPublic view and omits download_key, provider refs, and secrets.
+// @Produce json
+// @Param key path string true "Opaque build capability key"
+// @Success 200 {object} response.Response{data=model.CustomBuildPublic} "Public build detail envelope without download_key"
+// @Failure 409 {object} response.Response "Build is not publicly ready"
+// @Failure 410 {object} response.Response "Capability key has expired"
+// @Router /admin/custom_build/public/detailByKey/{key} [get]
 func (ct *CustomBuild) DetailByKey(c *gin.Context) {
 	key := c.Param("key")
 	build, status, ok := findBuildByDownloadKey(key)
@@ -176,18 +818,44 @@ func (ct *CustomBuild) DetailByKey(c *gin.Context) {
 		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 		return
 	}
-	response.Success(c, build)
+	if _, _, err := service.ValidateCompletedPublishedOutput(build); err != nil {
+		if global.Logger != nil {
+			global.Logger.Warnf("DetailByKey: build %d is not publicly ready: %s", build.Id, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusConflict, gin.H{
+			"code":    http.StatusConflict,
+			"message": "build is not publicly ready",
+		})
+		return
+	}
+	response.Success(c, build.Public())
 }
 
-// DownloadByKey — public: отдаёт zip с файлами собранного билда из
-// /rdgen-data/output/{id}/. Capability URL (тот же download_key что у DetailByKey).
-// Если статус не done или файлов нет — 409/404.
+// DownloadByKey is the public capability URL. The capability key remains the
+// only credential accepted by this unauthenticated route.
 //
-// Zip собирается стримом прямо в response writer (BUGS.md B-007). Раньше билд
-// складывался в `bytes.Buffer` целиком — это OOM-риск, когда артефакт включает
-// flutter runtime + dll'ки + portable packer (~20+ МБ × n параллельных скачиваний).
-// Content-Length не отдаём — длину знаем только после Close(), стрим уйдёт chunked.
+// @Tags CustomBuild
+// @Summary Download a completed custom build by capability key
+// @Description Public capability route with no authentication. The key expires according to download-key-ttl; an expired key returns 410. The response is the exact redacted ZIP bytes served by this response, not the stored publication output digest and not a signature.
+// @Produce application/zip
+// @Param key path string true "Opaque build capability key"
+// @Success 200 {file} file "Redacted custom-build ZIP archive"
+// @Header 200 {string} Content-Length "Exact ZIP response length in bytes"
+// @Header 200 {string} Content-Disposition "Attachment filename"
+// @Header 200 {string} X-DeskForge-Archive-SHA256 "SHA-256 of the exact ZIP bytes served by this response"
+// @Header 200 {string} X-DeskForge-Archive-SHA256-Scope "Digest scope; distinct from the stored publication digest"
+// @Failure 408 {object} response.Response "Download request was cancelled or timed out"
+// @Failure 409 {object} response.Response "Build completion or output provenance is unavailable"
+// @Failure 410 {object} response.Response "Capability key has expired"
+// @Failure 416 {object} response.Response "Range requests are not supported"
+// @Failure 500 {object} response.Response "ZIP packaging or validation failed"
+// @Router /admin/custom_build/public/download/{key} [get]
 func (ct *CustomBuild) DownloadByKey(c *gin.Context) {
+	// Preserve the public route's fail-closed Range behavior even when the key
+	// is invalid; no lookup or response headers are needed for a rejected range.
+	if rejectDownloadRange(c) {
+		return
+	}
 	key := c.Param("key")
 	build, status, ok := findBuildByDownloadKey(key)
 	if !ok {
@@ -198,469 +866,1633 @@ func (ct *CustomBuild) DownloadByKey(c *gin.Context) {
 		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 		return
 	}
-	if build.Status != model.CustomBuildStatusDone {
-		c.JSON(409, gin.H{
-			"code":    409,
-			"message": "build is not ready (status=" + build.Status + ")",
-		})
+	ct.downloadCompletedBuild(c, build, "DownloadByKey")
+}
+
+// DownloadByID streams a completed build to an authenticated administrator.
+// Unlike the public capability route, it resolves the artifact by the
+// administrator-selected build ID and never serializes or accepts DownloadKey.
+//
+// @Tags CustomBuild
+// @Summary Download a completed custom build by ID
+// @Description Admin-only download by build ID. BackendUserAuth and AdminPrivilege authorize the request; the build must have a complete immutable publication proof. The response is the exact redacted ZIP bytes served by this response, not the stored publication output digest and not a signature.
+// @Produce application/zip
+// @Param id path int true "Completed custom build ID"
+// @Success 200 {file} file "Redacted custom-build ZIP archive"
+// @Header 200 {string} Content-Length "Exact ZIP response length in bytes"
+// @Header 200 {string} Content-Disposition "Attachment filename"
+// @Header 200 {string} X-DeskForge-Archive-SHA256 "SHA-256 of the exact ZIP bytes served by this response"
+// @Header 200 {string} X-DeskForge-Archive-SHA256-Scope "Digest scope; distinct from the stored publication digest"
+// @Failure 400 {object} response.Response "Invalid build ID"
+// @Failure 403 {object} response.Response "Administrator authentication or privilege is required"
+// @Failure 408 {object} response.Response "Download request was cancelled or timed out"
+// @Failure 409 {object} response.Response "Build completion or output provenance is unavailable"
+// @Failure 416 {object} response.Response "Range requests are not supported"
+// @Failure 500 {object} response.Response "ZIP packaging or validation failed"
+// @Router /admin/custom_build/download/{id} [get]
+// @Security token
+func (ct *CustomBuild) DownloadByID(c *gin.Context) {
+	parsedID, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil || parsedID == 0 {
+		failCustomValidation(c, errors.New("invalid custom build id"))
 		return
 	}
-
-	dir := service.BuildOutputDir(build.Id)
-	entries, err := os.ReadDir(dir)
-	if err != nil || len(entries) == 0 {
-		c.JSON(404, gin.H{
-			"code":    404,
-			"message": "build artifacts not found on disk",
-		})
+	build, err := service.AllService.CustomBuildService.Info(uint(parsedID))
+	if err != nil {
+		failCustomBuildRead(c, err)
 		return
 	}
-
-	appName := build.AppName
-	if appName == "" {
-		appName = "rustqs"
+	if build.Id == 0 {
+		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
+		return
 	}
+	ct.downloadCompletedBuild(c, build, "DownloadByID")
+}
 
-	// Заголовки ДО первого Write — gin/net-http запретит их менять после.
-	c.Header("Content-Type", "application/zip")
-	c.Header("Content-Disposition", fmt.Sprintf(`attachment; filename="%s-%s.zip"`,
-		appName, time.Now().Format("20060102-150405")))
-	c.Status(200)
-
-	zw := zip.NewWriter(c.Writer)
-	defer zw.Close()
-	for _, e := range entries {
-		if e.IsDir() {
-			continue
-		}
-		full := filepath.Join(dir, e.Name())
-		f, openErr := os.Open(full)
-		if openErr != nil {
-			global.Logger.Warnf("DownloadByKey: skip %s: %v", full, openErr)
-			continue
-		}
-		w, createErr := zw.Create(e.Name())
-		if createErr != nil {
-			f.Close()
-			global.Logger.Warnf("DownloadByKey: zw.Create(%s): %v", e.Name(), createErr)
-			continue
-		}
-		if _, copyErr := io.Copy(w, f); copyErr != nil {
-			// клиент отвалился — zw.Close() в defer тоже упадёт, это OK
-			f.Close()
-			global.Logger.Warnf("DownloadByKey: copy %s: %v", e.Name(), copyErr)
-			return
-		}
-		f.Close()
+func rejectDownloadRange(c *gin.Context) bool {
+	if c.Request.Header.Get("Range") == "" {
+		return false
 	}
+	response.FailStatus(c, http.StatusRequestedRangeNotSatisfiable, http.StatusRequestedRangeNotSatisfiable, "range requests are not supported")
+	return true
 }
 
-// submitBuild — направляет job в соответствующий backend:
-//   - windows/linux/android + настроенный GithubBuildConfig → workflow_dispatch + async polling
-//   - иначе → файл-очередь rdgen-data/jobs (для агентов без GitHub)
-func (ct *CustomBuild) submitBuild(b *model.CustomBuild) {
-	// windows/linux/android (B-012) маршрутизируются в GitHub Actions; остальное — файл-очередь.
-	if b.Platform == "windows" || b.Platform == "linux" || b.Platform == "android" {
-		if ct.tryGithubDispatch(b) {
-			return
+// downloadCompletedBuild is the shared authenticated/capability archive
+// pipeline. It validates publication state, snapshots and packages the exact
+// redacted output, rechecks the stored digest before opening the archive, and
+// only then commits download headers. Keep both routes on this path so their
+// TOCTOU, range, archive digest, and secret-redaction behavior cannot diverge.
+func (ct *CustomBuild) downloadCompletedBuild(c *gin.Context, build *model.CustomBuild, operation string) {
+	if rejectDownloadRange(c) {
+		return
+	}
+	if _, _, err := service.ValidateCompletedPublishedOutput(build); err != nil {
+		if global.Logger != nil {
+			global.Logger.Warnf("%s: build %d has invalid completion provenance: %s", operation, build.Id, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusConflict, gin.H{
+			"code":    http.StatusConflict,
+			"message": "build completion provenance is unavailable",
+		})
+		return
+	}
+
+	select {
+	case downloadArchiveSlots <- struct{}{}:
+		defer func() { <-downloadArchiveSlots }()
+	case <-c.Request.Context().Done():
+		c.JSON(http.StatusRequestTimeout, gin.H{"code": http.StatusRequestTimeout, "message": "download request cancelled"})
+		return
+	}
+	if _, err := service.ValidatePublishedOutputDigest(build); err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: published output is not immutable for build %d: %s", operation, build.Id, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "published build artifact is no longer valid",
+		})
+		return
+	}
+	archivePath, archiveSize, err := buildDownloadArchive(c.Request.Context(), build)
+	if err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: package build %d: %s", operation, build.Id, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "failed to package build artifacts",
+		})
+		return
+	}
+	defer cleanupArtifactArchive(build.Id, archivePath)
+	// Recompute again after packaging and immediately before opening the
+	// archive. A mutation between the initial guard and packaging fails closed
+	// without committing response headers.
+	if _, err := service.ValidatePublishedOutputDigest(build); err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: published output changed for build %d: %s", operation, build.Id, service.GithubErrorDetail(err))
 		}
-		// fallback: продолжаем в файл-очередь (если GitHub не настроен)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "published build artifact is no longer valid",
+		})
+		return
+	}
+
+	archive, err := os.Open(archivePath)
+	if err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: open completed archive: %s", operation, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "failed to open build archive",
+		})
+		return
+	}
+	archiveSHA, err := hashDownloadArchive(archive, archiveSize)
+	if err != nil {
+		_ = archive.Close()
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: hash completed archive for build %d: %s", operation, build.Id, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "failed to verify build archive",
+		})
+		return
 	}
-	jobsDir := "/rdgen-data/jobs"
-	if err := os.MkdirAll(jobsDir, 0755); err != nil {
-		global.Logger.Warnf("failed to create rdgen jobs dir %s: %v", jobsDir, err)
+	if _, err := archive.Seek(0, io.SeekStart); err != nil {
+		_ = archive.Close()
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: rewind completed archive for build %d: %s", operation, build.Id, service.GithubErrorDetail(err))
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "failed to prepare build archive",
+		})
 		return
 	}
-	job := map[string]interface{}{
-		"id":           b.Id,
-		"platform":     b.Platform,
-		"version":      b.Version,
-		"app_name":     b.AppName,
-		"custom_json":  b.CustomJson,
-		"host":         global.Config.Rustdesk.ApiServer,
-		"key":          global.Config.Rustdesk.Key,
-		"api_server":   global.Config.Rustdesk.ApiServer,
-		"relay_server": global.Config.Rustdesk.RelayServer,
-		"api_base":     global.Config.App.ApiBase,
+
+	appName := build.AppName
+	if err := service.ValidateOutputAppName(appName); err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("%s: invalid output app name for build %d: %s", operation, build.Id, service.GithubErrorDetail(err))
+		}
+		_ = archive.Close()
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code":    http.StatusInternalServerError,
+			"message": "invalid build output name",
+		})
+		return
 	}
-	data, _ := json.Marshal(job)
-	jobFile := filepath.Join(jobsDir, fmt.Sprintf("%d.json", b.Id))
-	if err := os.WriteFile(jobFile, data, 0644); err != nil {
-		global.Logger.Errorf("failed to write build job file: %v", err)
+	c.Header("Content-Type", "application/zip")
+	c.Header("Content-Disposition", fmt.Sprintf(`attachment; filename="%s-%s.zip"`,
+		appName, time.Now().Format("20060102-150405")))
+	c.Header("Content-Length", strconv.FormatInt(archiveSize, 10))
+	// This digest covers the exact ZIP bytes written below, not the stored
+	// publication digest and not a signature. The scope header makes that
+	// distinction explicit to clients.
+	c.Header("X-DeskForge-Archive-SHA256", archiveSHA)
+	c.Header("X-DeskForge-Archive-SHA256-Scope", downloadArchiveDigestScope)
+	http.ServeContent(c.Writer, c.Request, filepath.Base(archivePath), time.Now(), archive)
+	if err := archive.Close(); err != nil && global.Logger != nil {
+		global.Logger.Warnf("%s: close served archive: %s", operation, service.GithubErrorDetail(err))
 	}
 }
 
-// tryGithubDispatch — пытается направить windows-сборку в GitHub Actions.
-// Возвращает false если GithubBuildConfig не настроен (тогда вызывающий делает fallback).
-func (ct *CustomBuild) tryGithubDispatch(b *model.CustomBuild) bool {
-	gcfg, err := service.AllService.GithubBuildConfigService.Get()
-	if err != nil || gcfg == nil || gcfg.Token == "" || gcfg.Repo == "" || gcfg.PayloadKey == "" {
-		return false
+func buildDownloadArchive(ctx context.Context, build *model.CustomBuild) (archivePath string, archiveSize int64, err error) {
+	if err := ctx.Err(); err != nil {
+		return "", 0, err
+	}
+	if build == nil {
+		return "", 0, errors.New("build record is required")
+	}
+	return archivePath, archiveSize, service.WithPublishedOutputExportLock(func() error {
+		dir := service.BuildOutputDir(build.Id)
+		beforeDigest, digestErr := service.PublishedOutputDigest(build)
+		if digestErr != nil {
+			return fmt.Errorf("validate published output before packaging: %w", digestErr)
+		}
+		if build.PublishedDigest != "" && !strings.EqualFold(build.PublishedDigest, beforeDigest) {
+			return errors.New("published output digest does not match recorded digest")
+		}
+		snapshotDir, files, snapshotErr := collectDownloadSnapshot(ctx, dir, build.Id)
+		if snapshotErr != nil {
+			return snapshotErr
+		}
+		defer cleanupDownloadSnapshot(snapshotDir)
+		downloadArchiveSnapshotHook()
+
+		buildID := build.Id
+		parent := filepath.Dir(dir)
+		part, createErr := os.CreateTemp(parent, fmt.Sprintf(".%d-download-*.zip.part", buildID))
+		if createErr != nil {
+			return fmt.Errorf("create temporary download archive: %w", createErr)
+		}
+		partPath := part.Name()
+		archivePath = strings.TrimSuffix(partPath, ".part")
+		service.ProtectGithubArtifactTemp(partPath)
+		service.ProtectGithubArtifactTemp(archivePath)
+		keepArchive := false
+		defer func() {
+			if !keepArchive {
+				_ = os.Remove(partPath)
+				_ = os.Remove(archivePath)
+				service.ReleaseGithubArtifactTemp(partPath)
+				service.ReleaseGithubArtifactTemp(archivePath)
+			}
+		}()
+
+		limited := &downloadArchiveLimitWriter{writer: part, limit: downloadArchiveMaxOutputBytes}
+		zw := zip.NewWriter(limited)
+		for _, file := range files {
+			if err := ctx.Err(); err != nil {
+				_ = part.Close()
+				return err
+			}
+			input, openErr := os.Open(file.path)
+			if openErr != nil {
+				_ = part.Close()
+				return fmt.Errorf("open build snapshot %q: %w", file.name, openErr)
+			}
+			output, createErr := zw.Create(file.name)
+			if createErr != nil {
+				_ = input.Close()
+				_ = part.Close()
+				return fmt.Errorf("create ZIP entry %q: %w", file.name, createErr)
+			}
+			hasher := sha256.New()
+			if _, copyErr := copyDownloadSourceLimit(ctx, io.MultiWriter(output, hasher), input, file.size); copyErr != nil {
+				_ = input.Close()
+				_ = part.Close()
+				return fmt.Errorf("copy build snapshot %q: %w", file.name, copyErr)
+			}
+			if hex.EncodeToString(hasher.Sum(nil)) != file.sha {
+				_ = input.Close()
+				_ = part.Close()
+				return fmt.Errorf("build snapshot %q changed during packaging", file.name)
+			}
+			if closeErr := input.Close(); closeErr != nil {
+				_ = part.Close()
+				return fmt.Errorf("close build snapshot %q: %w", file.name, closeErr)
+			}
+		}
+		if err := zw.Close(); err != nil {
+			_ = part.Close()
+			return fmt.Errorf("close ZIP archive: %w", err)
+		}
+		if err := part.Sync(); err != nil {
+			_ = part.Close()
+			return fmt.Errorf("sync ZIP archive: %w", err)
+		}
+		if err := part.Close(); err != nil {
+			return fmt.Errorf("close temporary ZIP archive: %w", err)
+		}
+		if limited.written > downloadArchiveMaxOutputBytes {
+			return fmt.Errorf("completed ZIP exceeds output limit")
+		}
+		if err := validateDownloadArchive(ctx, partPath); err != nil {
+			return err
+		}
+		if err := os.Rename(partPath, archivePath); err != nil {
+			return fmt.Errorf("publish completed ZIP archive: %w", err)
+		}
+		service.ReleaseGithubArtifactTemp(partPath)
+		archiveInfo, statErr := os.Stat(archivePath)
+		if statErr != nil {
+			return fmt.Errorf("stat completed ZIP archive: %w", statErr)
+		}
+		afterDigest, digestErr := service.PublishedOutputDigest(build)
+		if digestErr != nil {
+			return fmt.Errorf("recheck published output after packaging: %w", digestErr)
+		}
+		if beforeDigest != afterDigest || (build.PublishedDigest != "" && !strings.EqualFold(build.PublishedDigest, afterDigest)) {
+			return errors.New("published output changed during archive packaging")
+		}
+		keepArchive = true
+		archiveSize = archiveInfo.Size()
+		return nil
+	})
+}
+
+type downloadSnapshotFile struct {
+	name string
+	path string
+	size int64
+	sha  string
+}
+
+func cleanupDownloadSnapshot(snapshotDir string) {
+	if snapshotDir == "" {
+		return
+	}
+	_ = os.RemoveAll(snapshotDir)
+	service.ReleaseBuildOutputSnapshot(snapshotDir)
+}
+
+func collectDownloadSnapshot(ctx context.Context, dir string, buildID uint) (string, []downloadSnapshotFile, error) {
+	if downloadArchiveMaxFiles <= 0 || downloadArchiveMaxFileBytes <= 0 || downloadArchiveMaxSourceBytes <= 0 {
+		return "", nil, errors.New("download archive source limits are invalid")
+	}
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return "", nil, fmt.Errorf("read build output directory: %w", err)
+	}
+	if len(entries) > downloadArchiveMaxFiles {
+		return "", nil, fmt.Errorf("build output contains too many files: %d", len(entries))
+	}
+	parent := filepath.Dir(dir)
+	snapshotDir, err := os.MkdirTemp(parent, fmt.Sprintf(".%d-snapshot-*", buildID))
+	if err != nil {
+		return "", nil, fmt.Errorf("create output snapshot: %w", err)
+	}
+	if err := os.Chmod(snapshotDir, 0700); err != nil {
+		_ = os.RemoveAll(snapshotDir)
+		return "", nil, fmt.Errorf("restrict output snapshot: %w", err)
+	}
+	service.ProtectBuildOutputSnapshot(snapshotDir)
+	keep := false
+	defer func() {
+		if !keep {
+			cleanupDownloadSnapshot(snapshotDir)
+		}
+	}()
+	files := make([]downloadSnapshotFile, 0, len(entries))
+	publicCustomTxtAdded := false
+	var sourceBytes int64
+	for _, entry := range entries {
+		if err := ctx.Err(); err != nil {
+			return "", nil, err
+		}
+		full := filepath.Join(dir, entry.Name())
+		info, err := os.Lstat(full)
+		if err != nil {
+			return "", nil, fmt.Errorf("inspect build artifact %q: %w", entry.Name(), err)
+		}
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return "", nil, fmt.Errorf("build artifact %q is not a regular file", entry.Name())
+		}
+		if info.Size() < 0 || info.Size() > downloadArchiveMaxFileBytes {
+			return "", nil, fmt.Errorf("build artifact %q exceeds uncompressed limit", entry.Name())
+		}
+		if sourceBytes > downloadArchiveMaxSourceBytes-info.Size() {
+			return "", nil, errors.New("build artifact source exceeds aggregate uncompressed limit")
+		}
+		isCustomTxt := strings.EqualFold(entry.Name(), "custom_.txt")
+		if isCustomTxt && info.Size() > service.MaxPublicCustomTxtBytes {
+			// Never fall back to copying an oversized private custom_.txt.
+			// The client remains valid through its compiled L1 settings.
+			continue
+		}
+		input, err := os.Open(full)
+		if err != nil {
+			return "", nil, fmt.Errorf("open build artifact %q: %w", entry.Name(), err)
+		}
+		snapshotName := entry.Name()
+		var publicContents []byte
+		if isCustomTxt {
+			raw, readErr := io.ReadAll(io.LimitReader(input, service.MaxPublicCustomTxtBytes+1))
+			inputCloseErr := input.Close()
+			if readErr != nil {
+				return "", nil, fmt.Errorf("read build artifact %q: %w", entry.Name(), readErr)
+			}
+			if inputCloseErr != nil {
+				return "", nil, fmt.Errorf("close build artifact %q: %w", entry.Name(), inputCloseErr)
+			}
+			if int64(len(raw)) != info.Size() {
+				return "", nil, fmt.Errorf("build artifact %q changed during snapshot", entry.Name())
+			}
+			publicEncoded, transformErr := service.PublicCustomTxt(string(raw))
+			if transformErr != nil {
+				// Malformed, unknown, or secret-like native content is omitted;
+				// it is never copied as an opaque public file.
+				continue
+			}
+			if publicCustomTxtAdded {
+				continue
+			}
+			publicCustomTxtAdded = true
+			snapshotName = "custom_.txt"
+			publicContents = []byte(publicEncoded)
+		}
+		snapshotPath := filepath.Join(snapshotDir, snapshotName)
+		output, err := os.OpenFile(snapshotPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+		if err != nil {
+			_ = input.Close()
+			return "", nil, fmt.Errorf("create build snapshot %q: %w", entry.Name(), err)
+		}
+		hasher := sha256.New()
+		var copied int64
+		var copyErr error
+		if publicContents != nil {
+			copied, copyErr = copyDownloadSourceLimit(ctx, io.MultiWriter(output, hasher), strings.NewReader(string(publicContents)), int64(len(publicContents)))
+		} else {
+			copyLimit := info.Size()
+			if copyLimit == 0 {
+				copyLimit = 1
+			}
+			copied, copyErr = copyDownloadSourceLimit(ctx, io.MultiWriter(output, hasher), input, copyLimit)
+		}
+		inputCloseErr := error(nil)
+		if publicContents == nil {
+			inputCloseErr = input.Close()
+		}
+		outputCloseErr := output.Close()
+		if copyErr != nil {
+			return "", nil, fmt.Errorf("snapshot build artifact %q: %w", entry.Name(), copyErr)
+		}
+		expectedSnapshotSize := info.Size()
+		if publicContents != nil {
+			expectedSnapshotSize = int64(len(publicContents))
+		}
+		if inputCloseErr != nil || outputCloseErr != nil || copied != expectedSnapshotSize {
+			return "", nil, fmt.Errorf("build artifact %q changed during snapshot", entry.Name())
+		}
+		sourceBytes += copied
+		files = append(files, downloadSnapshotFile{
+			name: snapshotName,
+			path: snapshotPath,
+			size: copied,
+			sha:  hex.EncodeToString(hasher.Sum(nil)),
+		})
+	}
+	keep = true
+	return snapshotDir, files, nil
+}
+
+func hashDownloadArchive(archive *os.File, archiveSize int64) (string, error) {
+	if archiveSize < 0 || archiveSize > downloadArchiveMaxOutputBytes {
+		return "", errors.New("completed ZIP exceeds output limit")
+	}
+	info, err := archive.Stat()
+	if err != nil {
+		return "", fmt.Errorf("stat completed ZIP archive: %w", err)
+	}
+	if !info.Mode().IsRegular() || info.Size() != archiveSize {
+		return "", errors.New("completed ZIP archive changed before serving")
+	}
+	hasher := sha256.New()
+	copied, err := io.Copy(hasher, io.LimitReader(archive, archiveSize+1))
+	if err != nil {
+		return "", fmt.Errorf("hash completed ZIP archive: %w", err)
+	}
+	if copied != archiveSize {
+		return "", errors.New("completed ZIP archive changed while hashing")
+	}
+	return hex.EncodeToString(hasher.Sum(nil)), nil
+}
+
+type downloadArchiveLimitWriter struct {
+	writer  io.Writer
+	limit   int64
+	written int64
+}
+
+func (w *downloadArchiveLimitWriter) Write(p []byte) (int, error) {
+	if w.limit <= 0 || int64(len(p)) > w.limit-w.written {
+		return 0, errors.New("download archive output exceeds limit")
+	}
+	n, err := w.writer.Write(p)
+	w.written += int64(n)
+	return n, err
+}
+
+func copyDownloadSource(ctx context.Context, dst io.Writer, src io.Reader) (int64, error) {
+	return copyDownloadSourceLimit(ctx, dst, src, 0)
+}
+
+func copyDownloadSourceLimit(ctx context.Context, dst io.Writer, src io.Reader, limit int64) (int64, error) {
+	buf := make([]byte, 32*1024)
+	var written int64
+	emptyReads := 0
+	for {
+		if err := ctx.Err(); err != nil {
+			return written, err
+		}
+		n, readErr := src.Read(buf)
+		if n > 0 {
+			if limit > 0 && written > limit-int64(n) {
+				return written, fmt.Errorf("source exceeds uncompressed limit of %d bytes", limit)
+			}
+			emptyReads = 0
+			if err := ctx.Err(); err != nil {
+				return written, err
+			}
+			writtenNow, writeErr := dst.Write(buf[:n])
+			written += int64(writtenNow)
+			if writeErr != nil {
+				return written, writeErr
+			}
+			if writtenNow != n {
+				return written, io.ErrShortWrite
+			}
+		} else if readErr == nil {
+			emptyReads++
+			if emptyReads >= 100 {
+				return written, io.ErrNoProgress
+			}
+		}
+		if readErr != nil {
+			if errors.Is(readErr, io.EOF) {
+				return written, nil
+			}
+			return written, readErr
+		}
+	}
+}
+
+func validateDownloadArchive(ctx context.Context, archivePath string) error {
+	reader, err := zip.OpenReader(archivePath)
+	if err != nil {
+		return fmt.Errorf("validate ZIP archive: %w", err)
+	}
+	for _, entry := range reader.File {
+		if entry.FileInfo().IsDir() {
+			continue
+		}
+		input, openErr := entry.Open()
+		if openErr != nil {
+			_ = reader.Close()
+			return fmt.Errorf("open ZIP entry %q during validation: %w", entry.Name, openErr)
+		}
+		_, copyErr := copyDownloadSource(ctx, io.Discard, input)
+		closeErr := input.Close()
+		if copyErr != nil {
+			_ = reader.Close()
+			return fmt.Errorf("validate ZIP entry %q: %w", entry.Name, copyErr)
+		}
+		if closeErr != nil {
+			_ = reader.Close()
+			return fmt.Errorf("close ZIP entry %q during validation: %w", entry.Name, closeErr)
+		}
+	}
+	if err := reader.Close(); err != nil {
+		return fmt.Errorf("close ZIP validation reader: %w", err)
+	}
+	return nil
+}
+
+// submitBuild sends every production custom build to the configured GitHub
+// provider. Frozen manual builders are intentionally outside this API path.
+func (ct *CustomBuild) submitBuild(b *model.CustomBuild, config service.GithubBuildConfigSnapshot, dispatchParams map[string]any) error {
+	if err := service.RequireProductionBuildCapability(b.Platform); err != nil {
+		return err
+	}
+	return ct.tryGithubDispatch(b, config, dispatchParams)
+}
+
+// tryGithubDispatch dispatches through the fixed platform workflow. The
+// production API has no local file-queue fallback.
+func (ct *CustomBuild) tryGithubDispatch(b *model.CustomBuild, config service.GithubBuildConfigSnapshot, dispatchParams map[string]any) error {
+	if err := service.RequireProductionBuildCapability(b.Platform); err != nil {
+		return err
+	}
+	if config.Token == "" || config.Repo == "" || config.PayloadKey == "" {
+		providerErr := &service.GithubProviderConfigurationError{Cause: errors.New("GitHub build provider is not configured")}
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog("", service.GithubErrorDetail(providerErr))
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
+		}
+		return providerErr
+	}
+	identity, err := service.VersionIdentityFromRecord(b)
+	if err != nil {
+		global.Logger.Errorf("tryGithubDispatch: build %d has no immutable version identity: %s", b.Id, service.GithubErrorDetail(err))
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog("", "immutable GitHub build identity is unavailable")
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
+		}
+		return err
+	}
+	if identity.Repo != config.Repo {
+		err := fmt.Errorf("stored version identity repo %q does not match configured repo", identity.Repo)
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog("", "immutable GitHub build identity mismatch")
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
+		}
+		return err
 	}
 	// Validate version format to prevent command injection in workflow shell commands.
-	// b.Version попадает в env VERSION, используется в echo "VERSION=$RQS_VERSION" >> $GITHUB_ENV
+	// b.Version попадает в env VERSION через безопасную запись workflow env-файла
 	// и в download URL (`offline-assets-${VERSION}/...`) — shell metacharacters опасны.
 	if !utils.ValidateBuildVersion(b.Version) {
 		global.Logger.Warnf("tryGithubDispatch: invalid version format %q for build %d — failing build",
 			b.Version, b.Id)
 		b.Status = model.CustomBuildStatusFailed
-		b.BuildLog = "invalid version format: " + b.Version
-		_ = service.AllService.CustomBuildService.Update(b)
-		return true
-	}
-	// B-012: выбираем workflow по платформе. windows — настраиваемый
-	// gcfg.WorkflowFilename; linux — пока константа (см. defaultLinuxWorkflowFilename).
-	workflow := gcfg.WorkflowFilename
-	switch b.Platform {
-	case "linux":
-		workflow = defaultLinuxWorkflowFilename
-	case "android":
-		workflow = defaultAndroidWorkflowFilename
+		b.BuildLog = boundedBuildLog("", "invalid version format: "+b.Version)
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
+		}
+		return nil
 	}
-	if workflow == "" {
-		return false
+	if err := service.ValidateBuildRecordContext(service.BuildRecordContext{
+		BuildID:  b.Id,
+		Platform: b.Platform,
+		AppName:  b.AppName,
+		Version:  b.Version,
+	}); err != nil {
+		global.Logger.Warnf("invalid build context for build %d: %s", b.Id, service.GithubErrorDetail(err))
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog("", "invalid build context")
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
+		}
+		return nil
 	}
-	// Копия конфига: подменяем workflow (зависит от платформы) и нормализуем branch.
-	// Branch в БД мог остаться "master" от старой установки — форсируем rustqs/min-test,
-	// потому что воркфлоу rustqs-* живут только на этой ветке.
-	dispatchCfg := *gcfg
-	dispatchCfg.WorkflowFilename = workflow
-	dispatchCfg.Branch = "rustqs/min-test"
-
-	// Извлекаем параметры из CustomJson (произвольный JSON формы).
-	// version передаётся в workflow для VERSION env (скачивание ассетов).
-	// Фактическая версия клиента определяется кодом на rustqs/min-test ветке форка.
-	params := map[string]any{
-		"app_name": b.AppName,
-		"version":  b.Version,
-	}
-	if b.CustomJson != "" {
-		var raw map[string]any
-		if json.Unmarshal([]byte(b.CustomJson), &raw) == nil {
-			// server: воркфлоу ждёт ключ `server`; форма хранит `server_ip` — поддержим оба.
-			if v, ok := raw["server"]; ok {
-				params["server"] = v
-			} else if v, ok := raw["server_ip"]; ok {
-				params["server"] = v
-			}
-			// Strip port — client appends ports automatically.
-			// Стрипаем только числовой порт (:\d+$), а не любой суффикс после :.
-			if s, ok := params["server"].(string); ok {
-				if i := strings.LastIndex(s, ":"); i > 0 {
-					if _, err := strconv.Atoi(s[i+1:]); err == nil {
-						params["server"] = s[:i]
-					}
-				}
-			}
-			if v, ok := raw["key"]; ok {
-				params["key"] = v
-			}
-			// custom_txt: если задан напрямую (base64) — используем; иначе собираем из
-			// отдельных полей формы (permanent_password, hide_cm, deny_lan, и т.п.) →
-			// JSON → base64. Это нужно потому что allowCustom-patched клиент читает
-			// custom_.txt как base64(JSON-настройки rdgen).
-			if v, ok := raw["custom_txt"]; ok && fmt.Sprint(v) != "" {
-				params["custom_txt"] = v
-			} else {
-				params["custom_txt"] = buildCustomTxtFromForm(raw)
-			}
+	workflow, err := service.WorkflowFilenameForPlatform(b.Platform)
+	if err != nil {
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog("", "workflow mapping is unavailable")
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
 		}
+		return err
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
-	runId, err := service.AllService.GithubBuildConfigService.DispatchBuild(ctx, &dispatchCfg, params)
+	// The create boundary already parsed/validated once and returned the
+	// dispatch values. Do not reparse the now-L2-only persisted custom_json;
+	// DispatchBuild owns immutable version propagation.
+	dispatch, err := service.AllService.GithubBuildConfigService.DispatchBuild(ctx, config.ProviderConfig(), identity, b.Platform, dispatchParams)
 	if err != nil {
-		global.Logger.Errorf("github dispatch failed for build %d: %v", b.Id, err)
+		global.Logger.Errorf("github dispatch failed for build %d: %s", b.Id, service.GithubErrorDetail(err))
 		b.Status = model.CustomBuildStatusFailed
-		b.BuildLog = "github dispatch error: " + err.Error()
-		_ = service.AllService.CustomBuildService.Update(b)
-		return true // мы попытались — fallback на файл не нужен
+		b.BuildLog = boundedBuildLog("", "github dispatch error: "+service.GithubSafeErrorMessage(err))
+		if persistErr := persistPendingFailure(b); persistErr != nil {
+			return persistErr
+		}
+		return err
+	}
+	provenance := service.BuildProvenance{
+		Version:             identity.DisplayVersion,
+		BuildRef:            identity.BuildRef,
+		SourceTag:           identity.SourceTag,
+		AssetsRelease:       identity.AssetsRelease.TagName,
+		AssetsReleaseID:     identity.AssetsRelease.ID,
+		GithubProvider:      "github",
+		GithubRepo:          config.Repo,
+		GithubWorkflow:      workflow,
+		WorkflowRef:         identity.WorkflowRef,
+		WorkflowSHA:         identity.WorkflowSHA,
+		GithubRef:           identity.WorkflowSHA,
+		GithubArtifactName:  artifactNameForPlatform(b.Platform),
+		GithubRunID:         dispatch.WorkflowRunID,
+		GithubRunURL:        dispatch.RunURL,
+		GithubHTMLURL:       dispatch.HTMLURL,
+		AssetsReleaseAssets: identity.AssetsRelease.Assets,
+	}
+	if err := persistBuildMutation(b.Id, "dispatch provenance", func() error {
+		return service.AllService.CustomBuildService.SetProvenance(b.Id, provenance)
+	}); err != nil {
+		// GitHub has already accepted this exact run, but no durable identity was
+		// recorded. Polling must not start and this request must not report success.
+		// A distributed outbox or transactional provider cancellation is impossible
+		// here and remains an explicit later lifecycle limitation; never guess a run.
+		providerErr := fmt.Errorf("github dispatch run %d was accepted but provenance persistence failed; polling was not started: %w", dispatch.WorkflowRunID, err)
+		global.Logger.Errorf("tryGithubDispatch: %s", service.GithubErrorDetail(providerErr))
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog("", service.GithubErrorDetail(providerErr))
+		if terminalErr := persistPendingFailure(b); terminalErr != nil {
+			global.Logger.Errorf("tryGithubDispatch: terminal failure status was not durable for build %d; provider run remains an orphan requiring manual recovery: %s", b.Id, service.GithubErrorDetail(terminalErr))
+		}
+		return providerErr
 	}
 	b.Status = model.CustomBuildStatusBuilding
-	b.GithubRunId = runId
-	b.BuildLog = fmt.Sprintf("github run id: %d", runId)
-	_ = service.AllService.CustomBuildService.Update(b)
+	b.GithubRunId = dispatch.WorkflowRunID
+	b.GithubProvider = provenance.GithubProvider
+	b.GithubRepo = provenance.GithubRepo
+	b.GithubWorkflow = provenance.GithubWorkflow
+	b.GithubRef = provenance.GithubRef
+	b.GithubArtifactName = provenance.GithubArtifactName
+	b.GithubRunUrl = provenance.GithubRunURL
+	b.GithubHtmlUrl = provenance.GithubHTMLURL
+	b.BuildLog = boundedBuildLog("", fmt.Sprintf("github run id: %d", dispatch.WorkflowRunID))
 
 	// Поллинг в фоне. Используем независимый context (запрос уйдёт раньше, чем сборка).
-	go ct.pollAndDownload(b.Id, runId)
-	return true
+	startGithubPoll(ct, b.Id, dispatch.WorkflowRunID)
+	return nil
 }
 
-// ResumePendingPolls — стартап-хук. Находит билды со статусом `building` и
-// сохранённым GithubRunId, перезапускает для них pollAndDownload. Без этого после
-// рестарта api все in-flight GitHub сборки зависают навсегда (BUGS.md B-003).
+// ResumePendingPolls — стартап-хук. Находит все незавершённые GitHub-билды,
+// включая transient downloading/extracting states, и перезапускает
+// pollAndDownload только для строк с полной immutable provenance.
+// Incomplete rows are closed only when the stored run guard is available;
+// malformed rows without a run remain untouched rather than bypassing it.
 //
 // Должен вызываться один раз из cmd/apimain.go ПОСЛЕ AutoMigrate.
 func ResumePendingPolls() {
 	defer func() {
 		if r := recover(); r != nil {
-			global.Logger.Errorf("ResumePendingPolls panic: %v", r)
+			global.Logger.Errorf("ResumePendingPolls panic: %s", service.GithubErrorDetail(fmt.Errorf("background poll panic: %v", r)))
 		}
 	}()
 	ct := &CustomBuild{}
 	var builds []*model.CustomBuild
-	if err := global.DB.Where("status = ? AND github_run_id > 0", model.CustomBuildStatusBuilding).
+	if err := global.DB.Where("status IN ?", []string{
+		model.CustomBuildStatusBuilding,
+		model.CustomBuildStatusDownloading,
+		model.CustomBuildStatusExtracting,
+	}).
 		Find(&builds).Error; err != nil {
-		global.Logger.Warnf("ResumePendingPolls: query failed: %v", err)
+		global.Logger.Warnf("ResumePendingPolls: query failed: %s", service.GithubErrorDetail(err))
 		return
 	}
+	activeBuildIDs := make(map[uint]struct{}, len(builds))
 	for _, b := range builds {
+		activeBuildIDs[b.Id] = struct{}{}
+	}
+	outputRoot := filepath.Dir(customBuildOutputDir(0))
+	if err := service.SweepBuildOutputTemps(outputRoot, time.Now(), buildOutputTempTTL, activeBuildIDs); err != nil {
+		global.Logger.Warnf("ResumePendingPolls: stale build output cleanup failed: %s", service.GithubErrorDetail(err))
+	}
+	if err := service.SweepGithubArtifactTemps(os.TempDir(), time.Now(), buildOutputTempTTL); err != nil {
+		global.Logger.Warnf("ResumePendingPolls: stale GitHub artifact temp cleanup failed: %s", service.GithubErrorDetail(err))
+	}
+	for _, b := range builds {
+		provenance, err := service.BuildProvenanceFromRecord(b)
+		if err != nil {
+			reason := "building GitHub build has incomplete immutable provenance; refusing to resume: " + service.GithubErrorDetail(err)
+			if b.GithubRunId == 0 {
+				reason = "legacy/partial GitHub build has no provider run id; refusing to resume: " + service.GithubErrorDetail(err)
+			}
+			global.Logger.Errorf("ResumePendingPolls: build %d failed closed: %s", b.Id, reason)
+			b.Status = model.CustomBuildStatusFailed
+			b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+			persistFailure := persistBuildProgress
+			if b.GithubRunId == 0 {
+				persistFailure = func(build *model.CustomBuild, _ int64) error { return persistNoRunFailure(build) }
+			}
+			if persistErr := persistFailure(b, b.GithubRunId); persistErr != nil {
+				global.Logger.Errorf("ResumePendingPolls: failed to persist closed state for build %d: %s", b.Id, service.GithubErrorDetail(persistErr))
+			}
+			continue
+		}
+		if provenance.GithubRunID != b.GithubRunId {
+			global.Logger.Errorf("ResumePendingPolls: build %d run identity mismatch; refusing to resume", b.Id)
+			b.Status = model.CustomBuildStatusFailed
+			b.BuildLog = boundedBuildLog(b.BuildLog, "immutable GitHub provenance run identity mismatch; refusing to resume")
+			if persistErr := persistBuildProgress(b, b.GithubRunId); persistErr != nil {
+				global.Logger.Errorf("ResumePendingPolls: failed to persist mismatch state for build %d: %s", b.Id, service.GithubErrorDetail(persistErr))
+			}
+			continue
+		}
 		global.Logger.Infof("ResumePendingPolls: resuming build %d (run %d)", b.Id, b.GithubRunId)
-		go ct.pollAndDownload(b.Id, b.GithubRunId)
+		startGithubPoll(ct, b.Id, b.GithubRunId)
 	}
 }
 
 // pollAndDownload — асинхронно опрашивает статус рана GitHub до завершения,
-// при успехе скачивает артефакт rustdesk-min-test-windows.zip, кладёт exe в
+// при успехе скачивает артефакт rustqs-windows.zip, кладёт exe в
 // /rdgen-data/output/{buildId}/{appname}.exe, обновляет статус CustomBuild.
+type githubPollErrorAction uint8
+
+const (
+	githubPollRetry githubPollErrorAction = iota
+	githubPollFail
+)
+
+func githubPollErrorActionFor(err error) githubPollErrorAction {
+	if service.IsGithubRetryable(err) && !service.IsGithubTerminal(err) {
+		return githubPollRetry
+	}
+	return githubPollFail
+}
+
+func isActiveGithubBuildStatus(status string) bool {
+	switch status {
+	case model.CustomBuildStatusBuilding, model.CustomBuildStatusDownloading, model.CustomBuildStatusExtracting:
+		return true
+	default:
+		return false
+	}
+}
+
+func githubArtifactErrorActionFor(err error) githubPollErrorAction {
+	return githubPollErrorActionFor(err)
+}
+
+const (
+	githubPollInterval = 30 * time.Second
+	githubPollDeadline = 90 * time.Minute
+)
+
+func loadGithubPollConfig(buildID uint, provenance service.BuildProvenance, deadline time.Time, now func() time.Time, wait func(time.Duration), get func() (*model.GithubBuildConfig, error)) (*model.GithubBuildConfig, bool) {
+	for {
+		currentTime := now()
+		if !currentTime.Before(deadline) {
+			if global.Logger != nil {
+				global.Logger.Errorf("pollAndDownload: GitHub credentials/configuration remained unavailable for build %d until the bounded polling deadline; resume polling after provider configuration is restored", buildID)
+			}
+			return nil, false
+		}
+		gcfg, err := get()
+		if err == nil && gcfg != nil && gcfg.Token != "" {
+			// Only the mutable credential comes from current configuration. The
+			// repository and workflow identity remain bound to the stored snapshot.
+			return service.GithubConfigFromProvenance(provenance, gcfg.Token), true
+		}
+		if global.Logger != nil {
+			if err != nil {
+				global.Logger.Errorf("pollAndDownload: current GitHub configuration unavailable for build %d; retrying until the bounded polling deadline: %s", buildID, service.GithubErrorDetail(err))
+			} else {
+				global.Logger.Errorf("pollAndDownload: current GitHub PAT is unavailable for build %d; retrying until the bounded polling deadline", buildID)
+			}
+		}
+		remaining := deadline.Sub(currentTime)
+		if remaining <= 0 {
+			return nil, false
+		}
+		delay := githubPollInterval
+		if remaining < delay {
+			delay = remaining
+		}
+		wait(delay)
+	}
+}
+
 func (ct *CustomBuild) pollAndDownload(buildId uint, runId int64) {
+	ct.pollAndDownloadWithClock(buildId, runId, githubPollClock{now: time.Now, wait: time.Sleep})
+}
+
+func (ct *CustomBuild) pollAndDownloadWithClock(buildId uint, runId int64, clock githubPollClock) {
 	// Паника в фоновой горутине роняет весь процесс — гасим её здесь.
 	defer func() {
 		if r := recover(); r != nil {
-			global.Logger.Errorf("pollAndDownload panic for build %d: %v", buildId, r)
+			global.Logger.Errorf("pollAndDownload panic for build %d: %s", buildId, service.GithubErrorDetail(fmt.Errorf("background poll panic: %v", r)))
 		}
 	}()
-	gcfg, err := service.AllService.GithubBuildConfigService.Get()
-	if err != nil || gcfg == nil {
+	b, err := service.AllService.CustomBuildService.Info(buildId)
+	if err != nil {
+		if global.Logger != nil {
+			global.Logger.Errorf("pollAndDownload: failed to read build %d: %s", buildId, service.GithubErrorDetail(err))
+		}
 		return
 	}
-	deadline := time.Now().Add(90 * time.Minute) // защита от зависших ранов
-	for time.Now().Before(deadline) {
-		time.Sleep(30 * time.Second)
+	if b.Id == 0 {
+		return
+	}
+	if runId == 0 && b.GithubRunId == 0 {
+		reason := "legacy/partial GitHub build has no provider run id; refusing to poll"
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+		if persistErr := persistNoRunFailure(b); persistErr != nil && global.Logger != nil {
+			global.Logger.Errorf("pollAndDownload: failed to persist no-run terminal state for build %d: %s", buildId, service.GithubErrorDetail(persistErr))
+		}
+		return
+	}
+	provenance, err := service.BuildProvenanceFromRecord(b)
+	if err != nil {
+		reason := fmt.Sprintf("immutable GitHub provenance is missing; refusing to poll run %d: %s", runId, service.GithubErrorDetail(err))
+		global.Logger.Errorf("pollAndDownload: build %d failed closed: %s", buildId, reason)
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+		if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+			global.Logger.Errorf("pollAndDownload: failed to persist closed state for build %d: %s", buildId, service.GithubErrorDetail(persistErr))
+		}
+		return
+	}
+	if provenance.GithubRunID != runId || b.GithubRunId != runId {
+		reason := fmt.Sprintf("immutable GitHub provenance run identity mismatch (stored=%d requested=%d); refusing to poll", provenance.GithubRunID, runId)
+		global.Logger.Errorf("pollAndDownload: build %d failed closed: %s", buildId, reason)
+		b.Status = model.CustomBuildStatusFailed
+		b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+		if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+			global.Logger.Errorf("pollAndDownload: failed to persist mismatch state for build %d: %s", buildId, service.GithubErrorDetail(persistErr))
+		}
+		return
+	}
+	if clock.now == nil {
+		clock.now = time.Now
+	}
+	if clock.wait == nil {
+		clock.wait = time.Sleep
+	}
+	artifactName := provenance.GithubArtifactName
+	deadline := clock.now().Add(githubPollDeadline) // защита от зависших ранов
+	firstPoll := true
+	for clock.now().Before(deadline) {
+		if !firstPoll {
+			clock.wait(githubPollInterval)
+		}
+		firstPoll = false
+		// Recover a publication that already has both immutable proof values
+		// before loading provider configuration or handling a terminal provider
+		// response. This prevents a valid download from being stranded by a
+		// completion-write failure. Any partial/mismatched proof is terminal: an
+		// output with unverifiable provenance must never be silently reused.
+		current, currentErr := service.AllService.CustomBuildService.Info(buildId)
+		if currentErr != nil {
+			if global.Logger != nil {
+				global.Logger.Errorf("pollAndDownload: failed to refresh build %d: %s", buildId, service.GithubErrorDetail(currentErr))
+			}
+			return
+		}
+		if current.Id == 0 || current.GithubRunId != runId || !isActiveGithubBuildStatus(current.Status) {
+			return
+		}
+		if current.PublicationRecordedAt > 0 || current.PublishedDigest != "" {
+			recovered, recoveryErr := recoverRecordedPublishedBuild(buildId, runId)
+			if recovered {
+				if recoveryErr != nil && global.Logger != nil {
+					global.Logger.Errorf("pollAndDownload: failed to finalize recorded publication for build %d: %s", buildId, service.GithubErrorDetail(recoveryErr))
+				}
+				return
+			}
+			if recoveryErr != nil {
+				reason := "stored publication proof does not match the current output; refusing completion: " + service.GithubErrorDetail(recoveryErr)
+				failActiveGithubBuild(buildId, runId, reason)
+				return
+			}
+		}
+		// The token/config may become unavailable after a prior successful poll.
+		// Re-read it within the same bounded loop, while keeping all provider
+		// identity fields pinned to the stored provenance.
+		pollCfg, configAvailable := loadGithubPollConfig(
+			buildId,
+			provenance,
+			deadline,
+			clock.now,
+			clock.wait,
+			service.AllService.GithubBuildConfigService.Get,
+		)
+		if !configAvailable {
+			failActiveGithubBuild(buildId, runId, fmt.Sprintf("github poll stopped at deadline; restore the PAT for stored repository %q and resume this build", provenance.GithubRepo))
+			return
+		}
 		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
-		status, conclusion, err := service.AllService.GithubBuildConfigService.RunStatus(ctx, gcfg, runId)
+		details, err := service.AllService.GithubBuildConfigService.RunStatusDetails(ctx, pollCfg, runId)
 		cancel()
 		if err != nil {
-			continue
+			if githubPollErrorActionFor(err) == githubPollRetry {
+				continue
+			}
+			b, readErr := service.AllService.CustomBuildService.Info(buildId)
+			if readErr != nil {
+				if global.Logger != nil {
+					global.Logger.Errorf("custom build %d read failed after GitHub status error: %s", buildId, service.GithubErrorDetail(readErr))
+				}
+				return
+			}
+			if b.Id != 0 && b.GithubRunId == runId && isActiveGithubBuildStatus(b.Status) {
+				b.Status = model.CustomBuildStatusFailed
+				b.BuildLog = boundedBuildLog(b.BuildLog, "github status error: "+service.GithubSafeErrorMessage(err))
+				if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+					global.Logger.Errorf("custom build %d failed to persist status error: %s", buildId, service.GithubErrorDetail(persistErr))
+				}
+			}
+			return
+		}
+		if details.SourceSHA == "" {
+			reason := "provider run status omitted head_sha; refusing to continue without execution identity"
+			global.Logger.Errorf("pollAndDownload: build %d failed closed: %s", buildId, reason)
+			b.Status = model.CustomBuildStatusFailed
+			b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+			if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+				global.Logger.Errorf("pollAndDownload: failed to persist missing head_sha for build %d: %s", buildId, service.GithubErrorDetail(persistErr))
+			}
+			return
 		}
-		if status != "completed" {
+		if !strings.EqualFold(details.SourceSHA, provenance.WorkflowSHA) {
+			reason := fmt.Sprintf("provider run head SHA %q does not match stored workflow execution SHA; refusing to continue", details.SourceSHA)
+			global.Logger.Errorf("pollAndDownload: build %d failed closed: %s", buildId, reason)
+			b.Status = model.CustomBuildStatusFailed
+			b.BuildLog = boundedBuildLog(b.BuildLog, reason)
+			if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+				global.Logger.Errorf("pollAndDownload: failed to persist workflow execution SHA mismatch for build %d: %s", buildId, service.GithubErrorDetail(persistErr))
+			}
+			return
+		}
+		if b.GithubSourceSha == "" {
+			shaErr := persistPollMutation(buildId, runId, "run head SHA", func() error {
+				return service.AllService.CustomBuildService.SetSourceSha(buildId, runId, details.SourceSHA)
+			})
+			if shaErr != nil {
+				global.Logger.Errorf("pollAndDownload: run head SHA persistence exhausted for build %d; leaving building row resume-eligible: %s", buildId, service.GithubErrorDetail(shaErr))
+				return
+			}
+			b.GithubSourceSha = details.SourceSHA
+		}
+		if details.Status != "completed" {
 			continue
 		}
 		// completed → финализируем
-		b := service.AllService.CustomBuildService.Info(buildId)
-		// CustomBuildService.Info never returns nil; Id==0 means row not found.
+		b, err = service.AllService.CustomBuildService.Info(buildId)
+		if err != nil {
+			if global.Logger != nil {
+				global.Logger.Errorf("pollAndDownload: failed to refresh completed build %d: %s", buildId, service.GithubErrorDetail(err))
+			}
+			return
+		}
+		// A successful Info call returns a complete row; a missing row is handled
+		// as an error before this point.
 		if b.Id == 0 {
 			return
 		}
-		if conclusion != "success" {
+		if details.Conclusion != "success" {
 			b.Status = model.CustomBuildStatusFailed
-			b.BuildLog += fmt.Sprintf("\nrun %d completed with conclusion=%s", runId, conclusion)
-			_ = service.AllService.CustomBuildService.Update(b)
+			b.BuildLog = boundedBuildLog(b.BuildLog, fmt.Sprintf("run %d completed with conclusion=%s", runId, details.Conclusion))
+			if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+				global.Logger.Errorf("custom build %d failed to persist conclusion: %s", buildId, service.GithubErrorDetail(persistErr))
+			}
 			return
 		}
-		// скачать артефакт. Имя зависит от платформы (B-012); DownloadArtifact
-		// дополнительно фолбэчит на единственный артефакт рана, если имя не совпало.
-		artifactName := defaultWindowsArtifactName
-		switch b.Platform {
-		case "linux":
-			artifactName = "rustdesk-min-test-linux"
-		case "android":
-			artifactName = "rustdesk-min-test-android"
+		// An output without a valid stored publication proof is never reused. If
+		// one exists, the exact stored provider artifact is downloaded again and
+		// atomically replaces it after validation. A proof mismatch was handled
+		// above and is terminal instead of being repaired by a guessed artifact.
+		_, outputExists, inspectErr := inspectPublishedArtifact(customBuildOutputDir(b.Id), b)
+		if outputExists && global.Logger != nil {
+			if inspectErr != nil {
+				global.Logger.Warnf("custom build %d has an unproven/invalid final output; redownloading exact artifact: %s", buildId, service.GithubErrorDetail(inspectErr))
+			} else {
+				global.Logger.Warnf("custom build %d has an unproven final output; redownloading exact artifact", buildId)
+			}
+		}
+		b.Status = model.CustomBuildStatusDownloading
+		b.BuildLog = boundedBuildLog(b.BuildLog, "artifact download started")
+		if persistErr := persistBuildProgressWithRun(service.AllService.CustomBuildService.UpdateProgress, b, runId); persistErr != nil {
+			global.Logger.Errorf("custom build %d failed to persist downloading state: %s", buildId, service.GithubErrorDetail(persistErr))
+			return
 		}
 		dlCtx, dlCancel := context.WithTimeout(context.Background(), 5*time.Minute)
-		zipBytes, err := service.AllService.GithubBuildConfigService.DownloadArtifact(dlCtx, gcfg, runId, artifactName)
+		storedArtifactID := provenance.GithubArtifactID
+		download, err := service.AllService.GithubBuildConfigService.DownloadArtifact(
+			dlCtx, pollCfg, runId, storedArtifactID, artifactName,
+		)
 		dlCancel()
 		if err != nil {
+			if githubArtifactErrorActionFor(err) == githubPollRetry {
+				continue
+			}
 			b.Status = model.CustomBuildStatusFailed
-			b.BuildLog += "\ndownload artifact: " + err.Error()
-			_ = service.AllService.CustomBuildService.Update(b)
+			b.BuildLog = boundedBuildLog(b.BuildLog, "download artifact: "+service.GithubSafeErrorMessage(err))
+			if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+				global.Logger.Errorf("custom build %d failed to persist artifact error: %s", buildId, service.GithubErrorDetail(persistErr))
+			}
 			return
 		}
-		// распаковка zip и извлечение exe
-		appName := b.AppName
-		if appName == "" {
-			appName = "rustqs"
-		}
-		outDir := service.BuildOutputDir(buildId)
-		_ = os.MkdirAll(outDir, 0755)
-		zr, err := zip.NewReader(bytes.NewReader(zipBytes), int64(len(zipBytes)))
-		if err != nil {
-			b.Status = model.CustomBuildStatusFailed
-			b.BuildLog += "\nunzip: " + err.Error()
-			_ = service.AllService.CustomBuildService.Update(b)
+		// DownloadArtifact owns the temporary archive only until it returns a
+		// successful hand-off. Register cleanup before any later lifecycle write;
+		// a database failure must not strand the ZIP or its temporary path.
+		archiveCleanupDone := false
+		defer func(archivePath string) {
+			if !archiveCleanupDone {
+				cleanupArtifactArchive(buildId, archivePath)
+			}
+		}(download.ArchivePath)
+		b.Status = model.CustomBuildStatusExtracting
+		b.BuildLog = boundedBuildLog(b.BuildLog, "artifact download complete; extracting")
+		if persistErr := persistBuildProgressWithRun(service.AllService.CustomBuildService.UpdateProgress, b, runId); persistErr != nil {
+			global.Logger.Errorf("custom build %d failed to persist extracting state: %s", buildId, service.GithubErrorDetail(persistErr))
 			return
 		}
-		var extracted bool
-		if b.Platform == "linux" || b.Platform == "android" {
-			// Linux/Android-артефакт (B-012): плоский набор файлов (бинарь/.deb/.apk
-			// + custom_.txt). Извлекаем всё; FileSize — размер самого крупного файла.
-			for _, zf := range zr.File {
-				if zf.FileInfo().IsDir() {
-					continue
-				}
-				name := filepath.Base(zf.Name)
-				if name == "" {
-					continue
+		if storedArtifactID == 0 {
+			setErr := persistPollMutation(buildId, runId, "artifact ID", func() error {
+				return service.AllService.CustomBuildService.SetArtifactID(buildId, runId, download.ArtifactID)
+			})
+			if setErr != nil {
+				// A concurrent/resumed poll may have durably written the same
+				// provider-selected ID. Re-read only to recover that exact ID;
+				// never select a different artifact or infer one from a list.
+				latest, latestReadErr := service.AllService.CustomBuildService.Info(buildId)
+				if latestReadErr != nil {
+					global.Logger.Errorf("pollAndDownload: failed to reread build %d after artifact ID persistence: %s", buildId, service.GithubErrorDetail(latestReadErr))
+					return
 				}
-				if n, e := extractZipFile(zf, outDir, name); e == nil {
-					extracted = true
-					if n > b.FileSize {
-						b.FileSize = n
-					}
+				latestProvenance, latestErr := service.BuildProvenanceFromRecord(latest)
+				if latestErr != nil || latestProvenance.GithubArtifactID != download.ArtifactID {
+					global.Logger.Errorf("pollAndDownload: artifact ID persistence exhausted for build %d; leaving building row resume-eligible: %s", buildId, service.GithubErrorDetail(setErr))
+					return
 				}
+				provenance = latestProvenance
 			}
-		} else {
-			// Windows-артефакт — flat zip с rustqs.exe (или rustdesk.exe) + dll + custom_.txt.
-			for _, zf := range zr.File {
-				name := filepath.Base(zf.Name)
-				if name == appName+".exe" || name == "rustdesk.exe" {
-					if n, e := extractZipFile(zf, outDir, appName+".exe"); e == nil {
-						b.FileSize = n
-						extracted = true
-					}
-				}
-				if name == "custom_.txt" || filepath.Ext(name) == ".dll" {
-					_, _ = extractZipFile(zf, outDir, name)
-				}
+			provenance.GithubArtifactID = download.ArtifactID
+		} else if download.ArtifactID != storedArtifactID || download.ArtifactName != artifactName {
+			b.Status = model.CustomBuildStatusFailed
+			b.BuildLog = boundedBuildLog(b.BuildLog, "provider returned an artifact identity different from stored provenance")
+			if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+				global.Logger.Errorf("custom build %d failed to persist artifact identity mismatch: %s", buildId, service.GithubErrorDetail(persistErr))
 			}
+			return
 		}
-		if !extracted {
+		b.GithubArtifactID = download.ArtifactID
+
+		// Delete and poll share the same process-local lifecycle guard. Re-read
+		// the guarded row immediately before publication so a delete or terminal
+		// transition observed after the download cannot publish into a stale
+		// build directory. This is intentionally not a distributed lease.
+		latest, latestErr := service.AllService.CustomBuildService.Info(buildId)
+		if latestErr != nil {
+			if global.Logger != nil {
+				global.Logger.Errorf("pollAndDownload: failed to reread build %d before publication: %s", buildId, service.GithubErrorDetail(latestErr))
+			}
+			return
+		}
+		if latest.Id == 0 || latest.GithubRunId != runId || !isActiveGithubBuildStatus(latest.Status) {
+			return
+		}
+		b = latest
+		b.GithubArtifactID = download.ArtifactID
+		// This is the exact stored run/artifact download. If another unproven
+		// output appeared after the inspection, replace it rather than reusing it;
+		// a valid stored proof still wins inside the helper.
+		fileSize, producerManifest, publishErr := publishDownloadedArtifactWithManifest(b, download.ArchivePath, true)
+		if publishErr != nil {
 			b.Status = model.CustomBuildStatusFailed
-			b.BuildLog += "\nno usable files found in artifact"
-			_ = service.AllService.CustomBuildService.Update(b)
+			b.BuildLog = boundedBuildLog(b.BuildLog, "artifact validation/publication: "+service.GithubErrorDetail(publishErr))
+			if persistErr := persistBuildProgress(b, runId); persistErr != nil {
+				global.Logger.Errorf("custom build %d failed to persist artifact publication error: %s", buildId, service.GithubErrorDetail(persistErr))
+			}
 			return
 		}
+		cleanupArtifactArchive(buildId, download.ArchivePath)
+		archiveCleanupDone = true
+
+		b.FileSize = fileSize
 		b.Status = model.CustomBuildStatusDone
-		b.BuildLog += "\nartifact downloaded and extracted"
-		_ = service.AllService.CustomBuildService.Update(b)
+		b.BuildLog = boundedBuildLog(b.BuildLog, "artifact downloaded and extracted")
+		if publishErr := recordPublishedOutputWithManifest(b.Id, runId, b.GithubArtifactID, producerManifest); publishErr != nil {
+			if global.Logger != nil {
+				global.Logger.Errorf("custom build %d failed to record publication: %s", buildId, service.GithubErrorDetail(publishErr))
+			}
+			return
+		}
+		if persistErr := persistCompletedBuildWith(service.AllService.CustomBuildService.UpdateProgress, b, runId); persistErr != nil {
+			// UpdateProgress is the only operation that can claim completion. If all
+			// bounded retries fail, the database row remains building and resume can
+			// retry the exact artifact identity; never report or leave a false done.
+			global.Logger.Errorf("custom build %d failed to persist completion; leaving row resume-eligible and non-done: %s", buildId, service.GithubErrorDetail(persistErr))
+			// The output is already validated and published. Keep it intact: a
+			// later poll can idempotently reuse it after the guarded DB write
+			// recovers, and cleanup here could destroy the only valid artifact.
+		}
 		return
 	}
 	// таймаут
-	b := service.AllService.CustomBuildService.Info(buildId)
-	if b.Id != 0 && b.Status == model.CustomBuildStatusBuilding {
-		b.Status = model.CustomBuildStatusFailed
-		b.BuildLog += "\npolling timeout (90 min)"
-		_ = service.AllService.CustomBuildService.Update(b)
+	failActiveGithubBuild(buildId, runId, "github polling deadline reached; verify the provider run and resume this build")
+}
+
+// publishDownloadedArtifact validates and extracts a temporary ZIP into a
+// sibling staging directory, then atomically renames that directory to the
+// final output path. The final directory is never created before validation.
+func publishDownloadedArtifact(build *model.CustomBuild, archivePath string) (int64, error) {
+	return publishDownloadedArtifactWithMode(build, archivePath, false)
+}
+
+func publishDownloadedArtifactWithMode(build *model.CustomBuild, archivePath string, replaceUnproven bool) (int64, error) {
+	size, _, err := publishDownloadedArtifactWithManifest(build, archivePath, replaceUnproven)
+	return size, err
+}
+
+func publishDownloadedArtifactWithManifest(build *model.CustomBuild, archivePath string, replaceUnproven bool) (int64, service.ProducerManifest, error) {
+	if err := service.RequireProductionBuildCapability(build.Platform); err != nil {
+		return 0, service.ProducerManifest{}, err
+	}
+	outDir := customBuildOutputDir(build.Id)
+	parent := filepath.Dir(outDir)
+	if err := os.MkdirAll(parent, 0755); err != nil {
+		return 0, service.ProducerManifest{}, fmt.Errorf("create artifact output parent: %w", err)
+	}
+	staging, err := os.MkdirTemp(parent, fmt.Sprintf(".%d-artifact-*", build.Id))
+	if err != nil {
+		return 0, service.ProducerManifest{}, fmt.Errorf("create artifact staging directory: %w", err)
 	}
+	published := false
+	defer func() {
+		if !published {
+			_ = os.RemoveAll(staging)
+		}
+	}()
+
+	zr, err := zip.OpenReader(archivePath)
+	if err != nil {
+		return 0, service.ProducerManifest{}, fmt.Errorf("open artifact ZIP: %w", err)
+	}
+	archiveClosed := false
+	defer func() {
+		if !archiveClosed {
+			_ = zr.Close()
+		}
+	}()
+	fileSize, producerManifest, extractErr := extractValidatedArtifact(zr, staging, build)
+	closeErr := zr.Close()
+	archiveClosed = true
+	if extractErr != nil {
+		return 0, service.ProducerManifest{}, extractErr
+	}
+	if closeErr != nil {
+		return 0, service.ProducerManifest{}, fmt.Errorf("close artifact ZIP: %w", closeErr)
+	}
+	if _, exists, err := inspectPublishedArtifact(outDir, build); exists {
+		if proofSize, proofErr := service.ValidatePublishedOutputProof(build); proofErr == nil {
+			return proofSize, producerManifest, nil
+		}
+		if !replaceUnproven {
+			if err != nil {
+				return 0, service.ProducerManifest{}, fmt.Errorf("refusing to reuse unproven existing artifact output: %w", err)
+			}
+			return 0, service.ProducerManifest{}, errors.New("refusing to reuse unproven existing artifact output")
+		}
+		if err := replacePublishedOutput(staging, outDir); err != nil {
+			return 0, service.ProducerManifest{}, err
+		}
+		published = true
+		return fileSize, producerManifest, nil
+	} else if err != nil {
+		return 0, service.ProducerManifest{}, err
+	}
+	if err := os.Rename(staging, outDir); err != nil {
+		// Another poller may have won the absent-target race. Reuse only a
+		// complete output that satisfies the same stored publication proof.
+		if proofSize, proofErr := service.ValidatePublishedOutputProof(build); proofErr == nil {
+			return proofSize, producerManifest, nil
+		}
+		if replaceUnproven {
+			if replaceErr := replacePublishedOutput(staging, outDir); replaceErr == nil {
+				published = true
+				return fileSize, producerManifest, nil
+			}
+		}
+		return 0, service.ProducerManifest{}, fmt.Errorf("atomically publish artifact output: %w", err)
+	}
+	published = true
+	return fileSize, producerManifest, nil
 }
 
-// buildCustomTxtFromForm собирает base64-encoded JSON для custom_.txt из полей формы.
-// Контракт rdgen-allowCustom-patched клиента: общие настройки + 13 permission-флагов,
-// каждый — это строка "Y"/"N" (отсутствие ключа = client default).
-//
-// История бага (BUGS.md B-004/B-005): предыдущая версия мапила всего 6 полей и содержала
-// два ключа, которых форма не шлёт (`allow_remote_config_modification`, `disable_update`).
-// Из-за этого все permission-тоглы, branding-URL'ы, theme, direction и т.п. молча
-// терялись на windows-via-GitHub пути. Теперь маппинг покрывает весь PRESET_FIELDS из
-// admin-ui/src/views/custom-client/index.vue. Если расширяешь форму — добавь ключ сюда.
-//
-// Возвращает "" если ничего не задано (тогда L2 шаги в воркфлоу пропустятся).
-func buildCustomTxtFromForm(raw map[string]any) string {
-	cfg := map[string]any{}
-
-	// --- скаляры (string) ---
-	// relay_server: перед маппингом стрипаем порт — клиент знает дефолтный порт 21117
-	// и сам его подставляет (консистентно с host/server_ip).
-	// Стрипаем только числовой порт (:\d+$), а не любой суффикс после :.
-	if v, ok := raw["relay_server"].(string); ok && v != "" {
-		if i := strings.LastIndex(v, ":"); i > 0 {
-			if _, err := strconv.Atoi(v[i+1:]); err == nil {
-				raw["relay_server"] = v[:i]
-			}
-		}
-	}
-	stringFields := []struct{ from, to string }{
-		{"permanent_password", "password"},
-		{"pass_approve_mode", "approve-mode"},
-		{"direction", "direction"},
-		{"theme", "theme"},
-		{"permissions_type", "permissions-mode"},
-		{"company_name", "company-name"},
-		{"download_url", "download-url"},
-		// сетевые координаты — сервер/ключ ушли в L1 (config.rs), а api/relay
-		// остаются обычной runtime-настройкой клиента.
-		// ВАЖНО: api_server → "api-server" (нативный ключ hbb_common, НЕ custom-rendezvous-api-server).
-		{"api_server", "api-server"},
-		{"relay_server", "relay-server"},
-		// branding URLs — клиент допускает абсолютные или относительные пути
-		{"app_icon_url", "app-icon-url"},
-		{"app_logo_url", "app-logo-url"},
-		{"privacy_screen_url", "privacy-screen-url"},
-		// android package id
-		{"android_app_id", "android-app-id"},
-	}
-	for _, m := range stringFields {
-		if v, ok := raw[m.from]; ok {
-			if s := fmt.Sprint(v); s != "" && s != "<nil>" {
-				cfg[m.to] = s
-			}
-		}
-	}
-
-	// --- булевы — все опциональны, "Y" если true; отсутствие или false = опустить ---
-	boolFields := []struct{ from, to string }{
-		// security
-		{"deny_lan", "deny-lan-discovery"},
-		{"enable_direct_ip", "direct-server"},
-		{"hide_cm", "hide-connection-management"},
-		{"auto_close", "auto-close-incoming-sessions"},
-		// theme / UX
-		{"remove_wallpaper", "remove-wallpaper"},
-		{"remove_new_version_notif", "remove-new-version-notif"},
-		{"cycle_monitor", "cycle-monitor"},
-		{"x_offline", "x-offline"},
-		// permissions — клиент читает только при permissions-mode=custom,
-		// но передаём всегда (упрощает отладку)
-		{"enable_keyboard", "enable-keyboard"},
-		{"enable_clipboard", "enable-clipboard"},
-		{"enable_file_transfer", "enable-file-transfer"},
-		{"enable_audio", "enable-audio"},
-		{"enable_tcp", "enable-tunnel"},
-		{"enable_remote_restart", "enable-remote-restart"},
-		{"enable_recording", "enable-record-session"},
-		{"enable_blocking_input", "enable-block-input"},
-		{"enable_remote_modi", "allow-remote-config-modification"}, // B-005 fix
-		{"enable_printer", "enable-printer"},
-		{"enable_camera", "enable-camera"},
-		{"enable_terminal", "enable-terminal"},
-	}
-	for _, m := range boolFields {
-		if v, ok := raw[m.from]; ok {
-			if b, isBool := v.(bool); isBool && b {
-				cfg[m.to] = "Y"
-			}
-		}
-	}
-
-	// hide_cm + постоянный пароль → verification-method=use-permanent-password
-	// (нужно явно, иначе клиент ждёт пароль с экрана подтверждения, который скрыт)
-	if hide, _ := raw["hide_cm"].(bool); hide {
-		if pw, ok := raw["permanent_password"]; ok && fmt.Sprint(pw) != "" {
-			cfg["verification-method"] = "use-permanent-password"
-		}
-	}
-
-	if len(cfg) == 0 {
-		return ""
-	}
-	j, err := json.Marshal(cfg)
-	if err != nil {
-		return ""
-	}
-	return base64.StdEncoding.EncodeToString(j)
-}
-
-// extractZipFile извлекает один файл из zip в outDir/name, возвращает (записано байт, error).
-// Проверяет, что итоговый путь остаётся внутри outDir (защита от Zip Slip).
-func extractZipFile(zf *zip.File, outDir, name string) (int64, error) {
-	absOut, err := filepath.Abs(outDir)
+func replacePublishedOutput(staging, outputDir string) error {
+	outputInfo, err := os.Lstat(outputDir)
 	if err != nil {
-		return 0, err
+		return fmt.Errorf("inspect existing artifact output before replacement: %w", err)
 	}
-	dst := filepath.Join(absOut, filepath.Base(name))
-	if !strings.HasPrefix(dst+string(os.PathSeparator), absOut+string(os.PathSeparator)) {
-		return 0, fmt.Errorf("zip slip: path %q escapes output directory", dst)
+	if outputInfo.Mode()&os.ModeSymlink != 0 || !outputInfo.IsDir() {
+		return errors.New("refusing to replace non-directory artifact output")
 	}
-	rc, err := zf.Open()
+	backup, err := os.MkdirTemp(filepath.Dir(outputDir), fmt.Sprintf(".%s-artifact-recovery-*", filepath.Base(outputDir)))
+	if err != nil {
+		return fmt.Errorf("create artifact recovery backup: %w", err)
+	}
+	if err := os.Remove(backup); err != nil {
+		return fmt.Errorf("prepare artifact recovery backup: %w", err)
+	}
+	if err := os.Rename(outputDir, backup); err != nil {
+		return fmt.Errorf("stage unproven artifact output for replacement: %w", err)
+	}
+	if err := os.Rename(staging, outputDir); err != nil {
+		if restoreErr := os.Rename(backup, outputDir); restoreErr != nil {
+			return fmt.Errorf("replace artifact output: %w (restore failed: %v)", err, restoreErr)
+		}
+		return fmt.Errorf("replace artifact output: %w", err)
+	}
+	if err := os.RemoveAll(backup); err != nil {
+		return fmt.Errorf("remove replaced artifact output backup: %w", err)
+	}
+	return nil
+}
+
+// inspectPublishedArtifact validates an already-published output without
+// mutating it. A valid output is reusable after a crash between filesystem
+// publication and guarded status persistence.
+func inspectPublishedArtifact(outDir string, build *model.CustomBuild) (int64, bool, error) {
+	size, err := service.ValidatePublishedOutput(outDir, build)
+	if errors.Is(err, os.ErrNotExist) {
+		return 0, false, nil
+	} else if err != nil {
+		return 0, true, err
+	}
+	return size, true, nil
+}
+
+// extractValidatedArtifact preserves the existing platform contract while
+// rejecting unsafe, duplicate, non-regular, or incomplete entries before any
+// output becomes visible at the final path.
+func extractValidatedArtifact(zr *zip.ReadCloser, staging string, build *model.CustomBuild) (int64, service.ProducerManifest, error) {
+	if artifactMaxZipEntries <= 0 || int64(len(zr.File)) > artifactMaxZipEntries {
+		return 0, service.ProducerManifest{}, fmt.Errorf("artifact ZIP contains too many entries: %d", len(zr.File))
+	}
+	if err := validateZipMetadata(zr.File); err != nil {
+		return 0, service.ProducerManifest{}, err
+	}
+	validatedEntries := make(map[*zip.File]validatedZipEntry, len(zr.File))
+	for _, zf := range zr.File {
+		entry, err := validateZipEntryPath(staging, zf.Name, true)
+		if err != nil {
+			return 0, service.ProducerManifest{}, err
+		}
+		validatedEntries[zf] = entry
+	}
+	producerManifest, hasProducerManifest, err := readProducerManifest(zr, build)
+	if err != nil {
+		return 0, service.ProducerManifest{}, err
+	}
+	appName := build.AppName
+	if err := service.ValidateOutputAppName(appName); err != nil {
+		return 0, service.ProducerManifest{}, err
+	}
+	seen := make(map[string]struct{}, len(zr.File))
+	var largestFile int64
+	var extractedBytes uint64
+	var extractedFiles int
+	var windowsExe bool
+
+	for _, zf := range zr.File {
+		entry := validatedEntries[zf]
+		name := entry.name
+		if hasProducerManifest {
+			if zf.Name == service.ProducerManifestFilename {
+				continue
+			}
+			if zf.FileInfo().Mode()&os.ModeSymlink != 0 {
+				return 0, service.ProducerManifest{}, fmt.Errorf("producer artifact contains symlink %q", zf.Name)
+			}
+			if zf.FileInfo().IsDir() {
+				if build.Platform == "bridge" {
+					continue
+				}
+				return 0, service.ProducerManifest{}, fmt.Errorf("producer artifact contains unsafe extra entry %q", zf.Name)
+			}
+			if name != zf.Name {
+				return 0, service.ProducerManifest{}, fmt.Errorf("producer artifact contains unsafe extra entry %q", zf.Name)
+			}
+			if !producerManifestHasFile(producerManifest, name) && !producerManifestHasPrivateFile(producerManifest, name) {
+				return 0, service.ProducerManifest{}, fmt.Errorf("producer artifact contains unexpected output file %q", zf.Name)
+			}
+			n, err := extractZipFile(zf, entry, &extractedBytes)
+			if err != nil {
+				return 0, service.ProducerManifest{}, fmt.Errorf("extract producer output %q: %w", zf.Name, err)
+			}
+			extractedFiles++
+			if n > largestFile {
+				largestFile = n
+			}
+			continue
+		}
+		if zf.FileInfo().IsDir() || strings.HasSuffix(strings.ReplaceAll(zf.Name, "\\", "/"), "/") {
+			continue
+		}
+		if build.Platform == string(service.PlatformWindows) {
+			if err := service.ValidateWindowsArtifactFilename(zf.Name); err != nil {
+				return 0, service.ProducerManifest{}, fmt.Errorf("unsafe Windows artifact filename %q: %w", zf.Name, err)
+			}
+		}
+		if zf.FileInfo().Mode()&os.ModeSymlink != 0 {
+			return 0, service.ProducerManifest{}, fmt.Errorf("artifact ZIP contains symlink %q", zf.Name)
+		}
+
+		switch build.Platform {
+		case "linux", "android":
+			if _, exists := seen[name]; exists {
+				return 0, service.ProducerManifest{}, fmt.Errorf("artifact ZIP contains duplicate output file %q", name)
+			}
+			flatEntry, err := validateZipEntryPath(staging, name, false)
+			if err != nil {
+				return 0, service.ProducerManifest{}, err
+			}
+			n, err := extractZipFile(zf, flatEntry, &extractedBytes)
+			if err != nil {
+				return 0, service.ProducerManifest{}, fmt.Errorf("extract %q: %w", zf.Name, err)
+			}
+			seen[name] = struct{}{}
+			extractedFiles++
+			if n > largestFile {
+				largestFile = n
+			}
+		default:
+			target := ""
+			caseInsensitive := build.Platform == string(service.PlatformWindows)
+			equalName := func(left, right string) bool {
+				if caseInsensitive {
+					return strings.EqualFold(left, right)
+				}
+				return left == right
+			}
+			switch {
+			case equalName(name, appName+".exe") || equalName(name, "rustdesk.exe"):
+				target = appName + ".exe"
+			case equalName(name, "custom_.txt") || (caseInsensitive && strings.EqualFold(filepath.Ext(name), ".dll")) || (!caseInsensitive && filepath.Ext(name) == ".dll"):
+				target = name
+			}
+			if target == "" {
+				continue
+			}
+			seenKey := target
+			if caseInsensitive {
+				seenKey = service.WindowsArtifactNameKey(target)
+			}
+			if _, exists := seen[seenKey]; exists {
+				return 0, service.ProducerManifest{}, fmt.Errorf("artifact ZIP contains duplicate output file %q", target)
+			}
+			flatEntry, err := validateZipEntryPath(staging, target, false)
+			if err != nil {
+				return 0, service.ProducerManifest{}, err
+			}
+			n, err := extractZipFile(zf, flatEntry, &extractedBytes)
+			if err != nil {
+				return 0, service.ProducerManifest{}, fmt.Errorf("extract %q: %w", zf.Name, err)
+			}
+			seen[seenKey] = struct{}{}
+			extractedFiles++
+			if target == appName+".exe" {
+				windowsExe = true
+				largestFile = n
+			}
+		}
+	}
+
+	if extractedFiles == 0 {
+		return 0, service.ProducerManifest{}, errors.New("artifact ZIP contains no usable files")
+	}
+	if hasProducerManifest {
+		if _, err := service.ValidateProducerManifestOutput(producerManifest, staging); err != nil {
+			return 0, service.ProducerManifest{}, err
+		}
+		if build.Platform == string(service.PlatformWindows) {
+			if info, err := os.Stat(filepath.Join(staging, appName+".exe")); err == nil {
+				largestFile = info.Size()
+			}
+		}
+		return largestFile, producerManifest, nil
+	}
+	if build.Platform != "linux" && build.Platform != "android" && !windowsExe {
+		return 0, service.ProducerManifest{}, fmt.Errorf("artifact ZIP is missing required %s.exe", appName)
+	}
+	return largestFile, service.ProducerManifest{}, nil
+}
+
+func readProducerManifest(zr *zip.ReadCloser, build *model.CustomBuild) (service.ProducerManifest, bool, error) {
+	var matches []*zip.File
+	for _, entry := range zr.File {
+		if strings.EqualFold(entry.Name, service.ProducerManifestFilename) {
+			matches = append(matches, entry)
+		}
+	}
+	if len(matches) == 0 {
+		if service.RequiresProducerManifest(build) {
+			return service.ProducerManifest{}, false, errors.New("active provider artifact is missing manifest.txt")
+		}
+		return service.ProducerManifest{}, false, nil
+	}
+	if len(matches) != 1 || matches[0].Name != service.ProducerManifestFilename {
+		return service.ProducerManifest{}, false, errors.New("artifact ZIP contains duplicate or case-colliding manifest.txt entries")
+	}
+	entry := matches[0]
+	if entry.FileInfo().Mode()&os.ModeSymlink != 0 || entry.FileInfo().IsDir() || entry.UncompressedSize64 == 0 || entry.UncompressedSize64 > service.MaxProducerManifestBytes {
+		return service.ProducerManifest{}, false, errors.New("manifest.txt is missing or exceeds the manifest size limit")
+	}
+	reader, err := entry.Open()
+	if err != nil {
+		return service.ProducerManifest{}, false, fmt.Errorf("open manifest.txt: %w", err)
+	}
+	data, readErr := io.ReadAll(io.LimitReader(reader, service.MaxProducerManifestBytes+1))
+	closeErr := reader.Close()
+	if readErr != nil {
+		return service.ProducerManifest{}, false, fmt.Errorf("read manifest.txt: %w", readErr)
+	}
+	if closeErr != nil {
+		return service.ProducerManifest{}, false, fmt.Errorf("close manifest.txt: %w", closeErr)
+	}
+	if int64(len(data)) != int64(entry.UncompressedSize64) || len(data) > service.MaxProducerManifestBytes {
+		return service.ProducerManifest{}, false, errors.New("manifest.txt size changed during extraction")
+	}
+	manifest, err := service.ParseProducerManifest(data)
+	if err != nil {
+		return service.ProducerManifest{}, false, err
+	}
+	if err := service.ValidateProducerManifestForBuild(manifest, build); err != nil {
+		return service.ProducerManifest{}, false, err
+	}
+	return manifest, true, nil
+}
+
+func producerManifestHasFile(manifest service.ProducerManifest, name string) bool {
+	for _, file := range manifest.Files {
+		if file.Name == name {
+			return true
+		}
+	}
+	return false
+}
+
+func producerManifestHasPrivateFile(manifest service.ProducerManifest, name string) bool {
+	for _, privateName := range manifest.PrivateFilenames {
+		if privateName == name {
+			return true
+		}
+	}
+	return false
+}
+
+func validateZipMetadata(files []*zip.File) error {
+	if artifactMaxFileBytes == 0 || artifactMaxAggregateBytes == 0 || artifactMaxCompressionRatio == 0 {
+		return errors.New("artifact ZIP safety limits are invalid")
+	}
+	var aggregate uint64
+	for _, zf := range files {
+		uncompressed := zf.UncompressedSize64
+		compressed := zf.CompressedSize64
+		if uncompressed > artifactMaxFileBytes {
+			return fmt.Errorf("artifact ZIP entry %q exceeds per-file uncompressed limit", zf.Name)
+		}
+		if uncompressed > artifactMaxAggregateBytes || aggregate > artifactMaxAggregateBytes-uncompressed {
+			return fmt.Errorf("artifact ZIP exceeds aggregate uncompressed limit")
+		}
+		aggregate += uncompressed
+		if uncompressed == 0 {
+			continue
+		}
+		if compressed == 0 {
+			return fmt.Errorf("artifact ZIP entry %q has invalid compressed size", zf.Name)
+		}
+		quotient, remainder := uncompressed/compressed, uncompressed%compressed
+		if quotient > artifactMaxCompressionRatio || (quotient == artifactMaxCompressionRatio && remainder != 0) {
+			return fmt.Errorf("artifact ZIP entry %q has suspicious compression ratio", zf.Name)
+		}
+	}
+	return nil
+}
+
+func safeZipEntryName(name string) (string, error) {
+	if name == "" || strings.ContainsRune(name, '\x00') {
+		return "", fmt.Errorf("artifact ZIP contains an invalid path")
+	}
+	normalized := strings.ReplaceAll(name, "\\", "/")
+	if path.IsAbs(normalized) || strings.HasPrefix(normalized, "//") || (len(normalized) >= 2 && normalized[1] == ':') {
+		return "", fmt.Errorf("zip slip: absolute artifact path %q", name)
+	}
+	for _, part := range strings.Split(normalized, "/") {
+		if part == ".." {
+			return "", fmt.Errorf("zip slip: parent artifact path %q", name)
+		}
+	}
+	clean := path.Clean(normalized)
+	if clean == "." || clean == "/" || clean == ".." {
+		return "", fmt.Errorf("artifact ZIP contains an invalid path %q", name)
+	}
+	return clean, nil
+}
+
+// validateZipEntryPath validates an archive name and resolves its destination
+// under outDir. Callers must use the returned destination for all filesystem
+// operations; the archive name is never used as a filesystem path directly.
+func validateZipEntryPath(outDir, name string, allowNested bool) (validatedZipEntry, error) {
+	clean, err := safeZipEntryName(name)
+	if err != nil {
+		return validatedZipEntry{}, err
+	}
+	if !allowNested && strings.ContainsRune(clean, '/') {
+		return validatedZipEntry{}, fmt.Errorf("invalid flat extraction name %q", name)
+	}
+
+	root, err := filepath.Abs(outDir)
+	if err != nil {
+		return validatedZipEntry{}, fmt.Errorf("resolve artifact staging directory: %w", err)
+	}
+	normalizedPath := filepath.FromSlash(clean)
+	if !filepath.IsLocal(normalizedPath) {
+		return validatedZipEntry{}, fmt.Errorf("zip slip: non-local artifact path %q", name)
+	}
+	destination, err := filepath.Abs(filepath.Join(root, normalizedPath))
+	if err != nil {
+		return validatedZipEntry{}, fmt.Errorf("resolve artifact destination: %w", err)
+	}
+	relative, err := filepath.Rel(root, destination)
+	if err != nil {
+		return validatedZipEntry{}, fmt.Errorf("check artifact destination: %w", err)
+	}
+	if relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) || filepath.IsAbs(relative) {
+		return validatedZipEntry{}, fmt.Errorf("zip slip: artifact path escapes staging directory %q", name)
+	}
+	return validatedZipEntry{name: clean, destination: destination}, nil
+}
+
+// extractZipFile writes one already-validated output name without replacing
+// an earlier entry. A failed copy removes its partial file.
+func extractZipFile(zf *zip.File, entry validatedZipEntry, aggregate *uint64) (int64, error) {
+	dst := entry.destination
+	if strings.ContainsRune(entry.name, '/') {
+		parent := filepath.Dir(entry.destination)
+		if err := os.MkdirAll(parent, 0700); err != nil {
+			return 0, err
+		}
+	}
+	f, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
 	if err != nil {
 		return 0, err
 	}
-	defer rc.Close()
-	f, err := os.Create(dst)
+	rc, err := zf.Open()
 	if err != nil {
+		_ = f.Close()
+		_ = os.Remove(dst)
 		return 0, err
 	}
-	defer f.Close()
-	return io.Copy(f, rc)
+	n, copyErr := io.Copy(f, io.LimitReader(rc, int64(artifactMaxFileBytes)+1))
+	readerCloseErr := rc.Close()
+	fileCloseErr := f.Close()
+	if copyErr != nil || readerCloseErr != nil || fileCloseErr != nil || n > int64(artifactMaxFileBytes) || uint64(n) != zf.UncompressedSize64 {
+		_ = os.Remove(dst)
+		if copyErr != nil {
+			return 0, copyErr
+		}
+		if readerCloseErr != nil {
+			return 0, readerCloseErr
+		}
+		if fileCloseErr != nil {
+			return 0, fileCloseErr
+		}
+		if n > int64(artifactMaxFileBytes) {
+			return 0, errors.New("uncompressed file exceeds limit")
+		}
+		return 0, fmt.Errorf("extracted size %d does not match ZIP metadata %d", n, zf.UncompressedSize64)
+	}
+	if *aggregate > artifactMaxAggregateBytes-uint64(n) {
+		_ = os.Remove(dst)
+		return 0, errors.New("aggregate extracted bytes exceed limit")
+	}
+	*aggregate += uint64(n)
+	return n, nil
 }
diff --git a/api/http/controller/admin/custom_build_download_test.go b/api/http/controller/admin/custom_build_download_test.go
new file mode 100644
index 0000000..b4c3667
--- /dev/null
+++ b/api/http/controller/admin/custom_build_download_test.go
@@ -0,0 +1,238 @@
+package admin
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"rustdesk-server/api/config"
+	"rustdesk-server/api/global"
+	"rustdesk-server/api/http/middleware"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestCustomBuildDownloadByIDStreamsCompletedPublishedArtifact(t *testing.T) {
+	build, db, cleanup := setupDownloadBuild(t, model.CustomBuildStatusDone)
+	defer cleanup()
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, fmt.Sprintf("/api/admin/custom_build/download/%d", build.Id), nil)
+	c.Params = gin.Params{{Key: "id", Value: fmt.Sprint(build.Id)}}
+	(&CustomBuild{}).DownloadByID(c)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("DownloadByID() status = %d, want 200; body=%s", recorder.Code, recorder.Body.String())
+	}
+	if got := recorder.Header().Get("Content-Length"); got != fmt.Sprint(recorder.Body.Len()) {
+		t.Fatalf("Content-Length = %q, want %d", got, recorder.Body.Len())
+	}
+	if recorder.Header().Get("X-DeskForge-Archive-SHA256") == "" || recorder.Header().Get("X-DeskForge-Archive-SHA256-Scope") != downloadArchiveDigestScope {
+		t.Fatalf("archive integrity headers = %#v, want digest and scope", recorder.Header())
+	}
+	archive, err := zip.NewReader(strings.NewReader(recorder.Body.String()), int64(recorder.Body.Len()))
+	if err != nil {
+		t.Fatalf("response is not a ZIP archive: %v", err)
+	}
+	if len(archive.File) != 1 || archive.File[0].Name != "rustqs.exe" {
+		t.Fatalf("downloaded entries = %#v, want rustqs.exe", archive.File)
+	}
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("re-read downloaded build: %v", err)
+	}
+}
+
+func TestCustomBuildDownloadByIDRejectsPartialAndInvalidBuilds(t *testing.T) {
+	build, _, cleanup := setupDownloadBuild(t, model.CustomBuildStatusBuilding)
+	defer cleanup()
+
+	for _, tc := range []struct {
+		name string
+		id   string
+		want int
+	}{
+		{name: "partial publication", id: fmt.Sprint(build.Id), want: http.StatusConflict},
+		{name: "invalid id", id: "not-an-id", want: http.StatusBadRequest},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			c, _ := gin.CreateTestContext(recorder)
+			c.Request = httptest.NewRequest(http.MethodGet, "/download/"+tc.id, nil)
+			c.Params = gin.Params{{Key: "id", Value: tc.id}}
+			(&CustomBuild{}).DownloadByID(c)
+			if recorder.Code != tc.want {
+				t.Fatalf("DownloadByID() status = %d, want %d; body=%s", recorder.Code, tc.want, recorder.Body.String())
+			}
+			for _, forbidden := range []string{"capability-secret", `"download_key"`, "custom_json", "published_digest"} {
+				if strings.Contains(recorder.Body.String(), forbidden) {
+					t.Fatalf("unsafe download error exposed %q: %s", forbidden, recorder.Body.String())
+				}
+			}
+			if recorder.Header().Get("X-DeskForge-Archive-SHA256") != "" {
+				t.Fatalf("rejected download set archive digest header: %q", recorder.Header().Get("X-DeskForge-Archive-SHA256"))
+			}
+		})
+	}
+}
+
+func TestCustomBuildDownloadByIDRejectsRangeBeforeArchiveHeaders(t *testing.T) {
+	build, _, cleanup := setupDownloadBuild(t, model.CustomBuildStatusDone)
+	defer cleanup()
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/download/"+fmt.Sprint(build.Id), nil)
+	c.Request.Header.Set("Range", "bytes=0-15")
+	c.Params = gin.Params{{Key: "id", Value: fmt.Sprint(build.Id)}}
+	(&CustomBuild{}).DownloadByID(c)
+
+	if recorder.Code != http.StatusRequestedRangeNotSatisfiable {
+		t.Fatalf("DownloadByID() range status = %d, want 416; body=%s", recorder.Code, recorder.Body.String())
+	}
+	for _, header := range []string{"Content-Length", "X-DeskForge-Archive-SHA256", "X-DeskForge-Archive-SHA256-Scope"} {
+		if got := recorder.Header().Get(header); got != "" {
+			t.Fatalf("range rejection set %s = %q", header, got)
+		}
+	}
+}
+
+func TestCustomBuildDownloadRouteRequiresBackendAuthAndAdminPrivilege(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	if err := db.AutoMigrate(&model.User{}, &model.UserToken{}); err != nil {
+		t.Fatalf("migrate auth models: %v", err)
+	}
+	previousDB, previousServiceDB, previousServices, previousConfig := global.DB, service.DB, service.AllService, service.Config
+	previousLogger, previousLocalizer := global.Logger, global.Localizer
+	t.Cleanup(func() {
+		global.DB = previousDB
+		service.DB = previousServiceDB
+		service.AllService = previousServices
+		service.Config = previousConfig
+		global.Logger = previousLogger
+		global.Localizer = previousLocalizer
+		_ = sqlDB.Close()
+	})
+	global.DB = db
+	service.DB = db
+	service.Config = &config.Config{App: config.App{TokenExpire: time.Hour}}
+	global.Logger = logrus.New()
+	global.Localizer = testManifestLocalizer
+	service.AllService = &service.Service{UserService: &service.UserService{}, CustomBuildService: &service.CustomBuildService{}}
+
+	nonAdmin := &model.User{Username: "download-non-admin", IsAdmin: boolPointer(false), Status: model.COMMON_STATUS_ENABLE}
+	if err := db.Create(nonAdmin).Error; err != nil {
+		t.Fatalf("create non-admin: %v", err)
+	}
+	const nonAdminToken = "download-non-admin-token"
+	if err := db.Create(&model.UserToken{UserId: nonAdmin.Id, Token: nonAdminToken, ExpiredAt: time.Now().Add(time.Hour).Unix()}).Error; err != nil {
+		t.Fatalf("create non-admin token: %v", err)
+	}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	group := router.Group("/api/admin")
+	group.Use(middleware.BackendUserAuth())
+	downloadGroup := group.Group("/custom_build").Use(middleware.AdminPrivilege())
+	downloadGroup.GET("/download/:id", (&CustomBuild{}).DownloadByID)
+
+	for _, tc := range []struct {
+		name   string
+		token  string
+		want   int
+		status int
+	}{
+		{name: "missing authentication", want: 403, status: http.StatusOK},
+		{name: "non-admin privilege", token: nonAdminToken, want: 403, status: http.StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(http.MethodGet, "/api/admin/custom_build/download/1", nil)
+			if tc.token != "" {
+				request.Header.Set("api-token", tc.token)
+			}
+			router.ServeHTTP(recorder, request)
+			if recorder.Code != tc.status {
+				t.Fatalf("auth status = %d, want %d; body=%s", recorder.Code, tc.status, recorder.Body.String())
+			}
+			var envelope struct {
+				Code int `json:"code"`
+			}
+			if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+				t.Fatalf("auth response JSON: %v", err)
+			}
+			if envelope.Code != tc.want {
+				t.Fatalf("auth response code = %d, want %d", envelope.Code, tc.want)
+			}
+		})
+	}
+}
+
+func setupDownloadBuild(t *testing.T, status string) (*model.CustomBuild, *gorm.DB, func()) {
+	t.Helper()
+	withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousGlobalDB, previousServiceDB, previousServices := global.DB, service.DB, service.AllService
+	previousLogger := global.Logger
+	global.DB = db
+	service.DB = db
+	global.Logger = logrus.New()
+	service.AllService = &service.Service{CustomBuildService: &service.CustomBuildService{}}
+	cleanup := func() {
+		global.DB = previousGlobalDB
+		service.DB = previousServiceDB
+		service.AllService = previousServices
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	}
+
+	build := &model.CustomBuild{
+		Status:                status,
+		Platform:              "windows",
+		AppName:               "rustqs",
+		Version:               "1.2.3",
+		DownloadKey:           "capability-secret",
+		BuildRef:              strings.Repeat("a", 40),
+		SourceTag:             "1.2.3",
+		AssetsRelease:         "offline-assets-1.2.3",
+		AssetsReleaseID:       12,
+		GithubRunId:           901,
+		GithubProvider:        "github",
+		GithubRepo:            "owner/repo",
+		GithubWorkflow:        "workflow.yml",
+		WorkflowSelector:      "rustqs/workflows",
+		GithubRef:             strings.Repeat("a", 40),
+		GithubArtifactName:    "artifact",
+		GithubArtifactID:      42,
+		GithubRunUrl:          "https://api.github.com/repos/owner/repo/actions/runs/901",
+		GithubHtmlUrl:         "https://github.com/owner/repo/actions/runs/901",
+		PublicationRecordedAt: 1,
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create download build: %v", err)
+	}
+	outDir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0700); err != nil {
+		t.Fatalf("create download output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("binary"), 0600); err != nil {
+		t.Fatalf("write download output: %v", err)
+	}
+	if status == model.CustomBuildStatusDone {
+		markPublishedDigest(t, db, build)
+	}
+	return build, db, cleanup
+}
diff --git a/api/http/controller/admin/custom_platform.go b/api/http/controller/admin/custom_platform.go
new file mode 100644
index 0000000..8147367
--- /dev/null
+++ b/api/http/controller/admin/custom_platform.go
@@ -0,0 +1,36 @@
+package admin
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"rustdesk-server/api/http/response"
+	"rustdesk-server/api/service"
+)
+
+func failCustomValidation(c *gin.Context, err error) {
+	response.FailStatus(c, http.StatusBadRequest, 101, err.Error())
+}
+
+func failCustomServiceError(c *gin.Context, err error) bool {
+	if service.IsSecretEncryptionConfigurationError(err) {
+		response.FailStatus(c, http.StatusServiceUnavailable, 101, "secret encryption is not configured")
+		return true
+	}
+	if !service.IsClientValidationError(err) {
+		return false
+	}
+	failCustomValidation(c, err)
+	return true
+}
+
+// validateCustomPlatform is the request-time persistence gate for custom
+// builds and presets. The service owns the closed platform domain; callers
+// must run this gate before any Create, Update, or upsert operation.
+func validateCustomPlatform(c *gin.Context, value string) bool {
+	if err := service.ValidateCustomPlatform(value); err != nil {
+		failCustomValidation(c, err)
+		return false
+	}
+	return true
+}
diff --git a/api/http/controller/admin/custom_platform_test.go b/api/http/controller/admin/custom_platform_test.go
new file mode 100644
index 0000000..52d6868
--- /dev/null
+++ b/api/http/controller/admin/custom_platform_test.go
@@ -0,0 +1,68 @@
+package admin
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"rustdesk-server/api/utils"
+)
+
+func TestValidateCustomPlatform(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, test := range []struct {
+		name       string
+		platform   string
+		wantOK     bool
+		wantStatus int
+	}{
+		{name: "windows", platform: "windows", wantOK: true, wantStatus: http.StatusOK},
+		{name: "linux", platform: "linux", wantOK: true, wantStatus: http.StatusOK},
+		{name: "android", platform: "android", wantOK: true, wantStatus: http.StatusOK},
+		{name: "macos", platform: "macos", wantStatus: http.StatusBadRequest},
+		{name: "unknown", platform: "plan9", wantStatus: http.StatusBadRequest},
+		{name: "empty", platform: "", wantStatus: http.StatusBadRequest},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			context, _ := gin.CreateTestContext(recorder)
+
+			if got := validateCustomPlatform(context, test.platform); got != test.wantOK {
+				t.Errorf("validateCustomPlatform(%q) = %v, want %v", test.platform, got, test.wantOK)
+			}
+			if recorder.Code != test.wantStatus {
+				t.Errorf("validateCustomPlatform(%q) status = %d, want %d", test.platform, recorder.Code, test.wantStatus)
+			}
+			if !test.wantOK {
+				var payload struct {
+					Code int `json:"code"`
+				}
+				if err := json.Unmarshal(recorder.Body.Bytes(), &payload); err != nil {
+					t.Fatalf("invalid error response: %v", err)
+				}
+				if payload.Code != 101 {
+					t.Errorf("error response code = %d, want 101", payload.Code)
+				}
+			}
+		})
+	}
+}
+
+func TestSecretPersistenceErrorUsesServiceUnavailableWithoutSecret(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	recorder := httptest.NewRecorder()
+	context, _ := gin.CreateTestContext(recorder)
+	secretValue := "must-not-appear"
+	if !failCustomServiceError(context, &utils.SecretEncryptionKeyError{}) {
+		t.Fatal("failCustomServiceError() did not handle secret configuration error")
+	}
+	if recorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("error status = %d, want %d", recorder.Code, http.StatusServiceUnavailable)
+	}
+	if strings.Contains(recorder.Body.String(), secretValue) {
+		t.Fatalf("secret value leaked in error response: %s", recorder.Body.String())
+	}
+}
diff --git a/api/http/controller/admin/custom_preset.go b/api/http/controller/admin/custom_preset.go
index fe57884..d20d4a5 100644
--- a/api/http/controller/admin/custom_preset.go
+++ b/api/http/controller/admin/custom_preset.go
@@ -1,25 +1,41 @@
 package admin
 
 import (
+	"errors"
+	"fmt"
+	"net/http"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
+	"rustdesk-server/api/utils"
 )
 
 type CustomPreset struct{}
 
+func failCustomPresetRead(c *gin.Context, err error) {
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
+		return
+	}
+	if global.Logger != nil {
+		global.Logger.Errorf("custom preset read failed: %v", err)
+	}
+	response.FailStatus(c, http.StatusInternalServerError, 101, "custom preset is unavailable")
+}
+
 // getOwnedPreset loads a preset by id and verifies it belongs to the current user.
 // On any failure it writes the error response and returns ok=false, so callers
 // just `return` instead of repeating the not-found / ownership checks.
 func (p *CustomPreset) getOwnedPreset(c *gin.Context, id uint) (*model.CustomPreset, bool) {
-	ex := service.AllService.CustomPresetService.Info(id)
-	if ex.Id == 0 {
-		response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
+	ex, err := service.AllService.CustomPresetService.Info(id)
+	if err != nil {
+		failCustomPresetRead(c, err)
 		return nil, false
 	}
 	u := service.AllService.UserService.CurUser(c)
@@ -30,6 +46,17 @@ func (p *CustomPreset) getOwnedPreset(c *gin.Context, id uint) (*model.CustomPre
 	return ex, true
 }
 
+// List returns the current user's redacted custom presets.
+// @Tags CustomPreset
+// @Summary List custom presets
+// @Description Administrators with AdminPrivilege receive a paginated redacted custom-preset list.
+// @Produce json
+// @Param page query int false "Page number"
+// @Param page_size query int false "Number of presets per page"
+// @Success 200 {object} response.Response{data=model.CustomPresetSafeList}
+// @Failure 500 {object} response.Response
+// @Router /admin/custom_preset/list [get]
+// @Security token
 func (p *CustomPreset) List(c *gin.Context) {
 	q := &admin.CustomPresetQuery{}
 	if err := c.ShouldBindQuery(q); err != nil {
@@ -41,10 +68,24 @@ func (p *CustomPreset) List(c *gin.Context) {
 		response.Fail(c, 101, response.TranslateMsg(c, "Unauthorized"))
 		return
 	}
-	res := service.AllService.CustomPresetService.ListByUser(uint(q.Page), uint(q.PageSize), u.Id)
-	response.Success(c, res)
+	res, err := service.AllService.CustomPresetService.ListByUser(uint(q.Page), uint(q.PageSize), u.Id)
+	if err != nil {
+		failCustomPresetRead(c, err)
+		return
+	}
+	response.Success(c, res.Safe())
 }
 
+// Detail returns one redacted custom preset owned by the current user.
+// @Tags CustomPreset
+// @Summary Get a custom preset
+// @Description Administrators with AdminPrivilege may read their own redacted custom preset.
+// @Produce json
+// @Param id path int true "Custom preset ID"
+// @Success 200 {object} response.Response{data=model.CustomPresetSafe}
+// @Failure 500 {object} response.Response
+// @Router /admin/custom_preset/detail/{id} [get]
+// @Security token
 func (p *CustomPreset) Detail(c *gin.Context) {
 	id := c.Param("id")
 	iid, _ := strconv.Atoi(id)
@@ -52,15 +93,33 @@ func (p *CustomPreset) Detail(c *gin.Context) {
 	if !ok {
 		return
 	}
-	response.Success(c, preset)
+	response.Success(c, preset.Safe())
 }
 
+// Create stores a redacted custom preset for the current user.
+// @Tags CustomPreset
+// @Summary Create a custom preset
+// @Description Administrators with AdminPrivilege may save a custom preset; provider-derived build references are resolved server-side.
+// @Accept json
+// @Produce json
+// @Param body body admin.CustomPresetForm true "Custom-preset payload"
+// @Success 200 {object} response.Response{data=model.CustomPresetSafe}
+// @Failure 500 {object} response.Response
+// @Router /admin/custom_preset/create [post]
+// @Security token
 func (p *CustomPreset) Create(c *gin.Context) {
 	f := &admin.CustomPresetForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
 		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
+	if f.BuildRef != "" {
+		failCustomValidation(c, fmt.Errorf("build_ref is system-derived and cannot be supplied"))
+		return
+	}
+	if !validateCustomPlatform(c, f.Platform) {
+		return
+	}
 	errList := global.Validator.ValidStruct(c, f)
 	if len(errList) > 0 {
 		response.Fail(c, 101, errList[0])
@@ -74,20 +133,53 @@ func (p *CustomPreset) Create(c *gin.Context) {
 	}
 	preset := f.ToCustomPreset()
 	preset.UserId = user.Id
+	if err := utils.RequireSecretEncryptionForCustomBuilderJSON(preset.CustomJson); err != nil {
+		if failCustomServiceError(c, err) {
+			return
+		}
+		response.FailStatus(c, http.StatusServiceUnavailable, 101, "secret encryption is not configured")
+		return
+	}
 
 	if err := service.AllService.CustomPresetService.Create(preset); err != nil {
+		if failCustomServiceError(c, err) {
+			return
+		}
 		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
 		return
 	}
-	response.Success(c, preset)
+	response.Success(c, preset.Safe())
 }
 
+// Update changes a redacted custom preset owned by the current user.
+// @Tags CustomPreset
+// @Summary Update a custom preset
+// @Description Administrators with AdminPrivilege may update their own custom preset; provider-derived build references are resolved server-side.
+// @Accept json
+// @Produce json
+// @Param body body admin.CustomPresetForm true "Custom-preset update payload"
+// @Success 200 {object} response.Response{data=model.CustomPresetSafe}
+// @Failure 500 {object} response.Response
+// @Router /admin/custom_preset/update [post]
+// @Security token
 func (p *CustomPreset) Update(c *gin.Context) {
 	f := &admin.CustomPresetForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
 		response.Fail(c, 101, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
+	if f.BuildRef != "" {
+		failCustomValidation(c, fmt.Errorf("build_ref is system-derived and cannot be supplied"))
+		return
+	}
+	if !validateCustomPlatform(c, f.Platform) {
+		return
+	}
+	errList := global.Validator.ValidStruct(c, f)
+	if len(errList) > 0 {
+		response.Fail(c, 101, errList[0])
+		return
+	}
 	ex, ok := p.getOwnedPreset(c, f.Id)
 	if !ok {
 		return
@@ -97,14 +189,35 @@ func (p *CustomPreset) Update(c *gin.Context) {
 	ex.Version = f.Version
 	ex.AppName = f.AppName
 	ex.CustomJson = f.CustomJson
+	if err := utils.RequireSecretEncryptionForCustomBuilderJSON(ex.CustomJson); err != nil {
+		if failCustomServiceError(c, err) {
+			return
+		}
+		response.FailStatus(c, http.StatusServiceUnavailable, 101, "secret encryption is not configured")
+		return
+	}
 
 	if err := service.AllService.CustomPresetService.Update(ex); err != nil {
+		if failCustomServiceError(c, err) {
+			return
+		}
 		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
 		return
 	}
-	response.Success(c, ex)
+	response.Success(c, ex.Safe())
 }
 
+// Delete removes a custom preset owned by the current user.
+// @Tags CustomPreset
+// @Summary Delete a custom preset
+// @Description Administrators with AdminPrivilege may delete their own custom preset.
+// @Accept json
+// @Produce json
+// @Param body body admin.CustomPresetForm true "Custom-preset identifier"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/custom_preset/delete [post]
+// @Security token
 func (p *CustomPreset) Delete(c *gin.Context) {
 	f := &admin.CustomPresetForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
diff --git a/api/http/controller/admin/dashboard.go b/api/http/controller/admin/dashboard.go
index b0d7ec2..fa2c390 100644
--- a/api/http/controller/admin/dashboard.go
+++ b/api/http/controller/admin/dashboard.go
@@ -18,6 +18,15 @@ type Dashboard struct{}
 
 const onlinePeerWindow = 5 * time.Minute
 
+// Stats returns aggregate counters for the authenticated admin dashboard.
+// @Tags Dashboard
+// @Summary Get dashboard statistics
+// @Description Authenticated dashboard counters for users, peers, groups, and logins.
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/dashboard/stats [get]
+// @Security token
 func (ct *Dashboard) Stats(c *gin.Context) {
 	var totalUsers int64
 	var totalPeers int64
@@ -65,6 +74,15 @@ type usageRow struct {
 	Speed   float64 `json:"speed"`
 }
 
+// Health returns the current RustDesk server health and bandwidth summary.
+// @Tags Dashboard
+// @Summary Get server health
+// @Description Authenticated server health and bandwidth data for the admin dashboard.
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/dashboard/health [get]
+// @Security token
 func (ct *Dashboard) Health(c *gin.Context) {
 	idPort := global.Config.Admin.IdServerPort - 1
 	relayPort := global.Config.Admin.RelayServerPort
diff --git a/api/http/controller/admin/deviceGroup.go b/api/http/controller/admin/deviceGroup.go
index 84bc893..2db7ddb 100644
--- a/api/http/controller/admin/deviceGroup.go
+++ b/api/http/controller/admin/deviceGroup.go
@@ -41,7 +41,7 @@ func (ct *DeviceGroup) Detail(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.DeviceGroupForm true ""
+// @Param body body admin.DeviceGroupForm true "Device group form payload"
 // @Success 200 {object} response.Response{data=model.DeviceGroup}
 // @Failure 500 {object} response.Response
 // @Router /admin/device_group/create [post]
@@ -72,8 +72,8 @@ func (ct *DeviceGroup) Create(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the device-group list"
+// @Param page_size query int false "Number of device groups per page"
 // @Success 200 {object} response.Response{data=model.GroupList}
 // @Failure 500 {object} response.Response
 // @Router /admin/device_group/list [get]
@@ -94,7 +94,7 @@ func (ct *DeviceGroup) List(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.DeviceGroupForm true ""
+// @Param body body admin.DeviceGroupForm true "Device group update form payload"
 // @Success 200 {object} response.Response{data=model.Group}
 // @Failure 500 {object} response.Response
 // @Router /admin/device_group/update [post]
@@ -129,7 +129,7 @@ func (ct *DeviceGroup) Update(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.DeviceGroupForm true ""
+// @Param body body admin.DeviceGroupForm true "Device group deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/device_group/delete [post]
diff --git a/api/http/controller/admin/file.go b/api/http/controller/admin/file.go
index 2ac8cf6..22fcadf 100644
--- a/api/http/controller/admin/file.go
+++ b/api/http/controller/admin/file.go
@@ -1,4 +1,4 @@
-package admin
+package admin
 
 import (
 	"crypto/rand"
@@ -19,8 +19,8 @@ import (
 type File struct {
 }
 
-// OssToken 
-// @Tags 
+// OssToken
+// @Tags
 // @Summary ossToken
 // @Description ossToken
 // @Accept  json
@@ -39,7 +39,16 @@ type FileBack struct {
 	Url string `json:"url"`
 }
 
-// Notify 
+// Notify handles the authenticated upload callback after provider verification.
+// @Tags File
+// @Summary Confirm an uploaded file
+// @Description Authenticated upload callback used after the object-storage provider verifies the request.
+// @Accept multipart/form-data
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/file/notify [post]
+// @Security token
 func (f *File) Notify(c *gin.Context) {
 
 	res := global.Oss.Verify(c.Request)
@@ -56,13 +65,13 @@ func (f *File) Notify(c *gin.Context) {
 
 }
 
-// Upload 
-// @Tags 
-// @Summary 
-// @Description 
+// Upload
+// @Tags
+// @Summary
+// @Description
 // @Accept  multipart/form-data
 // @Produce  json
-// @Param file formData file true ""
+// @Param file formData file true "Multipart file to upload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/file/upload [post]
diff --git a/api/http/controller/admin/github_build_config.go b/api/http/controller/admin/github_build_config.go
index 7c5f7c3..0fe810a 100644
--- a/api/http/controller/admin/github_build_config.go
+++ b/api/http/controller/admin/github_build_config.go
@@ -2,12 +2,16 @@ package admin
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"io"
+	"net/http"
 	"time"
 
 	"github.com/gin-gonic/gin"
 
 	"rustdesk-server/api/global"
+	requestadmin "rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
@@ -17,53 +21,209 @@ import (
 // Все эндпоинты под /admin/github_build_config/* (admin-only).
 type GithubBuildConfig struct{}
 
+func failGithubConfigError(c *gin.Context, err error) bool {
+	if err == nil {
+		return false
+	}
+	if global.Logger != nil {
+		global.Logger.Errorf("GitHub workflow/provider operation failed: %s", service.GithubErrorDetail(err))
+	}
+	if status, handled := service.GithubErrorHTTPStatus(err); handled {
+		response.FailStatus(c, status, 101, service.GithubSafeErrorMessage(err))
+		return true
+	}
+	response.FailStatus(c, http.StatusInternalServerError, 101, service.GithubSafeErrorMessage(err))
+	return true
+}
+
+func dispatchTestResponse(dispatch *service.GithubDispatchResult) gin.H {
+	return gin.H{
+		"run_id":   dispatch.WorkflowRunID,
+		"run_url":  dispatch.RunURL,
+		"html_url": dispatch.HTMLURL,
+		"status":   "dispatched",
+		"message":  fmt.Sprintf("Smoke-test build dispatched. Check status at %s", dispatch.HTMLURL),
+	}
+}
+
 // GET /admin/github_build_config/get → возвращает SafeView (без секретов).
+// @Tags GithubBuildConfig
+// @Summary Get GitHub build configuration
+// @Description Admin-only secret-free GitHub build configuration view. Credentials are represented only by has_token and has_payload_key flags.
+// @Produce json
+// @Success 200 {object} response.Response{data=model.GithubBuildConfigSafe} "Secret-free GitHub build configuration envelope"
+// @Failure 500 {object} response.Response "GitHub build configuration is unavailable"
+// @Router /admin/github_build_config/get [get]
+// @Security token
 func (h *GithubBuildConfig) Get(c *gin.Context) {
 	cfg, err := service.AllService.GithubBuildConfigService.Get()
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
 	response.Success(c, cfg.Safe())
 }
 
 // POST /admin/github_build_config/save
-// body: { repo, workflow_filename, branch, token?, payload_key? }
+// body: { repo, token?, payload_key? }
 // Пустые token / payload_key — не затирают существующие значения.
+// @Tags GithubBuildConfig
+// @Summary Save GitHub build configuration
+// @Description Admin-only configuration update. Repository is user-authored; workflow selectors and resolved provider identities remain system/provider-derived. Empty secrets preserve stored values, and the response is secret-free.
+// @Accept json
+// @Produce json
+// @Param body body requestadmin.GithubBuildConfigForm true "GitHub build configuration"
+// @Success 200 {object} response.Response{data=model.GithubBuildConfigSafe} "Secret-free GitHub build configuration envelope"
+// @Failure 400 {object} response.Response "Invalid configuration request"
+// @Failure 500 {object} response.Response "GitHub build configuration could not be saved"
+// @Failure 503 {object} response.Response "Secret encryption is unavailable"
+// @Router /admin/github_build_config/save [post]
+// @Security token
 func (h *GithubBuildConfig) Save(c *gin.Context) {
-	var in model.GithubBuildConfig
-	if err := c.ShouldBindJSON(&in); err != nil {
-		response.Fail(c, 101, "params error: "+err.Error())
+	var form requestadmin.GithubBuildConfigForm
+	if err := c.ShouldBindJSON(&form); err != nil {
+		response.Fail(c, 101, "params error")
 		return
 	}
-	if err := service.AllService.GithubBuildConfigService.Save(&in); err != nil {
-		response.Fail(c, 101, err.Error())
+	in := &model.GithubBuildConfig{Repo: form.Repo, Token: form.Token, PayloadKey: form.PayloadKey}
+	if err := service.AllService.GithubBuildConfigService.Save(in); err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
+		return
+	}
+	cur, err := service.AllService.GithubBuildConfigService.Get()
+	if err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
-	cur, _ := service.AllService.GithubBuildConfigService.Get()
 	response.Success(c, cur.Safe())
 }
 
+// POST /admin/github_build_config/approve_workflow_ref
+// body: { confirm: true, workflow_tag: "provider-derived-tag-label" }
+// The tag label must come from the safe workflow_tags catalog; raw refs and
+// SHAs are not accepted as normal input.
+//
+// @Tags GithubBuildConfig
+// @Summary Approve a provider-derived workflow tag
+// @Description Admin confirmation for a provider-derived, verified, protected workflow tag. The workflow_tag must be selected from workflow_tags; raw refs and SHAs are not accepted. The response is the secret-free GithubBuildConfigSafe view.
+// @Accept json
+// @Produce json
+// @Param body body requestadmin.WorkflowRefApprovalForm true "Confirm and provider-derived workflow tag label"
+// @Success 200 {object} response.Response{data=model.GithubBuildConfigSafe} "Safe GitHub build configuration envelope"
+// @Failure 400 {object} response.Response "Invalid selector or approval request"
+// @Failure 500 {object} response.Response "Workflow approval failed"
+// @Failure 502 {object} response.Response "Provider rejected or could not verify the workflow tag"
+// @Failure 503 {object} response.Response "GitHub provider configuration or transport is unavailable"
+// @Router /admin/github_build_config/approve_workflow_ref [post]
+// @Security token
+func (h *GithubBuildConfig) ApproveWorkflowRef(c *gin.Context) {
+	var form requestadmin.WorkflowRefApprovalForm
+	if err := c.ShouldBindJSON(&form); err != nil {
+		response.Fail(c, 101, "params error")
+		return
+	}
+	if !form.Confirm {
+		response.Fail(c, 101, "workflow reference approval requires confirm=true")
+		return
+	}
+	cfg, err := service.AllService.GithubBuildConfigService.ApproveWorkflowTag(form.WorkflowTag)
+	if err != nil {
+		var approvalErr *service.WorkflowRefApprovalError
+		if errors.As(err, &approvalErr) {
+			response.FailStatus(c, http.StatusBadRequest, 101, "workflow reference is not an approved selector")
+			return
+		}
+		if failGithubConfigError(c, err) {
+			return
+		}
+		response.Fail(c, 101, "workflow reference approval failed")
+		return
+	}
+	response.Success(c, cfg.Safe())
+}
+
+// GET /admin/github_build_config/workflow_tags
+// Returns only provider-derived safe tag labels that pass provider verification and
+// current workflow readiness checks. PATs, payload keys, refs, and SHAs never
+// cross this admin DTO boundary.
+//
+// @Tags GithubBuildConfig
+// @Summary List provider-derived workflow tag options
+// @Description Admin-only capability catalog. Each WorkflowTagOption is a safe provider-derived label; credentials, raw refs, SHAs, and provider verification objects remain server-side. Approval must select one of these options.
+// @Produce json
+// @Success 200 {object} response.Response{data=map[string][]service.WorkflowTagOption} "Safe workflow tag options under data.tags"
+// @Failure 500 {object} response.Response "Workflow tag options are unavailable"
+// @Failure 502 {object} response.Response "Provider rejected or returned invalid workflow data"
+// @Failure 503 {object} response.Response "GitHub provider configuration or transport is unavailable"
+// @Router /admin/github_build_config/workflow_tags [get]
+// @Security token
+func (h *GithubBuildConfig) WorkflowTags(c *gin.Context) {
+	svc := service.AllService.GithubBuildConfigService
+	config, err := svc.Get()
+	if err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		response.Fail(c, 101, "workflow tag options unavailable")
+		return
+	}
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 20*time.Second)
+	defer cancel()
+	options, err := svc.ListWorkflowTagOptions(ctx, config)
+	if err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		response.Fail(c, 101, "workflow tag options unavailable")
+		return
+	}
+	response.Success(c, gin.H{"tags": options})
+}
+
 // POST /admin/github_build_config/generate_key
 // Генерит свежий 43-char base64 ключ и СОХРАНЯЕТ его в конфиг.
 // Возвращает ключ В ОТКРЫТУЮ — чтобы юзер скопировал и положил в GitHub Secrets форка
 // как WORKFLOW_PAYLOAD_KEY. Это единственный момент когда секрет показывается; потом
 // /get вернёт только has_payload_key=true.
+// @Tags GithubBuildConfig
+// @Summary Generate a workflow payload key
+// @Description Admin-only operation that creates and stores a new workflow payload key. The generated key is returned once so it can be copied to the provider secret store; later configuration reads are secret-free.
+// @Produce json
+// @Success 200 {object} response.Response "Generated workflow payload key"
+// @Failure 500 {object} response.Response "Payload key could not be generated"
+// @Failure 503 {object} response.Response "Secret encryption is unavailable"
+// @Router /admin/github_build_config/generate_key [post]
+// @Security token
 func (h *GithubBuildConfig) GenerateKey(c *gin.Context) {
 	svc := service.AllService.GithubBuildConfigService
 	key, err := svc.GeneratePayloadKey()
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		failGithubConfigError(c, err)
 		return
 	}
 	cur, err := svc.Get()
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
 	cur.PayloadKey = key
 	if err := service.AllService.GithubBuildConfigService.Save(cur); err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
 	response.Success(c, gin.H{"payload_key": key})
@@ -71,69 +231,63 @@ func (h *GithubBuildConfig) GenerateKey(c *gin.Context) {
 
 // POST /admin/github_build_config/test
 // Проверяет PAT + доступ к репо. Не светит токен в ответе.
+// @Tags GithubBuildConfig
+// @Summary Test GitHub provider access
+// @Description Admin-only read-only provider connectivity check. The stored PAT is used server-side and is never returned.
+// @Produce json
+// @Success 200 {object} response.Response "Provider access is available"
+// @Failure 502 {object} response.Response "Provider rejected the configured credentials or repository"
+// @Failure 503 {object} response.Response "GitHub provider configuration or transport is unavailable"
+// @Router /admin/github_build_config/test [post]
+// @Security token
 func (h *GithubBuildConfig) Test(c *gin.Context) {
 	svc := service.AllService.GithubBuildConfigService
 	cur, err := svc.Get()
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
-	ok, msg := svc.TestConnection(cur)
-	if ok {
-		response.Success(c, gin.H{"ok": true, "message": msg})
-	} else {
-		response.Success(c, gin.H{"ok": false, "message": msg})
+	if err := svc.TestConnectionError(cur); err != nil {
+		failGithubConfigError(c, err)
+		return
 	}
+	response.Success(c, gin.H{"ok": true, "message": "ok"})
 }
 
 // POST /admin/github_build_config/sync_secret
 // One-click sealed-box sync: кладёт текущий PayloadKey в GitHub Secrets форка как
 // WORKFLOW_PAYLOAD_KEY. Удобно после GenerateKey — больше не надо лезть в Settings.
+// @Tags GithubBuildConfig
+// @Summary Sync the workflow payload key
+// @Description Admin-only provider mutation that synchronizes the stored workflow payload key to the configured GitHub Actions secret. The key is not returned.
+// @Produce json
+// @Success 200 {object} response.Response "Workflow payload key synchronized"
+// @Failure 502 {object} response.Response "Provider rejected the secret update"
+// @Failure 503 {object} response.Response "GitHub provider configuration or transport is unavailable"
+// @Router /admin/github_build_config/sync_secret [post]
+// @Security token
 func (h *GithubBuildConfig) SyncSecret(c *gin.Context) {
 	svc := service.AllService.GithubBuildConfigService
 	cur, err := svc.Get()
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
 	if err := svc.SetWorkflowSecret(cur); err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
 		return
 	}
 	response.Success(c, gin.H{"ok": true, "message": "WORKFLOW_PAYLOAD_KEY synced to GitHub Secrets"})
 }
 
-// POST /admin/github_build_config/sync_pat
-// One-click sealed-box sync: кладёт PAT в GitHub Secrets настроенного репозитория как
-// GH_PAT. Нужен для sync-workflows.yml (доступ к форку из CI DeskForge).
-// body: { token? } — если token не передан, берётся сохранённый из конфига.
-func (h *GithubBuildConfig) SyncPat(c *gin.Context) {
-	svc := service.AllService.GithubBuildConfigService
-	cur, err := svc.Get()
-	if err != nil {
-		response.Fail(c, 101, err.Error())
-		return
-	}
-
-	var req struct {
-		Token string `json:"token"`
-	}
-	_ = c.ShouldBindJSON(&req) // тело опционально
-
-	// Use the token from the request if present; otherwise fall back to the
-	// saved config so "Sync PAT to CI" works after saving without retyping.
-	cfg := *cur
-	if req.Token != "" {
-		cfg.Token = req.Token
-	}
-
-	if err := svc.SetSyncPatSecret(&cfg); err != nil {
-		response.Fail(c, 101, err.Error())
-		return
-	}
-	response.Success(c, gin.H{"ok": true, "message": "GH_PAT synced to " + cfg.Repo + " GitHub Secrets"})
-}
-
 // POST /admin/github_build_config/dispatch_test
 // Диспетчит workflow_dispatch и возвращает run_id. Статус — в GitHub Actions
 // (длинный poll здесь не держим, чтобы не ловить обрыв прокси).
@@ -145,11 +299,27 @@ func (h *GithubBuildConfig) SyncPat(c *gin.Context) {
 //     реальный билд, а не дешёвая проверка (для read-only есть /test);
 //   - payload заполняется реальными server/key самого сервера и понятным
 //     app_name "deskforge-smoketest", так что smoke-сборка валидна и пригодна.
+//
+// @Tags GithubBuildConfig
+// @Summary Dispatch a GitHub smoke-test build
+// @Description Admin-only provider mutation that dispatches the configured Windows workflow with server-derived parameters after explicit confirmation. The response contains provider run metadata, not credentials.
+// @Accept json
+// @Produce json
+// @Param body body map[string]bool false "Explicit build confirmation"
+// @Success 200 {object} response.Response "Provider workflow dispatch metadata"
+// @Failure 412 {object} response.Response "Workflow reference approval is required"
+// @Failure 502 {object} response.Response "Provider rejected the workflow dispatch"
+// @Failure 503 {object} response.Response "GitHub provider configuration or transport is unavailable"
+// @Router /admin/github_build_config/dispatch_test [post]
+// @Security token
 func (h *GithubBuildConfig) DispatchTest(c *gin.Context) {
 	var req struct {
 		Confirm bool `json:"confirm"`
 	}
-	_ = c.ShouldBindJSON(&req) // тело опционально; нас интересует только confirm
+	if err := c.ShouldBindJSON(&req); err != nil && !errors.Is(err, io.EOF) {
+		response.Fail(c, 101, "params error")
+		return
+	} // тело опционально; нас интересует только confirm
 	if !req.Confirm {
 		response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+
 			"this triggers a REAL GitHub Actions build and consumes Actions minutes; "+
@@ -160,32 +330,80 @@ func (h *GithubBuildConfig) DispatchTest(c *gin.Context) {
 	svc := service.AllService.GithubBuildConfigService
 	cur, err := svc.Get()
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
+		return
+	}
+	if err := svc.RequireWorkflowRefApproval(cur); err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		response.FailStatus(c, http.StatusPreconditionFailed, 101, "workflow reference approval is required")
+		return
+	}
+	if err := service.RequireConfiguredPublicKey(); err != nil {
+		if failGithubConfigError(c, err) {
+			return
+		}
+		response.FailStatus(c, http.StatusServiceUnavailable, 101, "configured public key is unavailable")
 		return
 	}
 
+	// Select the newest validated catalog identity. The endpoint has no raw ref
+	// input; it follows the same fixed Windows workflow and immutable identity
+	// contract as normal builds.
+	versionsCtx, versionsCancel := context.WithTimeout(c.Request.Context(), 15*time.Second)
+	versions, err := svc.GetAvailableVersions(versionsCtx)
+	versionsCancel()
+	if err != nil || len(versions) == 0 {
+		if err == nil {
+			err = fmt.Errorf("configured repository has no available build versions")
+		}
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
+		return
+	}
+	identity := versions[0].VersionIdentity
+
 	// Реальные параметры сервера, чтобы smoke-артефакт был рабочим, а не пустым.
 	server := global.Config.Rustdesk.IdServer
 	if server == "" {
 		server = global.Config.Rustdesk.ApiServer
 	}
-	params := map[string]any{
-		"app_name":   "deskforge-smoketest",
-		"server":     server,
-		"key":        global.Config.Rustdesk.Key,
-		"custom_txt": "",
+	params, err := normalizeDispatchTestParams(server, global.Config.Rustdesk.Key, identity.DisplayVersion)
+	if err != nil {
+		response.Fail(c, 101, "invalid configured build parameters")
+		return
 	}
 
 	dispatchCtx, dispatchCancel := context.WithTimeout(c.Request.Context(), 60*time.Second)
 	defer dispatchCancel()
-	runId, err := svc.DispatchBuild(dispatchCtx, cur, params)
+	dispatch, err := svc.DispatchBuild(dispatchCtx, cur, identity, string(service.PlatformWindows), params)
 	if err != nil {
-		response.Fail(c, 101, err.Error())
+		if failGithubConfigError(c, err) {
+			return
+		}
+		failGithubConfigError(c, err)
 		return
 	}
-	response.Success(c, gin.H{
-		"run_id":  runId,
-		"status":  "dispatched",
-		"message": fmt.Sprintf("Smoke-test build dispatched. Check status at https://github.com/%s/actions/runs/%d", cur.Repo, runId),
+	response.Success(c, dispatchTestResponse(dispatch))
+}
+
+func normalizeDispatchTestParams(server, key, version string) (map[string]any, error) {
+	normalized, err := service.NormalizeCustomBuild(map[string]any{
+		"server_ip": server,
+		"key":       key,
+	}, service.BuildRecordContext{
+		Platform: string(service.PlatformWindows),
+		AppName:  "deskforge-smoketest",
+		Version:  version,
 	})
+	if err != nil {
+		return nil, err
+	}
+	return normalized.DispatchParams, nil
 }
diff --git a/api/http/controller/admin/github_build_config_test.go b/api/http/controller/admin/github_build_config_test.go
new file mode 100644
index 0000000..58d166d
--- /dev/null
+++ b/api/http/controller/admin/github_build_config_test.go
@@ -0,0 +1,468 @@
+package admin
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+
+	"rustdesk-server/api/global"
+	"rustdesk-server/api/http/middleware"
+	"rustdesk-server/api/http/response"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+	"rustdesk-server/api/utils"
+)
+
+func TestDispatchTestResponseIncludesProviderRunDetails(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	recorder := httptest.NewRecorder()
+	context, _ := gin.CreateTestContext(recorder)
+
+	htmlURL := "https://github.com/owner/repo/actions/runs/12345"
+	runURL := "https://api.github.com/repos/owner/repo/actions/runs/12345"
+	response.Success(context, dispatchTestResponse(&service.GithubDispatchResult{
+		WorkflowRunID: 12345,
+		RunURL:        runURL,
+		HTMLURL:       htmlURL,
+	}))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("response status = %d, want %d", recorder.Code, http.StatusOK)
+	}
+
+	var payload struct {
+		Data struct {
+			RunID   int64  `json:"run_id"`
+			RunURL  string `json:"run_url"`
+			HTMLURL string `json:"html_url"`
+			Status  string `json:"status"`
+			Message string `json:"message"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("invalid dispatch response: %v", err)
+	}
+
+	if payload.Data.RunID != 12345 {
+		t.Errorf("run_id = %d, want 12345", payload.Data.RunID)
+	}
+	if payload.Data.RunURL != runURL {
+		t.Errorf("run_url = %q, want %q", payload.Data.RunURL, runURL)
+	}
+	if payload.Data.HTMLURL != htmlURL {
+		t.Errorf("html_url = %q, want %q", payload.Data.HTMLURL, htmlURL)
+	}
+	if payload.Data.Status != "dispatched" {
+		t.Errorf("status = %q, want dispatched", payload.Data.Status)
+	}
+	wantMessage := "Smoke-test build dispatched. Check status at " + htmlURL
+	if payload.Data.Message != wantMessage {
+		t.Errorf("message = %q, want %q", payload.Data.Message, wantMessage)
+	}
+}
+
+func TestDispatchTestParamsUseTypedConfiguredValues(t *testing.T) {
+	params, err := normalizeDispatchTestParams("id.example:21116", "public-key", "1.4.8")
+	if err != nil {
+		t.Fatalf("normalizeDispatchTestParams() error = %v", err)
+	}
+	customTxt, ok := params["custom_txt"].(service.NormalizedCustomTxt)
+	if !ok || customTxt.Value() != "" || params["server"] != "id.example:21116" || params["key"] != "public-key" || params["app_name"] != "deskforge-smoketest" {
+		t.Fatalf("normalized smoke-test params = %#v", params)
+	}
+
+	for _, test := range []struct {
+		name   string
+		server string
+		key    string
+	}{
+		{name: "server newline", server: "id.example:21116\n"},
+		{name: "key newline", server: "id.example:21116", key: "public\nkey"},
+		{name: "key nul", server: "id.example:21116", key: "public\x00key"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := normalizeDispatchTestParams(test.server, test.key, "1.4.8"); err == nil {
+				t.Fatal("normalizeDispatchTestParams() error = nil, want unsafe configured value rejection")
+			}
+		})
+	}
+
+}
+
+func TestGithubSecretPersistenceErrorUsesServiceUnavailable(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	recorder := httptest.NewRecorder()
+	context, _ := gin.CreateTestContext(recorder)
+	if !failGithubConfigError(context, &utils.SecretEncryptionKeyError{}) {
+		t.Fatal("failGithubConfigError() did not handle secret configuration error")
+	}
+	if recorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("error status = %d, want %d", recorder.Code, http.StatusServiceUnavailable)
+	}
+	if strings.Contains(recorder.Body.String(), "github_pat_secret") {
+		t.Fatalf("secret value leaked in error response: %s", recorder.Body.String())
+	}
+}
+
+func TestGithubProviderErrorsUseTypedSafeResponses(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		err    error
+		status int
+		want   string
+	}{
+		{name: "missing provider config", err: &service.GithubProviderConfigurationError{Cause: errors.New("payload key is not configured")}, status: http.StatusServiceUnavailable, want: "GitHub build provider is not configured"},
+		{name: "workflow approval", err: &service.WorkflowRefApprovalError{Reason: "selector rustqs/workflows is not approved"}, status: http.StatusPreconditionFailed, want: "workflow reference approval is required"},
+		{name: "provider response", err: &service.GithubContractError{Operation: "dispatch", Cause: errors.New("invalid response")}, status: http.StatusBadGateway, want: "GitHub provider response was invalid"},
+		{name: "malformed provider response with sensitive details", err: &service.GithubContractError{Operation: "dispatch refs/tags/workflow-v1", Cause: errors.New(`response body https://api.github.com/repos/owner/repo?token=github_pat_secret enc_payload=ciphertext`)}, status: http.StatusBadGateway, want: "GitHub provider response was invalid"},
+		{name: "provider permission with sensitive body", err: &service.GithubAPIError{StatusCode: http.StatusForbidden, Terminal: true, Body: `{"message":"token=github_pat_secret enc_payload=ciphertext"}`}, status: http.StatusBadGateway, want: "GitHub provider request failed"},
+		{name: "unknown internal workflow error", err: errors.New(`workflow refs/tags/workflow-v1 failed at https://api.github.com/repos/owner/repo: ciphertext`), status: http.StatusInternalServerError, want: "GitHub build operation failed"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			gin.SetMode(gin.TestMode)
+			recorder := httptest.NewRecorder()
+			context, _ := gin.CreateTestContext(recorder)
+			if !failGithubConfigError(context, test.err) {
+				t.Fatal("failGithubConfigError() did not handle typed provider error")
+			}
+			if recorder.Code != test.status {
+				t.Fatalf("error status = %d, want %d", recorder.Code, test.status)
+			}
+			body := recorder.Body.String()
+			forbidden := []string{"payload key is not configured", "api.github.com", "owner/repo", "refs/tags/workflow-v1", "github_pat_secret", "ciphertext", "enc_payload"}
+			if !strings.Contains(body, test.want) {
+				t.Fatalf("missing safe provider response %q: %s", test.want, body)
+			}
+			for _, value := range forbidden {
+				if strings.Contains(body, value) {
+					t.Fatalf("unsafe provider response contains %q: %s", value, body)
+				}
+			}
+		})
+	}
+
+}
+
+func TestGithubNestedProviderErrorsPreserveSpecificClassification(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		inner  error
+		status int
+		want   string
+	}{
+		{
+			name:   "workflow policy inside provider configuration",
+			inner:  &service.WorkflowRefApprovalError{Reason: "mutable selector"},
+			status: http.StatusPreconditionFailed,
+			want:   "workflow reference approval is required",
+		},
+		{
+			name:   "capability inside provider configuration",
+			inner:  &service.ProductionCapabilityUnavailableError{Platform: "linux", Capability: "completion"},
+			status: http.StatusServiceUnavailable,
+			want:   "production build capability is unavailable",
+		},
+		{
+			name:   "transport inside provider configuration",
+			inner:  &service.GithubTransportError{Operation: "GET https://api.github.com/private/ref", Cause: errors.New("token=github_pat_nested")},
+			status: http.StatusServiceUnavailable,
+			want:   "GitHub provider is unavailable",
+		},
+		{
+			name:   "contract inside provider configuration",
+			inner:  &service.GithubContractError{Operation: "run refs/tags/private", Cause: errors.New("response body contains secret")},
+			status: http.StatusBadGateway,
+			want:   "GitHub provider response was invalid",
+		},
+		{
+			name:   "API inside provider configuration",
+			inner:  &service.GithubAPIError{StatusCode: http.StatusForbidden, Terminal: true, Body: `{"message":"payload=secret"}`},
+			status: http.StatusBadGateway,
+			want:   "GitHub provider request failed",
+		},
+		{
+			name:   "artifact contract inside provider configuration",
+			inner:  &service.GithubArtifactUnavailableError{RunID: 7, ArtifactName: "private-artifact"},
+			status: http.StatusBadGateway,
+			want:   "requested GitHub artifact is unavailable",
+		},
+		{
+			name:   "validation inside provider configuration",
+			inner:  &service.ClientValidationError{Err: errors.New("platform has unsupported value \"linux\"")},
+			status: http.StatusBadRequest,
+			want:   "custom build request is invalid",
+		},
+		{
+			name:   "secret configuration inside provider configuration",
+			inner:  &utils.SecretEncryptionKeyError{},
+			status: http.StatusServiceUnavailable,
+			want:   "secret encryption is not configured",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			recorder := httptest.NewRecorder()
+			context, _ := gin.CreateTestContext(recorder)
+			err := fmt.Errorf("outer provider wrapper: %w", &service.GithubProviderConfigurationError{
+				Cause: fmt.Errorf("inner workflow wrapper: %w", test.inner),
+			})
+			if !failGithubConfigError(context, err) {
+				t.Fatal("failGithubConfigError() did not handle nested provider error")
+			}
+			if recorder.Code != test.status {
+				t.Fatalf("HTTP status = %d, want %d: %s", recorder.Code, test.status, recorder.Body.String())
+			}
+			body := recorder.Body.String()
+			if !strings.Contains(body, test.want) {
+				t.Fatalf("response = %s, want safe message %q", body, test.want)
+			}
+			for _, forbidden := range []string{"api.github.com", "refs/tags/private", "github_pat_nested", "payload=secret", "response body contains secret", "platform has unsupported"} {
+				if strings.Contains(body, forbidden) {
+					t.Fatalf("nested provider response leaked %q: %s", forbidden, body)
+				}
+			}
+		})
+	}
+}
+
+func TestWorkflowRefApprovalEndpointRequiresAdminAndReturnsSafeStatus(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Setenv(utils.SecretEncryptionKeyEnv, "workflow-approval-controller-test")
+	if err := db.AutoMigrate(&model.GithubBuildConfig{}); err != nil {
+		t.Fatalf("migrate config: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo"}).Error; err != nil {
+		t.Fatalf("seed config: %v", err)
+	}
+	previousTransport := http.DefaultTransport
+	http.DefaultTransport = githubApprovalRoundTripper(func(req *http.Request) (*http.Response, error) {
+		if strings.HasSuffix(req.URL.Path, "/tags/protection") {
+			t.Fatalf("legacy tag-protection endpoint was requested: %s %s", req.Method, req.URL.Path)
+		}
+		body := `{"message":"unexpected endpoint"}`
+		status := http.StatusNotFound
+		if strings.HasSuffix(req.URL.Path, "/rulesets/1") {
+			status = http.StatusOK
+			body = `{"id":1,"name":"workflow-protection","source_type":"Repository","source":"owner/repo","created_at":"2026-08-01T00:00:00Z","updated_at":"2026-08-01T00:00:00Z","target":"tag","enforcement":"active","bypass_actors":[],"current_user_can_bypass":"never","conditions":{"ref_name":{"include":["refs/tags/workflow-*"],"exclude":[]}},"rules":[{"type":"tag_name_pattern","parameters":{"name":"tag_name","negate":false,"operator":"starts_with","pattern":"workflow-"}},{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}]}`
+		} else if strings.HasSuffix(req.URL.Path, "/rulesets") {
+			status = http.StatusOK
+			body = `[{"id":1}]`
+		} else if strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+			status = http.StatusOK
+			body = `{"ref":"refs/tags/workflow-v1","object":{"sha":"` + strings.Repeat("b", 40) + `","type":"tag"}}`
+		} else if strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("b", 40)) {
+			status = http.StatusOK
+			body = `{"sha":"` + strings.Repeat("b", 40) + `","object":{"sha":"` + strings.Repeat("a", 40) + `","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`
+		} else if strings.Contains(req.URL.Path, "/contents/.github/workflows/") {
+			status = http.StatusOK
+			body = `{"type":"file","path":".github/workflows/rustqs-windows.yml","sha":"` + strings.Repeat("c", 40) + `","encoding":"base64","content":"b246CiAgd29ya2Zsb3dfZGlzcGF0Y2g6Cg=="}`
+		} else if strings.Contains(req.URL.Path, "/actions/workflows/") {
+			status = http.StatusOK
+			body = `{"state":"active"}`
+		}
+		return &http.Response{StatusCode: status, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body))}, nil
+	})
+	t.Cleanup(func() { http.DefaultTransport = previousTransport })
+	previousDB, previousServices, previousLocalizer, previousLogger := service.DB, service.AllService, global.Localizer, global.Logger
+	service.DB = db
+	service.AllService = &service.Service{
+		UserService:              &service.UserService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	global.Localizer = testManifestLocalizer
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+		global.Localizer = previousLocalizer
+		global.Logger = previousLogger
+	})
+
+	for _, tc := range []struct {
+		name     string
+		user     *model.User
+		code     int
+		wantHTTP int
+	}{
+		{name: "non-admin", user: &model.User{IsAdmin: boolPointer(false)}, code: 403, wantHTTP: http.StatusOK},
+		{name: "admin", user: &model.User{IsAdmin: boolPointer(true)}, code: 0, wantHTTP: http.StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := newWorkflowApprovalRouter(tc.user)
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(http.MethodPost, "/api/admin/github_build_config/approve_workflow_ref", strings.NewReader(`{"confirm":true,"workflow_tag":"workflow-v1"}`))
+			request.Header.Set("Content-Type", "application/json")
+			router.ServeHTTP(recorder, request)
+			if recorder.Code != tc.wantHTTP {
+				t.Fatalf("HTTP status = %d, want %d: %s", recorder.Code, tc.wantHTTP, recorder.Body.String())
+			}
+			var envelope struct {
+				Code int `json:"code"`
+				Data struct {
+					WorkflowRef string `json:"workflow_ref"`
+					Approved    bool   `json:"workflow_ref_approved"`
+					Status      string `json:"workflow_ref_status"`
+				} `json:"data"`
+			}
+			if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+				t.Fatalf("approval response JSON: %v", err)
+			}
+			if envelope.Code != tc.code {
+				t.Fatalf("response code = %d, want %d: %s", envelope.Code, tc.code, recorder.Body.String())
+			}
+			if tc.code == 0 && (envelope.Data.WorkflowRef != "workflow-v1" || !envelope.Data.Approved || envelope.Data.Status != "approved") {
+				t.Fatalf("safe approval data = %#v, want approved effective selector", envelope.Data)
+			}
+		})
+	}
+
+	for _, tc := range []struct {
+		name       string
+		body       string
+		wantStatus int
+		wantCode   int
+	}{
+		{name: "confirm required", body: `{"confirm":false}`, wantStatus: http.StatusOK, wantCode: 101},
+		{name: "invalid selector", body: `{"confirm":true,"workflow_tag":"../bad"}`, wantStatus: http.StatusBadRequest, wantCode: 101},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := newWorkflowApprovalRouter(&model.User{IsAdmin: boolPointer(true)})
+			recorder := httptest.NewRecorder()
+			request := httptest.NewRequest(http.MethodPost, "/api/admin/github_build_config/approve_workflow_ref", strings.NewReader(tc.body))
+			request.Header.Set("Content-Type", "application/json")
+			router.ServeHTTP(recorder, request)
+			if recorder.Code != tc.wantStatus {
+				t.Fatalf("HTTP status = %d, want %d: %s", recorder.Code, tc.wantStatus, recorder.Body.String())
+			}
+			var envelope struct {
+				Code int `json:"code"`
+			}
+			if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+				t.Fatalf("approval response JSON: %v", err)
+			}
+			if envelope.Code != tc.wantCode {
+				t.Fatalf("response code = %d, want %d: %s", envelope.Code, tc.wantCode, recorder.Body.String())
+			}
+		})
+	}
+}
+
+type githubApprovalRoundTripper func(*http.Request) (*http.Response, error)
+
+func (f githubApprovalRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func TestDispatchTestRequiresWorkflowRefApprovalBeforeProvider(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv(utils.SecretEncryptionKeyEnv, "workflow-dispatch-approval-test")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := db.AutoMigrate(&model.GithubBuildConfig{}); err != nil {
+		t.Fatalf("migrate config: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "github_pat_test", PayloadKey: "payload-key",
+	}).Error; err != nil {
+		t.Fatalf("seed config: %v", err)
+	}
+	previousDB, previousServices := service.DB, service.AllService
+	service.DB = db
+	service.AllService = &service.Service{GithubBuildConfigService: &service.GithubBuildConfigService{}}
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+	})
+	recorder := httptest.NewRecorder()
+	context, _ := gin.CreateTestContext(recorder)
+	context.Request = httptest.NewRequest(http.MethodPost, "/admin/github_build_config/dispatch_test", strings.NewReader(`{"confirm":true}`))
+	context.Request.Header.Set("Content-Type", "application/json")
+	(&GithubBuildConfig{}).DispatchTest(context)
+	if recorder.Code != http.StatusPreconditionFailed || strings.Contains(recorder.Body.String(), "owner/repo") {
+		t.Fatalf("unapproved dispatch response status/body = %d/%s, want safe precondition failure", recorder.Code, recorder.Body.String())
+	}
+}
+
+func newWorkflowApprovalRouter(user *model.User) *gin.Engine {
+	router := gin.New()
+	group := router.Group("/api/admin")
+	if user != nil {
+		group.Use(func(c *gin.Context) {
+			c.Set("curUser", user)
+			c.Next()
+		})
+	}
+	approvalGroup := group.Group("/github_build_config").Use(middleware.AdminPrivilege())
+	approvalGroup.POST("/approve_workflow_ref", (&GithubBuildConfig{}).ApproveWorkflowRef)
+	return router
+}
+
+func TestGenerateKeyReturnsOneTimeCopyValueAndSafeConfigHidesIt(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv(utils.SecretEncryptionKeyEnv, "generate-key-test")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := db.AutoMigrate(&model.GithubBuildConfig{}); err != nil {
+		t.Fatalf("migrate config: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	previousDB, previousServices := service.DB, service.AllService
+	service.DB = db
+	service.AllService = &service.Service{GithubBuildConfigService: &service.GithubBuildConfigService{}}
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+		_ = sqlDB.Close()
+	})
+
+	recorder := httptest.NewRecorder()
+	context, _ := gin.CreateTestContext(recorder)
+	context.Request = httptest.NewRequest(http.MethodPost, "/admin/github_build_config/generate_key", nil)
+	(&GithubBuildConfig{}).GenerateKey(context)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("generate key status = %d, want %d: %s", recorder.Code, http.StatusOK, recorder.Body.String())
+	}
+	var payload struct {
+		Data struct {
+			PayloadKey string `json:"payload_key"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("invalid generate key response: %v", err)
+	}
+	if payload.Data.PayloadKey == "" {
+		t.Fatal("generate key response omitted the one-time payload key")
+	}
+
+	stored, err := service.AllService.GithubBuildConfigService.Get()
+	if err != nil {
+		t.Fatalf("reload generated config: %v", err)
+	}
+	encoded, err := json.Marshal(stored.Safe())
+	if err != nil {
+		t.Fatalf("marshal safe generated config: %v", err)
+	}
+	if strings.Contains(string(encoded), payload.Data.PayloadKey) || strings.Contains(string(encoded), `"payload_key"`) {
+		t.Fatalf("safe config exposed one-time payload key: %s", encoded)
+	}
+}
diff --git a/api/http/controller/admin/github_build_poll_test.go b/api/http/controller/admin/github_build_poll_test.go
new file mode 100644
index 0000000..aaa1f1c
--- /dev/null
+++ b/api/http/controller/admin/github_build_poll_test.go
@@ -0,0 +1,799 @@
+package admin
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"net/http/httptest"
+	"rustdesk-server/api/global"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+type adminGithubRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func prepareAdminBuildProvenance(build *model.CustomBuild) {
+	if build == nil || build.GithubRunId <= 0 || build.GithubRef == "" {
+		return
+	}
+	if build.WorkflowSelector == "" {
+		build.WorkflowSelector = "rustqs/workflows"
+	}
+	if build.AssetsReleaseAssets == "" {
+		build.AssetsReleaseAssets = `[{"id":101,"name":"windows-x64-release.zip","digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111"},{"id":102,"name":"usbmmidd_v2.zip","digest":"sha256:2222222222222222222222222222222222222222222222222222222222222222"},{"id":103,"name":"rustdesk_printer_driver_v4-1.4.zip","digest":"sha256:3333333333333333333333333333333333333333333333333333333333333333"},{"id":104,"name":"printer_driver_adapter.zip","digest":"sha256:4444444444444444444444444444444444444444444444444444444444444444"}]`
+	}
+}
+
+func (f adminGithubRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func TestGithubPollErrorActionForFailsTerminalAndRetriesRetryable(t *testing.T) {
+	cases := []struct {
+		name   string
+		err    error
+		result githubPollErrorAction
+	}{
+		{
+			name:   "terminal API error fails promptly",
+			err:    &service.GithubAPIError{StatusCode: http.StatusUnauthorized, Terminal: true},
+			result: githubPollFail,
+		},
+		{
+			name:   "rate limit remains retryable",
+			err:    &service.GithubAPIError{StatusCode: http.StatusTooManyRequests, Retryable: true},
+			result: githubPollRetry,
+		},
+		{
+			name:   "transport timeout remains retryable",
+			err:    &service.GithubTransportError{Operation: "GET run status", Cause: context.DeadlineExceeded},
+			result: githubPollRetry,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := githubPollErrorActionFor(tc.err); got != tc.result {
+				t.Fatalf("githubPollErrorActionFor() = %d, want %d", got, tc.result)
+			}
+		})
+	}
+}
+
+func TestGithubArtifactErrorActionClassifiesRetryableAndTerminalFailures(t *testing.T) {
+	cases := []struct {
+		name   string
+		err    error
+		result githubPollErrorAction
+	}{
+		{name: "429", err: &service.GithubAPIError{StatusCode: http.StatusTooManyRequests, Retryable: true}, result: githubPollRetry},
+		{name: "500", err: &service.GithubAPIError{StatusCode: http.StatusInternalServerError, Retryable: true}, result: githubPollRetry},
+		{name: "transport", err: &service.GithubTransportError{Operation: "download artifact", Cause: context.DeadlineExceeded}, result: githubPollRetry},
+		{name: "401", err: &service.GithubAPIError{StatusCode: http.StatusUnauthorized, Terminal: true}, result: githubPollFail},
+		{name: "403 ordinary", err: &service.GithubAPIError{StatusCode: http.StatusForbidden, Terminal: true}, result: githubPollFail},
+		{name: "404", err: &service.GithubAPIError{StatusCode: http.StatusNotFound, Terminal: true}, result: githubPollFail},
+		{name: "410", err: &service.GithubAPIError{StatusCode: http.StatusGone, Terminal: true}, result: githubPollFail},
+		{name: "422", err: &service.GithubAPIError{StatusCode: http.StatusUnprocessableEntity, Terminal: true}, result: githubPollFail},
+		{name: "missing artifact", err: &service.GithubArtifactUnavailableError{RunID: 7, ArtifactName: "requested", Available: []string{"other"}}, result: githubPollFail},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := githubArtifactErrorActionFor(tc.err); got != tc.result {
+				t.Fatalf("githubArtifactErrorActionFor() = %d, want %d", got, tc.result)
+			}
+		})
+	}
+}
+
+func TestGithubPollTerminalStatusErrorFailsEveryActiveLifecycleState(t *testing.T) {
+	for _, status := range []string{
+		model.CustomBuildStatusBuilding,
+		model.CustomBuildStatusDownloading,
+		model.CustomBuildStatusExtracting,
+	} {
+		t.Run(status, func(t *testing.T) {
+			db, sqlDB := newAdminProvenanceDB(t)
+			previousDB, previousService := global.DB, service.AllService
+			previousServiceDB, previousLogger := service.DB, global.Logger
+			previousTransport := http.DefaultTransport
+			global.DB = db
+			global.Logger = logrus.New()
+			service.DB = db
+			service.AllService = &service.Service{
+				CustomBuildService:       &service.CustomBuildService{},
+				GithubBuildConfigService: &service.GithubBuildConfigService{},
+			}
+			http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				return &http.Response{
+					StatusCode: http.StatusUnauthorized,
+					Header:     make(http.Header),
+					Body:       io.NopCloser(strings.NewReader(`{"message":"expired"}`)),
+				}, nil
+			})
+			t.Cleanup(func() {
+				http.DefaultTransport = previousTransport
+				global.DB = previousDB
+				global.Logger = previousLogger
+				service.DB = previousServiceDB
+				service.AllService = previousService
+				_ = sqlDB.Close()
+			})
+
+			const runID int64 = 901
+			build := &model.CustomBuild{
+				Status:             status,
+				Platform:           "windows",
+				Version:            "1.2.3",
+				BuildRef:           strings.Repeat("a", 40),
+				SourceTag:          "1.2.3",
+				AssetsRelease:      "offline-assets-1.2.3",
+				AssetsReleaseID:    12,
+				GithubRunId:        runID,
+				GithubProvider:     "github",
+				GithubRepo:         "owner/repo",
+				GithubWorkflow:     "workflow.yml",
+				GithubRef:          strings.Repeat("a", 40),
+				GithubArtifactName: "artifact",
+				GithubArtifactID:   42,
+				GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/901",
+				GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/901",
+			}
+			prepareAdminBuildProvenance(build)
+			if err := db.Create(build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "token"}).Error; err != nil {
+				t.Fatalf("create GitHub config: %v", err)
+			}
+
+			currentTime := time.Now()
+			(&CustomBuild{}).pollAndDownloadWithClock(build.Id, runID, githubPollClock{
+				now:  func() time.Time { return currentTime },
+				wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+			})
+
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if stored.Status != model.CustomBuildStatusFailed {
+				t.Fatalf("terminal status error left %s row in %q, want failed", status, stored.Status)
+			}
+			if !strings.Contains(stored.BuildLog, "github status error") {
+				t.Fatalf("terminal status error log = %q, want status error", stored.BuildLog)
+			}
+		})
+	}
+}
+
+func TestGithubPollRejectsRunHeadSHAMismatchWithStoredWorkflowSHA(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousService := global.DB, service.AllService
+	previousServiceDB, previousLogger := service.DB, global.Logger
+	previousTransport := http.DefaultTransport
+	global.DB = db
+	global.Logger = logrus.New()
+	service.DB = db
+	service.AllService = &service.Service{
+		CustomBuildService:       &service.CustomBuildService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path != "/repos/owner/repo/actions/runs/902" {
+			return &http.Response{
+				StatusCode: http.StatusNotFound,
+				Header:     make(http.Header),
+				Body:       io.NopCloser(strings.NewReader(`{"message":"unexpected endpoint"}`)),
+			}, nil
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader(`{"status":"in_progress","head_sha":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}`)),
+		}, nil
+	})
+	t.Cleanup(func() {
+		http.DefaultTransport = previousTransport
+		global.DB = previousDB
+		global.Logger = previousLogger
+		service.DB = previousServiceDB
+		service.AllService = previousService
+		_ = sqlDB.Close()
+	})
+
+	workflowSHA := strings.Repeat("a", 40)
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusBuilding,
+		Platform:           "windows",
+		Version:            "1.2.3",
+		BuildRef:           strings.Repeat("c", 40),
+		SourceTag:          "1.2.3",
+		AssetsRelease:      "offline-assets-1.2.3",
+		AssetsReleaseID:    12,
+		GithubRunId:        902,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "rustqs-windows.yml",
+		WorkflowSelector:   "rustqs/workflows",
+		GithubRef:          workflowSHA,
+		GithubArtifactName: "artifact",
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/902",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/902",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "current-token"}).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+
+	currentTime := time.Now()
+	(&CustomBuild{}).pollAndDownloadWithClock(build.Id, build.GithubRunId, githubPollClock{
+		now:  func() time.Time { return currentTime },
+		wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+	})
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusFailed {
+		t.Fatalf("mismatched run head SHA left build in %q, want failed", stored.Status)
+	}
+	if !strings.Contains(stored.BuildLog, "does not match stored workflow execution SHA") {
+		t.Fatalf("mismatch failure log = %q, want explicit stored workflow SHA rejection", stored.BuildLog)
+	}
+	if stored.GithubSourceSha != "" {
+		t.Fatalf("mismatched run head SHA was persisted as %q", stored.GithubSourceSha)
+	}
+}
+
+func TestPersistBuildProgressDoesNotCarryImmutableRunIdentity(t *testing.T) {
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 7}, Status: model.CustomBuildStatusDone, GithubRunId: 9, GithubArtifactID: 42}
+	wantCause := errors.New("database unavailable")
+	var persisted service.BuildProgress
+
+	err := persistBuildProgressWithRun(func(progress service.BuildProgress) error {
+		persisted = progress
+		return wantCause
+	}, build, build.GithubRunId)
+	var persistenceErr *service.BuildProgressPersistenceError
+	if !errors.As(err, &persistenceErr) || !errors.Is(err, wantCause) {
+		t.Fatalf("persistence error = %T %v, want typed wrapped failure", err, err)
+	}
+	if persisted.Status != build.Status {
+		t.Fatalf("progress = %#v, want only mutable status fields", persisted)
+	}
+	if persisted.ExpectedRunID != build.GithubRunId {
+		t.Fatalf("progress expected run id = %d, want %d", persisted.ExpectedRunID, build.GithubRunId)
+	}
+	if persisted.ExpectedArtifactID != build.GithubArtifactID {
+		t.Fatalf("progress expected artifact id = %d, want %d", persisted.ExpectedArtifactID, build.GithubArtifactID)
+	}
+}
+
+func TestPersistBuildMutationRetriesAndBoundsAttempts(t *testing.T) {
+	t.Run("retry succeeds", func(t *testing.T) {
+		calls := 0
+		if err := persistBuildMutation(7, "test", func() error {
+			calls++
+			if calls < 3 {
+				return errors.New("temporary database error")
+			}
+			return nil
+		}); err != nil {
+			t.Fatalf("persistBuildMutation() error = %v", err)
+		}
+		if calls != 3 {
+			t.Fatalf("persistBuildMutation() calls = %d, want 3", calls)
+		}
+	})
+
+	t.Run("exhaustion is explicit", func(t *testing.T) {
+		calls := 0
+		wantErr := errors.New("database remains unavailable")
+		err := persistBuildMutation(7, "test", func() error {
+			calls++
+			return wantErr
+		})
+		if !errors.Is(err, wantErr) {
+			t.Fatalf("persistBuildMutation() error = %v, want wrapped exhaustion error", err)
+		}
+		if calls != buildPersistenceAttempts {
+			t.Fatalf("persistBuildMutation() calls = %d, want bounded %d", calls, buildPersistenceAttempts)
+		}
+	})
+}
+
+func TestPollPersistenceExhaustionSchedulesOneRetryForSameBuildRun(t *testing.T) {
+	resetScheduledGithubPollRetries := func() {
+		scheduledGithubPollRetries.Lock()
+		scheduledGithubPollRetries.keys = make(map[githubPollRetryKey]struct{})
+		scheduledGithubPollRetries.Unlock()
+	}
+	resetScheduledGithubPollRetries()
+	t.Cleanup(resetScheduledGithubPollRetries)
+	previousSchedule := scheduleGithubPollRetry
+	var scheduled []githubPollRetryKey
+	scheduleGithubPollRetry = func(buildID uint, runID int64) {
+		scheduled = append(scheduled, githubPollRetryKey{buildID: buildID, runID: runID})
+	}
+	t.Cleanup(func() { scheduleGithubPollRetry = previousSchedule })
+
+	wantErr := errors.New("database unavailable")
+	mutation := func() error { return wantErr }
+	if err := persistPollMutation(991, 771, "test", mutation); !errors.Is(err, wantErr) {
+		t.Fatalf("persistPollMutation() error = %v, want wrapped persistence error", err)
+	}
+	if err := persistPollMutation(991, 771, "test", mutation); !errors.Is(err, wantErr) {
+		t.Fatalf("second persistPollMutation() error = %v, want wrapped persistence error", err)
+	}
+	if len(scheduled) != 1 || scheduled[0].buildID != 991 || scheduled[0].runID != 771 {
+		t.Fatalf("scheduled retries = %#v, want one retry for exact build/run", scheduled)
+	}
+}
+
+func TestPollPersistenceRetryCanBeScheduledAgainAfterAttemptFailure(t *testing.T) {
+	resetScheduledGithubPollRetries := func() {
+		scheduledGithubPollRetries.Lock()
+		scheduledGithubPollRetries.keys = make(map[githubPollRetryKey]struct{})
+		scheduledGithubPollRetries.Unlock()
+	}
+	resetScheduledGithubPollRetries()
+	t.Cleanup(resetScheduledGithubPollRetries)
+	previousSchedule := scheduleGithubPollRetry
+	var scheduled []githubPollRetryKey
+	scheduleGithubPollRetry = func(buildID uint, runID int64) {
+		scheduled = append(scheduled, githubPollRetryKey{buildID: buildID, runID: runID})
+	}
+	t.Cleanup(func() { scheduleGithubPollRetry = previousSchedule })
+
+	if err := persistPollMutation(992, 772, "test", func() error {
+		return errors.New("database unavailable")
+	}); err == nil {
+		t.Fatal("first persistPollMutation() error = nil")
+	}
+	runScheduledGithubPollRetry(992, 772, func() bool { return false })
+	if err := persistPollMutation(992, 772, "test", func() error {
+		return errors.New("database unavailable again")
+	}); err == nil {
+		t.Fatal("second persistPollMutation() error = nil")
+	}
+	if len(scheduled) != 2 {
+		t.Fatalf("scheduled retries after failed attempt = %d, want 2", len(scheduled))
+	}
+	if err := persistPollMutation(992, 772, "test", func() error {
+		return errors.New("database unavailable third time")
+	}); err == nil {
+		t.Fatal("third persistPollMutation() error = nil")
+	}
+	if len(scheduled) != 2 {
+		t.Fatalf("duplicate pending retries = %d, want 2", len(scheduled))
+	}
+}
+
+func TestPersistCompletedBuildDoesNotClaimDoneAfterExhaustion(t *testing.T) {
+	root := withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 7}, Status: model.CustomBuildStatusDone, GithubArtifactID: 42}
+	wantErr := errors.New("database unavailable")
+	var persisted service.BuildProgress
+	if err := persistCompletedBuildWith(func(progress service.BuildProgress) error {
+		persisted = progress
+		return wantErr
+	}, build, 7); !errors.Is(err, wantErr) {
+		t.Fatalf("persistCompletedBuildWith() error = %v, want wrapped persistence error", err)
+	}
+	if build.Status != model.CustomBuildStatusBuilding {
+		t.Fatalf("build status after exhausted completion = %q, want recoverable building", build.Status)
+	}
+	if persisted.ExpectedArtifactID != build.GithubArtifactID {
+		t.Fatalf("completion expected artifact id = %d, want %d", persisted.ExpectedArtifactID, build.GithubArtifactID)
+	}
+	output := filepath.Join(root, "output", "7", "rustqs.exe")
+	if err := os.MkdirAll(filepath.Dir(output), 0755); err != nil {
+		t.Fatalf("create published output: %v", err)
+	}
+	if err := os.WriteFile(output, []byte("valid output"), 0600); err != nil {
+		t.Fatalf("write published output: %v", err)
+	}
+	if _, err := os.Stat(output); err != nil {
+		t.Fatalf("published output was removed after CAS failure: %v", err)
+	}
+}
+
+func TestResumePendingPollsUsesStoredProvenanceAndGuardsIncompleteRows(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousService := global.DB, service.AllService
+	previousServiceDB, previousLogger := service.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	service.DB = db
+	service.AllService = &service.Service{
+		CustomBuildService:       &service.CustomBuildService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		service.DB = previousServiceDB
+		service.AllService = previousService
+		_ = sqlDB.Close()
+	})
+
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel:          model.IdModel{Id: 1},
+		Repo:             "owner/repo-b",
+		WorkflowFilename: "workflow-b.yml",
+		Branch:           "ref-b",
+		Token:            "current-token",
+	}).Error; err != nil {
+		t.Fatalf("create mutable global config: %v", err)
+	}
+	stored := &model.CustomBuild{
+		Status:              model.CustomBuildStatusBuilding,
+		Version:             "1.2.3",
+		GithubRunId:         777,
+		GithubProvider:      "github",
+		GithubRepo:          "owner/repo-a",
+		GithubWorkflow:      "workflow-a.yml",
+		WorkflowSelector:    "rustqs/workflows",
+		GithubRef:           strings.Repeat("a", 40),
+		BuildRef:            strings.Repeat("a", 40),
+		SourceTag:           "1.2.3",
+		AssetsRelease:       "offline-assets-1.2.3",
+		AssetsReleaseID:     12,
+		GithubArtifactName:  "artifact-a",
+		GithubRunUrl:        "https://api.github.com/repos/owner/repo-a/actions/runs/777",
+		GithubHtmlUrl:       "https://github.com/owner/repo-a/actions/runs/777",
+		AssetsReleaseAssets: `[{"id":101,"name":"windows-x64-release.zip","digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111"},{"id":102,"name":"usbmmidd_v2.zip","digest":"sha256:2222222222222222222222222222222222222222222222222222222222222222"},{"id":103,"name":"rustdesk_printer_driver_v4-1.4.zip","digest":"sha256:3333333333333333333333333333333333333333333333333333333333333333"},{"id":104,"name":"printer_driver_adapter.zip","digest":"sha256:4444444444444444444444444444444444444444444444444444444444444444"}]`,
+	}
+	legacy := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 0}
+	partial := &model.CustomBuild{
+		Status:          model.CustomBuildStatusBuilding,
+		Version:         "1.2.3",
+		BuildRef:        strings.Repeat("b", 40),
+		SourceTag:       "1.2.3",
+		AssetsRelease:   "offline-assets-1.2.3",
+		AssetsReleaseID: 13,
+	}
+	if err := db.Create(stored).Error; err != nil {
+		t.Fatalf("create stored build: %v", err)
+	}
+	if err := db.Create(legacy).Error; err != nil {
+		t.Fatalf("create legacy build: %v", err)
+	}
+	if err := db.Create(partial).Error; err != nil {
+		t.Fatalf("create partial build: %v", err)
+	}
+
+	requestPath := make(chan string, 1)
+	previousTransport := http.DefaultTransport
+	http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		requestPath <- req.URL.Path
+		return &http.Response{
+			StatusCode: http.StatusUnauthorized,
+			Header:     make(http.Header),
+			Body:       io.NopCloser(strings.NewReader(`{"message":"expired"}`)),
+		}, nil
+	})
+	defer func() { http.DefaultTransport = previousTransport }()
+
+	ResumePendingPolls()
+	select {
+	case path := <-requestPath:
+		if path != "/repos/owner/repo-a/actions/runs/777" {
+			t.Fatalf("resume request path = %q, want stored repo A/run 777", path)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("ResumePendingPolls() did not start the stored build poll")
+	}
+	if !activeGithubPolls.wait(stored.Id, 2*time.Second) {
+		t.Fatal("stored build poll did not exit before test cleanup")
+	}
+
+	legacyFailed := false
+	partialFailed := false
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		var loadedLegacy, loadedPartial model.CustomBuild
+		if err := db.First(&loadedLegacy, legacy.Id).Error; err == nil && loadedLegacy.Status == model.CustomBuildStatusFailed {
+			if !strings.Contains(loadedLegacy.BuildLog, "no provider run id") {
+				t.Fatalf("legacy failure log = %q, want explicit provenance reason", loadedLegacy.BuildLog)
+			}
+			legacyFailed = true
+		}
+		if err := db.First(&loadedPartial, partial.Id).Error; err != nil {
+			t.Fatalf("read partial build: %v", err)
+		}
+		if loadedPartial.Status == model.CustomBuildStatusFailed {
+			if !strings.Contains(loadedPartial.BuildLog, "no provider run id") {
+				t.Fatalf("partial failure log = %q, want explicit no-run reason", loadedPartial.BuildLog)
+			}
+			partialFailed = true
+		}
+		if legacyFailed && partialFailed {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("legacy or partial no-run row was not failed closed")
+}
+
+func TestPollConfigCredentialExhaustionPersistsGuardedFailure(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousService := global.DB, service.AllService
+	previousServiceDB, previousLogger := service.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	service.DB = db
+	service.AllService = &service.Service{
+		CustomBuildService:       &service.CustomBuildService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		service.DB = previousServiceDB
+		service.AllService = previousService
+		_ = sqlDB.Close()
+	})
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo"}).Error; err != nil {
+		t.Fatalf("create empty GitHub config: %v", err)
+	}
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusBuilding,
+		Platform:           "windows",
+		Version:            "1.2.3",
+		BuildRef:           strings.Repeat("a", 40),
+		SourceTag:          "1.2.3",
+		AssetsRelease:      "offline-assets-1.2.3",
+		AssetsReleaseID:    12,
+		GithubRunId:        900,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "rustqs-windows.yml",
+		GithubRef:          strings.Repeat("a", 40),
+		GithubArtifactName: "rustqs-windows",
+		BuildLog:           strings.Repeat("old log ", 1000),
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/900",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/900",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create building row: %v", err)
+	}
+
+	currentTime := time.Now()
+	(&CustomBuild{}).pollAndDownloadWithClock(build.Id, build.GithubRunId, githubPollClock{
+		now:  func() time.Time { return currentTime },
+		wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+	})
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read building row: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusFailed {
+		t.Fatalf("status after credential deadline = %q, want failed", stored.Status)
+	}
+	if len(stored.BuildLog) > maxBuildLogBytes || !strings.Contains(stored.BuildLog, "restore the PAT") {
+		t.Fatalf("credential deadline log length=%d contents=%q, want bounded actionable message", len(stored.BuildLog), stored.BuildLog)
+	}
+	if stored.GithubRunId != build.GithubRunId {
+		t.Fatalf("credential deadline changed run identity: %d", stored.GithubRunId)
+	}
+}
+
+func TestLoadGithubPollConfigRetriesWithoutRealBackoffAndKeepsStoredIdentity(t *testing.T) {
+	start := time.Unix(100, 0)
+	currentTime := start
+	provenance := service.BuildProvenance{GithubRepo: "owner/stored-repo"}
+	attempts := 0
+	var waits []time.Duration
+	config, ok := loadGithubPollConfig(
+		17,
+		provenance,
+		start.Add(2*time.Minute),
+		func() time.Time { return currentTime },
+		func(delay time.Duration) {
+			waits = append(waits, delay)
+			currentTime = currentTime.Add(delay)
+		},
+		func() (*model.GithubBuildConfig, error) {
+			attempts++
+			if attempts < 3 {
+				return nil, errors.New("config temporarily unavailable")
+			}
+			return &model.GithubBuildConfig{Repo: "owner/mutable-repo", Token: "current-token"}, nil
+		},
+	)
+	if !ok || config == nil {
+		t.Fatal("loadGithubPollConfig() did not recover within the injected deadline")
+	}
+	if attempts != 3 || len(waits) != 2 || waits[0] != githubPollInterval || waits[1] != githubPollInterval {
+		t.Fatalf("retry schedule: attempts=%d waits=%v", attempts, waits)
+	}
+	if config.Repo != provenance.GithubRepo || config.Token != "current-token" {
+		t.Fatalf("poll config identity = repo %q token %q, want stored repo %q and current token", config.Repo, config.Token, provenance.GithubRepo)
+	}
+}
+
+func TestGithubPollOwnershipIsKeyedAndReleased(t *testing.T) {
+	ownership := newGithubPollOwnership()
+	release, claimed := ownership.claim(42)
+	if !claimed {
+		t.Fatal("first poll claim = false, want true")
+	}
+	if _, claimed = ownership.claim(42); claimed {
+		t.Fatal("second poll claim = true, want duplicate rejection")
+	}
+	release()
+	if !ownership.wait(42, time.Second) {
+		t.Fatal("released poll remains active")
+	}
+	release, claimed = ownership.claim(42)
+	if !claimed {
+		t.Fatal("claim after release = false, want true")
+	}
+	release()
+}
+
+func TestDeleteWaitsForSameBuildLifecycleGuard(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousGlobalDB, previousServiceDB := global.DB, service.DB
+	previousServices := service.AllService
+	previousOutputDir := service.BuildOutputDir
+	global.DB = db
+	service.DB = db
+	service.AllService = &service.Service{CustomBuildService: &service.CustomBuildService{}}
+	outputRoot := t.TempDir()
+	service.BuildOutputDir = func(id uint) string { return filepath.Join(outputRoot, fmt.Sprint(id)) }
+	t.Cleanup(func() {
+		global.DB = previousGlobalDB
+		service.DB = previousServiceDB
+		service.AllService = previousServices
+		service.BuildOutputDir = previousOutputDir
+		_ = sqlDB.Close()
+	})
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	releasePoll, claimed := activeGithubPolls.claim(build.Id)
+	if !claimed {
+		t.Fatal("poll lifecycle claim = false, want true")
+	}
+	t.Cleanup(releasePoll)
+	body, err := json.Marshal(map[string]any{"id": build.Id})
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodPost, "/delete", strings.NewReader(string(body)))
+	done := make(chan struct{})
+	go func() {
+		(&CustomBuild{}).Delete(c)
+		close(done)
+	}()
+	select {
+	case <-done:
+		t.Fatal("Delete completed while poll lifecycle guard was held")
+	case <-time.After(50 * time.Millisecond):
+	}
+	var stillThere model.CustomBuild
+	if err := db.First(&stillThere, build.Id).Error; err != nil {
+		t.Fatalf("guarded delete removed row too early: %v", err)
+	}
+	releasePoll()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("Delete did not complete after poll lifecycle guard release")
+	}
+	var deleted model.CustomBuild
+	if err := db.First(&deleted, build.Id).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+		t.Fatalf("deleted build lookup error = %v, want record not found", err)
+	}
+}
+
+func TestCustomBuildDeleteReturnsSuccessWhenArtifactCleanupIsPending(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousGlobalDB, previousServiceDB := global.DB, service.DB
+	previousServices := service.AllService
+	previousOutputDir := service.BuildOutputDir
+	previousLogger, previousLocalizer := global.Logger, global.Localizer
+	var logs bytes.Buffer
+	logger := logrus.New()
+	logger.SetOutput(&logs)
+	t.Cleanup(func() {
+		global.DB = previousGlobalDB
+		service.DB = previousServiceDB
+		service.AllService = previousServices
+		service.BuildOutputDir = previousOutputDir
+		global.Logger = previousLogger
+		global.Localizer = previousLocalizer
+		_ = sqlDB.Close()
+	})
+	global.DB = db
+	service.DB = db
+	service.AllService = &service.Service{CustomBuildService: &service.CustomBuildService{}}
+	global.Logger = logger
+	global.Localizer = testManifestLocalizer
+	outputRoot := t.TempDir()
+	service.BuildOutputDir = func(id uint) string {
+		return filepath.Join(outputRoot, "output", fmt.Sprint(id), "\x00")
+	}
+
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	body, err := json.Marshal(map[string]any{"id": build.Id})
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodPost, "/delete", strings.NewReader(string(body)))
+
+	(&CustomBuild{}).Delete(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("Delete HTTP status = %d, want %d: %s", recorder.Code, http.StatusOK, recorder.Body.String())
+	}
+	var envelope struct {
+		Code int `json:"code"`
+		Data struct {
+			CleanupPending bool `json:"cleanup_pending"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(recorder.Body.Bytes(), &envelope); err != nil {
+		t.Fatalf("Delete response JSON: %v", err)
+	}
+	if envelope.Code != 0 {
+		t.Fatalf("Delete response code = %d, want success: %s", envelope.Code, recorder.Body.String())
+	}
+	if !envelope.Data.CleanupPending {
+		t.Fatalf("Delete response data = %#v, want cleanup_pending marker", envelope.Data)
+	}
+	var deleted model.CustomBuild
+	if err := db.First(&deleted, build.Id).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+		t.Fatalf("deleted build lookup error = %v, want record not found", err)
+	}
+	if !strings.Contains(logs.String(), "artifact cleanup remains pending") {
+		t.Fatalf("cleanup failure was not logged: %s", logs.String())
+	}
+}
+
+func newAdminProvenanceDB(t *testing.T) (*gorm.DB, *sql.DB) {
+	t.Helper()
+	t.Setenv("SECRET_ENCRYPTION_KEY", "focused-test-at-rest-key")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(&model.CustomBuild{}, &model.GithubBuildConfig{}); err != nil {
+		t.Fatalf("migrate provenance models: %v", err)
+	}
+	return db, sqlDB
+}
diff --git a/api/http/controller/admin/group.go b/api/http/controller/admin/group.go
index 3c9197f..6c805e7 100644
--- a/api/http/controller/admin/group.go
+++ b/api/http/controller/admin/group.go
@@ -41,7 +41,7 @@ func (ct *Group) Detail(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.GroupForm true ""
+// @Param body body admin.GroupForm true "Group form payload"
 // @Success 200 {object} response.Response{data=model.Group}
 // @Failure 500 {object} response.Response
 // @Router /admin/group/create [post]
@@ -72,8 +72,8 @@ func (ct *Group) Create(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the group list"
+// @Param page_size query int false "Number of groups per page"
 // @Success 200 {object} response.Response{data=model.GroupList}
 // @Failure 500 {object} response.Response
 // @Router /admin/group/list [get]
@@ -94,7 +94,7 @@ func (ct *Group) List(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.GroupForm true ""
+// @Param body body admin.GroupForm true "Group update form payload"
 // @Success 200 {object} response.Response{data=model.Group}
 // @Failure 500 {object} response.Response
 // @Router /admin/group/update [post]
@@ -129,7 +129,7 @@ func (ct *Group) Update(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.GroupForm true ""
+// @Param body body admin.GroupForm true "Group deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/group/delete [post]
diff --git a/api/http/controller/admin/login.go b/api/http/controller/admin/login.go
index 597ee06..4abdbcc 100644
--- a/api/http/controller/admin/login.go
+++ b/api/http/controller/admin/login.go
@@ -1,7 +1,8 @@
-package admin
+package admin
 
 import (
 	"fmt"
+	"net/http"
 
 	"github.com/gin-gonic/gin"
 	"rustdesk-server/api/global"
@@ -17,17 +18,16 @@ import (
 type Login struct {
 }
 
-// Login 
-// @Tags 
-// @Summary 
-// @Description 
+// Login authenticates an administrator before the admin middleware is applied.
+// @Tags Auth
+// @Summary Log in to the admin panel
+// @Description Public pre-authentication route for administrator credentials; it returns the admin access-token payload on success.
 // @Accept  json
 // @Produce  json
-// @Param body body admin.Login true ""
+// @Param body body admin.Login true "Admin login credentials payload"
 // @Success 200 {object} response.Response{data=adResp.LoginPayload}
 // @Failure 500 {object} response.Response
 // @Router /admin/login [post]
-// @Security token
 func (ct *Login) Login(c *gin.Context) {
 	if global.Config.App.DisablePwdLogin {
 		response.Fail(c, 101, response.TranslateMsg(c, "PwdLoginDisabled"))
@@ -97,6 +97,15 @@ func (ct *Login) Login(c *gin.Context) {
 	loginLimiter.RemoveAttempts(clientIp)
 	responseLoginSuccess(c, u, ut.Token)
 }
+
+// Captcha returns a CAPTCHA challenge when the login limiter requires one.
+// @Tags Auth
+// @Summary Get an admin login CAPTCHA
+// @Description Public pre-authentication route; a challenge is returned only when the client IP requires CAPTCHA verification.
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/captcha [get]
 func (ct *Login) Captcha(c *gin.Context) {
 	loginLimiter := global.LoginLimiter
 	clientIp := c.ClientIP()
@@ -127,33 +136,36 @@ func (ct *Login) Captcha(c *gin.Context) {
 	})
 }
 
-// Logout 
-// @Tags 
-// @Summary 
-// @Description 
+// Logout ends the current admin session when an api-token is supplied.
+// @Tags Auth
+// @Summary Log out of the admin panel
+// @Description Clears the supplied admin access token when it identifies a current user; the route is registered before the admin authentication middleware.
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/logout [post]
+// @Security token
 func (ct *Login) Logout(c *gin.Context) {
 	u := service.AllService.UserService.CurUser(c)
 	token, ok := c.Get("token")
 	if ok {
-		service.AllService.UserService.Logout(u, token.(string))
+		if err := service.AllService.UserService.Logout(u, token.(string)); err != nil {
+			response.FailStatus(c, http.StatusInternalServerError, 101, "logout failed")
+			return
+		}
 	}
 	response.Success(c, nil)
 }
 
-// LoginOptions
-// @Tags 
-// @Summary 
-// @Description 
-// @Accept  json
+// LoginOptions returns public admin login capabilities and configured OIDC providers.
+// @Tags Auth
+// @Summary Get admin login options
+// @Description Public pre-authentication route returning registration, password-login, CAPTCHA, and OIDC-provider capabilities.
 // @Produce  json
-// @Success 200 {object} []string
-// @Failure 500 {object} response.ErrorResponse
-// @Router /admin/login-options [post]
+// @Success 200 {object} response.Response "Public admin login capabilities"
+// @Failure 400 {object} response.Response "Login options could not be read"
+// @Router /admin/login-options [get]
 func (ct *Login) LoginOptions(c *gin.Context) {
 	loginLimiter := global.LoginLimiter
 	clientIp := c.ClientIP()
@@ -172,12 +184,14 @@ func (ct *Login) LoginOptions(c *gin.Context) {
 	})
 }
 
-// OidcAuth
+// OidcAuth starts the public admin OIDC authorization flow.
 // @Tags Oauth
-// @Summary OidcAuth
-// @Description OidcAuth
+// @Summary Start admin OIDC authorization
+// @Description Public pre-authentication route returning the state code and provider URL for the admin OIDC flow.
 // @Accept  json
 // @Produce  json
+// @Success 200 {object} response.Response{data=map[string]string} "Authorization state code and provider URL"
+// @Failure 400 {object} response.ErrorResponse "OIDC authorization could not be started"
 // @Router /admin/oidc/auth [post]
 func (ct *Login) OidcAuth(c *gin.Context) {
 	// o := &api.Oauth{}
@@ -213,14 +227,13 @@ func (ct *Login) OidcAuth(c *gin.Context) {
 	})
 }
 
-// OidcAuthQuery
+// OidcAuthQuery completes the public admin OIDC authorization flow.
 // @Tags Oauth
-// @Summary OidcAuthQuery
-// @Description OidcAuthQuery
-// @Accept  json
+// @Summary Complete admin OIDC authorization
+// @Description Public pre-authentication route exchanging the OIDC state code and provider callback values for an admin login payload.
 // @Produce  json
 // @Success 200 {object} response.Response{data=adResp.LoginPayload}
-// @Failure 500 {object} response.Response
+// @Failure 400 {object} response.ErrorResponse "OIDC authorization query failed"
 // @Router /admin/oidc/auth-query [get]
 func (ct *Login) OidcAuthQuery(c *gin.Context) {
 	o := &api.Oauth{}
diff --git a/api/http/controller/admin/loginLog.go b/api/http/controller/admin/loginLog.go
index abec89f..8933869 100644
--- a/api/http/controller/admin/loginLog.go
+++ b/api/http/controller/admin/loginLog.go
@@ -1,30 +1,19 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 	"strconv"
 )
 
 type LoginLog struct {
 }
 
-// Detail 
-// @Tags 
-// @Summary 
-// @Description 
-// @Accept  json
-// @Produce  json
-// @Param id path int true "ID"
-// @Success 200 {object} response.Response{data=model.LoginLog}
-// @Failure 500 {object} response.Response
-// @Router /admin/login_log/detail/{id} [get]
-// @Security token
 func (ct *LoginLog) Detail(c *gin.Context) {
 	id := c.Param("id")
 	iid, _ := strconv.Atoi(id)
@@ -37,14 +26,14 @@ func (ct *LoginLog) Detail(c *gin.Context) {
 	return
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the login-log list"
+// @Param page_size query int false "Number of login-log records per page"
 // @Param user_id query int false "ID"
 // @Success 200 {object} response.Response{data=model.LoginLogList}
 // @Failure 500 {object} response.Response
@@ -66,13 +55,13 @@ func (ct *LoginLog) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.LoginLog true ""
+// @Param body body model.LoginLog true "Login log deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/login_log/delete [post]
@@ -102,13 +91,13 @@ func (ct *LoginLog) Delete(c *gin.Context) {
 	response.Fail(c, 101, err.Error())
 }
 
-// BatchDelete 
-// @Tags 
-// @Summary 
-// @Description 
+// BatchDelete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.LoginLogIds true ""
+// @Param body body admin.LoginLogIds true "Login log ID batch deletion payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/login_log/batchDelete [post]
diff --git a/api/http/controller/admin/login_test.go b/api/http/controller/admin/login_test.go
new file mode 100644
index 0000000..a2e212d
--- /dev/null
+++ b/api/http/controller/admin/login_test.go
@@ -0,0 +1,100 @@
+package admin
+
+import (
+	"database/sql"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestLoginLogout(t *testing.T) {
+	tests := []struct {
+		name       string
+		closeDB    bool
+		wantStatus int
+		wantCode   int
+	}{
+		{name: "success", wantStatus: http.StatusOK, wantCode: 0},
+		{name: "revocation failure", closeDB: true, wantStatus: http.StatusInternalServerError, wantCode: 101},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+			if err != nil {
+				t.Fatalf("open sqlite: %v", err)
+			}
+			sqlDB, err := db.DB()
+			if err != nil {
+				t.Fatalf("get sqlite handle: %v", err)
+			}
+			sqlDB.SetMaxOpenConns(1)
+			defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+			if err := db.AutoMigrate(&model.UserToken{}); err != nil {
+				t.Fatalf("migrate user token: %v", err)
+			}
+
+			previousDB, previousServices := service.DB, service.AllService
+			service.DB = db
+			service.AllService = &service.Service{UserService: &service.UserService{}}
+			t.Cleanup(func() {
+				service.DB = previousDB
+				service.AllService = previousServices
+			})
+
+			const token = "logout-controller-token"
+			user := &model.User{IdModel: model.IdModel{Id: 1}}
+			if err := db.Create(&model.UserToken{
+				UserId:    user.Id,
+				Token:     token,
+				ExpiredAt: time.Now().Add(time.Hour).Unix(),
+			}).Error; err != nil {
+				t.Fatalf("create user token: %v", err)
+			}
+
+			if tt.closeDB {
+				if err := sqlDB.Close(); err != nil {
+					t.Fatalf("close sqlite: %v", err)
+				}
+			}
+
+			recorder := httptest.NewRecorder()
+			context, _ := gin.CreateTestContext(recorder)
+			context.Request = httptest.NewRequest(http.MethodPost, "/api/admin/logout", nil)
+			context.Set("curUser", user)
+			context.Set("token", token)
+			(&Login{}).Logout(context)
+
+			if recorder.Code != tt.wantStatus {
+				t.Fatalf("logout status = %d, want %d; body=%s", recorder.Code, tt.wantStatus, recorder.Body.String())
+			}
+			var payload struct {
+				Code int `json:"code"`
+			}
+			if err := json.Unmarshal(recorder.Body.Bytes(), &payload); err != nil {
+				t.Fatalf("decode logout response: %v", err)
+			}
+			if payload.Code != tt.wantCode {
+				t.Fatalf("logout response code = %d, want %d", payload.Code, tt.wantCode)
+			}
+			if tt.closeDB {
+				body := recorder.Body.String()
+				if strings.Contains(body, token) || strings.Contains(body, "database is closed") {
+					t.Fatalf("logout failure exposed secret or database error: %s", body)
+				}
+				if !strings.Contains(body, "logout failed") {
+					t.Fatalf("logout failure omitted safe message: %s", body)
+				}
+			}
+		})
+	}
+}
diff --git a/api/http/controller/admin/my/addressBook.go b/api/http/controller/admin/my/addressBook.go
index 0e89a5a..6b4cbe2 100644
--- a/api/http/controller/admin/my/addressBook.go
+++ b/api/http/controller/admin/my/addressBook.go
@@ -1,27 +1,27 @@
-package my
+package my
 
 import (
 	"encoding/json"
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 )
 
 type AddressBook struct{}
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the personal address book list"
+// @Param page_size query int false "Number of personal address book entries per page"
 // @Param user_id query int false "id"
-// @Success 200 {object} response.Response{data=model.AddressBookList}
+// @Success 200 {object} response.Response{data=model.AddressBookSafeList} "Redacted personal address-book list envelope"
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book/list [get]
 // @Security token
@@ -57,17 +57,17 @@ func (ct *AddressBook) List(c *gin.Context) {
 	for _, ab := range res.AddressBooks {
 		abCIds = append(abCIds, ab.CollectionId)
 	}
-	response.Success(c, res)
+	response.Success(c, res.Safe())
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
-// @Success 200 {object} response.Response{data=model.AddressBook}
+// @Param body body admin.AddressBookForm true "Personal address book entry form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book/create [post]
 // @Security token
@@ -104,14 +104,14 @@ func (ct *AddressBook) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
-// @Success 200 {object} response.Response{data=model.AddressBook}
+// @Param body body admin.AddressBookForm true "Personal address book entry update form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book/update [post]
 // @Security token
@@ -158,13 +158,13 @@ func (ct *AddressBook) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.AddressBookForm true ""
+// @Param body body admin.AddressBookForm true "Personal address book entry deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book/delete [post]
@@ -199,6 +199,18 @@ func (ct *AddressBook) Delete(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
 	return
 }
+
+// BatchCreateFromPeers
+// @Tags
+// @Summary
+// @Description Personal batch creation of address-book entries from the current user's peers.
+// @Accept  json
+// @Produce  json
+// @Param body body admin.BatchCreateFromPeersForm true "Peer IDs and address-book destination payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/my/address_book/batchCreateFromPeers [post]
+// @Security token
 func (ct *AddressBook) BatchCreateFromPeers(c *gin.Context) {
 	f := &admin.BatchCreateFromPeersForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
@@ -246,6 +258,17 @@ func (ct *AddressBook) BatchCreateFromPeers(c *gin.Context) {
 	response.Success(c, nil)
 }
 
+// BatchUpdateTags changes tags for the current user's address-book entries.
+// @Tags AddressBook
+// @Summary Update personal address-book tags
+// @Description Authenticated users may update tags on their own address-book entries.
+// @Accept json
+// @Produce json
+// @Param body body admin.BatchUpdateTagsForm true "Address-book tag update payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/my/address_book/batchUpdateTags [post]
+// @Security token
 func (ct *AddressBook) BatchUpdateTags(c *gin.Context) {
 	f := &admin.BatchUpdateTagsForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
diff --git a/api/http/controller/admin/my/addressBookCollection.go b/api/http/controller/admin/my/addressBookCollection.go
index b93edf1..c7de8f9 100644
--- a/api/http/controller/admin/my/addressBookCollection.go
+++ b/api/http/controller/admin/my/addressBookCollection.go
@@ -1,26 +1,26 @@
-package my
+package my
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 )
 
 type AddressBookCollection struct {
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollection true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollection true "Personal address book collection form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection/create [post]
 // @Security token
@@ -45,14 +45,14 @@ func (abc *AddressBookCollection) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the personal address book collection list"
+// @Param page_size query int false "Number of personal address book collections per page"
 // @Success 200 {object} response.Response{data=model.AddressBookCollectionList}
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection/list [get]
@@ -71,14 +71,14 @@ func (abc *AddressBookCollection) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollection true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollection true "Personal address book collection update form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection/update [post]
 // @Security token
@@ -120,13 +120,13 @@ func (abc *AddressBookCollection) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollection true ""
+// @Param body body model.AddressBookCollection true "Personal address book collection deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection/delete [post]
diff --git a/api/http/controller/admin/my/addressBookCollectionRule.go b/api/http/controller/admin/my/addressBookCollectionRule.go
index 24e03df..896b77e 100644
--- a/api/http/controller/admin/my/addressBookCollectionRule.go
+++ b/api/http/controller/admin/my/addressBookCollectionRule.go
@@ -1,30 +1,30 @@
-package my
+package my
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 )
 
 type AddressBookCollectionRule struct {
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param is_my query int false ""
+// @Param page query int false "Page number for personal address book collection rules"
+// @Param page_size query int false "Number of personal collection rules per page"
+// @Param is_my query int false "Filter for rules owned by the current user"
 // @Param user_id query int false "id"
 // @Param collection_id query int false "id"
-// @Success 200 {object} response.Response{data=model.AddressBookCollectionList}
+// @Success 200 {object} response.Response{data=model.AddressBookCollectionRuleList}
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection_rule/list [get]
 // @Security token
@@ -46,14 +46,14 @@ func (abcr *AddressBookCollectionRule) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollectionRule true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollectionRule true "Personal address book collection rule form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection_rule/create [post]
 // @Security token
@@ -134,14 +134,14 @@ func (abcr *AddressBookCollectionRule) CheckForm(u *model.User, t *model.Address
 	return "", true
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollectionRule true ""
-// @Success 200 {object} response.Response{data=model.AddressBookCollection}
+// @Param body body model.AddressBookCollectionRule true "Personal address book collection rule update form payload"
+// @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection_rule/update [post]
 // @Security token
@@ -185,13 +185,13 @@ func (abcr *AddressBookCollectionRule) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.AddressBookCollectionRule true ""
+// @Param body body model.AddressBookCollectionRule true "Personal address book collection rule deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/address_book_collection_rule/delete [post]
diff --git a/api/http/controller/admin/my/loginLog.go b/api/http/controller/admin/my/loginLog.go
index b3c976b..70aa931 100644
--- a/api/http/controller/admin/my/loginLog.go
+++ b/api/http/controller/admin/my/loginLog.go
@@ -19,8 +19,8 @@ type LoginLog struct {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the personal login-log list"
+// @Param page_size query int false "Number of personal login-log records per page"
 // @Param user_id query int false "ID"
 // @Success 200 {object} response.Response{data=model.LoginLogList}
 // @Failure 500 {object} response.Response
@@ -46,7 +46,7 @@ func (ct *LoginLog) List(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body model.LoginLog true ""
+// @Param body body model.LoginLog true "Personal login-log deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/login_log/delete [post]
@@ -87,7 +87,7 @@ func (ct *LoginLog) Delete(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.LoginLogIds true ""
+// @Param body body admin.LoginLogIds true "Personal login-log ID batch deletion payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/login_log/batchDelete [post]
diff --git a/api/http/controller/admin/my/peer.go b/api/http/controller/admin/my/peer.go
index 4a6899c..f4f7500 100644
--- a/api/http/controller/admin/my/peer.go
+++ b/api/http/controller/admin/my/peer.go
@@ -18,11 +18,11 @@ type Peer struct {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param time_ago query int false ""
+// @Param page query int false "Page number for the personal peer list"
+// @Param page_size query int false "Number of personal peers per page"
+// @Param time_ago query int false "Last-online time offset filter"
 // @Param id query string false "ID"
-// @Param hostname query string false ""
+// @Param hostname query string false "Hostname filter"
 // @Param uuids query string false "uuids "
 // @Success 200 {object} response.Response{data=model.PeerList}
 // @Failure 500 {object} response.Response
@@ -68,7 +68,7 @@ func (ct *Peer) List(c *gin.Context) {
 // @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.PeerForm true ""
+// @Param body body admin.PeerForm true "Personal peer deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/peer/delete [post]
@@ -102,7 +102,7 @@ func (ct *Peer) Delete(c *gin.Context) {
 // @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.PeerBatchDeleteForm true ""
+// @Param body body admin.PeerBatchDeleteForm true "Personal peer ID batch deletion payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/peer/batchDelete [post]
diff --git a/api/http/controller/admin/my/shareRecord.go b/api/http/controller/admin/my/shareRecord.go
index 4579e0b..857b3f2 100644
--- a/api/http/controller/admin/my/shareRecord.go
+++ b/api/http/controller/admin/my/shareRecord.go
@@ -1,26 +1,26 @@
-package my
+package my
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 )
 
 type ShareRecord struct {
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Success 200 {object} response.Response
+// @Param page query int false "Page number for personal share records"
+// @Param page_size query int false "Number of personal share records per page"
+// @Success 200 {object} response.Response{data=model.ShareRecordSafeList} "Redacted personal share-record list envelope"
 // @Failure 500 {object} response.Response
 // @Router /admin/my/share_record/list [get]
 // @Security token
@@ -34,16 +34,16 @@ func (sr *ShareRecord) List(c *gin.Context) {
 	res := service.AllService.ShareRecordService.List(query.Page, query.PageSize, func(tx *gorm.DB) {
 		tx.Where("user_id = ?", u.Id)
 	})
-	response.Success(c, res)
+	response.Success(c, res.Safe())
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.ShareRecordForm true ""
+// @Param body body admin.ShareRecordForm true "Personal share record deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/share_record/delete [post]
@@ -78,10 +78,10 @@ func (sr *ShareRecord) Delete(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "OperationFailed")+err.Error())
 }
 
-// BatchDelete 
-// @Tags 
-// @Summary 
-// @Description 
+// BatchDelete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param body body admin.PeerShareRecordBatchDeleteForm true "id"
diff --git a/api/http/controller/admin/my/share_record_test.go b/api/http/controller/admin/my/share_record_test.go
new file mode 100644
index 0000000..49a8353
--- /dev/null
+++ b/api/http/controller/admin/my/share_record_test.go
@@ -0,0 +1,72 @@
+package my
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestPersonalShareRecordListUsesSafeResponse(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+	if err := db.AutoMigrate(&model.ShareRecord{}); err != nil {
+		t.Fatalf("migrate share record: %v", err)
+	}
+	if err := db.Create(&model.ShareRecord{
+		UserId:       8,
+		PeerId:       "personal-peer",
+		ShareToken:   "personal-share-token",
+		PasswordType: "once",
+		Password:     "personal-password",
+		Expire:       900,
+	}).Error; err != nil {
+		t.Fatalf("create share record: %v", err)
+	}
+
+	previousDB, previousServices := service.DB, service.AllService
+	service.DB = db
+	service.AllService = &service.Service{
+		UserService:        &service.UserService{},
+		ShareRecordService: &service.ShareRecordService{},
+	}
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+	})
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Set("curUser", &model.User{IdModel: model.IdModel{Id: 8}})
+	c.Request = httptest.NewRequest(http.MethodGet, "/admin/my/share_record/list?page=1&page_size=10", nil)
+	(&ShareRecord{}).List(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("personal share record list status = %d; body=%s", recorder.Code, recorder.Body.String())
+	}
+	body := recorder.Body.String()
+	for _, forbidden := range []string{"personal-share-token", "personal-password", `"share_token"`, `"password_type"`, `"password"`} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("personal share record response exposed %q: %s", forbidden, body)
+		}
+	}
+	for _, expected := range []string{`"user_id":8`, `"peer_id":"personal-peer"`, `"expire":900`} {
+		if !strings.Contains(body, expected) {
+			t.Fatalf("personal share record response omitted %q: %s", expected, body)
+		}
+	}
+}
diff --git a/api/http/controller/admin/my/tag.go b/api/http/controller/admin/my/tag.go
index 69c2cf4..626ab82 100644
--- a/api/http/controller/admin/my/tag.go
+++ b/api/http/controller/admin/my/tag.go
@@ -17,9 +17,9 @@ type Tag struct{}
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param is_my query int false ""
+// @Param page query int false "Page number for the personal tag list"
+// @Param page_size query int false "Number of personal tags per page"
+// @Param is_my query int false "Filter for tags owned by the current user"
 // @Param user_id query int false "id"
 // @Success 200 {object} response.Response{data=model.TagList}
 // @Failure 500 {object} response.Response
@@ -51,7 +51,7 @@ func (ct *Tag) List(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.TagForm true ""
+// @Param body body admin.TagForm true "Personal tag form payload"
 // @Success 200 {object} response.Response{data=model.Tag}
 // @Failure 500 {object} response.Response
 // @Router /admin/my/tag/create [post]
@@ -84,7 +84,7 @@ func (ct *Tag) Create(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.TagForm true ""
+// @Param body body admin.TagForm true "Personal tag update form payload"
 // @Success 200 {object} response.Response{data=model.Tag}
 // @Failure 500 {object} response.Response
 // @Router /admin/my/tag/update [post]
@@ -139,7 +139,7 @@ func (ct *Tag) Update(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.TagForm true ""
+// @Param body body admin.TagForm true "Personal tag deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/my/tag/delete [post]
diff --git a/api/http/controller/admin/oauth.go b/api/http/controller/admin/oauth.go
index d4a0eac..4b6b3c3 100644
--- a/api/http/controller/admin/oauth.go
+++ b/api/http/controller/admin/oauth.go
@@ -1,4 +1,4 @@
-package admin
+package admin
 
 import (
 	"fmt"
@@ -15,7 +15,16 @@ import (
 type Oauth struct {
 }
 
-// Info
+// Info returns the cached OAuth handoff identified by its short-lived code.
+// @Tags Oauth
+// @Summary Get cached OAuth handoff data
+// @Description Authenticated OAuth handoff lookup by short-lived code.
+// @Produce json
+// @Param code query string true "OAuth handoff code"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/oauth/info [get]
+// @Security token
 func (o *Oauth) Info(c *gin.Context) {
 	code := c.Query("code")
 	if code == "" {
@@ -30,6 +39,17 @@ func (o *Oauth) Info(c *gin.Context) {
 	response.Success(c, v)
 }
 
+// ToBind starts an OAuth provider binding flow for the current user.
+// @Tags Oauth
+// @Summary Start OAuth binding
+// @Description Authenticated users receive a short-lived binding code and provider URL.
+// @Accept json
+// @Produce json
+// @Param body body admin.BindOauthForm true "OAuth provider binding payload"
+// @Success 200 {object} response.Response{data=map[string]string}
+// @Failure 500 {object} response.Response
+// @Router /admin/oauth/bind [post]
+// @Security token
 func (o *Oauth) ToBind(c *gin.Context) {
 	f := &adminReq.BindOauthForm{}
 	err := c.ShouldBindJSON(f)
@@ -65,7 +85,17 @@ func (o *Oauth) ToBind(c *gin.Context) {
 	})
 }
 
-// Confirm 
+// Confirm prepares the cached OAuth identity for binding to the current user.
+// @Tags Oauth
+// @Summary Confirm OAuth binding
+// @Description Authenticated users confirm a short-lived OAuth handoff before binding.
+// @Accept json
+// @Produce json
+// @Param body body admin.OauthConfirmForm true "OAuth confirmation payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/oauth/confirm [post]
+// @Security token
 func (o *Oauth) Confirm(c *gin.Context) {
 	j := &adminReq.OauthConfirmForm{}
 	err := c.ShouldBindJSON(j)
@@ -88,6 +118,17 @@ func (o *Oauth) Confirm(c *gin.Context) {
 	response.Success(c, v)
 }
 
+// BindConfirm completes OAuth binding for the current user.
+// @Tags Oauth
+// @Summary Complete OAuth binding
+// @Description Authenticated users attach the confirmed OAuth identity to their account.
+// @Accept json
+// @Produce json
+// @Param body body admin.OauthConfirmForm true "OAuth confirmation payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/oauth/bindConfirm [post]
+// @Security token
 func (o *Oauth) BindConfirm(c *gin.Context) {
 	j := &adminReq.OauthConfirmForm{}
 	err := c.ShouldBindJSON(j)
@@ -118,6 +159,17 @@ func (o *Oauth) BindConfirm(c *gin.Context) {
 	response.Success(c, oauthCache)
 }
 
+// Unbind removes the current user's OAuth provider binding.
+// @Tags Oauth
+// @Summary Unbind OAuth provider
+// @Description Authenticated users remove one OAuth provider binding from their account.
+// @Accept json
+// @Produce json
+// @Param body body admin.UnBindOauthForm true "OAuth provider unbinding payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/oauth/unbind [post]
+// @Security token
 func (o *Oauth) Unbind(c *gin.Context) {
 	f := &adminReq.UnBindOauthForm{}
 	err := c.ShouldBindJSON(f)
@@ -203,14 +255,14 @@ func (o *Oauth) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// List 
+// List
 // @Tags Oauth
 // @Summary Oauth
 // @Description Oauth
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the OAuth provider list"
+// @Param page_size query int false "Number of OAuth providers per page"
 // @Success 200 {object} response.Response{data=model.OauthList}
 // @Failure 500 {object} response.Response
 // @Router /admin/oauth/list [get]
@@ -225,7 +277,7 @@ func (o *Oauth) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Update 
+// Update
 // @Tags Oauth
 // @Summary Oauth
 // @Description Oauth
@@ -260,7 +312,7 @@ func (o *Oauth) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
+// Delete
 // @Tags Oauth
 // @Summary Oauth
 // @Description Oauth
diff --git a/api/http/controller/admin/peer.go b/api/http/controller/admin/peer.go
index bb4ff65..fdb3fb9 100644
--- a/api/http/controller/admin/peer.go
+++ b/api/http/controller/admin/peer.go
@@ -1,12 +1,12 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 	"strconv"
 	"time"
 )
@@ -14,10 +14,10 @@ import (
 type Peer struct {
 }
 
-// Detail 
-// @Tags 
-// @Summary 
-// @Description 
+// Detail
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param id path int true "ID"
@@ -37,13 +37,13 @@ func (ct *Peer) Detail(c *gin.Context) {
 	return
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.PeerForm true ""
+// @Param body body admin.PeerForm true "Peer form payload"
 // @Success 200 {object} response.Response{data=model.Peer}
 // @Failure 500 {object} response.Response
 // @Router /admin/peer/create [post]
@@ -68,17 +68,17 @@ func (ct *Peer) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param time_ago query int false ""
+// @Param page query int false "Page number for the peer list"
+// @Param page_size query int false "Number of peers per page"
+// @Param time_ago query int false "Last-online time offset filter"
 // @Param id query string false "ID"
-// @Param hostname query string false ""
+// @Param hostname query string false "Hostname filter"
 // @Param uuids query string false "uuids "
 // @Success 200 {object} response.Response{data=model.PeerList}
 // @Failure 500 {object} response.Response
@@ -121,13 +121,13 @@ func (ct *Peer) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.PeerForm true ""
+// @Param body body admin.PeerForm true "Peer update form payload"
 // @Success 200 {object} response.Response{data=model.Peer}
 // @Failure 500 {object} response.Response
 // @Router /admin/peer/update [post]
@@ -156,13 +156,13 @@ func (ct *Peer) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.PeerForm true ""
+// @Param body body admin.PeerForm true "Peer deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/peer/delete [post]
@@ -192,10 +192,10 @@ func (ct *Peer) Delete(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 }
 
-// BatchDelete 
-// @Tags 
-// @Summary 
-// @Description 
+// BatchDelete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param body body admin.PeerBatchDeleteForm true "id"
@@ -221,6 +221,17 @@ func (ct *Peer) BatchDelete(c *gin.Context) {
 	response.Success(c, nil)
 }
 
+// SimpleData returns the requested peer IDs and versions for authenticated clients.
+// @Tags Peer
+// @Summary Get peer version data
+// @Description Authenticated peer version lookup used by the admin panel.
+// @Accept json
+// @Produce json
+// @Param body body admin.SimpleDataQuery true "Peer ID lookup payload"
+// @Success 200 {object} response.Response{data=model.PeerList}
+// @Failure 500 {object} response.Response
+// @Router /admin/peer/simpleData [post]
+// @Security token
 func (ct *Peer) SimpleData(c *gin.Context) {
 	f := &admin.SimpleDataQuery{}
 	if err := c.ShouldBindJSON(f); err != nil {
diff --git a/api/http/controller/admin/rustdesk.go b/api/http/controller/admin/rustdesk.go
index ede365d..8cb8a6b 100644
--- a/api/http/controller/admin/rustdesk.go
+++ b/api/http/controller/admin/rustdesk.go
@@ -1,4 +1,4 @@
-package admin
+package admin
 
 import (
 	"time"
@@ -20,6 +20,17 @@ type RustdeskCmd struct {
 	Target string `json:"target"`
 }
 
+// CmdList lists the allowlisted RustDesk server commands.
+// @Tags Rustdesk
+// @Summary List server commands
+// @Description Admin-only paginated list of built-in and configured server commands.
+// @Produce json
+// @Param page query int false "Page number"
+// @Param page_size query int false "Number of commands per page"
+// @Success 200 {object} response.Response{data=model.ServerCmdList}
+// @Failure 500 {object} response.Response
+// @Router /admin/rustdesk/cmdList [get]
+// @Security token
 func (r *Rustdesk) CmdList(c *gin.Context) {
 	q := &admin.PageQuery{}
 	if err := c.ShouldBindQuery(q); err != nil {
@@ -38,6 +49,17 @@ func (r *Rustdesk) CmdList(c *gin.Context) {
 
 // CmdAuditList — журнал выполненных server-команд (BUGS.md AU-S-001), новейшие
 // сверху, постранично. Только для просмотра; пишется middleware.ServerCmdAudit.
+// CmdAuditList lists recorded server-command executions.
+// @Tags Rustdesk
+// @Summary List server-command audit records
+// @Description Admin-only paginated audit history for server-command executions.
+// @Produce json
+// @Param page query int false "Page number"
+// @Param page_size query int false "Number of audit records per page"
+// @Success 200 {object} response.Response{data=model.ServerCmdAuditList}
+// @Failure 500 {object} response.Response
+// @Router /admin/rustdesk/cmdAuditList [get]
+// @Security token
 func (r *Rustdesk) CmdAuditList(c *gin.Context) {
 	q := &admin.PageQuery{}
 	if err := c.ShouldBindQuery(q); err != nil {
@@ -64,6 +86,16 @@ func (r *Rustdesk) CmdAuditList(c *gin.Context) {
 	response.Success(c, res)
 }
 
+// CmdDelete deletes a configured server command.
+// @Tags Rustdesk
+// @Summary Delete a server command
+// @Accept json
+// @Produce json
+// @Param body body model.ServerCmd true "Server command identifier"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/rustdesk/cmdDelete [post]
+// @Security token
 func (r *Rustdesk) CmdDelete(c *gin.Context) {
 	f := &model.ServerCmd{}
 	if err := c.ShouldBindJSON(f); err != nil {
@@ -88,6 +120,17 @@ func (r *Rustdesk) CmdDelete(c *gin.Context) {
 	}
 	response.Success(c, nil)
 }
+
+// CmdCreate creates a configured server command.
+// @Tags Rustdesk
+// @Summary Create a server command
+// @Accept json
+// @Produce json
+// @Param body body model.ServerCmd true "Server command payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/rustdesk/cmdCreate [post]
+// @Security token
 func (r *Rustdesk) CmdCreate(c *gin.Context) {
 	f := &model.ServerCmd{}
 	if err := c.ShouldBindJSON(f); err != nil {
@@ -107,6 +150,16 @@ func (r *Rustdesk) CmdCreate(c *gin.Context) {
 	response.Success(c, nil)
 }
 
+// CmdUpdate changes a configured server command.
+// @Tags Rustdesk
+// @Summary Update a server command
+// @Accept json
+// @Produce json
+// @Param body body model.ServerCmd true "Server command update payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/rustdesk/cmdUpdate [post]
+// @Security token
 func (r *Rustdesk) CmdUpdate(c *gin.Context) {
 	f := &model.ServerCmd{}
 	if err := c.ShouldBindJSON(f); err != nil {
@@ -131,6 +184,17 @@ func (r *Rustdesk) CmdUpdate(c *gin.Context) {
 	response.Success(c, nil)
 }
 
+// SendCmd sends an allowlisted command to the selected RustDesk server.
+// @Tags Rustdesk
+// @Summary Send a server command
+// @Description Admin-only command execution against the selected ID or relay server.
+// @Accept json
+// @Produce json
+// @Param body body admin.RustdeskCmd true "Server command request"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/rustdesk/sendCmd [post]
+// @Security token
 func (r *Rustdesk) SendCmd(c *gin.Context) {
 	rc := &RustdeskCmd{}
 	if err := c.ShouldBindJSON(rc); err != nil {
diff --git a/api/http/controller/admin/shareRecord.go b/api/http/controller/admin/shareRecord.go
index 7cfb45b..94f9b6c 100644
--- a/api/http/controller/admin/shareRecord.go
+++ b/api/http/controller/admin/shareRecord.go
@@ -1,27 +1,27 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 )
 
 type ShareRecord struct {
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param user_id query int false "ID"
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Success 200 {object} response.Response
+// @Param page query int false "Page number for share records"
+// @Param page_size query int false "Number of share records per page"
+// @Success 200 {object} response.Response{data=model.ShareRecordSafeList} "Redacted share-record list envelope"
 // @Failure 500 {object} response.Response
 // @Router /admin/share_record/list [get]
 // @Security token
@@ -36,16 +36,16 @@ func (sr *ShareRecord) List(c *gin.Context) {
 			tx.Where("user_id = ?", query.UserId)
 		}
 	})
-	response.Success(c, res)
+	response.Success(c, res.Safe())
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.ShareRecordForm true ""
+// @Param body body admin.ShareRecordForm true "Share record deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/share_record/delete [post]
@@ -75,10 +75,10 @@ func (sr *ShareRecord) Delete(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 }
 
-// BatchDelete 
-// @Tags 
-// @Summary 
-// @Description 
+// BatchDelete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param body body admin.PeerShareRecordBatchDeleteForm true "id"
diff --git a/api/http/controller/admin/share_record_test.go b/api/http/controller/admin/share_record_test.go
new file mode 100644
index 0000000..6a3ce17
--- /dev/null
+++ b/api/http/controller/admin/share_record_test.go
@@ -0,0 +1,68 @@
+package admin
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestAdminShareRecordListUsesSafeResponse(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+	if err := db.AutoMigrate(&model.ShareRecord{}); err != nil {
+		t.Fatalf("migrate share record: %v", err)
+	}
+	if err := db.Create(&model.ShareRecord{
+		UserId:       8,
+		PeerId:       "admin-peer",
+		ShareToken:   "admin-share-token",
+		PasswordType: "fixed",
+		Password:     "admin-password",
+		Expire:       1800,
+	}).Error; err != nil {
+		t.Fatalf("create share record: %v", err)
+	}
+
+	previousDB, previousServices := service.DB, service.AllService
+	service.DB = db
+	service.AllService = &service.Service{ShareRecordService: &service.ShareRecordService{}}
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+	})
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/admin/share_record/list?page=1&page_size=10", nil)
+	(&ShareRecord{}).List(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("admin share record list status = %d; body=%s", recorder.Code, recorder.Body.String())
+	}
+	body := recorder.Body.String()
+	for _, forbidden := range []string{"admin-share-token", "admin-password", `"share_token"`, `"password_type"`, `"password"`} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("admin share record response exposed %q: %s", forbidden, body)
+		}
+	}
+	for _, expected := range []string{`"user_id":8`, `"peer_id":"admin-peer"`, `"expire":1800`} {
+		if !strings.Contains(body, expected) {
+			t.Fatalf("admin share record response omitted %q: %s", expected, body)
+		}
+	}
+}
diff --git a/api/http/controller/admin/streaming_artifact_test.go b/api/http/controller/admin/streaming_artifact_test.go
new file mode 100644
index 0000000..2804c6d
--- /dev/null
+++ b/api/http/controller/admin/streaming_artifact_test.go
@@ -0,0 +1,1644 @@
+package admin
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"rustdesk-server/api/global"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func makeArtifactZip(t *testing.T, files map[string]string) string {
+	t.Helper()
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	for name, contents := range files {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatalf("create ZIP entry %q: %v", name, err)
+		}
+		if _, err := w.Write([]byte(contents)); err != nil {
+			t.Fatalf("write ZIP entry %q: %v", name, err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatalf("close ZIP: %v", err)
+	}
+	archive, err := os.CreateTemp(t.TempDir(), "artifact-*.zip")
+	if err != nil {
+		t.Fatalf("create test archive: %v", err)
+	}
+	if _, err := archive.Write(buf.Bytes()); err != nil {
+		t.Fatalf("write test archive: %v", err)
+	}
+	if err := archive.Close(); err != nil {
+		t.Fatalf("close test archive: %v", err)
+	}
+	return archive.Name()
+}
+
+func withTestOutputRoot(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	previous := customBuildOutputDir
+	previousService := service.BuildOutputDir
+	customBuildOutputDir = func(id uint) string {
+		return filepath.Join(root, "output", fmt.Sprintf("%d", id))
+	}
+	service.BuildOutputDir = customBuildOutputDir
+	t.Cleanup(func() {
+		customBuildOutputDir = previous
+		service.BuildOutputDir = previousService
+	})
+	return root
+}
+
+func TestPublishDownloadedArtifactAtomicallyPublishesValidatedWindowsOutput(t *testing.T) {
+	root := withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 71}, Platform: "windows", AppName: "rustqs"}
+	archive := makeArtifactZip(t, map[string]string{
+		"rustqs.exe":  "exe",
+		"helper.dll":  "dll",
+		"custom_.txt": "settings",
+	})
+
+	size, err := publishDownloadedArtifact(build, archive)
+	if err != nil {
+		t.Fatalf("publishDownloadedArtifact() error = %v", err)
+	}
+	if size != int64(len("exe")) {
+		t.Fatalf("published file size = %d, want exe size", size)
+	}
+	outDir := filepath.Join(root, "output", "71")
+	for _, name := range []string{"rustqs.exe", "helper.dll", "custom_.txt"} {
+		if _, err := os.Stat(filepath.Join(outDir, name)); err != nil {
+			t.Fatalf("published %s: %v", name, err)
+		}
+	}
+	if entries, err := os.ReadDir(filepath.Dir(outDir)); err != nil || len(entries) != 1 || entries[0].Name() != "71" {
+		t.Fatalf("output parent entries = %v, err=%v; staging directory leaked", entries, err)
+	}
+}
+
+func TestPublishDownloadedArtifactFailsClosedAndCleansStaging(t *testing.T) {
+	cases := []struct {
+		name  string
+		files map[string]string
+	}{
+		{name: "invalid zip", files: nil},
+		{name: "zip slip", files: map[string]string{"../escape.exe": "bad"}},
+		{name: "backslash traversal", files: map[string]string{`..\escape.exe`: "bad"}},
+		{name: "absolute path", files: map[string]string{"/escape.exe": "bad"}},
+		{name: "drive absolute path", files: map[string]string{`C:\escape.exe`: "bad"}},
+		{name: "reserved device", files: map[string]string{"CON.exe": "bad"}},
+		{name: "unsafe extension", files: map[string]string{"helper.bat": "bad"}},
+		{name: "nested Windows path", files: map[string]string{"nested/helper.dll": "bad"}},
+		{name: "missing required exe", files: map[string]string{"custom_.txt": "settings"}},
+		{name: "duplicate output", files: map[string]string{"rustqs.exe": "one", "nested/rustqs.exe": "two"}},
+		{name: "case-insensitive duplicate executable", files: map[string]string{"rustqs.exe": "one", "RUSTQS.EXE": "two"}},
+		{name: "case-insensitive duplicate DLL", files: map[string]string{"rustqs.exe": "one", "helper.dll": "one", "HELPER.DLL": "two"}},
+	}
+	for index, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			root := withTestOutputRoot(t)
+			build := &model.CustomBuild{IdModel: model.IdModel{Id: uint(80 + index)}, Platform: "windows", AppName: "rustqs"}
+			archive := ""
+			if tc.files == nil {
+				file, err := os.CreateTemp(t.TempDir(), "invalid-*.zip")
+				if err != nil {
+					t.Fatal(err)
+				}
+				if _, err := file.WriteString("not a ZIP"); err != nil {
+					t.Fatal(err)
+				}
+				if err := file.Close(); err != nil {
+					t.Fatal(err)
+				}
+				archive = file.Name()
+			} else {
+				archive = makeArtifactZip(t, tc.files)
+			}
+			if _, err := publishDownloadedArtifact(build, archive); err == nil {
+				t.Fatal("publishDownloadedArtifact() error = nil, want fail-closed validation error")
+			}
+			outDir := filepath.Join(root, "output", fmt.Sprintf("%d", build.Id))
+			if _, err := os.Stat(outDir); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("final output stat = %v, want no final output", err)
+			}
+			if entries, err := os.ReadDir(filepath.Dir(outDir)); err != nil {
+				t.Fatalf("read output parent: %v", err)
+			} else if len(entries) != 0 {
+				t.Fatalf("output parent entries = %v, want staging cleanup", entries)
+			}
+			if _, err := os.Stat(filepath.Join(root, "output", "escape.exe")); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("zip-slip escape stat = %v, want absent", err)
+			}
+		})
+	}
+}
+
+func TestPublishDownloadedArtifactRejectsChecksumMismatch(t *testing.T) {
+	root := withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 90}, Platform: "windows", AppName: "rustqs"}
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	header := &zip.FileHeader{Name: "rustqs.exe", Method: zip.Store}
+	w, err := zw.CreateHeader(header)
+	if err != nil {
+		t.Fatalf("create stored ZIP entry: %v", err)
+	}
+	if _, err := w.Write([]byte("valid-exe")); err != nil {
+		t.Fatalf("write stored ZIP entry: %v", err)
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatalf("close stored ZIP: %v", err)
+	}
+	corrupted := buf.Bytes()
+	payload := bytes.Index(corrupted, []byte("valid-exe"))
+	if payload < 0 {
+		t.Fatal("stored ZIP payload not found")
+	}
+	corrupted[payload] = 'X'
+	archive := filepath.Join(t.TempDir(), "checksum-invalid.zip")
+	if err := os.WriteFile(archive, corrupted, 0600); err != nil {
+		t.Fatalf("write corrupted ZIP: %v", err)
+	}
+	if _, err := publishDownloadedArtifact(build, archive); err == nil {
+		t.Fatal("publishDownloadedArtifact() error = nil, want checksum failure")
+	}
+	if _, err := os.Stat(filepath.Join(root, "output", "90")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("checksum-invalid final output stat = %v, want absent", err)
+	}
+}
+
+func TestPublishDownloadedArtifactRequiresExactProducerManifestForActiveBuild(t *testing.T) {
+	cases := []struct {
+		name    string
+		archive func(*testing.T) string
+	}{
+		{name: "missing manifest", archive: func(t *testing.T) string {
+			return makeArtifactZip(t, map[string]string{"rustqs.exe": "exe"})
+		}},
+		{name: "extra output", archive: func(t *testing.T) string {
+			manifest := producerManifestBytes(t, "exe")
+			return makeArtifactZip(t, map[string]string{
+				"rustqs.exe":   "exe",
+				"helper.dll":   "extra",
+				"manifest.txt": manifest,
+			})
+		}},
+		{name: "case collision", archive: func(t *testing.T) string {
+			manifest := producerManifestBytes(t, "exe")
+			return makeArtifactZip(t, map[string]string{
+				"RUSTQS.EXE":   "exe",
+				"manifest.txt": manifest,
+			})
+		}},
+	}
+	for index, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			withTestOutputRoot(t)
+			build := activeWindowsBuild(uint(140 + index))
+			if _, err := publishDownloadedArtifact(build, tc.archive(t)); err == nil {
+				t.Fatal("publishDownloadedArtifact() error = nil, want producer manifest rejection")
+			}
+			if _, err := os.Stat(customBuildOutputDir(build.Id)); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("published output stat = %v, want absent", err)
+			}
+		})
+	}
+}
+
+func TestExtractValidatedArtifactAcceptsNestedBridgeManifestFiles(t *testing.T) {
+	build := &model.CustomBuild{
+		IdModel:          model.IdModel{Id: 150},
+		Platform:         "bridge",
+		AppName:          "rustdesk-bridge",
+		Version:          "1.2.3",
+		BuildRef:         strings.Repeat("a", 40),
+		GithubRef:        strings.Repeat("b", 40),
+		WorkflowSelector: "bridge",
+	}
+	names, err := service.ExpectedProducerOutputFilenames(build.Platform, build.AppName, build.Version)
+	if err != nil {
+		t.Fatal(err)
+	}
+	contents := make(map[string]string, len(names))
+	manifestFiles := make([]service.ProducerManifestFile, 0, len(names))
+	for _, name := range names {
+		contents[name] = name
+		digest := sha256.Sum256([]byte(name))
+		manifestFiles = append(manifestFiles, service.ProducerManifestFile{
+			Name: name, Size: int64(len(name)), SHA256: hex.EncodeToString(digest[:]),
+		})
+	}
+	manifestBytes, err := json.Marshal(service.ProducerManifest{
+		Schema:               service.ProducerManifestSchema,
+		ManifestSchema:       service.ProducerManifestSchema,
+		SchemaVersion:        service.ProducerManifestVersion,
+		Platform:             build.Platform,
+		AppName:              build.AppName,
+		OutputFilenames:      names,
+		SourceSHA:            build.BuildRef,
+		WorkflowSHA:          build.GithubRef,
+		WorkflowRef:          build.WorkflowSelector,
+		Version:              build.Version,
+		SourceTreeSHA:        strings.Repeat("c", 40),
+		Submodules:           []service.ProducerManifestSubmodule{},
+		DigestScope:          service.ProducerManifestDigestScope,
+		VerificationScope:    service.ProducerManifestVerificationScope,
+		VerificationResult:   service.ProducerManifestVerificationResult,
+		PublicationTimestamp: 1700000000,
+		HandoffContract:      service.ProducerManifestHandoffContract,
+		Files:                manifestFiles,
+		PrivateFilenames:     []string{"custom_.txt"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	archive := makeArtifactZip(t, map[string]string{
+		"manifest.txt": string(manifestBytes),
+		names[0]:       contents[names[0]],
+		names[1]:       contents[names[1]],
+		names[2]:       contents[names[2]],
+		names[3]:       contents[names[3]],
+		names[4]:       contents[names[4]],
+		names[5]:       contents[names[5]],
+		"custom_.txt":  "private settings",
+	})
+	archiveReader, err := zip.OpenReader(archive)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer archiveReader.Close()
+	staging := t.TempDir()
+	if _, parsed, err := extractValidatedArtifact(archiveReader, staging, build); err != nil {
+		t.Fatalf("extractValidatedArtifact() bridge error = %v", err)
+	} else if parsed.Platform != "bridge" {
+		t.Fatalf("parsed bridge manifest platform = %q", parsed.Platform)
+	}
+	for _, name := range names {
+		if _, err := os.Stat(filepath.Join(staging, filepath.FromSlash(name))); err != nil {
+			t.Fatalf("nested bridge output %q was not extracted: %v", name, err)
+		}
+	}
+	if contents, err := os.ReadFile(filepath.Join(staging, "custom_.txt")); err != nil || string(contents) != "private settings" {
+		t.Fatalf("private custom_.txt = %q, err=%v; want extracted private file", contents, err)
+	}
+}
+
+func TestExtractValidatedArtifactRejectsTraversalOutsideStaging(t *testing.T) {
+	archive := makeArtifactZip(t, map[string]string{
+		"../escape.txt": "must not be written",
+	})
+	archiveReader, err := zip.OpenReader(archive)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer archiveReader.Close()
+
+	staging := t.TempDir()
+	build := &model.CustomBuild{
+		Platform: "bridge",
+		AppName:  "rustdesk-bridge",
+	}
+	if _, _, err := extractValidatedArtifact(archiveReader, staging, build); err == nil {
+		t.Fatal("extractValidatedArtifact() error = nil, want traversal rejection")
+	}
+	if _, err := os.Stat(filepath.Join(filepath.Dir(staging), "escape.txt")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("traversal destination stat = %v, want absent", err)
+	}
+	entries, err := os.ReadDir(staging)
+	if err != nil {
+		t.Fatalf("read staging directory: %v", err)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("staging entries = %v, want no extracted files", entries)
+	}
+}
+
+func TestPublishDownloadedArtifactEnforcesDecompressionSafetyLimits(t *testing.T) {
+	previousEntries := artifactMaxZipEntries
+	previousFileBytes := artifactMaxFileBytes
+	previousAggregate := artifactMaxAggregateBytes
+	previousRatio := artifactMaxCompressionRatio
+	t.Cleanup(func() {
+		artifactMaxZipEntries = previousEntries
+		artifactMaxFileBytes = previousFileBytes
+		artifactMaxAggregateBytes = previousAggregate
+		artifactMaxCompressionRatio = previousRatio
+	})
+
+	cases := []struct {
+		name      string
+		files     map[string]string
+		entries   int64
+		fileBytes uint64
+		total     uint64
+		ratio     uint64
+	}{
+		{name: "entry limit", files: map[string]string{"rustqs.exe": "one", "custom_.txt": "two"}, entries: 1, fileBytes: 64, total: 128, ratio: 1000},
+		{name: "per-file limit", files: map[string]string{"rustqs.exe": "12345"}, entries: 8, fileBytes: 4, total: 128, ratio: 1000},
+		{name: "aggregate limit", files: map[string]string{"rustqs.exe": "1234", "custom_.txt": "5678"}, entries: 8, fileBytes: 64, total: 7, ratio: 1000},
+		{name: "compression ratio", files: map[string]string{"rustqs.exe": strings.Repeat("x", 4096)}, entries: 8, fileBytes: 8192, total: 8192, ratio: 1},
+	}
+	for index, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			withTestOutputRoot(t)
+			artifactMaxZipEntries = tc.entries
+			artifactMaxFileBytes = tc.fileBytes
+			artifactMaxAggregateBytes = tc.total
+			artifactMaxCompressionRatio = tc.ratio
+			build := &model.CustomBuild{IdModel: model.IdModel{Id: uint(120 + index)}, Platform: "windows", AppName: "rustqs"}
+			archive := makeArtifactZip(t, tc.files)
+			if _, err := publishDownloadedArtifact(build, archive); err == nil {
+				t.Fatal("publishDownloadedArtifact() error = nil, want decompression safety rejection")
+			}
+			if _, err := os.Stat(customBuildOutputDir(build.Id)); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("final output stat = %v, want no output", err)
+			}
+		})
+	}
+}
+
+func TestPublishDownloadedArtifactRejectsUnprovenExistingOutputAndPreservesSiblingStaging(t *testing.T) {
+	root := withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 130}, Platform: "windows", AppName: "rustqs"}
+	parent := filepath.Dir(customBuildOutputDir(build.Id))
+	stale := filepath.Join(parent, fmt.Sprintf(".%d-artifact-stale", build.Id))
+	if err := os.MkdirAll(stale, 0755); err != nil {
+		t.Fatalf("create stale staging: %v", err)
+	}
+	first := makeArtifactZip(t, map[string]string{"rustqs.exe": "old"})
+	if _, err := publishDownloadedArtifact(build, first); err != nil {
+		t.Fatalf("initial publish: %v", err)
+	}
+	second := makeArtifactZip(t, map[string]string{"rustqs.exe": "new"})
+	if _, err := publishDownloadedArtifact(build, second); err == nil {
+		t.Fatal("duplicate publish succeeded without stored publication proof")
+	}
+	contents, err := os.ReadFile(filepath.Join(customBuildOutputDir(build.Id), "rustqs.exe"))
+	if err != nil || string(contents) != "old" {
+		t.Fatalf("reused output = %q, err=%v; existing output must not be replaced", contents, err)
+	}
+	if _, err := os.Stat(stale); err != nil {
+		t.Fatalf("sibling staging stat = %v, want preserved", err)
+	}
+	_ = root
+}
+
+func TestPublishDownloadedArtifactRejectsUnvalidatedLinuxAndroidCapability(t *testing.T) {
+	for _, platform := range []string{"linux", "android"} {
+		t.Run(platform, func(t *testing.T) {
+			root := withTestOutputRoot(t)
+			build := &model.CustomBuild{IdModel: model.IdModel{Id: 100}, Platform: platform, AppName: "rustqs"}
+			archive := makeArtifactZip(t, map[string]string{"nested/binary": "binary", "custom_.txt": "settings"})
+			if _, err := publishDownloadedArtifact(build, archive); err == nil || !strings.Contains(err.Error(), "production capability") {
+				t.Fatalf("publishDownloadedArtifact() error = %v, want explicit capability-unavailable error", err)
+			}
+			outDir := filepath.Join(root, "output", "100")
+			if _, err := os.Stat(outDir); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("unvalidated platform output stat = %v, want absent", err)
+			}
+		})
+	}
+}
+
+func TestDownloadByKeyBuildsArchiveBeforeSendingSuccessHeaders(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousLogger := global.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:                model.CustomBuildStatusDone,
+		Platform:              "windows",
+		AppName:               "rustqs",
+		DownloadKey:           "download-key",
+		Version:               "1.2.3",
+		BuildRef:              strings.Repeat("a", 40),
+		SourceTag:             "1.2.3",
+		AssetsRelease:         "offline-assets-1.2.3",
+		AssetsReleaseID:       12,
+		GithubRunId:           901,
+		GithubProvider:        "github",
+		GithubRepo:            "owner/repo",
+		GithubWorkflow:        "workflow.yml",
+		GithubRef:             strings.Repeat("a", 40),
+		GithubArtifactName:    "artifact",
+		GithubArtifactID:      42,
+		PublicationRecordedAt: 1,
+		GithubRunUrl:          "https://api.github.com/repos/owner/repo/actions/runs/901",
+		GithubHtmlUrl:         "https://github.com/owner/repo/actions/runs/901",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("binary"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	markPublishedDigest(t, db, build)
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/download/download-key", nil)
+	c.Params = gin.Params{{Key: "key", Value: "download-key"}}
+	(&CustomBuild{}).DownloadByKey(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("DownloadByKey() status = %d, want 200; body=%s", recorder.Code, recorder.Body.String())
+	}
+	if got := recorder.Header().Get("Content-Length"); got != fmt.Sprint(recorder.Body.Len()) {
+		t.Fatalf("DownloadByKey() Content-Length = %q, want full response length %d", got, recorder.Body.Len())
+	}
+	archiveHash := sha256.Sum256(recorder.Body.Bytes())
+	if got := recorder.Header().Get("X-DeskForge-Archive-SHA256"); got != hex.EncodeToString(archiveHash[:]) {
+		t.Fatalf("archive SHA header = %q, want hash of served redacted bytes %x", got, archiveHash)
+	}
+	if got := recorder.Header().Get("X-DeskForge-Archive-SHA256-Scope"); got != downloadArchiveDigestScope {
+		t.Fatalf("archive SHA scope = %q, want %q", got, downloadArchiveDigestScope)
+	}
+	reader, err := zip.NewReader(bytes.NewReader(recorder.Body.Bytes()), int64(recorder.Body.Len()))
+	if err != nil {
+		t.Fatalf("downloaded response is not a ZIP: %v", err)
+	}
+	if len(reader.File) != 1 || reader.File[0].Name != "rustqs.exe" {
+		t.Fatalf("downloaded ZIP entries = %#v, want rustqs.exe", reader.File)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("mutated"), 0600); err != nil {
+		t.Fatalf("mutate published output: %v", err)
+	}
+	mutatedRecorder := httptest.NewRecorder()
+	mutatedContext, _ := gin.CreateTestContext(mutatedRecorder)
+	mutatedContext.Request = httptest.NewRequest(http.MethodGet, "/download/download-key", nil)
+	mutatedContext.Params = gin.Params{{Key: "key", Value: "download-key"}}
+	(&CustomBuild{}).DownloadByKey(mutatedContext)
+	if mutatedRecorder.Code != http.StatusConflict {
+		t.Fatalf("mutated DownloadByKey() status = %d, want 409; body=%s", mutatedRecorder.Code, mutatedRecorder.Body.String())
+	}
+	_ = root
+}
+
+func TestDownloadByKeyRejectsRangeBeforeServingDigestHeaders(t *testing.T) {
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/download/any-key", nil)
+	c.Request.Header.Set("Range", "bytes=0-15")
+	c.Params = gin.Params{{Key: "key", Value: "any-key"}}
+
+	(&CustomBuild{}).DownloadByKey(c)
+	if recorder.Code != http.StatusRequestedRangeNotSatisfiable {
+		t.Fatalf("DownloadByKey() range status = %d, want 416; body=%s", recorder.Code, recorder.Body.String())
+	}
+	if strings.HasPrefix(recorder.Header().Get("Content-Type"), "application/zip") {
+		t.Fatalf("range rejection committed ZIP content type: %q", recorder.Header().Get("Content-Type"))
+	}
+	for _, header := range []string{"Content-Length", "X-DeskForge-Archive-SHA256", "X-DeskForge-Archive-SHA256-Scope"} {
+		if got := recorder.Header().Get(header); got != "" {
+			t.Fatalf("range rejection set %s = %q", header, got)
+		}
+	}
+}
+
+func TestDetailByKeyRedactsCapabilityKey(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousLogger := global.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:                model.CustomBuildStatusDone,
+		Platform:              "windows",
+		AppName:               "rustqs",
+		Name:                  "public build",
+		DownloadKey:           "capability-secret",
+		DownloadKeyExpiresAt:  time.Now().Add(time.Hour).Unix(),
+		Version:               "1.2.3",
+		CustomJson:            `{"enable_audio":true,"permanent_password":"private-build-secret"}`,
+		BuildRef:              strings.Repeat("a", 40),
+		SourceTag:             "1.2.3",
+		AssetsRelease:         "offline-assets-1.2.3",
+		AssetsReleaseID:       12,
+		GithubRunId:           901,
+		GithubProvider:        "github",
+		GithubRepo:            "owner/repo",
+		GithubWorkflow:        "workflow.yml",
+		GithubRef:             strings.Repeat("a", 40),
+		GithubArtifactName:    "artifact",
+		GithubArtifactID:      42,
+		PublicationRecordedAt: 1,
+		GithubRunUrl:          "https://api.github.com/repos/owner/repo/actions/runs/901",
+		GithubHtmlUrl:         "https://github.com/owner/repo/actions/runs/901",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("binary"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	markPublishedDigest(t, db, build)
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/detail/capability-secret", nil)
+	c.Params = gin.Params{{Key: "key", Value: "capability-secret"}}
+	(&CustomBuild{}).DetailByKey(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("DetailByKey() status = %d, want 200; body=%s", recorder.Code, recorder.Body.String())
+	}
+	body := recorder.Body.String()
+	for _, forbidden := range []string{
+		"capability-secret", "private-build-secret", "private build log", `"download_key"`, `"user_id"`,
+		`"github_run_id"`, `"github_provider"`, `"github_repo"`, `"github_workflow"`,
+		`"github_ref"`, `"github_artifact_name"`, `"github_artifact_id"`, `"github_run_url"`,
+		`"github_html_url"`, `"github_source_sha"`,
+	} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("DetailByKey() exposed %q: %s", forbidden, body)
+		}
+	}
+	for _, expected := range []string{`"name":"public build"`, `"version":"1.2.3"`, `"download_key_expires_at"`} {
+		if !strings.Contains(body, expected) {
+			t.Fatalf("DetailByKey() omitted %q: %s", expected, body)
+		}
+	}
+	_ = root
+}
+
+func TestBuildDownloadArchiveRedactsOrOmitsCustomTxt(t *testing.T) {
+	cases := []struct {
+		name          string
+		customPayload string
+		wantCustom    bool
+	}{
+		{
+			name: "safe native settings",
+			customPayload: base64.StdEncoding.EncodeToString([]byte(
+				`{"conn-type":"outgoing","password":"password-secret","default-settings":{"allow-hide-cm":"Y","verification-method":"use-permanent-password","enable-audio":"Y"}}`,
+			)),
+			wantCustom: true,
+		},
+		{
+			name:          "malformed payload omitted",
+			customPayload: base64.StdEncoding.EncodeToString([]byte("not-json")),
+		},
+	}
+	for _, test := range cases {
+		t.Run(test.name, func(t *testing.T) {
+			withTestOutputRoot(t)
+			build := &model.CustomBuild{IdModel: model.IdModel{Id: 200}, Platform: "windows", AppName: "rustqs"}
+			dir := customBuildOutputDir(build.Id)
+			if err := os.MkdirAll(dir, 0700); err != nil {
+				t.Fatalf("create output: %v", err)
+			}
+			if err := os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte("binary"), 0600); err != nil {
+				t.Fatalf("write executable: %v", err)
+			}
+			if err := os.WriteFile(filepath.Join(dir, "custom_.txt"), []byte(test.customPayload), 0600); err != nil {
+				t.Fatalf("write custom_.txt: %v", err)
+			}
+			archivePath, _, err := buildDownloadArchive(context.Background(), build)
+			if err != nil {
+				t.Fatalf("buildDownloadArchive() error = %v", err)
+			}
+			defer cleanupArtifactArchive(build.Id, archivePath)
+			archive, err := zip.OpenReader(archivePath)
+			if err != nil {
+				t.Fatalf("open public archive: %v", err)
+			}
+			defer archive.Close()
+			entries := make(map[string]string, len(archive.File))
+			for _, entry := range archive.File {
+				reader, readErr := entry.Open()
+				if readErr != nil {
+					t.Fatalf("open archive entry %q: %v", entry.Name, readErr)
+				}
+				contents, readErr := io.ReadAll(reader)
+				closeErr := reader.Close()
+				if readErr != nil || closeErr != nil {
+					t.Fatalf("read archive entry %q: read=%v close=%v", entry.Name, readErr, closeErr)
+				}
+				entries[entry.Name] = string(contents)
+			}
+			if entries["rustqs.exe"] != "binary" {
+				t.Fatalf("public executable = %q, want binary", entries["rustqs.exe"])
+			}
+			publicCustom, exists := entries["custom_.txt"]
+			if exists != test.wantCustom {
+				t.Fatalf("public custom_.txt presence = %v, want %v; entries=%v", exists, test.wantCustom, entries)
+			}
+			if exists {
+				decoded, decodeErr := base64.StdEncoding.DecodeString(publicCustom)
+				if decodeErr != nil {
+					t.Fatalf("public custom_.txt is not base64: %v", decodeErr)
+				}
+				var public map[string]any
+				if err := json.Unmarshal(decoded, &public); err != nil {
+					t.Fatalf("public custom_.txt is not JSON: %v", err)
+				}
+				if public["conn-type"] != "outgoing" || strings.Contains(string(decoded), "password-secret") || strings.Contains(string(decoded), "allow-hide-cm") {
+					t.Fatalf("public custom_.txt leaked private settings: %s", decoded)
+				}
+			}
+		})
+	}
+}
+
+func TestBuildDownloadArchiveIsDeterministicWithPublicCustomTxt(t *testing.T) {
+	withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 201}, Platform: "windows", AppName: "rustqs"}
+	dir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte("binary"), 0600); err != nil {
+		t.Fatalf("write executable: %v", err)
+	}
+	raw := base64.StdEncoding.EncodeToString([]byte(`{"conn-type":"incoming","default-settings":{"theme":"dark","enable-audio":"Y"}}`))
+	if err := os.WriteFile(filepath.Join(dir, "custom_.txt"), []byte(raw), 0600); err != nil {
+		t.Fatalf("write custom_.txt: %v", err)
+	}
+	firstPath, _, err := buildDownloadArchive(context.Background(), build)
+	if err != nil {
+		t.Fatalf("first buildDownloadArchive() error = %v", err)
+	}
+	first, err := os.ReadFile(firstPath)
+	if err != nil {
+		t.Fatalf("read first archive: %v", err)
+	}
+	cleanupArtifactArchive(build.Id, firstPath)
+	secondPath, _, err := buildDownloadArchive(context.Background(), build)
+	if err != nil {
+		t.Fatalf("second buildDownloadArchive() error = %v", err)
+	}
+	second, err := os.ReadFile(secondPath)
+	if err != nil {
+		t.Fatalf("read second archive: %v", err)
+	}
+	cleanupArtifactArchive(build.Id, secondPath)
+	if !bytes.Equal(first, second) {
+		t.Fatalf("repeated public archives differ: first sha=%x second sha=%x", sha256.Sum256(first), sha256.Sum256(second))
+	}
+}
+
+func TestDownloadByKeyRejectsDoneLegacyBuildBeforePackaging(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousLogger := global.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:      model.CustomBuildStatusDone,
+		AppName:     "rustqs",
+		DownloadKey: "legacy-download-key",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create legacy build: %v", err)
+	}
+	outDir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("legacy output"), 0600); err != nil {
+		t.Fatalf("write legacy output: %v", err)
+	}
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/download/legacy-download-key", nil)
+	c.Params = gin.Params{{Key: "key", Value: "legacy-download-key"}}
+	(&CustomBuild{}).DownloadByKey(c)
+	if recorder.Code != http.StatusConflict {
+		t.Fatalf("DownloadByKey() status = %d, want 409; body=%s", recorder.Code, recorder.Body.String())
+	}
+	if got := recorder.Header().Get("Content-Type"); strings.HasPrefix(got, "application/zip") {
+		t.Fatalf("legacy DownloadByKey() committed ZIP headers: %q", got)
+	}
+	_ = root
+}
+
+func TestDetailByKeyRejectsUnmarkedDoneBuild(t *testing.T) {
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousLogger := global.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusDone,
+		DownloadKey:        "detail-unmarked-key",
+		Version:            "1.2.3",
+		BuildRef:           strings.Repeat("a", 40),
+		SourceTag:          "1.2.3",
+		AssetsRelease:      "offline-assets-1.2.3",
+		AssetsReleaseID:    12,
+		GithubRunId:        901,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "workflow.yml",
+		GithubRef:          strings.Repeat("a", 40),
+		GithubArtifactName: "artifact",
+		GithubArtifactID:   42,
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/901",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/901",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/detail/detail-unmarked-key", nil)
+	c.Params = gin.Params{{Key: "key", Value: "detail-unmarked-key"}}
+	(&CustomBuild{}).DetailByKey(c)
+	if recorder.Code != http.StatusConflict {
+		t.Fatalf("DetailByKey() status = %d, want 409; body=%s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestDetailByKeyRejectsDoneBuildAfterPublishedOutputMutation(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousLogger := global.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:                model.CustomBuildStatusDone,
+		AppName:               "rustqs",
+		DownloadKey:           "detail-mutated-key",
+		Version:               "1.2.3",
+		BuildRef:              strings.Repeat("a", 40),
+		SourceTag:             "1.2.3",
+		AssetsRelease:         "offline-assets-1.2.3",
+		AssetsReleaseID:       12,
+		GithubRunId:           902,
+		GithubProvider:        "github",
+		GithubRepo:            "owner/repo",
+		GithubWorkflow:        "workflow.yml",
+		GithubRef:             strings.Repeat("a", 40),
+		GithubArtifactName:    "artifact",
+		GithubArtifactID:      42,
+		PublicationRecordedAt: 1,
+		GithubRunUrl:          "https://api.github.com/repos/owner/repo/actions/runs/902",
+		GithubHtmlUrl:         "https://github.com/owner/repo/actions/runs/902",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	outputPath := filepath.Join(outDir, "rustqs.exe")
+	if err := os.WriteFile(outputPath, []byte("published"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	markPublishedDigest(t, db, build)
+	if err := os.WriteFile(outputPath, []byte("mutated"), 0600); err != nil {
+		t.Fatalf("mutate output: %v", err)
+	}
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/detail/detail-mutated-key", nil)
+	c.Params = gin.Params{{Key: "key", Value: "detail-mutated-key"}}
+	(&CustomBuild{}).DetailByKey(c)
+	if recorder.Code != http.StatusConflict {
+		t.Fatalf("DetailByKey() status = %d, want 409; body=%s", recorder.Code, recorder.Body.String())
+	}
+	_ = root
+}
+
+func TestDownloadByKeyReturnsServerErrorBeforeHeadersWhenPackagingFails(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousLogger := global.DB, global.Logger
+	global.DB = db
+	global.Logger = logrus.New()
+	t.Cleanup(func() {
+		global.DB = previousDB
+		global.Logger = previousLogger
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:                model.CustomBuildStatusDone,
+		Platform:              "windows",
+		AppName:               "rustqs",
+		DownloadKey:           "broken-key",
+		Version:               "1.2.3",
+		BuildRef:              strings.Repeat("a", 40),
+		SourceTag:             "1.2.3",
+		AssetsRelease:         "offline-assets-1.2.3",
+		AssetsReleaseID:       12,
+		GithubRunId:           901,
+		GithubProvider:        "github",
+		GithubRepo:            "owner/repo",
+		GithubWorkflow:        "workflow.yml",
+		GithubRef:             strings.Repeat("a", 40),
+		GithubArtifactName:    "artifact",
+		GithubArtifactID:      42,
+		PublicationRecordedAt: 1,
+		GithubRunUrl:          "https://api.github.com/repos/owner/repo/actions/runs/901",
+		GithubHtmlUrl:         "https://github.com/owner/repo/actions/runs/901",
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("binary"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	markPublishedDigest(t, db, build)
+	if err := os.Symlink(filepath.Join(outDir, "missing"), filepath.Join(outDir, "broken.bin")); err != nil {
+		t.Fatalf("create broken source symlink: %v", err)
+	}
+
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/download/broken-key", nil)
+	c.Params = gin.Params{{Key: "key", Value: "broken-key"}}
+	(&CustomBuild{}).DownloadByKey(c)
+	if recorder.Code != http.StatusConflict {
+		t.Fatalf("DownloadByKey() status = %d, want 409; body=%s", recorder.Code, recorder.Body.String())
+	}
+	if got := recorder.Header().Get("Content-Type"); strings.HasPrefix(got, "application/zip") {
+		t.Fatalf("packaging failure committed ZIP headers: %q", got)
+	}
+	_ = root
+}
+
+func TestArtifactCleanupRetryExhaustionReleasesTempProtection(t *testing.T) {
+	root := t.TempDir()
+	archivePath := filepath.Join(root, "deskforge-artifact-abcdef.zip")
+	if err := os.WriteFile(archivePath, []byte("stale"), 0600); err != nil {
+		t.Fatalf("create archive: %v", err)
+	}
+	service.ProtectGithubArtifactTemp(archivePath)
+	previousRemove := removeArtifactArchive
+	previousDelay := artifactCleanupRetryDelay
+	removeArtifactArchive = func(string) error { return errors.New("cleanup unavailable") }
+	artifactCleanupRetryDelay = 0
+	t.Cleanup(func() {
+		removeArtifactArchive = previousRemove
+		artifactCleanupRetryDelay = previousDelay
+		service.ReleaseGithubArtifactTemp(archivePath)
+	})
+
+	cleanupArtifactArchive(7, archivePath)
+	deadline := time.Now().Add(time.Second)
+	for time.Now().Before(deadline) {
+		if err := service.SweepGithubArtifactTemps(root, time.Now().Add(2*time.Hour), time.Hour); err == nil {
+			if _, statErr := os.Stat(archivePath); errors.Is(statErr, os.ErrNotExist) {
+				return
+			}
+		}
+		time.Sleep(time.Millisecond)
+	}
+	t.Fatal("cleanup retry exhaustion left provider temp protected from TTL sweep")
+}
+
+func TestBuildDownloadArchiveEnforcesOutputFileAndContextBounds(t *testing.T) {
+	previousMaxBytes, previousMaxFiles := downloadArchiveMaxOutputBytes, downloadArchiveMaxFiles
+	previousMaxFileBytes, previousMaxSourceBytes := downloadArchiveMaxFileBytes, downloadArchiveMaxSourceBytes
+	t.Cleanup(func() {
+		downloadArchiveMaxOutputBytes = previousMaxBytes
+		downloadArchiveMaxFiles = previousMaxFiles
+		downloadArchiveMaxFileBytes = previousMaxFileBytes
+		downloadArchiveMaxSourceBytes = previousMaxSourceBytes
+	})
+	withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 7}, Platform: "linux", AppName: "rustqs"}
+	dir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "a.bin"), []byte("aa"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "b.bin"), []byte("bb"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	downloadArchiveMaxFiles = 1
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil || !strings.Contains(err.Error(), "too many files") {
+		t.Fatalf("file-count bound error = %v, want too-many-files rejection", err)
+	}
+	downloadArchiveMaxFiles = 4096
+	downloadArchiveMaxOutputBytes = 16
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil || !strings.Contains(err.Error(), "exceeds limit") {
+		t.Fatalf("archive-size bound error = %v, want output-limit rejection", err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, _, err := buildDownloadArchive(ctx, build); !errors.Is(err, context.Canceled) {
+		t.Fatalf("cancelled archive error = %v, want context cancellation", err)
+	}
+
+	downloadArchiveMaxOutputBytes = 1 << 20
+	downloadArchiveMaxFileBytes = 1
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil || !strings.Contains(err.Error(), "uncompressed limit") {
+		t.Fatalf("per-file source bound error = %v, want uncompressed-limit rejection", err)
+	}
+	downloadArchiveMaxFileBytes = 1 << 20
+	downloadArchiveMaxSourceBytes = 1
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil || !strings.Contains(err.Error(), "uncompressed limit") {
+		t.Fatalf("aggregate source bound error = %v, want uncompressed-limit rejection", err)
+	}
+}
+
+func TestBuildDownloadArchiveRevalidatesMissingOrMutatedOutput(t *testing.T) {
+	withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 8}, Platform: "linux"}
+	dir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "binary"), []byte("safe"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	if err := os.Remove(filepath.Join(dir, "binary")); err != nil {
+		t.Fatalf("remove output: %v", err)
+	}
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil {
+		t.Fatal("buildDownloadArchive() error = nil for missing output")
+	}
+	if err := os.Symlink(filepath.Join(dir, "missing"), filepath.Join(dir, "binary")); err != nil {
+		t.Fatalf("create mutated output symlink: %v", err)
+	}
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil {
+		t.Fatal("buildDownloadArchive() error = nil for unsafe mutated output")
+	}
+}
+
+func TestBuildDownloadArchiveUsesOneBoundedSnapshotAndRejectsMutation(t *testing.T) {
+	withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 9}, Platform: "linux", AppName: "rustqs"}
+	dir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "artifact.bin"), []byte("before"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	previousHook := downloadArchiveSnapshotHook
+	downloadArchiveSnapshotHook = func() {
+		if err := os.WriteFile(filepath.Join(dir, "artifact.bin"), []byte("after"), 0600); err != nil {
+			t.Fatalf("mutate output after snapshot: %v", err)
+		}
+	}
+	t.Cleanup(func() { downloadArchiveSnapshotHook = previousHook })
+	if _, _, err := buildDownloadArchive(context.Background(), build); err == nil || !strings.Contains(err.Error(), "changed during archive packaging") {
+		t.Fatalf("buildDownloadArchive() error = %v, want canonical digest mutation rejection", err)
+	}
+}
+
+func TestCollectDownloadSnapshotUsesRestrictedServiceOwnedLifecycle(t *testing.T) {
+	root := withTestOutputRoot(t)
+	buildID := uint(11)
+	dir := filepath.Join(root, "output", fmt.Sprintf("%d", buildID))
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "artifact.bin"), []byte("snapshot"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	snapshotDir, files, err := collectDownloadSnapshot(context.Background(), dir, buildID)
+	if err != nil {
+		t.Fatalf("collectDownloadSnapshot() error = %v", err)
+	}
+	defer cleanupDownloadSnapshot(snapshotDir)
+	if filepath.Dir(snapshotDir) != filepath.Join(root, "output") {
+		t.Fatalf("snapshot directory = %q, want service-owned output parent", snapshotDir)
+	}
+	info, err := os.Stat(snapshotDir)
+	if err != nil {
+		t.Fatalf("stat snapshot directory: %v", err)
+	}
+	if info.Mode().Perm() != 0700 {
+		t.Fatalf("snapshot directory permissions = %o, want 700", info.Mode().Perm())
+	}
+	if len(files) != 1 {
+		t.Fatalf("snapshot files = %d, want 1", len(files))
+	}
+	fileInfo, err := os.Stat(files[0].path)
+	if err != nil {
+		t.Fatalf("stat snapshot file: %v", err)
+	}
+	if fileInfo.Mode().Perm() != 0600 {
+		t.Fatalf("snapshot file permissions = %o, want 600", fileInfo.Mode().Perm())
+	}
+}
+
+func TestBuildDownloadArchiveRemovesInterruptedSnapshot(t *testing.T) {
+	root := withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 12}, Platform: "linux", AppName: "rustqs"}
+	dir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "artifact.bin"), []byte("before"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	previousHook := downloadArchiveSnapshotHook
+	downloadArchiveSnapshotHook = cancel
+	t.Cleanup(func() { downloadArchiveSnapshotHook = previousHook })
+	if _, _, err := buildDownloadArchive(ctx, build); !errors.Is(err, context.Canceled) {
+		t.Fatalf("buildDownloadArchive() error = %v, want interrupted export cancellation", err)
+	}
+	matches, err := filepath.Glob(filepath.Join(root, "output", ".12-snapshot-*"))
+	if err != nil {
+		t.Fatalf("glob interrupted snapshots: %v", err)
+	}
+	if len(matches) != 0 {
+		t.Fatalf("interrupted snapshots remain after cleanup: %v", matches)
+	}
+}
+
+func TestBuildDownloadArchiveIsDeterministicForUnchangedOutput(t *testing.T) {
+	withTestOutputRoot(t)
+	build := &model.CustomBuild{IdModel: model.IdModel{Id: 10}, Platform: "linux", AppName: "rustqs"}
+	dir := customBuildOutputDir(build.Id)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatalf("create output: %v", err)
+	}
+	for name, contents := range map[string]string{"z.bin": "last", "a.bin": "first"} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(contents), 0600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+	firstPath, _, err := buildDownloadArchive(context.Background(), build)
+	if err != nil {
+		t.Fatalf("first buildDownloadArchive() error = %v", err)
+	}
+	first, err := os.ReadFile(firstPath)
+	if err != nil {
+		t.Fatalf("read first archive: %v", err)
+	}
+	if err := os.Remove(firstPath); err != nil {
+		t.Fatalf("remove first archive: %v", err)
+	}
+	secondPath, _, err := buildDownloadArchive(context.Background(), build)
+	if err != nil {
+		t.Fatalf("second buildDownloadArchive() error = %v", err)
+	}
+	second, err := os.ReadFile(secondPath)
+	if err != nil {
+		t.Fatalf("read second archive: %v", err)
+	}
+	if !bytes.Equal(first, second) {
+		t.Fatal("unchanged output produced different ZIP bytes")
+	}
+	if err := os.Remove(secondPath); err != nil {
+		t.Fatalf("remove second archive: %v", err)
+	}
+}
+
+func TestCopyDownloadSourceRejectsNoProgress(t *testing.T) {
+	noProgress := readerReturningNoProgress{}
+	if _, err := copyDownloadSource(context.Background(), io.Discard, noProgress); !errors.Is(err, io.ErrNoProgress) {
+		t.Fatalf("copyDownloadSource() error = %v, want io.ErrNoProgress", err)
+	}
+}
+
+type readerReturningNoProgress struct{}
+
+func (readerReturningNoProgress) Read([]byte) (int, error) { return 0, nil }
+
+func TestPollPublishesOnlyValidatedArtifactBeforeDone(t *testing.T) {
+	cases := []struct {
+		name       string
+		zipPayload []byte
+		wantStatus string
+		wantOutput bool
+	}{
+		{
+			name:       "successful output",
+			zipPayload: mustWindowsProducerArtifactZip(t, "exe"),
+			wantStatus: model.CustomBuildStatusDone,
+			wantOutput: true,
+		},
+		{
+			name:       "invalid ZIP stays non-done",
+			zipPayload: []byte("not a ZIP"),
+			wantStatus: model.CustomBuildStatusFailed,
+			wantOutput: false,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			root := withTestOutputRoot(t)
+			db, sqlDB := newAdminProvenanceDB(t)
+			previousDB, previousService := global.DB, service.AllService
+			previousServiceDB, previousLogger := service.DB, global.Logger
+			previousTransport := http.DefaultTransport
+			global.DB = db
+			global.Logger = logrus.New()
+			service.DB = db
+			service.AllService = &service.Service{
+				CustomBuildService:       &service.CustomBuildService{},
+				GithubBuildConfigService: &service.GithubBuildConfigService{},
+			}
+			http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				switch {
+				case req.URL.Path == "/repos/owner/repo/actions/runs/777":
+					return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"status":"completed","conclusion":"success","head_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`))}, nil
+				case req.URL.Path == "/repos/owner/repo/actions/runs/777/artifacts":
+					return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"artifacts":[{"id":42,"name":"artifact"}]}`))}, nil
+				case req.URL.Path == "/repos/owner/repo/actions/artifacts/42/zip":
+					return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(bytes.NewReader(tc.zipPayload))}, nil
+				default:
+					return &http.Response{StatusCode: http.StatusNotFound, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"message":"unexpected endpoint"}`))}, nil
+				}
+			})
+			t.Cleanup(func() {
+				http.DefaultTransport = previousTransport
+				global.DB = previousDB
+				global.Logger = previousLogger
+				service.DB = previousServiceDB
+				service.AllService = previousService
+				_ = sqlDB.Close()
+			})
+
+			build := &model.CustomBuild{
+				Status:             model.CustomBuildStatusBuilding,
+				Platform:           "windows",
+				AppName:            "rustqs",
+				Version:            "1.2.3",
+				BuildRef:           strings.Repeat("a", 40),
+				SourceTag:          "1.2.3",
+				AssetsRelease:      "offline-assets-1.2.3",
+				AssetsReleaseID:    12,
+				GithubRunId:        777,
+				GithubProvider:     "github",
+				GithubRepo:         "owner/repo",
+				GithubWorkflow:     "workflow.yml",
+				GithubRef:          strings.Repeat("a", 40),
+				GithubArtifactName: "artifact",
+				GithubArtifactID:   42,
+				GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/777",
+				GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/777",
+			}
+			prepareAdminBuildProvenance(build)
+			if err := db.Create(build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "token"}).Error; err != nil {
+				t.Fatalf("create GitHub config: %v", err)
+			}
+
+			currentTime := time.Now()
+			(&CustomBuild{}).pollAndDownloadWithClock(build.Id, build.GithubRunId, githubPollClock{
+				now:  func() time.Time { return currentTime },
+				wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+			})
+
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if stored.Status != tc.wantStatus {
+				t.Fatalf("stored status = %q, want %q", stored.Status, tc.wantStatus)
+			}
+			outDir := filepath.Join(root, "output", fmt.Sprintf("%d", build.Id))
+			_, outputErr := os.Stat(outDir)
+			if (outputErr == nil) != tc.wantOutput {
+				t.Fatalf("final output presence = %v, err=%v, want %v", outputErr == nil, outputErr, tc.wantOutput)
+			}
+			if entries, err := os.ReadDir(filepath.Dir(outDir)); err != nil && !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("read output parent: %v", err)
+			} else if !tc.wantOutput && len(entries) != 0 {
+				t.Fatalf("failed publication left output entries = %v", entries)
+			}
+		})
+	}
+}
+
+func TestPollCleanupFailureDoesNotFailPublishedBuild(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousService := global.DB, service.AllService
+	previousServiceDB, previousLogger := service.DB, global.Logger
+	previousTransport := http.DefaultTransport
+	previousRemove := removeArtifactArchive
+	previousSchedule := scheduleArtifactCleanupRetry
+	global.DB = db
+	global.Logger = logrus.New()
+	service.DB = db
+	service.AllService = &service.Service{
+		CustomBuildService:       &service.CustomBuildService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	var cleanupPath string
+	removeArtifactArchive = func(path string) error {
+		cleanupPath = path
+		return errors.New("simulated temporary cleanup failure")
+	}
+	scheduleArtifactCleanupRetry = func(_ uint, path string) {
+		cleanupPath = path
+	}
+	http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/actions/runs/778":
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"status":"completed","conclusion":"success","head_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`))}, nil
+		case "/repos/owner/repo/actions/runs/778/artifacts":
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"artifacts":[{"id":42,"name":"artifact"}]}`))}, nil
+		case "/repos/owner/repo/actions/artifacts/42/zip":
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(bytes.NewReader(mustWindowsProducerArtifactZip(t, "exe")))}, nil
+		default:
+			return &http.Response{StatusCode: http.StatusNotFound, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"message":"unexpected endpoint"}`))}, nil
+		}
+	})
+	t.Cleanup(func() {
+		if cleanupPath != "" {
+			_ = os.Remove(cleanupPath)
+		}
+		removeArtifactArchive = previousRemove
+		scheduleArtifactCleanupRetry = previousSchedule
+		http.DefaultTransport = previousTransport
+		global.DB = previousDB
+		global.Logger = previousLogger
+		service.DB = previousServiceDB
+		service.AllService = previousService
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusBuilding,
+		Platform:           "windows",
+		AppName:            "rustqs",
+		Version:            "1.2.3",
+		BuildRef:           strings.Repeat("a", 40),
+		SourceTag:          "1.2.3",
+		AssetsRelease:      "offline-assets-1.2.3",
+		AssetsReleaseID:    12,
+		GithubRunId:        778,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "workflow.yml",
+		GithubRef:          strings.Repeat("a", 40),
+		GithubArtifactName: "artifact",
+		GithubArtifactID:   42,
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/778",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/778",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "token"}).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+
+	currentTime := time.Now()
+	(&CustomBuild{}).pollAndDownloadWithClock(build.Id, build.GithubRunId, githubPollClock{
+		now:  func() time.Time { return currentTime },
+		wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+	})
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusDone {
+		t.Fatalf("cleanup failure changed status to %q, want done", stored.Status)
+	}
+	if cleanupPath == "" {
+		t.Fatal("cleanup failure did not schedule a retry")
+	}
+	if _, err := os.Stat(filepath.Join(root, "output", fmt.Sprintf("%d", build.Id), "rustqs.exe")); err != nil {
+		t.Fatalf("published output unavailable after cleanup failure: %v", err)
+	}
+}
+
+func TestPollRedownloadsExactArtifactForUnprovenExistingOutput(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousService := global.DB, service.AllService
+	previousServiceDB, previousLogger := service.DB, global.Logger
+	previousTransport := http.DefaultTransport
+	global.DB = db
+	global.Logger = logrus.New()
+	service.DB = db
+	service.AllService = &service.Service{
+		CustomBuildService:       &service.CustomBuildService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	artifactPayload := mustWindowsProducerArtifactZip(t, "provider-output")
+	artifactRequests := 0
+	http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch {
+		case req.URL.Path == "/repos/owner/repo/actions/runs/903":
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"status":"completed","conclusion":"success","head_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`))}, nil
+		case req.URL.Path == "/repos/owner/repo/actions/runs/903/artifacts":
+			artifactRequests++
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"artifacts":[{"id":42,"name":"artifact"}]}`))}, nil
+		case req.URL.Path == "/repos/owner/repo/actions/artifacts/42/zip":
+			artifactRequests++
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(bytes.NewReader(artifactPayload))}, nil
+		default:
+			return &http.Response{StatusCode: http.StatusNotFound, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"message":"unexpected endpoint"}`))}, nil
+		}
+	})
+	t.Cleanup(func() {
+		http.DefaultTransport = previousTransport
+		global.DB = previousDB
+		global.Logger = previousLogger
+		service.DB = previousServiceDB
+		service.AllService = previousService
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusBuilding,
+		Platform:           "windows",
+		AppName:            "rustqs",
+		Version:            "1.2.3",
+		BuildRef:           strings.Repeat("a", 40),
+		SourceTag:          "1.2.3",
+		AssetsRelease:      "offline-assets-1.2.3",
+		AssetsReleaseID:    12,
+		GithubRunId:        903,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "workflow.yml",
+		GithubRef:          strings.Repeat("a", 40),
+		GithubArtifactName: "artifact",
+		GithubArtifactID:   42,
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/903",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/903",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "token"}).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+	outDir := filepath.Join(root, "output", fmt.Sprintf("%d", build.Id))
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create unproven output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("stale-output"), 0600); err != nil {
+		t.Fatalf("write unproven output: %v", err)
+	}
+
+	currentTime := time.Now()
+	(&CustomBuild{}).pollAndDownloadWithClock(build.Id, build.GithubRunId, githubPollClock{
+		now:  func() time.Time { return currentTime },
+		wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+	})
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read recovered build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusDone || stored.PublicationRecordedAt <= 0 || stored.PublishedDigest == "" {
+		t.Fatalf("unproven recovery state = %#v, want done with publication proof", stored)
+	}
+	contents, err := os.ReadFile(filepath.Join(outDir, "rustqs.exe"))
+	if err != nil || string(contents) != "provider-output" {
+		t.Fatalf("recovered output = %q, err=%v; exact provider artifact was not republished", contents, err)
+	}
+	if artifactRequests != 2 {
+		t.Fatalf("provider artifact requests = %d, want exact list plus ZIP download", artifactRequests)
+	}
+}
+
+func TestPollRecoversValidFinalOutputBeforeProviderRedownload(t *testing.T) {
+	root := withTestOutputRoot(t)
+	db, sqlDB := newAdminProvenanceDB(t)
+	previousDB, previousService := global.DB, service.AllService
+	previousServiceDB, previousLogger := service.DB, global.Logger
+	previousTransport := http.DefaultTransport
+	global.DB = db
+	global.Logger = logrus.New()
+	service.DB = db
+	service.AllService = &service.Service{
+		CustomBuildService:       &service.CustomBuildService{},
+		GithubBuildConfigService: &service.GithubBuildConfigService{},
+	}
+	artifactRequests := 0
+	http.DefaultTransport = adminGithubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path == "/repos/owner/repo/actions/runs/779" {
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"status":"completed","conclusion":"success","head_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`))}, nil
+		}
+		artifactRequests++
+		return &http.Response{StatusCode: http.StatusInternalServerError, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"message":"artifact redownload must not happen"}`))}, nil
+	})
+	t.Cleanup(func() {
+		http.DefaultTransport = previousTransport
+		global.DB = previousDB
+		global.Logger = previousLogger
+		service.DB = previousServiceDB
+		service.AllService = previousService
+		_ = sqlDB.Close()
+	})
+
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusBuilding,
+		Platform:           "windows",
+		AppName:            "rustqs",
+		Version:            "1.2.3",
+		BuildRef:           strings.Repeat("a", 40),
+		SourceTag:          "1.2.3",
+		AssetsRelease:      "offline-assets-1.2.3",
+		AssetsReleaseID:    12,
+		GithubRunId:        779,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "workflow.yml",
+		GithubRef:          strings.Repeat("a", 40),
+		GithubArtifactName: "artifact",
+		GithubArtifactID:   42,
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/779",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/779",
+	}
+	prepareAdminBuildProvenance(build)
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "token"}).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+	outDir := filepath.Join(root, "output", fmt.Sprintf("%d", build.Id))
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create recovered output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("recovered"), 0600); err != nil {
+		t.Fatalf("write recovered output: %v", err)
+	}
+	if err := db.Model(&model.CustomBuild{}).Where("id = ?", build.Id).Updates(map[string]any{
+		"publication_recorded_at": 1,
+	}).Error; err != nil {
+		t.Fatalf("store recovered publication marker: %v", err)
+	}
+	markPublishedDigest(t, db, build)
+
+	currentTime := time.Now()
+	(&CustomBuild{}).pollAndDownloadWithClock(build.Id, build.GithubRunId, githubPollClock{
+		now:  func() time.Time { return currentTime },
+		wait: func(delay time.Duration) { currentTime = currentTime.Add(delay) },
+	})
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read recovered build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusDone || stored.FileSize != int64(len("recovered")) {
+		t.Fatalf("recovered build = %#v, want guarded done with existing size", stored)
+	}
+	if artifactRequests != 0 {
+		t.Fatalf("provider artifact requests = %d, want no redownload", artifactRequests)
+	}
+	contents, err := os.ReadFile(filepath.Join(outDir, "rustqs.exe"))
+	if err != nil || string(contents) != "recovered" {
+		t.Fatalf("recovered output changed: %q, err=%v", contents, err)
+	}
+}
+
+func mustArtifactZip(t *testing.T, files map[string]string) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	for name, contents := range files {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatalf("create ZIP entry %q: %v", name, err)
+		}
+		if _, err := w.Write([]byte(contents)); err != nil {
+			t.Fatalf("write ZIP entry %q: %v", name, err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatalf("close ZIP: %v", err)
+	}
+	return buf.Bytes()
+}
+
+func mustWindowsProducerArtifactZip(t *testing.T, contents string) []byte {
+	t.Helper()
+	return mustArtifactZip(t, map[string]string{
+		"rustqs.exe":   contents,
+		"manifest.txt": producerManifestBytes(t, contents),
+	})
+}
+
+func producerManifestBytes(t *testing.T, contents string) string {
+	t.Helper()
+	digest := sha256.Sum256([]byte(contents))
+	manifest := service.ProducerManifest{
+		Schema:               service.ProducerManifestSchema,
+		ManifestSchema:       service.ProducerManifestSchema,
+		SchemaVersion:        service.ProducerManifestVersion,
+		Platform:             "windows",
+		AppName:              "rustqs",
+		OutputFilenames:      []string{"rustqs.exe"},
+		SourceSHA:            strings.Repeat("a", 40),
+		WorkflowSHA:          strings.Repeat("a", 40),
+		WorkflowRef:          "rustqs/workflows",
+		Version:              "1.2.3",
+		SourceTreeSHA:        strings.Repeat("c", 40),
+		Submodules:           []service.ProducerManifestSubmodule{},
+		DigestScope:          service.ProducerManifestDigestScope,
+		VerificationScope:    service.ProducerManifestVerificationScope,
+		VerificationResult:   service.ProducerManifestVerificationResult,
+		PublicationTimestamp: 1700000000,
+		HandoffContract:      service.ProducerManifestHandoffContract,
+		Files:                []service.ProducerManifestFile{{Name: "rustqs.exe", Size: int64(len(contents)), SHA256: hex.EncodeToString(digest[:])}},
+	}
+	manifestBytes, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatalf("marshal producer manifest: %v", err)
+	}
+	return string(manifestBytes)
+}
+
+func activeWindowsBuild(id uint) *model.CustomBuild {
+	return &model.CustomBuild{
+		IdModel:          model.IdModel{Id: id},
+		Platform:         "windows",
+		AppName:          "rustqs",
+		Version:          "1.2.3",
+		BuildRef:         strings.Repeat("a", 40),
+		WorkflowSelector: "rustqs/workflows",
+		GithubRef:        strings.Repeat("a", 40),
+		GithubSourceSha:  strings.Repeat("a", 40),
+		GithubRunId:      1,
+	}
+}
+
+func markPublishedDigest(t *testing.T, db *gorm.DB, build *model.CustomBuild) {
+	t.Helper()
+	digest, err := service.PublishedOutputDigest(build)
+	if err != nil {
+		t.Fatalf("compute published digest: %v", err)
+	}
+	build.PublishedDigest = digest
+	if err := db.Model(&model.CustomBuild{}).Where("id = ?", build.Id).Update("published_digest", digest).Error; err != nil {
+		t.Fatalf("store published digest: %v", err)
+	}
+}
diff --git a/api/http/controller/admin/tag.go b/api/http/controller/admin/tag.go
index d46fa20..e81d273 100644
--- a/api/http/controller/admin/tag.go
+++ b/api/http/controller/admin/tag.go
@@ -47,7 +47,7 @@ func (ct *Tag) Detail(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.TagForm true ""
+// @Param body body admin.TagForm true "Tag form payload"
 // @Success 200 {object} response.Response{data=model.Tag}
 // @Failure 500 {object} response.Response
 // @Router /admin/tag/create [post]
@@ -82,9 +82,9 @@ func (ct *Tag) Create(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param is_my query int false ""
+// @Param page query int false "Page number for the tag list"
+// @Param page_size query int false "Number of tags per page"
+// @Param is_my query int false "Filter for tags owned by the current user"
 // @Param user_id query int false "id"
 // @Success 200 {object} response.Response{data=model.TagList}
 // @Failure 500 {object} response.Response
@@ -116,7 +116,7 @@ func (ct *Tag) List(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.TagForm true ""
+// @Param body body admin.TagForm true "Tag update form payload"
 // @Success 200 {object} response.Response{data=model.Tag}
 // @Failure 500 {object} response.Response
 // @Router /admin/tag/update [post]
@@ -156,7 +156,7 @@ func (ct *Tag) Update(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body admin.TagForm true ""
+// @Param body body admin.TagForm true "Tag deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/tag/delete [post]
diff --git a/api/http/controller/admin/user.go b/api/http/controller/admin/user.go
index dcc3f4c..69ba303 100644
--- a/api/http/controller/admin/user.go
+++ b/api/http/controller/admin/user.go
@@ -1,7 +1,8 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
@@ -9,7 +10,6 @@ import (
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
 	"rustdesk-server/api/utils"
-	"gorm.io/gorm"
 	"strconv"
 	"strings"
 )
@@ -17,10 +17,10 @@ import (
 type User struct {
 }
 
-// Detail 
-// @Tags 
-// @Summary 
-// @Description 
+// Detail
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param id path int true "ID"
@@ -40,13 +40,13 @@ func (ct *User) Detail(c *gin.Context) {
 	return
 }
 
-// Create 
-// @Tags 
-// @Summary 
-// @Description 
+// Create
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.UserForm true ""
+// @Param body body admin.UserForm true "User form payload"
 // @Success 200 {object} response.Response{data=model.User}
 // @Failure 500 {object} response.Response
 // @Router /admin/user/create [post]
@@ -71,15 +71,15 @@ func (ct *User) Create(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
-// @Param username query int false ""
+// @Param page query int false "Page number for the user list"
+// @Param page_size query int false "Number of users per page"
+// @Param username query int false "Username filter"
 // @Success 200 {object} response.Response{data=model.UserList}
 // @Failure 500 {object} response.Response
 // @Router /admin/user/list [get]
@@ -98,13 +98,13 @@ func (ct *User) List(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// Update 
-// @Tags 
-// @Summary 
-// @Description 
+// Update
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.UserForm true ""
+// @Param body body admin.UserForm true "User update form payload"
 // @Success 200 {object} response.Response{data=model.User}
 // @Failure 500 {object} response.Response
 // @Router /admin/user/update [post]
@@ -147,13 +147,13 @@ func (ct *User) Update(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.UserForm true ""
+// @Param body body admin.UserForm true "User deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/user/delete [post]
@@ -188,16 +188,16 @@ func (ct *User) Delete(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 }
 
-// UpdatePassword 
-// @Tags 
-// @Summary 
-// @Description 
+// UpdatePassword
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.UserPasswordForm true ""
+// @Param body body admin.UserPasswordForm true "User password update form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
-// @Router /admin/user/updatePassword [post]
+// @Router /admin/user/changePwd [post]
 // @Security token
 func (ct *User) UpdatePassword(c *gin.Context) {
 	f := &admin.UserPasswordForm{}
@@ -223,10 +223,10 @@ func (ct *User) UpdatePassword(c *gin.Context) {
 	response.Success(c, nil)
 }
 
-// Current 
-// @Tags 
-// @Summary 
-// @Description 
+// Current
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} response.Response{data=adResp.LoginPayload}
@@ -240,13 +240,13 @@ func (ct *User) Current(c *gin.Context) {
 	responseLoginSuccess(c, u, t)
 }
 
-// ChangeCurPwd 
-// @Tags 
-// @Summary 
-// @Description 
+// ChangeCurPwd
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.ChangeCurPasswordForm true ""
+// @Param body body admin.ChangeCurPasswordForm true "Current user password change form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/user/changeCurPwd [post]
@@ -283,6 +283,16 @@ func (ct *User) ChangeCurPwd(c *gin.Context) {
 // UpdateCurrent — обновление профиля текущего пользователя (BUGS.md AU-M-021).
 // Редактируемы только nickname и email; username — идентификатор, role/status/group
 // меняет лишь админ. Email проверяется на уникальность.
+// @Tags User
+// @Summary Update the current user profile
+// @Description Authenticated users may update only their nickname and email.
+// @Accept json
+// @Produce json
+// @Param body body admin.UpdateCurrentForm true "Current user profile update payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/user/updateCurrent [post]
+// @Security token
 func (ct *User) UpdateCurrent(c *gin.Context) {
 	f := &admin.UpdateCurrentForm{}
 	if err := c.ShouldBindJSON(f); err != nil {
@@ -314,14 +324,14 @@ func (ct *User) UpdateCurrent(c *gin.Context) {
 }
 
 // MyOauth
-// @Tags 
-// @Summary 
-// @Description 
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} response.Response{data=[]adResp.UserOauthItem}
 // @Failure 500 {object} response.Response
-// @Router /admin/user/myOauth [get]
+// @Router /admin/user/myOauth [post]
 // @Security token
 func (ct *User) MyOauth(c *gin.Context) {
 	u := service.AllService.UserService.CurUser(c)
@@ -347,7 +357,15 @@ func (ct *User) MyOauth(c *gin.Context) {
 	response.Success(c, res)
 }
 
-// groupUsers
+// groupUsers returns the groups and users available to an administrator.
+// @Tags User
+// @Summary List users grouped by group
+// @Description Admin-only group and user picker data.
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/user/groupUsers [post]
+// @Security token
 func (ct *User) GroupUsers(c *gin.Context) {
 	aG := service.AllService.GroupService.List(1, 999, nil)
 	aU := service.AllService.UserService.List(1, 9999, nil)
@@ -357,6 +375,16 @@ func (ct *User) GroupUsers(c *gin.Context) {
 	})
 }
 
+// GroupUsersForShare returns the restricted group and user picker data for a
+// personal address-book share.
+// @Tags User
+// @Summary List shareable users and groups
+// @Description Authenticated users receive only the group and user entries allowed for personal sharing.
+// @Produce json
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/my/groupUsers [post]
+// @Security token
 func (ct *User) GroupUsersForShare(c *gin.Context) {
 	cu := service.AllService.UserService.CurUser(c)
 	if cu == nil || cu.Id == 0 {
@@ -386,7 +414,16 @@ func (ct *User) GroupUsersForShare(c *gin.Context) {
 	})
 }
 
-// Register
+// Register creates a public user registration request when registration is enabled.
+// @Tags User
+// @Summary Register a user
+// @Description Public registration route; the server decides whether the new account is enabled immediately.
+// @Accept json
+// @Produce json
+// @Param body body admin.RegisterForm true "User registration payload"
+// @Success 200 {object} response.Response
+// @Failure 500 {object} response.Response
+// @Router /admin/user/register [post]
 func (ct *User) Register(c *gin.Context) {
 	if !global.Config.App.Register {
 		response.Fail(c, 101, response.TranslateMsg(c, "RegisterClosed"))
diff --git a/api/http/controller/admin/userToken.go b/api/http/controller/admin/userToken.go
index 014c1bd..871cf0d 100644
--- a/api/http/controller/admin/userToken.go
+++ b/api/http/controller/admin/userToken.go
@@ -1,28 +1,28 @@
-package admin
+package admin
 
 import (
 	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/admin"
 	"rustdesk-server/api/http/response"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"gorm.io/gorm"
 )
 
 type UserToken struct {
 }
 
-// List 
-// @Tags 
-// @Summary 
-// @Description 
+// List
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param page_size query int false ""
+// @Param page query int false "Page number for the user-token list"
+// @Param page_size query int false "Number of user tokens per page"
 // @Param user_id query int false "ID"
-// @Success 200 {object} response.Response{data=model.UserTokenList}
+// @Success 200 {object} response.Response{data=model.UserTokenSafeList} "Redacted user-token list envelope"
 // @Failure 500 {object} response.Response
 // @Router /admin/user_token/list [get]
 // @Security token
@@ -38,16 +38,16 @@ func (ct *UserToken) List(c *gin.Context) {
 		}
 		tx.Order("id desc")
 	})
-	response.Success(c, res)
+	response.Success(c, res.Safe())
 }
 
-// Delete 
-// @Tags 
-// @Summary 
-// @Description 
+// Delete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body model.UserToken true ""
+// @Param body body model.UserToken true "User-token deletion form payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/user_token/delete [post]
@@ -82,13 +82,13 @@ func (ct *UserToken) Delete(c *gin.Context) {
 	response.Fail(c, 101, response.TranslateMsg(c, "ItemNotFound"))
 }
 
-// BatchDelete 
-// @Tags 
-// @Summary 
-// @Description 
+// BatchDelete
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body admin.UserTokenBatchDeleteForm true ""
+// @Param body body admin.UserTokenBatchDeleteForm true "User-token ID batch deletion payload"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /admin/user_token/batchDelete [post]
diff --git a/api/http/controller/admin/user_token_test.go b/api/http/controller/admin/user_token_test.go
new file mode 100644
index 0000000..78b5a9b
--- /dev/null
+++ b/api/http/controller/admin/user_token_test.go
@@ -0,0 +1,59 @@
+package admin
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestUserTokenListRedactsRawTokenSecret(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+	if err := db.AutoMigrate(&model.UserToken{}); err != nil {
+		t.Fatalf("migrate user token: %v", err)
+	}
+	previousDB, previousServices := service.DB, service.AllService
+	service.DB = db
+	service.AllService = &service.Service{UserService: &service.UserService{}}
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+	})
+
+	secret := "0123456789abcdef-secret-token"
+	if err := db.Create(&model.UserToken{UserId: 8, Token: secret, ExpiredAt: 99}).Error; err != nil {
+		t.Fatalf("create user token: %v", err)
+	}
+	recorder := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(recorder)
+	c.Request = httptest.NewRequest(http.MethodGet, "/admin/user_token/list?page=1&page_size=10", nil)
+	(&UserToken{}).List(c)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("user token list status = %d; body=%s", recorder.Code, recorder.Body.String())
+	}
+	body := recorder.Body.String()
+	if strings.Contains(body, secret) {
+		t.Fatalf("user token list exposed raw secret: %s", body)
+	}
+	for _, expected := range []string{`"token":"0123****oken"`, `"user_id":8`, `"expired_at":99`} {
+		if !strings.Contains(body, expected) {
+			t.Fatalf("user token list omitted %q: %s", expected, body)
+		}
+	}
+}
diff --git a/api/http/controller/api/ab.go b/api/http/controller/api/ab.go
index 9aad40c..cbd3876 100644
--- a/api/http/controller/api/ab.go
+++ b/api/http/controller/api/ab.go
@@ -1,9 +1,10 @@
-package api
+package api
 
 import (
 	"encoding/json"
 	"errors"
 	"github.com/gin-gonic/gin"
+	"net/http"
 	"rustdesk-server/api/global"
 	requstform "rustdesk-server/api/http/request/api"
 	"rustdesk-server/api/http/response"
@@ -11,7 +12,6 @@ import (
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
 	"rustdesk-server/api/utils"
-	"net/http"
 	"strconv"
 	"strings"
 )
@@ -20,9 +20,9 @@ type Ab struct {
 }
 
 // Ab
-// @Tags 
-// @Summary 
-// @Description 
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} response.Response
@@ -44,7 +44,7 @@ func (a *Ab) Ab(c *gin.Context) {
 	}
 	tgc, _ := json.Marshal(tagColors)
 	res := &api.AbList{
-		Peers:     al.AddressBooks,
+		Peers:     al.Safe().AddressBooks,
 		Tags:      tagNames,
 		TagColors: string(tgc),
 	}
@@ -56,12 +56,12 @@ func (a *Ab) Ab(c *gin.Context) {
 }
 
 // UpAb
-// @Tags 
-// @Summary 
-// @Description 
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body requstform.AddressBookForm true ""
+// @Param body body requstform.AddressBookForm true "Address book request form payload"
 // @Success 200 {string} string "null"
 // @Failure 500 {object} response.ErrorResponse
 // @Router /ab [post]
@@ -79,6 +79,10 @@ func (a *Ab) UpAb(c *gin.Context) {
 		response.Error(c, response.TranslateMsg(c, "ParamsError")+err.Error())
 		return
 	}
+	peers := make([]*model.AddressBook, 0, len(abd.Peers))
+	for _, peer := range abd.Peers {
+		peers = append(peers, peer.ToAddressBook())
+	}
 	tc := map[string]uint{}
 	err = json.Unmarshal([]byte(abd.TagColors), &tc)
 	if err != nil {
@@ -87,7 +91,7 @@ func (a *Ab) UpAb(c *gin.Context) {
 	}
 	user := service.AllService.UserService.CurUser(c)
 
-	err = service.AllService.AddressBookService.UpdateAddressBook(abd.Peers, user.Id)
+	err = service.AllService.AddressBookService.UpdateAddressBook(peers, user.Id)
 	if err != nil {
 		response.Error(c, response.TranslateMsg(c, "OperationFailed")+err.Error())
 		return
@@ -100,8 +104,8 @@ func (a *Ab) UpAb(c *gin.Context) {
 
 // PTags
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
@@ -129,8 +133,8 @@ func (a *Ab) PTags(c *gin.Context) {
 
 // TagAdd
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
@@ -178,8 +182,8 @@ func (a *Ab) TagAdd(c *gin.Context) {
 
 // TagRename
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
@@ -230,8 +234,8 @@ func (a *Ab) TagRename(c *gin.Context) {
 
 // TagUpdate
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
@@ -276,8 +280,8 @@ func (a *Ab) TagUpdate(c *gin.Context) {
 
 // TagDel
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
@@ -325,8 +329,8 @@ func (a *Ab) TagDel(c *gin.Context) {
 
 // Personal
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param string body string false  "string valid"
@@ -359,8 +363,8 @@ func (a *Ab) Personal(c *gin.Context) {
 
 // Settings
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param string body string false  "string valid"
@@ -376,12 +380,12 @@ func (a *Ab) Settings(c *gin.Context) {
 
 // SharedProfiles
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param current query int false ""
-// @Param pageSize query int false ""
+// @Param current query int false "Current page number for shared profiles"
+// @Param pageSize query int false "Page size for shared profiles"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
 // @Router /ab/shared/profiles [post]
@@ -522,12 +526,12 @@ func (a *Ab) CheckGuid(cu *model.User, guid string) (gid, uid, cid uint, err err
 
 // Peers
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param current query int false ""
-// @Param pageSize query int false ""
+// @Param current query int false "Current page number for address book peers"
+// @Param pageSize query int false "Page size for address book peers"
 // @Param ab query string false "guid"
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
@@ -551,15 +555,15 @@ func (a *Ab) Peers(c *gin.Context) {
 	al := service.AllService.AddressBookService.ListByUserIdAndCollectionId(uid, cid, 1, 1000)
 	c.JSON(http.StatusOK, gin.H{
 		"total":            al.Total,
-		"data":             al.AddressBooks,
+		"data":             al.Safe().AddressBooks,
 		"licensed_devices": 99999,
 	})
 }
 
 // PeerAdd
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
@@ -614,14 +618,14 @@ func (a *Ab) PeerAdd(c *gin.Context) {
 
 // PeerDel
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
 // @Success 200 {string} string
 // @Failure 500 {object} response.ErrorResponse
-// @Router /ab/peer/add/{guid} [delete]
+// @Router /ab/peer/{guid} [delete]
 // @Security BearerAuth
 func (a *Ab) PeerDel(c *gin.Context) {
 	f := &[]string{}
@@ -662,8 +666,8 @@ func (a *Ab) PeerDel(c *gin.Context) {
 
 // PeerUpdate
 // @Tags [Personal]
-// @Summary 
-// @Description 
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Param guid path string true "guid"
diff --git a/api/http/controller/api/audit.go b/api/http/controller/api/audit.go
index 6322d12..7255554 100644
--- a/api/http/controller/api/audit.go
+++ b/api/http/controller/api/audit.go
@@ -19,7 +19,7 @@ type Audit struct {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body request.AuditConnForm true ""
+// @Param body body request.AuditConnForm true "Audit connection form payload"
 // @Success 200 {string} string ""
 // @Failure 500 {object} response.Response
 // @Router /audit/conn [post]
@@ -64,7 +64,7 @@ func (a *Audit) AuditConn(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body request.AuditFileForm true ""
+// @Param body body request.AuditFileForm true "Audit file form payload"
 // @Success 200 {string} string ""
 // @Failure 500 {object} response.Response
 // @Router /audit/file [post]
diff --git a/api/http/controller/api/group.go b/api/http/controller/api/group.go
index 43fb2d1..2557f44 100644
--- a/api/http/controller/api/group.go
+++ b/api/http/controller/api/group.go
@@ -19,9 +19,9 @@ type Group struct {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param pageSize query int false ""
-// @Param status query int false ""
+// @Param page query int false "Page number for the user list"
+// @Param pageSize query int false "Number of users per page"
+// @Param status query int false "User status filter"
 // @Param accessible query string false "accessible"
 // @Success 200 {object} response.DataResponse{data=[]apiResp.UserPayload}
 // @Failure 500 {object} response.ErrorResponse
@@ -63,9 +63,9 @@ func (g *Group) Users(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param pageSize query int false ""
-// @Param status query int false ""
+// @Param page query int false "Page number for the peer list"
+// @Param pageSize query int false "Number of peers per page"
+// @Param status query int false "Peer status filter"
 // @Param accessible query string false "accessible"
 // @Success 200 {object} response.DataResponse
 // @Failure 500 {object} response.Response
@@ -127,9 +127,9 @@ func (g *Group) Peers(c *gin.Context) {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param page query int false ""
-// @Param pageSize query int false ""
-// @Param status query int false ""
+// @Param page query int false "Page number for the group list"
+// @Param pageSize query int false "Number of groups per page"
+// @Param status query int false "Group status filter"
 // @Param accessible query string false "accessible"
 // @Success 200 {object} response.DataResponse
 // @Failure 500 {object} response.Response
diff --git a/api/http/controller/api/login.go b/api/http/controller/api/login.go
index d746e68..ebe64ff 100644
--- a/api/http/controller/api/login.go
+++ b/api/http/controller/api/login.go
@@ -1,28 +1,28 @@
-package api
+package api
 
 import (
 	"encoding/json"
 	"fmt"
 	"github.com/gin-gonic/gin"
+	"net/http"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/api"
 	"rustdesk-server/api/http/response"
 	apiResp "rustdesk-server/api/http/response/api"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"net/http"
 )
 
 type Login struct {
 }
 
-// Login 
-// @Tags 
-// @Summary 
-// @Description 
+// Login
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
-// @Param body body api.LoginForm true ""
+// @Param body body api.LoginForm true "Login credentials payload"
 // @Success 200 {object} apiResp.LoginRes
 // @Failure 500 {object} response.ErrorResponse
 // @Router /login [post]
@@ -91,9 +91,9 @@ func (l *Login) Login(c *gin.Context) {
 }
 
 // LoginOptions
-// @Tags 
-// @Summary 
-// @Description 
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} []string
@@ -122,19 +122,23 @@ func (l *Login) LoginOptions(c *gin.Context) {
 }
 
 // Logout
-// @Tags 
-// @Summary 
-// @Description 
+// @Tags
+// @Summary
+// @Description
 // @Accept  json
 // @Produce  json
 // @Success 200 {string} string
 // @Failure 500 {object} response.ErrorResponse
 // @Router /logout [post]
+// @Security BearerAuth
 func (l *Login) Logout(c *gin.Context) {
 	u := service.AllService.UserService.CurUser(c)
 	token, ok := c.Get("token")
 	if ok {
-		service.AllService.UserService.Logout(u, token.(string))
+		if err := service.AllService.UserService.Logout(u, token.(string)); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "logout failed"})
+			return
+		}
 	}
 	c.JSON(http.StatusOK, nil)
 
diff --git a/api/http/controller/api/ouath.go b/api/http/controller/api/ouath.go
index 3129044..2ce910c 100644
--- a/api/http/controller/api/ouath.go
+++ b/api/http/controller/api/ouath.go
@@ -1,4 +1,4 @@
-package api
+package api
 
 import (
 	"encoding/json"
@@ -6,26 +6,26 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
+	"github.com/nicksnyder/go-i18n/v2/i18n"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/request/api"
 	"rustdesk-server/api/http/response"
 	apiResp "rustdesk-server/api/http/response/api"
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/service"
-	"github.com/nicksnyder/go-i18n/v2/i18n"
 )
 
 type Oauth struct {
 }
 
-// OidcAuth
+// OidcAuth starts an OIDC authorization flow and returns its state code and URL.
 // @Tags Oauth
-// @Summary OidcAuth
-// @Description OidcAuth
+// @Summary Start OIDC authorization
+// @Description Starts OIDC authorization and returns the provider URL with the state code used by the follow-up query.
 // @Accept  json
 // @Produce  json
-// @Success 200 {object} apiResp.LoginRes
-// @Failure 500 {object} response.ErrorResponse
+// @Success 200 {object} map[string]string "Authorization state code and provider URL"
+// @Failure 400 {object} response.ErrorResponse "OIDC authorization could not be started"
 // @Router /oidc/auth [post]
 func (o *Oauth) OidcAuth(c *gin.Context) {
 	f := &api.OidcAuthRequest{}
@@ -71,7 +71,7 @@ func (o *Oauth) OidcAuthQueryPre(c *gin.Context) (*model.User, *model.UserToken)
 		return nil, nil
 	}
 
-	//  OAuth 
+	//  OAuth
 	v := service.AllService.OauthService.GetOauthCache(q.Code)
 	if v == nil {
 		response.Error(c, response.TranslateMsg(c, "OauthExpired"))
@@ -91,7 +91,7 @@ func (o *Oauth) OidcAuthQueryPre(c *gin.Context) (*model.User, *model.UserToken)
 		return nil, nil
 	}
 
-	//  OAuth 
+	//  OAuth
 	service.AllService.OauthService.DeleteOauthCache(q.Code)
 
 	ut = service.AllService.UserService.Login(u, &model.LoginLog{
@@ -112,14 +112,13 @@ func (o *Oauth) OidcAuthQueryPre(c *gin.Context) (*model.User, *model.UserToken)
 	return u, ut
 }
 
-// OidcAuthQuery
+// OidcAuthQuery exchanges a completed OIDC authorization state for a login token.
 // @Tags Oauth
-// @Summary OidcAuthQuery
-// @Description OidcAuthQuery
-// @Accept  json
+// @Summary Complete OIDC authorization
+// @Description Exchanges the OIDC state code and provider callback values for the Rust client login response.
 // @Produce  json
 // @Success 200 {object} apiResp.LoginRes
-// @Failure 500 {object} response.ErrorResponse
+// @Failure 400 {object} response.ErrorResponse "OIDC authorization query failed"
 // @Router /oidc/auth-query [get]
 func (o *Oauth) OidcAuthQuery(c *gin.Context) {
 	u, ut := o.OidcAuthQueryPre(c)
@@ -133,15 +132,18 @@ func (o *Oauth) OidcAuthQuery(c *gin.Context) {
 	})
 }
 
-// OauthCallback 
+// OauthCallback handles the provider callback for every registered OIDC/OAuth alias.
 // @Tags Oauth
-// @Summary OauthCallback
-// @Description OauthCallback
-// @Accept  json
-// @Produce  json
-// @Success 200 {object} apiResp.LoginRes
-// @Failure 500 {object} response.ErrorResponse
+// @Summary Handle the OIDC provider callback
+// @Description Renders the success/failure HTML result pages or redirects to the admin OAuth binding/app route. The same handler is registered for all four callback aliases below.
+// @Produce text/html
+// @Success 200 {string} string "Rendered OAuth success or failure HTML page"
+// @Success 302 {string} string "Redirect to the admin OAuth binding or app route"
+// @Header 302 {string} Location "Admin OAuth binding or app redirect target"
+// @Router /oauth/callback [get]
+// @Router /oauth/login [get]
 // @Router /oidc/callback [get]
+// @Router /oidc/login [get]
 func (o *Oauth) OauthCallback(c *gin.Context) {
 	state := c.Query("state")
 	if state == "" {
@@ -270,6 +272,17 @@ type MessageParams struct {
 	Msg   string `json:"msg" form:"msg"`
 }
 
+// Message returns localized JavaScript assignments for OAuth/OIDC pages.
+// @Tags Oauth
+// @Summary Get localized OAuth message script
+// @Description Returns JavaScript with localized title and message assignments when the corresponding query parameters are supplied.
+// @Produce application/javascript
+// @Param lang query string false "Localization language"
+// @Param title query string false "Localized title message ID"
+// @Param msg query string false "Localized body message ID"
+// @Success 200 {string} string "JavaScript response"
+// @Router /oauth/msg [get]
+// @Router /oidc/msg [get]
 func (o *Oauth) Message(c *gin.Context) {
 	mp := &MessageParams{}
 	if err := c.ShouldBindQuery(mp); err != nil {
diff --git a/api/http/controller/api/peer.go b/api/http/controller/api/peer.go
index c3b2785..3baf17d 100644
--- a/api/http/controller/api/peer.go
+++ b/api/http/controller/api/peer.go
@@ -19,7 +19,7 @@ type Peer struct {
 // @Description 
 // @Accept  json
 // @Produce  json
-// @Param body body requstform.PeerForm true ""
+// @Param body body requstform.PeerForm true "Peer request form payload"
 // @Success 200 {string} string "SYSINFO_UPDATED,ID_NOT_FOUND"
 // @Failure 500 {object} response.ErrorResponse
 // @Router /sysinfo [post]
diff --git a/api/http/controller/api/user.go b/api/http/controller/api/user.go
index 9ec75b9..5c235c6 100644
--- a/api/http/controller/api/user.go
+++ b/api/http/controller/api/user.go
@@ -1,41 +1,26 @@
-package api
+package api
 
 import (
 	"github.com/gin-gonic/gin"
+	"net/http"
 	apiResp "rustdesk-server/api/http/response/api"
 	"rustdesk-server/api/service"
-	"net/http"
 )
 
 type User struct {
 }
 
-// currentUser 
-// @Tags 
-// @Summary 
-// @Description 
-// @Accept  json
-// @Produce  json
-// @Success 200 {object} apiResp.UserPayload
-// @Failure 500 {object} response.Response
-// @Router /currentUser [get]
-// @Security token
-//func (u *User) currentUser(c *gin.Context) {
-//	user := service.AllService.UserService.CurUser(c)
-//	up := (&apiResp.UserPayload{}).FromName(user)
-//	c.JSON(http.StatusOK, up)
-//}
-
-// Info 
-// @Tags 
-// @Summary 
-// @Description 
+// Info returns the current Rust client user from the Authorization header.
+// @Tags User
+// @Summary Get the current Rust client user
+// @Description Returns the authenticated user for Rust client API requests.
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} apiResp.UserPayload
 // @Failure 500 {object} response.Response
-// @Router /currentUser [get]
-// @Security token
+// @Router /user/info [get]
+// @Router /currentUser [post]
+// @Security BearerAuth
 func (u *User) Info(c *gin.Context) {
 	user := service.AllService.UserService.CurUser(c)
 	up := (&apiResp.UserPayload{}).FromUser(user)
diff --git a/api/http/controller/api/webClient.go b/api/http/controller/api/webClient.go
index 98bdc8d..a963c43 100644
--- a/api/http/controller/api/webClient.go
+++ b/api/http/controller/api/webClient.go
@@ -1,4 +1,4 @@
-package api
+package api
 
 import (
 	"github.com/gin-gonic/gin"
@@ -12,16 +12,16 @@ import (
 type WebClient struct {
 }
 
-// ServerConfig 
+// ServerConfig returns the authenticated web-client server settings and peers.
 // @Tags WEBCLIENT
-// @Summary 
-// @Description ,webclientapi-server
+// @Summary Get web-client server configuration
+// @Description Returns the ID server, public key, and the current user's web-client peers.
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
-// @Router /server-config [get]
-// @Security token
+// @Router /server-config [post]
+// @Security BearerAuth
 func (i *WebClient) ServerConfig(c *gin.Context) {
 	u := service.AllService.UserService.CurUser(c)
 
@@ -89,16 +89,16 @@ func (i *WebClient) SharedPeer(c *gin.Context) {
 	})
 }
 
-// ServerConfigV2 
+// ServerConfigV2 returns the authenticated web-client server settings.
 // @Tags WEBCLIENT_V2
-// @Summary 
-// @Description ,webclientapi-server
+// @Summary Get web-client server configuration v2
+// @Description Returns the ID server and public key for the authenticated web-client request.
 // @Accept  json
 // @Produce  json
 // @Success 200 {object} response.Response
 // @Failure 500 {object} response.Response
-// @Router /server-config-v2 [get]
-// @Security token
+// @Router /server-config-v2 [post]
+// @Security BearerAuth
 func (i *WebClient) ServerConfigV2(c *gin.Context) {
 	response.Success(
 		c,
diff --git a/api/http/request/admin/addressBook_test.go b/api/http/request/admin/addressBook_test.go
new file mode 100644
index 0000000..d155c1e
--- /dev/null
+++ b/api/http/request/admin/addressBook_test.go
@@ -0,0 +1,15 @@
+package admin
+
+import "testing"
+
+func TestAddressBookFormPreservesTypedCredentialInput(t *testing.T) {
+	form := AddressBookForm{
+		Id:       "peer-id",
+		Password: "password-secret",
+		Hash:     "hash-credential",
+	}
+	addressBook := form.ToAddressBook()
+	if addressBook.Password != form.Password || addressBook.Hash != form.Hash {
+		t.Fatalf("typed credentials were not mapped to write model: %#v", addressBook)
+	}
+}
diff --git a/api/http/request/admin/custom_build.go b/api/http/request/admin/custom_build.go
index 0abd3cb..e898adb 100644
--- a/api/http/request/admin/custom_build.go
+++ b/api/http/request/admin/custom_build.go
@@ -1,4 +1,4 @@
-package admin
+package admin
 
 import "rustdesk-server/api/model"
 
@@ -9,6 +9,7 @@ type CustomBuildForm struct {
 	Version    string `json:"version" validate:"required"`
 	AppName    string `json:"app_name"`
 	CustomJson string `json:"custom_json"`
+	BuildRef   string `json:"build_ref" swaggerignore:"true"`
 }
 
 func (f *CustomBuildForm) ToCustomBuild() *model.CustomBuild {
diff --git a/api/http/request/admin/custom_preset.go b/api/http/request/admin/custom_preset.go
index 708cc50..bb68c1d 100644
--- a/api/http/request/admin/custom_preset.go
+++ b/api/http/request/admin/custom_preset.go
@@ -9,6 +9,7 @@ type CustomPresetForm struct {
 	Version    string `json:"version" validate:"required"`
 	AppName    string `json:"app_name"`
 	CustomJson string `json:"custom_json"`
+	BuildRef   string `json:"build_ref" swaggerignore:"true"`
 }
 
 func (f *CustomPresetForm) ToCustomPreset() *model.CustomPreset {
diff --git a/api/http/request/admin/github_build_config.go b/api/http/request/admin/github_build_config.go
new file mode 100644
index 0000000..b33679b
--- /dev/null
+++ b/api/http/request/admin/github_build_config.go
@@ -0,0 +1,18 @@
+package admin
+
+// GithubBuildConfigForm is the complete user-editable GitHub build contract.
+// Workflow names and refs are application/provider-owned values, not request
+// fields. Empty secrets preserve the currently stored value.
+type GithubBuildConfigForm struct {
+	Repo       string `json:"repo"`
+	Token      string `json:"token"`
+	PayloadKey string `json:"payload_key"`
+}
+
+// WorkflowRefApprovalForm is separate from the normal settings form. Clients
+// submit only the label selected from the provider-derived tag options; raw
+// refs and SHAs are not accepted as normal input.
+type WorkflowRefApprovalForm struct {
+	WorkflowTag string `json:"workflow_tag"`
+	Confirm     bool   `json:"confirm"`
+}
diff --git a/api/http/request/api/peer.go b/api/http/request/api/peer.go
index 2896a5a..6c80b36 100644
--- a/api/http/request/api/peer.go
+++ b/api/http/request/api/peer.go
@@ -1,11 +1,30 @@
-package api
+package api
 
 import "rustdesk-server/api/model"
 
 type AddressBookFormData struct {
-	Tags      []string             `json:"tags"`
-	Peers     []*model.AddressBook `json:"peers"`
-	TagColors string               `json:"tag_colors"`
+	Tags      []string               `json:"tags"`
+	Peers     []*AddressBookPeerForm `json:"peers"`
+	TagColors string                 `json:"tag_colors"`
+}
+
+// AddressBookPeerForm is the typed request representation used by address
+// book synchronization. Credentials remain accepted as input while the
+// storage model keeps them out of raw JSON responses.
+type AddressBookPeerForm struct {
+	model.AddressBook
+	Password string `json:"password"`
+	Hash     string `json:"hash"`
+}
+
+func (f *AddressBookPeerForm) ToAddressBook() *model.AddressBook {
+	if f == nil {
+		return nil
+	}
+	ab := f.AddressBook
+	ab.Password = f.Password
+	ab.Hash = f.Hash
+	return &ab
 }
 
 type AddressBookForm struct {
@@ -36,10 +55,12 @@ func (pf *PeerForm) ToPeer() *model.Peer {
 	}
 }
 
-// PersonalAddressBookForm 
+// PersonalAddressBookForm
 type PersonalAddressBookForm struct {
 	model.AddressBook
 	ForceAlwaysRelay string `json:"forceAlwaysRelay"`
+	Password         string `json:"password"`
+	Hash             string `json:"hash"`
 }
 
 func (pabf *PersonalAddressBookForm) ToAddressBook() *model.AddressBook {
diff --git a/api/http/request/api/peer_test.go b/api/http/request/api/peer_test.go
new file mode 100644
index 0000000..1115d79
--- /dev/null
+++ b/api/http/request/api/peer_test.go
@@ -0,0 +1,36 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestAddressBookRequestFormsPreserveTypedCredentials(t *testing.T) {
+	const payload = `{"data":"{\"peers\":[{\"id\":\"peer-id\",\"password\":\"password-secret\",\"hash\":\"hash-secret\"}]}"}`
+	var form AddressBookForm
+	if err := json.Unmarshal([]byte(payload), &form); err != nil {
+		t.Fatalf("decode address book form failed: %v", err)
+	}
+	var data AddressBookFormData
+	if err := json.Unmarshal([]byte(form.Data), &data); err != nil {
+		t.Fatalf("decode address book form data failed: %v", err)
+	}
+	if len(data.Peers) != 1 {
+		t.Fatalf("decoded peer count = %d, want 1", len(data.Peers))
+	}
+	peer := data.Peers[0].ToAddressBook()
+	if peer.Password != "password-secret" || peer.Hash != "hash-secret" {
+		t.Fatal("typed address book credentials were not preserved")
+	}
+}
+
+func TestPersonalAddressBookFormPreservesTypedCredentials(t *testing.T) {
+	var form PersonalAddressBookForm
+	if err := json.Unmarshal([]byte(`{"id":"peer-id","password":"password-secret","hash":"hash-secret"}`), &form); err != nil {
+		t.Fatalf("decode personal address book form failed: %v", err)
+	}
+	peer := form.ToAddressBook()
+	if peer.Password != "password-secret" || peer.Hash != "hash-secret" {
+		t.Fatal("typed personal address book credentials were not preserved")
+	}
+}
diff --git a/api/http/response/api/ab.go b/api/http/response/api/ab.go
index adbc926..bf60670 100644
--- a/api/http/response/api/ab.go
+++ b/api/http/response/api/ab.go
@@ -1,11 +1,11 @@
-package api
+package api
 
 import "rustdesk-server/api/model"
 
 type AbList struct {
-	Peers     []*model.AddressBook `json:"peers,omitempty"`
-	Tags      []string             `json:"tags,omitempty"`
-	TagColors string               `json:"tag_colors,omitempty"`
+	Peers     []*model.AddressBookSafe `json:"peers,omitempty"`
+	Tags      []string                 `json:"tags,omitempty"`
+	TagColors string                   `json:"tag_colors,omitempty"`
 }
 
 type SharedProfilesPayload struct {
diff --git a/api/http/response/api/webClient.go b/api/http/response/api/webClient.go
index 6b3153b..1941da7 100644
--- a/api/http/response/api/webClient.go
+++ b/api/http/response/api/webClient.go
@@ -1,4 +1,4 @@
-package api
+package api
 
 import (
 	"rustdesk-server/api/model"
@@ -16,7 +16,6 @@ type WebClientPeerInfoPayload struct {
 	Username string `json:"username"`
 	Hostname string `json:"hostname"`
 	Platform string `json:"platform"`
-	Hash     string `json:"hash"`
 	Id       string `json:"id"`
 }
 
@@ -28,7 +27,6 @@ func (wcpp *WebClientPeerPayload) FromAddressBook(a *model.AddressBook) {
 		Username: a.Username,
 		Hostname: a.Hostname,
 		Platform: a.Platform,
-		Hash:     a.Hash,
 	}
 }
 
diff --git a/api/http/response/api/webClient_security_test.go b/api/http/response/api/webClient_security_test.go
new file mode 100644
index 0000000..764d9e7
--- /dev/null
+++ b/api/http/response/api/webClient_security_test.go
@@ -0,0 +1,35 @@
+package api
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"rustdesk-server/api/model"
+)
+
+func TestWebClientAddressBookPayloadDoesNotExposeStoredCredentialHash(t *testing.T) {
+	payload := &WebClientPeerPayload{}
+	payload.FromAddressBook(&model.AddressBook{
+		Username: "alice",
+		Hostname: "host",
+		Platform: "Windows",
+		Hash:     "hash-credential",
+		Password: "password-secret",
+	})
+	encoded, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("marshal web client payload: %v", err)
+	}
+	response := string(encoded)
+	for _, forbidden := range []string{"hash-credential", "password-secret", `"hash"`, `"password"`} {
+		if strings.Contains(response, forbidden) {
+			t.Fatalf("web client payload exposed %q: %s", forbidden, response)
+		}
+	}
+	for _, expected := range []string{`"username":"alice"`, `"hostname":"host"`, `"platform":"Windows"`} {
+		if !strings.Contains(response, expected) {
+			t.Fatalf("web client payload omitted %q: %s", expected, response)
+		}
+	}
+}
diff --git a/api/http/response/response.go b/api/http/response/response.go
index 1acbbce..1fb475a 100644
--- a/api/http/response/response.go
+++ b/api/http/response/response.go
@@ -1,11 +1,11 @@
-package response
+package response
 
 import (
 	"fmt"
 	"github.com/gin-gonic/gin"
-	"rustdesk-server/api/global"
 	"github.com/nicksnyder/go-i18n/v2/i18n"
 	"net/http"
+	"rustdesk-server/api/global"
 )
 
 type Response struct {
@@ -42,6 +42,16 @@ func Fail(c *gin.Context, code int, message string) {
 	SendResponse(c, code, message, nil)
 }
 
+// FailStatus keeps the standard response envelope while allowing callers to
+// return an HTTP status other than the legacy 200 used by Fail.
+func FailStatus(c *gin.Context, status, code int, message string) {
+	c.JSON(status, Response{
+		Code:    code,
+		Message: message,
+		Data:    nil,
+	})
+}
+
 func Error(c *gin.Context, message string) {
 	c.JSON(http.StatusBadRequest, ErrorResponse{
 		Error: message,
diff --git a/api/http/router/admin.go b/api/http/router/admin.go
index 6c624e9..98853d8 100644
--- a/api/http/router/admin.go
+++ b/api/http/router/admin.go
@@ -1,14 +1,14 @@
-package router
+package router
 
 import (
 	"github.com/gin-gonic/gin"
+	swaggerFiles "github.com/swaggo/files"
+	ginSwagger "github.com/swaggo/gin-swagger"
 	_ "rustdesk-server/api/docs/admin"
 	"rustdesk-server/api/global"
 	"rustdesk-server/api/http/controller/admin"
 	"rustdesk-server/api/http/controller/admin/my"
 	"rustdesk-server/api/http/middleware"
-	swaggerFiles "github.com/swaggo/files"
-	ginSwagger "github.com/swaggo/gin-swagger"
 )
 
 func Init(g *gin.Engine) {
@@ -82,7 +82,11 @@ func LoginBind(rg *gin.RouterGroup) {
 	cont := &admin.Login{}
 	rg.POST("/login", cont.Login)
 	rg.GET("/captcha", cont.Captcha)
-	rg.POST("/logout", cont.Logout)
+	// Logout needs BackendUserAuth here because LoginBind is registered before
+	// the authenticated admin group middleware. This keeps login public while
+	// ensuring the supplied api-token is placed in the request context for
+	// revocation.
+	rg.POST("/logout", middleware.BackendUserAuth(), cont.Logout)
 	rg.GET("/login-options", cont.LoginOptions)
 	rg.POST("/oidc/auth", cont.OidcAuth)
 	rg.GET("/oidc/auth-query", cont.OidcAuthQuery)
@@ -376,6 +380,8 @@ func CustomBuildBind(rg *gin.RouterGroup) {
 	cont := &admin.CustomBuild{}
 	aR := rg.Group("/custom_build").Use(middleware.AdminPrivilege())
 	aR.GET("/list", cont.List)
+	aR.GET("/manifest/:id", cont.Manifest)
+	aR.GET("/download/:id", cont.DownloadByID)
 	// /detail/:id intentionally not exposed: never had a UI consumer (BUGS.md B-014).
 	aR.POST("/create", cont.Create)
 	aR.POST("/delete", cont.Delete)
@@ -397,9 +403,10 @@ func GithubBuildConfigBind(rg *gin.RouterGroup) {
 	aR := rg.Group("/github_build_config").Use(middleware.AdminPrivilege())
 	aR.GET("/get", cont.Get)
 	aR.POST("/save", cont.Save)
+	aR.GET("/workflow_tags", cont.WorkflowTags)
+	aR.POST("/approve_workflow_ref", cont.ApproveWorkflowRef)
 	aR.POST("/generate_key", cont.GenerateKey)
 	aR.POST("/test", cont.Test)
 	aR.POST("/sync_secret", cont.SyncSecret)
-	aR.POST("/sync_pat", cont.SyncPat)
 	aR.POST("/dispatch_test", cont.DispatchTest)
 }
diff --git a/api/http/router/admin_test.go b/api/http/router/admin_test.go
new file mode 100644
index 0000000..8ccdc21
--- /dev/null
+++ b/api/http/router/admin_test.go
@@ -0,0 +1,74 @@
+package router
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/config"
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/service"
+)
+
+func TestAdminLogoutRevokesSuppliedToken(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+	if err := db.AutoMigrate(&model.User{}, &model.UserToken{}); err != nil {
+		t.Fatalf("migrate auth models: %v", err)
+	}
+
+	previousDB, previousServices, previousConfig := service.DB, service.AllService, service.Config
+	service.DB = db
+	service.Config = &config.Config{App: config.App{TokenExpire: time.Hour}}
+	service.AllService = &service.Service{UserService: &service.UserService{}}
+	t.Cleanup(func() {
+		service.DB = previousDB
+		service.AllService = previousServices
+		service.Config = previousConfig
+	})
+
+	user := &model.User{Username: "logout-user", Status: model.COMMON_STATUS_ENABLE}
+	if err := db.Create(user).Error; err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	const token = "admin-session-token"
+	if err := db.Create(&model.UserToken{
+		UserId:    user.Id,
+		Token:     token,
+		ExpiredAt: time.Now().Add(time.Hour).Unix(),
+	}).Error; err != nil {
+		t.Fatalf("create user token: %v", err)
+	}
+
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	LoginBind(router.Group("/api/admin"))
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/api/admin/logout", nil)
+	request.Header.Set("api-token", token)
+	router.ServeHTTP(recorder, request)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("logout status = %d, want 200; body=%s", recorder.Code, recorder.Body.String())
+	}
+
+	var remaining int64
+	if err := db.Model(&model.UserToken{}).Where("token = ?", token).Count(&remaining).Error; err != nil {
+		t.Fatalf("count revoked token: %v", err)
+	}
+	if remaining != 0 {
+		t.Fatalf("logout left supplied token stored: %d row(s)", remaining)
+	}
+}
diff --git a/api/lib/cache/cache_test.go b/api/lib/cache/cache_test.go
index f57f8ee..5524cc8 100644
--- a/api/lib/cache/cache_test.go
+++ b/api/lib/cache/cache_test.go
@@ -2,7 +2,6 @@ package cache
 
 import (
 	"fmt"
-	"github.com/go-redis/redis/v8"
 	"reflect"
 	"testing"
 )
@@ -61,32 +60,23 @@ func TestFileCacheGet(t *testing.T) {
 }
 
 func TestRedisCacheSet(t *testing.T) {
-	rc := NewRedis(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
-	})
+	rc := newRedisTestCache(t)
 	err := rc.Set("123", "ddd", 0)
 	if err != nil {
-		fmt.Println(err.Error())
-		t.Fatalf("")
+		t.Fatalf("Redis set failed: %v", err)
 	}
 }
 
 func TestRedisCacheGet(t *testing.T) {
-	rc := NewRedis(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
-	})
+	rc := newRedisTestCache(t)
 	err := rc.Set("123", "451156", 300)
 	if err != nil {
-		t.Fatalf("")
+		t.Fatalf("Redis set failed: %v", err)
 	}
 	res := ""
 	err = rc.Get("123", &res)
 	if err != nil {
-		t.Fatalf("")
+		t.Fatalf("Redis get failed: %v", err)
 	}
 	fmt.Println("res", res)
 }
diff --git a/api/lib/cache/file_test.go b/api/lib/cache/file_test.go
index 3be2025..67a3742 100644
--- a/api/lib/cache/file_test.go
+++ b/api/lib/cache/file_test.go
@@ -46,7 +46,7 @@ func TestFileGetJson(t *testing.T) {
 	err2 := fc.Get("123", res)
 	fmt.Println("res", res)
 	if err2 != nil {
-		t.Fatalf("" + err2.Error())
+		t.Fatalf("%s", err2.Error())
 	}
 }
 func TestFileSetGetJson(t *testing.T) {
@@ -68,7 +68,7 @@ func TestFileSetGetJson(t *testing.T) {
 	err2 := fc.Get("123", res)
 	fmt.Println("res", res)
 	if err2 != nil {
-		t.Fatalf("" + err2.Error())
+		t.Fatalf("%s", err2.Error())
 	}
 	if !reflect.DeepEqual(res, old) {
 		t.Fatalf("")
diff --git a/api/lib/cache/memory_test.go b/api/lib/cache/memory_test.go
index fd4ab1b..ebe081b 100644
--- a/api/lib/cache/memory_test.go
+++ b/api/lib/cache/memory_test.go
@@ -22,7 +22,7 @@ func TestMemoryGet(t *testing.T) {
 	err := mc.Get("123", &res)
 	fmt.Println("res", res)
 	if err != nil {
-		t.Fatalf(" " + err.Error())
+		t.Fatalf(" %s", err.Error())
 	}
 	if res != "44567" {
 		t.Fatalf("")
@@ -43,24 +43,24 @@ func TestMemorySetExpGet(t *testing.T) {
 	res := ""
 	err = mc.Get("3", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res 3", res)
 	time.Sleep(4 * time.Second)
 	//res = ""
 	err = mc.Get("3", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res 3", res)
 	err = mc.Get("2", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res 2", res)
 	err = mc.Get("1", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res 1", res)
 
@@ -79,19 +79,19 @@ func TestMemoryLru(t *testing.T) {
 	res := ""
 	err = mc.Get("3", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res3", res)
 	res = ""
 	err = mc.Get("2", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res2", res)
 	res = ""
 	err = mc.Get("1", &res)
 	if err != nil {
-		t.Fatalf("" + err.Error())
+		t.Fatalf("%s", err.Error())
 	}
 	fmt.Println("res1", res)
 
diff --git a/api/lib/cache/redis_test.go b/api/lib/cache/redis_test.go
index 7040ef4..c968cd5 100644
--- a/api/lib/cache/redis_test.go
+++ b/api/lib/cache/redis_test.go
@@ -1,50 +1,123 @@
 package cache
 
 import (
+	"context"
+	"crypto/rand"
 	"fmt"
-	"github.com/go-redis/redis/v8"
+	"os"
 	"reflect"
+	"strings"
 	"testing"
+
+	"github.com/go-redis/redis/v8"
 )
 
-func TestRedisSet(t *testing.T) {
-	//rc := New("redis")
-	rc := RedisCacheInit(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
+// Redis integration tests are opt-in and use the address supplied by this variable.
+const redisTestAddrEnv = "DESKFORGE_TEST_REDIS_ADDR"
+const invalidRedisTestEndpoint = "invalid Redis test endpoint"
+
+type redisTestCache struct {
+	*RedisCache
+	prefix string
+}
+
+func redisTestParseErrorMessage(string, error) string {
+	return invalidRedisTestEndpoint
+}
+
+func newRedisTestCache(t testing.TB) *redisTestCache {
+	t.Helper()
+	addr := os.Getenv(redisTestAddrEnv)
+	if addr == "" {
+		t.Skipf("Redis integration test skipped: %s is unset", redisTestAddrEnv)
+	}
+
+	// Plain host:port endpoints use default options; redis:// and rediss:// URLs
+	// retain the endpoint's password, database, and TLS settings.
+	options := &redis.Options{Addr: addr}
+	if strings.Contains(addr, "://") {
+		var err error
+		options, err = redis.ParseURL(addr)
+		if err != nil {
+			t.Fatal(redisTestParseErrorMessage(addr, err))
+		}
+	}
+
+	var random [16]byte
+	if _, err := rand.Read(random[:]); err != nil {
+		t.Fatalf("generate Redis test namespace: %v", err)
+	}
+	prefix := fmt.Sprintf("deskforge:test:%d:%x:", os.Getpid(), random)
+	cache := &redisTestCache{
+		RedisCache: RedisCacheInit(options),
+		prefix:     prefix,
+	}
+	t.Cleanup(func() {
+		cache.cleanup(t)
 	})
+	return cache
+}
+
+func (c *redisTestCache) key(key string) string {
+	return c.prefix + key
+}
+
+func (c *redisTestCache) Set(key string, value interface{}, exp int) error {
+	return c.RedisCache.Set(c.key(key), value, exp)
+}
+
+func (c *redisTestCache) Get(key string, value interface{}) error {
+	return c.RedisCache.Get(c.key(key), value)
+}
+
+func (c *redisTestCache) cleanup(t testing.TB) {
+	t.Helper()
+	ctx := context.Background()
+	var cursor uint64
+	for {
+		keys, nextCursor, err := c.rdb.Scan(ctx, cursor, c.prefix+"*", 0).Result()
+		if err != nil {
+			t.Fatalf("Redis test cleanup scan failed: %v", err)
+		}
+		if len(keys) > 0 {
+			if err := c.rdb.Del(ctx, keys...).Err(); err != nil {
+				t.Fatalf("Redis test cleanup delete failed: %v", err)
+			}
+		}
+		cursor = nextCursor
+		if cursor == 0 {
+			break
+		}
+	}
+	if err := c.rdb.Close(); err != nil {
+		t.Fatalf("Redis test client close failed: %v", err)
+	}
+}
+
+func TestRedisSet(t *testing.T) {
+	rc := newRedisTestCache(t)
 	err := rc.Set("123", "ddd", 0)
 	if err != nil {
-		fmt.Println(err.Error())
-		t.Fatalf("")
+		t.Fatalf("Redis set failed: %v", err)
 	}
 }
 
 func TestRedisGet(t *testing.T) {
-	rc := RedisCacheInit(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
-	})
+	rc := newRedisTestCache(t)
 	err := rc.Set("123", "451156", 300)
 	if err != nil {
-		t.Fatalf("")
+		t.Fatalf("Redis set failed: %v", err)
 	}
 	res := ""
 	err = rc.Get("123", &res)
 	if err != nil {
-		t.Fatalf("")
+		t.Fatalf("Redis get failed: %v", err)
 	}
 	fmt.Println("res", res)
 }
 
 func TestRedisGetJson(t *testing.T) {
-	rc := RedisCacheInit(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
-	})
+	rc := newRedisTestCache(t)
 	type r struct {
 		Aa string `json:"a"`
 		B  string `json:"c"`
@@ -54,41 +127,40 @@ func TestRedisGetJson(t *testing.T) {
 	}
 	err := rc.Set("1233", old, 300)
 	if err != nil {
-		t.Fatalf("")
+		t.Fatalf("Redis set failed: %v", err)
 	}
 
 	res := &r{}
 	err2 := rc.Get("1233", res)
 	if err2 != nil {
-		t.Fatalf("")
+		t.Fatalf("Redis get failed: %v", err2)
 	}
 	if !reflect.DeepEqual(res, old) {
-		t.Fatalf("")
+		t.Fatalf("Redis JSON value mismatch: got %v, want %v", res, old)
 	}
 	fmt.Println(res, res.Aa)
 }
 
 func BenchmarkRSet(b *testing.B) {
-	rc := RedisCacheInit(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
-	})
+	rc := newRedisTestCache(b)
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
-		rc.Set("123", "{dsv}", 1000)
+		if err := rc.Set("123", "{dsv}", 1000); err != nil {
+			b.Fatalf("Redis set failed: %v", err)
+		}
 	}
 }
 
 func BenchmarkRGet(b *testing.B) {
-	rc := RedisCacheInit(&redis.Options{
-		Addr:     "192.168.1.168:6379",
-		Password: "", // no password set
-		DB:       0,  // use default DB
-	})
+	rc := newRedisTestCache(b)
+	if err := rc.Set("123", "{dsv}", 1000); err != nil {
+		b.Fatalf("Redis seed failed: %v", err)
+	}
 	b.ResetTimer()
 	v := ""
 	for i := 0; i < b.N; i++ {
-		rc.Get("123", &v)
+		if err := rc.Get("123", &v); err != nil {
+			b.Fatalf("Redis get failed: %v", err)
+		}
 	}
 }
diff --git a/api/lib/cache/simple_cache_test.go b/api/lib/cache/simple_cache_test.go
index 9f73efc..4a528c4 100644
--- a/api/lib/cache/simple_cache_test.go
+++ b/api/lib/cache/simple_cache_test.go
@@ -87,7 +87,7 @@ func TestSimpleCache_GetStruct(t *testing.T) {
 	err2 := s.Get("key", res)
 	fmt.Println("res", res)
 	if err2 != nil {
-		t.Fatalf("" + err2.Error())
+		t.Fatalf("%s", err2.Error())
 
 	}
 
@@ -99,7 +99,7 @@ func TestSimpleCache_GetStruct(t *testing.T) {
 	err3 := s.Get("key", res2)
 	fmt.Println("res2", res2, res2.R.AA, res2.R.BB)
 	if err3 != nil {
-		t.Fatalf("" + err3.Error())
+		t.Fatalf("%s", err3.Error())
 
 	}
 	//if reflect.DeepEqual(res, old) {
diff --git a/api/lib/lock/local_test.go b/api/lib/lock/local_test.go
index 68c783c..225f3b0 100644
--- a/api/lib/lock/local_test.go
+++ b/api/lib/lock/local_test.go
@@ -16,7 +16,6 @@ func TestLocal_GetLock(t *testing.T) {
 	i := 0
 	go func() {
 		l1 = l.GetLock("key")
-		fmt.Println("l1", l1, i)
 		l1.Lock()
 		fmt.Println("l1", i)
 		i++
@@ -25,7 +24,6 @@ func TestLocal_GetLock(t *testing.T) {
 	}()
 	go func() {
 		l2 = l.GetLock("key")
-		fmt.Println("l2", l2, i)
 		l2.Lock()
 		fmt.Println("l2", i)
 		i++
@@ -34,7 +32,6 @@ func TestLocal_GetLock(t *testing.T) {
 	}()
 	go func() {
 		l3 = l.GetLock("key")
-		fmt.Println("l3", l3, i)
 		l3.Lock()
 		fmt.Println("l3", i)
 		i++
diff --git a/api/model/addressBook.go b/api/model/addressBook.go
index c5eab3c..ba60f71 100644
--- a/api/model/addressBook.go
+++ b/api/model/addressBook.go
@@ -1,4 +1,4 @@
-package model
+package model
 
 import "rustdesk-server/api/model/custom_types"
 
@@ -22,12 +22,12 @@ type AddressBook struct {
 	RowId            uint                   `gorm:"primaryKey" json:"row_id"`
 	Id               string                 `json:"id" gorm:"default:0;not null;index"`
 	Username         string                 `json:"username" gorm:"default:'';not null;"`
-	Password         string                 `json:"password" gorm:"default:'';not null;"`
+	Password         string                 `json:"-" gorm:"default:'';not null;"`
 	Hostname         string                 `json:"hostname" gorm:"default:'';not null;"`
 	Alias            string                 `json:"alias" gorm:"default:'';not null;"`
 	Platform         string                 `json:"platform" gorm:"default:'';not null;"`
 	Tags             custom_types.AutoJson  `json:"tags" gorm:"not null;" swaggertype:"array,string"`
-	Hash             string                 `json:"hash" gorm:"default:'';not null;"`
+	Hash             string                 `json:"-" gorm:"default:'';not null;"`
 	UserId           uint                   `json:"user_id" gorm:"default:0;not null;index"`
 	ForceAlwaysRelay bool                   `json:"forceAlwaysRelay" gorm:"default:0;not null;"`
 	RdpPort          string                 `json:"rdpPort" gorm:"default:'';not null;"`
@@ -45,6 +45,75 @@ type AddressBookList struct {
 	Pagination
 }
 
+// AddressBookSafe is the normal response view. Password and Hash are stored
+// credentials used by typed write/protocol flows and are intentionally absent
+// from this DTO; all unrelated address-book metadata remains available.
+type AddressBookSafe struct {
+	RowId            uint                   `json:"row_id"`
+	Id               string                 `json:"id"`
+	Username         string                 `json:"username"`
+	Hostname         string                 `json:"hostname"`
+	Alias            string                 `json:"alias"`
+	Platform         string                 `json:"platform"`
+	Tags             custom_types.AutoJson  `json:"tags" gorm:"not null;" swaggertype:"array,string"`
+	UserId           uint                   `json:"user_id"`
+	ForceAlwaysRelay bool                   `json:"forceAlwaysRelay"`
+	RdpPort          string                 `json:"rdpPort"`
+	RdpUsername      string                 `json:"rdpUsername"`
+	Online           bool                   `json:"online"`
+	LoginName        string                 `json:"loginName"`
+	SameServer       bool                   `json:"sameServer"`
+	CollectionId     uint                   `json:"collection_id"`
+	Collection       *AddressBookCollection `json:"collection,omitempty"`
+	TimeModel
+}
+
+type AddressBookSafeList struct {
+	AddressBooks []*AddressBookSafe `json:"list"`
+	Pagination
+}
+
+// Safe returns the response-only address-book view without stored credentials.
+func (a *AddressBook) Safe() *AddressBookSafe {
+	if a == nil {
+		return nil
+	}
+	return &AddressBookSafe{
+		RowId:            a.RowId,
+		Id:               a.Id,
+		Username:         a.Username,
+		Hostname:         a.Hostname,
+		Alias:            a.Alias,
+		Platform:         a.Platform,
+		Tags:             a.Tags,
+		UserId:           a.UserId,
+		ForceAlwaysRelay: a.ForceAlwaysRelay,
+		RdpPort:          a.RdpPort,
+		RdpUsername:      a.RdpUsername,
+		Online:           a.Online,
+		LoginName:        a.LoginName,
+		SameServer:       a.SameServer,
+		CollectionId:     a.CollectionId,
+		Collection:       a.Collection,
+		TimeModel:        a.TimeModel,
+	}
+}
+
+// Safe returns a paginated response-only address-book view.
+func (l *AddressBookList) Safe() *AddressBookSafeList {
+	if l == nil {
+		return nil
+	}
+	view := &AddressBookSafeList{Pagination: l.Pagination}
+	if l.AddressBooks != nil {
+		view.AddressBooks = make([]*AddressBookSafe, 0, len(l.AddressBooks))
+		for _, addressBook := range l.AddressBooks {
+			view.AddressBooks = append(view.AddressBooks, addressBook.Safe())
+		}
+	}
+	return view
+}
+
 type AddressBookCollection struct {
 	IdModel
 	UserId uint   `json:"user_id" gorm:"default:0;not null;index"`
@@ -59,8 +128,8 @@ type AddressBookCollectionRule struct {
 	IdModel
 	UserId       uint `json:"user_id" gorm:"default:0;not null;"`
 	CollectionId uint `json:"collection_id" gorm:"default:0;not null;index" validate:"required"`
-	Rule         int  `json:"rule" gorm:"default:0;not null;" validate:"required,gte=1,lte=3"` // 0:  1:  2:   3: 
-	Type         int  `json:"type" gorm:"default:1;not null;" validate:"required,gte=1,lte=2"` // 1:  2: 
+	Rule         int  `json:"rule" gorm:"default:0;not null;" validate:"required,gte=1,lte=3"` // 0:  1:  2:   3:
+	Type         int  `json:"type" gorm:"default:1;not null;" validate:"required,gte=1,lte=2"` // 1:  2:
 	ToId         uint `json:"to_id" gorm:"default:0;not null;" validate:"required,gt=0"`
 	TimeModel
 }
diff --git a/api/model/custom_build.go b/api/model/custom_build.go
index ca09e84..42d810b 100644
--- a/api/model/custom_build.go
+++ b/api/model/custom_build.go
@@ -14,18 +14,58 @@ type CustomBuild struct {
 	Version     string `json:"version" gorm:"size:32;default:'';not null;"`
 	Status      string `json:"status" gorm:"size:32;default:'pending';not null;"`
 	AppName     string `json:"app_name" gorm:"size:128;default:'';not null;"`
-	CustomJson  string `json:"custom_json" gorm:"type:text;"`
+	CustomJson  string `json:"-" gorm:"type:text;"`
 	BuildLog    string `json:"build_log" gorm:"type:text;"`
 	FileSize    int64  `json:"file_size" gorm:"default:0;not null;"`
-	DownloadKey string `json:"download_key" gorm:"size:64;default:'';not null;"`
+	DownloadKey string `json:"-" gorm:"size:64;default:'';not null;"`
 	// DownloadKeyExpiresAt — unix-секунды, после которых capability-ссылка
 	// (download_key) протухает (BUGS.md B-006). 0 = бессрочно: legacy-строки,
 	// созданные до появления TTL, остаются доступны.
 	DownloadKeyExpiresAt int64 `json:"download_key_expires_at" gorm:"default:0;not null;"`
 	// GithubRunId — id рана GitHub Actions, если билд диспетчился туда. Нужен для
-	// возобновления `pollAndDownload` после рестарта api (BUGS.md B-003). 0 = file-queue
-	// или ещё не диспетчен.
+	// возобновления `pollAndDownload` после рестарта api (BUGS.md B-003). 0 = legacy
+	// file-queue/не диспетчен; это не допустимый id текущего provider-backed рана.
 	GithubRunId int64 `json:"github_run_id" gorm:"default:0;not null;"`
+	// Immutable GitHub dispatch provenance. These fields are provider-derived
+	// build metadata; secrets and the dispatch payload are intentionally absent.
+	GithubProvider string `json:"github_provider" gorm:"size:32;default:'';not null;"`
+	GithubRepo     string `json:"github_repo" gorm:"size:128;default:'';not null;"`
+	GithubWorkflow string `json:"github_workflow" gorm:"size:128;default:'';not null;"`
+	// WorkflowSelector is the exact provider ref used to dispatch the workflow.
+	// GithubRef remains the separately persisted immutable execution SHA.
+	WorkflowSelector string `json:"-" gorm:"size:128;default:'';not null;"`
+	// GithubRef is the immutable commit SHA of the workflow execution ref used
+	// for dispatch. The source tag SHA remains in BuildRef and is never replaced
+	// by this value. Mutable legacy refs are not accepted for new polling.
+	GithubRef          string `json:"github_ref" gorm:"size:128;default:'';not null;"`
+	GithubArtifactName string `json:"github_artifact_name" gorm:"size:128;default:'';not null;"`
+	GithubArtifactID   int64  `json:"github_artifact_id" gorm:"default:0;not null;"`
+	GithubRunUrl       string `json:"github_run_url" gorm:"size:512;default:'';not null;"`
+	GithubHtmlUrl      string `json:"github_html_url" gorm:"size:512;default:'';not null;"`
+	// GithubSourceSha retains the provider-observed run head_sha. It must match
+	// GithubRef (the execution SHA); BuildRef remains the checked-out source SHA.
+	GithubSourceSha string `json:"github_source_sha" gorm:"size:128;default:'';not null;"`
+	// PublicationRecordedAt is a non-secret, service-generated proof that the
+	// exact dispatched artifact was validated and atomically published. 0 means
+	// no publication has been recorded.
+	PublicationRecordedAt int64 `json:"-" gorm:"default:0;not null;"`
+	// PublishedDigest is the service-generated SHA-256 manifest of the
+	// canonical published output. It is write-once with PublicationRecordedAt.
+	PublishedDigest string `json:"-" gorm:"size:64;default:'';not null;"`
+	// ProducerManifestJSON is the validated, secret-free manifest emitted by
+	// the provider workflow. It is retained so handoff exports do not depend on
+	// the extracted manifest.txt or a mutable host filesystem.
+	ProducerManifestJSON string `json:"-" gorm:"type:text;"`
+	// Version remains the display metadata selected by the user. These fields
+	// are the immutable, system-derived release identity used for dispatch.
+	BuildRef        string `json:"-" gorm:"size:128;default:'';not null;"`
+	SourceTag       string `json:"-" gorm:"size:128;default:'';not null;"`
+	AssetsRelease   string `json:"-" gorm:"size:128;default:'';not null;"`
+	AssetsReleaseID int64  `json:"-" gorm:"default:0;not null;"`
+	// AssetsReleaseAssets is canonical JSON of provider-supplied required asset
+	// IDs, names, and digests. It is storage-only; BuildProvenance exposes the
+	// typed form when reporting immutable publication metadata.
+	AssetsReleaseAssets string `json:"-" gorm:"type:text;"`
 	TimeModel
 }
 
@@ -34,19 +74,142 @@ type CustomBuildList struct {
 	Pagination
 }
 
+// CustomBuildSafe is the administrative response view. It keeps the existing
+// non-secret build contract while replacing custom_json with its redacted,
+// canonical settings view. Storage-only identity fields remain excluded.
+type CustomBuildSafe struct {
+	Id                   uint   `json:"id"`
+	UserId               uint   `json:"user_id"`
+	Name                 string `json:"name"`
+	Platform             string `json:"platform"`
+	Version              string `json:"version"`
+	Status               string `json:"status"`
+	AppName              string `json:"app_name"`
+	CustomJson           string `json:"custom_json"`
+	BuildLog             string `json:"build_log"`
+	FileSize             int64  `json:"file_size"`
+	DownloadKeyExpiresAt int64  `json:"download_key_expires_at"`
+	GithubRunId          int64  `json:"github_run_id"`
+	GithubProvider       string `json:"github_provider"`
+	GithubRepo           string `json:"github_repo"`
+	GithubWorkflow       string `json:"github_workflow"`
+	GithubRef            string `json:"github_ref"`
+	GithubArtifactName   string `json:"github_artifact_name"`
+	GithubArtifactID     int64  `json:"github_artifact_id"`
+	GithubRunUrl         string `json:"github_run_url"`
+	GithubHtmlUrl        string `json:"github_html_url"`
+	GithubSourceSha      string `json:"github_source_sha"`
+	TimeModel
+}
+
+// CustomBuildSafeList is the paginated administrative response view.
+type CustomBuildSafeList struct {
+	CustomBuilds []*CustomBuildSafe `json:"list"`
+	Pagination
+}
+
+// CustomBuildPublic is the response view for the unauthenticated capability
+// route. It contains only the status/version/platform/app and download fields
+// needed by the public UI. Provider metadata, build logs, custom configuration,
+// and DownloadKey are intentionally excluded.
+type CustomBuildPublic struct {
+	Id                   uint   `json:"id"`
+	Name                 string `json:"name"`
+	Platform             string `json:"platform"`
+	Version              string `json:"version"`
+	Status               string `json:"status"`
+	AppName              string `json:"app_name"`
+	FileSize             int64  `json:"file_size"`
+	DownloadKeyExpiresAt int64  `json:"download_key_expires_at"`
+}
+
+// Safe returns a response-only view that cannot serialize the raw model's
+// decrypted or encrypted custom_json representation.
+func (c *CustomBuild) Safe() *CustomBuildSafe {
+	if c == nil {
+		return nil
+	}
+	return &CustomBuildSafe{
+		Id:                   c.Id,
+		UserId:               c.UserId,
+		Name:                 c.Name,
+		Platform:             c.Platform,
+		Version:              c.Version,
+		Status:               c.Status,
+		AppName:              c.AppName,
+		CustomJson:           utils.RedactCustomBuilderJSON(c.CustomJson),
+		BuildLog:             c.BuildLog,
+		FileSize:             c.FileSize,
+		DownloadKeyExpiresAt: c.DownloadKeyExpiresAt,
+		GithubRunId:          c.GithubRunId,
+		GithubProvider:       c.GithubProvider,
+		GithubRepo:           c.GithubRepo,
+		GithubWorkflow:       c.GithubWorkflow,
+		GithubRef:            c.GithubRef,
+		GithubArtifactName:   c.GithubArtifactName,
+		GithubArtifactID:     c.GithubArtifactID,
+		GithubRunUrl:         c.GithubRunUrl,
+		GithubHtmlUrl:        c.GithubHtmlUrl,
+		GithubSourceSha:      c.GithubSourceSha,
+		TimeModel:            c.TimeModel,
+	}
+}
+
+// Public returns the redacted view used by the public capability detail route.
+// Unlike Safe, this view has no capability key or other route credential.
+func (c *CustomBuild) Public() *CustomBuildPublic {
+	if c == nil {
+		return nil
+	}
+	return &CustomBuildPublic{
+		Id:                   c.Id,
+		Name:                 c.Name,
+		Platform:             c.Platform,
+		Version:              c.Version,
+		Status:               c.Status,
+		AppName:              c.AppName,
+		FileSize:             c.FileSize,
+		DownloadKeyExpiresAt: c.DownloadKeyExpiresAt,
+	}
+}
+
+// Safe returns a paginated response-only view for administrative consumers.
+func (l *CustomBuildList) Safe() *CustomBuildSafeList {
+	if l == nil {
+		return nil
+	}
+	view := &CustomBuildSafeList{Pagination: l.Pagination}
+	if l.CustomBuilds != nil {
+		view.CustomBuilds = make([]*CustomBuildSafe, 0, len(l.CustomBuilds))
+		for _, build := range l.CustomBuilds {
+			view.CustomBuilds = append(view.CustomBuilds, build.Safe())
+		}
+	}
+	return view
+}
+
 const (
-	CustomBuildStatusPending   = "pending"
-	CustomBuildStatusBuilding  = "building"
-	CustomBuildStatusDone      = "done"
-	CustomBuildStatusFailed    = "failed"
+	CustomBuildStatusPending     = "pending"
+	CustomBuildStatusBuilding    = "building"
+	CustomBuildStatusDownloading = "downloading"
+	CustomBuildStatusExtracting  = "extracting"
+	CustomBuildStatusDone        = "done"
+	CustomBuildStatusFailed      = "failed"
 )
 
-// --- BUGS.md B-008: permanent_password лежит внутри custom_json. Шифруем весь
-// JSON-блоб at rest; вызывающий код видит открытый JSON как раньше. ------------
+// --- BUGS.md B-008: non-empty permanent_password lies inside custom_json.
+// Secret-bearing JSON is encrypted at rest; non-secret typed JSON keeps its
+// existing representation so core non-secret operations remain available. ----
 
 func (c *CustomBuild) BeforeSave(tx *gorm.DB) error {
-	var err error
-	c.CustomJson, err = utils.EncryptSecret(c.CustomJson)
+	if err := utils.ValidateCustomBuilderJSONFields(c.CustomJson); err != nil {
+		return err
+	}
+	customJSON, err := utils.EncryptCustomBuilderJSON(c.CustomJson)
+	if err != nil {
+		return err
+	}
+	c.CustomJson = customJSON
 	return err
 }
 
diff --git a/api/model/custom_build_test.go b/api/model/custom_build_test.go
new file mode 100644
index 0000000..01c24ec
--- /dev/null
+++ b/api/model/custom_build_test.go
@@ -0,0 +1,47 @@
+package model
+
+import (
+	"testing"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestCustomBuildAutoMigrateAddsProvenanceAndReadsLegacyRows(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	defer sqlDB.Close()
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(&CustomBuild{}); err != nil {
+		t.Fatalf("AutoMigrate() error = %v", err)
+	}
+	for _, column := range []string{
+		"github_provider", "github_repo", "github_workflow", "workflow_selector", "github_ref",
+		"github_artifact_name", "github_artifact_id", "github_run_url", "github_html_url", "github_source_sha",
+		"build_ref", "source_tag", "assets_release", "assets_release_id",
+		"assets_release_assets",
+		"publication_recorded_at", "published_digest",
+		"producer_manifest_json",
+	} {
+		if !db.Migrator().HasColumn(&CustomBuild{}, column) {
+			t.Errorf("AutoMigrate() missing provenance column %q", column)
+		}
+	}
+	legacy := &CustomBuild{Status: CustomBuildStatusBuilding, GithubRunId: 77, DownloadKey: "legacy-download-key"}
+	if err := db.Create(legacy).Error; err != nil {
+		t.Fatalf("create legacy row: %v", err)
+	}
+	var loaded CustomBuild
+	if err := db.First(&loaded, legacy.Id).Error; err != nil {
+		t.Fatalf("read legacy row: %v", err)
+	}
+	if loaded.GithubRunId != 77 || loaded.DownloadKey != "legacy-download-key" || loaded.GithubRepo != "" || loaded.GithubSourceSha != "" || loaded.PublicationRecordedAt != 0 || loaded.PublishedDigest != "" {
+		t.Fatalf("legacy row was not readable with empty provenance: %#v", loaded)
+	}
+}
diff --git a/api/model/custom_preset.go b/api/model/custom_preset.go
index 513f8ea..2476eeb 100644
--- a/api/model/custom_preset.go
+++ b/api/model/custom_preset.go
@@ -13,7 +13,7 @@ type CustomPreset struct {
 	Platform   string `json:"platform" gorm:"size:32;default:'';not null;"`
 	Version    string `json:"version" gorm:"size:32;default:'';not null;"`
 	AppName    string `json:"app_name" gorm:"size:128;default:'';not null;"`
-	CustomJson string `json:"custom_json" gorm:"type:text;"`
+	CustomJson string `json:"-" gorm:"type:text;"`
 	TimeModel
 }
 
@@ -22,12 +22,70 @@ type CustomPresetList struct {
 	Pagination
 }
 
-// --- BUGS.md B-008: permanent_password лежит внутри custom_json. Шифруем весь
-// JSON-блоб at rest; вызывающий код видит открытый JSON как раньше. ------------
+// CustomPresetSafe is the administrative response view. Its custom_json is
+// limited to canonical non-secret settings.
+type CustomPresetSafe struct {
+	Id         uint   `json:"id"`
+	UserId     uint   `json:"user_id"`
+	Name       string `json:"name"`
+	Platform   string `json:"platform"`
+	Version    string `json:"version"`
+	AppName    string `json:"app_name"`
+	CustomJson string `json:"custom_json"`
+	TimeModel
+}
+
+// CustomPresetSafeList is the paginated administrative response view.
+type CustomPresetSafeList struct {
+	CustomPresets []*CustomPresetSafe `json:"list"`
+	Pagination
+}
+
+// Safe returns a response-only view that cannot serialize raw custom_json.
+func (c *CustomPreset) Safe() *CustomPresetSafe {
+	if c == nil {
+		return nil
+	}
+	return &CustomPresetSafe{
+		Id:         c.Id,
+		UserId:     c.UserId,
+		Name:       c.Name,
+		Platform:   c.Platform,
+		Version:    c.Version,
+		AppName:    c.AppName,
+		CustomJson: utils.RedactCustomBuilderJSON(c.CustomJson),
+		TimeModel:  c.TimeModel,
+	}
+}
+
+// Safe returns a paginated response-only view for administrative consumers.
+func (l *CustomPresetList) Safe() *CustomPresetSafeList {
+	if l == nil {
+		return nil
+	}
+	view := &CustomPresetSafeList{Pagination: l.Pagination}
+	if l.CustomPresets != nil {
+		view.CustomPresets = make([]*CustomPresetSafe, 0, len(l.CustomPresets))
+		for _, preset := range l.CustomPresets {
+			view.CustomPresets = append(view.CustomPresets, preset.Safe())
+		}
+	}
+	return view
+}
+
+// --- BUGS.md B-008: non-empty permanent_password lies inside custom_json.
+// Secret-bearing JSON is encrypted at rest; non-secret typed JSON keeps its
+// existing representation so core non-secret operations remain available. ----
 
 func (c *CustomPreset) BeforeSave(tx *gorm.DB) error {
-	var err error
-	c.CustomJson, err = utils.EncryptSecret(c.CustomJson)
+	if err := utils.ValidateCustomBuilderJSONFields(c.CustomJson); err != nil {
+		return err
+	}
+	customJSON, err := utils.EncryptCustomBuilderJSON(c.CustomJson)
+	if err != nil {
+		return err
+	}
+	c.CustomJson = customJSON
 	return err
 }
 
diff --git a/api/model/custom_safe_test.go b/api/model/custom_safe_test.go
new file mode 100644
index 0000000..70b304a
--- /dev/null
+++ b/api/model/custom_safe_test.go
@@ -0,0 +1,175 @@
+package model
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestCustomBuildSafeResponsesRedactSecretCustomJSON(t *testing.T) {
+	build := &CustomBuild{
+		IdModel:    IdModel{Id: 7},
+		Name:       "safe-build",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		CustomJson: `{"enable_audio":true,"key":"public-key","permanent_password":"builder-secret","nested":{"token":"nested-secret"}}`,
+	}
+
+	views := []struct {
+		name string
+		view any
+	}{
+		{name: "list", view: (&CustomBuildList{CustomBuilds: []*CustomBuild{build}}).Safe()},
+		{name: "detail", view: build.Safe()},
+		{name: "create", view: build.Safe()},
+		{name: "update", view: build.Safe()},
+	}
+	for _, test := range views {
+		t.Run(test.name, func(t *testing.T) {
+			assertSafeCustomResponse(t, test.view)
+		})
+	}
+}
+
+func TestCustomPresetSafeResponsesRedactSecretCustomJSON(t *testing.T) {
+	preset := &CustomPreset{
+		IdModel:    IdModel{Id: 8},
+		Name:       "safe-preset",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		CustomJson: `{"enable_audio":true,"key":"public-key","permanent_password":"preset-secret","nested":{"secret":"nested-secret"}}`,
+	}
+
+	views := []struct {
+		name string
+		view any
+	}{
+		{name: "list", view: (&CustomPresetList{CustomPresets: []*CustomPreset{preset}}).Safe()},
+		{name: "detail", view: preset.Safe()},
+		{name: "create", view: preset.Safe()},
+		{name: "update", view: preset.Safe()},
+	}
+	for _, test := range views {
+		t.Run(test.name, func(t *testing.T) {
+			assertSafeCustomResponse(t, test.view)
+		})
+	}
+}
+
+func TestCustomSafeViewNeverSerializesCiphertext(t *testing.T) {
+	build := &CustomBuild{CustomJson: "enc:v1:not-ciphertext"}
+	preset := &CustomPreset{CustomJson: "enc:v1:not-ciphertext"}
+	for _, view := range []any{build.Safe(), preset.Safe()} {
+		encoded, err := json.Marshal(view)
+		if err != nil {
+			t.Fatalf("marshal safe view: %v", err)
+		}
+		if strings.Contains(string(encoded), "enc:v1:") {
+			t.Fatalf("safe view exposed ciphertext: %s", encoded)
+		}
+	}
+}
+
+func TestRawSecretBearingModelsNeverSerializeStorageFields(t *testing.T) {
+	models := []any{
+		&GithubBuildConfig{Repo: "owner/repo", WorkflowRefApproved: true, Token: "github_pat_secret", PayloadKey: "payload-secret"},
+		&CustomBuild{CustomJson: `{"permanent_password":"build-secret","enable_audio":true}`},
+		&CustomPreset{CustomJson: `{"permanent_password":"preset-secret"}`},
+	}
+	for _, value := range models {
+		encoded, err := json.Marshal(value)
+		if err != nil {
+			t.Fatalf("marshal raw model: %v", err)
+		}
+		response := string(encoded)
+		for _, forbidden := range []string{"github_pat_secret", "payload-secret", "build-secret", "preset-secret", "custom_json", "payload_key", `"token"`, `"workflow_ref_approved"`} {
+			if strings.Contains(response, forbidden) {
+				t.Fatalf("raw model serialized forbidden field/value %q: %s", forbidden, response)
+			}
+		}
+	}
+}
+
+func TestGithubBuildConfigSafeViewPreservesPresenceFlagsOnly(t *testing.T) {
+	encoded, err := json.Marshal((&GithubBuildConfig{
+		Repo:       "owner/repo",
+		Token:      "github_pat_secret",
+		PayloadKey: "payload-secret",
+	}).Safe())
+	if err != nil {
+		t.Fatalf("marshal safe config: %v", err)
+	}
+	response := string(encoded)
+	for _, forbidden := range []string{"github_pat_secret", "payload-secret", `"token"`, `"payload_key"`} {
+		if strings.Contains(response, forbidden) {
+			t.Fatalf("safe config serialized forbidden value/field %q: %s", forbidden, response)
+		}
+	}
+	for _, expected := range []string{`"has_token":true`, `"has_payload_key":true`} {
+		if !strings.Contains(response, expected) {
+			t.Fatalf("safe config omitted %q: %s", expected, response)
+		}
+	}
+}
+
+func TestGithubBuildConfigSafeViewDistinguishesProviderPolicyStatus(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		approved   bool
+		verified   bool
+		sha        string
+		branch     string
+		wantStatus string
+	}{
+		{name: "approval required", wantStatus: WorkflowRefStatusApprovalRequired},
+		{name: "legacy attestation", approved: true, wantStatus: WorkflowRefStatusProviderPolicyUnverified},
+		{name: "provider-backed approval", approved: true, verified: true, wantStatus: WorkflowRefStatusApproved},
+		{name: "malformed historical SHA", approved: true, verified: true, sha: "historical-sha", wantStatus: WorkflowRefStatusProviderPolicyUnverified},
+		{name: "mutable historical selector", approved: true, verified: true, branch: "refs/heads/main", wantStatus: WorkflowRefStatusProviderPolicyUnverified},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			sha := test.sha
+			if sha == "" {
+				sha = strings.Repeat("a", 40)
+			}
+			branch := test.branch
+			if branch == "" {
+				branch = "refs/tags/workflow-v1"
+			}
+			view := (&GithubBuildConfig{
+				Branch:                      branch,
+				WorkflowRefApproved:         test.approved,
+				WorkflowRefProviderVerified: test.verified,
+				WorkflowRefApprovalSHA:      sha,
+			}).Safe()
+			if view.WorkflowRefStatus != test.wantStatus {
+				t.Fatalf("workflow_ref_status = %q, want %q", view.WorkflowRefStatus, test.wantStatus)
+			}
+			if test.wantStatus == WorkflowRefStatusApproved && view.WorkflowRefTrustStatus != WorkflowRefTrustProviderReported {
+				t.Fatalf("workflow_ref_trust_status = %q, want provider-reported", view.WorkflowRefTrustStatus)
+			}
+			if test.wantStatus != WorkflowRefStatusApproved && view.WorkflowRefApproved {
+				t.Fatal("malformed or stale approval was exposed as effective approved")
+			}
+		})
+	}
+}
+
+func assertSafeCustomResponse(t *testing.T, view any) {
+	t.Helper()
+	encoded, err := json.Marshal(view)
+	if err != nil {
+		t.Fatalf("marshal safe response: %v", err)
+	}
+	response := string(encoded)
+	for _, secret := range []string{"builder-secret", "preset-secret", "nested-secret", "permanent_password", `"token"`, `"secret"`} {
+		if strings.Contains(response, secret) {
+			t.Fatalf("safe response exposed %q: %s", secret, response)
+		}
+	}
+	for _, nonSecret := range []string{"enable_audio", "public-key"} {
+		if !strings.Contains(response, nonSecret) {
+			t.Fatalf("safe response omitted non-secret %q: %s", nonSecret, response)
+		}
+	}
+}
diff --git a/api/model/github_build_config.go b/api/model/github_build_config.go
index 1567132..d4f4e4e 100644
--- a/api/model/github_build_config.go
+++ b/api/model/github_build_config.go
@@ -1,6 +1,8 @@
 package model
 
 import (
+	"strings"
+
 	"rustdesk-server/api/utils"
 
 	"gorm.io/gorm"
@@ -19,11 +21,25 @@ import (
 // `Secrets: write` у fine-grained PAT).
 type GithubBuildConfig struct {
 	IdModel
-	Repo             string `json:"repo"              gorm:"size:128;default:'';not null;"`      // owner/name, напр. "bashrusakh/rustdesk"
-	WorkflowFilename string `json:"workflow_filename" gorm:"size:128;default:'';not null;"`      // напр. "rustqs-windows-min-test.yml"
-	Branch           string `json:"branch"            gorm:"size:128;default:'rustqs/min-test';not null;"` // ветка форка, на которой лежат rustqs-*.yml воркфлоу
-	Token            string `json:"token,omitempty"   gorm:"type:text;"`                         // PAT (fine-grained); в API-ответах ОПУСКАЕМ
-	PayloadKey       string `json:"payload_key,omitempty" gorm:"type:text;"`                     // AES-passphrase; в API-ответах ОПУСКАЕМ
+	Repo string `json:"repo" gorm:"size:128;default:'';not null;"` // configured owner/name
+	// WorkflowFilename is retained as an unread legacy column for migration
+	// safety. Branch is retained as a storage-compatibility slot; the service
+	// normalizes only known legacy owned values to rustqs/workflows. Workflow
+	// selectors are branch/tag names; resolved commit SHAs are stored on builds.
+	WorkflowFilename    string `json:"-" gorm:"size:128;default:'';not null;"`
+	Branch              string `json:"-" gorm:"size:128;default:'';not null;"`
+	WorkflowRefApproved bool   `json:"-" gorm:"default:false;not null;"`
+	// WorkflowRefProviderVerified records that the last explicit approval had
+	// provider-reported verification and protection evidence. It is status
+	// metadata only, not a cryptographic signer allowlist; build preparation and
+	// dispatch always revalidate GitHub evidence.
+	WorkflowRefProviderVerified bool `json:"-" gorm:"default:false;not null;"`
+	// WorkflowRefApprovalSHA is the provider-resolved commit recorded with the
+	// explicit tag approval. Builds compare it with a fresh provider resolution
+	// so a moved tag cannot reuse an old approval.
+	WorkflowRefApprovalSHA string `json:"-" gorm:"size:64;default:'';not null;"`
+	Token                  string `json:"-" gorm:"type:text;"` // PAT (fine-grained); доступен только provider boundary
+	PayloadKey             string `json:"-" gorm:"type:text;"` // AES-passphrase; доступен только provider boundary
 	TimeModel
 }
 
@@ -31,24 +47,108 @@ type GithubBuildConfig struct {
 // замещены booleanами "has_*", чтобы UI знал, заданы ли они, но не получал значений.
 type GithubBuildConfigSafe struct {
 	IdModel
-	Repo             string `json:"repo"`
-	WorkflowFilename string `json:"workflow_filename"`
-	Branch           string `json:"branch"`
-	HasToken         bool   `json:"has_token"`
-	HasPayloadKey    bool   `json:"has_payload_key"`
+	Repo                   string `json:"repo"`
+	WorkflowRef            string `json:"workflow_ref"`
+	WorkflowRefApproved    bool   `json:"workflow_ref_approved"`
+	WorkflowRefStatus      string `json:"workflow_ref_status"`
+	WorkflowRefTrustStatus string `json:"workflow_ref_trust_status"`
+	HasToken               bool   `json:"has_token"`
+	HasPayloadKey          bool   `json:"has_payload_key"`
 	TimeModel
 }
 
 func (c *GithubBuildConfig) Safe() *GithubBuildConfigSafe {
 	return &GithubBuildConfigSafe{
-		IdModel:          c.IdModel,
-		Repo:             c.Repo,
-		WorkflowFilename: c.WorkflowFilename,
-		Branch:           c.Branch,
-		HasToken:         c.Token != "",
-		HasPayloadKey:    c.PayloadKey != "",
-		TimeModel:        c.TimeModel,
+		IdModel:                c.IdModel,
+		Repo:                   c.Repo,
+		WorkflowRef:            safeWorkflowRef(c.Branch),
+		WorkflowRefApproved:    c.workflowRefStatus() == WorkflowRefStatusApproved,
+		WorkflowRefStatus:      c.workflowRefStatus(),
+		WorkflowRefTrustStatus: c.workflowRefTrust(),
+		HasToken:               c.Token != "",
+		HasPayloadKey:          c.PayloadKey != "",
+		TimeModel:              c.TimeModel,
+	}
+}
+
+const (
+	WorkflowRefStatusApprovalRequired         = "approval-required"
+	WorkflowRefStatusProviderPolicyUnverified = "provider-policy-unverified"
+	WorkflowRefStatusApproved                 = "approved"
+	WorkflowRefTrustProviderReported          = "provider-reported"
+	WorkflowRefTrustUnverified                = "unverified"
+)
+
+func (c *GithubBuildConfig) workflowRefStatus() string {
+	if c == nil || !c.WorkflowRefApproved {
+		return WorkflowRefStatusApprovalRequired
+	}
+	if !c.WorkflowRefProviderVerified || safeWorkflowTag(c.Branch) == "" || !validWorkflowApprovalSHA(c.WorkflowRefApprovalSHA) {
+		return WorkflowRefStatusProviderPolicyUnverified
+	}
+	if _, err := approvedWorkflowRefForSafeStatus(c.Branch); err != nil {
+		return WorkflowRefStatusProviderPolicyUnverified
 	}
+	return WorkflowRefStatusApproved
+}
+
+func validWorkflowApprovalSHA(sha string) bool {
+	if len(sha) < 40 || len(sha) > 64 {
+		return false
+	}
+	for _, char := range sha {
+		if (char < '0' || char > '9') && (char < 'a' || char > 'f') && (char < 'A' || char > 'F') {
+			return false
+		}
+	}
+	return true
+}
+
+// approvedWorkflowRefForSafeStatus mirrors the closed provider selector policy
+// without importing the service package into the model package. Safe status is
+// never "approved" for a mutable, malformed, or raw-SHA selector.
+func approvedWorkflowRefForSafeStatus(ref string) (string, error) {
+	const tagPrefix = "refs/tags/"
+	if !strings.HasPrefix(ref, tagPrefix) {
+		return "", gorm.ErrInvalidData
+	}
+	tag := strings.TrimPrefix(ref, tagPrefix)
+	if safeWorkflowTag(ref) == "" || validWorkflowApprovalSHA(tag) {
+		return "", gorm.ErrInvalidData
+	}
+	return ref, nil
+}
+
+func (c *GithubBuildConfig) workflowRefTrust() string {
+	if c != nil && c.WorkflowRefProviderVerified {
+		return WorkflowRefTrustProviderReported
+	}
+	return WorkflowRefTrustUnverified
+}
+
+// safeWorkflowRef exposes only the selected tag label. Mutable compatibility
+// values and raw refs are deliberately never serialized to an API client.
+func safeWorkflowRef(ref string) string {
+	ref = strings.TrimSpace(ref)
+	return safeWorkflowTag(ref)
+}
+
+func safeWorkflowTag(ref string) string {
+	const tagPrefix = "refs/tags/"
+	if !strings.HasPrefix(ref, tagPrefix) {
+		return ""
+	}
+	tag := strings.TrimPrefix(ref, tagPrefix)
+	if tag == "" || len(ref) > 128 || strings.HasSuffix(tag, "/") || strings.Contains(tag, "..") || strings.Contains(tag, "//") {
+		return ""
+	}
+	for _, char := range tag {
+		if (char < 'a' || char > 'z') && (char < 'A' || char > 'Z') &&
+			(char < '0' || char > '9') && !strings.ContainsRune("._/-", char) {
+			return ""
+		}
+	}
+	return tag
 }
 
 // --- BUGS.md B-008: прозрачное шифрование секретов at rest ---------------------
@@ -56,11 +156,18 @@ func (c *GithubBuildConfig) Safe() *GithubBuildConfigSafe {
 // так что вызывающий код работает с открытыми значениями, а в БД лежит шифртекст.
 
 func (c *GithubBuildConfig) encryptSecrets() error {
-	var err error
-	if c.Token, err = utils.EncryptSecret(c.Token); err != nil {
+	token, err := utils.EncryptSecret(c.Token)
+	if err != nil {
+		return err
+	}
+	payloadKey, err := utils.EncryptSecret(c.PayloadKey)
+	if err != nil {
 		return err
 	}
-	c.PayloadKey, err = utils.EncryptSecret(c.PayloadKey)
+	// Assign only after both values have been encrypted successfully. A failed
+	// hook must not leave the caller's in-memory model half-mutated.
+	c.Token = token
+	c.PayloadKey = payloadKey
 	return err
 }
 
diff --git a/api/model/github_build_config_test.go b/api/model/github_build_config_test.go
new file mode 100644
index 0000000..5cb75b6
--- /dev/null
+++ b/api/model/github_build_config_test.go
@@ -0,0 +1,50 @@
+package model
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestGithubBuildConfigAutoMigrateAddsWorkflowApprovalAndPreservesLegacyRead(t *testing.T) {
+	t.Setenv("SECRET_ENCRYPTION_KEY", "model-workflow-approval-test")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := db.AutoMigrate(&GithubBuildConfig{}); err != nil {
+		t.Fatalf("AutoMigrate() error = %v", err)
+	}
+	if !db.Migrator().HasColumn(&GithubBuildConfig{}, "workflow_ref_approved") {
+		t.Fatal("AutoMigrate() did not add workflow_ref_approved")
+	}
+	if !db.Migrator().HasColumn(&GithubBuildConfig{}, "workflow_ref_provider_verified") {
+		t.Fatal("AutoMigrate() did not add workflow_ref_provider_verified")
+	}
+	if !db.Migrator().HasColumn(&GithubBuildConfig{}, "workflow_ref_approval_sha") {
+		t.Fatal("AutoMigrate() did not add workflow_ref_approval_sha")
+	}
+
+	legacy := &GithubBuildConfig{IdModel: IdModel{Id: 1}, Repo: "owner/repo", Branch: "master"}
+	if err := db.Create(legacy).Error; err != nil {
+		t.Fatalf("create legacy config: %v", err)
+	}
+	var loaded GithubBuildConfig
+	if err := db.First(&loaded, 1).Error; err != nil {
+		t.Fatalf("read legacy config: %v", err)
+	}
+	if loaded.WorkflowRefApproved {
+		t.Fatal("legacy config unexpectedly read as approved")
+	}
+	view, err := json.Marshal(loaded.Safe())
+	if err != nil {
+		t.Fatalf("marshal safe config: %v", err)
+	}
+	encoded := string(view)
+	if !strings.Contains(encoded, `"workflow_ref":""`) || strings.Contains(encoded, `"branch"`) {
+		t.Fatalf("safe legacy config = %s, want no mutable ref in safe view", encoded)
+	}
+}
diff --git a/api/model/response_security_test.go b/api/model/response_security_test.go
new file mode 100644
index 0000000..ef4ddf6
--- /dev/null
+++ b/api/model/response_security_test.go
@@ -0,0 +1,270 @@
+package model
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestCustomBuildPublicViewOmitsCapabilityKey(t *testing.T) {
+	build := &CustomBuild{
+		IdModel:              IdModel{Id: 7},
+		UserId:               9,
+		Name:                 "public-build",
+		Platform:             "windows",
+		Status:               CustomBuildStatusDone,
+		AppName:              "rustqs",
+		Version:              "1.2.3",
+		DownloadKey:          "capability-secret",
+		DownloadKeyExpiresAt: 1234,
+		FileSize:             456,
+		CustomJson:           `{"enable_audio":true,"permanent_password":"build-secret"}`,
+		BuildLog:             "private build log",
+		GithubRunId:          55,
+		GithubRepo:           "owner/private-repo",
+		GithubWorkflow:       "private-workflow.yml",
+		GithubRef:            "private-ref",
+		GithubArtifactName:   "private-artifact",
+		GithubArtifactID:     66,
+	}
+
+	encoded, err := json.Marshal(build.Public())
+	if err != nil {
+		t.Fatalf("marshal public build: %v", err)
+	}
+	response := string(encoded)
+	for _, forbidden := range []string{
+		"capability-secret", `"download_key"`, "build-secret", "permanent_password",
+		"private build log", `"github_run_id"`, `"github_repo"`, `"github_workflow"`,
+		`"github_ref"`, `"github_artifact_name"`, `"github_artifact_id"`, `"user_id"`,
+	} {
+		if strings.Contains(response, forbidden) {
+			t.Fatalf("public build exposed %q: %s", forbidden, response)
+		}
+	}
+	for _, expected := range []string{
+		`"id":7`, `"name":"public-build"`, `"platform":"windows"`,
+		`"version":"1.2.3"`, `"status":"done"`, `"app_name":"rustqs"`,
+		`"file_size":456`, `"download_key_expires_at":1234`,
+	} {
+		if !strings.Contains(response, expected) {
+			t.Fatalf("public build omitted %q: %s", expected, response)
+		}
+	}
+}
+
+func TestCustomBuildSafeViewOmitsCapabilityKey(t *testing.T) {
+	build := &CustomBuild{
+		IdModel:              IdModel{Id: 8},
+		DownloadKey:          "admin-dto-capability-secret",
+		DownloadKeyExpiresAt: 1234,
+		CustomJson:           `{"enable_audio":true}`,
+	}
+
+	encoded, err := json.Marshal(build.Safe())
+	if err != nil {
+		t.Fatalf("marshal safe build: %v", err)
+	}
+	response := string(encoded)
+	for _, forbidden := range []string{"admin-dto-capability-secret", `"download_key"`} {
+		if strings.Contains(response, forbidden) {
+			t.Fatalf("safe build exposed %q: %s", forbidden, response)
+		}
+	}
+	if !strings.Contains(response, `"download_key_expires_at":1234`) {
+		t.Fatalf("safe build omitted capability expiry metadata: %s", response)
+	}
+}
+
+func TestRawCustomBuildModelAndListOmitDownloadKey(t *testing.T) {
+	build := &CustomBuild{
+		Name:        "raw-build",
+		DownloadKey: "raw-download-key",
+	}
+	values := []struct {
+		name  string
+		value any
+	}{
+		{name: "model", value: build},
+		{name: "list", value: &CustomBuildList{CustomBuilds: []*CustomBuild{build}}},
+	}
+	for _, test := range values {
+		t.Run(test.name, func(t *testing.T) {
+			encoded, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("marshal raw custom build %s: %v", test.name, err)
+			}
+			response := string(encoded)
+			if strings.Contains(response, "raw-download-key") || strings.Contains(response, `"download_key"`) {
+				t.Fatalf("raw custom build %s exposed download key: %s", test.name, response)
+			}
+			if !strings.Contains(response, `"name":"raw-build"`) {
+				t.Fatalf("raw custom build %s omitted public field: %s", test.name, response)
+			}
+		})
+	}
+}
+
+func TestShareRecordSafeListOmitsCredentials(t *testing.T) {
+	record := &ShareRecord{
+		IdModel:      IdModel{Id: 3},
+		UserId:       8,
+		PeerId:       "peer-1",
+		ShareToken:   "share-token-secret",
+		PasswordType: "fixed",
+		Password:     "password-secret",
+		Expire:       1800,
+	}
+	encoded, err := json.Marshal((&ShareRecordList{
+		ShareRecords: []*ShareRecord{record},
+		Pagination:   Pagination{Page: 1, PageSize: 10, Total: 1},
+	}).Safe())
+	if err != nil {
+		t.Fatalf("marshal safe share records: %v", err)
+	}
+	response := string(encoded)
+	for _, forbidden := range []string{"share-token-secret", "password-secret", `"share_token"`, `"password_type"`, `"password"`} {
+		if strings.Contains(response, forbidden) {
+			t.Fatalf("safe share record exposed %q: %s", forbidden, response)
+		}
+	}
+	for _, expected := range []string{`"id":3`, `"user_id":8`, `"peer_id":"peer-1"`, `"expire":1800`, `"list"`} {
+		if !strings.Contains(response, expected) {
+			t.Fatalf("safe share record omitted %q: %s", expected, response)
+		}
+	}
+}
+
+func TestUserTokenSafeListMasksBearerSecretAndPreservesSchema(t *testing.T) {
+	secret := "0123456789abcdef-secret-token"
+	encoded, err := json.Marshal((&UserTokenList{
+		UserTokens: []UserToken{{
+			IdModel:   IdModel{Id: 3},
+			UserId:    8,
+			Token:     secret,
+			ExpiredAt: 99,
+		}},
+		Pagination: Pagination{Page: 1, PageSize: 10, Total: 1},
+	}).Safe())
+	if err != nil {
+		t.Fatalf("marshal safe token list: %v", err)
+	}
+	response := string(encoded)
+	if strings.Contains(response, secret) {
+		t.Fatalf("safe token list exposed bearer secret: %s", response)
+	}
+	for _, expected := range []string{`"id":3`, `"user_id":8`, `"token":"0123****oken"`, `"expired_at":99`, `"list"`} {
+		if !strings.Contains(response, expected) {
+			t.Fatalf("safe token list omitted %q: %s", expected, response)
+		}
+	}
+}
+
+func TestRawUserTokenModelDoesNotSerializeBearerSecret(t *testing.T) {
+	encoded, err := json.Marshal(&UserToken{Token: "raw-token-secret"})
+	if err != nil {
+		t.Fatalf("marshal raw user token: %v", err)
+	}
+	response := string(encoded)
+	if strings.Contains(response, "raw-token-secret") || strings.Contains(response, `"token"`) {
+		t.Fatalf("raw user token serialized bearer secret: %s", response)
+	}
+}
+
+func TestAddressBookSafeViewRedactsCredentialsAndPreservesPublicFields(t *testing.T) {
+	addressBook := &AddressBook{
+		RowId:            4,
+		Id:               "peer-id",
+		Username:         "alice",
+		Password:         "password-secret",
+		Hash:             "hash-credential",
+		Hostname:         "host",
+		Alias:            "friendly",
+		Platform:         "Windows",
+		UserId:           8,
+		ForceAlwaysRelay: true,
+		RdpPort:          "3389",
+		RdpUsername:      "rdp-user",
+		LoginName:        "login",
+	}
+
+	encoded, err := json.Marshal((&AddressBookList{AddressBooks: []*AddressBook{addressBook}}).Safe())
+	if err != nil {
+		t.Fatalf("marshal safe address book: %v", err)
+	}
+	response := string(encoded)
+	for _, forbidden := range []string{"password-secret", "hash-credential", `"password"`, `"hash"`} {
+		if strings.Contains(response, forbidden) {
+			t.Fatalf("safe address book exposed %q: %s", forbidden, response)
+		}
+	}
+	for _, expected := range []string{`"id":"peer-id"`, `"hostname":"host"`, `"alias":"friendly"`, `"rdpPort":"3389"`, `"loginName":"login"`} {
+		if !strings.Contains(response, expected) {
+			t.Fatalf("safe address book omitted %q: %s", expected, response)
+		}
+	}
+}
+
+func TestRawAddressBookModelAndListOmitCredentials(t *testing.T) {
+	addressBook := &AddressBook{
+		Id:       "raw-peer",
+		Password: "raw-password-secret",
+		Hash:     "raw-hash-secret",
+		Hostname: "host",
+	}
+	values := []struct {
+		name  string
+		value any
+	}{
+		{name: "model", value: addressBook},
+		{name: "list", value: &AddressBookList{AddressBooks: []*AddressBook{addressBook}}},
+	}
+	for _, test := range values {
+		t.Run(test.name, func(t *testing.T) {
+			encoded, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("marshal raw address book %s failed", test.name)
+			}
+			response := string(encoded)
+			if strings.Contains(response, "raw-password-secret") || strings.Contains(response, "raw-hash-secret") || strings.Contains(response, `"password"`) || strings.Contains(response, `"hash"`) {
+				t.Fatalf("raw address book %s serialized credential fields", test.name)
+			}
+			if !strings.Contains(response, `"id":"raw-peer"`) || !strings.Contains(response, `"hostname":"host"`) {
+				t.Fatalf("raw address book %s omitted public fields", test.name)
+			}
+		})
+	}
+}
+
+func TestRawShareRecordModelAndListOmitCredentials(t *testing.T) {
+	record := &ShareRecord{
+		IdModel:      IdModel{Id: 5},
+		PeerId:       "raw-peer",
+		ShareToken:   "raw-share-token-secret",
+		PasswordType: "fixed",
+		Password:     "raw-password-secret",
+		Expire:       1800,
+	}
+	values := []struct {
+		name  string
+		value any
+	}{
+		{name: "model", value: record},
+		{name: "list", value: &ShareRecordList{ShareRecords: []*ShareRecord{record}}},
+	}
+	for _, test := range values {
+		t.Run(test.name, func(t *testing.T) {
+			encoded, err := json.Marshal(test.value)
+			if err != nil {
+				t.Fatalf("marshal raw share record %s failed", test.name)
+			}
+			response := string(encoded)
+			if strings.Contains(response, "raw-share-token-secret") || strings.Contains(response, "raw-password-secret") || strings.Contains(response, `"share_token"`) || strings.Contains(response, `"password"`) {
+				t.Fatalf("raw share record %s serialized credential fields", test.name)
+			}
+			if !strings.Contains(response, `"id":5`) || !strings.Contains(response, `"peer_id":"raw-peer"`) {
+				t.Fatalf("raw share record %s omitted public fields", test.name)
+			}
+		})
+	}
+}
diff --git a/api/model/shareRecord.go b/api/model/shareRecord.go
index 9812e3d..d5da5a9 100644
--- a/api/model/shareRecord.go
+++ b/api/model/shareRecord.go
@@ -4,15 +4,63 @@ type ShareRecord struct {
 	IdModel
 	UserId       uint   `json:"user_id" gorm:"default:0;not null;index"`
 	PeerId       string `json:"peer_id" gorm:"default:'';not null;index"`
-	ShareToken   string `json:"share_token" gorm:"default:'';not null;index"`
+	ShareToken   string `json:"-" gorm:"default:'';not null;index"`
 	PasswordType string `json:"password_type" gorm:"default:'';not null;"`
-	Password     string `json:"password" gorm:"default:'';not null;"`
+	Password     string `json:"-" gorm:"default:'';not null;"`
 	Expire       int64  `json:"expire" gorm:"default:0;not null;"`
 	TimeModel
 }
 
-// ShareRecordList 
+// ShareRecordList
 type ShareRecordList struct {
 	ShareRecords []*ShareRecord `json:"list,omitempty"`
 	Pagination
 }
+
+// ShareRecordSafe is the response view for administrative and personal share
+// record lists. ShareToken, PasswordType, and Password remain available on
+// ShareRecord for internal reads and write/input handling, but never cross
+// these response boundaries.
+type ShareRecordSafe struct {
+	Id     uint   `json:"id"`
+	UserId uint   `json:"user_id"`
+	PeerId string `json:"peer_id"`
+	Expire int64  `json:"expire"`
+	TimeModel
+}
+
+// ShareRecordSafeList is the paginated response view for share records.
+type ShareRecordSafeList struct {
+	ShareRecords []*ShareRecordSafe `json:"list,omitempty"`
+	Pagination
+}
+
+// Safe returns a share record without its bearer token or credentials.
+func (r *ShareRecord) Safe() *ShareRecordSafe {
+	if r == nil {
+		return nil
+	}
+	return &ShareRecordSafe{
+		Id:        r.Id,
+		UserId:    r.UserId,
+		PeerId:    r.PeerId,
+		Expire:    r.Expire,
+		TimeModel: r.TimeModel,
+	}
+}
+
+// Safe returns a paginated share-record response without bearer tokens or
+// credentials.
+func (l *ShareRecordList) Safe() *ShareRecordSafeList {
+	if l == nil {
+		return nil
+	}
+	view := &ShareRecordSafeList{Pagination: l.Pagination}
+	if l.ShareRecords != nil {
+		view.ShareRecords = make([]*ShareRecordSafe, 0, len(l.ShareRecords))
+		for _, record := range l.ShareRecords {
+			view.ShareRecords = append(view.ShareRecords, record.Safe())
+		}
+	}
+	return view
+}
diff --git a/api/model/userToken.go b/api/model/userToken.go
index 8fba177..cdd39b0 100644
--- a/api/model/userToken.go
+++ b/api/model/userToken.go
@@ -5,7 +5,7 @@ type UserToken struct {
 	UserId     uint   `json:"user_id" gorm:"default:0;not null;index"`
 	DeviceUuid string `json:"device_uuid" gorm:"default:'';omitempty;"`
 	DeviceId   string `json:"device_id" gorm:"default:'';omitempty;"`
-	Token      string `json:"token" gorm:"default:'';not null;index"`
+	Token      string `json:"-" gorm:"default:'';not null;index"`
 	ExpiredAt  int64  `json:"expired_at" gorm:"default:0;not null;"`
 	TimeModel
 }
@@ -14,3 +14,61 @@ type UserTokenList struct {
 	UserTokens []UserToken `json:"list"`
 	Pagination
 }
+
+// UserTokenSafe is the metadata exposed by token-management responses. Token
+// retains the existing UI field as a server-side mask; the raw bearer secret
+// never crosses the response boundary.
+type UserTokenSafe struct {
+	Id         uint   `json:"id"`
+	UserId     uint   `json:"user_id"`
+	DeviceUuid string `json:"device_uuid,omitempty"`
+	DeviceId   string `json:"device_id,omitempty"`
+	Token      string `json:"token"`
+	ExpiredAt  int64  `json:"expired_at"`
+	TimeModel
+}
+
+type UserTokenSafeList struct {
+	UserTokens []UserTokenSafe `json:"list"`
+	Pagination
+}
+
+// Safe returns token metadata without exposing the bearer secret.
+func (t *UserToken) Safe() UserTokenSafe {
+	if t == nil {
+		return UserTokenSafe{}
+	}
+	return UserTokenSafe{
+		Id:         t.Id,
+		UserId:     t.UserId,
+		DeviceUuid: t.DeviceUuid,
+		DeviceId:   t.DeviceId,
+		Token:      MaskUserToken(t.Token),
+		ExpiredAt:  t.ExpiredAt,
+		TimeModel:  t.TimeModel,
+	}
+}
+
+// Safe returns token metadata for list responses. A masked token preserves the
+// existing administrative display contract without disclosing its secret.
+func (l *UserTokenList) Safe() *UserTokenSafeList {
+	if l == nil {
+		return nil
+	}
+	view := &UserTokenSafeList{Pagination: l.Pagination}
+	if l.UserTokens != nil {
+		view.UserTokens = make([]UserTokenSafe, 0, len(l.UserTokens))
+		for i := range l.UserTokens {
+			view.UserTokens = append(view.UserTokens, l.UserTokens[i].Safe())
+		}
+	}
+	return view
+}
+
+// MaskUserToken returns the same short display form used by the admin UI.
+func MaskUserToken(token string) string {
+	if len(token) <= 8 {
+		return ""
+	}
+	return token[:4] + "****" + token[len(token)-4:]
+}
diff --git a/api/service/addressBook.go b/api/service/addressBook.go
index 74ce48f..2bfd69a 100644
--- a/api/service/addressBook.go
+++ b/api/service/addressBook.go
@@ -1,10 +1,10 @@
-package service
+package service
 
 import (
 	"encoding/json"
 	"github.com/google/uuid"
-	"rustdesk-server/api/model"
 	"gorm.io/gorm"
+	"rustdesk-server/api/model"
 	"strings"
 )
 
@@ -56,7 +56,7 @@ func (s *AddressBookService) UpdateAddressBook(abs []*model.AddressBook, userId
 	//peersпјЊpeersпјЊпјЊпјЊpeersпјЊ
 
 	tx := DB.Begin()
-	//1. 
+	//1.
 	var dbABs []*model.AddressBook
 	tx.Where("user_id = ?", userId).Find(&dbABs)
 	//2. peers
@@ -86,11 +86,21 @@ func (s *AddressBookService) UpdateAddressBook(abs []*model.AddressBook, userId
 			}
 			tx.Create(ab)
 		} else {
+			// Normal response DTOs intentionally omit stored credentials. When a
+			// client sends back such a typed address-book snapshot, preserve the
+			// existing values rather than clearing them because they were not
+			// user-authored in this update.
+			if ab.Password == "" {
+				ab.Password = dbAB.Password
+			}
+			if ab.Hash == "" {
+				ab.Hash = dbAB.Hash
+			}
 
 			tx.Model(&model.AddressBook{}).Where("row_id = ?", dbAB.RowId).Updates(ab)
 		}
 	}
-	//2.4 
+	//2.4
 	for id, dbAB := range dbABIds {
 		_, ok := aBIds[id]
 		if !ok {
@@ -126,7 +136,7 @@ func (s *AddressBookService) FromPeer(peer *model.Peer) (a *model.AddressBook) {
 	return a
 }
 
-// Create 
+// Create
 func (s *AddressBookService) Create(u *model.AddressBook) error {
 	res := DB.Create(u).Error
 	return res
@@ -135,22 +145,38 @@ func (s *AddressBookService) Delete(u *model.AddressBook) error {
 	return DB.Delete(u).Error
 }
 
-// Update 
+// Update
 func (s *AddressBookService) Update(u *model.AddressBook) error {
 	return DB.Model(u).Updates(u).Error
 }
 
-// UpdateByMap 
+// UpdateByMap
 func (s *AddressBookService) UpdateByMap(u *model.AddressBook, data map[string]interface{}) error {
 	return DB.Model(u).Updates(data).Error
 }
 
-// UpdateAll 
+// UpdateAll
 func (s *AddressBookService) UpdateAll(u *model.AddressBook) error {
+	if u == nil {
+		return gorm.ErrInvalidData
+	}
+	var existing model.AddressBook
+	if err := DB.Where("row_id = ?", u.RowId).First(&existing).Error; err != nil {
+		return err
+	}
+	// Safe response DTOs omit credentials. Treat empty credential fields as
+	// "unchanged" at this typed write boundary so editing a redacted row does
+	// not destroy its stored password/hash.
+	if u.Password == "" {
+		u.Password = existing.Password
+	}
+	if u.Hash == "" {
+		u.Hash = existing.Hash
+	}
 	return DB.Model(u).Select("*").Omit("created_at").Updates(u).Error
 }
 
-// ShareByWebClient 
+// ShareByWebClient
 func (s *AddressBookService) ShareByWebClient(m *model.ShareRecord) error {
 	m.ShareToken = uuid.New().String()
 	return DB.Create(m).Error
diff --git a/api/service/addressBook_security_test.go b/api/service/addressBook_security_test.go
new file mode 100644
index 0000000..71f624d
--- /dev/null
+++ b/api/service/addressBook_security_test.go
@@ -0,0 +1,46 @@
+package service
+
+import (
+	"database/sql"
+	"testing"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/model"
+)
+
+func TestAddressBookUpdateAllPreservesCredentialsOmittedBySafeResponse(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+	if err := db.AutoMigrate(&model.AddressBook{}); err != nil {
+		t.Fatalf("migrate address book: %v", err)
+	}
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() { DB = previousDB })
+
+	stored := &model.AddressBook{Id: "peer-id", Password: "password-secret", Hash: "hash-credential", Alias: "old"}
+	if err := db.Create(stored).Error; err != nil {
+		t.Fatalf("create address book: %v", err)
+	}
+	update := &model.AddressBook{RowId: stored.RowId, Id: stored.Id, Alias: "new"}
+	if err := (&AddressBookService{}).UpdateAll(update); err != nil {
+		t.Fatalf("UpdateAll() error = %v", err)
+	}
+
+	var loaded model.AddressBook
+	if err := db.First(&loaded, stored.RowId).Error; err != nil {
+		t.Fatalf("reload address book: %v", err)
+	}
+	if loaded.Alias != "new" || loaded.Password != stored.Password || loaded.Hash != stored.Hash {
+		t.Fatalf("updated address book = %#v, want public fields updated and credentials preserved", loaded)
+	}
+}
diff --git a/api/service/build_manifest.go b/api/service/build_manifest.go
new file mode 100644
index 0000000..e416f9e
--- /dev/null
+++ b/api/service/build_manifest.go
@@ -0,0 +1,265 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+
+	"rustdesk-server/api/model"
+)
+
+const (
+	buildHandoffSchema                       = "deskforge.custom-build.handoff"
+	buildHandoffSchemaVersion                = 2
+	buildHandoffDigestScope                  = "stored service SHA-256 covers canonical published output, including private custom_.txt when present; public archive SHA-256 covers separately redacted ZIP bytes; neither is a signature or a newly generated ZIP container"
+	buildHandoffVerificationScope            = "service-verified stored build/source/workflow/run/artifact/release identity, producer manifest identity, publication proof, and current output bytes; producer source-tree/submodule and provider asset-digest evidence remain reported"
+	buildHandoffContract                     = "deskforge.custom-build-export-v1"
+	buildHandoffExportRoute                  = "GET /api/admin/custom_build/manifest/:id"
+	maxBuildHandoffJSONBytes                 = 64 << 10
+	HandoffVerificationStatusServiceVerified = "service_verified"
+	HandoffVerificationStatusReported        = "reported"
+	HandoffProducerVerificationScope         = "producer-reported source-tree and recursive submodule evidence; not independently recomputed by DeskForge"
+	HandoffProviderAssetVerificationScope    = "provider-reported release asset SHA-256; copied as evidence and not independently recomputed by DeskForge"
+)
+
+// BuildHandoffAsset is the exact provider release asset identity retained for
+// an operator handoff. ProviderDigest is copied from the provider; it is not a
+// signature and is not recomputed by the handoff serializer.
+type BuildHandoffAsset struct {
+	ID                 int64  `json:"id"`
+	Name               string `json:"name"`
+	ProviderDigest     string `json:"provider_digest"`
+	VerificationScope  string `json:"verification_scope"`
+	VerificationStatus string `json:"verification_status"`
+}
+
+// BuildHandoffOutputFile is public metadata for one non-secret published
+// output. It never carries file contents; custom_.txt is omitted entirely.
+type BuildHandoffOutputFile struct {
+	Name   string `json:"name"`
+	Size   int64  `json:"size"`
+	SHA256 string `json:"sha256"`
+}
+
+type BuildHandoffSubmodule struct {
+	Path      string `json:"path"`
+	CommitSHA string `json:"commit_sha"`
+}
+
+// BuildHandoffProducerReport keeps producer-supplied source-tree metadata
+// explicit without promoting it to independently verified provenance.
+type BuildHandoffProducerReport struct {
+	SourceTreeSHA      string                  `json:"source_tree_sha"`
+	Submodules         []BuildHandoffSubmodule `json:"submodules"`
+	VerificationScope  string                  `json:"verification_scope"`
+	VerificationResult string                  `json:"verification_result"`
+	VerificationStatus string                  `json:"verification_status"`
+}
+
+// BuildHandoffManifest is the redacted, versioned operator handoff contract.
+// It contains only immutable build/provenance data and service-owned
+// publication proof. It intentionally has no secrets, raw custom JSON,
+// filesystem paths, output-file contents, or signature claim.
+//
+// JSON is produced from this fixed-field struct rather than a map, so field
+// ordering is stable for canonical handoff/checksum comparisons. The stored
+// publication timestamp is canonical and must not be confused with the
+// published output digest, which covers canonical output rather than a ZIP
+// made for a download request.
+type BuildHandoffManifest struct {
+	Schema                string                     `json:"schema"`
+	SchemaVersion         int                        `json:"schema_version"`
+	ManifestSchema        string                     `json:"manifest_schema"`
+	HandoffContract       string                     `json:"handoff_contract"`
+	ExportRoute           string                     `json:"export_route"`
+	BuildID               uint                       `json:"build_id"`
+	Status                string                     `json:"status"`
+	Platform              string                     `json:"platform"`
+	Version               string                     `json:"version"`
+	Provider              string                     `json:"provider"`
+	Repository            string                     `json:"repository"`
+	SourceTag             string                     `json:"source_tag"`
+	SourceSHA             string                     `json:"source_sha"`
+	WorkflowRepository    string                     `json:"workflow_repository"`
+	WorkflowPath          string                     `json:"workflow_path"`
+	WorkflowSelector      string                     `json:"workflow_selector"`
+	WorkflowSHA           string                     `json:"workflow_sha"`
+	RunID                 int64                      `json:"run_id"`
+	RunURL                string                     `json:"run_url"`
+	RunHTMLURL            string                     `json:"run_html_url"`
+	RunHeadSHA            string                     `json:"run_head_sha"`
+	ArtifactName          string                     `json:"artifact_name"`
+	ArtifactID            int64                      `json:"artifact_id"`
+	ReleaseRepository     string                     `json:"release_repository"`
+	ReleaseID             int64                      `json:"release_id"`
+	ReleaseTag            string                     `json:"release_tag"`
+	ReleaseAssets         []BuildHandoffAsset        `json:"release_assets"`
+	OutputFiles           []BuildHandoffOutputFile   `json:"output_files"`
+	PublishedDigest       string                     `json:"published_digest"`
+	PublishedDigestScope  string                     `json:"published_digest_scope"`
+	DigestScope           string                     `json:"digest_scope"`
+	VerificationScope     string                     `json:"verification_scope"`
+	VerificationResult    string                     `json:"verification_result"`
+	VerificationStatus    string                     `json:"verification_status"`
+	ProducerReport        BuildHandoffProducerReport `json:"producer_report"`
+	PublicationTimestamp  int64                      `json:"publication_timestamp"`
+	PublicationRecordedAt int64                      `json:"publication_recorded_at"`
+}
+
+// BuildManifestService reads a stored build and creates a verified handoff.
+// It performs no provider calls, publication, upload, or filesystem export.
+type BuildManifestService struct{}
+
+// ForBuild returns a redacted manifest only after revalidating the complete
+// immutable provenance and current service-owned publication proof. The time
+// argument is retained for route compatibility but is intentionally ignored;
+// repeated exports use only stored publication state.
+func (s *BuildManifestService) ForBuild(buildID uint, _ time.Time) (BuildHandoffManifest, error) {
+	if buildID == 0 {
+		return BuildHandoffManifest{}, errors.New("build id is required")
+	}
+	if DB == nil {
+		return BuildHandoffManifest{}, errors.New("build database is unavailable")
+	}
+	var build model.CustomBuild
+	if err := DB.Where("id = ?", buildID).First(&build).Error; err != nil {
+		return BuildHandoffManifest{}, err
+	}
+	return BuildHandoffManifestFromRecord(&build, time.Time{})
+}
+
+// BuildHandoffManifestFromRecord creates a canonical manifest from an already
+// loaded record. generatedAt is retained as a source-compatible, non-canonical
+// argument and has no effect on the result.
+func BuildHandoffManifestFromRecord(build *model.CustomBuild, _ time.Time) (BuildHandoffManifest, error) {
+	if build == nil {
+		return BuildHandoffManifest{}, errors.New("build record is required")
+	}
+	provenance, _, err := ValidateCompletedPublishedOutput(build)
+	if err != nil {
+		return BuildHandoffManifest{}, fmt.Errorf("completed build handoff is unavailable: %w", err)
+	}
+	if provenance.GithubSourceSHA == "" {
+		return BuildHandoffManifest{}, errors.New("completed build handoff requires the provider run head SHA")
+	}
+	producerManifest, err := ProducerManifestFromStoredJSON(build.ProducerManifestJSON)
+	if err != nil {
+		return BuildHandoffManifest{}, errors.New("completed build handoff requires validated producer manifest provenance")
+	}
+	if err := ValidateProducerManifestForBuild(producerManifest, build); err != nil {
+		return BuildHandoffManifest{}, fmt.Errorf("completed build producer provenance is invalid: %w", err)
+	}
+	if strings.EqualFold(provenance.GithubArtifactName, "custom_.txt") {
+		return BuildHandoffManifest{}, errors.New("completed build handoff contains a forbidden artifact name")
+	}
+	if err := validateHandoffURL("run_url", provenance.GithubRunURL); err != nil {
+		return BuildHandoffManifest{}, err
+	}
+	if err := validateHandoffURL("run_html_url", provenance.GithubHTMLURL); err != nil {
+		return BuildHandoffManifest{}, err
+	}
+	outputFiles, err := PublishedOutputFileEntries(build)
+	if err != nil {
+		return BuildHandoffManifest{}, fmt.Errorf("read redacted published output entries: %w", err)
+	}
+
+	assets := make([]BuildHandoffAsset, 0, len(provenance.AssetsReleaseAssets))
+	for _, asset := range provenance.AssetsReleaseAssets {
+		assets = append(assets, BuildHandoffAsset{
+			ID:                 asset.ID,
+			Name:               asset.Name,
+			ProviderDigest:     asset.Digest,
+			VerificationScope:  HandoffProviderAssetVerificationScope,
+			VerificationStatus: HandoffVerificationStatusReported,
+		})
+	}
+	sort.Slice(assets, func(i, j int) bool {
+		return assets[i].Name < assets[j].Name
+	})
+	submodules := make([]BuildHandoffSubmodule, 0, len(producerManifest.Submodules))
+	for _, submodule := range producerManifest.Submodules {
+		submodules = append(submodules, BuildHandoffSubmodule{Path: submodule.Path, CommitSHA: submodule.CommitSHA})
+	}
+
+	manifest := BuildHandoffManifest{
+		Schema:               buildHandoffSchema,
+		SchemaVersion:        buildHandoffSchemaVersion,
+		ManifestSchema:       producerManifest.ManifestSchema,
+		HandoffContract:      buildHandoffContract,
+		ExportRoute:          buildHandoffExportRoute,
+		BuildID:              build.Id,
+		Status:               build.Status,
+		Platform:             build.Platform,
+		Version:              provenance.Version,
+		Provider:             provenance.GithubProvider,
+		Repository:           provenance.GithubRepo,
+		SourceTag:            provenance.SourceTag,
+		SourceSHA:            provenance.BuildRef,
+		WorkflowRepository:   provenance.GithubRepo,
+		WorkflowPath:         provenance.GithubWorkflow,
+		WorkflowSelector:     provenance.WorkflowRef,
+		WorkflowSHA:          provenance.WorkflowSHA,
+		RunID:                provenance.GithubRunID,
+		RunURL:               provenance.GithubRunURL,
+		RunHTMLURL:           provenance.GithubHTMLURL,
+		RunHeadSHA:           provenance.GithubSourceSHA,
+		ArtifactName:         provenance.GithubArtifactName,
+		ArtifactID:           provenance.GithubArtifactID,
+		ReleaseRepository:    provenance.GithubRepo,
+		ReleaseID:            provenance.AssetsReleaseID,
+		ReleaseTag:           provenance.AssetsRelease,
+		ReleaseAssets:        assets,
+		OutputFiles:          outputFiles,
+		PublishedDigest:      build.PublishedDigest,
+		PublishedDigestScope: buildHandoffDigestScope,
+		DigestScope:          buildHandoffDigestScope,
+		VerificationScope:    buildHandoffVerificationScope,
+		VerificationResult:   HandoffVerificationStatusServiceVerified,
+		VerificationStatus:   HandoffVerificationStatusServiceVerified,
+		ProducerReport: BuildHandoffProducerReport{
+			SourceTreeSHA:      producerManifest.SourceTreeSHA,
+			Submodules:         append([]BuildHandoffSubmodule(nil), submodules...),
+			VerificationScope:  HandoffProducerVerificationScope,
+			VerificationResult: ProducerManifestVerificationResult,
+			VerificationStatus: HandoffVerificationStatusReported,
+		},
+		PublicationTimestamp:  build.PublicationRecordedAt,
+		PublicationRecordedAt: build.PublicationRecordedAt,
+	}
+	encoded, err := manifest.CanonicalJSON()
+	if err != nil {
+		return BuildHandoffManifest{}, fmt.Errorf("encode build handoff: %w", err)
+	}
+	if len(encoded) > maxBuildHandoffJSONBytes {
+		return BuildHandoffManifest{}, errors.New("build handoff exceeds bounded JSON size")
+	}
+	return manifest, nil
+}
+
+// CanonicalJSON encodes the fixed-field handoff DTO without a map or
+// nondeterministic data. It does not add a signature or a manifest checksum.
+func (m BuildHandoffManifest) CanonicalJSON() ([]byte, error) {
+	encoded, err := json.Marshal(m)
+	if err != nil {
+		return nil, fmt.Errorf("marshal build handoff: %w", err)
+	}
+	if len(encoded) > maxBuildHandoffJSONBytes {
+		return nil, errors.New("build handoff exceeds bounded JSON size")
+	}
+	return encoded, nil
+}
+
+func validateHandoffURL(field, raw string) error {
+	if strings.ContainsAny(raw, "\r\n") {
+		return fmt.Errorf("%s contains invalid control characters", field)
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return fmt.Errorf("%s is not a credential-free provider URL", field)
+	}
+	return nil
+}
diff --git a/api/service/build_manifest_test.go b/api/service/build_manifest_test.go
new file mode 100644
index 0000000..125901b
--- /dev/null
+++ b/api/service/build_manifest_test.go
@@ -0,0 +1,277 @@
+package service
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"rustdesk-server/api/model"
+)
+
+func TestBuildHandoffManifestIsCanonicalAndContainsExactDigestFields(t *testing.T) {
+	build := newCompleteBuildHandoffFixture(t)
+	fixedGeneratedAt := time.Date(2026, time.August, 10, 12, 34, 56, 0, time.UTC)
+	manifest, err := BuildHandoffManifestFromRecord(build, fixedGeneratedAt)
+	if err != nil {
+		t.Fatalf("BuildHandoffManifestFromRecord() error = %v", err)
+	}
+	if manifest.Schema != buildHandoffSchema || manifest.SchemaVersion != buildHandoffSchemaVersion {
+		t.Fatalf("schema = %q/%d, want %q/%d", manifest.Schema, manifest.SchemaVersion, buildHandoffSchema, buildHandoffSchemaVersion)
+	}
+	if manifest.SourceSHA != build.BuildRef || manifest.SourceTag != build.SourceTag || manifest.WorkflowSelector != build.WorkflowSelector || manifest.WorkflowSHA != build.GithubRef {
+		t.Fatalf("source/workflow identity = %#v, want source=%q/%q workflow=%q/%q", manifest, build.SourceTag, build.BuildRef, build.WorkflowSelector, build.GithubRef)
+	}
+	if manifest.ManifestSchema != ProducerManifestSchema || manifest.HandoffContract != buildHandoffContract || manifest.ExportRoute != buildHandoffExportRoute || manifest.ProducerReport.SourceTreeSHA == "" || len(manifest.ProducerReport.Submodules) != 1 || manifest.PublicationTimestamp != build.PublicationRecordedAt {
+		t.Fatalf("handoff producer provenance = %#v, want explicit schema/contract/route/tree/submodule/timestamp", manifest)
+	}
+	if manifest.RunID != build.GithubRunId || manifest.RunHeadSHA != build.GithubSourceSha || manifest.ArtifactID != build.GithubArtifactID || manifest.PublishedDigest != build.PublishedDigest {
+		t.Fatalf("exact run/artifact/digest fields = %#v, want run=%d head=%q artifact=%d digest=%q", manifest, build.GithubRunId, build.GithubSourceSha, build.GithubArtifactID, build.PublishedDigest)
+	}
+	if manifest.PublicationRecordedAt != build.PublicationRecordedAt || manifest.VerificationResult != HandoffVerificationStatusServiceVerified || manifest.VerificationStatus != HandoffVerificationStatusServiceVerified {
+		t.Fatalf("publication verification = %#v, want publication=%d service_verified", manifest, build.PublicationRecordedAt)
+	}
+	if manifest.ReleaseRepository != build.GithubRepo || manifest.ReleaseID != build.AssetsReleaseID || manifest.ReleaseTag != build.AssetsRelease {
+		t.Fatalf("release identity = %#v, want repo=%q id=%d tag=%q", manifest, build.GithubRepo, build.AssetsReleaseID, build.AssetsRelease)
+	}
+	if manifest.PublishedDigestScope != buildHandoffDigestScope {
+		t.Fatalf("digest scope = %q, want %q", manifest.PublishedDigestScope, buildHandoffDigestScope)
+	}
+	if manifest.DigestScope != buildHandoffDigestScope || manifest.VerificationScope != buildHandoffVerificationScope || manifest.VerificationResult != HandoffVerificationStatusServiceVerified {
+		t.Fatalf("handoff verification contract = %#v, want exact scope/result", manifest)
+	}
+	if manifest.ProducerReport.VerificationResult != ProducerManifestVerificationResult || manifest.ProducerReport.VerificationStatus != HandoffVerificationStatusReported || manifest.ProducerReport.VerificationResult == HandoffVerificationStatusServiceVerified || manifest.ProducerReport.VerificationScope != HandoffProducerVerificationScope {
+		t.Fatalf("producer report = %#v, want explicitly reported producer source evidence", manifest.ProducerReport)
+	}
+	if len(manifest.OutputFiles) != 2 || manifest.OutputFiles[0].Name != "helper.dll" || manifest.OutputFiles[1].Name != "rustqs.exe" {
+		t.Fatalf("redacted output files = %#v, want sorted non-secret entries", manifest.OutputFiles)
+	}
+	if manifest.OutputFiles[0].Size != int64(len("helper")) || manifest.OutputFiles[1].Size != int64(len("executable")) {
+		t.Fatalf("redacted output sizes = %#v, want exact byte sizes", manifest.OutputFiles)
+	}
+	helperHash := sha256.Sum256([]byte("helper"))
+	exeHash := sha256.Sum256([]byte("executable"))
+	if manifest.OutputFiles[0].SHA256 != hex.EncodeToString(helperHash[:]) || manifest.OutputFiles[1].SHA256 != hex.EncodeToString(exeHash[:]) {
+		t.Fatalf("redacted output hashes = %#v, want helper=%x exe=%x", manifest.OutputFiles, helperHash, exeHash)
+	}
+	if len(manifest.ReleaseAssets) != len(requiredOfflineAssetNames) {
+		t.Fatalf("release assets = %d, want %d", len(manifest.ReleaseAssets), len(requiredOfflineAssetNames))
+	}
+	for index := 1; index < len(manifest.ReleaseAssets); index++ {
+		if manifest.ReleaseAssets[index-1].Name >= manifest.ReleaseAssets[index].Name {
+			t.Fatalf("release assets are not name ordered: %#v", manifest.ReleaseAssets)
+		}
+	}
+	for _, asset := range manifest.ReleaseAssets {
+		var expectedID int64
+		var expectedDigest string
+		switch asset.Name {
+		case "windows-x64-release.zip":
+			expectedID, expectedDigest = 101, "sha256:"+strings.Repeat("1", 64)
+		case "usbmmidd_v2.zip":
+			expectedID, expectedDigest = 102, "sha256:"+strings.Repeat("2", 64)
+		case "rustdesk_printer_driver_v4-1.4.zip":
+			expectedID, expectedDigest = 103, "sha256:"+strings.Repeat("3", 64)
+		case "printer_driver_adapter.zip":
+			expectedID, expectedDigest = 104, "sha256:"+strings.Repeat("4", 64)
+		default:
+			t.Fatalf("unexpected release asset %q", asset.Name)
+		}
+		if asset.ID != expectedID || asset.ProviderDigest != expectedDigest || asset.VerificationStatus != HandoffVerificationStatusReported || asset.VerificationScope != HandoffProviderAssetVerificationScope {
+			t.Fatalf("release asset = %#v, want id=%d provider_digest=%q", asset, expectedID, expectedDigest)
+		}
+	}
+
+	first, err := manifest.CanonicalJSON()
+	if err != nil {
+		t.Fatalf("first CanonicalJSON() error = %v", err)
+	}
+	second, err := manifest.CanonicalJSON()
+	if err != nil {
+		t.Fatalf("second CanonicalJSON() error = %v", err)
+	}
+	if string(first) != string(second) {
+		t.Fatalf("canonical JSON changed between encodes:\n%s\n%s", first, second)
+	}
+	thirdManifest, err := BuildHandoffManifestFromRecord(build, fixedGeneratedAt.Add(24*time.Hour))
+	if err != nil {
+		t.Fatalf("repeat BuildHandoffManifestFromRecord() error = %v", err)
+	}
+	third, err := thirdManifest.CanonicalJSON()
+	if err != nil {
+		t.Fatalf("repeat CanonicalJSON() error = %v", err)
+	}
+	if string(first) != string(third) {
+		t.Fatalf("handoff changed with request timestamp:\n%s\n%s", first, third)
+	}
+	var decoded map[string]any
+	if err := json.Unmarshal(first, &decoded); err != nil {
+		t.Fatalf("canonical JSON is invalid: %v", err)
+	}
+	if _, ok := decoded["source_tree_sha"]; ok {
+		t.Fatalf("producer source tree self-report was emitted at service level: %s", first)
+	}
+	if _, ok := decoded["submodules"]; ok {
+		t.Fatalf("producer submodule self-report was emitted at service level: %s", first)
+	}
+	reported, ok := decoded["producer_report"].(map[string]any)
+	if !ok {
+		t.Fatalf("producer_report = %#v, want explicit reported-evidence object", decoded["producer_report"])
+	}
+	if reported["verification_status"] != HandoffVerificationStatusReported || reported["verification_result"] == HandoffVerificationStatusServiceVerified {
+		t.Fatalf("producer report self-report status = %#v, want reported and never service_verified", reported)
+	}
+}
+
+func TestBuildHandoffManifestRedactsSecretsAndPaths(t *testing.T) {
+	build := newCompleteBuildHandoffFixture(t)
+	build.CustomJson = `{"permanent_password":"password-secret","payload_key":"payload-secret","server_key":"server-secret","path":"/rdgen-data/output/91","file":"custom_.txt"}`
+	manifest, err := BuildHandoffManifestFromRecord(build, time.Unix(1700000000, 0))
+	if err != nil {
+		t.Fatalf("BuildHandoffManifestFromRecord() error = %v", err)
+	}
+	encoded, err := manifest.CanonicalJSON()
+	if err != nil {
+		t.Fatalf("CanonicalJSON() error = %v", err)
+	}
+	for _, forbidden := range []string{
+		"password-secret",
+		"payload-secret",
+		"server-secret",
+		"/rdgen-data/output/91",
+		"custom_json",
+	} {
+		if strings.Contains(string(encoded), forbidden) {
+			t.Fatalf("manifest contains forbidden value %q: %s", forbidden, encoded)
+		}
+	}
+	if strings.Contains(string(encoded), "secret-bearing settings must not be exported") {
+		t.Fatal("manifest contains custom_.txt contents")
+	}
+}
+
+func TestBuildHandoffManifestFailsWhenOutputMutatesDuringCollection(t *testing.T) {
+	build := newCompleteBuildHandoffFixture(t)
+	previousHook := publishedOutputEntriesHook
+	publishedOutputEntriesHook = func() {
+		if err := os.WriteFile(filepath.Join(BuildOutputDir(build.Id), "helper.dll"), []byte("mutated"), 0600); err != nil {
+			t.Fatalf("mutate published output: %v", err)
+		}
+	}
+	t.Cleanup(func() { publishedOutputEntriesHook = previousHook })
+	if _, err := BuildHandoffManifestFromRecord(build, time.Time{}); err == nil {
+		t.Fatal("BuildHandoffManifestFromRecord() error = nil, want TOCTOU rejection")
+	}
+}
+
+func TestBuildHandoffManifestFailsWhenStoredProducerProvenanceIsTampered(t *testing.T) {
+	build := newCompleteBuildHandoffFixture(t)
+	build.ProducerManifestJSON = strings.Replace(build.ProducerManifestJSON, build.BuildRef, strings.Repeat("e", 40), 1)
+	if _, err := BuildHandoffManifestFromRecord(build, time.Time{}); err == nil {
+		t.Fatal("BuildHandoffManifestFromRecord() error = nil, want stored provenance mismatch rejection")
+	}
+}
+
+func TestBuildHandoffManifestFailsClosedForPartialLegacyAndCredentialURLs(t *testing.T) {
+	cases := []struct {
+		name   string
+		mutate func(*model.CustomBuild)
+	}{
+		{name: "legacy", mutate: func(build *model.CustomBuild) {
+			*build = model.CustomBuild{IdModel: model.IdModel{Id: 92}, Status: model.CustomBuildStatusDone, Platform: "windows"}
+		}},
+		{name: "missing run head sha", mutate: func(build *model.CustomBuild) {
+			build.GithubSourceSha = ""
+		}},
+		{name: "missing publication marker", mutate: func(build *model.CustomBuild) {
+			build.PublicationRecordedAt = 0
+		}},
+		{name: "credential-bearing run URL", mutate: func(build *model.CustomBuild) {
+			build.GithubRunUrl = "https://operator:pat@example.invalid/run"
+		}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			build := newCompleteBuildHandoffFixture(t)
+			tc.mutate(build)
+			if _, err := BuildHandoffManifestFromRecord(build, time.Unix(1700000000, 0)); err == nil {
+				t.Fatal("BuildHandoffManifestFromRecord() error = nil, want fail-closed error")
+			}
+		})
+	}
+}
+
+func newCompleteBuildHandoffFixture(t *testing.T) *model.CustomBuild {
+	t.Helper()
+	root := t.TempDir()
+	previousOutputDir := BuildOutputDir
+	BuildOutputDir = func(id uint) string {
+		return filepath.Join(root, "output", "build", "91")
+	}
+	t.Cleanup(func() { BuildOutputDir = previousOutputDir })
+
+	provenance := testBuildProvenance(91, "owner/repo", "rustqs-windows.yml", "refs/heads/rustqs/workflows", "rustqs-windows")
+	provenance.GithubArtifactID = 901
+	provenance.GithubSourceSHA = provenance.WorkflowSHA
+	assets := append([]ReleaseAsset(nil), provenance.AssetsReleaseAssets...)
+	for left, right := 0, len(assets)-1; left < right; left, right = left+1, right-1 {
+		assets[left], assets[right] = assets[right], assets[left]
+	}
+	assetsJSON, err := json.Marshal(assets)
+	if err != nil {
+		t.Fatalf("marshal fixture assets: %v", err)
+	}
+	build := &model.CustomBuild{
+		IdModel:               model.IdModel{Id: 91},
+		Status:                model.CustomBuildStatusDone,
+		Platform:              "windows",
+		AppName:               "rustqs",
+		Version:               provenance.Version,
+		BuildRef:              provenance.BuildRef,
+		SourceTag:             provenance.SourceTag,
+		AssetsRelease:         provenance.AssetsRelease,
+		AssetsReleaseID:       provenance.AssetsReleaseID,
+		AssetsReleaseAssets:   string(assetsJSON),
+		GithubProvider:        provenance.GithubProvider,
+		GithubRepo:            provenance.GithubRepo,
+		GithubWorkflow:        provenance.GithubWorkflow,
+		WorkflowSelector:      provenance.WorkflowRef,
+		GithubRef:             provenance.WorkflowSHA,
+		GithubSourceSha:       provenance.GithubSourceSHA,
+		GithubArtifactName:    provenance.GithubArtifactName,
+		GithubArtifactID:      provenance.GithubArtifactID,
+		GithubRunId:           provenance.GithubRunID,
+		GithubRunUrl:          provenance.GithubRunURL,
+		GithubHtmlUrl:         provenance.GithubHTMLURL,
+		PublicationRecordedAt: 1700000000,
+	}
+	outputDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outputDir, 0700); err != nil {
+		t.Fatalf("create fixture output: %v", err)
+	}
+	for name, contents := range map[string]string{
+		"rustqs.exe":  "executable",
+		"helper.dll":  "helper",
+		"custom_.txt": "secret-bearing settings must not be exported",
+	} {
+		if err := os.WriteFile(filepath.Join(outputDir, name), []byte(contents), 0600); err != nil {
+			t.Fatalf("write fixture output %q: %v", name, err)
+		}
+	}
+	producerManifest := producerManifestForBuild(build, map[string]string{"rustqs.exe": "executable"})
+	producerManifestJSON, err := producerManifest.StoredJSON()
+	if err != nil {
+		t.Fatalf("ProducerManifest.StoredJSON() error: %v", err)
+	}
+	build.ProducerManifestJSON = producerManifestJSON
+	digest, err := PublishedOutputDigest(build)
+	if err != nil {
+		t.Fatalf("PublishedOutputDigest() error = %v", err)
+	}
+	build.PublishedDigest = digest
+	return build
+}
diff --git a/api/service/build_output_cleanup.go b/api/service/build_output_cleanup.go
new file mode 100644
index 0000000..6784386
--- /dev/null
+++ b/api/service/build_output_cleanup.go
@@ -0,0 +1,607 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"rustdesk-server/api/model"
+
+	"gorm.io/gorm"
+)
+
+var githubArtifactTempPattern = regexp.MustCompile(`^deskforge-artifact-[A-Za-z0-9]{6}\.(?:part|zip)$`)
+var buildOutputNestedTempPattern = regexp.MustCompile(`^\.(?:[0-9]+-)?(?:download|archive|artifact)-[A-Za-z0-9._-]+\.(?:part|zip)$`)
+var buildOutputRecoveryPattern = regexp.MustCompile(`^\.artifact-recovery-[A-Za-z0-9._-]+$`)
+var buildOutputSnapshotPattern = regexp.MustCompile(`^\.[0-9]+-snapshot-[A-Za-z0-9._-]+$`)
+var buildOutputDeletionTombstonePattern = regexp.MustCompile(`^\.deskforge-build-delete-([1-9][0-9]*)\.tombstone$`)
+var buildOutputDeletionTombstoneTempPattern = regexp.MustCompile(`^\.deskforge-build-delete-[A-Za-z0-9]{6}\.tmp$`)
+
+const maxNestedBuildOutputTempEntries = 256
+const maxBuildOutputDeletionTombstones = 256
+
+var activeGithubArtifactTemps = struct {
+	sync.Mutex
+	paths map[string]struct{}
+}{
+	paths: make(map[string]struct{}),
+}
+
+var activeBuildOutputSnapshots = struct {
+	sync.Mutex
+	paths map[string]struct{}
+}{
+	paths: make(map[string]struct{}),
+}
+
+// ProtectBuildOutputSnapshot marks an export source snapshot as active until
+// its caller has finished packaging and removed it.
+func ProtectBuildOutputSnapshot(path string) {
+	path = filepath.Clean(path)
+	activeBuildOutputSnapshots.Lock()
+	activeBuildOutputSnapshots.paths[path] = struct{}{}
+	activeBuildOutputSnapshots.Unlock()
+}
+
+// ReleaseBuildOutputSnapshot removes active protection after an export
+// snapshot has been cleaned up. It is safe to call for an unknown path.
+func ReleaseBuildOutputSnapshot(path string) {
+	path = filepath.Clean(path)
+	activeBuildOutputSnapshots.Lock()
+	delete(activeBuildOutputSnapshots.paths, path)
+	activeBuildOutputSnapshots.Unlock()
+}
+
+func isProtectedBuildOutputSnapshot(path string) bool {
+	path = filepath.Clean(path)
+	activeBuildOutputSnapshots.Lock()
+	_, protected := activeBuildOutputSnapshots.paths[path]
+	activeBuildOutputSnapshots.Unlock()
+	return protected
+}
+
+// ProtectGithubArtifactTemp marks a provider archive as owned by an active
+// download until the caller explicitly releases it.
+func ProtectGithubArtifactTemp(path string) {
+	path = filepath.Clean(path)
+	activeGithubArtifactTemps.Lock()
+	activeGithubArtifactTemps.paths[path] = struct{}{}
+	activeGithubArtifactTemps.Unlock()
+}
+
+// ReleaseGithubArtifactTemp removes a provider archive from the active-path
+// protection set after its caller has finished with it. It is safe to call for
+// paths that were not created by DownloadArtifact.
+func ReleaseGithubArtifactTemp(path string) {
+	path = filepath.Clean(path)
+	activeGithubArtifactTemps.Lock()
+	delete(activeGithubArtifactTemps.paths, path)
+	activeGithubArtifactTemps.Unlock()
+}
+
+func isProtectedGithubArtifactTemp(path string) bool {
+	path = filepath.Clean(path)
+	activeGithubArtifactTemps.Lock()
+	_, protected := activeGithubArtifactTemps.paths[path]
+	activeGithubArtifactTemps.Unlock()
+	return protected
+}
+
+func buildOutputDeletionTombstonePath(outputRoot string, id uint) string {
+	return filepath.Join(outputRoot, fmt.Sprintf(".deskforge-build-delete-%d.tombstone", id))
+}
+
+// ensureBuildOutputDeletionTombstone durably records deletion intent before
+// the database row is removed. Existing valid markers are reused so retries do
+// not create a second intent.
+func ensureBuildOutputDeletionTombstone(outputRoot string, id uint) (string, error) {
+	if outputRoot == "" || id == 0 {
+		return "", errors.New("build deletion tombstone requires an output root and positive id")
+	}
+	if err := os.MkdirAll(outputRoot, 0700); err != nil {
+		return "", fmt.Errorf("create build output root for deletion tombstone: %w", err)
+	}
+	rootInfo, err := os.Lstat(outputRoot)
+	if err != nil {
+		return "", fmt.Errorf("inspect build output root for deletion tombstone: %w", err)
+	}
+	if !rootInfo.IsDir() || rootInfo.Mode()&os.ModeSymlink != 0 {
+		return "", errors.New("build output root for deletion tombstone is not a regular directory")
+	}
+	path := buildOutputDeletionTombstonePath(outputRoot, id)
+	info, err := os.Lstat(path)
+	if err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			return "", errors.New("build deletion tombstone is not a regular file")
+		}
+		if err := validateBuildOutputDeletionTombstone(path, id); err != nil {
+			return "", err
+		}
+		if err := os.Chmod(path, 0600); err != nil {
+			return "", fmt.Errorf("restrict build deletion tombstone permissions: %w", err)
+		}
+		return path, nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return "", fmt.Errorf("inspect build deletion tombstone: %w", err)
+	}
+	file, err := os.CreateTemp(outputRoot, ".deskforge-build-delete-*.tmp")
+	if err != nil {
+		return "", fmt.Errorf("create build deletion tombstone: %w", err)
+	}
+	tempPath := file.Name()
+	if err := file.Chmod(0600); err != nil {
+		_ = file.Close()
+		_ = os.Remove(tempPath)
+		return "", fmt.Errorf("restrict build deletion tombstone permissions: %w", err)
+	}
+	content := []byte(fmt.Sprintf("%d\n", id))
+	if _, err := file.Write(content); err != nil {
+		_ = file.Close()
+		_ = os.Remove(tempPath)
+		return "", fmt.Errorf("write build deletion tombstone: %w", err)
+	}
+	if err := file.Sync(); err != nil {
+		_ = file.Close()
+		_ = os.Remove(tempPath)
+		return "", fmt.Errorf("sync build deletion tombstone: %w", err)
+	}
+	if err := file.Close(); err != nil {
+		_ = os.Remove(tempPath)
+		return "", fmt.Errorf("close build deletion tombstone: %w", err)
+	}
+	if err := os.Rename(tempPath, path); err != nil {
+		if _, statErr := os.Lstat(path); statErr == nil {
+			_ = os.Remove(tempPath)
+			if validateErr := validateBuildOutputDeletionTombstone(path, id); validateErr != nil {
+				return "", validateErr
+			}
+			return path, nil
+		}
+		_ = os.Remove(tempPath)
+		return "", fmt.Errorf("publish build deletion tombstone: %w", err)
+	}
+	if err := syncBuildOutputDirectory(outputRoot); err != nil {
+		return "", fmt.Errorf("sync build output root after deletion tombstone: %w", err)
+	}
+	return path, nil
+}
+
+func syncBuildOutputDirectory(path string) error {
+	dir, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = dir.Close() }()
+	return dir.Sync()
+}
+
+func validateBuildOutputDeletionTombstone(path string, id uint) error {
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("read build deletion tombstone: %w", err)
+	}
+	if string(content) != fmt.Sprintf("%d\n", id) {
+		return errors.New("build deletion tombstone does not match its filename")
+	}
+	return nil
+}
+
+var removeBuildOutputDeletionTombstone = os.Remove
+
+func removeBuildOutputDeletionTombstoneIfPresent(path string) error {
+	info, err := os.Lstat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+		return errors.New("build deletion tombstone is not a regular file")
+	}
+	if err := removeBuildOutputDeletionTombstone(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	return nil
+}
+
+// SweepBuildOutputTemps removes only stale temporary artifact files and
+// staging directories directly below outputRoot. Final numeric build
+// directories are never candidates. activeBuildIDs protects temporary paths
+// for builds that are currently in an asynchronous lifecycle state.
+func SweepBuildOutputTemps(outputRoot string, now time.Time, ttl time.Duration, activeBuildIDs map[uint]struct{}) error {
+	if outputRoot == "" {
+		return errors.New("build output root is required")
+	}
+	if ttl <= 0 {
+		return errors.New("build output temporary-file TTL must be positive")
+	}
+
+	rootInfo, err := os.Lstat(outputRoot)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("inspect build output root: %w", err)
+	}
+	if !rootInfo.IsDir() || rootInfo.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("build output root is not a regular directory")
+	}
+
+	entries, err := os.ReadDir(outputRoot)
+	if err != nil {
+		return fmt.Errorf("read build output root: %w", err)
+	}
+	cleanupErr := sweepBuildOutputDeletionTombstones(outputRoot, entries, now, ttl, activeBuildIDs)
+	for _, entry := range entries {
+		if entry.IsDir() {
+			buildID, buildDir := parseBuildOutputDirectory(entry.Name())
+			if buildDir {
+				if _, active := activeBuildIDs[buildID]; active {
+					continue
+				}
+				path := filepath.Join(outputRoot, entry.Name())
+				if _, err := os.Lstat(path); errors.Is(err, os.ErrNotExist) {
+					continue
+				}
+				if err := sweepNestedBuildOutputTemps(path, now, ttl); err != nil {
+					cleanupErr = errors.Join(cleanupErr, err)
+				}
+				continue
+			}
+		}
+		buildID, candidate := buildOutputTempCandidate(entry.Name(), entry.IsDir())
+		if !candidate {
+			continue
+		}
+		if buildID > 0 {
+			if _, active := activeBuildIDs[buildID]; active {
+				continue
+			}
+		}
+		info, err := entry.Info()
+		if err != nil {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect stale build output temp %q: %w", entry.Name(), err))
+			continue
+		}
+		if now.Sub(info.ModTime()) < ttl {
+			continue
+		}
+		path := filepath.Join(outputRoot, entry.Name())
+		if isProtectedBuildOutputSnapshot(path) {
+			continue
+		}
+		if isProtectedGithubArtifactTemp(path) {
+			continue
+		}
+		pathInfo, err := os.Lstat(path)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect cleanup target %q: %w", path, err))
+			continue
+		}
+		if pathInfo.Mode()&os.ModeSymlink != 0 {
+			continue
+		}
+		if pathInfo.IsDir() {
+			err = os.RemoveAll(path)
+		} else {
+			err = os.Remove(path)
+		}
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("remove stale build output temp %q: %w", path, err))
+		}
+	}
+	return cleanupErr
+}
+
+func sweepBuildOutputDeletionTombstones(outputRoot string, entries []os.DirEntry, now time.Time, ttl time.Duration, activeBuildIDs map[uint]struct{}) error {
+	var cleanupErr error
+	candidates := 0
+	for _, entry := range entries {
+		if buildOutputDeletionTombstoneTempPattern.MatchString(entry.Name()) {
+			path := filepath.Join(outputRoot, entry.Name())
+			info, err := os.Lstat(path)
+			if err != nil {
+				if !errors.Is(err, os.ErrNotExist) {
+					cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect build deletion tombstone temp %q: %w", path, err))
+				}
+				continue
+			}
+			if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() || now.Sub(info.ModTime()) < ttl {
+				continue
+			}
+			if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+				cleanupErr = errors.Join(cleanupErr, fmt.Errorf("remove stale build deletion tombstone temp %q: %w", path, err))
+			}
+			continue
+		}
+		matches := buildOutputDeletionTombstonePattern.FindStringSubmatch(entry.Name())
+		if len(matches) != 2 {
+			continue
+		}
+		candidates++
+		if candidates > maxBuildOutputDeletionTombstones {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("build output deletion tombstone limit exceeded: %d", maxBuildOutputDeletionTombstones))
+			break
+		}
+		parsed, err := strconv.ParseUint(matches[1], 10, 0)
+		if err != nil || parsed == 0 {
+			continue
+		}
+		buildID := uint(parsed)
+		if _, active := activeBuildIDs[buildID]; active {
+			continue
+		}
+		path := filepath.Join(outputRoot, entry.Name())
+		info, err := os.Lstat(path)
+		if err != nil {
+			if !errors.Is(err, os.ErrNotExist) {
+				cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect build deletion tombstone %q: %w", path, err))
+			}
+			continue
+		}
+		if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+			continue
+		}
+		if now.Sub(info.ModTime()) < ttl {
+			continue
+		}
+		if err := validateBuildOutputDeletionTombstone(path, buildID); err != nil {
+			continue
+		}
+		if DB == nil {
+			cleanupErr = errors.Join(cleanupErr, errors.New("database is unavailable for build deletion tombstone cleanup"))
+			continue
+		}
+		cleanupErr = errors.Join(cleanupErr, func() error {
+			buildOutputLifecycleMu.Lock()
+			defer buildOutputLifecycleMu.Unlock()
+
+			// Recheck immediately under the shared lifecycle lock. This is the
+			// final authority check before exact output and marker removal.
+			var build model.CustomBuild
+			err = DB.First(&build, buildID).Error
+			if err == nil {
+				return nil
+			}
+			if !errors.Is(err, gorm.ErrRecordNotFound) {
+				return fmt.Errorf("verify deleted custom build %d: %w", buildID, err)
+			}
+			outputDir := filepath.Join(outputRoot, strconv.FormatUint(parsed, 10))
+			outputInfo, err := os.Lstat(outputDir)
+			if err != nil && !errors.Is(err, os.ErrNotExist) {
+				return fmt.Errorf("inspect deleted custom build output %q: %w", outputDir, err)
+			}
+			if err == nil {
+				if outputInfo.Mode()&os.ModeSymlink != 0 || !outputInfo.IsDir() {
+					return nil
+				}
+				if err := removeBuildOutputDir(outputDir); err != nil {
+					return fmt.Errorf("remove deleted custom build output %q: %w", outputDir, err)
+				}
+				if _, err := os.Lstat(outputDir); err != nil && !errors.Is(err, os.ErrNotExist) {
+					return fmt.Errorf("verify deleted custom build output %q: %w", outputDir, err)
+				}
+			}
+			if err := removeBuildOutputDeletionTombstoneIfPresent(path); err != nil {
+				return fmt.Errorf("remove build deletion tombstone %q: %w", path, err)
+			}
+			return nil
+		}())
+	}
+	return cleanupErr
+}
+
+func parseBuildOutputDirectory(name string) (uint, bool) {
+	buildID, err := strconv.ParseUint(name, 10, 0)
+	return uint(buildID), err == nil && buildID > 0
+}
+
+// sweepNestedBuildOutputTemps is deliberately one level deep except for an
+// explicitly service-owned recovery directory. The numeric directory is a
+// published-output boundary, so ordinary files are never candidates. A hard
+// entry bound prevents a malformed build directory or recovery tree from
+// turning startup cleanup into an unbounded traversal.
+func sweepNestedBuildOutputTemps(buildDir string, now time.Time, ttl time.Duration) error {
+	entries, err := os.ReadDir(buildDir)
+	if err != nil {
+		return fmt.Errorf("read build output temp directory %q: %w", buildDir, err)
+	}
+	if len(entries) > maxNestedBuildOutputTempEntries {
+		return fmt.Errorf("build output temp directory %q contains too many entries: %d", buildDir, len(entries))
+	}
+	var cleanupErr error
+	for _, entry := range entries {
+		isNestedTemp := buildOutputNestedTempPattern.MatchString(entry.Name())
+		isRecoveryPath := buildOutputRecoveryPattern.MatchString(entry.Name())
+		if !isNestedTemp && !isRecoveryPath {
+			continue
+		}
+		path := filepath.Join(buildDir, entry.Name())
+		if isProtectedGithubArtifactTemp(path) {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect stale nested build output temp %q: %w", path, err))
+			continue
+		}
+		if now.Sub(info.ModTime()) < ttl {
+			continue
+		}
+		pathInfo, err := os.Lstat(path)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect nested build output cleanup target %q: %w", path, err))
+			continue
+		}
+		if pathInfo.Mode()&os.ModeSymlink != 0 {
+			continue
+		}
+		if pathInfo.IsDir() {
+			if !isRecoveryPath {
+				continue
+			}
+			removed, err := removeBoundedRecoveryDirectory(path, now, ttl)
+			if err != nil && !errors.Is(err, os.ErrNotExist) {
+				cleanupErr = errors.Join(cleanupErr, fmt.Errorf("remove stale nested artifact recovery %q: %w", path, err))
+			}
+			if !removed {
+				continue
+			}
+			continue
+		}
+		if !pathInfo.Mode().IsRegular() {
+			continue
+		}
+		if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("remove stale nested build output temp %q: %w", path, err))
+		}
+	}
+	return cleanupErr
+}
+
+func removeBoundedRecoveryDirectory(path string, now time.Time, ttl time.Duration) (bool, error) {
+	entries := 0
+	stale := true
+	err := filepath.WalkDir(path, func(current string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		entries++
+		if entries > maxNestedBuildOutputTempEntries {
+			return fmt.Errorf("artifact recovery directory contains too many entries: %d", entries)
+		}
+		if entry.Type()&os.ModeSymlink == 0 {
+			info, err := entry.Info()
+			if err != nil {
+				return err
+			}
+			if now.Sub(info.ModTime()) < ttl {
+				stale = false
+			}
+		}
+		if current != path && entry.Type()&os.ModeSymlink != 0 {
+			if entry.IsDir() {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+		return nil
+	})
+	if err != nil {
+		return false, err
+	}
+	if !stale {
+		return false, nil
+	}
+	return true, os.RemoveAll(path)
+}
+
+// SweepGithubArtifactTemps removes only stale provider download archives from
+// tempRoot. The exact CreateTemp filename shape is required so unrelated temp
+// files are never swept. Archives still owned by an active download remain
+// protected until ReleaseGithubArtifactTemp is called.
+func SweepGithubArtifactTemps(tempRoot string, now time.Time, ttl time.Duration) error {
+	if tempRoot == "" {
+		tempRoot = os.TempDir()
+	}
+	if ttl <= 0 {
+		return errors.New("GitHub artifact temporary-file TTL must be positive")
+	}
+
+	rootInfo, err := os.Lstat(tempRoot)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("inspect GitHub artifact temp root: %w", err)
+	}
+	if !rootInfo.IsDir() || rootInfo.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("GitHub artifact temp root is not a regular directory")
+	}
+
+	entries, err := os.ReadDir(tempRoot)
+	if err != nil {
+		return fmt.Errorf("read GitHub artifact temp root: %w", err)
+	}
+	var cleanupErr error
+	for _, entry := range entries {
+		if entry.IsDir() || !githubArtifactTempPattern.MatchString(entry.Name()) {
+			continue
+		}
+		path := filepath.Join(tempRoot, entry.Name())
+		if isProtectedGithubArtifactTemp(path) {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect stale GitHub artifact temp %q: %w", entry.Name(), err))
+			continue
+		}
+		if now.Sub(info.ModTime()) < ttl {
+			continue
+		}
+		pathInfo, err := os.Lstat(path)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("inspect GitHub artifact cleanup target %q: %w", path, err))
+			continue
+		}
+		if pathInfo.Mode()&os.ModeSymlink != 0 || !pathInfo.Mode().IsRegular() {
+			continue
+		}
+		if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("remove stale GitHub artifact temp %q: %w", path, err))
+		}
+	}
+	return cleanupErr
+}
+
+func buildOutputTempCandidate(name string, isDir bool) (uint, bool) {
+	if buildOutputSnapshotPattern.MatchString(name) {
+		buildID, _, _ := strings.Cut(strings.TrimPrefix(name, "."), "-snapshot-")
+		parsed, err := strconv.ParseUint(buildID, 10, 0)
+		return uint(parsed), err == nil && parsed > 0 && isDir
+	}
+	if !strings.HasPrefix(name, ".") {
+		return 0, false
+	}
+	rest := strings.TrimPrefix(name, ".")
+	dash := strings.IndexByte(rest, '-')
+	if dash <= 0 {
+		return 0, false
+	}
+	buildID, err := strconv.ParseUint(rest[:dash], 10, 0)
+	if err != nil || buildID == 0 {
+		return 0, false
+	}
+	kind := rest[dash+1:]
+	if strings.HasPrefix(kind, "artifact-recovery-") {
+		return uint(buildID), buildOutputRecoveryPattern.MatchString("." + kind)
+	}
+	if strings.HasPrefix(kind, "artifact-") {
+		if isDir {
+			return uint(buildID), true
+		}
+		return uint(buildID), strings.HasSuffix(kind, ".part") || strings.HasSuffix(kind, ".zip")
+	}
+	if strings.HasPrefix(kind, "download-") || strings.HasPrefix(kind, "archive-") {
+		return uint(buildID), strings.HasSuffix(kind, ".part") || strings.HasSuffix(kind, ".zip")
+	}
+	return 0, false
+}
diff --git a/api/service/build_output_cleanup_test.go b/api/service/build_output_cleanup_test.go
new file mode 100644
index 0000000..a97b2cd
--- /dev/null
+++ b/api/service/build_output_cleanup_test.go
@@ -0,0 +1,348 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"rustdesk-server/api/model"
+
+	"gorm.io/gorm"
+)
+
+func TestSweepBuildOutputTempsRemovesOnlyStaleInactiveTemps(t *testing.T) {
+	root := t.TempDir()
+	now := time.Unix(2_000, 0)
+	ttl := time.Hour
+	old := now.Add(-2 * ttl)
+	fresh := now.Add(-ttl / 2)
+
+	staleStaging := filepath.Join(root, ".7-artifact-stale")
+	if err := os.MkdirAll(staleStaging, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(staleStaging, "partial.bin"), []byte("partial"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	staleArchive := filepath.Join(root, ".8-download-stale.zip.part")
+	if err := os.WriteFile(staleArchive, []byte("partial"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	staleCompletedArchive := filepath.Join(root, ".8-download-stale.zip")
+	if err := os.WriteFile(staleCompletedArchive, []byte("archive"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	protectedCurrent := filepath.Join(root, ".12-download-current.zip.part")
+	if err := os.WriteFile(protectedCurrent, []byte("current"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	freshStaging := filepath.Join(root, ".9-artifact-fresh")
+	if err := os.Mkdir(freshStaging, 0755); err != nil {
+		t.Fatal(err)
+	}
+	activeStaging := filepath.Join(root, ".10-artifact-active")
+	if err := os.Mkdir(activeStaging, 0755); err != nil {
+		t.Fatal(err)
+	}
+	currentOutput := filepath.Join(root, "11")
+	if err := os.Mkdir(currentOutput, 0755); err != nil {
+		t.Fatal(err)
+	}
+	staleNestedPart := filepath.Join(currentOutput, ".download-interrupted.zip.part")
+	if err := os.WriteFile(staleNestedPart, []byte("partial"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	staleNestedArchive := filepath.Join(currentOutput, ".archive-interrupted.zip")
+	if err := os.WriteFile(staleNestedArchive, []byte("archive"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	staleNestedRecovery := filepath.Join(currentOutput, ".artifact-recovery-interrupted")
+	if err := os.MkdirAll(staleNestedRecovery, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(staleNestedRecovery, "temporary-secret.bin"), []byte("recovery"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	freshNestedRecovery := filepath.Join(currentOutput, ".artifact-recovery-active")
+	if err := os.MkdirAll(freshNestedRecovery, 0755); err != nil {
+		t.Fatal(err)
+	}
+	freshRecoveryFile := filepath.Join(freshNestedRecovery, "current.bin")
+	if err := os.WriteFile(freshRecoveryFile, []byte("active recovery"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	activeNested := filepath.Join(activeStaging, ".download-active.zip.part")
+	if err := os.WriteFile(activeNested, []byte("active"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	staleSnapshot := filepath.Join(root, ".13-snapshot-interrupted")
+	if err := os.MkdirAll(staleSnapshot, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(staleSnapshot, "secret.bin"), []byte("snapshot"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	activeSnapshot := filepath.Join(root, ".14-snapshot-current")
+	if err := os.MkdirAll(activeSnapshot, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(activeSnapshot, "current.bin"), []byte("active snapshot"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	freshSnapshot := filepath.Join(root, ".15-snapshot-fresh")
+	if err := os.MkdirAll(freshSnapshot, 0700); err != nil {
+		t.Fatal(err)
+	}
+	unrelated := filepath.Join(root, ".not-a-build-temp")
+	if err := os.WriteFile(unrelated, []byte("keep"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, path := range []string{staleStaging, staleArchive, staleCompletedArchive, protectedCurrent, staleNestedPart, staleNestedArchive, staleNestedRecovery, activeNested, staleSnapshot, activeSnapshot} {
+		if err := os.Chtimes(path, old, old); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.Chtimes(filepath.Join(staleNestedRecovery, "temporary-secret.bin"), old, old); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(freshNestedRecovery, old, old); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(freshRecoveryFile, fresh, fresh); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(freshStaging, fresh, fresh); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(activeStaging, old, old); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(freshSnapshot, fresh, fresh); err != nil {
+		t.Fatal(err)
+	}
+	ProtectGithubArtifactTemp(protectedCurrent)
+	t.Cleanup(func() { ReleaseGithubArtifactTemp(protectedCurrent) })
+	ProtectBuildOutputSnapshot(activeSnapshot)
+	t.Cleanup(func() { ReleaseBuildOutputSnapshot(activeSnapshot) })
+	if err := os.Chtimes(currentOutput, old, old); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := SweepBuildOutputTemps(root, now, ttl, map[uint]struct{}{10: {}}); err != nil {
+		t.Fatalf("SweepBuildOutputTemps() error = %v", err)
+	}
+	for _, path := range []string{staleStaging, staleArchive, staleCompletedArchive, staleNestedPart, staleNestedArchive, staleNestedRecovery, staleSnapshot} {
+		if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("stale temp %q stat = %v, want removed", path, err)
+		}
+	}
+	for _, path := range []string{freshStaging, activeStaging, activeNested, currentOutput, freshNestedRecovery, freshRecoveryFile, protectedCurrent, activeSnapshot, freshSnapshot, unrelated} {
+		if _, err := os.Stat(path); err != nil {
+			t.Fatalf("protected/fresh path %q stat = %v, want preserved", path, err)
+		}
+	}
+}
+
+func TestSweepGithubArtifactTempsRemovesOnlyStaleUnprotectedArchives(t *testing.T) {
+	root := t.TempDir()
+	now := time.Unix(2_000, 0)
+	ttl := time.Hour
+	old := now.Add(-2 * ttl)
+	fresh := now.Add(-ttl / 2)
+
+	stalePart := filepath.Join(root, "deskforge-artifact-abcdef.part")
+	staleArchive := filepath.Join(root, "deskforge-artifact-123456.zip")
+	freshPart := filepath.Join(root, "deskforge-artifact-fedcba.part")
+	activeArchive := filepath.Join(root, "deskforge-artifact-654321.zip")
+	unrelatedPrefix := filepath.Join(root, "deskforge-artifact-provider.part")
+	unrelatedFile := filepath.Join(root, "other-service-abcdef.part")
+	for _, path := range []string{stalePart, staleArchive, freshPart, activeArchive, unrelatedPrefix, unrelatedFile} {
+		if err := os.WriteFile(path, []byte("partial"), 0600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, path := range []string{stalePart, staleArchive, activeArchive, unrelatedPrefix, unrelatedFile} {
+		if err := os.Chtimes(path, old, old); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := os.Chtimes(freshPart, fresh, fresh); err != nil {
+		t.Fatal(err)
+	}
+
+	ProtectGithubArtifactTemp(activeArchive)
+	t.Cleanup(func() { ReleaseGithubArtifactTemp(activeArchive) })
+	if err := SweepGithubArtifactTemps(root, now, ttl); err != nil {
+		t.Fatalf("SweepGithubArtifactTemps() error = %v", err)
+	}
+	for _, path := range []string{stalePart, staleArchive} {
+		if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("stale provider temp %q stat = %v, want removed", path, err)
+		}
+	}
+	for _, path := range []string{freshPart, activeArchive, unrelatedPrefix, unrelatedFile} {
+		if _, err := os.Stat(path); err != nil {
+			t.Fatalf("fresh/protected/unrelated path %q stat = %v, want preserved", path, err)
+		}
+	}
+}
+
+func TestSweepBuildOutputDeletionTombstonesRetriesOnlyDeletedBuilds(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	root := t.TempDir()
+	now := time.Unix(2_000, 0)
+	ttl := time.Hour
+	old := now.Add(-2 * ttl)
+	fresh := now.Add(-ttl / 2)
+
+	deletedID := uint(41)
+	rowID := uint(42)
+	activeID := uint(43)
+	for _, id := range []uint{deletedID, rowID, activeID} {
+		marker := buildOutputDeletionTombstonePath(root, id)
+		if err := os.WriteFile(marker, []byte(fmt.Sprintf("%d\n", id)), 0600); err != nil {
+			t.Fatalf("write tombstone %d: %v", id, err)
+		}
+		if err := os.Chtimes(marker, old, old); err != nil {
+			t.Fatalf("age tombstone %d: %v", id, err)
+		}
+		outDir := filepath.Join(root, fmt.Sprint(id))
+		if err := os.MkdirAll(outDir, 0700); err != nil {
+			t.Fatalf("create output %d: %v", id, err)
+		}
+		if err := os.WriteFile(filepath.Join(outDir, "artifact.bin"), []byte("artifact"), 0600); err != nil {
+			t.Fatalf("write output %d: %v", id, err)
+		}
+	}
+	if err := db.Create(&model.CustomBuild{IdModel: model.IdModel{Id: rowID}}).Error; err != nil {
+		t.Fatalf("create retained row: %v", err)
+	}
+
+	if err := SweepBuildOutputTemps(root, now, ttl, map[uint]struct{}{activeID: {}}); err != nil {
+		t.Fatalf("SweepBuildOutputTemps() error = %v", err)
+	}
+	for _, path := range []string{
+		filepath.Join(root, fmt.Sprint(deletedID)),
+		buildOutputDeletionTombstonePath(root, deletedID),
+	} {
+		if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("deleted build path %q stat = %v, want removed", path, err)
+		}
+	}
+	for _, id := range []uint{rowID, activeID} {
+		for _, path := range []string{filepath.Join(root, fmt.Sprint(id)), buildOutputDeletionTombstonePath(root, id)} {
+			if _, err := os.Stat(path); err != nil {
+				t.Fatalf("protected build path %q stat = %v, want preserved", path, err)
+			}
+		}
+	}
+
+	freshID := uint(44)
+	freshMarker := buildOutputDeletionTombstonePath(root, freshID)
+	if err := os.WriteFile(freshMarker, []byte(fmt.Sprintf("%d\n", freshID)), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(freshMarker, fresh, fresh); err != nil {
+		t.Fatal(err)
+	}
+	if err := SweepBuildOutputTemps(root, now, ttl, nil); err != nil {
+		t.Fatalf("fresh tombstone sweep error = %v", err)
+	}
+	if _, err := os.Stat(freshMarker); err != nil {
+		t.Fatalf("fresh tombstone stat = %v, want preserved", err)
+	}
+}
+
+func TestSweepBuildOutputDeletionTombstonesWaitsForLifecycleLock(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	root := t.TempDir()
+	now := time.Unix(2_000, 0)
+	ttl := time.Hour
+	buildID := uint(61)
+	if err := db.Create(&model.CustomBuild{IdModel: model.IdModel{Id: buildID}}).Error; err != nil {
+		t.Fatalf("create retained row: %v", err)
+	}
+	marker := buildOutputDeletionTombstonePath(root, buildID)
+	if err := os.WriteFile(marker, []byte(fmt.Sprintf("%d\n", buildID)), 0600); err != nil {
+		t.Fatalf("write tombstone: %v", err)
+	}
+	if err := os.Chtimes(marker, now.Add(-2*ttl), now.Add(-2*ttl)); err != nil {
+		t.Fatalf("age tombstone: %v", err)
+	}
+
+	buildOutputLifecycleMu.Lock()
+	result := make(chan error, 1)
+	go func() { result <- SweepBuildOutputTemps(root, now, ttl, nil) }()
+	select {
+	case err := <-result:
+		buildOutputLifecycleMu.Unlock()
+		t.Fatalf("sweep completed while lifecycle lock was held: %v", err)
+	case <-time.After(25 * time.Millisecond):
+	}
+	buildOutputLifecycleMu.Unlock()
+	if err := <-result; err != nil {
+		t.Fatalf("SweepBuildOutputTemps() error = %v", err)
+	}
+	if _, err := os.Stat(marker); err != nil {
+		t.Fatalf("retained-row tombstone stat = %v, want preserved", err)
+	}
+}
+
+func TestSweepBuildOutputDeletionTombstonesSkipsMalformedAndFailsClosed(t *testing.T) {
+	newCustomPersistenceDB(t)
+	root := t.TempDir()
+	now := time.Unix(2_000, 0)
+	ttl := time.Hour
+	old := now.Add(-2 * ttl)
+	malformed := filepath.Join(root, ".deskforge-build-delete-51.tombstone")
+	if err := os.WriteFile(malformed, []byte("not-51\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(malformed, old, old); err != nil {
+		t.Fatal(err)
+	}
+	unknownNumeric := filepath.Join(root, "52")
+	if err := os.MkdirAll(unknownNumeric, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := SweepBuildOutputTemps(root, now, ttl, nil); err != nil {
+		t.Fatalf("malformed tombstone sweep error = %v", err)
+	}
+	for _, path := range []string{malformed, unknownNumeric} {
+		if _, err := os.Stat(path); err != nil {
+			t.Fatalf("malformed/unknown path %q stat = %v, want preserved", path, err)
+		}
+	}
+
+	newClosedCustomPersistenceDB(t)
+	closedMarker := filepath.Join(root, ".deskforge-build-delete-53.tombstone")
+	if err := os.WriteFile(closedMarker, []byte("53\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(closedMarker, old, old); err != nil {
+		t.Fatal(err)
+	}
+	if err := SweepBuildOutputTemps(root, now, ttl, nil); err == nil {
+		t.Fatal("closed database sweep error = nil, want fail-closed error")
+	}
+	if _, err := os.Stat(closedMarker); err != nil {
+		t.Fatalf("closed database marker stat = %v, want preserved", err)
+	}
+}
+
+func newClosedCustomPersistenceDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	db := newCustomPersistenceDB(t)
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := sqlDB.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return db
+}
diff --git a/api/service/build_provenance_test.go b/api/service/build_provenance_test.go
new file mode 100644
index 0000000..0895c42
--- /dev/null
+++ b/api/service/build_provenance_test.go
@@ -0,0 +1,697 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+
+	"rustdesk-server/api/model"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestSetProvenanceIsOneShotAndStoresExactIdentity(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusPending, Platform: "windows"}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	first := testBuildProvenance(101, "owner/repo-a", "workflow-a.yml", "refs/heads/ref-a", "artifact-a")
+	if err := (&CustomBuildService{}).SetProvenance(build.Id, first); err != nil {
+		t.Fatalf("SetProvenance() error = %v", err)
+	}
+	second := testBuildProvenance(202, "owner/repo-b", "workflow-b.yml", "refs/heads/ref-b", "artifact-b")
+	err := (&CustomBuildService{}).SetProvenance(build.Id, second)
+	var persistenceErr *BuildProvenancePersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("second SetProvenance() error = %T %v, want typed persistence error", err, err)
+	}
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusBuilding || stored.BuildLog != "github run id: 101" {
+		t.Fatalf("stored dispatch state = %#v", stored)
+	}
+	got, err := BuildProvenanceFromRecord(&stored)
+	if err != nil {
+		t.Fatalf("BuildProvenanceFromRecord() error = %v", err)
+	}
+	if !reflect.DeepEqual(got, first) {
+		t.Fatalf("stored provenance = %#v, want %#v", got, first)
+	}
+}
+
+func TestCompletedBuildProvenanceRequiresDoneAndPublicationMarker(t *testing.T) {
+	provenance := testBuildProvenance(101, "owner/repo", "workflow.yml", "refs/heads/ref", "artifact")
+	provenance.GithubArtifactID = 42
+	build := &model.CustomBuild{
+		Status:             model.CustomBuildStatusDone,
+		Version:            provenance.Version,
+		BuildRef:           provenance.BuildRef,
+		SourceTag:          provenance.SourceTag,
+		AssetsRelease:      provenance.AssetsRelease,
+		AssetsReleaseID:    provenance.AssetsReleaseID,
+		GithubProvider:     provenance.GithubProvider,
+		GithubRepo:         provenance.GithubRepo,
+		GithubWorkflow:     provenance.GithubWorkflow,
+		WorkflowSelector:   provenance.WorkflowRef,
+		GithubRef:          provenance.GithubRef,
+		GithubArtifactName: provenance.GithubArtifactName,
+		GithubArtifactID:   provenance.GithubArtifactID,
+		GithubRunId:        provenance.GithubRunID,
+		GithubRunUrl:       provenance.GithubRunURL,
+		GithubHtmlUrl:      provenance.GithubHTMLURL,
+		PublishedDigest:    strings.Repeat("a", 64),
+	}
+	assetsJSON, err := json.Marshal(testReleaseAssets())
+	if err != nil {
+		t.Fatalf("marshal release assets: %v", err)
+	}
+	build.AssetsReleaseAssets = string(assetsJSON)
+	if _, err := CompletedBuildProvenanceFromRecord(build); err == nil {
+		t.Fatal("CompletedBuildProvenanceFromRecord() error = nil for unmarked done row")
+	}
+	build.PublicationRecordedAt = 1
+	got, err := CompletedBuildProvenanceFromRecord(build)
+	if err != nil {
+		t.Fatalf("CompletedBuildProvenanceFromRecord() marked error = %v", err)
+	}
+	if !reflect.DeepEqual(got, provenance) {
+		t.Fatalf("completed provenance = %#v, want %#v", got, provenance)
+	}
+	build.Status = model.CustomBuildStatusBuilding
+	if _, err := CompletedBuildProvenanceFromRecord(build); err == nil {
+		t.Fatal("CompletedBuildProvenanceFromRecord() error = nil for non-done marked row")
+	}
+}
+
+func TestValidateCompletedPublishedOutputRequiresProductionCapability(t *testing.T) {
+	provenance := testBuildProvenance(202, "owner/repo", "workflow.yml", "refs/heads/ref", "artifact")
+	provenance.GithubArtifactID = 42
+	for _, platform := range []string{string(PlatformLinux), string(PlatformAndroid)} {
+		t.Run(platform, func(t *testing.T) {
+			build := &model.CustomBuild{
+				Status:                model.CustomBuildStatusDone,
+				Platform:              platform,
+				Version:               provenance.Version,
+				BuildRef:              provenance.BuildRef,
+				SourceTag:             provenance.SourceTag,
+				AssetsRelease:         provenance.AssetsRelease,
+				AssetsReleaseID:       provenance.AssetsReleaseID,
+				GithubProvider:        provenance.GithubProvider,
+				GithubRepo:            provenance.GithubRepo,
+				GithubWorkflow:        provenance.GithubWorkflow,
+				GithubRef:             provenance.GithubRef,
+				GithubArtifactName:    provenance.GithubArtifactName,
+				GithubArtifactID:      provenance.GithubArtifactID,
+				GithubRunId:           provenance.GithubRunID,
+				GithubRunUrl:          provenance.GithubRunURL,
+				GithubHtmlUrl:         provenance.GithubHTMLURL,
+				PublicationRecordedAt: 1,
+				PublishedDigest:       strings.Repeat("a", 64),
+			}
+			_, _, err := ValidateCompletedPublishedOutput(build)
+			var unavailable *ProductionCapabilityUnavailableError
+			if !errors.As(err, &unavailable) {
+				t.Fatalf("ValidateCompletedPublishedOutput() error = %T %v, want capability-unavailable error", err, err)
+			}
+			if unavailable.Platform != platform {
+				t.Fatalf("capability error platform = %q, want %q", unavailable.Platform, platform)
+			}
+		})
+	}
+}
+
+func TestCreateNormalizedWithIdentityPersistsWriteOnceVersionFields(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	identity := VersionIdentity{
+		Repo:           "owner/repo",
+		DisplayVersion: "1.4.8",
+		BuildRef:       strings.Repeat("a", 40),
+		SourceTag:      "1.4.8",
+		WorkflowRef:    defaultWorkflowExecutionRef,
+		WorkflowSHA:    strings.Repeat("b", 40),
+		AssetsRelease:  AssetsRelease{ID: 48, TagName: "offline-assets-1.4.8", Assets: testReleaseAssets()},
+	}
+	build := &model.CustomBuild{Status: model.CustomBuildStatusPending, Platform: "windows", Version: identity.DisplayVersion, AppName: "rustqs"}
+	normalized, err := (&CustomBuildService{}).CreateNormalizedWithIdentity(build, identity)
+	if err != nil {
+		t.Fatalf("CreateNormalizedWithIdentity() error = %v", err)
+	}
+	if normalized.DispatchParams["version"] != identity.DisplayVersion {
+		t.Fatalf("dispatch version = %#v, want resolved display version %q", normalized.DispatchParams["version"], identity.DisplayVersion)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read identity build: %v", err)
+	}
+	if stored.Version != identity.DisplayVersion || stored.BuildRef != identity.BuildRef || stored.SourceTag != identity.SourceTag || stored.WorkflowSelector != identity.WorkflowRef || stored.GithubRef != identity.WorkflowSHA || stored.AssetsRelease != identity.AssetsRelease.TagName || stored.AssetsReleaseID != identity.AssetsRelease.ID || stored.AssetsReleaseAssets == "" {
+		t.Fatalf("stored version identity = %#v, want %#v", stored, identity)
+	}
+	stored.Version = "1.4.7"
+	if err := (&CustomBuildService{}).UpdateValidated(&stored); err == nil {
+		t.Fatal("UpdateValidated() error = nil, want immutable version rejection")
+	}
+	var unchanged model.CustomBuild
+	if err := db.First(&unchanged, build.Id).Error; err != nil {
+		t.Fatalf("read unchanged identity build: %v", err)
+	}
+	if unchanged.Version != identity.DisplayVersion || unchanged.BuildRef != identity.BuildRef {
+		t.Fatalf("immutable identity changed after rejected edit: %#v", unchanged)
+	}
+}
+
+func TestCatalogResolvedIdentityDispatchesAndRejectsMismatchedRepo(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	if err := db.AutoMigrate(&model.GithubBuildConfig{}); err != nil {
+		t.Fatalf("migrate GitHub config: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo"}).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+	resetVersionCatalogCache()
+	t.Cleanup(resetVersionCatalogCache)
+	buildRef := strings.Repeat("a", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path == "/repos/owner/repo/git/ref/heads/rustqs/workflows" {
+			return githubResponse(http.StatusOK, `{"ref":"refs/heads/rustqs/workflows","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"commit"}}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/releases") {
+			return githubResponse(http.StatusOK, `[{"id":48,"tag_name":"offline-assets-1.4.8"}]`, nil), nil
+		}
+		if req.URL.Path == "/repos/owner/repo/git/releases/48" || req.URL.Path == "/repos/owner/repo/releases/48" {
+			return githubResponse(http.StatusOK, testReleaseDetails(48, "offline-assets-1.4.8"), nil), nil
+		}
+		return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.4.8","object":{"sha":"`+buildRef+`","type":"commit"}}`, nil), nil
+	}))
+
+	identity, err := (&GithubBuildConfigService{}).ResolveVersion(context.Background(), "1.4.8")
+	if err != nil {
+		t.Fatalf("ResolveVersion() error = %v", err)
+	}
+	build := &model.CustomBuild{Status: model.CustomBuildStatusPending, Platform: "windows", Version: identity.DisplayVersion, AppName: "rustqs"}
+	if _, err := (&CustomBuildService{}).CreateNormalizedWithIdentity(build, identity); err != nil {
+		t.Fatalf("CreateNormalizedWithIdentity() error = %v", err)
+	}
+	provenance := testBuildProvenance(606, identity.Repo, "workflow.yml", identity.BuildRef, "artifact-a")
+	provenance.Version = identity.DisplayVersion
+	provenance.BuildRef = identity.BuildRef
+	provenance.SourceTag = identity.SourceTag
+	provenance.AssetsRelease = identity.AssetsRelease.TagName
+	provenance.AssetsReleaseID = identity.AssetsRelease.ID
+	provenance.WorkflowRef = identity.WorkflowRef
+	provenance.WorkflowSHA = identity.WorkflowSHA
+	provenance.GithubRef = identity.WorkflowSHA
+	if err := (&CustomBuildService{}).SetProvenance(build.Id, provenance); err != nil {
+		t.Fatalf("SetProvenance() for catalog identity error = %v", err)
+	}
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read dispatched build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusBuilding || stored.GithubRepo != identity.Repo || stored.BuildRef != identity.BuildRef {
+		t.Fatalf("catalog dispatch state = %#v", stored)
+	}
+
+	mismatchedBuild := &model.CustomBuild{Status: model.CustomBuildStatusPending, Platform: "windows", Version: identity.DisplayVersion, AppName: "rustqs"}
+	if _, err := (&CustomBuildService{}).CreateNormalizedWithIdentity(mismatchedBuild, identity); err != nil {
+		t.Fatalf("CreateNormalizedWithIdentity() for mismatch case error = %v", err)
+	}
+	mismatched := provenance
+	mismatched.GithubRepo = "owner/other-repo"
+	err = (&CustomBuildService{}).SetProvenance(mismatchedBuild.Id, mismatched)
+	var persistenceErr *BuildProvenancePersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("mismatched repo error = %T %v, want typed persistence error", err, err)
+	}
+	stored = model.CustomBuild{}
+	if err := db.First(&stored, mismatchedBuild.Id).Error; err != nil {
+		t.Fatalf("read mismatched build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusPending || stored.GithubRepo != identity.Repo || stored.GithubRunId != 0 {
+		t.Fatalf("mismatched repo changed prebound row = %#v", stored)
+	}
+}
+
+func TestCreateNormalizedWithIdentityRejectsInvalidVersionBeforeDBCreate(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	identity := VersionIdentity{
+		Repo:           "owner/repo",
+		DisplayVersion: "not-a-version",
+		BuildRef:       strings.Repeat("a", 40),
+		SourceTag:      "not-a-version",
+		AssetsRelease:  AssetsRelease{ID: 1, TagName: "offline-assets-not-a-version"},
+	}
+	build := &model.CustomBuild{Status: model.CustomBuildStatusPending, Platform: "windows", Version: identity.DisplayVersion}
+	if _, err := (&CustomBuildService{}).CreateNormalizedWithIdentity(build, identity); err == nil || !IsClientValidationError(err) {
+		t.Fatalf("invalid identity error = %v, want client validation error", err)
+	}
+	var count int64
+	if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+		t.Fatalf("count builds: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("invalid identity created %d row(s)", count)
+	}
+}
+
+func TestSetProvenanceRequiresPendingAndEmptyIdentity(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	first := testBuildProvenance(101, "owner/repo-a", "workflow-a.yml", "refs/heads/ref-a", "artifact-a")
+	cases := []struct {
+		name  string
+		build model.CustomBuild
+	}{
+		{name: "wrong status", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding}},
+		{name: "existing run", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubRunId: 202}},
+		{name: "partial provider identity", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubProvider: "github"}},
+		{name: "partial artifact identity", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubArtifactName: "artifact-a"}},
+		{name: "partial source identity", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubSourceSha: strings.Repeat("a", 40)}},
+		{name: "partial repo identity", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubRepo: "owner/repo-a"}},
+		{name: "partial version identity", build: model.CustomBuild{Status: model.CustomBuildStatusPending, Version: "1.2.3", BuildRef: strings.Repeat("a", 40)}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			build := tc.build
+			if err := db.Create(&build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			if err := (&CustomBuildService{}).SetProvenance(build.Id, first); err == nil {
+				t.Fatal("SetProvenance() error = nil, want guard rejection")
+			}
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if stored.Status != build.Status || stored.GithubRunId != build.GithubRunId || stored.GithubProvider != build.GithubProvider || stored.GithubArtifactName != build.GithubArtifactName || stored.GithubSourceSha != build.GithubSourceSha {
+				t.Fatalf("guarded row changed: %#v, want %#v", stored, build)
+			}
+		})
+	}
+}
+
+func TestSetSourceShaIsGuardedAndCannotOverwrite(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	shaA := strings.Repeat("a", 40)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, BuildRef: shaA, GithubRef: shaA}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	shaB := strings.Repeat("b", 40)
+	if err := (&CustomBuildService{}).SetSourceSha(build.Id, build.GithubRunId, shaA); err != nil {
+		t.Fatalf("first SetSourceSha() error = %v", err)
+	}
+	err := (&CustomBuildService{}).SetSourceSha(build.Id, build.GithubRunId, shaB)
+	var persistenceErr *BuildProvenancePersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("second SetSourceSha() error = %T %v, want typed persistence error", err, err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.GithubSourceSha != shaA {
+		t.Fatalf("source sha = %q, want first SHA", stored.GithubSourceSha)
+	}
+}
+
+func TestSetSourceShaRequiresCurrentBuildingRun(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	sha := strings.Repeat("a", 40)
+	cases := []struct {
+		name     string
+		build    model.CustomBuild
+		expected int64
+	}{
+		{name: "pending", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubRunId: 17}, expected: 17},
+		{name: "missing run", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding}, expected: 17},
+		{name: "wrong run", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17}, expected: 18},
+		{name: "existing sha", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, GithubSourceSha: strings.Repeat("b", 40)}, expected: 17},
+		{name: "current run", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, BuildRef: sha, GithubRef: sha}, expected: 17},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			build := tc.build
+			if err := db.Create(&build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			err := (&CustomBuildService{}).SetSourceSha(build.Id, tc.expected, sha)
+			wantError := tc.name != "current run"
+			if (err != nil) != wantError {
+				t.Fatalf("SetSourceSha() error = %v, wantError=%v", err, wantError)
+			}
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if wantError && stored.GithubSourceSha != build.GithubSourceSha {
+				t.Fatalf("guarded SHA changed to %q, want %q", stored.GithubSourceSha, build.GithubSourceSha)
+			}
+			if !wantError && stored.GithubSourceSha != sha {
+				t.Fatalf("source SHA = %q, want %q", stored.GithubSourceSha, sha)
+			}
+		})
+	}
+}
+
+func TestSetSourceShaRejectsNonHexOrWrongLength(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, BuildRef: strings.Repeat("a", 40), GithubRef: strings.Repeat("a", 40)}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	for _, sourceSHA := range []string{"", strings.Repeat("a", 39), strings.Repeat("a", 65), strings.Repeat("g", 40)} {
+		if err := (&CustomBuildService{}).SetSourceSha(build.Id, build.GithubRunId, sourceSHA); err == nil {
+			t.Errorf("SetSourceSha(%q) error = nil, want validation error", sourceSHA)
+		}
+	}
+}
+
+func TestSetSourceShaRequiresStoredBuildRefAndProvenanceRejectsMismatch(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	buildRef := strings.Repeat("a", 40)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, BuildRef: buildRef, GithubRef: buildRef}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := (&CustomBuildService{}).SetSourceSha(build.Id, build.GithubRunId, strings.Repeat("b", 40)); err == nil {
+		t.Fatal("SetSourceSha() error = nil, want stored BuildRef mismatch rejection")
+	}
+	if err := (&CustomBuildService{}).SetSourceSha(build.Id, build.GithubRunId, strings.ToUpper(buildRef)); err != nil {
+		t.Fatalf("SetSourceSha() case-insensitive matching error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if _, err := BuildProvenanceFromRecord(&stored); err == nil {
+		t.Fatal("BuildProvenanceFromRecord() error = nil, want incomplete provider identity error")
+	}
+	p := testBuildProvenance(18, "owner/repo", "workflow.yml", buildRef, "artifact")
+	p.GithubSourceSHA = strings.Repeat("b", 40)
+	if err := p.validate(); err == nil {
+		t.Fatal("BuildProvenance.validate() error = nil, want source/build-ref mismatch")
+	}
+}
+
+func TestSetArtifactIDIsWriteOnce(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, GithubArtifactName: "artifact-a"}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := (&CustomBuildService{}).SetArtifactID(build.Id, build.GithubRunId, 101); err != nil {
+		t.Fatalf("first SetArtifactID() error = %v", err)
+	}
+	if err := (&CustomBuildService{}).SetArtifactID(build.Id, build.GithubRunId, 202); err == nil {
+		t.Fatal("second SetArtifactID() error = nil, want write-once rejection")
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.GithubArtifactID != 101 || stored.GithubArtifactName != build.GithubArtifactName {
+		t.Fatalf("artifact id = %d, want 101", stored.GithubArtifactID)
+	}
+}
+
+func TestSetArtifactIDRequiresCurrentBuildingRun(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	cases := []struct {
+		name     string
+		build    model.CustomBuild
+		expected int64
+	}{
+		{name: "pending", build: model.CustomBuild{Status: model.CustomBuildStatusPending, GithubRunId: 17}, expected: 17},
+		{name: "missing run", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding}, expected: 17},
+		{name: "wrong run", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17}, expected: 18},
+		{name: "existing artifact", build: model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, GithubArtifactID: 101}, expected: 17},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			build := tc.build
+			if err := db.Create(&build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			if err := (&CustomBuildService{}).SetArtifactID(build.Id, tc.expected, 202); err == nil {
+				t.Fatal("SetArtifactID() error = nil, want guard rejection")
+			}
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if stored.GithubArtifactID != build.GithubArtifactID || stored.GithubArtifactName != build.GithubArtifactName {
+				t.Fatalf("guarded artifact identity changed: %#v, want id=%d name=%q", stored, build.GithubArtifactID, build.GithubArtifactName)
+			}
+		})
+	}
+}
+
+func TestLegacyGithubRunWithoutProvenanceFailsClosed(t *testing.T) {
+	legacy := &model.CustomBuild{GithubRunId: 77, Status: model.CustomBuildStatusBuilding}
+	if _, err := BuildProvenanceFromRecord(legacy); err == nil {
+		t.Fatal("BuildProvenanceFromRecord() error = nil, want fail-closed legacy error")
+	}
+}
+
+func TestUpdateNoRunFailureClosesLegacyActiveRowWithoutProviderRun(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 0, BuildLog: "legacy"}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create legacy active build: %v", err)
+	}
+	if err := (&CustomBuildService{}).UpdateNoRunFailure(BuildProgress{
+		BuildID:  build.Id,
+		Status:   model.CustomBuildStatusFailed,
+		BuildLog: "no provider run exists; refusing to resume legacy build",
+	}); err != nil {
+		t.Fatalf("UpdateNoRunFailure() error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read failed legacy build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusFailed || stored.GithubRunId != 0 || !strings.Contains(stored.BuildLog, "no provider run exists") {
+		t.Fatalf("legacy active row after no-run failure = %#v", stored)
+	}
+
+	positive := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17}
+	if err := db.Create(positive).Error; err != nil {
+		t.Fatalf("create positive-run build: %v", err)
+	}
+	if err := (&CustomBuildService{}).UpdateNoRunFailure(BuildProgress{
+		BuildID:       positive.Id,
+		ExpectedRunID: 0,
+		Status:        model.CustomBuildStatusFailed,
+	}); err == nil {
+		t.Fatal("UpdateNoRunFailure() error = nil for positive-run row")
+	}
+}
+
+func TestLegacyMutableWorkflowRefFailsClosed(t *testing.T) {
+	// Keep a stale mutable workflow selector as a legacy fixture; migrated defaults
+	// must continue to fail closed for mutable workflow selectors.
+	legacy := &model.CustomBuild{
+		Version:         "1.2.3",
+		BuildRef:        strings.Repeat("a", 40),
+		SourceTag:       "1.2.3",
+		AssetsRelease:   "offline-assets-1.2.3",
+		AssetsReleaseID: 12,
+		GithubRepo:      "owner/repo",
+		GithubRef:       "refs/heads/rustqs/workflows",
+	}
+	if _, err := VersionIdentityFromRecord(legacy); err == nil {
+		t.Fatal("VersionIdentityFromRecord() error = nil, want mutable workflow ref rejection")
+	}
+}
+
+func TestGithubConfigFromProvenanceIgnoresMutableGlobalIdentity(t *testing.T) {
+	provenance := testBuildProvenance(303, "owner/repo-a", "workflow-a.yml", "ref-a", "artifact-a")
+	globalConfig := &model.GithubBuildConfig{Repo: "owner/repo-b", WorkflowFilename: "workflow-b.yml", Branch: "ref-b", Token: "new-token"}
+	requestConfig := GithubConfigFromProvenance(provenance, globalConfig.Token)
+	if requestConfig.Repo != provenance.GithubRepo || requestConfig.WorkflowFilename != "" || requestConfig.Branch != provenance.WorkflowRef {
+		t.Fatalf("request config = %#v, want stored repository and workflow selector identity", requestConfig)
+	}
+	if requestConfig.Token != globalConfig.Token {
+		t.Fatalf("request config token = %q, want current token", requestConfig.Token)
+	}
+}
+
+func TestStoredProvenanceTargetsOriginalRepoAndArtifactAfterConfigMutation(t *testing.T) {
+	provenance := testBuildProvenance(404, "owner/repo-a", "workflow-a.yml", "ref-a", "artifact-a")
+	mutableGlobalConfig := &model.GithubBuildConfig{Repo: "owner/repo-b", WorkflowFilename: "workflow-b.yml", Branch: "ref-b", Token: "current-token"}
+	requestConfig := GithubConfigFromProvenance(provenance, mutableGlobalConfig.Token)
+	artifactPayload := serviceArtifactZip(t, "artifact-a-bytes")
+	var requestedArtifact string
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if !strings.Contains(req.URL.Path, "/repos/owner/repo-a/") {
+			return githubResponse(http.StatusBadRequest, `{"message":"wrong repository"}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/actions/runs/404") {
+			return githubResponse(http.StatusOK, `{"status":"in_progress","head_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/artifacts") {
+			requestedArtifact = provenance.GithubArtifactName
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":9,"name":"artifact-a"}]}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/artifacts/9/zip") {
+			return githubResponse(http.StatusOK, string(artifactPayload), nil), nil
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+	}))
+
+	details, err := (&GithubBuildConfigService{}).RunStatusDetails(context.Background(), requestConfig, provenance.GithubRunID)
+	if err != nil || details.SourceSHA != strings.Repeat("a", 40) {
+		t.Fatalf("RunStatusDetails() = %#v, %v", details, err)
+	}
+	artifact, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), requestConfig, provenance.GithubRunID, 0, provenance.GithubArtifactName)
+	if err != nil {
+		t.Fatalf("DownloadArtifact() error = %v, requested=%q", err, requestedArtifact)
+	}
+	t.Cleanup(func() { _ = os.Remove(artifact.ArchivePath) })
+	contents, err := os.ReadFile(artifact.ArchivePath)
+	if err != nil || !bytes.Equal(contents, artifactPayload) || artifact.ArtifactID != 9 || artifact.ArtifactName != "artifact-a" || requestedArtifact != "artifact-a" {
+		t.Fatalf("DownloadArtifact() = %#v, contents=%q, err=%v, requested=%q", artifact, contents, err, requestedArtifact)
+	}
+}
+
+func TestStoredArtifactIDSkipsNameFallbackAfterConfigMutation(t *testing.T) {
+	provenance := testBuildProvenance(505, "owner/repo-a", "workflow-a.yml", "ref-a", "artifact-a")
+	provenance.GithubArtifactID = 909
+	mutableGlobalConfig := &model.GithubBuildConfig{Repo: "owner/repo-b", WorkflowFilename: "workflow-b.yml", Branch: "ref-b", Token: "current-token"}
+	requestConfig := GithubConfigFromProvenance(provenance, mutableGlobalConfig.Token)
+	artifactPayload := serviceArtifactZip(t, "stored-artifact")
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path == "/repos/owner/repo-a/actions/runs/505/artifacts" {
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":909,"name":"artifact-a"}]}`, nil), nil
+		}
+		if req.URL.Path != "/repos/owner/repo-a/actions/artifacts/909/zip" {
+			return githubResponse(http.StatusBadRequest, `{"message":"must use stored repository and artifact id"}`, nil), nil
+		}
+		return githubResponse(http.StatusOK, string(artifactPayload), nil), nil
+	}))
+
+	artifact, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), requestConfig, provenance.GithubRunID, provenance.GithubArtifactID, provenance.GithubArtifactName)
+	if err != nil {
+		t.Fatalf("DownloadArtifact() error = %v", err)
+	}
+	t.Cleanup(func() { _ = os.Remove(artifact.ArchivePath) })
+	contents, err := os.ReadFile(artifact.ArchivePath)
+	if err != nil || !bytes.Equal(contents, artifactPayload) || artifact.ArtifactID != provenance.GithubArtifactID || artifact.ArtifactName != provenance.GithubArtifactName {
+		t.Fatalf("DownloadArtifact() = %#v, contents=%q, err=%v", artifact, contents, err)
+	}
+}
+
+func TestRunStatusSourceSHACanBePersistedAfterInitialOmission(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 17, BuildRef: strings.Repeat("A", 64), GithubRef: strings.Repeat("A", 64)}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	sha := strings.Repeat("A", 64)
+	if err := (&CustomBuildService{}).SetSourceSha(build.Id, build.GithubRunId, sha); err != nil {
+		t.Fatalf("SetSourceSha() after omitted first response error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.GithubSourceSha != sha {
+		t.Fatalf("source sha = %q, want %q", stored.GithubSourceSha, sha)
+	}
+}
+
+func TestConcurrentProvenanceRecordsStayIsolated(t *testing.T) {
+	db := newBuildProvenanceDB(t)
+	builds := []*model.CustomBuild{{Status: model.CustomBuildStatusPending}, {Status: model.CustomBuildStatusPending}}
+	for _, build := range builds {
+		if err := db.Create(build).Error; err != nil {
+			t.Fatalf("create build: %v", err)
+		}
+	}
+
+	var wg sync.WaitGroup
+	for index, build := range builds {
+		index, build := index, build
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			provenance := testBuildProvenance(int64(index+1), "owner/repo-"+string(rune('a'+index)), "workflow.yml", "ref-"+string(rune('a'+index)), "artifact-"+string(rune('a'+index)))
+			if err := (&CustomBuildService{}).SetProvenance(build.Id, provenance); err != nil {
+				t.Errorf("SetProvenance(build %d) error = %v", build.Id, err)
+			}
+		}()
+	}
+	wg.Wait()
+
+	for index, build := range builds {
+		var stored model.CustomBuild
+		if err := db.First(&stored, build.Id).Error; err != nil {
+			t.Fatalf("read build %d: %v", build.Id, err)
+		}
+		wantRepo := "owner/repo-" + string(rune('a'+index))
+		if stored.GithubRepo != wantRepo || stored.GithubArtifactName != "artifact-"+string(rune('a'+index)) {
+			t.Fatalf("build %d provenance crossed records: %#v", build.Id, stored)
+		}
+	}
+}
+
+func testBuildProvenance(runID int64, repo, workflow, ref, artifact string) BuildProvenance {
+	run := strconv.FormatInt(runID, 10)
+	buildRef := fmt.Sprintf("%040x", runID)
+	return BuildProvenance{
+		Version:             "1.2.3",
+		BuildRef:            buildRef,
+		SourceTag:           "1.2.3",
+		AssetsRelease:       "offline-assets-1.2.3",
+		AssetsReleaseID:     runID,
+		AssetsReleaseAssets: testReleaseAssets(),
+		GithubProvider:      "github",
+		GithubRepo:          repo,
+		GithubWorkflow:      workflow,
+		WorkflowRef:         defaultWorkflowExecutionRef,
+		WorkflowSHA:         fmt.Sprintf("%040x", runID+1000),
+		GithubRef:           fmt.Sprintf("%040x", runID+1000),
+		GithubArtifactName:  artifact,
+		GithubRunID:         runID,
+		GithubRunURL:        "https://api.github.com/repos/" + repo + "/actions/runs/" + run,
+		GithubHTMLURL:       "https://github.com/" + repo + "/actions/runs/" + run,
+	}
+}
+
+func newBuildProvenanceDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	t.Setenv("SECRET_ENCRYPTION_KEY", "focused-test-at-rest-key")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(&model.CustomBuild{}); err != nil {
+		t.Fatalf("migrate custom builds: %v", err)
+	}
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	return db
+}
diff --git a/api/service/custom_build.go b/api/service/custom_build.go
index 7973791..fbbdbe7 100644
--- a/api/service/custom_build.go
+++ b/api/service/custom_build.go
@@ -1,62 +1,875 @@
-package service
+package service
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
+	"sync"
+	"time"
 
 	"rustdesk-server/api/model"
+	"rustdesk-server/api/utils"
 )
 
 type CustomBuildService struct{}
 
+// IsSecretEncryptionConfigurationError reports whether an error means a
+// secret-bearing persistence operation is unavailable because the canonical
+// at-rest key is missing. The helper keeps HTTP boundaries independent of GORM
+// hook details while preserving the typed root error for callers.
+func IsSecretEncryptionConfigurationError(err error) bool {
+	var keyErr *utils.SecretEncryptionKeyError
+	return errors.As(err, &keyErr)
+}
+
+var removeBuildOutputDir = os.RemoveAll
+
+// buildOutputLifecycleMu serializes the DB deletion boundary and exact output
+// and marker removal with stale-tombstone cleanup. Normal SQLite/GORM model
+// operation does not reuse deleted IDs, but this closes the in-process
+// delete/sweep overlap that could otherwise remove a live path.
+var buildOutputLifecycleMu sync.Mutex
+
+// CustomBuildCleanupPending reports a successful authoritative DB deletion
+// whose service-owned output directory still needs cleanup. Callers must not
+// turn this into a failed deletion: the row is gone, while the filesystem
+// condition remains observable for operator/sweeper handling.
+type CustomBuildCleanupPending struct {
+	Directory string
+	Cause     error
+}
+
+func (e *CustomBuildCleanupPending) Error() string {
+	return fmt.Sprintf("custom build deleted; artifact cleanup pending for %s: %v", e.Directory, e.Cause)
+}
+
+func (e *CustomBuildCleanupPending) Unwrap() error { return e.Cause }
+
 // BuildOutputDir returns the on-disk path where the build agent writes
 // artifacts for a given build id. The convention `/rdgen-data/output/<id>`
 // is shared with docker/entrypoint-{linux,win}.sh and is referenced by the
 // download handler in api/http/controller/admin/custom_build.go — keep this
 // helper as the single source of truth so callers can't drift.
-func BuildOutputDir(id uint) string {
+var BuildOutputDir = func(id uint) string {
 	return filepath.Join("/rdgen-data", "output", fmt.Sprintf("%d", id))
 }
 
-func (is *CustomBuildService) List(page, pageSize uint) (res *model.CustomBuildList) {
-	res = &model.CustomBuildList{}
+func (is *CustomBuildService) List(page, pageSize uint) (*model.CustomBuildList, error) {
+	res := &model.CustomBuildList{}
 	tx := DB.Model(&model.CustomBuild{})
-	tx.Count(&res.Total)
-	tx.Scopes(Paginate(page, pageSize)).Order("id desc").Find(&res.CustomBuilds)
-	return
+	if err := tx.Count(&res.Total).Error; err != nil {
+		return nil, err
+	}
+	if err := tx.Scopes(Paginate(page, pageSize)).Order("id desc").Find(&res.CustomBuilds).Error; err != nil {
+		return nil, err
+	}
+	return res, nil
 }
 
-func (is *CustomBuildService) Info(id uint) *model.CustomBuild {
+func (is *CustomBuildService) Info(id uint) (*model.CustomBuild, error) {
 	u := &model.CustomBuild{}
-	DB.Where("id = ?", id).First(u)
-	return u
+	if err := DB.Where("id = ?", id).First(u).Error; err != nil {
+		return nil, err
+	}
+	return u, nil
 }
 
-// Delete drops the DB row first, then best-effort removes the artifact
-// directory. Filesystem cleanup happens after the DB delete so that a failed
-// DB delete does not leave the user with a row pointing at missing files;
-// the download handler already returns 404 if the directory is missing, so
-// a failed cleanup is recoverable.
+// Delete records cleanup intent before deleting the DB row. A nil DB.Delete
+// result is the authoritative deletion boundary: database errors remain ordinary
+// failures, while only filesystem/tombstone errors after that boundary are
+// reported as cleanup pending. The row remains authoritative before that point;
+// cleanup after a successful delete cannot resurrect ownership.
 func (is *CustomBuildService) Delete(u *model.CustomBuild) error {
 	id := u.Id
+	dir := BuildOutputDir(id)
+	outputRoot := filepath.Dir(dir)
+	buildOutputLifecycleMu.Lock()
+	defer buildOutputLifecycleMu.Unlock()
+	tombstone, err := ensureBuildOutputDeletionTombstone(outputRoot, id)
+	if err != nil {
+		return err
+	}
 	if err := DB.Delete(u).Error; err != nil {
 		return err
 	}
-	dir := BuildOutputDir(id)
-	if err := os.RemoveAll(dir); err != nil {
-		Logger.Warnf("custom_build: failed to remove artifact dir %s: %v", dir, err)
+	if err := removeBuildOutputDir(dir); err != nil {
+		return &CustomBuildCleanupPending{Directory: dir, Cause: err}
+	}
+	if _, err := os.Lstat(dir); err == nil {
+		return &CustomBuildCleanupPending{Directory: dir, Cause: errors.New("directory remains after cleanup")}
+	} else if !os.IsNotExist(err) {
+		return &CustomBuildCleanupPending{Directory: dir, Cause: fmt.Errorf("verify cleanup: %w", err)}
+	}
+	if err := removeBuildOutputDeletionTombstoneIfPresent(tombstone); err != nil {
+		return &CustomBuildCleanupPending{Directory: dir, Cause: fmt.Errorf("remove cleanup tombstone: %w", err)}
 	}
 	return nil
 }
 
 func (is *CustomBuildService) Create(u *model.CustomBuild) error {
-	return DB.Create(u).Error
+	_, err := is.CreateNormalized(u)
+	return err
+}
+
+// CreateNormalized persists the canonical form and returns the same normalized
+// dispatch values used by the caller to submit the build. L1 values therefore
+// remain available for dispatch without being stored in custom_json.
+func (is *CustomBuildService) CreateNormalized(u *model.CustomBuild) (NormalizedBuild, error) {
+	if err := ValidateDirectCustomBuilderJSON(u.CustomJson); err != nil {
+		return NormalizedBuild{}, err
+	}
+	if u.BuildRef != "" || u.SourceTag != "" || u.AssetsRelease != "" || u.AssetsReleaseID != 0 || u.AssetsReleaseAssets != "" {
+		if _, err := VersionIdentityFromRecord(u); err != nil {
+			return NormalizedBuild{}, &ClientValidationError{Err: err}
+		}
+	}
+	normalized, err := NormalizeCustomBuildJSON(u.CustomJson, BuildRecordContext{
+		BuildID:  u.Id,
+		Platform: u.Platform,
+		AppName:  u.AppName,
+		Version:  u.Version,
+	})
+	if err != nil {
+		return NormalizedBuild{}, &ClientValidationError{Err: err}
+	}
+	if err := utils.RequireSecretEncryptionForCustomBuilderJSON(normalized.PersistedJSON); err != nil {
+		return NormalizedBuild{}, err
+	}
+	u.CustomJson = normalized.PersistedJSON
+	if err := DB.Create(u).Error; err != nil {
+		return NormalizedBuild{}, err
+	}
+	return normalized, nil
+}
+
+// CreateNormalizedWithIdentity persists a build after the configured catalog
+// has resolved its display version to one immutable source/assets identity.
+// The identity is copied into the row before Create; the dispatch transition
+// later verifies the same values and cannot replace them.
+func (is *CustomBuildService) CreateNormalizedWithIdentity(u *model.CustomBuild, identity VersionIdentity) (NormalizedBuild, error) {
+	if err := identity.validate(); err != nil {
+		return NormalizedBuild{}, &ClientValidationError{Err: err}
+	}
+	if u.Version != "" && u.Version != identity.DisplayVersion {
+		return NormalizedBuild{}, &ClientValidationError{Err: fmt.Errorf("build version does not match resolved catalog identity")}
+	}
+	u.Version = identity.DisplayVersion
+	u.GithubRepo = identity.Repo
+	// Persist the exact selector separately from the resolved execution SHA. A
+	// mutable branch must never replace the immutable execution identity.
+	u.WorkflowSelector = identity.WorkflowRef
+	u.GithubRef = identity.WorkflowSHA
+	u.BuildRef = identity.BuildRef
+	u.SourceTag = identity.SourceTag
+	u.AssetsRelease = identity.AssetsRelease.TagName
+	u.AssetsReleaseID = identity.AssetsRelease.ID
+	assets, err := marshalReleaseAssets(identity.AssetsRelease.Assets)
+	if err != nil {
+		return NormalizedBuild{}, &ClientValidationError{Err: err}
+	}
+	u.AssetsReleaseAssets = assets
+	return is.CreateNormalized(u)
+}
+
+// UpdateValidated is the user-facing update boundary for a future custom-build
+// edit path. It writes only user-editable canonical fields; provenance and
+// asynchronous state are deliberately not part of this update boundary.
+func (is *CustomBuildService) UpdateValidated(u *model.CustomBuild) error {
+	if u.Id == 0 {
+		return &ClientValidationError{Err: fmt.Errorf("build id is required")}
+	}
+	var stored model.CustomBuild
+	if err := DB.First(&stored, u.Id).Error; err != nil {
+		return err
+	}
+	if stored.BuildRef != "" || stored.SourceTag != "" || stored.AssetsRelease != "" || stored.AssetsReleaseID != 0 || stored.AssetsReleaseAssets != "" {
+		if u.Version != stored.Version {
+			return &ClientValidationError{Err: fmt.Errorf("immutable build version cannot be changed")}
+		}
+	}
+	if err := ValidateDirectCustomBuilderJSON(u.CustomJson); err != nil {
+		return err
+	}
+	canonicalJSON, err := CanonicalizeCustomBuildJSON(u.CustomJson, BuildRecordContext{
+		BuildID:  u.Id,
+		Platform: u.Platform,
+		AppName:  u.AppName,
+		Version:  u.Version,
+	})
+	if err != nil {
+		return err
+	}
+	storedJSON, err := utils.EncryptCustomBuilderJSON(canonicalJSON)
+	if err != nil {
+		return err
+	}
+	tx := DB.Model(&model.CustomBuild{}).Where("id = ?", u.Id).Updates(map[string]any{
+		"name":        u.Name,
+		"platform":    u.Platform,
+		"version":     u.Version,
+		"app_name":    u.AppName,
+		"custom_json": storedJSON,
+	})
+	if tx.Error != nil {
+		return tx.Error
+	}
+	if tx.RowsAffected == 0 {
+		return fmt.Errorf("validated update affected no rows")
+	}
+	return nil
+}
+
+// BuildProgress contains the fields owned by the asynchronous build worker.
+// It intentionally has no custom_json or other user-authored fields.
+type BuildProgress struct {
+	BuildID            uint
+	ExpectedRunID      int64
+	ExpectedArtifactID int64
+	Status             string
+	BuildLog           string
+	FileSize           int64
+}
+
+const MaxBuildLogBytes = 4096
+
+// BoundBuildLog keeps asynchronous/provider messages bounded before they cross
+// the persistence boundary. The newest message is retained because it carries
+// the actionable lifecycle failure when older history is discarded.
+func BoundBuildLog(existing, message string) string {
+	if message != "" {
+		if existing != "" {
+			existing += "\n"
+		}
+		existing += message
+	}
+	if len(existing) <= MaxBuildLogBytes {
+		return existing
+	}
+	return existing[len(existing)-MaxBuildLogBytes:]
+}
+
+// BuildProgressPersistenceError means that asynchronous build state could not
+// be durably recorded. Callers must not continue with provider-derived state
+// (such as starting a poll) after this error.
+type BuildProgressPersistenceError struct {
+	BuildID uint
+	Cause   error
+}
+
+func (e *BuildProgressPersistenceError) Error() string {
+	return fmt.Sprintf("persist build %d progress: %v", e.BuildID, e.Cause)
+}
+
+func (e *BuildProgressPersistenceError) Unwrap() error { return e.Cause }
+
+func (is *CustomBuildService) requireCompletionCapability(buildID uint) error {
+	var build model.CustomBuild
+	if err := DB.Select("platform").First(&build, buildID).Error; err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if err := RequireProductionBuildCapability(build.Platform); err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	return nil
+}
+
+func (is *CustomBuildService) requireCompletedPublication(buildID uint, expectedRunID, expectedArtifactID int64) error {
+	var build model.CustomBuild
+	if err := DB.First(&build, buildID).Error; err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if err := is.requireCompletionCapability(buildID); err != nil {
+		return err
+	}
+	provenance, err := BuildProvenanceFromRecord(&build)
+	if err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if provenance.GithubRunID != expectedRunID || provenance.GithubArtifactID != expectedArtifactID {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("completion provenance does not match expected run and artifact")}
+	}
+	if build.PublicationRecordedAt <= 0 || !validPublishedDigest(build.PublishedDigest) {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("completion requires publication marker and digest")}
+	}
+	if _, err := ValidatePublishedOutputProof(&build); err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("completion requires current output matching publication proof: %w", err)}
+	}
+	return nil
+}
+
+// BuildProvenance is the immutable provider-derived identity of a dispatched
+// build. It deliberately contains no token, payload key, or dispatch payload.
+type BuildProvenance struct {
+	Version             string         `json:"version"`
+	BuildRef            string         `json:"build_ref"`
+	SourceTag           string         `json:"source_tag"`
+	AssetsRelease       string         `json:"assets_release"`
+	AssetsReleaseID     int64          `json:"assets_release_id"`
+	GithubProvider      string         `json:"github_provider"`
+	GithubRepo          string         `json:"github_repo"`
+	GithubWorkflow      string         `json:"github_workflow"`
+	WorkflowRef         string         `json:"workflow_ref"`
+	WorkflowSHA         string         `json:"workflow_sha"`
+	GithubRef           string         `json:"github_ref"`
+	GithubArtifactName  string         `json:"github_artifact_name"`
+	GithubArtifactID    int64          `json:"github_artifact_id"`
+	GithubRunID         int64          `json:"github_run_id"`
+	GithubRunURL        string         `json:"github_run_url"`
+	GithubHTMLURL       string         `json:"github_html_url"`
+	GithubSourceSHA     string         `json:"github_source_sha,omitempty"`
+	AssetsReleaseAssets []ReleaseAsset `json:"assets_release_assets"`
+}
+
+const (
+	maxGithubProviderLength     = 32
+	maxGithubRepoLength         = 128
+	maxGithubWorkflowLength     = 128
+	maxGithubRefLength          = 128
+	maxGithubArtifactNameLength = 128
+	maxGithubURLLength          = 512
+	maxGithubSourceSHALength    = 64
+)
+
+// BuildProvenancePersistenceError means that an immutable provenance write
+// failed or was rejected because the build was already dispatched.
+type BuildProvenancePersistenceError struct {
+	BuildID uint
+	Cause   error
+}
+
+func (e *BuildProvenancePersistenceError) Error() string {
+	return fmt.Sprintf("persist build %d provenance: %v", e.BuildID, e.Cause)
+}
+
+func (e *BuildProvenancePersistenceError) Unwrap() error { return e.Cause }
+
+func (p BuildProvenance) validate() error {
+	workflowRef := p.WorkflowRef
+	workflowSHA := p.WorkflowSHA
+	if workflowSHA == "" {
+		workflowSHA = p.GithubRef
+	}
+	if p.WorkflowSHA != "" && p.GithubRef != "" && !strings.EqualFold(p.WorkflowSHA, p.GithubRef) {
+		return fmt.Errorf("workflow_sha and github_ref must match")
+	}
+	if workflowRef != "" && len(workflowRef) > maxGithubRefLength {
+		return fmt.Errorf("workflow_ref exceeds %d bytes", maxGithubRefLength)
+	}
+	identity := VersionIdentity{
+		Repo:           p.GithubRepo,
+		DisplayVersion: p.Version,
+		BuildRef:       p.BuildRef,
+		SourceTag:      p.SourceTag,
+		WorkflowRef:    workflowRef,
+		WorkflowSHA:    workflowSHA,
+		AssetsRelease:  AssetsRelease{ID: p.AssetsReleaseID, TagName: p.AssetsRelease, Assets: p.AssetsReleaseAssets},
+	}
+	if err := identity.validate(); err != nil {
+		return err
+	}
+	fields := []struct {
+		name  string
+		value string
+		limit int
+	}{
+		{"github_provider", p.GithubProvider, maxGithubProviderLength},
+		{"github_repo", p.GithubRepo, maxGithubRepoLength},
+		{"github_workflow", p.GithubWorkflow, maxGithubWorkflowLength},
+		{"workflow_selector", workflowRef, maxGithubRefLength},
+		{"workflow_sha", workflowSHA, maxGithubSourceSHALength},
+		{"github_artifact_name", p.GithubArtifactName, maxGithubArtifactNameLength},
+		{"github_run_url", p.GithubRunURL, maxGithubURLLength},
+		{"github_html_url", p.GithubHTMLURL, maxGithubURLLength},
+	}
+	for _, field := range fields {
+		if field.value == "" {
+			return fmt.Errorf("%s is required", field.name)
+		}
+		if len(field.value) > field.limit {
+			return fmt.Errorf("%s exceeds %d bytes", field.name, field.limit)
+		}
+	}
+	if p.GithubRunID <= 0 {
+		return fmt.Errorf("github_run_id must be positive")
+	}
+	if len(p.GithubSourceSHA) > maxGithubSourceSHALength {
+		return fmt.Errorf("github_source_sha exceeds %d bytes", maxGithubSourceSHALength)
+	}
+	if p.GithubSourceSHA != "" && !validGithubSourceSHA(p.GithubSourceSHA) {
+		return fmt.Errorf("github_source_sha must be 40-64 hexadecimal characters")
+	}
+	if p.GithubSourceSHA != "" && !strings.EqualFold(p.GithubSourceSHA, workflowSHA) {
+		return fmt.Errorf("github_source_sha must equal immutable workflow execution SHA")
+	}
+	if p.GithubArtifactID < 0 {
+		return fmt.Errorf("github_artifact_id must not be negative")
+	}
+	return nil
+}
+
+func validGithubSourceSHA(sourceSHA string) bool {
+	if len(sourceSHA) < 40 || len(sourceSHA) > 64 {
+		return false
+	}
+	for _, char := range sourceSHA {
+		if (char < '0' || char > '9') && (char < 'a' || char > 'f') && (char < 'A' || char > 'F') {
+			return false
+		}
+	}
+	return true
+}
+
+// BuildProvenanceFromRecord returns the immutable snapshot stored on a build
+// record. A missing field is an error so legacy rows cannot silently fall back
+// to the mutable global GitHub configuration.
+func BuildProvenanceFromRecord(b *model.CustomBuild) (BuildProvenance, error) {
+	identity, err := VersionIdentityFromRecord(b)
+	if err != nil {
+		return BuildProvenance{}, err
+	}
+	p := BuildProvenance{
+		Version:             identity.DisplayVersion,
+		BuildRef:            identity.BuildRef,
+		SourceTag:           identity.SourceTag,
+		AssetsRelease:       identity.AssetsRelease.TagName,
+		AssetsReleaseID:     identity.AssetsRelease.ID,
+		GithubProvider:      b.GithubProvider,
+		GithubRepo:          b.GithubRepo,
+		GithubWorkflow:      b.GithubWorkflow,
+		WorkflowRef:         b.WorkflowSelector,
+		WorkflowSHA:         identity.WorkflowSHA,
+		GithubRef:           b.GithubRef,
+		GithubArtifactName:  b.GithubArtifactName,
+		GithubArtifactID:    b.GithubArtifactID,
+		GithubRunID:         b.GithubRunId,
+		GithubRunURL:        b.GithubRunUrl,
+		GithubHTMLURL:       b.GithubHtmlUrl,
+		GithubSourceSHA:     b.GithubSourceSha,
+		AssetsReleaseAssets: identity.AssetsRelease.Assets,
+	}
+	if err := p.validate(); err != nil {
+		return BuildProvenance{}, err
+	}
+	return p, nil
+}
+
+// CompletedBuildProvenanceFromRecord returns readiness for a public completed
+// build. The done status, service-generated publication marker, and immutable
+// provider/artifact identity are all required; legacy/direct done rows fail
+// closed rather than becoming public through a partial provenance snapshot.
+func CompletedBuildProvenanceFromRecord(b *model.CustomBuild) (BuildProvenance, error) {
+	if b == nil {
+		return BuildProvenance{}, fmt.Errorf("build record is required")
+	}
+	if b.Status != model.CustomBuildStatusDone {
+		return BuildProvenance{}, fmt.Errorf("build status %q is not done", b.Status)
+	}
+	if b.PublicationRecordedAt <= 0 || !validPublishedDigest(b.PublishedDigest) {
+		return BuildProvenance{}, fmt.Errorf("publication marker and digest are required for completed build")
+	}
+	p, err := BuildProvenanceFromRecord(b)
+	if err != nil {
+		return BuildProvenance{}, err
+	}
+	if p.GithubArtifactID <= 0 {
+		return BuildProvenance{}, fmt.Errorf("github_artifact_id must be positive for completed build")
+	}
+	return p, nil
+}
+
+// SetArtifactID records the exact artifact selected from the expected stored
+// run. The status, run-id, and zero-value guards make artifact identity
+// write-once and prevent a later poll, retry, or callback from replacing it.
+func (is *CustomBuildService) SetArtifactID(buildID uint, expectedRunID, artifactID int64) error {
+	if buildID == 0 {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("build id is required")}
+	}
+	if expectedRunID <= 0 {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("github_run_id must be positive")}
+	}
+	if artifactID <= 0 {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("github_artifact_id must be positive")}
+	}
+	tx := DB.Model(&model.CustomBuild{}).
+		Where("id = ? AND github_run_id > 0 AND github_run_id = ? AND status IN ? AND (github_artifact_id = 0 OR github_artifact_id IS NULL)", buildID, expectedRunID, []string{
+			model.CustomBuildStatusBuilding,
+			model.CustomBuildStatusDownloading,
+			model.CustomBuildStatusExtracting,
+		}).
+		Update("github_artifact_id", artifactID)
+	if tx.Error != nil {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected == 0 {
+		return &BuildProvenancePersistenceError{
+			BuildID: buildID,
+			Cause:   fmt.Errorf("artifact id write affected no undispatched artifact row"),
+		}
+	}
+	return nil
+}
+
+// GithubConfigFromProvenance creates the request configuration for an existing
+// build. The token is the only mutable credential; all request identity values
+// come from the stored build snapshot.
+func GithubConfigFromProvenance(provenance BuildProvenance, token string) *model.GithubBuildConfig {
+	return &model.GithubBuildConfig{
+		Repo:   provenance.GithubRepo,
+		Branch: provenance.WorkflowRef,
+		Token:  token,
+	}
+}
+
+// SetProvenance atomically records the dispatch identity and transitions a
+// pending build to building. The run-id guard makes the write one-shot and
+// prevents a second dispatch from overwriting the first identity.
+func (is *CustomBuildService) SetProvenance(buildID uint, provenance BuildProvenance) error {
+	if buildID == 0 {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("build id is required")}
+	}
+	if err := provenance.validate(); err != nil {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: err}
+	}
+	assetsJSON, err := marshalReleaseAssets(provenance.AssetsReleaseAssets)
+	if err != nil {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: err}
+	}
+	tx := DB.Model(&model.CustomBuild{}).
+		Where(`id = ? AND status = ? AND (github_run_id = 0 OR github_run_id IS NULL) AND
+			(((version = '' AND build_ref = '' AND source_tag = '' AND assets_release = '' AND assets_release_id = 0) AND
+			  (github_repo = '' OR github_repo IS NULL)) OR
+				 (version = ? AND build_ref = ? AND source_tag = ? AND assets_release = ? AND assets_release_id = ? AND
+				  github_repo = ? AND assets_release_assets = ?)) AND
+			(github_provider = '' OR github_provider IS NULL) AND
+			(github_workflow = '' OR github_workflow IS NULL) AND
+			(workflow_selector = '' OR workflow_selector IS NULL OR workflow_selector = ?) AND
+			(github_ref = '' OR github_ref IS NULL OR LOWER(github_ref) = LOWER(?)) AND
+			(github_artifact_name = '' OR github_artifact_name IS NULL) AND
+			(github_run_url = '' OR github_run_url IS NULL) AND
+			(github_html_url = '' OR github_html_url IS NULL) AND
+			(github_artifact_id = 0 OR github_artifact_id IS NULL) AND
+			(github_source_sha = '' OR github_source_sha IS NULL)`, buildID, model.CustomBuildStatusPending,
+			provenance.Version, provenance.BuildRef, provenance.SourceTag, provenance.AssetsRelease, provenance.AssetsReleaseID,
+			provenance.GithubRepo, assetsJSON, provenance.WorkflowRef, provenance.WorkflowSHA).
+		Updates(map[string]any{
+			"version":               provenance.Version,
+			"build_ref":             provenance.BuildRef,
+			"source_tag":            provenance.SourceTag,
+			"assets_release":        provenance.AssetsRelease,
+			"assets_release_id":     provenance.AssetsReleaseID,
+			"assets_release_assets": assetsJSON,
+			"status":                model.CustomBuildStatusBuilding,
+			"build_log":             BoundBuildLog("", fmt.Sprintf("github run id: %d", provenance.GithubRunID)),
+			"github_run_id":         provenance.GithubRunID,
+			"github_provider":       provenance.GithubProvider,
+			"github_repo":           provenance.GithubRepo,
+			"github_workflow":       provenance.GithubWorkflow,
+			"workflow_selector":     provenance.WorkflowRef,
+			"github_ref":            provenance.WorkflowSHA,
+			"github_artifact_name":  provenance.GithubArtifactName,
+			"github_run_url":        provenance.GithubRunURL,
+			"github_html_url":       provenance.GithubHTMLURL,
+		})
+	if tx.Error != nil {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected == 0 {
+		return &BuildProvenancePersistenceError{
+			BuildID: buildID,
+			Cause:   fmt.Errorf("provenance write affected no pending undispatched row"),
+		}
+	}
+	return nil
+}
+
+// SetSourceSha records the first exact run head SHA returned by the expected
+// stored run. It is guarded against the persisted workflow execution SHA and
+// can never overwrite an earlier observation.
+func (is *CustomBuildService) SetSourceSha(buildID uint, expectedRunID int64, sourceSHA string) error {
+	if buildID == 0 {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("build id is required")}
+	}
+	if expectedRunID <= 0 {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("github_run_id must be positive")}
+	}
+	if !validGithubSourceSHA(sourceSHA) {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: fmt.Errorf("github_source_sha must be 40-64 hexadecimal characters")}
+	}
+	tx := DB.Model(&model.CustomBuild{}).
+		Where("id = ? AND github_run_id > 0 AND github_run_id = ? AND status IN ? AND LOWER(github_ref) = LOWER(?) AND (github_source_sha = '' OR github_source_sha IS NULL)", buildID, expectedRunID, []string{
+			model.CustomBuildStatusBuilding,
+			model.CustomBuildStatusDownloading,
+			model.CustomBuildStatusExtracting,
+		}, sourceSHA).
+		Update("github_source_sha", sourceSHA)
+	if tx.Error != nil {
+		return &BuildProvenancePersistenceError{BuildID: buildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected == 0 {
+		return &BuildProvenancePersistenceError{
+			BuildID: buildID,
+			Cause:   fmt.Errorf("source sha write affected no row with empty source sha"),
+		}
+	}
+	return nil
 }
 
-// Update — full-row save. Раньше использовался `Updates(struct)`, который в gorm
-// тихо игнорирует zero-value поля (status="", file_size=0, github_run_id=0). Для
-// pollAndDownload это уже ловило баги (BUGS.md B-011); переход на Save снимает мину.
-func (is *CustomBuildService) Update(u *model.CustomBuild) error {
-	return DB.Save(u).Error
+// ValidatePublishedOutput verifies that a final output directory is present,
+// contains only regular files, and includes the platform's required published
+// content. It returns the required executable size for Windows and zero for
+// other supported output layouts.
+func ValidatePublishedOutput(outputDir string, build *model.CustomBuild) (int64, error) {
+	size, _, err := publishedOutputManifest(outputDir, build)
+	return size, err
+}
+
+// RecordPublishedOutput validates and records the canonical final output for
+// the exact active build run and artifact. The marker and digest are write-once
+// and generated here, rather than accepted from an arbitrary progress caller.
+// Filesystem and DB updates cannot be one transaction: a DB failure after this
+// marker write (or a filesystem change after validation) remains recoverable
+// through polling.
+func (is *CustomBuildService) RecordPublishedOutput(buildID uint, expectedRunID, expectedArtifactID int64, producerManifest ...ProducerManifest) error {
+	if buildID == 0 {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("build id is required")}
+	}
+	if expectedRunID <= 0 || expectedArtifactID <= 0 {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("expected run and artifact ids must be positive")}
+	}
+	var build model.CustomBuild
+	if err := DB.Where("id = ? AND status IN ? AND github_run_id = ? AND github_artifact_id = ?", buildID, []string{
+		model.CustomBuildStatusBuilding,
+		model.CustomBuildStatusDownloading,
+		model.CustomBuildStatusExtracting,
+	}, expectedRunID, expectedArtifactID).First(&build).Error; err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if err := is.requireCompletionCapability(buildID); err != nil {
+		return err
+	}
+	provenance, err := BuildProvenanceFromRecord(&build)
+	if err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if provenance.GithubRunID != expectedRunID || provenance.GithubArtifactID != expectedArtifactID || provenance.GithubArtifactID <= 0 {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("published output provenance does not match expected run and artifact")}
+	}
+	storedManifestJSON := build.ProducerManifestJSON
+	manifestJSON := storedManifestJSON
+	if len(producerManifest) > 1 {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: errors.New("at most one producer manifest may be recorded")}
+	}
+	if len(producerManifest) == 1 {
+		manifest := producerManifest[0]
+		if err := ValidateProducerManifestForBuild(manifest, &build); err != nil {
+			return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+		}
+		manifestJSON, err = manifest.StoredJSON()
+		if err != nil {
+			return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+		}
+		if storedManifestJSON != "" && storedManifestJSON != manifestJSON {
+			return &BuildProgressPersistenceError{BuildID: buildID, Cause: errors.New("producer manifest provenance is write-once")}
+		}
+	}
+	if manifestJSON != "" {
+		storedManifest, manifestErr := ProducerManifestFromStoredJSON(manifestJSON)
+		if manifestErr != nil {
+			return &BuildProgressPersistenceError{BuildID: buildID, Cause: manifestErr}
+		}
+		if err := ValidateProducerManifestForBuild(storedManifest, &build); err != nil {
+			return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+		}
+	}
+	_, digest, err := publishedOutputManifest(BuildOutputDir(buildID), &build)
+	if err != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if build.PublicationRecordedAt > 0 || build.PublishedDigest != "" {
+		if build.PublicationRecordedAt <= 0 || !publishedDigestMatches(build.PublishedDigest, digest) {
+			return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("published output marker and digest are incomplete or mismatched")}
+		}
+		return nil
+	}
+
+	marker := time.Now().Unix()
+	tx := DB.Model(&model.CustomBuild{}).
+		Where("id = ? AND status IN ? AND github_run_id = ? AND github_artifact_id = ? AND (publication_recorded_at = 0 OR publication_recorded_at IS NULL) AND (published_digest = '' OR published_digest IS NULL)", buildID, []string{
+			model.CustomBuildStatusBuilding,
+			model.CustomBuildStatusDownloading,
+			model.CustomBuildStatusExtracting,
+		}, expectedRunID, expectedArtifactID)
+	updates := map[string]any{"publication_recorded_at": marker, "published_digest": digest}
+	if manifestJSON != "" {
+		updates["producer_manifest_json"] = manifestJSON
+	}
+	tx = tx.Updates(updates)
+	if tx.Error != nil {
+		return &BuildProgressPersistenceError{BuildID: buildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected > 0 {
+		return nil
+	}
+
+	var recorded model.CustomBuild
+	err = DB.Select("publication_recorded_at", "published_digest").Where("id = ? AND status IN ? AND github_run_id = ? AND github_artifact_id = ? AND publication_recorded_at > 0 AND published_digest <> ''", buildID, []string{
+		model.CustomBuildStatusBuilding,
+		model.CustomBuildStatusDownloading,
+		model.CustomBuildStatusExtracting,
+	}, expectedRunID, expectedArtifactID).First(&recorded).Error
+	if err == nil && publishedDigestMatches(recorded.PublishedDigest, digest) {
+		return nil
+	}
+	if err == nil {
+		err = fmt.Errorf("stored publication digest does not match computed digest")
+	}
+	return &BuildProgressPersistenceError{BuildID: buildID, Cause: fmt.Errorf("publication marker write affected no exact active row: %w", err)}
+}
+
+// UpdateProgress updates only asynchronous status and artifact metadata for the
+// exact dispatched run. Updates(map) is intentional: zero values are
+// meaningful and custom_json is never read from or written through this
+// compatibility path.
+func (is *CustomBuildService) UpdateProgress(progress BuildProgress) error {
+	if progress.BuildID == 0 {
+		return fmt.Errorf("build id is required")
+	}
+	if progress.ExpectedRunID <= 0 {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("expected github_run_id must be positive"),
+		}
+	}
+	if !validBuildProgressStatus(progress.Status) {
+		return &BuildProgressPersistenceError{BuildID: progress.BuildID, Cause: fmt.Errorf("invalid build progress status %q", progress.Status)}
+	}
+	if progress.Status == model.CustomBuildStatusDone {
+		if progress.ExpectedArtifactID <= 0 {
+			return &BuildProgressPersistenceError{
+				BuildID: progress.BuildID,
+				Cause:   fmt.Errorf("expected github_artifact_id must be positive for completion"),
+			}
+		}
+		if err := is.requireCompletedPublication(progress.BuildID, progress.ExpectedRunID, progress.ExpectedArtifactID); err != nil {
+			return err
+		}
+	}
+	where := "id = ? AND status IN ? AND github_run_id = ?"
+	args := []any{progress.BuildID, []string{
+		model.CustomBuildStatusBuilding,
+		model.CustomBuildStatusDownloading,
+		model.CustomBuildStatusExtracting,
+	}, progress.ExpectedRunID}
+	if progress.Status == model.CustomBuildStatusDone {
+		where += " AND github_artifact_id > 0 AND github_artifact_id = ? AND publication_recorded_at > 0 AND published_digest <> ''"
+		args = append(args, progress.ExpectedArtifactID)
+	}
+	tx := DB.Model(&model.CustomBuild{}).
+		Where(where, args...).
+		Updates(map[string]any{
+			"status":    progress.Status,
+			"build_log": BoundBuildLog(progress.BuildLog, ""),
+			"file_size": progress.FileSize,
+		})
+	if tx.Error != nil {
+		return &BuildProgressPersistenceError{BuildID: progress.BuildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected == 0 {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("progress update affected no rows"),
+		}
+	}
+	return nil
+}
+
+// UpdateNoRunFailure closes an active legacy/partial row that never received
+// a provider run. It is intentionally separate from UpdateProgress so the
+// positive run-ID guard remains intact and no fake provider run is recorded.
+func (is *CustomBuildService) UpdateNoRunFailure(progress BuildProgress) error {
+	if progress.BuildID == 0 {
+		return fmt.Errorf("build id is required")
+	}
+	if progress.ExpectedRunID != 0 {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("no-run failure must use expected github_run_id zero"),
+		}
+	}
+	if progress.Status != model.CustomBuildStatusFailed {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("no-run failure status must be failed"),
+		}
+	}
+	tx := DB.Model(&model.CustomBuild{}).
+		Where("id = ? AND status IN ? AND (github_run_id = 0 OR github_run_id IS NULL)", progress.BuildID, []string{
+			model.CustomBuildStatusBuilding,
+			model.CustomBuildStatusDownloading,
+			model.CustomBuildStatusExtracting,
+		}).
+		Updates(map[string]any{
+			"status":    progress.Status,
+			"build_log": BoundBuildLog(progress.BuildLog, ""),
+			"file_size": progress.FileSize,
+		})
+	if tx.Error != nil {
+		return &BuildProgressPersistenceError{BuildID: progress.BuildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected == 0 {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("no-run failure update affected no active undispatched row"),
+		}
+	}
+	return nil
+}
+
+// UpdatePendingFailure is the explicit pre-dispatch failure path. It may only
+// transition a still-pending row that has no provider run, so it cannot be
+// used to bypass the run guard for an already-dispatched build.
+func (is *CustomBuildService) UpdatePendingFailure(progress BuildProgress) error {
+	if progress.BuildID == 0 {
+		return fmt.Errorf("build id is required")
+	}
+	if progress.ExpectedRunID != 0 {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("pending failure must not include expected github_run_id"),
+		}
+	}
+	if progress.Status != model.CustomBuildStatusFailed {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("pending failure status must be failed"),
+		}
+	}
+	tx := DB.Model(&model.CustomBuild{}).
+		Where("id = ? AND status = ? AND (github_run_id = 0 OR github_run_id IS NULL)", progress.BuildID, model.CustomBuildStatusPending).
+		Updates(map[string]any{
+			"status":    progress.Status,
+			"build_log": BoundBuildLog(progress.BuildLog, ""),
+			"file_size": progress.FileSize,
+		})
+	if tx.Error != nil {
+		return &BuildProgressPersistenceError{BuildID: progress.BuildID, Cause: tx.Error}
+	}
+	if tx.RowsAffected == 0 {
+		return &BuildProgressPersistenceError{
+			BuildID: progress.BuildID,
+			Cause:   fmt.Errorf("pending failure update affected no undispatched pending rows"),
+		}
+	}
+	return nil
+}
+
+func validBuildProgressStatus(status string) bool {
+	switch status {
+	case model.CustomBuildStatusBuilding, model.CustomBuildStatusDownloading, model.CustomBuildStatusExtracting, model.CustomBuildStatusDone, model.CustomBuildStatusFailed:
+		return true
+	default:
+		return false
+	}
 }
diff --git a/api/service/custom_build_spec.go b/api/service/custom_build_spec.go
new file mode 100644
index 0000000..41b3056
--- /dev/null
+++ b/api/service/custom_build_spec.go
@@ -0,0 +1,1275 @@
+package service
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"rustdesk-server/api/config"
+	"rustdesk-server/api/utils"
+)
+
+// Platform is a platform supported by the Custom Client builder.
+type Platform string
+
+const (
+	PlatformWindows Platform = "windows"
+	PlatformLinux   Platform = "linux"
+	PlatformAndroid Platform = "android"
+)
+
+const maxBuildAppNameBytes = 128
+
+var androidAppIDPattern = regexp.MustCompile(`^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$`)
+
+// MaxPublicCustomTxtBytes bounds the generated native payload that may be
+// parsed while preparing a public download. Larger or malformed payloads are
+// omitted by the archive exporter rather than copied as opaque bytes.
+const MaxPublicCustomTxtBytes = 128 << 10
+
+// SettingsScope selects the native settings object that consumes option keys.
+// The form currently has no manual/raw scope input, so normalization defaults
+// to DefaultSettingsScope unless the typed record context selects otherwise.
+type SettingsScope string
+
+const (
+	DefaultSettingsScope  SettingsScope = "default"
+	OverrideSettingsScope SettingsScope = "override"
+)
+
+// BuildRecordContext contains values owned by the build record rather than by
+// custom_json. These values may be sent to the workflow, but never enter the
+// generated custom_.txt mapping.
+type BuildRecordContext struct {
+	BuildID       uint
+	Platform      string
+	AppName       string
+	Version       string
+	SettingsScope SettingsScope
+	// AllowMissingAndroidAppID is reserved for explicit legacy-read/migration
+	// normalization. Ordinary build and preset writes leave this false, so the
+	// typed Android identity is required before persistence or dispatch.
+	AllowMissingAndroidAppID bool
+}
+
+// BuildSpec is the typed form of user-authored Custom Client settings.
+// ServerIP and Key are persisted L1 dispatch fields and are intentionally not
+// serialized into custom_.txt; record context is also excluded from that
+// payload. Persisted-only fields retain form values for preset/build restore,
+// but have no proven native runtime consumer and are never emitted to
+// custom_.txt.
+type BuildSpec struct {
+	BuildID       uint
+	Platform      Platform
+	AppName       string
+	Version       string
+	SettingsScope SettingsScope
+
+	ServerIP string
+	Key      string
+
+	CompanyName           string
+	DownloadURL           string
+	RemoveNewVersionNotif *bool
+	CycleMonitor          *bool
+	XOffline              *bool
+	AndroidAppID          string
+	AppIconURL            string
+	AppLogoURL            string
+	PrivacyScreenURL      string
+
+	APIServer           string
+	RelayServer         string
+	Direction           string
+	PermanentPassword   string
+	PassApproveMode     string
+	Theme               string
+	PermissionsType     string
+	DenyLAN             *bool
+	EnableDirectIP      *bool
+	AutoClose           *bool
+	HideCM              *bool
+	RemoveWallpaper     *bool
+	EnableRemoteModi    *bool
+	EnableKeyboard      *bool
+	EnableClipboard     *bool
+	EnableFileTransfer  *bool
+	EnableAudio         *bool
+	EnableTCP           *bool
+	EnableRemoteRestart *bool
+	EnableRecording     *bool
+	EnableBlockingInput *bool
+	EnablePrinter       *bool
+	EnableCamera        *bool
+	EnableTerminal      *bool
+
+	// stringPresence distinguishes an authored empty string from an omitted
+	// field while keeping the presence bookkeeping internal to the typed
+	// boundary.
+	stringPresence           map[string]struct{}
+	allowMissingAndroidAppID bool
+}
+
+type buildSpecStringField struct {
+	name          string
+	persisted     bool
+	persistedOnly bool
+	get           func(BuildSpec) string
+	set           func(*BuildSpec, string)
+}
+
+var buildSpecStringFields = []buildSpecStringField{
+	{name: "server_ip", persisted: true, get: func(spec BuildSpec) string { return spec.ServerIP }, set: func(spec *BuildSpec, value string) { spec.ServerIP = value }},
+	{name: "key", persisted: true, get: func(spec BuildSpec) string { return spec.Key }, set: func(spec *BuildSpec, value string) { spec.Key = value }},
+	{name: "api_server", persisted: true, get: func(spec BuildSpec) string { return spec.APIServer }, set: func(spec *BuildSpec, value string) { spec.APIServer = value }},
+	{name: "relay_server", persisted: true, get: func(spec BuildSpec) string { return spec.RelayServer }, set: func(spec *BuildSpec, value string) { spec.RelayServer = value }},
+	{name: "direction", persisted: true, get: func(spec BuildSpec) string { return spec.Direction }, set: func(spec *BuildSpec, value string) { spec.Direction = value }},
+	{name: "permanent_password", persisted: true, get: func(spec BuildSpec) string { return spec.PermanentPassword }, set: func(spec *BuildSpec, value string) { spec.PermanentPassword = value }},
+	{name: "pass_approve_mode", persisted: true, get: func(spec BuildSpec) string { return spec.PassApproveMode }, set: func(spec *BuildSpec, value string) { spec.PassApproveMode = value }},
+	{name: "theme", persisted: true, get: func(spec BuildSpec) string { return spec.Theme }, set: func(spec *BuildSpec, value string) { spec.Theme = value }},
+	{name: "permissions_type", persisted: true, get: func(spec BuildSpec) string { return spec.PermissionsType }, set: func(spec *BuildSpec, value string) { spec.PermissionsType = value }},
+	{name: "company_name", persistedOnly: true, get: func(spec BuildSpec) string { return spec.CompanyName }, set: func(spec *BuildSpec, value string) { spec.CompanyName = value }},
+	{name: "download_url", persistedOnly: true, get: func(spec BuildSpec) string { return spec.DownloadURL }, set: func(spec *BuildSpec, value string) { spec.DownloadURL = value }},
+	{name: "android_app_id", persistedOnly: true, get: func(spec BuildSpec) string { return spec.AndroidAppID }, set: func(spec *BuildSpec, value string) { spec.AndroidAppID = value }},
+	{name: "app_icon_url", persistedOnly: true, get: func(spec BuildSpec) string { return spec.AppIconURL }, set: func(spec *BuildSpec, value string) { spec.AppIconURL = value }},
+	{name: "app_logo_url", persistedOnly: true, get: func(spec BuildSpec) string { return spec.AppLogoURL }, set: func(spec *BuildSpec, value string) { spec.AppLogoURL = value }},
+	{name: "privacy_screen_url", persistedOnly: true, get: func(spec BuildSpec) string { return spec.PrivacyScreenURL }, set: func(spec *BuildSpec, value string) { spec.PrivacyScreenURL = value }},
+}
+
+type buildSpecBoolField struct {
+	name          string
+	persisted     bool
+	persistedOnly bool
+	get           func(BuildSpec) *bool
+	set           func(*BuildSpec, *bool)
+}
+
+var buildSpecBoolFields = []buildSpecBoolField{
+	{name: "deny_lan", persisted: true, get: func(spec BuildSpec) *bool { return spec.DenyLAN }, set: func(spec *BuildSpec, value *bool) { spec.DenyLAN = value }},
+	{name: "enable_direct_ip", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableDirectIP }, set: func(spec *BuildSpec, value *bool) { spec.EnableDirectIP = value }},
+	{name: "auto_close", persisted: true, get: func(spec BuildSpec) *bool { return spec.AutoClose }, set: func(spec *BuildSpec, value *bool) { spec.AutoClose = value }},
+	{name: "hide_cm", persisted: true, get: func(spec BuildSpec) *bool { return spec.HideCM }, set: func(spec *BuildSpec, value *bool) { spec.HideCM = value }},
+	{name: "remove_wallpaper", persisted: true, get: func(spec BuildSpec) *bool { return spec.RemoveWallpaper }, set: func(spec *BuildSpec, value *bool) { spec.RemoveWallpaper = value }},
+	{name: "remove_new_version_notif", persistedOnly: true, get: func(spec BuildSpec) *bool { return spec.RemoveNewVersionNotif }, set: func(spec *BuildSpec, value *bool) { spec.RemoveNewVersionNotif = value }},
+	{name: "cycle_monitor", persistedOnly: true, get: func(spec BuildSpec) *bool { return spec.CycleMonitor }, set: func(spec *BuildSpec, value *bool) { spec.CycleMonitor = value }},
+	{name: "x_offline", persistedOnly: true, get: func(spec BuildSpec) *bool { return spec.XOffline }, set: func(spec *BuildSpec, value *bool) { spec.XOffline = value }},
+	{name: "enable_remote_modi", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableRemoteModi }, set: func(spec *BuildSpec, value *bool) { spec.EnableRemoteModi = value }},
+	{name: "enable_keyboard", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableKeyboard }, set: func(spec *BuildSpec, value *bool) { spec.EnableKeyboard = value }},
+	{name: "enable_clipboard", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableClipboard }, set: func(spec *BuildSpec, value *bool) { spec.EnableClipboard = value }},
+	{name: "enable_file_transfer", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableFileTransfer }, set: func(spec *BuildSpec, value *bool) { spec.EnableFileTransfer = value }},
+	{name: "enable_audio", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableAudio }, set: func(spec *BuildSpec, value *bool) { spec.EnableAudio = value }},
+	{name: "enable_tcp", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableTCP }, set: func(spec *BuildSpec, value *bool) { spec.EnableTCP = value }},
+	{name: "enable_remote_restart", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableRemoteRestart }, set: func(spec *BuildSpec, value *bool) { spec.EnableRemoteRestart = value }},
+	{name: "enable_recording", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableRecording }, set: func(spec *BuildSpec, value *bool) { spec.EnableRecording = value }},
+	{name: "enable_blocking_input", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableBlockingInput }, set: func(spec *BuildSpec, value *bool) { spec.EnableBlockingInput = value }},
+	{name: "enable_printer", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnablePrinter }, set: func(spec *BuildSpec, value *bool) { spec.EnablePrinter = value }},
+	{name: "enable_camera", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableCamera }, set: func(spec *BuildSpec, value *bool) { spec.EnableCamera = value }},
+	{name: "enable_terminal", persisted: true, get: func(spec BuildSpec) *bool { return spec.EnableTerminal }, set: func(spec *BuildSpec, value *bool) { spec.EnableTerminal = value }},
+}
+
+// NormalizedBuild is the service-owned result consumed by persistence and
+// dispatch code. DispatchParams contains workflow/L1 values and the generated
+// native custom_txt payload; PersistedJSON is the canonical form-field JSON
+// stored in custom_json. CustomTxt is kept separately for direct callers/tests.
+type NormalizedBuild struct {
+	Spec           BuildSpec
+	DispatchParams map[string]any
+	CustomTxt      string
+	PersistedJSON  string
+}
+
+// NormalizedCustomTxt is the only representation of custom_txt accepted by
+// the shared workflow-dispatch boundary. It can only be produced by the typed
+// BuildSpec encoder; a plain string from a caller is rejected there so raw
+// native payloads cannot bypass BuildSpec validation.
+type NormalizedCustomTxt struct {
+	value string
+}
+
+func newNormalizedCustomTxt(value string) NormalizedCustomTxt {
+	return NormalizedCustomTxt{value: value}
+}
+
+// Value returns the generated native payload for diagnostics/tests. Callers
+// cannot construct a non-empty normalized value because its storage is private.
+func (v NormalizedCustomTxt) Value() string { return v.value }
+
+func (v NormalizedCustomTxt) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.value)
+}
+
+// ClientValidationError marks input errors that must be returned as a client
+// error by HTTP handlers. Storage errors remain untyped and keep the existing
+// legacy error response path.
+type ClientValidationError struct {
+	Err error
+}
+
+func (e *ClientValidationError) Error() string {
+	return e.Err.Error()
+}
+
+func (e *ClientValidationError) Unwrap() error {
+	return e.Err
+}
+
+// IsClientValidationError reports whether err originated from user input.
+func IsClientValidationError(err error) bool {
+	if err == nil {
+		return false
+	}
+	var validationErr *ClientValidationError
+	return errors.As(err, &validationErr)
+}
+
+// ParsePlatform validates the closed platform domain used by BuildSpec.
+func ParsePlatform(value string) (Platform, error) {
+	switch platform := Platform(value); platform {
+	case PlatformWindows, PlatformLinux, PlatformAndroid:
+		return platform, nil
+	default:
+		return "", fmt.Errorf("platform has unsupported value %q", value)
+	}
+}
+
+// ValidateCustomPlatform is the shared persistence boundary for custom build
+// and preset records. Existing rows are still readable; only new writes and
+// updates are rejected when their platform is outside the supported domain.
+func ValidateCustomPlatform(value string) error {
+	if _, err := ParsePlatform(value); err != nil {
+		return &ClientValidationError{Err: err}
+	}
+	return nil
+}
+
+// ValidateCustomBuildInput validates the normal typed request path without
+// changing the persisted custom_json representation. Empty custom_json keeps
+// the existing optional-payload behavior; a non-empty value must pass the
+// authoritative BuildSpec normalizer.
+func ValidateCustomBuildInput(platform, customJSON, appName, version string) error {
+	if err := ValidateBuildRecordContext(BuildRecordContext{
+		Platform: platform,
+		AppName:  appName,
+		Version:  version,
+	}); err != nil {
+		return &ClientValidationError{Err: err}
+	}
+	if err := ValidateCustomPlatform(platform); err != nil {
+		return err
+	}
+	if customJSON == "" && platform != string(PlatformAndroid) {
+		return nil
+	}
+	if _, err := NormalizeCustomBuildJSON(customJSON, BuildRecordContext{
+		Platform: platform,
+		AppName:  appName,
+		Version:  version,
+	}); err != nil {
+		return &ClientValidationError{Err: err}
+	}
+	return nil
+}
+
+// ValidateDirectCustomBuilderJSON applies the shared exact storage validator
+// before a build or preset service writes a caller-supplied custom_json. The
+// normalizer still owns semantic validation; this boundary prevents direct
+// saves from accepting compact aliases or record/internal fields.
+func ValidateDirectCustomBuilderJSON(customJSON string) error {
+	if err := utils.ValidateCustomBuilderJSONFields(customJSON); err != nil {
+		return &ClientValidationError{Err: err}
+	}
+	return nil
+}
+
+// CanonicalizeCustomBuildJSON applies the typed parse/validate/normalize path
+// and returns the form-field JSON used for persistence. An empty payload keeps
+// the existing optional-payload representation; non-empty payloads are always
+// rewritten from BuildSpec before a caller writes them.
+func CanonicalizeCustomBuildJSON(customJSON string, context BuildRecordContext) (string, error) {
+	normalized, err := NormalizeCustomBuildJSON(customJSON, context)
+	if err != nil {
+		return "", &ClientValidationError{Err: err}
+	}
+	return normalized.PersistedJSON, nil
+}
+
+// ParseSettingsScope validates the closed native settings placement domain.
+func ParseSettingsScope(value SettingsScope) (SettingsScope, error) {
+	if value == "" {
+		return DefaultSettingsScope, nil
+	}
+	switch value {
+	case DefaultSettingsScope, OverrideSettingsScope:
+		return value, nil
+	default:
+		return "", fmt.Errorf("settings scope has unsupported value %q", value)
+	}
+}
+
+// ValidateBuildRecordContext validates record-owned values before a caller
+// constructs workflow parameters, even when custom_json is empty.
+func ValidateBuildRecordContext(context BuildRecordContext) error {
+	if _, err := ParsePlatform(context.Platform); err != nil {
+		return err
+	}
+	if err := ValidateOutputAppName(context.AppName); err != nil {
+		return err
+	}
+	if err := validateWorkflowValue("version", context.Version); err != nil {
+		return err
+	}
+	_, err := ParseSettingsScope(context.SettingsScope)
+	return err
+}
+
+// NormalizeCustomBuildJSON parses and normalizes the persisted custom_json
+// boundary once. The controller passes record context only; it does not parse
+// or map raw fields itself.
+func NormalizeCustomBuildJSON(rawJSON string, context BuildRecordContext) (NormalizedBuild, error) {
+	if rawJSON == "" {
+		normalized, err := NormalizeCustomBuild(map[string]any{}, context)
+		if err != nil {
+			return NormalizedBuild{}, err
+		}
+		normalized.PersistedJSON = ""
+		return normalized, nil
+	}
+	var raw map[string]any
+	if err := json.Unmarshal([]byte(rawJSON), &raw); err != nil {
+		return NormalizedBuild{}, fmt.Errorf("invalid custom JSON: %w", err)
+	}
+	if raw == nil {
+		return NormalizedBuild{}, fmt.Errorf("custom JSON must be an object")
+	}
+	return NormalizeCustomBuild(raw, context)
+}
+
+// NormalizeCustomBuild converts form fields and record context into the
+// single typed BuildSpec owner and workflow parameters. It deliberately keeps
+// L1 dispatch values out of custom_.txt and puts every native option in the
+// selected settings object.
+func NormalizeCustomBuild(raw map[string]any, context BuildRecordContext) (NormalizedBuild, error) {
+	if err := ValidateBuildRecordContext(context); err != nil {
+		return NormalizedBuild{}, err
+	}
+	platform, _ := ParsePlatform(context.Platform)
+	scope, err := ParseSettingsScope(context.SettingsScope)
+	if err != nil {
+		return NormalizedBuild{}, err
+	}
+
+	spec, err := parseBuildSpec(raw)
+	if err != nil {
+		return NormalizedBuild{}, err
+	}
+	spec.BuildID = context.BuildID
+	spec.Platform = platform
+	spec.AppName = context.AppName
+	spec.Version = context.Version
+	spec.SettingsScope = scope
+	spec.allowMissingAndroidAppID = context.AllowMissingAndroidAppID
+
+	customTxt, err := EncodeCustomTxt(spec)
+	if err != nil {
+		return NormalizedBuild{}, err
+	}
+	params := map[string]any{
+		"app_name": spec.AppName,
+		"version":  spec.Version,
+	}
+	if spec.ServerIP != "" {
+		params["server"] = spec.ServerIP
+	}
+	if spec.Key != "" {
+		params["key"] = spec.Key
+	}
+	if platform == PlatformAndroid {
+		if spec.AndroidAppID != "" {
+			params["android_app_id"] = spec.AndroidAppID
+		}
+	}
+	params["custom_txt"] = newNormalizedCustomTxt(customTxt)
+
+	persistedJSON, err := spec.PersistedJSON()
+	if err != nil {
+		return NormalizedBuild{}, err
+	}
+	return NormalizedBuild{Spec: spec, DispatchParams: params, CustomTxt: customTxt, PersistedJSON: persistedJSON}, nil
+}
+
+// PersistedJSON serializes the typed fields used by custom_json, including L1
+// dispatch values needed for preset restore/retry and persisted-only form
+// values without a proven native runtime consumer. Record context, unsupported
+// fields, and raw custom_txt are not included. The custom_.txt encoder has its
+// own explicit native allowlist, so none of the persisted-only fields enter it.
+// Non-nil bool pointers are intentionally emitted even when false so authored
+// false remains distinct from omission.
+func (spec BuildSpec) PersistedJSON() (string, error) {
+	if err := validateBuildSpec(spec); err != nil {
+		return "", err
+	}
+	persisted := make(map[string]any)
+	for _, field := range buildSpecStringFields {
+		if field.persisted || field.persistedOnly {
+			if value := field.get(spec); value != "" || spec.hasString(field.name) {
+				persisted[field.name] = value
+			}
+		}
+	}
+	for _, field := range buildSpecBoolFields {
+		if !field.persisted && !field.persistedOnly {
+			continue
+		}
+		if value := field.get(spec); value != nil {
+			persisted[field.name] = *value
+		}
+	}
+	encoded, err := json.Marshal(persisted)
+	if err != nil {
+		return "", fmt.Errorf("marshal persisted custom JSON: %w", err)
+	}
+	return string(encoded), nil
+}
+
+// ParseBuildSpec validates the typed form boundary and converts it into BuildSpec.
+// Raw workflow payloads such as custom_txt are deliberately not accepted here.
+func ParseBuildSpec(raw map[string]any) (BuildSpec, error) {
+	return parseBuildSpec(raw)
+}
+
+// BuildCustomTxtFromForm returns base64(JSON) after parsing and validating the
+// ordinary typed form path. Raw custom_txt is rejected rather than forwarded.
+func BuildCustomTxtFromForm(raw map[string]any) (string, error) {
+	spec, err := ParseBuildSpec(raw)
+	if err != nil {
+		return "", err
+	}
+	return EncodeCustomTxt(spec)
+}
+
+func parseBuildSpec(raw map[string]any) (BuildSpec, error) {
+	var spec BuildSpec
+	if err := validateKnownBuildFields(raw); err != nil {
+		return BuildSpec{}, err
+	}
+
+	for _, field := range buildSpecStringFields {
+		value, fieldErr := optionalString(raw, field.name)
+		if fieldErr != nil {
+			return BuildSpec{}, fieldErr
+		}
+		if field.name == "key" {
+			value = config.NormalizePublicKey(value)
+		}
+		field.set(&spec, value)
+		if _, ok := raw[field.name]; ok {
+			spec.markString(field.name)
+		}
+	}
+
+	for _, field := range buildSpecBoolFields {
+		value, fieldErr := optionalBool(raw, field.name)
+		if fieldErr != nil {
+			return BuildSpec{}, fieldErr
+		}
+		field.set(&spec, value)
+	}
+	if spec.AndroidAppID != "" {
+		if err := ValidateAndroidAppID(spec.AndroidAppID); err != nil {
+			return BuildSpec{}, err
+		}
+	}
+	if err := validateBuildSpecTransportFields(spec); err != nil {
+		return BuildSpec{}, err
+	}
+	for _, validation := range []struct {
+		name    string
+		value   string
+		allowed []string
+	}{
+		{"direction", spec.Direction, []string{"both", "incoming", "outgoing"}},
+		{"permissions_type", spec.PermissionsType, []string{"custom", "full", "view"}},
+		{"theme", spec.Theme, []string{"light", "dark", "system"}},
+		{"pass_approve_mode", spec.PassApproveMode, []string{"password", "click", "password-click", "both"}},
+	} {
+		if err := validateEnum(validation.name, validation.value, validation.allowed...); err != nil {
+			return BuildSpec{}, err
+		}
+	}
+	for _, endpoint := range []struct {
+		name  string
+		value string
+	}{
+		{"server_ip", spec.ServerIP},
+		{"relay_server", spec.RelayServer},
+	} {
+		if err := validateEndpoint(endpoint.name, endpoint.value); err != nil {
+			return BuildSpec{}, err
+		}
+	}
+	if err := validateAPIURL("api_server", spec.APIServer); err != nil {
+		return BuildSpec{}, err
+	}
+	if spec.HideCM != nil && *spec.HideCM && spec.PermanentPassword == "" {
+		return BuildSpec{}, fmt.Errorf("permanent_password is required when hide_cm is true")
+	}
+
+	return spec, nil
+}
+
+var buildSpecRecordFields = map[string]struct{}{
+	"app_name": {},
+	"build_id": {},
+	"platform": {},
+	"version":  {},
+}
+
+func validateKnownBuildFields(raw map[string]any) error {
+	for name := range raw {
+		if name == "custom_txt" {
+			return fmt.Errorf("custom_txt is not accepted by the typed build path")
+		}
+		if _, ok := buildSpecRecordFields[name]; ok {
+			continue
+		}
+		known := false
+		for _, field := range buildSpecStringFields {
+			if field.name == name {
+				known = true
+				break
+			}
+		}
+		if !known {
+			for _, field := range buildSpecBoolFields {
+				if field.name == name {
+					known = true
+					break
+				}
+			}
+		}
+		if !known {
+			return fmt.Errorf("unsupported custom field %q", name)
+		}
+	}
+	return nil
+}
+
+func (spec *BuildSpec) markString(name string) {
+	if spec.stringPresence == nil {
+		spec.stringPresence = make(map[string]struct{})
+	}
+	spec.stringPresence[name] = struct{}{}
+}
+
+func (spec BuildSpec) hasString(name string) bool {
+	_, ok := spec.stringPresence[name]
+	return ok
+}
+
+// EncodeCustomTxt serializes the exact native contract. Password and
+// conn-type are flat; all other options are consumed from one selected
+// default-settings or override-settings object.
+func EncodeCustomTxt(spec BuildSpec) (string, error) {
+	if err := validateBuildSpec(spec); err != nil {
+		return "", err
+	}
+
+	config := make(map[string]any)
+	if spec.Direction != "" && spec.Direction != "both" {
+		config["conn-type"] = spec.Direction
+	}
+	if spec.PermanentPassword != "" {
+		config["password"] = spec.PermanentPassword
+	}
+
+	settings := make(map[string]string)
+	// nil means the user did not author a value; omission preserves the
+	// downstream/system-derived default and is not a user-authored false.
+	if spec.DenyLAN != nil {
+		settings["enable-lan-discovery"] = yn(!*spec.DenyLAN)
+	}
+	if spec.AutoClose != nil {
+		settings["allow-auto-disconnect"] = yn(*spec.AutoClose)
+	}
+	if spec.APIServer != "" {
+		settings["api-server"] = spec.APIServer
+	}
+	if spec.RelayServer != "" {
+		settings["relay-server"] = spec.RelayServer
+	}
+	if spec.PermissionsType != "" {
+		settings["access-mode"] = spec.PermissionsType
+	}
+	if spec.PassApproveMode != "" {
+		settings["approve-mode"] = spec.PassApproveMode
+	}
+	// Native theme is platform-independent here. Do not invent the legacy
+	// allow-darktheme key without a proven local runtime consumer.
+	if spec.Theme != "" && spec.Theme != "system" {
+		settings["theme"] = spec.Theme
+	}
+	if spec.EnableDirectIP != nil {
+		settings["direct-server"] = yn(*spec.EnableDirectIP)
+	}
+	if spec.HideCM != nil {
+		settings["allow-hide-cm"] = yn(*spec.HideCM)
+		if *spec.HideCM {
+			settings["verification-method"] = "use-permanent-password"
+		} else {
+			settings["verification-method"] = "use-both-passwords"
+		}
+	}
+	if spec.RemoveWallpaper != nil {
+		settings["allow-remove-wallpaper"] = yn(*spec.RemoveWallpaper)
+	}
+
+	for _, field := range []struct {
+		value *bool
+		key   string
+	}{
+		{spec.EnableRemoteModi, "allow-remote-config-modification"},
+		{spec.EnableKeyboard, "enable-keyboard"},
+		{spec.EnableClipboard, "enable-clipboard"},
+		{spec.EnableFileTransfer, "enable-file-transfer"},
+		{spec.EnableAudio, "enable-audio"},
+		{spec.EnableTCP, "enable-tunnel"},
+		{spec.EnableRemoteRestart, "enable-remote-restart"},
+		{spec.EnableRecording, "enable-record-session"},
+		{spec.EnableBlockingInput, "enable-block-input"},
+		{spec.EnablePrinter, "enable-remote-printer"},
+		{spec.EnableCamera, "enable-camera"},
+		{spec.EnableTerminal, "enable-terminal"},
+	} {
+		if field.value != nil {
+			settings[field.key] = yn(*field.value)
+		}
+	}
+
+	if len(settings) > 0 {
+		scope := spec.SettingsScope
+		if scope == "" {
+			scope = DefaultSettingsScope
+		}
+		config[string(scope)+"-settings"] = settings
+	}
+	if len(config) == 0 {
+		return "", nil
+	}
+
+	encoded, err := json.Marshal(config)
+	if err != nil {
+		return "", fmt.Errorf("marshal custom client config: %w", err)
+	}
+	return base64.StdEncoding.EncodeToString(encoded), nil
+}
+
+// nativeCustomTxt is the typed/native schema boundary for generated
+// custom_.txt. Password is accepted only so it can be removed; it is never
+// included in the public representation. The settings type has its own
+// allowlist so unknown or secret-like fields cannot pass through as raw JSON.
+type nativeCustomTxt struct {
+	ConnType         string                  `json:"conn-type,omitempty"`
+	Password         string                  `json:"password,omitempty"`
+	DefaultSettings  nativeCustomTxtSettings `json:"default-settings,omitempty"`
+	OverrideSettings nativeCustomTxtSettings `json:"override-settings,omitempty"`
+}
+
+type nativeCustomTxtSettings map[string]string
+
+var nativeCustomTxtSafeSettings = map[string]struct{}{
+	"enable-lan-discovery":             {},
+	"allow-auto-disconnect":            {},
+	"api-server":                       {},
+	"relay-server":                     {},
+	"access-mode":                      {},
+	"approve-mode":                     {},
+	"theme":                            {},
+	"direct-server":                    {},
+	"allow-remove-wallpaper":           {},
+	"allow-remote-config-modification": {},
+	"enable-keyboard":                  {},
+	"enable-clipboard":                 {},
+	"enable-file-transfer":             {},
+	"enable-audio":                     {},
+	"enable-tunnel":                    {},
+	"enable-remote-restart":            {},
+	"enable-record-session":            {},
+	"enable-block-input":               {},
+	"enable-remote-printer":            {},
+	"enable-camera":                    {},
+	"enable-terminal":                  {},
+}
+
+var nativeCustomTxtPasswordDependentSettings = map[string]struct{}{
+	"allow-hide-cm":       {},
+	"verification-method": {},
+}
+
+func (s *nativeCustomTxtSettings) UnmarshalJSON(data []byte) error {
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return fmt.Errorf("native settings must be an object: %w", err)
+	}
+	if raw == nil {
+		return errors.New("native settings must be an object")
+	}
+	settings := make(nativeCustomTxtSettings, len(raw))
+	for key, value := range raw {
+		if bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
+			return fmt.Errorf("native setting %q must not be null", key)
+		}
+		var stringValue string
+		if err := json.Unmarshal(value, &stringValue); err != nil {
+			return fmt.Errorf("native setting %q must be a string", key)
+		}
+		if err := validateWorkflowValue("native setting", stringValue); err != nil {
+			return err
+		}
+		if _, passwordDependent := nativeCustomTxtPasswordDependentSettings[key]; passwordDependent {
+			continue
+		}
+		if _, safe := nativeCustomTxtSafeSettings[key]; !safe {
+			return fmt.Errorf("native setting %q is not safe for public export", key)
+		}
+		settings[key] = stringValue
+	}
+	*s = settings
+	return nil
+}
+
+// PublicCustomTxt parses generated base64(JSON) custom_.txt content and
+// returns a canonical public variant. It preserves conn-type and allowlisted
+// non-secret L2 settings, while removing password, allow-hide-cm, and
+// verification-method together. Unknown fields fail closed so callers can
+// omit the file instead of exposing opaque private bytes.
+func PublicCustomTxt(encoded string) (string, error) {
+	if encoded == "" {
+		return "", errors.New("custom_.txt payload is empty")
+	}
+	decoded, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return "", fmt.Errorf("decode custom_.txt payload: %w", err)
+	}
+	if len(decoded) == 0 || len(decoded) > MaxPublicCustomTxtBytes {
+		return "", errors.New("custom_.txt payload exceeds public parsing bounds")
+	}
+	if err := rejectDuplicateJSONKeys(decoded); err != nil {
+		return "", fmt.Errorf("custom_.txt payload is not canonical JSON: %w", err)
+	}
+
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(decoded, &raw); err != nil {
+		return "", fmt.Errorf("decode custom_.txt JSON: %w", err)
+	}
+	if raw == nil {
+		return "", errors.New("custom_.txt JSON must be an object")
+	}
+	for key, value := range raw {
+		if bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
+			return "", fmt.Errorf("custom_.txt field %q must not be null", key)
+		}
+	}
+
+	decoder := json.NewDecoder(bytes.NewReader(decoded))
+	decoder.DisallowUnknownFields()
+	var native nativeCustomTxt
+	if err := decoder.Decode(&native); err != nil {
+		return "", fmt.Errorf("decode typed custom_.txt JSON: %w", err)
+	}
+	var trailing json.RawMessage
+	if err := decoder.Decode(&trailing); err != io.EOF {
+		if err == nil {
+			return "", errors.New("custom_.txt JSON contains trailing data")
+		}
+		return "", fmt.Errorf("decode custom_.txt trailing data: %w", err)
+	}
+	if native.ConnType != "" {
+		if err := validateEnum("conn-type", native.ConnType, "both", "incoming", "outgoing"); err != nil {
+			return "", err
+		}
+	}
+	if native.Password != "" {
+		if err := validateWorkflowValue("password", native.Password); err != nil {
+			return "", err
+		}
+	}
+
+	public := make(map[string]any, 3)
+	if native.ConnType != "" {
+		public["conn-type"] = native.ConnType
+	}
+	if len(native.DefaultSettings) > 0 {
+		public["default-settings"] = native.DefaultSettings
+	}
+	if len(native.OverrideSettings) > 0 {
+		public["override-settings"] = native.OverrideSettings
+	}
+	canonical, err := json.Marshal(public)
+	if err != nil {
+		return "", fmt.Errorf("marshal public custom_.txt JSON: %w", err)
+	}
+	return base64.StdEncoding.EncodeToString(canonical), nil
+}
+
+func validateBuildSpec(spec BuildSpec) error {
+	if spec.Platform != "" {
+		if _, err := ParsePlatform(string(spec.Platform)); err != nil {
+			return err
+		}
+		if spec.Platform == PlatformAndroid && !spec.allowMissingAndroidAppID {
+			if spec.AndroidAppID == "" {
+				return fmt.Errorf("android_app_id is required for Android builds")
+			}
+			if err := ValidateAndroidAppID(spec.AndroidAppID); err != nil {
+				return err
+			}
+		}
+	}
+	if _, err := ParseSettingsScope(spec.SettingsScope); err != nil {
+		return err
+	}
+	for _, validation := range []struct {
+		name    string
+		value   string
+		allowed []string
+	}{
+		{"direction", spec.Direction, []string{"both", "incoming", "outgoing"}},
+		{"permissions_type", spec.PermissionsType, []string{"custom", "full", "view"}},
+		{"theme", spec.Theme, []string{"light", "dark", "system"}},
+		{"pass_approve_mode", spec.PassApproveMode, []string{"password", "click", "password-click", "both"}},
+	} {
+		if err := validateEnum(validation.name, validation.value, validation.allowed...); err != nil {
+			return err
+		}
+	}
+	if spec.HideCM != nil && *spec.HideCM && spec.PermanentPassword == "" {
+		return fmt.Errorf("permanent_password is required when hide_cm is true")
+	}
+	if err := validateBuildSpecTransportFields(spec); err != nil {
+		return err
+	}
+	for _, endpoint := range []struct {
+		name  string
+		value string
+	}{
+		{"server_ip", spec.ServerIP},
+		{"relay_server", spec.RelayServer},
+	} {
+		if err := validateEndpoint(endpoint.name, endpoint.value); err != nil {
+			return err
+		}
+	}
+	if err := validateAPIURL("api_server", spec.APIServer); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateBuildSpecTransportFields(spec BuildSpec) error {
+	for _, field := range []struct {
+		name  string
+		value string
+	}{
+		{"server_ip", spec.ServerIP},
+		{"key", spec.Key},
+	} {
+		if err := validateWorkflowValue(field.name, field.value); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateWorkflowValue(name, value string) error {
+	if !utf8.ValidString(value) {
+		return fmt.Errorf("%s contains invalid UTF-8", name)
+	}
+	for _, char := range value {
+		if unicode.IsControl(char) {
+			return fmt.Errorf("%s contains unsafe control characters", name)
+		}
+	}
+	return nil
+}
+
+// NormalizeWorkflowDispatchParams validates the typed values that may enter a
+// workflow payload. Provider-derived identity fields are still overwritten by
+// DispatchBuild, but caller-supplied duplicates are type-checked before that
+// overwrite so an arbitrary map cannot bypass the normal BuildSpec boundary.
+func NormalizeWorkflowDispatchParams(platform string, raw map[string]any) (map[string]any, error) {
+	if _, err := ParsePlatform(platform); err != nil {
+		return nil, err
+	}
+
+	normalized := make(map[string]any, len(raw))
+	specRaw := make(map[string]any)
+	context := BuildRecordContext{
+		Platform: platform,
+		AppName:  "dispatch-output",
+		Version:  "1.0.0",
+	}
+	for name, value := range raw {
+		switch name {
+		case "app_name":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if err := ValidateOutputAppName(stringValue); err != nil {
+				return nil, err
+			}
+			context.AppName = stringValue
+			normalized[name] = stringValue
+		case "server":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			specRaw["server_ip"] = stringValue
+			normalized[name] = stringValue
+		case "key":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			stringValue = config.NormalizePublicKey(stringValue)
+			specRaw[name] = stringValue
+			normalized[name] = stringValue
+		case "custom_txt":
+			normalizedValue, ok := value.(NormalizedCustomTxt)
+			if !ok {
+				return nil, fmt.Errorf("workflow dispatch field %q must be generated from typed BuildSpec", name)
+			}
+			stringValue := normalizedValue.value
+			if err := validateWorkflowValue(name, stringValue); err != nil {
+				return nil, err
+			}
+			normalized[name] = stringValue
+		case "android_app_id":
+			if platform != string(PlatformAndroid) {
+				return nil, fmt.Errorf("workflow dispatch field %q is only valid for Android", name)
+			}
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if err := ValidateAndroidAppID(stringValue); err != nil {
+				return nil, err
+			}
+			specRaw[name] = stringValue
+			normalized[name] = stringValue
+		case "version":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if !utils.ValidateBuildVersion(stringValue) {
+				return nil, fmt.Errorf("version has invalid or unsafe format")
+			}
+			normalized[name] = stringValue
+		case "source_sha":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if !validGithubSourceSHA(stringValue) {
+				return nil, fmt.Errorf("source_sha must be a 40-64 character hexadecimal SHA")
+			}
+			normalized[name] = stringValue
+		case "workflow_repo":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if err := validateGithubRepo(stringValue); err != nil {
+				return nil, fmt.Errorf("workflow_repo is invalid: %w", err)
+			}
+			normalized[name] = stringValue
+		case "release_repo":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if err := validateGithubRepo(stringValue); err != nil {
+				return nil, fmt.Errorf("release_repo is invalid: %w", err)
+			}
+			normalized[name] = stringValue
+		case "assets_release_tag":
+			stringValue, err := dispatchStringValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			if err := validateWorkflowValue(name, stringValue); err != nil {
+				return nil, err
+			}
+			normalized[name] = stringValue
+		case "assets_release_id":
+			integer, err := dispatchIntegerValue(name, value)
+			if err != nil {
+				return nil, err
+			}
+			normalized[name] = integer
+		case "release_assets":
+			assets, ok := value.([]ReleaseAsset)
+			if !ok {
+				return nil, fmt.Errorf("workflow dispatch field %q must use typed release assets", name)
+			}
+			// This caller value is deliberately retained only until DispatchBuild
+			// overwrites it with the resolved catalog identity. Preserve the
+			// existing overwrite rule; forged asset metadata must never be used,
+			// but it also must not replace the provider-derived payload contract.
+			normalized[name] = assets
+		default:
+			return nil, fmt.Errorf("unsupported workflow dispatch field %q", name)
+		}
+	}
+	if len(specRaw) > 0 {
+		if _, err := NormalizeCustomBuild(specRaw, context); err != nil {
+			return nil, err
+		}
+	}
+	if platform == string(PlatformAndroid) {
+		if _, ok := normalized["android_app_id"]; !ok {
+			return nil, fmt.Errorf("android_app_id is required for Android workflow dispatch")
+		}
+	}
+	return normalized, nil
+}
+
+func dispatchStringValue(name string, value any) (string, error) {
+	stringValue, ok := value.(string)
+	if !ok {
+		return "", fmt.Errorf("workflow dispatch field %q must be a string", name)
+	}
+	return stringValue, nil
+}
+
+func dispatchIntegerValue(name string, value any) (int64, error) {
+	var integer int64
+	switch typed := value.(type) {
+	case int:
+		integer = int64(typed)
+	case int64:
+		integer = typed
+	case float64:
+		if typed != float64(int64(typed)) {
+			return 0, fmt.Errorf("workflow dispatch field %q must be an integer", name)
+		}
+		integer = int64(typed)
+	default:
+		return 0, fmt.Errorf("workflow dispatch field %q must be an integer", name)
+	}
+	if integer <= 0 {
+		return 0, fmt.Errorf("workflow dispatch field %q must be positive", name)
+	}
+	return integer, nil
+}
+
+// ValidateOutputAppName validates the user-authored name used in artifact and
+// response filenames. It accepts ordinary Unicode names and spaces, but never
+// permits an empty, traversing, or control-bearing path component.
+func ValidateOutputAppName(value string) error {
+	if err := validateWorkflowValue("app_name", value); err != nil {
+		return err
+	}
+	if value == "" {
+		return fmt.Errorf("app_name is required")
+	}
+	if len(value) > maxBuildAppNameBytes {
+		return fmt.Errorf("app_name exceeds %d bytes", maxBuildAppNameBytes)
+	}
+	if value == "." || value == ".." || strings.ContainsAny(value, `/\\<>:"|?*`) ||
+		strings.HasSuffix(value, ".") || strings.HasSuffix(value, " ") {
+		return fmt.Errorf("app_name must be a single safe filename component")
+	}
+	if isWindowsReservedDeviceName(value) {
+		return fmt.Errorf("app_name uses a reserved Windows device name")
+	}
+	return nil
+}
+
+// ValidateAndroidAppID validates the user-authored Android application/package
+// identifier before it can reach Gradle or the Android manifest. It is a
+// platform-specific typed field and is never accepted as a generic workflow
+// or raw native parameter.
+func ValidateAndroidAppID(value string) error {
+	if err := validateWorkflowValue("android_app_id", value); err != nil {
+		return err
+	}
+	if len(value) == 0 || len(value) > 255 || !androidAppIDPattern.MatchString(value) {
+		return fmt.Errorf("android_app_id must be a lowercase Java package identifier")
+	}
+	return nil
+}
+
+// ValidateWindowsArtifactFilename validates a filename that may cross the
+// provider ZIP/publication boundary. It is stricter than app-name validation:
+// Windows output is flat, must have a known executable/archive/config
+// extension, and may not contain path syntax or device names.
+func ValidateWindowsArtifactFilename(value string) error {
+	if !utf8.ValidString(value) {
+		return fmt.Errorf("artifact filename contains invalid UTF-8")
+	}
+	if value == "" || len(value) > 255 || value == "." || value == ".." {
+		return fmt.Errorf("artifact filename is empty or too long")
+	}
+	for _, char := range value {
+		if unicode.IsControl(char) {
+			return fmt.Errorf("artifact filename contains unsafe control characters")
+		}
+	}
+	if strings.ContainsAny(value, `/\\<>:"|?*`) || strings.HasSuffix(value, ".") || strings.HasSuffix(value, " ") {
+		return fmt.Errorf("artifact filename contains unsafe Windows path characters")
+	}
+	if isWindowsReservedDeviceName(value) {
+		return fmt.Errorf("artifact filename uses a reserved Windows device name")
+	}
+	dot := strings.LastIndexByte(value, '.')
+	if dot <= 0 {
+		return fmt.Errorf("artifact filename must have a supported extension")
+	}
+	switch strings.ToLower(value[dot:]) {
+	case ".dll", ".exe", ".zip", ".txt":
+		return nil
+	default:
+		return fmt.Errorf("artifact filename uses an unsupported extension")
+	}
+}
+
+// WindowsArtifactNameKey returns the publication identity used for Windows
+// artifact names. Windows-delivered output is case-insensitive even when it is
+// staged on a case-sensitive filesystem.
+func WindowsArtifactNameKey(value string) string {
+	return strings.ToLower(value)
+}
+
+func isWindowsReservedDeviceName(value string) bool {
+	base := value
+	if dot := strings.IndexByte(base, '.'); dot >= 0 {
+		base = base[:dot]
+	}
+	base = strings.TrimRight(base, " .")
+	upper := strings.ToUpper(base)
+	if upper == "CON" || upper == "PRN" || upper == "AUX" || upper == "NUL" {
+		return true
+	}
+	if len(upper) == 4 && (strings.HasPrefix(upper, "COM") || strings.HasPrefix(upper, "LPT")) {
+		return upper[3] >= '1' && upper[3] <= '9'
+	}
+	return false
+}
+
+func validateEndpoint(name, value string) error {
+	if value == "" {
+		return nil
+	}
+	if strings.TrimSpace(value) != value {
+		return fmt.Errorf("%s must not contain surrounding whitespace", name)
+	}
+	if net.ParseIP(value) != nil {
+		return nil
+	}
+	if host, port, err := net.SplitHostPort(value); err == nil {
+		if port == "" {
+			return fmt.Errorf("%s has invalid endpoint %q", name, value)
+		}
+		portNumber, err := strconv.ParseUint(port, 10, 16)
+		if err != nil || portNumber == 0 {
+			return fmt.Errorf("%s has invalid endpoint %q", name, value)
+		}
+		if strings.HasPrefix(value, "[") && net.ParseIP(host) == nil {
+			return fmt.Errorf("%s has invalid endpoint %q", name, value)
+		}
+		if net.ParseIP(host) == nil {
+			if err := validateHost(host); err != nil {
+				return fmt.Errorf("%s has invalid endpoint %q: %w", name, value, err)
+			}
+		}
+		return nil
+	}
+	if strings.Contains(value, ":") {
+		return fmt.Errorf("%s has invalid endpoint %q", name, value)
+	}
+	if err := validateHost(value); err != nil {
+		return fmt.Errorf("%s has invalid endpoint %q: %w", name, value, err)
+	}
+	return nil
+}
+
+func validateAPIURL(name, value string) error {
+	if value == "" {
+		return nil
+	}
+	if strings.TrimSpace(value) != value {
+		return fmt.Errorf("%s must not contain surrounding whitespace", name)
+	}
+	parsed, err := url.ParseRequestURI(value)
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" || parsed.User != nil {
+		return fmt.Errorf("%s has invalid URL %q", name, value)
+	}
+	return nil
+}
+
+func validateHost(value string) error {
+	if value == "" {
+		return fmt.Errorf("invalid host")
+	}
+	parsed, err := url.Parse("//" + value)
+	if err != nil || parsed.Host != value || parsed.Hostname() != value || parsed.Path != "" || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return fmt.Errorf("invalid host")
+	}
+	return nil
+}
+
+func optionalString(raw map[string]any, name string) (string, error) {
+	value, ok := raw[name]
+	if !ok {
+		return "", nil
+	}
+	stringValue, ok := value.(string)
+	if !ok {
+		return "", fmt.Errorf("%s must be a string", name)
+	}
+	return stringValue, nil
+}
+
+func optionalBool(raw map[string]any, name string) (*bool, error) {
+	value, ok := raw[name]
+	if !ok {
+		return nil, nil
+	}
+	boolValue, ok := value.(bool)
+	if !ok {
+		return nil, fmt.Errorf("%s must be a boolean", name)
+	}
+	return &boolValue, nil
+}
+
+func validateEnum(name, value string, allowed ...string) error {
+	if value == "" {
+		return nil
+	}
+	for _, candidate := range allowed {
+		if value == candidate {
+			return nil
+		}
+	}
+	return fmt.Errorf("%s has unsupported value %q", name, value)
+}
+
+func yn(value bool) string {
+	if value {
+		return "Y"
+	}
+	return "N"
+}
diff --git a/api/service/custom_build_spec_test.go b/api/service/custom_build_spec_test.go
new file mode 100644
index 0000000..a6f42ce
--- /dev/null
+++ b/api/service/custom_build_spec_test.go
@@ -0,0 +1,970 @@
+package service
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestParsePlatform(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		value   string
+		want    Platform
+		wantErr bool
+	}{
+		{name: "windows", value: "windows", want: PlatformWindows},
+		{name: "linux", value: "linux", want: PlatformLinux},
+		{name: "android", value: "android", want: PlatformAndroid},
+		{name: "macos", value: "macos", wantErr: true},
+		{name: "unknown", value: "plan9", wantErr: true},
+		{name: "empty", value: "", wantErr: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := ParsePlatform(test.value)
+			if test.wantErr {
+				if err == nil {
+					t.Fatalf("ParsePlatform(%q) error = nil, want error", test.value)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("ParsePlatform(%q) error = %v", test.value, err)
+			}
+			if got != test.want {
+				t.Errorf("ParsePlatform(%q) = %q, want %q", test.value, got, test.want)
+			}
+		})
+	}
+}
+
+func TestPublicCustomTxtRedactsPrivateNativeSettings(t *testing.T) {
+	raw := `{"conn-type":"incoming","password":"password-secret","default-settings":{"allow-hide-cm":"Y","verification-method":"use-permanent-password","enable-audio":"Y","theme":"dark"}}`
+	encoded := base64.StdEncoding.EncodeToString([]byte(raw))
+	got, err := PublicCustomTxt(encoded)
+	if err != nil {
+		t.Fatalf("PublicCustomTxt() error = %v", err)
+	}
+	decoded, err := base64.StdEncoding.DecodeString(got)
+	if err != nil {
+		t.Fatalf("public custom_.txt is not standard base64: %v", err)
+	}
+	var public map[string]any
+	if err := json.Unmarshal(decoded, &public); err != nil {
+		t.Fatalf("public custom_.txt is not client-compatible JSON: %v", err)
+	}
+	if public["conn-type"] != "incoming" {
+		t.Fatalf("public conn-type = %#v, want incoming", public["conn-type"])
+	}
+	settings, ok := public["default-settings"].(map[string]any)
+	if !ok {
+		t.Fatalf("public default-settings = %T, want object", public["default-settings"])
+	}
+	if settings["enable-audio"] != "Y" || settings["theme"] != "dark" {
+		t.Fatalf("safe L2 settings = %#v, want preserved settings", settings)
+	}
+	for _, forbidden := range []string{"password", "allow-hide-cm", "verification-method", "password-secret", "use-permanent-password"} {
+		if strings.Contains(string(decoded), forbidden) {
+			t.Fatalf("public custom_.txt contains forbidden value %q: %s", forbidden, decoded)
+		}
+	}
+	repeated, err := PublicCustomTxt(encoded)
+	if err != nil {
+		t.Fatalf("repeated PublicCustomTxt() error = %v", err)
+	}
+	if repeated != got {
+		t.Fatalf("public custom_.txt is not deterministic: first=%q second=%q", got, repeated)
+	}
+}
+
+func TestPublicCustomTxtFailsClosedForMalformedOrUnsafePayloads(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		encoded string
+	}{
+		{name: "invalid base64", encoded: "%%%"},
+		{name: "invalid JSON", encoded: base64.StdEncoding.EncodeToString([]byte("not-json"))},
+		{name: "duplicate JSON key", encoded: base64.StdEncoding.EncodeToString([]byte(`{"conn-type":"incoming","conn-type":"outgoing"}`))},
+		{name: "unknown secret field", encoded: base64.StdEncoding.EncodeToString([]byte(`{"token":"token-secret"}`))},
+		{name: "unsafe nested field", encoded: base64.StdEncoding.EncodeToString([]byte(`{"default-settings":{"payload-key":"payload-secret"}}`))},
+		{name: "null nested setting", encoded: base64.StdEncoding.EncodeToString([]byte(`{"default-settings":{"enable-audio":null}}`))},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := PublicCustomTxt(test.encoded)
+			if err == nil {
+				t.Fatalf("PublicCustomTxt() output = %q, want fail-closed error", got)
+			}
+			if strings.Contains(got, "secret") {
+				t.Fatalf("failed public transform returned secret-bearing output: %q", got)
+			}
+		})
+	}
+}
+
+func TestValidateOutputAppName(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		value   string
+		wantErr bool
+	}{
+		{name: "ascii name", value: "rustqs"},
+		{name: "spaces and unicode", value: "My RustDesk 客户端"},
+		{name: "empty", value: "", wantErr: true},
+		{name: "dot", value: ".", wantErr: true},
+		{name: "dot dot", value: "..", wantErr: true},
+		{name: "slash traversal", value: "../rustqs", wantErr: true},
+		{name: "backslash traversal", value: `..\rustqs`, wantErr: true},
+		{name: "control newline", value: "rustqs\nnext", wantErr: true},
+		{name: "control carriage return", value: "rustqs\rnext", wantErr: true},
+		{name: "control nul", value: "rustqs\x00next", wantErr: true},
+		{name: "excessive", value: strings.Repeat("a", maxBuildAppNameBytes+1), wantErr: true},
+		{name: "windows reserved punctuation", value: "rust|qs", wantErr: true},
+		{name: "reserved CON", value: "CON", wantErr: true},
+		{name: "reserved extension", value: "con.txt", wantErr: true},
+		{name: "reserved spaced extension", value: "LPT1 .exe", wantErr: true},
+		{name: "reserved case insensitive", value: "aUx", wantErr: true},
+		{name: "safe reserved prefix", value: "CONSOLE"},
+		{name: "safe COM10", value: "COM10"},
+		{name: "trailing dot", value: "rustqs.", wantErr: true},
+		{name: "trailing space", value: "rustqs ", wantErr: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateOutputAppName(test.value)
+			if test.wantErr && err == nil {
+				t.Fatalf("ValidateOutputAppName(%q) error = nil, want error", test.value)
+			}
+			if !test.wantErr && err != nil {
+				t.Fatalf("ValidateOutputAppName(%q) error = %v", test.value, err)
+			}
+		})
+	}
+}
+
+func TestValidateWindowsArtifactFilename(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		value   string
+		wantErr bool
+	}{
+		{name: "legitimate exe", value: "rustqs.exe"},
+		{name: "legitimate dll", value: "helper.DLL"},
+		{name: "legitimate zip", value: "driver_bundle.zip"},
+		{name: "config txt", value: "custom_.txt"},
+		{name: "traversal", value: "../rustqs.exe", wantErr: true},
+		{name: "separator", value: `bin\\helper.dll`, wantErr: true},
+		{name: "control", value: "helper\n.dll", wantErr: true},
+		{name: "reserved device", value: "CON.exe", wantErr: true},
+		{name: "unsupported extension", value: "helper.bat", wantErr: true},
+		{name: "trailing space", value: "helper.dll ", wantErr: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateWindowsArtifactFilename(test.value)
+			if (err != nil) != test.wantErr {
+				t.Fatalf("ValidateWindowsArtifactFilename(%q) error = %v, wantErr %v", test.value, err, test.wantErr)
+			}
+		})
+	}
+	if got := WindowsArtifactNameKey("helper.DLL"); got != "helper.dll" {
+		t.Fatalf("WindowsArtifactNameKey() = %q, want case-insensitive identity", got)
+	}
+}
+
+func TestNormalizeCustomBuildRejectsUnsafeWorkflowValues(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		raw  map[string]any
+		ctx  BuildRecordContext
+	}{
+		{name: "key newline", raw: map[string]any{"key": "public\nkey"}, ctx: BuildRecordContext{Platform: "windows", AppName: "rustqs"}},
+		{name: "key carriage return", raw: map[string]any{"key": "public\rkey"}, ctx: BuildRecordContext{Platform: "windows", AppName: "rustqs"}},
+		{name: "key nul", raw: map[string]any{"key": "public\x00key"}, ctx: BuildRecordContext{Platform: "windows", AppName: "rustqs"}},
+		{name: "server tab", raw: map[string]any{"server_ip": "id.example\t:21116"}, ctx: BuildRecordContext{Platform: "windows", AppName: "rustqs"}},
+		{name: "app newline", ctx: BuildRecordContext{Platform: "windows", AppName: "rustqs\nnext"}},
+		{name: "version carriage return", ctx: BuildRecordContext{Platform: "windows", AppName: "rustqs", Version: "1.2.3\r"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := NormalizeCustomBuild(test.raw, test.ctx); err == nil {
+				t.Fatal("NormalizeCustomBuild() error = nil, want unsafe workflow value rejection")
+			}
+		})
+	}
+	for _, value := range []string{"public\nkey", "public\rkey", "public\x00key"} {
+		if _, err := ParseBuildSpec(map[string]any{"key": value}); err == nil {
+			t.Fatalf("ParseBuildSpec() accepted unsafe key %q", value)
+		}
+	}
+}
+
+func TestNormalizeWorkflowDispatchParamsRequiresTypedCustomTxt(t *testing.T) {
+	if _, err := NormalizeWorkflowDispatchParams(string(PlatformWindows), map[string]any{"custom_txt": "raw-native-payload"}); err == nil {
+		t.Fatal("NormalizeWorkflowDispatchParams() accepted raw custom_txt")
+	}
+	normalized, err := NormalizeCustomBuild(map[string]any{"enable_audio": true}, BuildRecordContext{
+		Platform: string(PlatformWindows),
+		AppName:  "rustqs",
+		Version:  "1.2.3",
+	})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuild() error = %v", err)
+	}
+	params, err := NormalizeWorkflowDispatchParams(string(PlatformWindows), normalized.DispatchParams)
+	if err != nil {
+		t.Fatalf("NormalizeWorkflowDispatchParams() rejected typed BuildSpec output: %v", err)
+	}
+	if _, ok := params["custom_txt"].(string); !ok {
+		t.Fatalf("normalized custom_txt type = %T, want string for provider JSON", params["custom_txt"])
+	}
+	keyParams, err := NormalizeWorkflowDispatchParams(string(PlatformWindows), map[string]any{
+		"key": validRustDeskPublicKey + "\r\n",
+	})
+	if err != nil {
+		t.Fatalf("NormalizeWorkflowDispatchParams() rejected trailing key line endings: %v", err)
+	}
+	if keyParams["key"] != validRustDeskPublicKey {
+		t.Fatalf("normalized public key = %q, want trailing CR/LF removed", keyParams["key"])
+	}
+}
+
+func TestNormalizeCustomBuildFullNativeMapping(t *testing.T) {
+	raw := map[string]any{
+		"server_ip":             "id.example:21116",
+		"key":                   "public-key",
+		"app_name":              "ignored-app-name",
+		"version":               "ignored-version",
+		"direction":             "incoming",
+		"permanent_password":    "secret",
+		"pass_approve_mode":     "password-click",
+		"permissions_type":      "custom",
+		"theme":                 "dark",
+		"deny_lan":              true,
+		"enable_direct_ip":      false,
+		"auto_close":            true,
+		"hide_cm":               true,
+		"remove_wallpaper":      true,
+		"enable_remote_modi":    false,
+		"enable_keyboard":       false,
+		"enable_clipboard":      false,
+		"enable_file_transfer":  false,
+		"enable_audio":          true,
+		"enable_tcp":            true,
+		"enable_remote_restart": true,
+		"enable_recording":      false,
+		"enable_blocking_input": true,
+		"enable_printer":        false,
+		"enable_camera":         true,
+		"enable_terminal":       false,
+		"api_server":            "https://api.example",
+		"relay_server":          "relay.example:21117",
+	}
+
+	got, err := NormalizeCustomBuild(raw, BuildRecordContext{
+		BuildID:  42,
+		Platform: "windows",
+		AppName:  "record-app",
+		Version:  "1.2.3",
+	})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuild() error = %v", err)
+	}
+	decoded := decodeCustomTxt(t, got.CustomTxt)
+	want := map[string]any{
+		"conn-type": "incoming",
+		"password":  "secret",
+		"default-settings": map[string]any{
+			"access-mode":                      "custom",
+			"approve-mode":                     "password-click",
+			"verification-method":              "use-permanent-password",
+			"allow-hide-cm":                    "Y",
+			"enable-keyboard":                  "N",
+			"enable-clipboard":                 "N",
+			"enable-file-transfer":             "N",
+			"enable-audio":                     "Y",
+			"enable-tunnel":                    "Y",
+			"enable-remote-restart":            "Y",
+			"enable-record-session":            "N",
+			"enable-block-input":               "Y",
+			"enable-camera":                    "Y",
+			"enable-terminal":                  "N",
+			"enable-remote-printer":            "N",
+			"allow-remote-config-modification": "N",
+			"enable-lan-discovery":             "N",
+			"allow-auto-disconnect":            "Y",
+			"allow-remove-wallpaper":           "Y",
+			"api-server":                       "https://api.example",
+			"relay-server":                     "relay.example:21117",
+			"direct-server":                    "N",
+			"theme":                            "dark",
+		},
+	}
+	if !reflect.DeepEqual(decoded, want) {
+		t.Fatalf("decoded custom JSON = %#v, want %#v", decoded, want)
+	}
+	if got.DispatchParams["server"] != "id.example:21116" {
+		t.Errorf("dispatch server = %v, want literal endpoint", got.DispatchParams["server"])
+	}
+	if got.DispatchParams["key"] != "public-key" {
+		t.Errorf("dispatch key = %v, want public-key", got.DispatchParams["key"])
+	}
+	if got.DispatchParams["app_name"] != "record-app" || got.DispatchParams["version"] != "1.2.3" {
+		t.Errorf("record context leaked or was lost in dispatch params: %#v", got.DispatchParams)
+	}
+	if got.Spec.BuildID != 42 || got.Spec.Platform != PlatformWindows {
+		t.Errorf("typed record context = %#v", got.Spec)
+	}
+	assertNoLegacyAliases(t, decoded)
+}
+
+func TestEncodeCustomTxtSettingsScope(t *testing.T) {
+	for _, test := range []struct {
+		name  string
+		scope SettingsScope
+		key   string
+	}{
+		{name: "default", scope: DefaultSettingsScope, key: "default-settings"},
+		{name: "override", scope: OverrideSettingsScope, key: "override-settings"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := NormalizeCustomBuild(map[string]any{
+				"permissions_type": "view",
+				"api_server":       "https://api.example",
+			}, BuildRecordContext{Platform: "linux", AppName: "rustqs", SettingsScope: test.scope})
+			if err != nil {
+				t.Fatalf("NormalizeCustomBuild() error = %v", err)
+			}
+			decoded := decodeCustomTxt(t, got.CustomTxt)
+			settings := nestedSettings(t, decoded, test.key)
+			if settings["access-mode"] != "view" || settings["api-server"] != "https://api.example" {
+				t.Errorf("%s = %#v", test.key, settings)
+			}
+			other := "default-settings"
+			if test.key == other {
+				other = "override-settings"
+			}
+			if _, ok := decoded[other]; ok {
+				t.Errorf("unexpected %s object", other)
+			}
+		})
+	}
+
+	// Ordinary form parsing has no raw/manual scope input and defaults to default.
+	encoded, err := BuildCustomTxtFromForm(map[string]any{"permissions_type": "custom"})
+	if err != nil {
+		t.Fatalf("BuildCustomTxtFromForm() error = %v", err)
+	}
+	if _, ok := decodeCustomTxt(t, encoded)["default-settings"]; !ok {
+		t.Error("ordinary form must default to default-settings")
+	}
+}
+
+func TestBuildCustomTxtBooleanSemantics(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		raw     map[string]any
+		key     string
+		want    string
+		wantErr bool
+	}{
+		{name: "true becomes Y", raw: map[string]any{"enable_keyboard": true}, key: "enable-keyboard", want: "Y"},
+		{name: "false becomes N", raw: map[string]any{"enable_keyboard": false}, key: "enable-keyboard", want: "N"},
+		{name: "absent remains absent", raw: map[string]any{"permissions_type": "custom"}, key: "enable-keyboard"},
+		{name: "wrong type rejected", raw: map[string]any{"enable_keyboard": "false"}, wantErr: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			encoded, err := BuildCustomTxtFromForm(test.raw)
+			if test.wantErr {
+				if err == nil {
+					t.Fatal("BuildCustomTxtFromForm() error = nil, want error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("BuildCustomTxtFromForm() error = %v", err)
+			}
+			settings := nestedSettings(t, decodeCustomTxt(t, encoded), "default-settings")
+			got, ok := settings[test.key]
+			if test.want == "" {
+				if ok {
+					t.Errorf("default-settings.%s = %v, want absent", test.key, got)
+				}
+				return
+			}
+			if !ok || got != test.want {
+				t.Errorf("default-settings.%s = %v, want %q", test.key, got, test.want)
+			}
+		})
+	}
+}
+
+func TestBuildCustomTxtOverrideBooleanMatrix(t *testing.T) {
+	fields := []struct {
+		input string
+		key   string
+	}{
+		{"deny_lan", "enable-lan-discovery"},
+		{"enable_direct_ip", "direct-server"},
+		{"auto_close", "allow-auto-disconnect"},
+		{"hide_cm", "allow-hide-cm"},
+		{"remove_wallpaper", "allow-remove-wallpaper"},
+		{"enable_remote_modi", "allow-remote-config-modification"},
+		{"enable_keyboard", "enable-keyboard"},
+		{"enable_clipboard", "enable-clipboard"},
+		{"enable_file_transfer", "enable-file-transfer"},
+		{"enable_audio", "enable-audio"},
+		{"enable_tcp", "enable-tunnel"},
+		{"enable_remote_restart", "enable-remote-restart"},
+		{"enable_recording", "enable-record-session"},
+		{"enable_blocking_input", "enable-block-input"},
+		{"enable_printer", "enable-remote-printer"},
+		{"enable_camera", "enable-camera"},
+		{"enable_terminal", "enable-terminal"},
+	}
+	for _, value := range []bool{true, false} {
+		raw := map[string]any{"permanent_password": "secret"}
+		for _, field := range fields {
+			raw[field.input] = value
+		}
+		got, err := NormalizeCustomBuildJSON(mustJSON(t, raw), BuildRecordContext{
+			Platform:      "windows",
+			AppName:       "rustqs",
+			SettingsScope: OverrideSettingsScope,
+		})
+		if err != nil {
+			t.Fatalf("NormalizeCustomBuildJSON(%v) error = %v", value, err)
+		}
+		settings := nestedSettings(t, decodeCustomTxt(t, got.CustomTxt), "override-settings")
+		for _, field := range fields {
+			want := yn(value)
+			if field.input == "deny_lan" {
+				want = yn(!value)
+			}
+			if settings[field.key] != want {
+				t.Errorf("override-settings.%s = %v, want %q for %s", field.key, settings[field.key], want, field.input)
+			}
+		}
+	}
+}
+
+func TestBuildCustomTxtAbsentBooleanIsSystemDerived(t *testing.T) {
+	encoded, err := BuildCustomTxtFromForm(map[string]any{"permissions_type": "custom"})
+	if err != nil {
+		t.Fatalf("BuildCustomTxtFromForm() error = %v", err)
+	}
+	settings := nestedSettings(t, decodeCustomTxt(t, encoded), "default-settings")
+	if _, ok := settings["enable-lan-discovery"]; ok {
+		t.Fatal("absent deny_lan must omit enable-lan-discovery; system defaults are not user-authored false")
+	}
+	if _, ok := settings["enable-keyboard"]; ok {
+		t.Fatal("absent enable_keyboard must omit enable-keyboard; downstream derives its default")
+	}
+}
+
+func TestBuildCustomTxtHideConnectionManagement(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		raw     map[string]any
+		want    map[string]any
+		wantErr bool
+	}{
+		{
+			name: "false uses both passwords",
+			raw:  map[string]any{"hide_cm": false},
+			want: map[string]any{"allow-hide-cm": "N", "verification-method": "use-both-passwords"},
+		},
+		{
+			name: "true uses permanent password",
+			raw:  map[string]any{"hide_cm": true, "permanent_password": "secret"},
+			want: map[string]any{"allow-hide-cm": "Y", "verification-method": "use-permanent-password"},
+		},
+		{
+			name: "absent emits neither key",
+			raw:  map[string]any{"permissions_type": "custom"},
+			want: map[string]any{},
+		},
+		{
+			name:    "true without password rejected",
+			raw:     map[string]any{"hide_cm": true},
+			wantErr: true,
+		},
+		{
+			name:    "wrong type rejected",
+			raw:     map[string]any{"hide_cm": "false"},
+			wantErr: true,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			encoded, err := BuildCustomTxtFromForm(test.raw)
+			if test.wantErr {
+				if err == nil {
+					t.Fatal("BuildCustomTxtFromForm() error = nil, want error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("BuildCustomTxtFromForm() error = %v", err)
+			}
+			settings := nestedSettings(t, decodeCustomTxt(t, encoded), "default-settings")
+			for key, want := range test.want {
+				if got := settings[key]; got != want {
+					t.Errorf("settings[%q] = %v, want %v", key, got, want)
+				}
+			}
+			if len(test.want) == 0 {
+				if _, ok := settings["allow-hide-cm"]; ok {
+					t.Error("allow-hide-cm must be absent when hide_cm is absent")
+				}
+				if _, ok := settings["verification-method"]; ok {
+					t.Error("verification-method must be absent when hide_cm is absent")
+				}
+			}
+		})
+	}
+}
+
+func TestNormalizeCustomBuildEndpointPreservation(t *testing.T) {
+	for _, endpoint := range []string{
+		"relay.example",
+		"relay.example:21117",
+		"192.0.2.10",
+		"192.0.2.10:21117",
+		"2001:db8::10",
+		"[2001:db8::10]:21117",
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			got, err := NormalizeCustomBuild(map[string]any{
+				"server_ip":      endpoint,
+				"relay_server":   endpoint,
+				"android_app_id": "com.example.rustqs",
+			}, BuildRecordContext{Platform: "android", AppName: "rustqs"})
+			if err != nil {
+				t.Fatalf("NormalizeCustomBuild() error = %v", err)
+			}
+			if got.DispatchParams["server"] != endpoint {
+				t.Errorf("server = %v, want literal %q", got.DispatchParams["server"], endpoint)
+			}
+			settings := nestedSettings(t, decodeCustomTxt(t, got.CustomTxt), "default-settings")
+			if settings["relay-server"] != endpoint {
+				t.Errorf("relay-server = %v, want literal %q", settings["relay-server"], endpoint)
+			}
+		})
+	}
+}
+
+func TestAndroidAppIDIsTypedAndroidOnlyAndRequiredBeforeDispatch(t *testing.T) {
+	normalized, err := NormalizeCustomBuild(map[string]any{
+		"android_app_id": "com.example.rustqs",
+		"enable_audio":   true,
+	}, BuildRecordContext{Platform: string(PlatformAndroid), AppName: "rustqs", Version: "1.2.3"})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuild() error = %v", err)
+	}
+	if got := normalized.DispatchParams["android_app_id"]; got != "com.example.rustqs" {
+		t.Fatalf("android dispatch identity = %#v, want typed package identifier", got)
+	}
+	if _, ok := normalized.DispatchParams["custom_txt"].(NormalizedCustomTxt); !ok {
+		t.Fatal("generated custom_txt did not retain typed dispatch boundary")
+	}
+	encrypted, err := (&GithubBuildConfigService{}).EncryptPayload("android-contract-key", normalized.DispatchParams)
+	if err != nil {
+		t.Fatalf("EncryptPayload() error = %v", err)
+	}
+	decrypted, err := (&GithubBuildConfigService{}).DecryptPayload("android-contract-key", encrypted)
+	if err != nil {
+		t.Fatalf("DecryptPayload() error = %v", err)
+	}
+	if decrypted["android_app_id"] != "com.example.rustqs" {
+		t.Fatalf("DFP1 android_app_id = %#v, want typed package identifier", decrypted["android_app_id"])
+	}
+
+	for _, tc := range []struct {
+		name string
+		id   string
+	}{
+		{name: "missing", id: ""},
+		{name: "single segment", id: "com"},
+		{name: "uppercase", id: "Com.Example.App"},
+		{name: "traversal", id: "com.example/escape"},
+		{name: "empty segment", id: "com.example..app"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.id == "" {
+				if err := ValidateAndroidAppID(tc.id); err == nil {
+					t.Fatal("ValidateAndroidAppID() accepted a missing package identifier")
+				}
+				return
+			}
+			_, err := NormalizeCustomBuild(map[string]any{"android_app_id": tc.id}, BuildRecordContext{
+				Platform: string(PlatformAndroid), AppName: "rustqs", Version: "1.2.3",
+			})
+			if err == nil {
+				t.Fatalf("NormalizeCustomBuild() accepted invalid android_app_id %q", tc.id)
+			}
+		})
+	}
+
+	if _, err := NormalizeWorkflowDispatchParams(string(PlatformAndroid), map[string]any{}); err == nil {
+		t.Fatal("NormalizeWorkflowDispatchParams() accepted Android dispatch without identity")
+	}
+	noL2, err := NormalizeWorkflowDispatchParams(string(PlatformAndroid), map[string]any{
+		"android_app_id": "com.example.rustqs",
+	})
+	if err != nil {
+		t.Fatalf("NormalizeWorkflowDispatchParams() rejected valid no-L2 Android dispatch: %v", err)
+	}
+	if _, ok := noL2["custom_txt"]; ok {
+		t.Fatal("no-L2 Android dispatch manufactured a raw custom_txt field")
+	}
+	if _, err := NormalizeWorkflowDispatchParams(string(PlatformLinux), map[string]any{
+		"android_app_id": "com.example.rustqs",
+	}); err == nil {
+		t.Fatal("non-Android dispatch accepted android_app_id")
+	}
+}
+
+func TestNormalizeCustomBuildRequiresAndroidAppIDBeforePersistence(t *testing.T) {
+	for _, platform := range []Platform{PlatformWindows, PlatformLinux} {
+		t.Run(string(platform), func(t *testing.T) {
+			if _, err := NormalizeCustomBuild(map[string]any{}, BuildRecordContext{
+				Platform: string(platform), AppName: "rustqs", Version: "1.2.3",
+			}); err != nil {
+				t.Fatalf("NormalizeCustomBuild() error = %v, want platform without Android identity to remain valid", err)
+			}
+		})
+	}
+
+	_, err := NormalizeCustomBuild(map[string]any{}, BuildRecordContext{
+		Platform: string(PlatformAndroid), AppName: "rustqs", Version: "1.2.3",
+	})
+	if err == nil || err.Error() != "android_app_id is required for Android builds" {
+		t.Fatalf("NormalizeCustomBuild() error = %v, want required Android identity validation", err)
+	}
+}
+
+func TestNormalizeCustomBuildAPIURLValidation(t *testing.T) {
+	for _, value := range []string{"https://api.example", "https://api.example:21114/api"} {
+		t.Run(value, func(t *testing.T) {
+			got, err := NormalizeCustomBuild(map[string]any{"api_server": value}, BuildRecordContext{Platform: "linux", AppName: "rustqs"})
+			if err != nil {
+				t.Fatalf("NormalizeCustomBuild() error = %v", err)
+			}
+			settings := nestedSettings(t, decodeCustomTxt(t, got.CustomTxt), "default-settings")
+			if settings["api-server"] != value {
+				t.Errorf("api-server = %v, want literal %q", settings["api-server"], value)
+			}
+		})
+	}
+	for _, value := range []string{"api.example", "api://example", "https://"} {
+		t.Run("invalid-"+value, func(t *testing.T) {
+			if _, err := NormalizeCustomBuild(map[string]any{"api_server": value}, BuildRecordContext{Platform: "linux", AppName: "rustqs"}); err == nil {
+				t.Errorf("NormalizeCustomBuild(%q) error = nil, want error", value)
+			}
+		})
+	}
+}
+
+func TestNormalizeCustomBuildValidation(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		context BuildRecordContext
+		raw     map[string]any
+	}{
+		{name: "unknown platform", context: BuildRecordContext{Platform: "macos"}},
+		{name: "missing platform", context: BuildRecordContext{}},
+		{name: "invalid hostname", context: BuildRecordContext{Platform: "windows"}, raw: map[string]any{"server_ip": "bad host"}},
+		{name: "missing hostname", context: BuildRecordContext{Platform: "windows"}, raw: map[string]any{"server_ip": ":21116"}},
+		{name: "invalid port", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"relay_server": "relay.example:not-a-port"}},
+		{name: "zero port", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"relay_server": "relay.example:0"}},
+		{name: "endpoint URL", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"relay_server": "https://relay.example"}},
+		{name: "bracketed hostname", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"relay_server": "[relay.example]:21117"}},
+		{name: "invalid direction", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"direction": "sideways"}},
+		{name: "invalid permissions type", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"permissions_type": "admin"}},
+		{name: "invalid theme", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"theme": "blue"}},
+		{name: "invalid approve mode", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"pass_approve_mode": "auto"}},
+		{name: "wrong endpoint type", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"server_ip": 21116}},
+		{name: "wrong URL type", context: BuildRecordContext{Platform: "linux"}, raw: map[string]any{"api_server": false}},
+		{name: "invalid scope", context: BuildRecordContext{Platform: "linux", SettingsScope: "manual"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := NormalizeCustomBuild(test.raw, test.context); err == nil {
+				t.Fatal("NormalizeCustomBuild() error = nil, want error")
+			}
+		})
+	}
+}
+
+func TestNormalizeCustomBuildRejectsRawCustomTxt(t *testing.T) {
+	if _, err := NormalizeCustomBuildJSON(`{"custom_txt":"not-forwarded"}`, BuildRecordContext{Platform: "windows"}); err == nil {
+		t.Fatal("NormalizeCustomBuildJSON() error = nil, want raw custom_txt rejection")
+	}
+	if _, err := BuildCustomTxtFromForm(map[string]any{"custom_txt": "not-forwarded"}); err == nil {
+		t.Fatal("BuildCustomTxtFromForm() error = nil, want raw custom_txt rejection")
+	}
+}
+
+func TestNormalizeCustomBuildRecordContextAndUnsupportedFields(t *testing.T) {
+	got, err := NormalizeCustomBuildJSON(`{"server_ip":"id.example:21116","app_name":"raw-app","version":"raw-version","permissions_type":"custom"}`, BuildRecordContext{
+		BuildID:  7,
+		Platform: "windows",
+		AppName:  "record-app",
+		Version:  "record-version",
+	})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuildJSON() error = %v", err)
+	}
+	decoded := decodeCustomTxt(t, got.CustomTxt)
+	if got.DispatchParams["server"] != "id.example:21116" || got.DispatchParams["app_name"] != "record-app" || got.DispatchParams["version"] != "record-version" {
+		t.Errorf("dispatch params = %#v", got.DispatchParams)
+	}
+	for _, key := range []string{"app_name", "version", "server_ip", "key"} {
+		if _, ok := decoded[key]; ok {
+			t.Errorf("%s leaked into custom JSON", key)
+		}
+	}
+}
+
+func TestNormalizeCustomBuildRejectsUnknownPersistedFields(t *testing.T) {
+	for _, raw := range []string{
+		`{"future_field":"value"}`,
+		`{"legacy_variant":{"value":true}}`,
+		`{"custom_txt":"raw"}`,
+	} {
+		t.Run(raw, func(t *testing.T) {
+			if _, err := NormalizeCustomBuildJSON(raw, BuildRecordContext{Platform: "windows"}); err == nil {
+				t.Fatal("NormalizeCustomBuildJSON() error = nil, want fail-closed rejection")
+			}
+		})
+	}
+}
+
+func TestNormalizedBuildPersistedJSONIsCanonicalFormJSON(t *testing.T) {
+	got, err := NormalizeCustomBuildJSON(`{"server_ip":"id.example:21116","key":"public-key","api_server":"https://api.example","enable_audio":false,"enable_terminal":true,"app_name":"raw-app","version":"raw-version","platform":"raw-platform"}`, BuildRecordContext{
+		BuildID:  99,
+		Platform: "linux",
+		AppName:  "record-app",
+		Version:  "record-version",
+	})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuildJSON() error = %v", err)
+	}
+	var persisted map[string]any
+	if err := json.Unmarshal([]byte(got.PersistedJSON), &persisted); err != nil {
+		t.Fatalf("PersistedJSON is not JSON: %v", err)
+	}
+	if persisted["api_server"] != "https://api.example" {
+		t.Fatalf("known values not preserved: %#v", persisted)
+	}
+	if got.DispatchParams["server"] != "id.example:21116" || got.DispatchParams["key"] != "public-key" {
+		t.Fatalf("L1 endpoint/key dispatch values not preserved: %#v", got.DispatchParams)
+	}
+	if persisted["server_ip"] != "id.example:21116" || persisted["key"] != "public-key" {
+		t.Fatalf("L1 endpoint/key persisted values not preserved: %#v", persisted)
+	}
+	if persisted["enable_audio"] != false || persisted["enable_terminal"] != true {
+		t.Fatalf("typed bool values not preserved: %#v", persisted)
+	}
+	for _, key := range []string{"app_name", "version", "platform", "build_id", "custom_txt"} {
+		if _, ok := persisted[key]; ok {
+			t.Errorf("excluded field %q present in persisted JSON: %#v", key, persisted)
+		}
+	}
+	if got.PersistedJSON == got.CustomTxt {
+		t.Fatal("PersistedJSON must be form-field JSON, not base64 custom_.txt")
+	}
+}
+
+func TestPersistedJSONPreservesAuthoredEmptyStringsOnly(t *testing.T) {
+	got, err := NormalizeCustomBuild(map[string]any{
+		"server_ip":    "",
+		"key":          "",
+		"company_name": "",
+		"api_server":   "",
+	}, BuildRecordContext{Platform: "windows", AppName: "rustqs"})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuild() error = %v", err)
+	}
+	persisted := decodeJSON(t, got.PersistedJSON)
+	for _, key := range []string{"server_ip", "key", "company_name", "api_server"} {
+		value, ok := persisted[key]
+		if !ok || value != "" {
+			t.Errorf("persisted[%q] = %#v, present = %v, want authored empty string", key, value, ok)
+		}
+	}
+	if _, ok := persisted["relay_server"]; ok {
+		t.Error("absent relay_server was serialized")
+	}
+}
+
+func TestCanonicalPersistedPRESETFieldsAndCustomTxtBoundary(t *testing.T) {
+	raw := map[string]any{
+		"server_ip":                "id.example:21116",
+		"key":                      "public-key",
+		"api_server":               "https://api.example",
+		"relay_server":             "relay.example:21117",
+		"company_name":             "DeskForge",
+		"download_url":             "https://download.example/client",
+		"direction":                "incoming",
+		"pass_approve_mode":        "password-click",
+		"permanent_password":       "secret",
+		"deny_lan":                 false,
+		"enable_direct_ip":         true,
+		"auto_close":               false,
+		"hide_cm":                  false,
+		"theme":                    "dark",
+		"remove_wallpaper":         true,
+		"remove_new_version_notif": false,
+		"permissions_type":         "full",
+		"enable_keyboard":          false,
+		"enable_clipboard":         true,
+		"enable_file_transfer":     false,
+		"enable_audio":             true,
+		"enable_tcp":               false,
+		"enable_remote_restart":    true,
+		"enable_recording":         false,
+		"enable_blocking_input":    true,
+		"enable_remote_modi":       false,
+		"enable_printer":           true,
+		"enable_camera":            false,
+		"enable_terminal":          true,
+		"cycle_monitor":            true,
+		"x_offline":                false,
+		"android_app_id":           "com.example.client",
+		"app_icon_url":             "/upload/icon.png",
+		"app_logo_url":             "/upload/logo.png",
+		"privacy_screen_url":       "/upload/privacy.png",
+	}
+	got, err := NormalizeCustomBuild(raw, BuildRecordContext{Platform: "windows", AppName: "rustqs"})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuild() error = %v", err)
+	}
+
+	persisted := decodeJSON(t, got.PersistedJSON)
+	for key, want := range raw {
+		if got := persisted[key]; !reflect.DeepEqual(got, want) {
+			t.Errorf("persisted[%q] = %#v, want %#v", key, got, want)
+		}
+	}
+	for _, key := range []string{
+		"server_ip", "key", "company_name", "download_url", "remove_new_version_notif",
+		"cycle_monitor", "x_offline", "android_app_id", "app_icon_url", "app_logo_url",
+		"privacy_screen_url",
+	} {
+		if _, ok := decodeCustomTxt(t, got.CustomTxt)[key]; ok {
+			t.Errorf("L1/persisted-only field %q entered custom_.txt", key)
+		}
+	}
+	assertNoKeys(t, decodeCustomTxt(t, got.CustomTxt), []string{
+		"server_ip", "key", "company_name", "download_url", "remove_new_version_notif",
+		"cycle_monitor", "x_offline", "android_app_id", "app_icon_url", "app_logo_url",
+		"privacy_screen_url",
+	})
+	if got.DispatchParams["server"] != raw["server_ip"] || got.DispatchParams["key"] != raw["key"] {
+		t.Fatalf("dispatch params did not use normalized L1 values: %#v", got.DispatchParams)
+	}
+}
+
+func TestParseBuildSpecRejectsInvalidTypesForEveryTypedField(t *testing.T) {
+	for _, field := range buildSpecStringFields {
+		t.Run(field.name+" string", func(t *testing.T) {
+			if _, err := NormalizeCustomBuild(map[string]any{field.name: 123}, BuildRecordContext{Platform: "linux"}); err == nil {
+				t.Fatalf("NormalizeCustomBuild() error = nil for invalid %s type", field.name)
+			}
+		})
+	}
+	for _, field := range buildSpecBoolFields {
+		t.Run(field.name+" bool", func(t *testing.T) {
+			if _, err := NormalizeCustomBuild(map[string]any{field.name: "false"}, BuildRecordContext{Platform: "linux"}); err == nil {
+				t.Fatalf("NormalizeCustomBuild() error = nil for invalid %s type", field.name)
+			}
+		})
+	}
+}
+
+func TestNormalizeCustomBuildJSONRejectsNonObject(t *testing.T) {
+	if _, err := NormalizeCustomBuildJSON(`[]`, BuildRecordContext{Platform: "windows"}); err == nil {
+		t.Fatal("NormalizeCustomBuildJSON() error = nil, want error")
+	}
+}
+
+func decodeCustomTxt(t *testing.T, encoded string) map[string]any {
+	t.Helper()
+	decodedJSON, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		t.Fatalf("decode custom_.txt: %v", err)
+	}
+	var decoded map[string]any
+	if err := json.Unmarshal(decodedJSON, &decoded); err != nil {
+		t.Fatalf("unmarshal custom_.txt: %v", err)
+	}
+	return decoded
+}
+
+func decodeJSON(t *testing.T, value string) map[string]any {
+	t.Helper()
+	var decoded map[string]any
+	if err := json.Unmarshal([]byte(value), &decoded); err != nil {
+		t.Fatalf("unmarshal JSON: %v", err)
+	}
+	return decoded
+}
+
+func assertNoKeys(t *testing.T, value map[string]any, forbidden []string) {
+	t.Helper()
+	for key, child := range value {
+		for _, forbiddenKey := range forbidden {
+			if key == forbiddenKey {
+				t.Errorf("forbidden key %q emitted", key)
+			}
+		}
+		if nested, ok := child.(map[string]any); ok {
+			assertNoKeys(t, nested, forbidden)
+		}
+	}
+}
+
+func mustJSON(t *testing.T, value map[string]any) string {
+	t.Helper()
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("json.Marshal() error = %v", err)
+	}
+	return string(encoded)
+}
+
+func nestedSettings(t *testing.T, decoded map[string]any, name string) map[string]any {
+	t.Helper()
+	value, ok := decoded[name].(map[string]any)
+	if !ok {
+		t.Fatalf("%s is %T, want object", name, decoded[name])
+	}
+	return value
+}
+
+func assertNoLegacyAliases(t *testing.T, value any) {
+	t.Helper()
+	legacy := []string{
+		"permissions-mode", "deny-lan-discovery", "enable-printer",
+		"remove-wallpaper", "hide-connection-management", "auto-close-incoming-sessions",
+		"custom-rendezvous-api-server", "allow_remote_config_modification", "disable_update",
+		"direction", "server_ip", "key", "app_name", "version", "allow-darktheme",
+	}
+	switch typed := value.(type) {
+	case map[string]any:
+		for key, child := range typed {
+			for _, alias := range legacy {
+				if key == alias {
+					t.Errorf("legacy/internal alias %q emitted", alias)
+				}
+			}
+			assertNoLegacyAliases(t, child)
+		}
+	case []any:
+		for _, child := range typed {
+			assertNoLegacyAliases(t, child)
+		}
+	case string:
+		if strings.Contains(typed, "permissions-mode") {
+			t.Errorf("legacy alias leaked into value %q", typed)
+		}
+	}
+}
diff --git a/api/service/custom_persistence_test.go b/api/service/custom_persistence_test.go
new file mode 100644
index 0000000..67cfc8b
--- /dev/null
+++ b/api/service/custom_persistence_test.go
@@ -0,0 +1,1494 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"rustdesk-server/api/model"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestCustomPersistenceMethodsRejectUnsupportedPlatformBeforeDB(t *testing.T) {
+	tests := []struct {
+		name string
+		call func() error
+	}{
+		{
+			name: "build create",
+			call: func() error {
+				return (&CustomBuildService{}).Create(&model.CustomBuild{Platform: "macos"})
+			},
+		},
+		{
+			name: "preset create",
+			call: func() error {
+				return (&CustomPresetService{}).Create(&model.CustomPreset{Platform: "macos"})
+			},
+		},
+		{
+			name: "preset update",
+			call: func() error {
+				return (&CustomPresetService{}).Update(&model.CustomPreset{Platform: "macos"})
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := test.call()
+			if err == nil {
+				t.Fatal("error = nil, want unsupported platform validation error")
+			}
+			if !IsClientValidationError(err) {
+				t.Fatalf("error type = %T, want ClientValidationError", err)
+			}
+			if got := err.Error(); got != `platform has unsupported value "macos"` {
+				t.Errorf("error = %q, want unsupported platform message", got)
+			}
+		})
+	}
+}
+
+func TestCustomBuildCreateCanonicalizesBeforePersistence(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Name:       "typed-build",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "deskforge",
+		CustomJson: `{"server_ip":"id.example:21116","key":"public-key","relay_server":"relay.example:21117","enable_audio":false}`,
+	}
+	normalized, err := (&CustomBuildService{}).CreateNormalized(build)
+	if err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+
+	var persisted map[string]any
+	if err := json.Unmarshal([]byte(build.CustomJson), &persisted); err != nil {
+		t.Fatalf("canonical custom_json is invalid: %v", err)
+	}
+	assertCanonicalPersistedJSON(t, persisted)
+	if normalized.DispatchParams["server"] != "id.example:21116" || persisted["relay_server"] != "relay.example:21117" {
+		t.Fatalf("endpoint literals were not preserved: persisted=%#v dispatch=%#v", persisted, normalized.DispatchParams)
+	}
+	if persisted["enable_audio"] != false {
+		t.Fatalf("explicit false was not preserved: %#v", persisted)
+	}
+
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read persisted build: %v", err)
+	}
+	if stored.CustomJson != build.CustomJson {
+		t.Fatalf("stored custom_json = %q, returned = %q", stored.CustomJson, build.CustomJson)
+	}
+}
+
+func TestCustomPersistenceRejectsInvalidPayloadBeforeWrite(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	var before int64
+	if err := db.Model(&model.CustomBuild{}).Count(&before).Error; err != nil {
+		t.Fatal(err)
+	}
+	for _, payload := range []string{
+		`{"custom_txt":"raw"}`,
+		`{"permissions_type":"not-supported"}`,
+		`{"enable_audio":"false"}`,
+	} {
+		buildErr := (&CustomBuildService{}).Create(&model.CustomBuild{
+			Name:       "invalid-build",
+			Platform:   "linux",
+			Version:    "1.2.3",
+			CustomJson: payload,
+		})
+		if buildErr == nil || !IsClientValidationError(buildErr) {
+			t.Fatalf("build Create(%s) error = %v, want ClientValidationError", payload, buildErr)
+		}
+	}
+	var after int64
+	if err := db.Model(&model.CustomBuild{}).Count(&after).Error; err != nil {
+		t.Fatal(err)
+	}
+	if after != before {
+		t.Fatalf("invalid build changed row count from %d to %d", before, after)
+	}
+
+	presetErr := (&CustomPresetService{}).Create(&model.CustomPreset{
+		UserId:     7,
+		Name:       "invalid-preset",
+		Platform:   "linux",
+		Version:    "1.2.3",
+		CustomJson: `{"permissions_type":"not-supported"}`,
+	})
+	if presetErr == nil || !IsClientValidationError(presetErr) {
+		t.Fatalf("preset Create() error = %v, want ClientValidationError", presetErr)
+	}
+	var presetCount int64
+	if err := db.Model(&model.CustomPreset{}).Count(&presetCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if presetCount != 0 {
+		t.Fatalf("invalid preset changed row count to %d", presetCount)
+	}
+}
+
+func TestDirectCustomSavesRequireExactCanonicalTypedFields(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	invalidPayloads := []string{
+		`{"server-ip":"id.example:21116"}`,
+		`{"enable-audio":true}`,
+		`{"server_ip":{"value":"id.example:21116"}}`,
+		`{"enable_audio":"false"}`,
+		`{"enable_audio":null}`,
+		`{"future_field":"value"}`,
+		`{"app_name":"internal-record-field"}`,
+	}
+	for index, payload := range invalidPayloads {
+		t.Run(fmt.Sprintf("build-%d", index), func(t *testing.T) {
+			err := (&CustomBuildService{}).Create(&model.CustomBuild{
+				Name:       "invalid-build",
+				Platform:   "windows",
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: payload,
+			})
+			if err == nil || !IsClientValidationError(err) {
+				t.Fatalf("Create(%s) error = %v, want ClientValidationError", payload, err)
+			}
+		})
+		t.Run(fmt.Sprintf("preset-%d", index), func(t *testing.T) {
+			err := (&CustomPresetService{}).Create(&model.CustomPreset{
+				UserId:     uint(index + 1),
+				Name:       fmt.Sprintf("invalid-preset-%d", index),
+				Platform:   "windows",
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: payload,
+			})
+			if err == nil || !IsClientValidationError(err) {
+				t.Fatalf("Create(%s) error = %v, want ClientValidationError", payload, err)
+			}
+		})
+	}
+
+	build := &model.CustomBuild{
+		Name:       "valid-build",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: `{"server_ip":"id.example:21116","enable_audio":false,"company_name":"DeskForge"}`,
+	}
+	if err := (&CustomBuildService{}).Create(build); err != nil {
+		t.Fatalf("valid build Create() error = %v", err)
+	}
+	preset := &model.CustomPreset{
+		UserId:     100,
+		Name:       "valid-preset",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: `{"relay_server":"relay.example:21117","enable_terminal":true}`,
+	}
+	if err := (&CustomPresetService{}).Create(preset); err != nil {
+		t.Fatalf("valid preset Create() error = %v", err)
+	}
+	var buildCount, presetCount int64
+	if err := db.Model(&model.CustomBuild{}).Count(&buildCount).Error; err != nil {
+		t.Fatalf("count valid builds: %v", err)
+	}
+	if err := db.Model(&model.CustomPreset{}).Count(&presetCount).Error; err != nil {
+		t.Fatalf("count valid presets: %v", err)
+	}
+	if buildCount != 1 || presetCount != 1 {
+		t.Fatalf("valid direct saves counts = builds %d, presets %d; want one each", buildCount, presetCount)
+	}
+}
+
+func TestCustomPresetCreateUpdateCanonicalizeAndPreserveUpsert(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	service := &CustomPresetService{}
+	preset := &model.CustomPreset{
+		UserId:     9,
+		Name:       "shared-name",
+		Platform:   "android",
+		Version:    "1.0.0",
+		AppName:    "rustqs",
+		CustomJson: `{"android_app_id":"com.example.rustqs","enable_audio":false}`,
+	}
+	if err := service.Create(preset); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+	firstID := preset.Id
+	var created map[string]any
+	if err := json.Unmarshal([]byte(preset.CustomJson), &created); err != nil {
+		t.Fatal(err)
+	}
+	assertCanonicalPersistedJSON(t, created)
+
+	replacement := &model.CustomPreset{
+		UserId:     9,
+		Name:       "shared-name",
+		Platform:   "android",
+		Version:    "2.0.0",
+		AppName:    "rustqs",
+		CustomJson: `{"android_app_id":"com.example.client","relay_server":"relay.example:21117"}`,
+	}
+	if err := service.Create(replacement); err != nil {
+		t.Fatalf("upsert Create() error = %v", err)
+	}
+	if replacement.Id != firstID {
+		t.Fatalf("upsert id = %d, want existing id %d", replacement.Id, firstID)
+	}
+	var count int64
+	if err := db.Model(&model.CustomPreset{}).Where("user_id = ? AND name = ?", 9, "shared-name").Count(&count).Error; err != nil {
+		t.Fatal(err)
+	}
+	if count != 1 {
+		t.Fatalf("upsert row count = %d, want 1", count)
+	}
+
+	replacement.CustomJson = `{"android_app_id":"com.example.client"}`
+	if err := service.Update(replacement); err != nil {
+		t.Fatalf("Update() error = %v", err)
+	}
+	var stored model.CustomPreset
+	if err := db.First(&stored, firstID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if stored.CustomJson != replacement.CustomJson || stored.AppName != "rustqs" {
+		t.Fatalf("valid Android custom_json was not saved without clearing the required output name: %#v", stored)
+	}
+	replacement.CustomJson = `{"custom_txt":"raw"}`
+	if err := service.Update(replacement); err == nil || !IsClientValidationError(err) {
+		t.Fatalf("invalid preset Update() error = %v, want ClientValidationError", err)
+	}
+	var unchanged model.CustomPreset
+	if err := db.First(&unchanged, firstID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if unchanged.CustomJson != `{"android_app_id":"com.example.client"}` {
+		t.Fatalf("invalid preset update changed persisted custom_json to %q", unchanged.CustomJson)
+	}
+}
+
+func TestCustomPresetAndroidAppIDRequiredForCreateAndUpdate(t *testing.T) {
+	tests := []struct {
+		name       string
+		customJSON string
+		wantErr    bool
+	}{
+		{name: "missing", customJSON: `{}`, wantErr: true},
+		{name: "invalid", customJSON: `{"android_app_id":"Com.Example.Client"}`, wantErr: true},
+		{name: "valid", customJSON: `{"android_app_id":"com.example.client"}`},
+	}
+
+	for _, test := range tests {
+		t.Run("create/"+test.name, func(t *testing.T) {
+			db := newCustomPersistenceDB(t)
+			preset := &model.CustomPreset{
+				UserId:     31,
+				Name:       "android-create-" + test.name,
+				Platform:   string(PlatformAndroid),
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: test.customJSON,
+			}
+			err := (&CustomPresetService{}).Create(preset)
+			if (err != nil) != test.wantErr {
+				t.Fatalf("Create() error = %v, wantErr %v", err, test.wantErr)
+			}
+			if test.wantErr && !IsClientValidationError(err) {
+				t.Fatalf("Create() error type = %T, want ClientValidationError", err)
+			}
+			var count int64
+			if err := db.Model(&model.CustomPreset{}).Where("name = ?", preset.Name).Count(&count).Error; err != nil {
+				t.Fatalf("count presets: %v", err)
+			}
+			if count != map[bool]int64{true: 0, false: 1}[test.wantErr] {
+				t.Fatalf("preset count = %d, want %d", count, map[bool]int64{true: 0, false: 1}[test.wantErr])
+			}
+		})
+
+		t.Run("update/"+test.name, func(t *testing.T) {
+			db := newCustomPersistenceDB(t)
+			preset := &model.CustomPreset{
+				UserId:     32,
+				Name:       "android-update-" + test.name,
+				Platform:   string(PlatformAndroid),
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: `{"android_app_id":"com.example.original"}`,
+			}
+			if err := (&CustomPresetService{}).Create(preset); err != nil {
+				t.Fatalf("seed Create() error = %v", err)
+			}
+			preset.CustomJson = test.customJSON
+			err := (&CustomPresetService{}).Update(preset)
+			if (err != nil) != test.wantErr {
+				t.Fatalf("Update() error = %v, wantErr %v", err, test.wantErr)
+			}
+			if test.wantErr && !IsClientValidationError(err) {
+				t.Fatalf("Update() error type = %T, want ClientValidationError", err)
+			}
+			var stored model.CustomPreset
+			if err := db.First(&stored, preset.Id).Error; err != nil {
+				t.Fatalf("read preset: %v", err)
+			}
+			wantJSON := test.customJSON
+			if test.wantErr {
+				wantJSON = `{"android_app_id":"com.example.original"}`
+			}
+			if stored.CustomJson != wantJSON {
+				t.Fatalf("stored custom_json = %q, want %q", stored.CustomJson, wantJSON)
+			}
+		})
+	}
+}
+
+func TestCustomPresetLegacyAndroidReadAndMigrationCompatibility(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	legacyJSON := `{"enable_audio":true}`
+	legacy := &model.CustomPreset{
+		UserId:     41,
+		Name:       "legacy-android",
+		Platform:   string(PlatformAndroid),
+		Version:    "1.0.0",
+		AppName:    "rustqs",
+		CustomJson: legacyJSON,
+	}
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(legacy).Error; err != nil {
+		t.Fatalf("seed legacy preset: %v", err)
+	}
+
+	service := &CustomPresetService{}
+	loaded, err := service.Info(legacy.Id)
+	if err != nil {
+		t.Fatalf("read legacy preset: %v", err)
+	}
+	if loaded.CustomJson != legacyJSON {
+		t.Fatalf("legacy read custom_json = %q, want %q", loaded.CustomJson, legacyJSON)
+	}
+	list, err := service.ListByUser(1, 10, legacy.UserId)
+	if err != nil {
+		t.Fatalf("list legacy preset: %v", err)
+	}
+	if len(list.CustomPresets) != 1 || list.CustomPresets[0].CustomJson != legacyJSON {
+		t.Fatalf("legacy list = %#v, want one unchanged preset", list.CustomPresets)
+	}
+
+	if _, err := NormalizeCustomBuildJSON(legacyJSON, BuildRecordContext{
+		Platform:                 legacy.Platform,
+		AppName:                  legacy.AppName,
+		Version:                  legacy.Version,
+		AllowMissingAndroidAppID: true,
+	}); err != nil {
+		t.Fatalf("legacy migration normalization rejected missing Android identity: %v", err)
+	}
+}
+
+func TestCustomPresetWindowsAndLinuxRemainValidWithoutAndroidAppID(t *testing.T) {
+	for _, platform := range []Platform{PlatformWindows, PlatformLinux} {
+		t.Run(string(platform), func(t *testing.T) {
+			newCustomPersistenceDB(t)
+			preset := &model.CustomPreset{
+				UserId:     51,
+				Name:       string(platform) + "-preset",
+				Platform:   string(platform),
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: `{"enable_audio":false}`,
+			}
+			service := &CustomPresetService{}
+			if err := service.Create(preset); err != nil {
+				t.Fatalf("Create() error = %v", err)
+			}
+			preset.CustomJson = `{"enable_audio":true}`
+			if err := service.Update(preset); err != nil {
+				t.Fatalf("Update() error = %v", err)
+			}
+		})
+	}
+}
+
+func TestCustomBuildProgressUpdateDoesNotModifyCustomJSON(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	legacyJSON := `{"legacy_field":"opaque","custom_txt":"legacy"}`
+	build := &model.CustomBuild{
+		Name:             "legacy-build",
+		Platform:         "windows",
+		Version:          "legacy",
+		AppName:          "legacy-app",
+		CustomJson:       legacyJSON,
+		Status:           model.CustomBuildStatusBuilding,
+		BuildLog:         "initial",
+		FileSize:         42,
+		GithubRunId:      99,
+		GithubArtifactID: 7,
+	}
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(build).Error; err != nil {
+		t.Fatalf("seed legacy build: %v", err)
+	}
+	recordValidPublication(t, build)
+	if err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:            build.Id,
+		ExpectedRunID:      build.GithubRunId,
+		ExpectedArtifactID: build.GithubArtifactID,
+		Status:             model.CustomBuildStatusDone,
+		BuildLog:           "completed",
+		FileSize:           0,
+	}); err != nil {
+		t.Fatalf("UpdateProgress() error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatal(err)
+	}
+	if stored.Status != model.CustomBuildStatusDone || stored.BuildLog != "completed" || stored.FileSize != 0 || stored.GithubRunId != 99 || stored.PublicationRecordedAt <= 0 {
+		t.Fatalf("progress fields were not updated, including zero values: %#v", stored)
+	}
+	if stored.CustomJson != legacyJSON || stored.Platform != "windows" || stored.Version != "1.2.3" || stored.AppName != "legacy-app" {
+		t.Fatalf("progress update changed user-authored fields: %#v", stored)
+	}
+}
+
+func TestCustomBuildDeleteRemovesRowEvenWhenArtifactCleanupFails(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	previousRemove := removeBuildOutputDir
+	removeBuildOutputDir = func(string) error { return errors.New("simulated cleanup failure") }
+	t.Cleanup(func() { removeBuildOutputDir = previousRemove })
+
+	err := (&CustomBuildService{}).Delete(build)
+	var cleanupPending *CustomBuildCleanupPending
+	if !errors.As(err, &cleanupPending) {
+		t.Fatalf("Delete() error = %T %v, want cleanup-pending status", err, err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; !errors.Is(err, gorm.ErrRecordNotFound) {
+		t.Fatalf("read build after successful DB delete: error = %v, want record-not-found", err)
+	}
+	tombstone := buildOutputDeletionTombstonePath(filepath.Dir(BuildOutputDir(build.Id)), build.Id)
+	if _, err := os.Stat(tombstone); err != nil {
+		t.Fatalf("cleanup tombstone stat = %v, want retained marker", err)
+	}
+}
+
+func TestCustomBuildDeleteCreatesAndRemovesCleanupTombstone(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0700); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "artifact.bin"), []byte("artifact"), 0600); err != nil {
+		t.Fatalf("write artifact: %v", err)
+	}
+	tombstone := buildOutputDeletionTombstonePath(filepath.Dir(outDir), build.Id)
+	callbackName := "test:check-custom-build-delete-tombstone-" + strings.ReplaceAll(t.Name(), "/", "-")
+	if err := db.Callback().Delete().Before("gorm:delete").Register(callbackName, func(tx *gorm.DB) {
+		if _, err := os.Stat(tombstone); err != nil {
+			tx.AddError(fmt.Errorf("deletion tombstone was not created before DB delete: %w", err))
+		}
+	}); err != nil {
+		t.Fatalf("register tombstone callback: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Callback().Delete().Remove(callbackName) })
+
+	if err := (&CustomBuildService{}).Delete(build); err != nil {
+		t.Fatalf("Delete() error = %v, want nil", err)
+	}
+	if _, err := os.Stat(tombstone); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("cleanup tombstone stat = %v, want removed", err)
+	}
+	if _, err := os.Stat(outDir); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("output directory stat = %v, want removed", err)
+	}
+}
+
+func TestCustomBuildDeleteReturnsPendingWhenTombstoneRemovalFails(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	previousRemove := removeBuildOutputDeletionTombstone
+	removeBuildOutputDeletionTombstone = func(string) error { return errors.New("simulated tombstone removal failure") }
+	t.Cleanup(func() { removeBuildOutputDeletionTombstone = previousRemove })
+
+	err := (&CustomBuildService{}).Delete(build)
+	var cleanupPending *CustomBuildCleanupPending
+	if !errors.As(err, &cleanupPending) {
+		t.Fatalf("Delete() error = %T %v, want cleanup-pending status", err, err)
+	}
+	tombstone := buildOutputDeletionTombstonePath(filepath.Dir(BuildOutputDir(build.Id)), build.Id)
+	if _, err := os.Stat(tombstone); err != nil {
+		t.Fatalf("cleanup tombstone stat = %v, want retained marker", err)
+	}
+}
+
+func TestCustomBuildDeleteRetainsRowAndArtifactWhenDBDeleteFails(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	artifact := filepath.Join(outDir, "rustqs.exe")
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create artifact directory: %v", err)
+	}
+	if err := os.WriteFile(artifact, []byte("must remain accessible"), 0600); err != nil {
+		t.Fatalf("write artifact: %v", err)
+	}
+
+	wantErr := errors.New("simulated database delete failure")
+	callbackName := "test:fail-custom-build-delete-" + strings.ReplaceAll(t.Name(), "/", "-")
+	if err := db.Callback().Delete().Before("gorm:delete").Register(callbackName, func(tx *gorm.DB) {
+		tx.AddError(wantErr)
+	}); err != nil {
+		t.Fatalf("register delete failure callback: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Callback().Delete().Remove(callbackName) })
+
+	if err := (&CustomBuildService{}).Delete(build); !errors.Is(err, wantErr) {
+		t.Fatalf("Delete() error = %v, want %v", err, wantErr)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build after failed DB delete: %v", err)
+	}
+	if contents, err := os.ReadFile(artifact); err != nil || string(contents) != "must remain accessible" {
+		t.Fatalf("artifact after failed DB delete = %q, error = %v; want accessible artifact", contents, err)
+	}
+	tombstone := buildOutputDeletionTombstonePath(filepath.Dir(outDir), build.Id)
+	if _, err := os.Stat(tombstone); err != nil {
+		t.Fatalf("cleanup tombstone after failed DB delete = %v, want marker", err)
+	}
+}
+
+func TestCustomBuildDeleteDoesNotClassifyPostDeleteDatabaseUncertaintyAsCleanupPending(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := (&CustomBuildService{}).Delete(build); err != nil {
+		var cleanupPending *CustomBuildCleanupPending
+		if errors.As(err, &cleanupPending) {
+			t.Fatalf("Delete() error = %T %v, cleanup-pending must only represent filesystem failures after DB delete", err, err)
+		}
+		t.Fatalf("Delete() error = %v, want nil after successful DB delete and filesystem cleanup", err)
+	}
+}
+
+func TestCustomBuildDeleteReturnsOrdinaryErrorWhenTombstonePrecreationFails(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusDone}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	previousOutputDir := BuildOutputDir
+	BuildOutputDir = func(uint) string { return filepath.Join(t.TempDir(), "invalid\x00root", "1") }
+	t.Cleanup(func() { BuildOutputDir = previousOutputDir })
+
+	err := (&CustomBuildService{}).Delete(build)
+	var cleanupPending *CustomBuildCleanupPending
+	if errors.As(err, &cleanupPending) {
+		t.Fatalf("Delete() error = %T %v, tombstone precreation failure must remain ordinary", err, err)
+	}
+	if err == nil {
+		t.Fatal("Delete() error = nil, want tombstone precreation failure")
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build after tombstone precreation failure: %v", err)
+	}
+}
+
+func TestRecordPublishedOutputValidatesContentAndWritesMarkerOnce(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Status:              model.CustomBuildStatusExtracting,
+		Platform:            "windows",
+		Version:             "1.2.3",
+		AppName:             "rustqs",
+		BuildRef:            strings.Repeat("a", 40),
+		SourceTag:           "1.2.3",
+		AssetsRelease:       "offline-assets-1.2.3",
+		AssetsReleaseID:     12,
+		GithubRunId:         17,
+		GithubProvider:      "github",
+		GithubRepo:          "owner/repo",
+		GithubWorkflow:      "workflow.yml",
+		WorkflowSelector:    defaultWorkflowExecutionRef,
+		GithubRef:           strings.Repeat("a", 40),
+		GithubArtifactName:  "artifact",
+		GithubArtifactID:    42,
+		GithubRunUrl:        "https://api.github.com/repos/owner/repo/actions/runs/17",
+		GithubHtmlUrl:       "https://github.com/owner/repo/actions/runs/17",
+		AssetsReleaseAssets: string(mustTestReleaseAssetsJSON(t)),
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	decoyDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(decoyDir, "rustqs.exe"), []byte("caller-selected"), 0600); err != nil {
+		t.Fatalf("write decoy output: %v", err)
+	}
+	if err := (&CustomBuildService{}).RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err == nil {
+		t.Fatal("RecordPublishedOutput() error = nil for missing canonical output, want validation failure")
+	}
+
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create canonical output: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("published"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	service := &CustomBuildService{}
+	if err := service.RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err != nil {
+		t.Fatalf("RecordPublishedOutput() valid output error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read marked build: %v", err)
+	}
+	if stored.PublicationRecordedAt <= 0 {
+		t.Fatalf("publication marker = %d, want positive timestamp", stored.PublicationRecordedAt)
+	}
+	if !validPublishedDigest(stored.PublishedDigest) {
+		t.Fatalf("published digest = %q, want SHA-256 hex", stored.PublishedDigest)
+	}
+	marker := stored.PublicationRecordedAt
+	digest := stored.PublishedDigest
+	if err := service.RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err != nil {
+		t.Fatalf("RecordPublishedOutput() idempotent retry error = %v", err)
+	}
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read retried build: %v", err)
+	}
+	if stored.PublicationRecordedAt != marker {
+		t.Fatalf("publication marker changed from %d to %d", marker, stored.PublicationRecordedAt)
+	}
+	if stored.PublishedDigest != digest {
+		t.Fatalf("published digest changed from %q to %q", digest, stored.PublishedDigest)
+	}
+}
+
+func TestRecordPublishedOutputRejectsPartialProvenance(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Status:           model.CustomBuildStatusExtracting,
+		Platform:         "windows",
+		GithubRunId:      17,
+		GithubArtifactID: 42,
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("published"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	if err := (&CustomBuildService{}).RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err == nil {
+		t.Fatal("RecordPublishedOutput() error = nil for partial provenance")
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.PublicationRecordedAt != 0 || stored.PublishedDigest != "" {
+		t.Fatalf("partial provenance recorded publication proof: %#v", stored)
+	}
+}
+
+func TestPublishedOutputDigestMismatchFailsClosed(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Status:              model.CustomBuildStatusExtracting,
+		Platform:            "windows",
+		Version:             "1.2.3",
+		AppName:             "rustqs",
+		BuildRef:            strings.Repeat("a", 40),
+		SourceTag:           "1.2.3",
+		AssetsRelease:       "offline-assets-1.2.3",
+		AssetsReleaseID:     12,
+		GithubRunId:         18,
+		GithubProvider:      "github",
+		GithubRepo:          "owner/repo",
+		GithubWorkflow:      "workflow.yml",
+		WorkflowSelector:    defaultWorkflowExecutionRef,
+		GithubRef:           strings.Repeat("a", 40),
+		GithubArtifactName:  "artifact",
+		GithubArtifactID:    42,
+		GithubRunUrl:        "https://api.github.com/repos/owner/repo/actions/runs/18",
+		GithubHtmlUrl:       "https://github.com/owner/repo/actions/runs/18",
+		AssetsReleaseAssets: string(mustTestReleaseAssetsJSON(t)),
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	path := filepath.Join(outDir, "rustqs.exe")
+	if err := os.WriteFile(path, []byte("published"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	service := &CustomBuildService{}
+	if err := service.RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err != nil {
+		t.Fatalf("RecordPublishedOutput() error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read recorded build: %v", err)
+	}
+	if err := os.WriteFile(path, []byte("mutated!"), 0600); err != nil {
+		t.Fatalf("mutate output: %v", err)
+	}
+	stored.Status = model.CustomBuildStatusDone
+	if _, err := ValidatePublishedOutputDigest(&stored); err == nil {
+		t.Fatal("ValidatePublishedOutputDigest() error = nil after output mutation")
+	}
+}
+
+func TestPublishedOutputDigestBindsImmutablePublicationIdentity(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Status:              model.CustomBuildStatusExtracting,
+		Platform:            "windows",
+		Version:             "1.2.3",
+		AppName:             "rustqs",
+		BuildRef:            strings.Repeat("a", 40),
+		SourceTag:           "1.2.3",
+		AssetsRelease:       "offline-assets-1.2.3",
+		AssetsReleaseID:     12,
+		GithubRunId:         18,
+		GithubProvider:      "github",
+		GithubRepo:          "owner/repo",
+		GithubWorkflow:      "workflow.yml",
+		WorkflowSelector:    defaultWorkflowExecutionRef,
+		GithubRef:           strings.Repeat("a", 40),
+		GithubArtifactName:  "artifact",
+		GithubArtifactID:    42,
+		GithubRunUrl:        "https://api.github.com/repos/owner/repo/actions/runs/18",
+		GithubHtmlUrl:       "https://github.com/owner/repo/actions/runs/18",
+		AssetsReleaseAssets: string(mustTestReleaseAssetsJSON(t)),
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(outDir, "rustqs.exe"), []byte("published"), 0600); err != nil {
+		t.Fatalf("write output: %v", err)
+	}
+	if err := (&CustomBuildService{}).RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err != nil {
+		t.Fatalf("record publication: %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read recorded build: %v", err)
+	}
+	for name, mutate := range map[string]func(*model.CustomBuild){
+		"run":      func(b *model.CustomBuild) { b.GithubRunId++ },
+		"artifact": func(b *model.CustomBuild) { b.GithubArtifactID++ },
+		"repo":     func(b *model.CustomBuild) { b.GithubRepo = "owner/other" },
+		"name":     func(b *model.CustomBuild) { b.GithubArtifactName = "other-artifact" },
+		"ref":      func(b *model.CustomBuild) { b.GithubRef = strings.Repeat("b", 40) },
+	} {
+		t.Run(name, func(t *testing.T) {
+			mutated := stored
+			mutate(&mutated)
+			if _, err := ValidatePublishedOutputProof(&mutated); err == nil {
+				t.Fatal("ValidatePublishedOutputProof() succeeded after immutable publication identity mutation")
+			}
+		})
+	}
+}
+
+func TestPublishedOutputDigestIsStableForEntryOrder(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Platform: "linux", AppName: "rustqs"}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create output directory: %v", err)
+	}
+	write := func(name, contents string) {
+		t.Helper()
+		if err := os.WriteFile(filepath.Join(outDir, name), []byte(contents), 0600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+	write("z.bin", "last")
+	write("a.bin", "first")
+	first, err := PublishedOutputDigest(build)
+	if err != nil {
+		t.Fatalf("first digest: %v", err)
+	}
+	if err := os.RemoveAll(outDir); err != nil {
+		t.Fatalf("remove output: %v", err)
+	}
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("recreate output directory: %v", err)
+	}
+	write("a.bin", "first")
+	write("z.bin", "last")
+	second, err := PublishedOutputDigest(build)
+	if err != nil {
+		t.Fatalf("second digest: %v", err)
+	}
+	if first != second {
+		t.Fatalf("published digest changed with entry order: %q != %q", first, second)
+	}
+}
+
+func TestCustomBuildProgressUpdateTreatsZeroRowsAsPersistenceError(t *testing.T) {
+	newCustomPersistenceDB(t)
+
+	err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:            404,
+		ExpectedRunID:      404,
+		ExpectedArtifactID: 1,
+		Status:             model.CustomBuildStatusDone,
+		BuildLog:           "completed",
+		FileSize:           1,
+	})
+	if err == nil {
+		t.Fatal("UpdateProgress() error = nil, want persistence error for missing build")
+	}
+	var persistenceErr *BuildProgressPersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("UpdateProgress() error = %T %v, want BuildProgressPersistenceError", err, err)
+	}
+}
+
+func TestCustomBuildProgressDoneRequiresStoredArtifactIdentity(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Status:           model.CustomBuildStatusExtracting,
+		Platform:         "windows",
+		AppName:          "rustqs",
+		GithubRunId:      909,
+		GithubArtifactID: 0,
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+
+	err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:            build.Id,
+		ExpectedRunID:      build.GithubRunId,
+		ExpectedArtifactID: 0,
+		Status:             model.CustomBuildStatusDone,
+		BuildLog:           "must not complete without artifact identity",
+	})
+	var persistenceErr *BuildProgressPersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("UpdateProgress() error = %T %v, want guarded persistence error", err, err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build after rejected completion: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusExtracting || stored.BuildLog != "" {
+		t.Fatalf("rejected completion changed build: %#v", stored)
+	}
+
+	if err := db.Model(&model.CustomBuild{}).Where("id = ?", build.Id).Update("github_artifact_id", 42).Error; err != nil {
+		t.Fatalf("store artifact identity: %v", err)
+	}
+	build.GithubArtifactID = 42
+	recordValidPublication(t, build)
+	err = (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:            build.Id,
+		ExpectedRunID:      build.GithubRunId,
+		ExpectedArtifactID: 99,
+		Status:             model.CustomBuildStatusDone,
+		BuildLog:           "wrong artifact must not complete",
+	})
+	if err == nil {
+		t.Fatal("UpdateProgress() with wrong artifact identity = nil, want guarded persistence error")
+	}
+	var persistenceErrWrongArtifact *BuildProgressPersistenceError
+	if !errors.As(err, &persistenceErrWrongArtifact) {
+		t.Fatalf("wrong artifact error = %T %v, want guarded persistence error", err, err)
+	}
+	if err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:            build.Id,
+		ExpectedRunID:      build.GithubRunId,
+		ExpectedArtifactID: 42,
+		Status:             model.CustomBuildStatusDone,
+		BuildLog:           "completed",
+	}); err != nil {
+		t.Fatalf("UpdateProgress() with stored artifact identity = %v", err)
+	}
+}
+
+func TestCustomBuildProgressDoneRequiresRecordedPublication(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusExtracting, Platform: "windows", AppName: "rustqs", GithubRunId: 909, GithubArtifactID: 42}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:            build.Id,
+		ExpectedRunID:      build.GithubRunId,
+		ExpectedArtifactID: build.GithubArtifactID,
+		Status:             model.CustomBuildStatusDone,
+		BuildLog:           "published without marker",
+	})
+	var persistenceErr *BuildProgressPersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("UpdateProgress() error = %T %v, want publication marker rejection", err, err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if stored.Status != model.CustomBuildStatusExtracting || stored.BuildLog != "" {
+		t.Fatalf("marker rejection changed build: %#v", stored)
+	}
+}
+
+func TestCustomBuildProgressBoundsBuildLog(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, Platform: "windows", AppName: "rustqs", GithubRunId: 909, GithubArtifactID: 42}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("create build: %v", err)
+	}
+	if err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+		BuildID:       build.Id,
+		ExpectedRunID: build.GithubRunId,
+		Status:        model.CustomBuildStatusBuilding,
+		BuildLog:      strings.Repeat("x", MaxBuildLogBytes+100),
+	}); err != nil {
+		t.Fatalf("UpdateProgress() error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build: %v", err)
+	}
+	if len(stored.BuildLog) != MaxBuildLogBytes {
+		t.Fatalf("stored build log length = %d, want %d", len(stored.BuildLog), MaxBuildLogBytes)
+	}
+}
+
+func TestCustomBuildProgressRejectsStaleRunUpdates(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	cases := []struct {
+		name          string
+		status        string
+		storedRunID   int64
+		staleRunID    int64
+		attemptStatus string
+		wantStatus    string
+	}{
+		{
+			name:          "done row cannot be overwritten",
+			status:        model.CustomBuildStatusDone,
+			storedRunID:   101,
+			staleRunID:    100,
+			attemptStatus: model.CustomBuildStatusFailed,
+			wantStatus:    model.CustomBuildStatusDone,
+		},
+		{
+			name:          "failed row cannot be overwritten",
+			status:        model.CustomBuildStatusFailed,
+			storedRunID:   202,
+			staleRunID:    201,
+			attemptStatus: model.CustomBuildStatusDone,
+			wantStatus:    model.CustomBuildStatusFailed,
+		},
+		{
+			name:          "another run cannot update building row",
+			status:        model.CustomBuildStatusBuilding,
+			storedRunID:   303,
+			staleRunID:    304,
+			attemptStatus: model.CustomBuildStatusDone,
+			wantStatus:    model.CustomBuildStatusBuilding,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			build := &model.CustomBuild{
+				Status:           tc.status,
+				GithubRunId:      tc.storedRunID,
+				GithubArtifactID: 1,
+			}
+			if err := db.Create(build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+				BuildID:            build.Id,
+				ExpectedRunID:      tc.staleRunID,
+				ExpectedArtifactID: 1,
+				Status:             tc.attemptStatus,
+				BuildLog:           "stale update",
+			})
+			var persistenceErr *BuildProgressPersistenceError
+			if !errors.As(err, &persistenceErr) {
+				t.Fatalf("UpdateProgress() error = %T %v, want typed zero-row persistence error", err, err)
+			}
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if stored.Status != tc.wantStatus || stored.BuildLog != "" {
+				t.Fatalf("stale update changed row: status=%q log=%q", stored.Status, stored.BuildLog)
+			}
+		})
+	}
+}
+
+func TestCustomBuildProgressSupportsDownloadLifecycleStatesWithRunGuard(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	for _, current := range []string{model.CustomBuildStatusDownloading, model.CustomBuildStatusExtracting} {
+		t.Run(current, func(t *testing.T) {
+			build := &model.CustomBuild{Status: current, Platform: "windows", AppName: "rustqs", GithubRunId: 909, GithubArtifactID: 42}
+			if err := db.Create(build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			if current == model.CustomBuildStatusDownloading || current == model.CustomBuildStatusExtracting {
+				recordValidPublication(t, build)
+			}
+			if err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+				BuildID: build.Id, ExpectedRunID: build.GithubRunId,
+				ExpectedArtifactID: build.GithubArtifactID,
+				Status:             model.CustomBuildStatusDone, BuildLog: "published",
+			}); err != nil {
+				t.Fatalf("UpdateProgress() lifecycle transition error = %v", err)
+			}
+			staleErr := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+				BuildID: build.Id, ExpectedRunID: build.GithubRunId - 1,
+				Status: model.CustomBuildStatusFailed, BuildLog: "stale",
+			})
+			var persistenceErr *BuildProgressPersistenceError
+			if !errors.As(staleErr, &persistenceErr) {
+				t.Fatalf("stale lifecycle update error = %T %v, want guarded persistence error", staleErr, staleErr)
+			}
+		})
+	}
+}
+
+func TestCustomBuildProgressCannotTransitionLinuxOrAndroidToDone(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	for _, platform := range []string{"linux", "android"} {
+		t.Run(platform, func(t *testing.T) {
+			build := &model.CustomBuild{Status: model.CustomBuildStatusExtracting, Platform: platform, GithubRunId: 909, GithubArtifactID: 42}
+			if err := db.Create(build).Error; err != nil {
+				t.Fatalf("create build: %v", err)
+			}
+			err := (&CustomBuildService{}).UpdateProgress(BuildProgress{
+				BuildID: build.Id, ExpectedRunID: build.GithubRunId,
+				ExpectedArtifactID: build.GithubArtifactID,
+				Status:             model.CustomBuildStatusDone, BuildLog: "must remain non-done",
+			})
+			var unavailable *ProductionCapabilityUnavailableError
+			if !errors.As(err, &unavailable) {
+				t.Fatalf("UpdateProgress() error = %T %v, want capability-unavailable error", err, err)
+			}
+			var stored model.CustomBuild
+			if err := db.First(&stored, build.Id).Error; err != nil {
+				t.Fatalf("read build: %v", err)
+			}
+			if stored.Status != model.CustomBuildStatusExtracting {
+				t.Fatalf("status after rejected completion = %q, want extracting", stored.Status)
+			}
+		})
+	}
+}
+
+func TestCustomBuildPendingFailureUsesExplicitUndispatchedGuard(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	pending := &model.CustomBuild{Status: model.CustomBuildStatusPending}
+	building := &model.CustomBuild{Status: model.CustomBuildStatusBuilding, GithubRunId: 505}
+	if err := db.Create(pending).Error; err != nil {
+		t.Fatalf("create pending build: %v", err)
+	}
+	if err := db.Create(building).Error; err != nil {
+		t.Fatalf("create building build: %v", err)
+	}
+	if err := (&CustomBuildService{}).UpdatePendingFailure(BuildProgress{
+		BuildID:  pending.Id,
+		Status:   model.CustomBuildStatusFailed,
+		BuildLog: "pre-dispatch failure",
+	}); err != nil {
+		t.Fatalf("UpdatePendingFailure() error = %v", err)
+	}
+	err := (&CustomBuildService{}).UpdatePendingFailure(BuildProgress{
+		BuildID:  building.Id,
+		Status:   model.CustomBuildStatusFailed,
+		BuildLog: "must not bypass run guard",
+	})
+	var persistenceErr *BuildProgressPersistenceError
+	if !errors.As(err, &persistenceErr) {
+		t.Fatalf("building pending-failure error = %T %v, want typed zero-row persistence error", err, err)
+	}
+	var storedPending, storedBuilding model.CustomBuild
+	if err := db.First(&storedPending, pending.Id).Error; err != nil {
+		t.Fatalf("read pending build: %v", err)
+	}
+	if err := db.First(&storedBuilding, building.Id).Error; err != nil {
+		t.Fatalf("read building build: %v", err)
+	}
+	if storedPending.Status != model.CustomBuildStatusFailed || storedBuilding.Status != model.CustomBuildStatusBuilding {
+		t.Fatalf("pending guard results: pending=%q building=%q", storedPending.Status, storedBuilding.Status)
+	}
+}
+
+func TestCustomBuildUpdateValidatedRejectsZeroIDBeforePersistence(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Platform:   "linux",
+		Version:    "1.2.3",
+		CustomJson: `{"enable_audio":true}`,
+	}
+
+	err := (&CustomBuildService{}).UpdateValidated(build)
+	if err == nil || !IsClientValidationError(err) {
+		t.Fatalf("UpdateValidated() error = %v, want ClientValidationError", err)
+	}
+	if got := err.Error(); got != "build id is required" {
+		t.Fatalf("UpdateValidated() error = %q, want build id validation error", got)
+	}
+	var count int64
+	if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+		t.Fatalf("count builds after rejected update: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("zero-id update inserted %d row(s)", count)
+	}
+}
+
+func TestCustomBuildUpdateValidatedAllowlistPreservesProvenance(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Name:               "validated-build",
+		Platform:           "linux",
+		Version:            "1.2.3",
+		AppName:            "rustqs",
+		CustomJson:         `{"enable_audio":true}`,
+		Status:             model.CustomBuildStatusBuilding,
+		FileSize:           42,
+		GithubRunId:        77,
+		GithubProvider:     "github",
+		GithubRepo:         "owner/repo",
+		GithubWorkflow:     "workflow.yml",
+		GithubRef:          "ref",
+		GithubArtifactName: "artifact",
+		GithubArtifactID:   88,
+		GithubRunUrl:       "https://api.github.com/repos/owner/repo/actions/runs/77",
+		GithubHtmlUrl:      "https://github.com/owner/repo/actions/runs/77",
+		GithubSourceSha:    strings.Repeat("a", 40),
+	}
+	if _, err := (&CustomBuildService{}).CreateNormalized(build); err != nil {
+		t.Fatalf("CreateNormalized() error = %v", err)
+	}
+
+	build.CustomJson = ""
+	build.Status = ""
+	build.FileSize = 0
+	if err := (&CustomBuildService{}).UpdateValidated(build); err != nil {
+		t.Fatalf("UpdateValidated() error = %v", err)
+	}
+	var stored model.CustomBuild
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read validated build: %v", err)
+	}
+	if stored.CustomJson != "" || stored.Status != model.CustomBuildStatusBuilding || stored.FileSize != 42 {
+		t.Fatalf("validated zero values were not saved: %#v", stored)
+	}
+	if stored.GithubRunId != 77 || stored.GithubArtifactID != 88 || stored.GithubRepo != "owner/repo" || stored.GithubSourceSha != strings.Repeat("a", 40) {
+		t.Fatalf("validated update erased immutable provenance: %#v", stored)
+	}
+
+	build.CustomJson = `{"enable_audio":"false"}`
+	if err := (&CustomBuildService{}).UpdateValidated(build); err == nil || !IsClientValidationError(err) {
+		t.Fatalf("invalid UpdateValidated() error = %v, want ClientValidationError", err)
+	}
+	if err := db.First(&stored, build.Id).Error; err != nil {
+		t.Fatalf("read build after rejected update: %v", err)
+	}
+	if stored.CustomJson != "" {
+		t.Fatalf("rejected validated update changed custom_json to %q", stored.CustomJson)
+	}
+}
+
+func newCustomPersistenceDB(t *testing.T) *gorm.DB {
+	t.Helper()
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(&model.CustomBuild{}, &model.CustomPreset{}); err != nil {
+		t.Fatalf("migrate test models: %v", err)
+	}
+	previousDB := DB
+	previousOutputDir := BuildOutputDir
+	DB = db
+	outputRoot := t.TempDir()
+	BuildOutputDir = func(id uint) string { return filepath.Join(outputRoot, "output", fmt.Sprintf("%d", id)) }
+	t.Cleanup(func() {
+		DB = previousDB
+		BuildOutputDir = previousOutputDir
+		_ = sqlDB.Close()
+	})
+	return db
+}
+
+func mustTestReleaseAssetsJSON(t *testing.T) []byte {
+	t.Helper()
+	assetsJSON, err := json.Marshal(testReleaseAssets())
+	if err != nil {
+		t.Fatalf("marshal release assets: %v", err)
+	}
+	return assetsJSON
+}
+
+func recordValidPublication(t *testing.T, build *model.CustomBuild) {
+	t.Helper()
+	assetsJSON := mustTestReleaseAssetsJSON(t)
+	if build.Version == "" || build.Version == "legacy" {
+		build.Version = "1.2.3"
+	}
+	if build.BuildRef == "" {
+		build.BuildRef = strings.Repeat("a", 40)
+	}
+	if build.SourceTag == "" {
+		build.SourceTag = build.Version
+	}
+	if build.AssetsRelease == "" {
+		build.AssetsRelease = "offline-assets-" + build.Version
+	}
+	if build.AssetsReleaseID == 0 {
+		build.AssetsReleaseID = 12
+	}
+	if build.GithubProvider == "" {
+		build.GithubProvider = "github"
+	}
+	if build.GithubRepo == "" {
+		build.GithubRepo = "owner/repo"
+	}
+	if build.GithubWorkflow == "" {
+		build.GithubWorkflow = "workflow.yml"
+	}
+	if build.WorkflowSelector == "" {
+		build.WorkflowSelector = defaultWorkflowExecutionRef
+	}
+	if build.GithubRef == "" {
+		build.GithubRef = build.BuildRef
+	}
+	if build.GithubArtifactName == "" {
+		build.GithubArtifactName = "artifact"
+	}
+	if build.GithubRunUrl == "" {
+		build.GithubRunUrl = fmt.Sprintf("https://api.github.com/repos/%s/actions/runs/%d", build.GithubRepo, build.GithubRunId)
+	}
+	if build.GithubHtmlUrl == "" {
+		build.GithubHtmlUrl = fmt.Sprintf("https://github.com/%s/actions/runs/%d", build.GithubRepo, build.GithubRunId)
+	}
+	if err := DB.Model(&model.CustomBuild{}).Where("id = ?", build.Id).Updates(map[string]any{
+		"version": build.Version, "build_ref": build.BuildRef, "source_tag": build.SourceTag,
+		"assets_release": build.AssetsRelease, "assets_release_id": build.AssetsReleaseID,
+		"github_provider": build.GithubProvider, "github_repo": build.GithubRepo,
+		"github_workflow": build.GithubWorkflow, "workflow_selector": build.WorkflowSelector, "github_ref": build.GithubRef,
+		"assets_release_assets": string(assetsJSON),
+		"github_artifact_name":  build.GithubArtifactName, "github_run_url": build.GithubRunUrl,
+		"github_html_url": build.GithubHtmlUrl,
+	}).Error; err != nil {
+		t.Fatalf("seed publication provenance: %v", err)
+	}
+	outDir := BuildOutputDir(build.Id)
+	if err := os.MkdirAll(outDir, 0755); err != nil {
+		t.Fatalf("create canonical output: %v", err)
+	}
+	appName := build.AppName
+	if appName == "" {
+		appName = "rustqs"
+	}
+	if err := os.WriteFile(filepath.Join(outDir, appName+".exe"), []byte("published"), 0600); err != nil {
+		t.Fatalf("write published output: %v", err)
+	}
+	if err := (&CustomBuildService{}).RecordPublishedOutput(build.Id, build.GithubRunId, build.GithubArtifactID); err != nil {
+		t.Fatalf("RecordPublishedOutput() error = %v", err)
+	}
+}
+
+func assertCanonicalPersistedJSON(t *testing.T, value map[string]any) {
+	t.Helper()
+	if value["enable_audio"] == nil {
+		t.Error("canonical output omitted supported enable_audio")
+	}
+	for _, key := range []string{
+		"app_name", "version", "platform", "build_id", "future_field", "dead_field", "custom_txt",
+	} {
+		if _, ok := value[key]; ok {
+			t.Errorf("canonical output contains excluded field %q", key)
+		}
+	}
+}
+
+func TestCustomPresetLegacyUpdateRejectsUnknownFieldWithoutMutation(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	for _, test := range []struct {
+		name string
+		json string
+	}{
+		{name: "unknown legacy field", json: `{"enable_audio":false,"unknown_legacy_field":"not-guaranteed"}`},
+		{name: "raw custom txt", json: `{"custom_txt":"legacy-base64"}`},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			legacy := &model.CustomPreset{
+				UserId:     12,
+				Name:       "legacy-preset-" + test.name,
+				Platform:   "windows",
+				Version:    "1.0.0",
+				CustomJson: test.json,
+			}
+			if err := db.Session(&gorm.Session{SkipHooks: true}).Create(legacy).Error; err != nil {
+				t.Fatalf("seed legacy preset: %v", err)
+			}
+			loaded, err := (&CustomPresetService{}).Info(legacy.Id)
+			if err != nil {
+				t.Fatalf("read legacy preset: %v", err)
+			}
+			if loaded.CustomJson != test.json {
+				t.Fatalf("legacy read changed custom_json before update: %q", loaded.CustomJson)
+			}
+			loaded.Version = "2.0.0"
+			err = (&CustomPresetService{}).Update(loaded)
+			if err == nil || !IsClientValidationError(err) {
+				t.Fatalf("legacy preset Update() error = %v, want ClientValidationError", err)
+			}
+			var unchanged model.CustomPreset
+			if err := db.First(&unchanged, legacy.Id).Error; err != nil {
+				t.Fatalf("read rejected preset: %v", err)
+			}
+			if unchanged.CustomJson != test.json || unchanged.Version != "1.0.0" {
+				t.Fatalf("rejected update mutated row: %#v", unchanged)
+			}
+		})
+	}
+}
+
+func TestCustomPresetUpdateClearsPreviouslyPopulatedField(t *testing.T) {
+	newCustomPersistenceDB(t)
+	service := &CustomPresetService{}
+	preset := &model.CustomPreset{
+		UserId:     21,
+		Name:       "clearable-preset",
+		Platform:   "windows",
+		Version:    "1.0.0",
+		AppName:    "rustqs",
+		CustomJson: `{"company_name":"DeskForge","server_ip":"id.example:21116"}`,
+	}
+	if err := service.Create(preset); err != nil {
+		t.Fatalf("Create() error = %v", err)
+	}
+	preset.Version = "2.0.0"
+	preset.CustomJson = `{"company_name":"","server_ip":""}`
+	if err := service.Update(preset); err != nil {
+		t.Fatalf("Update() error = %v", err)
+	}
+	loaded, err := service.Info(preset.Id)
+	if err != nil {
+		t.Fatalf("read updated preset: %v", err)
+	}
+	if loaded.CustomJson != preset.CustomJson {
+		t.Fatalf("loaded canonical custom_json = %q, want %q", loaded.CustomJson, preset.CustomJson)
+	}
+	normalized, err := NormalizeCustomBuildJSON(loaded.CustomJson, BuildRecordContext{Platform: loaded.Platform, AppName: "rustqs", Version: loaded.Version})
+	if err != nil {
+		t.Fatalf("NormalizeCustomBuildJSON() error = %v", err)
+	}
+	if normalized.Spec.CompanyName != "" || normalized.Spec.ServerIP != "" {
+		t.Fatalf("cleared values retained stale state: %#v", normalized.Spec)
+	}
+	persisted := decodeJSON(t, loaded.CustomJson)
+	for _, key := range []string{"company_name", "server_ip"} {
+		if value, ok := persisted[key]; !ok || value != "" {
+			t.Errorf("persisted[%q] = %#v, present = %v, want empty value", key, value, ok)
+		}
+	}
+}
+
+func TestValidateCustomBuildInput(t *testing.T) {
+	tests := []struct {
+		name       string
+		platform   string
+		customJSON string
+		wantErr    bool
+	}{
+		{name: "supported empty payload", platform: "windows"},
+		{name: "supported typed payload", platform: "linux", customJSON: `{"enable_audio":false}`},
+		{name: "android requires package identity", platform: "android", wantErr: true},
+		{name: "unsupported platform", platform: "macos", customJSON: `{}`, wantErr: true},
+		{name: "malformed payload", platform: "android", customJSON: `{`, wantErr: true},
+		{name: "raw custom txt bypass", platform: "windows", customJSON: `{"custom_txt":"raw"}`, wantErr: true},
+		{name: "wrong typed field", platform: "windows", customJSON: `{"enable_audio":"false"}`, wantErr: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateCustomBuildInput(test.platform, test.customJSON, "app", "1.2.3")
+			if (err != nil) != test.wantErr {
+				t.Fatalf("ValidateCustomBuildInput() error = %v, wantErr %v", err, test.wantErr)
+			}
+			if err != nil && !IsClientValidationError(err) {
+				t.Fatalf("error type = %T, want ClientValidationError", err)
+			}
+		})
+	}
+}
+
+func TestCustomBuildCreateRejectsMissingAndroidAppIDBeforePersistence(t *testing.T) {
+	db := newCustomPersistenceDB(t)
+	build := &model.CustomBuild{
+		Name:       "android-build",
+		Platform:   "android",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: "",
+	}
+
+	err := (&CustomBuildService{}).Create(build)
+	if err == nil || !IsClientValidationError(err) {
+		t.Fatalf("Create() error = %v, want typed Android identity validation", err)
+	}
+	var count int64
+	if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+		t.Fatalf("count builds: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("missing Android identity created %d build row(s)", count)
+	}
+}
diff --git a/api/service/custom_preset.go b/api/service/custom_preset.go
index dd39cbf..c5db366 100644
--- a/api/service/custom_preset.go
+++ b/api/service/custom_preset.go
@@ -1,40 +1,71 @@
 package service
 
 import (
+	"fmt"
+
 	"rustdesk-server/api/model"
+	"rustdesk-server/api/utils"
 )
 
 type CustomPresetService struct{}
 
-func (ps *CustomPresetService) List(page, pageSize uint) (res *model.CustomPresetList) {
-	res = &model.CustomPresetList{}
+func (ps *CustomPresetService) List(page, pageSize uint) (*model.CustomPresetList, error) {
+	res := &model.CustomPresetList{}
 	tx := DB.Model(&model.CustomPreset{})
-	tx.Count(&res.Total)
-	tx.Scopes(Paginate(page, pageSize)).Order("id desc").Find(&res.CustomPresets)
-	return
+	if err := tx.Count(&res.Total).Error; err != nil {
+		return nil, err
+	}
+	if err := tx.Scopes(Paginate(page, pageSize)).Order("id desc").Find(&res.CustomPresets).Error; err != nil {
+		return nil, err
+	}
+	return res, nil
 }
 
-func (ps *CustomPresetService) ListByUser(page, pageSize, userId uint) (res *model.CustomPresetList) {
-	res = &model.CustomPresetList{}
+func (ps *CustomPresetService) ListByUser(page, pageSize, userId uint) (*model.CustomPresetList, error) {
+	res := &model.CustomPresetList{}
 	tx := DB.Model(&model.CustomPreset{}).Where("user_id = ?", userId)
-	tx.Count(&res.Total)
-	tx.Scopes(Paginate(page, pageSize)).Order("id desc").Find(&res.CustomPresets)
-	return
+	if err := tx.Count(&res.Total).Error; err != nil {
+		return nil, err
+	}
+	if err := tx.Scopes(Paginate(page, pageSize)).Order("id desc").Find(&res.CustomPresets).Error; err != nil {
+		return nil, err
+	}
+	return res, nil
 }
 
-func (ps *CustomPresetService) Info(id uint) *model.CustomPreset {
+func (ps *CustomPresetService) Info(id uint) (*model.CustomPreset, error) {
 	p := &model.CustomPreset{}
-	DB.Where("id = ?", id).First(p)
-	return p
+	if err := DB.Where("id = ?", id).First(p).Error; err != nil {
+		return nil, err
+	}
+	return p, nil
 }
 
 // Create — upsert по (user_id, name): если запись с таким именем у юзера уже есть,
 // перезаписывает её содержимое (§8.9 «Save as preset → перезаписывать при совпадении»).
 // Иначе создаёт новую. Поле Id у входящего p при upsert будет установлено на найденный.
 func (ps *CustomPresetService) Create(p *model.CustomPreset) error {
+	if err := validateCustomPresetFields(p, false); err != nil {
+		return err
+	}
+	if err := ValidateDirectCustomBuilderJSON(p.CustomJson); err != nil {
+		return err
+	}
+	canonicalJSON, err := CanonicalizeCustomBuildJSON(p.CustomJson, BuildRecordContext{
+		Platform: p.Platform,
+		AppName:  p.AppName,
+		Version:  p.Version,
+	})
+	if err != nil {
+		return err
+	}
+	if err := utils.RequireSecretEncryptionForCustomBuilderJSON(canonicalJSON); err != nil {
+		return err
+	}
+	p.CustomJson = canonicalJSON
 	if p.Name != "" {
 		existing := &model.CustomPreset{}
-		err := DB.Where("user_id = ? AND name = ?", p.UserId, p.Name).First(existing).Error
+		err = DB.Where("user_id = ? AND name = ?", p.UserId, p.Name).First(existing).Error
 		if err == nil && existing.Id > 0 {
 			// найден → перезаписываем (Updates не трогает zero-value через struct,
 			// поэтому используем Save)
@@ -46,7 +77,47 @@ func (ps *CustomPresetService) Create(p *model.CustomPreset) error {
 }
 
 func (ps *CustomPresetService) Update(p *model.CustomPreset) error {
-	return DB.Model(p).Updates(p).Error
+	if err := validateCustomPresetFields(p, true); err != nil {
+		return err
+	}
+	if err := ValidateDirectCustomBuilderJSON(p.CustomJson); err != nil {
+		return err
+	}
+	canonicalJSON, err := CanonicalizeCustomBuildJSON(p.CustomJson, BuildRecordContext{
+		BuildID:  p.Id,
+		Platform: p.Platform,
+		AppName:  p.AppName,
+		Version:  p.Version,
+	})
+	if err != nil {
+		return err
+	}
+	if err := utils.RequireSecretEncryptionForCustomBuilderJSON(canonicalJSON); err != nil {
+		return err
+	}
+	p.CustomJson = canonicalJSON
+	// Save is required here: Updates(struct) silently drops intentional zero
+	// values such as an empty custom_json.
+	return DB.Save(p).Error
+}
+
+func validateCustomPresetFields(p *model.CustomPreset, requireID bool) error {
+	if err := ValidateCustomPlatform(p.Platform); err != nil {
+		return err
+	}
+	if requireID && p.Id == 0 {
+		return &ClientValidationError{Err: fmt.Errorf("preset id is required")}
+	}
+	if p.Name == "" {
+		return &ClientValidationError{Err: fmt.Errorf("preset name is required")}
+	}
+	if p.Version == "" {
+		return &ClientValidationError{Err: fmt.Errorf("preset version is required")}
+	}
+	if !utils.ValidateBuildVersion(p.Version) {
+		return &ClientValidationError{Err: fmt.Errorf("invalid version format: %s", p.Version)}
+	}
+	return nil
 }
 
 func (ps *CustomPresetService) Delete(p *model.CustomPreset) error {
diff --git a/api/service/github_build_config.go b/api/service/github_build_config.go
index 9f3e891..fe99090 100644
--- a/api/service/github_build_config.go
+++ b/api/service/github_build_config.go
@@ -1,10 +1,12 @@
 package service
 
 import (
+	"archive/zip"
 	"bytes"
 	"context"
 	"crypto/aes"
 	"crypto/cipher"
+	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
@@ -13,18 +15,16 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"sort"
+	"net/url"
+	"os"
+	"regexp"
 	"strconv"
 	"strings"
-	"sync"
 	"time"
 
-	"golang.org/x/sync/singleflight"
-
 	"rustdesk-server/api/model"
 	"rustdesk-server/api/utils"
 
-	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/nacl/box"
 	"golang.org/x/crypto/pbkdf2"
 	"gorm.io/gorm"
@@ -43,27 +43,49 @@ func (s *GithubBuildConfigService) Get() (*model.GithubBuildConfig, error) {
 		if err := DB.Create(c).Error; err != nil {
 			return nil, err
 		}
+		normalizePersistedWorkflowExecutionRef(c)
 		return c, nil
 	}
+	if err == nil {
+		// Existing installations may still contain the old default "master".
+		// Normalize only known owned representations in memory; unknown/mutable
+		// values remain intact and are rejected by workflowExecutionRef.
+		normalizePersistedWorkflowExecutionRef(c)
+	}
 	return c, err
 }
 
-// Save обновляет настройки.
-//   - Repo / WorkflowFilename: всегда копируем (включая пустое значение — это
-//     валидный способ очистить настройку).
-//   - Branch / Token / PayloadKey: пустая строка означает «оставить как есть».
-//     Это удобство UI: показывать секреты нельзя, а Branch имеет осмысленный
-//     default (`master`), и обнулять его пустым полем формы — почти всегда
-//     случайность (см. BUGS.md B-010).
+// Save обновляет только глобальную конфигурацию, разрешённую оператору:
+// repository, PAT и payload key. Legacy workflow/ref columns remain untouched;
+// Branch is read only as the pre-existing execution-ref configuration.
 func (s *GithubBuildConfigService) Save(in *model.GithubBuildConfig) error {
+	if in == nil {
+		return errors.New("GitHub build config is missing")
+	}
+	// Check before Get(): Get creates the singleton row when absent, but a
+	// secret-bearing save without the at-rest key must not leave even an
+	// incidental row behind.
+	if (in.Token != "" && !utils.IsEncryptedSecret(in.Token)) ||
+		(in.PayloadKey != "" && !utils.IsEncryptedSecret(in.PayloadKey)) {
+		if err := utils.RequireSecretEncryptionKey(); err != nil {
+			return err
+		}
+	}
+	if in.Repo != "" {
+		if err := validateGithubRepo(in.Repo); err != nil {
+			return err
+		}
+	}
 	cur, err := s.Get()
 	if err != nil {
 		return err
 	}
+	repoChanged := cur.Repo != in.Repo
 	cur.Repo = in.Repo
-	cur.WorkflowFilename = in.WorkflowFilename
-	if in.Branch != "" {
-		cur.Branch = in.Branch
+	if repoChanged {
+		cur.WorkflowRefApproved = false
+		cur.WorkflowRefProviderVerified = false
+		cur.WorkflowRefApprovalSHA = ""
 	}
 	if in.Token != "" {
 		cur.Token = in.Token
@@ -71,9 +93,46 @@ func (s *GithubBuildConfigService) Save(in *model.GithubBuildConfig) error {
 	if in.PayloadKey != "" {
 		cur.PayloadKey = in.PayloadKey
 	}
+	if in.Token == "" && in.PayloadKey == "" {
+		if utils.HasSecretEncryptionKey() {
+			// Preserve the existing resave behavior when the key is available:
+			// legacy plaintext secrets are migrated to encrypted storage.
+			return DB.Save(cur).Error
+		}
+		updates := map[string]any{"repo": in.Repo, "branch": cur.Branch}
+		if repoChanged {
+			updates["workflow_ref_approved"] = false
+			updates["workflow_ref_provider_verified"] = false
+			updates["workflow_ref_approval_sha"] = ""
+		}
+		if err := updateGithubBuildConfigMetadata(cur.Id, "", updates); err != nil {
+			return err
+		}
+		return nil
+	}
 	return DB.Save(cur).Error
 }
 
+// updateGithubBuildConfigMetadata changes only non-secret singleton metadata.
+// UpdateColumns deliberately skips GithubBuildConfig's secret hooks so legacy
+// plaintext PATs and payload keys are not reserialized during metadata changes.
+// An expected repository, when supplied, prevents an approval read from being
+// applied after a concurrent repository change.
+func updateGithubBuildConfigMetadata(id uint, expectedRepo string, updates map[string]any) error {
+	query := DB.Model(&model.GithubBuildConfig{}).Where("id = ?", id)
+	if expectedRepo != "" {
+		query = query.Where("repo = ?", expectedRepo)
+	}
+	result := query.UpdateColumns(updates)
+	if result.Error != nil {
+		return result.Error
+	}
+	if result.RowsAffected != 1 {
+		return fmt.Errorf("GitHub build config metadata update affected %d rows: %w", result.RowsAffected, gorm.ErrRecordNotFound)
+	}
+	return nil
+}
+
 // GeneratePayloadKey — 32 случайных байта → base64-URL без padding (≈43 char).
 // Совместимо с тем, как ключ был выпущен в PowerShell на этапе (5).
 func (s *GithubBuildConfigService) GeneratePayloadKey() (string, error) {
@@ -81,22 +140,22 @@ func (s *GithubBuildConfigService) GeneratePayloadKey() (string, error) {
 	if _, err := rand.Read(buf); err != nil {
 		return "", err
 	}
-	// убираем +/= для удобства (как в PS-скрипте)
-	out := base64.StdEncoding.EncodeToString(buf)
-	clean := make([]byte, 0, len(out))
-	for i := 0; i < len(out); i++ {
-		c := out[i]
-		if c == '+' || c == '/' || c == '=' {
-			continue
-		}
-		clean = append(clean, c)
-	}
-	return string(clean), nil
+	return base64.RawURLEncoding.EncodeToString(buf), nil
 }
 
-// EncryptPayload шифрует JSON-карту в base64-блоб, совместимый с
-// `openssl enc -aes-256-cbc -pbkdf2 -pass pass:<key>` (формат: "Salted__"+salt(8)+ct).
-// Используется для workflow input enc_payload (шаг 5 PLAN §8.8.3b).
+const (
+	payloadEnvelopeMagic     = "DFP1"
+	payloadSaltSize          = 16
+	payloadMACSize           = sha256.Size
+	payloadPBKDF2Iterations  = 100000
+	payloadDerivedKeySize    = 32 + aes.BlockSize + sha256.Size
+	legacyPayloadSaltSize    = 8
+	legacyPayloadPBKDF2Iters = 10000
+)
+
+// EncryptPayload emits a versioned encrypt-then-MAC envelope. The AES-CBC
+// ciphertext remains easy for the active shell workflows to decrypt, while a
+// separate HMAC is verified before any new ciphertext is decrypted.
 func (s *GithubBuildConfigService) EncryptPayload(passphrase string, data map[string]any) (string, error) {
 	if passphrase == "" {
 		return "", errors.New("encryption passphrase is empty")
@@ -106,16 +165,16 @@ func (s *GithubBuildConfigService) EncryptPayload(passphrase string, data map[st
 		return "", err
 	}
 
-	// salt 8 байт (как у openssl)
-	salt := make([]byte, 8)
+	salt := make([]byte, payloadSaltSize)
 	if _, err := rand.Read(salt); err != nil {
 		return "", err
 	}
 
-	// PBKDF2-HMAC-SHA256 iter=10000, length=48 → 32 ключ + 16 IV
-	derived := pbkdf2.Key([]byte(passphrase), salt, 10000, 48, sha256.New)
+	// PBKDF2-HMAC-SHA256 derives AES key, IV, and an independent MAC key.
+	derived := pbkdf2.Key([]byte(passphrase), salt, payloadPBKDF2Iterations, payloadDerivedKeySize, sha256.New)
 	key := derived[:32]
 	iv := derived[32:48]
+	macKey := derived[48:]
 
 	block, err := aes.NewCipher(key)
 	if err != nil {
@@ -130,197 +189,435 @@ func (s *GithubBuildConfigService) EncryptPayload(passphrase string, data map[st
 	ct := make([]byte, len(padded))
 	cipher.NewCBCEncrypter(block, iv).CryptBlocks(ct, padded)
 
+	var signed bytes.Buffer
+	signed.WriteString(payloadEnvelopeMagic)
+	signed.Write(salt)
+	signed.Write(ct)
+	tag := hmac.New(sha256.New, macKey)
+	_, _ = tag.Write(signed.Bytes())
+
 	var out bytes.Buffer
-	out.WriteString("Salted__")
-	out.Write(salt)
-	out.Write(ct)
+	out.Write(signed.Bytes())
+	out.Write(tag.Sum(nil))
 	return base64.StdEncoding.EncodeToString(out.Bytes()), nil
 }
 
+// DecryptPayload verifies and decrypts a new DFP1 envelope. Salted__ payloads
+// are retained only as a clearly distinguishable legacy compatibility path;
+// new payloads never fall back to unauthenticated CBC after a MAC failure.
+func (s *GithubBuildConfigService) DecryptPayload(passphrase, encoded string) (map[string]any, error) {
+	if passphrase == "" {
+		return nil, errors.New("encryption passphrase is empty")
+	}
+	raw, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return nil, errors.New("encrypted payload has invalid base64")
+	}
+	var plain []byte
+	switch {
+	case len(raw) >= len(payloadEnvelopeMagic) && string(raw[:len(payloadEnvelopeMagic)]) == payloadEnvelopeMagic:
+		if len(raw) <= len(payloadEnvelopeMagic)+payloadSaltSize+payloadMACSize {
+			return nil, errors.New("encrypted payload envelope is truncated")
+		}
+		ciphertextEnd := len(raw) - payloadMACSize
+		ciphertext := raw[len(payloadEnvelopeMagic)+payloadSaltSize : ciphertextEnd]
+		if len(ciphertext) == 0 || len(ciphertext)%aes.BlockSize != 0 {
+			return nil, errors.New("encrypted payload ciphertext is invalid")
+		}
+		derived := pbkdf2.Key([]byte(passphrase), raw[len(payloadEnvelopeMagic):len(payloadEnvelopeMagic)+payloadSaltSize], payloadPBKDF2Iterations, payloadDerivedKeySize, sha256.New)
+		mac := hmac.New(sha256.New, derived[48:])
+		_, _ = mac.Write(raw[:ciphertextEnd])
+		if !hmac.Equal(mac.Sum(nil), raw[ciphertextEnd:]) {
+			return nil, errors.New("encrypted payload authentication failed")
+		}
+		plain, err = decryptPayloadCBC(derived[:32], derived[32:48], ciphertext)
+	case len(raw) >= len("Salted__")+legacyPayloadSaltSize && string(raw[:len("Salted__")]) == "Salted__":
+		derived := pbkdf2.Key([]byte(passphrase), raw[len("Salted__"):len("Salted__")+legacyPayloadSaltSize], legacyPayloadPBKDF2Iters, 48, sha256.New)
+		plain, err = decryptPayloadCBC(derived[:32], derived[32:48], raw[len("Salted__")+legacyPayloadSaltSize:])
+	default:
+		return nil, errors.New("encrypted payload envelope version is unsupported")
+	}
+	if err != nil {
+		return nil, err
+	}
+	var data map[string]any
+	if err := json.Unmarshal(plain, &data); err != nil {
+		return nil, fmt.Errorf("decode encrypted payload JSON: %w", err)
+	}
+	return data, nil
+}
+
+func decryptPayloadCBC(key, iv, ciphertext []byte) ([]byte, error) {
+	if len(ciphertext) == 0 || len(ciphertext)%aes.BlockSize != 0 {
+		return nil, errors.New("encrypted payload ciphertext is invalid")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	plain := make([]byte, len(ciphertext))
+	cipher.NewCBCDecrypter(block, iv).CryptBlocks(plain, ciphertext)
+	padding := int(plain[len(plain)-1])
+	if padding == 0 || padding > aes.BlockSize || padding > len(plain) {
+		return nil, errors.New("encrypted payload padding is invalid")
+	}
+	for _, value := range plain[len(plain)-padding:] {
+		if int(value) != padding {
+			return nil, errors.New("encrypted payload padding is invalid")
+		}
+	}
+	return plain[:len(plain)-padding], nil
+}
+
 // --- GitHub REST API helpers ---
 
 const githubAPI = "https://api.github.com"
 
-// ghReq — общий helper для запросов к GitHub REST API с авторизацией из
-// конфига. Если body == nil — GET; иначе — JSON-кодируется и Content-Type
-// выставляется автоматически. Таймаут контролируется через ctx вызывающего.
-func (s *GithubBuildConfigService) ghReq(ctx context.Context, c *model.GithubBuildConfig, method, path string, body any) (*http.Response, error) {
-	var br io.Reader
-	if body != nil {
-		j, err := json.Marshal(body)
-		if err != nil {
-			return nil, err
-		}
-		br = bytes.NewReader(j)
+const (
+	githubErrorBodyLimit = 4 << 10
+	githubJSONBodyLimit  = 4 << 20
+)
+
+// githubArtifactBodyLimit bounds the compressed artifact written to the
+// temporary archive. It is a variable rather than a second caller-provided
+// limit so every artifact download shares the same fail-closed boundary and
+// hermetic tests can exercise the oversized path without allocating 256 MiB.
+var githubArtifactBodyLimit int64 = 256 << 20
+
+// Empty uses the process temp directory in production. Tests may inject a
+// hermetic directory without changing the public service contract.
+var githubArtifactTempDir string
+
+// GithubAPIError describes a non-successful GitHub REST response without
+// retaining an unbounded or sensitive response body.
+type GithubAPIError struct {
+	StatusCode         int
+	Retryable          bool
+	Terminal           bool
+	Body               string
+	RetryAfter         string
+	RateLimitRemaining string
+	RateLimitReset     string
+}
+
+func (e *GithubAPIError) Error() string {
+	message := fmt.Sprintf("GitHub API HTTP %d", e.StatusCode)
+	if e.Retryable {
+		message += " (retryable)"
 	}
-	req, err := http.NewRequestWithContext(ctx, method, githubAPI+path, br)
-	if err != nil {
-		return nil, err
+	if e.Body != "" {
+		message += ": " + e.Body
 	}
-	req.Header.Set("Authorization", "Bearer "+c.Token)
-	req.Header.Set("Accept", "application/vnd.github+json")
-	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
-	if br != nil {
-		req.Header.Set("Content-Type", "application/json")
+	return message
+}
+
+// GithubTransportError wraps a request/response-body transport failure.
+// Transport failures and context timeouts are retryable by default.
+type GithubTransportError struct {
+	Operation string
+	Cause     error
+}
+
+func (e *GithubTransportError) Error() string {
+	return fmt.Sprintf("GitHub %s failed: %v", e.Operation, e.Cause)
+}
+
+func (e *GithubTransportError) Unwrap() error { return e.Cause }
+
+// GithubContractError means GitHub returned an otherwise successful response
+// that does not satisfy the endpoint contract. It must never be guessed from.
+type GithubContractError struct {
+	Operation string
+	Cause     error
+}
+
+func (e *GithubContractError) Error() string {
+	if e.Cause == nil {
+		return fmt.Sprintf("GitHub %s response contract invalid", e.Operation)
 	}
-	// Без жёсткого Timeout — таймаут контролируется через ctx у каждого вызова
-	// (иначе скачивание большого артефакта обрезалось бы на 30s).
-	return ghClient.Do(req)
+	return fmt.Sprintf("GitHub %s response contract invalid: %v", e.Operation, e.Cause)
 }
 
-var ghClient = &http.Client{}
+func (e *GithubContractError) Unwrap() error { return e.Cause }
 
-// --- Available versions cache (offline-assets releases) ---
+// GithubArtifactUnavailableError means the requested artifact name was not
+// present in the completed run. It is terminal: selecting another artifact
+// would violate the workflow's exact artifact contract.
+type GithubArtifactUnavailableError struct {
+	RunID        int64
+	ArtifactName string
+	Available    []string
+}
 
-type ghVersionsCache struct {
-	versions []string
-	cachedAt time.Time
-	mu       sync.Mutex
+type githubArtifactMetadata struct {
+	ID      int64  `json:"id"`
+	Name    string `json:"name"`
+	Expired bool   `json:"expired"`
+}
+
+func (e *GithubArtifactUnavailableError) Error() string {
+	return fmt.Sprintf("artifact %q not found in run %d (available: %v)", e.ArtifactName, e.RunID, e.Available)
+}
+
+// IsGithubRetryable reports whether a GitHub failure may be retried.
+func IsGithubRetryable(err error) bool {
+	var apiErr *GithubAPIError
+	if errors.As(err, &apiErr) {
+		return apiErr.Retryable
+	}
+	var transportErr *GithubTransportError
+	return errors.As(err, &transportErr)
+}
+
+// IsGithubTerminal reports whether a GitHub failure must fail the operation
+// instead of being silently retried.
+func IsGithubTerminal(err error) bool {
+	var apiErr *GithubAPIError
+	if errors.As(err, &apiErr) {
+		return apiErr.Terminal
+	}
+	var contractErr *GithubContractError
+	if errors.As(err, &contractErr) {
+		return true
+	}
+	var artifactErr *GithubArtifactUnavailableError
+	return errors.As(err, &artifactErr)
+}
+
+func classifyGithubStatus(status int, headers http.Header) (retryable, terminal bool) {
+	switch {
+	case status == http.StatusRequestTimeout,
+		status == http.StatusTooEarly,
+		status == http.StatusTooManyRequests,
+		status >= http.StatusInternalServerError:
+		return true, false
+	case status == http.StatusForbidden:
+		if headers.Get("X-RateLimit-Remaining") == "0" || headers.Get("Retry-After") != "" {
+			return true, false
+		}
+		return false, true
+	default:
+		return false, true
+	}
 }
 
 var (
-	releasesCache    ghVersionsCache
-	releasesCacheTTL = 5 * time.Minute
-	versionsFlight   singleflight.Group
+	githubBearerPattern = regexp.MustCompile(`(?i)bearer\s+[A-Za-z0-9._~+/=-]+`)
+	githubTokenPattern  = regexp.MustCompile(`(?:gh[pousr]_[A-Za-z0-9_]*|github_pat_[A-Za-z0-9_]*)`)
 )
 
-// GetAvailableVersions возвращает список версий RustDesk, доступных для сборки
-// custom-клиента. Версии извлекаются из GitHub-релизов форка bashrusakh/rustdesk
-// с тегами "offline-assets-*". Результат кешируется на 5 минут.
-//
-// singleflight защищает от stampede при одновременных запросах: пока один
-// goroutine обновляет кеш, остальные ждут того же результата.
-// Если GitHub API недоступен или нет релизов, возвращается пустой слайс
-// и ошибка — нет смысла предлагать версии, ассеты для которых не существуют.
-//
-// Ожидание результата cancellation-aware: используется DoChan + select на
-// ctx.Done() — caller с отменённым/протухшим контекстом выходит сразу,
-// не дожидаясь detached shared refresh, которая продолжается для остальных.
-func (s *GithubBuildConfigService) GetAvailableVersions(ctx context.Context) ([]string, error) {
-	// 1) Проверить кеш
-	releasesCache.mu.Lock()
-	if releasesCache.versions != nil && time.Since(releasesCache.cachedAt) < releasesCacheTTL {
-		versions := releasesCache.versions
-		releasesCache.mu.Unlock()
-		return versions, nil
-	}
-	releasesCache.mu.Unlock()
-
-	// 2) Если caller уже отвалился — вернуть ошибку моментально, не заводя
-	// singleflight shared goroutine (иначе теряем герметичность тестов и
-	// тратим ресурсы на запрос, результат которого никто не ждёт).
-	select {
-	case <-ctx.Done():
-		return nil, ctx.Err()
+func redactGithubBody(body []byte) string {
+	if len(body) == 0 {
+		return ""
+	}
+	if len(body) > githubErrorBodyLimit+1 {
+		body = body[:githubErrorBodyLimit+1]
+	}
+	// The input has already been bounded to limit+1 by readGithubBody. Scan the
+	// extra byte before truncating so a sensitive value cut at the limit cannot
+	// leak its prefix.
+	sanitized := redactGithubSensitiveFields(body)
+	message := githubBearerPattern.ReplaceAllString(string(sanitized), "Bearer [REDACTED]")
+	message = githubTokenPattern.ReplaceAllString(message, "[REDACTED]")
+	if len(message) > githubErrorBodyLimit {
+		message = message[:githubErrorBodyLimit] + "…"
+	}
+	return strings.TrimSpace(message)
+}
+
+func isGithubSensitiveKey(key string) bool {
+	switch strings.ToLower(strings.TrimSpace(key)) {
+	case "token", "access_token", "authorization", "payload", "payload_key", "payload-key", "payloadkey", "pat", "github_pat", "secret", "password", "encrypted_value", "enc_payload":
+		return true
 	default:
+		return false
 	}
+}
 
-	// 3) Один запрос к GitHub API на concurrent batch.
-	// Используем detached bounded context, чтобы таймаут/отмена одного caller
-	// не убила shared refresh для всех остальных waiter'ов.
-	// Создаём контекст внутри замыкания: singleflight выполняет closure только
-	// для первого caller'а, так что утечки для non-executing callers нет.
-	// DoChan возвращает канал, по которому результат придёт даже если наш ctx
-	// уже отменён. Это и есть cancellation-aware ожидание:
-	//   - ctx живой → блокируемся на ch
-	//   - ctx отменён/протух → возвращаемся с ctx.Err(), не дожидаясь fetch
-	// shared goroutine при этом продолжает работу для остальных waiter'ов.
-	ch := versionsFlight.DoChan("versions", func() (interface{}, error) {
-		fetchCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-		defer cancel()
-		versions, fetchErr := s.fetchReleases(fetchCtx)
-		if fetchErr != nil {
-			log.Warnf("fetchReleases failed: %v", fetchErr)
-			return []string{}, fetchErr
-		}
-		// Don't cache empty results — a transient API blip or zero-matching tags
-		// would poison the cache for the full TTL, hiding real releases from all users.
-		if len(versions) > 0 {
-			releasesCache.mu.Lock()
-			releasesCache.versions = versions
-			releasesCache.cachedAt = time.Now()
-			releasesCache.mu.Unlock()
-		}
-		return versions, nil
-	})
-	select {
-	case r := <-ch:
-		if r.Err != nil {
-			return []string{}, r.Err
-		}
-		return r.Val.([]string), nil
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	}
-}
-
-// fetchReleases делает HTTP-запрос к GitHub API и возвращает отсортированные
-// по semver (по убыванию) версии из тегов "offline-assets-*".
-func (s *GithubBuildConfigService) fetchReleases(ctx context.Context) ([]string, error) {
-	gcfg, err := s.Get()
-	if err != nil {
-		// Только ErrRecordNotFound допустим (конфиг ещё не задан — используем public API).
-		// Любая другая ошибка — реальная проблема (DB unavailable и т.п.),
-		// её надо увидеть, а не тихо провалиться на public rate limit.
-		if !errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, fmt.Errorf("get config: %w", err)
-		}
-	}
-
-	// TODO: handle pagination via Link header if releases exceed 100. Реальных релизов <10,
-	// но при росте выше 100 будут silently omitted. Нужен fetcher с follow Link header.
-	path := "/repos/bashrusakh/rustdesk/releases?per_page=100"
-	var resp *http.Response
-
-	if gcfg != nil && gcfg.Token != "" {
-		resp, err = s.ghReq(ctx, gcfg, "GET", path, nil)
-	} else {
-		// Без PAT — публичный запрос (ниже rate limit, но работает)
-		var req *http.Request
-		req, err = http.NewRequestWithContext(ctx, "GET", githubAPI+path, nil)
-		if err == nil {
-			req.Header.Set("Accept", "application/vnd.github+json")
-			req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
-			resp, err = ghClient.Do(req)
+func githubFieldKey(body []byte, start int) (end int, key string, ok bool) {
+	if start >= len(body) {
+		return 0, "", false
+	}
+	if body[start] == '"' || body[start] == '\'' {
+		quote := body[start]
+		for i := start + 1; i < len(body); i++ {
+			if body[i] == '\\' {
+				i++
+				continue
+			}
+			if body[i] == quote {
+				return i + 1, string(body[start+1 : i]), true
+			}
 		}
+		return 0, "", false
 	}
-	if err != nil {
-		return nil, err
+	if !((body[start] >= 'a' && body[start] <= 'z') || (body[start] >= 'A' && body[start] <= 'Z') || body[start] == '_') {
+		return 0, "", false
 	}
-	defer resp.Body.Close()
+	end = start + 1
+	for end < len(body) {
+		c := body[end]
+		if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_' || c == '-') {
+			break
+		}
+		end++
+	}
+	return end, string(body[start:end]), true
+}
 
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
-		return nil, fmt.Errorf("GitHub API returned HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+func redactGithubSensitiveFields(body []byte) []byte {
+	var sanitized bytes.Buffer
+	sanitized.Grow(len(body))
+	for i := 0; i < len(body); {
+		keyEnd, key, ok := githubFieldKey(body, i)
+		if !ok || !isGithubSensitiveKey(key) {
+			sanitized.WriteByte(body[i])
+			i++
+			continue
+		}
+		valueStart := keyEnd
+		for valueStart < len(body) && (body[valueStart] == ' ' || body[valueStart] == '\t' || body[valueStart] == '\r' || body[valueStart] == '\n') {
+			valueStart++
+		}
+		if valueStart >= len(body) || (body[valueStart] != ':' && body[valueStart] != '=') {
+			sanitized.WriteByte(body[i])
+			i++
+			continue
+		}
+		valueStart++
+		for valueStart < len(body) && (body[valueStart] == ' ' || body[valueStart] == '\t' || body[valueStart] == '\r' || body[valueStart] == '\n') {
+			valueStart++
+		}
+		sanitized.Write(body[i:valueStart])
+		if valueStart == len(body) {
+			sanitized.WriteString("[REDACTED]")
+			i = valueStart
+			continue
+		}
+		if body[valueStart] == '"' || body[valueStart] == '\'' {
+			quote := body[valueStart]
+			sanitized.WriteByte(quote)
+			sanitized.WriteString("[REDACTED]")
+			i = valueStart + 1
+			for i < len(body) {
+				if body[i] == '\\' {
+					i += 2
+					continue
+				}
+				if body[i] == quote {
+					sanitized.WriteByte(quote)
+					i++
+					break
+				}
+				i++
+			}
+			// An unterminated value is intentionally consumed through the bounded
+			// input, including the limit+1 byte.
+			continue
+		}
+		sanitized.WriteString("[REDACTED]")
+		i = valueStart
+		for i < len(body) && body[i] != ',' && body[i] != '}' && body[i] != ']' && body[i] != '\r' && body[i] != '\n' {
+			i++
+		}
 	}
+	return sanitized.Bytes()
+}
 
-	var releases []struct {
-		TagName string `json:"tag_name"`
+func readGithubBody(body io.Reader, limit int) ([]byte, bool, error) {
+	data, err := io.ReadAll(io.LimitReader(body, int64(limit)+1))
+	if err != nil {
+		return nil, false, err
 	}
-	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
-		return nil, err
+	if len(data) > limit {
+		return data, true, nil
 	}
+	return data, false, nil
+}
 
-	// Фильтр: только offline-assets-* и строгий semver
-	prefix := "offline-assets-"
-	var versions []string
-	for _, r := range releases {
-		if strings.HasPrefix(r.TagName, prefix) {
-			v := strings.TrimPrefix(r.TagName, prefix)
-			if v != "" && utils.VersionRegex.MatchString(v) {
-				versions = append(versions, v)
-			}
-		}
+func decodeGithubJSON(resp *http.Response, operation string, dst any) error {
+	body, truncated, err := readGithubBody(resp.Body, githubJSONBodyLimit)
+	if err != nil {
+		return &GithubTransportError{Operation: operation + " response body", Cause: err}
 	}
+	if truncated {
+		return &GithubContractError{Operation: operation, Cause: errors.New("response body exceeds limit")}
+	}
+	if err := json.Unmarshal(body, dst); err != nil {
+		return &GithubContractError{Operation: operation, Cause: err}
+	}
+	return nil
+}
 
-	// Сортировка semver по убыванию
-	sort.Slice(versions, func(i, j int) bool {
-		return compareSemver(versions[i], versions[j]) > 0
-	})
+func safeGithubURL(raw string) bool {
+	u, err := url.Parse(raw)
+	if err != nil || u.Scheme != "https" || u.User != nil || u.Hostname() == "" {
+		return false
+	}
+	host := strings.ToLower(u.Hostname())
+	return host == "github.com" || host == "api.github.com"
+}
 
-	return versions, nil
+// ghReq — общий helper для запросов к GitHub REST API с авторизацией из
+// конфига. Если body == nil — GET; иначе — JSON-кодируется и Content-Type
+// выставляется автоматически. Таймаут контролируется через ctx вызывающего.
+func (s *GithubBuildConfigService) ghReq(ctx context.Context, c *model.GithubBuildConfig, method, path string, body any, expected ...int) (*http.Response, error) {
+	if c == nil {
+		return nil, errors.New("GitHub build config is missing")
+	}
+	if err := validateGithubRepo(c.Repo); err != nil {
+		return nil, err
+	}
+	var br io.Reader
+	if body != nil {
+		j, err := json.Marshal(body)
+		if err != nil {
+			return nil, err
+		}
+		br = bytes.NewReader(j)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, githubAPI+path, br)
+	if err != nil {
+		return nil, err
+	}
+	if c.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.Token)
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+	if br != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	// Без жёсткого Timeout — таймаут контролируется через ctx у каждого вызова
+	// (иначе скачивание большого артефакта обрезалось бы на 30s).
+	resp, err := ghClient.Do(req)
+	if err != nil {
+		return nil, &GithubTransportError{Operation: method + " " + path, Cause: err}
+	}
+	for _, status := range expected {
+		if resp.StatusCode == status {
+			return resp, nil
+		}
+	}
+	responseBody, _, readErr := readGithubBody(resp.Body, githubErrorBodyLimit)
+	resp.Body.Close()
+	if readErr != nil {
+		return nil, &GithubTransportError{Operation: method + " " + path + " error response", Cause: readErr}
+	}
+	retryable, terminal := classifyGithubStatus(resp.StatusCode, resp.Header)
+	return nil, &GithubAPIError{
+		StatusCode:         resp.StatusCode,
+		Retryable:          retryable,
+		Terminal:           terminal,
+		Body:               redactGithubBody(responseBody),
+		RetryAfter:         resp.Header.Get("Retry-After"),
+		RateLimitRemaining: resp.Header.Get("X-RateLimit-Remaining"),
+		RateLimitReset:     resp.Header.Get("X-RateLimit-Reset"),
+	}
 }
 
+var ghClient = &http.Client{}
+
 // compareSemver сравнивает две semver-подобные строки: сначала numeric core,
 // затем prerelease-сегменты. Release всегда старше prerelease, а
 // prerelease вроде "1.4.10-beta" корректно сравнивается с более низкой
@@ -422,24 +719,149 @@ func prereleaseIdentifier(v string) (int, bool) {
 // TestConnection — read-only вызов GET /repos/{repo}: проверяет PAT, scope, доступ к репо.
 // Возвращает (ok, message).
 func (s *GithubBuildConfigService) TestConnection(c *model.GithubBuildConfig) (bool, string) {
+	if err := s.TestConnectionError(c); err != nil {
+		return false, githubErrorMessage(err)
+	}
+	return true, "ok"
+}
+
+// TestConnectionError is the typed-error variant used by callers that need to
+// distinguish a retryable GitHub outage from a terminal configuration error.
+func (s *GithubBuildConfigService) TestConnectionError(c *model.GithubBuildConfig) error {
 	if c.Token == "" {
-		return false, "token not set"
+		return errors.New("token not set")
 	}
 	if c.Repo == "" {
-		return false, "repo not set (expected owner/name)"
+		return errors.New("repo not set (expected owner/name)")
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
-	resp, err := s.ghReq(ctx, c, "GET", "/repos/"+c.Repo, nil)
+	path, err := githubRepoPath(c.Repo, "")
+	if err != nil {
+		return err
+	}
+	resp, err := s.ghReq(ctx, c, "GET", path, nil, http.StatusOK)
 	if err != nil {
-		return false, "request failed: " + err.Error()
+		return err
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode == 200 {
-		return true, "ok"
+	return nil
+}
+
+func githubErrorMessage(err error) string {
+	return GithubSafeErrorMessage(err)
+}
+
+// GithubErrorHTTPStatus returns the safe HTTP classification for a known
+// provider/workflow error. Nested errors are checked before the provider
+// configuration wrapper so a policy, capability, validation, transport, or
+// provider-response failure cannot be flattened into "not configured".
+func GithubErrorHTTPStatus(err error) (int, bool) {
+	if err == nil {
+		return 0, false
+	}
+	if IsSecretEncryptionConfigurationError(err) {
+		return http.StatusServiceUnavailable, true
 	}
-	b, _ := io.ReadAll(resp.Body)
-	return false, fmt.Sprintf("HTTP %d: %s", resp.StatusCode, string(b))
+	var validationErr *ClientValidationError
+	if errors.As(err, &validationErr) {
+		return http.StatusBadRequest, true
+	}
+	var approvalErr *WorkflowRefApprovalError
+	if errors.As(err, &approvalErr) {
+		return http.StatusPreconditionFailed, true
+	}
+	var capabilityErr *ProductionCapabilityUnavailableError
+	if errors.As(err, &capabilityErr) {
+		return http.StatusServiceUnavailable, true
+	}
+	var apiErr *GithubAPIError
+	if errors.As(err, &apiErr) {
+		return http.StatusBadGateway, true
+	}
+	var artifactErr *GithubArtifactUnavailableError
+	if errors.As(err, &artifactErr) {
+		return http.StatusBadGateway, true
+	}
+	var transportErr *GithubTransportError
+	if errors.As(err, &transportErr) {
+		return http.StatusServiceUnavailable, true
+	}
+	var contractErr *GithubContractError
+	if errors.As(err, &contractErr) {
+		return http.StatusBadGateway, true
+	}
+	var providerErr *GithubProviderConfigurationError
+	if errors.As(err, &providerErr) {
+		return http.StatusServiceUnavailable, true
+	}
+	return 0, false
+}
+
+const githubDiagnosticLimit = 512
+
+// GithubErrorDetail returns a bounded, log-oriented diagnostic. It is
+// deliberately reconstructed from typed classifications instead of formatting
+// err.Error(): provider URLs, refs, response bodies, credentials, payloads,
+// and nested implementation details therefore cannot enter logs or build logs.
+func GithubErrorDetail(err error) string {
+	if err == nil {
+		return ""
+	}
+	detail := GithubSafeErrorMessage(err)
+	var apiErr *GithubAPIError
+	if errors.As(err, &apiErr) {
+		detail = fmt.Sprintf("%s (status=%d, retryable=%t, terminal=%t)", detail, apiErr.StatusCode, apiErr.Retryable, apiErr.Terminal)
+	}
+	if len(detail) > githubDiagnosticLimit {
+		return detail[:githubDiagnosticLimit] + "…"
+	}
+	return detail
+}
+
+// GithubSafeErrorMessage maps GitHub workflow/provider failures to a bounded
+// user-facing message. Provider URLs, selectors, response bodies, credentials,
+// encrypted payloads, and internal causes remain outside the API response.
+func GithubSafeErrorMessage(err error) string {
+	if err == nil {
+		return "GitHub build operation failed"
+	}
+	if IsSecretEncryptionConfigurationError(err) {
+		return "secret encryption is not configured"
+	}
+	var validationErr *ClientValidationError
+	if errors.As(err, &validationErr) {
+		return "custom build request is invalid"
+	}
+	var approvalErr *WorkflowRefApprovalError
+	if errors.As(err, &approvalErr) {
+		return "workflow reference approval is required"
+	}
+	var capabilityErr *ProductionCapabilityUnavailableError
+	if errors.As(err, &capabilityErr) {
+		return "production build capability is unavailable"
+	}
+	var artifactErr *GithubArtifactUnavailableError
+	if errors.As(err, &artifactErr) {
+		return "requested GitHub artifact is unavailable"
+	}
+	var apiErr *GithubAPIError
+	if errors.As(err, &apiErr) {
+		return "GitHub provider request failed"
+	}
+	var transportErr *GithubTransportError
+	if errors.As(err, &transportErr) {
+		return "GitHub provider is unavailable"
+	}
+	var contractErr *GithubContractError
+	if errors.As(err, &contractErr) {
+		return "GitHub provider response was invalid"
+	}
+	var providerErr *GithubProviderConfigurationError
+	if errors.As(err, &providerErr) {
+		return "GitHub build provider is not configured"
+	}
+	return "GitHub build operation failed"
 }
 
 // SetWorkflowSecret — кладёт/обновляет PayloadKey в GitHub Secrets форка как
@@ -453,20 +875,7 @@ func (s *GithubBuildConfigService) SetWorkflowSecret(c *model.GithubBuildConfig)
 	if c.PayloadKey == "" {
 		return errors.New("payload_key is empty (Generate or paste one first)")
 	}
-	return s.putGithubSecret(c, "/repos/"+c.Repo, "WORKFLOW_PAYLOAD_KEY", c.PayloadKey)
-}
-
-// SetSyncPatSecret кладёт/обновляет PAT в GitHub Secrets текущего настроенного
-// репозитория как GH_PAT. Используется sync-workflows.yml для доступа к форку
-// из CI. Тот же sealed box механизм, что и SetWorkflowSecret.
-func (s *GithubBuildConfigService) SetSyncPatSecret(c *model.GithubBuildConfig) error {
-	if c.Token == "" {
-		return errors.New("token is empty — save a PAT first")
-	}
-	if c.Repo == "" {
-		return errors.New("repo is not set")
-	}
-	return s.putGithubSecret(c, "/repos/"+c.Repo, "GH_PAT", c.Token)
+	return s.putGithubSecret(c, "WORKFLOW_PAYLOAD_KEY", c.PayloadKey)
 }
 
 // putGithubSecret — общая логика encrypt-and-PUT секрета в GitHub Actions Secrets.
@@ -474,25 +883,25 @@ func (s *GithubBuildConfigService) SetSyncPatSecret(c *model.GithubBuildConfig)
 //
 //	GET  {repoPath}/actions/secrets/public-key  → {key_id, key (base64 32B)}
 //	PUT  {repoPath}/actions/secrets/{secretName}  body {encrypted_value, key_id}
-func (s *GithubBuildConfigService) putGithubSecret(c *model.GithubBuildConfig, repoPath, secretName, plaintext string) error {
+func (s *GithubBuildConfigService) putGithubSecret(c *model.GithubBuildConfig, secretName, plaintext string) error {
+	repoPath, err := githubRepoPath(c.Repo, "")
+	if err != nil {
+		return err
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 	defer cancel()
 
 	// 1) забрать публичный ключ репо
-	resp, err := s.ghReq(ctx, c, "GET", repoPath+"/actions/secrets/public-key", nil)
+	resp, err := s.ghReq(ctx, c, "GET", repoPath+"/actions/secrets/public-key", nil, http.StatusOK)
 	if err != nil {
 		return fmt.Errorf("get public-key: %w", err)
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("get public-key HTTP %d: %s", resp.StatusCode, string(b))
-	}
 	var pk struct {
 		KeyId string `json:"key_id"`
 		Key   string `json:"key"`
 	}
-	if err := json.NewDecoder(resp.Body).Decode(&pk); err != nil {
+	if err := decodeGithubJSON(resp, "get public-key", &pk); err != nil {
 		return fmt.Errorf("decode public-key: %w", err)
 	}
 	keyBytes, err := base64.StdEncoding.DecodeString(pk.Key)
@@ -518,150 +927,484 @@ func (s *GithubBuildConfigService) putGithubSecret(c *model.GithubBuildConfig, r
 		"key_id":          pk.KeyId,
 	}
 	putResp, err := s.ghReq(ctx, c, "PUT",
-		repoPath+"/actions/secrets/"+secretName, body)
+		repoPath+"/actions/secrets/"+secretName, body, http.StatusCreated, http.StatusNoContent)
 	if err != nil {
 		return fmt.Errorf("put secret: %w", err)
 	}
 	defer putResp.Body.Close()
-	if putResp.StatusCode != http.StatusCreated && putResp.StatusCode != http.StatusNoContent {
-		b, _ := io.ReadAll(putResp.Body)
-		return fmt.Errorf("put secret HTTP %d: %s", putResp.StatusCode, string(b))
-	}
+	// Both accepted statuses have no response contract to decode.
 	return nil
 }
 
-// DispatchBuild — workflow_dispatch с зашифрованным payload.
-// params — {server, key, app_name, custom_txt}. Возвращает (runId, error).
-// runId получается отдельным запросом /actions/runs?per_page=1 после dispatch (GitHub
-// не возвращает id напрямую — приходится поллить).
-func (s *GithubBuildConfigService) DispatchBuild(ctx context.Context, c *model.GithubBuildConfig, params map[string]any) (int64, error) {
-	if c.Token == "" || c.Repo == "" || c.WorkflowFilename == "" {
-		return 0, errors.New("GithubBuildConfig: token/repo/workflow_filename required")
+// GithubDispatchResult is the exact identity returned by GitHub for a
+// workflow_dispatch request. The run ID is provider-derived; callers must not
+// accept or manufacture it from user input.
+type GithubDispatchResult struct {
+	WorkflowRunID int64  `json:"workflow_run_id"`
+	RunURL        string `json:"run_url"`
+	HTMLURL       string `json:"html_url"`
+}
+
+// releaseAssetDispatchPayload is the typed, provider-derived portion of the
+// encrypted workflow payload. ReleaseRepo is projected from the resolved
+// catalog identity rather than accepted from normal build parameters.
+type releaseAssetDispatchPayload struct {
+	ReleaseRepo      string         `json:"release_repo"`
+	AssetsReleaseID  int64          `json:"assets_release_id"`
+	AssetsReleaseTag string         `json:"assets_release_tag"`
+	ReleaseAssets    []ReleaseAsset `json:"release_assets"`
+}
+
+func releaseAssetPayloadForIdentity(identity VersionIdentity) (releaseAssetDispatchPayload, error) {
+	if err := validateGithubRepo(identity.Repo); err != nil {
+		return releaseAssetDispatchPayload{}, fmt.Errorf("release asset repository is invalid: %w", err)
+	}
+	return releaseAssetDispatchPayload{
+		ReleaseRepo:      identity.Repo,
+		AssetsReleaseID:  identity.AssetsRelease.ID,
+		AssetsReleaseTag: identity.AssetsRelease.TagName,
+		ReleaseAssets:    identity.AssetsRelease.Assets,
+	}, nil
+}
+
+// DispatchBuild dispatches a workflow using the validated branch/tag selector
+// and returns the exact run details from GitHub. The resolved workflow SHA is
+// checked during preparation and retained for polling; it is not sent as the
+// workflow_dispatch ref. This method deliberately does not poll or infer a run
+// from a list response.
+func (s *GithubBuildConfigService) DispatchBuild(ctx context.Context, c *model.GithubBuildConfig, identity VersionIdentity, platform string, params map[string]any) (*GithubDispatchResult, error) {
+	if err := RequireProductionBuildCapability(platform); err != nil {
+		return nil, err
+	}
+	if c == nil {
+		return nil, &GithubProviderConfigurationError{Cause: errors.New("configuration is missing")}
+	}
+	if c.Token == "" || c.Repo == "" || c.PayloadKey == "" {
+		return nil, &GithubProviderConfigurationError{Cause: errors.New("repo, PAT, and payload key are required")}
+	}
+	// Direct callers must not reach provider policy reads, encryption, or a
+	// dispatch POST when the typed public-key/input gate is not satisfied.
+	normalizedParams, err := NormalizeWorkflowDispatchParams(platform, params)
+	if err != nil {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: err}
+	}
+	if err := RequireDispatchPublicKey(normalizedParams); err != nil {
+		return nil, err
+	}
+	if err := s.RequireWorkflowRefApproval(c); err != nil {
+		return nil, err
+	}
+	workflow, err := WorkflowFilenameForPlatform(platform)
+	if err != nil {
+		return nil, err
 	}
-	enc, err := s.EncryptPayload(c.PayloadKey, params)
+	configuredWorkflowRef, err := workflowExecutionRef(c)
 	if err != nil {
-		return 0, fmt.Errorf("encrypt: %w", err)
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: err}
 	}
-	ref := c.Branch
-	if ref == "" {
-		ref = "rustqs/min-test"
+	if identity.WorkflowRef == "" || identity.WorkflowSHA == "" {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: errors.New("workflow selector and resolved execution SHA are required")}
+	}
+	if identity.WorkflowRef != configuredWorkflowRef {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: errors.New("workflow dispatch ref does not match the configured workflow selector")}
+	}
+	if err := identity.validate(); err != nil {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: err}
+	}
+	if identity.Repo != c.Repo {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: fmt.Errorf("version identity repo %q does not match configured repo", identity.Repo)}
+	}
+	releasePayload, err := releaseAssetPayloadForIdentity(identity)
+	if err != nil {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: err}
+	}
+	// Re-check the mapped workflow immediately before dispatch. PrepareBuild
+	// performs the same readiness check before persistence, while this second
+	// check closes the gap for direct dispatch callers and provider-side races.
+	if err := s.verifyWorkflowAvailable(ctx, c, workflow, identity.WorkflowSHA); err != nil {
+		return nil, &GithubProviderConfigurationError{
+			Cause: fmt.Errorf("mapped workflow %q is not ready: %w", workflow, err),
+		}
+	}
+	// This is the dispatch primitive's final provider-policy check. It must be
+	// immediately before encryption so a moved branch/tag cannot produce a DFP1
+	// payload, even when a caller reuses a stale prepared identity or readiness
+	// checks observe the ref before it moves.
+	execution, err := s.validateWorkflowRefPolicy(ctx, c)
+	if err != nil {
+		return nil, &GithubProviderConfigurationError{Cause: fmt.Errorf("workflow reference policy is not verified: %w", err)}
+	}
+	if execution.Ref != identity.WorkflowRef || execution.SHA != identity.WorkflowSHA || !strings.EqualFold(execution.SHA, c.WorkflowRefApprovalSHA) {
+		return nil, &GithubContractError{
+			Operation: "workflow dispatch",
+			Cause:     errors.New("workflow selector resolved to a different execution SHA"),
+		}
+	}
+	dispatchParams := make(map[string]any, len(normalizedParams)+1)
+	for key, value := range normalizedParams {
+		dispatchParams[key] = value
+	}
+	// Version propagation is provider/workflow-owned. Never trust a caller's
+	// duplicate or stale value over the immutable selected identity.
+	dispatchParams["version"] = identity.DisplayVersion
+	// Keep the source checkout identity available to the owned workflow without
+	// replacing the execution ref used to locate its workflow definition.
+	dispatchParams["source_sha"] = identity.BuildRef
+	// Bind the authenticated payload to the configured repository. The workflow
+	// compares this provider-derived value with github.repository, preserving
+	// self-hosted fork support without trusting a hardcoded owner/name.
+	dispatchParams["workflow_repo"] = c.Repo
+	// Release asset identity is catalog/provider-derived. Overwrite any caller
+	// value so raw/manual asset IDs or digests can never enter a normal build.
+	dispatchParams["release_repo"] = releasePayload.ReleaseRepo
+	dispatchParams["assets_release_id"] = releasePayload.AssetsReleaseID
+	dispatchParams["assets_release_tag"] = releasePayload.AssetsReleaseTag
+	dispatchParams["release_assets"] = releasePayload.ReleaseAssets
+	enc, err := s.EncryptPayload(c.PayloadKey, dispatchParams)
+	if err != nil {
+		return nil, fmt.Errorf("encrypt: %w", err)
 	}
 	body := map[string]any{
-		"ref": ref,
+		// GitHub workflow_dispatch accepts a branch or tag selector here. The
+		// resolved SHA is used by readiness and polling, not as this selector.
+		"ref":                workflowDispatchRef(identity.WorkflowRef),
+		"return_run_details": true,
 		"inputs": map[string]string{
 			"enc_payload": enc,
 		},
 	}
-	path := fmt.Sprintf("/repos/%s/actions/workflows/%s/dispatches", c.Repo, c.WorkflowFilename)
-	resp, err := s.ghReq(ctx, c, "POST", path, body)
+	path, err := githubRepoPath(c.Repo, fmt.Sprintf("/actions/workflows/%s/dispatches", workflow))
 	if err != nil {
-		return 0, err
+		return nil, err
 	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 204 {
-		b, _ := io.ReadAll(resp.Body)
-		return 0, fmt.Errorf("dispatch HTTP %d: %s", resp.StatusCode, string(b))
-	}
-	// найти id свежезапущенного рана (GitHub индексирует не моментально).
-	// ВАЖНО: принимаем только ран, созданный не раньше момента dispatch (минус
-	// небольшой допуск на рассинхрон часов сервера и GitHub). Иначе per_page=1
-	// вернёт ПРЕДЫДУЩИЙ ран этого воркфлоу, пока новый не проиндексирован, и UI
-	// покажет ссылку на чужую сборку.
-	dispatchedAt := time.Now().UTC().Add(-10 * time.Second)
-	for i := 0; i < 10; i++ {
-		time.Sleep(2 * time.Second)
-		listPath := fmt.Sprintf("/repos/%s/actions/workflows/%s/runs?per_page=1&branch=%s",
-			c.Repo, c.WorkflowFilename, ref)
-		rr, err := s.ghReq(ctx, c, "GET", listPath, nil)
-		if err != nil {
-			continue
-		}
-		var data struct {
-			WorkflowRuns []struct {
-				Id        int64  `json:"id"`
-				Status    string `json:"status"`
-				CreatedAt string `json:"created_at"`
-			} `json:"workflow_runs"`
-		}
-		_ = json.NewDecoder(rr.Body).Decode(&data)
-		rr.Body.Close()
-		if len(data.WorkflowRuns) > 0 {
-			run := data.WorkflowRuns[0]
-			created, perr := time.Parse(time.RFC3339, run.CreatedAt)
-			// если created_at непарсится — не блокируемся, берём как есть;
-			// иначе ждём появления именно нового рана.
-			if perr != nil || !created.Before(dispatchedAt) {
-				return run.Id, nil
-			}
+	resp, err := s.ghReq(ctx, c, "POST", path, body, http.StatusOK)
+	if err != nil {
+		var apiErr *GithubAPIError
+		if errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusNoContent {
+			return nil, &GithubContractError{Operation: "workflow dispatch", Cause: err}
 		}
+		return nil, err
 	}
-	return 0, errors.New("dispatch ok but run id not found after polling")
+	defer resp.Body.Close()
+	var result GithubDispatchResult
+	if err := decodeGithubJSON(resp, "workflow dispatch", &result); err != nil {
+		return nil, err
+	}
+	if result.WorkflowRunID <= 0 || !safeGithubURL(result.RunURL) || !safeGithubURL(result.HTMLURL) {
+		return nil, &GithubContractError{Operation: "workflow dispatch", Cause: errors.New("expected nonzero workflow_run_id and safe run_url/html_url")}
+	}
+	return &result, nil
 }
 
-// RunStatus — GET /actions/runs/{id}: возвращает (status, conclusion).
-func (s *GithubBuildConfigService) RunStatus(ctx context.Context, c *model.GithubBuildConfig, runId int64) (status, conclusion string, err error) {
-	resp, err := s.ghReq(ctx, c, "GET", fmt.Sprintf("/repos/%s/actions/runs/%d", c.Repo, runId), nil)
+// GithubRunStatusDetails contains the exact provider-owned fields returned by
+// a run-status response. New builds require SourceSHA to guard the immutable
+// workflow execution commit.
+type GithubRunStatusDetails struct {
+	Status     string
+	Conclusion string
+	SourceSHA  string
+}
+
+// RunStatusDetails fetches the status response, including the exact run
+// head_sha used to identify the workflow execution commit.
+func (s *GithubBuildConfigService) RunStatusDetails(ctx context.Context, c *model.GithubBuildConfig, runId int64) (GithubRunStatusDetails, error) {
+	path, err := githubRepoPath(c.Repo, fmt.Sprintf("/actions/runs/%d", runId))
 	if err != nil {
-		return "", "", err
+		return GithubRunStatusDetails{}, err
+	}
+	resp, err := s.ghReq(ctx, c, "GET", path, nil, http.StatusOK)
+	if err != nil {
+		return GithubRunStatusDetails{}, err
 	}
 	defer resp.Body.Close()
 	var data struct {
 		Status     string `json:"status"`
 		Conclusion string `json:"conclusion"`
+		HeadSHA    string `json:"head_sha"`
+	}
+	if err := decodeGithubJSON(resp, "run status", &data); err != nil {
+		return GithubRunStatusDetails{}, err
 	}
-	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+	if data.Status == "" {
+		return GithubRunStatusDetails{}, &GithubContractError{Operation: "run status", Cause: errors.New("status is empty")}
+	}
+	if data.HeadSHA != "" && !validGithubSourceSHA(data.HeadSHA) {
+		return GithubRunStatusDetails{}, &GithubContractError{Operation: "run status", Cause: errors.New("head_sha must be 40-64 hexadecimal characters")}
+	}
+	return GithubRunStatusDetails{Status: data.Status, Conclusion: data.Conclusion, SourceSHA: data.HeadSHA}, nil
+}
+
+// RunStatus preserves the existing status-only caller contract.
+func (s *GithubBuildConfigService) RunStatus(ctx context.Context, c *model.GithubBuildConfig, runId int64) (status, conclusion string, err error) {
+	details, err := s.RunStatusDetails(ctx, c, runId)
+	if err != nil {
 		return "", "", err
 	}
-	return data.Status, data.Conclusion, nil
+	return details.Status, details.Conclusion, nil
 }
 
-// DownloadArtifact — скачивает zip артефакта по имени, возвращает []byte (zip-байты).
-// Используется после успешного завершения сборки.
-func (s *GithubBuildConfigService) DownloadArtifact(ctx context.Context, c *model.GithubBuildConfig, runId int64, artifactName string) ([]byte, error) {
-	resp, err := s.ghReq(ctx, c, "GET", fmt.Sprintf("/repos/%s/actions/runs/%d/artifacts", c.Repo, runId), nil)
+func (s *GithubBuildConfigService) listRunArtifacts(ctx context.Context, c *model.GithubBuildConfig, runId int64) ([]githubArtifactMetadata, error) {
+	path, err := githubRepoPath(c.Repo, fmt.Sprintf("/actions/runs/%d/artifacts", runId))
+	if err != nil {
+		return nil, err
+	}
+	resp, err := s.ghReq(ctx, c, "GET", path, nil, http.StatusOK)
 	if err != nil {
 		return nil, err
 	}
 	var data struct {
-		Artifacts []struct {
-			Id   int64  `json:"id"`
-			Name string `json:"name"`
-		} `json:"artifacts"`
+		Artifacts []githubArtifactMetadata `json:"artifacts"`
+	}
+	if err := decodeGithubJSON(resp, "list artifacts", &data); err != nil {
+		resp.Body.Close()
+		return nil, err
 	}
-	_ = json.NewDecoder(resp.Body).Decode(&data)
 	resp.Body.Close()
+	return data.Artifacts, nil
+}
+
+// ResolveArtifactID selects the exact named artifact from the exact workflow
+// run. A missing or expired name is terminal; there is deliberately no
+// sole-artifact fallback.
+func (s *GithubBuildConfigService) ResolveArtifactID(ctx context.Context, c *model.GithubBuildConfig, runId int64, artifactName string) (int64, error) {
+	artifacts, err := s.listRunArtifacts(ctx, c, runId)
+	if err != nil {
+		return 0, err
+	}
 	var aid int64
 	if artifactName != "" {
-		for _, a := range data.Artifacts {
+		for _, a := range artifacts {
 			if a.Name == artifactName {
-				aid = a.Id
-				break
+				if a.Expired {
+					return 0, &GithubArtifactUnavailableError{RunID: runId, ArtifactName: artifactName}
+				}
+				if a.ID <= 0 {
+					return 0, &GithubContractError{Operation: "list artifacts", Cause: fmt.Errorf("artifact %q has an invalid id", artifactName)}
+				}
+				if aid != 0 {
+					return 0, &GithubContractError{Operation: "list artifacts", Cause: fmt.Errorf("artifact name %q is ambiguous", artifactName)}
+				}
+				aid = a.ID
 			}
 		}
 	}
-	// AU-L-011: не завязываемся жёстко на имя артефакта. Если имя не задано или
-	// не найдено, но ран произвёл ровно один артефакт — берём его.
-	if aid == 0 && len(data.Artifacts) == 1 {
-		aid = data.Artifacts[0].Id
-	}
 	if aid == 0 {
-		names := make([]string, 0, len(data.Artifacts))
-		for _, a := range data.Artifacts {
+		names := make([]string, 0, len(artifacts))
+		for _, a := range artifacts {
 			names = append(names, a.Name)
 		}
-		return nil, fmt.Errorf("artifact %q not found in run %d (available: %v)", artifactName, runId, names)
+		return 0, &GithubArtifactUnavailableError{RunID: runId, ArtifactName: artifactName, Available: names}
 	}
-	// /artifacts/{id}/zip → 302 redirect → CDN. http.Client сам не следует на скачивание
-	// большого файла — но в нашем случае GitHub отдаёт 302 на signed URL.
-	zipPath := fmt.Sprintf("/repos/%s/actions/artifacts/%d/zip", c.Repo, aid)
-	rr, err := s.ghReq(ctx, c, "GET", zipPath, nil)
+	return aid, nil
+}
+
+func (s *GithubBuildConfigService) verifyRunArtifact(ctx context.Context, c *model.GithubBuildConfig, runId, artifactID int64, artifactName string) error {
+	artifacts, err := s.listRunArtifacts(ctx, c, runId)
 	if err != nil {
-		return nil, err
+		return err
+	}
+	var nameMatch *githubArtifactMetadata
+	for i := range artifacts {
+		a := &artifacts[i]
+		if a.ID == artifactID {
+			if a.Expired {
+				return &GithubArtifactUnavailableError{RunID: runId, ArtifactName: artifactName, Available: []string{a.Name}}
+			}
+			if a.Name != artifactName {
+				return &GithubContractError{Operation: "verify artifact identity", Cause: fmt.Errorf("stored artifact %d belongs to %q, not %q", artifactID, a.Name, artifactName)}
+			}
+			return nil
+		}
+		if a.Name == artifactName {
+			copy := *a
+			nameMatch = &copy
+		}
+	}
+	if nameMatch != nil {
+		return &GithubContractError{Operation: "verify artifact identity", Cause: fmt.Errorf("stored artifact id %d does not match run artifact id %d for %q", artifactID, nameMatch.ID, artifactName)}
+	}
+	return &GithubArtifactUnavailableError{RunID: runId, ArtifactName: artifactName}
+}
+
+// ArtifactDownload is the bounded hand-off between the GitHub service and the
+// controller. The archive is always a temporary file; callers own cleanup of
+// ArchivePath after validation/publication, while the identity is provider
+// derived and can be guarded into build provenance.
+type ArtifactDownload struct {
+	ArchivePath  string
+	ArtifactID   int64
+	ArtifactName string
+	Size         int64
+}
+
+// DownloadArtifact resolves the exact requested artifact when its stored ID
+// is absent, then streams that exact ID to a temporary archive. It never
+// selects a sole artifact, infers a path, or returns the ZIP in memory.
+func (s *GithubBuildConfigService) DownloadArtifact(ctx context.Context, c *model.GithubBuildConfig, runId, artifactID int64, artifactName string) (ArtifactDownload, error) {
+	if runId <= 0 {
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: errors.New("github run id must be positive")}
+	}
+	if artifactName == "" {
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: errors.New("artifact name is required")}
+	}
+	if artifactID > 0 {
+		if err := s.verifyRunArtifact(ctx, c, runId, artifactID, artifactName); err != nil {
+			return ArtifactDownload{}, err
+		}
+	} else {
+		resolvedID, err := s.ResolveArtifactID(ctx, c, runId, artifactName)
+		if err != nil {
+			return ArtifactDownload{}, err
+		}
+		artifactID = resolvedID
+	}
+	if artifactID <= 0 {
+		return ArtifactDownload{}, &GithubArtifactUnavailableError{RunID: runId, ArtifactName: artifactName}
+	}
+
+	zipPath, err := githubRepoPath(c.Repo, fmt.Sprintf("/actions/artifacts/%d/zip", artifactID))
+	if err != nil {
+		return ArtifactDownload{}, err
+	}
+	resp, err := s.ghReq(ctx, c, "GET", zipPath, nil, http.StatusOK)
+	if err != nil {
+		return ArtifactDownload{}, err
+	}
+	defer resp.Body.Close()
+
+	limit := githubArtifactBodyLimit
+	if limit <= 0 {
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: errors.New("artifact response limit must be positive")}
+	}
+	expectedLength, hasContentLength := responseContentLength(resp)
+	if hasContentLength && expectedLength > limit {
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: errors.New("artifact response exceeds limit")}
+	}
+
+	part, err := os.CreateTemp(githubArtifactTempDir, "deskforge-artifact-*.part")
+	if err != nil {
+		return ArtifactDownload{}, &GithubTransportError{Operation: "create artifact temporary file", Cause: err}
+	}
+	partPath := part.Name()
+	archivePath := strings.TrimSuffix(partPath, ".part") + ".zip"
+	ProtectGithubArtifactTemp(partPath)
+	ProtectGithubArtifactTemp(archivePath)
+	keepArchive := false
+	defer func() {
+		if !keepArchive {
+			_ = os.Remove(partPath)
+			_ = os.Remove(archivePath)
+			ReleaseGithubArtifactTemp(partPath)
+			ReleaseGithubArtifactTemp(archivePath)
+		}
+	}()
+
+	written, copyErr := copyContextBounded(ctx, part, resp.Body, limit+1)
+	if copyErr != nil {
+		_ = part.Close()
+		return ArtifactDownload{}, &GithubTransportError{Operation: "download artifact response body", Cause: copyErr}
+	}
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		_ = part.Close()
+		return ArtifactDownload{}, &GithubTransportError{Operation: "download artifact response body", Cause: ctxErr}
+	}
+	if written > limit {
+		_ = part.Close()
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: errors.New("artifact response exceeds limit")}
+	}
+	if err := part.Sync(); err != nil {
+		_ = part.Close()
+		return ArtifactDownload{}, &GithubTransportError{Operation: "sync artifact temporary file", Cause: err}
+	}
+	if err := part.Close(); err != nil {
+		return ArtifactDownload{}, &GithubTransportError{Operation: "close artifact temporary file", Cause: err}
+	}
+	if hasContentLength && written != expectedLength {
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: fmt.Errorf("artifact response body length %d does not match Content-Length %d", written, expectedLength)}
+	}
+	if err := validateDownloadedArtifactArchive(partPath); err != nil {
+		return ArtifactDownload{}, &GithubContractError{Operation: "download artifact", Cause: err}
+	}
+	if err := os.Rename(partPath, archivePath); err != nil {
+		return ArtifactDownload{}, &GithubTransportError{Operation: "publish artifact temporary file", Cause: err}
+	}
+	ReleaseGithubArtifactTemp(partPath)
+	keepArchive = true
+	return ArtifactDownload{
+		ArchivePath:  archivePath,
+		ArtifactID:   artifactID,
+		ArtifactName: artifactName,
+		Size:         written,
+	}, nil
+}
+
+// copyContextBounded keeps streaming bounded even when a non-conforming body
+// repeatedly returns (0, nil). The context is checked between reads; the
+// transport remains responsible for interrupting a blocked network read.
+func copyContextBounded(ctx context.Context, dst io.Writer, src io.Reader, limit int64) (int64, error) {
+	if limit < 0 {
+		return 0, errors.New("copy limit must not be negative")
+	}
+	buf := make([]byte, 32*1024)
+	var written int64
+	emptyReads := 0
+	for {
+		if err := ctx.Err(); err != nil {
+			return written, err
+		}
+		n, readErr := src.Read(buf)
+		if n > 0 {
+			emptyReads = 0
+			if err := ctx.Err(); err != nil {
+				return written, err
+			}
+			writtenNow, writeErr := dst.Write(buf[:n])
+			written += int64(writtenNow)
+			if writeErr != nil {
+				return written, writeErr
+			}
+			if writtenNow != n {
+				return written, io.ErrShortWrite
+			}
+			if written > limit {
+				return written, nil
+			}
+		} else if readErr == nil {
+			emptyReads++
+			if emptyReads >= 100 {
+				return written, io.ErrNoProgress
+			}
+		}
+		if readErr != nil {
+			if errors.Is(readErr, io.EOF) {
+				return written, nil
+			}
+			return written, readErr
+		}
 	}
-	defer rr.Body.Close()
-	if rr.StatusCode != 200 {
-		b, _ := io.ReadAll(rr.Body)
-		return nil, fmt.Errorf("artifact zip HTTP %d: %s", rr.StatusCode, string(b))
+}
+
+func responseContentLength(resp *http.Response) (int64, bool) {
+	if raw := resp.Header.Get("Content-Length"); raw != "" {
+		length, err := strconv.ParseInt(raw, 10, 64)
+		if err == nil && length >= 0 {
+			return length, true
+		}
+		return 0, true
+	}
+	if resp.ContentLength > 0 {
+		return resp.ContentLength, true
+	}
+	return 0, false
+}
+
+func validateDownloadedArtifactArchive(path string) error {
+	zr, err := zip.OpenReader(path)
+	if err != nil {
+		return fmt.Errorf("invalid ZIP archive: %w", err)
 	}
-	return io.ReadAll(rr.Body)
+	if err := zr.Close(); err != nil {
+		return fmt.Errorf("close ZIP archive: %w", err)
+	}
+	return nil
 }
diff --git a/api/service/github_build_config_test.go b/api/service/github_build_config_test.go
index bb797df..0c79733 100644
--- a/api/service/github_build_config_test.go
+++ b/api/service/github_build_config_test.go
@@ -1,12 +1,125 @@
 package service
 
 import (
+	"bytes"
 	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
 	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
+
+	"golang.org/x/crypto/pbkdf2"
+	"rustdesk-server/api/model"
 )
 
+type githubRoundTripFunc func(*http.Request) (*http.Response, error)
+
+type countingGithubReader struct {
+	remaining int
+	read      int
+}
+
+func (r *countingGithubReader) Read(p []byte) (int, error) {
+	if r.remaining == 0 {
+		return 0, io.EOF
+	}
+	n := len(p)
+	if n > r.remaining {
+		n = r.remaining
+	}
+	for i := 0; i < n; i++ {
+		p[i] = 'x'
+	}
+	r.remaining -= n
+	r.read += n
+	return n, nil
+}
+
+func (f githubRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func withGithubTransport(t *testing.T, transport http.RoundTripper) {
+	t.Helper()
+	previous := ghClient.Transport
+	ghClient.Transport = transport
+	t.Cleanup(func() { ghClient.Transport = previous })
+}
+
+func githubResponse(status int, body string, headers http.Header) *http.Response {
+	if headers == nil {
+		headers = make(http.Header)
+	}
+	return &http.Response{
+		StatusCode: status,
+		Header:     headers,
+		Body:       io.NopCloser(strings.NewReader(body)),
+	}
+}
+
+func githubConfig() *model.GithubBuildConfig {
+	return &model.GithubBuildConfig{
+		Repo:                        "owner/repo",
+		Token:                       "github_pat_test",
+		PayloadKey:                  "payload-key",
+		Branch:                      "refs/tags/workflow-v1",
+		WorkflowRefApproved:         true,
+		WorkflowRefProviderVerified: true,
+		WorkflowRefApprovalSHA:      strings.Repeat("f", 40),
+	}
+}
+
+func githubVersionIdentity() VersionIdentity {
+	return VersionIdentity{
+		Repo:           "owner/repo",
+		DisplayVersion: "1.2.3",
+		BuildRef:       "0123456789abcdef0123456789abcdef01234567",
+		SourceTag:      "1.2.3",
+		WorkflowRef:    "refs/tags/workflow-v1",
+		WorkflowSHA:    strings.Repeat("f", 40),
+		AssetsRelease:  AssetsRelease{ID: 12, TagName: "offline-assets-1.2.3", Assets: testReleaseAssets()},
+	}
+}
+
+func testReleaseAssets() []ReleaseAsset {
+	return []ReleaseAsset{
+		{ID: 101, Name: "windows-x64-release.zip", Digest: "sha256:" + strings.Repeat("1", 64)},
+		{ID: 102, Name: "usbmmidd_v2.zip", Digest: "sha256:" + strings.Repeat("2", 64)},
+		{ID: 103, Name: "rustdesk_printer_driver_v4-1.4.zip", Digest: "sha256:" + strings.Repeat("3", 64)},
+		{ID: 104, Name: "printer_driver_adapter.zip", Digest: "sha256:" + strings.Repeat("4", 64)},
+	}
+}
+
+func testReleaseDetails(id int64, tag string) string {
+	return fmt.Sprintf(`{"id":%d,"tag_name":%q,"assets":[{"id":101,"name":"windows-x64-release.zip","digest":"sha256:%s"},{"id":102,"name":"usbmmidd_v2.zip","digest":"sha256:%s"},{"id":103,"name":"rustdesk_printer_driver_v4-1.4.zip","digest":"sha256:%s"},{"id":104,"name":"printer_driver_adapter.zip","digest":"sha256:%s"}]}`,
+		id, tag, strings.Repeat("1", 64), strings.Repeat("2", 64), strings.Repeat("3", 64), strings.Repeat("4", 64))
+}
+
+func testWorkflowFileResponse(workflow string) string {
+	return testWorkflowFileResponseWithContent(workflow, "on:\n  workflow_dispatch:\n")
+}
+
+func testWorkflowFileResponseWithContent(workflow, content string) string {
+	encoded := base64.StdEncoding.EncodeToString([]byte(content))
+	return fmt.Sprintf(`{"type":"file","path":".github/workflows/%s","sha":"%s","encoding":"base64","content":%q}`, workflow, strings.Repeat("c", 40), encoded)
+}
+
+func testWorkflowStateResponse() string { return `{"state":"active"}` }
+
+func testWorkflowBranchRefResponse(sha string) string {
+	return `{"ref":"refs/heads/rustqs/workflows","object":{"sha":"` + sha + `","type":"commit"}}`
+}
+
 // TestCompareSemver проверяет упорядочивание compareSemver для стабильных
 // и pre-release версий: numeric > numeric-equal-non-numeric ("1.4.8" > "1.4.8-beta"),
 // trailing-segments-равны только если non-zero, pre-release между равными numeric
@@ -35,6 +148,85 @@ func TestCompareSemver(t *testing.T) {
 	}
 }
 
+func TestGeneratePayloadKeyUsesRawURLBase64(t *testing.T) {
+	svc := &GithubBuildConfigService{}
+	keys := make(map[string]struct{})
+	for i := 0; i < 8; i++ {
+		key, err := svc.GeneratePayloadKey()
+		if err != nil {
+			t.Fatalf("GeneratePayloadKey() error = %v", err)
+		}
+		if len(key) != 43 {
+			t.Fatalf("generated key length = %d, want 43", len(key))
+		}
+		decoded, err := base64.RawURLEncoding.DecodeString(key)
+		if err != nil {
+			t.Fatalf("generated key is not raw URL base64: %v", err)
+		}
+		if len(decoded) != 32 {
+			t.Fatalf("decoded key length = %d, want 32", len(decoded))
+		}
+		for _, char := range key {
+			if !(char >= 'A' && char <= 'Z') && !(char >= 'a' && char <= 'z') && !(char >= '0' && char <= '9') && char != '-' && char != '_' {
+				t.Fatalf("generated key contains non-URL-base64 character %q", char)
+			}
+		}
+		keys[key] = struct{}{}
+	}
+	if len(keys) < 2 {
+		t.Fatal("generated payload keys were not random across samples")
+	}
+}
+
+func TestEncryptPayloadAuthenticatesNewEnvelopeBeforeDecrypting(t *testing.T) {
+	svc := &GithubBuildConfigService{}
+	encoded, err := svc.EncryptPayload("payload-key", map[string]any{"version": "1.2.3", "server": "id.example"})
+	if err != nil {
+		t.Fatalf("EncryptPayload() error = %v", err)
+	}
+	decoded, err := svc.DecryptPayload("payload-key", encoded)
+	if err != nil || decoded["version"] != "1.2.3" {
+		t.Fatalf("DecryptPayload() = %#v, %v", decoded, err)
+	}
+	raw, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		t.Fatalf("decode envelope: %v", err)
+	}
+	for _, index := range []int{len(raw) - 1, len(payloadEnvelopeMagic) + payloadSaltSize} {
+		t.Run(fmt.Sprintf("tamper-%d", index), func(t *testing.T) {
+			mutated := append([]byte(nil), raw...)
+			mutated[index] ^= 0x01
+			if _, err := svc.DecryptPayload("payload-key", base64.StdEncoding.EncodeToString(mutated)); err == nil {
+				t.Fatal("DecryptPayload() accepted a tampered authenticated envelope")
+			}
+		})
+	}
+}
+
+func TestDecryptPayloadReadsLegacySaltedPayload(t *testing.T) {
+	const passphrase = "legacy-payload-key"
+	plaintext := []byte(`{"version":"1.2.3","server":"id.example:21116"}`)
+	salt := []byte("12345678")
+	derived := pbkdf2.Key([]byte(passphrase), salt, legacyPayloadPBKDF2Iters, 48, sha256.New)
+	padded := append(append([]byte(nil), plaintext...), bytes.Repeat([]byte{byte(aes.BlockSize - len(plaintext)%aes.BlockSize)}, aes.BlockSize-len(plaintext)%aes.BlockSize)...)
+	block, err := aes.NewCipher(derived[:32])
+	if err != nil {
+		t.Fatalf("create legacy cipher: %v", err)
+	}
+	ciphertext := make([]byte, len(padded))
+	cipher.NewCBCEncrypter(block, derived[32:48]).CryptBlocks(ciphertext, padded)
+	raw := append([]byte("Salted__"), salt...)
+	raw = append(raw, ciphertext...)
+
+	decoded, err := (&GithubBuildConfigService{}).DecryptPayload(passphrase, base64.StdEncoding.EncodeToString(raw))
+	if err != nil {
+		t.Fatalf("DecryptPayload() legacy Salted__ error = %v", err)
+	}
+	if decoded["version"] != "1.2.3" || decoded["server"] != "id.example:21116" {
+		t.Fatalf("legacy Salted__ payload = %#v", decoded)
+	}
+}
+
 // TestGetAvailableVersionsCtxCancel подтверждает, что отменённый контекст
 // возвращается моментально через select перед DoChan, не заводя singleflight
 // shared goroutine (герметично — без реального запроса к GitHub API).
@@ -42,10 +234,7 @@ func TestGetAvailableVersionsCtxCancel(t *testing.T) {
 	s := &GithubBuildConfigService{}
 
 	// Сбросить кеш, чтобы не было cache-hit.
-	releasesCache.mu.Lock()
-	releasesCache.versions = nil
-	releasesCache.cachedAt = time.Time{}
-	releasesCache.mu.Unlock()
+	resetVersionCatalogCache()
 
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel() // отменяем заранее
@@ -63,3 +252,720 @@ func TestGetAvailableVersionsCtxCancel(t *testing.T) {
 	// Не сбрасываем releasesCache: при cancelled ctx singleflight goroutine
 	// не заводится — кеш не мутируется, тест герметичен.
 }
+
+func TestDispatchBuildUsesExactRunDetailsWithoutPolling(t *testing.T) {
+	identity := githubVersionIdentity()
+	config := githubConfig()
+	config.Branch = identity.WorkflowRef
+	var requests int32
+	var listRequests int32
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		atomic.AddInt32(&requests, 1)
+		if strings.Contains(req.URL.Path, "/runs") {
+			atomic.AddInt32(&listRequests, 1)
+		}
+		if req.Method == http.MethodGet && strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/") {
+			return githubResponse(http.StatusOK, strings.Replace(testProtectedRulesetResponse("workflow-*"), `"id":1`, `"id":1`, 1), nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/rulesets") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"tag"}}`, nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("e", 40)) {
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("e", 40)+`","object":{"sha":"`+identity.WorkflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/ref/heads/workflow-v1") {
+			return githubResponse(http.StatusNotFound, `{"message":"branch not found"}`, nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/contents/.github/workflows/rustqs-windows.yml") {
+			if req.URL.Query().Get("ref") != identity.WorkflowSHA {
+				return githubResponse(http.StatusBadRequest, `{"message":"workflow readiness did not use exact SHA"}`, nil), nil
+			}
+			return githubResponse(http.StatusOK, testWorkflowFileResponse("rustqs-windows.yml"), nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/actions/workflows/rustqs-windows.yml") {
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		}
+		if req.Method != http.MethodPost || !strings.HasSuffix(req.URL.Path, "/actions/workflows/rustqs-windows.yml/dispatches") {
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+		var payload map[string]any
+		if err := json.NewDecoder(req.Body).Decode(&payload); err != nil {
+			return nil, fmt.Errorf("decode request: %w", err)
+		}
+		if payload["return_run_details"] != true {
+			return githubResponse(http.StatusBadRequest, `{"message":"return_run_details missing"}`, nil), nil
+		}
+		if payload["ref"] != workflowDispatchRef(identity.WorkflowRef) {
+			return githubResponse(http.StatusBadRequest, `{"message":"workflow selector was not used"}`, nil), nil
+		}
+		return githubResponse(http.StatusOK, `{"workflow_run_id":12345,"run_url":"https://api.github.com/repos/owner/repo/actions/runs/12345","html_url":"https://github.com/owner/repo/actions/runs/12345"}`, nil), nil
+	}))
+
+	result, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, identity, string(PlatformWindows), map[string]any{"server": "id.example", "key": validRustDeskPublicKey})
+	if err != nil {
+		t.Fatalf("DispatchBuild() error = %v", err)
+	}
+	if result.WorkflowRunID != 12345 || result.RunURL == "" || result.HTMLURL == "" {
+		t.Fatalf("unexpected exact dispatch result: %#v", result)
+	}
+	if atomic.LoadInt32(&requests) != 8 || atomic.LoadInt32(&listRequests) != 0 {
+		t.Fatalf("dispatch made unexpected policy/readiness/polling requests: requests=%d list=%d", requests, listRequests)
+	}
+	if config.Branch != identity.WorkflowRef {
+		t.Fatalf("dispatch changed selector audit provenance: got %q, want %q", config.Branch, identity.WorkflowRef)
+	}
+}
+
+func TestDispatchBuildBindsEncryptedSourceSHAAndImmutableWorkflowSHA(t *testing.T) {
+	identity := githubVersionIdentity()
+	config := githubConfig()
+	config.Branch = identity.WorkflowRef
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.Method == http.MethodGet && strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/rulesets") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"tag"}}`, nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("e", 40)) {
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("e", 40)+`","object":{"sha":"`+identity.WorkflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/ref/heads/workflow-v1") {
+			return githubResponse(http.StatusNotFound, `{"message":"branch not found"}`, nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/contents/.github/workflows/rustqs-windows.yml") {
+			if req.URL.Query().Get("ref") != identity.WorkflowSHA {
+				return githubResponse(http.StatusBadRequest, `{"message":"workflow readiness did not use exact SHA"}`, nil), nil
+			}
+			return githubResponse(http.StatusOK, testWorkflowFileResponse("rustqs-windows.yml"), nil), nil
+		}
+		if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/actions/workflows/rustqs-windows.yml") {
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		}
+		var payload map[string]any
+		if err := json.NewDecoder(req.Body).Decode(&payload); err != nil {
+			return nil, fmt.Errorf("decode request: %w", err)
+		}
+		if payload["ref"] != workflowDispatchRef(identity.WorkflowRef) {
+			return githubResponse(http.StatusBadRequest, `{"message":"wrong workflow selector"}`, nil), nil
+		}
+		inputs, ok := payload["inputs"].(map[string]any)
+		if !ok {
+			return githubResponse(http.StatusBadRequest, `{"message":"missing encrypted inputs"}`, nil), nil
+		}
+		decoded, err := decryptTestPayload(inputs["enc_payload"].(string), "payload-key")
+		if err != nil {
+			return nil, err
+		}
+		if decoded["version"] != identity.DisplayVersion || decoded["source_sha"] != identity.BuildRef || decoded["workflow_repo"] != identity.Repo {
+			return githubResponse(http.StatusBadRequest, `{"message":"source identity was not bound"}`, nil), nil
+		}
+		if decoded["release_repo"] != identity.Repo {
+			return githubResponse(http.StatusBadRequest, `{"message":"release repository was not bound"}`, nil), nil
+		}
+		if decoded["assets_release_id"] != float64(identity.AssetsRelease.ID) || decoded["assets_release_tag"] != identity.AssetsRelease.TagName {
+			return githubResponse(http.StatusBadRequest, `{"message":"release identity was not bound"}`, nil), nil
+		}
+		assets, ok := decoded["release_assets"].([]any)
+		if !ok || len(assets) != len(identity.AssetsRelease.Assets) {
+			return githubResponse(http.StatusBadRequest, `{"message":"release asset metadata was not bound"}`, nil), nil
+		}
+		for index, expected := range identity.AssetsRelease.Assets {
+			asset, ok := assets[index].(map[string]any)
+			if !ok || asset["id"] != float64(expected.ID) || asset["name"] != expected.Name || asset["digest"] != expected.Digest {
+				return githubResponse(http.StatusBadRequest, `{"message":"release asset metadata changed"}`, nil), nil
+			}
+		}
+		return githubResponse(http.StatusOK, `{"workflow_run_id":12347,"run_url":"https://api.github.com/repos/owner/repo/actions/runs/12347","html_url":"https://github.com/owner/repo/actions/runs/12347"}`, nil), nil
+	}))
+
+	if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, identity, string(PlatformWindows), map[string]any{
+		"key":               validRustDeskPublicKey,
+		"release_repo":      "attacker/other-repo",
+		"assets_release_id": float64(999),
+		"release_assets":    []ReleaseAsset{{ID: 999, Name: "forged.zip", Digest: "sha256:" + strings.Repeat("f", 64)}},
+	}); err != nil {
+		t.Fatalf("DispatchBuild() error = %v", err)
+	}
+	if config.Branch != identity.WorkflowRef {
+		t.Fatalf("dispatch changed selector audit provenance: got %q, want %q", config.Branch, identity.WorkflowRef)
+	}
+}
+
+func TestDispatchBuildRejectsUnsafeOrUnknownRawParamsBeforeProvider(t *testing.T) {
+	identity := githubVersionIdentity()
+	for _, test := range []struct {
+		name   string
+		params map[string]any
+	}{
+		{name: "path unsafe app name", params: map[string]any{"app_name": "../escape"}},
+		{name: "control custom text", params: map[string]any{"custom_txt": "safe\nunsafe"}},
+		{name: "path unsafe version", params: map[string]any{"version": "../../etc"}},
+		{name: "wrong version type", params: map[string]any{"version": 1.4}},
+		{name: "unknown raw field", params: map[string]any{"raw_internal": "value"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(*http.Request) (*http.Response, error) {
+				t.Fatal("unexpected provider request for rejected raw dispatch params")
+				return nil, nil
+			}))
+			if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), identity, string(PlatformWindows), test.params); err == nil {
+				t.Fatal("DispatchBuild() error = nil, want raw dispatch parameter rejection")
+			}
+		})
+	}
+}
+
+func TestReleaseAssetPayloadRejectsMalformedResolvedRepository(t *testing.T) {
+	identity := githubVersionIdentity()
+	identity.Repo = "owner/repo?ref=mutable"
+	if _, err := releaseAssetPayloadForIdentity(identity); err == nil {
+		t.Fatal("releaseAssetPayloadForIdentity() error = nil, want malformed repository rejection")
+	}
+}
+
+func decryptTestPayload(encoded, passphrase string) (map[string]any, error) {
+	return (&GithubBuildConfigService{}).DecryptPayload(passphrase, encoded)
+}
+
+func TestDispatchBuildRejectsMissingWorkflowSelector(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("unexpected provider request: %s", req.URL.Path)
+		return nil, nil
+	}))
+	identity := githubVersionIdentity()
+	identity.WorkflowRef = ""
+	if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey}); err == nil {
+		t.Fatal("DispatchBuild() error = nil, want missing selector rejection")
+	}
+}
+
+func TestDispatchBuildRequiresConfiguredWorkflowSelectorIdentity(t *testing.T) {
+	identity := githubVersionIdentity()
+	for _, tc := range []struct {
+		name   string
+		branch string
+	}{
+		{name: "tampered tag selector", branch: "refs/tags/workflow-v2"},
+		{name: "unknown legacy selector", branch: "legacy-ref"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				t.Fatalf("unexpected provider request for mismatched workflow identity: %s %s", req.Method, req.URL.Path)
+				return nil, nil
+			}))
+			config := githubConfig()
+			config.Branch = tc.branch
+			if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey}); err == nil {
+				t.Fatal("DispatchBuild() error = nil, want configured-selector identity rejection")
+			}
+		})
+	}
+}
+
+func TestDispatchBuildRejectsMissingOrInvalidWorkflowSHA(t *testing.T) {
+	cases := []struct {
+		name string
+		sha  string
+	}{
+		{name: "missing", sha: ""},
+		{name: "invalid", sha: strings.Repeat("g", 40)},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				t.Fatalf("unexpected provider request: %s", req.URL.Path)
+				return nil, nil
+			}))
+			identity := githubVersionIdentity()
+			identity.WorkflowSHA = tc.sha
+			if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), identity, string(PlatformWindows), nil); err == nil {
+				t.Fatal("DispatchBuild() error = nil, want fail-closed workflow SHA rejection")
+			}
+		})
+	}
+}
+
+func TestDispatchBuildRejectsInvalidReleaseAssetIdentity(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("unexpected provider request: %s", req.URL.Path)
+		return nil, nil
+	}))
+	identity := githubVersionIdentity()
+	identity.AssetsRelease.Assets[0].Digest = "sha256:not-a-digest"
+	if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey}); err == nil {
+		t.Fatal("DispatchBuild() error = nil, want invalid release asset rejection")
+	}
+}
+
+func TestDispatchBuildRejectsUnvalidatedPlatformsAtServiceBoundary(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		t.Fatal("unexpected provider request for unavailable platform")
+		return nil, nil
+	}))
+	for _, platform := range []string{string(PlatformLinux), string(PlatformAndroid)} {
+		t.Run(platform, func(t *testing.T) {
+			result, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), githubVersionIdentity(), platform, nil)
+			var unavailable *ProductionCapabilityUnavailableError
+			if result != nil || !errors.As(err, &unavailable) {
+				t.Fatalf("DispatchBuild(%q) = %#v, %T %v; want capability rejection", platform, result, err, err)
+			}
+		})
+	}
+}
+
+func TestDispatchBuildRejectsMissingMalformedZeroAnd204(t *testing.T) {
+	cases := []struct {
+		name   string
+		status int
+		body   string
+	}{
+		{name: "missing run id", status: http.StatusOK, body: `{"run_url":"https://api.github.com/runs/1","html_url":"https://github.com/runs/1"}`},
+		{name: "zero run id", status: http.StatusOK, body: `{"workflow_run_id":0,"run_url":"https://api.github.com/runs/1","html_url":"https://github.com/runs/1"}`},
+		{name: "malformed body", status: http.StatusOK, body: `{"workflow_run_id":`},
+		{name: "unexpected 204", status: http.StatusNoContent, body: ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			identity := githubVersionIdentity()
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if req.Method == http.MethodGet && strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/") {
+					return testRulesetResponse(req, "workflow-*"), nil
+				}
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/rulesets") {
+					return testRulesetResponse(req, "workflow-*"), nil
+				}
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+					return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"tag"}}`, nil), nil
+				}
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("e", 40)) {
+					return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("e", 40)+`","object":{"sha":"`+identity.WorkflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+				}
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/git/ref/heads/workflow-v1") {
+					return githubResponse(http.StatusNotFound, `{"message":"branch not found"}`, nil), nil
+				}
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/contents/.github/workflows/rustqs-windows.yml") {
+					return githubResponse(http.StatusOK, testWorkflowFileResponse("rustqs-windows.yml"), nil), nil
+				}
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/actions/workflows/rustqs-windows.yml") {
+					return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+				}
+				return githubResponse(tc.status, tc.body, nil), nil
+			}))
+			result, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey})
+			if err == nil || result != nil {
+				t.Fatalf("DispatchBuild() = %#v, %v; want terminal error", result, err)
+			}
+			if !IsGithubTerminal(err) {
+				t.Fatalf("DispatchBuild() error is not terminal: %T %v", err, err)
+			}
+			if tc.status == http.StatusNoContent {
+				var contractErr *GithubContractError
+				if !errors.As(err, &contractErr) {
+					t.Fatalf("204 dispatch error = %T %v, want GithubContractError", err, err)
+				}
+			}
+		})
+	}
+}
+
+func TestGithubRESTStatusClassificationIsBoundedAndRedacted(t *testing.T) {
+	cases := []struct {
+		name      string
+		status    int
+		headers   http.Header
+		retryable bool
+		terminal  bool
+	}{
+		{name: "401", status: http.StatusUnauthorized, terminal: true},
+		{name: "403 ordinary", status: http.StatusForbidden, terminal: true},
+		{name: "403 rate limit", status: http.StatusForbidden, headers: http.Header{"X-Ratelimit-Remaining": []string{"0"}}, retryable: true},
+		{name: "403 retry after", status: http.StatusForbidden, headers: http.Header{"Retry-After": []string{"30"}}, retryable: true},
+		{name: "404", status: http.StatusNotFound, terminal: true},
+		{name: "409", status: http.StatusConflict, terminal: true},
+		{name: "422", status: http.StatusUnprocessableEntity, terminal: true},
+		{name: "429", status: http.StatusTooManyRequests, retryable: true},
+		{name: "500", status: http.StatusInternalServerError, retryable: true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(*http.Request) (*http.Response, error) {
+				body := strings.Repeat(`{"message":"token=github_pat_secret","enc_payload":"encrypted-payload"}`, 200)
+				return githubResponse(tc.status, body, tc.headers), nil
+			}))
+			_, err := (&GithubBuildConfigService{}).ghReq(context.Background(), githubConfig(), http.MethodGet, "/repos/owner/repo", nil, http.StatusOK)
+			var apiErr *GithubAPIError
+			if !errors.As(err, &apiErr) {
+				t.Fatalf("ghReq() error = %T %v, want GithubAPIError", err, err)
+			}
+			if apiErr.Retryable != tc.retryable || apiErr.Terminal != tc.terminal {
+				t.Fatalf("classification = retryable:%v terminal:%v, want retryable:%v terminal:%v", apiErr.Retryable, apiErr.Terminal, tc.retryable, tc.terminal)
+			}
+			if len(apiErr.Body) > githubErrorBodyLimit || strings.Contains(apiErr.Body, "github_pat_secret") || strings.Contains(apiErr.Body, "encrypted-payload") {
+				t.Fatalf("unsafe/unbounded API body: len=%d body=%q", len(apiErr.Body), apiErr.Body)
+			}
+		})
+	}
+}
+
+func TestGithubTransportErrorsAreRetryable(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		return nil, context.DeadlineExceeded
+	}))
+	_, err := (&GithubBuildConfigService{}).ghReq(context.Background(), githubConfig(), http.MethodGet, "/repos/owner/repo", nil, http.StatusOK)
+	var transportErr *GithubTransportError
+	if !errors.As(err, &transportErr) || !IsGithubRetryable(err) || IsGithubTerminal(err) {
+		t.Fatalf("transport classification = %T retryable=%v terminal=%v err=%v", err, IsGithubRetryable(err), IsGithubTerminal(err), err)
+	}
+}
+
+func TestGithubRequestRejectsUnsafeRepoBeforeTransport(t *testing.T) {
+	var requests int32
+	withGithubTransport(t, githubRoundTripFunc(func(*http.Request) (*http.Response, error) {
+		atomic.AddInt32(&requests, 1)
+		return githubResponse(http.StatusOK, `{}`, nil), nil
+	}))
+	for _, repo := range []string{"../repo", "owner/..", "./repo", ".", "..", `owner\\repo`} {
+		t.Run(repo, func(t *testing.T) {
+			cfg := githubConfig()
+			cfg.Repo = repo
+			_, err := (&GithubBuildConfigService{}).ghReq(context.Background(), cfg, http.MethodGet, "/repos/"+repo, nil, http.StatusOK)
+			if err == nil {
+				t.Fatalf("ghReq(%q) error = nil, want repository validation error", repo)
+			}
+		})
+	}
+	if got := atomic.LoadInt32(&requests); got != 0 {
+		t.Fatalf("unsafe repository reached transport %d time(s)", got)
+	}
+}
+
+func TestGithubConfigSaveRejectsUnsafeRepoBeforeDatabaseAccess(t *testing.T) {
+	for _, repo := range []string{"../repo", "owner/..", "./repo", ".", "..", `owner\\repo`, "owner/repo?ref=main"} {
+		t.Run(repo, func(t *testing.T) {
+			err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{Repo: repo})
+			if err == nil {
+				t.Fatalf("Save(%q) error = nil, want repository validation error", repo)
+			}
+		})
+	}
+}
+
+func TestDispatchBuildRejectsMissingProviderAsTypedConfigurationError(t *testing.T) {
+	identity := githubVersionIdentity()
+	for _, config := range []*model.GithubBuildConfig{
+		nil,
+		{Repo: "owner/repo", Token: "", PayloadKey: "payload-key"},
+		{Repo: "owner/repo", Token: "github_pat_test", PayloadKey: ""},
+		{Repo: "", Token: "github_pat_test", PayloadKey: "payload-key"},
+	} {
+		_, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, identity, string(PlatformWindows), nil)
+		var providerErr *GithubProviderConfigurationError
+		if !errors.As(err, &providerErr) {
+			t.Fatalf("DispatchBuild(%#v) error = %T %v, want GithubProviderConfigurationError", config, err, err)
+		}
+	}
+}
+
+func TestDispatchBuildRejectsNilOrEmptyParamsBeforeDFP1OrProviderPost(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		params map[string]any
+	}{
+		{name: "nil params"},
+		{name: "empty params", params: map[string]any{}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			var requests int32
+			var posts int32
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				atomic.AddInt32(&requests, 1)
+				if req.Method == http.MethodPost {
+					atomic.AddInt32(&posts, 1)
+				}
+				t.Fatalf("unexpected provider request before missing public-key gate: %s %s", req.Method, req.URL.Path)
+				return nil, nil
+			}))
+			_, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), githubConfig(), githubVersionIdentity(), string(PlatformWindows), test.params)
+			var providerErr *GithubProviderConfigurationError
+			if !errors.As(err, &providerErr) || !strings.Contains(err.Error(), "public key") {
+				t.Fatalf("DispatchBuild() error = %T %v, want typed public-key gate", err, err)
+			}
+			if requests != 0 || posts != 0 {
+				t.Fatalf("DispatchBuild() requests=%d posts=%d, want no provider or DFP1 dispatch", requests, posts)
+			}
+		})
+	}
+}
+
+func TestGithubResponseReadsAreBounded(t *testing.T) {
+	reader := &countingGithubReader{remaining: githubErrorBodyLimit * 10}
+	body, truncated, err := readGithubBody(reader, githubErrorBodyLimit)
+	if err != nil || !truncated {
+		t.Fatalf("readGithubBody() = len:%d truncated:%v err:%v", len(body), truncated, err)
+	}
+	if len(body) != githubErrorBodyLimit+1 || reader.read != githubErrorBodyLimit+1 {
+		t.Fatalf("readGithubBody() consumed unbounded body: returned=%d read=%d", len(body), reader.read)
+	}
+}
+
+func TestGithubRedactionCoversSensitiveValueCutAtBodyLimit(t *testing.T) {
+	prefix := `{"enc_payload":"`
+	body := []byte(prefix + strings.Repeat("s", githubErrorBodyLimit-len(prefix)+10))
+	bounded, truncated, err := readGithubBody(strings.NewReader(string(body)), githubErrorBodyLimit)
+	if err != nil || !truncated {
+		t.Fatalf("readGithubBody() = truncated:%v err:%v, want truncated body", truncated, err)
+	}
+	message := redactGithubBody(bounded)
+	if strings.Contains(message, "s") {
+		t.Fatalf("truncated sensitive field leaked in redacted body: %q", message)
+	}
+	if !strings.Contains(message, "[REDACTED]") {
+		t.Fatalf("truncated sensitive field was not redacted: %q", message)
+	}
+}
+
+func TestGithubRedactionHandlesSensitiveValuesCutAtBoundedInput(t *testing.T) {
+	cases := []struct {
+		name         string
+		field        string
+		secret       string
+		secretPrefix string
+	}{
+		{name: "enc payload", field: `{"enc_payload":"`, secret: strings.Repeat("e", 64), secretPrefix: "eeee"},
+		{name: "token", field: `{"token":"`, secret: "token-boundary-secret", secretPrefix: "token-boundary"},
+		{name: "authorization", field: "Authorization: Bearer ", secret: "authorization-boundary-secret", secretPrefix: "authorization-boundary"},
+		{name: "PAT", field: "PAT=", secret: "github_pat_boundary_secret", secretPrefix: "github_pat_boundary"},
+		{name: "payload key", field: "payload-key=", secret: "payload-key-boundary-secret", secretPrefix: "payload-key-boundary"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			padding := githubErrorBodyLimit - len(tc.field) - 1
+			body := []byte(strings.Repeat("x", padding) + tc.field + tc.secret)
+			bounded, truncated, err := readGithubBody(strings.NewReader(string(body)), githubErrorBodyLimit)
+			if err != nil || !truncated || len(bounded) != githubErrorBodyLimit+1 {
+				t.Fatalf("readGithubBody() = len:%d truncated:%v err:%v", len(bounded), truncated, err)
+			}
+			message := redactGithubBody(bounded)
+			if strings.Contains(message, tc.secretPrefix) {
+				t.Fatalf("sensitive prefix leaked after bounded redaction: %q", message)
+			}
+		})
+	}
+}
+
+func TestGithubErrorDetailIsBoundedAndDoesNotFormatNestedProviderData(t *testing.T) {
+	err := fmt.Errorf("outer: %w", &GithubProviderConfigurationError{Cause: fmt.Errorf(
+		"provider response https://api.github.com/repos/owner/repo/refs/tags/private: %w",
+		&GithubAPIError{
+			StatusCode: http.StatusForbidden,
+			Terminal:   true,
+			Body:       `{"message":"token=github_pat_secret enc_payload=private-payload"}`,
+		},
+	)})
+	detail := GithubErrorDetail(err)
+	if len(detail) > githubDiagnosticLimit {
+		t.Fatalf("GithubErrorDetail() length = %d, want <= %d", len(detail), githubDiagnosticLimit)
+	}
+	for _, forbidden := range []string{
+		"api.github.com",
+		"refs/tags/private",
+		"github_pat_secret",
+		"private-payload",
+		"token=",
+		"enc_payload",
+	} {
+		if strings.Contains(detail, forbidden) {
+			t.Fatalf("GithubErrorDetail() leaked %q: %q", forbidden, detail)
+		}
+	}
+	if !strings.Contains(detail, "status=403") || !strings.Contains(detail, "GitHub provider request failed") {
+		t.Fatalf("GithubErrorDetail() = %q, want safe status/classification", detail)
+	}
+}
+
+func TestGithubRESTSuccessPathsUseExpectedStatusBeforeDecode(t *testing.T) {
+	publicKey := base64.StdEncoding.EncodeToString(make([]byte, 32))
+	artifactPayload := serviceArtifactZip(t, "zip-bytes")
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch {
+		case strings.HasSuffix(req.URL.Path, "/actions/runs/7"):
+			return githubResponse(http.StatusOK, `{"status":"in_progress","conclusion":null}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/artifacts"):
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact"}]}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/artifacts/42/zip"):
+			return githubResponse(http.StatusOK, string(artifactPayload), nil), nil
+		case strings.HasSuffix(req.URL.Path, "/releases"):
+			return githubResponse(http.StatusOK, `[{"id":12,"tag_name":"offline-assets-1.2.3"}]`, nil), nil
+		case req.URL.Path == "/repos/owner/repo/releases/12":
+			return githubResponse(http.StatusOK, testReleaseDetails(12, "offline-assets-1.2.3"), nil), nil
+		case req.URL.Path == "/repos/owner/repo/git/ref/tags/1.2.3":
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.2.3","object":{"sha":"0123456789abcdef0123456789abcdef01234567","type":"commit"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/actions/secrets/public-key"):
+			return githubResponse(http.StatusOK, `{"key_id":"key-id","key":"`+publicKey+`"}`, nil), nil
+		case strings.Contains(req.URL.Path, "/actions/secrets/"):
+			return githubResponse(http.StatusNoContent, "", nil), nil
+		case req.URL.Path == "/repos/owner/repo":
+			return githubResponse(http.StatusOK, `{}`, nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	s := &GithubBuildConfigService{}
+	cfg := githubConfig()
+	status, conclusion, err := s.RunStatus(context.Background(), cfg, 7)
+	if err != nil || status != "in_progress" || conclusion != "" {
+		t.Fatalf("RunStatus() = %q, %q, %v", status, conclusion, err)
+	}
+	artifact, err := s.DownloadArtifact(context.Background(), cfg, 7, 0, "artifact")
+	if err != nil {
+		t.Fatalf("DownloadArtifact() error = %v", err)
+	}
+	t.Cleanup(func() { _ = os.Remove(artifact.ArchivePath) })
+	contents, err := os.ReadFile(artifact.ArchivePath)
+	if err != nil || !bytes.Equal(contents, artifactPayload) || artifact.ArtifactID != 42 || artifact.ArtifactName != "artifact" || artifact.Size != int64(len(contents)) {
+		t.Fatalf("DownloadArtifact() = %#v, contents=%q, err=%v", artifact, contents, err)
+	}
+	versions, err := s.fetchReleasesWithConfig(context.Background(), cfg, WorkflowExecutionIdentity{Ref: defaultWorkflowExecutionRef, SHA: strings.Repeat("f", 40)})
+	if err != nil || len(versions) != 1 || versions[0].DisplayVersion != "1.2.3" {
+		t.Fatalf("fetchReleasesWithConfig() = %#v, %v", versions, err)
+	}
+	if err := s.TestConnectionError(cfg); err != nil {
+		t.Fatalf("TestConnectionError() = %v", err)
+	}
+	if err := s.SetWorkflowSecret(cfg); err != nil {
+		t.Fatalf("SetWorkflowSecret() = %v", err)
+	}
+}
+
+func TestRunStatusDetailsCapturesExactHeadSHA(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path != "/repos/owner/repo/actions/runs/7" {
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+		return githubResponse(http.StatusOK, `{"status":"completed","conclusion":"success","head_sha":"0123456789abcdef0123456789abcdef01234567"}`, nil), nil
+	}))
+	details, err := (&GithubBuildConfigService{}).RunStatusDetails(context.Background(), githubConfig(), 7)
+	if err != nil {
+		t.Fatalf("RunStatusDetails() error = %v", err)
+	}
+	if details.Status != "completed" || details.Conclusion != "success" || details.SourceSHA != "0123456789abcdef0123456789abcdef01234567" {
+		t.Fatalf("RunStatusDetails() = %#v, want exact status/conclusion/head_sha", details)
+	}
+}
+
+func TestRunStatusDetailsRejectsUnboundedOrInvalidHeadSHA(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return githubResponse(http.StatusOK, `{"status":"completed","conclusion":"failure","head_sha":"not-a-sha"}`, nil), nil
+	}))
+	_, err := (&GithubBuildConfigService{}).RunStatusDetails(context.Background(), githubConfig(), 7)
+	var contractErr *GithubContractError
+	if !errors.As(err, &contractErr) || !strings.Contains(err.Error(), "head_sha") {
+		t.Fatalf("RunStatusDetails() error = %T %v, want bounded head_sha contract rejection", err, err)
+	}
+}
+
+func TestDownloadArtifactRequiresExactRequestedName(t *testing.T) {
+	var zipRequests int32
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasSuffix(req.URL.Path, "/artifacts") {
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"different-artifact"}]}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/artifacts/42/zip") {
+			atomic.AddInt32(&zipRequests, 1)
+			return githubResponse(http.StatusOK, "must-not-download", nil), nil
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+	}))
+
+	_, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 0, "requested-artifact")
+	var unavailable *GithubArtifactUnavailableError
+	if !errors.As(err, &unavailable) || !IsGithubTerminal(err) || IsGithubRetryable(err) {
+		t.Fatalf("DownloadArtifact() error = %T %v, want typed terminal availability error", err, err)
+	}
+	if atomic.LoadInt32(&zipRequests) != 0 {
+		t.Fatal("DownloadArtifact() downloaded an arbitrary sole artifact")
+	}
+}
+
+func TestGithubEndpointErrorsRemainTypedAcrossCallers(t *testing.T) {
+	type endpointCase struct {
+		name string
+		call func(*GithubBuildConfigService, *model.GithubBuildConfig) error
+	}
+	endpoints := []endpointCase{
+		{name: "run status", call: func(s *GithubBuildConfigService, c *model.GithubBuildConfig) error {
+			_, _, err := s.RunStatus(context.Background(), c, 7)
+			return err
+		}},
+		{name: "artifact list", call: func(s *GithubBuildConfigService, c *model.GithubBuildConfig) error {
+			_, err := s.DownloadArtifact(context.Background(), c, 7, 0, "artifact")
+			return err
+		}},
+		{name: "release list", call: func(s *GithubBuildConfigService, c *model.GithubBuildConfig) error {
+			_, err := s.fetchReleasesWithConfig(context.Background(), c, WorkflowExecutionIdentity{Ref: defaultWorkflowExecutionRef, SHA: strings.Repeat("f", 40)})
+			return err
+		}},
+		{name: "test connection", call: func(s *GithubBuildConfigService, c *model.GithubBuildConfig) error {
+			return s.TestConnectionError(c)
+		}},
+		{name: "secret public key", call: func(s *GithubBuildConfigService, c *model.GithubBuildConfig) error {
+			return s.SetWorkflowSecret(c)
+		}},
+	}
+	statuses := []struct {
+		name      string
+		status    int
+		retryable bool
+	}{
+		{name: "401", status: http.StatusUnauthorized},
+		{name: "403", status: http.StatusForbidden},
+		{name: "404", status: http.StatusNotFound},
+		{name: "410", status: http.StatusGone},
+		{name: "409", status: http.StatusConflict},
+		{name: "422", status: http.StatusUnprocessableEntity},
+		{name: "429", status: http.StatusTooManyRequests, retryable: true},
+		{name: "500", status: http.StatusInternalServerError, retryable: true},
+		{name: "408", status: http.StatusRequestTimeout, retryable: true},
+		{name: "425", status: http.StatusTooEarly, retryable: true},
+	}
+	for _, endpoint := range endpoints {
+		for _, status := range statuses {
+			t.Run(endpoint.name+"/"+status.name, func(t *testing.T) {
+				withGithubTransport(t, githubRoundTripFunc(func(*http.Request) (*http.Response, error) {
+					return githubResponse(status.status, `{"message":"bounded failure"}`, nil), nil
+				}))
+				err := endpoint.call(&GithubBuildConfigService{}, githubConfig())
+				var apiErr *GithubAPIError
+				if !errors.As(err, &apiErr) {
+					t.Fatalf("error = %T %v, want GithubAPIError", err, err)
+				}
+				if apiErr.Retryable != status.retryable || apiErr.Terminal == status.retryable {
+					t.Fatalf("classification = retryable:%v terminal:%v for status %d", apiErr.Retryable, apiErr.Terminal, status.status)
+				}
+			})
+		}
+	}
+}
+
+func TestGithubPollErrorPolicyDoesNotRetryTerminalErrors(t *testing.T) {
+	terminal := &GithubAPIError{StatusCode: http.StatusUnauthorized, Terminal: true}
+	retryable := &GithubAPIError{StatusCode: http.StatusTooManyRequests, Retryable: true}
+	if IsGithubRetryable(terminal) || githubPollErrorActionForService(terminal) != false {
+		t.Fatalf("terminal API error was classified as retryable")
+	}
+	if !IsGithubRetryable(retryable) || githubPollErrorActionForService(retryable) != true {
+		t.Fatalf("retryable API error was not retained as retryable")
+	}
+}
+
+func githubPollErrorActionForService(err error) bool {
+	return IsGithubRetryable(err) && !IsGithubTerminal(err)
+}
diff --git a/api/service/producer_manifest.go b/api/service/producer_manifest.go
new file mode 100644
index 0000000..5b0a851
--- /dev/null
+++ b/api/service/producer_manifest.go
@@ -0,0 +1,692 @@
+package service
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"unicode/utf8"
+
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/utils"
+)
+
+const (
+	ProducerManifestFilename           = "manifest.txt"
+	ProducerManifestSchema             = "deskforge.client-artifact"
+	ProducerManifestVersion            = 2
+	ProducerManifestDigestScope        = "sha256 covers public delivered output files; manifest.txt and declared private files are excluded"
+	producerManifestLegacyDigestScope  = "sha256 covers delivered output files; manifest.txt is excluded"
+	ProducerManifestVerificationScope  = "producer-reported source_sha, workflow_sha, workflow_ref, version, source_tree_sha, recursive submodule commits, and delivered output file names, sizes, and SHA-256 values"
+	producerManifestLegacyScope        = "source_sha, workflow_sha, workflow_ref, version, source_tree_sha, recursive submodule commits, and delivered output file names, sizes, and SHA-256 values"
+	ProducerManifestVerificationResult = "reported"
+	ProducerManifestHandoffContract    = "deskforge.client-artifact-handoff-v1"
+	MaxProducerManifestBytes           = 64 << 10
+)
+
+// ProducerManifest is the exact JSON schema emitted by the active RustDesk
+// client workflows in manifest.txt. It is deliberately shared by all
+// platforms; platform-specific output names are derived by
+// ExpectedProducerOutputFilenames rather than parsed by individual callers.
+type ProducerManifest struct {
+	Schema               string                      `json:"schema"`
+	ManifestSchema       string                      `json:"manifest_schema"`
+	SchemaVersion        int                         `json:"schema_version"`
+	Platform             string                      `json:"platform"`
+	AppName              string                      `json:"app_name"`
+	OutputFilenames      []string                    `json:"output_filenames"`
+	SourceSHA            string                      `json:"source_sha"`
+	WorkflowSHA          string                      `json:"workflow_sha"`
+	WorkflowRef          string                      `json:"workflow_ref"`
+	Version              string                      `json:"version"`
+	SourceTreeSHA        string                      `json:"source_tree_sha"`
+	Submodules           []ProducerManifestSubmodule `json:"submodules"`
+	DigestScope          string                      `json:"digest_scope"`
+	VerificationScope    string                      `json:"verification_scope"`
+	VerificationResult   string                      `json:"verification_result"`
+	PublicationTimestamp int64                       `json:"publication_timestamp"`
+	HandoffContract      string                      `json:"handoff_contract"`
+	Files                []ProducerManifestFile      `json:"files"`
+	PrivateFilenames     []string                    `json:"private_filenames"`
+}
+
+type ProducerManifestFile struct {
+	Name   string `json:"name"`
+	Size   int64  `json:"size"`
+	SHA256 string `json:"sha256"`
+}
+
+type ProducerManifestSubmodule struct {
+	Path      string `json:"path"`
+	CommitSHA string `json:"commit_sha"`
+}
+
+// ParseProducerManifest parses one bounded producer manifest and rejects
+// unknown fields, duplicate JSON keys, trailing values, and malformed JSON.
+func ParseProducerManifest(data []byte) (ProducerManifest, error) {
+	if len(data) == 0 || len(data) > MaxProducerManifestBytes {
+		return ProducerManifest{}, fmt.Errorf("producer manifest must be between 1 and %d bytes", MaxProducerManifestBytes)
+	}
+	if err := rejectDuplicateJSONKeys(data); err != nil {
+		return ProducerManifest{}, err
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	var manifest ProducerManifest
+	if err := decoder.Decode(&manifest); err != nil {
+		return ProducerManifest{}, fmt.Errorf("decode producer manifest: %w", err)
+	}
+	var extra json.RawMessage
+	if err := decoder.Decode(&extra); err != io.EOF {
+		if err == nil {
+			return ProducerManifest{}, errors.New("producer manifest contains trailing JSON")
+		}
+		return ProducerManifest{}, fmt.Errorf("decode producer manifest trailing data: %w", err)
+	}
+	if err := manifest.validateShape(); err != nil {
+		return ProducerManifest{}, err
+	}
+	return manifest, nil
+}
+
+func (m ProducerManifest) validateShape() error {
+	if m.Schema != ProducerManifestSchema {
+		return fmt.Errorf("producer manifest schema must be %q", ProducerManifestSchema)
+	}
+	if m.SchemaVersion == 1 {
+		return m.validateLegacyShape()
+	}
+	if m.SchemaVersion != ProducerManifestVersion || m.ManifestSchema != ProducerManifestSchema {
+		return fmt.Errorf("producer manifest schema must be %q version %d", ProducerManifestSchema, ProducerManifestVersion)
+	}
+	if err := validateProducerPlatform(m.Platform); err != nil {
+		return fmt.Errorf("producer manifest platform: %w", err)
+	}
+	if err := ValidateOutputAppName(m.AppName); err != nil {
+		return fmt.Errorf("producer manifest app_name: %w", err)
+	}
+	if !utils.ValidateBuildVersion(m.Version) {
+		return errors.New("producer manifest version is invalid")
+	}
+	if !validGithubSourceSHA(m.SourceSHA) || !validGithubSourceSHA(m.WorkflowSHA) {
+		return errors.New("producer manifest source/workflow SHA must be 40-64 hexadecimal characters")
+	}
+	if m.WorkflowRef == "" || strings.TrimSpace(m.WorkflowRef) != m.WorkflowRef || strings.ContainsAny(m.WorkflowRef, "\r\n\x00") {
+		return errors.New("producer manifest workflow_ref is invalid")
+	}
+	if m.DigestScope != ProducerManifestDigestScope && (m.DigestScope != producerManifestLegacyDigestScope || len(m.PrivateFilenames) != 0) {
+		return fmt.Errorf("producer manifest digest_scope must be %q", ProducerManifestDigestScope)
+	}
+	if !validGithubSourceSHA(m.SourceTreeSHA) {
+		return errors.New("producer manifest source_tree_sha must be 40-64 hexadecimal characters")
+	}
+	if m.Submodules == nil {
+		return errors.New("producer manifest submodules must be present")
+	}
+	if err := validateProducerSubmodules(m.Submodules); err != nil {
+		return err
+	}
+	if err := validateProducerPrivateFilenames(m.PrivateFilenames); err != nil {
+		return err
+	}
+	if m.VerificationScope != ProducerManifestVerificationScope && m.VerificationScope != producerManifestLegacyScope {
+		return fmt.Errorf("producer manifest verification_scope must be %q", ProducerManifestVerificationScope)
+	}
+	if m.VerificationResult != ProducerManifestVerificationResult && m.VerificationResult != "verified" {
+		return fmt.Errorf("producer manifest verification_result must be %q", ProducerManifestVerificationResult)
+	}
+	if m.PublicationTimestamp <= 0 {
+		return errors.New("producer manifest publication_timestamp must be positive")
+	}
+	if m.HandoffContract != ProducerManifestHandoffContract {
+		return fmt.Errorf("producer manifest handoff_contract must be %q", ProducerManifestHandoffContract)
+	}
+	expected, err := ExpectedProducerOutputFilenames(m.Platform, m.AppName, m.Version)
+	if err != nil {
+		return err
+	}
+	if !sameStrings(m.OutputFilenames, expected) {
+		return fmt.Errorf("producer manifest output_filenames = %v, want %v", m.OutputFilenames, expected)
+	}
+	if len(m.Files) != len(expected) {
+		return fmt.Errorf("producer manifest files must contain exactly %d entries", len(expected))
+	}
+	seen := make(map[string]struct{}, len(m.Files))
+	for index, file := range m.Files {
+		if file.Name != expected[index] {
+			return fmt.Errorf("producer manifest file %d name = %q, want %q", index, file.Name, expected[index])
+		}
+		if err := validateProducerFilenameForPlatform(file.Name, m.Platform); err != nil {
+			return err
+		}
+		if file.Size < 0 {
+			return fmt.Errorf("producer manifest file %q has a negative size", file.Name)
+		}
+		key := strings.ToLower(file.Name)
+		if _, exists := seen[key]; exists {
+			return fmt.Errorf("producer manifest contains duplicate or case-colliding file %q", file.Name)
+		}
+		seen[key] = struct{}{}
+		if len(file.SHA256) != sha256.Size*2 || !isLowerHex(file.SHA256) {
+			return fmt.Errorf("producer manifest file %q has an invalid SHA-256", file.Name)
+		}
+	}
+	return nil
+}
+
+func (m ProducerManifest) validateLegacyShape() error {
+	if m.ManifestSchema != "" || m.SourceTreeSHA != "" || m.Submodules != nil || m.VerificationScope != "" || m.VerificationResult != "" || m.PublicationTimestamp != 0 || m.HandoffContract != "" || m.PrivateFilenames != nil {
+		return errors.New("legacy producer manifest contains v2-only fields")
+	}
+	if err := ValidateCustomPlatform(m.Platform); err != nil {
+		return fmt.Errorf("producer manifest platform: %w", err)
+	}
+	if err := ValidateOutputAppName(m.AppName); err != nil {
+		return fmt.Errorf("producer manifest app_name: %w", err)
+	}
+	if !utils.ValidateBuildVersion(m.Version) || !validGithubSourceSHA(m.SourceSHA) || !validGithubSourceSHA(m.WorkflowSHA) {
+		return errors.New("legacy producer manifest identity is invalid")
+	}
+	if m.WorkflowRef == "" || strings.TrimSpace(m.WorkflowRef) != m.WorkflowRef || strings.ContainsAny(m.WorkflowRef, "\r\n\x00") {
+		return errors.New("legacy producer manifest workflow_ref is invalid")
+	}
+	if m.DigestScope != producerManifestLegacyDigestScope {
+		return fmt.Errorf("legacy producer manifest digest_scope must be %q", producerManifestLegacyDigestScope)
+	}
+	expected, err := ExpectedProducerOutputFilenames(m.Platform, m.AppName, m.Version)
+	if err != nil {
+		return err
+	}
+	if !sameStrings(m.OutputFilenames, expected) || len(m.Files) != len(expected) {
+		return errors.New("legacy producer manifest output files are invalid")
+	}
+	for index, file := range m.Files {
+		if file.Name != expected[index] || file.Size != 0 || len(file.SHA256) != sha256.Size*2 || !isLowerHex(file.SHA256) {
+			return fmt.Errorf("legacy producer manifest file %q is invalid", file.Name)
+		}
+	}
+	return nil
+}
+
+func validateProducerPrivateFilenames(filenames []string) error {
+	if len(filenames) == 0 {
+		return nil
+	}
+	if len(filenames) != 1 || filenames[0] != "custom_.txt" {
+		return errors.New("producer manifest private_filenames may contain only custom_.txt")
+	}
+	return nil
+}
+
+func validateProducerPlatform(platform string) error {
+	if platform == "bridge" {
+		return nil
+	}
+	return ValidateCustomPlatform(platform)
+}
+
+func validateProducerSubmodules(submodules []ProducerManifestSubmodule) error {
+	seen := make(map[string]struct{}, len(submodules))
+	previous := ""
+	for _, submodule := range submodules {
+		if submodule.Path == "" || strings.TrimSpace(submodule.Path) != submodule.Path || strings.ContainsAny(submodule.Path, "\\\x00\r\n") || filepath.IsAbs(submodule.Path) || filepath.Clean(submodule.Path) != submodule.Path || submodule.Path == "." || submodule.Path == ".." || strings.HasPrefix(submodule.Path, "../") {
+			return fmt.Errorf("producer manifest submodule path %q is invalid", submodule.Path)
+		}
+		if _, exists := seen[submodule.Path]; exists {
+			return fmt.Errorf("producer manifest contains duplicate submodule path %q", submodule.Path)
+		}
+		if previous != "" && previous >= submodule.Path {
+			return errors.New("producer manifest submodules must be sorted by path")
+		}
+		if !validGithubSourceSHA(submodule.CommitSHA) {
+			return fmt.Errorf("producer manifest submodule %q commit SHA is invalid", submodule.Path)
+		}
+		seen[submodule.Path] = struct{}{}
+		previous = submodule.Path
+	}
+	return nil
+}
+
+// StoredJSON returns the bounded, secret-free producer provenance persisted
+// with a published provider artifact.
+func (m ProducerManifest) StoredJSON() (string, error) {
+	if m.SchemaVersion != ProducerManifestVersion {
+		return "", errors.New("only the current producer manifest can be stored")
+	}
+	// v2 artifacts emitted before the producer/source evidence boundary used
+	// "verified" for self-reported source-tree data. Keep parsing that v2
+	// shape for compatibility, but never persist or export that label again.
+	normalized := m
+	normalized.DigestScope = ProducerManifestDigestScope
+	normalized.VerificationScope = ProducerManifestVerificationScope
+	normalized.VerificationResult = ProducerManifestVerificationResult
+	if err := normalized.validateShape(); err != nil {
+		return "", err
+	}
+	encoded, err := json.Marshal(normalized)
+	if err != nil {
+		return "", fmt.Errorf("marshal producer manifest: %w", err)
+	}
+	return string(encoded), nil
+}
+
+// ProducerManifestFromStoredJSON parses the redacted producer provenance
+// retained for deterministic handoff exports.
+func ProducerManifestFromStoredJSON(value string) (ProducerManifest, error) {
+	if value == "" {
+		return ProducerManifest{}, errors.New("stored producer manifest is missing")
+	}
+	manifest, err := ParseProducerManifest([]byte(value))
+	if err != nil {
+		return ProducerManifest{}, fmt.Errorf("stored producer manifest: %w", err)
+	}
+	return manifest, nil
+}
+
+// ValidateProducerManifestForBuild compares producer-owned identity with the
+// immutable build snapshot. The caller must use this before any output is
+// published or exposed.
+func ValidateProducerManifestForBuild(manifest ProducerManifest, build *model.CustomBuild) error {
+	if build == nil {
+		return errors.New("build record is required for producer manifest validation")
+	}
+	if err := manifest.validateShape(); err != nil {
+		return err
+	}
+	if RequiresProducerManifest(build) && manifest.SchemaVersion != ProducerManifestVersion {
+		return errors.New("provider artifact requires the current producer manifest contract")
+	}
+	if manifest.Platform != build.Platform || manifest.AppName != build.AppName || manifest.Version != build.Version {
+		return errors.New("producer manifest platform, app_name, or version does not match stored build")
+	}
+	if !strings.EqualFold(manifest.SourceSHA, build.BuildRef) {
+		return errors.New("producer manifest source_sha does not match stored source identity")
+	}
+	if !strings.EqualFold(manifest.WorkflowSHA, build.GithubRef) {
+		return errors.New("producer manifest workflow_sha does not match stored workflow identity")
+	}
+	if !producerWorkflowRefMatches(manifest.WorkflowRef, build.WorkflowSelector) {
+		return errors.New("producer manifest workflow_ref does not match stored workflow selector")
+	}
+	if build.ProducerManifestJSON != "" {
+		stored, err := ProducerManifestFromStoredJSON(build.ProducerManifestJSON)
+		if err != nil {
+			return err
+		}
+		storedJSON, err := stored.StoredJSON()
+		if err != nil {
+			return err
+		}
+		candidateJSON, err := manifest.StoredJSON()
+		if err != nil {
+			return err
+		}
+		if storedJSON != candidateJSON {
+			return errors.New("producer manifest does not match stored producer provenance")
+		}
+	}
+	return nil
+}
+
+// GitHub exposes workflow_dispatch's run ref as refs/heads/<selector> (or
+// refs/tags/<selector>), while DeskForge stores the exact selector sent in the
+// dispatch request without that transport prefix. These are the only accepted
+// equivalent representations; arbitrary ref inference is not allowed.
+func producerWorkflowRefMatches(producer, stored string) bool {
+	if producer == stored {
+		return true
+	}
+	return strings.TrimPrefix(strings.TrimPrefix(producer, "refs/heads/"), "refs/tags/") == stored
+}
+
+// ExpectedProducerOutputFilenames is the one platform mapping shared by
+// manifest validation and extraction. These names match the active workflow
+// assertions exactly and preserve the existing artifact names.
+func ExpectedProducerOutputFilenames(platform, appName, version string) ([]string, error) {
+	if err := validateProducerPlatform(platform); err != nil {
+		return nil, err
+	}
+	if err := ValidateOutputAppName(appName); err != nil {
+		return nil, err
+	}
+	if !utils.ValidateBuildVersion(version) {
+		return nil, errors.New("producer output version is invalid")
+	}
+	var names []string
+	switch platform {
+	case string(PlatformWindows):
+		names = []string{appName + ".exe"}
+	case string(PlatformLinux):
+		// This is Python sorted() order used by rustqs-linux.yml: '-' sorts
+		// before '.', so the RPM entry precedes the DEB entry.
+		names = []string{appName + "-" + version + "-0.x86_64.rpm", appName + "-" + version + ".deb"}
+	case string(PlatformAndroid):
+		names = []string{appName + ".apk"}
+	case "bridge":
+		if appName != "rustdesk-bridge" {
+			return nil, errors.New("bridge producer app_name must be rustdesk-bridge")
+		}
+		names = []string{
+			"flutter/ios/Runner/bridge_generated.h",
+			"flutter/lib/generated_bridge.dart",
+			"flutter/lib/generated_bridge.freezed.dart",
+			"flutter/macos/Runner/bridge_generated.h",
+			"src/bridge_generated.io.rs",
+			"src/bridge_generated.rs",
+		}
+	}
+	return names, nil
+}
+
+// RequiresProducerManifest identifies new provider-run artifacts. Rows without
+// a run and immutable identity are the explicit legacy compatibility boundary;
+// any provider-run row must carry the active workflow manifest.
+func RequiresProducerManifest(build *model.CustomBuild) bool {
+	if build == nil {
+		return false
+	}
+	return build.GithubRunId > 0 || build.BuildRef != "" || build.WorkflowSelector != "" || build.GithubRef != "" || build.GithubSourceSha != ""
+}
+
+// ValidateProducerManifestOutput verifies that staging contains exactly the
+// manifest-declared regular files and that every declared SHA-256 matches the
+// extracted bytes. manifest.txt is never part of the published output.
+func ValidateProducerManifestOutput(manifest ProducerManifest, outputDir string) (int64, error) {
+	if err := manifest.validateShape(); err != nil {
+		return 0, err
+	}
+	if manifest.Platform == "bridge" {
+		return validateNestedProducerManifestOutput(manifest, outputDir)
+	}
+	entries, err := os.ReadDir(outputDir)
+	if err != nil {
+		return 0, fmt.Errorf("read producer output: %w", err)
+	}
+	if len(entries) != len(manifest.Files)+len(manifest.PrivateFilenames) {
+		return 0, fmt.Errorf("producer output contains %d entries, want %d", len(entries), len(manifest.Files)+len(manifest.PrivateFilenames))
+	}
+	expected := make(map[string]ProducerManifestFile, len(manifest.Files))
+	for _, file := range manifest.Files {
+		expected[file.Name] = file
+	}
+	private := make(map[string]struct{}, len(manifest.PrivateFilenames))
+	for _, name := range manifest.PrivateFilenames {
+		private[name] = struct{}{}
+	}
+	var total uint64
+	for _, entry := range entries {
+		info, err := os.Lstat(filepath.Join(outputDir, entry.Name()))
+		if err != nil {
+			return 0, fmt.Errorf("inspect producer output %q: %w", entry.Name(), err)
+		}
+		if _, ok := expected[entry.Name()]; !ok {
+			if _, isPrivate := private[entry.Name()]; isPrivate {
+				if err := validatePrivateProducerOutputFile(entry.Name(), info); err != nil {
+					return 0, err
+				}
+				if total > maxPublishedOutputTotalBytes-uint64(info.Size()) {
+					return 0, errors.New("producer output exceeds aggregate size limit")
+				}
+				total += uint64(info.Size())
+				continue
+			}
+			return 0, fmt.Errorf("producer output contains unexpected file %q", entry.Name())
+		}
+		if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
+			return 0, fmt.Errorf("producer output %q is not a regular file", entry.Name())
+		}
+		file, err := os.Open(filepath.Join(outputDir, entry.Name()))
+		if err != nil {
+			return 0, fmt.Errorf("open producer output %q: %w", entry.Name(), err)
+		}
+		hasher := sha256.New()
+		copied, copyErr := io.Copy(hasher, io.LimitReader(file, int64(maxPublishedOutputFileBytes)+1))
+		closeErr := file.Close()
+		if copyErr != nil || closeErr != nil {
+			return 0, fmt.Errorf("hash producer output %q: %w", entry.Name(), firstError(copyErr, closeErr))
+		}
+		if copied != info.Size() || uint64(copied) > maxPublishedOutputFileBytes {
+			return 0, fmt.Errorf("producer output %q changed or exceeds size limit", entry.Name())
+		}
+		if expected[entry.Name()].Size != info.Size() {
+			return 0, fmt.Errorf("producer output %q size does not match manifest", entry.Name())
+		}
+		if !strings.EqualFold(hex.EncodeToString(hasher.Sum(nil)), expected[entry.Name()].SHA256) {
+			return 0, fmt.Errorf("producer output %q does not match manifest SHA-256", entry.Name())
+		}
+		if total > maxPublishedOutputTotalBytes-uint64(copied) {
+			return 0, errors.New("producer output exceeds aggregate size limit")
+		}
+		total += uint64(copied)
+	}
+	return int64(total), nil
+}
+
+func validateNestedProducerManifestOutput(manifest ProducerManifest, outputDir string) (int64, error) {
+	rootInfo, err := os.Lstat(outputDir)
+	if err != nil {
+		return 0, fmt.Errorf("inspect producer output: %w", err)
+	}
+	if rootInfo.Mode()&os.ModeSymlink != 0 || !rootInfo.IsDir() {
+		return 0, errors.New("producer output is not a regular directory")
+	}
+	expected := make(map[string]ProducerManifestFile, len(manifest.Files))
+	for _, file := range manifest.Files {
+		expected[file.Name] = file
+	}
+	seen := make(map[string]struct{}, len(expected))
+	private := make(map[string]struct{}, len(manifest.PrivateFilenames))
+	for _, name := range manifest.PrivateFilenames {
+		private[name] = struct{}{}
+	}
+	var total uint64
+	err = filepath.WalkDir(outputDir, func(current string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if current == outputDir {
+			return nil
+		}
+		if entry.Type()&os.ModeSymlink != 0 {
+			return fmt.Errorf("producer output %q contains a symlink", entry.Name())
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		info, infoErr := entry.Info()
+		if infoErr != nil {
+			return infoErr
+		}
+		if !info.Mode().IsRegular() {
+			return fmt.Errorf("producer output %q is not a regular file", entry.Name())
+		}
+		relative, relErr := filepath.Rel(outputDir, current)
+		if relErr != nil {
+			return relErr
+		}
+		name := filepath.ToSlash(relative)
+		declared, ok := expected[name]
+		if !ok {
+			if _, isPrivate := private[name]; isPrivate {
+				if err := validatePrivateProducerOutputFile(name, info); err != nil {
+					return err
+				}
+				if total > maxPublishedOutputTotalBytes-uint64(info.Size()) {
+					return errors.New("producer output exceeds aggregate size limit")
+				}
+				total += uint64(info.Size())
+				seen[name] = struct{}{}
+				return nil
+			}
+			return fmt.Errorf("producer output contains unexpected file %q", name)
+		}
+		if _, exists := seen[name]; exists {
+			return fmt.Errorf("producer output contains duplicate file %q", name)
+		}
+		seen[name] = struct{}{}
+		file, openErr := os.Open(current)
+		if openErr != nil {
+			return openErr
+		}
+		hasher := sha256.New()
+		copied, copyErr := io.Copy(hasher, io.LimitReader(file, int64(maxPublishedOutputFileBytes)+1))
+		closeErr := file.Close()
+		if copyErr != nil || closeErr != nil {
+			return firstError(copyErr, closeErr)
+		}
+		if copied != info.Size() || uint64(copied) > maxPublishedOutputFileBytes {
+			return fmt.Errorf("producer output %q changed or exceeds size limit", name)
+		}
+		if declared.Size != info.Size() {
+			return fmt.Errorf("producer output %q size does not match manifest", name)
+		}
+		if !strings.EqualFold(hex.EncodeToString(hasher.Sum(nil)), declared.SHA256) {
+			return fmt.Errorf("producer output %q does not match manifest SHA-256", name)
+		}
+		if total > maxPublishedOutputTotalBytes-uint64(copied) {
+			return errors.New("producer output exceeds aggregate size limit")
+		}
+		total += uint64(copied)
+		return nil
+	})
+	if err != nil {
+		return 0, fmt.Errorf("walk producer output: %w", err)
+	}
+	if len(seen) != len(expected)+len(private) {
+		return 0, fmt.Errorf("producer output contains %d files, want %d", len(seen), len(expected)+len(private))
+	}
+	return int64(total), nil
+}
+
+func validatePrivateProducerOutputFile(name string, info os.FileInfo) error {
+	if name != "custom_.txt" {
+		return fmt.Errorf("producer output contains undeclared private file %q", name)
+	}
+	if info == nil || !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("producer output %q is not a regular file", name)
+	}
+	if info.Size() < 0 || uint64(info.Size()) > maxPublishedOutputFileBytes {
+		return fmt.Errorf("producer output %q exceeds size limit", name)
+	}
+	return nil
+}
+
+func validateProducerFilename(name string) error {
+	if !utf8.ValidString(name) || name == "" || name == "." || name == ".." || strings.ContainsAny(name, "/\\\x00\r\n") || strings.TrimSpace(name) != name {
+		return fmt.Errorf("producer manifest contains unsafe filename %q", name)
+	}
+	if filepath.Base(name) != name {
+		return fmt.Errorf("producer manifest filename %q is not flat", name)
+	}
+	return nil
+}
+
+func validateProducerFilenameForPlatform(name, platform string) error {
+	if platform != "bridge" {
+		return validateProducerFilename(name)
+	}
+	if !utf8.ValidString(name) || name == "" || strings.ContainsAny(name, "\\\x00\r\n") || strings.TrimSpace(name) != name || path.IsAbs(name) || strings.HasPrefix(name, "//") || windowsDrivePath(name) || path.Clean(name) != name || name == "." || name == ".." || strings.HasPrefix(name, "../") {
+		return fmt.Errorf("producer manifest contains unsafe filename %q", name)
+	}
+	for _, part := range strings.Split(name, "/") {
+		if part == "" || part == "." || part == ".." {
+			return fmt.Errorf("producer manifest contains unsafe filename %q", name)
+		}
+	}
+	return nil
+}
+
+func windowsDrivePath(name string) bool {
+	return len(name) >= 2 && ((name[0] >= 'a' && name[0] <= 'z') || (name[0] >= 'A' && name[0] <= 'Z')) && name[1] == ':'
+}
+
+func sameStrings(left, right []string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func isLowerHex(value string) bool {
+	for _, char := range value {
+		if (char < '0' || char > '9') && (char < 'a' || char > 'f') {
+			return false
+		}
+	}
+	return true
+}
+
+func firstError(left, right error) error {
+	if left != nil {
+		return left
+	}
+	return right
+}
+
+func rejectDuplicateJSONKeys(data []byte) error {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	var walk func() error
+	walk = func() error {
+		token, err := decoder.Token()
+		if err != nil {
+			return err
+		}
+		switch delimiter := token.(type) {
+		case json.Delim:
+			switch delimiter {
+			case '{':
+				seen := map[string]struct{}{}
+				for decoder.More() {
+					key, err := decoder.Token()
+					if err != nil {
+						return err
+					}
+					keyString, ok := key.(string)
+					if !ok {
+						return errors.New("producer manifest object key is not a string")
+					}
+					if _, exists := seen[keyString]; exists {
+						return fmt.Errorf("producer manifest contains duplicate JSON key %q", keyString)
+					}
+					seen[keyString] = struct{}{}
+					if err := walk(); err != nil {
+						return err
+					}
+				}
+				_, err = decoder.Token()
+				return err
+			case '[':
+				for decoder.More() {
+					if err := walk(); err != nil {
+						return err
+					}
+				}
+				_, err = decoder.Token()
+				return err
+			}
+		}
+		return nil
+	}
+	if err := walk(); err != nil {
+		return fmt.Errorf("validate producer manifest JSON: %w", err)
+	}
+	if _, err := decoder.Token(); err != io.EOF {
+		if err == nil {
+			return errors.New("producer manifest contains trailing JSON")
+		}
+		return fmt.Errorf("validate producer manifest trailing JSON: %w", err)
+	}
+	return nil
+}
diff --git a/api/service/producer_manifest_test.go b/api/service/producer_manifest_test.go
new file mode 100644
index 0000000..b107b37
--- /dev/null
+++ b/api/service/producer_manifest_test.go
@@ -0,0 +1,448 @@
+package service
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"rustdesk-server/api/model"
+)
+
+func TestParseProducerManifestExactSchemaAndBuildIdentity(t *testing.T) {
+	build := producerManifestBuild()
+	manifest := producerManifestForBuild(build, map[string]string{"rustqs.exe": "exe"})
+	encoded, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	parsed, err := ParseProducerManifest(encoded)
+	if err != nil {
+		t.Fatalf("ParseProducerManifest() error = %v", err)
+	}
+	if err := ValidateProducerManifestForBuild(parsed, build); err != nil {
+		t.Fatalf("ValidateProducerManifestForBuild() error = %v", err)
+	}
+	if parsed.DigestScope != ProducerManifestDigestScope || len(parsed.Files) != 1 || parsed.Files[0].Name != "rustqs.exe" {
+		t.Fatalf("parsed manifest = %#v", parsed)
+	}
+	linux := producerManifestBuild()
+	linux.Platform = "linux"
+	linuxManifest := producerManifestForBuild(linux, map[string]string{
+		"rustqs-1.2.3-0.x86_64.rpm": "rpm",
+		"rustqs-1.2.3.deb":          "deb",
+	})
+	if encoded, err := json.Marshal(linuxManifest); err != nil {
+		t.Fatal(err)
+	} else if parsedLinux, err := ParseProducerManifest(encoded); err != nil {
+		t.Fatalf("ParseProducerManifest() Linux error = %v", err)
+	} else if err := ValidateProducerManifestForBuild(parsedLinux, linux); err != nil {
+		t.Fatalf("ValidateProducerManifestForBuild() Linux error = %v", err)
+	}
+}
+
+func TestParseProducerManifestRejectsSchemaTamperMissingExtraAndDuplicateKeys(t *testing.T) {
+	valid := `{"schema":"deskforge.client-artifact","schema_version":1,"platform":"windows","app_name":"rustqs","output_filenames":["rustqs.exe"],"source_sha":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","workflow_sha":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","workflow_ref":"rustqs/workflows","version":"1.2.3","digest_scope":"sha256 covers delivered output files; manifest.txt is excluded","files":[{"name":"rustqs.exe","sha256":"` + strings.Repeat("c", 64) + `"}]}`
+	cases := map[string]string{
+		"missing field":  strings.Replace(valid, `"workflow_ref":"rustqs/workflows",`, "", 1),
+		"unknown field":  strings.Replace(valid, `"schema_version":1,`, `"schema_version":1,"extra":"unsafe",`, 1),
+		"duplicate key":  strings.Replace(valid, `"schema_version":1,`, `"schema_version":1,"schema_version":1,`, 1),
+		"wrong hash":     strings.Replace(valid, strings.Repeat("c", 64), strings.Repeat("g", 64), 1),
+		"case collision": strings.Replace(valid, `"files":[{"name":"rustqs.exe"`, `"files":[{"name":"rustqs.exe"`, 1),
+	}
+	// The case-collision case is exercised by the output validator below; this
+	// table keeps parser failures focused on the JSON/schema boundary.
+	delete(cases, "case collision")
+	for name, input := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, err := ParseProducerManifest([]byte(input)); err == nil {
+				t.Fatal("ParseProducerManifest() error = nil, want fail-closed schema rejection")
+			}
+		})
+	}
+}
+
+func TestValidateProducerManifestOutputRejectsMissingTamperExtraAndCaseCollision(t *testing.T) {
+	build := producerManifestBuild()
+	contents := map[string]string{"rustqs.exe": "exe"}
+	manifest := producerManifestForBuild(build, contents)
+	for name, mutate := range map[string]func(string){
+		"missing": func(dir string) {
+			_ = os.Remove(filepath.Join(dir, "rustqs.exe"))
+		},
+		"tamper": func(dir string) {
+			_ = os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte("tampered"), 0600)
+		},
+		"extra": func(dir string) {
+			_ = os.WriteFile(filepath.Join(dir, "helper.dll"), []byte("extra"), 0600)
+		},
+		"case collision": func(dir string) {
+			_ = os.WriteFile(filepath.Join(dir, "RUSTQS.EXE"), []byte("collision"), 0600)
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			if err := os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte(contents["rustqs.exe"]), 0600); err != nil {
+				t.Fatal(err)
+			}
+			mutate(dir)
+			if _, err := ValidateProducerManifestOutput(manifest, dir); err == nil {
+				t.Fatal("ValidateProducerManifestOutput() error = nil, want fail-closed output rejection")
+			}
+		})
+	}
+}
+
+func TestProducerManifestOutputHashesAndCompatibilityNames(t *testing.T) {
+	for _, tc := range []struct {
+		platform string
+		app      string
+		version  string
+		want     []string
+	}{
+		{platform: "windows", app: "rustqs", version: "1.2.3", want: []string{"rustqs.exe"}},
+		{platform: "linux", app: "rustqs", version: "1.2.3", want: []string{"rustqs-1.2.3-0.x86_64.rpm", "rustqs-1.2.3.deb"}},
+		{platform: "android", app: "rustqs", version: "1.2.3", want: []string{"rustqs.apk"}},
+	} {
+		t.Run(tc.platform, func(t *testing.T) {
+			got, err := ExpectedProducerOutputFilenames(tc.platform, tc.app, tc.version)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if strings.Join(got, "\x00") != strings.Join(tc.want, "\x00") {
+				t.Fatalf("expected output names = %v, want %v", got, tc.want)
+			}
+		})
+	}
+	build := producerManifestBuild()
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte("exe"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	manifest := producerManifestForBuild(build, map[string]string{"rustqs.exe": "exe"})
+	total, err := ValidateProducerManifestOutput(manifest, dir)
+	if err != nil || total != 3 {
+		t.Fatalf("ValidateProducerManifestOutput() = %d, %v; want 3 bytes", total, err)
+	}
+	wantHash := sha256.Sum256([]byte("exe"))
+	if manifest.Files[0].SHA256 != hex.EncodeToString(wantHash[:]) {
+		t.Fatalf("manifest hash = %q, want %x", manifest.Files[0].SHA256, wantHash)
+	}
+}
+
+func TestProducerManifestPrivateCustomFileIsOptionalAndPlatformCompatible(t *testing.T) {
+	platforms := []struct {
+		platform string
+		app      string
+		public   map[string]string
+	}{
+		{platform: "windows", app: "rustqs", public: map[string]string{"rustqs.exe": "exe"}},
+		{platform: "linux", app: "rustqs", public: map[string]string{
+			"rustqs-1.2.3-0.x86_64.rpm": "rpm", "rustqs-1.2.3.deb": "deb",
+		}},
+		{platform: "android", app: "rustqs", public: map[string]string{"rustqs.apk": "apk"}},
+		{platform: "bridge", app: "rustdesk-bridge", public: map[string]string{
+			"flutter/ios/Runner/bridge_generated.h":     "ios-header",
+			"flutter/lib/generated_bridge.dart":         "dart",
+			"flutter/lib/generated_bridge.freezed.dart": "freezed",
+			"flutter/macos/Runner/bridge_generated.h":   "mac-header",
+			"src/bridge_generated.io.rs":                "io-rs",
+			"src/bridge_generated.rs":                   "rs",
+		}},
+	}
+	for _, tc := range platforms {
+		t.Run(tc.platform, func(t *testing.T) {
+			build := producerManifestBuild()
+			build.Platform = tc.platform
+			build.AppName = tc.app
+			manifest := producerManifestForBuild(build, tc.public)
+			for _, withPrivate := range []bool{false, true} {
+				t.Run(map[bool]string{false: "absent", true: "present"}[withPrivate], func(t *testing.T) {
+					dir := t.TempDir()
+					for name, contents := range tc.public {
+						full := filepath.Join(dir, filepath.FromSlash(name))
+						if err := os.MkdirAll(filepath.Dir(full), 0700); err != nil {
+							t.Fatal(err)
+						}
+						if err := os.WriteFile(full, []byte(contents), 0600); err != nil {
+							t.Fatal(err)
+						}
+					}
+					candidate := manifest
+					if withPrivate {
+						candidate.PrivateFilenames = []string{"custom_.txt"}
+						if err := os.WriteFile(filepath.Join(dir, "custom_.txt"), []byte("private settings"), 0600); err != nil {
+							t.Fatal(err)
+						}
+					}
+					if total, err := ValidateProducerManifestOutput(candidate, dir); err != nil {
+						t.Fatalf("ValidateProducerManifestOutput() error = %v", err)
+					} else if withPrivate && total != int64(len("exe"+"private settings")) && tc.platform == "windows" {
+						t.Fatalf("output total = %d, want private bytes included in bounded total", total)
+					}
+				})
+			}
+			encoded, err := json.Marshal(manifest)
+			if err != nil {
+				t.Fatal(err)
+			}
+			withoutOptionalField := strings.Replace(string(encoded), `,"private_filenames":null`, "", 1)
+			if _, err := ParseProducerManifest([]byte(withoutOptionalField)); err != nil {
+				t.Fatalf("ParseProducerManifest() rejected absent optional private_filenames: %v", err)
+			}
+		})
+	}
+}
+
+func TestProducerManifestPrivateFileDeclarationRejectsMisdeclaredOrSecretFiles(t *testing.T) {
+	build := producerManifestBuild()
+	manifest := producerManifestForBuild(build, map[string]string{"rustqs.exe": "exe"})
+	for _, privateFilenames := range [][]string{{"secret.txt"}, {"custom_.txt", "custom_.txt"}} {
+		candidate := manifest
+		candidate.PrivateFilenames = privateFilenames
+		encoded, err := json.Marshal(candidate)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := ParseProducerManifest(encoded); err == nil {
+			t.Fatalf("ParseProducerManifest() accepted private_filenames=%v", privateFilenames)
+		}
+	}
+
+	publicMisdeclared := manifest
+	publicMisdeclared.Files = append([]ProducerManifestFile(nil), manifest.Files...)
+	publicMisdeclared.Files[0].Name = "custom_.txt"
+	encoded, err := json.Marshal(publicMisdeclared)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ParseProducerManifest(encoded); err == nil {
+		t.Fatal("ParseProducerManifest() accepted custom_.txt in public files")
+	}
+
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte("exe"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "custom_.txt"), []byte("secret"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ValidateProducerManifestOutput(manifest, dir); err == nil {
+		t.Fatal("ValidateProducerManifestOutput() accepted undeclared custom_.txt")
+	}
+	manifest.PrivateFilenames = []string{"custom_.txt"}
+	if err := os.WriteFile(filepath.Join(dir, "other-secret.txt"), []byte("secret"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ValidateProducerManifestOutput(manifest, dir); err == nil {
+		t.Fatal("ValidateProducerManifestOutput() accepted an unlisted secret file")
+	}
+}
+
+func TestProducerManifestBridgeAllowsNestedFilesAndRejectsUnsafeOrExtraOutputs(t *testing.T) {
+	build := &model.CustomBuild{
+		Platform:         "bridge",
+		AppName:          "rustdesk-bridge",
+		Version:          "1.2.3",
+		BuildRef:         strings.Repeat("a", 40),
+		GithubRef:        strings.Repeat("b", 40),
+		WorkflowSelector: "bridge",
+	}
+	names, err := ExpectedProducerOutputFilenames(build.Platform, build.AppName, build.Version)
+	if err != nil {
+		t.Fatal(err)
+	}
+	contents := make(map[string]string, len(names))
+	manifest := producerManifestForBuild(build, contents)
+	dir := t.TempDir()
+	for _, name := range names {
+		contents[name] = name
+		full := filepath.Join(dir, filepath.FromSlash(name))
+		if err := os.MkdirAll(filepath.Dir(full), 0700); err != nil {
+			t.Fatalf("create bridge output parent for %q: %v", name, err)
+		}
+		if err := os.WriteFile(full, []byte(name), 0600); err != nil {
+			t.Fatalf("write bridge output %q: %v", name, err)
+		}
+	}
+	manifest = producerManifestForBuild(build, contents)
+	if total, err := ValidateProducerManifestOutput(manifest, dir); err != nil {
+		t.Fatalf("ValidateProducerManifestOutput() bridge error = %v", err)
+	} else if total == 0 {
+		t.Fatal("ValidateProducerManifestOutput() bridge total = 0, want nested files")
+	}
+
+	for _, unsafeName := range []string{"../escape", "/absolute", "C:/absolute", "flutter/../escape", "flutter\\escape"} {
+		t.Run("unsafe "+unsafeName, func(t *testing.T) {
+			candidate := manifest
+			candidate.OutputFilenames = append([]string(nil), manifest.OutputFilenames...)
+			candidate.Files = append([]ProducerManifestFile(nil), manifest.Files...)
+			candidate.OutputFilenames[0] = unsafeName
+			candidate.Files[0].Name = unsafeName
+			encoded, marshalErr := json.Marshal(candidate)
+			if marshalErr != nil {
+				t.Fatal(marshalErr)
+			}
+			if _, parseErr := ParseProducerManifest(encoded); parseErr == nil {
+				t.Fatalf("ParseProducerManifest() accepted unsafe bridge path %q", unsafeName)
+			}
+		})
+	}
+
+	t.Run("bridge symlink", func(t *testing.T) {
+		linkTarget := filepath.Join(dir, "outside")
+		if err := os.WriteFile(linkTarget, []byte("outside"), 0600); err != nil {
+			t.Fatal(err)
+		}
+		link := filepath.Join(dir, filepath.FromSlash(names[0]))
+		if err := os.Remove(link); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(linkTarget, link); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := ValidateProducerManifestOutput(manifest, dir); err == nil {
+			t.Fatal("ValidateProducerManifestOutput() accepted a bridge symlink")
+		}
+	})
+
+	t.Run("bridge extra file", func(t *testing.T) {
+		extra := filepath.Join(dir, "flutter", "extra.dart")
+		if err := os.WriteFile(extra, []byte("extra"), 0600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := ValidateProducerManifestOutput(manifest, dir); err == nil {
+			t.Fatal("ValidateProducerManifestOutput() accepted an extra bridge output")
+		}
+	})
+}
+
+func TestValidateProducerManifestOutputKeepsFinalPlatformsFlat(t *testing.T) {
+	build := producerManifestBuild()
+	manifest := producerManifestForBuild(build, map[string]string{"rustqs.exe": "exe"})
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "rustqs.exe"), []byte("exe"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(dir, "nested"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "nested", "extra.bin"), []byte("extra"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ValidateProducerManifestOutput(manifest, dir); err == nil {
+		t.Fatal("ValidateProducerManifestOutput() accepted nested final-platform output")
+	}
+}
+
+func TestProducerManifestProvenanceRejectsMissingMismatchAndTamperedFields(t *testing.T) {
+	build := producerManifestBuild()
+	manifest := producerManifestForBuild(build, map[string]string{"rustqs.exe": "exe"})
+	valid, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name   string
+		mutate func(*ProducerManifest)
+		parse  bool
+	}{
+		{name: "missing source tree", parse: true, mutate: func(value *ProducerManifest) { value.SourceTreeSHA = "" }},
+		{name: "mismatched source", mutate: func(value *ProducerManifest) { value.SourceSHA = strings.Repeat("d", 40) }},
+		{name: "tampered submodule", mutate: func(value *ProducerManifest) {
+			value.Submodules = []ProducerManifestSubmodule{{Path: "libs/example", CommitSHA: strings.Repeat("d", 40)}}
+		}},
+		{name: "missing verification", parse: true, mutate: func(value *ProducerManifest) { value.VerificationScope = "" }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			candidate := manifest
+			tc.mutate(&candidate)
+			encoded, marshalErr := json.Marshal(candidate)
+			if marshalErr != nil {
+				t.Fatal(marshalErr)
+			}
+			parsed, parseErr := ParseProducerManifest(encoded)
+			if tc.parse {
+				if parseErr == nil {
+					t.Fatal("ParseProducerManifest() error = nil, want fail-closed shape rejection")
+				}
+				return
+			}
+			if parseErr != nil {
+				t.Fatalf("ParseProducerManifest() error = %v, want shape-valid candidate", parseErr)
+			}
+			storedJSON, storedErr := manifest.StoredJSON()
+			if storedErr != nil {
+				t.Fatal(storedErr)
+			}
+			build.ProducerManifestJSON = storedJSON
+			if err := ValidateProducerManifestForBuild(parsed, build); err == nil {
+				t.Fatal("ValidateProducerManifestForBuild() error = nil, want stored provenance mismatch rejection")
+			}
+		})
+	}
+	if _, err := ParseProducerManifest(valid); err != nil {
+		t.Fatalf("valid provenance manifest rejected: %v", err)
+	}
+}
+
+func TestProducerManifestV2VerifiedSelfReportIsNormalizedToReported(t *testing.T) {
+	manifest := producerManifestForBuild(producerManifestBuild(), map[string]string{"rustqs.exe": "exe"})
+	manifest.VerificationScope = producerManifestLegacyScope
+	manifest.VerificationResult = "verified"
+	stored, err := manifest.StoredJSON()
+	if err != nil {
+		t.Fatalf("StoredJSON() rejected compatible v2 self-report: %v", err)
+	}
+	if strings.Contains(stored, `"verification_result":"verified"`) || !strings.Contains(stored, `"verification_result":"reported"`) {
+		t.Fatalf("stored producer manifest retained verified self-report: %s", stored)
+	}
+}
+
+func producerManifestBuild() *model.CustomBuild {
+	return &model.CustomBuild{
+		Platform:         "windows",
+		AppName:          "rustqs",
+		Version:          "1.2.3",
+		BuildRef:         strings.Repeat("a", 40),
+		WorkflowSelector: "rustqs/workflows",
+		GithubRef:        strings.Repeat("b", 40),
+		GithubSourceSha:  strings.Repeat("b", 40),
+		GithubRunId:      77,
+	}
+}
+
+func producerManifestForBuild(build *model.CustomBuild, contents map[string]string) ProducerManifest {
+	names, err := ExpectedProducerOutputFilenames(build.Platform, build.AppName, build.Version)
+	if err != nil {
+		panic(err)
+	}
+	files := make([]ProducerManifestFile, 0, len(names))
+	for _, name := range names {
+		digest := sha256.Sum256([]byte(contents[name]))
+		files = append(files, ProducerManifestFile{Name: name, Size: int64(len(contents[name])), SHA256: hex.EncodeToString(digest[:])})
+	}
+	return ProducerManifest{
+		Schema:               ProducerManifestSchema,
+		ManifestSchema:       ProducerManifestSchema,
+		SchemaVersion:        ProducerManifestVersion,
+		Platform:             build.Platform,
+		AppName:              build.AppName,
+		OutputFilenames:      append([]string(nil), names...),
+		SourceSHA:            build.BuildRef,
+		WorkflowSHA:          build.GithubRef,
+		WorkflowRef:          build.WorkflowSelector,
+		Version:              build.Version,
+		SourceTreeSHA:        strings.Repeat("c", 40),
+		Submodules:           []ProducerManifestSubmodule{{Path: "libs/hbb_common", CommitSHA: strings.Repeat("d", 40)}},
+		DigestScope:          ProducerManifestDigestScope,
+		VerificationScope:    ProducerManifestVerificationScope,
+		VerificationResult:   ProducerManifestVerificationResult,
+		PublicationTimestamp: 1700000000,
+		HandoffContract:      ProducerManifestHandoffContract,
+		Files:                files,
+	}
+}
diff --git a/api/service/published_output.go b/api/service/published_output.go
new file mode 100644
index 0000000..1a3143d
--- /dev/null
+++ b/api/service/published_output.go
@@ -0,0 +1,382 @@
+package service
+
+import (
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+
+	"rustdesk-server/api/model"
+)
+
+const (
+	maxPublishedOutputFiles      = 4096
+	maxPublishedOutputFileBytes  = uint64(512 << 20)
+	maxPublishedOutputTotalBytes = uint64(1 << 30)
+)
+
+type publishedOutputFile struct {
+	name string
+	size int64
+}
+
+const publishedOutputPublicationContext = "github-artifact-canonical-output-v2"
+
+var (
+	publishedOutputExportMu    sync.Mutex
+	publishedOutputEntriesHook = func() {}
+)
+
+// WithPublishedOutputExportLock serializes bounded reads of canonical output
+// with handoff and archive packaging. Writers outside this process still have
+// to be detected by the caller's before/after digest comparison.
+func WithPublishedOutputExportLock(operation func() error) error {
+	if operation == nil {
+		return errors.New("published output export operation is required")
+	}
+	publishedOutputExportMu.Lock()
+	defer publishedOutputExportMu.Unlock()
+	return operation()
+}
+
+// publishedOutputManifest validates the canonical flat output and computes a
+// deterministic SHA-256 over the immutable publication identity followed by
+// relative names, sizes, and contents in name order. The provider does not
+// cryptographically sign this value; binding it here prevents a valid output
+// from being reused for another build, run, or artifact.
+func publishedOutputManifest(outputDir string, build *model.CustomBuild) (int64, string, error) {
+	if outputDir == "" {
+		return 0, "", errors.New("published output directory is required")
+	}
+	if build == nil {
+		return 0, "", errors.New("build record is required")
+	}
+	info, err := os.Lstat(outputDir)
+	if err != nil {
+		return 0, "", fmt.Errorf("inspect final artifact output: %w", err)
+	}
+	if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+		return 0, "", errors.New("final artifact output is not a regular directory")
+	}
+	entries, err := os.ReadDir(outputDir)
+	if err != nil {
+		return 0, "", fmt.Errorf("read final artifact output: %w", err)
+	}
+	if len(entries) == 0 {
+		return 0, "", errors.New("final artifact output contains no published files")
+	}
+	if len(entries) > maxPublishedOutputFiles {
+		return 0, "", fmt.Errorf("final artifact output contains too many files: %d", len(entries))
+	}
+
+	appName := build.AppName
+	if err := ValidateOutputAppName(appName); err != nil {
+		return 0, "", err
+	}
+	files := make([]publishedOutputFile, 0, len(entries))
+	seenWindowsNames := make(map[string]string)
+	var executableSize int64
+	foundExecutable := false
+	var totalBytes uint64
+	for _, entry := range entries {
+		if build.Platform == string(PlatformWindows) {
+			if err := ValidateWindowsArtifactFilename(entry.Name()); err != nil {
+				return 0, "", fmt.Errorf("invalid published Windows artifact %q: %w", entry.Name(), err)
+			}
+			nameKey := WindowsArtifactNameKey(entry.Name())
+			if previous, exists := seenWindowsNames[nameKey]; exists {
+				return 0, "", fmt.Errorf("published Windows artifact names collide case-insensitively: %q and %q", previous, entry.Name())
+			}
+			seenWindowsNames[nameKey] = entry.Name()
+		}
+		entryPath := filepath.Join(outputDir, entry.Name())
+		entryInfo, err := os.Lstat(entryPath)
+		if err != nil {
+			return 0, "", fmt.Errorf("inspect final artifact %q: %w", entry.Name(), err)
+		}
+		if entryInfo.IsDir() || entryInfo.Mode()&os.ModeSymlink != 0 || !entryInfo.Mode().IsRegular() {
+			return 0, "", fmt.Errorf("final artifact output contains non-regular entry %q", entry.Name())
+		}
+		if entryInfo.Size() < 0 || uint64(entryInfo.Size()) > maxPublishedOutputFileBytes {
+			return 0, "", fmt.Errorf("final artifact %q exceeds published output file limit", entry.Name())
+		}
+		if totalBytes > maxPublishedOutputTotalBytes-uint64(entryInfo.Size()) {
+			return 0, "", errors.New("final artifact output exceeds published aggregate limit")
+		}
+		totalBytes += uint64(entryInfo.Size())
+		relativeName, err := filepath.Rel(outputDir, entryPath)
+		if err != nil || relativeName == "." || strings.HasPrefix(relativeName, ".."+string(filepath.Separator)) || relativeName == ".." {
+			return 0, "", fmt.Errorf("invalid published output name %q", entry.Name())
+		}
+		files = append(files, publishedOutputFile{name: filepath.ToSlash(relativeName), size: entryInfo.Size()})
+		if strings.EqualFold(entry.Name(), appName+".exe") {
+			executableSize = entryInfo.Size()
+			foundExecutable = true
+		}
+	}
+	if build.Platform == string(PlatformWindows) && !foundExecutable {
+		return 0, "", fmt.Errorf("final artifact output is missing required %s.exe", appName)
+	}
+	sort.Slice(files, func(i, j int) bool { return files[i].name < files[j].name })
+
+	hasher := sha256.New()
+	writeManifestString(hasher, publishedOutputPublicationContext)
+	writeManifestUint64(hasher, uint64(build.Id))
+	writeManifestUint64(hasher, uint64(build.GithubRunId))
+	writeManifestUint64(hasher, uint64(build.GithubArtifactID))
+	for _, identity := range []string{
+		build.GithubProvider,
+		build.GithubRepo,
+		build.GithubWorkflow,
+		build.WorkflowSelector,
+		build.GithubRef,
+		build.GithubArtifactName,
+		build.GithubRunUrl,
+		build.GithubHtmlUrl,
+		build.GithubSourceSha,
+		build.Platform,
+		build.AppName,
+		build.Version,
+		build.BuildRef,
+		build.SourceTag,
+		build.AssetsRelease,
+		build.AssetsReleaseAssets,
+	} {
+		writeManifestString(hasher, identity)
+	}
+	writeManifestUint64(hasher, uint64(build.AssetsReleaseID))
+	for _, file := range files {
+		writeManifestString(hasher, file.name)
+		writeManifestUint64(hasher, uint64(file.size))
+		opened, err := os.Open(filepath.Join(outputDir, filepath.FromSlash(file.name)))
+		if err != nil {
+			return 0, "", fmt.Errorf("open published artifact %q: %w", file.name, err)
+		}
+		openedInfo, statErr := opened.Stat()
+		if statErr != nil {
+			_ = opened.Close()
+			return 0, "", fmt.Errorf("stat published artifact %q: %w", file.name, statErr)
+		}
+		if !openedInfo.Mode().IsRegular() || openedInfo.Size() != file.size {
+			_ = opened.Close()
+			return 0, "", fmt.Errorf("published artifact %q changed during manifest computation", file.name)
+		}
+		copied, copyErr := io.Copy(hasher, io.LimitReader(opened, file.size+1))
+		closeErr := opened.Close()
+		if copyErr != nil {
+			return 0, "", fmt.Errorf("read published artifact %q: %w", file.name, copyErr)
+		}
+		if closeErr != nil {
+			return 0, "", fmt.Errorf("close published artifact %q: %w", file.name, closeErr)
+		}
+		if copied != file.size {
+			return 0, "", fmt.Errorf("published artifact %q changed during manifest computation", file.name)
+		}
+	}
+	return executableSize, hex.EncodeToString(hasher.Sum(nil)), nil
+}
+
+func writeManifestString(hasher io.Writer, value string) {
+	writeManifestUint64(hasher, uint64(len(value)))
+	_, _ = io.WriteString(hasher, value)
+}
+
+func writeManifestUint64(hasher io.Writer, value uint64) {
+	var encoded [8]byte
+	binary.BigEndian.PutUint64(encoded[:], value)
+	_, _ = hasher.Write(encoded[:])
+}
+
+func validPublishedDigest(digest string) bool {
+	if len(digest) != sha256.Size*2 {
+		return false
+	}
+	_, err := hex.DecodeString(digest)
+	return err == nil
+}
+
+func publishedDigestMatches(stored, computed string) bool {
+	if !validPublishedDigest(stored) || !validPublishedDigest(computed) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(strings.ToLower(stored)), []byte(strings.ToLower(computed))) == 1
+}
+
+// ValidatePublishedOutputDigest revalidates the canonical output and compares
+// it with the write-once digest recorded for a completed build.
+func ValidatePublishedOutputDigest(build *model.CustomBuild) (int64, error) {
+	if build == nil {
+		return 0, errors.New("build record is required")
+	}
+	if build.PublicationRecordedAt <= 0 || !validPublishedDigest(build.PublishedDigest) {
+		return 0, errors.New("published output marker or digest is missing")
+	}
+	if _, err := CompletedBuildProvenanceFromRecord(build); err != nil {
+		return 0, err
+	}
+	size, err := ValidatePublishedOutputProof(build)
+	if err != nil {
+		return 0, err
+	}
+	return size, nil
+}
+
+// ValidatePublishedOutputProof verifies the stored publication marker/digest
+// against the current canonical output without requiring the row to be done.
+// It is used by recovery and publication code that must not reuse an unproven
+// output directory.
+func ValidatePublishedOutputProof(build *model.CustomBuild) (int64, error) {
+	if build == nil {
+		return 0, errors.New("build record is required")
+	}
+	if build.PublicationRecordedAt <= 0 || !validPublishedDigest(build.PublishedDigest) {
+		return 0, errors.New("published output marker or digest is missing")
+	}
+	size, digest, err := publishedOutputManifest(BuildOutputDir(build.Id), build)
+	if err != nil {
+		return 0, err
+	}
+	if !publishedDigestMatches(build.PublishedDigest, digest) {
+		return 0, errors.New("published output digest does not match recorded digest")
+	}
+	return size, nil
+}
+
+// ValidateCompletedPublishedOutput is the shared public readiness predicate.
+// Completion, immutable provider identity, stored publication proof, and the
+// current output contents must all agree before a completed build is exposed.
+func ValidateCompletedPublishedOutput(build *model.CustomBuild) (BuildProvenance, int64, error) {
+	if build == nil {
+		return BuildProvenance{}, 0, errors.New("build record is required")
+	}
+	if err := RequireProductionBuildCapability(build.Platform); err != nil {
+		return BuildProvenance{}, 0, err
+	}
+	provenance, err := CompletedBuildProvenanceFromRecord(build)
+	if err != nil {
+		return BuildProvenance{}, 0, err
+	}
+	size, err := ValidatePublishedOutputProof(build)
+	if err != nil {
+		return BuildProvenance{}, 0, err
+	}
+	return provenance, size, nil
+}
+
+// PublishedOutputDigest computes the service-owned digest for a canonical
+// output directory. Callers cannot provide an alternate output path.
+func PublishedOutputDigest(build *model.CustomBuild) (string, error) {
+	if build == nil {
+		return "", errors.New("build record is required")
+	}
+	_, digest, err := publishedOutputManifest(BuildOutputDir(build.Id), build)
+	return digest, err
+}
+
+// PublishedOutputFileEntries returns deterministic, secret-redacted output
+// metadata for an already validated canonical output. custom_.txt is part of
+// the service-owned publication digest when present, but its name, size, and
+// hash are intentionally omitted from the operator handoff because its bytes
+// carry private build settings.
+func PublishedOutputFileEntries(build *model.CustomBuild) ([]BuildHandoffOutputFile, error) {
+	if build == nil {
+		return nil, errors.New("build record is required")
+	}
+	var files []BuildHandoffOutputFile
+	err := WithPublishedOutputExportLock(func() error {
+		outputDir := BuildOutputDir(build.Id)
+		if _, _, err := publishedOutputManifest(outputDir, build); err != nil {
+			return err
+		}
+		entries, err := os.ReadDir(outputDir)
+		if err != nil {
+			return fmt.Errorf("read published output entries: %w", err)
+		}
+		files = make([]BuildHandoffOutputFile, 0, len(entries))
+		for _, entry := range entries {
+			if strings.EqualFold(entry.Name(), "custom_.txt") {
+				continue
+			}
+			path := filepath.Join(outputDir, entry.Name())
+			info, err := os.Lstat(path)
+			if err != nil {
+				return fmt.Errorf("inspect published output entry %q: %w", entry.Name(), err)
+			}
+			if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 {
+				return fmt.Errorf("published output entry %q is not a regular file", entry.Name())
+			}
+			file, err := os.Open(path)
+			if err != nil {
+				return fmt.Errorf("open published output entry %q: %w", entry.Name(), err)
+			}
+			hasher := sha256.New()
+			copied, copyErr := io.Copy(hasher, io.LimitReader(file, int64(maxPublishedOutputFileBytes)+1))
+			closeErr := file.Close()
+			if copyErr != nil {
+				return fmt.Errorf("hash published output entry %q: %w", entry.Name(), copyErr)
+			}
+			if closeErr != nil {
+				return fmt.Errorf("close published output entry %q: %w", entry.Name(), closeErr)
+			}
+			if copied != info.Size() {
+				return fmt.Errorf("published output entry %q changed during handoff export", entry.Name())
+			}
+			files = append(files, BuildHandoffOutputFile{
+				Name:   entry.Name(),
+				Size:   copied,
+				SHA256: hex.EncodeToString(hasher.Sum(nil)),
+			})
+		}
+		sort.Slice(files, func(i, j int) bool { return files[i].Name < files[j].Name })
+		publishedOutputEntriesHook()
+		_, digest, err := publishedOutputManifest(outputDir, build)
+		if err != nil {
+			return fmt.Errorf("recheck published output entries: %w", err)
+		}
+		if !publishedDigestMatches(build.PublishedDigest, digest) {
+			return errors.New("published output changed during handoff export")
+		}
+		return nil
+	})
+	return files, err
+}
+
+// ValidateRecordedPublishedOutput verifies a write-once publication while a
+// build is still active. It is the recovery-only path for failed completion
+// persistence and requires exact run/artifact identity.
+func (is *CustomBuildService) ValidateRecordedPublishedOutput(buildID uint, expectedRunID, expectedArtifactID int64) (int64, error) {
+	if buildID == 0 || expectedRunID <= 0 || expectedArtifactID <= 0 {
+		return 0, &BuildProgressPersistenceError{BuildID: buildID, Cause: errors.New("expected build, run, and artifact ids must be positive")}
+	}
+	var build model.CustomBuild
+	if err := DB.Where("id = ? AND status IN ? AND github_run_id = ? AND github_artifact_id = ?", buildID, []string{
+		model.CustomBuildStatusBuilding,
+		model.CustomBuildStatusDownloading,
+		model.CustomBuildStatusExtracting,
+	}, expectedRunID, expectedArtifactID).First(&build).Error; err != nil {
+		return 0, &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	provenance, err := BuildProvenanceFromRecord(&build)
+	if err != nil {
+		return 0, &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	if provenance.GithubRunID != expectedRunID || provenance.GithubArtifactID != expectedArtifactID {
+		return 0, &BuildProgressPersistenceError{BuildID: buildID, Cause: errors.New("published output provenance does not match expected run and artifact")}
+	}
+	if err := is.requireCompletionCapability(buildID); err != nil {
+		return 0, err
+	}
+	size, err := ValidatePublishedOutputProof(&build)
+	if err != nil {
+		return 0, &BuildProgressPersistenceError{BuildID: buildID, Cause: err}
+	}
+	return size, nil
+}
diff --git a/api/service/published_output_test.go b/api/service/published_output_test.go
new file mode 100644
index 0000000..9754e3a
--- /dev/null
+++ b/api/service/published_output_test.go
@@ -0,0 +1,42 @@
+package service
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"rustdesk-server/api/model"
+)
+
+func TestValidatePublishedOutputRejectsCaseInsensitiveWindowsNames(t *testing.T) {
+	output := t.TempDir()
+	for name, contents := range map[string]string{
+		"rustqs.exe": "exe",
+		"helper.dll": "lower",
+		"HELPER.DLL": "upper",
+	} {
+		if err := os.WriteFile(filepath.Join(output, name), []byte(contents), 0600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+	build := &model.CustomBuild{Platform: "windows", AppName: "rustqs"}
+	if _, err := ValidatePublishedOutput(output, build); err == nil {
+		t.Fatal("ValidatePublishedOutput() accepted case-insensitive Windows artifact collision")
+	}
+}
+
+func TestValidatePublishedOutputPreservesDistinctPOSIXNames(t *testing.T) {
+	output := t.TempDir()
+	for name, contents := range map[string]string{
+		"helper.dll": "lower",
+		"HELPER.DLL": "upper",
+	} {
+		if err := os.WriteFile(filepath.Join(output, name), []byte(contents), 0600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+	build := &model.CustomBuild{Platform: "linux", AppName: "rustqs"}
+	if _, err := ValidatePublishedOutput(output, build); err != nil {
+		t.Fatalf("ValidatePublishedOutput() rejected distinct POSIX names: %v", err)
+	}
+}
diff --git a/api/service/secret_persistence_test.go b/api/service/secret_persistence_test.go
new file mode 100644
index 0000000..894a6b6
--- /dev/null
+++ b/api/service/secret_persistence_test.go
@@ -0,0 +1,463 @@
+package service
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/utils"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestSecretBearingGithubConfigSaveFailsWithoutKeyBeforeCreatingRow(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	db := newSecretPersistenceDB(t, &model.GithubBuildConfig{})
+
+	err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{
+		Repo:       "owner/repo",
+		Token:      "github_pat_secret",
+		PayloadKey: "payload-secret",
+	})
+	var keyErr *utils.SecretEncryptionKeyError
+	if !errors.As(err, &keyErr) {
+		t.Fatalf("Save() error = %T %v, want SecretEncryptionKeyError", err, err)
+	}
+	var count int64
+	if err := db.Model(&model.GithubBuildConfig{}).Count(&count).Error; err != nil {
+		t.Fatalf("count configs: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("missing-key config save created %d row(s)", count)
+	}
+}
+
+func TestSecretBearingCustomCreateAndUpdateFailWithoutKeyBeforeRowMutation(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+
+	t.Run("custom build create", func(t *testing.T) {
+		db := newSecretPersistenceDB(t, &model.CustomBuild{})
+		build := &model.CustomBuild{Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: `{"permanent_password":"build-secret"}`}
+		if _, err := (&CustomBuildService{}).CreateNormalized(build); err == nil {
+			t.Fatal("CustomBuild create succeeded without encryption key")
+		}
+		assertRowCount(t, db, &model.CustomBuild{}, 0)
+	})
+
+	t.Run("custom build update", func(t *testing.T) {
+		db := newSecretPersistenceDB(t, &model.CustomBuild{})
+		build := &model.CustomBuild{Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: `{"enable_audio":true}`}
+		if _, err := (&CustomBuildService{}).CreateNormalized(build); err != nil {
+			t.Fatalf("seed custom build: %v", err)
+		}
+		build.CustomJson = `{"permanent_password":"build-secret"}`
+		if err := (&CustomBuildService{}).UpdateValidated(build); err == nil {
+			t.Fatal("CustomBuild update succeeded without encryption key")
+		}
+		assertRowCount(t, db, &model.CustomBuild{}, 1)
+		if raw := rawCustomJSON(t, db, "custom_builds", build.Id); raw != `{"enable_audio":true}` {
+			t.Fatalf("failed custom build update changed stored JSON to %q", raw)
+		}
+	})
+
+	t.Run("custom preset create", func(t *testing.T) {
+		db := newSecretPersistenceDB(t, &model.CustomPreset{})
+		preset := &model.CustomPreset{UserId: 1, Name: "secret", Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: `{"permanent_password":"preset-secret"}`}
+		if err := (&CustomPresetService{}).Create(preset); err == nil {
+			t.Fatal("CustomPreset create succeeded without encryption key")
+		}
+		assertRowCount(t, db, &model.CustomPreset{}, 0)
+	})
+
+	t.Run("custom preset update", func(t *testing.T) {
+		db := newSecretPersistenceDB(t, &model.CustomPreset{})
+		preset := &model.CustomPreset{UserId: 1, Name: "secret", Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: `{}`}
+		if err := (&CustomPresetService{}).Create(preset); err != nil {
+			t.Fatalf("seed custom preset: %v", err)
+		}
+		preset.CustomJson = `{"permanent_password":"preset-secret"}`
+		if err := (&CustomPresetService{}).Update(preset); err == nil {
+			t.Fatal("CustomPreset update succeeded without encryption key")
+		}
+		assertRowCount(t, db, &model.CustomPreset{}, 1)
+		if raw := rawCustomJSON(t, db, "custom_presets", preset.Id); raw != `{}` {
+			t.Fatalf("failed custom preset update changed stored JSON to %q", raw)
+		}
+	})
+}
+
+func TestSecretBearingPersistenceEncryptsAtRestAndReadsPlaintext(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "persistence-key")
+	db := newSecretPersistenceDB(t, &model.GithubBuildConfig{}, &model.CustomBuild{}, &model.CustomPreset{})
+
+	config := &model.GithubBuildConfig{Repo: "owner/repo", Token: "github_pat_secret", PayloadKey: "payload-secret"}
+	if err := db.Create(config).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+	var rawConfig struct {
+		Token      string
+		PayloadKey string
+	}
+	if err := db.Table("github_build_configs").Select("token, payload_key").Where("id = ?", config.Id).Scan(&rawConfig).Error; err != nil {
+		t.Fatalf("read raw config: %v", err)
+	}
+	if !utils.IsEncryptedSecret(rawConfig.Token) || !utils.IsEncryptedSecret(rawConfig.PayloadKey) {
+		t.Fatalf("GitHub secrets were not encrypted at rest: %#v", rawConfig)
+	}
+	var loadedConfig model.GithubBuildConfig
+	if err := db.First(&loadedConfig, config.Id).Error; err != nil {
+		t.Fatalf("read GitHub config: %v", err)
+	}
+	if loadedConfig.Token != "github_pat_secret" || loadedConfig.PayloadKey != "payload-secret" {
+		t.Fatalf("decrypted GitHub config = %#v", loadedConfig)
+	}
+
+	build := &model.CustomBuild{
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: `{"permanent_password":"builder-secret","enable_audio":true}`,
+	}
+	if _, err := (&CustomBuildService{}).CreateNormalized(build); err != nil {
+		t.Fatalf("create custom build: %v", err)
+	}
+	rawBuild := rawCustomJSON(t, db, "custom_builds", build.Id)
+	if !utils.IsEncryptedSecret(rawBuild) || strings.Contains(rawBuild, "builder-secret") {
+		t.Fatalf("custom build secret was not protected at rest: %q", rawBuild)
+	}
+	loadedBuild, err := (&CustomBuildService{}).Info(build.Id)
+	if err != nil {
+		t.Fatalf("read custom build: %v", err)
+	}
+	if got := loadedBuild.CustomJson; got != build.CustomJson {
+		t.Fatalf("custom build read = %q, want %q", got, build.CustomJson)
+	}
+
+	preset := &model.CustomPreset{
+		UserId:     7,
+		Name:       "secret-preset",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: `{"permanent_password":"preset-secret"}`,
+	}
+	if err := (&CustomPresetService{}).Create(preset); err != nil {
+		t.Fatalf("create custom preset: %v", err)
+	}
+	rawPreset := rawCustomJSON(t, db, "custom_presets", preset.Id)
+	if !utils.IsEncryptedSecret(rawPreset) || strings.Contains(rawPreset, "preset-secret") {
+		t.Fatalf("custom preset secret was not protected at rest: %q", rawPreset)
+	}
+	loadedPreset, err := (&CustomPresetService{}).Info(preset.Id)
+	if err != nil {
+		t.Fatalf("read custom preset: %v", err)
+	}
+	if got := loadedPreset.CustomJson; got != preset.CustomJson {
+		t.Fatalf("custom preset read = %q, want %q", got, preset.CustomJson)
+	}
+}
+
+func TestLegacyCustomSecretReadsAndResavesAsCiphertext(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	db := newSecretPersistenceDB(t, &model.CustomBuild{}, &model.CustomPreset{})
+	legacyJSON := `{"permanent_password":"legacy-secret","enable_audio":true}`
+
+	legacyBuild := &model.CustomBuild{Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: legacyJSON}
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(legacyBuild).Error; err != nil {
+		t.Fatalf("seed legacy custom build: %v", err)
+	}
+	loadedBuild, err := (&CustomBuildService{}).Info(legacyBuild.Id)
+	if err != nil {
+		t.Fatalf("read legacy custom build: %v", err)
+	}
+	if loadedBuild.CustomJson != legacyJSON {
+		t.Fatalf("legacy custom build read = %q", loadedBuild.CustomJson)
+	}
+	loadedBuild.Name = "migrated"
+	if err := (&CustomBuildService{}).UpdateValidated(loadedBuild); err == nil {
+		t.Fatal("legacy custom build re-save without key succeeded")
+	}
+	if raw := rawCustomJSON(t, db, "custom_builds", legacyBuild.Id); raw != legacyJSON {
+		t.Fatalf("failed legacy update changed raw custom build to %q", raw)
+	}
+
+	legacyPreset := &model.CustomPreset{
+		UserId:     7,
+		Name:       "legacy-preset",
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: legacyJSON,
+	}
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(legacyPreset).Error; err != nil {
+		t.Fatalf("seed legacy custom preset: %v", err)
+	}
+	loadedPreset, err := (&CustomPresetService{}).Info(legacyPreset.Id)
+	if err != nil {
+		t.Fatalf("read legacy custom preset: %v", err)
+	}
+	if got := loadedPreset.CustomJson; got != legacyJSON {
+		t.Fatalf("legacy custom preset read = %q", got)
+	}
+
+	t.Setenv(utils.SecretEncryptionKeyEnv, "migration-key")
+	loadedBuild, err = (&CustomBuildService{}).Info(legacyBuild.Id)
+	if err != nil {
+		t.Fatalf("reread legacy custom build: %v", err)
+	}
+	if err := (&CustomBuildService{}).UpdateValidated(loadedBuild); err != nil {
+		t.Fatalf("legacy custom build re-save with key: %v", err)
+	}
+	if raw := rawCustomJSON(t, db, "custom_builds", legacyBuild.Id); !utils.IsEncryptedSecret(raw) {
+		t.Fatalf("migrated custom build is not encrypted: %q", raw)
+	}
+	loadedPreset, err = (&CustomPresetService{}).Info(legacyPreset.Id)
+	if err != nil {
+		t.Fatalf("reread legacy custom preset: %v", err)
+	}
+	if err := (&CustomPresetService{}).Update(loadedPreset); err != nil {
+		t.Fatalf("legacy custom preset re-save with key: %v", err)
+	}
+	if raw := rawCustomJSON(t, db, "custom_presets", legacyPreset.Id); !utils.IsEncryptedSecret(raw) {
+		t.Fatalf("migrated custom preset is not encrypted: %q", raw)
+	}
+}
+
+func TestLegacyGithubSecretsReadAndResaveAsCiphertext(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	db := newSecretPersistenceDB(t, &model.GithubBuildConfig{})
+	legacy := &model.GithubBuildConfig{
+		IdModel:    model.IdModel{Id: 1},
+		Repo:       "owner/repo",
+		Token:      "legacy-pat",
+		PayloadKey: "legacy-payload-key",
+	}
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(legacy).Error; err != nil {
+		t.Fatalf("seed legacy GitHub config: %v", err)
+	}
+	var loaded model.GithubBuildConfig
+	if err := db.First(&loaded, legacy.Id).Error; err != nil {
+		t.Fatalf("read legacy GitHub config: %v", err)
+	}
+	if loaded.Token != legacy.Token || loaded.PayloadKey != legacy.PayloadKey {
+		t.Fatalf("legacy GitHub config read = %#v", loaded)
+	}
+	t.Setenv(utils.SecretEncryptionKeyEnv, "github-migration-key")
+	if err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{Repo: loaded.Repo}); err != nil {
+		t.Fatalf("re-save legacy GitHub config: %v", err)
+	}
+	var raw struct {
+		Token      string
+		PayloadKey string
+	}
+	if err := db.Table("github_build_configs").Select("token, payload_key").Where("id = ?", legacy.Id).Scan(&raw).Error; err != nil {
+		t.Fatalf("read migrated raw GitHub config: %v", err)
+	}
+	if !utils.IsEncryptedSecret(raw.Token) || !utils.IsEncryptedSecret(raw.PayloadKey) {
+		t.Fatalf("legacy GitHub secrets were not migrated on re-save: %#v", raw)
+	}
+}
+
+func TestNonSecretCustomRecordsRemainAllowedWithoutKey(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	db := newSecretPersistenceDB(t, &model.CustomBuild{}, &model.CustomPreset{})
+	build := &model.CustomBuild{Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: `{"enable_audio":true}`}
+	if _, err := (&CustomBuildService{}).CreateNormalized(build); err != nil {
+		t.Fatalf("non-secret custom build rejected without key: %v", err)
+	}
+	if raw := rawCustomJSON(t, db, "custom_builds", build.Id); raw != build.CustomJson {
+		t.Fatalf("non-secret custom build raw JSON = %q, want %q", raw, build.CustomJson)
+	}
+
+	preset := &model.CustomPreset{UserId: 1, Name: "plain", Platform: "windows", Version: "1.2.3", AppName: "rustqs", CustomJson: `{}`}
+	if err := (&CustomPresetService{}).Create(preset); err != nil {
+		t.Fatalf("empty non-secret preset rejected without key: %v", err)
+	}
+}
+
+func TestDirectCustomModelSaveRejectsUnknownNeutralFields(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	db := newSecretPersistenceDB(t, &model.CustomBuild{}, &model.CustomPreset{})
+	for _, field := range []string{"cookie", "jwt", "signing_key"} {
+		t.Run(field+" build", func(t *testing.T) {
+			err := db.Create(&model.CustomBuild{
+				Platform:   "windows",
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: `{"` + field + `":"must-not-be-plaintext"}`,
+			}).Error
+			if err == nil || !strings.Contains(err.Error(), "unsupported custom field") {
+				t.Fatalf("direct build save error = %v, want unsupported custom field rejection", err)
+			}
+		})
+		t.Run(field+" preset", func(t *testing.T) {
+			err := db.Create(&model.CustomPreset{
+				Platform:   "windows",
+				Version:    "1.2.3",
+				AppName:    "rustqs",
+				CustomJson: `{"` + field + `":"must-not-be-plaintext"}`,
+			}).Error
+			if err == nil || !strings.Contains(err.Error(), "unsupported custom field") {
+				t.Fatalf("direct preset save error = %v, want unsupported custom field rejection", err)
+			}
+		})
+	}
+}
+
+func TestDirectCustomModelSaveAcceptsCanonicalPublicFields(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	db := newSecretPersistenceDB(t, &model.CustomBuild{}, &model.CustomPreset{})
+	build := &model.CustomBuild{
+		Platform:   "windows",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: `{"server_ip":"id.example:21116","enable_audio":true}`,
+	}
+	if err := db.Create(build).Error; err != nil {
+		t.Fatalf("direct canonical build save: %v", err)
+	}
+	if raw := rawCustomJSON(t, db, "custom_builds", build.Id); raw != build.CustomJson {
+		t.Fatalf("canonical build JSON = %q, want %q", raw, build.CustomJson)
+	}
+	preset := &model.CustomPreset{
+		Platform:   "android",
+		Version:    "1.2.3",
+		AppName:    "rustqs",
+		CustomJson: `{"theme":"dark","enable_audio":false}`,
+	}
+	if err := db.Create(preset).Error; err != nil {
+		t.Fatalf("direct canonical preset save: %v", err)
+	}
+	if raw := rawCustomJSON(t, db, "custom_presets", preset.Id); raw != preset.CustomJson {
+		t.Fatalf("canonical preset JSON = %q, want %q", raw, preset.CustomJson)
+	}
+}
+
+func TestCustomReadErrorsAreReturnedAndRowsAreNotPartiallyLoaded(t *testing.T) {
+	for _, test := range []struct {
+		name  string
+		seed  func(*gorm.DB) error
+		check func(*testing.T)
+	}{
+		{
+			name: "custom build missing key",
+			seed: func(db *gorm.DB) error {
+				return db.Session(&gorm.Session{SkipHooks: true}).Create(&model.CustomBuild{
+					Platform: "windows", Version: "1.2.3", CustomJson: "enc:v1:not-readable",
+				}).Error
+			},
+			check: func(t *testing.T) {
+				buildService := &CustomBuildService{}
+				if got, err := buildService.Info(1); err == nil || got != nil {
+					t.Fatalf("CustomBuild.Info() = %#v, %v; want nil and decryption error", got, err)
+				}
+				if got, err := buildService.List(1, 10); err == nil || got != nil {
+					t.Fatalf("CustomBuild.List() = %#v, %v; want nil and decryption error", got, err)
+				}
+			},
+		},
+		{
+			name: "custom preset missing key",
+			seed: func(db *gorm.DB) error {
+				return db.Session(&gorm.Session{SkipHooks: true}).Create(&model.CustomPreset{
+					UserId: 7, Name: "broken", Platform: "windows", Version: "1.2.3", CustomJson: "enc:v1:not-readable",
+				}).Error
+			},
+			check: func(t *testing.T) {
+				presetService := &CustomPresetService{}
+				if got, err := presetService.Info(1); err == nil || got != nil {
+					t.Fatalf("CustomPreset.Info() = %#v, %v; want nil and decryption error", got, err)
+				}
+				if got, err := presetService.List(1, 10); err == nil || got != nil {
+					t.Fatalf("CustomPreset.List() = %#v, %v; want nil and decryption error", got, err)
+				}
+				if got, err := presetService.ListByUser(1, 10, 7); err == nil || got != nil {
+					t.Fatalf("CustomPreset.ListByUser() = %#v, %v; want nil and decryption error", got, err)
+				}
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Setenv(utils.SecretEncryptionKeyEnv, "")
+			db := newSecretPersistenceDB(t, &model.CustomBuild{}, &model.CustomPreset{})
+			if err := test.seed(db); err != nil {
+				t.Fatalf("seed broken row: %v", err)
+			}
+			test.check(t)
+		})
+	}
+}
+
+func TestCustomReadMalformedCiphertextReturnsError(t *testing.T) {
+	t.Setenv(utils.SecretEncryptionKeyEnv, "malformed-read-key")
+	db := newSecretPersistenceDB(t, &model.CustomBuild{}, &model.CustomPreset{})
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(&model.CustomBuild{
+		Platform: "windows", Version: "1.2.3", CustomJson: "enc:v1:not-readable",
+	}).Error; err != nil {
+		t.Fatalf("seed malformed build: %v", err)
+	}
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Create(&model.CustomPreset{
+		UserId: 7, Name: "malformed", Platform: "windows", Version: "1.2.3", CustomJson: "enc:v1:not-readable",
+	}).Error; err != nil {
+		t.Fatalf("seed malformed preset: %v", err)
+	}
+	if got, err := (&CustomBuildService{}).Info(1); err == nil || got != nil {
+		t.Fatalf("CustomBuild.Info() = %#v, %v; want nil and malformed-ciphertext error", got, err)
+	}
+	if got, err := (&CustomBuildService{}).List(1, 10); err == nil || got != nil {
+		t.Fatalf("CustomBuild.List() = %#v, %v; want nil and malformed-ciphertext error", got, err)
+	}
+	if got, err := (&CustomPresetService{}).Info(1); err == nil || got != nil {
+		t.Fatalf("CustomPreset.Info() = %#v, %v; want nil and malformed-ciphertext error", got, err)
+	}
+	if got, err := (&CustomPresetService{}).ListByUser(1, 10, 7); err == nil || got != nil {
+		t.Fatalf("CustomPreset.ListByUser() = %#v, %v; want nil and malformed-ciphertext error", got, err)
+	}
+}
+
+func newSecretPersistenceDB(t *testing.T, models ...any) *gorm.DB {
+	t.Helper()
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(models...); err != nil {
+		t.Fatalf("migrate secret persistence models: %v", err)
+	}
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	return db
+}
+
+func rawCustomJSON(t *testing.T, db *gorm.DB, table string, id uint) string {
+	t.Helper()
+	var row struct {
+		CustomJSON string `gorm:"column:custom_json"`
+	}
+	if err := db.Table(table).Select("custom_json").Where("id = ?", id).Scan(&row).Error; err != nil {
+		t.Fatalf("read raw custom JSON: %v", err)
+	}
+	return row.CustomJSON
+}
+
+func assertRowCount(t *testing.T, db *gorm.DB, value any, want int64) {
+	t.Helper()
+	var count int64
+	if err := db.Model(value).Count(&count).Error; err != nil {
+		t.Fatalf("count rows: %v", err)
+	}
+	if count != want {
+		t.Fatalf("row count = %d, want %d", count, want)
+	}
+}
diff --git a/api/service/streaming_artifact_test.go b/api/service/streaming_artifact_test.go
new file mode 100644
index 0000000..c94b6d5
--- /dev/null
+++ b/api/service/streaming_artifact_test.go
@@ -0,0 +1,251 @@
+package service
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func serviceArtifactZip(t *testing.T, contents string) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	writer := zip.NewWriter(&buffer)
+	entry, err := writer.Create("artifact.bin")
+	if err != nil {
+		t.Fatalf("create artifact entry: %v", err)
+	}
+	if _, err := entry.Write([]byte(contents)); err != nil {
+		t.Fatalf("write artifact entry: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close artifact ZIP: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+type failingArtifactReader struct {
+	remaining int
+}
+
+func (r *failingArtifactReader) Read(p []byte) (int, error) {
+	if r.remaining == 0 {
+		return 0, errors.New("simulated interrupted download")
+	}
+	n := len(p)
+	if n > r.remaining {
+		n = r.remaining
+	}
+	for i := 0; i < n; i++ {
+		p[i] = 'x'
+	}
+	r.remaining -= n
+	return n, nil
+}
+
+func artifactTempFiles(t *testing.T, dir string) []string {
+	t.Helper()
+	paths, err := filepath.Glob(filepath.Join(dir, "deskforge-artifact-*"))
+	if err != nil {
+		t.Fatalf("glob artifact temp files: %v", err)
+	}
+	return paths
+}
+
+func TestDownloadArtifactStreamsToBoundedTemporaryArchive(t *testing.T) {
+	previousLimit := githubArtifactBodyLimit
+	previousTempDir := githubArtifactTempDir
+	payload := serviceArtifactZip(t, strings.Repeat("z", 32))
+	githubArtifactBodyLimit = int64(len(payload))
+	githubArtifactTempDir = t.TempDir()
+	t.Cleanup(func() {
+		githubArtifactBodyLimit = previousLimit
+		githubArtifactTempDir = previousTempDir
+	})
+	before := artifactTempFiles(t, githubArtifactTempDir)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/actions/runs/7/artifacts":
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact"}]}`, nil), nil
+		case "/repos/owner/repo/actions/artifacts/42/zip":
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Header:     make(http.Header),
+				Body:       io.NopCloser(bytes.NewReader(payload)),
+			}, nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	result, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 42, "artifact")
+	if err != nil {
+		t.Fatalf("DownloadArtifact() error = %v", err)
+	}
+	if result.ArtifactID != 42 || result.ArtifactName != "artifact" || result.Size != int64(len(payload)) {
+		t.Fatalf("DownloadArtifact() result = %#v, want exact identity and size", result)
+	}
+	data, err := os.ReadFile(result.ArchivePath)
+	if err != nil || !bytes.Equal(data, payload) {
+		t.Fatalf("temporary archive = %d bytes, err=%v", len(data), err)
+	}
+	if strings.HasSuffix(result.ArchivePath, ".part") {
+		t.Fatalf("returned path still has partial suffix: %q", result.ArchivePath)
+	}
+	if err := os.Remove(result.ArchivePath); err != nil {
+		t.Fatalf("remove successful temporary archive: %v", err)
+	}
+	if after := artifactTempFiles(t, githubArtifactTempDir); len(after) != len(before) {
+		t.Fatalf("temporary files after successful cleanup = %v, before=%v", after, before)
+	}
+}
+
+func TestDownloadArtifactCleansPartialAndOversizedTemporaryFiles(t *testing.T) {
+	previousLimit := githubArtifactBodyLimit
+	previousTempDir := githubArtifactTempDir
+	githubArtifactBodyLimit = 16
+	githubArtifactTempDir = t.TempDir()
+	t.Cleanup(func() {
+		githubArtifactBodyLimit = previousLimit
+		githubArtifactTempDir = previousTempDir
+	})
+
+	t.Run("partial body", func(t *testing.T) {
+		before := artifactTempFiles(t, githubArtifactTempDir)
+		withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if strings.HasSuffix(req.URL.Path, "/actions/runs/7/artifacts") {
+				return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact"}]}`, nil), nil
+			}
+			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(&failingArtifactReader{remaining: 4})}, nil
+		}))
+		_, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 42, "artifact")
+		var transportErr *GithubTransportError
+		if !errors.As(err, &transportErr) {
+			t.Fatalf("partial download error = %T %v, want transport error", err, err)
+		}
+		if after := artifactTempFiles(t, githubArtifactTempDir); len(after) != len(before) {
+			t.Fatalf("partial download left temp files = %v, before=%v", after, before)
+		}
+	})
+
+	t.Run("oversized body", func(t *testing.T) {
+		before := artifactTempFiles(t, githubArtifactTempDir)
+		withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if strings.HasSuffix(req.URL.Path, "/actions/runs/7/artifacts") {
+				return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact"}]}`, nil), nil
+			}
+			return &http.Response{
+				StatusCode:    http.StatusOK,
+				Header:        make(http.Header),
+				ContentLength: 17,
+				Body:          io.NopCloser(strings.NewReader(strings.Repeat("x", 17))),
+			}, nil
+		}))
+		_, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 42, "artifact")
+		var contractErr *GithubContractError
+		if !errors.As(err, &contractErr) || !strings.Contains(err.Error(), "exceeds limit") {
+			t.Fatalf("oversized download error = %T %v, want bounded contract error", err, err)
+		}
+		if after := artifactTempFiles(t, githubArtifactTempDir); len(after) != len(before) {
+			t.Fatalf("oversized download left temp files = %v, before=%v", after, before)
+		}
+	})
+}
+
+func TestDownloadArtifactCancellationCleansTemporaryFile(t *testing.T) {
+	previousTempDir := githubArtifactTempDir
+	githubArtifactTempDir = t.TempDir()
+	t.Cleanup(func() { githubArtifactTempDir = previousTempDir })
+	before := artifactTempFiles(t, githubArtifactTempDir)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasSuffix(req.URL.Path, "/actions/runs/7/artifacts") {
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact"}]}`, nil), nil
+		}
+		return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader("cancelled"))}, nil
+	}))
+	_, err := (&GithubBuildConfigService{}).DownloadArtifact(ctx, githubConfig(), 7, 42, "artifact")
+	if err == nil || !strings.Contains(err.Error(), "context canceled") {
+		t.Fatalf("cancelled download error = %v, want context cancellation", err)
+	}
+	if after := artifactTempFiles(t, githubArtifactTempDir); len(after) != len(before) {
+		t.Fatalf("cancelled download left temp files = %v, before=%v", after, before)
+	}
+}
+
+func TestDownloadArtifactRejectsStoredIDNotBelongingToRun(t *testing.T) {
+	zipRequests := 0
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasSuffix(req.URL.Path, "/actions/runs/7/artifacts") {
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":99,"name":"artifact"}]}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/actions/artifacts/42/zip") {
+			zipRequests++
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"unexpected ZIP request"}`, nil), nil
+	}))
+	_, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 42, "artifact")
+	if err == nil || !strings.Contains(err.Error(), "does not match run artifact id") {
+		t.Fatalf("DownloadArtifact() error = %v, want wrong-run identity rejection", err)
+	}
+	if zipRequests != 0 {
+		t.Fatal("DownloadArtifact() requested ZIP for an artifact absent from the stored run")
+	}
+}
+
+func TestDownloadArtifactRejectsExpiredStoredArtifact(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasSuffix(req.URL.Path, "/actions/runs/7/artifacts") {
+			return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact","expired":true}]}`, nil), nil
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"ZIP must not be requested"}`, nil), nil
+	}))
+	_, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 42, "artifact")
+	var unavailable *GithubArtifactUnavailableError
+	if !errors.As(err, &unavailable) {
+		t.Fatalf("DownloadArtifact() error = %T %v, want expired artifact rejection", err, err)
+	}
+}
+
+func TestDownloadArtifactRejectsFixedLengthAndChunkedShortBodies(t *testing.T) {
+	payload := serviceArtifactZip(t, "short body test")
+	previousTempDir := githubArtifactTempDir
+	githubArtifactTempDir = t.TempDir()
+	t.Cleanup(func() { githubArtifactTempDir = previousTempDir })
+	for _, tc := range []struct {
+		name   string
+		header bool
+	}{
+		{name: "fixed length", header: true},
+		{name: "chunked", header: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if strings.HasSuffix(req.URL.Path, "/actions/runs/7/artifacts") {
+					return githubResponse(http.StatusOK, `{"artifacts":[{"id":42,"name":"artifact"}]}`, nil), nil
+				}
+				body := payload[:len(payload)-1]
+				resp := &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(bytes.NewReader(body))}
+				if tc.header {
+					resp.Header.Set("Content-Length", strconv.Itoa(len(payload)))
+				}
+				return resp, nil
+			}))
+			_, err := (&GithubBuildConfigService{}).DownloadArtifact(context.Background(), githubConfig(), 7, 42, "artifact")
+			if err == nil || !strings.Contains(err.Error(), "invalid ZIP archive") && !strings.Contains(err.Error(), "does not match Content-Length") {
+				t.Fatalf("DownloadArtifact() error = %v, want short-body rejection", err)
+			}
+			if files := artifactTempFiles(t, githubArtifactTempDir); len(files) != 0 {
+				t.Fatalf("short body left temporary files: %v", files)
+			}
+		})
+	}
+}
diff --git a/api/service/user_test.go b/api/service/user_test.go
new file mode 100644
index 0000000..ff020e7
--- /dev/null
+++ b/api/service/user_test.go
@@ -0,0 +1,79 @@
+package service
+
+import (
+	"database/sql"
+	"testing"
+	"time"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"rustdesk-server/api/model"
+)
+
+func TestUserServiceLogout(t *testing.T) {
+	tests := []struct {
+		name      string
+		closeDB   bool
+		wantError bool
+	}{
+		{name: "revokes token", wantError: false},
+		{name: "returns database error", closeDB: true, wantError: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+			if err != nil {
+				t.Fatalf("open sqlite: %v", err)
+			}
+			sqlDB, err := db.DB()
+			if err != nil {
+				t.Fatalf("get sqlite handle: %v", err)
+			}
+			sqlDB.SetMaxOpenConns(1)
+			defer func(db *sql.DB) { _ = db.Close() }(sqlDB)
+			if err := db.AutoMigrate(&model.UserToken{}); err != nil {
+				t.Fatalf("migrate user token: %v", err)
+			}
+
+			previousDB, previousServices := DB, AllService
+			DB = db
+			AllService = &Service{UserService: &UserService{}}
+			t.Cleanup(func() {
+				DB = previousDB
+				AllService = previousServices
+			})
+
+			const token = "logout-service-token"
+			user := &model.User{IdModel: model.IdModel{Id: 1}}
+			if err := db.Create(&model.UserToken{
+				UserId:    user.Id,
+				Token:     token,
+				ExpiredAt: time.Now().Add(time.Hour).Unix(),
+			}).Error; err != nil {
+				t.Fatalf("create user token: %v", err)
+			}
+			if tt.closeDB {
+				if err := sqlDB.Close(); err != nil {
+					t.Fatalf("close sqlite: %v", err)
+				}
+			}
+
+			err = AllService.UserService.Logout(user, token)
+			if (err != nil) != tt.wantError {
+				t.Fatalf("Logout() error = %v, want error: %t", err, tt.wantError)
+			}
+			if tt.wantError {
+				return
+			}
+
+			var remaining int64
+			if err := db.Model(&model.UserToken{}).Where("token = ?", token).Count(&remaining).Error; err != nil {
+				t.Fatalf("count revoked token: %v", err)
+			}
+			if remaining != 0 {
+				t.Fatalf("Logout() left token stored: %d row(s)", remaining)
+			}
+		})
+	}
+}
diff --git a/api/service/version_catalog.go b/api/service/version_catalog.go
new file mode 100644
index 0000000..003769a
--- /dev/null
+++ b/api/service/version_catalog.go
@@ -0,0 +1,604 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/singleflight"
+
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/utils"
+)
+
+const (
+	assetsReleasePrefix  = "offline-assets-"
+	maxReleasePages      = 10
+	versionCatalogTTL    = 5 * time.Minute
+	githubSourceRefLimit = 128
+)
+
+var githubRepoPattern = regexp.MustCompile(`^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$`)
+
+// AssetsRelease is the provider release metadata paired with one source
+// version. The release tag is user-visible metadata; the ID prevents silently
+// switching to a different GitHub release with the same tag.
+type AssetsRelease struct {
+	ID      int64          `json:"id"`
+	TagName string         `json:"tag_name"`
+	Name    string         `json:"name,omitempty"`
+	Assets  []ReleaseAsset `json:"assets"`
+}
+
+// ReleaseAsset is provider-derived identity for one required offline asset.
+// Digest is copied verbatim from GitHub; the service never computes or invents
+// a provider checksum at catalog time.
+type ReleaseAsset struct {
+	ID     int64  `json:"id"`
+	Name   string `json:"name"`
+	Digest string `json:"digest"`
+}
+
+var requiredOfflineAssetNames = []string{
+	"windows-x64-release.zip",
+	"usbmmidd_v2.zip",
+	"rustdesk_printer_driver_v4-1.4.zip",
+	"printer_driver_adapter.zip",
+}
+
+// VersionIdentity is the complete immutable release identity selected by the
+// normal typed version flow. BuildRef is the source object SHA resolved from
+// the configured repository's exact source tag; it is never user supplied.
+type VersionIdentity struct {
+	Repo           string `json:"-"`
+	DisplayVersion string `json:"version"`
+	BuildRef       string `json:"-"`
+	SourceTag      string `json:"-"`
+	// WorkflowRef is the provider selector used to locate the owned workflow
+	// definition at dispatch time. WorkflowSHA is the immutable commit that
+	// GitHub resolves that selector to and is persisted in CustomBuild.GithubRef.
+	WorkflowRef   string        `json:"-"`
+	WorkflowSHA   string        `json:"-"`
+	AssetsRelease AssetsRelease `json:"assets_release"`
+}
+
+// AvailableVersion is a catalog entry. Its provider identity is retained in
+// the service domain for persistence, while controllers expose only the
+// display version and safe release metadata to normal users.
+type AvailableVersion struct {
+	VersionIdentity
+}
+
+type versionCatalogCache struct {
+	entries    map[string][]AvailableVersion
+	cachedAt   map[string]time.Time
+	activeRepo string
+	mu         sync.Mutex
+}
+
+var (
+	versionCache  versionCatalogCache
+	versionFlight singleflight.Group
+)
+
+func resetVersionCatalogCache() {
+	versionCache.mu.Lock()
+	versionCache.entries = nil
+	versionCache.cachedAt = nil
+	versionCache.activeRepo = ""
+	versionCache.mu.Unlock()
+}
+
+func validateGithubRepo(repo string) error {
+	if !githubRepoPattern.MatchString(repo) {
+		return fmt.Errorf("configured GitHub repo must be owner/name")
+	}
+	owner, name, ok := strings.Cut(repo, "/")
+	if !ok || owner == "." || owner == ".." || name == "." || name == ".." {
+		return fmt.Errorf("configured GitHub repo must not contain dot-segment paths")
+	}
+	return nil
+}
+
+func githubRepoPath(repo, suffix string) (string, error) {
+	if err := validateGithubRepo(repo); err != nil {
+		return "", err
+	}
+	return "/repos/" + repo + suffix, nil
+}
+
+func (identity VersionIdentity) validate() error {
+	if err := validateGithubRepo(identity.Repo); err != nil {
+		return err
+	}
+	if !utils.ValidateBuildVersion(identity.DisplayVersion) {
+		return fmt.Errorf("invalid display version %q", identity.DisplayVersion)
+	}
+	if identity.SourceTag != identity.DisplayVersion {
+		return fmt.Errorf("source tag %q does not match version %q", identity.SourceTag, identity.DisplayVersion)
+	}
+	if !validGithubSourceSHA(identity.BuildRef) {
+		return fmt.Errorf("build ref must be a 40-64 character hexadecimal SHA")
+	}
+	if identity.WorkflowRef != "" && !validGithubWorkflowRef(identity.WorkflowRef) {
+		return fmt.Errorf("workflow execution ref is invalid")
+	}
+	if identity.WorkflowRef == "" {
+		return fmt.Errorf("workflow execution selector is missing")
+	}
+	if !validGithubSourceSHA(identity.WorkflowSHA) {
+		return fmt.Errorf("workflow execution SHA is missing or invalid")
+	}
+	wantRelease := assetsReleasePrefix + identity.DisplayVersion
+	if identity.AssetsRelease.TagName != wantRelease || identity.AssetsRelease.ID <= 0 {
+		return fmt.Errorf("assets release does not match version %q", identity.DisplayVersion)
+	}
+	if err := validateReleaseAssets(identity.AssetsRelease.Assets); err != nil {
+		return fmt.Errorf("release asset identity is missing or invalid: %w", err)
+	}
+	return nil
+}
+
+func validGithubWorkflowRef(ref string) bool {
+	if validGithubSourceSHA(ref) {
+		return false
+	}
+	if len(ref) == 0 || len(ref) > githubSourceRefLimit || strings.Contains(ref, "..") || strings.Contains(ref, "//") {
+		return false
+	}
+	if strings.HasPrefix(ref, "refs/") && !strings.HasPrefix(ref, "refs/heads/") && !strings.HasPrefix(ref, "refs/tags/") {
+		return false
+	}
+	for _, char := range ref {
+		if (char < 'a' || char > 'z') && (char < 'A' || char > 'Z') &&
+			(char < '0' || char > '9') && !strings.ContainsRune("._/-", char) {
+			return false
+		}
+	}
+	if ref[0] == '/' || ref[len(ref)-1] == '/' {
+		return false
+	}
+	if strings.HasSuffix(ref, "refs/heads/") || strings.HasSuffix(ref, "refs/tags/") {
+		return false
+	}
+	return true
+}
+
+func validateReleaseAssets(assets []ReleaseAsset) error {
+	if len(assets) != len(requiredOfflineAssetNames) {
+		return fmt.Errorf("release asset metadata must contain exactly %d required assets", len(requiredOfflineAssetNames))
+	}
+	byName := make(map[string]ReleaseAsset, len(assets))
+	for _, asset := range assets {
+		if asset.ID <= 0 || asset.Name == "" || asset.Name != strings.TrimSpace(asset.Name) {
+			return fmt.Errorf("asset has invalid id or name")
+		}
+		if _, duplicate := byName[asset.Name]; duplicate {
+			return fmt.Errorf("asset %q is ambiguous", asset.Name)
+		}
+		if !strings.HasPrefix(asset.Digest, "sha256:") || !validGithubSourceSHA(strings.TrimPrefix(asset.Digest, "sha256:")) || len(strings.TrimPrefix(asset.Digest, "sha256:")) != 64 {
+			return fmt.Errorf("asset %q has no trusted SHA-256 digest", asset.Name)
+		}
+		byName[asset.Name] = asset
+	}
+	for name := range byName {
+		required := false
+		for _, requiredName := range requiredOfflineAssetNames {
+			if name == requiredName {
+				required = true
+				break
+			}
+		}
+		if !required {
+			return fmt.Errorf("unexpected release asset %q", name)
+		}
+	}
+	for _, name := range requiredOfflineAssetNames {
+		if _, ok := byName[name]; !ok {
+			return fmt.Errorf("required asset %q is missing", name)
+		}
+	}
+	return nil
+}
+
+func marshalReleaseAssets(assets []ReleaseAsset) (string, error) {
+	if err := validateReleaseAssets(assets); err != nil {
+		return "", err
+	}
+	data, err := json.Marshal(assets)
+	if err != nil {
+		return "", fmt.Errorf("marshal release assets: %w", err)
+	}
+	return string(data), nil
+}
+
+func unmarshalReleaseAssets(raw string) ([]ReleaseAsset, error) {
+	if raw == "" {
+		// Legacy provenance rows predate release-asset identity. They remain
+		// readable for restart compatibility, while every new persistence path
+		// still requires marshalReleaseAssets to succeed.
+		return nil, nil
+	}
+	var assets []ReleaseAsset
+	if err := json.Unmarshal([]byte(raw), &assets); err != nil {
+		return nil, fmt.Errorf("decode release asset metadata: %w", err)
+	}
+	if err := validateReleaseAssets(assets); err != nil {
+		return nil, err
+	}
+	return assets, nil
+}
+
+// VersionIdentityFromRecord returns the stored identity and rejects legacy or
+// partial rows instead of reconstructing a ref from mutable global config.
+func VersionIdentityFromRecord(build *model.CustomBuild) (VersionIdentity, error) {
+	if build == nil {
+		return VersionIdentity{}, errors.New("build record is nil")
+	}
+	identity := VersionIdentity{
+		Repo:           build.GithubRepo,
+		DisplayVersion: build.Version,
+		BuildRef:       build.BuildRef,
+		SourceTag:      build.SourceTag,
+		// WorkflowSelector is the exact dispatch selector. GithubRef is the
+		// resolved execution commit; a mutable legacy branch/ref therefore fails
+		// the SHA validation above instead of being reused as immutable identity.
+		WorkflowRef: build.WorkflowSelector,
+		WorkflowSHA: build.GithubRef,
+		AssetsRelease: AssetsRelease{
+			ID:      build.AssetsReleaseID,
+			TagName: build.AssetsRelease,
+		},
+	}
+	assets, err := unmarshalReleaseAssets(build.AssetsReleaseAssets)
+	if err != nil {
+		return VersionIdentity{}, fmt.Errorf("immutable release assets missing or invalid: %w", err)
+	}
+	identity.AssetsRelease.Assets = assets
+	if err := identity.validate(); err != nil {
+		return VersionIdentity{}, fmt.Errorf("immutable version identity missing or invalid: %w", err)
+	}
+	return identity, nil
+}
+
+func copyAvailableVersions(entries []AvailableVersion) []AvailableVersion {
+	result := make([]AvailableVersion, len(entries))
+	copy(result, entries)
+	return result
+}
+
+func (s *GithubBuildConfigService) cachedVersions(repo string) ([]AvailableVersion, bool) {
+	versionCache.mu.Lock()
+	defer versionCache.mu.Unlock()
+	if versionCache.activeRepo != repo {
+		// The configured repository is part of the cache identity. Clear the
+		// previous catalog when the setting changes so it cannot be reused.
+		versionCache.entries = make(map[string][]AvailableVersion)
+		versionCache.cachedAt = make(map[string]time.Time)
+		versionCache.activeRepo = repo
+	}
+	entries, ok := versionCache.entries[repo]
+	if !ok || time.Since(versionCache.cachedAt[repo]) >= versionCatalogTTL {
+		return nil, false
+	}
+	return copyAvailableVersions(entries), true
+}
+
+func (s *GithubBuildConfigService) storeVersions(repo string, entries []AvailableVersion) {
+	versionCache.mu.Lock()
+	defer versionCache.mu.Unlock()
+	if versionCache.entries == nil || versionCache.activeRepo != repo {
+		versionCache.entries = make(map[string][]AvailableVersion)
+		versionCache.cachedAt = make(map[string]time.Time)
+		versionCache.activeRepo = repo
+	}
+	versionCache.entries[repo] = copyAvailableVersions(entries)
+	versionCache.cachedAt[repo] = time.Now()
+}
+
+// GetAvailableVersions returns only versions whose matching assets release and
+// immutable source tag/ref were both verified in the configured repository.
+func (s *GithubBuildConfigService) GetAvailableVersions(ctx context.Context) ([]AvailableVersion, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+	gcfg, err := s.Get()
+	if err != nil {
+		return nil, fmt.Errorf("get GitHub build config: %w", err)
+	}
+	return s.getAvailableVersionsWithConfig(ctx, gcfg)
+}
+
+func (s *GithubBuildConfigService) getAvailableVersionsWithConfig(ctx context.Context, gcfg *model.GithubBuildConfig) ([]AvailableVersion, error) {
+	if gcfg == nil {
+		return nil, errors.New("GitHub build config is missing")
+	}
+	if err := validateGithubRepo(gcfg.Repo); err != nil {
+		return nil, err
+	}
+	workflowIdentity, err := s.resolveWorkflowExecution(ctx, gcfg)
+	if err != nil {
+		return nil, err
+	}
+	return s.getAvailableVersionsWithWorkflowIdentity(ctx, gcfg, workflowIdentity)
+}
+
+func (s *GithubBuildConfigService) getAvailableVersionsWithWorkflowIdentity(ctx context.Context, gcfg *model.GithubBuildConfig, workflowIdentity WorkflowExecutionIdentity) ([]AvailableVersion, error) {
+	if gcfg == nil {
+		return nil, errors.New("GitHub build config is missing")
+	}
+	if err := validateGithubRepo(gcfg.Repo); err != nil {
+		return nil, err
+	}
+	if entries, ok := s.cachedVersions(gcfg.Repo); ok {
+		return applyWorkflowIdentity(entries, workflowIdentity), nil
+	}
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+	key := "catalog:" + gcfg.Repo
+	result := versionFlight.DoChan(key, func() (any, error) {
+		if entries, ok := s.cachedVersions(gcfg.Repo); ok {
+			return entries, nil
+		}
+		fetchCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		entries, fetchErr := s.fetchReleasesWithConfig(fetchCtx, gcfg, workflowIdentity)
+		if fetchErr != nil {
+			return nil, fetchErr
+		}
+		if len(entries) == 0 {
+			return nil, errors.New("configured repository has no valid offline-assets releases")
+		}
+		s.storeVersions(gcfg.Repo, entries)
+		return entries, nil
+	})
+	select {
+	case shared := <-result:
+		if shared.Err != nil {
+			return nil, shared.Err
+		}
+		return applyWorkflowIdentity(copyAvailableVersions(shared.Val.([]AvailableVersion)), workflowIdentity), nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+func applyWorkflowIdentity(entries []AvailableVersion, identity WorkflowExecutionIdentity) []AvailableVersion {
+	for index := range entries {
+		entries[index].WorkflowRef = identity.Ref
+		entries[index].WorkflowSHA = identity.SHA
+	}
+	return entries
+}
+
+// ResolveVersion resolves only a display version from the current configured
+// repository. The caller persists the returned identity before dispatch.
+func (s *GithubBuildConfigService) ResolveVersion(ctx context.Context, displayVersion string) (VersionIdentity, error) {
+	if !utils.ValidateBuildVersion(displayVersion) {
+		return VersionIdentity{}, fmt.Errorf("invalid display version %q", displayVersion)
+	}
+	gcfg, err := s.Get()
+	if err != nil {
+		return VersionIdentity{}, fmt.Errorf("get GitHub build config: %w", err)
+	}
+	workflowIdentity, err := s.resolveWorkflowExecution(ctx, gcfg)
+	if err != nil {
+		return VersionIdentity{}, err
+	}
+	return s.resolveVersionWithConfig(ctx, gcfg, displayVersion, workflowIdentity)
+}
+
+func (s *GithubBuildConfigService) resolveVersionWithConfig(ctx context.Context, gcfg *model.GithubBuildConfig, displayVersion string, workflowIdentity WorkflowExecutionIdentity) (VersionIdentity, error) {
+	if !utils.ValidateBuildVersion(displayVersion) {
+		return VersionIdentity{}, fmt.Errorf("invalid display version %q", displayVersion)
+	}
+	entries, err := s.getAvailableVersionsWithWorkflowIdentity(ctx, gcfg, workflowIdentity)
+	if err != nil {
+		return VersionIdentity{}, err
+	}
+	for _, entry := range entries {
+		if entry.DisplayVersion == displayVersion {
+			identity := entry.VersionIdentity
+			if err := identity.validate(); err != nil {
+				return VersionIdentity{}, err
+			}
+			return identity, nil
+		}
+	}
+	return VersionIdentity{}, fmt.Errorf("version %q is not available in configured repository", displayVersion)
+}
+
+type githubReleaseRecord struct {
+	ID         int64  `json:"id"`
+	TagName    string `json:"tag_name"`
+	Name       string `json:"name"`
+	Draft      bool   `json:"draft"`
+	Prerelease bool   `json:"prerelease"`
+}
+
+type githubReleaseAssetRecord struct {
+	ID     int64  `json:"id"`
+	Name   string `json:"name"`
+	Digest string `json:"digest"`
+}
+
+type githubRefRecord struct {
+	Ref    string `json:"ref"`
+	Object struct {
+		SHA  string `json:"sha"`
+		Type string `json:"type"`
+	} `json:"object"`
+}
+
+func nextGithubLink(link string) (string, bool, error) {
+	for _, part := range strings.Split(link, ",") {
+		segments := strings.Split(strings.TrimSpace(part), ";")
+		if len(segments) < 2 || !strings.Contains(segments[1], `rel="next"`) {
+			continue
+		}
+		value := strings.TrimSpace(segments[0])
+		if len(value) < 2 || value[0] != '<' || value[len(value)-1] != '>' {
+			return "", false, errors.New("invalid GitHub Link header")
+		}
+		u, err := url.Parse(value[1 : len(value)-1])
+		if err != nil || (u.Host != "" && u.Host != "api.github.com") || u.Path == "" {
+			return "", false, errors.New("unsafe GitHub pagination link")
+		}
+		return u.EscapedPath() + func() string {
+			if u.RawQuery == "" {
+				return ""
+			}
+			return "?" + u.RawQuery
+		}(), true, nil
+	}
+	return "", false, nil
+}
+
+func (s *GithubBuildConfigService) fetchReleasesWithConfig(ctx context.Context, gcfg *model.GithubBuildConfig, workflowIdentity WorkflowExecutionIdentity) ([]AvailableVersion, error) {
+	if gcfg == nil {
+		return nil, errors.New("GitHub build config is missing")
+	}
+	if err := validateGithubRepo(gcfg.Repo); err != nil {
+		return nil, err
+	}
+	path, err := githubRepoPath(gcfg.Repo, "/releases?per_page=100")
+	if err != nil {
+		return nil, err
+	}
+	var releases []githubReleaseRecord
+	for page := 0; page < maxReleasePages; page++ {
+		resp, err := s.ghReq(ctx, gcfg, http.MethodGet, path, nil, http.StatusOK)
+		if err != nil {
+			return nil, err
+		}
+		var pageReleases []githubReleaseRecord
+		if err := decodeGithubJSON(resp, "list releases", &pageReleases); err != nil {
+			resp.Body.Close()
+			return nil, err
+		}
+		resp.Body.Close()
+		releases = append(releases, pageReleases...)
+		next, hasNext, err := nextGithubLink(resp.Header.Get("Link"))
+		if err != nil {
+			return nil, &GithubContractError{Operation: "list releases", Cause: err}
+		}
+		if !hasNext {
+			break
+		}
+		if page == maxReleasePages-1 {
+			return nil, &GithubContractError{Operation: "list releases", Cause: fmt.Errorf("pagination exceeds %d pages", maxReleasePages)}
+		}
+		path = next
+	}
+
+	entries := make([]AvailableVersion, 0, len(releases))
+	seen := make(map[string]struct{})
+	for _, release := range releases {
+		if release.Draft || release.TagName == "" || !strings.HasPrefix(release.TagName, assetsReleasePrefix) {
+			continue
+		}
+		version := strings.TrimPrefix(release.TagName, assetsReleasePrefix)
+		if !utils.ValidateBuildVersion(version) {
+			continue
+		}
+		if release.ID <= 0 {
+			return nil, &GithubContractError{Operation: "list releases", Cause: fmt.Errorf("release %q has no immutable id", release.TagName)}
+		}
+		if _, duplicate := seen[version]; duplicate {
+			return nil, &GithubContractError{Operation: "list releases", Cause: fmt.Errorf("duplicate release for version %q", version)}
+		}
+		seen[version] = struct{}{}
+
+		releasePath, err := githubRepoPath(gcfg.Repo, fmt.Sprintf("/releases/%d", release.ID))
+		if err != nil {
+			return nil, err
+		}
+		releaseResp, err := s.ghReq(ctx, gcfg, http.MethodGet, releasePath, nil, http.StatusOK)
+		if err != nil {
+			return nil, fmt.Errorf("resolve assets release %q: %w", version, err)
+		}
+		var releaseDetails struct {
+			ID      int64                      `json:"id"`
+			TagName string                     `json:"tag_name"`
+			Assets  []githubReleaseAssetRecord `json:"assets"`
+		}
+		if err := decodeGithubJSON(releaseResp, "resolve assets release", &releaseDetails); err != nil {
+			releaseResp.Body.Close()
+			return nil, err
+		}
+		releaseResp.Body.Close()
+		if releaseDetails.ID != release.ID || releaseDetails.TagName != release.TagName {
+			return nil, &GithubContractError{Operation: "resolve assets release", Cause: fmt.Errorf("release identity changed for %q", version)}
+		}
+		assets := make([]ReleaseAsset, 0, len(requiredOfflineAssetNames))
+		for _, requiredName := range requiredOfflineAssetNames {
+			var match *githubReleaseAssetRecord
+			for index := range releaseDetails.Assets {
+				asset := &releaseDetails.Assets[index]
+				if asset.Name != requiredName {
+					continue
+				}
+				if match != nil {
+					return nil, &GithubContractError{Operation: "resolve assets release", Cause: fmt.Errorf("asset %q is ambiguous", requiredName)}
+				}
+				match = asset
+			}
+			if match == nil {
+				return nil, &GithubContractError{Operation: "resolve assets release", Cause: fmt.Errorf("required asset %q is missing", requiredName)}
+			}
+			assets = append(assets, ReleaseAsset{ID: match.ID, Name: match.Name, Digest: match.Digest})
+		}
+		if err := validateReleaseAssets(assets); err != nil {
+			return nil, &GithubContractError{Operation: "resolve assets release", Cause: err}
+		}
+
+		sourcePath, err := githubRepoPath(gcfg.Repo, "/git/ref/tags/"+url.PathEscape(version))
+		if err != nil {
+			return nil, err
+		}
+		resp, err := s.ghReq(ctx, gcfg, http.MethodGet, sourcePath, nil, http.StatusOK)
+		if err != nil {
+			return nil, fmt.Errorf("resolve source tag %q: %w", version, err)
+		}
+		var ref githubRefRecord
+		if err := decodeGithubJSON(resp, "resolve source tag", &ref); err != nil {
+			resp.Body.Close()
+			return nil, err
+		}
+		resp.Body.Close()
+		expectedRef := "refs/tags/" + version
+		if ref.Ref != expectedRef || ref.Object.Type != "commit" || !validGithubSourceSHA(ref.Object.SHA) || len(ref.Object.SHA) > githubSourceRefLimit {
+			return nil, &GithubContractError{Operation: "resolve source tag", Cause: fmt.Errorf("tag %q did not resolve to an immutable source SHA", version)}
+		}
+		entry := AvailableVersion{VersionIdentity: VersionIdentity{
+			Repo:           gcfg.Repo,
+			DisplayVersion: version,
+			BuildRef:       ref.Object.SHA,
+			SourceTag:      version,
+			WorkflowRef:    workflowIdentity.Ref,
+			WorkflowSHA:    workflowIdentity.SHA,
+			AssetsRelease:  AssetsRelease{ID: release.ID, TagName: release.TagName, Name: release.Name, Assets: assets},
+		}}
+		if err := entry.VersionIdentity.validate(); err != nil {
+			return nil, &GithubContractError{Operation: "resolve version identity", Cause: err}
+		}
+		entries = append(entries, entry)
+	}
+	sort.Slice(entries, func(i, j int) bool {
+		return compareSemver(entries[i].DisplayVersion, entries[j].DisplayVersion) > 0
+	})
+	return entries, nil
+}
diff --git a/api/service/version_catalog_test.go b/api/service/version_catalog_test.go
new file mode 100644
index 0000000..b3a9eba
--- /dev/null
+++ b/api/service/version_catalog_test.go
@@ -0,0 +1,297 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"rustdesk-server/api/model"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestValidateGithubRepoStrictOwnerNameAllowlist(t *testing.T) {
+	cases := []struct {
+		name  string
+		repo  string
+		valid bool
+	}{
+		{name: "normal", repo: "owner/repo", valid: true},
+		{name: "allowed punctuation", repo: "Owner.Name/repo_name-1", valid: true},
+		{name: "dot in name", repo: "a-b/c.d", valid: true},
+		{name: "empty", repo: "", valid: false},
+		{name: "missing owner", repo: "/repo", valid: false},
+		{name: "missing name", repo: "owner/", valid: false},
+		{name: "missing slash", repo: "owner", valid: false},
+		{name: "multiple slash", repo: "owner/repo/extra", valid: false},
+		{name: "empty segment", repo: "owner//repo", valid: false},
+		{name: "query", repo: "owner/repo?ref=main", valid: false},
+		{name: "fragment", repo: "owner/repo#fragment", valid: false},
+		{name: "encoded slash", repo: "owner/repo%2Fother", valid: false},
+		{name: "space in owner", repo: "owner name/repo", valid: false},
+		{name: "space in name", repo: "owner/repo name", valid: false},
+		{name: "unicode", repo: "владелец/repo", valid: false},
+		{name: "dot owner segment", repo: "./repo", valid: false},
+		{name: "dot name segment", repo: "owner/.", valid: false},
+		{name: "parent owner segment", repo: "../repo", valid: false},
+		{name: "parent name segment", repo: "owner/..", valid: false},
+		{name: "dot only", repo: ".", valid: false},
+		{name: "parent only", repo: "..", valid: false},
+		{name: "backslash", repo: `owner\\repo`, valid: false},
+		{name: "semicolon", repo: "owner/repo;param", valid: false},
+		{name: "colon", repo: "owner/repo:tag", valid: false},
+		{name: "control character", repo: "owner/repo\n", valid: false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateGithubRepo(tc.repo)
+			if (err == nil) != tc.valid {
+				t.Fatalf("validateGithubRepo(%q) error = %v, valid = %v", tc.repo, err, tc.valid)
+			}
+		})
+	}
+}
+
+func TestVersionCatalogFollowsPaginationAndResolvesConfiguredRepo(t *testing.T) {
+	newVersionCatalogDB(t, "owner/repo-a")
+	sha := strings.Repeat("a", 40)
+	var pathsMu sync.Mutex
+	var paths []string
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		pathsMu.Lock()
+		paths = append(paths, req.URL.RequestURI())
+		pathsMu.Unlock()
+		switch {
+		case req.URL.Path == "/repos/owner/repo-a/git/ref/heads/rustqs/workflows":
+			return githubResponse(http.StatusOK, `{"ref":"refs/heads/rustqs/workflows","object":{"sha":"`+sha+`","type":"commit"}}`, nil), nil
+		case req.URL.Path == "/repos/owner/repo-a/releases" && req.URL.Query().Get("page") == "":
+			return githubResponse(http.StatusOK, `[{"id":7,"tag_name":"offline-assets-1.4.7"},{"id":8,"tag_name":"not-an-assets-release"}]`, http.Header{
+				"Link": []string{`<https://api.github.com/repos/owner/repo-a/releases?per_page=100&page=2>; rel="next"`},
+			}), nil
+		case req.URL.Path == "/repos/owner/repo-a/releases" && req.URL.Query().Get("page") == "2":
+			return githubResponse(http.StatusOK, `[{"id":9,"tag_name":"offline-assets-1.4.8"},{"id":10,"tag_name":"offline-assets-not-semver"}]`, nil), nil
+		case req.URL.Path == "/repos/owner/repo-a/releases/7":
+			return githubResponse(http.StatusOK, testReleaseDetails(7, "offline-assets-1.4.7"), nil), nil
+		case req.URL.Path == "/repos/owner/repo-a/releases/9":
+			return githubResponse(http.StatusOK, testReleaseDetails(9, "offline-assets-1.4.8"), nil), nil
+		case strings.HasPrefix(req.URL.Path, "/repos/owner/repo-a/git/ref/tags/"):
+			version := strings.TrimPrefix(req.URL.Path, "/repos/owner/repo-a/git/ref/tags/")
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/`+version+`","object":{"sha":"`+sha+`","type":"commit"}}`, nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	entries, err := (&GithubBuildConfigService{}).GetAvailableVersions(context.Background())
+	if err != nil {
+		t.Fatalf("GetAvailableVersions() error = %v", err)
+	}
+	if len(entries) != 2 || entries[0].DisplayVersion != "1.4.8" || entries[1].DisplayVersion != "1.4.7" {
+		t.Fatalf("catalog entries = %#v, want semver-descending 1.4.8 and 1.4.7", entries)
+	}
+	identity, err := (&GithubBuildConfigService{}).ResolveVersion(context.Background(), "1.4.8")
+	if err != nil {
+		t.Fatalf("ResolveVersion() error = %v", err)
+	}
+	if identity.Repo != "owner/repo-a" || identity.BuildRef != sha || identity.SourceTag != "1.4.8" || identity.WorkflowRef != defaultWorkflowExecutionRef || identity.WorkflowSHA != sha || identity.AssetsRelease.ID != 9 || len(identity.AssetsRelease.Assets) != len(requiredOfflineAssetNames) {
+		t.Fatalf("resolved identity = %#v", identity)
+	}
+	pathsMu.Lock()
+	defer pathsMu.Unlock()
+	for _, path := range paths {
+		if !strings.Contains(path, "/repos/owner/repo-a/") {
+			t.Errorf("catalog request escaped configured repo: %q", path)
+		}
+	}
+}
+
+func TestVersionCatalogCacheInvalidatesWhenConfiguredRepoChanges(t *testing.T) {
+	db := newVersionCatalogDB(t, "owner/repo-a")
+	sha := strings.Repeat("b", 40)
+	var releaseRequests int32
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasSuffix(req.URL.Path, "/git/ref/heads/rustqs/workflows") {
+			return githubResponse(http.StatusOK, `{"ref":"refs/heads/rustqs/workflows","object":{"sha":"`+sha+`","type":"commit"}}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/releases") {
+			atomic.AddInt32(&releaseRequests, 1)
+			return githubResponse(http.StatusOK, `[{"id":1,"tag_name":"offline-assets-1.4.8"}]`, nil), nil
+		}
+		if req.URL.Path == "/repos/owner/repo-a/releases/1" || req.URL.Path == "/repos/owner/repo-b/releases/1" {
+			return githubResponse(http.StatusOK, testReleaseDetails(1, "offline-assets-1.4.8"), nil), nil
+		}
+		if strings.HasPrefix(req.URL.Path, "/repos/owner/repo-a/git/ref/tags/") || strings.HasPrefix(req.URL.Path, "/repos/owner/repo-b/git/ref/tags/") {
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.4.8","object":{"sha":"`+sha+`","type":"commit"}}`, nil), nil
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+	}))
+
+	if _, err := (&GithubBuildConfigService{}).GetAvailableVersions(context.Background()); err != nil {
+		t.Fatalf("first catalog call: %v", err)
+	}
+	if err := db.Model(&model.GithubBuildConfig{}).Where("id = ?", 1).Update("repo", "owner/repo-b").Error; err != nil {
+		t.Fatalf("mutate configured repo: %v", err)
+	}
+	entries, err := (&GithubBuildConfigService{}).GetAvailableVersions(context.Background())
+	if err != nil {
+		t.Fatalf("catalog call after repo mutation: %v", err)
+	}
+	if len(entries) != 1 || entries[0].Repo != "owner/repo-b" {
+		t.Fatalf("catalog after repo mutation = %#v", entries)
+	}
+	if got := atomic.LoadInt32(&releaseRequests); got != 2 {
+		t.Fatalf("release requests = %d, want one request per configured repo", got)
+	}
+}
+
+func TestVersionCatalogFailsClosedForMissingOrMismatchedSourceTag(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		body string
+		code int
+	}{
+		{name: "missing source tag", code: http.StatusNotFound, body: `{"message":"missing"}`},
+		{name: "mismatched source ref", code: http.StatusOK, body: `{"ref":"refs/tags/1.4.7","object":{"sha":"` + strings.Repeat("c", 40) + `","type":"commit"}}`},
+		{name: "non-commit source object", code: http.StatusOK, body: `{"ref":"refs/tags/1.4.8","object":{"sha":"` + strings.Repeat("c", 40) + `","type":"tag"}}`},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			newVersionCatalogDB(t, "owner/repo")
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if strings.HasSuffix(req.URL.Path, "/releases") {
+					return githubResponse(http.StatusOK, `[{"id":1,"tag_name":"offline-assets-1.4.8"}]`, nil), nil
+				}
+				if req.URL.Path == "/repos/owner/repo/releases/1" {
+					return githubResponse(http.StatusOK, testReleaseDetails(1, "offline-assets-1.4.8"), nil), nil
+				}
+				return githubResponse(test.code, test.body, nil), nil
+			}))
+			_, err := (&GithubBuildConfigService{}).GetAvailableVersions(context.Background())
+			if err == nil {
+				t.Fatal("GetAvailableVersions() error = nil, want fail-closed catalog error")
+			}
+			var apiErr *GithubAPIError
+			if test.code == http.StatusNotFound && !errors.As(err, &apiErr) {
+				t.Fatalf("missing source error = %T %v, want wrapped GithubAPIError", err, err)
+			}
+		})
+	}
+}
+
+func TestVersionCatalogRequiresExactReleaseAssetIdentityAndDigest(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		mutateBody func(string) string
+	}{
+		{name: "missing asset", mutateBody: func(body string) string {
+			return strings.Replace(body, `{"id":104,"name":"printer_driver_adapter.zip","digest":"sha256:`+strings.Repeat("4", 64)+`"}`, "", 1)
+		}},
+		{name: "missing digest", mutateBody: func(body string) string {
+			return strings.Replace(body, "sha256:"+strings.Repeat("1", 64), "", 1)
+		}},
+		{name: "provider supplied non-sha256 digest", mutateBody: func(body string) string {
+			return strings.Replace(body, "sha256:"+strings.Repeat("1", 64), "md5:"+strings.Repeat("1", 32), 1)
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			newVersionCatalogDB(t, "owner/repo")
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				switch req.URL.Path {
+				case "/repos/owner/repo/releases":
+					return githubResponse(http.StatusOK, `[{"id":1,"tag_name":"offline-assets-1.4.8"}]`, nil), nil
+				case "/repos/owner/repo/releases/1":
+					return githubResponse(http.StatusOK, test.mutateBody(testReleaseDetails(1, "offline-assets-1.4.8")), nil), nil
+				case "/repos/owner/repo/git/ref/tags/1.4.8":
+					return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.4.8","object":{"sha":"`+strings.Repeat("a", 40)+`","type":"commit"}}`, nil), nil
+				default:
+					return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+				}
+			}))
+			if _, err := (&GithubBuildConfigService{}).GetAvailableVersions(context.Background()); err == nil {
+				t.Fatal("GetAvailableVersions() error = nil, want release asset rejection")
+			}
+		})
+	}
+}
+
+func TestVersionCatalogConcurrentCallsShareOneRefresh(t *testing.T) {
+	newVersionCatalogDB(t, "owner/repo")
+	sha := strings.Repeat("d", 40)
+	var releases, refs int32
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch {
+		case strings.HasSuffix(req.URL.Path, "/git/ref/heads/rustqs/workflows"):
+			return githubResponse(http.StatusOK, `{"ref":"refs/heads/rustqs/workflows","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"commit"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/releases"):
+			atomic.AddInt32(&releases, 1)
+			time.Sleep(20 * time.Millisecond)
+			return githubResponse(http.StatusOK, `[{"id":1,"tag_name":"offline-assets-1.4.8"}]`, nil), nil
+		case strings.Contains(req.URL.Path, "/git/ref/tags/"):
+			atomic.AddInt32(&refs, 1)
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.4.8","object":{"sha":"`+sha+`","type":"commit"}}`, nil), nil
+		case req.URL.Path == "/repos/owner/repo/releases/1":
+			return githubResponse(http.StatusOK, testReleaseDetails(1, "offline-assets-1.4.8"), nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	const callers = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, callers)
+	for i := 0; i < callers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			entries, err := (&GithubBuildConfigService{}).GetAvailableVersions(context.Background())
+			if err == nil && len(entries) != 1 {
+				err = errors.New("unexpected catalog length")
+			}
+			errs <- err
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatalf("concurrent catalog call: %v", err)
+		}
+	}
+	if atomic.LoadInt32(&releases) != 1 || atomic.LoadInt32(&refs) != 1 {
+		t.Fatalf("refresh requests = releases:%d refs:%d, want one each", releases, refs)
+	}
+}
+
+func newVersionCatalogDB(t *testing.T, repo string) *gorm.DB {
+	t.Helper()
+	t.Setenv("SECRET_ENCRYPTION_KEY", "focused-test-at-rest-key")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(&model.GithubBuildConfig{}); err != nil {
+		t.Fatalf("migrate GitHub config: %v", err)
+	}
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: repo}).Error; err != nil {
+		t.Fatalf("create GitHub config: %v", err)
+	}
+	previousDB := DB
+	DB = db
+	resetVersionCatalogCache()
+	t.Cleanup(func() {
+		resetVersionCatalogCache()
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	return db
+}
diff --git a/api/service/workflow_mapping.go b/api/service/workflow_mapping.go
new file mode 100644
index 0000000..5111837
--- /dev/null
+++ b/api/service/workflow_mapping.go
@@ -0,0 +1,2045 @@
+package service
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+	"time"
+
+	"rustdesk-server/api/config"
+	"rustdesk-server/api/global"
+	"rustdesk-server/api/model"
+)
+
+const (
+	windowsWorkflowFilename = "rustqs-windows.yml"
+	linuxWorkflowFilename   = "rustqs-linux.yml"
+	androidWorkflowFilename = "rustqs-android.yml"
+	// This is retained only for read-only catalog/version health compatibility.
+	// Production approval and dispatch never accept this mutable branch.
+	defaultWorkflowExecutionRef = "rustqs/workflows"
+)
+
+// normalizeKnownWorkflowExecutionRef translates only representations that were
+// used by DeskForge before the workflow selector became application-owned. It
+// deliberately leaves unknown values untouched so workflowExecutionRef can
+// reject them rather than silently expanding repository/workflow ownership.
+func normalizeKnownWorkflowExecutionRef(ref string) string {
+	ref = strings.TrimSpace(ref)
+	switch ref {
+	case "", defaultWorkflowExecutionRef, "refs/heads/" + defaultWorkflowExecutionRef,
+		"master", "refs/heads/master":
+		return defaultWorkflowExecutionRef
+	default:
+		return ref
+	}
+}
+
+func normalizePersistedWorkflowExecutionRef(config *model.GithubBuildConfig) {
+	if config == nil {
+		return
+	}
+	config.Branch = normalizeKnownWorkflowExecutionRef(config.Branch)
+}
+
+func workflowExecutionRef(config *model.GithubBuildConfig) (string, error) {
+	if config == nil {
+		return "", errors.New("GitHub build config is missing")
+	}
+	ref := normalizeKnownWorkflowExecutionRef(config.Branch)
+	if ref == "" {
+		ref = defaultWorkflowExecutionRef
+	}
+	if !validGithubWorkflowRef(ref) || (ref != defaultWorkflowExecutionRef && !strings.HasPrefix(ref, "refs/tags/")) {
+		return "", fmt.Errorf("configured workflow execution ref %q is invalid", ref)
+	}
+	return ref, nil
+}
+
+// WorkflowRefApprovalError means the operator attestation required before a
+// workflow-backed build is persisted or dispatched is missing or invalid.
+// Reason is internal and must not be returned directly by HTTP controllers.
+type WorkflowRefApprovalError struct {
+	Reason string
+}
+
+func (e *WorkflowRefApprovalError) Error() string {
+	if e == nil || e.Reason == "" {
+		return "workflow reference approval is required"
+	}
+	return "workflow reference approval is required: " + e.Reason
+}
+
+// approvedWorkflowRef validates the deliberately closed operator approval
+// domain. Only a provider-derived fully-qualified tag selector is acceptable;
+// the legacy default branch is intentionally excluded from production policy.
+func approvedWorkflowRef(selector string) (string, error) {
+	selector = strings.TrimSpace(selector)
+	if !strings.HasPrefix(selector, "refs/tags/") || validGithubSourceSHA(selector) || !validGithubWorkflowRef(selector) {
+		return "", &WorkflowRefApprovalError{Reason: "selector is outside the approved workflow reference domain"}
+	}
+	if validGithubSourceSHA(strings.TrimPrefix(selector, "refs/tags/")) {
+		return "", &WorkflowRefApprovalError{Reason: "raw SHA selectors are not approved"}
+	}
+	return selector, nil
+}
+
+// RequireWorkflowRefApproval is the shared deployment gate for provider-backed
+// builds. It validates the current selector as well as the persisted approval
+// bit, so malformed or changed compatibility values fail closed.
+func (s *GithubBuildConfigService) RequireWorkflowRefApproval(config *model.GithubBuildConfig) error {
+	ref, err := workflowExecutionRef(config)
+	if err != nil {
+		return &WorkflowRefApprovalError{Reason: "configured selector is invalid"}
+	}
+	if config == nil || !config.WorkflowRefApproved || !config.WorkflowRefProviderVerified || !validGithubSourceSHA(config.WorkflowRefApprovalSHA) {
+		return &WorkflowRefApprovalError{Reason: fmt.Sprintf("selector %q has not been approved", ref)}
+	}
+	if _, err := approvedWorkflowRef(ref); err != nil {
+		return err
+	}
+	return nil
+}
+
+// WorkflowTagOption is the safe admin-facing representation of a provider
+// candidate. The tag label is the only value a client may select; refs, SHAs,
+// verification objects, and credentials remain inside the provider boundary.
+type WorkflowTagOption struct {
+	Tag   string `json:"tag"`
+	Label string `json:"label"`
+}
+
+func workflowTagLabel(value string) (string, error) {
+	value = strings.TrimSpace(value)
+	if strings.HasPrefix(value, "refs/tags/") {
+		return "", &WorkflowRefApprovalError{Reason: "workflow tag must be selected by its provider-derived label"}
+	}
+	selector := "refs/tags/" + value
+	if value == "" || !validGithubWorkflowRef(selector) || validGithubSourceSHA(value) {
+		return "", &WorkflowRefApprovalError{Reason: "workflow tag is outside the provider-derived domain"}
+	}
+	return value, nil
+}
+
+// ApproveWorkflowTag resolves and verifies a provider-derived annotated tag,
+// confirms the current owned workflow is ready at that exact commit, and then
+// writes selector, SHA, and approval metadata in one repo-scoped update.
+func (s *GithubBuildConfigService) ApproveWorkflowTag(tag string) (*model.GithubBuildConfig, error) {
+	config, err := s.Get()
+	if err != nil {
+		return nil, err
+	}
+	if err := validateGithubRepo(config.Repo); err != nil {
+		return nil, &WorkflowRefApprovalError{Reason: "configured repository is invalid"}
+	}
+	tag, err = workflowTagLabel(tag)
+	if err != nil {
+		return nil, err
+	}
+	ref := "refs/tags/" + tag
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	policyConfig := *config
+	policyConfig.Branch = ref
+	execution, err := s.validateWorkflowRefPolicy(ctx, &policyConfig)
+	if err != nil {
+		return nil, fmt.Errorf("validate workflow reference policy: %w", err)
+	}
+	workflow, err := WorkflowFilenameForPlatform(string(PlatformWindows))
+	if err != nil {
+		return nil, err
+	}
+	if err := s.verifyWorkflowAvailable(ctx, &policyConfig, workflow, execution.SHA); err != nil {
+		return nil, fmt.Errorf("validate workflow readiness: %w", err)
+	}
+	if err := updateGithubBuildConfigMetadata(config.Id, config.Repo, map[string]any{
+		"branch":                         ref,
+		"workflow_ref_approved":          true,
+		"workflow_ref_provider_verified": true,
+		"workflow_ref_approval_sha":      execution.SHA,
+	}); err != nil {
+		return nil, err
+	}
+	config.Branch = ref
+	config.WorkflowRefApproved = true
+	config.WorkflowRefProviderVerified = true
+	config.WorkflowRefApprovalSHA = execution.SHA
+	return config, nil
+}
+
+// ApproveWorkflowRef is retained as an internal compatibility wrapper for
+// callers that already hold the full provider selector. HTTP clients use the
+// label-only ApproveWorkflowTag contract instead.
+func (s *GithubBuildConfigService) ApproveWorkflowRef(selector string) (*model.GithubBuildConfig, error) {
+	if !strings.HasPrefix(strings.TrimSpace(selector), "refs/tags/") {
+		return nil, &WorkflowRefApprovalError{Reason: "only provider-derived tag selectors may be approved"}
+	}
+	return s.ApproveWorkflowTag(strings.TrimPrefix(strings.TrimSpace(selector), "refs/tags/"))
+}
+
+func workflowDispatchRef(ref string) string {
+	ref = strings.TrimPrefix(ref, "refs/heads/")
+	return strings.TrimPrefix(ref, "refs/tags/")
+}
+
+// WorkflowExecutionIdentity is the two-part identity needed by GitHub: Ref
+// selects the workflow definition for dispatch, while SHA pins the commit that
+// the resulting run must execute.
+type WorkflowExecutionIdentity struct {
+	Ref                string
+	SHA                string
+	VerificationReason string
+	TrustStatus        string
+}
+
+type githubTagObjectRecord struct {
+	SHA    string `json:"sha"`
+	Object struct {
+		SHA  string `json:"sha"`
+		Type string `json:"type"`
+	} `json:"object"`
+	Verification struct {
+		Verified bool   `json:"verified"`
+		Reason   string `json:"reason"`
+	} `json:"verification"`
+}
+
+type githubRulesetBypassActor struct {
+	ActorID    *int64 `json:"actor_id"`
+	ActorType  string `json:"actor_type"`
+	BypassMode string `json:"bypass_mode"`
+}
+
+func (a *githubRulesetBypassActor) UnmarshalJSON(data []byte) error {
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	var raw struct {
+		ActorID    json.RawMessage `json:"actor_id"`
+		ActorType  string          `json:"actor_type"`
+		BypassMode string          `json:"bypass_mode"`
+	}
+	if err := decoder.Decode(&raw); err != nil {
+		return err
+	}
+	if raw.ActorID == nil {
+		return errors.New("ruleset bypass actor is missing actor_id")
+	}
+	if string(raw.ActorID) != "null" {
+		var actorID int64
+		if err := json.Unmarshal(raw.ActorID, &actorID); err != nil {
+			return fmt.Errorf("decode actor_id: %w", err)
+		}
+		a.ActorID = &actorID
+	} else {
+		a.ActorID = nil
+	}
+	if raw.ActorType == "" {
+		return errors.New("ruleset bypass actor is missing actor_type")
+	}
+	switch raw.ActorType {
+	case "Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey", "User":
+	default:
+		return fmt.Errorf("unsupported ruleset bypass actor type %q", raw.ActorType)
+	}
+	switch raw.BypassMode {
+	case "always", "pull_request", "exempt":
+	default:
+		return fmt.Errorf("unsupported ruleset bypass mode %q", raw.BypassMode)
+	}
+	a.ActorType = raw.ActorType
+	a.BypassMode = raw.BypassMode
+	return nil
+}
+
+type githubRulesetRefNameCondition struct {
+	Include []string `json:"include"`
+	Exclude []string `json:"exclude"`
+}
+
+func decodeStrictGithubRulesetCondition(data []byte, conditionName string) ([]string, []string, error) {
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	var raw struct {
+		Include json.RawMessage `json:"include"`
+		Exclude json.RawMessage `json:"exclude"`
+	}
+	if err := decoder.Decode(&raw); err != nil {
+		return nil, nil, err
+	}
+	decodePatterns := func(data json.RawMessage, field string) ([]string, error) {
+		if len(data) == 0 {
+			return nil, nil
+		}
+		if string(data) == "null" {
+			return nil, fmt.Errorf("%s.%s must be an array", conditionName, field)
+		}
+		var patterns []string
+		if err := json.Unmarshal(data, &patterns); err != nil {
+			return nil, fmt.Errorf("decode %s.%s: %w", conditionName, field, err)
+		}
+		return patterns, nil
+	}
+	include, err := decodePatterns(raw.Include, "include")
+	if err != nil {
+		return nil, nil, err
+	}
+	exclude, err := decodePatterns(raw.Exclude, "exclude")
+	if err != nil {
+		return nil, nil, err
+	}
+	return include, exclude, nil
+}
+
+func (c *githubRulesetRefNameCondition) UnmarshalJSON(data []byte) error {
+	include, exclude, err := decodeStrictGithubRulesetCondition(data, "ref_name")
+	if err != nil {
+		return err
+	}
+	c.Include = include
+	c.Exclude = exclude
+	return nil
+}
+
+type githubRulesetRuleParameters struct {
+	Name     string `json:"name"`
+	Negate   bool   `json:"negate"`
+	Operator string `json:"operator"`
+	Pattern  string `json:"pattern"`
+}
+
+type githubRulesetConditions struct {
+	RefName *githubRulesetRefNameCondition `json:"ref_name"`
+}
+
+func (c *githubRulesetConditions) UnmarshalJSON(data []byte) error {
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	var raw struct {
+		RefName json.RawMessage `json:"ref_name"`
+	}
+	if err := decoder.Decode(&raw); err != nil {
+		return err
+	}
+	c.RefName = nil
+	if len(raw.RefName) != 0 {
+		if string(raw.RefName) == "null" {
+			return errors.New("conditions.ref_name must be an object")
+		}
+		var refName githubRulesetRefNameCondition
+		if err := json.Unmarshal(raw.RefName, &refName); err != nil {
+			return fmt.Errorf("decode conditions.ref_name: %w", err)
+		}
+		c.RefName = &refName
+	}
+	return nil
+}
+
+type githubRulesetRule struct {
+	Type                      string                       `json:"type"`
+	Parameters                *githubRulesetRuleParameters `json:"parameters"`
+	ParametersPresent         bool                         `json:"-"`
+	UpdateAllowsFetchAndMerge *bool                        `json:"-"`
+}
+
+type githubRulesetUpdateParameters struct {
+	UpdateAllowsFetchAndMerge *bool `json:"update_allows_fetch_and_merge"`
+}
+
+type githubRulesetRequiredDeploymentsParameters struct {
+	RequiredDeploymentEnvironments *[]string `json:"required_deployment_environments"`
+}
+
+type githubRulesetWorkflowParameter struct {
+	Path         *string `json:"path"`
+	Ref          *string `json:"ref"`
+	RepositoryID *int64  `json:"repository_id"`
+	SHA          *string `json:"sha"`
+}
+
+type githubRulesetWorkflowsParameters struct {
+	DoNotEnforceOnCreate *bool                             `json:"do_not_enforce_on_create"`
+	Workflows            *[]githubRulesetWorkflowParameter `json:"workflows"`
+}
+
+type githubRulesetStatusCheck struct {
+	Context       *string `json:"context"`
+	IntegrationID *int64  `json:"integration_id"`
+}
+
+type githubRulesetRequiredStatusChecksParameters struct {
+	DoNotEnforceOnCreate             *bool                       `json:"do_not_enforce_on_create"`
+	RequiredStatusChecks             *[]githubRulesetStatusCheck `json:"required_status_checks"`
+	StrictRequiredStatusChecksPolicy *bool                       `json:"strict_required_status_checks_policy"`
+}
+
+type githubRulesetDismissalActor struct {
+	ID   *int64  `json:"id"`
+	Type *string `json:"type"`
+}
+
+type githubRulesetDismissalRestriction struct {
+	AllowedActors *[]githubRulesetDismissalActor `json:"allowed_actors"`
+	Enabled       *bool                          `json:"enabled"`
+}
+
+type githubRulesetRequiredReviewer struct {
+	FilePatterns     *[]string `json:"file_patterns"`
+	MinimumApprovals *int      `json:"minimum_approvals"`
+	Reviewer         *struct {
+		ID   *int64  `json:"id"`
+		Type *string `json:"type"`
+	} `json:"reviewer"`
+}
+
+type githubRulesetPullRequestParameters struct {
+	AllowedMergeMethods            *[]string                          `json:"allowed_merge_methods"`
+	DismissStaleReviewsOnPush      *bool                              `json:"dismiss_stale_reviews_on_push"`
+	DismissalRestriction           *githubRulesetDismissalRestriction `json:"dismissal_restriction"`
+	RequireCodeOwnerReview         *bool                              `json:"require_code_owner_review"`
+	RequireLastPushApproval        *bool                              `json:"require_last_push_approval"`
+	RequiredApprovingReviewCount   *int                               `json:"required_approving_review_count"`
+	RequiredReviewThreadResolution *bool                              `json:"required_review_thread_resolution"`
+	RequiredReviewers              *[]githubRulesetRequiredReviewer   `json:"required_reviewers"`
+}
+
+type githubRulesetMergeQueueParameters struct {
+	CheckResponseTimeoutMinutes  *int    `json:"check_response_timeout_minutes"`
+	GroupingStrategy             *string `json:"grouping_strategy"`
+	MaxEntriesToBuild            *int    `json:"max_entries_to_build"`
+	MaxEntriesToMerge            *int    `json:"max_entries_to_merge"`
+	MergeMethod                  *string `json:"merge_method"`
+	MinEntriesToMerge            *int    `json:"min_entries_to_merge"`
+	MinEntriesToMergeWaitMinutes *int    `json:"min_entries_to_merge_wait_minutes"`
+}
+
+type githubRulesetCopilotCodeReviewParameters struct {
+	ReviewDraftPullRequests *bool `json:"review_draft_pull_requests"`
+	ReviewOnPush            *bool `json:"review_on_push"`
+}
+
+type githubRulesetCodeScanningTool struct {
+	AlertsThreshold         *string `json:"alerts_threshold"`
+	SecurityAlertsThreshold *string `json:"security_alerts_threshold"`
+	Tool                    *string `json:"tool"`
+}
+
+type githubRulesetCodeScanningParameters struct {
+	CodeScanningTools *[]githubRulesetCodeScanningTool `json:"code_scanning_tools"`
+}
+
+type githubRulesetFilePathRestrictionParameters struct {
+	RestrictedFilePaths *[]string `json:"restricted_file_paths"`
+}
+
+type githubRulesetMaxFilePathLengthParameters struct {
+	MaxFilePathLength *int `json:"max_file_path_length"`
+}
+
+type githubRulesetFileExtensionRestrictionParameters struct {
+	RestrictedFileExtensions *[]string `json:"restricted_file_extensions"`
+}
+
+type githubRulesetMaxFileSizeParameters struct {
+	MaxFileSize *int `json:"max_file_size"`
+}
+
+func decodeStrictGithubRulesetParameters(data json.RawMessage, ruleType string, target any) error {
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		return fmt.Errorf("decode %s parameters: %w", ruleType, err)
+	}
+	return nil
+}
+
+func validateNonEmptyStrings(values []string, field string) error {
+	if len(values) == 0 {
+		return fmt.Errorf("%s must not be empty", field)
+	}
+	for _, value := range values {
+		if strings.TrimSpace(value) == "" {
+			return fmt.Errorf("%s contains an empty value", field)
+		}
+	}
+	return nil
+}
+
+func validateGithubRulesetParameters(ruleType string, data json.RawMessage) error {
+	switch ruleType {
+	case "required_deployments":
+		var parameters githubRulesetRequiredDeploymentsParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.RequiredDeploymentEnvironments == nil {
+			return errors.New("required_deployment_environments is required")
+		}
+		return validateNonEmptyStrings(*parameters.RequiredDeploymentEnvironments, "required_deployment_environments")
+	case "pull_request":
+		var parameters githubRulesetPullRequestParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.DismissStaleReviewsOnPush == nil || parameters.RequireCodeOwnerReview == nil || parameters.RequireLastPushApproval == nil || parameters.RequiredApprovingReviewCount == nil || parameters.RequiredReviewThreadResolution == nil {
+			return errors.New("pull_request parameters are missing a required field")
+		}
+		if parameters.AllowedMergeMethods != nil {
+			if err := validateNonEmptyStrings(*parameters.AllowedMergeMethods, "allowed_merge_methods"); err != nil {
+				return err
+			}
+			for _, method := range *parameters.AllowedMergeMethods {
+				switch method {
+				case "merge", "squash", "rebase":
+				default:
+					return fmt.Errorf("unsupported allowed merge method %q", method)
+				}
+			}
+		}
+		if restriction := parameters.DismissalRestriction; restriction != nil {
+			if restriction.Enabled == nil || restriction.AllowedActors == nil {
+				return errors.New("dismissal_restriction is missing a required field")
+			}
+			for _, actor := range *restriction.AllowedActors {
+				if actor.ID == nil || *actor.ID <= 0 || actor.Type == nil {
+					return errors.New("dismissal_restriction contains an invalid allowed actor")
+				}
+				switch *actor.Type {
+				case "User", "Team", "IntegrationInstallation", "RepositoryRole":
+				default:
+					return fmt.Errorf("unsupported dismissal actor type %q", *actor.Type)
+				}
+			}
+		}
+		if reviewers := parameters.RequiredReviewers; reviewers != nil {
+			for _, reviewer := range *reviewers {
+				if reviewer.FilePatterns == nil || reviewer.MinimumApprovals == nil || reviewer.Reviewer == nil || reviewer.Reviewer.ID == nil || reviewer.Reviewer.Type == nil {
+					return errors.New("required_reviewers contains a missing required field")
+				}
+				if err := validateNonEmptyStrings(*reviewer.FilePatterns, "required reviewer file_patterns"); err != nil {
+					return err
+				}
+				if *reviewer.Reviewer.ID <= 0 || *reviewer.Reviewer.Type != "Team" {
+					return errors.New("required_reviewers contains an invalid reviewer")
+				}
+			}
+		}
+	case "required_status_checks":
+		var parameters githubRulesetRequiredStatusChecksParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.RequiredStatusChecks == nil || parameters.StrictRequiredStatusChecksPolicy == nil {
+			return errors.New("required_status_checks parameters are missing a required field")
+		}
+		if len(*parameters.RequiredStatusChecks) == 0 {
+			return errors.New("required_status_checks must not be empty")
+		}
+		for _, check := range *parameters.RequiredStatusChecks {
+			if check.Context == nil || strings.TrimSpace(*check.Context) == "" {
+				return errors.New("required_status_checks contains an empty context")
+			}
+		}
+	case "workflows":
+		var parameters githubRulesetWorkflowsParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.Workflows == nil || len(*parameters.Workflows) == 0 {
+			return errors.New("workflows must not be empty")
+		}
+		for _, workflow := range *parameters.Workflows {
+			if workflow.Path == nil || strings.TrimSpace(*workflow.Path) == "" || workflow.RepositoryID == nil || *workflow.RepositoryID <= 0 {
+				return errors.New("workflows contains a missing required field")
+			}
+		}
+	case "merge_queue":
+		var parameters githubRulesetMergeQueueParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.CheckResponseTimeoutMinutes == nil || parameters.GroupingStrategy == nil || parameters.MaxEntriesToBuild == nil || parameters.MaxEntriesToMerge == nil || parameters.MergeMethod == nil || parameters.MinEntriesToMerge == nil || parameters.MinEntriesToMergeWaitMinutes == nil {
+			return errors.New("merge_queue parameters are missing a required field")
+		}
+		switch *parameters.GroupingStrategy {
+		case "ALLGREEN", "HEADGREEN":
+		default:
+			return fmt.Errorf("unsupported merge queue grouping strategy %q", *parameters.GroupingStrategy)
+		}
+		switch *parameters.MergeMethod {
+		case "MERGE", "SQUASH", "REBASE":
+		default:
+			return fmt.Errorf("unsupported merge queue merge method %q", *parameters.MergeMethod)
+		}
+	case "copilot_code_review":
+		var parameters githubRulesetCopilotCodeReviewParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.ReviewDraftPullRequests == nil && parameters.ReviewOnPush == nil {
+			return errors.New("copilot_code_review parameters must not be empty")
+		}
+	case "code_scanning":
+		var parameters githubRulesetCodeScanningParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.CodeScanningTools == nil || len(*parameters.CodeScanningTools) == 0 {
+			return errors.New("code_scanning_tools must not be empty")
+		}
+		for _, tool := range *parameters.CodeScanningTools {
+			if tool.AlertsThreshold == nil || tool.SecurityAlertsThreshold == nil || tool.Tool == nil || strings.TrimSpace(*tool.Tool) == "" {
+				return errors.New("code_scanning_tools contains a missing required field")
+			}
+			switch *tool.AlertsThreshold {
+			case "none", "errors", "errors_and_warnings", "all":
+			default:
+				return fmt.Errorf("unsupported code scanning alerts threshold %q", *tool.AlertsThreshold)
+			}
+			switch *tool.SecurityAlertsThreshold {
+			case "none", "critical", "high_or_higher", "medium_or_higher", "all":
+			default:
+				return fmt.Errorf("unsupported code scanning security alerts threshold %q", *tool.SecurityAlertsThreshold)
+			}
+		}
+	case "file_path_restriction":
+		var parameters githubRulesetFilePathRestrictionParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.RestrictedFilePaths == nil {
+			return errors.New("restricted_file_paths is required")
+		}
+		return validateNonEmptyStrings(*parameters.RestrictedFilePaths, "restricted_file_paths")
+	case "max_file_path_length":
+		var parameters githubRulesetMaxFilePathLengthParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.MaxFilePathLength == nil {
+			return errors.New("max_file_path_length is required")
+		}
+	case "file_extension_restriction":
+		var parameters githubRulesetFileExtensionRestrictionParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.RestrictedFileExtensions == nil {
+			return errors.New("restricted_file_extensions is required")
+		}
+		return validateNonEmptyStrings(*parameters.RestrictedFileExtensions, "restricted_file_extensions")
+	case "max_file_size":
+		var parameters githubRulesetMaxFileSizeParameters
+		if err := decodeStrictGithubRulesetParameters(data, ruleType, &parameters); err != nil {
+			return err
+		}
+		if parameters.MaxFileSize == nil {
+			return errors.New("max_file_size is required")
+		}
+	default:
+		return fmt.Errorf("unsupported parameterized ruleset rule type %q", ruleType)
+	}
+	return nil
+}
+
+func (r *githubRulesetRule) UnmarshalJSON(data []byte) error {
+	var raw struct {
+		Type       string          `json:"type"`
+		Parameters json.RawMessage `json:"parameters"`
+	}
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&raw); err != nil {
+		return err
+	}
+	r.Type = raw.Type
+	if !githubRulesetRuleTypeAllowed(r.Type) {
+		return fmt.Errorf("unsupported or missing ruleset rule type %q", r.Type)
+	}
+	r.Parameters = nil
+	r.UpdateAllowsFetchAndMerge = nil
+	r.ParametersPresent = len(raw.Parameters) != 0
+	if r.ParametersPresent && string(raw.Parameters) == "null" {
+		return errors.New("ruleset rule parameters cannot be null")
+	}
+	if !r.ParametersPresent {
+		if r.Type == "tag_name_pattern" || rulesetRuleRequiresParameters(r.Type) {
+			return fmt.Errorf("ruleset rule %q requires parameters", r.Type)
+		}
+		return nil
+	}
+	var parameters githubRulesetRuleParameters
+	parametersDecoder := json.NewDecoder(strings.NewReader(string(raw.Parameters)))
+	parametersDecoder.DisallowUnknownFields()
+	switch raw.Type {
+	case "tag_name_pattern", "branch_name_pattern", "commit_author_email_pattern", "commit_message_pattern", "committer_email_pattern":
+		if err := parametersDecoder.Decode(&parameters); err != nil {
+			return fmt.Errorf("decode %s parameters: %w", raw.Type, err)
+		}
+		if !validGithubTagNamePattern(parameters.Operator, parameters.Pattern) {
+			return fmt.Errorf("%s parameters contain an unsupported operator or pattern", raw.Type)
+		}
+	case "update":
+		var updateParameters githubRulesetUpdateParameters
+		if err := parametersDecoder.Decode(&updateParameters); err != nil {
+			return fmt.Errorf("decode update parameters: %w", err)
+		}
+		if updateParameters.UpdateAllowsFetchAndMerge == nil {
+			return errors.New("decode update parameters: update_allows_fetch_and_merge is required")
+		}
+		r.UpdateAllowsFetchAndMerge = updateParameters.UpdateAllowsFetchAndMerge
+	case "creation", "deletion", "required_linear_history", "required_signatures", "non_fast_forward", "license_compliance_scanning":
+		return fmt.Errorf("ruleset rule %q does not accept parameters", raw.Type)
+	default:
+		if err := validateGithubRulesetParameters(raw.Type, raw.Parameters); err != nil {
+			return fmt.Errorf("decode %s parameters: %w", raw.Type, err)
+		}
+	}
+	r.Parameters = &parameters
+	return nil
+}
+
+// githubRulesetRuleTypeAllowed is intentionally explicit. Ruleset evaluation
+// must reject a provider rule added outside this reviewed domain rather than
+// silently treating it as irrelevant to tag protection.
+func githubRulesetRuleTypeAllowed(ruleType string) bool {
+	switch ruleType {
+	case "creation", "update", "deletion", "required_linear_history", "merge_queue",
+		"required_deployments", "required_signatures", "pull_request", "required_status_checks",
+		"non_fast_forward", "workflows", "copilot_code_review", "code_scanning",
+		"commit_author_email_pattern", "commit_message_pattern", "committer_email_pattern",
+		"branch_name_pattern", "tag_name_pattern", "license_compliance_scanning",
+		"file_path_restriction", "max_file_path_length", "file_extension_restriction", "max_file_size":
+		return true
+	default:
+		return false
+	}
+}
+
+func rulesetRuleRequiresParameters(ruleType string) bool {
+	switch ruleType {
+	case "required_deployments", "pull_request", "required_status_checks", "workflows",
+		"merge_queue", "copilot_code_review", "code_scanning", "file_path_restriction",
+		"max_file_path_length", "file_extension_restriction", "max_file_size",
+		"commit_author_email_pattern", "commit_message_pattern", "committer_email_pattern",
+		"branch_name_pattern":
+		return true
+	default:
+		return false
+	}
+}
+
+type githubRepositoryRulesetRecord struct {
+	ID                   int64                       `json:"id"`
+	Target               string                      `json:"target"`
+	Enforcement          string                      `json:"enforcement"`
+	SourceType           string                      `json:"source_type"`
+	Source               string                      `json:"source"`
+	BypassActors         *[]githubRulesetBypassActor `json:"bypass_actors"`
+	CurrentUserCanBypass *string                     `json:"current_user_can_bypass"`
+	Conditions           *githubRulesetConditions    `json:"conditions"`
+	Rules                []githubRulesetRule         `json:"rules"`
+}
+
+type githubRulesetSummary struct {
+	ID int64 `json:"id"`
+}
+
+type githubRepositoryRulesetDetail struct {
+	ID                   *int64          `json:"id"`
+	Name                 *string         `json:"name"`
+	Target               *string         `json:"target"`
+	Enforcement          *string         `json:"enforcement"`
+	SourceType           *string         `json:"source_type"`
+	Source               *string         `json:"source"`
+	CreatedAt            json.RawMessage `json:"created_at"`
+	UpdatedAt            json.RawMessage `json:"updated_at"`
+	BypassActors         json.RawMessage `json:"bypass_actors"`
+	CurrentUserCanBypass json.RawMessage `json:"current_user_can_bypass"`
+	Conditions           json.RawMessage `json:"conditions"`
+	Rules                json.RawMessage `json:"rules"`
+}
+
+func validateOptionalGithubRulesetTimestamp(data json.RawMessage, field string) error {
+	if len(data) == 0 {
+		return nil
+	}
+	if string(data) == "null" {
+		return fmt.Errorf("ruleset detail %s must be a date-time string", field)
+	}
+	var timestamp time.Time
+	if err := json.Unmarshal(data, &timestamp); err != nil {
+		return fmt.Errorf("decode ruleset detail %s: %w", field, err)
+	}
+	return nil
+}
+
+const (
+	maxRulesetRecords             = 256
+	maxRulesetRules               = 64
+	maxRulesetPages               = 3
+	githubTrustStatusProvider     = "provider-reported"
+	githubVerificationReasonValid = "valid"
+)
+
+// githubTagPatternMatches implements the small glob domain GitHub exposes for
+// ruleset tag patterns. A pattern may be returned as a tag label or as a
+// fully-qualified refs/tags selector; neither form is treated as a raw manual
+// selector outside the provider boundary.
+func githubTagPatternMatches(pattern, tag string) bool {
+	if pattern == "" {
+		return false
+	}
+	if pattern == "~ALL" {
+		return true
+	}
+	if pattern == "~DEFAULT_BRANCH" {
+		return false
+	}
+	candidate := tag
+	if strings.HasPrefix(pattern, "refs/tags/") {
+		candidate = "refs/tags/" + tag
+	}
+	return githubTagGlobMatches(pattern, candidate)
+}
+
+func githubRulesetTagPatternMatches(pattern, tag string) bool {
+	return githubTagPatternMatches(pattern, tag)
+}
+
+type githubTagGlobRange struct {
+	first rune
+	last  rune
+}
+
+type githubTagGlobToken struct {
+	kind          byte
+	literal       rune
+	ranges        []githubTagGlobRange
+	globstar      bool
+	globstarSlash bool
+}
+
+const (
+	githubTagGlobLiteral byte = iota
+	githubTagGlobStar
+	githubTagGlobQuestion
+	githubTagGlobClass
+)
+
+func readGithubTagGlobClassRune(pattern []rune, index int) (rune, int, bool) {
+	if index >= len(pattern) {
+		return 0, index, false
+	}
+	if pattern[index] == '\\' {
+		return 0, index, false
+	}
+	return pattern[index], index + 1, true
+}
+
+// parseGithubTagGlobClass parses one positive fnmatch character class. GitHub
+// protection patterns do not need complement classes here; rejecting them and
+// any class that could match '/' keeps pathname matching fail-closed.
+func parseGithubTagGlobClass(pattern []rune, start int) (githubTagGlobToken, int, bool) {
+	if start >= len(pattern) || pattern[start] != '[' {
+		return githubTagGlobToken{}, start, false
+	}
+	index := start + 1
+	if index >= len(pattern) || pattern[index] == '^' || pattern[index] == '!' {
+		return githubTagGlobToken{}, start, false
+	}
+	ranges := make([]githubTagGlobRange, 0, 1)
+	for {
+		if index >= len(pattern) {
+			return githubTagGlobToken{}, start, false
+		}
+		if pattern[index] == ']' {
+			if len(ranges) == 0 {
+				return githubTagGlobToken{}, start, false
+			}
+			return githubTagGlobToken{kind: githubTagGlobClass, ranges: ranges}, index + 1, true
+		}
+		if pattern[index] == '[' {
+			return githubTagGlobToken{}, start, false
+		}
+		first, next, ok := readGithubTagGlobClassRune(pattern, index)
+		if !ok || first == '/' {
+			return githubTagGlobToken{}, start, false
+		}
+		index = next
+		// A leading hyphen is literal in a positive fnmatch class. Do not
+		// parse a range when the first member is '-', so [-a] denotes '-'
+		// or 'a' rather than a range beginning at '-'.
+		if first != '-' && index < len(pattern) && pattern[index] == '-' && index+1 < len(pattern) && pattern[index+1] != ']' {
+			last, rangeEnd, rangeOK := readGithubTagGlobClassRune(pattern, index+1)
+			if !rangeOK || last == '/' || first > last || (first <= '/' && '/' <= last) {
+				return githubTagGlobToken{}, start, false
+			}
+			ranges = append(ranges, githubTagGlobRange{first: first, last: last})
+			index = rangeEnd
+			continue
+		}
+		ranges = append(ranges, githubTagGlobRange{first: first, last: first})
+	}
+}
+
+func parseGithubTagGlob(pattern string) ([]githubTagGlobToken, bool) {
+	// GitHub ruleset fnmatch does not support backslash quoting. Reject it
+	// before parsing classes as well, so no parser path can reinterpret it as
+	// an escape and produce a false-positive protection match.
+	if strings.ContainsRune(pattern, '\\') {
+		return nil, false
+	}
+	patternRunes := []rune(pattern)
+	tokens := make([]githubTagGlobToken, 0, len(patternRunes))
+	for index := 0; index < len(patternRunes); {
+		switch patternRunes[index] {
+		case '[':
+			token, next, ok := parseGithubTagGlobClass(patternRunes, index)
+			if !ok {
+				return nil, false
+			}
+			tokens = append(tokens, token)
+			index = next
+		case ']':
+			return nil, false
+		case '{', '}':
+			// Brace expansion is not part of the supported GitHub pattern subset.
+			return nil, false
+		case '*':
+			end := index
+			for end < len(patternRunes) && patternRunes[end] == '*' {
+				end++
+			}
+			isGlobstar := end-index >= 2
+			tokens = append(tokens, githubTagGlobToken{
+				kind:          githubTagGlobStar,
+				globstar:      isGlobstar,
+				globstarSlash: isGlobstar && end < len(patternRunes) && patternRunes[end] == '/',
+			})
+			index = end
+		case '?':
+			tokens = append(tokens, githubTagGlobToken{kind: githubTagGlobQuestion})
+			index++
+		default:
+			tokens = append(tokens, githubTagGlobToken{kind: githubTagGlobLiteral, literal: patternRunes[index]})
+			index++
+		}
+	}
+	return tokens, true
+}
+
+func githubTagGlobClassMatches(ranges []githubTagGlobRange, value rune) bool {
+	if value == '/' {
+		return false
+	}
+	for _, classRange := range ranges {
+		if classRange.first <= value && value <= classRange.last {
+			return true
+		}
+	}
+	return false
+}
+
+func githubTagGlobMatches(pattern, value string) bool {
+	tokens, valid := parseGithubTagGlob(pattern)
+	if !valid {
+		return false
+	}
+	valueRunes := []rune(value)
+	cache := make(map[[2]int]bool)
+	seen := make(map[[2]int]bool)
+	var match func(int, int) bool
+	match = func(patternIndex, valueIndex int) bool {
+		key := [2]int{patternIndex, valueIndex}
+		if seen[key] {
+			return cache[key]
+		}
+		seen[key] = true
+		matched := false
+		switch {
+		case patternIndex == len(tokens):
+			matched = valueIndex == len(valueRunes)
+		case tokens[patternIndex].kind == githubTagGlobStar:
+			starEnd := patternIndex + 1
+			if tokens[patternIndex].globstarSlash {
+				// GitHub's FNM_PATHNAME-compatible `**/` matches zero or more
+				// complete directory components. The slash belongs to this
+				// construct, so `release/**/*` also matches `release/v1`.
+				if starEnd < len(tokens) && tokens[starEnd].kind == githubTagGlobLiteral && tokens[starEnd].literal == '/' {
+					matched = match(starEnd+1, valueIndex)
+					for index := valueIndex; !matched && index < len(valueRunes); index++ {
+						if valueRunes[index] == '/' {
+							matched = match(starEnd+1, index+1)
+						}
+					}
+				}
+			} else if tokens[patternIndex].globstar {
+				matched = match(starEnd, valueIndex)
+				if !matched && valueIndex < len(valueRunes) {
+					matched = match(patternIndex, valueIndex+1)
+				}
+			} else {
+				matched = match(starEnd, valueIndex)
+				if !matched && valueIndex < len(valueRunes) && valueRunes[valueIndex] != '/' {
+					matched = match(patternIndex, valueIndex+1)
+				}
+			}
+		case tokens[patternIndex].kind == githubTagGlobQuestion:
+			matched = valueIndex < len(valueRunes) && valueRunes[valueIndex] != '/' && match(patternIndex+1, valueIndex+1)
+		case tokens[patternIndex].kind == githubTagGlobClass:
+			matched = valueIndex < len(valueRunes) && githubTagGlobClassMatches(tokens[patternIndex].ranges, valueRunes[valueIndex]) && match(patternIndex+1, valueIndex+1)
+		default:
+			matched = valueIndex < len(valueRunes) && tokens[patternIndex].literal == valueRunes[valueIndex] && match(patternIndex+1, valueIndex+1)
+		}
+		cache[key] = matched
+		return matched
+	}
+	return match(0, 0)
+}
+
+func githubTagNamePatternMatches(operator, pattern, tag string) bool {
+	if !validGithubTagNamePattern(operator, pattern) {
+		return false
+	}
+	switch operator {
+	case "starts_with":
+		return strings.HasPrefix(tag, pattern)
+	case "ends_with":
+		return strings.HasSuffix(tag, pattern)
+	case "contains":
+		return strings.Contains(tag, pattern)
+	case "regex":
+		re, _ := regexp.Compile(pattern)
+		return re.MatchString(tag)
+	default:
+		return false
+	}
+}
+
+func validGithubTagNamePattern(operator, pattern string) bool {
+	if pattern == "" {
+		return false
+	}
+	switch operator {
+	case "starts_with":
+	case "ends_with":
+	case "contains":
+	case "regex":
+		re, err := regexp.Compile(pattern)
+		return err == nil && re != nil
+	default:
+		return false
+	}
+	return true
+}
+
+func validGithubTagVerification(record githubTagObjectRecord) bool {
+	return record.Verification.Verified && strings.EqualFold(strings.TrimSpace(record.Verification.Reason), githubVerificationReasonValid)
+}
+
+// verifyWorkflowTagSelectorUnambiguous ensures GitHub's short workflow_dispatch
+// selector cannot resolve to a branch with the same label as the verified tag.
+// A missing heads ref is the expected no-collision result; all other provider
+// failures and malformed successful responses fail closed at the policy boundary.
+func (s *GithubBuildConfigService) verifyWorkflowTagSelectorUnambiguous(ctx context.Context, config *model.GithubBuildConfig, tag string) error {
+	path, err := githubRepoPath(config.Repo, "/git/ref/heads/"+url.PathEscape(tag))
+	if err != nil {
+		return err
+	}
+	resp, err := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+	if err != nil {
+		var apiErr *GithubAPIError
+		if errors.As(err, &apiErr) && apiErr.StatusCode == http.StatusNotFound {
+			return nil
+		}
+		return fmt.Errorf("verify workflow tag selector collision: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var record githubRefRecord
+	if err := decodeGithubJSON(resp, "verify workflow tag selector collision", &record); err != nil {
+		return err
+	}
+	expectedRef := "refs/heads/" + tag
+	if record.Ref != expectedRef || record.Object.Type != "commit" || !validGithubSourceSHA(record.Object.SHA) {
+		return &GithubContractError{
+			Operation: "verify workflow tag selector collision",
+			Cause:     errors.New("provider returned an invalid branch ref response"),
+		}
+	}
+	return &WorkflowRefApprovalError{Reason: "workflow tag selector collides with a branch of the same label"}
+}
+
+func rulesetRefNameMatches(condition *githubRulesetRefNameCondition, tag string) bool {
+	if condition == nil || len(condition.Include) == 0 {
+		return false
+	}
+	for _, pattern := range condition.Exclude {
+		if githubRulesetTagPatternMatches(pattern, tag) {
+			return false
+		}
+	}
+	for _, pattern := range condition.Include {
+		if githubRulesetTagPatternMatches(pattern, tag) {
+			return true
+		}
+	}
+	return false
+}
+
+type githubRulesetProtection struct {
+	hasUpdateRule   bool
+	hasDeletionRule bool
+}
+
+func validateGithubRulesetBypassActors(actors []githubRulesetBypassActor) error {
+	for _, actor := range actors {
+		switch actor.ActorType {
+		case "Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey", "User":
+		default:
+			return fmt.Errorf("unsupported ruleset bypass actor type %q", actor.ActorType)
+		}
+		switch actor.ActorType {
+		case "Integration", "RepositoryRole", "Team", "User":
+			if actor.ActorID == nil || *actor.ActorID <= 0 {
+				return errors.New("ruleset bypass actor has no positive actor_id")
+			}
+		case "DeployKey", "OrganizationAdmin":
+			if actor.ActorID != nil && *actor.ActorID <= 0 {
+				return errors.New("ruleset bypass actor has an invalid actor_id")
+			}
+		}
+		switch actor.BypassMode {
+		case "always", "exempt":
+		case "pull_request":
+			return errors.New("pull_request bypass mode is not valid for tag rulesets")
+		default:
+			return fmt.Errorf("unsupported ruleset bypass mode %q", actor.BypassMode)
+		}
+	}
+	return nil
+}
+
+func validateGithubRulesetBypassPolicy(ruleset githubRepositoryRulesetRecord) error {
+	if ruleset.BypassActors == nil || ruleset.CurrentUserCanBypass == nil {
+		return errors.New("ruleset bypass metadata is missing or not visible")
+	}
+	if err := validateGithubRulesetBypassActors(*ruleset.BypassActors); err != nil {
+		return err
+	}
+	switch *ruleset.CurrentUserCanBypass {
+	case "never":
+	case "always", "pull_requests_only", "exempt":
+		return &WorkflowRefApprovalError{Reason: "workflow tag matches an active repository ruleset with bypass permission"}
+	default:
+		return fmt.Errorf("unsupported current_user_can_bypass value %q", *ruleset.CurrentUserCanBypass)
+	}
+	if len(*ruleset.BypassActors) != 0 {
+		return &WorkflowRefApprovalError{Reason: "workflow tag matches an active repository ruleset with bypass actors"}
+	}
+	return nil
+}
+
+func evaluateRulesetTagProtection(ruleset githubRepositoryRulesetRecord, tag string) (githubRulesetProtection, error) {
+	if ruleset.Conditions == nil || !rulesetRefNameMatches(ruleset.Conditions.RefName, tag) {
+		return githubRulesetProtection{}, nil
+	}
+	if err := validateGithubRulesetRules(ruleset.Target, ruleset.Rules); err != nil {
+		return githubRulesetProtection{}, err
+	}
+	if err := validateGithubRulesetBypassPolicy(ruleset); err != nil {
+		return githubRulesetProtection{}, err
+	}
+	if len(ruleset.Rules) > maxRulesetRules {
+		return githubRulesetProtection{}, errors.New("provider returned too many ruleset rules")
+	}
+	protection := githubRulesetProtection{}
+	for _, rule := range ruleset.Rules {
+		switch rule.Type {
+		case "tag_name_pattern":
+			// Parse documented metadata, but do not use its semantics as a
+			// protection selector. Ref protection comes from conditions.ref_name
+			// plus update/deletion.
+		case "creation", "required_linear_history", "merge_queue", "required_deployments",
+			"required_signatures", "pull_request", "required_status_checks", "non_fast_forward",
+			"workflows", "copilot_code_review", "code_scanning", "license_compliance_scanning",
+			"file_path_restriction", "max_file_path_length", "file_extension_restriction", "max_file_size",
+			"commit_author_email_pattern", "commit_message_pattern", "committer_email_pattern", "branch_name_pattern":
+			// These known rules do not weaken tag immutability. Their parameters
+			// are validated by the ruleset decoder but are not part of this
+			// protection decision.
+		case "update":
+			if protection.hasUpdateRule || (rule.ParametersPresent && !validGithubUpdateRuleParameters(rule)) {
+				return githubRulesetProtection{}, errors.New("ruleset update rule is duplicated or malformed")
+			}
+			protection.hasUpdateRule = true
+		case "deletion":
+			if protection.hasDeletionRule || rule.ParametersPresent {
+				return githubRulesetProtection{}, errors.New("ruleset deletion rule is duplicated or malformed")
+			}
+			protection.hasDeletionRule = true
+		default:
+			// The JSON decoder rejects unknown rule types. This branch is kept
+			// fail-closed if the in-memory representation is constructed directly.
+			return githubRulesetProtection{}, fmt.Errorf("unsupported or missing ruleset rule type %q", rule.Type)
+		}
+	}
+	return protection, nil
+}
+
+func validGithubUpdateRuleParameters(rule githubRulesetRule) bool {
+	return rule.ParametersPresent && rule.Parameters != nil && rule.UpdateAllowsFetchAndMerge != nil
+}
+
+func validateGithubRulesetRules(target string, rules []githubRulesetRule) error {
+	for _, rule := range rules {
+		if rule.Type != "update" {
+			continue
+		}
+		if !rule.ParametersPresent {
+			if target != "tag" {
+				return errors.New("branch ruleset update rule requires parameters")
+			}
+			continue
+		}
+		if !validGithubUpdateRuleParameters(rule) {
+			return errors.New("ruleset update rule parameters are malformed")
+		}
+	}
+	return nil
+}
+
+func activeRulesetTargetsWorkflowTag(ruleset githubRepositoryRulesetRecord, tag string) bool {
+	if ruleset.ID <= 0 || ruleset.Target != "tag" || ruleset.Enforcement != "active" || ruleset.Conditions == nil || !rulesetRefNameMatches(ruleset.Conditions.RefName, tag) {
+		return false
+	}
+	return true
+}
+
+func fetchRulesetDetail(ctx context.Context, s *GithubBuildConfigService, config *model.GithubBuildConfig, summary githubRulesetSummary, tag string) (githubRepositoryRulesetRecord, error) {
+	if summary.ID <= 0 {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset summary has no positive id")}
+	}
+	path, err := githubRepoPath(config.Repo, fmt.Sprintf("/rulesets/%d?includes_parents=true", summary.ID))
+	if err != nil {
+		return githubRepositoryRulesetRecord{}, err
+	}
+	resp, err := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+	if err != nil {
+		return githubRepositoryRulesetRecord{}, fmt.Errorf("verify repository ruleset detail: %w", err)
+	}
+	defer resp.Body.Close()
+	var rawDetail githubRepositoryRulesetDetail
+	if err := decodeGithubJSON(resp, "verify repository ruleset detail", &rawDetail); err != nil {
+		return githubRepositoryRulesetRecord{}, err
+	}
+	if rawDetail.ID == nil || *rawDetail.ID != summary.ID {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset detail id does not match summary")}
+	}
+	if *rawDetail.ID <= 0 || rawDetail.Name == nil || strings.TrimSpace(*rawDetail.Name) == "" || rawDetail.Source == nil || strings.TrimSpace(*rawDetail.Source) == "" || rawDetail.SourceType == nil {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset detail is missing required metadata")}
+	}
+	switch *rawDetail.SourceType {
+	case "Repository", "Organization", "Enterprise":
+	default:
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: fmt.Errorf("ruleset detail has an invalid source_type %q", *rawDetail.SourceType)}
+	}
+	if err := validateOptionalGithubRulesetTimestamp(rawDetail.CreatedAt, "created_at"); err != nil {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: err}
+	}
+	if err := validateOptionalGithubRulesetTimestamp(rawDetail.UpdatedAt, "updated_at"); err != nil {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: err}
+	}
+	if rawDetail.Target == nil || *rawDetail.Target != "tag" {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset detail has an invalid target")}
+	}
+	if rawDetail.Enforcement == nil {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset detail has an invalid enforcement")}
+	}
+	switch *rawDetail.Enforcement {
+	case "active", "evaluate", "disabled":
+	default:
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset detail has an invalid enforcement")}
+	}
+	detail := githubRepositoryRulesetRecord{
+		ID:          *rawDetail.ID,
+		Target:      *rawDetail.Target,
+		Enforcement: *rawDetail.Enforcement,
+		SourceType:  *rawDetail.SourceType,
+		Source:      *rawDetail.Source,
+	}
+	if string(rawDetail.Conditions) == "null" {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset conditions must be an object")}
+	}
+	if len(rawDetail.Conditions) != 0 {
+		var conditions githubRulesetConditions
+		if err := json.Unmarshal(rawDetail.Conditions, &conditions); err != nil {
+			return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: fmt.Errorf("decode conditions: %w", err)}
+		}
+		detail.Conditions = &conditions
+	}
+	if detail.Target == "tag" {
+		if err := validateGithubTagRulesetConditions(detail.Conditions); err != nil {
+			return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: err}
+		}
+	}
+	if detail.Target != "tag" || detail.Enforcement != "active" {
+		return detail, nil
+	}
+	if !activeRulesetTargetsWorkflowTag(detail, tag) {
+		return detail, nil
+	}
+	if len(rawDetail.BypassActors) != 0 && string(rawDetail.BypassActors) != "null" {
+		var actors []githubRulesetBypassActor
+		if err := json.Unmarshal(rawDetail.BypassActors, &actors); err != nil {
+			return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: fmt.Errorf("decode bypass_actors: %w", err)}
+		}
+		detail.BypassActors = &actors
+	}
+	if len(rawDetail.CurrentUserCanBypass) != 0 && string(rawDetail.CurrentUserCanBypass) != "null" {
+		var currentUserCanBypass string
+		if err := json.Unmarshal(rawDetail.CurrentUserCanBypass, &currentUserCanBypass); err != nil {
+			return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: fmt.Errorf("decode current_user_can_bypass: %w", err)}
+		}
+		detail.CurrentUserCanBypass = &currentUserCanBypass
+	}
+	if len(rawDetail.Rules) == 0 {
+		return detail, nil
+	}
+	if string(rawDetail.Rules) == "null" {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: errors.New("ruleset rules cannot be null")}
+	}
+	if err := json.Unmarshal(rawDetail.Rules, &detail.Rules); err != nil {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: fmt.Errorf("decode rules: %w", err)}
+	}
+	if err := validateGithubRulesetRules(detail.Target, detail.Rules); err != nil {
+		return githubRepositoryRulesetRecord{}, &GithubContractError{Operation: "verify repository ruleset detail", Cause: err}
+	}
+	return detail, nil
+}
+
+func validateGithubTagRulesetConditions(conditions *githubRulesetConditions) error {
+	if conditions == nil || conditions.RefName == nil {
+		return errors.New("tag ruleset conditions must include ref_name")
+	}
+	return nil
+}
+
+func inheritedRulesetPagePath(path string) (string, error) {
+	u, err := url.Parse(path)
+	if err != nil || u.Path == "" {
+		return "", errors.New("invalid GitHub ruleset pagination path")
+	}
+	query := u.Query()
+	query.Set("targets", "tag")
+	query.Set("includes_parents", "true")
+	u.RawQuery = query.Encode()
+	return u.EscapedPath() + "?" + u.RawQuery, nil
+}
+
+// verifyModernProtectedWorkflowTag inspects repository rulesets, including
+// inherited parent rulesets. Missing, unsupported, forbidden, or ambiguous
+// ruleset metadata is never treated as proof of protection. An explicitly empty
+// bypass list is required because any bypass actor could bypass protection for
+// the configured workflow selector; exact workflow path/SHA readiness remains
+// enforced separately by verifyWorkflowAvailable.
+func (s *GithubBuildConfigService) verifyModernProtectedWorkflowTag(ctx context.Context, config *model.GithubBuildConfig, tag string) error {
+	path, err := githubRepoPath(config.Repo, "/rulesets?targets=tag&includes_parents=true&per_page=100&page=1")
+	if err != nil {
+		return err
+	}
+	rulesetCount := 0
+	foundApplicableRuleset := false
+	var effectiveProtection githubRulesetProtection
+	var evaluationErr error
+	for page := 0; page < maxRulesetPages; page++ {
+		resp, requestErr := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+		if requestErr != nil {
+			return fmt.Errorf("verify repository rulesets: %w", requestErr)
+		}
+		var summaries []githubRulesetSummary
+		decodeErr := decodeGithubJSON(resp, "verify repository rulesets", &summaries)
+		next, hasNext, linkErr := nextGithubLink(resp.Header.Get("Link"))
+		resp.Body.Close()
+		if decodeErr != nil {
+			return decodeErr
+		}
+		if linkErr != nil {
+			return &GithubContractError{Operation: "verify repository rulesets", Cause: linkErr}
+		}
+		rulesetCount += len(summaries)
+		if rulesetCount > maxRulesetRecords {
+			return &GithubContractError{Operation: "verify repository rulesets", Cause: errors.New("provider returned too many repository rulesets")}
+		}
+		for _, summary := range summaries {
+			ruleset, detailErr := fetchRulesetDetail(ctx, s, config, summary, tag)
+			if detailErr != nil {
+				if evaluationErr == nil {
+					evaluationErr = detailErr
+				}
+				continue
+			}
+			if !activeRulesetTargetsWorkflowTag(ruleset, tag) {
+				continue
+			}
+			foundApplicableRuleset = true
+			protection, err := evaluateRulesetTagProtection(ruleset, tag)
+			if err != nil {
+				if evaluationErr == nil {
+					evaluationErr = err
+				}
+				continue
+			}
+			effectiveProtection.hasUpdateRule = effectiveProtection.hasUpdateRule || protection.hasUpdateRule
+			effectiveProtection.hasDeletionRule = effectiveProtection.hasDeletionRule || protection.hasDeletionRule
+		}
+		if !hasNext {
+			break
+		}
+		if page == maxRulesetPages-1 {
+			return &GithubContractError{Operation: "verify repository rulesets", Cause: fmt.Errorf("pagination exceeds %d pages", maxRulesetPages)}
+		}
+		path, err = inheritedRulesetPagePath(next)
+		if err != nil {
+			return &GithubContractError{Operation: "verify repository rulesets", Cause: err}
+		}
+	}
+	if evaluationErr != nil {
+		var approvalErr *WorkflowRefApprovalError
+		if errors.As(evaluationErr, &approvalErr) {
+			return evaluationErr
+		}
+		return &GithubContractError{Operation: "verify repository ruleset detail", Cause: evaluationErr}
+	}
+	if foundApplicableRuleset && effectiveProtection.hasUpdateRule && effectiveProtection.hasDeletionRule {
+		return nil
+	}
+	if rulesetCount == 0 {
+		return &GithubContractError{Operation: "verify repository rulesets", Cause: errors.New("provider returned no repository rulesets")}
+	}
+	return &WorkflowRefApprovalError{Reason: "workflow tag is not covered by an active immutable repository ruleset without bypass actors"}
+}
+
+// verifyProtectedWorkflowTag delegates to the supported modern ruleset surface.
+// Modern rulesets (requested with includes_parents=true) aggregate effective
+// update and deletion rules across every applicable active tag ruleset, while
+// every applicable ruleset must expose an empty bypass list and current-user
+// value of never. Permission/provider failures and malformed successful
+// responses fail closed; no bypass actor is accepted.
+func (s *GithubBuildConfigService) verifyProtectedWorkflowTag(ctx context.Context, config *model.GithubBuildConfig, tag string) error {
+	return s.verifyModernProtectedWorkflowTag(ctx, config, tag)
+}
+
+const maxWorkflowTagPages = 3
+
+// resolveWorkflowTag resolves one provider-derived tag label and requires the
+// GitHub ref to point at an annotated tag object whose signature is verified
+// and whose nested object is exactly a commit. Lightweight tags, unverified
+// tags, malformed refs, and missing provider objects all fail closed.
+func (s *GithubBuildConfigService) resolveWorkflowTag(ctx context.Context, config *model.GithubBuildConfig, tag string, enforceSelectorPolicy bool) (WorkflowExecutionIdentity, error) {
+	tag, err := workflowTagLabel(tag)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	if config == nil {
+		return WorkflowExecutionIdentity{}, errors.New("GitHub build config is missing")
+	}
+	ref := "refs/tags/" + tag
+	path, err := githubRepoPath(config.Repo, "/git/ref/tags/"+url.PathEscape(tag))
+	if err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	resp, err := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, fmt.Errorf("resolve workflow tag: %w", err)
+	}
+	defer resp.Body.Close()
+	var record githubRefRecord
+	if err := decodeGithubJSON(resp, "resolve workflow tag", &record); err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	if record.Ref != ref || record.Object.Type != "tag" || !validGithubSourceSHA(record.Object.SHA) {
+		return WorkflowExecutionIdentity{}, &GithubContractError{
+			Operation: "resolve workflow tag",
+			Cause:     errors.New("workflow tag is missing or lightweight"),
+		}
+	}
+
+	tagPath, err := githubRepoPath(config.Repo, "/git/tags/"+url.PathEscape(record.Object.SHA))
+	if err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	tagResp, err := s.ghReq(ctx, config, http.MethodGet, tagPath, nil, http.StatusOK)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, fmt.Errorf("resolve workflow tag object: %w", err)
+	}
+	defer tagResp.Body.Close()
+	var tagRecord githubTagObjectRecord
+	if err := decodeGithubJSON(tagResp, "resolve workflow tag object", &tagRecord); err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	if tagRecord.SHA != record.Object.SHA || !validGithubTagVerification(tagRecord) || tagRecord.Object.Type != "commit" || !validGithubSourceSHA(tagRecord.Object.SHA) {
+		return WorkflowExecutionIdentity{}, &GithubContractError{
+			Operation: "resolve workflow tag object",
+			Cause:     errors.New("workflow tag is not a verified annotated commit tag with an accepted verification reason"),
+		}
+	}
+	if enforceSelectorPolicy {
+		if err := s.verifyWorkflowTagSelectorUnambiguous(ctx, config, tag); err != nil {
+			return WorkflowExecutionIdentity{}, err
+		}
+	}
+	return WorkflowExecutionIdentity{Ref: ref, SHA: tagRecord.Object.SHA, VerificationReason: githubVerificationReasonValid, TrustStatus: githubTrustStatusProvider}, nil
+}
+
+// ResolveWorkflowTag resolves a provider-derived tag for the tag-policy
+// boundary. Unlike normal catalog reads, it rejects a branch sharing the
+// workflow_dispatch short selector.
+func (s *GithubBuildConfigService) ResolveWorkflowTag(ctx context.Context, config *model.GithubBuildConfig, tag string) (WorkflowExecutionIdentity, error) {
+	return s.resolveWorkflowTag(ctx, config, tag, true)
+}
+
+// resolveWorkflowExecution resolves a workflow ref for read-only catalog
+// identity. Tag-policy collision checks are intentionally performed by the
+// approval/build boundary instead of normal catalog reads.
+func (s *GithubBuildConfigService) resolveWorkflowExecution(ctx context.Context, config *model.GithubBuildConfig) (WorkflowExecutionIdentity, error) {
+	ref, err := workflowExecutionRef(config)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	if strings.HasPrefix(ref, "refs/tags/") {
+		return s.resolveWorkflowTag(ctx, config, strings.TrimPrefix(ref, "refs/tags/"), false)
+	}
+	lookupRef := ref
+	refPrefix := "heads"
+	expectedRef := "refs/heads/" + ref
+	if strings.HasPrefix(ref, "refs/heads/") {
+		lookupRef = strings.TrimPrefix(ref, "refs/heads/")
+		expectedRef = ref
+	}
+	path, err := githubRepoPath(config.Repo, "/git/ref/"+refPrefix+"/"+lookupRef)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	resp, err := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, fmt.Errorf("resolve workflow execution ref %q: %w", ref, err)
+	}
+	defer resp.Body.Close()
+	var record githubRefRecord
+	if err := decodeGithubJSON(resp, "resolve workflow execution ref", &record); err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	if record.Ref != expectedRef || !validGithubSourceSHA(record.Object.SHA) {
+		return WorkflowExecutionIdentity{}, &GithubContractError{
+			Operation: "resolve workflow execution ref",
+			Cause:     fmt.Errorf("owned ref %q did not resolve to a valid provider object", ref),
+		}
+	}
+	if refPrefix == "heads" {
+		if record.Object.Type != "commit" {
+			return WorkflowExecutionIdentity{}, &GithubContractError{
+				Operation: "resolve workflow execution ref",
+				Cause:     fmt.Errorf("branch %q did not resolve directly to a commit SHA", ref),
+			}
+		}
+		return WorkflowExecutionIdentity{Ref: ref, SHA: record.Object.SHA}, nil
+	}
+	return WorkflowExecutionIdentity{}, &GithubContractError{Operation: "resolve workflow execution", Cause: errors.New("unsupported workflow ref type")}
+}
+
+// ListWorkflowTagOptions returns a bounded, provider-derived list of tag
+// labels that are signed annotated tags and contain the current Windows
+// workflow with an active workflow_dispatch trigger. It never returns refs,
+// SHAs, verification payloads, or credentials to the admin client.
+func (s *GithubBuildConfigService) ListWorkflowTagOptions(ctx context.Context, config *model.GithubBuildConfig) ([]WorkflowTagOption, error) {
+	if config == nil {
+		return nil, errors.New("GitHub build config is missing")
+	}
+	if err := validateGithubRepo(config.Repo); err != nil {
+		return nil, err
+	}
+	workflow, err := WorkflowFilenameForPlatform(string(PlatformWindows))
+	if err != nil {
+		return nil, err
+	}
+	path, err := githubRepoPath(config.Repo, "/git/refs/tags?per_page=100&page=1")
+	if err != nil {
+		return nil, err
+	}
+	options := make([]WorkflowTagOption, 0)
+	seen := make(map[string]struct{})
+	for page := 0; page < maxWorkflowTagPages; page++ {
+		resp, err := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+		if err != nil {
+			return nil, err
+		}
+		var refs []githubRefRecord
+		if err := decodeGithubJSON(resp, "list workflow tags", &refs); err != nil {
+			resp.Body.Close()
+			return nil, err
+		}
+		next, hasNext, err := nextGithubLink(resp.Header.Get("Link"))
+		resp.Body.Close()
+		if err != nil {
+			return nil, &GithubContractError{Operation: "list workflow tags", Cause: err}
+		}
+		for _, ref := range refs {
+			if !strings.HasPrefix(ref.Ref, "refs/tags/") || ref.Object.Type != "tag" {
+				// Lightweight tags are not candidates; they are not surfaced as
+				// selectable options and cannot be approved by label.
+				continue
+			}
+			tag := strings.TrimPrefix(ref.Ref, "refs/tags/")
+			if _, duplicate := seen[tag]; duplicate {
+				return nil, &GithubContractError{Operation: "list workflow tags", Cause: errors.New("provider returned duplicate workflow tag")}
+			}
+			if protectionErr := s.verifyProtectedWorkflowTag(ctx, config, tag); protectionErr != nil {
+				var approvalErr *WorkflowRefApprovalError
+				if errors.As(protectionErr, &approvalErr) {
+					continue
+				}
+				return nil, protectionErr
+			}
+			identity, resolveErr := s.ResolveWorkflowTag(ctx, config, tag)
+			if resolveErr != nil {
+				// A tag can be removed or have invalid signature metadata between
+				// the list and resolve calls. Such a tag is simply not selectable;
+				// provider transport/API failures remain visible and fail closed.
+				var apiErr *GithubAPIError
+				var transportErr *GithubTransportError
+				if errors.As(resolveErr, &apiErr) || errors.As(resolveErr, &transportErr) {
+					return nil, resolveErr
+				}
+				continue
+			}
+			if err := s.verifyWorkflowAvailable(ctx, config, workflow, identity.SHA); err != nil {
+				var apiErr *GithubAPIError
+				var transportErr *GithubTransportError
+				if errors.As(err, &apiErr) || errors.As(err, &transportErr) {
+					return nil, err
+				}
+				continue
+			}
+			seen[tag] = struct{}{}
+			options = append(options, WorkflowTagOption{Tag: tag, Label: tag})
+		}
+		if !hasNext {
+			break
+		}
+		if page == maxWorkflowTagPages-1 {
+			return nil, &GithubContractError{Operation: "list workflow tags", Cause: fmt.Errorf("pagination exceeds %d pages", maxWorkflowTagPages)}
+		}
+		path = next
+	}
+	return options, nil
+}
+
+func (s *GithubBuildConfigService) validateWorkflowRefPolicy(ctx context.Context, config *model.GithubBuildConfig) (WorkflowExecutionIdentity, error) {
+	ref, err := workflowExecutionRef(config)
+	if err != nil {
+		return WorkflowExecutionIdentity{}, &WorkflowRefApprovalError{Reason: "configured selector is invalid"}
+	}
+	if _, err := approvedWorkflowRef(ref); err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	if ref == defaultWorkflowExecutionRef || strings.HasPrefix(ref, "refs/heads/") {
+		return WorkflowExecutionIdentity{}, &WorkflowRefApprovalError{Reason: "mutable workflow branch selectors are not approvable"}
+	}
+	if err := s.verifyProtectedWorkflowTag(ctx, config, strings.TrimPrefix(ref, "refs/tags/")); err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	var execution WorkflowExecutionIdentity
+	if strings.HasPrefix(ref, "refs/tags/") {
+		execution, err = s.ResolveWorkflowTag(ctx, config, strings.TrimPrefix(ref, "refs/tags/"))
+	} else {
+		execution, err = s.resolveWorkflowExecution(ctx, config)
+	}
+	if err != nil {
+		return WorkflowExecutionIdentity{}, err
+	}
+	return execution, nil
+}
+
+// WorkflowFilenameForPlatform is the single application-owned workflow map.
+// The configured repository supplies the executable workflow; users never
+// select a filename.
+func WorkflowFilenameForPlatform(platform string) (string, error) {
+	switch platform {
+	case string(PlatformWindows):
+		return windowsWorkflowFilename, nil
+	case string(PlatformLinux):
+		return linuxWorkflowFilename, nil
+	case string(PlatformAndroid):
+		return androidWorkflowFilename, nil
+	default:
+		return "", fmt.Errorf("no GitHub workflow is mapped for platform %q", platform)
+	}
+}
+
+// GithubProviderConfigurationError means a build cannot be submitted through
+// the production provider path. It is intentionally raised before a build row
+// is persisted, so the API never creates a row that can only enter a dead
+// local-file queue.
+type GithubProviderConfigurationError struct {
+	Cause error
+}
+
+func (e *GithubProviderConfigurationError) Error() string {
+	return fmt.Sprintf("GitHub build provider is not ready: %v", e.Cause)
+}
+
+func (e *GithubProviderConfigurationError) Unwrap() error { return e.Cause }
+
+// ProductionCapabilityUnavailableError means the platform is valid in the
+// typed custom-build domain but its production completion path is not yet
+// validated. PR11 owns re-enabling additional platforms after evidence.
+type ProductionCapabilityUnavailableError struct {
+	Platform   string
+	Capability string
+}
+
+func (e *ProductionCapabilityUnavailableError) Error() string {
+	return fmt.Sprintf("production capability %q is unavailable for platform %q", e.Capability, e.Platform)
+}
+
+// RequireProductionBuildCapability is the single backend capability gate for
+// production build execution and completion. Linux and Android remain valid
+// enum values for typed settings/preset data, but cannot enter this provider
+// path until PR11 validates and explicitly re-enables them.
+func RequireProductionBuildCapability(platform string) error {
+	if err := ValidateCustomPlatform(platform); err != nil {
+		return err
+	}
+	if platform != string(PlatformWindows) {
+		return &ProductionCapabilityUnavailableError{
+			Platform:   platform,
+			Capability: "production build execution and completion",
+		}
+	}
+	return nil
+}
+
+// RequireConfiguredPublicKey enforces the runtime key-file/config contract at
+// the custom-build boundary. Startup remains compatible with installations
+// that intentionally have no key yet; only a build dispatch requires one.
+func RequireConfiguredPublicKey() error {
+	if err := global.Config.Rustdesk.RequirePublicKey(); err != nil {
+		return &GithubProviderConfigurationError{Cause: err}
+	}
+	return nil
+}
+
+// RequireDispatchPublicKey rejects a missing typed workflow key after normal
+// BuildSpec normalization. This keeps direct provider callers fail-closed even
+// when they are not running through the admin DispatchTest controller.
+func RequireDispatchPublicKey(params map[string]any) error {
+	value, ok := params["key"].(string)
+	if !ok {
+		return &GithubProviderConfigurationError{Cause: &config.PublicKeyConfigurationError{Reason: "public key is missing"}}
+	}
+	if err := config.ValidatePublicKeyMaterial(value); err != nil {
+		return &GithubProviderConfigurationError{Cause: err}
+	}
+	return nil
+}
+
+type githubWorkflowRecord struct {
+	State string `json:"state"`
+}
+
+type githubWorkflowFileRecord struct {
+	Type     string `json:"type"`
+	Path     string `json:"path"`
+	SHA      string `json:"sha"`
+	Content  string `json:"content"`
+	Encoding string `json:"encoding"`
+}
+
+// workflowDeclaresDispatch recognizes the GitHub Actions YAML trigger forms
+// used by the owned workflows without turning the provider boundary into a
+// general-purpose YAML interpreter. It accepts a block mapping, an inline
+// sequence, and an inline mapping under the top-level "on" key.
+func workflowDeclaresDispatch(content string) bool {
+	lines := strings.Split(strings.TrimPrefix(content, "\ufeff"), "\n")
+	for index, line := range lines {
+		line = stripWorkflowYAMLComment(line)
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || leadingWorkflowYAMLSpaces(line) != 0 {
+			continue
+		}
+		key, value, ok := splitWorkflowYAMLKey(trimmed)
+		if !ok || key != "on" {
+			continue
+		}
+		if workflowDispatchInline(value) {
+			return true
+		}
+		if strings.TrimSpace(value) != "" {
+			continue
+		}
+		childIndent := -1
+		for _, child := range lines[index+1:] {
+			child = stripWorkflowYAMLComment(child)
+			if strings.TrimSpace(child) == "" {
+				continue
+			}
+			indent := leadingWorkflowYAMLSpaces(child)
+			if indent <= 0 {
+				break
+			}
+			if childIndent < 0 {
+				childIndent = indent
+			}
+			if indent == childIndent {
+				childKey, _, childOK := splitWorkflowYAMLKey(strings.TrimSpace(child))
+				if childOK && childKey == "workflow_dispatch" {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+func leadingWorkflowYAMLSpaces(line string) int {
+	for index, char := range line {
+		if char != ' ' && char != '\t' {
+			return index
+		}
+	}
+	return len(line)
+}
+
+func splitWorkflowYAMLKey(line string) (key, value string, ok bool) {
+	colon := strings.IndexByte(line, ':')
+	if colon < 0 {
+		return "", "", false
+	}
+	key = strings.Trim(strings.TrimSpace(line[:colon]), "\"'")
+	return key, strings.TrimSpace(line[colon+1:]), key != ""
+}
+
+func workflowDispatchInline(value string) bool {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return false
+	}
+	if strings.HasPrefix(value, "[") || strings.HasPrefix(value, "{") {
+		value = strings.Trim(value, "[]{} ")
+		for _, item := range strings.Split(value, ",") {
+			item = strings.Trim(strings.TrimSpace(item), "\"'")
+			itemKey, _, hasKey := splitWorkflowYAMLKey(item)
+			if item == "workflow_dispatch" || (hasKey && itemKey == "workflow_dispatch") {
+				return true
+			}
+		}
+		return false
+	}
+	return strings.Trim(value, "\"'") == "workflow_dispatch"
+}
+
+func stripWorkflowYAMLComment(line string) string {
+	var quote rune
+	escaped := false
+	for index, char := range line {
+		if escaped {
+			escaped = false
+			continue
+		}
+		if quote != 0 && char == '\\' && quote == '"' {
+			escaped = true
+			continue
+		}
+		if char == '\'' || char == '"' {
+			if quote == 0 {
+				quote = char
+			} else if quote == char {
+				quote = 0
+			}
+			continue
+		}
+		if char == '#' && quote == 0 && (index == 0 || line[index-1] == ' ' || line[index-1] == '\t') {
+			return line[:index]
+		}
+	}
+	return line
+}
+
+// verifyWorkflowAvailable confirms that the configured repository owns the
+// fixed workflow for this build platform at the exact immutable workflow SHA.
+// GitHub's repository-contents API officially supports a commit SHA in ref;
+// the actions/workflows endpoint does not provide the same immutable-file
+// contract. The REST error is deliberately preserved so callers can distinguish
+// terminal configuration failures from retryable provider outages.
+func (s *GithubBuildConfigService) verifyWorkflowAvailable(ctx context.Context, config *model.GithubBuildConfig, workflow, workflowSHA string) error {
+	workflowSHA = strings.TrimSpace(workflowSHA)
+	if !validGithubSourceSHA(workflowSHA) {
+		return &GithubContractError{
+			Operation: "workflow readiness",
+			Cause:     errors.New("workflow readiness requires the resolved immutable workflow SHA"),
+		}
+	}
+	path, err := githubRepoPath(config.Repo, "/contents/.github/workflows/"+url.PathEscape(workflow)+"?ref="+url.QueryEscape(workflowSHA))
+	if err != nil {
+		return err
+	}
+	resp, err := s.ghReq(ctx, config, http.MethodGet, path, nil, http.StatusOK)
+	if err != nil {
+		return fmt.Errorf("workflow %q readiness request: %w", workflow, err)
+	}
+	defer resp.Body.Close()
+
+	var fileRecord githubWorkflowFileRecord
+	if err := decodeGithubJSON(resp, "workflow readiness file", &fileRecord); err != nil {
+		return fmt.Errorf("workflow %q readiness response: %w", workflow, err)
+	}
+	expectedPath := ".github/workflows/" + workflow
+	if fileRecord.Type != "file" || fileRecord.Path != expectedPath || !validGithubSourceSHA(fileRecord.SHA) {
+		return &GithubContractError{
+			Operation: "workflow readiness",
+			Cause:     fmt.Errorf("workflow %q is not a file at the resolved workflow SHA", workflow),
+		}
+	}
+	if fileRecord.Encoding != "base64" || fileRecord.Content == "" {
+		return &GithubContractError{
+			Operation: "workflow readiness",
+			Cause:     fmt.Errorf("workflow %q contents are missing or not base64 encoded", workflow),
+		}
+	}
+	encodedContent := strings.Join(strings.Fields(fileRecord.Content), "")
+	content, err := base64.StdEncoding.DecodeString(encodedContent)
+	if err != nil {
+		return &GithubContractError{Operation: "workflow readiness", Cause: fmt.Errorf("workflow %q contents are invalid base64: %w", workflow, err)}
+	}
+	if !workflowDeclaresDispatch(string(content)) {
+		return &GithubContractError{
+			Operation: "workflow readiness",
+			Cause:     fmt.Errorf("workflow %q does not declare a workflow_dispatch trigger", workflow),
+		}
+	}
+	statePath, err := githubRepoPath(config.Repo, "/actions/workflows/"+workflow)
+	if err != nil {
+		return err
+	}
+	stateResp, err := s.ghReq(ctx, config, http.MethodGet, statePath, nil, http.StatusOK)
+	if err != nil {
+		return fmt.Errorf("workflow %q state request: %w", workflow, err)
+	}
+	defer stateResp.Body.Close()
+	var stateRecord githubWorkflowRecord
+	if err := decodeGithubJSON(stateResp, "workflow readiness state", &stateRecord); err != nil {
+		return fmt.Errorf("workflow %q state response: %w", workflow, err)
+	}
+	if stateRecord.State != "active" {
+		return &GithubContractError{
+			Operation: "workflow readiness",
+			Cause:     fmt.Errorf("workflow %q is not active (state=%q)", workflow, stateRecord.State),
+		}
+	}
+	return nil
+}
+
+// GithubBuildConfigSnapshot is the validated provider configuration captured at
+// the create boundary. It is intentionally an in-memory value: credentials
+// are needed by the provider request but are never copied into a build row.
+type GithubBuildConfigSnapshot struct {
+	Repo                        string
+	Token                       string
+	PayloadKey                  string
+	WorkflowRef                 string
+	WorkflowRefApproved         bool
+	WorkflowRefProviderVerified bool
+	WorkflowRefApprovalSHA      string
+}
+
+// ProviderConfig materializes the snapshot for one provider request without
+// exposing it to persistence or API response serialization.
+func (c GithubBuildConfigSnapshot) ProviderConfig() *model.GithubBuildConfig {
+	return &model.GithubBuildConfig{
+		Repo:                        c.Repo,
+		Token:                       c.Token,
+		PayloadKey:                  c.PayloadKey,
+		Branch:                      c.WorkflowRef,
+		WorkflowRefApproved:         c.WorkflowRefApproved,
+		WorkflowRefProviderVerified: c.WorkflowRefProviderVerified,
+		WorkflowRefApprovalSHA:      c.WorkflowRefApprovalSHA,
+	}
+}
+
+// PreparedGithubBuild contains the provider configuration snapshot plus
+// immutable version identity selected from the configured repository. It is
+// created at the API create boundary and consumed by dispatch.
+type PreparedGithubBuild struct {
+	Config   GithubBuildConfigSnapshot
+	Identity VersionIdentity
+}
+
+// PrepareBuild validates all provider prerequisites before persistence: the
+// strict repository, current credentials, fixed workflow mapping, and the
+// selected version's immutable source/assets identity.
+func (s *GithubBuildConfigService) PrepareBuild(ctx context.Context, platform, displayVersion string) (PreparedGithubBuild, error) {
+	if err := RequireProductionBuildCapability(platform); err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: err}
+	}
+	workflow, err := WorkflowFilenameForPlatform(platform)
+	if err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: err}
+	}
+	gcfg, err := s.Get()
+	if err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: fmt.Errorf("load configuration: %w", err)}
+	}
+	if gcfg == nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: errors.New("configuration is missing")}
+	}
+	if err := validateGithubRepo(gcfg.Repo); err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: err}
+	}
+	if err := s.RequireWorkflowRefApproval(gcfg); err != nil {
+		return PreparedGithubBuild{}, err
+	}
+	if gcfg.Token == "" {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: errors.New("PAT is not configured")}
+	}
+	if gcfg.PayloadKey == "" {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: errors.New("payload key is not configured")}
+	}
+	execution, err := s.validateWorkflowRefPolicy(ctx, gcfg)
+	if err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: fmt.Errorf("resolve workflow execution identity: %w", err)}
+	}
+	if !strings.EqualFold(execution.SHA, gcfg.WorkflowRefApprovalSHA) {
+		return PreparedGithubBuild{}, &WorkflowRefApprovalError{Reason: "provider tag resolved to a different commit than the approved tag"}
+	}
+	if err := s.verifyWorkflowAvailable(ctx, gcfg, workflow, execution.SHA); err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{
+			Cause: fmt.Errorf("mapped workflow %q is not ready: %w", workflow, err),
+		}
+	}
+	identity, err := s.resolveVersionWithConfig(ctx, gcfg, displayVersion, execution)
+	if err != nil {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: fmt.Errorf("resolve version: %w", err)}
+	}
+	if identity.Repo != gcfg.Repo {
+		return PreparedGithubBuild{}, &GithubProviderConfigurationError{Cause: fmt.Errorf("resolved version repository %q does not match configured repo", identity.Repo)}
+	}
+	return PreparedGithubBuild{
+		Config: GithubBuildConfigSnapshot{
+			Repo:                        gcfg.Repo,
+			Token:                       gcfg.Token,
+			PayloadKey:                  gcfg.PayloadKey,
+			WorkflowRef:                 identity.WorkflowRef,
+			WorkflowRefApproved:         gcfg.WorkflowRefApproved,
+			WorkflowRefProviderVerified: gcfg.WorkflowRefProviderVerified,
+			WorkflowRefApprovalSHA:      gcfg.WorkflowRefApprovalSHA,
+		},
+		Identity: identity,
+	}, nil
+}
diff --git a/api/service/workflow_mapping_test.go b/api/service/workflow_mapping_test.go
new file mode 100644
index 0000000..0282c3f
--- /dev/null
+++ b/api/service/workflow_mapping_test.go
@@ -0,0 +1,1958 @@
+package service
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"rustdesk-server/api/model"
+	"rustdesk-server/api/utils"
+
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+const validRustDeskPublicKey = "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM="
+
+const testRulesetMetadata = `"name":"workflow-protection","source_type":"Repository","source":"owner/repo","created_at":"2026-08-01T00:00:00Z","updated_at":"2026-08-01T00:00:00Z"`
+
+func testProtectedRulesetResponse(pattern string) string {
+	pattern = strings.TrimSuffix(strings.TrimPrefix(pattern, "refs/tags/"), "*")
+	return `{"id":1,` + testRulesetMetadata + `,"target":"tag","enforcement":"active","bypass_actors":[],"current_user_can_bypass":"never","conditions":{"ref_name":{"include":["refs/tags/` + pattern + `*"],"exclude":[]}},"rules":[{"type":"tag_name_pattern","parameters":{"name":"tag_name","negate":false,"operator":"starts_with","pattern":"` + pattern + `"}},{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}]}`
+}
+
+func testPatternOnlyRulesetResponse(pattern string) string {
+	pattern = strings.TrimSuffix(strings.TrimPrefix(pattern, "refs/tags/"), "*")
+	return `{"id":1,` + testRulesetMetadata + `,"target":"tag","enforcement":"active","bypass_actors":[],"current_user_can_bypass":"never","conditions":{"ref_name":{"include":["refs/tags/` + pattern + `*"],"exclude":[]}},"rules":[{"type":"tag_name_pattern","parameters":{"name":"tag_name","negate":false,"operator":"starts_with","pattern":"` + pattern + `"}}]}`
+}
+
+func testObservedGithubDocsRulesetResponse(includeBypassActors bool) string {
+	bypassActors := ""
+	if includeBypassActors {
+		bypassActors = `,"bypass_actors":[]`
+	}
+	return `{"id":18281681,"name":"Enterprise Tags","target":"tag","source_type":"Organization","source":"github","enforcement":"active","conditions":{"ref_name":{"exclude":[],"include":["refs/tags/enterprise-[0-9].*-freeze","refs/tags/enterprise-[0-9].[0-9].[0-9]","refs/tags/enterprise-[0-9].[0-9].[0-9][0-9]","refs/tags/enterprise-[0-9].[0-9][0-9].[0-9]","refs/tags/enterprise-[0-9].[0-9][0-9].[0-9][0-9]","refs/tags/enterprise-[0-9].*.pre[0-9]","refs/tags/enterprise-[0-9].*.pre[0-9][0-9]","refs/tags/enterprise-[0-9].*.gm[0-9]","refs/tags/enterprise-[0-9].*.gm[0-9][0-9]","refs/tags/enterprise-[0-9].*.rc[0-9]","refs/tags/enterprise-[0-9].*.rc[0-9][0-9]"]}},"rules":[{"type":"deletion"},{"type":"non_fast_forward"},{"type":"creation"},{"type":"update"}],"created_at":"2026-06-30T07:19:50.340+11:00","updated_at":"2026-06-30T07:20:37.936+11:00"` + bypassActors + `,"current_user_can_bypass":"never"}`
+}
+
+func testObservedGithubDocsRulesetSummaryResponse() string {
+	return `[{"id":18281681,"target":"tag","source_type":"Organization","source":"github","enforcement":"active"}]`
+}
+
+func testRulesetResponseWithRules(id int, include string, exclude string, rules string) string {
+	excludeJSON := "[]"
+	if exclude != "" {
+		excludeJSON = `["` + exclude + `"]`
+	}
+	return fmt.Sprintf(`{"id":%d,%s,"target":"tag","enforcement":"active","bypass_actors":[],"current_user_can_bypass":"never","conditions":{"ref_name":{"include":["%s"],"exclude":%s}},"rules":[%s]}`, id, testRulesetMetadata, include, excludeJSON, rules)
+}
+
+func testRulesetSummaryResponse() string {
+	return "[" + testProtectedRulesetResponse("workflow-*") + "]"
+}
+
+func testRulesetSummaryResponseForID(id int) string {
+	return "[" + strings.Replace(testProtectedRulesetResponse("workflow-*"), `"id":1`, fmt.Sprintf(`"id":%d`, id), 1) + "]"
+}
+
+func testRulesetResponse(req *http.Request, pattern string) *http.Response {
+	if strings.Contains(req.URL.Path, "/rulesets/") {
+		id := strings.TrimPrefix(req.URL.Path, "/repos/owner/repo-a/rulesets/")
+		id = strings.TrimPrefix(id, "/repos/owner/repo/rulesets/")
+		response := testProtectedRulesetResponse(pattern)
+		if id != "" && id != req.URL.Path {
+			response = strings.Replace(response, `"id":1`, `"id":`+id, 1)
+		}
+		return githubResponse(http.StatusOK, response, nil)
+	}
+	return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil)
+}
+
+func TestWorkflowFilenameForPlatformUsesFixedApplicationMapping(t *testing.T) {
+	for _, test := range []struct {
+		platform string
+		workflow string
+	}{
+		{platform: string(PlatformWindows), workflow: "rustqs-windows.yml"},
+		{platform: string(PlatformLinux), workflow: "rustqs-linux.yml"},
+		{platform: string(PlatformAndroid), workflow: "rustqs-android.yml"},
+	} {
+		t.Run(test.platform, func(t *testing.T) {
+			got, err := WorkflowFilenameForPlatform(test.platform)
+			if err != nil || got != test.workflow {
+				t.Fatalf("WorkflowFilenameForPlatform(%q) = %q, %v; want %q", test.platform, got, err, test.workflow)
+			}
+		})
+	}
+	if _, err := WorkflowFilenameForPlatform("macos"); err == nil {
+		t.Fatal("unsupported platform returned a workflow")
+	}
+}
+
+func TestGithubTagPatternMatchingUsesRefPathSemantics(t *testing.T) {
+	for _, test := range []struct {
+		pattern string
+		value   string
+		want    bool
+	}{
+		{"workflow-*", "workflow-v1", true},
+		{"workflow-*", "workflow/team-v1", false},
+		{"workflow/**", "workflow/team/v1", true},
+		{"workflow/?", "workflow/x", true},
+		{"workflow/?", "workflow/team", false},
+		{"release/**/*", "release/v1", true},
+		{"release/**/*", "release/foo/bar", true},
+		{"release/**/*", "release", false},
+		{"**/release", "release", true},
+		{"**/release", "team/release", true},
+		{"**/release", "team/subteam/release", true},
+		{"**/release", "team/release/extra", false},
+		{"release/*", "release/v1", true},
+		{"release/*", "release/foo/bar", false},
+		{"release/?", "release/x", true},
+		{"release/?", "release/foo", false},
+		{"refs/tags/release/v1", "release/v1", true},
+		{"refs/tags/release/v1", "release/v2", false},
+		{"workflow-[abc]", "workflow-b", true},
+		{"workflow-[abc]", "workflow-d", false},
+		{"workflow-v[0-9]", "workflow-v7", true},
+		{"workflow-v[0-9]", "workflow-vx", false},
+		{"[-a]", "-", true},
+		{"[-a]", "a", true},
+		{"[-a]", "0", false},
+		{"workflow-[-a]", "workflow--", true},
+		{"workflow-[-a]", "workflow-a", true},
+		{"workflow-[-a]", "workflow-0", false},
+		{"refs/tags/release/[a-z]/**", "release/a/nested/v1", true},
+		{"refs/tags/release/[a-z]/**", "release/a/b/c", true},
+		{"refs/tags/release/[a-z]/**", "release/ab/c", false},
+		{"~ALL", "anything/nested", true},
+		{"~DEFAULT_BRANCH", "workflow-v1", false},
+	} {
+		t.Run(test.pattern+"/"+test.value, func(t *testing.T) {
+			got := githubTagPatternMatches(test.pattern, test.value)
+			if got != test.want {
+				t.Fatalf("githubTagPatternMatches(%q, %q) = %v, want %v", test.pattern, test.value, got, test.want)
+			}
+		})
+	}
+}
+
+func TestRulesetRefNameMatchesGitHubIncludeExcludeGlobstarSemantics(t *testing.T) {
+	condition := &githubRulesetRefNameCondition{
+		Include: []string{"refs/tags/release/**/*"},
+		Exclude: []string{"refs/tags/release/private/**"},
+	}
+	for _, test := range []struct {
+		name string
+		tag  string
+		want bool
+	}{
+		{name: "single component after directory", tag: "release/v1", want: true},
+		{name: "deeper nested path", tag: "release/foo/bar", want: true},
+		{name: "excluded nested path", tag: "release/private/v1", want: false},
+		{name: "directory itself remains outside exclusion suffix", tag: "release/private", want: true},
+		{name: "outside include", tag: "hotfix/v1", want: false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := rulesetRefNameMatches(condition, test.tag); got != test.want {
+				t.Fatalf("rulesetRefNameMatches(%q) = %v, want %v", test.tag, got, test.want)
+			}
+		})
+	}
+}
+
+func TestProviderTagPatternsPreserveWhitespace(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		pattern string
+		tag     string
+		want    bool
+	}{
+		{name: "leading whitespace is literal", pattern: " workflow-*", tag: " workflow-v1", want: true},
+		{name: "leading whitespace does not match trimmed tag", pattern: " workflow-*", tag: "workflow-v1"},
+		{name: "trailing whitespace is literal", pattern: "workflow-* ", tag: "workflow-v1 ", want: true},
+		{name: "trailing whitespace does not match trimmed tag", pattern: "workflow-* ", tag: "workflow-v1"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := githubTagPatternMatches(test.pattern, test.tag); got != test.want {
+				t.Fatalf("githubTagPatternMatches(%q, %q) = %v, want %v", test.pattern, test.tag, got, test.want)
+			}
+		})
+	}
+	if githubTagNamePatternMatches("starts_with", " workflow-", "workflow-v1") {
+		t.Fatal("tag_name_pattern leading whitespace was normalized")
+	}
+	if !githubTagNamePatternMatches("starts_with", " workflow-", " workflow-v1") {
+		t.Fatal("tag_name_pattern leading whitespace was not treated literally")
+	}
+}
+
+func TestGithubRulesetConditionsAcceptRepositoryScopedRefName(t *testing.T) {
+	var conditions githubRulesetConditions
+	if err := json.Unmarshal([]byte(`{"ref_name":{"include":["refs/tags/*"],"exclude":[]}}`), &conditions); err != nil {
+		t.Fatalf("repository-scoped ref_name condition rejected: %v", err)
+	}
+	if err := validateGithubTagRulesetConditions(&conditions); err != nil {
+		t.Fatalf("repository-scoped ref_name condition failed validation: %v", err)
+	}
+}
+
+func TestGithubTagRulesetConditionsRequireRefName(t *testing.T) {
+	for _, conditions := range []*githubRulesetConditions{
+		nil,
+		{},
+		{RefName: nil},
+	} {
+		if err := validateGithubTagRulesetConditions(conditions); err == nil {
+			t.Fatalf("validateGithubTagRulesetConditions(%#v) = nil, want missing ref_name rejection", conditions)
+		}
+	}
+}
+
+func TestGithubRulesetConditionsRejectUnknownFieldsAndMalformedTypes(t *testing.T) {
+	for _, fixture := range []string{
+		`{"unknown":{"include":["refs/tags/*"]}}`,
+		`{"ref_name":{"include":["refs/tags/*"],"unknown":[]}}`,
+		`{"ref_name":{"include":["refs/tags/*"],"protected":true}}`,
+		`{"repository_name":{"include":["owner/*"]}}`,
+		`{"repository_id":{"repository_ids":[123]}}`,
+		`{"repository_property":{"include":[]}}`,
+		`{"ref_name":{"include":"refs/tags/*"}}`,
+		`{"ref_name":{"include":null}}`,
+		`{"ref_name":null}`,
+	} {
+		var conditions githubRulesetConditions
+		if err := json.Unmarshal([]byte(fixture), &conditions); err == nil {
+			t.Fatalf("ruleset conditions %s were accepted, want fail-closed rejection", fixture)
+		}
+	}
+}
+
+func TestGithubTagGlobRejectsMalformedUnsupportedAndUnsafeClasses(t *testing.T) {
+	for _, pattern := range []string{
+		"workflow-[abc",
+		"workflow-[]",
+		"workflow-[z-a]",
+		"workflow-[^a]",
+		"workflow-[!a]",
+		"workflow-[a/]",
+		"workflow-[!-0]",
+		"workflow-]",
+		"workflow-\\",
+		`workflow-\*`,
+		`workflow-[a\-z]`,
+	} {
+		if githubTagGlobMatches(pattern, "workflow-a") {
+			t.Fatalf("githubTagGlobMatches(%q) = true, want malformed/unsupported pattern rejected", pattern)
+		}
+	}
+	for _, pattern := range []string{`workflow-\*`, `workflow-\[a\]`, `workflow-[a\-z]`} {
+		if githubTagGlobMatches(pattern, "workflow-*") || githubTagGlobMatches(pattern, "workflow-[a]") {
+			t.Fatalf("githubTagGlobMatches(%q) matched a backslash-quoted value", pattern)
+		}
+	}
+}
+
+func TestRulesetTagNamePatternOperatorsDoNotControlRefProtection(t *testing.T) {
+	for _, operator := range []string{"starts_with", "ends_with", "contains", "regex"} {
+		t.Run(operator, func(t *testing.T) {
+			if !githubTagNamePatternMatches(operator, map[string]string{
+				"starts_with": "workflow-",
+				"ends_with":   "-v1",
+				"contains":    "flow",
+				"regex":       `^workflow-v[0-9]+$`,
+			}[operator], "workflow-v1") {
+				t.Fatalf("operator %q did not match documented pattern", operator)
+			}
+		})
+	}
+	if githubTagNamePatternMatches("fnmatch", "workflow-*", "workflow-v1") {
+		t.Fatal("unsupported fnmatch operator was accepted")
+	}
+}
+
+func TestResolveWorkflowExecutionResolvesOwnedDefaultRef(t *testing.T) {
+	workflowSHA := strings.Repeat("a", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path != "/repos/owner/repo/git/ref/heads/rustqs/workflows" {
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+		return githubResponse(http.StatusOK, `{"ref":"refs/heads/rustqs/workflows","object":{"sha":"`+workflowSHA+`","type":"commit"}}`, nil), nil
+	}))
+
+	identity, err := (&GithubBuildConfigService{}).resolveWorkflowExecution(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"})
+	if err != nil {
+		t.Fatalf("resolveWorkflowExecution() error = %v", err)
+	}
+	if identity.Ref != defaultWorkflowExecutionRef || identity.SHA != workflowSHA {
+		t.Fatalf("workflow execution identity = %#v, want ref %q and SHA %q", identity, defaultWorkflowExecutionRef, workflowSHA)
+	}
+}
+
+func TestResolveWorkflowExecutionRejectsConfiguredSHAAsDispatchSelector(t *testing.T) {
+	workflowSHA := strings.Repeat("b", 64)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("configured immutable SHA caused provider lookup: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+
+	identity, err := (&GithubBuildConfigService{}).resolveWorkflowExecution(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo", Branch: workflowSHA})
+	if err == nil {
+		t.Fatalf("resolveWorkflowExecution() = %#v, want raw SHA selector rejection", identity)
+	}
+}
+
+func TestWorkflowRefPolicyRejectsMutableDefaultBeforeProvider(t *testing.T) {
+	var requests int
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		requests++
+		t.Fatalf("unexpected provider request for mutable default: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+	_, err := (&GithubBuildConfigService{}).validateWorkflowRefPolicy(context.Background(), &model.GithubBuildConfig{
+		Repo: "fork.example/repo", Branch: defaultWorkflowExecutionRef,
+	})
+	var approvalErr *WorkflowRefApprovalError
+	if !errors.As(err, &approvalErr) || requests != 0 {
+		t.Fatalf("validateWorkflowRefPolicy() = %T %v, requests=%d; want fail-closed mutable default", err, err, requests)
+	}
+}
+
+func TestDispatchBuildRejectsLegacyDefaultEvenWhenApprovalBitsAreForged(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("unexpected provider request for forged mutable approval: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+	config := &model.GithubBuildConfig{
+		Repo:                        "owner/repo",
+		Token:                       "github_pat_test",
+		PayloadKey:                  "payload-key",
+		Branch:                      defaultWorkflowExecutionRef,
+		WorkflowRefApproved:         true,
+		WorkflowRefProviderVerified: true,
+		WorkflowRefApprovalSHA:      strings.Repeat("a", 40),
+	}
+	_, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, githubVersionIdentity(), string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey})
+	var approvalErr *WorkflowRefApprovalError
+	if !errors.As(err, &approvalErr) {
+		t.Fatalf("DispatchBuild() error = %T %v, want mutable default rejection", err, err)
+	}
+}
+
+func TestResolveWorkflowExecutionRequiresVerifiedAnnotatedTag(t *testing.T) {
+	const selector = "refs/tags/workflow-v1"
+	tagObjectSHA := strings.Repeat("b", 40)
+	commitSHA := strings.Repeat("c", 40)
+	for _, test := range []struct {
+		name      string
+		refType   string
+		verified  bool
+		objectSHA string
+		wantError bool
+	}{
+		{name: "verified annotated", refType: "tag", verified: true, objectSHA: commitSHA},
+		{name: "lightweight", refType: "commit", verified: true, objectSHA: commitSHA, wantError: true},
+		{name: "unverified annotated", refType: "tag", verified: false, objectSHA: commitSHA, wantError: true},
+		{name: "provider tag moved to a new valid commit", refType: "tag", verified: true, objectSHA: strings.Repeat("d", 40)},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if strings.HasSuffix(req.URL.Path, "/git/ref/heads/workflow-v1") {
+					t.Fatal("normal catalog workflow resolution queried the short-selector branch ref")
+				}
+				if strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+					return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+tagObjectSHA+`","type":"`+test.refType+`"}}`, nil), nil
+				}
+				if strings.HasSuffix(req.URL.Path, "/git/tags/"+tagObjectSHA) {
+					return githubResponse(http.StatusOK, `{"sha":"`+tagObjectSHA+`","object":{"sha":"`+test.objectSHA+`","type":"commit"},"verification":{"verified":`+fmt.Sprintf("%t", test.verified)+`,"reason":"valid"}}`, nil), nil
+				}
+				return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+			}))
+			identity, err := (&GithubBuildConfigService{}).resolveWorkflowExecution(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo", Branch: selector})
+			if test.wantError {
+				if err == nil {
+					t.Fatalf("resolveWorkflowExecution() = %#v, nil; want tag rejection", identity)
+				}
+				return
+			}
+			wantSHA := commitSHA
+			if test.objectSHA != commitSHA {
+				wantSHA = test.objectSHA
+			}
+			if err != nil || identity.SHA != wantSHA {
+				t.Fatalf("resolveWorkflowExecution() = %#v, %v; want verified commit %q", identity, err, wantSHA)
+			}
+			if identity.VerificationReason != githubVerificationReasonValid || identity.TrustStatus != githubTrustStatusProvider {
+				t.Fatalf("verification trust metadata = %#v, want provider-reported valid status", identity)
+			}
+		})
+	}
+}
+
+func TestVerifyProtectedWorkflowTagRequiresMatchingProviderProtection(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		listStatus int
+		detailBody string
+		wantError  bool
+		wantAPIErr bool
+		wantPolicy bool
+	}{
+		{name: "protected"},
+		{name: "initial list 404", listStatus: http.StatusNotFound, wantError: true, wantAPIErr: true},
+		{name: "initial list 403", listStatus: http.StatusForbidden, wantError: true, wantAPIErr: true},
+		{name: "initial list 500", listStatus: http.StatusInternalServerError, wantError: true, wantAPIErr: true},
+		{name: "matching ruleset mismatch", detailBody: testProtectedRulesetResponse("release-*"), wantError: true, wantPolicy: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				switch req.URL.Path {
+				case "/repos/owner/repo/rulesets":
+					if test.listStatus != 0 {
+						return githubResponse(test.listStatus, `{"message":"rulesets unavailable"}`, nil), nil
+					}
+					return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+				case "/repos/owner/repo/rulesets/1":
+					body := test.detailBody
+					if body == "" {
+						body = testProtectedRulesetResponse("workflow-*")
+					}
+					return githubResponse(http.StatusOK, body, nil), nil
+				default:
+					t.Fatalf("unexpected protected-tag request: %s %s", req.Method, req.URL.Path)
+					return nil, nil
+				}
+			}))
+			err := (&GithubBuildConfigService{}).verifyProtectedWorkflowTag(
+				context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1",
+			)
+			if (err != nil) != test.wantError {
+				t.Fatalf("verifyProtectedWorkflowTag() error = %v, wantError=%v", err, test.wantError)
+			}
+			if test.wantAPIErr {
+				var apiErr *GithubAPIError
+				if !errors.As(err, &apiErr) {
+					t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want GithubAPIError", err, err)
+				}
+			}
+			if test.wantPolicy {
+				var policyErr *WorkflowRefApprovalError
+				if !errors.As(err, &policyErr) {
+					t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want policy rejection", err, err)
+				}
+			}
+		})
+	}
+}
+
+func TestVerifyModernProtectedWorkflowTagAcceptsObservedInheritedOrganizationRuleset(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/rulesets":
+			return githubResponse(http.StatusOK, testObservedGithubDocsRulesetSummaryResponse(), nil), nil
+		case "/repos/owner/repo/rulesets/18281681":
+			return githubResponse(http.StatusOK, testObservedGithubDocsRulesetResponse(true), nil), nil
+		default:
+			t.Fatalf("unexpected observed inherited-ruleset request: %s %s", req.Method, req.URL.RequestURI())
+			return nil, nil
+		}
+	}))
+	if err := (&GithubBuildConfigService{}).verifyModernProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "enterprise-1.2.3"); err != nil {
+		t.Fatalf("verifyModernProtectedWorkflowTag() error = %v, want observed inherited organization protection", err)
+	}
+}
+
+func TestVerifyModernProtectedWorkflowTagRejectsObservedOmittedBypassActors(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/rulesets":
+			return githubResponse(http.StatusOK, testObservedGithubDocsRulesetSummaryResponse(), nil), nil
+		case "/repos/owner/repo/rulesets/18281681":
+			return githubResponse(http.StatusOK, testObservedGithubDocsRulesetResponse(false), nil), nil
+		default:
+			t.Fatalf("unexpected omitted-bypass ruleset request: %s %s", req.Method, req.URL.RequestURI())
+			return nil, nil
+		}
+	}))
+	err := (&GithubBuildConfigService{}).verifyModernProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "enterprise-1.2.3")
+	var contractErr *GithubContractError
+	if !errors.As(err, &contractErr) {
+		t.Fatalf("verifyModernProtectedWorkflowTag() error = %T %v, want omitted bypass metadata to fail closed", err, err)
+	}
+}
+
+func TestVerifyProtectedWorkflowTagFailsClosedAfterModernSurfaceIsSupported(t *testing.T) {
+	tests := []struct {
+		name          string
+		modernPageTwo bool
+		detailStatus  int
+		detailBody    string
+		wantAPI       bool
+	}{
+		{
+			name:         "detail 404",
+			detailStatus: http.StatusNotFound,
+			detailBody:   `{"message":"detail disappeared"}`,
+		},
+		{
+			name:         "detail 403",
+			detailStatus: http.StatusForbidden,
+			detailBody:   `{"message":"permission denied"}`,
+		},
+		{
+			name:         "detail 500",
+			detailStatus: http.StatusInternalServerError,
+			detailBody:   `{"message":"server failed"}`,
+		},
+		{
+			name:       "detail malformed",
+			detailBody: `{`,
+		},
+		{
+			name:          "later list page 404",
+			modernPageTwo: true,
+			detailBody:    testProtectedRulesetResponse("workflow-*"),
+			wantAPI:       true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				switch req.URL.Path {
+				case "/repos/owner/repo/rulesets":
+					if test.modernPageTwo {
+						if req.URL.Query().Get("page") == "2" {
+							return githubResponse(http.StatusNotFound, test.detailBody, nil), nil
+						}
+						return githubResponse(http.StatusOK, testRulesetSummaryResponse(), http.Header{"Link": []string{`<https://api.github.com/repos/owner/repo/rulesets?per_page=100&page=2>; rel="next"`}}), nil
+					}
+					return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+				case "/repos/owner/repo/rulesets/1":
+					if test.detailStatus != 0 {
+						return githubResponse(test.detailStatus, test.detailBody, nil), nil
+					}
+					return githubResponse(http.StatusOK, test.detailBody, nil), nil
+				default:
+					t.Fatalf("unexpected ruleset request: %s %s", req.Method, req.URL.RequestURI())
+					return nil, nil
+				}
+			}))
+			err := (&GithubBuildConfigService{}).verifyProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1")
+			if err == nil {
+				t.Fatal("verifyProtectedWorkflowTag() returned nil after modern failure")
+			}
+			if test.wantAPI {
+				var apiErr *GithubAPIError
+				if !errors.As(err, &apiErr) {
+					t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want later-page GithubAPIError", err, err)
+				}
+				return
+			}
+			var contractErr *GithubContractError
+			if !errors.As(err, &contractErr) {
+				t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want detail contract error", err, err)
+			}
+		})
+	}
+}
+
+func TestVerifyProtectedWorkflowTagRequiresModernActiveRuleset(t *testing.T) {
+	for _, test := range []struct {
+		name         string
+		ruleset      string
+		status       int
+		wantAPI      bool
+		wantPolicy   bool
+		wantContract bool
+	}{
+		{name: "protected", ruleset: testProtectedRulesetResponse("workflow-*")},
+		{name: "mismatch", ruleset: testProtectedRulesetResponse("release-*"), wantPolicy: true},
+		{name: "tag metadata does not select protection", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"operator":"starts_with","pattern":"workflow-"`, `"operator":"ends_with","pattern":"not-the-ref"`, 1)},
+		{name: "tag metadata is optional", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `{"type":"tag_name_pattern","parameters":{"name":"tag_name","negate":false,"operator":"starts_with","pattern":"workflow-"}},`, "", 1)},
+		{name: "pattern only", ruleset: testPatternOnlyRulesetResponse("workflow-*"), wantPolicy: true},
+		{name: "missing update rule", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},`, "", 1), wantPolicy: true},
+		{name: "missing deletion rule", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `,{"type":"deletion"}`, "", 1), wantPolicy: true},
+		{name: "unsupported rule", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `{"type":"deletion"}`, `{"type":"required_signatures"}`, 1), wantPolicy: true},
+		{name: "unknown rule is rejected", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `,{"type":"deletion"}]`, `,{"type":"deletion"},{"type":"unknown_rule"}]`, 1), wantContract: true},
+		{name: "update allows fetch and merge", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"update_allows_fetch_and_merge":false`, `"update_allows_fetch_and_merge":true`, 1)},
+		{name: "missing update parameter", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}}`, `{"type":"update","parameters":{}}`, 1), wantContract: true},
+		{name: "unknown update parameter", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}}`, `{"type":"update","parameters":{"operator":"fnmatch"}}`, 1), wantContract: true},
+		{name: "inactive", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"enforcement":"active"`, `"enforcement":"disabled"`, 1), wantPolicy: true},
+		{name: "bypass actor", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"bypass_actors":[]`, `"bypass_actors":[{"actor_id":1,"actor_type":"RepositoryRole","bypass_mode":"always"}]`, 1), wantPolicy: true},
+		{name: "missing bypass declaration", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"bypass_actors":[],`, "", 1), wantContract: true},
+		{name: "current user can always bypass", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"current_user_can_bypass":"never"`, `"current_user_can_bypass":"always"`, 1), wantPolicy: true},
+		{name: "current user can bypass pull requests", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"current_user_can_bypass":"never"`, `"current_user_can_bypass":"pull_requests_only"`, 1), wantPolicy: true},
+		{name: "current user is exempt", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"current_user_can_bypass":"never"`, `"current_user_can_bypass":"exempt"`, 1), wantPolicy: true},
+		{name: "missing current-user bypass declaration", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"current_user_can_bypass":"never",`, "", 1), wantContract: true},
+		{name: "malformed bypass actor", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"bypass_actors":[]`, `"bypass_actors":[{"actor_id":0,"actor_type":"User","bypass_mode":"always"}]`, 1), wantContract: true},
+		{name: "pull-request bypass mode is not valid for tags", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"bypass_actors":[]`, `"bypass_actors":[{"actor_id":1,"actor_type":"User","bypass_mode":"pull_request"}]`, 1), wantContract: true},
+		{name: "missing ruleset target", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"target":"tag"`, `"target":""`, 1), wantContract: true},
+		{name: "invalid ruleset enforcement", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"enforcement":"active"`, `"enforcement":"unknown"`, 1), wantContract: true},
+		{name: "missing ruleset name", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"name":"workflow-protection",`, "", 1), wantContract: true},
+		{name: "missing ruleset source", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"source":"owner/repo",`, "", 1), wantContract: true},
+		{name: "missing ruleset source type", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"source_type":"Repository",`, "", 1), wantContract: true},
+		{name: "invalid ruleset source type", ruleset: strings.Replace(testProtectedRulesetResponse("workflow-*"), `"source_type":"Repository"`, `"source_type":"Unknown"`, 1), wantContract: true},
+		{name: "optional ruleset timestamps", ruleset: strings.Replace(strings.Replace(testProtectedRulesetResponse("workflow-*"), `"created_at":"2026-08-01T00:00:00Z",`, "", 1), `,"updated_at":"2026-08-01T00:00:00Z"`, "", 1)},
+		{name: "malformed response", ruleset: `{`, wantContract: true},
+		{name: "initial list unsupported", status: http.StatusNotFound, wantAPI: true},
+		{name: "permission ambiguity", status: http.StatusForbidden, wantAPI: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				switch req.URL.Path {
+				case "/repos/owner/repo/rulesets/1":
+					if test.status != 0 {
+						return githubResponse(test.status, `{"message":"rulesets unavailable"}`, nil), nil
+					}
+					return githubResponse(http.StatusOK, test.ruleset, nil), nil
+				case "/repos/owner/repo/rulesets":
+					if test.status != 0 {
+						return githubResponse(test.status, `{"message":"rulesets unavailable"}`, nil), nil
+					}
+					return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+				default:
+					t.Fatalf("unexpected ruleset policy request: %s %s", req.Method, req.URL.Path)
+					return nil, nil
+				}
+			}))
+			err := (&GithubBuildConfigService{}).verifyProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1")
+			if test.wantContract {
+				var contractErr *GithubContractError
+				if !errors.As(err, &contractErr) {
+					t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want malformed-response contract error", err, err)
+				}
+				return
+			}
+			if test.wantAPI {
+				var apiErr *GithubAPIError
+				if !errors.As(err, &apiErr) {
+					t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want provider API error", err, err)
+				}
+				return
+			}
+			if test.wantPolicy {
+				var policyErr *WorkflowRefApprovalError
+				if !errors.As(err, &policyErr) {
+					t.Fatalf("verifyProtectedWorkflowTag() error = %T %v, want policy rejection", err, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("verifyProtectedWorkflowTag() error = %v, want protected tag", err)
+			}
+		})
+	}
+}
+
+func TestVerifyModernProtectedWorkflowTagFindsRulesetBeyondFirstPage(t *testing.T) {
+	var rulesetPages int
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/rulesets":
+			rulesetPages++
+			if req.URL.Query().Get("targets") != "tag" || req.URL.Query().Get("includes_parents") != "true" {
+				t.Fatalf("ruleset page %q omitted targets=tag or includes_parents=true", req.URL.RawQuery)
+			}
+			if req.URL.Query().Get("page") == "2" {
+				return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+			}
+			return githubResponse(http.StatusOK, testRulesetSummaryResponseForID(2), http.Header{"Link": []string{`<https://api.github.com/repos/owner/repo/rulesets?per_page=100&page=2>; rel="next"`}}), nil
+		case "/repos/owner/repo/rulesets/1":
+			return githubResponse(http.StatusOK, testProtectedRulesetResponse("workflow-*"), nil), nil
+		case "/repos/owner/repo/rulesets/2":
+			return githubResponse(http.StatusOK, strings.Replace(testProtectedRulesetResponse("release-*"), `"id":1`, `"id":2`, 1), nil), nil
+		default:
+			t.Fatalf("unexpected ruleset pagination request: %s %s", req.Method, req.URL.Path)
+			return nil, nil
+		}
+	}))
+	if err := (&GithubBuildConfigService{}).verifyModernProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1"); err != nil {
+		t.Fatalf("verifyModernProtectedWorkflowTag() error = %v, want page-two ruleset protection", err)
+	}
+	if rulesetPages != 2 {
+		t.Fatalf("ruleset pages = %d, want 2", rulesetPages)
+	}
+}
+
+func TestVerifyModernProtectedWorkflowTagIncludesInheritedParentRulesets(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Path == "/repos/owner/repo/rulesets/9" {
+			return githubResponse(http.StatusOK, strings.Replace(testProtectedRulesetResponse("workflow-*"), `"id":1`, `"id":9`, 1), nil), nil
+		}
+		if req.URL.Path != "/repos/owner/repo/rulesets" {
+			t.Fatalf("unexpected inherited-ruleset request: %s %s", req.Method, req.URL.RequestURI())
+		}
+		if req.URL.Query().Get("targets") != "tag" || req.URL.Query().Get("includes_parents") != "true" || req.URL.Query().Get("per_page") != "100" || req.URL.Query().Get("page") != "1" {
+			t.Fatalf("ruleset query = %q, want bounded inherited-ruleset query", req.URL.RawQuery)
+		}
+		return githubResponse(http.StatusOK, `[{"id":9}]`, nil), nil
+	}))
+	if err := (&GithubBuildConfigService{}).verifyModernProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1"); err != nil {
+		t.Fatalf("verifyModernProtectedWorkflowTag() error = %v, want inherited parent policy to count", err)
+	}
+}
+
+func TestVerifyModernProtectedWorkflowTagAggregatesApplicableRulesets(t *testing.T) {
+	tests := []struct {
+		name    string
+		tag     string
+		details []struct {
+			id   int
+			body string
+		}
+		wantPolicy bool
+	}{
+		{
+			name: "split update and deletion rules pass",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}}`)},
+				{2, testRulesetResponseWithRules(2, "refs/tags/workflow-*", "", `{"type":"deletion"}`)},
+			},
+		},
+		{
+			name: "stronger known rule does not weaken complete protection",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"},{"type":"required_signatures"}`)},
+			},
+		},
+		{
+			name: "matching weak-only set fails closed",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}}`)},
+			},
+			wantPolicy: true,
+		},
+		{
+			name: "protected tag ignores non-matching weak ruleset",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}`)},
+				{2, testRulesetResponseWithRules(2, "refs/tags/release-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}}`)},
+			},
+		},
+		{
+			name: "protected tag ignores inactive weak ruleset",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}`)},
+				{2, strings.Replace(testRulesetResponseWithRules(2, "refs/tags/workflow-*", "", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}}`), `"enforcement":"active"`, `"enforcement":"evaluate"`, 1)},
+			},
+		},
+		{
+			name: "excluded tag is not protected",
+			tag:  "workflow-v1",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "refs/tags/workflow-v1", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}`)},
+			},
+			wantPolicy: true,
+		},
+		{
+			name: "non-excluded tag remains protected",
+			tag:  "workflow-v2",
+			details: []struct {
+				id   int
+				body string
+			}{
+				{1, testRulesetResponseWithRules(1, "refs/tags/workflow-*", "refs/tags/workflow-v1", `{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}`)},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			tag := test.tag
+			if tag == "" {
+				tag = "workflow-v1"
+			}
+			summary := "["
+			for index, detail := range test.details {
+				if index > 0 {
+					summary += ","
+				}
+				summary += strings.TrimSuffix(strings.TrimPrefix(testRulesetSummaryResponseForID(detail.id), "["), "]")
+			}
+			summary += "]"
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if req.URL.Path == "/repos/owner/repo/rulesets" {
+					return githubResponse(http.StatusOK, summary, nil), nil
+				}
+				for _, detail := range test.details {
+					if req.URL.Path == fmt.Sprintf("/repos/owner/repo/rulesets/%d", detail.id) {
+						return githubResponse(http.StatusOK, detail.body, nil), nil
+					}
+				}
+				t.Fatalf("unexpected ruleset request: %s %s", req.Method, req.URL.RequestURI())
+				return nil, nil
+			}))
+
+			err := (&GithubBuildConfigService{}).verifyModernProtectedWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, tag)
+			if test.wantPolicy {
+				var policyErr *WorkflowRefApprovalError
+				if !errors.As(err, &policyErr) {
+					t.Fatalf("verifyModernProtectedWorkflowTag() error = %T %v, want policy rejection", err, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("verifyModernProtectedWorkflowTag() error = %v, want protected tag", err)
+			}
+		})
+	}
+}
+
+func TestGithubRulesetParserAcceptsDocumentedKnownRuleParameters(t *testing.T) {
+	fixture := `{"id":1,` + testRulesetMetadata + `,"target":"tag","enforcement":"active","bypass_actors":[],"current_user_can_bypass":"never","conditions":{"ref_name":{"include":["refs/tags/workflow-*"]}},"rules":[{"type":"workflows","parameters":{"do_not_enforce_on_create":true,"workflows":[{"path":".github/workflows/build.yml","repository_id":123,"ref":"refs/heads/main","sha":"` + strings.Repeat("a", 40) + `"}]}},{"type":"pull_request","parameters":{"dismiss_stale_reviews_on_push":true,"require_code_owner_review":true,"required_approving_review_count":1,"required_review_thread_resolution":true,"require_last_push_approval":true,"allowed_merge_methods":["merge","squash"],"dismissal_restriction":{"enabled":true,"allowed_actors":[{"id":123,"type":"User"}]},"required_reviewers":[{"file_patterns":["src/**"],"minimum_approvals":1,"reviewer":{"id":123,"type":"Team"}}]}},{"type":"update","parameters":{"update_allows_fetch_and_merge":false}},{"type":"deletion"}]}`
+	var ruleset githubRepositoryRulesetRecord
+	if err := json.Unmarshal([]byte(fixture), &ruleset); err != nil {
+		t.Fatalf("documented ruleset fixture rejected: %v", err)
+	}
+	protection, err := evaluateRulesetTagProtection(ruleset, "workflow-0")
+	if err != nil || !protection.hasUpdateRule || !protection.hasDeletionRule {
+		t.Fatalf("documented known rule parameters prevented valid tag ruleset protection: protection=%#v err=%v", protection, err)
+	}
+}
+
+func TestGithubRulesetParserRejectsMalformedKnownRuleParameters(t *testing.T) {
+	for _, parameters := range []string{`null`, `[]`, `{`} {
+		fixture := `{"type":"workflows","parameters":` + parameters + `}`
+		var rule githubRulesetRule
+		if err := json.Unmarshal([]byte(fixture), &rule); err == nil {
+			t.Fatalf("ruleset parameters %s were accepted, want fail-closed rejection", parameters)
+		}
+	}
+	for _, ruleType := range []string{"required_deployments", "pull_request", "required_status_checks", "workflows", "merge_queue", "copilot_code_review", "code_scanning", "file_path_restriction", "max_file_path_length", "file_extension_restriction", "max_file_size"} {
+		fixture := `{"type":"` + ruleType + `","parameters":{}}`
+		var rule githubRulesetRule
+		if err := json.Unmarshal([]byte(fixture), &rule); err == nil {
+			t.Fatalf("known neutral rule %q with empty parameters was accepted", ruleType)
+		}
+	}
+	for _, ruleType := range []string{"creation", "deletion", "required_linear_history", "required_signatures", "non_fast_forward", "license_compliance_scanning"} {
+		fixture := `{"type":"` + ruleType + `","parameters":{}}`
+		var rule githubRulesetRule
+		if err := json.Unmarshal([]byte(fixture), &rule); err == nil {
+			t.Fatalf("no-parameter rule %q with parameters was accepted", ruleType)
+		}
+	}
+	var unknown githubRulesetRule
+	if err := json.Unmarshal([]byte(`{"type":"unknown_rule","parameters":{}}`), &unknown); err == nil {
+		t.Fatal("unknown ruleset type was accepted")
+	}
+}
+
+func TestGithubRulesetUpdateValidationIsTargetAware(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		target     string
+		parameters string
+		wantDecode bool
+		wantValid  bool
+	}{
+		{name: "tag without parameters", target: "tag", wantDecode: true, wantValid: true},
+		{name: "tag with valid parameters", target: "tag", parameters: `{"update_allows_fetch_and_merge":false}`, wantDecode: true, wantValid: true},
+		{name: "branch without parameters", target: "branch", wantDecode: true},
+		{name: "branch with valid parameters", target: "branch", parameters: `{"update_allows_fetch_and_merge":true}`, wantDecode: true, wantValid: true},
+		{name: "tag null parameters", target: "tag", parameters: `null`},
+		{name: "tag empty parameters", target: "tag", parameters: `{}`},
+		{name: "tag array parameters", target: "tag", parameters: `[]`},
+		{name: "tag wrong boolean type", target: "tag", parameters: `{"update_allows_fetch_and_merge":"false"}`},
+		{name: "tag unknown parameter", target: "tag", parameters: `{"update_allows_fetch_and_merge":false,"unknown":true}`},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			fixture := `{"type":"update"`
+			if test.parameters != "" {
+				fixture += `,"parameters":` + test.parameters
+			}
+			fixture += `}`
+			var rule githubRulesetRule
+			err := json.Unmarshal([]byte(fixture), &rule)
+			if test.wantDecode {
+				if err != nil {
+					t.Fatalf("decode update rule = %v, want decode success", err)
+				}
+				if err := validateGithubRulesetRules(test.target, []githubRulesetRule{rule}); (err == nil) != test.wantValid {
+					t.Fatalf("validateGithubRulesetRules(%q) = %v, wantValid=%v", test.target, err, test.wantValid)
+				}
+				return
+			}
+			if err == nil {
+				t.Fatalf("decode update rule %s succeeded, want fail-closed rejection", fixture)
+			}
+		})
+	}
+}
+
+func TestGithubRulesetParserAcceptsDocumentedNullableBypassActorIDs(t *testing.T) {
+	fixture := `[{"actor_id":null,"actor_type":"DeployKey","bypass_mode":"always"},{"actor_id":null,"actor_type":"OrganizationAdmin","bypass_mode":"exempt"}]`
+	var actors []githubRulesetBypassActor
+	if err := json.Unmarshal([]byte(fixture), &actors); err != nil {
+		t.Fatalf("documented nullable bypass actors rejected: %v", err)
+	}
+	if len(actors) != 2 || actors[0].ActorID != nil || actors[1].ActorID != nil {
+		t.Fatalf("nullable bypass actors = %#v, want nil actor IDs", actors)
+	}
+	if err := validateGithubRulesetBypassActors(actors); err != nil {
+		t.Fatalf("documented nullable bypass actors failed validation: %v", err)
+	}
+}
+
+func TestResolveWorkflowTagRequiresExplicitAcceptedVerificationReason(t *testing.T) {
+	for _, reason := range []string{"", "unsigned", "unknown_signature_type"} {
+		t.Run("reason-"+reason, func(t *testing.T) {
+			tagObjectSHA := strings.Repeat("a", 40)
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+					return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+tagObjectSHA+`","type":"tag"}}`, nil), nil
+				}
+				if strings.HasSuffix(req.URL.Path, "/git/tags/"+tagObjectSHA) {
+					return githubResponse(http.StatusOK, `{"sha":"`+tagObjectSHA+`","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"`+reason+`"}}`, nil), nil
+				}
+				return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+			}))
+			if _, err := (&GithubBuildConfigService{}).ResolveWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1"); err == nil {
+				t.Fatalf("ResolveWorkflowTag() accepted verification reason %q", reason)
+			}
+		})
+	}
+}
+
+func TestResolveWorkflowTagRejectsShortSelectorBranchCollision(t *testing.T) {
+	tagObjectSHA := strings.Repeat("a", 40)
+	workflowSHA := strings.Repeat("b", 40)
+	for _, test := range []struct {
+		name          string
+		branchCode    int
+		branchBody    string
+		transportErr  bool
+		wantError     bool
+		wantAPI       bool
+		wantTransport bool
+	}{
+		{name: "no branch collision", branchCode: http.StatusNotFound, branchBody: `{"message":"branch not found"}`},
+		{name: "same label branch", branchCode: http.StatusOK, branchBody: `{"ref":"refs/heads/workflow-v1","object":{"sha":"` + workflowSHA + `","type":"commit"}}`, wantError: true},
+		{name: "provider outage", branchCode: http.StatusBadGateway, branchBody: `{"message":"provider unavailable"}`, wantError: true, wantAPI: true},
+		{name: "provider transport error", transportErr: true, wantError: true, wantTransport: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				switch req.URL.Path {
+				case "/repos/owner/repo/git/ref/tags/workflow-v1":
+					return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+tagObjectSHA+`","type":"tag"}}`, nil), nil
+				case "/repos/owner/repo/git/tags/" + tagObjectSHA:
+					return githubResponse(http.StatusOK, `{"sha":"`+tagObjectSHA+`","object":{"sha":"`+workflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+				case "/repos/owner/repo/git/ref/heads/workflow-v1":
+					if test.transportErr {
+						return nil, context.DeadlineExceeded
+					}
+					return githubResponse(test.branchCode, test.branchBody, nil), nil
+				default:
+					t.Fatalf("unexpected request: %s %s", req.Method, req.URL.Path)
+					return nil, nil
+				}
+			}))
+
+			identity, err := (&GithubBuildConfigService{}).ResolveWorkflowTag(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, "workflow-v1")
+			if test.wantError {
+				if err == nil {
+					t.Fatalf("ResolveWorkflowTag() = %#v, nil; want collision/provider rejection", identity)
+				}
+				if test.wantAPI {
+					var apiErr *GithubAPIError
+					if !errors.As(err, &apiErr) || apiErr.Retryable != true || apiErr.Terminal {
+						t.Fatalf("ResolveWorkflowTag() error = %T %v, want retryable provider error", err, err)
+					}
+				} else if test.wantTransport {
+					var transportErr *GithubTransportError
+					if !errors.As(err, &transportErr) || !IsGithubRetryable(err) || IsGithubTerminal(err) {
+						t.Fatalf("ResolveWorkflowTag() error = %T %v, want retryable transport error", err, err)
+					}
+				} else {
+					var approvalErr *WorkflowRefApprovalError
+					if !errors.As(err, &approvalErr) {
+						t.Fatalf("ResolveWorkflowTag() error = %T %v, want collision approval rejection", err, err)
+					}
+				}
+				return
+			}
+			if err != nil || identity.Ref != "refs/tags/workflow-v1" || identity.SHA != workflowSHA {
+				t.Fatalf("ResolveWorkflowTag() = %#v, %v; want verified tag identity", identity, err)
+			}
+		})
+	}
+}
+
+func TestDispatchBuildRejectsBranchCollisionBeforeProviderPayloadPost(t *testing.T) {
+	identity := githubVersionIdentity()
+	config := githubConfig()
+	var payloadPosts int
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/rulesets":
+			return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+		case "/repos/owner/repo/rulesets/1":
+			return githubResponse(http.StatusOK, testProtectedRulesetResponse("workflow-*"), nil), nil
+		case "/repos/owner/repo/git/ref/tags/workflow-v1":
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"tag"}}`, nil), nil
+		case "/repos/owner/repo/git/tags/" + strings.Repeat("e", 40):
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("e", 40)+`","object":{"sha":"`+identity.WorkflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		case "/repos/owner/repo/git/ref/heads/workflow-v1":
+			return githubResponse(http.StatusOK, `{"ref":"refs/heads/workflow-v1","object":{"sha":"`+strings.Repeat("d", 40)+`","type":"commit"}}`, nil), nil
+		case "/repos/owner/repo/contents/.github/workflows/rustqs-windows.yml":
+			return githubResponse(http.StatusOK, testWorkflowFileResponse(windowsWorkflowFilename), nil), nil
+		case "/repos/owner/repo/actions/workflows/rustqs-windows.yml":
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		default:
+			if req.Method == http.MethodPost {
+				payloadPosts++
+			}
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	if _, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey}); err == nil {
+		t.Fatal("DispatchBuild() error = nil, want branch collision rejection")
+	}
+	if payloadPosts != 0 {
+		t.Fatalf("DispatchBuild() made %d provider payload POST(s), want none on branch collision", payloadPosts)
+	}
+}
+
+func TestListWorkflowTagOptionsReturnsOnlyVerifiedReadyProviderTags(t *testing.T) {
+	tagObjectSHA := strings.Repeat("a", 40)
+	workflowSHA := strings.Repeat("b", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch {
+		case strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/"):
+			return testRulesetResponse(req, "workflow-*"), nil
+		case strings.HasSuffix(req.URL.Path, "/rulesets"):
+			return testRulesetResponse(req, "workflow-*"), nil
+		case strings.HasSuffix(req.URL.Path, "/git/refs/tags"):
+			return githubResponse(http.StatusOK, `[{"ref":"refs/tags/lightweight","object":{"sha":"`+strings.Repeat("c", 40)+`","type":"commit"}},{"ref":"refs/tags/unverified","object":{"sha":"`+strings.Repeat("d", 40)+`","type":"tag"}},{"ref":"refs/tags/workflow-v1","object":{"sha":"`+tagObjectSHA+`","type":"tag"}}]`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/git/ref/tags/unverified"):
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/unverified","object":{"sha":"`+strings.Repeat("d", 40)+`","type":"tag"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1"):
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+tagObjectSHA+`","type":"tag"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("d", 40)):
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("d", 40)+`","object":{"sha":"`+workflowSHA+`","type":"commit"},"verification":{"verified":false,"reason":"unsigned"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/git/tags/"+tagObjectSHA):
+			return githubResponse(http.StatusOK, `{"sha":"`+tagObjectSHA+`","object":{"sha":"`+workflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		case strings.Contains(req.URL.Path, "/contents/.github/workflows/"):
+			return githubResponse(http.StatusOK, testWorkflowFileResponse(windowsWorkflowFilename), nil), nil
+		case strings.Contains(req.URL.Path, "/actions/workflows/"):
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+	options, err := (&GithubBuildConfigService{}).ListWorkflowTagOptions(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"})
+	if err != nil {
+		t.Fatalf("ListWorkflowTagOptions() error = %v", err)
+	}
+	if len(options) != 1 || options[0].Tag != "workflow-v1" || options[0].Label != "workflow-v1" {
+		t.Fatalf("workflow tag options = %#v, want only safe verified label", options)
+	}
+	encoded, err := json.Marshal(options)
+	if err != nil {
+		t.Fatalf("marshal workflow tag options: %v", err)
+	}
+	if strings.Contains(string(encoded), workflowSHA) || strings.Contains(string(encoded), "verification") || strings.Contains(string(encoded), "refs/tags") {
+		t.Fatalf("workflow tag options exposed internal provider details: %s", encoded)
+	}
+}
+
+func TestListWorkflowTagOptionsBoundsPagination(t *testing.T) {
+	var pages int
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if !strings.HasSuffix(req.URL.Path, "/git/refs/tags") {
+			t.Fatalf("unexpected request after bounded pagination: %s %s", req.Method, req.URL.Path)
+		}
+		pages++
+		return githubResponse(http.StatusOK, `[]`, http.Header{"Link": []string{`<https://api.github.com/repos/owner/repo/git/refs/tags?page=` + fmt.Sprint(pages+1) + `>; rel="next"`}}), nil
+	}))
+	_, err := (&GithubBuildConfigService{}).ListWorkflowTagOptions(context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"})
+	var contractErr *GithubContractError
+	if !errors.As(err, &contractErr) || pages != maxWorkflowTagPages {
+		t.Fatalf("ListWorkflowTagOptions() = %T %v, pages=%d; want bounded pagination contract error at %d pages", err, err, pages, maxWorkflowTagPages)
+	}
+}
+
+func TestDispatchBuildRejectsMovedWorkflowBeforeDFP1Payload(t *testing.T) {
+	identity := githubVersionIdentity()
+	config := githubConfig()
+	var payloadRequests int
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch {
+		case strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/"):
+			return testRulesetResponse(req, "workflow-*"), nil
+		case strings.HasSuffix(req.URL.Path, "/rulesets"):
+			return testRulesetResponse(req, "workflow-*"), nil
+		case strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1"):
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"tag"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("e", 40)):
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("e", 40)+`","object":{"sha":"`+strings.Repeat("e", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/contents/.github/workflows/rustqs-windows.yml"):
+			return githubResponse(http.StatusOK, testWorkflowFileResponse(windowsWorkflowFilename), nil), nil
+		case strings.HasSuffix(req.URL.Path, "/actions/workflows/rustqs-windows.yml"):
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		case req.Method == http.MethodPost:
+			payloadRequests++
+			return githubResponse(http.StatusOK, `{"workflow_run_id":1,"run_url":"https://api.github.com/runs/1","html_url":"https://github.com/runs/1"}`, nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	_, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey})
+	if err == nil || payloadRequests != 0 {
+		t.Fatalf("DispatchBuild() = %v, payload requests=%d; want moved-ref rejection before DFP1 dispatch", err, payloadRequests)
+	}
+}
+
+func TestVerifyWorkflowAvailableRequiresWorkflowDispatch(t *testing.T) {
+	workflowSHA := strings.Repeat("a", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.Contains(req.URL.Path, "/contents/.github/workflows/") {
+			return githubResponse(http.StatusOK, testWorkflowFileResponseWithContent("rustqs-windows.yml", "name: missing trigger\non:\n  push:\n"), nil), nil
+		}
+		t.Fatalf("unexpected readiness request after missing trigger: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+
+	err := (&GithubBuildConfigService{}).verifyWorkflowAvailable(
+		context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, windowsWorkflowFilename, workflowSHA,
+	)
+	var contractErr *GithubContractError
+	if !errors.As(err, &contractErr) || !strings.Contains(err.Error(), "workflow_dispatch") {
+		t.Fatalf("verifyWorkflowAvailable() error = %T %v, want missing-trigger contract error", err, err)
+	}
+}
+
+func TestVerifyWorkflowAvailableAcceptsWorkflowDispatchForms(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		content string
+	}{
+		{name: "block mapping", content: "on:\n  workflow_dispatch:\n"},
+		{name: "inline sequence", content: "on: [push, workflow_dispatch]\n"},
+		{name: "inline mapping", content: "on: {workflow_dispatch: {}}\n"},
+		{name: "quoted key", content: "\"on\":\n  workflow_dispatch: {}\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			workflowSHA := strings.Repeat("b", 40)
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				if strings.Contains(req.URL.Path, "/contents/.github/workflows/") {
+					if req.URL.Query().Get("ref") != workflowSHA {
+						t.Fatalf("contents ref = %q, want exact workflow SHA", req.URL.Query().Get("ref"))
+					}
+					return githubResponse(http.StatusOK, testWorkflowFileResponseWithContent("rustqs-windows.yml", test.content), nil), nil
+				}
+				if strings.Contains(req.URL.Path, "/actions/workflows/") {
+					return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+				}
+				t.Fatalf("unexpected readiness request: %s %s", req.Method, req.URL.Path)
+				return nil, nil
+			}))
+
+			if err := (&GithubBuildConfigService{}).verifyWorkflowAvailable(
+				context.Background(), &model.GithubBuildConfig{Repo: "owner/repo"}, windowsWorkflowFilename, workflowSHA,
+			); err != nil {
+				t.Fatalf("verifyWorkflowAvailable() error = %v", err)
+			}
+		})
+	}
+}
+
+func TestWorkflowExecutionRefNormalizesKnownLegacyValuesAndRejectsMutableValues(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		ref  string
+		want string
+		err  bool
+	}{
+		{name: "empty", ref: "", want: defaultWorkflowExecutionRef},
+		{name: "legacy master", ref: "master", want: defaultWorkflowExecutionRef},
+		{name: "legacy full master ref", ref: "refs/heads/master", want: defaultWorkflowExecutionRef},
+		{name: "canonical full ref", ref: "refs/heads/" + defaultWorkflowExecutionRef, want: defaultWorkflowExecutionRef},
+		{name: "explicit 40 character sha", ref: strings.Repeat("c", 40), want: strings.Repeat("c", 40)},
+		{name: "explicit 64 character sha", ref: strings.Repeat("d", 64), want: strings.Repeat("d", 64)},
+		{name: "explicit tag selector", ref: "refs/tags/workflow-v1", want: "refs/tags/workflow-v1"},
+		{name: "unknown mutable ref", ref: "main", err: true},
+		{name: "unknown legacy ref", ref: "legacy-ref", err: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := workflowExecutionRef(&model.GithubBuildConfig{Branch: test.ref})
+			if test.err || strings.Contains(test.name, "sha") {
+				if err == nil {
+					t.Fatalf("workflowExecutionRef(%q) error = nil, want fail-closed selector rejection", test.ref)
+				}
+				return
+			}
+			if err != nil || got != test.want {
+				t.Fatalf("workflowExecutionRef(%q) = %q, %v; want %q", test.ref, got, err, test.want)
+			}
+		})
+	}
+}
+
+func TestApproveWorkflowRefUsesClosedDomainAndOptionalEffectiveSelector(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	if err := db.Create(&model.GithubBuildConfig{IdModel: model.IdModel{Id: 1}, Repo: "owner/repo"}).Error; err != nil {
+		t.Fatalf("seed config: %v", err)
+	}
+	workflowSHA := strings.Repeat("a", 40)
+	annotatedTagSHA := strings.Repeat("b", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch {
+		case strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/"):
+			return testRulesetResponse(req, "workflow-*"), nil
+		case strings.HasSuffix(req.URL.Path, "/rulesets"):
+			return testRulesetResponse(req, "workflow-*"), nil
+		case strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1"):
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+annotatedTagSHA+`","type":"tag"}}`, nil), nil
+		case strings.HasSuffix(req.URL.Path, "/git/tags/"+annotatedTagSHA):
+			return githubResponse(http.StatusOK, `{"sha":"`+annotatedTagSHA+`","object":{"sha":"`+workflowSHA+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		case strings.Contains(req.URL.Path, "/contents/.github/workflows/"):
+			return githubResponse(http.StatusOK, testWorkflowFileResponse(windowsWorkflowFilename), nil), nil
+		case strings.Contains(req.URL.Path, "/actions/workflows/"):
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+	svc := &GithubBuildConfigService{}
+	if _, err := svc.ApproveWorkflowRef(""); err == nil {
+		t.Fatal("ApproveWorkflowRef(\"\") accepted mutable/default selector")
+	}
+	approved, err := svc.ApproveWorkflowTag("workflow-v1")
+	if err != nil {
+		t.Fatalf("ApproveWorkflowTag() error = %v", err)
+	}
+	if approved.Branch != "refs/tags/workflow-v1" || !approved.WorkflowRefApproved || approved.WorkflowRefApprovalSHA != workflowSHA {
+		t.Fatalf("tag approval = %#v, want approved immutable selector", approved)
+	}
+
+	if err := db.Model(&model.GithubBuildConfig{}).Where("id = 1").Updates(map[string]any{"workflow_ref_approved": false}).Error; err != nil {
+		t.Fatalf("reset approval: %v", err)
+	}
+	approved, err = svc.ApproveWorkflowRef("refs/tags/workflow-v1")
+	if err != nil {
+		t.Fatalf("ApproveWorkflowRef(tag) error = %v", err)
+	}
+	if approved.Branch != "refs/tags/workflow-v1" || !approved.WorkflowRefApproved {
+		t.Fatalf("tag approval = %#v, want approved tag selector", approved)
+	}
+
+	for _, selector := range []string{"main", strings.Repeat("a", 40), "refs/heads/main", "refs/tags/" + strings.Repeat("b", 40)} {
+		t.Run(selector, func(t *testing.T) {
+			if _, err := svc.ApproveWorkflowRef(selector); err == nil {
+				t.Fatalf("ApproveWorkflowRef(%q) error = nil, want closed-domain rejection", selector)
+			} else {
+				var approvalErr *WorkflowRefApprovalError
+				if !errors.As(err, &approvalErr) {
+					t.Fatalf("ApproveWorkflowRef(%q) error = %T %v, want WorkflowRefApprovalError", selector, err, err)
+				}
+			}
+		})
+	}
+}
+
+func TestApproveWorkflowRefPreservesLegacyPlaintextSecretsWithoutEncryptionKey(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+
+	const token = "legacy-github-pat"
+	const payloadKey = "legacy-payload-key"
+	if err := db.Exec(`INSERT INTO github_build_configs (id, repo, branch, workflow_ref_approved, token, payload_key) VALUES (?, ?, ?, ?, ?, ?)`,
+		1, "owner/repo", defaultWorkflowExecutionRef, false, token, payloadKey).Error; err != nil {
+		t.Fatalf("seed legacy config: %v", err)
+	}
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/rulesets") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"tag"}}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("b", 40)) {
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("b", 40)+`","object":{"sha":"`+strings.Repeat("a", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		}
+		if strings.Contains(req.URL.Path, "/contents/.github/workflows/") {
+			return githubResponse(http.StatusOK, testWorkflowFileResponse(windowsWorkflowFilename), nil), nil
+		}
+		if strings.Contains(req.URL.Path, "/actions/workflows/") {
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+	}))
+
+	approved, err := (&GithubBuildConfigService{}).ApproveWorkflowTag("workflow-v1")
+	if err != nil {
+		t.Fatalf("ApproveWorkflowRef() legacy error = %v", err)
+	}
+	if approved.Branch != "refs/tags/workflow-v1" || !approved.WorkflowRefApproved {
+		t.Fatalf("legacy approval = %#v, want approved tag selector", approved)
+	}
+	if rawToken, rawPayloadKey := rawGithubConfigSecrets(t, db); rawToken != token || rawPayloadKey != payloadKey {
+		t.Fatalf("legacy secrets changed during approval: token preserved=%v payload key preserved=%v", rawToken == token, rawPayloadKey == payloadKey)
+	}
+}
+
+func TestApproveWorkflowRefPreservesNewEncryptedSecrets(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+
+	const token = "new-github-pat"
+	const payloadKey = "new-payload-key"
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Branch: defaultWorkflowExecutionRef,
+		Token: token, PayloadKey: payloadKey,
+	}).Error; err != nil {
+		t.Fatalf("seed encrypted config: %v", err)
+	}
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/rulesets") {
+			return testRulesetResponse(req, "workflow-*"), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"tag"}}`, nil), nil
+		}
+		if strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("b", 40)) {
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("b", 40)+`","object":{"sha":"`+strings.Repeat("a", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		}
+		if strings.Contains(req.URL.Path, "/contents/.github/workflows/") {
+			return githubResponse(http.StatusOK, testWorkflowFileResponse(windowsWorkflowFilename), nil), nil
+		}
+		if strings.Contains(req.URL.Path, "/actions/workflows/") {
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		}
+		return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+	}))
+	rawToken, rawPayloadKey := rawGithubConfigSecrets(t, db)
+	if !utils.IsEncryptedSecret(rawToken) || !utils.IsEncryptedSecret(rawPayloadKey) {
+		t.Fatal("seed config did not use encrypted secret storage")
+	}
+
+	if _, err := (&GithubBuildConfigService{}).ApproveWorkflowTag("workflow-v1"); err != nil {
+		t.Fatalf("ApproveWorkflowRef() encrypted error = %v", err)
+	}
+	if gotToken, gotPayloadKey := rawGithubConfigSecrets(t, db); gotToken != rawToken || gotPayloadKey != rawPayloadKey {
+		t.Fatalf("encrypted secrets were reserialized during approval: token preserved=%v payload key preserved=%v", gotToken == rawToken, gotPayloadKey == rawPayloadKey)
+	}
+}
+
+func TestGithubConfigRepoChangePreservesLegacySecretsAndClearsApproval(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Setenv(utils.SecretEncryptionKeyEnv, "")
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+
+	const token = "legacy-repo-change-pat"
+	const payloadKey = "legacy-repo-change-key"
+	if err := db.Exec(`INSERT INTO github_build_configs (id, repo, branch, workflow_ref_approved, token, payload_key) VALUES (?, ?, ?, ?, ?, ?)`,
+		1, "owner/old", defaultWorkflowExecutionRef, true, token, payloadKey).Error; err != nil {
+		t.Fatalf("seed legacy repo config: %v", err)
+	}
+
+	if err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{Repo: "owner/new"}); err != nil {
+		t.Fatalf("Save() legacy repo change error = %v", err)
+	}
+	loaded, err := (&GithubBuildConfigService{}).Get()
+	if err != nil {
+		t.Fatalf("reload repo config: %v", err)
+	}
+	if loaded.Repo != "owner/new" || loaded.WorkflowRefApproved {
+		t.Fatalf("repo change result = %#v, want new repo and cleared approval", loaded)
+	}
+	if rawToken, rawPayloadKey := rawGithubConfigSecrets(t, db); rawToken != token || rawPayloadKey != payloadKey {
+		t.Fatalf("legacy secrets changed during repo reset: token preserved=%v payload key preserved=%v", rawToken == token, rawPayloadKey == payloadKey)
+	}
+}
+
+func TestGithubBuildConfigSaveClearsWorkflowApprovalWhenRepoChanges(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel: model.IdModel{Id: 1}, Repo: "owner/old", Branch: defaultWorkflowExecutionRef, WorkflowRefApproved: true,
+	}).Error; err != nil {
+		t.Fatalf("seed approved config: %v", err)
+	}
+	if err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{Repo: "owner/new"}); err != nil {
+		t.Fatalf("Save(repo change) error = %v", err)
+	}
+	loaded, err := (&GithubBuildConfigService{}).Get()
+	if err != nil {
+		t.Fatalf("reload config: %v", err)
+	}
+	if loaded.Repo != "owner/new" || loaded.WorkflowRefApproved {
+		t.Fatalf("repo reset result = %#v, want new repo and cleared approval", loaded)
+	}
+}
+
+func TestPrepareBuildRejectsUnapprovedWorkflowBeforeProviderOrBuildRow(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel: model.IdModel{Id: 1}, Repo: "owner/repo", Token: "github_pat_test", PayloadKey: "payload-key",
+	}).Error; err != nil {
+		t.Fatalf("seed unapproved config: %v", err)
+	}
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("unexpected provider request for unapproved workflow: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+
+	_, err := (&GithubBuildConfigService{}).PrepareBuild(context.Background(), string(PlatformWindows), "1.2.3")
+	var approvalErr *WorkflowRefApprovalError
+	if !errors.As(err, &approvalErr) {
+		t.Fatalf("PrepareBuild() error = %T %v, want WorkflowRefApprovalError", err, err)
+	}
+	var count int64
+	if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+		t.Fatalf("count builds: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("unapproved workflow left %d build row(s)", count)
+	}
+}
+
+func TestDispatchBuildRejectsUnapprovedWorkflowBeforeProvider(t *testing.T) {
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("unexpected provider request for unapproved workflow: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+	config := githubConfig()
+	config.WorkflowRefApproved = false
+	_, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), config, githubVersionIdentity(), string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey})
+	var approvalErr *WorkflowRefApprovalError
+	if !errors.As(err, &approvalErr) {
+		t.Fatalf("DispatchBuild() error = %T %v, want WorkflowRefApprovalError", err, err)
+	}
+}
+
+func TestGithubBuildConfigGetNormalizesKnownLegacyBranchAtConfigBoundary(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel: model.IdModel{Id: 1},
+		Repo:    "owner/repo",
+		Branch:  "master",
+	}).Error; err != nil {
+		t.Fatalf("seed legacy GitHub config: %v", err)
+	}
+
+	config, err := (&GithubBuildConfigService{}).Get()
+	if err != nil {
+		t.Fatalf("Get() error = %v", err)
+	}
+	if config.Branch != defaultWorkflowExecutionRef {
+		t.Fatalf("normalized config branch = %q, want %q", config.Branch, defaultWorkflowExecutionRef)
+	}
+
+	if err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{Repo: "owner/repo"}); err != nil {
+		t.Fatalf("Save() after legacy normalization error = %v", err)
+	}
+	var stored model.GithubBuildConfig
+	if err := db.First(&stored, 1).Error; err != nil {
+		t.Fatalf("reload normalized config: %v", err)
+	}
+	if stored.Branch != defaultWorkflowExecutionRef {
+		t.Fatalf("persisted normalized branch = %q, want %q", stored.Branch, defaultWorkflowExecutionRef)
+	}
+}
+
+func TestRequireProductionBuildCapabilityKeepsUnvalidatedPlatformsFailClosed(t *testing.T) {
+	for _, platform := range []string{string(PlatformLinux), string(PlatformAndroid)} {
+		t.Run(platform, func(t *testing.T) {
+			err := RequireProductionBuildCapability(platform)
+			var unavailable *ProductionCapabilityUnavailableError
+			if !errors.As(err, &unavailable) {
+				t.Fatalf("RequireProductionBuildCapability(%q) = %T %v, want explicit capability-unavailable error", platform, err, err)
+			}
+			if unavailable.Platform != platform || unavailable.Capability == "" {
+				t.Fatalf("capability error = %#v, want platform and capability", unavailable)
+			}
+		})
+	}
+	if err := RequireProductionBuildCapability(string(PlatformWindows)); err != nil {
+		t.Fatalf("Windows production capability = %v, want available", err)
+	}
+	if err := RequireProductionBuildCapability(string(PlatformLinux)); err == nil {
+		t.Fatal("Linux production capability error = nil")
+	}
+}
+
+func TestRequireDispatchPublicKeyRejectsMalformedMaterial(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		value   any
+		wantErr string
+	}{
+		{name: "missing", value: nil, wantErr: "missing"},
+		{name: "whitespace-only", value: " \t", wantErr: "whitespace-only"},
+		{name: "control", value: validRustDeskPublicKey[:8] + "\x00" + validRustDeskPublicKey[8:], wantErr: "control"},
+		{name: "malformed", value: "public-key", wantErr: "base64"},
+		{name: "wrong length", value: "cHVibGljLWtleQ==", wantErr: "32 bytes"},
+		{name: "valid trailing line endings", value: validRustDeskPublicKey + "\r\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			params := map[string]any{}
+			if test.value != nil {
+				params["key"] = test.value
+			}
+			err := RequireDispatchPublicKey(params)
+			if test.wantErr == "" {
+				if err != nil {
+					t.Fatalf("RequireDispatchPublicKey() error = %v, want valid key", err)
+				}
+				return
+			}
+			var providerErr *GithubProviderConfigurationError
+			if !errors.As(err, &providerErr) || !strings.Contains(err.Error(), test.wantErr) {
+				t.Fatalf("RequireDispatchPublicKey() error = %T %v, want typed provider error containing %q", err, err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestPrepareBuildRejectsUnvalidatedPlatformBeforeProviderOrBuildRow(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Fatalf("unexpected provider request for unavailable platform: %s %s", req.Method, req.URL.Path)
+		return nil, nil
+	}))
+
+	_, err := (&GithubBuildConfigService{}).PrepareBuild(context.Background(), string(PlatformLinux), "1.2.3")
+	var unavailable *ProductionCapabilityUnavailableError
+	if !errors.As(err, &unavailable) {
+		t.Fatalf("PrepareBuild() error = %T %v, want explicit capability-unavailable error", err, err)
+	}
+	var count int64
+	if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+		t.Fatalf("count builds: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("unavailable platform left %d build row(s)", count)
+	}
+}
+
+func TestGithubBuildConfigSafeAndSaveExposeOnlyProviderContract(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+
+	stored := &model.GithubBuildConfig{
+		IdModel:          model.IdModel{Id: 1},
+		Repo:             "owner/old",
+		WorkflowFilename: "legacy.yml",
+		Branch:           "legacy-ref",
+		Token:            "old-token",
+		PayloadKey:       "old-key",
+	}
+	if err := db.Create(stored).Error; err != nil {
+		t.Fatalf("seed config: %v", err)
+	}
+	if err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{
+		Repo:             "owner/new",
+		WorkflowFilename: "attacker.yml",
+		Branch:           "attacker-ref",
+		Token:            "new-token",
+		PayloadKey:       "new-key",
+	}); err != nil {
+		t.Fatalf("Save() error = %v", err)
+	}
+
+	var loaded model.GithubBuildConfig
+	if err := db.First(&loaded, 1).Error; err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	if loaded.Repo != "owner/new" || loaded.Token != "new-token" || loaded.PayloadKey != "new-key" {
+		t.Fatalf("saved provider contract = %#v", loaded)
+	}
+	if loaded.WorkflowFilename != "legacy.yml" || loaded.Branch != "legacy-ref" {
+		t.Fatalf("legacy workflow/ref columns were rewritten: %#v", loaded)
+	}
+
+	encoded, err := json.Marshal(loaded.Safe())
+	if err != nil {
+		t.Fatalf("marshal safe config: %v", err)
+	}
+	for _, forbidden := range []string{"workflow_filename", "branch", "legacy.yml", "legacy-ref"} {
+		if strings.Contains(string(encoded), forbidden) {
+			t.Fatalf("safe config exposes forbidden value %q: %s", forbidden, encoded)
+		}
+	}
+}
+
+func TestPrepareBuildRejectsMissingProviderBeforeBuildPersistence(t *testing.T) {
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+	})
+
+	_, err := (&GithubBuildConfigService{}).PrepareBuild(context.Background(), string(PlatformWindows), "1.2.3")
+	var providerErr *GithubProviderConfigurationError
+	if !errors.As(err, &providerErr) {
+		t.Fatalf("PrepareBuild() error = %T %v, want provider configuration error", err, err)
+	}
+	var count int64
+	if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+		t.Fatalf("count builds: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("provider readiness failure left %d build row(s)", count)
+	}
+}
+
+func TestPrepareBuildRejectsUnavailableWorkflowBeforeBuildPersistence(t *testing.T) {
+	cases := []struct {
+		name       string
+		status     int
+		retryable  bool
+		terminal   bool
+		response   string
+		expectType string
+	}{
+		{name: "401 unauthorized", status: http.StatusUnauthorized, terminal: true, response: `{"message":"bad credentials"}`, expectType: "api"},
+		{name: "403 forbidden", status: http.StatusForbidden, terminal: true, response: `{"message":"workflow access denied"}`, expectType: "api"},
+		{name: "404 missing tag", status: http.StatusNotFound, terminal: true, response: `{"message":"workflow tag not found"}`, expectType: "api"},
+		{name: "500 provider outage", status: http.StatusInternalServerError, retryable: true, response: `{"message":"provider unavailable"}`, expectType: "api"},
+		{name: "workflow file contract", status: http.StatusOK, terminal: true, response: `{"state":"disabled_manually"}`, expectType: "contract"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			db, sqlDB := newGithubConfigTestDB(t)
+			previousDB := DB
+			DB = db
+			t.Cleanup(func() {
+				DB = previousDB
+				_ = sqlDB.Close()
+			})
+			if err := db.Create(&model.GithubBuildConfig{
+				IdModel:                     model.IdModel{Id: 1},
+				Repo:                        "owner/repo",
+				Token:                       "github_pat_test",
+				PayloadKey:                  "payload-key",
+				Branch:                      "refs/tags/workflow-v1",
+				WorkflowRefApproved:         true,
+				WorkflowRefProviderVerified: true,
+				WorkflowRefApprovalSHA:      strings.Repeat("b", 40),
+			}).Error; err != nil {
+				t.Fatalf("seed GitHub config: %v", err)
+			}
+
+			var paths []string
+			withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+				paths = append(paths, req.Method+" "+req.URL.Path)
+				if strings.HasPrefix(req.URL.Path, "/repos/owner/repo/rulesets/") {
+					return testRulesetResponse(req, "workflow-*"), nil
+				}
+				if strings.HasSuffix(req.URL.Path, "/rulesets") {
+					return testRulesetResponse(req, "workflow-*"), nil
+				}
+				if strings.HasSuffix(req.URL.Path, "/git/ref/tags/workflow-v1") {
+					if tc.expectType == "contract" {
+						return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("a", 40)+`","type":"tag"}}`, nil), nil
+					}
+					return githubResponse(tc.status, tc.response, nil), nil
+				}
+				if strings.HasSuffix(req.URL.Path, "/git/tags/"+strings.Repeat("a", 40)) {
+					return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("a", 40)+`","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+				}
+				if strings.HasSuffix(req.URL.Path, "/git/ref/heads/workflow-v1") {
+					return githubResponse(http.StatusNotFound, `{"message":"branch not found"}`, nil), nil
+				}
+				if strings.Contains(req.URL.Path, "/contents/.github/workflows/") {
+					return githubResponse(http.StatusOK, tc.response, nil), nil
+				}
+				return githubResponse(tc.status, tc.response, nil), nil
+			}))
+
+			_, err := (&GithubBuildConfigService{}).PrepareBuild(context.Background(), string(PlatformWindows), "1.2.3")
+			var providerErr *GithubProviderConfigurationError
+			if !errors.As(err, &providerErr) {
+				t.Fatalf("PrepareBuild() error = %T %v, want provider configuration error", err, err)
+			}
+			expectedPaths := []string{"GET /repos/owner/repo/rulesets", "GET /repos/owner/repo/rulesets/1", "GET /repos/owner/repo/git/ref/tags/workflow-v1"}
+			if tc.expectType == "contract" {
+				expectedPaths = append(expectedPaths, "GET /repos/owner/repo/git/tags/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "GET /repos/owner/repo/git/ref/heads/workflow-v1", "GET /repos/owner/repo/contents/.github/workflows/rustqs-windows.yml")
+			}
+			if len(paths) != len(expectedPaths) {
+				t.Fatalf("readiness requests = %v, want %v", paths, expectedPaths)
+			}
+			for i := range expectedPaths {
+				if paths[i] != expectedPaths[i] {
+					t.Fatalf("readiness requests = %v, want %v", paths, expectedPaths)
+				}
+			}
+			switch tc.expectType {
+			case "api":
+				var apiErr *GithubAPIError
+				if !errors.As(err, &apiErr) {
+					t.Fatalf("PrepareBuild() error = %T %v, want wrapped GithubAPIError", err, err)
+				}
+				if apiErr.Retryable != tc.retryable || apiErr.Terminal != tc.terminal {
+					t.Fatalf("provider classification = retryable:%v terminal:%v, want retryable:%v terminal:%v", apiErr.Retryable, apiErr.Terminal, tc.retryable, tc.terminal)
+				}
+			case "contract":
+				var contractErr *GithubContractError
+				if !errors.As(err, &contractErr) || !IsGithubTerminal(err) || IsGithubRetryable(err) {
+					t.Fatalf("PrepareBuild() error = %T %v, want terminal GithubContractError", err, err)
+				}
+			}
+
+			var count int64
+			if err := db.Model(&model.CustomBuild{}).Count(&count).Error; err != nil {
+				t.Fatalf("count builds: %v", err)
+			}
+			if count != 0 {
+				t.Fatalf("workflow readiness failure left %d build row(s)", count)
+			}
+		})
+	}
+}
+
+func TestPrepareBuildAcceptsActiveMappedWorkflowAndPreservesCatalogIdentity(t *testing.T) {
+	resetVersionCatalogCache()
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+		resetVersionCatalogCache()
+	})
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel:                     model.IdModel{Id: 1},
+		Repo:                        "owner/repo",
+		Token:                       "github_pat_test",
+		PayloadKey:                  "payload-key",
+		Branch:                      "refs/tags/workflow-v1",
+		WorkflowRefApproved:         true,
+		WorkflowRefProviderVerified: true,
+		WorkflowRefApprovalSHA:      strings.Repeat("b", 40),
+	}).Error; err != nil {
+		t.Fatalf("seed GitHub config: %v", err)
+	}
+	buildRef := strings.Repeat("a", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo/rulesets":
+			return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+		case "/repos/owner/repo/rulesets/1":
+			return githubResponse(http.StatusOK, testProtectedRulesetResponse("workflow-*"), nil), nil
+		case "/repos/owner/repo/git/ref/tags/workflow-v1":
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("a", 40)+`","type":"tag"}}`, nil), nil
+		case "/repos/owner/repo/git/tags/" + strings.Repeat("a", 40):
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("a", 40)+`","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		case "/repos/owner/repo/contents/.github/workflows/rustqs-windows.yml":
+			if req.URL.Query().Get("ref") != strings.Repeat("b", 40) {
+				t.Fatalf("workflow readiness ref = %q, want immutable workflow SHA", req.URL.Query().Get("ref"))
+			}
+			return githubResponse(http.StatusOK, testWorkflowFileResponse("rustqs-windows.yml"), nil), nil
+		case "/repos/owner/repo/actions/workflows/rustqs-windows.yml":
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		case "/repos/owner/repo/releases":
+			return githubResponse(http.StatusOK, `[{"id":12,"tag_name":"offline-assets-1.2.3"}]`, nil), nil
+		case "/repos/owner/repo/releases/12":
+			return githubResponse(http.StatusOK, testReleaseDetails(12, "offline-assets-1.2.3"), nil), nil
+		case "/repos/owner/repo/git/ref/tags/1.2.3":
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.2.3","object":{"sha":"`+buildRef+`","type":"commit"}}`, nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	prepared, err := (&GithubBuildConfigService{}).PrepareBuild(context.Background(), string(PlatformWindows), "1.2.3")
+	if err != nil {
+		t.Fatalf("PrepareBuild() error = %v", err)
+	}
+	if prepared.Identity.Repo != "owner/repo" || prepared.Identity.BuildRef != buildRef || prepared.Identity.SourceTag != "1.2.3" || prepared.Identity.WorkflowRef != "refs/tags/workflow-v1" || prepared.Identity.WorkflowSHA != strings.Repeat("b", 40) {
+		t.Fatalf("prepared identity = %#v, want catalog-resolved identity", prepared.Identity)
+	}
+}
+
+func TestPreparedConfigSnapshotSurvivesGlobalConfigMutationBeforeDispatch(t *testing.T) {
+	resetVersionCatalogCache()
+	db, sqlDB := newGithubConfigTestDB(t)
+	previousDB := DB
+	DB = db
+	t.Cleanup(func() {
+		DB = previousDB
+		_ = sqlDB.Close()
+		resetVersionCatalogCache()
+	})
+	if err := db.Create(&model.GithubBuildConfig{
+		IdModel:                     model.IdModel{Id: 1},
+		Repo:                        "owner/repo-a",
+		Token:                       "token-a",
+		PayloadKey:                  "payload-a",
+		Branch:                      "refs/tags/workflow-v1",
+		WorkflowRefApproved:         true,
+		WorkflowRefProviderVerified: true,
+		WorkflowRefApprovalSHA:      strings.Repeat("b", 40),
+	}).Error; err != nil {
+		t.Fatalf("seed GitHub config: %v", err)
+	}
+	buildRef := strings.Repeat("a", 40)
+	withGithubTransport(t, githubRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/repos/owner/repo-a/rulesets":
+			return githubResponse(http.StatusOK, testRulesetSummaryResponse(), nil), nil
+		case "/repos/owner/repo-a/rulesets/1":
+			return githubResponse(http.StatusOK, testProtectedRulesetResponse("workflow-*"), nil), nil
+		case "/repos/owner/repo-a/git/ref/tags/workflow-v1":
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/workflow-v1","object":{"sha":"`+strings.Repeat("a", 40)+`","type":"tag"}}`, nil), nil
+		case "/repos/owner/repo-a/git/tags/" + strings.Repeat("a", 40):
+			return githubResponse(http.StatusOK, `{"sha":"`+strings.Repeat("a", 40)+`","object":{"sha":"`+strings.Repeat("b", 40)+`","type":"commit"},"verification":{"verified":true,"reason":"valid"}}`, nil), nil
+		case "/repos/owner/repo-a/contents/.github/workflows/rustqs-windows.yml":
+			if req.URL.Query().Get("ref") != strings.Repeat("b", 40) {
+				t.Fatalf("workflow readiness ref = %q, want immutable workflow SHA", req.URL.Query().Get("ref"))
+			}
+			return githubResponse(http.StatusOK, testWorkflowFileResponse("rustqs-windows.yml"), nil), nil
+		case "/repos/owner/repo-a/actions/workflows/rustqs-windows.yml":
+			return githubResponse(http.StatusOK, testWorkflowStateResponse(), nil), nil
+		case "/repos/owner/repo-a/releases":
+			return githubResponse(http.StatusOK, `[{"id":12,"tag_name":"offline-assets-1.2.3"}]`, nil), nil
+		case "/repos/owner/repo-a/releases/12":
+			return githubResponse(http.StatusOK, testReleaseDetails(12, "offline-assets-1.2.3"), nil), nil
+		case "/repos/owner/repo-a/git/ref/tags/1.2.3":
+			return githubResponse(http.StatusOK, `{"ref":"refs/tags/1.2.3","object":{"sha":"`+buildRef+`","type":"commit"}}`, nil), nil
+		case "/repos/owner/repo-a/actions/workflows/rustqs-windows.yml/dispatches":
+			if req.Header.Get("Authorization") != "Bearer token-a" {
+				return githubResponse(http.StatusBadRequest, `{"message":"dispatch used mutated token"}`, nil), nil
+			}
+			return githubResponse(http.StatusOK, `{"workflow_run_id":12345,"run_url":"https://api.github.com/repos/owner/repo-a/actions/runs/12345","html_url":"https://github.com/owner/repo-a/actions/runs/12345"}`, nil), nil
+		default:
+			return githubResponse(http.StatusNotFound, `{"message":"unexpected endpoint"}`, nil), nil
+		}
+	}))
+
+	prepared, err := (&GithubBuildConfigService{}).PrepareBuild(context.Background(), string(PlatformWindows), "1.2.3")
+	if err != nil {
+		t.Fatalf("PrepareBuild() error = %v", err)
+	}
+	if err := (&GithubBuildConfigService{}).Save(&model.GithubBuildConfig{
+		Repo:       "owner/repo-b",
+		Token:      "token-b",
+		PayloadKey: "payload-b",
+	}); err != nil {
+		t.Fatalf("mutate global GitHub config: %v", err)
+	}
+	if prepared.Config.Repo != "owner/repo-a" || prepared.Config.Token != "token-a" || prepared.Config.PayloadKey != "payload-a" {
+		t.Fatalf("prepared config snapshot changed after global mutation: %#v", prepared.Config)
+	}
+
+	result, err := (&GithubBuildConfigService{}).DispatchBuild(context.Background(), prepared.Config.ProviderConfig(), prepared.Identity, string(PlatformWindows), map[string]any{"key": validRustDeskPublicKey})
+	if err != nil {
+		t.Fatalf("DispatchBuild() error = %v", err)
+	}
+	if result.WorkflowRunID != 12345 {
+		t.Fatalf("DispatchBuild() run id = %d, want exact snapshot dispatch", result.WorkflowRunID)
+	}
+}
+
+func newGithubConfigTestDB(t *testing.T) (*gorm.DB, *sql.DB) {
+	t.Helper()
+	t.Setenv("SECRET_ENCRYPTION_KEY", "focused-test-at-rest-key")
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatalf("get sqlite handle: %v", err)
+	}
+	sqlDB.SetMaxOpenConns(1)
+	if err := db.AutoMigrate(&model.GithubBuildConfig{}, &model.CustomBuild{}); err != nil {
+		t.Fatalf("migrate config test models: %v", err)
+	}
+	return db, sqlDB
+}
+
+func rawGithubConfigSecrets(t *testing.T, db *gorm.DB) (string, string) {
+	t.Helper()
+	var raw struct {
+		Token      string
+		PayloadKey string
+	}
+	if err := db.Table("github_build_configs").Select("token, payload_key").Where("id = ?", 1).Scan(&raw).Error; err != nil {
+		t.Fatalf("read raw config secrets: %v", err)
+	}
+	return raw.Token, raw.PayloadKey
+}
diff --git a/api/utils/secretcrypt.go b/api/utils/secretcrypt.go
index d3727b7..79ca485 100644
--- a/api/utils/secretcrypt.go
+++ b/api/utils/secretcrypt.go
@@ -1,16 +1,18 @@
 package utils
 
 import (
+	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
-	"errors"
+	"encoding/json"
+	"fmt"
 	"io"
 	"os"
 	"strings"
-	"sync"
+	"unicode"
 )
 
 // Шифрование секретов «at rest» (BUGS.md B-008).
@@ -25,31 +27,62 @@ import (
 //   - Зашифрованные значения помечаются префиксом "enc:v1:". DecryptSecret
 //     отдаёт значения без префикса как есть (legacy-плейнтекст), так что старые
 //     строки продолжают читаться, а при следующей записи шифруются.
-//   - Если SECRET_ENCRYPTION_KEY не задан, шифрование выключено (passthrough)
-//     с одноразовым предупреждением — чтобы существующие деплои не падали до
-//     того, как оператор задаст ключ.
+//   - Если SECRET_ENCRYPTION_KEY не задан, новые секреты не записываются:
+//     EncryptSecret возвращает typed configuration error вместо plaintext.
 //   - EncryptSecret идемпотентна: уже-зашифрованное значение возвращается без
 //     изменений (защита от двойного шифрования в GORM-хуках).
 
 const secretEncPrefix = "enc:v1:"
+const SecretEncryptionKeyEnv = "SECRET_ENCRYPTION_KEY"
 
-var (
-	secretKeyOnce sync.Once
-	secretKey     []byte // 32 байта, либо nil если ключ не задан
-	secretKeyWarn sync.Once
-)
+// SecretEncryptionKeyError reports that a new secret cannot be persisted
+// because the canonical at-rest encryption key is not configured.
+type SecretEncryptionKeyError struct{}
+
+func (e *SecretEncryptionKeyError) Error() string {
+	return "secret encryption key is not configured"
+}
 
-func loadSecretKey() {
-	raw := os.Getenv("SECRET_ENCRYPTION_KEY")
+// SecretCiphertextError reports malformed or unauthentic encrypted data
+// without including the ciphertext or plaintext in the error.
+type SecretCiphertextError struct {
+	Cause string
+}
+
+func (e *SecretCiphertextError) Error() string {
+	return "secret ciphertext is invalid: " + e.Cause
+}
+
+// IsEncryptedSecret reports whether stored uses the versioned ciphertext
+// representation. It is intentionally a format check, not a decryption check.
+func IsEncryptedSecret(stored string) bool {
+	return strings.HasPrefix(stored, secretEncPrefix)
+}
+
+func secretKey() ([]byte, error) {
+	raw := os.Getenv(SecretEncryptionKeyEnv)
 	if raw == "" {
-		return
+		return nil, &SecretEncryptionKeyError{}
 	}
 	sum := sha256.Sum256([]byte(raw))
-	secretKey = sum[:]
+	return sum[:], nil
+}
+
+// HasSecretEncryptionKey reports whether the canonical at-rest key is set.
+// It reads the environment on every call so tests and key changes do not
+// depend on a process-global sync.Once cache.
+func HasSecretEncryptionKey() bool {
+	return os.Getenv(SecretEncryptionKeyEnv) != ""
 }
 
-func newGCM() (cipher.AEAD, error) {
-	block, err := aes.NewCipher(secretKey)
+// RequireSecretEncryptionKey fails without revealing any secret value.
+func RequireSecretEncryptionKey() error {
+	_, err := secretKey()
+	return err
+}
+
+func newGCM(key []byte) (cipher.AEAD, error) {
+	block, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
 	}
@@ -58,22 +91,26 @@ func newGCM() (cipher.AEAD, error) {
 
 // EncryptSecret шифрует значение для хранения в БД. Возвращает строку с
 // префиксом "enc:v1:". Пустая строка и уже-зашифрованное значение возвращаются
-// без изменений. Если ключ не задан — возвращает plaintext (шифрование off).
+// без изменений. Для нового непустого plaintext без ключа возвращается ошибка.
 func EncryptSecret(plain string) (string, error) {
-	if plain == "" || strings.HasPrefix(plain, secretEncPrefix) {
+	if plain == "" {
 		return plain, nil
 	}
-	secretKeyOnce.Do(loadSecretKey)
-	if secretKey == nil {
-		secretKeyWarn.Do(func() {
-			// stderr — global.Logger недоступен в utils без цикла импортов.
-			_, _ = os.Stderr.WriteString(
-				"WARNING: SECRET_ENCRYPTION_KEY is not set — secrets (PAT, " +
-					"permanent_password) are stored in plaintext (BUGS.md B-008)\n")
-		})
+	if strings.HasPrefix(plain, secretEncPrefix) {
+		// The prefix is reserved for ciphertext. Validate it with the canonical
+		// key before treating the value as an idempotent write; otherwise an
+		// attacker could persist arbitrary plaintext that merely starts with the
+		// reserved marker.
+		if _, err := DecryptSecret(plain); err != nil {
+			return "", err
+		}
 		return plain, nil
 	}
-	gcm, err := newGCM()
+	key, err := secretKey()
+	if err != nil {
+		return "", err
+	}
+	gcm, err := newGCM(key)
 	if err != nil {
 		return "", err
 	}
@@ -91,25 +128,340 @@ func DecryptSecret(stored string) (string, error) {
 	if !strings.HasPrefix(stored, secretEncPrefix) {
 		return stored, nil
 	}
-	secretKeyOnce.Do(loadSecretKey)
-	if secretKey == nil {
-		return "", errors.New("value is encrypted but SECRET_ENCRYPTION_KEY is not set")
+	key, err := secretKey()
+	if err != nil {
+		return "", fmt.Errorf("decrypt secret: %w", err)
 	}
 	raw, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(stored, secretEncPrefix))
 	if err != nil {
-		return "", err
+		return "", &SecretCiphertextError{Cause: "malformed encoding"}
 	}
-	gcm, err := newGCM()
+	gcm, err := newGCM(key)
 	if err != nil {
 		return "", err
 	}
 	if len(raw) < gcm.NonceSize() {
-		return "", errors.New("ciphertext too short")
+		return "", &SecretCiphertextError{Cause: "ciphertext is too short"}
 	}
 	nonce, ct := raw[:gcm.NonceSize()], raw[gcm.NonceSize():]
 	pt, err := gcm.Open(nil, nonce, ct, nil)
 	if err != nil {
-		return "", err
+		return "", &SecretCiphertextError{Cause: "authentication failed"}
 	}
 	return string(pt), nil
 }
+
+// CustomBuilderJSONContainsSecret identifies the user-authored secret in the
+// typed custom-builder JSON. Invalid JSON is treated conservatively as secret-
+// bearing so a direct model write cannot bypass encryption accidentally.
+func CustomBuilderJSONContainsSecret(value string) bool {
+	if value == "" || IsEncryptedSecret(value) {
+		return false
+	}
+	var decoded any
+	if err := json.Unmarshal([]byte(value), &decoded); err != nil {
+		return true
+	}
+	return customBuilderJSONValueContainsSecret(decoded)
+}
+
+func customBuilderJSONValueContainsSecret(value any) bool {
+	switch value := value.(type) {
+	case map[string]any:
+		for key, nested := range value {
+			if isSecretCustomBuilderKey(key) && !isEmptyJSONValue(nested) {
+				return true
+			}
+			if customBuilderJSONValueContainsSecret(nested) {
+				return true
+			}
+		}
+	case []any:
+		for _, nested := range value {
+			if customBuilderJSONValueContainsSecret(nested) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func isEmptyJSONValue(value any) bool {
+	stringValue, ok := value.(string)
+	return ok && stringValue == ""
+}
+
+// RequireSecretEncryptionForCustomBuilderJSON checks the custom-builder
+// persistence boundary without changing the caller's plaintext representation.
+func RequireSecretEncryptionForCustomBuilderJSON(value string) error {
+	if IsEncryptedSecret(value) {
+		_, err := EncryptSecret(value)
+		return err
+	}
+	if !CustomBuilderJSONContainsSecret(value) {
+		return nil
+	}
+	return RequireSecretEncryptionKey()
+}
+
+// ValidateCustomBuilderJSONFields enforces the canonical persisted custom
+// field boundary for direct model writes. Service normalization remains the
+// primary typed request path; this second boundary prevents a caller that
+// saves a model directly from placing an unknown or neutral field in the
+// database as plaintext. Legacy rows remain readable because this validator is
+// applied only by the save hook.
+func ValidateCustomBuilderJSONFields(value string) error {
+	if value == "" || IsEncryptedSecret(value) {
+		return nil
+	}
+	var decoded map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(value), &decoded); err != nil {
+		return fmt.Errorf("custom builder JSON is invalid: %w", err)
+	}
+	if decoded == nil {
+		return fmt.Errorf("custom builder JSON must be an object")
+	}
+	for key, raw := range decoded {
+		fieldType, ok := canonicalCustomBuilderFieldTypes[key]
+		if !ok {
+			return fmt.Errorf("unsupported custom field %q", key)
+		}
+		if bytes.Equal(bytes.TrimSpace(raw), []byte("null")) {
+			return fmt.Errorf("custom field %q has invalid %s value", key, fieldType)
+		}
+		if fieldType == canonicalCustomBuilderBool {
+			var target bool
+			if err := json.Unmarshal(raw, &target); err != nil {
+				return fmt.Errorf("custom field %q has invalid %s value", key, fieldType)
+			}
+			continue
+		}
+		var target string
+		if err := json.Unmarshal(raw, &target); err != nil {
+			return fmt.Errorf("custom field %q has invalid %s value", key, fieldType)
+		}
+	}
+	return nil
+}
+
+type canonicalCustomBuilderFieldType string
+
+const (
+	canonicalCustomBuilderString canonicalCustomBuilderFieldType = "string"
+	canonicalCustomBuilderBool   canonicalCustomBuilderFieldType = "boolean"
+)
+
+// canonicalCustomBuilderFieldTypes is the storage boundary for new direct
+// model writes. Keep this allowlist exact: response redaction intentionally
+// understands compact legacy names, but accepting those names on write would
+// let aliases or nested values bypass the typed BuildSpec contract.
+var canonicalCustomBuilderFieldTypes = map[string]canonicalCustomBuilderFieldType{
+	"server_ip":                canonicalCustomBuilderString,
+	"key":                      canonicalCustomBuilderString,
+	"api_server":               canonicalCustomBuilderString,
+	"relay_server":             canonicalCustomBuilderString,
+	"direction":                canonicalCustomBuilderString,
+	"permanent_password":       canonicalCustomBuilderString,
+	"pass_approve_mode":        canonicalCustomBuilderString,
+	"theme":                    canonicalCustomBuilderString,
+	"permissions_type":         canonicalCustomBuilderString,
+	"company_name":             canonicalCustomBuilderString,
+	"download_url":             canonicalCustomBuilderString,
+	"android_app_id":           canonicalCustomBuilderString,
+	"app_icon_url":             canonicalCustomBuilderString,
+	"app_logo_url":             canonicalCustomBuilderString,
+	"privacy_screen_url":       canonicalCustomBuilderString,
+	"deny_lan":                 canonicalCustomBuilderBool,
+	"enable_direct_ip":         canonicalCustomBuilderBool,
+	"auto_close":               canonicalCustomBuilderBool,
+	"hide_cm":                  canonicalCustomBuilderBool,
+	"remove_wallpaper":         canonicalCustomBuilderBool,
+	"remove_new_version_notif": canonicalCustomBuilderBool,
+	"cycle_monitor":            canonicalCustomBuilderBool,
+	"x_offline":                canonicalCustomBuilderBool,
+	"enable_remote_modi":       canonicalCustomBuilderBool,
+	"enable_keyboard":          canonicalCustomBuilderBool,
+	"enable_clipboard":         canonicalCustomBuilderBool,
+	"enable_file_transfer":     canonicalCustomBuilderBool,
+	"enable_audio":             canonicalCustomBuilderBool,
+	"enable_tcp":               canonicalCustomBuilderBool,
+	"enable_remote_restart":    canonicalCustomBuilderBool,
+	"enable_recording":         canonicalCustomBuilderBool,
+	"enable_blocking_input":    canonicalCustomBuilderBool,
+	"enable_printer":           canonicalCustomBuilderBool,
+	"enable_camera":            canonicalCustomBuilderBool,
+	"enable_terminal":          canonicalCustomBuilderBool,
+}
+
+// EncryptCustomBuilderJSON encrypts custom_json only when it contains a
+// non-empty secret-bearing field. Empty and non-secret typed records retain
+// their existing representation and remain usable without the at-rest key.
+func EncryptCustomBuilderJSON(value string) (string, error) {
+	if IsEncryptedSecret(value) {
+		return EncryptSecret(value)
+	}
+	if err := ValidateCustomBuilderJSONFields(value); err != nil {
+		return "", err
+	}
+	if err := RequireSecretEncryptionForCustomBuilderJSON(value); err != nil {
+		return "", err
+	}
+	if !CustomBuilderJSONContainsSecret(value) {
+		return value, nil
+	}
+	return EncryptSecret(value)
+}
+
+// RedactCustomBuilderJSON returns the canonical custom-builder settings that
+// are safe for normal API/UI responses. Secret-bearing fields are removed and
+// malformed or ciphertext values are omitted so a response can never become a
+// storage or secret transport boundary.
+func RedactCustomBuilderJSON(value string) string {
+	if value == "" || IsEncryptedSecret(value) {
+		return ""
+	}
+	var decoded any
+	if err := json.Unmarshal([]byte(value), &decoded); err != nil {
+		return ""
+	}
+	if _, ok := decoded.(map[string]any); !ok {
+		return ""
+	}
+	redacted, ok := redactCustomBuilderJSONValue(decoded)
+	if !ok {
+		return ""
+	}
+	encoded, err := json.Marshal(redacted)
+	if err != nil {
+		return ""
+	}
+	return string(encoded)
+}
+
+func redactCustomBuilderJSONValue(value any) (any, bool) {
+	switch value := value.(type) {
+	case map[string]any:
+		for key, nested := range value {
+			compact := compactCustomBuilderKey(key)
+			// Safe/public responses use an allowlist rather than attempting to
+			// prove that an arbitrary legacy value is harmless. Legacy storage
+			// remains readable internally, but unknown keys are omitted here.
+			if !isSafePublicCustomBuilderKey(compact) || isSecretCustomBuilderKey(key) || !isCanonicalPublicCustomBuilderValue(compact, nested) {
+				delete(value, key)
+				continue
+			}
+		}
+		return value, true
+	}
+	return nil, false
+}
+
+// isCanonicalPublicCustomBuilderValue keeps safe responses aligned with the
+// typed BuildSpec contract. A legacy key is public only when its value has the
+// scalar type that the normal form accepts; arrays, objects, and JSON type
+// smuggling are omitted rather than recursively exposed.
+func isCanonicalPublicCustomBuilderValue(key string, value any) bool {
+	if isCanonicalPublicCustomBuilderStringKey(key) {
+		_, ok := value.(string)
+		return ok
+	}
+	if isCanonicalPublicCustomBuilderBoolKey(key) {
+		_, ok := value.(bool)
+		return ok
+	}
+	return false
+}
+
+func isCanonicalPublicCustomBuilderStringKey(key string) bool {
+	switch key {
+	case "server", "serverip", "serverurl", "endpoint", "endpointurl", "idserver", "relayserver", "apiserver", "apiserverurl",
+		"key", "publickey", "publickeyfile", "appname", "companyname", "downloadurl", "androidappid", "appiconurl", "applogourl", "privacyscreenurl",
+		"direction", "passapprovemode", "theme", "permissionstype", "conntype", "accessmode", "approvemode":
+		return true
+	default:
+		return false
+	}
+}
+
+func isCanonicalPublicCustomBuilderBoolKey(key string) bool {
+	switch key {
+	case "denylan", "enabledirectip", "autoclose", "hidecm", "removewallpaper", "removenewversionnotif", "cyclemonitor", "xoffline",
+		"enableremotemodi", "enablekeyboard", "enableclipboard", "enablefiletransfer", "enableaudio", "enabletcp", "enableremoterestart",
+		"enablerecording", "enableblockinginput", "enableprinter", "enablecamera", "enableterminal", "enablelandiscovery", "allowautodisconnect",
+		"allowhidecm", "allowremovewallpaper", "allowremoteconfigmodification", "enabletunnel", "enablerecordsession", "enableblockinput", "enableremoteprinter":
+		return true
+	default:
+		return false
+	}
+}
+
+func isSecretCustomBuilderKey(key string) bool {
+	compact := compactCustomBuilderKey(key)
+	if isExplicitPublicCustomBuilderKey(compact) {
+		return false
+	}
+	return compact == "auth" || compact == "authorization" ||
+		strings.Contains(compact, "auth") ||
+		strings.Contains(compact, "password") ||
+		strings.Contains(compact, "secret") ||
+		strings.Contains(compact, "token") ||
+		strings.Contains(compact, "credential") ||
+		strings.Contains(compact, "private") ||
+		strings.Contains(compact, "ciphertext") ||
+		strings.Contains(compact, "payloadkey") ||
+		strings.Contains(compact, "apikey") ||
+		strings.Contains(compact, "accesskey") ||
+		compact == "pat" || strings.HasSuffix(compact, "pat") ||
+		compact == "encpayload"
+}
+
+func compactCustomBuilderKey(key string) string {
+	return strings.Map(func(char rune) rune {
+		if unicode.IsLetter(char) || unicode.IsDigit(char) {
+			return unicode.ToLower(char)
+		}
+		return -1
+	}, strings.ToLower(strings.TrimSpace(key)))
+}
+
+// isExplicitPublicCustomBuilderKey is deliberately a small allowlist. These
+// names are part of the documented public server/key contract; every other
+// auth-like or credential-like legacy key is redacted conservatively.
+func isExplicitPublicCustomBuilderKey(compact string) bool {
+	if strings.Contains(compact, "auth") || strings.Contains(compact, "token") ||
+		strings.Contains(compact, "secret") || strings.Contains(compact, "private") ||
+		strings.Contains(compact, "password") || strings.Contains(compact, "credential") {
+		return false
+	}
+	switch compact {
+	case "key", "publickey", "publickeyfile", "endpoint", "endpointurl", "server", "serverurl", "serverip", "idserver", "relayserver", "apiserver":
+		return true
+	default:
+		return strings.HasSuffix(compact, "publickey")
+	}
+}
+
+// isSafePublicCustomBuilderKey is the response allowlist for the documented
+// BuildSpec fields and the generated native settings that the UI can display.
+// It intentionally does not include arbitrary legacy keys: omission is safer
+// than exposing a value whose meaning is no longer known.
+func isSafePublicCustomBuilderKey(compact string) bool {
+	if isSecretCustomBuilderKey(compact) {
+		return false
+	}
+	switch compact {
+	case "server", "serverip", "serverurl", "endpoint", "endpointurl", "idserver", "relayserver", "apiserver", "apiserverurl",
+		"key", "publickey", "publickeyfile", "appname",
+		"companyname", "downloadurl", "androidappid", "appiconurl", "applogourl", "privacyscreenurl",
+		"direction", "passapprovemode", "theme", "permissionstype",
+		"denylan", "enabledirectip", "autoclose", "hidecm", "removewallpaper", "removenewversionnotif", "cyclemonitor", "xoffline",
+		"enableremotemodi", "enablekeyboard", "enableclipboard", "enablefiletransfer", "enableaudio", "enabletcp", "enableremoterestart",
+		"enablerecording", "enableblockinginput", "enableprinter", "enablecamera", "enableterminal",
+		"defaultsettings", "overridesettings", "conntype", "enablelandiscovery", "allowautodisconnect", "accessmode", "approvemode",
+		"directserver", "allowhidecm", "verificationmethod", "allowremovewallpaper", "allowremoteconfigmodification", "enabletunnel",
+		"enablerecordsession", "enableblockinput", "enableremoteprinter":
+		return true
+	default:
+		return false
+	}
+}
diff --git a/api/utils/secretcrypt_test.go b/api/utils/secretcrypt_test.go
index 9775617..d2cae0c 100644
--- a/api/utils/secretcrypt_test.go
+++ b/api/utils/secretcrypt_test.go
@@ -1,19 +1,14 @@
 package utils
 
 import (
+	"encoding/json"
+	"errors"
 	"strings"
-	"sync"
 	"testing"
 )
 
-func resetSecretState() {
-	secretKeyOnce = sync.Once{}
-	secretKey = nil
-}
-
 func TestSecretRoundTripWithKey(t *testing.T) {
 	t.Setenv("SECRET_ENCRYPTION_KEY", "unit-test-key-123")
-	resetSecretState()
 
 	plain := "ghp_supersecretPAT_value"
 	enc, err := EncryptSecret(plain)
@@ -40,9 +35,46 @@ func TestSecretRoundTripWithKey(t *testing.T) {
 	}
 }
 
+func TestReservedPrefixPlaintextIsRejected(t *testing.T) {
+	t.Setenv(SecretEncryptionKeyEnv, "reserved-prefix-key")
+	reservedPlaintext := secretEncPrefix + "this-is-not-ciphertext"
+
+	got, err := EncryptSecret(reservedPlaintext)
+	if err == nil {
+		t.Fatal("reserved-prefix plaintext was accepted")
+	}
+	if got != "" {
+		t.Fatalf("reserved-prefix plaintext returned %q", got)
+	}
+	var ciphertextErr *SecretCiphertextError
+	if !errors.As(err, &ciphertextErr) {
+		t.Fatalf("error = %T %v, want SecretCiphertextError", err, err)
+	}
+
+	got, err = EncryptCustomBuilderJSON(reservedPlaintext)
+	if err == nil || got != "" {
+		t.Fatalf("custom JSON reserved-prefix input = %q, %v; want fail closed", got, err)
+	}
+}
+
+func TestReservedPrefixEncryptedValueRemainsIdempotent(t *testing.T) {
+	t.Setenv(SecretEncryptionKeyEnv, "reserved-prefix-key")
+	plain := `{"permanent_password":"secret"}`
+	ciphertext, err := EncryptSecret(plain)
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	got, err := EncryptSecret(ciphertext)
+	if err != nil {
+		t.Fatalf("idempotent encrypt: %v", err)
+	}
+	if got != ciphertext {
+		t.Fatalf("idempotent encrypt changed valid ciphertext")
+	}
+}
+
 func TestEmptyAndLegacyPassthrough(t *testing.T) {
 	t.Setenv("SECRET_ENCRYPTION_KEY", "k")
-	resetSecretState()
 	if v, _ := EncryptSecret(""); v != "" {
 		t.Fatalf("empty should stay empty")
 	}
@@ -52,14 +84,103 @@ func TestEmptyAndLegacyPassthrough(t *testing.T) {
 	}
 }
 
-func TestDisabledWhenKeyUnset(t *testing.T) {
+func TestMissingKeyFailsClosedWithoutPlaintext(t *testing.T) {
 	t.Setenv("SECRET_ENCRYPTION_KEY", "")
-	resetSecretState()
 	enc, err := EncryptSecret("secret")
+	var keyErr *SecretEncryptionKeyError
+	if !errors.As(err, &keyErr) {
+		t.Fatalf("encrypt error = %T %v, want SecretEncryptionKeyError", err, err)
+	}
+	if enc != "" {
+		t.Fatalf("missing key returned plaintext/ciphertext %q", enc)
+	}
+	if HasSecretEncryptionKey() {
+		t.Fatal("HasSecretEncryptionKey() = true with empty canonical key")
+	}
+	t.Setenv("SECRET_CRYPT_KEY", "legacy-alias-must-not-work")
+	if _, err := EncryptSecret("secret"); !errors.As(err, &keyErr) {
+		t.Fatalf("alias unexpectedly enabled encryption: %T %v", err, err)
+	}
+}
+
+func TestEncryptedReadRequiresKeyButLegacyPlaintextDoesNot(t *testing.T) {
+	t.Setenv("SECRET_ENCRYPTION_KEY", "read-key")
+	ciphertext, err := EncryptSecret("legacy-readable")
 	if err != nil {
 		t.Fatalf("encrypt: %v", err)
 	}
-	if enc != "secret" {
-		t.Fatalf("with no key, should passthrough, got %q", enc)
+	t.Setenv("SECRET_ENCRYPTION_KEY", "")
+	if got, err := DecryptSecret("legacy-readable"); err != nil || got != "legacy-readable" {
+		t.Fatalf("legacy plaintext read = %q, %v", got, err)
+	}
+	if _, err := DecryptSecret(ciphertext); err == nil {
+		t.Fatal("encrypted read without key succeeded")
+	}
+}
+
+func TestMalformedAndRotatedCiphertextFailClosed(t *testing.T) {
+	t.Setenv("SECRET_ENCRYPTION_KEY", "original-key")
+	ciphertext, err := EncryptSecret("rotated-secret")
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	if _, err := DecryptSecret(secretEncPrefix + "not-base64"); err == nil {
+		t.Fatal("malformed ciphertext succeeded")
+	}
+	t.Setenv("SECRET_ENCRYPTION_KEY", "rotated-key")
+	if _, err := DecryptSecret(ciphertext); err == nil {
+		t.Fatal("ciphertext decrypted with rotated key")
+	}
+}
+
+func TestCustomBuilderJSONSecretBoundary(t *testing.T) {
+	t.Setenv("SECRET_ENCRYPTION_KEY", "")
+	for _, value := range []string{"", `{}`, `{"enable_audio":true}`} {
+		if err := RequireSecretEncryptionForCustomBuilderJSON(value); err != nil {
+			t.Errorf("non-secret JSON %q rejected without key: %v", value, err)
+		}
+	}
+	if err := RequireSecretEncryptionForCustomBuilderJSON(`{"token":"secret"}`); err == nil {
+		t.Fatal("other secret-bearing JSON accepted without key")
+	}
+	if err := RequireSecretEncryptionForCustomBuilderJSON(`{"permanent_password":"secret"}`); err == nil {
+		t.Fatal("secret JSON accepted without key")
+	}
+	t.Setenv("SECRET_ENCRYPTION_KEY", "custom-json-key")
+	ciphertext, err := EncryptCustomBuilderJSON(`{"permanent_password":"secret"}`)
+	if err != nil || !IsEncryptedSecret(ciphertext) {
+		t.Fatalf("secret JSON encryption = %q, %v", ciphertext, err)
+	}
+}
+
+func TestRedactCustomBuilderJSONCatchesUnknownSecretLikeKeys(t *testing.T) {
+	legacy := `{"endpoint":"https://api.example","server":"id.example:21116","public_key":"public-key","app_name":"RustDesk","enable_audio":true,"API-KEY":"api-secret","accessKey":"access-secret","auth":"auth-secret","authorization":"authorization-secret","AUTH-TOKEN":"token-secret","PAT":"pat-secret","password":"password-secret","legacyCredential":"credential-secret","private-value":"private-secret","misc":"unknown-legacy-value","notes":"unknown-legacy-value"}`
+	redacted := RedactCustomBuilderJSON(legacy)
+	for _, secret := range []string{"api-secret", "access-secret", "auth-secret", "authorization-secret", "token-secret", "pat-secret", "password-secret", "credential-secret", "private-secret", "unknown-legacy-value"} {
+		if strings.Contains(redacted, secret) {
+			t.Fatalf("redacted JSON leaked %q: %s", secret, redacted)
+		}
+	}
+	for _, public := range []string{"https://api.example", "id.example:21116", "public-key", "RustDesk", "enable_audio"} {
+		if !strings.Contains(redacted, public) {
+			t.Fatalf("redacted JSON removed public value %q: %s", public, redacted)
+		}
+	}
+}
+
+func TestRedactCustomBuilderJSONDropsTypeSmuggledPublicFields(t *testing.T) {
+	legacy := `{"endpoint":"https://api.example","server":["id.example:21116"],"public_key":{"value":"public-key"},"app_name":["RustDesk"],"enable_audio":"true","enable_keyboard":false,"theme":{"name":"dark"},"server_url":"https://server.example"}`
+	redacted := RedactCustomBuilderJSON(legacy)
+	var decoded map[string]any
+	if err := json.Unmarshal([]byte(redacted), &decoded); err != nil {
+		t.Fatalf("redacted JSON is invalid: %v", err)
+	}
+	for _, key := range []string{"server", "public_key", "app_name", "enable_audio", "theme"} {
+		if _, ok := decoded[key]; ok {
+			t.Fatalf("type-smuggled public field %q survived redaction: %s", key, redacted)
+		}
+	}
+	if decoded["endpoint"] != "https://api.example" || decoded["server_url"] != "https://server.example" || decoded["enable_keyboard"] != false {
+		t.Fatalf("valid canonical public fields were not preserved: %#v", decoded)
 	}
 }
diff --git a/api/utils/tools.go b/api/utils/tools.go
index 4276b0a..9b072cd 100644
--- a/api/utils/tools.go
+++ b/api/utils/tools.go
@@ -9,17 +9,55 @@ import (
 	"regexp"
 	"runtime/debug"
 	"strings"
+	"unicode"
+	"unicode/utf8"
 )
 
 // VersionRegex ограничивает версию безопасным форматом перед передачей
 // в GitHub Actions dispatch — защита от command injection в shell-командах
 // workflow (echo "VERSION=$RQS_VERSION", download URL и т.п.).
-// Допускает: digits.dots.digits + optional pre-release (например "1.4.8", "1.4.8-beta.1").
-var VersionRegex = regexp.MustCompile(`^[0-9]+\.[0-9]+(\.[0-9]+)?(-[a-zA-Z0-9.]+)?$`)
+// Допускает строгий SemVer core и optional pre-release (например "1.4.8",
+// "1.4.8-beta.1"). Numeric prerelease identifiers may not contain leading
+// zeroes. Build metadata is intentionally excluded because the workflow
+// release/tag contract names assets by the exact version string. The 32-byte
+// limit preserves the existing CustomBuild/CustomPreset storage contract.
+var VersionRegex = regexp.MustCompile(`^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$`)
 
 // ValidateBuildVersion проверяет, что версия подходит для dispatch.
 func ValidateBuildVersion(v string) bool {
-	return VersionRegex.MatchString(v)
+	if v == "" || len(v) > 32 || !utf8.ValidString(v) {
+		return false
+	}
+	for _, char := range v {
+		if unicode.IsControl(char) {
+			return false
+		}
+	}
+	if !VersionRegex.MatchString(v) {
+		return false
+	}
+	_, prerelease, hasPrerelease := strings.Cut(v, "-")
+	if !hasPrerelease {
+		return true
+	}
+	for _, identifier := range strings.Split(prerelease, ".") {
+		if len(identifier) > 1 && identifier[0] == '0' && isASCIIDigits(identifier) {
+			return false
+		}
+	}
+	return true
+}
+
+func isASCIIDigits(value string) bool {
+	if value == "" {
+		return false
+	}
+	for _, char := range value {
+		if char < '0' || char > '9' {
+			return false
+		}
+	}
+	return true
 }
 
 func Md5(str string) string {
@@ -76,7 +114,7 @@ func SafeGo(f interface{}, params ...interface{}) {
 	}()
 }
 
-// RandomString 
+// RandomString
 func RandomString(n int) string {
 	const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 	length := len(letterBytes)
@@ -91,7 +129,7 @@ func RandomString(n int) string {
 	return string(b)
 }
 
-// Keys ，K ，V 
+// Keys ，K ，V
 func Keys[K comparable, V any](m map[K]V) []K {
 	keys := make([]K, 0, len(m))
 	for k := range m {
@@ -100,7 +138,7 @@ func Keys[K comparable, V any](m map[K]V) []K {
 	return keys
 }
 
-// Values ，K ，V 
+// Values ，K ，V
 func Values[K comparable, V any](m map[K]V) []V {
 	values := make([]V, 0, len(m))
 	for _, v := range m {
diff --git a/api/utils/tools_test.go b/api/utils/tools_test.go
new file mode 100644
index 0000000..421de5d
--- /dev/null
+++ b/api/utils/tools_test.go
@@ -0,0 +1,32 @@
+package utils
+
+import "testing"
+
+func TestValidateBuildVersionStrictSemver(t *testing.T) {
+	for _, test := range []struct {
+		name  string
+		value string
+		valid bool
+	}{
+		{name: "release", value: "1.4.8", valid: true},
+		{name: "prerelease", value: "1.4.8-rc.1", valid: true},
+		{name: "numeric prerelease zero", value: "1.4.8-0", valid: true},
+		{name: "zero release", value: "0.0.0", valid: true},
+		{name: "traversal", value: "../../etc", valid: false},
+		{name: "backslash", value: `1.2.3\\out`, valid: false},
+		{name: "control", value: "1.2.3\n", valid: false},
+		{name: "missing patch", value: "1.2", valid: false},
+		{name: "leading zero", value: "01.2.3", valid: false},
+		{name: "leading zero prerelease", value: "1.2.3-01", valid: false},
+		{name: "empty prerelease identifier", value: "1.2.3-rc.", valid: false},
+		{name: "build metadata rejected", value: "1.2.3+build.7", valid: false},
+		{name: "too long for storage", value: "1.2.3-" + "a" + "bcdefghijklmnopqrstuvwxyz012345", valid: false},
+		{name: "shell syntax", value: "1.2.3$(id)", valid: false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := ValidateBuildVersion(test.value); got != test.valid {
+				t.Fatalf("ValidateBuildVersion(%q) = %v, want %v", test.value, got, test.valid)
+			}
+		})
+	}
+}
diff --git a/docker/Dockerfile b/docker/Dockerfile
index bfbdc21..ac8a32f 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -2,25 +2,32 @@
 # Multi-stage build: Rust server + Go API + Web Admin + s6-overlay
 
 # Stage 1: Build Rust server (hbbs, hbbr) with musl for Alpine compatibility
-FROM rust:bookworm AS rust-builder
+# Rust 1.92 is the local pinned toolchain used for the committed lockfile;
+# its locked transitive dependencies declare MSRVs through Rust 1.88.
+FROM rust:1.92.0-bookworm@sha256:e90e846de4124376164ddfbaab4b0774c7bdeef5e738866295e5a90a34a307a2 AS rust-builder
 
 # Map Docker TARGETARCH to the musl Rust target so arm64 builds produce aarch64 binaries
 # (s6-overlay stage already uses this mapping for its own arch selection).
 ARG TARGETARCH=amd64
+# Optional trusted commit timestamp for deterministic Rust build metadata. When
+# omitted, hbb_common emits "unknown" rather than reading the wall clock.
+ARG SOURCE_DATE_EPOCH
 
 RUN apt-get update && apt-get install -y --no-install-recommends musl-tools sqlite3 perl && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build/server
 
-# Copy Cargo files and delete lock to regenerate with compatible versions
+# Copy the manifest and committed lockfile for reproducible dependency resolution.
 COPY server/Cargo.toml ./
+COPY server/Cargo.lock ./
 COPY server/build.rs ./
-COPY libs/hbb_common ./libs/hbb_common
+COPY libs/hbb_common /build/libs/hbb_common
 
 # Create dummy src files for dependency caching
 RUN mkdir -p src && \
     echo 'fn main() {}' > src/main.rs && \
-    echo 'fn main() {}' > src/hbbr.rs
+    echo 'fn main() {}' > src/hbbr.rs && \
+    echo 'fn main() {}' > src/utils.rs
 
 # Build dependencies only (musl target matching TARGETARCH)
 RUN case "${TARGETARCH}" in \
@@ -29,7 +36,8 @@ RUN case "${TARGETARCH}" in \
       *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
     esac && \
     rustup target add ${RUST_TARGET} && \
-    cargo build --release --target ${RUST_TARGET} 2>/dev/null || true
+    if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then export SOURCE_DATE_EPOCH; else unset SOURCE_DATE_EPOCH; fi && \
+      cargo build --locked --release --target ${RUST_TARGET}
 
 # Create dummy SQLite DB for sqlx compile-time query checks
 RUN rm -f /tmp/dummy.db && \
@@ -44,8 +52,9 @@ RUN case "${TARGETARCH}" in \
       amd64) RUST_TARGET=x86_64-unknown-linux-musl ;; \
       arm64) RUST_TARGET=aarch64-unknown-linux-musl ;; \
       *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
-    esac && \
-    rm -f Cargo.lock && cargo build --release --target ${RUST_TARGET} --bin hbbs --bin hbbr --bin rustdesk-utils && \
+     esac && \
+     if [ -n "${SOURCE_DATE_EPOCH:-}" ]; then export SOURCE_DATE_EPOCH; else unset SOURCE_DATE_EPOCH; fi && \
+     cargo build --locked --release --target ${RUST_TARGET} --bin hbbs --bin hbbr --bin rustdesk-utils && \
     # Stage the binaries at arch-independent paths so the final stage can COPY them
     # without re-deriving the musl target. Mirrors what `cargo install` does.
     mkdir -p /build/server/release && \
@@ -54,24 +63,23 @@ RUN case "${TARGETARCH}" in \
     cp /build/server/target/${RUST_TARGET}/release/rustdesk-utils /build/server/release/rustdesk-utils
 
 # Stage 2: Build Go API
-FROM golang:1.23-alpine AS go-builder
+FROM golang:1.25.0-alpine@sha256:f18a072054848d87a8077455f0ac8a25886f2397f88bfdd222d6fafbb5bba440 AS go-builder
+
+ENV GOTOOLCHAIN=local
 
 RUN apk add --no-cache gcc musl-dev
 
 WORKDIR /build/api
 
-# Copy source and generate go.sum
+# Copy source and use the checked-in module lock metadata.
 COPY api ./
-RUN go mod tidy
-
-# Download dependencies
 RUN go mod download
 
 # Build the API binary
 RUN CGO_ENABLED=1 GOOS=linux go build -ldflags "-s -w" -o apimain ./cmd/apimain.go
 
 # Stage 3: Web Admin (Vue 3 + Element Plus) — build from source inside Docker
-FROM node:20-bookworm AS admin-ui-builder
+FROM node:20.20.2-bookworm@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5 AS admin-ui-builder
 WORKDIR /build/admin-ui
 COPY admin-ui/package*.json ./
 RUN npm ci
@@ -79,7 +87,7 @@ COPY admin-ui/ ./
 RUN npm run build
 
 # Stage 4: Install s6-overlay from official GitHub release (no upstream dependency)
-FROM alpine:latest AS s6-stage
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS s6-stage
 
 ARG S6_OVERLAY_VERSION=3.2.3.0
 # s6-overlay arch differs from Docker TARGETARCH naming (x86_64 vs amd64)
@@ -117,7 +125,7 @@ RUN case "${TARGETARCH}" in \
 SHELL ["/bin/sh", "-c"]
 
 # Stage 5: Final image
-FROM alpine
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 ARG BUILDARCH
 ARG VERSION=dev
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 9652303..31eb584 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -11,6 +11,10 @@ services:
     build:
       context: ..
       dockerfile: docker/Dockerfile
+      args:
+        # Pass a trusted commit timestamp for deterministic Rust metadata;
+        # empty keeps the build deterministic with BUILD_DATE=unknown.
+        SOURCE_DATE_EPOCH: ${SOURCE_DATE_EPOCH:-}
     ports:
       - 21114:21114
       - 21115:21115
@@ -29,6 +33,7 @@ services:
       - RUSTDESK_API_RUSTDESK_WS_HOST=ws://localhost:21118
       - RUSTDESK_API_KEY_FILE=/data/id_ed25519.pub
       - RUSTDESK_API_JWT_KEY=your-secret-jwt-key-change-this
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-}
     volumes:
       - ../data/server:/data
       - ../data/api:/app/data
@@ -37,12 +42,11 @@ services:
       - rustdesk-net
     restart: unless-stopped
 
-  # Сборочные агенты — frozen fallback (PLAN.md §3, §8.7). Активный путь сейчас
-  # GitHub Actions (Windows x64) через github_build_config. Эти контейнеры
-  # стартуют только с `--profile fallback`, обычный `docker compose up` их
-  # не поднимает. Linux/Android агент будет вытеснен GitHub-воркфлоу (§8.14).
-  # MinGW build-win — абандон (§9), оставлен как историческая ссылка до §8.7
-  # cleanup.
+  # Manual/historical builders only (PLAN.md §3). The active path is provider-backed
+  # workflow dispatch for the admitted Windows capability. These containers require
+  # `--profile fallback` and are not started by ordinary `docker compose up`.
+  # Linux/Android workflow mappings remain disabled until PR11 live evidence closes.
+  # MinGW build-win is legacy material retained for historical reference.
   build-linux:
     profiles: ["fallback"]
     build:
diff --git a/docs/UPSTREAM_DEPENDENCY_REMOVAL.md b/docs/UPSTREAM_DEPENDENCY_REMOVAL.md
index c18f01d..84a4643 100644
--- a/docs/UPSTREAM_DEPENDENCY_REMOVAL.md
+++ b/docs/UPSTREAM_DEPENDENCY_REMOVAL.md
@@ -2,7 +2,7 @@
 
 ## Problem
 
-In `docker/Dockerfile:62`:
+The previous implementation in `docker/Dockerfile` used:
 ```dockerfile
 FROM rustdesk/rustdesk-server-s6:latest AS s6-source
 ```
@@ -75,7 +75,7 @@ Without it: 3 separate containers or custom bash supervisor.
 **New Stage 4 (s6-stage) — as implemented in `docker/Dockerfile`:**
 ```dockerfile
 # Stage 4: Install s6-overlay from official GitHub release (no upstream dependency)
-FROM alpine:latest AS s6-stage
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS s6-stage
 
 ARG S6_OVERLAY_VERSION=3.2.3.0
 # s6-overlay arch differs from Docker TARGETARCH naming (x86_64 vs amd64)
@@ -186,15 +186,16 @@ Add `# DEPRECATED` comment or delete.
 
 ## Pinned Versions
 
-Only the s6-overlay release is pinned (by version tag and SHA-256 checksums).
-The base images (`rust:bookworm`, `alpine:latest`) are mutable tags and are
-**not** pinned — they can resolve to different images on later builds.
+Production base images are pinned by both version and digest. The s6-overlay
+release is pinned by version tag and SHA-256 checksums.
 
 | Component | Version | Where |
 |-----------|---------|-------|
 | s6-overlay | 3.2.3.0 | `ARG S6_OVERLAY_VERSION=3.2.3.0` + `S6_*_SHA256` checksums in Dockerfile |
-| rust (base image) | bookworm (mutable tag, not pinned) | Stage 1 base image |
-| alpine (base image) | latest (mutable tag, not pinned) | Stage 4/5 base images |
+| rust (base image) | `1.92.0-bookworm@sha256:e90e846de4124376164ddfbaab4b0774c7bdeef5e738866295e5a90a34a307a2` | Stage 1 base image |
+| golang (base image) | `1.25.0-alpine@sha256:f18a072054848d87a8077455f0ac8a25886f2397f88bfdd222d6fafbb5bba440` | Stage 2 base image |
+| node (base image) | `20.20.2-bookworm@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5` | Stage 3 base image |
+| alpine (base image) | `3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` | Stage 4/5 base images |
 
 ---
 
@@ -261,4 +262,4 @@ docker compose logs -f
 1. **Remove `rustdesk/rustdesk-server-s6` locally**: `docker rmi rustdesk/rustdesk-server-s6:latest`
 2. **Delete `api/Dockerfile_full_s6`** entirely (currently commented)
 3. **Update `.env.example`** — remove any upstream references
-4. **Add to CI** — verify build doesn't pull upstream
\ No newline at end of file
+4. **CI coverage** — the production Dockerfile is now covered by CI
diff --git a/github-build/README.md b/github-build/README.md
index 90cc9ae..3db9f5c 100644
--- a/github-build/README.md
+++ b/github-build/README.md
@@ -1,161 +1,163 @@
-# github-build — active build path via GitHub Actions
+# github-build — reference/docs for fork workflows
 
-All platforms (Windows, Linux, Android) are built through GitHub Actions in the
-`bashrusakh/rustdesk` fork. DeskForge workflow files are deployed to three
-branches:
+All executable client-build workflows live in the configured RustDesk fork.
+This directory is reference and documentation only; it is not an executable
+workflow source and does not contain deployable workflow copies.
 
-| Branch                | Purpose                                                          |
-| --------------------- | ---------------------------------------------------------------- |
-| `master`                | Default branch — API discovery (workflow must exist here)        |
-| `rustqs/min-test`       | Execution — all dispatches go here                               |
-| `rustqs/master-workflows` | Mirror — backup copy of workflow files, kept in sync with `master` |
+The API dispatches the application-owned platform workflow in the configured
+RustDesk fork. The fork's branch/ref and workflow files are provider-side
+execution details; this directory does not define or deploy them.
+
+The dispatch contract under test sends `return_run_details=true` and accepts only
+an exact HTTP 200 run-details response containing the provider run identity. Standard
+204 is intentionally unsupported because it does not provide an accepted exact run
+correlation. Local fake-transport/static checks cover this contract; no normal GitHub
+dispatch, poll, or download operation is verified.
 
-Each local workflow file in this directory has the same filename as its target
-in the fork's `.github/workflows/` (identical names, no rename needed).
+The API's current application-owned execution selector defaults to
+`rustqs/workflows`; the configured provider repository resolves the selector and
+workflow SHA. The following branch labels describe the configured fork's roles;
+they are not a claim that synchronized copies or a live provider run currently exist:
 
-| Platform | File                                    | Target in fork                                    | Status          |
-| -------- | --------------------------------------- | ------------------------------------------------- | --------------- |
-| Windows  | `github-build/rustqs-windows-min-test.yml` | `.github/workflows/rustqs-windows-min-test.yml`   | ✅ active       |
-| Linux    | `github-build/rustqs-linux.yml`            | `.github/workflows/rustqs-linux.yml`              | ✅ active       |
-| Android  | `github-build/rustqs-android.yml`          | `.github/workflows/rustqs-android.yml`            | ✅ active       |
+| Branch                | Purpose                                                          |
+| --------------------- | ---------------------------------------------------------------- |
+| `master`                | Fork default branch                                             |
+| `rustqs/workflows`      | Current default workflow execution ref                          |
+| `rustqs/master-workflows` | Fork-maintained workflow mirror/reference ref                  |
+
+| Platform | Executable workflow in fork                           | Status    |
+| -------- | ----------------------------------------------------- | --------- |
+| Windows  | `.github/workflows/rustqs-windows.yml`               | 🟡 API-enabled; live evidence pending |
+| Linux    | `.github/workflows/rustqs-linux.yml`                  | 🟡 API capability-gated |
+| Android  | `.github/workflows/rustqs-android.yml`                | 🟡 API capability-gated |
+
+> **Current-state note (2026-08-10):** Windows is the only platform admitted by the
+> API production capability gate. Linux and Android mappings exist but remain gated
+> until PR11 records end-to-end provider, artifact, embedding, and download evidence.
+> Workflow manifests, bridge/helper source, Android app-ID/runtime-path checks, and
+> package assertions are static implementation evidence only; capabilities remain disabled.
+> No live provider run or clean-environment build proof is recorded here.
 
 ---
 
 ## Architecture
 
-All dispatches go to the `rustqs/min-test` branch of the fork (the Go code
-forces this branch in `tryGithubDispatch` regardless of per-install config).
+The API maps the selected platform to an owned workflow in the configured
+RustDesk fork and dispatches it with an encrypted payload. The provider returns
+the exact run identity, which the API stores and uses for subsequent polling.
+The stored run and artifact identities are required; the API does not select a sole
+artifact or infer a path from a provider response.
 
 ```text
-admin-ui → Go API → workflow_dispatch (encrypted payload, ref=rustqs/min-test) →
-  GitHub Actions [rustdesk fork, rustqs/min-test branch] →
+admin-ui → Go API → workflow_dispatch (encrypted payload, owned fork workflow) →
+  GitHub Actions [configured RustDesk fork] →
     L1 config.rs (server+key) → L2 custom_.txt (permanent password) → L3 branding →
-    artifact → POST /api/save_custom_client → your server → admin-ui Download
+    provider run ← Go API polls provider status →
+    provider artifact API → Go API validates/extracts/publishes locally → admin-ui Download
 ```
 
 ### Version flow
 
-The `version` field in the admin UI is **not just metadata** — it is passed
-in the encrypted payload to the workflow and used as `VERSION` env var for
-downloading offline build assets (flutter engine, usbmmidd, printer drivers).
+The `version` field in the admin UI is **not just metadata** — it is resolved
+from the configured provider repository, passed in the encrypted payload, and
+used by the owned workflow for its matching build assets.
 
 - Admin UI loads available versions from `GET /api/admin/custom_build/versions`
-- This endpoint queries GitHub releases of `bashrusakh/rustdesk` for tags
-  `offline-assets-*` and returns only versions that have assets published
-- If GitHub API is unavailable, falls back to `['1.4.8', '1.4.7']`
+- The API queries the configured repository for matching `offline-assets-*`
+  releases, checks the provider-reported matching source tag and required asset metadata,
+  and exposes only the resulting display versions. Independent source/asset provenance
+  verification remains a separate gate.
+- If the provider catalog is unavailable, the API returns an empty/error state;
+  there is no hardcoded repository or obsolete version fallback
 - The version list is cached for ~5 minutes; a newly published release may
   take a few minutes to appear in the dropdown
-- The workflow decrypts `version` from `enc_payload` and overrides `VERSION`
-  env (takes precedence over the workflow-level default `'1.4.8'`)
+- The workflow receives the resolved version in `enc_payload`; the API does not
+  accept a separate raw/manual version identity from the normal build flow
+- Active fork workflows accept only the authenticated `DFP1` `enc_payload` input.
+  Direct/manual runs without a valid payload fail closed before checkout/build;
+  they are non-build diagnostics, not a public-debug or fixed-asset fallback.
+- The authenticated payload binds the configured workflow repository to
+  `github.repository`, so self-hosted forks remain supported without a hardcoded
+  owner/name. GitHub still receives the required branch/tag selector; exact
+  workflow contents readiness and run `head_sha` checks use the resolved SHA.
+
+### Provider identity and asset contract
+
+The provider supplies the source-tree/ref/commit identity, recursive submodule commits,
+workflow identity, release identity, and asset metadata. This directory reports those
+values; it does not independently verify them unless a separately trusted source proves
+the expected value. A URL, provider-reported digest, local presence, or first-seen hash is
+not by itself authenticity or release evidence. The listed asset names and digest fields
+are a provider/project contract under test, not evidence that normal GitHub operation has
+been verified.
+
+The authenticated handoff must carry the exact required asset names and their expected
+SHA-256 digests. The current required asset-name contract is:
+
+- `windows-x64-release.zip`
+- `usbmmidd_v2.zip`
+- `rustdesk_printer_driver_v4-1.4.zip`
+- `printer_driver_adapter.zip`
+
+Missing names, missing digests, changed content, or unavailable source/submodule identity
+must fail closed rather than being inferred from a provider listing.
+
+### Reusable workflow details
+
+Reusable workflow behavior, including any bridge workflow, is defined in the
+RustDesk fork. The `rdgen` copy is reference material only and is not copied or
+deployed by the current DeskForge path.
+
+The provider artifact is downloaded through the provider API, then validated,
+extracted, and published in local API storage. It is not sent to the API by a
+runner callback and is not published to a public release. Frozen local file-queue
+builders are manual/historical-only material, not a production fallback for this path.
+
+Active fork uploads use the focused workflow retention contract (`retention-days: 7`
+and fail-closed missing-file handling). That provider retention is not a completed
+output TTL, release-retention policy, or release publication claim. The service-owned
+handoff records exact source/workflow/run/artifact identity, output names, sizes,
+hashes, and its publication digest; private `custom_.txt` content is not exported. A public
+download may contain only a redacted `custom_.txt`; raw/private handoff contents, payload keys,
+PATs, and other internal secret-bearing values are excluded.
+These records are integrity/provenance metadata, not signatures or attestations.
 
-### bridge.yml
-
-`bridge.yml` follows the upstream pattern:
-- **No `inputs.version`** — bridge and build work from the same fork code
-- Checkout is **without `repository:`** — uses the current repo (fork)
-- Matrix has 2 jobs: default (Flutter 3.22.3) and Windows arm64 (Flutter 3.44)
-
-Binary is NOT published to public releases — only to your server.
 Credentials — encrypted payload, decrypted inside the runner via GitHub Secret.
 
 ---
 
-## Workflow layers
-
-| Layer | Path (in rustdesk fork)                                        | Role                                          |
-| ----- | --------------------------------------------------------------- | --------------------------------------------- |
-| 1a    | `rustqs/min-test/.github/workflows/rustqs-windows-min-test.yml` | ✅ Windows x64 (active)                       |
-| 1b    | `rustqs/min-test/.github/workflows/rustqs-linux.yml`            | ✅ Linux x64 (active)                        |
-| 1c    | `rustqs/min-test/.github/workflows/rustqs-android.yml`          | ✅ Android arm64 (active)                      |
-| 2     | `rustqs/min-test/.github/workflows/bridge.yml`                  | reusable workflow (from upstream 1.4.7)       |
-| 3     | `rustqs/min-test/.github/workflows/third-party-RustDeskTempTopMostWindow.yml` | TopMost build   |
-| 4     | `DeskForge/github-build/`                                       | local copies for code review                  |
-| 5     | `DeskForge/rdgen/.github/workflows/*.yml`                       | vendored upstream rdgen reference             |
-
-**Rule:** change build logic → edit in fork (layer 1), then update local copy (layer 4).
-
----
-
-## Workflow deployment — pushing to the fork
-
-Workflow files are deployed to all three branches of `bashrusakh/rustdesk`:
-
-- `master` — API discovery (must exist on default branch)
-- `rustqs/min-test` — execution (all dispatches go here)
-- `rustqs/master-workflows` — mirror of `master`
-
-> **NOTE:** `rustqs-linux.yml` and `rustqs-android.yml` will not be found by
-> the workflow_dispatch API unless they exist on the default branch (`master`).
-
-```bash
-cd /path/to/rustdesk-fork
-# 1) Push to master first (API discovery)
-git checkout master
-cp /path/to/DeskForge/github-build/rustqs-*.yml .github/workflows/
-cp /path/to/DeskForge/rdgen/.github/workflows/bridge.yml .github/workflows/
-git add .github/workflows/
-git commit -m "feat: update rustqs-* workflows"
-git push origin master
-
-# 2) Then push to rustqs/master-workflows (mirror)
-git checkout rustqs/master-workflows
-cp /path/to/DeskForge/github-build/rustqs-*.yml .github/workflows/
-cp /path/to/DeskForge/rdgen/.github/workflows/bridge.yml .github/workflows/
-git add .github/workflows/
-git commit -m "feat: update rustqs-* workflows"
-git push origin rustqs/master-workflows
-
-# 3) Then push to rustqs/min-test (execution)
-git checkout rustqs/min-test
-cp /path/to/DeskForge/github-build/rustqs-*.yml .github/workflows/
-cp /path/to/DeskForge/rdgen/.github/workflows/bridge.yml .github/workflows/
-git add .github/workflows/
-git commit -m "feat: update rustqs-* workflows"
-git push origin rustqs/min-test
-```
+## Workflow ownership
 
-If a workflow file is missing from the fork, dispatch immediately fails with HTTP 404.
-`bridge.yml` is required by all three `rustqs-*.yml` files — without it the workflow
-run fails with a parse error (422).
-
-> DeskForge workflow files live on all three branches: `master`, `rustqs/master-workflows`, and `rustqs/min-test`.
+- The rustdesk fork's `.github/workflows/` files are the sole executable source.
+- `github-build/` contains reference/documentation material only; it is not a
+  second workflow source or a deployment copy.
+- The vendored `rdgen` workflows are historical/reference material and must not
+  be copied into the active fork workflows.
+- Change active build logic in the rustdesk fork. Keep this README aligned with
+  the fork's actual workflow ownership and behavior.
+- A protected branch or immutable workflow tag remains an unclosed deployment gate.
+  A mutable branch selector is preserved for GitHub's dispatch API but is not claimed
+  to be immutable by the API. No release, signature, attestation, or readiness claim
+  follows from workflow-file presence or local focused checks.
 
 ---
 
 ## Security (REQUIRED for a public fork)
 
-- `enc_payload` — AES-256-CBC + PBKDF2, key `WORKFLOW_PAYLOAD_KEY` in GitHub Secrets.
-- `GENURL` — your server URL (where to send the binary).
-- `ZIP_PASSWORD` — password to encrypt config inside the workflow.
+- `enc_payload` — authenticated `DFP1` AES-256-CBC + PBKDF2 + HMAC envelope, with
+  `WORKFLOW_PAYLOAD_KEY` in GitHub Secrets.
 - `RS_PUB_KEY` is a public key, not a secret.
 - `SetWorkflowSecret` — button in admin UI (`Push to GitHub Secrets`) via `nacl/box.SealAnonymous`.
 
 ---
 
-## When a new upstream version ships
-
-Workflow files live on `rustqs/min-test` (execution), `master` (API discovery),
-and `rustqs/master-workflows` (mirror). `master` is synced with upstream
-except for the workflow manifests that must exist there for API discovery.
-
-1. **Fork sync** → `git fetch upstream --tags && git push origin v1.5.0`
-2. **Repoint submodule** → `.gitmodules` → `bashrusakh/hbb_common`
-3. **Vendor** → `cargo vendor && git add vendor`
-4. **Update `rustqs/min-test` branch** → `git checkout rustqs/min-test && git rebase v1.5.0`
-5. **Update workflows:** diff upstream with `rustqs-*.yml`
-6. **Test** → `gh workflow run rustqs-windows-min-test.yml --ref rustqs/min-test`
-
-Detailed: [PLAN.md §7](../PLAN.md#7-workflow-new-upstream-rustdesk-client-release).
-
----
-
-## Sync rules
+## Upstream updates
 
-1. **Build logic changes go to the fork first** (layer 1), then copy to `github-build/` (layer 4).
-2. `rdgen/.github/workflows/*` (layer 5) — vendored reference, **do not edit by hand**.
-3. Action version bumps (`@v4 → @v7`) — independently per layer. In fork — SHA-pinned.
-4. When min-test is stable → switch to full `generator-windows.yml` (msi, signing).
+Follow
+[PLAN.md §7](../PLAN.md#7-historical-fork-maintenance-notes-for-a-new-upstream-rustdesk-client-release)
+for the upstream release process. Active workflow changes belong in the rustdesk
+fork; this directory remains reference/documentation only.
 
-### Fork bump log
+### Historical fork bump log
 
 - 2026-06-13: `setup-msbuild` v2→v3, `upload-artifact` → SHA-pinned v7.
diff --git a/github-build/rustqs-android.yml b/github-build/rustqs-android.yml
deleted file mode 100755
index 7bd58b9..0000000
--- a/github-build/rustqs-android.yml
+++ /dev/null
@@ -1,327 +0,0 @@
-name: rustqs android min test
-# ============================================================================
-# DRAFT (B-012) — НЕ ВАЛИДИРОВАН РЕАЛЬНЫМ ПРОГОНОМ GITHUB ACTIONS.
-# Перенос generator-android.yml в контракт форка (enc_payload + L1/L2/L3), по
-# образцу github-build/rustqs-windows-min-test.yml / rustqs-linux.yml. Сборка одной
-# ABI (arm64-v8a) для min-test. Build-шаги (NDK/cargo-ndk/flutter build apk/пути)
-# требуют доводки на реальных прогонах. Бэкенд диспетчит platform=android сюда и
-# забирает артефакт `rustdesk-min-test-android`.
-#
-# Контракт параметров идентичен windows/linux:
-#   enc_payload = base64(openssl aes-256-cbc -pbkdf2 -pass pass:$WORKFLOW_PAYLOAD_KEY)
-#                 от JSON {server,key,app_name,custom_txt}; либо открытые inputs (debug).
-#
-# ОГРАНИЧЕНИЕ ЧЕРНОВИКА: способ вшивания custom_.txt в Android-клиент отличается от
-# desktop (assets/flutter), здесь сделано best-effort и требует проверки.
-#
-# Путь в форке: .github/workflows/rustqs-android.yml на ветке rustqs/min-test.
-# ============================================================================
-
-on:
-  workflow_dispatch:
-    inputs:
-      enc_payload:
-        description: 'Encrypted payload (base64 openssl aes-256-cbc -pbkdf2). Overrides open inputs below.'
-        required: false
-        type: string
-        default: ''
-      server:
-        description: '[Debug] RustDesk server (rendezvous host:port). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      key:
-        description: '[Debug] RustDesk server public key (base64). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      app_name:
-        description: '[Debug] Brand name. Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      custom_txt:
-        description: '[Debug] Base64 custom_.txt payload. Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      version:
-        description: 'RustDesk version for offline assets (e.g. 1.4.8). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: '1.4.8'
-
-env:
-  RUST_VERSION: "1.75"
-  FLUTTER_VERSION: "3.24.5"
-  CARGO_NDK_VERSION: "3.1.2"
-  NDK_VERSION: "r28c"
-  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
-  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-  VERSION: "${{ inputs.version || '1.4.8' }}"
-
-jobs:
-  bridge:
-    uses: ./.github/workflows/bridge.yml
-
-  build:
-    needs: [bridge]
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
-        with:
-          tool-cache: false
-          android: false
-          dotnet: true
-          haskell: true
-          large-packages: false
-          docker-images: true
-          swap-storage: false
-
-      - name: Export GitHub Actions cache environment variables
-        uses: actions/github-script@v9
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-               clang \
-               cmake \
-               curl \
-               gcc-multilib \
-               git \
-               g++ \
-               g++-multilib \
-               libayatana-appindicator3-dev \
-               libasound2-dev \
-               libc6-dev \
-               libclang-dev \
-               libunwind-dev \
-               libgstreamer1.0-dev \
-               libgstreamer-plugins-base1.0-dev \
-               libgtk-3-dev \
-               libpam0g-dev \
-               libpulse-dev \
-               libva-dev \
-               libxcb-randr0-dev \
-               libxcb-shape0-dev \
-               libxcb-xfixes0-dev \
-               libxdo-dev \
-               libxfixes-dev \
-               llvm-dev \
-               nasm \
-               ninja-build \
-               openjdk-17-jdk-headless \
-               pkg-config \
-               tree \
-               wget
-
-      - name: Checkout source code
-        uses: actions/checkout@v7
-        with:
-          submodules: recursive
-
-      # Разрешение параметров (идентично windows/linux): enc_payload (prod) или open inputs.
-      - name: 'Resolve build config (decrypt or pass-through)'
-        shell: bash
-        env:
-          ENC: ${{ inputs.enc_payload }}
-          PAYLOAD_KEY: ${{ secrets.WORKFLOW_PAYLOAD_KEY }}
-          IN_SERVER: ${{ inputs.server }}
-          IN_KEY: ${{ inputs.key }}
-          IN_APP: ${{ inputs.app_name }}
-          IN_CT: ${{ inputs.custom_txt }}
-          IN_VERSION: ${{ inputs.version }}
-        run: |
-          set -eu
-          if [ -n "${ENC:-}" ]; then
-            if [ -z "${PAYLOAD_KEY:-}" ]; then
-              echo "::error::enc_payload provided but secret WORKFLOW_PAYLOAD_KEY is not set in this repo"
-              exit 1
-            fi
-            decrypted=$(printf '%s' "$ENC" | base64 -d \
-              | openssl enc -d -aes-256-cbc -pbkdf2 -pass "pass:${PAYLOAD_KEY}")
-            RQS_SERVER=$(printf '%s' "$decrypted" | jq -r '.server // ""')
-            RQS_KEY=$(printf '%s' "$decrypted" | jq -r '.key // ""')
-            RQS_APP=$(printf '%s' "$decrypted" | jq -r '.app_name // ""')
-            RQS_CT=$(printf '%s' "$decrypted" | jq -r '.custom_txt // ""')
-            RQS_VERSION=$(printf '%s' "$decrypted" | jq -r '.version // ""')
-          else
-            RQS_SERVER="${IN_SERVER:-}"; RQS_KEY="${IN_KEY:-}"; RQS_APP="${IN_APP:-}"; RQS_CT="${IN_CT:-}"; RQS_VERSION="${IN_VERSION:-}"
-          fi
-          for v in "$RQS_KEY" "$RQS_CT"; do [ -n "$v" ] && echo "::add-mask::$v" || true; done
-          {
-            echo "RQS_SERVER=$RQS_SERVER"
-            echo "RQS_KEY=$RQS_KEY"
-            echo "RQS_APP_NAME=$RQS_APP"
-            echo "RQS_CUSTOM_TXT=$RQS_CT"
-            echo "RQS_VERSION=$RQS_VERSION"
-          } >> "$GITHUB_ENV"
-
-      # Override VERSION from encrypted payload (takes precedence over workflow-level default).
-      - name: 'Override VERSION from dispatch payload'
-        if: env.RQS_VERSION != ''
-        shell: bash
-        run: |
-          echo "VERSION=$RQS_VERSION" >> "$GITHUB_ENV"
-          echo "VERSION overridden from dispatch: $RQS_VERSION"
-
-      # L1: server+key в config.rs (платформо-независимо).
-      - name: 'L1 inject: server + key into hbb_common/config.rs'
-        if: env.RQS_SERVER != '' || env.RQS_KEY != ''
-        shell: bash
-        run: |
-          set -eu
-          f=libs/hbb_common/src/config.rs
-          if [ -n "${RQS_SERVER:-}" ]; then
-            esc=$(printf '%s' "$RQS_SERVER" | sed -e 's/[\/&]/\\&/g')
-            sed -i "s/rs-ny\.rustdesk\.com/${esc}/" "$f"
-            grep -F -q -- "$RQS_SERVER" "$f" || { echo "L1: server marker not found"; exit 1; }
-          fi
-          if [ -n "${RQS_KEY:-}" ]; then
-            esc=$(printf '%s' "$RQS_KEY" | sed -e 's/[\/&]/\\&/g')
-            sed -i "s|OeVuKk5nlHiXp+APNn0Y3pC1Iwpwn44JGqrQCsWqmBw=|${esc}|" "$f"
-            grep -F -q -- "$RQS_KEY" "$f" || { echo "L1: key marker not found"; exit 1; }
-          fi
-
-      # L2: allowCustom (платформо-независимо).
-      - name: 'L2 patch: allowCustom'
-        if: env.RQS_CUSTOM_TXT != ''
-        shell: bash
-        run: |
-          set -eu
-          python3 .github/patches/rdgen-allowCustom.py
-          if grep -q '5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM=' src/common.rs; then
-            echo "L2: allowCustom FAILED"; exit 1
-          fi
-
-      # L3: брендинг (Cargo.toml + lang).
-      - name: 'L3 brand: rename RustDesk → app_name'
-        if: env.RQS_APP_NAME != ''
-        shell: bash
-        run: |
-          set -eu
-          esc=$(printf '%s' "$RQS_APP_NAME" | sed -e 's/[\/&]/\\&/g')
-          sed -i -e "s|description = \"RustDesk Remote Desktop\"|description = \"${esc}\"|" Cargo.toml
-          find ./src/lang -name "*.rs" -exec sed -i -e "s|RustDesk|${esc}|" {} \;
-
-      # L2 payload (best-effort для Android — требует проверки): кладём custom_.txt в
-      # flutter assets, чтобы клиент мог его прочитать после установки.
-      - name: 'L2 payload: place custom_.txt into flutter assets'
-        if: env.RQS_CUSTOM_TXT != ''
-        shell: bash
-        run: |
-          set -eu
-          mkdir -p flutter/assets
-          printf '%s' "$RQS_CUSTOM_TXT" > flutter/assets/custom_.txt
-          ls -la flutter/assets/custom_.txt
-
-      - name: Install flutter
-        uses: subosito/flutter-action@v2.12.0
-        with:
-          channel: "stable"
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-
-      - name: Setup Android NDK
-        id: setup-ndk
-        uses: nttld/setup-ndk@v1
-        with:
-          ndk-version: ${{ env.NDK_VERSION }}
-          add-to-path: true
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@v1
-        with:
-          toolchain: ${{ env.RUST_VERSION }}
-          targets: aarch64-linux-android
-          components: "rustfmt"
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: android-arm64
-
-      - name: Restore bridge files
-        uses: actions/download-artifact@v8
-        with:
-          name: bridge-artifact
-          path: ./
-
-      - name: Setup vcpkg with Github Actions binary cache
-        uses: lukka/run-vcpkg@v11
-        with:
-          vcpkgDirectory: /opt/artifacts/vcpkg
-          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
-          doNotCache: false
-
-      - name: Install vcpkg dependencies (opus, vpx, ffmpeg, etc.) for Android arm64
-        env:
-          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
-          ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
-          VCPKG_ROOT: /opt/artifacts/vcpkg
-        run: |
-          ./flutter/build_android_deps.sh arm64-v8a
-
-      - name: Build rustdesk native lib (via ndk_arm64.sh)
-        env:
-          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
-          ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
-          VCPKG_ROOT: /opt/artifacts/vcpkg
-        run: |
-          set -euo pipefail
-          cargo install cargo-ndk --version ${{ env.CARGO_NDK_VERSION }} --locked
-          ./flutter/ndk_arm64.sh
-          # Verify native lib was built before copying
-          if [ ! -f ./target/aarch64-linux-android/release/liblibrustdesk.so ]; then
-            echo "::error::librustdesk.so not found after cargo ndk build"
-            find ./target/aarch64-linux-android/release -name '*.so' 2>/dev/null || true
-            exit 1
-          fi
-          # Copy native lib from target to jniLibs
-          mkdir -p ./flutter/android/app/src/main/jniLibs/arm64-v8a
-          cp ./target/aarch64-linux-android/release/liblibrustdesk.so \
-             ./flutter/android/app/src/main/jniLibs/arm64-v8a/librustdesk.so
-          # Copy libc++_shared.so from NDK sysroot
-          cp "${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/libc++_shared.so" \
-             ./flutter/android/app/src/main/jniLibs/arm64-v8a/
-          ls -lh ./flutter/android/app/src/main/jniLibs/arm64-v8a/
-
-      - name: Build APK (flutter, arm64)
-        shell: bash
-        env:
-          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
-          ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
-          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
-        run: |
-          set -eu
-          APP="${RQS_APP_NAME:-rustdesk}"
-          export PATH=/usr/lib/jvm/java-17-openjdk-amd64/bin:$PATH
-          # Increase Gradle JVM memory for CI builds
-          sed -i "s/org.gradle.jvmargs=-Xmx1024M/org.gradle.jvmargs=-Xmx2g/g" ./flutter/android/gradle.properties
-          # Use debug signing config (no release key in CI)
-          sed -i "s/signingConfigs.release/signingConfigs.debug/g" ./flutter/android/app/build.gradle
-          # Ensure jniLibs are in place
-          mkdir -p ./flutter/android/app/src/main/jniLibs/arm64-v8a
-          cp ./target/aarch64-linux-android/release/liblibrustdesk.so \
-             ./flutter/android/app/src/main/jniLibs/arm64-v8a/librustdesk.so 2>/dev/null || true
-          cp "${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/libc++_shared.so" \
-             ./flutter/android/app/src/main/jniLibs/arm64-v8a/ 2>/dev/null || true
-          pushd flutter
-          flutter pub get
-          flutter build apk --release --target-platform android-arm64 --split-per-abi
-          popd
-          mkdir -p ./output
-          apk=$(find flutter/build/app/outputs/flutter-apk -name 'app-arm64-v8a-release.apk' | head -1)
-          [ -n "$apk" ] || { echo "FAIL: apk not found"; find flutter/build -name '*.apk'; exit 1; }
-          cp "$apk" "./output/${APP}.apk"
-          ls -lh ./output/
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: rustdesk-min-test-android
-          path: output
diff --git a/github-build/rustqs-linux.yml b/github-build/rustqs-linux.yml
deleted file mode 100755
index 8b71f65..0000000
--- a/github-build/rustqs-linux.yml
+++ /dev/null
@@ -1,314 +0,0 @@
-name: rustqs linux min test
-# ============================================================================
-# DRAFT (B-012) — НЕ ВАЛИДИРОВАН РЕАЛЬНЫМ ПРОГОНОМ GITHUB ACTIONS.
-# Перенос generator-linux.yml в контракт форка (enc_payload + L1/L2/L3), по образцу
-# github-build/rustqs-windows-min-test.yml. Build-шаги Flutter-Linux требуют доводки
-# на реальных прогонах (vcpkg, движок, build.py, упаковка, пути артефактов) — как это
-# делалось для windows-min-test. Бэкенд уже умеет диспетчить platform=linux сюда и
-# забирать артефакт `rustdesk-min-test-linux`.
-#
-# Контракт параметров идентичен rustqs-windows-min-test:
-#   enc_payload = base64(openssl aes-256-cbc -pbkdf2 -pass pass:$WORKFLOW_PAYLOAD_KEY)
-#                 от JSON {server,key,app_name,custom_txt}; либо открытые inputs (debug).
-#
-# Путь в форке: .github/workflows/rustqs-linux.yml на ветке rustqs/min-test.
-# ============================================================================
-
-on:
-  workflow_dispatch:
-    inputs:
-      enc_payload:
-        description: 'Encrypted payload (base64 openssl aes-256-cbc -pbkdf2). Overrides open inputs below.'
-        required: false
-        type: string
-        default: ''
-      server:
-        description: '[Debug] RustDesk server (rendezvous host:port). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      key:
-        description: '[Debug] RustDesk server public key (base64). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      app_name:
-        description: '[Debug] Brand name. Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      custom_txt:
-        description: '[Debug] Base64 custom_.txt payload. Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      version:
-        description: 'RustDesk version for offline assets (e.g. 1.4.8). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: '1.4.8'
-
-env:
-  RUST_VERSION: "1.75"
-  LLVM_VERSION: "15.0.6"
-  FLUTTER_VERSION: "3.24.5"
-  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
-  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-  VERSION: "${{ inputs.version || '1.4.8' }}"
-
-jobs:
-  bridge:
-    uses: ./.github/workflows/bridge.yml
-
-  build:
-    needs: [bridge]
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Maximize build space
-        run: |
-          sudo rm -rf /opt/ghc /usr/local/lib/android /usr/share/dotnet
-          df -h
-
-      - name: Export GitHub Actions cache environment variables
-        uses: actions/github-script@v9
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Checkout source code
-        uses: actions/checkout@v7
-        with:
-          submodules: recursive
-
-      # Разрешение параметров: расшифровать enc_payload (prod) или взять открытые inputs (debug).
-      # Идентично windows-min-test: на выходе env RQS_*, секреты замаскированы.
-      - name: 'Resolve build config (decrypt or pass-through)'
-        shell: bash
-        env:
-          ENC: ${{ inputs.enc_payload }}
-          PAYLOAD_KEY: ${{ secrets.WORKFLOW_PAYLOAD_KEY }}
-          IN_SERVER: ${{ inputs.server }}
-          IN_KEY: ${{ inputs.key }}
-          IN_APP: ${{ inputs.app_name }}
-          IN_CT: ${{ inputs.custom_txt }}
-          IN_VERSION: ${{ inputs.version }}
-        run: |
-          set -eu
-          if [ -n "${ENC:-}" ]; then
-            if [ -z "${PAYLOAD_KEY:-}" ]; then
-              echo "::error::enc_payload provided but secret WORKFLOW_PAYLOAD_KEY is not set in this repo"
-              exit 1
-            fi
-            decrypted=$(printf '%s' "$ENC" | base64 -d \
-              | openssl enc -d -aes-256-cbc -pbkdf2 -pass "pass:${PAYLOAD_KEY}")
-            RQS_SERVER=$(printf '%s' "$decrypted" | jq -r '.server // ""')
-            RQS_KEY=$(printf '%s' "$decrypted" | jq -r '.key // ""')
-            RQS_APP=$(printf '%s' "$decrypted" | jq -r '.app_name // ""')
-            RQS_CT=$(printf '%s' "$decrypted" | jq -r '.custom_txt // ""')
-            RQS_VERSION=$(printf '%s' "$decrypted" | jq -r '.version // ""')
-          else
-            RQS_SERVER="${IN_SERVER:-}"; RQS_KEY="${IN_KEY:-}"; RQS_APP="${IN_APP:-}"; RQS_CT="${IN_CT:-}"; RQS_VERSION="${IN_VERSION:-}"
-          fi
-          for v in "$RQS_KEY" "$RQS_CT"; do [ -n "$v" ] && echo "::add-mask::$v" || true; done
-          {
-            echo "RQS_SERVER=$RQS_SERVER"
-            echo "RQS_KEY=$RQS_KEY"
-            echo "RQS_APP_NAME=$RQS_APP"
-            echo "RQS_CUSTOM_TXT=$RQS_CT"
-            echo "RQS_VERSION=$RQS_VERSION"
-          } >> "$GITHUB_ENV"
-
-      # Override VERSION from encrypted payload (takes precedence over workflow-level default).
-      - name: 'Override VERSION from dispatch payload'
-        if: env.RQS_VERSION != ''
-        shell: bash
-        run: |
-          echo "VERSION=$RQS_VERSION" >> "$GITHUB_ENV"
-          echo "VERSION overridden from dispatch: $RQS_VERSION"
-
-      # L1: вшить сервер+ключ в config.rs (платформо-независимо, идентично windows).
-      - name: 'L1 inject: server + key into hbb_common/config.rs'
-        if: env.RQS_SERVER != '' || env.RQS_KEY != ''
-        shell: bash
-        run: |
-          set -eu
-          f=libs/hbb_common/src/config.rs
-          if [ -n "${RQS_SERVER:-}" ]; then
-            esc=$(printf '%s' "$RQS_SERVER" | sed -e 's/[\/&]/\\&/g')
-            sed -i "s/rs-ny\.rustdesk\.com/${esc}/" "$f"
-            grep -F -q -- "$RQS_SERVER" "$f" || { echo "L1: server marker not found"; exit 1; }
-          fi
-          if [ -n "${RQS_KEY:-}" ]; then
-            esc=$(printf '%s' "$RQS_KEY" | sed -e 's/[\/&]/\\&/g')
-            sed -i "s|OeVuKk5nlHiXp+APNn0Y3pC1Iwpwn44JGqrQCsWqmBw=|${esc}|" "$f"
-            grep -F -q -- "$RQS_KEY" "$f" || { echo "L1: key marker not found"; exit 1; }
-          fi
-
-      # L2: allowCustom — снять проверку подписи custom.txt (платформо-независимо).
-      - name: 'L2 patch: allowCustom'
-        if: env.RQS_CUSTOM_TXT != ''
-        shell: bash
-        run: |
-          set -eu
-          python3 .github/patches/rdgen-allowCustom.py
-          if grep -q '5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM=' src/common.rs; then
-            echo "L2: allowCustom FAILED"; exit 1
-          fi
-
-      # L3: брендинг для Linux (без .exe/Runner.rc — только Cargo.toml/portable/lang).
-      - name: 'L3 brand: rename RustDesk → app_name'
-        if: env.RQS_APP_NAME != ''
-        shell: bash
-        run: |
-          set -eu
-          esc=$(printf '%s' "$RQS_APP_NAME" | sed -e 's/[\/&]/\\&/g')
-          for f in Cargo.toml libs/portable/Cargo.toml; do
-            sed -i -e "s|description = \"RustDesk Remote Desktop\"|description = \"${esc}\"|" "$f"
-          done
-          find ./src/lang -name "*.rs" -exec sed -i -e "s|RustDesk|${esc}|" {} \;
-
-      - name: Restore bridge files
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: bridge-artifact
-          path: ./
-
-      - name: Build dependencies (apt)
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y nasm libva-dev libvdpau-dev imagemagick \
-            libgtk-3-dev libxcb-randr0-dev libxdo-dev libxfixes-dev \
-            libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev \
-            libpam0g-dev libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \
-            libunwind-dev libclang-dev llvm-dev \
-            build-essential cmake ninja-build pkg-config \
-            libssl-dev libayatana-appindicator3-dev wget
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
-        with:
-          toolchain: ${{ env.RUST_VERSION }}
-          targets: x86_64-unknown-linux-gnu
-          components: "rustfmt"
-
-      # 12 GB swap: ffmpeg/vcpkg + flutter build eat > 7 GB RAM на ubuntu-24.04 runner.
-      - name: Set Swap Space
-        uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # v1.0
-        with:
-          swap-size-gb: 12
-
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-        with:
-          prefix-key: ubuntu-24.04
-
-      # Сборка только cdylib: экономит ~30% времени cargo (staticlib/rlib не нужны Flutter-у).
-      - name: Disable rust bridge build
-        run: |
-          sed -i 's/\["cdylib", "staticlib", "rlib"\]/\["cdylib"\]/g' Cargo.toml
-
-      - name: Setup vcpkg with Github Actions binary cache
-        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
-        with:
-          vcpkgDirectory: /opt/artifacts/vcpkg
-          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
-          doNotCache: false
-
-      - name: Install vcpkg dependencies
-        run: |
-          # libva-dev ставим заранее, иначе vcpkg-ffmpeg спотыкается на свежем ubuntu.
-          sudo apt-get install -y libva-dev
-          if ! "${VCPKG_ROOT}/vcpkg" install --triplet x64-linux --x-install-root="$VCPKG_ROOT/installed"; then
-            find "${VCPKG_ROOT}/" -name "*.log" | while read -r _1; do
-              echo "$_1:"
-              echo "======"
-              cat "$_1"
-              echo "======"
-              echo ""
-            done
-            exit 1
-          fi
-          head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-x64-linux-rel-out.log" || true
-        shell: bash
-
-      - name: Install flutter
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
-        with:
-          channel: "stable"
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-
-      # Flutter 3.24.5 без этого патча не фильтрует dropdown — падает в UI на первом клике.
-      - name: Patch flutter
-        if: env.FLUTTER_VERSION == '3.24.5'
-        shell: bash
-        run: |
-          cp .github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff $(dirname $(dirname $(which flutter)))
-          cd $(dirname $(dirname $(which flutter)))
-          git apply flutter_3.24.4_dropdown_menu_enableFilter.diff
-
-      # Двухстадийная сборка (как в upstream flutter-build.yml): сначала cargo lib
-      # со всеми нужными фичами, затем build.py только для Flutter-UI + .deb.
-      - name: Build rustdesk (Flutter Linux)
-        run: |
-          export VCPKG_ROOT=/opt/artifacts/vcpkg
-          export CARGO_INCREMENTAL=0
-          export DEB_ARCH=amd64
-          cargo build --locked --lib --features hwcodec,flutter,unix-file-copy-paste --release
-          python3 ./build.py --flutter --skip-cargo
-
-      # L2 payload: положить custom_.txt рядом с бинарём в bundle (читается клиентом).
-      - name: 'L2 payload: place custom_.txt into bundle'
-        if: env.RQS_CUSTOM_TXT != ''
-        shell: bash
-        run: |
-          set -eu
-          dst=flutter/build/linux/x64/release/bundle/custom_.txt
-          printf '%s' "$RQS_CUSTOM_TXT" > "$dst"
-          ls -la "$dst"
-
-      - name: Install rpm
-        run: |
-          # Долгий vcpkg-build (ffmpeg, 5-10 мин) мог состарить apt-кэш — обновим.
-          sudo apt-get update -y
-          sudo apt-get install -y rpm
-
-      - name: Package artifact (.deb + .rpm)
-        shell: bash
-        env:
-          HBB: ${{ github.workspace }}
-        run: |
-          set -eu
-          APP_RAW="${RQS_APP_NAME:-rustdesk}"
-          APP="$(printf '%s' "$APP_RAW" | tr -c 'A-Za-z0-9._+-' '-' | sed -e 's/^-*//' -e 's/-*$//')"
-          [ -n "$APP" ] || APP=rustdesk
-          VERSION=$(grep '^version =' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
-          mkdir -p ./output
-
-          # 1) .deb — создан build.py → build_flutter_deb()
-          for pkg in rustdesk-*.deb; do
-            [ -f "$pkg" ] || continue
-            new_name="$(echo "$pkg" | sed "s/^rustdesk/${APP}/")"
-            cp "$pkg" "./output/${new_name}"
-            echo "::notice::DEB: $pkg → output/${new_name}"
-          done
-
-          # 2) .rpm — rpmbuild из того же flutter bundle
-          if [ -d flutter/build/linux/x64/release/bundle ]; then
-            sed -i "s/^Version:.*/Version:    ${VERSION}/" res/rpm-flutter.spec
-            rpmbuild -ba res/rpm-flutter.spec
-            rpm_file=$(find "$HOME/rpmbuild/RPMS" -name 'rustdesk-*.rpm' | head -1)
-            if [ -n "$rpm_file" ]; then
-              new_name="${APP}-${VERSION}-0.x86_64.rpm"
-              cp "$rpm_file" "./output/${new_name}"
-              echo "::notice::RPM: ${new_name}"
-            fi
-          fi
-
-          ls -lh ./output/
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: rustdesk-min-test-linux
-          path: output
-          if-no-files-found: error
diff --git a/github-build/rustqs-windows-min-test.yml b/github-build/rustqs-windows-min-test.yml
deleted file mode 100644
index 4e06384..0000000
--- a/github-build/rustqs-windows-min-test.yml
+++ /dev/null
@@ -1,375 +0,0 @@
-name: rustqs windows min test
-# Минимальный workflow сборки rustqs.exe (Flutter Windows) в форке rustdesk.
-# Шаги — копия build-for-windows-flutter@1.4.7 + workflow_dispatch + три слоя вшивания
-# (L1 config.rs server+key, L2 allowCustom+custom_.txt, L3 brand+rename exe).
-#
-# Два режима передачи параметров (через workflow inputs):
-#   1) enc_payload — base64(openssl aes-256-cbc -pbkdf2 -pass pass:$SECRET) от JSON
-#      {server,key,app_name,custom_txt}. Recommended для prod: значения не утекают в
-#      логи публичного рана. Требует GitHub Secret WORKFLOW_PAYLOAD_KEY в форке.
-#   2) Открытые server/key/app_name/custom_txt — для дебага и тестирования.
-#      Удобно, но значения видны в логах рана. Не использовать на проде.
-#
-# Запуск из gh:
-#   gh api repos/$REPO/actions/workflows/rustqs-windows-min-test.yml/dispatches -X POST \
-#     -f ref=rustqs/min-test -f inputs[enc_payload]=$BLOB
-
-on:
-  workflow_dispatch:
-    inputs:
-      enc_payload:
-        description: 'Encrypted payload (base64 openssl aes-256-cbc -pbkdf2). Overrides open inputs below.'
-        required: false
-        type: string
-        default: ''
-      server:
-        description: '[Debug] RustDesk server (rendezvous host:port). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      key:
-        description: '[Debug] RustDesk server public key (base64). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      app_name:
-        description: '[Debug] Brand name. Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      custom_txt:
-        description: '[Debug] Base64 custom_.txt payload. Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: ''
-      version:
-        description: 'RustDesk version for offline assets (e.g. 1.4.8). Ignored if enc_payload set.'
-        required: false
-        type: string
-        default: '1.4.8'
-
-env:
-  RUST_VERSION: "1.75"
-  LLVM_VERSION: "15.0.6"
-  FLUTTER_VERSION: "3.24.5"
-  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
-  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-  VERSION: "${{ inputs.version || '1.4.8' }}"
-
-jobs:
-  bridge:
-    uses: ./.github/workflows/bridge.yml
-
-  topmost:
-    uses: ./.github/workflows/third-party-RustDeskTempTopMostWindow.yml
-    with:
-      upload-artifact: true
-      target: windows-2022
-      configuration: Release
-      platform: x64
-      target_version: Windows10
-
-  build:
-    needs: [bridge, topmost]
-    runs-on: windows-2022
-    steps:
-      - name: Export GitHub Actions cache environment variables
-        uses: actions/github-script@v9
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Checkout source code
-        uses: actions/checkout@v7
-        with:
-          submodules: recursive
-
-      # Разрешение параметров сборки: либо расшифровать enc_payload (prod),
-      # либо взять открытые inputs (debug). На выходе — env vars RQS_*, скрытые
-      # из логов через ::add-mask::.
-      - name: 'Resolve build config (decrypt or pass-through)'
-        shell: bash
-        env:
-          ENC: ${{ inputs.enc_payload }}
-          PAYLOAD_KEY: ${{ secrets.WORKFLOW_PAYLOAD_KEY }}
-          IN_SERVER: ${{ inputs.server }}
-          IN_KEY: ${{ inputs.key }}
-          IN_APP: ${{ inputs.app_name }}
-          IN_CT: ${{ inputs.custom_txt }}
-          IN_VERSION: ${{ inputs.version }}
-        run: |
-          set -eu
-
-          if [ -n "${ENC:-}" ]; then
-            if [ -z "${PAYLOAD_KEY:-}" ]; then
-              echo "::error::enc_payload provided but secret WORKFLOW_PAYLOAD_KEY is not set in this repo"
-              exit 1
-            fi
-            echo "Resolve mode: ENCRYPTED (enc_payload, len ${#ENC})"
-            # base64 → openssl decrypt с PBKDF2 → JSON
-            decrypted=$(printf '%s' "$ENC" | base64 -d \
-              | openssl enc -d -aes-256-cbc -pbkdf2 -pass "pass:${PAYLOAD_KEY}")
-            RQS_SERVER=$(printf '%s' "$decrypted" | jq -r '.server // ""')
-            RQS_KEY=$(printf '%s' "$decrypted" | jq -r '.key // ""')
-            RQS_APP=$(printf '%s' "$decrypted" | jq -r '.app_name // ""')
-            RQS_CT=$(printf '%s' "$decrypted" | jq -r '.custom_txt // ""')
-            RQS_VERSION=$(printf '%s' "$decrypted" | jq -r '.version // ""')
-          else
-            echo "Resolve mode: OPEN inputs (debug)"
-            RQS_SERVER="${IN_SERVER:-}"
-            RQS_KEY="${IN_KEY:-}"
-            RQS_APP="${IN_APP:-}"
-            RQS_CT="${IN_CT:-}"
-            RQS_VERSION="${IN_VERSION:-}"
-          fi
-
-          # Маскируем чувствительные значения в логах ДО экспорта в $GITHUB_ENV.
-          # add-mask распространяется на всё содержимое логов до конца job'a.
-          for v in "$RQS_KEY" "$RQS_CT"; do
-            if [ -n "$v" ]; then echo "::add-mask::$v"; fi
-          done
-
-          {
-            echo "RQS_SERVER=$RQS_SERVER"
-            echo "RQS_KEY=$RQS_KEY"
-            echo "RQS_APP_NAME=$RQS_APP"
-            echo "RQS_CUSTOM_TXT=$RQS_CT"
-            echo "RQS_VERSION=$RQS_VERSION"
-          } >> "$GITHUB_ENV"
-
-          # сводка (без значений): что задано, что пусто
-          echo "config: server=$([ -n "$RQS_SERVER" ] && echo SET || echo empty)"
-          echo "config: key=$([ -n "$RQS_KEY" ] && echo SET || echo empty)"
-          echo "config: app_name=$([ -n "$RQS_APP" ] && echo SET || echo empty)"
-          echo "config: custom_txt=$([ -n "$RQS_CT" ] && echo SET || echo empty)"
-          echo "config: version=$([ -n "$RQS_VERSION" ] && echo "$RQS_VERSION" || echo empty)"
-
-      # Override VERSION from encrypted payload (takes precedence over workflow-level default).
-      - name: 'Override VERSION from dispatch payload'
-        if: env.RQS_VERSION != ''
-        shell: bash
-        run: |
-          echo "VERSION=$RQS_VERSION" >> "$GITHUB_ENV"
-          echo "VERSION overridden from dispatch: $RQS_VERSION"
-
-      # L1: вшить сервер+ключ в config.rs ДО любой сборки. Опционально.
-      - name: 'L1 inject: server + key into hbb_common/config.rs'
-        if: env.RQS_SERVER != '' || env.RQS_KEY != ''
-        shell: bash
-        run: |
-          set -eu
-          f=libs/hbb_common/src/config.rs
-          if [ -n "${RQS_SERVER:-}" ]; then
-            echo "L1: server -> (masked)"
-            esc=$(printf '%s' "$RQS_SERVER" | sed -e 's/[\/&]/\\&/g')
-            sed -i "s/rs-ny\.rustdesk\.com/${esc}/" "$f"
-            grep -F -q -- "$RQS_SERVER" "$f" || { echo "L1: server marker not found after sed"; exit 1; }
-          fi
-          if [ -n "${RQS_KEY:-}" ]; then
-            echo "L1: key embedded (len ${#RQS_KEY})"
-            esc=$(printf '%s' "$RQS_KEY" | sed -e 's/[\/&]/\\&/g')
-            sed -i "s|OeVuKk5nlHiXp+APNn0Y3pC1Iwpwn44JGqrQCsWqmBw=|${esc}|" "$f"
-            grep -F -q -- "$RQS_KEY" "$f" || { echo "L1: key marker not found after sed"; exit 1; }
-          fi
-
-      # L2 step A (PRE-BUILD): allowCustom — снять проверку подписи custom.txt + переименовать на custom_.txt
-      - name: 'L2 patch: allowCustom (remove signature check, custom.txt → custom_.txt)'
-        if: env.RQS_CUSTOM_TXT != ''
-        shell: bash
-        run: |
-          set -eu
-          python3 .github/patches/rdgen-allowCustom.py
-          if grep -q '5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM=' src/common.rs; then
-            echo "L2: allowCustom FAILED — signature key still present"; exit 1
-          fi
-          echo "L2: allowCustom applied (src/common.rs patched)"
-          grep -c 'custom_\.txt' src/common.rs || true
-
-      # L3: брендинг RustDesk → app_name (sed по тем же файлам что rdgen + flutter CMakeLists)
-      - name: 'L3 brand: rename RustDesk → app_name'
-        if: env.RQS_APP_NAME != ''
-        shell: bash
-        run: |
-          set -eu
-          APP="$RQS_APP_NAME"
-          esc=$(printf '%s' "$APP" | sed -e 's/[\/&]/\\&/g')
-
-          for f in Cargo.toml libs/portable/Cargo.toml; do
-            sed -i -e "s|description = \"RustDesk Remote Desktop\"|description = \"${esc}\"|" \
-                   -e "s|ProductName = \"RustDesk\"|ProductName = \"${esc}\"|" \
-                   -e "s|FileDescription = \"RustDesk Remote Desktop\"|FileDescription = \"${esc}\"|" \
-                   -e "s|OriginalFilename = \"rustdesk.exe\"|OriginalFilename = \"${esc}.exe\"|" "$f"
-          done
-
-          sed -i -e "s|const APP_PREFIX: \&str = \"rustdesk\";|const APP_PREFIX: \&str = \"${esc}\";|" libs/portable/src/main.rs
-
-          sed -i -e "s|\"RustDesk Remote Desktop\"|\"${esc}\"|" \
-                 -e "s|VALUE \"InternalName\", \"rustdesk\" \"\\\\0\"|VALUE \"InternalName\", \"${esc}\" \"\\\\0\"|" \
-                 -e "s|\"rustdesk.exe\"|\"${esc}.exe\"|" \
-                 -e "s|\"RustDesk\"|\"${esc}\"|" flutter/windows/runner/Runner.rc
-
-          # ВАЖНО: НЕ менять BINARY_NAME в flutter/windows/CMakeLists.txt!
-          # libs/portable/generate.py hard-coded ищет внутри Release/ файл с именем
-          # `rustdesk.exe` (см. вызов в build.py). Если переименовать — packer не найдёт
-          # exe и build упадёт. Метаданные (ProductName/FileDescription/etc) уже
-          # установлены через sed Runner.rc/Cargo.toml выше — этого достаточно для
-          # отображения "rustqs" в свойствах файла. Финальный self-extract single-exe
-          # переименовывается в "${appname}.exe" уже после packer'a (см. Portable-pack).
-          echo "L3: brand → ${APP} (BINARY_NAME left as 'rustdesk' for packer)"
-
-      - name: Restore bridge files
-        uses: actions/download-artifact@v8
-        with:
-          name: bridge-artifact
-          path: ./
-
-      - name: Install LLVM and Clang
-        uses: KyleMayes/install-llvm-action@v1
-        with:
-          version: ${{ env.LLVM_VERSION }}
-
-      - name: Install flutter
-        uses: subosito/flutter-action@v2.12.0
-        with:
-          channel: "stable"
-          flutter-version: ${{ env.FLUTTER_VERSION }}
-
-      - name: Replace engine with rustdesk custom flutter engine
-        run: |
-          flutter doctor -v
-          flutter precache --windows
-          Invoke-WebRequest -Uri https://github.com/bashrusakh/rustdesk/releases/download/offline-assets-$env:VERSION/windows-x64-release.zip -OutFile windows-x64-release.zip
-          Expand-Archive -Path windows-x64-release.zip -DestinationPath windows-x64-release
-          mv -Force windows-x64-release/* C:/hostedtoolcache/windows/flutter/stable-${{ env.FLUTTER_VERSION }}-x64/bin/cache/artifacts/engine/windows-x64-release/
-
-      - name: Patch flutter
-        shell: bash
-        run: |
-          cp .github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff $(dirname $(dirname $(which flutter)))
-          cd $(dirname $(dirname $(which flutter)))
-          [[ "3.24.5" == ${{env.FLUTTER_VERSION}} ]] && git apply flutter_3.24.4_dropdown_menu_enableFilter.diff
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@v1
-        with:
-          toolchain: ${{ env.RUST_VERSION }}
-          targets: x86_64-pc-windows-msvc
-          components: "rustfmt"
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          prefix-key: windows-2022
-
-      - name: Setup vcpkg with Github Actions binary cache
-        uses: lukka/run-vcpkg@v11
-        with:
-          vcpkgDirectory: C:\vcpkg
-          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
-          doNotCache: false
-
-      - name: Install vcpkg dependencies
-        env:
-          VCPKG_DEFAULT_HOST_TRIPLET: x64-windows-static
-        shell: bash
-        run: |
-          if ! $VCPKG_ROOT/vcpkg install --triplet x64-windows-static --x-install-root="$VCPKG_ROOT/installed"; then
-            find "${VCPKG_ROOT}/" -name "*.log" | while read -r f; do echo "=== $f ==="; cat "$f"; done
-            exit 1
-          fi
-
-      - name: Build rustdesk (Flutter Windows) + bring in native deps
-        run: |
-          # --skip-portable-pack: packer запускаем сами в отдельном шаге, чтобы
-          # положить custom_.txt + native deps в Release/ ДО упаковки.
-          # НЕ переименовываем Release/ → ./rustdesk — packer ищет именно по этому пути
-          # (libs/portable/generate.py вызывается с -f ../../flutter/build/windows/x64/runner/Release/).
-          python3 .\build.py --portable --hwcodec --flutter --vram --skip-portable-pack
-          $RELEASE = "flutter/build/windows/x64/runner/Release"
-
-          # usbmmidd_v2 — виртуальный дисплей. Из release ФОРКА (суверенно). → в Release/
-          Invoke-WebRequest -Uri https://github.com/bashrusakh/rustdesk/releases/download/offline-assets-$env:VERSION/usbmmidd_v2.zip -OutFile usbmmidd_v2.zip
-          Expand-Archive usbmmidd_v2.zip -DestinationPath .
-          Remove-Item -Path usbmmidd_v2\Win32 -Recurse
-          Remove-Item -Path "usbmmidd_v2\deviceinstaller64.exe", "usbmmidd_v2\deviceinstaller.exe", "usbmmidd_v2\usbmmidd.bat"
-          mv -Force .\usbmmidd_v2 "$RELEASE/"
-
-          # Printer driver + adapter из release форка. → в Release/
-          try {
-            Invoke-WebRequest -Uri https://github.com/bashrusakh/rustdesk/releases/download/offline-assets-$env:VERSION/rustdesk_printer_driver_v4-1.4.zip -OutFile rustdesk_printer_driver_v4-1.4.zip
-            Invoke-WebRequest -Uri https://github.com/bashrusakh/rustdesk/releases/download/offline-assets-$env:VERSION/printer_driver_adapter.zip -OutFile printer_driver_adapter.zip
-            Invoke-WebRequest -Uri https://github.com/bashrusakh/rustdesk/releases/download/offline-assets-$env:VERSION/sha256sums -OutFile sha256sums
-
-            $checksum_driver = (Select-String -Path .\sha256sums -Pattern '^([a-fA-F0-9]{64}) \*rustdesk_printer_driver_v4-1.4\.zip$').Matches.Groups[1].Value
-            $downloadsum_driver = Get-FileHash -Path rustdesk_printer_driver_v4-1.4.zip -Algorithm SHA256
-            $checksum_adapter = (Select-String -Path .\sha256sums -Pattern '^([a-fA-F0-9]{64}) \*printer_driver_adapter\.zip$').Matches.Groups[1].Value
-            $downloadsum_adapter = Get-FileHash -Path printer_driver_adapter.zip -Algorithm SHA256
-            if ($checksum_driver -eq $downloadsum_driver.Hash -and $checksum_adapter -eq $downloadsum_adapter.Hash) {
-                Write-Output "printer driver+adapter checksums match, extracting"
-                Expand-Archive rustdesk_printer_driver_v4-1.4.zip -DestinationPath .
-                mkdir "$RELEASE/drivers"
-                mv -Force .\rustdesk_printer_driver_v4-1.4 "$RELEASE/drivers/RustDeskPrinterDriver"
-                Expand-Archive printer_driver_adapter.zip -DestinationPath .
-                mv -Force .\printer_driver_adapter.dll "$RELEASE/"
-            } else {
-                Write-Output "checksum mismatch — ignoring printer files"
-            }
-          } catch {
-              Write-Host "Ignore the printer driver error."
-          }
-
-      - name: Download RustDeskTempTopMostWindow artifacts (→ Release/)
-        uses: actions/download-artifact@v8
-        with:
-          name: topmostwindow-artifacts-x64
-          path: "./flutter/build/windows/x64/runner/Release"
-
-      # L2-B: положить custom_.txt в Release/ ДО запуска packer'a, чтобы он
-      # попал ВНУТРЬ single-exe. После self-extract клиента, custom_.txt будет лежать
-      # рядом с rustdesk.exe в TEMP-папке (там его и читает read_custom_client).
-      - name: 'L2 payload: place custom_.txt into Release/ (will be packed inside exe)'
-        if: env.RQS_CUSTOM_TXT != ''
-        shell: bash
-        run: |
-          set -eu
-          dst=flutter/build/windows/x64/runner/Release/custom_.txt
-          printf '%s' "$RQS_CUSTOM_TXT" > "$dst"
-          ls -la "$dst"
-          echo "L2: custom_.txt placed inside Release/ (size $(wc -c < "$dst"))"
-
-      # L4: portable-pack (single self-extracting exe).
-      # generate.py сжимает ВСЁ из -f папки в data.bin → embedded в Rust packer-binary.
-      # Финал: target/release/rustdesk-portable-packer.exe (~30 MB). Переименуем в
-      # {appname}.exe и положим в ./output/ для upload-artifact.
-      - name: 'L4 portable-pack: build single-binary self-extracting exe'
-        shell: bash
-        run: |
-          set -eu
-          APP="${RQS_APP_NAME:-rustdesk}"
-          ls flutter/build/windows/x64/runner/Release/ | head
-          pushd libs/portable
-          pip3 install -r requirements.txt
-          # тот же CLI что вызывает build.py (когда --portable БЕЗ --skip-portable-pack).
-          # generate.py сам в конце вызывает `cargo build --locked --release` для
-          # portable-packer Rust-проекта (см. build_portable() в generate.py).
-          python3 ./generate.py \
-            -f ../../flutter/build/windows/x64/runner/Release/ \
-            -o . \
-            -e ../../flutter/build/windows/x64/runner/Release/rustdesk.exe
-          popd
-          mkdir -p ./output
-          src="./target/release/rustdesk-portable-packer.exe"
-          if [ ! -f "$src" ]; then
-            # Cargo мог быть в libs/portable/target — fallback
-            src="./libs/portable/target/release/rustdesk-portable-packer.exe"
-          fi
-          ls -lh "$src" || { echo "FAIL: portable-packer.exe not found"; find . -name "rustdesk-portable-packer.exe" 2>/dev/null; exit 1; }
-          cp "$src" "./output/${APP}.exe"
-          ls -lh "./output/"
-          echo "L4: ${APP}.exe size = $(stat -c%s "./output/${APP}.exe" 2>/dev/null || wc -c < "./output/${APP}.exe")"
-
-      - name: Upload unsigned
-        uses: actions/upload-artifact@v7
-        with:
-          name: rustdesk-min-test-windows
-          path: output
diff --git a/go.work.sum b/go.work.sum
index 901cdf5..067464b 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -1 +1,11 @@
+cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
+github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/libs/hbb_common/examples/webrtc.rs b/libs/hbb_common/examples/webrtc.rs
index 2c993ca..b0aac96 100644
--- a/libs/hbb_common/examples/webrtc.rs
+++ b/libs/hbb_common/examples/webrtc.rs
@@ -3,10 +3,10 @@ extern crate hbb_common;
 #[cfg(feature = "webrtc")]
 use hbb_common::webrtc::WebRTCStream;
 
-use std::io::Write;
 use anyhow::Result;
 use bytes::Bytes;
 use clap::{Arg, Command};
+use std::io::Write;
 use tokio::time::Duration;
 
 #[cfg(not(feature = "webrtc"))]
diff --git a/libs/hbb_common/src/lib.rs b/libs/hbb_common/src/lib.rs
index 2b35642..1e31e6f 100644
--- a/libs/hbb_common/src/lib.rs
+++ b/libs/hbb_common/src/lib.rs
@@ -58,9 +58,9 @@ pub use uuid;
 pub mod fingerprint;
 pub use flexi_logger;
 pub mod stream;
-pub mod websocket;
 #[cfg(feature = "webrtc")]
 pub mod webrtc;
+pub mod websocket;
 #[cfg(any(target_os = "android", target_os = "ios"))]
 pub use rustls_platform_verifier;
 pub use stream::Stream;
@@ -68,9 +68,9 @@ pub use whoami;
 pub mod tls;
 pub mod verifier;
 pub use async_recursion;
+pub use libloading;
 #[cfg(target_os = "linux")]
 pub use users;
-pub use libloading;
 #[cfg(target_os = "linux")]
 pub use x11;
 
@@ -227,8 +227,11 @@ pub fn get_version_from_url(url: &str) -> String {
 
 pub fn gen_version() {
     println!("cargo:rerun-if-changed=Cargo.toml");
+    println!("cargo:rerun-if-env-changed=SOURCE_DATE_EPOCH");
+    println!("cargo:rerun-if-env-changed=RUSTDESK_NON_REPRODUCIBLE_DEBUG");
     use std::io::prelude::*;
-    let mut file = File::create("./src/version.rs").unwrap();
+    let out_dir = std::env::var("OUT_DIR").expect("Cargo did not provide OUT_DIR");
+    let mut file = File::create(Path::new(&out_dir).join("version.rs")).unwrap();
     for line in read_lines("Cargo.toml").unwrap().flatten() {
         let ab: Vec<&str> = line.split('=').map(|x| x.trim()).collect();
         if ab.len() == 2 && ab[0] == "version" {
@@ -237,8 +240,11 @@ pub fn gen_version() {
             break;
         }
     }
-    // generate build date
-    let build_date = format!("{}", chrono::Local::now().format("%Y-%m-%d %H:%M"));
+    // Generate deterministic metadata for active/reproducible builds. The
+    // wall-clock fallback is opt-in only for explicitly non-reproducible local
+    // debug work; production builds without SOURCE_DATE_EPOCH use "unknown"
+    // rather than silently embedding the current time.
+    let build_date = build_date_from_environment();
     file.write_all(
         format!("#[allow(dead_code)]\npub const BUILD_DATE: &str = \"{build_date}\";\n").as_bytes(),
     )
@@ -246,6 +252,66 @@ pub fn gen_version() {
     file.sync_all().ok();
 }
 
+fn build_date_from_environment() -> String {
+    match std::env::var("SOURCE_DATE_EPOCH") {
+        Ok(value) => deterministic_build_date(Some(&value), false),
+        Err(std::env::VarError::NotPresent) => deterministic_build_date(
+            None,
+            std::env::var("RUSTDESK_NON_REPRODUCIBLE_DEBUG").as_deref() == Ok("1"),
+        ),
+        Err(err) => panic!("failed to read SOURCE_DATE_EPOCH: {}", err),
+    }
+}
+
+fn deterministic_build_date(
+    source_date_epoch: Option<&str>,
+    allow_non_reproducible_debug: bool,
+) -> String {
+    if let Some(value) = source_date_epoch {
+        let epoch = value
+            .parse::<i64>()
+            .unwrap_or_else(|_| panic!("SOURCE_DATE_EPOCH must be a signed Unix timestamp"));
+        let timestamp =
+            chrono::DateTime::<chrono::Utc>::from_timestamp(epoch, 0).unwrap_or_else(|| {
+                panic!("SOURCE_DATE_EPOCH is outside the supported timestamp range")
+            });
+        return timestamp.format("%Y-%m-%d %H:%M").to_string();
+    }
+    if allow_non_reproducible_debug {
+        return chrono::Local::now().format("%Y-%m-%d %H:%M").to_string();
+    }
+    "unknown".to_owned()
+}
+
+#[cfg(test)]
+mod build_date_tests {
+    use super::deterministic_build_date;
+
+    #[test]
+    fn source_date_epoch_is_stable() {
+        assert_eq!(
+            deterministic_build_date(Some("0"), false),
+            "1970-01-01 00:00"
+        );
+        assert_eq!(
+            deterministic_build_date(Some("0"), false),
+            "1970-01-01 00:00"
+        );
+    }
+
+    #[test]
+    fn missing_epoch_does_not_use_wall_clock_by_default() {
+        assert_eq!(deterministic_build_date(None, false), "unknown");
+    }
+
+    #[test]
+    fn debug_opt_in_allows_wall_clock_metadata() {
+        let build_date = deterministic_build_date(None, true);
+        assert_ne!(build_date, "unknown");
+        assert_eq!(build_date.len(), "1970-01-01 00:00".len());
+    }
+}
+
 fn read_lines<P>(filename: P) -> io::Result<io::Lines<io::BufReader<File>>>
 where
     P: AsRef<Path>,
@@ -432,7 +498,10 @@ pub fn init_log(_is_async: bool, _name: &str) -> Option<flexi_logger::LoggerHand
         #[cfg(debug_assertions)]
         {
             use env_logger::*;
-            init_from_env(Env::default().filter_or(DEFAULT_FILTER_ENV, "info,reqwest=warn,rustls=warn,webrtc-sctp=warn,webrtc=warn"));
+            init_from_env(Env::default().filter_or(
+                DEFAULT_FILTER_ENV,
+                "info,reqwest=warn,rustls=warn,webrtc-sctp=warn,webrtc=warn",
+            ));
         }
         #[cfg(not(debug_assertions))]
         {
@@ -447,7 +516,9 @@ pub fn init_log(_is_async: bool, _name: &str) -> Option<flexi_logger::LoggerHand
                 path.push(_name);
             }
             use flexi_logger::*;
-            if let Ok(x) = Logger::try_with_env_or_str("debug,reqwest=warn,rustls=warn,webrtc-sctp=warn,webrtc=warn") {
+            if let Ok(x) = Logger::try_with_env_or_str(
+                "debug,reqwest=warn,rustls=warn,webrtc-sctp=warn,webrtc=warn",
+            ) {
                 logger_holder = x
                     .log_to_file(FileSpec::default().directory(path))
                     .write_mode(if _is_async {
diff --git a/libs/hbb_common/src/stream.rs b/libs/hbb_common/src/stream.rs
index a8e6b6c..4b0f9a8 100644
--- a/libs/hbb_common/src/stream.rs
+++ b/libs/hbb_common/src/stream.rs
@@ -1,6 +1,6 @@
-use crate::{config, tcp, websocket, ResultType};
 #[cfg(feature = "webrtc")]
 use crate::webrtc;
+use crate::{config, tcp, websocket, ResultType};
 use sodiumoxide::crypto::secretbox::Key;
 use std::net::SocketAddr;
 use tokio::net::TcpStream;
diff --git a/libs/hbb_common/src/tcp.rs b/libs/hbb_common/src/tcp.rs
index 2296edb..ad5867f 100644
--- a/libs/hbb_common/src/tcp.rs
+++ b/libs/hbb_common/src/tcp.rs
@@ -1,4 +1,4 @@
-use crate::{bail, bytes_codec::BytesCodec, ResultType, config::Socks5Server, proxy::Proxy};
+use crate::{bail, bytes_codec::BytesCodec, config::Socks5Server, proxy::Proxy, ResultType};
 use anyhow::Context as AnyhowCtx;
 use bytes::{BufMut, Bytes, BytesMut};
 use futures::{SinkExt, StreamExt};
@@ -62,7 +62,10 @@ impl DerefMut for DynTcpStream {
     }
 }
 
-pub(crate) fn new_socket(addr: std::net::SocketAddr, reuse: bool) -> Result<TcpSocket, std::io::Error> {
+pub(crate) fn new_socket(
+    addr: std::net::SocketAddr,
+    reuse: bool,
+) -> Result<TcpSocket, std::io::Error> {
     let socket = match addr {
         std::net::SocketAddr::V4(..) => TcpSocket::new_v4()?,
         std::net::SocketAddr::V6(..) => TcpSocket::new_v6()?,
diff --git a/libs/hbb_common/src/webrtc.rs b/libs/hbb_common/src/webrtc.rs
index 430a6e8..ed6895f 100644
--- a/libs/hbb_common/src/webrtc.rs
+++ b/libs/hbb_common/src/webrtc.rs
@@ -579,10 +579,7 @@ mod tests {
             "turn:example.com:3478"
         );
         assert_eq!(WebRTCStream::get_ice_servers().len(), 2);
-        config::Config::set_option(
-            "ice-servers".to_string(),
-            "".to_string(),
-        );
+        config::Config::set_option("ice-servers".to_string(), "".to_string());
     }
 
     #[test]
diff --git a/offline-kit/FORK-PROCEDURE.md b/offline-kit/FORK-PROCEDURE.md
index c43d27a..7222211 100644
--- a/offline-kit/FORK-PROCEDURE.md
+++ b/offline-kit/FORK-PROCEDURE.md
@@ -1,11 +1,16 @@
-# FORK-PROCEDURE — how to make a fork sovereign
+# FORK-PROCEDURE — historical fork/dependency procedure (frozen reference)
 
-> **FROZEN** — procedure was completed for 1.4.7/1.4.8. Below is reference for a new version
-> or for downstream forkers. Commands are executed by the repo owner.
+> **FROZEN** — examples below use 1.4.8 and are historical reference for a new version
+> or downstream forkers. The commands are not a claim that a current release or complete
+> offline build exists; commands are executed only by the repo owner.
+>
+> This procedure is not evidence of upstream independence, a network-denied full build,
+> a verified license bundle, or a release. The offline kit has no signature claim;
+> signature verification is still a gap.
 
 ---
 
-## Level A — fork + vendor (minimum to survive upstream deletion)
+## Level A — historical fork + vendor candidate (not current proof)
 
 ### A1. Fork rustdesk + hbb_common
 
@@ -35,15 +40,40 @@ git push origin release/1.4.8
 ```env
 RUSTDESK_REPO="https://github.com/YOUR_ORG/rustdesk.git"
 RUSTDESK_REF="1.4.8"
+# Also record the exact 40-character RUSTDESK_COMMIT and expected local
+# artifact SHA-256 values before accepting a freeze.
 ```
 
+### A4. Verify before handoff
+
+From `offline-kit/`, after the local artifact set has been assembled:
+
+```bash
+bash freeze.sh --verify
+bash license-inventory.sh > /tmp/deskforge-third-party-inventory.txt
+```
+
+Verification is read-only and fail-closed. It checks exact manifest byte sizes,
+file SHA-256 values, Git-tree/content-hash records, source/tag/commit equality,
+a clean non-shallow source checkout, recursive submodules, the source bundle,
+vendor/source consistency, vcpkg baseline, the active TopMostWindow workflow
+pin, and required pins. Only generated `vendor/` and
+`.cargo/config.vendor.toml` source paths are allowed as working-tree additions;
+their content is included in the manifest contract. It never downloads or
+rewrites `MANIFEST.txt`. Missing
+engine/source/vendor files are local blockers; missing provider assets are
+reported as unavailable rather than treated as success.
+If an expected digest is missing, only `freeze.sh --allow-tofu ...` may proceed
+as an explicit manual exception, and `--verify` remains red until the digest is
+manually recorded in `versions.env`.
+
 ---
 
-## Level B — full sovereignty (binaries in releases)
+## Level B — historical candidate asset handoff (not current sovereignty proof)
 
-### B1. What to upload
+### B1. What to upload (historical candidate handoff)
 
-From `offline-kit/artifacts/`:
+From `offline-kit/artifacts/`, after the local verification gates pass:
 
 | Artifact                         | Why                                |
 | -------------------------------- | ---------------------------------- |
@@ -53,7 +83,7 @@ From `offline-kit/artifacts/`:
 | `printer_driver_adapter.zip`     | Printer adapter                    |
 | `vendor-*.tar.gz`                | (optional, if not in git)          |
 
-### B2. Commands
+### B2. Historical release command (not a publication or readiness claim)
 
 ```bash
 gh release create offline-assets-1.4.8 --repo YOUR_ORG/rustdesk \
@@ -78,24 +108,33 @@ Someone forks **your** DeskForge → changes one line:
 ```env
 RUSTDESK_REPO="https://github.com/THEIR_ORG/rustdesk.git"
 ```
-→ their GUI builds from their fork. Upstream is not involved.
+→ their GUI can be configured to build from their fork. Upstream independence remains
+unverified until the source, submodule, dependency, license, and offline-build checklist
+passes.
 
 ### C1. Versions in admin UI
 
 The version list in the admin UI (Custom Client → Version dropdown) is loaded
-dynamically via `GET /api/admin/custom_build/versions`. This endpoint queries
-GitHub releases of the fork tagged `offline-assets-*`.
+dynamically from the configured provider repository's `offline-assets-*` catalog.
+Matching source-tag and required-asset checks determine the entries; provider
+catalog failure returns an empty/error state rather than a hardcoded fallback.
 
 **For downstream forkers:**
-- After publishing your own `offline-assets-{tag}` release, the version will
-  automatically appear in the UI
-- If the GitHub API is unavailable, falls back to `['1.4.8', '1.4.7']`
+- After a matching provider asset release and source tag are available, the version
+  may appear in the UI after the provider-derived catalog refreshes
+- If the provider API is unavailable, no obsolete version fallback is shown
 - No hardcoded values in code need to be changed
 
-### C2. Workflow deployment
+### C2. Active workflow ownership
+
+The configured RustDesk fork's `.github/workflows/` files are the sole executable
+source. `github-build/` and `rdgen/` are reference/frozen material and must not be
+copied into the active fork as deployment sources. The API preserves the configured
+branch/tag selector and separately checks the resolved workflow SHA; immutable
+workflow-ref protection remains a gate, not a current readiness claim.
 
-Workflow files (`rustqs-*.yml`, `bridge.yml`) must be deployed to **three branches**
-of the fork:
+The current DeskForge default workflow execution ref is `rustqs/workflows`. The
+following three-branch model is historical reference only:
 
 | Branch | Purpose |
 |---|---|
@@ -103,16 +142,21 @@ of the fork:
 | `rustqs/min-test` | Execution — all dispatches go here |
 | `rustqs/master-workflows` | Mirror — backup for applying after upstream sync |
 
-**Important:** `bridge.yml` must be **without `inputs.version`** — same as upstream.
-Checkout — **without `repository:`** (checkout the current repo, not upstream).
-Otherwise the workflow will fail with `startup_failure`.
+Historical bridge/checkout constraints are retained for maintenance context:
+`bridge.yml` must be without `inputs.version`, and checkout must use the current
+fork repository rather than upstream. They do not make a live run or support claim.
 
 ---
 
-## Sovereignty verification
+## Sovereignty verification checklist (not a current claim)
 
-- [ ] `YOUR_ORG/rustdesk` with vendor + `.cargo/config.toml`
-- [ ] `YOUR_ORG/hbb_common` (submodule)
-- [ ] Release `offline-assets-{tag}` with binaries
+- [ ] `YOUR_ORG/rustdesk` with independently verified vendor + Cargo source config
+- [ ] `YOUR_ORG/hbb_common` (submodule) with clean, published provenance
+- [ ] Provider `offline-assets-{tag}` with independently verified candidate assets
 - [ ] `versions.env` → your fork
 - [ ] `cargo build --offline` passes without `github.com/rustdesk*`
+- [ ] `bash freeze.sh --verify` passes in the handoff environment
+- [ ] `license-inventory.sh` reviewed; every `GAP` has an owner or accepted risk
+- [ ] Current local gaps (missing engine, legacy manifest/trusted expected values,
+      license evidence, signature/attestation, and network-denied full-build proof)
+      are closed with separate evidence
diff --git a/offline-kit/README.md b/offline-kit/README.md
index bcdd7f7..96a6143 100644
--- a/offline-kit/README.md
+++ b/offline-kit/README.md
@@ -1,8 +1,10 @@
-# offline-kit — sovereign freeze tool
+# offline-kit — frozen dependency-freeze tool (verification incomplete)
 
 **Why:** if `rustdesk/rustdesk` gets deleted, `rustdesk-org/*` disappears, or
 `crates.io`/Google becomes unreachable, building a custom client becomes impossible.
-This kit freezes everything needed **while upstream is still alive**.
+This kit attempts to capture build inputs **while upstream is still alive**. It is a
+frozen operator tool, not a verified license bundle, sovereignty package, or proof of a
+network-denied full client build.
 
 ## Contents
 
@@ -10,24 +12,27 @@ This kit freezes everything needed **while upstream is still alive**.
 | ------------------------------- | ----------------------------------------------------- |
 | `freeze.sh`                       | Downloads sources, toolchain, dependencies            |
 | `versions.env`                    | Versions of all components (Rust, Flutter, vcpkg...)  |
-| `FORK-PROCEDURE.md`               | How to make a fork sovereign                          |
-| `artifacts/`                      | Output of freeze.sh (5 GB, **not in git**)            |
+| `verify.sh`                        | Read-only, fail-closed local manifest/pin verifier     |
+| `license-inventory.sh`             | Deterministic license-evidence inventory; known gaps are reported |
+| `FORK-PROCEDURE.md`               | Historical fork procedure; not sovereignty proof      |
+| `artifacts/`                      | Local output of freeze.sh (**not in git**)             |
 
 ## How it works
 
 ```
-freeze.sh → offline-kit/artifacts/*  (locally, all 5 GB)
-                ↓ upload (binaries only: engine, drivers)
-         offline-assets-{tag}        (GitHub Release in rustdesk fork, ~100 MB)
+freeze.sh → offline-kit/artifacts/*  (local operator storage)
+                ↓ optional operator handoff (candidate engine/driver assets)
+         offline-assets-{tag}        (provider-side asset naming convention)
                 ↓ download
          GitHub Actions runner → build rustqs.exe
 ```
 
 - **`offline-kit/`** (this directory) — **tool**: scripts and configs for freezing. Lightweight, in git.
-- **`offline-assets-{tag}`** — **GitHub Release** in the `bashrusakh/rustdesk` fork.
-  Heavy binaries (Flutter engine, usbmmidd, drivers) are uploaded there so CI downloads
-  from our release, not from `rustdesk.com`.
-- The rest (vendor 2.7 GB, Flutter SDK, Rust MSI, vcpkg) stays local — for standalone fallback.
+- **`offline-assets-{tag}`** — a provider-side asset naming convention for candidate
+  Flutter-engine/driver inputs. Current provider release availability is unverified.
+- The rest (local vendor tree/archive, Flutter SDK, Rust MSI, and vcpkg) stays in
+  operator storage. It is not a tracked repository vendor bundle or a supported
+  standalone build claim.
 
 ## Freezing a new version
 
@@ -38,16 +43,63 @@ bash freeze.sh source        # git clone + bundle
 bash freeze.sh vendor        # cargo vendor
 bash freeze.sh engine        # Flutter engine
 # Other stages as needed
+bash freeze.sh --verify      # no network; never rewrites MANIFEST
+
+# Deterministic evidence report; gaps are reported, not guessed
+bash license-inventory.sh > /tmp/deskforge-third-party-inventory.txt
 ```
 
+An existing non-empty file is skipped only after its expected SHA-256 matches
+`versions.env`. If a digest is genuinely unavailable, `--allow-tofu` is an
+explicit manual exception for acquisition only; `--verify` still fails until a
+digest is recorded. Mutable release URLs are never proof of identity. Source
+verification requires both `RUSTDESK_REF` and the full `RUSTDESK_COMMIT`, and
+checks a clean, non-shallow checkout, recursive submodules, the bundle, and the
+checkout against that commit. Only freeze-generated `vendor/` and
+`.cargo/config.vendor.toml` paths are allowed as source working-tree additions;
+both are recorded in the manifest (`vendor/` by deterministic content hash and
+the config by exact SHA-256). Verification also compares the complete vendor
+tarball contents with the staged tree and requires the Cargo config to set
+`net.offline = true` and replace sources only with the local `vendor/`
+directory. `MANIFEST.txt` schema 2 and all
+required pin records are mandatory; legacy/incompatible manifests are never
+rewritten—use a new artifact directory and re-freeze. The TopMostWindow pin is
+also compared with the active workflow checkout line in the frozen RustDesk source.
+The vcpkg and TopMostWindow source trees are independently required to be
+initialized, non-shallow, clean, and exactly at their configured commits before
+freeze stages can mutate or download anything.
+
 For downstream forks:
 ```bash
 RUSTDESK_REPO=https://github.com/YOUR_ORG/rustdesk.git RUSTDESK_REF=1.5.0 bash freeze.sh
 ```
 
+The current local verification boundary is incomplete: the Flutter engine archive
+is missing, the existing manifest is legacy/incompatible with the required trusted
+manifest contract, the printer checksum sidecar has no accepted digest, and license
+evidence has gaps. The presence of `workflow-payload.key` also blocks verification;
+its contents are never inspected or recorded. A complete network-denied full build,
+signature/attestation verification, and release readiness are not claimed.
+
 ## Storage
 
 `artifacts/` is in `.gitignore` — heavy files are not committed.
-- `vendor/` — commit directly to the rustdesk fork or release asset.
-- Binaries (engine, usbmmidd, driver) — upload to fork GitHub Release (`offline-assets-{tag}`).
-- `bundles` — backup outside GitHub.
+- `vendor/` — keep in local operator storage or publish only through a separately
+  approved fork-maintenance process; it is not tracked in DeskForge.
+- Candidate engine/driver assets — provider-side handoff/release inputs only; their
+  availability and authenticity remain unverified here.
+- `bundles` — backup outside the repository.
+
+## Operational boundary
+
+- Missing local engine/source/vendor files and unavailable provider assets are
+  failures, not successful partial freezes. Existing files are preserved; the
+  tool does not delete artifacts.
+- `verify.sh` is read-only: it does not download, rewrite `MANIFEST.txt`, or
+  inspect secret payload keys. `workflow-payload.key` and similar files must
+  never be added to an inventory or manifest.
+- The inventory reports only license evidence paths and is incomplete. A `GAP` means
+  evidence is absent or intentionally outside the ignored local payload; no license is
+  inferred, and this inventory is not a verified license bundle. No signatures are claimed;
+  signature verification remains a gap. Missing engine, legacy manifest, empty printer
+  digest, incomplete license evidence, and secret-bearing artifact blockers remain explicit.
diff --git a/offline-kit/freeze.sh b/offline-kit/freeze.sh
old mode 100644
new mode 100755
index 588b787..9f9bbed
--- a/offline-kit/freeze.sh
+++ b/offline-kit/freeze.sh
@@ -1,217 +1,941 @@
 #!/usr/bin/env bash
-# offline-kit/freeze.sh — "online freeze stage" (PLAN.md §6, §8.1).
+# offline-kit/freeze.sh — resumable acquisition stage for the frozen kit.
 #
-# Выкачивает и замораживает ВСЁ, нужное для суверенной offline-сборки
-# Windows Flutter-клиента, ПОКА upstream rustdesk/rustdesk жив.
-#
-# Запускать в окружении с git + cargo (например, внутри контейнера
-# docker-build-linux-1, либо в WSL/Linux с установленным Rust). Все стадии
-# идемпотентны: уже скачанное пропускается, можно перезапускать после обрыва.
-#
-# НЕ запускает тяжёлый vcpkg install (ffmpeg/hwcodec) — это делается на
-# Windows-билдере (PLAN.md §8.3). Здесь только git-checkout vcpkg на baseline.
-#
-# Использование:
-#   bash freeze.sh                 # все стадии
-#   bash freeze.sh vendor          # только стадия vendor
-#   RUSTDESK_REPO=... bash freeze.sh   # переопределить источник (downstream-форк)
+# This script may download and update the ignored local artifact directory.
+# Verification is deliberately separate: use `bash freeze.sh --verify` for a
+# read-only, fail-closed check.
+
+set -u -o pipefail
 
-set -uo pipefail
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+cd "$SCRIPT_DIR"
 
-cd "$(dirname "$0")"
+_artifacts_override=${ARTIFACTS_DIR-}
+_repo_override=${RUSTDESK_REPO-}
+_ref_override=${RUSTDESK_REF-}
 # shellcheck disable=SC1091
 source ./versions.env
+[ -n "$_artifacts_override" ] && ARTIFACTS_DIR="$_artifacts_override"
+[ -n "$_repo_override" ] && RUSTDESK_REPO="$_repo_override"
+[ -n "$_ref_override" ] && RUSTDESK_REF="$_ref_override"
 
-# ENV переопределяет значения из versions.env (для downstream-форкеров)
-RUSTDESK_REPO="${RUSTDESK_REPO:?}"
-RUSTDESK_REF="${RUSTDESK_REF:?}"
+RUSTDESK_REPO=${RUSTDESK_REPO:?}
+RUSTDESK_REF=${RUSTDESK_REF:?}
+ARTIFACTS_DIR=${ARTIFACTS_DIR:?}
 
-OUT="$ARTIFACTS_DIR"
+OUT=$ARTIFACTS_DIR
 SRC="$OUT/rustdesk-src"
 MANIFEST="$OUT/MANIFEST.txt"
-mkdir -p "$OUT"
-
-log()  { echo "[freeze] $*"; }
-warn() { echo "[freeze][WARN] $*" >&2; }
-die()  { echo "[freeze][FAIL] $*" >&2; exit 1; }
+KIT_ROOT="$SCRIPT_DIR"
+ALLOW_TOFU=0
+MANIFEST_SCHEMA_VERSION=2
 
+log()  { printf '%s\n' "[freeze] $*"; }
+warn() { printf '%s\n' "[freeze][WARN] $*" >&2; }
+die()  { printf '%s\n' "[freeze][FAIL] $*" >&2; exit 1; }
 have() { command -v "$1" >/dev/null 2>&1; }
 
+display_value() {
+    local value=$1 rest host
+    case "$value" in
+        *://*@*)
+            rest=${value#*://}
+            host=${rest#*@}
+            printf '%s\n' "[redacted]@$host"
+            ;;
+        *workflow-payload*|*.key|*.pem|*.p12|*.pfx)
+            printf '%s\n' '[redacted]'
+            ;;
+        *) printf '%s\n' "$value" ;;
+    esac
+}
+
+usage() {
+    cat <<'EOF'
+Usage: bash freeze.sh [--allow-tofu] [--verify | stage ...]
+
+Stages: source vendor engine flutter_sdk vcpkg rust thirdparty
+
+--verify       run the read-only verifier; no network and no MANIFEST rewrite
+--allow-tofu   explicit manual exception for an artifact with no expected digest
+EOF
+}
+
+is_secret_path() {
+    case "$1" in
+        custom_.txt|*/custom_.txt|*.key|*.pem|*.p12|*.pfx|*/.env|.env|*workflow-payload*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+is_generated_source_path() {
+    case "$1" in
+        vendor|vendor/*|.cargo/config.vendor.toml) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+canonical_path() {
+    if have realpath; then
+        realpath -m "$1"
+    else
+        case "$1" in
+            /*) printf '%s\n' "$1" ;;
+            *) printf '%s/%s\n' "$SCRIPT_DIR" "$1" ;;
+        esac
+    fi
+}
+
+path_has_symlink() {
+    local path=$1 absolute component current
+    case "$path" in
+        /*) absolute=$path ;;
+        *) absolute="$SCRIPT_DIR/$path" ;;
+    esac
+    current=
+    IFS=/ read -r -a components <<< "${absolute#/}"
+    for component in "${components[@]}"; do
+        [ -n "$component" ] || continue
+        current="$current/$component"
+        [ -L "$current" ] && return 0
+    done
+    return 1
+}
+
+validate_existing_path_components() {
+    local path=$1 absolute component current
+    case "$path" in
+        /*) absolute=$path ;;
+        *) absolute="$SCRIPT_DIR/$path" ;;
+    esac
+    current=
+    IFS=/ read -r -a components <<< "${absolute#/}"
+    for component in "${components[@]}"; do
+        [ -n "$component" ] || continue
+        current="$current/$component"
+        if [ -L "$current" ]; then
+            return 1
+        fi
+        if [ -e "$current" ] && [ ! -d "$current" ] && [ "$current" != "$absolute" ]; then
+            return 1
+        fi
+    done
+    return 0
+}
+
+validate_path_location() {
+    local label=$1 path=$2 canonical
+    case "$path" in
+        *$'\n'*) warn "$label path contains a newline; refusing to stage it"; return 1 ;;
+    esac
+    canonical=$(canonical_path "$path") || return 1
+    case "$canonical" in
+        "$KIT_ROOT"|"$KIT_ROOT"/*) ;;
+        *) warn "$label path escapes kit root: [redacted path]"; return 1 ;;
+    esac
+    if ! validate_existing_path_components "$path"; then
+        warn "$label path contains a symlink; refusing to stage it: [redacted path]"
+        return 1
+    fi
+    return 0
+}
+
+validate_regular_tree() {
+    local label=$1 path=$2 bad
+    bad=$(LC_ALL=C find -P "$path" \( -type l -o \( ! -type f ! -type d \) \) -print -quit 2>/dev/null) || return 1
+    [ -z "$bad" ] || {
+        warn "$label contains a symlink or non-regular entry; refusing to stage it"
+        return 1
+    }
+    return 0
+}
+
+validate_staged_path() {
+    local label=$1 path=$2
+    validate_path_location "$label" "$path" || return 1
+    if [ -L "$path" ]; then
+        warn "$label is a symlink; refusing to stage it"
+        return 1
+    elif [ -f "$path" ]; then
+        return 0
+    elif [ -d "$path" ]; then
+        validate_regular_tree "$label" "$path"
+    else
+        warn "$label is not a regular file or directory: [redacted path]"
+        return 1
+    fi
+}
+
+validate_file_target() {
+    local label=$1 path=$2
+    validate_path_location "$label" "$path" || return 1
+    if [ -L "$path" ]; then
+        warn "$label is a symlink; refusing to stage it"
+        return 1
+    fi
+    if [ -e "$path" ] && [ ! -f "$path" ]; then
+        warn "$label is not a regular file"
+        return 1
+    fi
+    return 0
+}
+
+validate_optional_directory() {
+    local label=$1 path=$2
+    validate_path_location "$label" "$path" || return 1
+    if [ -e "$path" ]; then
+        [ -d "$path" ] || {
+            warn "$label is not a regular directory: [redacted path]"
+            return 1
+        }
+        validate_regular_tree "$label" "$path"
+    fi
+}
+
+check_vendor_config() {
+    local config=$1
+    validate_path_location "vendor-config" "$config" || return 1
+    [ -f "$config" ] || {
+        warn "vendor config is missing"
+        return 1
+    }
+    awk '
+        function trim(value) {
+            gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+            return value
+        }
+        function quoted(value) {
+            return value ~ /^"[^"\n]*"$/
+        }
+        function unquote(value) {
+            return substr(value, 2, length(value) - 2)
+        }
+        function mark_source(section) {
+            if (section == "net") {
+                source_kind = "net"
+                net_sections++
+            } else if (section == "source.crates-io") {
+                source_kind = "crates"
+                crates_sections++
+            } else if (section == "source.vendored-sources") {
+                source_kind = "vendor"
+                vendor_sections++
+            } else if (section ~ /^source\.\"git\+https:\/\/[^"]+\"$/) {
+                source_kind = "git"
+                git_sections++
+            } else {
+                bad = 1
+                source_kind = "unknown"
+            }
+        }
+        {
+            line = $0
+            sub(/\r$/, "", line)
+            sub(/[[:space:]]+#.*$/, "", line)
+            line = trim(line)
+            if (line == "") next
+            if (line ~ /^\[[^]]+\]$/) {
+                section = substr(line, 2, length(line) - 2)
+                mark_source(section)
+                next
+            }
+            if (line !~ /^[A-Za-z0-9_.-]+[[:space:]]*=/) {
+                bad = 1
+                next
+            }
+            if (source_kind == "unknown" || source_kind == "") {
+                bad = 1
+                next
+            }
+            equals = index(line, "=")
+            key = trim(substr(line, 1, equals - 1))
+            value = trim(substr(line, equals + 1))
+            if (source_kind == "net") {
+                # Cargo offline switch is a TOML boolean, not a string.
+                if (value != "true") {
+                    bad = 1
+                    next
+                }
+            } else {
+                if (!quoted(value)) {
+                    bad = 1
+                    next
+                }
+                value = unquote(value)
+            }
+            if (source_kind == "net") {
+                if (key != "offline" || value != "true" || ++net_offline > 1)
+                    bad = 1
+            } else if (source_kind == "crates") {
+                if (key != "replace-with" || value != "vendored-sources" || ++crates_replace > 1)
+                    bad = 1
+            } else if (source_kind == "vendor") {
+                if (key != "directory" || value != "vendor" || ++vendor_directory > 1)
+                    bad = 1
+            } else if (source_kind == "git") {
+                if (key == "replace-with") {
+                    if (value != "vendored-sources" || ++git_replace > git_sections)
+                        bad = 1
+                } else if (key == "git") {
+                    if (value !~ /^https:\/\/[^[:space:]"]+$/ || ++git_url > git_sections)
+                        bad = 1
+                } else if (key == "branch" || key == "tag") {
+                    if (++git_selector > git_sections || value == "") bad = 1
+                } else if (key == "rev") {
+                    if (value !~ /^[0-9a-fA-F]{7,64}$/ || ++git_rev > git_sections) bad = 1
+                } else {
+                    bad = 1
+                }
+            }
+        }
+        END {
+            if (bad || net_sections != 1 || net_offline != 1 ||
+                crates_sections != 1 || vendor_sections != 1 ||
+                crates_replace != 1 || vendor_directory != 1 ||
+                git_replace != git_sections || git_url != git_sections ||
+                git_selector > git_sections || git_rev > git_sections) exit 1
+        }
+    ' "$config" >/dev/null 2>&1 || {
+        warn "vendor config contains unknown or network-capable settings; only local vendored-sources replacement is allowed"
+        return 1
+    }
+}
+
+validate_source_entry_paths() {
+    validate_optional_directory "rustdesk-src" "$SRC" || return 1
+    if [ -d "$SRC" ]; then
+        validate_optional_directory "rustdesk-src/.cargo" "$SRC/.cargo" || return 1
+        validate_optional_directory "rustdesk-src/vendor" "$SRC/vendor" || return 1
+        validate_file_target "vendor-config" "$SRC/.cargo/config.vendor.toml" || return 1
+        if [ -f "$SRC/.cargo/config.vendor.toml" ]; then
+            check_vendor_config "$SRC/.cargo/config.vendor.toml" || return 1
+        fi
+    fi
+}
+
+validate_stage_entries() {
+    local stage=$1
+    case "$stage" in
+        source)
+            validate_source_entry_paths || return 1
+            validate_file_target "rustdesk-bundle" "$OUT/rustdesk-$RUSTDESK_REF.bundle" || return 1
+            ;;
+        vendor)
+            validate_source_entry_paths || return 1
+            [ -d "$SRC" ] || { warn "local-only source missing: $SRC"; return 1; }
+            validate_file_target "vendor-tarball" "$OUT/vendor-$RUSTDESK_REF.tar.gz" || return 1
+            validate_file_target "vendor-tarball" "$OUT/vendor-$RUSTDESK_REF.tar.zst" || return 1
+            ;;
+        engine)
+            validate_file_target "flutter-engine-win" "$OUT/windows-x64-release.zip" || return 1
+            ;;
+        flutter_sdk)
+            validate_file_target "flutter-sdk-win" "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip" || return 1
+            validate_file_target "flutter-sdk-linux" "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz" || return 1
+            ;;
+        vcpkg)
+            validate_optional_directory "vcpkg source" "$OUT/vcpkg" || return 1
+            ;;
+        rust)
+            validate_file_target "rust-win-msvc" "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" || return 1
+            ;;
+        thirdparty)
+            validate_optional_directory "TopMostWindow source" "$OUT/RustDeskTempTopMostWindow" || return 1
+            validate_file_target "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle" || return 1
+            validate_file_target "usbmmidd" "$OUT/usbmmidd_v2.zip" || return 1
+            validate_file_target "printer-driver" "$OUT/rustdesk_printer_driver_v4-1.4.zip" || return 1
+            validate_file_target "printer-adapter" "$OUT/printer_driver_adapter.zip" || return 1
+            validate_file_target "printer-sums" "$OUT/printer_sha256sums" || return 1
+            ;;
+        *)
+            warn "unknown stage: $stage"
+            return 1
+            ;;
+    esac
+}
+
+file_size() {
+    if stat -c '%s' "$1" 2>/dev/null; then return 0; fi
+    wc -c < "$1" | tr -d '[:space:]'
+}
+
+dir_size() {
+    if du -sb "$1" 2>/dev/null | awk '{print $1}'; then return 0; fi
+    du -sk "$1" | awk '{print $1 * 1024}'
+}
+
+sha256_file() {
+    if have sha256sum; then
+        sha256sum "$1" | awk '{print $1}'
+    elif have shasum; then
+        shasum -a 256 "$1" | awk '{print $1}'
+    else
+        die "sha256sum or shasum is required"
+    fi
+}
+
+content_hash_dir() {
+    local dir=$1 listing file rel digest target rc
+    listing=$(mktemp "${TMPDIR:-/tmp}/offline-kit-dir.XXXXXX") || return 1
+    (
+        cd "$dir" || exit 1
+        LC_ALL=C find -P . \( -type f -o -type l \) -print | LC_ALL=C sort |
+            while IFS= read -r file; do
+                rel=${file#./}
+                case "$rel" in
+                    *$'\n'*) exit 1 ;;
+                esac
+                is_secret_path "$rel" && exit 1
+                [ -f "$file" ] || exit 1
+                digest=$(sha256_file "$file") || exit 1
+                printf 'F\t%s\t%s\n' "$rel" "$digest"
+            done
+    ) > "$listing"
+    rc=$?
+    if [ "$rc" -eq 0 ]; then
+        sha256_file "$listing"
+        rc=$?
+    fi
+    rm -f "$listing"
+    return "$rc"
+}
+
+directory_record() {
+    local path=$1 tree
+    if tree=$(git -C "$path" rev-parse --verify --quiet HEAD^{tree} 2>/dev/null); then
+        printf 'git-tree:%s\n' "$tree"
+    else
+        tree=$(content_hash_dir "$path") || return 1
+        printf 'content-sha256:%s\n' "$tree"
+    fi
+}
+
+check_source_clean_except_generated() {
+    local path dirty=0
+    while IFS= read -r path; do
+        [ -z "$path" ] && continue
+        if ! is_generated_source_path "$path"; then
+            warn "source checkout has unexpected dirty or untracked path: [redacted path]"
+            dirty=1
+        fi
+    done < <(
+        git -C "$SRC" diff --name-only HEAD -- 2>/dev/null
+        git -C "$SRC" diff --cached --name-only HEAD -- 2>/dev/null
+        git -C "$SRC" status --porcelain=v1 --untracked-files=all 2>/dev/null |
+            while IFS= read -r path; do
+                path=${path:3}
+                path=${path#\"}
+                path=${path%\"}
+                printf '%s\n' "$path"
+            done
+    )
+    if [ -f "$SRC/.gitmodules" ]; then
+        git -C "$SRC" submodule status --recursive 2>/dev/null |
+            awk 'substr($0, 1, 1) ~ /[-+U]/ { bad=1 } END { exit bad }' || {
+                warn "recursive source submodule is uninitialized, modified, or mismatched"
+                dirty=1
+            }
+        git -C "$SRC" submodule foreach --quiet --recursive \
+            'test -z "$(git status --porcelain=v1 --untracked-files=all)"' >/dev/null 2>&1 || {
+                warn "recursive source submodule working tree is dirty"
+                dirty=1
+            }
+    fi
+    [ "$dirty" -eq 0 ]
+}
+
+check_git_dependency_tree() {
+    local label=$1 path=$2 expected=$3 head status
+    validate_optional_directory "$label" "$path" || return 1
+    [ -e "$path" ] || return 0
+    [ -e "$path/.git" ] || {
+        warn "$label is not an initialized Git checkout"
+        return 1
+    }
+    git -C "$path" rev-parse --git-dir >/dev/null 2>&1 || {
+        warn "$label is not an initialized Git checkout"
+        return 1
+    }
+    [ "$(git -C "$path" rev-parse --is-shallow-repository 2>/dev/null)" = false ] || {
+        warn "$label checkout is shallow or shallow state is unreadable"
+        return 1
+    }
+    head=$(git -C "$path" rev-parse --verify HEAD 2>/dev/null) || head=
+    [ "$head" = "$expected" ] || {
+        warn "$label commit mismatch; expected pinned commit"
+        return 1
+    }
+    status=$(git -C "$path" status --porcelain=v1 --untracked-files=all --ignored=matching 2>/dev/null) || {
+        warn "$label checkout status could not be inspected"
+        return 1
+    }
+    [ -z "$status" ] || {
+        warn "$label checkout has unexpected untracked or modified files"
+        return 1
+    }
+    if [ -f "$path/.gitmodules" ]; then
+        git -C "$path" submodule status --recursive 2>/dev/null |
+            awk 'substr($0, 1, 1) ~ /[-+U]/ { bad=1 } END { exit bad }' || {
+                warn "$label has an uninitialized, modified, or mismatched recursive submodule"
+                return 1
+            }
+        git -C "$path" submodule foreach --quiet --recursive \
+            'test -z "$(git status --porcelain=v1 --untracked-files=all --ignored=matching)"' >/dev/null 2>&1 || {
+                warn "$label recursive submodule working tree is dirty"
+                return 1
+            }
+    fi
+    return 0
+}
+
+preflight_source_dependencies() {
+    local stage=$1
+    case "$stage" in
+        vcpkg)
+            check_git_dependency_tree "vcpkg source" "$OUT/vcpkg" "$VCPKG_BASELINE" || return 1
+            ;;
+        thirdparty)
+            check_git_dependency_tree "TopMostWindow source" \
+                "$OUT/RustDeskTempTopMostWindow" "$TOPMOST_COMMIT" || return 1
+            ;;
+    esac
+}
+
+check_manifest_compatibility() {
+    local schema_count key pin_count pin_value
+    [ -f "$MANIFEST" ] || return 0
+    schema_count=$(awk -v version="$MANIFEST_SCHEMA_VERSION" \
+        '$0 == "# schema=" version { count++ } END { print count + 0 }' "$MANIFEST")
+    if [ "$schema_count" -ne 1 ]; then
+        die "incompatible MANIFEST.txt (legacy or unsupported schema); migrate/re-freeze into a new empty artifact directory, then rerun"
+    fi
+    for key in RUSTDESK_REF RUSTDESK_COMMIT RUST_VERSION LLVM_VERSION FLUTTER_VERSION \
+        FLUTTER_RUST_BRIDGE_VERSION NDK_VERSION CARGO_NDK_VERSION VCPKG_BASELINE VCPKG_TRIPLET; do
+        pin_count=$(awk -v key="$key" '$0 ~ "^# pin " key "=" { count++ } END { print count + 0 }' "$MANIFEST")
+        pin_value=$(awk -v key="$key" '$0 ~ "^# pin " key "=" { sub("^# pin " key "=", ""); print; exit }' "$MANIFEST")
+        if [ "$pin_count" -ne 1 ] || [ -z "$pin_value" ]; then
+            die "incompatible MANIFEST.txt (missing or duplicate required pin record $key); migrate/re-freeze into a new empty artifact directory, then rerun"
+        fi
+    done
+}
+
+expected_digest_for() {
+    case "$1" in
+        "$OUT/rustdesk-$RUSTDESK_REF.bundle") printf '%s\n' "${RUSTDESK_BUNDLE_SHA256-}" ;;
+        "$OUT/vendor-$RUSTDESK_REF.tar.zst"|"$OUT/vendor-$RUSTDESK_REF.tar.gz") printf '%s\n' "${VENDOR_TARBALL_SHA256-}" ;;
+        "$OUT/windows-x64-release.zip") printf '%s\n' "${FLUTTER_ENGINE_WIN_SHA256-}" ;;
+        "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip") printf '%s\n' "${FLUTTER_SDK_WIN_SHA256-}" ;;
+        "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz") printf '%s\n' "${FLUTTER_SDK_LINUX_SHA256-}" ;;
+        "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi") printf '%s\n' "${RUST_WIN_MSI_SHA256-}" ;;
+        "$OUT/RustDeskTempTopMostWindow.bundle") printf '%s\n' "${TOPMOST_BUNDLE_SHA256-}" ;;
+        "$OUT/usbmmidd_v2.zip") printf '%s\n' "${USBMMIDD_SHA256-}" ;;
+        "$OUT/rustdesk_printer_driver_v4-1.4.zip") printf '%s\n' "${PRINTER_DRIVER_SHA256-}" ;;
+        "$OUT/printer_driver_adapter.zip") printf '%s\n' "${PRINTER_ADAPTER_SHA256-}" ;;
+        "$OUT/printer_sha256sums") printf '%s\n' "${PRINTER_SUMS_SHA256-}" ;;
+        *) printf '%s\n' "" ;;
+    esac
+}
+
+require_digest_policy() {
+    local label=$1 path=$2 expected
+    expected=$(expected_digest_for "$path")
+    if [ -z "$expected" ]; then
+        if [ "$ALLOW_TOFU" -eq 1 ]; then
+            warn "TOFU/manual exception for $label; digest is not evidence: $path"
+            return 0
+        fi
+        warn "missing expected digest for $label; rerun with --allow-tofu only after manual review: $path"
+        return 1
+    fi
+    [[ "$expected" =~ ^[0-9a-fA-F]{64}$ ]] || {
+        warn "invalid expected SHA-256 for $label"
+        return 1
+    }
+}
+
+verify_existing_file() {
+    local label=$1 path=$2 expected actual
+    validate_file_target "$label" "$path" || return 1
+    [ -s "$path" ] || return 1
+    require_digest_policy "$label" "$path" || return 2
+    expected=$(expected_digest_for "$path")
+    [ -n "$expected" ] || return 0
+    actual=$(sha256_file "$path")
+    if [ "$actual" != "$expected" ]; then
+        warn "digest mismatch for $label (preserving existing file): $path"
+        return 1
+    fi
+    return 0
+}
+
 record() {
-    # record <label> <path> — идемпотентно: заменяет существующую строку этого label
-    local label="$1" path="$2" line=""
+    local label=$1 path=$2 line tmp checksum
+    is_secret_path "$path" && die "refusing to record a secret-bearing path"
+    validate_staged_path "$label" "$path" || return 1
     if [ -f "$path" ]; then
-        local sum size
-        sum=$( (sha256sum "$path" 2>/dev/null || shasum -a 256 "$path") | awk '{print $1}')
-        size=$(du -h "$path" | awk '{print $1}')
-        line="$label  $size  sha256:$sum  $path"
+        line="$label  $(file_size "$path")  sha256:$(sha256_file "$path")  $path"
     elif [ -d "$path" ]; then
-        local size
-        size=$(du -sh "$path" | awk '{print $1}')
-        line="$label  $size  (dir)  $path"
+        checksum=$(directory_record "$path") || return 1
+        line="$label  $(dir_size "$path")  $checksum  $path"
     else
-        return
+        return 1
     fi
-    # убрать прежнюю строку с этим label (первое поле), затем дописать свежую
+    tmp="$MANIFEST.tmp.$$"
+    validate_file_target "manifest temporary" "$tmp" || return 1
     if [ -f "$MANIFEST" ]; then
-        grep -v "^$label  " "$MANIFEST" > "$MANIFEST.tmp" 2>/dev/null && mv "$MANIFEST.tmp" "$MANIFEST"
+        awk -v label="$label" '$1 != label' "$MANIFEST" > "$tmp" || return 1
+        mv -f "$tmp" "$MANIFEST"
     fi
-    echo "$line" >> "$MANIFEST"
+    printf '%s\n' "$line" >> "$MANIFEST"
 }
 
 dl() {
-    # dl <url> <output> — resumable download, skip if present & non-empty
-    local url="$1" out="$2"
-    if [ -s "$out" ]; then log "skip (exists): $out"; return 0; fi
-    log "download: $url"
+    local label=$1 url=$2 out=$3 expected actual
+    is_secret_path "$out" && die "refusing to handle a secret-bearing path"
+    validate_file_target "$label" "$out" || return 1
+    if [ -s "$out" ]; then
+        if verify_existing_file "$label" "$out"; then
+            log "skip (verified): $out"
+            return 0
+        else
+            local existing_rc=$?
+            [ "$existing_rc" -eq 2 ] && return 1
+        fi
+        warn "resuming after digest mismatch; final digest must match: $out"
+    else
+        require_digest_policy "$label" "$out" || return 1
+    fi
+    log "download provider asset: $(display_value "$url")"
     if have curl; then
-        curl -fSL --retry 3 -C - -o "$out" "$url" || { warn "download failed: $url"; return 1; }
+        curl -fSL --retry 3 -C - -o "$out" "$url" || {
+            warn "provider asset unavailable: $label"
+            return 1
+        }
     elif have wget; then
-        wget -c -O "$out" "$url" || { warn "download failed: $url"; return 1; }
+        wget -c -O "$out" "$url" || {
+            warn "provider asset unavailable: $label"
+            return 1
+        }
     else
-        die "neither curl nor wget available"
+        warn "provider asset unavailable: neither curl nor wget is available"
+        return 1
+    fi
+    [ -s "$out" ] || { warn "provider returned an empty asset: $label"; return 1; }
+    expected=$(expected_digest_for "$out")
+    if [ -z "$expected" ]; then
+        [ "$ALLOW_TOFU" -eq 1 ] || return 1
+        warn "downloaded $label under explicit TOFU/manual exception"
+        return 0
     fi
+    actual=$(sha256_file "$out")
+    [ "$actual" = "$expected" ] || {
+        warn "downloaded asset digest mismatch for $label; preserving file"
+        return 1
+    }
+}
+
+verify_source_identity() {
+    local head ref_commit
+    [ -d "$SRC/.git" ] || { warn "local-only source missing: $SRC"; return 1; }
+    have git || { warn "git not found"; return 1; }
+    head=$(git -C "$SRC" rev-parse HEAD 2>/dev/null) || {
+        warn "cannot read local source HEAD: $SRC"; return 1;
+    }
+    [ "$head" = "$RUSTDESK_COMMIT" ] || {
+        warn "source commit mismatch: expected $RUSTDESK_COMMIT, got $head"; return 1;
+    }
+    git -C "$SRC" check-ref-format --allow-onelevel "refs/tags/$RUSTDESK_REF" >/dev/null 2>&1 || {
+        warn "source ref is not a valid immutable tag name: $RUSTDESK_REF"; return 1;
+    }
+    ref_commit=$(git -C "$SRC" rev-parse --verify "refs/tags/$RUSTDESK_REF^{commit}" 2>/dev/null) || {
+        warn "source ref/tag is unavailable locally: $RUSTDESK_REF"; return 1;
+    }
+    [ "$ref_commit" = "$RUSTDESK_COMMIT" ] || {
+        warn "source ref/tag mismatch: $RUSTDESK_REF is $ref_commit"; return 1;
+    }
+}
+
+verify_bundle_commit() {
+    local bundle=$1 heads bundle_path
+    bundle_path=$(canonical_path "$bundle") || return 1
+    git bundle verify "$bundle_path" >/dev/null 2>&1 || {
+        warn "source bundle is invalid: $bundle"; return 1;
+    }
+    heads=$(git bundle list-heads "$bundle_path" 2>/dev/null || true)
+    printf '%s\n' "$heads" | awk '{print $1}' | grep -F -x "$RUSTDESK_COMMIT" >/dev/null 2>&1 || {
+        warn "source bundle does not contain RUSTDESK_COMMIT"; return 1;
+    }
 }
 
-# ---------------------------------------------------------------------------
 stage_source() {
-    log "=== STAGE: source (git clone + submodules, pin $RUSTDESK_REF) ==="
+    local bundle="$OUT/rustdesk-$RUSTDESK_REF.bundle" head
+    log "=== STAGE: source (pin $RUSTDESK_REF @ $RUSTDESK_COMMIT) ==="
     have git || die "git not found"
-    # ВАЖНО: полный клон (НЕ --depth 1). Из shallow-клона git bundle --all получается
-    # неполным ("remote did not send all necessary objects" при клоне обратно).
+    validate_stage_entries source || return 1
     if [ ! -d "$SRC/.git" ]; then
-        git clone --branch "$RUSTDESK_REF" --recurse-submodules \
-            "$RUSTDESK_REPO" "$SRC" || die "clone failed"
-    else
-        log "source already present at $SRC (если был shallow — bundle пересобери на полном клоне)"
+        git clone --branch "$RUSTDESK_REF" --recurse-submodules "$RUSTDESK_REPO" "$SRC" || {
+            warn "local-only source acquisition failed"; return 1;
+        }
     fi
-    # git bundle — единый переносимый архив репозитория. Требует ПОЛНОЙ истории.
-    local bundle="$OUT/rustdesk-$RUSTDESK_REF.bundle"
-    if [ ! -s "$bundle" ]; then
-        ( cd "$SRC" && git bundle create "../rustdesk-$RUSTDESK_REF.bundle" --all ) \
-            && log "bundle created: $bundle" || warn "bundle failed"
+    verify_source_identity || return 1
+    check_source_clean_except_generated || return 1
+    validate_file_target "rustdesk-bundle" "$bundle" || return 1
+    head=$(git -C "$SRC" rev-parse HEAD) || return 1
+    [ "$head" = "$RUSTDESK_COMMIT" ] || return 1
+    if [ -s "$bundle" ]; then
+        verify_existing_file "rustdesk-bundle" "$bundle" || {
+            warn "source bundle mismatch; preserving existing bundle: $bundle"; return 1;
+        }
+        verify_bundle_commit "$bundle" || return 1
+    else
+        require_digest_policy "rustdesk-bundle" "$bundle" || return 1
+        ( cd "$SRC" && git bundle create "../rustdesk-$RUSTDESK_REF.bundle" --all ) || {
+            warn "source bundle creation failed"; return 1;
+        }
+        verify_existing_file "rustdesk-bundle" "$bundle" || return 1
+        verify_bundle_commit "$bundle" || return 1
     fi
-    record "rustdesk-bundle" "$bundle"
+    record "rustdesk-source" "$SRC" || return 1
+    record "rustdesk-bundle" "$bundle" || return 1
 }
 
 stage_vendor() {
-    log "=== STAGE: vendor (cargo vendor → замораживает hbb_common + ~20 rustdesk-org/*) ==="
-    [ -d "$SRC" ] || die "run stage_source first (no $SRC)"
-    have cargo || die "cargo not found — запусти в build-linux контейнере или WSL с Rust"
-    if [ ! -d "$SRC/vendor" ]; then
-        ( cd "$SRC" && cargo vendor vendor > .cargo/config.vendor.toml 2>/dev/null ) \
-            || warn "cargo vendor вернул ненулевой код (проверь .cargo/config.vendor.toml)"
+    local tarball vendor_stage
+    log "=== STAGE: vendor (cargo vendor) ==="
+    validate_stage_entries vendor || return 1
+    [ -d "$SRC" ] || { warn "local-only source missing: $SRC"; return 1; }
+    verify_source_identity || return 1
+    check_source_clean_except_generated || return 1
+    have cargo || { warn "local-only vendor generation unavailable: cargo not found"; return 1; }
+    if [ ! -d "$SRC/vendor" ] || [ ! -f "$SRC/.cargo/config.vendor.toml" ]; then
+        vendor_stage=$(mktemp -d "$OUT/.offline-kit-vendor-stage.XXXXXX") || {
+            warn "cannot create safe vendor staging directory"; return 1;
+        }
+        vendor_stage=$(canonical_path "$vendor_stage") || {
+            rm -rf "$vendor_stage"; return 1;
+        }
+        validate_path_location "vendor staging" "$vendor_stage" || {
+            rm -rf "$vendor_stage"; return 1;
+        }
+        validate_path_location "staged vendor" "$vendor_stage/vendor" || {
+            rm -rf "$vendor_stage"; return 1;
+        }
+        validate_file_target "staged vendor-config" "$vendor_stage/config.vendor.toml" || {
+            rm -rf "$vendor_stage"; return 1;
+        }
+        if ! ( cd "$SRC" && cargo vendor "$vendor_stage/vendor" > "$vendor_stage/config.vendor.toml" 2>/dev/null ); then
+            rm -rf "$vendor_stage"
+            warn "vendor generation failed"
+            return 1
+        fi
+        validate_file_target "staged offline vendor-config" "$vendor_stage/config.vendor.toml.offline" || {
+            rm -rf "$vendor_stage"; return 1
+        }
+        {
+            printf '%s\n' '[net]' 'offline = true' ''
+            awk '
+                BEGIN { in_vendor = 0 }
+                {
+                    line = $0
+                    if (line == "[source.vendored-sources]") in_vendor = 1
+                    else if (line ~ /^\[/) in_vendor = 0
+                    if (in_vendor && line ~ /^[[:space:]]*directory[[:space:]]*=/) {
+                        print "directory = \"vendor\""
+                    } else {
+                        print line
+                    }
+                }
+            ' "$vendor_stage/config.vendor.toml"
+        } > "$vendor_stage/config.vendor.toml.offline" || {
+            rm -rf "$vendor_stage"; return 1
+        }
+        mv -f "$vendor_stage/config.vendor.toml.offline" "$vendor_stage/config.vendor.toml" || {
+            rm -rf "$vendor_stage"; return 1
+        }
+        validate_staged_path "staged vendor" "$vendor_stage/vendor" || {
+            rm -rf "$vendor_stage"; return 1;
+        }
+        validate_file_target "staged vendor-config" "$vendor_stage/config.vendor.toml" || {
+            rm -rf "$vendor_stage"; return 1
+        }
+        check_vendor_config "$vendor_stage/config.vendor.toml" || {
+            rm -rf "$vendor_stage"; return 1
+        }
+        if [ ! -d "$SRC/vendor" ]; then
+            validate_path_location "rustdesk-src/vendor" "$SRC/vendor" || {
+                rm -rf "$vendor_stage"; return 1
+            }
+            cp -a -- "$vendor_stage/vendor" "$SRC/vendor" || {
+                rm -rf "$vendor_stage"; return 1
+            }
+        fi
+        if [ ! -f "$SRC/.cargo/config.vendor.toml" ]; then
+            validate_path_location "rustdesk-src/.cargo" "$SRC/.cargo" || {
+                rm -rf "$vendor_stage"; return 1
+            }
+            if [ ! -e "$SRC/.cargo" ]; then
+                mkdir "$SRC/.cargo" || {
+                    rm -rf "$vendor_stage"; return 1
+                }
+            fi
+            validate_file_target "rustdesk-src/.cargo/config.vendor.toml" "$SRC/.cargo/config.vendor.toml" || {
+                rm -rf "$vendor_stage"; return 1
+            }
+            cp -- "$vendor_stage/config.vendor.toml" "$SRC/.cargo/config.vendor.toml" || {
+                rm -rf "$vendor_stage"; return 1
+            }
+        fi
+        rm -rf "$vendor_stage"
     else
         log "vendor already present"
     fi
-    # tarball для хранения отдельно от git
-    local tar="$OUT/vendor-$RUSTDESK_REF.tar.zst"
-    if [ ! -s "$tar" ] && [ -d "$SRC/vendor" ]; then
-        if have zstd; then
-            tar -C "$SRC" -cf - vendor | zstd -q -o "$tar" && log "vendor tarball: $tar"
-        else
-            tar="$OUT/vendor-$RUSTDESK_REF.tar.gz"
-            tar -C "$SRC" -czf "$tar" vendor && log "vendor tarball (gz): $tar"
-        fi
+    validate_stage_entries vendor || return 1
+    check_source_clean_except_generated || return 1
+    tarball="$OUT/vendor-$RUSTDESK_REF.tar.gz"
+    if [ ! -s "$tarball" ] && [ -s "$OUT/vendor-$RUSTDESK_REF.tar.zst" ]; then
+        tarball="$OUT/vendor-$RUSTDESK_REF.tar.zst"
+    fi
+    if [ ! -s "$tarball" ]; then
+        validate_file_target "vendor-tarball" "$tarball" || return 1
+        require_digest_policy "vendor-tarball" "$tarball" || return 1
+        # Keep the pinned artifact format deterministic; an existing zstd
+        # artifact remains resumable/accepted when its digest is pinned.
+        tar -C "$SRC" -czf "$tarball" vendor || return 1
+        verify_existing_file "vendor-tarball" "$tarball" || return 1
+    else
+        validate_file_target "vendor-tarball" "$tarball" || return 1
+        verify_existing_file "vendor-tarball" "$tarball" || return 1
     fi
-    record "vendor-tarball" "$tar"
+    record "rustdesk-source" "$SRC" || return 1
+    record "vendor-tarball" "$tarball" || return 1
+    record "vendor-source" "$SRC/vendor" || return 1
+    record "vendor-config" "$SRC/.cargo/config.vendor.toml" || return 1
 }
 
 stage_engine() {
-    log "=== STAGE: flutter engine (кастомный rustdesk, Windows x64) ==="
-    dl "$FLUTTER_ENGINE_WIN_URL" "$OUT/windows-x64-release.zip"
-    record "flutter-engine-win" "$OUT/windows-x64-release.zip"
+    log "=== STAGE: flutter engine (Windows x64) ==="
+    dl "flutter-engine-win" "$FLUTTER_ENGINE_WIN_URL" "$OUT/windows-x64-release.zip" || return 1
+    record "flutter-engine-win" "$OUT/windows-x64-release.zip" || return 1
 }
 
 stage_flutter_sdk() {
     log "=== STAGE: flutter SDK ($FLUTTER_VERSION) ==="
-    dl "$FLUTTER_SDK_WIN_URL"   "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip"
-    dl "$FLUTTER_SDK_LINUX_URL" "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz"
-    record "flutter-sdk-win"   "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip"
-    record "flutter-sdk-linux" "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz"
+    dl "flutter-sdk-win" "$FLUTTER_SDK_WIN_URL" "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip" || return 1
+    dl "flutter-sdk-linux" "$FLUTTER_SDK_LINUX_URL" "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz" || return 1
+    record "flutter-sdk-win" "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip" || return 1
+    record "flutter-sdk-linux" "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz" || return 1
 }
 
 stage_vcpkg() {
-    log "=== STAGE: vcpkg (checkout на baseline $VCPKG_BASELINE) ==="
     local vdir="$OUT/vcpkg"
-    if [ ! -d "$vdir/.git" ]; then
-        git clone "$VCPKG_REPO" "$vdir" || { warn "vcpkg clone failed"; return 1; }
+    log "=== STAGE: vcpkg (baseline $VCPKG_BASELINE) ==="
+    have git || return 1
+    validate_stage_entries vcpkg || return 1
+    preflight_source_dependencies vcpkg || return 1
+    if [ ! -e "$vdir/.git" ]; then
+        git clone "$VCPKG_REPO" "$vdir" || { warn "provider source unavailable: vcpkg"; return 1; }
     fi
-    ( cd "$vdir" && git fetch --depth 1 origin "$VCPKG_BASELINE" 2>/dev/null; \
-      git checkout "$VCPKG_BASELINE" 2>/dev/null ) \
-        || warn "vcpkg checkout $VCPKG_BASELINE не удался (нужен полный fetch)"
-    log "vcpkg готов на baseline. ВНИМАНИЕ: binary cache (ffmpeg/hwcodec, триплет"
-    log "$VCPKG_TRIPLET) собирается на Windows-билдере, не здесь (PLAN.md §8.3)."
-    record "vcpkg-src" "$vdir"
+    ( cd "$vdir" && git fetch origin "$VCPKG_BASELINE" 2>/dev/null && git checkout --detach "$VCPKG_BASELINE" 2>/dev/null ) || {
+        warn "vcpkg baseline unavailable locally: $VCPKG_BASELINE"; return 1;
+    }
+    check_git_dependency_tree "vcpkg source" "$vdir" "$VCPKG_BASELINE" || return 1
+    record "vcpkg-src" "$vdir" || return 1
 }
 
 stage_rust() {
     log "=== STAGE: rust toolchain offline installer ($RUST_VERSION) ==="
-    # rustup-init + offline-инсталлятор для Windows-хоста (MSVC host).
-    # Для полного offline нужен host x86_64-pc-windows-msvc; здесь качаем dist-архив.
-    local base="https://static.rust-lang.org/dist"
-    dl "$base/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" \
-       "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" \
-        || warn "rust msi: если недоступен, ставь через rustup на билдере"
-    record "rust-win-msvc" "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi"
+    dl "rust-win-msvc" "https://static.rust-lang.org/dist/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" \
+        "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" || return 1
+    record "rust-win-msvc" "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" || return 1
 }
 
 stage_thirdparty() {
-    log "=== STAGE: thirdparty (TopMostWindow src + usbmmidd + printer drivers) ==="
-    # RustDeskTempTopMostWindow — собирается на win-агенте, замораживаем исходники
     local tmw="$OUT/RustDeskTempTopMostWindow"
-    if [ ! -d "$tmw/.git" ]; then
-        git clone "$TOPMOST_REPO" "$tmw" || warn "TopMostWindow clone failed"
+    log "=== STAGE: thirdparty (TopMostWindow, usbmmidd, printer assets) ==="
+    validate_stage_entries thirdparty || return 1
+    preflight_source_dependencies thirdparty || return 1
+    if [ ! -e "$tmw/.git" ]; then
+        git clone "$TOPMOST_REPO" "$tmw" || { warn "provider source unavailable: TopMostWindow"; return 1; }
     fi
-    if [ -d "$tmw/.git" ]; then
-        ( cd "$tmw" && git checkout "$TOPMOST_COMMIT" 2>/dev/null ) || warn "TopMost checkout $TOPMOST_COMMIT failed"
-        ( cd "$tmw" && git bundle create "../RustDeskTempTopMostWindow.bundle" --all ) 2>/dev/null
+    ( cd "$tmw" && git fetch origin "$TOPMOST_COMMIT" 2>/dev/null && git checkout --detach "$TOPMOST_COMMIT" 2>/dev/null ) || {
+        warn "TopMostWindow commit unavailable locally: $TOPMOST_COMMIT"; return 1;
+    }
+    check_git_dependency_tree "TopMostWindow source" "$tmw" "$TOPMOST_COMMIT" || return 1
+    validate_file_target "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle" || return 1
+    if [ ! -s "$OUT/RustDeskTempTopMostWindow.bundle" ]; then
+        require_digest_policy "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle" || return 1
+        ( cd "$tmw" && git bundle create "../RustDeskTempTopMostWindow.bundle" --all ) || return 1
+        verify_existing_file "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle" || return 1
+    else
+        verify_existing_file "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle" || return 1
     fi
-    record "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle"
-    # release-assets (бинарные)
-    dl "$USBMMIDD_URL"        "$OUT/usbmmidd_v2.zip"
-    dl "$PRINTER_DRIVER_URL"  "$OUT/rustdesk_printer_driver_v4-1.4.zip"
-    dl "$PRINTER_ADAPTER_URL" "$OUT/printer_driver_adapter.zip"
-    dl "$PRINTER_SUMS_URL"    "$OUT/printer_sha256sums"
-    record "usbmmidd"         "$OUT/usbmmidd_v2.zip"
-    record "printer-driver"   "$OUT/rustdesk_printer_driver_v4-1.4.zip"
-    record "printer-adapter"  "$OUT/printer_driver_adapter.zip"
+    dl "usbmmidd" "$USBMMIDD_URL" "$OUT/usbmmidd_v2.zip" || return 1
+    dl "printer-driver" "$PRINTER_DRIVER_URL" "$OUT/rustdesk_printer_driver_v4-1.4.zip" || return 1
+    dl "printer-adapter" "$PRINTER_ADAPTER_URL" "$OUT/printer_driver_adapter.zip" || return 1
+    dl "printer-sums" "$PRINTER_SUMS_URL" "$OUT/printer_sha256sums" || return 1
+    record "topmost-bundle" "$OUT/RustDeskTempTopMostWindow.bundle" || return 1
+    record "topmost-src" "$tmw" || return 1
+    record "usbmmidd" "$OUT/usbmmidd_v2.zip" || return 1
+    record "printer-driver" "$OUT/rustdesk_printer_driver_v4-1.4.zip" || return 1
+    record "printer-adapter" "$OUT/printer_driver_adapter.zip" || return 1
+    record "printer-sums" "$OUT/printer_sha256sums" || return 1
 }
 
 write_manifest_header() {
-    # Заголовок пишется только если манифеста нет — частичные прогоны не затирают записи.
-    [ -f "$MANIFEST" ] && return
+    [ -f "$MANIFEST" ] && return 0
     {
-        echo "# offline-kit MANIFEST — суверенный комплект сборки rustdesk $RUSTDESK_REF"
-        echo "# Создан: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-        echo "# Источник: $RUSTDESK_REPO @ $RUSTDESK_REF"
-        echo "# Пины: Rust $RUST_VERSION, Flutter $FLUTTER_VERSION, LLVM $LLVM_VERSION,"
-        echo "#       vcpkg baseline $VCPKG_BASELINE, triplet $VCPKG_TRIPLET"
-        echo "#"
-        echo "# label  size  checksum  path"
+        printf '%s\n' "# offline-kit MANIFEST — frozen rustdesk $RUSTDESK_REF"
+        printf '%s\n' "# schema=$MANIFEST_SCHEMA_VERSION"
+        printf '%s\n' "# Source: $(display_value "$RUSTDESK_REPO")"
+        printf '%s\n' "# label  exact-byte-size  checksum  path"
+        printf '%s\n' "# pin RUSTDESK_REF=$RUSTDESK_REF"
+        printf '%s\n' "# pin RUSTDESK_COMMIT=$RUSTDESK_COMMIT"
+        printf '%s\n' "# pin RUST_VERSION=$RUST_VERSION"
+        printf '%s\n' "# pin LLVM_VERSION=$LLVM_VERSION"
+        printf '%s\n' "# pin FLUTTER_VERSION=$FLUTTER_VERSION"
+        printf '%s\n' "# pin FLUTTER_RUST_BRIDGE_VERSION=$FLUTTER_RUST_BRIDGE_VERSION"
+        printf '%s\n' "# pin NDK_VERSION=$NDK_VERSION"
+        printf '%s\n' "# pin CARGO_NDK_VERSION=$CARGO_NDK_VERSION"
+        printf '%s\n' "# pin VCPKG_BASELINE=$VCPKG_BASELINE"
+        printf '%s\n' "# pin VCPKG_TRIPLET=$VCPKG_TRIPLET"
     } > "$MANIFEST"
 }
 
 main() {
-    write_manifest_header
-    local stages=("$@")
-    if [ ${#stages[@]} -eq 0 ]; then
-        stages=(source vendor engine flutter_sdk vcpkg rust thirdparty)
-    fi
+    local stages=() s
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --help|-h) usage; return 0 ;;
+            --verify) exec bash "$SCRIPT_DIR/verify.sh" ;;
+            --allow-tofu) ALLOW_TOFU=1 ;;
+            --) shift; stages+=("$@"); break ;;
+            *) stages+=("$1") ;;
+        esac
+        shift
+    done
+    [ "${#stages[@]}" -gt 0 ] || stages=(source vendor engine flutter_sdk vcpkg rust thirdparty)
+    validate_path_location "artifact directory" "$OUT" || die "artifact directory is outside the kit or contains a symlink"
+    validate_file_target "manifest" "$MANIFEST" || die "manifest path is outside the kit or contains a symlink"
+    check_manifest_compatibility
+    for s in "${stages[@]}"; do
+        validate_stage_entries "$s" || die "stage-entry validation failed; no stage mutation was performed"
+        preflight_source_dependencies "$s" || die "source dependency preflight failed; no stage mutation was performed"
+    done
+    mkdir -p "$OUT" || die "cannot create artifact directory"
+    write_manifest_header || die "cannot create MANIFEST"
     for s in "${stages[@]}"; do
         case "$s" in
-            source)      stage_source ;;
-            vendor)      stage_vendor ;;
-            engine)      stage_engine ;;
-            flutter_sdk) stage_flutter_sdk ;;
-            vcpkg)       stage_vcpkg ;;
-            rust)        stage_rust ;;
-            thirdparty)  stage_thirdparty ;;
-            *) warn "unknown stage: $s" ;;
+            source) stage_source || die "stage failed; stopping immediately: source" ;;
+            vendor) stage_vendor || die "stage failed; stopping immediately: vendor" ;;
+            engine) stage_engine || die "stage failed; stopping immediately: engine" ;;
+            flutter_sdk) stage_flutter_sdk || die "stage failed; stopping immediately: flutter_sdk" ;;
+            vcpkg) stage_vcpkg || die "stage failed; stopping immediately: vcpkg" ;;
+            rust) stage_rust || die "stage failed; stopping immediately: rust" ;;
+            thirdparty) stage_thirdparty || die "stage failed; stopping immediately: thirdparty" ;;
+            *) die "stage-entry validation failed; no stage mutation was performed" ;;
         esac
     done
-    log "=== ГОТОВО. Манифест: $MANIFEST ==="
-    [ -f "$MANIFEST" ] && cat "$MANIFEST"
+    log "=== stages complete; verify with: bash freeze.sh --verify ==="
 }
 
 main "$@"
diff --git a/offline-kit/license-inventory.sh b/offline-kit/license-inventory.sh
new file mode 100755
index 0000000..c84a781
--- /dev/null
+++ b/offline-kit/license-inventory.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Deterministic third-party license evidence inventory.
+# It reports evidence paths only; it never invents a license conclusion.
+
+set -u -o pipefail
+export LC_ALL=C
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd -P)
+_root_override=${1-}
+[ -n "$_root_override" ] && ROOT=$(CDPATH= cd -- "$_root_override" && pwd -P)
+
+case "$ROOT" in
+    "$SCRIPT_DIR/artifacts"|"$SCRIPT_DIR/artifacts"/*)
+        printf '%s\n' "license inventory refuses to scan offline-kit/artifacts" >&2
+        exit 2
+        ;;
+esac
+
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/versions.env"
+
+is_secret_value() {
+    case "$1" in
+        *.key|*.pem|*.p12|*.pfx|*/.env|.env|*workflow-payload*|*://*@*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+display_value() {
+    local value=$1 rest host
+    if is_secret_value "$value"; then
+        case "$value" in
+            *://*@*)
+                rest=${value#*://}
+                host=${rest#*@}
+                printf '%s\n' "[redacted]@$host"
+                ;;
+            *) printf '%s\n' '[redacted]' ;;
+        esac
+    else
+        printf '%s\n' "$value"
+    fi
+}
+
+printf '%s\n' "# DeskForge offline-kit third-party evidence inventory"
+printf '%s\n' "# Deterministic output; no signatures or license conclusions are claimed."
+printf '%s\n' "# Status is COVERED only when a license evidence path is present; otherwise GAP."
+printf '%s\n' "# Overall coverage: INCOMPLETE; GAP entries are never promoted to complete coverage."
+printf '%s\n' "component|source or pin|license evidence|status"
+
+root_license=""
+for candidate in LICENSE LICENCE COPYING NOTICE; do
+    if [ -f "$ROOT/$candidate" ]; then root_license=$candidate; break; fi
+done
+
+if [ -n "$root_license" ]; then
+    printf '%s\n' "DeskForge|tracked repository|$root_license|COVERED"
+else
+    printf '%s\n' "DeskForge|tracked repository|no tracked license evidence|GAP"
+fi
+
+printf '%s\n' "RustDesk client|$(display_value "${RUSTDESK_REPO}@${RUSTDESK_COMMIT}")|ignored local source bundle not scanned|GAP"
+printf '%s\n' "hbb_common|$(display_value "$HBB_COMMON_REPO")|no pinned license evidence in offline-kit|GAP"
+printf '%s\n' "RustDesk vendored crates|vendor-$RUSTDESK_REF.tar.*|ignored local vendor payload not scanned|GAP"
+printf '%s\n' "Flutter custom engine|$(display_value "$FLUTTER_ENGINE_WIN_URL")|provider asset license evidence not supplied|GAP"
+printf '%s\n' "Flutter SDK Windows|$(display_value "$FLUTTER_SDK_WIN_URL")|provider asset license evidence not supplied|GAP"
+printf '%s\n' "Flutter SDK Linux|$(display_value "$FLUTTER_SDK_LINUX_URL")|provider asset license evidence not supplied|GAP"
+printf '%s\n' "vcpkg|$(display_value "${VCPKG_REPO}@${VCPKG_BASELINE}")|ignored local source not scanned|GAP"
+printf '%s\n' "Rust Windows MSI|rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi|provider asset license evidence not supplied|GAP"
+printf '%s\n' "RustDeskTempTopMostWindow|$(display_value "${TOPMOST_REPO}@${TOPMOST_COMMIT}")|provider source license evidence not supplied|GAP"
+printf '%s\n' "usbmmidd|$(display_value "$USBMMIDD_URL")|provider asset license evidence not supplied|GAP"
+printf '%s\n' "RustDesk printer driver|$(display_value "$PRINTER_DRIVER_URL")|provider asset license evidence not supplied|GAP"
+printf '%s\n' "RustDesk printer adapter|$(display_value "$PRINTER_ADAPTER_URL")|provider asset license evidence not supplied|GAP"
+printf '%s\n' "RustDesk printer checksum sidecar|printer_sha256sums|provider asset license evidence not supplied|GAP"
diff --git a/offline-kit/tests/verify-fixtures.sh b/offline-kit/tests/verify-fixtures.sh
new file mode 100755
index 0000000..23bdad8
--- /dev/null
+++ b/offline-kit/tests/verify-fixtures.sh
@@ -0,0 +1,582 @@
+#!/usr/bin/env bash
+# Temporary, local-only regression fixtures for offline-kit verification.
+
+set -e -u -o pipefail
+
+TEST_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+KIT_DIR=$(CDPATH= cd -- "$TEST_DIR/.." && pwd -P)
+TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/offline-kit-fixtures.XXXXXX")
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+die() { printf '%s\n' "[fixture][FAIL] $*" >&2; exit 1; }
+pass() { printf '%s\n' "[fixture][OK] $*"; }
+
+git_init() {
+    local dir=$1
+    git init -q "$dir" || die "git init failed"
+    git -C "$dir" config user.name fixture
+    git -C "$dir" config user.email fixture@example.invalid
+}
+
+hash_file() { sha256sum "$1" | awk '{print $1}'; }
+
+content_hash_dir() {
+    local dir=$1 listing file rel digest target
+    listing=$(mktemp "${TMPDIR:-/tmp}/offline-kit-fixture-dir.XXXXXX") || return 1
+    (
+        cd "$dir" || exit 1
+        LC_ALL=C find -P . \( -type f -o -type l \) -print | LC_ALL=C sort |
+            while IFS= read -r file; do
+                rel=${file#./}
+                if [ -L "$file" ]; then
+                    target=$(readlink "$file") || exit 1
+                    printf 'L\t%s\t%s\n' "$rel" "$target"
+                else
+                    digest=$(hash_file "$file") || exit 1
+                    printf 'F\t%s\t%s\n' "$rel" "$digest"
+                fi
+            done
+    ) > "$listing" || { rm -f "$listing"; return 1; }
+    hash_file "$listing"
+    rm -f "$listing"
+}
+
+write_file_record() {
+    local label=$1 path=$2
+    printf '%s  %s  sha256:%s  %s\n' "$label" "$(stat -c '%s' "$path")" "$(hash_file "$path")" "${path#"$KIT_FIXTURE/"}"
+}
+
+make_fixture() {
+    local name=$1 root source submodule vcpkg top commit vcpkg_commit top_commit
+    KIT_FIXTURE="$TMP_ROOT/$name/kit"
+    root="$TMP_ROOT/$name"
+    source="$root/source-origin"
+    submodule="$root/submodule-origin"
+    vcpkg="$root/vcpkg-origin"
+    top="$root/topmost-origin"
+    mkdir -p "$root" "$KIT_FIXTURE/artifacts"
+
+    git_init "$submodule"
+    printf '%s\n' fixture-submodule > "$submodule/submodule.txt"
+    git -C "$submodule" add submodule.txt
+    git -C "$submodule" commit -q -m submodule
+
+    git_init "$source"
+    mkdir -p "$source/.cargo" "$source/.github/workflows" "$source/vendor/crate" "$source/libs"
+    cat > "$source/.cargo/config.vendor.toml" <<'EOF'
+[net]
+offline = true
+
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+EOF
+    printf '%s\n' 'license evidence' > "$source/vendor/crate/LICENSE"
+    printf '%s\n' 'fixture crate' > "$source/vendor/crate/lib.rs"
+    printf '%s\n' 'tracked source' > "$source/tracked.txt"
+    cat > "$source/.github/workflows/third-party-RustDeskTempTopMostWindow.yml" <<'EOF'
+name: fixture
+steps:
+  - run: git checkout 2222222222222222222222222222222222222222
+EOF
+    git -C "$source" -c protocol.file.allow=always submodule add -q "$submodule" libs/hbb_common
+    git -C "$source" add .gitmodules .github/workflows/third-party-RustDeskTempTopMostWindow.yml tracked.txt libs/hbb_common
+    git -C "$source" commit -q -m source
+    git -C "$source" tag test-ref
+    commit=$(git -C "$source" rev-parse HEAD)
+
+    git_init "$vcpkg"
+    printf '%s\n' fixture-vcpkg > "$vcpkg/vcpkg.txt"
+    git -C "$vcpkg" add vcpkg.txt
+    git -C "$vcpkg" commit -q -m vcpkg
+    vcpkg_commit=$(git -C "$vcpkg" rev-parse HEAD)
+
+    git_init "$top"
+    printf '%s\n' fixture-topmost > "$top/topmost.txt"
+    git -C "$top" add topmost.txt
+    git -C "$top" commit -q -m topmost
+    top_commit=$(git -C "$top" rev-parse HEAD)
+    # The workflow pin is deliberately independent of this fixture repository;
+    # the bundle only needs to prove the configured commit below.
+    git -C "$top" commit --allow-empty -q -m workflow-pin
+    top_commit=$(git -C "$top" rev-parse HEAD)
+    awk -v pin="$top_commit" '{gsub(/2222222222222222222222222222222222222222/, pin); print}' \
+        "$source/.github/workflows/third-party-RustDeskTempTopMostWindow.yml" > "$source/.github/workflows/pin.tmp"
+    mv "$source/.github/workflows/pin.tmp" "$source/.github/workflows/third-party-RustDeskTempTopMostWindow.yml"
+    git -C "$source" add .github/workflows/third-party-RustDeskTempTopMostWindow.yml
+    git -C "$source" commit -q -m workflow-pin
+    commit=$(git -C "$source" rev-parse HEAD)
+    git -C "$source" tag -f test-ref
+
+    git -C "$source" bundle create "$KIT_FIXTURE/artifacts/rustdesk-test-ref.bundle" --all >/dev/null
+    git -C "$top" bundle create "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow.bundle" --all >/dev/null
+    git -c protocol.file.allow=always clone -q --recurse-submodules "$source" "$KIT_FIXTURE/artifacts/rustdesk-src"
+    git clone -q "$vcpkg" "$KIT_FIXTURE/artifacts/vcpkg"
+    git clone -q "$top" "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow"
+    mkdir -p "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo" "$KIT_FIXTURE/artifacts/rustdesk-src/vendor"
+    cp "$source/.cargo/config.vendor.toml" "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml"
+    cp -R "$source/vendor/." "$KIT_FIXTURE/artifacts/rustdesk-src/vendor/"
+
+    printf '%s\n' fixture-engine > "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+    printf '%s\n' fixture-flutter-win > "$KIT_FIXTURE/artifacts/flutter_windows_3.24.5-stable.zip"
+    printf '%s\n' fixture-flutter-linux > "$KIT_FIXTURE/artifacts/flutter_linux_3.24.5-stable.tar.xz"
+    printf '%s\n' fixture-rust > "$KIT_FIXTURE/artifacts/rust-1.75.0-x86_64-pc-windows-msvc.msi"
+    printf '%s\n' fixture-usb > "$KIT_FIXTURE/artifacts/usbmmidd_v2.zip"
+    printf '%s\n' fixture-driver > "$KIT_FIXTURE/artifacts/rustdesk_printer_driver_v4-1.4.zip"
+    printf '%s\n' fixture-adapter > "$KIT_FIXTURE/artifacts/printer_driver_adapter.zip"
+    printf '%s\n' fixture-sums > "$KIT_FIXTURE/artifacts/printer_sha256sums"
+    tar -C "$KIT_FIXTURE/artifacts/rustdesk-src" -czf "$KIT_FIXTURE/artifacts/vendor-test-ref.tar.gz" vendor
+
+    cp "$KIT_DIR/verify.sh" "$KIT_FIXTURE/verify.sh"
+    cp "$KIT_DIR/freeze.sh" "$KIT_FIXTURE/freeze.sh"
+    cat > "$KIT_FIXTURE/versions.env" <<EOF
+RUSTDESK_REPO="file://fixture/source"
+RUSTDESK_REF="test-ref"
+RUSTDESK_COMMIT="$commit"
+HBB_COMMON_REPO="file://fixture/hbb_common"
+RUST_VERSION="1.75.0"
+LLVM_VERSION="15.0.6"
+FLUTTER_VERSION="3.24.5"
+FLUTTER_RUST_BRIDGE_VERSION="1.80"
+NDK_VERSION="r28c"
+CARGO_NDK_VERSION="3.1.2"
+FLUTTER_ENGINE_WIN_URL="https://example.invalid/engine"
+FLUTTER_SDK_WIN_URL="https://example.invalid/flutter-win"
+FLUTTER_SDK_LINUX_URL="https://example.invalid/flutter-linux"
+VCPKG_REPO="file://fixture/vcpkg"
+VCPKG_BASELINE="$vcpkg_commit"
+VCPKG_TRIPLET="x64-windows-static"
+TOPMOST_REPO="file://fixture/topmost"
+TOPMOST_COMMIT="$top_commit"
+USBMMIDD_URL="https://example.invalid/usb"
+PRINTER_DRIVER_URL="https://example.invalid/driver"
+PRINTER_ADAPTER_URL="https://example.invalid/adapter"
+PRINTER_SUMS_URL="https://example.invalid/sums"
+ARTIFACTS_DIR="artifacts"
+RUSTDESK_BUNDLE_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/rustdesk-test-ref.bundle")"
+VENDOR_TARBALL_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/vendor-test-ref.tar.gz")"
+FLUTTER_ENGINE_WIN_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/windows-x64-release.zip")"
+FLUTTER_SDK_WIN_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/flutter_windows_3.24.5-stable.zip")"
+FLUTTER_SDK_LINUX_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/flutter_linux_3.24.5-stable.tar.xz")"
+RUST_WIN_MSI_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/rust-1.75.0-x86_64-pc-windows-msvc.msi")"
+TOPMOST_BUNDLE_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow.bundle")"
+USBMMIDD_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/usbmmidd_v2.zip")"
+PRINTER_DRIVER_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/rustdesk_printer_driver_v4-1.4.zip")"
+PRINTER_ADAPTER_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/printer_driver_adapter.zip")"
+PRINTER_SUMS_SHA256="$(hash_file "$KIT_FIXTURE/artifacts/printer_sha256sums")"
+EOF
+
+    local source_tree vendor_tree vcpkg_tree topmost_tree
+    source_tree=$(git -C "$KIT_FIXTURE/artifacts/rustdesk-src" rev-parse HEAD^{tree})
+    vendor_tree=$(content_hash_dir "$KIT_FIXTURE/artifacts/rustdesk-src/vendor")
+    vcpkg_tree=$(git -C "$KIT_FIXTURE/artifacts/vcpkg" rev-parse HEAD^{tree})
+    topmost_tree=$(git -C "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow" rev-parse HEAD^{tree})
+    {
+        printf '%s\n' '# fixture manifest'
+        printf '%s\n' '# schema=2'
+        printf '%s\n' "# pin RUSTDESK_REF=test-ref"
+        printf '%s\n' "# pin RUSTDESK_COMMIT=$commit"
+        printf '%s\n' '# pin RUST_VERSION=1.75.0'
+        printf '%s\n' '# pin LLVM_VERSION=15.0.6'
+        printf '%s\n' '# pin FLUTTER_VERSION=3.24.5'
+        printf '%s\n' '# pin FLUTTER_RUST_BRIDGE_VERSION=1.80'
+        printf '%s\n' '# pin NDK_VERSION=r28c'
+        printf '%s\n' '# pin CARGO_NDK_VERSION=3.1.2'
+        printf '%s\n' "# pin VCPKG_BASELINE=$vcpkg_commit"
+        printf '%s\n' '# pin VCPKG_TRIPLET=x64-windows-static'
+        printf '%s  %s  git-tree:%s  artifacts/rustdesk-src\n' rustdesk-source "$(du -sb "$KIT_FIXTURE/artifacts/rustdesk-src" | awk '{print $1}')" "$source_tree"
+        write_file_record rustdesk-bundle "$KIT_FIXTURE/artifacts/rustdesk-test-ref.bundle"
+        printf '%s  %s  content-sha256:%s  artifacts/rustdesk-src/vendor\n' vendor-source "$(du -sb "$KIT_FIXTURE/artifacts/rustdesk-src/vendor" | awk '{print $1}')" "$vendor_tree"
+        write_file_record vendor-config "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml"
+        write_file_record vendor-tarball "$KIT_FIXTURE/artifacts/vendor-test-ref.tar.gz"
+        write_file_record flutter-engine-win "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+        write_file_record flutter-sdk-win "$KIT_FIXTURE/artifacts/flutter_windows_3.24.5-stable.zip"
+        write_file_record flutter-sdk-linux "$KIT_FIXTURE/artifacts/flutter_linux_3.24.5-stable.tar.xz"
+        printf '%s  %s  git-tree:%s  artifacts/vcpkg\n' vcpkg-src "$(du -sb "$KIT_FIXTURE/artifacts/vcpkg" | awk '{print $1}')" "$vcpkg_tree"
+        printf '%s  %s  git-tree:%s  artifacts/RustDeskTempTopMostWindow\n' topmost-src "$(du -sb "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow" | awk '{print $1}')" "$topmost_tree"
+        write_file_record rust-win-msvc "$KIT_FIXTURE/artifacts/rust-1.75.0-x86_64-pc-windows-msvc.msi"
+        write_file_record topmost-bundle "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow.bundle"
+        write_file_record usbmmidd "$KIT_FIXTURE/artifacts/usbmmidd_v2.zip"
+        write_file_record printer-driver "$KIT_FIXTURE/artifacts/rustdesk_printer_driver_v4-1.4.zip"
+        write_file_record printer-adapter "$KIT_FIXTURE/artifacts/printer_driver_adapter.zip"
+        write_file_record printer-sums "$KIT_FIXTURE/artifacts/printer_sha256sums"
+    } > "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+}
+
+expect_failure() {
+    local name=$1 marker=$2 output
+    output="$TMP_ROOT/$name.out"
+    shift 2
+    if "$@" > "$output" 2>&1; then
+        printf '%s\n' "[fixture][FAIL] expected failure: $name" >&2
+        return 1
+    fi
+    awk -v marker="$marker" 'index($0, marker) { found = 1 } END { exit found ? 0 : 1 }' "$output" || {
+        printf '%s\n' "[fixture][FAIL] missing failure marker for $name" >&2
+        return 1
+    }
+}
+
+run_verify() {
+    local fixture=$1
+    ( cd "$fixture" && ./verify.sh )
+}
+
+run_freeze_source() {
+    local fixture=$1
+    ( cd "$fixture" && bash freeze.sh source )
+}
+
+run_freeze_stage() {
+    local fixture=$1 stage=$2
+    ( cd "$fixture" && bash freeze.sh "$stage" )
+}
+
+run_freeze_args() {
+    local fixture=$1
+    shift
+    ( cd "$fixture" && bash freeze.sh "$@" )
+}
+
+run_verify_overrides() {
+    local fixture=$1 repo=$2 ref=$3
+    ( cd "$fixture" && ARTIFACTS_DIR="$fixture/artifacts" \
+        RUSTDESK_REPO="$repo" RUSTDESK_REF="$ref" ./verify.sh )
+}
+
+replace_manifest_file_record() {
+    local label=$1 path=$2 manifest=$3
+    awk -v label="$label" -v size="$(stat -c '%s' "$path")" \
+        -v digest="$(hash_file "$path")" \
+        '$1 == label { printf "%s  %s  sha256:%s  %s\n", label, size, digest, $4; next } { print }' \
+        "$manifest" > "$manifest.tmp"
+    mv "$manifest.tmp" "$manifest"
+}
+
+replace_manifest_directory_size() {
+    local label=$1 path=$2 manifest=$3 size
+    size=$(du -sb "$path" | awk '{print $1}')
+    awk -v label="$label" -v size="$size" \
+        '$1 == label { $2 = size; print; next } { print }' \
+        "$manifest" > "$manifest.tmp"
+    mv "$manifest.tmp" "$manifest"
+}
+
+make_fixture valid
+chmod +x "$KIT_FIXTURE/verify.sh"
+valid_output_before=$(run_verify "$KIT_FIXTURE" 2>&1)
+valid_output_after=$(run_verify "$KIT_FIXTURE" 2>&1)
+[ "$valid_output_before" = "$valid_output_after" ] || die 'verification output is not deterministic'
+run_verify "$KIT_FIXTURE" >/dev/null
+pass 'generated vendor/config paths are allowed and verification is deterministic'
+
+make_fixture vendor-config-generated
+cat > "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" <<'EOF'
+[net]
+offline = true
+
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source."git+https://example.invalid/fixture-crate?rev=abcdef0"]
+git = "https://example.invalid/fixture-crate"
+rev = "abcdef0"
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+EOF
+replace_manifest_file_record vendor-config \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" \
+    "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+replace_manifest_directory_size rustdesk-source \
+    "$KIT_FIXTURE/artifacts/rustdesk-src" "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+run_verify "$KIT_FIXTURE" >/dev/null
+pass 'cargo-generated git source replacement remains allowed only when locally vendored'
+
+run_verify_overrides "$KIT_FIXTURE" 'https://mutable.example.invalid/main' test-ref >/dev/null
+pass 'verify honors repository and artifact/ref overrides without using a mutable source as proof'
+expect_failure override-ref 'manifest pin mismatch or missing: RUSTDESK_REF' \
+    run_verify_overrides "$KIT_FIXTURE" 'https://mutable.example.invalid/main' wrong-ref
+pass 'ref override cannot bypass immutable manifest/tag equality'
+
+make_fixture acquisition-dirty
+printf '%s\n' unexpected > "$KIT_FIXTURE/artifacts/rustdesk-src/acquisition-dirty.txt"
+expect_failure acquisition-dirty 'source checkout has unexpected dirty or untracked path' run_freeze_source "$KIT_FIXTURE"
+pass 'freeze rejects unexpected source dirt before staging'
+
+make_fixture dirty
+printf '%s\n' dirty >> "$KIT_FIXTURE/artifacts/rustdesk-src/tracked.txt"
+expect_failure dirty 'source checkout has unexpected dirty or untracked path' run_verify "$KIT_FIXTURE"
+pass 'unexpected dirty source file fails closed'
+
+make_fixture untracked
+printf '%s\n' unexpected > "$KIT_FIXTURE/artifacts/rustdesk-src/unexpected.txt"
+expect_failure untracked 'source checkout has unexpected dirty or untracked path' run_verify "$KIT_FIXTURE"
+pass 'unexpected untracked source file fails closed'
+
+make_fixture legacy-manifest
+awk '$0 != "# schema=2"' "$KIT_FIXTURE/artifacts/MANIFEST.txt" > "$KIT_FIXTURE/artifacts/MANIFEST.legacy"
+mv "$KIT_FIXTURE/artifacts/MANIFEST.legacy" "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+legacy_manifest_before=$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")
+expect_failure legacy-manifest 'incompatible MANIFEST.txt' run_verify "$KIT_FIXTURE"
+[ "$legacy_manifest_before" = "$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")" ] || die 'verify changed a legacy manifest'
+expect_failure legacy-manifest-freeze 'incompatible MANIFEST.txt' run_freeze_source "$KIT_FIXTURE"
+[ "$legacy_manifest_before" = "$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")" ] || die 'freeze changed a legacy manifest'
+pass 'legacy manifest is refused without mutation and requires re-freeze'
+
+make_fixture vendor-mismatch
+mkdir -p "$TMP_ROOT/vendor-mismatch-tree"
+cp -R "$KIT_FIXTURE/artifacts/rustdesk-src/vendor" "$TMP_ROOT/vendor-mismatch-tree/"
+printf '%s\n' archive-only > "$TMP_ROOT/vendor-mismatch-tree/vendor/archive-only.txt"
+tar -C "$TMP_ROOT/vendor-mismatch-tree" -czf "$KIT_FIXTURE/artifacts/vendor-test-ref.tar.gz" vendor
+vendor_digest=$(hash_file "$KIT_FIXTURE/artifacts/vendor-test-ref.tar.gz")
+awk -v digest="$vendor_digest" '$0 ~ /^VENDOR_TARBALL_SHA256=/ { print "VENDOR_TARBALL_SHA256=\"" digest "\""; next } { print }' \
+    "$KIT_FIXTURE/versions.env" > "$KIT_FIXTURE/versions.env.tmp"
+mv "$KIT_FIXTURE/versions.env.tmp" "$KIT_FIXTURE/versions.env"
+replace_manifest_file_record vendor-tarball "$KIT_FIXTURE/artifacts/vendor-test-ref.tar.gz" "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+expect_failure vendor-mismatch 'vendor tarball contents mismatch with staged vendor tree' run_verify "$KIT_FIXTURE"
+pass 'vendor tarball contents are compared with the staged vendor tree'
+
+make_fixture vendor-config-mismatch
+awk '{ if ($0 ~ /^directory[[:space:]]*=/) print "directory = \"../remote-vendor\""; else print }' \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" > \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml.tmp"
+mv "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml.tmp" \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml"
+replace_manifest_file_record vendor-config \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" \
+    "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+expect_failure vendor-config-mismatch 'vendor config contains unknown or network-capable settings' run_verify "$KIT_FIXTURE"
+pass 'vendor config must select local vendor sources without remote replacement'
+
+make_fixture symlink-escape
+printf '%s\n' outside > "$TMP_ROOT/symlink-target"
+rm -f "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+ln -s "$TMP_ROOT/symlink-target" "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+expect_failure symlink-escape 'flutter-engine-win path escapes kit root' run_verify "$KIT_FIXTURE"
+pass 'symlinked expected artifact escaping the kit fails before hashing'
+
+make_fixture symlink-output-entry
+rm -f "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+ln -s "$TMP_ROOT/symlink-output-target" "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+expect_failure symlink-output-entry 'flutter-engine-win path escapes kit root' \
+    run_freeze_stage "$KIT_FIXTURE" engine
+pass 'symlinked output is rejected before download/write'
+
+make_fixture symlink-directory
+mv "$KIT_FIXTURE/artifacts/rustdesk-src/vendor" "$TMP_ROOT/vendor-target"
+ln -s "$TMP_ROOT/vendor-target" "$KIT_FIXTURE/artifacts/rustdesk-src/vendor"
+expect_failure symlink-directory 'vendor-source path escapes kit root' run_verify "$KIT_FIXTURE"
+pass 'symlinked expected directory escaping the kit fails before hashing'
+
+make_fixture symlink-entry
+printf '%s\n' outside > "$TMP_ROOT/vendor-entry-target"
+ln -s "$TMP_ROOT/vendor-entry-target" "$KIT_FIXTURE/artifacts/rustdesk-src/vendor/crate/escape"
+expect_failure symlink-entry 'vendor-source contains a symlink' run_verify "$KIT_FIXTURE"
+pass 'symlinked directory entry fails before content hashing'
+
+make_fixture symlink-rustdesk-src
+mv "$KIT_FIXTURE/artifacts/rustdesk-src" "$TMP_ROOT/rustdesk-src-target"
+ln -s "$TMP_ROOT/rustdesk-src-target" "$KIT_FIXTURE/artifacts/rustdesk-src"
+expect_failure symlink-rustdesk-src 'rustdesk-src path escapes kit root' run_freeze_source "$KIT_FIXTURE"
+pass 'symlinked rustdesk-src is rejected at freeze stage entry'
+
+make_fixture symlink-cargo
+mv "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo" "$TMP_ROOT/cargo-target"
+ln -s "$TMP_ROOT/cargo-target" "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo"
+expect_failure symlink-cargo 'rustdesk-src contains a symlink or non-regular entry' run_freeze_stage "$KIT_FIXTURE" vendor
+pass 'symlinked .cargo is rejected before vendor generation'
+
+make_fixture symlink-vendor
+mv "$KIT_FIXTURE/artifacts/rustdesk-src/vendor" "$TMP_ROOT/vendor-target"
+ln -s "$TMP_ROOT/vendor-target" "$KIT_FIXTURE/artifacts/rustdesk-src/vendor"
+expect_failure symlink-vendor 'rustdesk-src contains a symlink or non-regular entry' run_freeze_stage "$KIT_FIXTURE" vendor
+pass 'symlinked vendor directory is rejected before vendor generation'
+
+make_fixture special-entry
+mkfifo "$KIT_FIXTURE/artifacts/rustdesk-src/vendor/crate/special"
+expect_failure special-entry 'vendor-source contains a symlink or non-regular entry' run_verify "$KIT_FIXTURE"
+pass 'special vendor entries fail before content hashing'
+
+make_fixture vendor-config-network
+cat > "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" <<'EOF'
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+
+[net]
+offline = false
+EOF
+replace_manifest_file_record vendor-config \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" \
+    "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+expect_failure vendor-config-network 'vendor config contains unknown or network-capable settings' run_verify "$KIT_FIXTURE"
+pass 'network-enabled Cargo config is rejected'
+
+make_fixture vendor-config-remote-replacement
+cat > "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" <<'EOF'
+[net]
+offline = true
+
+[source.crates-io]
+replace-with = "remote-crates"
+
+[source.remote-crates]
+registry = "https://example.invalid/index"
+
+[source.vendored-sources]
+directory = "vendor"
+EOF
+replace_manifest_file_record vendor-config \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" \
+    "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+expect_failure vendor-config-remote-replacement 'vendor config contains unknown or network-capable settings' run_verify "$KIT_FIXTURE"
+pass 'remote Cargo source replacement is rejected even with offline mode'
+
+make_fixture vendor-config-unknown
+cat > "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" <<'EOF'
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+
+[registries.crates-io]
+index = "https://example.invalid/index"
+EOF
+replace_manifest_file_record vendor-config \
+    "$KIT_FIXTURE/artifacts/rustdesk-src/.cargo/config.vendor.toml" \
+    "$KIT_FIXTURE/artifacts/MANIFEST.txt"
+expect_failure vendor-config-unknown 'vendor config contains unknown or network-capable settings' run_verify "$KIT_FIXTURE"
+pass 'unknown Cargo registry config is rejected'
+
+make_fixture stage-stop
+stage_stop_output="$TMP_ROOT/stage-stop.out"
+if run_freeze_args "$KIT_FIXTURE" unknown engine > "$stage_stop_output" 2>&1; then
+    die 'unknown stage unexpectedly succeeded'
+fi
+if awk 'index($0, "STAGE: flutter engine") { found = 1 } END { exit found ? 0 : 1 }' \
+    "$stage_stop_output"; then
+    die 'freeze continued after a failed stage-entry validation'
+fi
+pass 'freeze stops immediately after a failed stage-entry validation'
+
+make_fixture secret
+printf '%s\n' secret > "$KIT_FIXTURE/artifacts/fixture-secret.key"
+secret_output="$TMP_ROOT/secret.out"
+if run_verify "$KIT_FIXTURE" > "$secret_output" 2>&1; then
+    die 'secret presence unexpectedly verified'
+fi
+awk 'index($0, "[redacted path]") { found = 1 } END { exit found ? 0 : 1 }' "$secret_output" || die 'secret failure was not redacted'
+awk 'index($0, "fixture-secret.key") { found = 1 } END { exit found ? 1 : 0 }' "$secret_output" || die 'secret filename leaked in verifier output'
+pass 'secret presence fails closed with a redacted reason'
+
+make_fixture secret-custom-txt
+printf '%s\n' secret > "$KIT_FIXTURE/artifacts/custom_.txt"
+custom_secret_output="$TMP_ROOT/secret-custom-txt.out"
+if run_verify "$KIT_FIXTURE" > "$custom_secret_output" 2>&1; then
+    die 'custom_.txt secret presence unexpectedly verified'
+fi
+awk 'index($0, "[redacted path]") { found = 1 } END { exit found ? 0 : 1 }' \
+    "$custom_secret_output" || die 'custom_.txt secret failure was not redacted'
+awk 'index($0, "custom_.txt") { found = 1 } END { exit found ? 1 : 0 }' \
+    "$custom_secret_output" || die 'custom_.txt filename leaked in verifier output'
+pass 'custom_.txt is secret-bearing by filename without content inspection'
+
+make_fixture shallow
+rm -rf "$KIT_FIXTURE/artifacts/rustdesk-src"
+git -c protocol.file.allow=always clone -q --depth 1 --recurse-submodules \
+    "file://$TMP_ROOT/shallow/source-origin" "$KIT_FIXTURE/artifacts/rustdesk-src"
+expect_failure shallow 'source checkout is shallow' run_verify "$KIT_FIXTURE"
+pass 'shallow source fails closed'
+
+make_fixture shallow-vcpkg
+rm -rf "$KIT_FIXTURE/artifacts/vcpkg"
+git clone -q --depth 1 "file://$TMP_ROOT/shallow-vcpkg/vcpkg-origin" \
+    "$KIT_FIXTURE/artifacts/vcpkg"
+expect_failure shallow-vcpkg 'vcpkg source checkout is shallow' run_verify "$KIT_FIXTURE"
+pass 'shallow vcpkg source fails closed'
+
+make_fixture shallow-topmost
+rm -rf "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow"
+git clone -q --depth 1 "file://$TMP_ROOT/shallow-topmost/topmost-origin" \
+    "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow"
+expect_failure shallow-topmost 'TopMostWindow source checkout is shallow' run_verify "$KIT_FIXTURE"
+pass 'shallow TopMostWindow source fails closed'
+
+make_fixture vcpkg-dirty
+printf '%s\n' unexpected > "$KIT_FIXTURE/artifacts/vcpkg/unexpected.txt"
+vcpkg_manifest_before=$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")
+expect_failure vcpkg-dirty 'vcpkg source checkout has unexpected untracked or modified files' \
+    run_freeze_stage "$KIT_FIXTURE" vcpkg
+[ "$vcpkg_manifest_before" = "$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")" ] ||
+    die 'vcpkg preflight changed the manifest'
+pass 'dirty vcpkg source fails before staging mutation'
+
+make_fixture topmost-dirty
+printf '%s\n' unexpected > "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow/unexpected.txt"
+expect_failure topmost-dirty 'TopMostWindow source checkout has unexpected untracked or modified files' \
+    run_freeze_stage "$KIT_FIXTURE" thirdparty
+pass 'dirty TopMostWindow source fails before staging mutation'
+
+make_fixture vcpkg-uninitialized
+mv "$KIT_FIXTURE/artifacts/vcpkg/.git" "$TMP_ROOT/vcpkg-uninitialized-git"
+expect_failure vcpkg-uninitialized 'vcpkg source is not an initialized Git checkout' run_verify "$KIT_FIXTURE"
+pass 'uninitialized vcpkg source fails closed'
+
+make_fixture topmost-uninitialized
+mv "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow/.git" "$TMP_ROOT/topmost-uninitialized-git"
+expect_failure topmost-uninitialized 'TopMostWindow source is not an initialized Git checkout' run_verify "$KIT_FIXTURE"
+pass 'uninitialized TopMostWindow source fails closed'
+
+make_fixture vcpkg-mismatched
+git -C "$KIT_FIXTURE/artifacts/vcpkg" commit --allow-empty -q -m mismatch
+expect_failure vcpkg-mismatched 'vcpkg source commit mismatch' run_verify "$KIT_FIXTURE"
+pass 'mismatched vcpkg pin fails closed'
+
+make_fixture topmost-mismatched
+git -C "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow" commit --allow-empty -q -m mismatch
+expect_failure topmost-mismatched 'TopMostWindow source commit mismatch' run_verify "$KIT_FIXTURE"
+pass 'mismatched TopMostWindow pin fails closed'
+
+make_fixture submodule-uninitialized
+git -C "$KIT_FIXTURE/artifacts/rustdesk-src" submodule deinit -f -q -- libs/hbb_common
+expect_failure submodule-uninitialized 'recursive source submodule is uninitialized' run_verify "$KIT_FIXTURE"
+pass 'uninitialized recursive submodule fails closed'
+
+make_fixture submodule-modified
+printf '%s\n' modified >> "$KIT_FIXTURE/artifacts/rustdesk-src/libs/hbb_common/submodule.txt"
+expect_failure submodule-modified 'source checkout has unexpected dirty or untracked path' run_verify "$KIT_FIXTURE"
+pass 'modified recursive submodule fails closed'
+
+make_fixture submodule-mismatched
+git -C "$KIT_FIXTURE/artifacts/rustdesk-src/libs/hbb_common" config user.name fixture
+git -C "$KIT_FIXTURE/artifacts/rustdesk-src/libs/hbb_common" config user.email fixture@example.invalid
+git -C "$KIT_FIXTURE/artifacts/rustdesk-src/libs/hbb_common" commit --allow-empty -q -m mismatch
+expect_failure submodule-mismatched 'recursive source submodule is uninitialized, modified, or mismatched' run_verify "$KIT_FIXTURE"
+pass 'mismatched recursive submodule fails closed'
+
+make_fixture hash
+printf '%s\n' changed > "$KIT_FIXTURE/artifacts/windows-x64-release.zip"
+expect_failure hash 'manifest SHA-256 mismatch: flutter-engine-win' run_verify "$KIT_FIXTURE"
+pass 'content hash mismatch fails closed'
+
+make_fixture entrypoint
+chmod 644 "$KIT_FIXTURE/verify.sh"
+manifest_before=$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")
+source_status_before=$(git -C "$KIT_FIXTURE/artifacts/rustdesk-src" status --porcelain=v1 --untracked-files=all)
+vcpkg_status_before=$(git -C "$KIT_FIXTURE/artifacts/vcpkg" status --porcelain=v1 --untracked-files=all)
+topmost_status_before=$(git -C "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow" status --porcelain=v1 --untracked-files=all)
+( cd "$KIT_FIXTURE" && bash freeze.sh --verify ) >/dev/null
+[ "$manifest_before" = "$(hash_file "$KIT_FIXTURE/artifacts/MANIFEST.txt")" ]
+[ "$source_status_before" = "$(git -C "$KIT_FIXTURE/artifacts/rustdesk-src" status --porcelain=v1 --untracked-files=all)" ]
+[ "$vcpkg_status_before" = "$(git -C "$KIT_FIXTURE/artifacts/vcpkg" status --porcelain=v1 --untracked-files=all)" ]
+[ "$topmost_status_before" = "$(git -C "$KIT_FIXTURE/artifacts/RustDeskTempTopMostWindow" status --porcelain=v1 --untracked-files=all)" ]
+pass 'freeze --verify invokes a non-executable verifier robustly'
+
+printf '%s\n' '[fixture] all offline-kit verifier fixtures passed'
diff --git a/offline-kit/verify.sh b/offline-kit/verify.sh
new file mode 100755
index 0000000..97a28d2
--- /dev/null
+++ b/offline-kit/verify.sh
@@ -0,0 +1,786 @@
+#!/usr/bin/env bash
+# Read-only, fail-closed verifier for offline-kit.
+
+set -u -o pipefail
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+cd "$SCRIPT_DIR"
+_artifacts_override=${ARTIFACTS_DIR-}
+_repo_override=${RUSTDESK_REPO-}
+_ref_override=${RUSTDESK_REF-}
+# shellcheck disable=SC1091
+source ./versions.env
+[ -n "$_artifacts_override" ] && ARTIFACTS_DIR="$_artifacts_override"
+[ -n "$_repo_override" ] && RUSTDESK_REPO="$_repo_override"
+[ -n "$_ref_override" ] && RUSTDESK_REF="$_ref_override"
+ARTIFACTS_DIR=${ARTIFACTS_DIR:?}
+RUSTDESK_REPO=${RUSTDESK_REPO:?}
+RUSTDESK_REF=${RUSTDESK_REF:?}
+RUSTDESK_COMMIT=${RUSTDESK_COMMIT-}
+RUST_VERSION=${RUST_VERSION-}
+LLVM_VERSION=${LLVM_VERSION-}
+FLUTTER_VERSION=${FLUTTER_VERSION-}
+FLUTTER_RUST_BRIDGE_VERSION=${FLUTTER_RUST_BRIDGE_VERSION-}
+NDK_VERSION=${NDK_VERSION-}
+CARGO_NDK_VERSION=${CARGO_NDK_VERSION-}
+VCPKG_BASELINE=${VCPKG_BASELINE-}
+VCPKG_TRIPLET=${VCPKG_TRIPLET-}
+TOPMOST_COMMIT=${TOPMOST_COMMIT-}
+GIT_CHECK_TIMEOUT_SECONDS=${GIT_CHECK_TIMEOUT_SECONDS:-10}
+MANIFEST_SCHEMA_VERSION=2
+OUT=$ARTIFACTS_DIR
+SRC="$OUT/rustdesk-src"
+MANIFEST="$OUT/MANIFEST.txt"
+KIT_ROOT="$SCRIPT_DIR"
+ERRORS=0
+MANIFEST_COMPATIBLE=1
+
+ok()   { printf '%s\n' "[verify][OK] $*"; }
+fail() { printf '%s\n' "[verify][FAIL] $*" >&2; ERRORS=$((ERRORS + 1)); }
+have() { command -v "$1" >/dev/null 2>&1; }
+
+usage() {
+    printf '%s\n' "Usage: bash verify.sh [--manifest PATH]"
+    printf '%s\n' "Read-only: never downloads, rewrites MANIFEST, or accepts TOFU."
+}
+
+file_size() {
+    if stat -c '%s' "$1" 2>/dev/null; then return 0; fi
+    wc -c < "$1" | tr -d '[:space:]'
+}
+
+dir_size() {
+    if du -sb "$1" 2>/dev/null | awk '{print $1}'; then return 0; fi
+    du -sk "$1" | awk '{print $1 * 1024}'
+}
+
+git_bounded() {
+    timeout "$GIT_CHECK_TIMEOUT_SECONDS" git "$@"
+}
+
+sha256_file() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | awk '{print $1}'
+    elif command -v shasum >/dev/null 2>&1; then
+        shasum -a 256 "$1" | awk '{print $1}'
+    else
+        fail "sha256sum or shasum is required"
+        printf '%s\n' ""
+    fi
+}
+
+content_hash_dir() {
+    local dir=$1 listing file rel digest rc bad
+    bad=$(LC_ALL=C find -P "$dir" \( -type l -o \( ! -type f ! -type d \) \) -print -quit 2>/dev/null) || return 1
+    [ -z "$bad" ] || return 1
+    listing=$(mktemp "${TMPDIR:-/tmp}/offline-kit-dir.XXXXXX") || return 1
+    (
+        cd "$dir" || exit 1
+        LC_ALL=C find -P . \( -type f -o -type l \) -print | LC_ALL=C sort |
+            while IFS= read -r file; do
+                rel=${file#./}
+                case "$rel" in
+                    *$'\n'*) exit 1 ;;
+                esac
+                is_secret_path "$rel" && exit 1
+                [ -f "$file" ] || exit 1
+                digest=$(sha256_file "$file") || exit 1
+                printf 'F\t%s\t%s\n' "$rel" "$digest"
+            done
+    ) > "$listing"
+    rc=$?
+    if [ "$rc" -eq 0 ]; then
+        sha256_file "$listing"
+        rc=$?
+    fi
+    rm -f "$listing"
+    return "$rc"
+}
+
+directory_record() {
+    local path=$1 tree
+    if tree=$(git_bounded -C "$path" rev-parse --verify --quiet HEAD^{tree} 2>/dev/null); then
+        printf 'git-tree:%s\n' "$tree"
+    else
+        tree=$(content_hash_dir "$path") || return 1
+        printf 'content-sha256:%s\n' "$tree"
+    fi
+}
+
+is_secret_path() {
+    case "$1" in
+        custom_.txt|*/custom_.txt|*.key|*.pem|*.p12|*.pfx|*/.env|.env|*workflow-payload*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+is_generated_source_path() {
+    case "$1" in
+        vendor|vendor/*|.cargo/config.vendor.toml) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+canonical_path() {
+    if command -v realpath >/dev/null 2>&1; then
+        realpath -m "$1"
+    else
+        case "$1" in
+            /*) printf '%s\n' "$1" ;;
+            *) printf '%s/%s\n' "$SCRIPT_DIR" "$1" ;;
+        esac
+    fi
+}
+
+path_has_symlink() {
+    local path=$1 absolute component current
+    case "$path" in
+        /*) absolute=$path ;;
+        *) absolute="$SCRIPT_DIR/$path" ;;
+    esac
+    current=
+    IFS=/ read -r -a components <<< "${absolute#/}"
+    for component in "${components[@]}"; do
+        [ -n "$component" ] || continue
+        current="$current/$component"
+        [ -L "$current" ] && return 0
+    done
+    return 1
+}
+
+validate_existing_path_components() {
+    local path=$1 absolute component current
+    case "$path" in
+        /*) absolute=$path ;;
+        *) absolute="$SCRIPT_DIR/$path" ;;
+    esac
+    current=
+    IFS=/ read -r -a components <<< "${absolute#/}"
+    for component in "${components[@]}"; do
+        [ -n "$component" ] || continue
+        current="$current/$component"
+        if [ -L "$current" ]; then
+            return 1
+        fi
+        if [ -e "$current" ] && [ ! -d "$current" ] && [ "$current" != "$absolute" ]; then
+            return 1
+        fi
+    done
+    return 0
+}
+
+validate_path_location() {
+    local label=$1 path=$2 canonical
+    case "$path" in
+        *$'\n'*) fail "$label path contains a newline"; return 1 ;;
+    esac
+    canonical=$(canonical_path "$path") || return 1
+    case "$canonical" in
+        "$KIT_ROOT"|"$KIT_ROOT"/*) ;;
+        *) fail "$label path escapes kit root ([redacted path])"; return 1 ;;
+    esac
+    if ! validate_existing_path_components "$path"; then
+        fail "$label path contains a symlink ([redacted path])"
+        return 1
+    fi
+    return 0
+}
+
+validate_regular_tree() {
+    local label=$1 path=$2 bad
+    bad=$(LC_ALL=C find -P "$path" \( -type l -o \( ! -type f ! -type d \) \) -print -quit 2>/dev/null) || {
+        fail "$label cannot be inspected safely"
+        return 1
+    }
+    [ -z "$bad" ] || {
+        fail "$label contains a symlink or non-regular entry"
+        return 1
+    }
+    return 0
+}
+
+validate_expected_path() {
+    local label=$1 path=$2 kind=$3
+    validate_path_location "$label" "$path" || return 1
+    if [ -L "$path" ]; then
+        fail "$label is a symlink; expected a regular $kind"
+        return 1
+    fi
+    if [ -e "$path" ]; then
+        case "$kind" in
+            file|generated-file)
+                [ -f "$path" ] || { fail "$label is not a regular file"; return 1; } ;;
+            git-tree|content-sha256)
+                [ -d "$path" ] || { fail "$label is not a regular directory"; return 1; }
+                validate_regular_tree "$label" "$path" || return 1 ;;
+            *) fail "$label has an unknown manifest kind"; return 1 ;;
+        esac
+    fi
+    return 0
+}
+
+validate_file_target() {
+    local label=$1 path=$2
+    validate_path_location "$label" "$path" || return 1
+    if [ -L "$path" ]; then
+        fail "$label is a symlink"
+        return 1
+    fi
+    if [ -e "$path" ] && [ ! -f "$path" ]; then
+        fail "$label is not a regular file"
+        return 1
+    fi
+    return 0
+}
+
+validate_optional_directory() {
+    local label=$1 path=$2
+    validate_path_location "$label" "$path" || return 1
+    if [ -e "$path" ]; then
+        [ -d "$path" ] || {
+            fail "$label is not a regular directory"
+            return 1
+        }
+        validate_regular_tree "$label" "$path"
+    fi
+}
+
+check_secret_presence() {
+    local secret
+    secret=$(LC_ALL=C find -P "$KIT_ROOT" \( -type f -o -type l \) \
+        \( -name 'custom_.txt' -o -name '*.key' -o -name '*.pem' -o -name '*.p12' -o -name '*.pfx' \
+        -o -name '.env' -o -name 'workflow-payload*' \) -print -quit 2>/dev/null) || {
+        fail "secret-bearing path scan could not be completed"
+        return
+    }
+    [ -z "$secret" ] || fail "secret-bearing local file detected under kit/artifact handoff ([redacted path]); refusing secret exclusion"
+}
+
+expected_digest_for() {
+    case "$1" in
+        "$OUT/rustdesk-$RUSTDESK_REF.bundle") printf '%s\n' "${RUSTDESK_BUNDLE_SHA256-}" ;;
+        "$OUT/vendor-$RUSTDESK_REF.tar.zst"|"$OUT/vendor-$RUSTDESK_REF.tar.gz") printf '%s\n' "${VENDOR_TARBALL_SHA256-}" ;;
+        "$OUT/windows-x64-release.zip") printf '%s\n' "${FLUTTER_ENGINE_WIN_SHA256-}" ;;
+        "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip") printf '%s\n' "${FLUTTER_SDK_WIN_SHA256-}" ;;
+        "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz") printf '%s\n' "${FLUTTER_SDK_LINUX_SHA256-}" ;;
+        "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi") printf '%s\n' "${RUST_WIN_MSI_SHA256-}" ;;
+        "$OUT/RustDeskTempTopMostWindow.bundle") printf '%s\n' "${TOPMOST_BUNDLE_SHA256-}" ;;
+        "$OUT/usbmmidd_v2.zip") printf '%s\n' "${USBMMIDD_SHA256-}" ;;
+        "$OUT/rustdesk_printer_driver_v4-1.4.zip") printf '%s\n' "${PRINTER_DRIVER_SHA256-}" ;;
+        "$OUT/printer_driver_adapter.zip") printf '%s\n' "${PRINTER_ADAPTER_SHA256-}" ;;
+        "$OUT/printer_sha256sums") printf '%s\n' "${PRINTER_SUMS_SHA256-}" ;;
+        *) printf '%s\n' "" ;;
+    esac
+}
+
+rows() {
+    local vendor_path="$OUT/vendor-$RUSTDESK_REF.tar.gz"
+    [ -f "$OUT/vendor-$RUSTDESK_REF.tar.zst" ] && vendor_path="$OUT/vendor-$RUSTDESK_REF.tar.zst"
+    printf '%s\t%s\t%s\t%s\n' rustdesk-source "$OUT/rustdesk-src" git-tree ""
+    printf '%s\t%s\t%s\t%s\n' rustdesk-bundle "$OUT/rustdesk-$RUSTDESK_REF.bundle" file "${RUSTDESK_BUNDLE_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' vendor-source "$OUT/rustdesk-src/vendor" content-sha256 ""
+    printf '%s\t%s\t%s\t%s\n' vendor-config "$OUT/rustdesk-src/.cargo/config.vendor.toml" generated-file ""
+    printf '%s\t%s\t%s\t%s\n' vendor-tarball "$vendor_path" file "${VENDOR_TARBALL_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' flutter-engine-win "$OUT/windows-x64-release.zip" file "${FLUTTER_ENGINE_WIN_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' flutter-sdk-win "$OUT/flutter_windows_$FLUTTER_VERSION-stable.zip" file "${FLUTTER_SDK_WIN_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' flutter-sdk-linux "$OUT/flutter_linux_$FLUTTER_VERSION-stable.tar.xz" file "${FLUTTER_SDK_LINUX_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' vcpkg-src "$OUT/vcpkg" git-tree ""
+    printf '%s\t%s\t%s\t%s\n' rust-win-msvc "$OUT/rust-$RUST_VERSION-x86_64-pc-windows-msvc.msi" file "${RUST_WIN_MSI_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' topmost-src "$OUT/RustDeskTempTopMostWindow" git-tree ""
+    printf '%s\t%s\t%s\t%s\n' topmost-bundle "$OUT/RustDeskTempTopMostWindow.bundle" file "${TOPMOST_BUNDLE_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' usbmmidd "$OUT/usbmmidd_v2.zip" file "${USBMMIDD_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' printer-driver "$OUT/rustdesk_printer_driver_v4-1.4.zip" file "${PRINTER_DRIVER_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' printer-adapter "$OUT/printer_driver_adapter.zip" file "${PRINTER_ADAPTER_SHA256-}"
+    printf '%s\t%s\t%s\t%s\n' printer-sums "$OUT/printer_sha256sums" file "${PRINTER_SUMS_SHA256-}"
+}
+
+check_pins() {
+    local key expected found
+    [[ "$RUSTDESK_COMMIT" =~ ^[0-9a-fA-F]{40}$ ]] || fail "RUSTDESK_COMMIT is not a full commit id"
+    [[ "$VCPKG_BASELINE" =~ ^[0-9a-fA-F]{40}$ ]] || fail "VCPKG_BASELINE is not a full commit id"
+    for key in RUSTDESK_REPO RUSTDESK_REF RUST_VERSION LLVM_VERSION FLUTTER_VERSION \
+        FLUTTER_RUST_BRIDGE_VERSION NDK_VERSION CARGO_NDK_VERSION VCPKG_TRIPLET; do
+        eval "expected=\${$key-}"
+        [ -n "$expected" ] || fail "required pin is empty: $key"
+    done
+    while IFS=$'\t' read -r _label _path kind expected; do
+        [ "$_label" = rustdesk-source ] && continue
+        [ "$kind" = file ] || continue
+        if ! [[ "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then
+            fail "expected digest is missing or invalid for $_label"
+        fi
+    done < <(rows)
+    [ -f "$MANIFEST" ] || return
+    for key in RUSTDESK_REF RUSTDESK_COMMIT RUST_VERSION LLVM_VERSION FLUTTER_VERSION \
+        FLUTTER_RUST_BRIDGE_VERSION NDK_VERSION CARGO_NDK_VERSION VCPKG_BASELINE VCPKG_TRIPLET; do
+        eval "expected=\${$key-}"
+        found=$(awk -v key="$key" '$0 ~ "^# pin " key "=" {sub("^# pin " key "=", ""); print; exit}' "$MANIFEST")
+        [ "$found" = "$expected" ] || fail "manifest pin mismatch or missing: $key"
+    done
+}
+
+check_manifest_compatibility() {
+    local schema_count key pin_count pin_value
+    if ! validate_path_location "manifest" "$MANIFEST"; then
+        MANIFEST_COMPATIBLE=0
+        return
+    fi
+    [ -f "$MANIFEST" ] || return
+    schema_count=$(awk -v version="$MANIFEST_SCHEMA_VERSION" \
+        '$0 == "# schema=" version { count++ } END { print count + 0 }' "$MANIFEST")
+    if [ "$schema_count" -ne 1 ]; then
+        fail "incompatible MANIFEST.txt (legacy or unsupported schema); migrate/re-freeze into a new empty artifact directory, then rerun"
+        MANIFEST_COMPATIBLE=0
+        return
+    fi
+    for key in RUSTDESK_REF RUSTDESK_COMMIT RUST_VERSION LLVM_VERSION FLUTTER_VERSION \
+        FLUTTER_RUST_BRIDGE_VERSION NDK_VERSION CARGO_NDK_VERSION VCPKG_BASELINE VCPKG_TRIPLET; do
+        pin_count=$(awk -v key="$key" '$0 ~ "^# pin " key "=" { count++ } END { print count + 0 }' "$MANIFEST")
+        pin_value=$(awk -v key="$key" '$0 ~ "^# pin " key "=" { sub("^# pin " key "=", ""); print; exit }' "$MANIFEST")
+        if [ "$pin_count" -ne 1 ] || [ -z "$pin_value" ]; then
+            fail "incompatible MANIFEST.txt (missing or duplicate required pin record $key); migrate/re-freeze into a new empty artifact directory, then rerun"
+            MANIFEST_COMPATIBLE=0
+        fi
+    done
+}
+
+check_manifest() {
+    local label size checksum path rest expected_path expected_kind expected_digest actual record_path found actual_record
+    declare -A expected_label seen_path seen_size seen_checksum seen_label
+    validate_path_location "manifest" "$MANIFEST" || return
+    [ -f "$MANIFEST" ] || { fail "manifest missing (local artifact set unavailable): $MANIFEST"; return; }
+    while IFS=$'\t' read -r label expected_path expected_kind expected_digest; do
+        expected_label["$label"]=$expected_kind
+    done < <(rows)
+    while IFS= read -r line || [ -n "$line" ]; do
+        case "$line" in ''|\#*) continue ;; esac
+        IFS=' ' read -r label size checksum path rest <<< "$line"
+        [ -n "${rest-}" ] && fail "manifest has unexpected fields for $label"
+        [ -n "${label-}" ] || { fail "manifest has an empty label"; continue; }
+        [ -n "${expected_label[$label]-}" ] || { fail "manifest entry is unexpected: $label"; continue; }
+        [ -z "${seen_label[$label]-}" ] || { fail "manifest entry is duplicated: $label"; continue; }
+        if is_secret_path "${path-}"; then
+            fail "manifest contains a secret-bearing entry; refusing to inspect it"
+            continue
+        fi
+        seen_label["$label"]=1
+        seen_path["$label"]=$path
+        seen_size["$label"]=$size
+        seen_checksum["$label"]=$checksum
+    done < "$MANIFEST"
+    while IFS=$'\t' read -r label expected_path expected_kind expected_digest; do
+        record_path=${seen_path[$label]-}
+        [ -n "$record_path" ] || { fail "manifest entry missing: $label"; continue; }
+        [ "$(canonical_path "$record_path")" = "$(canonical_path "$expected_path")" ] || {
+            fail "manifest path mismatch: $label"; continue;
+        }
+        path="$record_path"
+        validate_expected_path "$label" "$path" "$expected_kind" || continue
+        [ -e "$path" ] || {
+            case "$label" in
+                flutter-engine-win) fail "local-only engine asset missing: $label" ;;
+                flutter-*|rust-win-msvc|usbmmidd|printer-*) fail "provider asset unavailable locally: $label" ;;
+                *) fail "local-only artifact missing: $label" ;;
+            esac
+            continue
+        }
+        size=${seen_size[$label]}
+        [[ "$size" =~ ^[0-9]+$ ]] || { fail "manifest size is not exact bytes: $label"; continue; }
+        if { [ "$expected_kind" = file ] || [ "$expected_kind" = generated-file ]; } && [ -f "$path" ]; then
+            [ "$(file_size "$path")" = "$size" ] || fail "manifest size mismatch: $label"
+            checksum=${seen_checksum[$label]}
+            [[ "$checksum" =~ ^sha256:[0-9a-fA-F]{64}$ ]] || { fail "manifest SHA-256 missing/invalid: $label"; continue; }
+            actual=$(sha256_file "$path")
+            [ "sha256:$actual" = "$checksum" ] || fail "manifest SHA-256 mismatch: $label"
+            if [ "$expected_kind" = file ]; then
+                [ -n "$expected_digest" ] || fail "expected digest missing: $label"
+                [ "$actual" = "$expected_digest" ] || fail "expected digest mismatch: $label"
+            fi
+        elif [ -d "$path" ]; then
+            checksum=${seen_checksum[$label]}
+            if [ "$expected_kind" = git-tree ] && [[ "$checksum" =~ ^git-tree:[0-9a-fA-F]{40}$ ]]; then
+                actual_record=$(git_bounded -C "$path" rev-parse --verify --quiet HEAD^{tree} 2>/dev/null) || actual_record=""
+                [ "git-tree:$actual_record" = "$checksum" ] || fail "manifest Git tree mismatch: $label"
+            elif [ "$expected_kind" = content-sha256 ] && [[ "$checksum" =~ ^content-sha256:[0-9a-fA-F]{64}$ ]]; then
+                actual_record=$(content_hash_dir "$path") || actual_record=""
+                [ "content-sha256:$actual_record" = "$checksum" ] || fail "manifest content hash mismatch: $label"
+            else
+                fail "manifest content record missing/invalid: $label"
+            fi
+            [[ "$size" =~ ^[0-9]+$ ]] || fail "manifest directory size is not exact bytes: $label"
+            [ "$(dir_size "$path")" = "$size" ] || fail "manifest directory size mismatch: $label"
+        else
+            fail "manifest path is neither file nor directory: $label"
+        fi
+    done < <(rows)
+}
+
+verify_bundle_commit() {
+    local bundle=$1 commit=$2 tmp bundle_path rc=0
+    [[ "$commit" =~ ^[0-9a-fA-F]{40}$ ]] || { fail "bundle commit pin is not a full commit id"; return; }
+    [ -f "$bundle" ] || { fail "bundle missing: $bundle"; return; }
+    have git || { fail "git is required for bundle verification"; return; }
+    have timeout || { fail "timeout is required for bounded git checks"; return; }
+    bundle_path=$(canonical_path "$bundle")
+    tmp=$(mktemp -d "${TMPDIR:-/tmp}/offline-kit-bundle.XXXXXX") || { fail "cannot create temporary bundle verification directory"; return; }
+    git_bounded init -q "$tmp/repo" >/dev/null 2>&1 || rc=1
+    if [ "$rc" -eq 0 ]; then
+        git_bounded -C "$tmp/repo" bundle verify "$bundle_path" >/dev/null 2>&1 || rc=1
+    fi
+    if [ "$rc" -eq 0 ]; then
+        git_bounded -C "$tmp/repo" fetch -q --no-tags "$bundle_path" 'refs/*:refs/remotes/bundle/*' >/dev/null 2>&1 || rc=1
+    fi
+    if [ "$rc" -eq 0 ]; then
+        git_bounded -C "$tmp/repo" cat-file -e "$commit^{commit}" >/dev/null 2>&1 || rc=1
+    fi
+    rm -rf "$tmp"
+    if [ "$rc" -ne 0 ]; then
+        fail "bundle does not prove pinned commit"
+        return 1
+    fi
+    return 0
+}
+
+check_source_clean_except_generated() {
+    local path dirty=0
+    while IFS= read -r path; do
+        [ -z "$path" ] && continue
+        if ! is_generated_source_path "$path"; then
+            fail "source checkout has unexpected dirty or untracked path ([redacted path])"
+            dirty=1
+        fi
+    done < <(
+        git_bounded -C "$SRC" diff --name-only HEAD -- 2>/dev/null
+        git_bounded -C "$SRC" diff --cached --name-only HEAD -- 2>/dev/null
+        git_bounded -C "$SRC" status --porcelain=v1 --untracked-files=all 2>/dev/null |
+            while IFS= read -r path; do
+                path=${path:3}
+                path=${path#\"}
+                path=${path%\"}
+                printf '%s\n' "$path"
+            done
+    )
+    [ "$dirty" -eq 0 ]
+}
+
+check_git_dependency_tree() {
+    local label=$1 path=$2 expected=$3 head status
+    validate_path_location "$label" "$path" || return 1
+    [ -d "$path" ] || { fail "$label source is missing"; return 1; }
+    validate_regular_tree "$label" "$path" || return 1
+    [ -e "$path/.git" ] || {
+        fail "$label is not an initialized Git checkout"
+        return 1
+    }
+    git_bounded -C "$path" rev-parse --git-dir >/dev/null 2>&1 || {
+        fail "$label is not an initialized Git checkout"
+        return 1
+    }
+    [ "$(git_bounded -C "$path" rev-parse --is-shallow-repository 2>/dev/null)" = false ] ||
+        fail "$label checkout is shallow or shallow state is unreadable"
+    head=$(git_bounded -C "$path" rev-parse --verify HEAD 2>/dev/null) || head=
+    [ "$head" = "$expected" ] || fail "$label commit mismatch"
+    status=$(git_bounded -C "$path" status --porcelain=v1 --untracked-files=all --ignored=matching 2>/dev/null) || {
+        fail "$label checkout status could not be inspected"
+        return 1
+    }
+    [ -z "$status" ] || fail "$label checkout has unexpected untracked or modified files"
+    if [ -f "$path/.gitmodules" ]; then
+        git_bounded -C "$path" submodule status --recursive 2>/dev/null |
+            awk 'substr($0, 1, 1) ~ /[-+U]/ { bad=1 } END { exit bad }' ||
+            fail "$label has an uninitialized, modified, or mismatched recursive submodule"
+        git_bounded -C "$path" submodule foreach --quiet --recursive \
+            'test -z "$(git status --porcelain=v1 --untracked-files=all --ignored=matching)"' >/dev/null 2>&1 ||
+            fail "$label recursive submodule working tree is dirty"
+    fi
+}
+
+check_vendor_config() {
+    local config=$1
+    validate_path_location "vendor-config" "$config" || return
+    [ -f "$config" ] || { fail "vendor config is missing: vendor-config"; return; }
+    [ -L "$config" ] && { fail "vendor config is a symlink: vendor-config"; return; }
+    awk '
+        function trim(value) {
+            gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+            return value
+        }
+        function quoted(value) {
+            return value ~ /^"[^"\n]*"$/
+        }
+        function unquote(value) {
+            return substr(value, 2, length(value) - 2)
+        }
+        function mark_source(section) {
+            if (section == "net") {
+                source_kind = "net"
+                net_sections++
+            } else if (section == "source.crates-io") {
+                source_kind = "crates"
+                crates_sections++
+            } else if (section == "source.vendored-sources") {
+                source_kind = "vendor"
+                vendor_sections++
+            } else if (section ~ /^source\.\"git\+https:\/\/[^"]+\"$/) {
+                source_kind = "git"
+                git_sections++
+            } else {
+                bad = 1
+                source_kind = "unknown"
+            }
+        }
+        {
+            line = $0
+            sub(/\r$/, "", line)
+            sub(/[[:space:]]+#.*$/, "", line)
+            line = trim(line)
+            if (line == "") next
+            if (line ~ /^\[[^]]+\]$/) {
+                section = substr(line, 2, length(line) - 2)
+                mark_source(section)
+                next
+            }
+            if (line !~ /^[A-Za-z0-9_.-]+[[:space:]]*=/) {
+                bad = 1
+                next
+            }
+            if (source_kind == "unknown" || source_kind == "") {
+                bad = 1
+                next
+            }
+            equals = index(line, "=")
+            key = trim(substr(line, 1, equals - 1))
+            value = trim(substr(line, equals + 1))
+            if (source_kind == "net") {
+                # Cargo offline switch is a TOML boolean, not a string.
+                if (value != "true") {
+                    bad = 1
+                    next
+                }
+            } else {
+                if (!quoted(value)) {
+                    bad = 1
+                    next
+                }
+                value = unquote(value)
+            }
+            if (source_kind == "net") {
+                if (key != "offline" || value != "true" || ++net_offline > 1)
+                    bad = 1
+            } else if (source_kind == "crates") {
+                if (key != "replace-with" || value != "vendored-sources" || ++crates_replace > 1)
+                    bad = 1
+            } else if (source_kind == "vendor") {
+                if (key != "directory" || value != "vendor" || ++vendor_directory > 1)
+                    bad = 1
+            } else if (source_kind == "git") {
+                if (key == "replace-with") {
+                    if (value != "vendored-sources" || ++git_replace > git_sections)
+                        bad = 1
+                } else if (key == "git") {
+                    if (value !~ /^https:\/\/[^[:space:]"]+$/ || ++git_url > git_sections)
+                        bad = 1
+                } else if (key == "branch" || key == "tag") {
+                    if (++git_selector > git_sections || value == "") bad = 1
+                } else if (key == "rev") {
+                    if (value !~ /^[0-9a-fA-F]{7,64}$/ || ++git_rev > git_sections) bad = 1
+                } else {
+                    bad = 1
+                }
+            }
+        }
+        END {
+            if (bad || net_sections != 1 || net_offline != 1 ||
+                crates_sections != 1 || vendor_sections != 1 ||
+                crates_replace != 1 || vendor_directory != 1 ||
+                git_replace != git_sections || git_url != git_sections ||
+                git_selector > git_sections || git_rev > git_sections) exit 1
+        }
+    ' "$config" >/dev/null 2>&1 || {
+        fail "vendor config contains unknown or network-capable settings; only local vendored-sources replacement is allowed"
+        return
+    }
+}
+
+archive_list() {
+    local archive=$1 output=$2
+    case "$archive" in
+        *.tar.gz) tar --null -tzf "$archive" > "$output" 2>/dev/null ;;
+        *.tar.zst)
+            have zstd || return 1
+            zstd -dc "$archive" 2>/dev/null | tar --null -tf - > "$output" 2>/dev/null
+            ;;
+        *) return 1 ;;
+    esac
+}
+
+check_vendor_tarball() {
+    local archive=$1 listing records entry staged_hash archive_hash rc=0
+    validate_path_location "vendor-tarball" "$archive" || return
+    [ -f "$archive" ] || { fail "vendor tarball missing"; return; }
+    listing=$(mktemp "${TMPDIR:-/tmp}/offline-kit-vendor-list.XXXXXX") || {
+        fail "cannot create temporary vendor archive listing"
+        return
+    }
+    if ! archive_list "$archive" "$listing"; then
+        rm -f "$listing"
+        fail "vendor tarball cannot be listed safely"
+        return
+    fi
+    if LC_ALL=C sort -z "$listing" | LC_ALL=C uniq -z -d | grep -q .; then
+        rm -f "$listing"
+        fail "vendor tarball contains duplicate entries"
+        return
+    fi
+    while IFS= read -r -d '' entry; do
+        case "$entry" in
+            *$'\n'*|/*|../*|*/../*|*/..|..|vendor/../*|vendor/..)
+                rc=1
+                ;;
+            vendor|vendor/*) ;;
+            *) rc=1 ;;
+        esac
+        is_secret_path "$entry" && rc=1
+    done < "$listing"
+    if [ "$rc" -ne 0 ]; then
+        rm -f "$listing"
+        fail "vendor tarball contains an unsafe, secret-bearing, or unexpected path"
+        return
+    fi
+    if ! have sha256sum; then
+        rm -f "$listing"
+        fail "sha256sum is required for deterministic vendor archive comparison"
+        return
+    fi
+    records=$(mktemp "${TMPDIR:-/tmp}/offline-kit-vendor-records.XXXXXX") || {
+        rm -f "$listing"
+        fail "cannot create temporary vendor archive records"
+        return
+    }
+    case "$archive" in
+        *.tar.gz)
+            tar -xzf "$archive" --to-command='
+                case "$TAR_FILETYPE" in
+                    f)
+                        digest=$(sha256sum | awk "{print \$1}") || exit 1
+                        printf "F\\t%s\\t%s\\n" "${TAR_FILENAME#vendor/}" "$digest"
+                        ;;
+                    d) ;;
+                    *) exit 1 ;;
+                esac
+            ' > "$records" 2>/dev/null || rc=1
+            ;;
+        *.tar.zst)
+            zstd -dc "$archive" 2>/dev/null | tar -x --to-command='
+                case "$TAR_FILETYPE" in
+                    f)
+                        digest=$(sha256sum | awk "{print \$1}") || exit 1
+                        printf "F\\t%s\\t%s\\n" "${TAR_FILENAME#vendor/}" "$digest"
+                        ;;
+                    d) ;;
+                    *) exit 1 ;;
+                esac
+            ' - > "$records" 2>/dev/null || rc=1
+            ;;
+    esac
+    if [ "$rc" -eq 0 ]; then
+        staged_hash=$(content_hash_dir "$SRC/vendor") || rc=1
+        LC_ALL=C sort "$records" -o "$records"
+        archive_hash=$(sha256_file "$records") || rc=1
+        [ "$staged_hash" = "$archive_hash" ] || rc=1
+    fi
+    rm -f "$records"
+    rm -f "$listing"
+    [ "$rc" -eq 0 ] || fail "vendor tarball contents mismatch with staged vendor tree"
+}
+
+check_source_and_vendor() {
+    local head ref_commit bundle submodule_status workflow workflow_pin vendor_path
+    have git || { fail "git is required for source verification"; return; }
+    have timeout || { fail "timeout is required for bounded git checks"; return; }
+    validate_path_location "rustdesk-src" "$SRC" || return
+    [ -d "$SRC" ] || { fail "local-only source missing: $SRC"; return; }
+    validate_regular_tree "rustdesk-src" "$SRC" || return
+    validate_optional_directory "rustdesk-src/.cargo" "$SRC/.cargo" || return
+    validate_optional_directory "rustdesk-src/vendor" "$SRC/vendor" || return
+    validate_file_target "vendor-config" "$SRC/.cargo/config.vendor.toml" || return
+    git_bounded -C "$SRC" rev-parse --git-dir >/dev/null 2>&1 || { fail "source is not a Git checkout: $SRC"; return; }
+    [ "$(git_bounded -C "$SRC" rev-parse --is-shallow-repository 2>/dev/null)" = false ] ||
+        fail "source checkout is shallow or shallow state is unreadable"
+    check_source_clean_except_generated
+    head=$(git_bounded -C "$SRC" rev-parse --verify HEAD 2>/dev/null) || head=""
+    [ "$head" = "$RUSTDESK_COMMIT" ] || fail "source HEAD mismatch: expected $RUSTDESK_COMMIT"
+    git_bounded -C "$SRC" check-ref-format --allow-onelevel "refs/tags/$RUSTDESK_REF" >/dev/null 2>&1 ||
+        fail "RUSTDESK_REF is not a valid immutable tag name"
+    ref_commit=$(git_bounded -C "$SRC" rev-parse --verify --quiet "refs/tags/$RUSTDESK_REF^{commit}" 2>/dev/null) || ref_commit=""
+    [ "$ref_commit" = "$RUSTDESK_COMMIT" ] || fail "source tag/commit mismatch: $RUSTDESK_REF"
+    [ -d "$SRC/vendor" ] || fail "vendor/source inconsistency: source vendor directory missing"
+    [ -f "$SRC/.cargo/config.vendor.toml" ] || fail "vendor/source inconsistency: vendor config missing"
+    [ -f "$SRC/.cargo/config.vendor.toml" ] && check_vendor_config "$SRC/.cargo/config.vendor.toml"
+    workflow="$SRC/.github/workflows/third-party-RustDeskTempTopMostWindow.yml"
+    [ -f "$workflow" ] || fail "active RustDesk TopMostWindow workflow is missing from frozen source"
+    if [ -f "$workflow" ]; then
+        workflow_pin=$(awk '
+            { for (i = 1; i <= NF - 2; i++)
+                if ($i == "git" && $(i + 1) == "checkout" && $(i + 2) ~ /^[0-9a-fA-F]{40}$/) {
+                    print $(i + 2); count++
+                }
+            }
+            END { if (count != 1) exit 1 }
+        ' "$workflow" 2>/dev/null) || workflow_pin=""
+        [ "$workflow_pin" = "$TOPMOST_COMMIT" ] || fail "TopMostWindow pin mismatches active RustDesk workflow"
+    fi
+    if [ -f "$SRC/.gitmodules" ]; then
+        submodule_status=$(git_bounded -C "$SRC" submodule status --recursive 2>/dev/null) || submodule_status=""
+        printf '%s\n' "$submodule_status" | awk 'substr($0, 1, 1) ~ /[-+U]/ { bad=1 } END { exit bad }' ||
+            fail "recursive source submodule is uninitialized, modified, or mismatched"
+        git_bounded -C "$SRC" submodule foreach --quiet --recursive \
+            'test -z "$(git status --porcelain=v1 --untracked-files=all)"' >/dev/null 2>&1 ||
+            fail "recursive source submodule working tree is dirty"
+    fi
+    bundle="$OUT/rustdesk-$RUSTDESK_REF.bundle"
+    [ -f "$bundle" ] || fail "source bundle missing: $bundle"
+    [ -f "$bundle" ] && verify_bundle_commit "$bundle" "$RUSTDESK_COMMIT"
+    bundle="$OUT/RustDeskTempTopMostWindow.bundle"
+    [ -f "$bundle" ] && verify_bundle_commit "$bundle" "$TOPMOST_COMMIT"
+    check_git_dependency_tree "vcpkg source" "$OUT/vcpkg" "$VCPKG_BASELINE"
+    check_git_dependency_tree "TopMostWindow source" \
+        "$OUT/RustDeskTempTopMostWindow" "$TOPMOST_COMMIT"
+    if [ -f "$OUT/vendor-$RUSTDESK_REF.tar.zst" ]; then
+        vendor_path="$OUT/vendor-$RUSTDESK_REF.tar.zst"
+    elif [ -f "$OUT/vendor-$RUSTDESK_REF.tar.gz" ]; then
+        vendor_path="$OUT/vendor-$RUSTDESK_REF.tar.gz"
+    else
+        fail "vendor tarball missing"
+        vendor_path=""
+    fi
+    [ -n "$vendor_path" ] && check_vendor_tarball "$vendor_path"
+}
+
+main() {
+    local arg
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --help|-h) usage; return 0 ;;
+            --manifest) [ "$#" -ge 2 ] || { usage >&2; return 2; }; MANIFEST=$2; shift ;;
+            *) usage >&2; return 2 ;;
+        esac
+        shift
+    done
+    check_secret_presence
+    check_manifest_compatibility
+    if [ "$MANIFEST_COMPATIBLE" -eq 0 ]; then
+        printf '%s\n' "[verify] FAIL: $ERRORS check(s) failed; no network or manifest mutation was performed" >&2
+        return 1
+    fi
+    check_pins
+    check_manifest
+    check_source_and_vendor
+    if [ "$ERRORS" -ne 0 ]; then
+        printf '%s\n' "[verify] FAIL: $ERRORS check(s) failed; no network or manifest mutation was performed" >&2
+        return 1
+    fi
+    ok "offline-kit manifest, pins, source commit, bundle, and vendor consistency verified"
+}
+
+main "$@"
diff --git a/offline-kit/versions.env b/offline-kit/versions.env
index c5871a4..f705eb1 100644
--- a/offline-kit/versions.env
+++ b/offline-kit/versions.env
@@ -1,6 +1,8 @@
 # offline-kit/versions.env — единая точка пинов для суверенной сборки.
-# Все версии — факты, извлечённые из тега 1.4.8 rustdesk/rustdesk
-# (.github/workflows/flutter-build.yml, vcpkg.json, rust-toolchain.toml).
+# The 1.4.8 values were historically extracted from the upstream tag and its
+# then-referenced build metadata (including the historical flutter-build.yml).
+# That workflow is absent from the current fork; active workflow truth is in the
+# configured RustDesk fork's rustqs/bridge files.
 # Меняешь версию клиента — обновляй ВСЕ пины ниже под соответствующий тег.
 
 # --- Источник клиента (параметризуемо для downstream-форкеров, PLAN.md §7) ---
@@ -36,9 +38,13 @@ VCPKG_TRIPLET="x64-windows-static"
 # только на Windows-хосте с MSVC. Binary cache заполняется на этапе win-build (PLAN.md §8.3).
 
 # --- Сторонние артефакты Windows-сборки (release-assets + один репо) ---
-# RustDeskTempTopMostWindow: собирается из исходников msbuild'ом на win-агенте (пин коммита)
+# RustDeskTempTopMostWindow: the active frozen RustDesk workflow is the local
+# evidence at artifacts/rustdesk-src/.github/workflows/
+# third-party-RustDeskTempTopMostWindow.yml; its checkout pin is
+# ecd8d6a139eee76845ea66423fb739af450fda90.
+# verify.sh compares this value with that workflow and with the local bundle.
 TOPMOST_REPO="https://github.com/rustdesk-org/RustDeskTempTopMostWindow.git"
-TOPMOST_COMMIT="53b548a5398624f7149a382000397993542ad796"
+TOPMOST_COMMIT="ecd8d6a139eee76845ea66423fb739af450fda90"
 # usbmmidd_v2: виртуальный дисплей-драйвер (release-asset)
 USBMMIDD_URL="https://github.com/rustdesk-org/rdev/releases/download/usbmmidd_v2/usbmmidd_v2.zip"
 # Принтер-драйверы (release-assets hbb_common)
@@ -48,3 +54,20 @@ PRINTER_SUMS_URL="https://github.com/rustdesk/hbb_common/releases/download/drive
 
 # --- Куда складывать артефакты ---
 ARTIFACTS_DIR="artifacts"
+
+# --- Ожидаемые SHA-256 локальных файлов (не URL-доказательство) ---
+# Пустое значение запрещает freeze без явного --allow-tofu и всегда
+# делает offline-kit --verify неуспешным до ручного подтверждения.
+RUSTDESK_BUNDLE_SHA256="eec4cd6587489864c0dc8eab4b8ed983521099faafce8dcdc77170c59798390d"
+VENDOR_TARBALL_SHA256="bec49649ff3c0a49fc4cf2f5ff2aff3a459f2f6fb45039cbe8b89a9995d8a4b6"
+FLUTTER_ENGINE_WIN_SHA256="ec8cabf36ee4ff24c8d98de25b00e70781eb03876265aee84d0fe554a110036e"
+FLUTTER_SDK_WIN_SHA256="b8a7485acd3c6fb23a76b7ac09f89e8d93d62fbff7147c6f5f8c5686d949eeac"
+FLUTTER_SDK_LINUX_SHA256="a7c82f551a9eae018e078f6bb186171e5a77920d35a3d75a61d9a593d0a9e4ae"
+RUST_WIN_MSI_SHA256="c090304864698576114cda578d43da2c81abaf9263efddf1bfc9ea5900cda07f"
+TOPMOST_BUNDLE_SHA256="7752c8c2be7a7e7c7affd0f7c67ec5755e797b13d8e5706726c0140c8ad572ea"
+USBMMIDD_SHA256="629b51e9944762bae73948171c65d09a79595cf4c771a82ebc003fbba5b24f51"
+PRINTER_DRIVER_SHA256="c4cf4d3b48c4d9079b243edc43bb1db03b076282bc259c9f49883e9db20fa8b5"
+PRINTER_ADAPTER_SHA256="e90e5d52c8807b4c6293c78a52479338715e0bf396b1b34802777b8c452e6781"
+# The sidecar checksum file is provider-supplied and needs a manually checked
+# digest before it can be accepted by the fail-closed path.
+PRINTER_SUMS_SHA256=""
diff --git a/plans/deskforge-corrective-refactor/phases/phase-1.md b/plans/deskforge-corrective-refactor/phases/phase-1.md
new file mode 100644
index 0000000..8cb4996
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-1.md
@@ -0,0 +1,57 @@
+# Phase 1 — PR1: BuildSpec/settings
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** typed custom-client settings, canonical persisted `custom_json`, platform gate, and preset compatibility prerequisites. No workflow/Docker/RustDesk changes.
+
+## Behavioral contract
+
+The operator chooses a supported platform and edits known custom-client settings in the existing typed form, then saves a build or preset. The UI/API owns user-authored settings; platform/version/app name are record context; native workflow/provider identity is system-derived. Normal users do not edit raw JSON, raw `custom_txt`, or provider fields.
+
+## Delivered contract
+
+- `BuildSpec` is the typed owner of user-authored settings.
+- `NormalizeCustomBuildJSON`/`CanonicalizeCustomBuildJSON` separate persisted form JSON from dispatch values and generated native `custom_.txt`.
+- L1 `server_ip` and `key` remain available as typed persisted/dispatch values; record context (`platform`, `version`, `app_name`) is not accepted as arbitrary persisted form fields.
+- The closed platform domain is `windows`, `linux`, and `android`; unsupported platforms fail validation before persistence or dispatch.
+- Preset create/update uses the same canonicalization and preserves intentional empty/zero values rather than silently dropping them.
+- Existing typed UI selection remains the normal path; no raw/manual editor was introduced.
+
+## Exact implementation/evidence record
+
+Relevant files checked:
+
+- `api/service/custom_build_spec.go`
+- `api/service/custom_build_spec_test.go`
+- `api/service/custom_build.go`
+- `api/service/custom_persistence_test.go`
+- `api/service/custom_preset.go`
+- `api/model/custom_build.go`
+- `api/model/custom_preset.go`
+- `api/http/controller/admin/custom_build.go`
+- `api/http/controller/admin/custom_preset.go`
+- `api/http/request/admin/custom_build.go`
+- `api/http/request/admin/custom_preset.go`
+- `admin-ui/src/views/custom-client/index.vue`
+
+Focused evidence covers typed field mapping, field presence, malformed/wrong types, unsupported platforms, raw `custom_txt` rejection, canonical persistence, preset create/update, and empty-value compatibility.
+
+Commands recorded:
+
+```text
+GOWORK=off go test ./cmd ./model ./service ./http/controller/admin
+GOWORK=off go test -race ./cmd ./model ./service ./http/controller/admin
+go vet ./cmd ./model ./service ./http/controller/admin
+gofmt -w api/cmd/apimain.go api/http/controller/admin/custom_build.go api/http/controller/admin/custom_preset.go api/http/request/admin/custom_build.go api/http/request/admin/custom_preset.go api/model/custom_build.go api/service/custom_build.go api/service/custom_build_spec.go api/service/custom_preset.go
+git diff --check
+npm run build
+```
+
+The local run passed; the UI build emitted only the existing Rollup pure-comment/chunk-size warnings. This plan record does not claim live provider or deployment validation.
+
+## Gates and remaining dependencies
+
+- Keep all normal inputs typed and capability-shaped; do not expose raw/internal values.
+- Keep the platform gate consistent across API, preset, build, and UI paths.
+- PR2 must consume the canonical endpoint values without a second normalization layer.
+- PR3 must consume typed dispatch parameters rather than reparsing arbitrary persisted JSON.
+- PR6 owns workflow YAML/config simplification; PR1 does not change workflows.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-10.md b/plans/deskforge-corrective-refactor/phases/phase-10.md
new file mode 100644
index 0000000..68a0eb2
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-10.md
@@ -0,0 +1,301 @@
+# Phase 10 — PR10: Offline-Kit/Release Evidence
+
+**Status:** 🟡 `in-progress`
+**Scope:** Packages A–C: offline-kit freeze/verify-only hardening, redacted operator handoff, and active-artifact retention/export evidence. Package C includes the active fork/API workflow retention, exact-output, and manifest contract. This plan record does not perform RustDesk-source build execution, tag, release, asset-upload, commit, or push actions; no release claim is made.
+
+**Current evidence boundary:** Packages A–C implementation and focused checks pass locally: strict offline fixtures/stage checks; v2 producer/API manifests including private `custom_.txt` declaration; deterministic handoff/archive hashes; TOCTOU-safe snapshot cleanup; retention-days/`if-no-files-found: error`; and public `custom_.txt` redaction. PR10 must remain `in-progress`, not `verified-with-notes`, because real offline-kit verification fails closed and the release-boundary gates remain unproven.
+
+## Behavioral contract
+
+An operator naturally chooses **verify-only** for a frozen kit or follows a
+redacted handoff/export verification for a specific build. The values are not
+manual guesses: source/ref/commit, workflow identity, run/artifact identity,
+release/assets identity, output files, and service digest come from frozen
+files or stored immutable build provenance; expected hashes come from a trusted
+reviewable manifest. Existing PR4/PR5 immutable provenance, PR7 exact
+run/artifact binding, and the service-owned PR7 output digest are the patterns
+that represent this action. The normal operator path must not expose PATs,
+payload keys, generated secrets, raw database fields, or provider-internal
+manual selectors.
+
+## Completed-inventory blueprint
+
+### Package A — offline-kit: freeze and verify-only
+
+**Files/evidence:**
+
+- `offline-kit/freeze.sh` and `offline-kit/versions.env` — staged downloads,
+  source/toolchain pins, mutable URLs, vcpkg baseline, and third-party pins.
+- `offline-kit/README.md` and `offline-kit/FORK-PROCEDURE.md` — storage,
+  fork, release-asset, and historical/manual procedures; no current sovereignty claim.
+- `offline-kit/artifacts/MANIFEST.txt`, `sha256sums`, and
+  `printer_sha256sums` — observed manifest/checksum evidence.
+- `offline-kit/artifacts/rustdesk-1.4.8.bundle`,
+  `vendor-1.4.8.tar.gz`, and the frozen `rustdesk-src` tree, including
+  `.gitmodules`, `Cargo.lock`, `.cargo/config.vendor.toml`, and licenses.
+- `win-builder/README.md`, `setup.ps1`, and `agent.ps1` — frozen Windows-only
+  manual/historical evidence, not the active API or release workflow.
+
+**Required work contract:**
+
+1. Keep an explicit online `freeze` mode, but add/define a no-network
+   `verify-only` boundary that neither downloads nor mutates a checkout or
+   observed manifest.
+2. Require equality among `versions.env`'s `RUSTDESK_COMMIT`, source `HEAD`,
+   declared ref/tag, bundle contents, recursive submodule commits, and the
+   source tree used for vendor/config evidence. Reject shallow or dirty source.
+3. Compare every artifact to independently trusted expected SHA-256 values;
+   a generated `MANIFEST.txt`, a URL, or a first-seen hash is not an expected
+   trust root.
+4. Treat mutable URLs and TOFU as retrieval risk. A mutable location must have
+   an independent expected hash/provenance or remain explicitly unverified.
+5. Record vendor completeness, license/source notices, submodule provenance,
+   manifest inputs, sizes, hashes, and repeatability.
+
+**Focused implementation checks:** Strict offline fixtures and freeze/verify-only
+stage checks pass locally, including fail-closed handling for secret-bearing
+artifact presence and staged manifest/input conditions.
+
+**Real-kit verification boundary:** A real offline-kit verify/freeze run fails
+closed on secret-bearing artifact presence, the legacy manifest, missing engine,
+empty printer digest, and incomplete license evidence. `git bundle verify`, source
+`rev-parse`/clean-tree/recursive submodule checks, independently trusted
+expected-manifest checks, and repeat no-mutation verification remain required
+evidence and are not closed by fixture/stage tests.
+
+**Stop points / risks:** stop for a network attempt, missing expected hash,
+mutable URL without independent pin, source/ref/bundle/submodule mismatch,
+shallow/dirty state, incomplete vendor/license evidence, partial artifact, or
+manifest rewrite. Risks are ignored multi-gigabyte artifacts, resumable files
+mistaken for verified files, hash-only evidence mistaken for authenticity, and
+Windows vcpkg/binary-cache requirements not covered by Linux checks.
+
+### Package B — operator handoff: provenance/checksum export
+
+**Files/evidence:** `api/model/custom_build.go`, `api/service/custom_build.go`,
+`api/service/build_provenance_test.go`,
+`api/http/controller/admin/custom_build.go`,
+`api/http/controller/admin/github_build_poll_test.go`, and the configured
+fork's protected workflow files. The handoff is an export/manifest for an
+operator, not a secret-bearing normal response and not a publication action.
+
+The manifest must identify exactly: source repository, selector/ref, source
+commit/tree SHA and submodule commits; workflow repository/path, protected
+selector, workflow SHA/file identity and action pins; provider/run ID, run
+URLs and `head_sha`; artifact ID/name; release tag/ID and exact asset names
+and digests; final output file names/sizes/per-file hashes; service-owned output
+digest; export location; and verification time/result. Generate it from stored
+immutable provenance, re-read and compare it at export time, and fail closed
+on inferred, missing, changed, or provider-only values. Redact PATs, payload
+keys, generated secrets, credential-bearing URLs, and raw internal secret
+fields. Export verification must work from the captured evidence without
+publishing or uploading anything.
+
+**Checks:** Package B implementation and focused tests pass locally: v2
+producer/API manifests, including the private `custom_.txt` declaration;
+deterministic redacted handoff and archive hashes; exact identity, checksum,
+digest, sidecar, and public `custom_.txt` redaction assertions; and offline
+read-back verification without provider access. No live provider evidence is
+inferred.
+
+**Stop points / risks:** stop for incomplete legacy provenance, changed
+workflow contents, missing run/artifact/release identity, checksum/digest
+mismatch, secret leakage, non-deterministic output, or publication attempt.
+Risks are provider URL drift, replaced release assets, unsigned checksums being
+misread as signatures, and the export becoming a secret exfiltration path.
+
+### Package C — active artifacts: retention and exact export
+
+**Files/evidence:** `api/service/published_output.go`,
+`api/service/build_output_cleanup.go`, their focused tests,
+`api/model/custom_build.go`, and the existing download/poll controller paths.
+The service-owned canonical output root and numeric build directories are the
+boundary; `offline-kit/artifacts/` is not an API output directory.
+
+Define separate retention for active `.part`/`.zip` downloads,
+extraction/staging/recovery paths, failed outputs, and completed canonical
+outputs. Cleanup may remove only an exact stale service-owned temporary shape;
+active builds remain protected; completed output remains until its explicit
+retention/export policy is satisfied. Exact-file/manifest verification must
+require regular non-symlink files, bounded count/size/aggregate, canonical
+relative names, deterministic ordering, and the required Windows executable.
+The service-owned digest binds immutable build/run/artifact and release/assets
+identity to exact names, sizes, and contents. An export sidecar/metadata record
+carries the digest and manifest identity and is checked against the bytes before
+handoff; it is evidence, not a signature or release asset.
+
+Preserve Windows-only production capability and fail closed for Linux/Android
+until PR11 supplies real end-to-end evidence. Keep `win-builder/` frozen and
+manual/historical-only. Local output, an export sidecar, or a handoff
+manifest must never be described as a live release.
+
+**Checks:** Package C implementation and focused tests pass locally:
+TOCTOU-safe snapshot/archive cleanup, exact-manifest and digest/publication-proof
+checks, retry/partial-output handling, active-versus-terminal retention,
+retention-days and `if-no-files-found: error` workflow contracts, mutation/missing-
+file and symlink/path/name/size-limit rejection, export-sidecar verification, and
+Windows-only capability checks. Completed-output retention/deletion remains a
+manual operator policy; the API does not claim an automatic completed-output TTL
+or release-retention policy. Cross-DB and live-provider checks remain gates below.
+
+**Stop points / risks:** stop for ambiguous ownership, unsafe cleanup scope,
+manifest/digest/sidecar mismatch, post-proof mutation, missing Windows
+executable, or Linux/Android/release exposure. Risks are premature deletion,
+stale recovery trees, digest replay, detached metadata, and confusing artifact
+retention with release retention.
+
+## Explicit gates, checks, and non-claims
+
+These are stop gates, not gaps to work around:
+
+- **Protected workflow ref:** deployment must protect the immutable workflow
+  selector and verify exact workflow contents at the resolved SHA; the required
+  dispatch branch/tag selector remains distinct from the workflow file SHA.
+- **Submodule publication:** RustDesk `hbb_common` must have clean, published
+  provenance before reproducibility or sovereignty is claimed; dirty/unpublished
+  submodule state remains a blocker.
+- **Live provider:** live GitHub/provider, runner, and workflow execution remain
+  unverified and are never simulated by local metadata.
+- **Signatures:** SHA-256 manifests/digests provide integrity evidence only;
+  signatures, attestations, and their trust roots remain a separate gate.
+- **Cross-DB:** MySQL and PostgreSQL migration/read-write evidence remains
+  required; SQLite-only checks do not close this gate.
+- **Network-denied full build:** a complete offline build, including Windows
+  toolchain/vcpkg capability and repeat-build evidence, remains required;
+  verify-only or metadata checks do not satisfy it.
+
+Release publication, tag creation, asset upload, secrets, destructive cleanup,
+and a live release/readiness claim are outside PR10. A package may be marked
+verified only with its own evidence; otherwise record `blocked` or
+`verified-with-notes`.
+
+## Local Package B/C implementation update — 2026-08-10
+
+- The active fork workflows already emit one JSON schema in `manifest.txt`:
+  `schema="deskforge.client-artifact"`, `schema_version=2`, `platform`,
+  `app_name`, ordered `output_filenames`, `source_sha`, `workflow_sha`,
+  `workflow_ref`, `version`, the exact digest scope
+  `sha256 covers public delivered output files; manifest.txt and declared private
+  files are excluded`, and ordered
+  `files` entries containing `name` and lowercase SHA-256 `sha256`.
+- DeskForge now parses this bounded schema once at the ZIP extraction boundary,
+  rejects duplicate JSON keys/unknown fields, compares source/workflow/version/
+  platform/app identity with the stored build snapshot, derives the exact
+  platform output names from one shared mapping, and verifies extracted bytes.
+  New provider-run/partial-identity artifacts require the manifest; rows with no
+  provider run and no immutable identity retain the existing legacy extraction
+  compatibility path. Windows normal-path filtering is not weakened.
+- The admin handoff now contains sorted non-secret output entries (`name`,
+  `size`, `sha256`), an explicit `verification_result`, the stored publication
+  timestamp, and the existing source/workflow/run/artifact/release identity.
+  Request-time `generated_at` is omitted. The service digest scope explicitly
+  allows canonical output to include private `custom_.txt`; the handoff omits
+  that entry and never exposes its contents. SHA-256 evidence is not a
+  signature.
+- Local focused Go tests, race tests, targeted vet/build, RustDesk workflow
+  contract checks, active-workflow manifest marker checks, and `git diff --check`
+  passed. The full `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and
+  `GOWORK=off go test -race ./...` checks also pass after test-only cache diagnostics,
+  opt-in Redis test changes, and test-only lock-test race fixes; production lock code is
+  unchanged. The API build, UI build, deterministic Swagger regeneration/parity, and
+  Compose checks pass. No live provider/runner, migration, publication, or external
+  code-sharing check was run.
+
+## Package B/C integrity follow-up — 2026-08-10
+
+- The shared producer manifest writer now validates the output root and every
+  declared path with `lstat`, rejects symlinks and special files before hashing
+  or writing `manifest.txt`, rejects extra output files, and emits v2 producer
+  source-tree/submodule evidence as `reported`. Older v2 scope/result labels
+  remain readable and normalize to the current report label when stored.
+- v2 now declares optional `private_filenames`; the only accepted private name
+  is `custom_.txt`. The writer emits it without size/content/hash records when
+  present, public `files` and digest scope exclude it, and Windows/Linux/
+  Android workflows copy the already-embedded private file beside public
+  output before writing the manifest. Extraction accepts only that declared
+  private file and rejects every other unlisted or secret-bearing filename.
+- Public ZIP export now takes the shared canonical-output export lock, copies
+  bounded regular files into a private snapshot while hashing them, packages
+  only that snapshot, and rechecks the canonical service digest before returning.
+  A mutation aborts before response headers; `X-DeskForge-Archive-SHA256` is
+  computed from the actual archive bytes. Existing published digest semantics,
+  artifact names, and admin/public authorization boundaries are unchanged.
+- The admin handoff now includes stable `export_route`, explicit
+  `verification_status`, and a `producer_report` whose source-tree/submodule
+  fields remain `reported`; provider release-asset digests are separately
+  `reported` and explicitly not recomputed by DeskForge. Service publication,
+  output, and identity checks use `service_verified`. Publication timestamp
+  and verification status are derived from stored publication proof; request
+  timestamps and host paths are excluded. The admin response body is emitted
+  once and its exact bytes are hashed in `X-DeskForge-Manifest-SHA256`.
+- Active Windows/Linux/Android workflows install failure cleanup traps before
+  writing sensitive `custom_.txt` temp files and add an always-run cleanup step.
+  The workflow contract test covers trap placement, regular/symlink/special
+  writer inputs, path escape rejection, v2 report labeling, YAML, Bash, action
+  pins, permissions, and redaction boundaries.
+- Focused `go test`, `-race`, `go vet`, `go build`, Python/Bash, YAML, workflow
+  contract, Swagger regeneration/parity, Compose, and `git diff --check` checks pass.
+  The full Go vet/test/race commands pass after test-only cache diagnostics, opt-in Redis
+  test changes, and test-only lock-test race fixes; production lock code is unchanged.
+  `actionlint` and `shellcheck` are unavailable; no live provider/runner, migration, release,
+  publication, or external code-sharing check was run.
+
+## Active/frozen workflow evidence boundary
+
+- The configured RustDesk fork workflows are the active executable source and
+  their manifest, retention-days, `if-no-files-found: error`, and cleanup
+  contracts have focused local evidence only. No provider, runner, or live
+  workflow result is inferred from those files or tests.
+- Frozen offline-kit artifacts/procedures and `win-builder/` remain manual/historical-only
+  evidence, not an active release path. Their presence cannot close the protected
+  workflow-ref, clean published submodule, signature, cross-DB, or complete
+  network-denied full-build gates.
+
+## Current state carried from PR9
+
+- PR1–PR9 and the security-hardening work are `verified-with-notes`. Focused
+  Go/UI/Docker/Cargo metadata/DFP1/workflow-contract checks pass locally.
+- Full `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and
+  `GOWORK=off go test -race ./...` pass after test-only cache diagnostics, opt-in Redis test
+  changes, and test-only lock-test race fixes; production lock code is unchanged. The API
+  build, UI build, deterministic Swagger regeneration/parity, Compose checks, and
+  `git diff --check` pass. Redis integration tests and benchmarks run only when
+  `DESKFORGE_TEST_REDIS_ADDR` is configured, and no live Redis run is recorded. Default
+  OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, live provider/runner
+  execution, clean-worktree/repeat-build evidence, cross-DB coverage, and
+  Windows/Linux/Android execution remain unverified.
+- Workflow dispatch requires a branch/tag selector, exact contents-at-
+  `WorkflowSHA` readiness, and a matching run `head_sha`; protected/immutable
+  workflow-ref deployment remains a release gate. RustDesk `hbb_common`
+  timestamp work remains dirty and unpublished submodule state.
+
+## Workflow approval and dispatch evidence carried into PR10 — 2026-08-11
+
+- Local provider-contract/focused-test evidence requires a provider-derived verified annotated
+  commit tag, an accepted verification reason, active matching protection with explicit update
+  and deletion rules, an empty bypass-actor list, and rejection of a same-label branch collision.
+  Missing, conflicting, malformed, or bypassable protection is not evidence of immutability.
+- Approval and migration evidence records the selected tag, provider-resolved SHA, and policy
+  state through additive `DatabaseVersion 282` fields while retaining required legacy compatibility.
+  Preparation and dispatch revalidate the selector, workflow contents, policy, and SHA before
+  secret-bearing DFP1 payload creation; typed provider/approval/validation/contract failures use
+  bounded safe errors and do not expose credentials, provider bodies/URLs, selectors, or payloads.
+- The provider boundary remains open: GitHub `workflow_dispatch` requires a branch/tag selector
+  and does not bind the POST atomically to a SHA. A theoretical selector move between final
+  validation and POST can expose DFP1 to another workflow revision. Secret-bearing production
+  dispatch/live readiness therefore remains gated until provider-side immutable/no-bypass
+  deployment proof or atomic API support is actually evidenced.
+
+## Dependencies / remaining evidence
+
+PR10 depends on the verified-with-notes PR9 reproducibility/action-pin record,
+PR7 exact artifact delivery/digest boundary, and PR6 workflow ownership. Package
+A/B/C implementation and focused checks pass locally, but real offline-kit
+verify/freeze fails closed on secret-bearing artifact presence, the legacy manifest,
+missing engine, empty printer digest, and incomplete license evidence. Protected
+workflow-ref deployment, clean published RustDesk `hbb_common` submodule provenance,
+live provider/runner execution, signatures/attestations, MySQL/PostgreSQL
+cross-DB evidence, a complete network-denied full build, and release publication
+remain unproven. Completed-output retention remains manual/explicit; no completed-
+output TTL, release-retention policy, signature/attestation, live provider/runner
+result, or complete offline full-build proof exists.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-11.md b/plans/deskforge-corrective-refactor/phases/phase-11.md
new file mode 100644
index 0000000..2ed50dd
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-11.md
@@ -0,0 +1,83 @@
+# Phase 11 — PR11: Linux/Android Capability
+
+**Status:** 🟡 `in-progress` (not verified)
+**Scope:** end-to-end Linux and Android build capability validation and guarded platform exposure. This phase consumes PR7 streaming artifacts and does not equate workflow-file presence with support. Local static implementation evidence is recorded below; live capability evidence remains blocked and the capabilities remain disabled.
+
+## Behavioral contract
+
+A user may choose Linux or Android only when the corresponding capability is known-good: the owned workflow, bridge dependencies, custom settings embedding, exact artifact, streamed delivery, and download path all pass. Unsupported or unproven platforms fail closed and are not shown as selectable normal capabilities.
+
+## Local implementation evidence — 2026-08-10
+
+These are local source/static implementation and focused-test observations only; they do
+not verify real platform builds, provider execution, APK/package creation, installation,
+custom runtime delivery, or Android app-ID behavior in a built application:
+
+- Bridge staging and hash restore are implemented and locally evidenced.
+- The DFP1-only workflow/helper boundary is preserved, with no alternate payload path.
+- Manifest v2 is implemented and locally evidenced.
+- Android app-id validation preserves the `applicationId` contract.
+- Android `custom_.txt` uses the required runtime path and has a fail-closed packaging
+  check rather than best-effort embedding.
+- Linux deb/RPM packaging preserves `custom_.txt` ordering.
+- Portable deterministic traversal/timestamp tests pass locally.
+- Capability gating keeps the normal UI platform choice disabled until evidence is
+  green; unsupported or unproven platforms remain unavailable.
+
+Workflow manifests, bridge/helper source, app-ID/`applicationId` checks, custom_.txt
+runtime-path checks, and local package assertions are not live evidence. Deleted local
+reference workflow copies and frozen `rdgen` workflows are not proof of provider
+execution, packaging, installation, or support.
+
+## Shared repository verification — 2026-08-12
+
+The full repository checks pass independently of live platform capability: `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` passed after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. The API build, UI build, deterministic Swagger regeneration/parity, Compose checks, and `git diff --check` also passed. These checks do not provide live Linux/Android/Windows/provider, package/install/runtime, signing, protected-ref, clean/repeat-build, cross-DB, signature, or offline-build evidence.
+
+## Shared workflow approval and dispatch evidence — 2026-08-11
+
+- The local API contract now records provider-derived verified annotated commit tags, accepted
+  verification reasons, active matching protection with explicit update/deletion rules, no bypass
+  actors, and same-label tag/branch collision rejection. Approval/migration checks cover the
+  additive fields at `DatabaseVersion 282`; safe typed errors keep provider bodies, selectors,
+  credentials, and encrypted payloads out of normal responses and diagnostics.
+- Preparation and dispatch revalidate the approved selector, protected policy, exact workflow
+  contents, and resolved SHA immediately before DFP1 encryption. This is local focused evidence,
+  not proof that a provider POST is immutably bound to that SHA.
+- GitHub `workflow_dispatch` requires a branch/tag selector and does not provide atomic SHA
+  binding. A theoretical selector move between final validation and POST can expose DFP1 to a
+  different workflow revision, so secret-bearing production dispatch/live readiness remains gated
+  until provider-side immutable/no-bypass deployment proof or atomic API support is evidenced.
+
+## Required contract
+
+- Real `rustqs-linux.yml` and `rustqs-android.yml` runs execute on the approved fork/branch with the PR6 ownership mapping.
+- vcpkg, Flutter, `build.py`, packaging, signing/input, and bridge dependencies are verified for the supported environment.
+- Android `custom_.txt` embedding must be validated in a real build; local generation and
+  fail-closed packaging checks are not live embedding evidence.
+- Exact artifact names/paths, PR4 provenance, PR5 version/build-ref, and PR7 streaming/download completion agree end to end.
+- UI/API platform choices are enabled only behind the validated capability gate.
+
+## Gates
+
+- Use approved non-production provider credentials and redact all secrets; record exact workflow run, artifact, and environment evidence.
+- Verify failure behavior for missing dependencies, unsupported platform, incomplete embedding, wrong artifact, stream interruption, and provider terminal errors.
+- Recheck public endpoint and runtime reachability without claiming Docker/dev-compose parity unless it is actually tested.
+- Preserve the PR1 closed platform domain and all PR2/PR3/PR4/PR5/PR6 limitations; no platform is marked supported from YAML presence alone.
+
+## Explicit blockers / non-claims
+
+PR11 remains `in-progress`, not verified. The following blockers are explicit:
+
+- All changes are unpublished, and the helper is untracked at the remote HEAD.
+- No live Linux, Android, Windows, or provider runs have been performed.
+- No APK/package/install/runtime evidence exists.
+- No protected workflow-ref proof exists.
+- No clean-worktree or repeat-build evidence exists.
+- Required toolchains and native validators are unavailable.
+- RustDesk `hbb_common` remains dirty and unpublished.
+- Android signing/debug evidence is unavailable.
+- Cross-DB and cryptographic signature evidence are unavailable.
+
+## Dependencies / remaining evidence
+
+Depends on PR6 workflow ownership/config, PR7 streaming artifact, PR9 reproducibility/action pins, and PR10 offline-kit/release inputs. Local implementation evidence is recorded above, but live Linux/Android workflow execution, exact APK/package output, installation/runtime delivery, and provider-backed download completion remain unverified. PR10 and PR11 remain `in-progress`; PR12 is `verified-with-notes` for the completed documentation reconciliation.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-12.md b/plans/deskforge-corrective-refactor/phases/phase-12.md
new file mode 100644
index 0000000..1f03515
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-12.md
@@ -0,0 +1,136 @@
+# Phase 12 — PR12: Docs/Tracker
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** audit and reconcile external docs, the tracker, and PR10/PR11 implementation notes against the current canonical evidence. PR12 also records source Swagger annotations and regenerated `api/docs/api` plus `api/docs/admin` as API documentation metadata, produced with module-pinned `swag v1.16.3`. PR12 remains the documentation/tracker phase; the cumulative DeskForge candidate also includes the PR1–PR11 API/UI/Docker/server/offline-kit/tests implementation, while a separate RustDesk candidate includes active workflow/Android/portable/helper/tests.
+**Boundary:** no live-provider, full-offline-build, signature/attestation, cross-DB, protected-ref, release-readiness, sovereignty, or Linux/Android support claim is allowed from local implementation notes or focused checks. Commits and PR publication are authorized by the user but remain pending final checks; this phase performs no publication.
+**Provenance:** the DeskForge and RustDesk candidates are separate publication units. `rdgen` deletion and dirty RustDesk submodule content are excluded; this phase is not an isolated publication diff.
+
+## Behavioral contract
+
+Operators and maintainers should find one truthful account of supported capabilities, configuration, endpoints, build status, artifact handling, offline/release constraints, and known gaps. Documentation and tracker entries must describe what the evidence actually proves; they must not promote planned, local-only, historical, or unverified work to ready.
+
+The normal user action remains typed configuration/selection or an operator verification of stored/frozen identity. Provider-derived run/artifact identity, source/workflow identity, hashes, and service digests remain system/provider-derived; secrets and raw internal values are not normal manual inputs.
+
+## Audited-document checklist
+
+- [x] `PLAN.md` — confirms the provider-only path, published client 1.4.8 / DeskForge
+      schema 272, local corrective API schema 282 target, Windows-only admitted capability,
+      Linux/Android gating, current ports, DFP1 payload, and absence of live-provider/
+      clean-build proof.
+- [x] `README.md` — records Linux/Android as in development and labels the published
+      client 1.4.8 / DeskForge schema 272 against the local API schema 282 target, key path,
+      port 21119, fork ownership,
+      and no support/readiness claim.
+- [x] `CHANGELOG.md` — preserves the current provider-only/no-live-run boundary,
+      with PR10/PR11 `in-progress` and PR12 `verified-with-notes` for the documentation/tracker phase.
+- [x] `BUGS.md` — preserves the capability gate and pending live evidence;
+      historical closure text remains historical and is not current run/support proof.
+- [x] `CONTRIBUTING.md` and `AGENTS.md` — agree on workflow ownership, frozen/reference
+      boundaries, secret handling, and no-publication constraints.
+- [x] `github-build/README.md` — identifies the configured RustDesk fork as the
+      sole executable workflow source and keeps Linux/Android capability-gated.
+- [x] `offline-kit/README.md` and `offline-kit/FORK-PROCEDURE.md` — define
+      fail-closed verify-only behavior and explicitly deny full-build/signature proof.
+- [x] `api/README.md` — confirms redacted handoff metadata and that the service
+      digest is integrity metadata, not a signature or release publication;
+      documents provider-derived verified annotated tags, active protected-tag
+      policy, explicit update/deletion protections, no bypass actors,
+      tag/branch collision rejection, schema 280–282 additive fields, legacy
+      metadata-only secret compatibility, pre-payload revalidation, safe errors,
+      and the live-provider/atomic-dispatch limitation.
+- [x] Canonical `phase-10.md` and `phase-11.md` — confirm focused local evidence
+      and the exact PR10/PR11 blockers used by this reconciliation.
+- [x] Canonical implementation evidence records protected verified annotated tags, active
+      update/deletion protections, no bypass actors, tag/branch collision rejection, approval
+      migration through `DatabaseVersion 282`, pre-payload revalidation, and bounded safe errors.
+- [x] Source Swagger annotations and regenerated `api/docs/api` plus `api/docs/admin` use
+      module-pinned `swag v1.16.3`; JSON/YAML/`docs.go` outputs are deterministic, and
+      route/auth/schema/redaction parity checks pass.
+
+## Reconciliation result
+
+The canonical plan records PR10 and PR11 as `in-progress` and carries their local
+evidence and blockers forward. PR12 includes source Swagger annotations and regenerated
+`api/docs/api` plus `api/docs/admin` via module-pinned `swag v1.16.3`; JSON/YAML/`docs.go`
+outputs are deterministic, and route/auth/schema/redaction parity checks pass. Full
+`GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and
+`GOWORK=off go test -race ./...` pass after test-only cache diagnostics, opt-in Redis test
+changes, and test-only lock-test race fixes; production lock code is unchanged. The API
+build, UI build, deterministic Swagger regeneration/parity checks, Compose checks, and
+`git diff --check` pass. Swagger metadata remains sparse for legacy operations, a
+low-usability issue that does not change the verified status or create a correctness claim.
+The audited DeskForge documents and directly copied RustDesk README workflow links are
+aligned with that record.
+
+Recorded verification commands/checks:
+
+- `GOWORK=off go vet ./...`
+- `GOWORK=off go test ./...`
+- `GOWORK=off go test -race ./...`
+- API build: `GOWORK=off go build -o release/apimain cmd/apimain.go`
+- UI build: `npm run build`
+- Module-pinned Swagger regeneration with `swag v1.16.3`, followed by deterministic
+  JSON/YAML/`docs.go` parity and route/auth/schema/redaction checks
+- Compose configuration checks
+- `git diff --check`
+
+All listed checks pass. The Redis integration and benchmark path remains untested when
+`DESKFORGE_TEST_REDIS_ADDR` is unset.
+Published HEAD/version
+claims, dispatch response requirements, PR11 static-only evidence, manual/historical
+builder boundaries, the 2026-08-12 full Go vet/test/race result with its opt-in Redis
+boundary, and license-inventory non-claims are explicit. The full commands passed after
+test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes;
+production lock code is unchanged. Redis integration tests and benchmarks run only when
+`DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded. The reconciliation
+corrects stale next/status and ownership wording without adding unsupported capability or
+readiness language. Local pre-payload revalidation and
+safe-error behavior do not resolve GitHub's provider boundary: `workflow_dispatch` still
+requires a branch/tag selector without atomic SHA binding, so a theoretical selector move
+between final validation and POST can expose DFP1.
+
+## Exact remaining gates
+
+- [ ] **Real offline-kit verification:** independently trusted expected manifest and
+      hashes; clean, non-shallow source and bundle; recursive submodule provenance;
+      complete vendor/license evidence; and repeat no-mutation verification. Current
+      real-kit verification fails closed on secret-bearing artifacts, the legacy
+      manifest, missing engine, empty printer digest, and incomplete license evidence.
+- [ ] **Protected workflow identity:** the local API now requires a provider-derived
+      verified annotated tag, active protected-tag evidence with explicit update and
+      deletion protections, no bypass actors, no tag/branch label collision, and exact
+      workflow contents at resolved `WorkflowSHA`, distinct from GitHub's required
+      dispatch branch/tag selector; approval/migration fields are at local schema 282 and
+      the dispatch primitive revalidates policy/SHA immediately before DFP1 creation. Live
+      provider proof remains unverified.
+- [ ] **Atomic dispatch boundary:** the pending → building identity write and local final
+      policy revalidation are atomic/ordered locally, but GitHub `workflow_dispatch` requires
+      a branch/tag selector and provides no atomic SHA binding. A theoretical selector move
+      between final validation and POST can expose DFP1 to another revision; no durable
+      outbox/distributed lease or provider-side immutable/no-bypass proof closes this window.
+      Secret-bearing production dispatch/live readiness remains gated until such proof or
+      atomic API support is actually evidenced.
+- [ ] **Published submodule provenance:** clean, published RustDesk `hbb_common` state.
+- [ ] **Live execution:** provider/runner/workflow runs for any claimed platform, with
+      exact run/artifact identity, matching `head_sha`, and provider-backed streamed
+      download completion. No live provider run is recorded.
+- [ ] **Linux/Android capability:** APK/package output, installation/runtime delivery,
+      and Android signing/debug evidence. Linux/Android remain capability-gated, not
+      supported.
+- [ ] **Build environment:** required toolchains/native validators plus clean-worktree
+      and repeat-build evidence.
+- [ ] **Cross-database evidence:** MySQL and PostgreSQL migration/read-write checks;
+      SQLite-only checks do not close this gate.
+- [ ] **Authenticity evidence:** cryptographic signatures, attestations, and trusted
+      verification roots; SHA-256 manifests/digests are integrity evidence only.
+- [ ] **Complete offline build:** a network-denied full build, including Windows
+      toolchain/vcpkg capability and repeat-build evidence. Verify-only/metadata
+      checks do not satisfy this gate.
+- [ ] **Retention/publication boundary:** explicit completed-output retention/deletion
+      policy; no automatic TTL, release-retention, tag, asset upload, or release claim.
+
+PR12 is `verified-with-notes` as a documentation/tracker phase and is not a release
+step. Swagger source/output parity does not close the preserved PR10/PR11
+external-provider/live-execution, real offline-kit, protected workflow-ref, signature/
+attestation, cross-DB, or publication/release blockers. PR10 and PR11 remain
+`in-progress` and must not be marked complete by documentation reconciliation alone.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-2.md b/plans/deskforge-corrective-refactor/phases/phase-2.md
new file mode 100644
index 0000000..6b7001a
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-2.md
@@ -0,0 +1,50 @@
+# Phase 2 — PR2: network/public endpoints
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** endpoint representation and public/runtime endpoint checks only. No claim of complete Docker or deployment coverage.
+
+## Behavioral contract
+
+The operator enters/chooses server endpoints in the existing form. The typed API persists and dispatches the literal endpoint supplied by the operator, including an explicit port where valid. The client/runtime derives only the protocol-specific defaults it already owns; normal users are not asked to provide internal WebSocket payloads.
+
+## Delivered contract
+
+- Endpoint values remain typed strings with hostname/IP and port validation at the BuildSpec boundary.
+- The canonical path preserves literal endpoint ports; there is **no `stripPort` transformation** in the service canonicalization/dispatch contract.
+- `server_ip`, `relay_server`, and `api_server` retain their distinct roles; the native mapping uses the existing key names and does not silently rewrite a supplied endpoint.
+- The existing UI/web-client paths were checked for the public WebSocket port contract, including `21119` for relay/public flow and `21118` for the existing bridge flow.
+- Docker entrypoint consumption of `custom_json` and the compose port/environment declarations were checked against the API/UI contract.
+
+## Exact implementation/evidence record
+
+Relevant files checked:
+
+- `api/service/custom_build_spec.go`
+- `api/service/custom_build_spec_test.go`
+- `api/service/custom_build.go`
+- `admin-ui/src/views/custom-client/index.vue`
+- `admin-ui/src/utils/webclient.js`
+- `docker/docker-compose.yml`
+- `docker/entrypoint-linux.sh`
+- `docker/entrypoint-win.sh`
+
+Focused tests include literal endpoint preservation for host-only and host-with-port values, invalid ports/URLs, and dispatch/persisted-value agreement. The UI build and the Go focused package checks passed as recorded in Phase 1/5.
+
+## Checks and notes
+
+```text
+GOWORK=off go test ./cmd ./model ./service ./http/controller/admin
+GOWORK=off go test -race ./cmd ./model ./service ./http/controller/admin
+go vet ./cmd ./model ./service ./http/controller/admin
+npm run build
+git diff --check
+```
+
+The checks are local/static and focused. Manual browser/runtime endpoint checks, documentation alignment, and the development compose exposure of `21119` remain gaps. The production compose file currently exposes the established `21114`–`21118` set; this phase does not claim that `21119` is published by Docker. No manual live-network or dev-compose run is evidence here.
+
+## Gates and remaining dependencies
+
+- Do not reintroduce port stripping in API normalization, dispatch preparation, or preset restore.
+- Keep UI public-host behavior and Docker port/env declarations aligned before enabling additional public flows.
+- Manual verification must cover an actual browser/public WebSocket path and both production and dev compose configurations.
+- PR6 must settle workflow ownership/config before endpoint defaults are treated as deployment guarantees.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-3.md b/plans/deskforge-corrective-refactor/phases/phase-3.md
new file mode 100644
index 0000000..ff6d10f
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-3.md
@@ -0,0 +1,50 @@
+# Phase 3 — PR3: exact run_id/REST errors
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** GitHub REST transport, exact workflow dispatch response, typed error policy, redaction, artifact identity, and retry classification. The exact dispatch response is a project/provider contract under test; no normal GitHub operation or live-provider claim is made.
+
+## Behavioral contract
+
+The operator selects a known build capability and starts it. The service encrypts the typed payload and asks GitHub to dispatch the configured workflow. GitHub supplies the run identity; the service must not manufacture it by listing recent runs or accept it from user input. Provider errors are typed and safe to surface; secrets and encrypted payloads never appear in logs.
+
+## Delivered contract
+
+- **Contract under test:** dispatch sends `return_run_details: true` and requires the exact HTTP `200` run-details response containing `workflow_run_id`, `run_url`, and `html_url`.
+- Standard `204` is intentionally unsupported because it provides no accepted exact run correlation. A `204`, missing/zero run ID, malformed JSON, or unsafe URL is a contract error; there is no “latest run” guessing or list-and-hope fallback. Stored `GithubRunId=0` remains the legacy/no-provider-run sentinel, not a current provider identity.
+- Shared REST handling validates repository paths before transport, bounds response bodies, redacts bearer tokens/PATs/payload keys/encrypted payloads, and classifies transport/API failures as retryable or terminal.
+- `401`, ordinary `403`, `404`, `409`, `410`, and `422` remain terminal; rate-limited `403`, `408`, `425`, `429`, and `5xx` are retryable under the recorded policy.
+- Run status returns typed status/conclusion and optional exact `head_sha`.
+- Artifact resolution is tied to the exact stored run and requested artifact name; there is no sole-artifact inference. Download uses the resolved artifact ID.
+- Secret public-key and secret-write endpoints use the same expected-status and bounded/typed error handling.
+
+## Exact implementation/evidence record
+
+Relevant files checked:
+
+- `api/service/github_build_config.go`
+- `api/service/github_build_config_test.go`
+- `api/service/custom_build.go`
+- `api/http/controller/admin/custom_build.go`
+- `api/http/controller/admin/github_build_config.go`
+- `api/model/github_build_config.go`
+
+Focused fake-transport coverage exercises the project/provider dispatch response shape and `200` requirement, no list polling/guessing, malformed/zero/missing identity rejection, URL safety, status classification, bounded and redacted bodies (including truncation boundaries), unsafe repository rejection, exact status/head SHA handling, exact artifact-name selection, artifact-ID download, secret endpoint status handling, and retry-vs-terminal poll policy. These tests do not prove normal GitHub operation.
+
+Commands recorded:
+
+```text
+GOWORK=off go test ./cmd ./model ./service ./http/controller/admin
+GOWORK=off go test -race ./cmd ./model ./service ./http/controller/admin
+go vet ./cmd ./model ./service ./http/controller/admin
+git diff --check
+```
+
+These are local fake-transport checks. No live GitHub/provider dispatch, real credentials, or live poll/download integration was performed. Historical note: this earlier phase record did not include the broad Go checks. The 2026-08-11 verification records `GOWORK=off go vet ./...` and `GOWORK=off go test ./...` passing after test-only cache diagnostics and opt-in Redis test changes; Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`, with no live Redis run recorded.
+
+## Gates and remaining dependencies
+
+- Keep the exact provider contract; do not restore `204` success, list-based run inference, or guessed artifact selection.
+- Preserve typed errors and redaction at every GitHub REST caller.
+- PR4 owns durable provenance and restart-safe binding of this exact identity.
+- PR5 owns immutable version/build-ref binding before dispatch.
+- Live provider dispatch, real poll progression, and CI artifact delivery remain explicit follow-up evidence, not completed by PR3.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-4.md b/plans/deskforge-corrective-refactor/phases/phase-4.md
new file mode 100644
index 0000000..f00a025
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-4.md
@@ -0,0 +1,55 @@
+# Phase 4 — PR4: provenance
+
+**Status:** ✅ `verified-with-notes`
+**Date recorded:** 2026-08-09
+**Scope:** provider identity persistence and restart-safe polling; no claim of distributed delivery.
+
+## Delivered contract
+
+A GitHub build stores one immutable provider-derived snapshot:
+
+- `github_provider`
+- `github_repo`
+- `github_workflow`
+- `github_ref`
+- `github_run_id`
+- `github_run_url`
+- `github_html_url`
+- `github_artifact_name`
+- `github_artifact_id`
+- `github_source_sha`
+
+Secrets and dispatch payloads are not part of the snapshot. `github_run_id` comes from GitHub's exact dispatch response; the code does not infer a run by listing recent runs. The artifact name is selected by platform, the artifact ID is resolved from the exact stored run and exact name, and the source SHA is taken from the run-status response when available.
+
+## Schema and write guards
+
+- **DatabaseVersion:** `273`.
+- **Migration:** `AutoMigrate` adds the provenance fields and keeps legacy rows readable.
+- **Dispatch guard:** one atomic pending → building write stores the complete run/repository/workflow/ref/URL identity and rejects a second dispatch or partial pre-existing identity.
+- **Artifact guard:** artifact ID is write-once, positive, tied to the stored run ID and current building state.
+- **SHA guard:** source SHA is validated and write-once for the stored run; a later poll cannot replace it.
+- **Progress guard:** asynchronous progress updates do not carry or overwrite immutable run identity.
+
+## Polling and restart evidence
+
+Polling builds a request configuration from the stored provenance snapshot. After global repository/workflow/ref configuration is mutated, requests still target the original stored repository, workflow, ref, run, and artifact. Only the current token is read from the mutable global configuration. Startup resume runs after migration and applies the same snapshot validation before starting a poll.
+
+Rows with a run ID but missing or inconsistent immutable provenance fail closed to `failed` with an explicit log reason. A process-local ownership guard prevents duplicate pollers for one build and releases its claim when polling exits. It is intentionally not a distributed lease.
+
+## Verification recorded
+
+- Focused SQLite migration/backward-compatibility checks: **pass**.
+- Fake-transport exact dispatch/status/artifact checks, including global-config mutation: **pass**.
+- Focused race checks: **pass**.
+- Targeted `go vet`: **pass**.
+- `go.work.sum`: cleaned.
+
+## Notes and limitations
+
+- No MySQL or PostgreSQL pass is recorded.
+- No live GitHub/provider pass is recorded.
+- Historical note: this earlier phase record did not include the broad Go checks. The 2026-08-11 verification records `GOWORK=off go vet ./...` and `GOWORK=off go test ./...` passing after test-only cache diagnostics and opt-in Redis test changes; Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`, with no live Redis run recorded.
+- PR4 does not provide a distributed lease or outbox for the failure window where provider dispatch succeeds but the local database write fails.
+- The process-local poll guard does not coordinate multiple API processes.
+
+PR5 is the next phase and must address immutable version/build-ref under the exact acceptance and gates in [`phase-5.md`](phase-5.md).
diff --git a/plans/deskforge-corrective-refactor/phases/phase-5.md b/plans/deskforge-corrective-refactor/phases/phase-5.md
new file mode 100644
index 0000000..5624075
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-5.md
@@ -0,0 +1,49 @@
+# Phase 5 — PR5: immutable version/build-ref
+
+**Status:** ✅ `verified-with-notes` (no commit/push)
+**Boundary:** preserve the existing typed version-selection workflow; do not turn provider identity into a normal-user raw/manual editor.
+
+## Behavioral contract
+
+The user naturally chooses a known available build version and starts a build. The selected version is user-authored through the existing capability-selection UI; the effective provider build-ref and run identity are system/provider-derived. The implementation must preserve that distinction: typed validation and known capabilities provide the normal input, while internal provider fields are persisted and used by the workflow without exposing raw payload editing.
+
+## Objective
+
+Extend the PR4 immutable snapshot so the selected `version` and provider `build-ref` are captured at the one-shot dispatch boundary and remain authoritative for the lifetime of the build. A mutable global GitHub configuration may provide the current credential, but it must not redirect an existing build to a different version, repository, workflow, or ref.
+
+## Acceptance (exact)
+
+All criteria are required:
+
+1. **Atomic capture:** validated version and selected build-ref are persisted with the one-shot dispatch identity at the pending → building transition.
+2. **Write-once identity:** edit, retry, poll, resume, callback, or a second dispatch cannot overwrite version or build-ref after capture.
+3. **Typed normal path:** the workflow receives version/ref from the canonical typed build selection; raw `custom_txt`, raw provider payload, or manual internal identity is not accepted as the normal user-facing input.
+4. **Snapshot-bound execution:** status, artifact resolution/download, and restart resume use the stored version/ref and the PR4 stored repository/workflow/run/artifact identity, even after global config mutation; only the current token may come from global config.
+5. **Legacy safety:** a legacy or partial row missing immutable version/build-ref fails closed with an explicit terminal reason and never falls back to mutable global identity.
+6. **Concurrency:** only one complete immutable snapshot can win for a pending build; later or concurrent writes cannot replace it.
+7. **Migration safety:** existing rows remain readable through `AutoMigrate`; migration failure prevents recording the new database version.
+8. **Evidence:** focused SQLite, fake-transport, race, and targeted vet checks pass; no live provider is required for this acceptance.
+
+## Gates (exact)
+
+- Inspect the current branch/worktree before implementation and keep the change limited to PR5; do not include unrelated files or behavior.
+- Reuse the existing user-facing known-version selection pattern and typed validation. Do not add a raw/manual version or ref editor.
+- Add focused SQLite tests for new fields, legacy reads, one-shot guards, and migration/version-recording failure behavior.
+- Add fake-transport tests that assert the exact dispatch version/ref and assert that polling/resume remain on the stored snapshot after global configuration mutation.
+- Add tests for legacy/partial fail-closed behavior and concurrent/duplicate write rejection.
+- Run the narrow focused package tests, focused `-race`, and targeted `go vet`; record exact commands and outcomes.
+- Keep the explicit PR4 limitations: no MySQL/Postgres or live provider evidence. Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`; do not treat the broad Go checks as live Redis evidence.
+- Do not claim a distributed lease or outbox for a post-dispatch database failure; those remain out of scope.
+- Finish with `git diff --check`; do not commit or push.
+
+## Exit record
+
+PR5 is `verified-with-notes` because every acceptance item and gate above is evidenced below. PR4's `verified-with-notes` status was not treated as evidence for the version/build-ref slice.
+
+## Exit evidence
+
+- `CustomBuild` migration fields are covered by SQLite `AutoMigrate` tests; `DatabaseVersion` is **274**. The migration/version-recording failure test remains fail-closed.
+- `version_catalog_test.go` covers configured-repo pagination, source-tag SHA resolution, cache invalidation, missing/mismatched source tags, and concurrent refresh singleflight. No live GitHub transport or credentials are used.
+- `build_provenance_test.go` covers identity persistence, invalid identity/no-row behavior, write-once dispatch identity, immutable edit rejection, and stored-ref behavior after configuration mutation. Admin polling tests cover stored provenance and legacy fail-closed resume.
+- `GOWORK=off go test ./cmd ./model ./service ./http/controller/admin`, the matching `-race` command, targeted `go vet`, `gofmt`, `git diff --check`, and `npm run build` passed locally. The npm build emitted existing Rollup pure-comment/chunk-size warnings only.
+- MySQL/PostgreSQL, live GitHub, Redis integration/benchmark coverage, and workflow YAML behavior remain unverified/out of scope. The broad Go checks pass with `GOWORK=off`; Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`. The existing workflow `version` input is intentionally retained only as the PR6 boundary and is derived from the stored resolved identity.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-6.md b/plans/deskforge-corrective-refactor/phases/phase-6.md
new file mode 100644
index 0000000..95a360f
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-6.md
@@ -0,0 +1,31 @@
+# Phase 6 — PR6: workflow ownership/config
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** workflow YAML ownership and mutable GitHub configuration simplification.
+
+## Behavioral contract
+
+The operator chooses a known version/capability. The catalog and immutable build snapshot provide the effective repository, workflow, and ref. Workflow files consume that validated identity; normal users do not choose a raw branch/ref or edit workflow payload fields. Global configuration may provide credentials, but must not redirect an existing build.
+
+## Implemented boundary from PR5
+
+- The existing workflow `version` input remains temporarily as a PR6 boundary and is overwritten from the resolved immutable identity immediately before dispatch.
+- Fixed workflow mapping is application-owned while executable files remain in the configured rustdesk fork.
+- The API contract exposes only Repo, PAT, and PayloadKey; legacy workflow/ref columns are retained but unread.
+- The catalog resolves repository-specific release/source identity before persistence; dispatch overwrites version from that immutable identity and keeps the source `BuildRef` separate from workflow execution identity.
+- GitHub's `workflow_dispatch` REST body requires `ref` to be a branch or tag selector; a raw SHA is not a valid selector. The persisted `WorkflowRef` is sent in the body, while resolved `WorkflowSHA` is used to check the workflow file and to reject any run whose `head_sha` differs.
+
+## Required work and gates
+
+- Define one canonical owner for repository, workflow filenames, execution ref, and version propagation; remove duplicate/hardcoded fallback authority without breaking legacy reads. ✅
+- Remove DeskForge `github-build/rustqs-{windows-min-test,linux,android}.yml` duplicates; the configured rustdesk fork owns executable workflows. ✅
+- Remove `rdgen/.github/workflows/sync-workflows.yml`; no workflow-file or PAT synchronization path remains. ✅
+- Keep `rdgen/.github/workflows/bridge.yml` because vendored rdgen generator workflows reference it as their manual/reference workflow. ✅ deferred duplicate cleanup.
+- Preserve the upstream-compatible bridge contract: no guessed `inputs.version` requirement and no checkout of the wrong repository.
+- Historical/deferred note (superseded by `plans/deskforge-workflow-migration`): prior verification targeted `master` discovery, `rustqs/min-test` execution, and `rustqs/master-workflows` mirror ownership; live provider validation remains deferred.
+- Keep provider payloads encrypted and keep workflow logs free of secrets.
+- Do not re-enable Linux/Android UI choices merely because YAML exists; real CI runs and artifact paths are a later gate.
+
+## Dependencies and acceptance
+
+PR6 depends on PR5's stored version/build-ref and exact PR3 dispatch contract. Local acceptance is complete with focused Go/UI/static checks. Live GitHub dispatch, polling, artifact, and real Linux/Android workflow results remain unverified and are deferred to PR7/PR11.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-7.md b/plans/deskforge-corrective-refactor/phases/phase-7.md
new file mode 100644
index 0000000..5398133
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-7.md
@@ -0,0 +1,36 @@
+# Phase 7 — PR7: Streaming Artifact
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** GitHub HTTP-body streaming of the exact build artifact, truthful lifecycle/status handling, bounded transfer, publication proof, and cleanup. Linux/Android capability enablement is a later PR11 boundary. The user contract specifies GitHub HTTP body flow; a runner callback endpoint is explicitly not part of this phase.
+
+## Behavioral contract
+
+The operator starts a known Windows build and can observe whether the provider run is pending, building, downloading, extracting, complete, or failed. GitHub supplies the provider-derived artifact through its HTTP response body; the API streams it to bounded temporary storage, validates and publishes only the exact immutable build/artifact result, and exposes download only after publication proof. An interrupted, mismatched, expired, partial, or over-limit stream fails closed rather than producing a phantom successful build or an unbounded local queue.
+
+A reviewer request for a runner callback is out of scope: it would change the delivery contract, while the user contract explicitly requires the GitHub HTTP body flow.
+
+## Recorded verification
+
+- **Bounded GitHub-body stream:** the exact GitHub artifact response body is streamed to a server-owned temporary `.part` file with a `256 MiB` compressed-response limit, Content-Length/short-body checks, ZIP validation, and atomic `.part` → `.zip` rename. The ZIP is never buffered as a whole in memory.
+- **Exact identity:** run ID, artifact ID, artifact name, immutable provenance, and final download identity are checked together. The implementation does not choose a sole artifact, infer a path, or guess a run from a list.
+- **Archive limits:** decompressed provider ZIP content is bounded to `4096` entries, `512 MiB` per file, `1 GiB` aggregate, and `1000:1` compression ratio. The public/generated download archive is bounded to `4096` files, `512 MiB` per source file, `1 GiB` source aggregate, and `512 MiB` output.
+- **Cleanup and staging:** failed/partial/oversized/cancelled downloads remove temporary files; artifact and build-output staging cleanup has bounded retries and TTL sweeps, while active downloads/builds are protected. Final output is not swept as stale temporary data.
+- **Nested cleanup:** `SweepBuildOutputTemps` scans only bounded direct children of inactive numeric
+  per-build output directories for interrupted `.part`/download/archive files. Active build IDs,
+  fresh files, protected current download archives, symlinks, and published output remain untouched.
+- **Digest/publication proof:** the service computes a deterministic SHA-256 manifest over immutable build/run/artifact identity plus canonical output names, sizes, and contents. A write-once publication marker and digest are required, and `done` revalidates current output against that proof.
+- **Atomic/idempotent output:** filesystem publication uses temporary paths and rename boundaries; repeating publication with the same exact identity and digest is a no-op, while changed identity/content or incomplete proof fails closed.
+- **Lifecycle and guards:** statuses are `pending`, `building`, `downloading`, `extracting`, `done`, and `failed`. Exact run/artifact/status guards reject stale, duplicate, mismatched, expired, interrupted, partial, and zero-row persistence updates; a completion transition requires artifact identity and publication proof.
+- **Capability and UI:** production build capability is Windows-only and Linux/Android fail closed until PR11. The admin UI polls active lifecycle states, stops at terminal states, and uses mounted/request-generation guards so stale responses cannot overwrite current state; download is shown only for `done`.
+- **Focused checks:** focused Go tests, `go test -race`, `go vet`, and `npm run build` passed locally. Existing UI build warnings are not treated as new failures.
+
+## Explicitly unverified / out of scope
+
+- Broad Go vet/test checks pass with `GOWORK=off` after test-only cache diagnostics and opt-in Redis test changes. Redis integration tests and benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded. Live GitHub/provider dispatch or workflow execution and cross-database MySQL/PostgreSQL evidence remain unverified.
+- Crash recovery across process failure, distributed lease coordination, and durable outbox/scheduler semantics remain out of scope; the poll ownership guard is process-local and restart recovery is bounded by the existing resume path.
+- Browser/manual UI verification remains a gap; the recorded UI evidence is code-level lifecycle checks plus the focused UI build.
+- No runner callback contract, callback endpoint, or callback-specific evidence is required for PR7.
+
+## Dependencies / remaining evidence
+
+PR7 depends on PR3 exact REST errors, PR4 provenance, PR5 immutable version/build-ref, and PR6 workflow ownership/config. Its focused local evidence is recorded above with notes; PR8 and PR9 are verified-with-notes. PR10 and PR11 remain `in-progress`, while PR12 is `verified-with-notes` for documentation reconciliation. Linux/Android workflow capability remains intentionally retained as a PR11 gate.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-8.md b/plans/deskforge-corrective-refactor/phases/phase-8.md
new file mode 100644
index 0000000..efe07f1
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-8.md
@@ -0,0 +1,42 @@
+# Phase 8 — PR8: Secret Persistence
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** encrypted persistence, lifecycle, access boundaries, and redaction for provider credentials, payload keys, and other build secrets. No raw secret exposure or unrelated auth redesign is part of this phase. PR8 and PR9 are verified-with-notes; PR10 and PR11 remain `in-progress`, while PR12 is `verified-with-notes` for docs only.
+
+## Behavioral contract
+
+An administrator enters a secret through the existing typed configuration path (`Repo`, PAT, and `PayloadKey`). The service encrypts sensitive values before persistence, decrypts only at the provider boundary, and returns redacted state to normal UI/API consumers. A missing, invalid, or undecryptable secret fails closed without logging the secret, plaintext payload, or encrypted payload. The one-time generated payload-key display is intentional; it is not a persistent secret readback.
+
+The canonical API deployment environment key is `SECRET_ENCRYPTION_KEY` for AES-GCM secrets at rest. The GitHub Actions secret is `WORKFLOW_PAYLOAD_KEY` and must match the configured `PayloadKey`; `WORKFLOW_PAYLOAD_KEY` is not reused as the API at-rest key. `RUSTDESK_API_JWT_KEY` remains the JWT key and is not a substitute for either secret-persistence key.
+
+## Required contract
+
+- Secret-at-rest protection uses the canonical `SECRET_ENCRYPTION_KEY` source with an explicit format and migration behavior. New non-empty secret writes fail closed when the current key is missing; legacy plaintext reads remain supported and re-save encrypts them.
+- Read responses, errors, logs, artifacts, and workflow output never expose plaintext secrets, tokens, payload keys, or ciphertext unnecessarily. Normal UI/API responses expose typed state such as presence flags, not raw values.
+- Key rotation is unsupported and the current key is required; restart and legacy-row behavior are explicit, and existing immutable builds are not redirected.
+- `PayloadKey` remains the typed administrative value corresponding to GitHub Secret `WORKFLOW_PAYLOAD_KEY`; provider synchronization remains a typed administrative action, not a raw secret editor or callback path.
+- Persistence and provider calls use typed errors and bounded responses, with safe DTOs and explicit raw `json` tags; malformed ciphertext prefixes are rejected. Generated payload keys use `base64.RawURLEncoding`.
+- Docker passes `SECRET_ENCRYPTION_KEY` through to the API runtime without logging or transforming the value.
+- CustomBuild/CustomPreset save hooks enforce the canonical typed custom-field allowlist in addition
+  to service normalization. Unknown neutral fields such as `cookie`, `jwt`, or `signing_key` are
+  rejected before persistence; valid public fields retain their existing non-secret behavior,
+  canonical secret fields are encrypted, legacy rows remain readable internally, and safe DTOs stay
+  redacted.
+
+## Verification notes
+
+- Focused secret-persistence tests, race checks, `go vet`, and `npm run build` passed locally.
+- Evidence is SQLite-only; MySQL/PostgreSQL coverage is not established. Broad Go vet/test checks pass with `GOWORK=off` after test-only cache diagnostics and opt-in Redis test changes. Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`, and no live Redis run is recorded.
+
+## Gates
+
+- Inventory every secret field, persistence path, encryption/decryption caller, log/error path, provider payload path, and test fixture before changing storage.
+- Verify encryption, exact key loading, key-missing, malformed-ciphertext, legacy-row, and concurrent-update behavior with focused tests; key rotation remains an explicit unsupported limitation and the current key is required.
+- Confirm provider payloads are encrypted before dispatch and that redaction covers transport errors and bounded response bodies without leaking PATs, payload keys, plaintext payloads, or ciphertext.
+- Confirm safe UI/API views preserve typed configuration and never return secret values; verify restart, current-key requirements, and existing immutable-build behavior under key loss.
+- Document operational key-loss and migration limits without inventing recovery or backup guarantees.
+- This phase is verified-with-notes from focused evidence and the project-required Go race/vet/UI checks; the limitations above remain binding and do not imply cross-DB or full-suite coverage.
+
+## Dependencies / remaining evidence
+
+PR8 depends on PR3 typed REST errors, PR4 immutable provenance, PR6 configuration ownership, and the verified PR7 delivery boundary. Secret persistence implementation and verification are recorded as `verified-with-notes`; no new secret storage or migration was performed by this plan restoration. PR9 reproducibility is verified-with-notes; PR10 and PR11 remain `in-progress`, while PR12 documentation reconciliation is `verified-with-notes`.
diff --git a/plans/deskforge-corrective-refactor/phases/phase-9.md b/plans/deskforge-corrective-refactor/phases/phase-9.md
new file mode 100644
index 0000000..9cd24c5
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/phases/phase-9.md
@@ -0,0 +1,79 @@
+# Phase 9 — PR9: Go/Rust Reproducibility + SHA-Pinned Actions
+
+**Status:** ✅ `verified-with-notes`
+**Scope:** reproducible Go/Rust build inputs and provenance, plus immutable SHA pinning for active workflow actions. This phase records build-integrity evidence; it does not claim live workflow execution or release publication.
+
+## Behavioral contract
+
+An operator or release process builds from declared Go/Rust toolchains and dependency inputs and can compare the resulting source/build identity with the recorded provenance. CI actions resolve to reviewed immutable SHAs rather than mutable tags or branches. Normal users select a known capability; they do not edit toolchain, action, or provider internals.
+
+## Required contract
+
+- Go modules, Rust crates/toolchains, vendored inputs, build flags, and generated inputs have an auditable source of truth.
+- Repeated builds under the supported environment produce explainable, reproducible outputs or explicitly recorded nondeterminism.
+- Every active third-party workflow action is pinned to a full commit SHA and reviewed for repository ownership/version intent.
+- Build metadata connects source, toolchain, workflow, action pins, and artifact identity without leaking secrets.
+
+## Gates
+
+- Inventory Go/Rust versions, lockfiles, vendored dependencies, generators, environment inputs, and active workflow action references.
+- Run repeat-build and clean-environment comparisons where supported; record exact limitations instead of inferring reproducibility.
+- Verify SHA pins, transitive action usage, permissions, and update ownership across active workflows; do not modify frozen/vendored workflows without evidence of ownership.
+- Add focused checks for provenance completeness and mutable action-reference detection.
+- Preserve PR4/PR5 immutable identity and PR6 workflow ownership boundaries; no live provider or release claim is implied.
+- Treat protected/tagged workflow refs as a deployment gate: GitHub dispatch must retain a
+  branch/tag selector, exact workflow contents must be ready at the resolved `WorkflowSHA`, and
+  the run `head_sha` must match. A mutable branch is not claimed to be immutable. Production
+  publication requires an operator-approved protected branch or immutable workflow-ref policy
+  in the configured self-hosted fork.
+
+## Recorded evidence
+
+- Go 1.25.0, `GOTOOLCHAIN=local`, tracked module metadata, existing swag version, the
+  committed Rust lockfile, and a pinned Rust Docker toolchain are recorded in the active
+  build paths.
+- Active DeskForge workflow actions are pinned to full commit SHAs with reviewed ownership
+  and scoped permissions. The configured RustDesk fork remains the sole executable source
+  for client workflows; `github-build/` and vendored `rdgen` copies remain reference/frozen.
+- Focused Go, UI, API, Docker/Compose, Cargo metadata, DFP1 payload, workflow-contract,
+  Swagger regeneration/parity, and `git diff --check` checks passed locally. The API build and
+  UI build passed. On 2026-08-12, `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and
+  `GOWORK=off go test -race ./...` also passed after test-only cache diagnostics, opt-in Redis
+  test changes, and test-only lock-test race fixes; production lock code is unchanged.
+- Active fork bridge/windows/linux/android workflows now accept only the authenticated `DFP1`
+  payload, bind its `workflow_repo` to the executing fork, and fail closed before checkout/build
+  for direct/manual runs without a valid payload. The API still dispatches the required encrypted
+  payload and preserves the GitHub branch/tag selector contract.
+- `SweepBuildOutputTemps` removes bounded, stale interrupted `.part`/download/archive files and
+  service-owned `.artifact-recovery-*` files/directories inside inactive per-build output
+  directories while preserving active build directories, published output, and unrelated files.
+  DB-first custom-build deletion remains fail-safe; without a durable tombstone, complete orphan
+  directory removal is intentionally left for operator review rather than risking a published
+  artifact.
+- Custom build/preset model saves and service boundaries enforce one exact canonical typed field
+  allowlist. Compacted aliases, record/internal fields, unknown keys, nested values, nulls, and
+  stringified booleans are rejected on new writes; valid BuildSpec fields and legacy internal
+  reads remain supported, and safe DTOs stay redacted.
+- RustDesk `hbb_common` timestamp work remains dirty and unpublished submodule state; it
+  is not clean published reproducibility evidence. `SOURCE_DATE_EPOCH` remains deterministic,
+  while wall-clock metadata remains an explicit `RUSTDESK_NON_REPRODUCIBLE_DEBUG=1` opt-in.
+  Focused Cargo metadata and targeted checks passed locally. The 2026-08-12 broad Go
+  verification records `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and
+  `GOWORK=off go test -race ./...` passing after test-only cache diagnostics, opt-in Redis test
+  changes, and test-only lock-test race fixes; production lock code is unchanged. Redis
+  integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`, with no live Redis
+  run recorded.
+
+## Remaining evidence before a reproducibility claim
+
+- Establish repeat-build and clean-environment comparisons where supported, including artifact
+  identity and provenance checks; do not infer reproducibility from local checks alone.
+- Keep live provider/runner execution, cross-DB evidence, Windows/Linux/Android execution,
+  default OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, and release
+  publication outside the PR9 claim until separately verified.
+- The protected/immutable workflow-ref deployment gate and real fork/provider execution remain
+  unverified locally; no mutable branch is treated as an immutable release source.
+
+## Dependencies / remaining evidence
+
+Depends on PR4 provenance, PR5 immutable version/build-ref, PR6 workflow ownership/config, the actual streaming artifact contract from PR7, and the recorded PR8 secret-persistence boundary. Live provider/runner execution, clean-environment and repeat-build comparisons, cross-DB evidence, default OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, Windows/Linux/Android execution, and release proof remain unverified; PR10 and PR11 remain `in-progress`, while PR12 is `verified-with-notes` for documentation only.
diff --git a/plans/deskforge-corrective-refactor/plan.md b/plans/deskforge-corrective-refactor/plan.md
new file mode 100644
index 0000000..be1e9ae
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/plan.md
@@ -0,0 +1,486 @@
+# DeskForge Corrective Refactor
+
+**Date:** 2026-08-10
+**Scope:** cumulative PR1–PR12 DeskForge candidate publication package plus a separately
+scoped RustDesk candidate. The DeskForge candidate includes API, UI, Docker, server,
+offline-kit, Swagger, documentation, and tests. The separate RustDesk candidate includes
+active workflows, Android, portable, helper, and tests. `rdgen` deletion and dirty
+RustDesk submodule content are excluded from both candidates.
+**Publication boundary:** follow-up commit `68e7f30` (`workflow: harden ruleset failure
+handling`) was pushed to `refactor/deskforge-corrective-pr`, and PR #59 remains open.
+GitHub run `31785951197` passed Go, Rust, Admin UI, and CodeQL/analyzer checks; CodeRabbit
+was skipped because the PR has 191 files. This publication status does not make the PR
+ready, close PR10/PR11, or close their preserved evidence gates.
+**Current next action:** keep
+PR10 and PR11 `in-progress`, not verified, and PR12 `verified-with-notes`. This plan
+does not make live-provider, full-offline-build, signature/attestation, cross-DB,
+protected-ref, release-readiness, or sovereignty claims.
+**Candidate provenance:** the DeskForge and RustDesk candidates are intentionally
+separate publication units; this plan records their boundaries without treating staged
+files, local implementation checks, or dirty submodule state as publication evidence.
+
+## Phase index
+
+| Phase | User PR scope | Status | Evidence / next dependency |
+|---|---|---|---|
+| PR1 | BuildSpec/settings | ✅ `verified-with-notes` | [`phase-1.md`](phases/phase-1.md); PR2 endpoint contract |
+| PR2 | network/public endpoints | ✅ `verified-with-notes` | [`phase-2.md`](phases/phase-2.md); manual/docs/dev-compose gaps remain |
+| PR3 | exact run_id/REST errors | ✅ `verified-with-notes` | [`phase-3.md`](phases/phase-3.md); live provider/poll integration remains |
+| PR4 | provenance | ✅ `verified-with-notes` | [`phase-4.md`](phases/phase-4.md); no distributed lease/outbox, no cross-DB/live evidence |
+| PR5 | immutable version/build-ref | ✅ `verified-with-notes` | [`phase-5.md`](phases/phase-5.md); workflow YAML/config is PR6 boundary |
+| PR6 | workflow ownership/config | ✅ `verified-with-notes` | [`phase-6.md`](phases/phase-6.md); live provider/YAML execution remains deferred |
+| PR7 | streaming artifact | ✅ `verified-with-notes` | [`phase-7.md`](phases/phase-7.md); focused evidence recorded, bounded gaps remain |
+| PR8 | secret persistence/security hardening | ✅ `verified-with-notes` | [`phase-8.md`](phases/phase-8.md); current-key and storage limitations remain explicit |
+| PR9 | Go/Rust reproducibility + SHA-pinned actions | ✅ `verified-with-notes` | [`phase-9.md`](phases/phase-9.md); live provider/clean-build proof remains absent |
+| PR10 | offline-kit/release evidence | 🟡 `in-progress` | [`phase-10.md`](phases/phase-10.md); Packages A–C implementation/focused checks pass, offline-kit and release gates remain blocked |
+| PR11 | Linux/Android capability | 🟡 `in-progress` | [`phase-11.md`](phases/phase-11.md); local implementation evidence recorded, live capability evidence blocked |
+| PR12 | docs/tracker | ✅ `verified-with-notes` | [`phase-12.md`](phases/phase-12.md); reconciliation included in the cumulative candidate, with PR10/PR11 evidence gates retained |
+
+## Preserved completed facts
+
+### PR4 — `verified-with-notes`
+
+- `DatabaseVersion 273`; `AutoMigrate` adds provenance columns while retaining legacy readability.
+- Immutable snapshot: provider, repository, workflow, ref, run ID, run URL, HTML URL, expected artifact name, artifact ID, and provider source SHA when available.
+- Dispatch requires GitHub's exact run-details response; no recent-run/list inference.
+- One-shot pending → building guard; artifact ID and source SHA are guarded first-write operations tied to the stored run.
+- Poll/resume reconstructs identity from the snapshot after global GitHub configuration changes; only the current credential is mutable.
+- Legacy/incomplete provenance fails closed; the poll ownership guard is process-local, not a distributed lease.
+- Focused SQLite, fake-transport, race, and targeted vet checks passed; `go.work.sum` was cleaned.
+- No MySQL/PostgreSQL/live provider/Redis integration or benchmark evidence; no distributed lease or outbox for post-dispatch DB failure.
+
+### PR5 — `verified-with-notes`
+
+- `DatabaseVersion 274` fields for immutable version/build identity are covered by SQLite migration/backward-compatibility checks.
+- Catalog is keyed by `GithubBuildConfig.Repo`, follows bounded release pagination, filters `offline-assets-<semver>`, and verifies the matching `refs/tags/<version>` object SHA in that repository.
+- `CustomBuild` stores display `Version` plus write-once `BuildRef`, `SourceTag`, `AssetsRelease`, and `AssetsReleaseID`; legacy/partial rows fail closed.
+- Dispatch overwrites the temporary workflow `version` input from the resolved immutable identity; no user-supplied ref or second workflow-ref selector is accepted on the normal path.
+- GitHub's `workflow_dispatch` REST contract requires the request-body `ref` to be a branch or tag selector, not a raw commit SHA. `WorkflowRef` is persisted and dispatched as that selector; `WorkflowSHA` is retained separately for exact workflow-file readiness and run `head_sha` verification.
+- Focused SQLite/fake-transport/race and targeted vet checks, `gofmt`, `git diff --check`, and `npm run build` passed locally; UI build warnings were existing Rollup warnings.
+- MySQL/PostgreSQL, live GitHub, Redis integration/benchmark coverage, and workflow YAML behavior remain unverified/out of scope.
+
+### PR6 — `verified-with-notes`
+
+- User-editable GitHub configuration is limited to repository, PAT, and payload key; legacy workflow/ref columns remain unread for migration safety.
+- Fixed platform workflow mapping and immutable catalog identity own new dispatches; existing builds poll stored provenance with only the current token.
+- Provider readiness is checked before custom-build persistence; production API has no implicit file-queue fallback or PAT-sync endpoint.
+- DeskForge duplicate platform workflows and the draft sync workflow were deleted. The rdgen bridge copy remains because vendored rdgen generator workflows reference it; the rustdesk fork bridge remains the executable source of truth.
+- Focused Go tests, race, targeted vet, UI build, formatting, diff-check, and deletion/source-marker checks passed; live GitHub credentials/runs and real workflow execution remain deferred to PR7/PR11.
+
+### PR7 — `verified-with-notes`
+
+- GitHub's artifact HTTP response body is streamed with a bounded reader into a server-owned temporary `.part` file, validated, and atomically renamed; the user contract specifies this GitHub HTTP body flow, so a runner callback endpoint is explicitly not implemented and any reviewer callback request is out of scope.
+- The stream and final download remain bound to the exact immutable run, artifact ID, artifact name, and stored provenance; no sole-artifact, path, or inferred-run fallback is accepted.
+- Limits are separate and fail closed: compressed provider body `256 MiB`; decompressed ZIP entries `4096`, per-file `512 MiB`, aggregate `1 GiB`, and compression ratio `1000:1`; public output archive `4096` files, `512 MiB` per source file, `1 GiB` source aggregate, and `512 MiB` generated archive.
+- Temporary archives, `.part` files, staging directories, and failed publication outputs have bounded cleanup/retry and stale-file sweeps; active downloads/builds are protected from sweeps.
+- Publication computes a service-owned SHA-256 digest bound to immutable build/run/artifact identity and canonical output contents. Publication proof is write-once, atomic at the file boundary, and idempotent on retry; `done` requires the marker, digest, and current proof.
+- Lifecycle statuses and guards cover `pending`, `building`, `downloading`, `extracting`, `done`, and `failed`; mismatched, duplicate, expired, interrupted, partial, stale, or persistence-failed paths remain non-success and recoverable where specified.
+- Production capability is intentionally Windows-only and fails closed for Linux/Android until PR11. The UI polls only active lifecycle states, stops polling at terminal states, and uses mounted/request-generation guards; the completed action is exposed only after lifecycle checks.
+- Focused Go tests, `-race`, targeted vet, and `npm run build` passed locally. On 2026-08-12, the full `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` checks also passed after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; the production lock implementation is unchanged. The API build, UI build, deterministic Swagger regeneration/parity checks, Compose checks, and `git diff --check` passed. Redis integration tests and benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is configured, and no live Redis run is recorded. Live provider/runner execution, MySQL/PostgreSQL, crash recovery and distributed lease/outbox behavior, and browser/manual gaps remain unverified.
+
+### PR8 — `verified-with-notes`
+
+- `SECRET_ENCRYPTION_KEY` is the canonical API at-rest key. New non-empty secret writes fail closed when the current key is unavailable; no plaintext fallback is accepted.
+- Legacy plaintext rows remain readable for migration safety, and saving them again encrypts them with the current key. Malformed ciphertext prefixes are rejected rather than treated as legacy plaintext.
+- Safe DTOs and explicit raw `json` tags keep secret fields out of normal responses and raw JSON paths. Generated payload keys use `base64.RawURLEncoding`; the one-time generated-key display is intentional and is not a persistent secret readback.
+- Docker passes `SECRET_ENCRYPTION_KEY` through to the API runtime without logging or transforming the value. Focused secret-persistence tests, race checks, targeted vet, and `npm run build` passed locally.
+- Limitations remain explicit: key rotation is unsupported and the current key is required; evidence is SQLite-only with no MySQL/PostgreSQL coverage; Redis integration and benchmark coverage are opt-in through `DESKFORGE_TEST_REDIS_ADDR`, and no live Redis run is recorded.
+
+### PR9 — `verified-with-notes`
+
+- Go 1.25.0 and `GOTOOLCHAIN=local` are pinned across the recorded build paths; module
+  download/build inputs use the tracked Go module metadata and existing swag version.
+- Rust dependency resolution uses the committed lockfile and a pinned Rust Docker toolchain;
+  active DeskForge workflow actions are pinned to full commit SHAs with scoped permissions.
+  Fork-owned client workflows remain the executable source; frozen/reference workflow copies
+  are excluded from the active ownership boundary.
+- Full Go, API, UI, Swagger, Compose, and diff verification passes locally. On 2026-08-12, `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` passed after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. The API build and UI build passed; Swagger was regenerated deterministically with module-pinned `swag v1.16.3`, and JSON/YAML/`docs.go` plus route/auth/schema/redaction parity checks passed. Compose checks and `git diff --check` passed.
+- Full Go vet/tests and the full race suite pass with `GOWORK=off` after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. Specifically, `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` pass. The API build, UI build, deterministic Swagger regeneration/parity, Compose, and `git diff --check` checks pass. Redis integration tests and benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded. Default
+  OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, live provider/runner
+  execution, clean-worktree/repeat-build evidence, cross-DB evidence, Windows/Linux/Android
+  execution, and release publication remain unverified.
+
+## Current workflow approval and dispatch evidence — 2026-08-11
+
+- The local approval boundary accepts only a provider-derived annotated tag whose verification
+  reports `verified=true` with the accepted reason, whose nested object is a commit, and whose
+  label does not collide with a branch. Active provider protection evidence requires the matching
+  tag policy, explicit update and deletion protections, and an explicitly empty bypass-actor list;
+  conflicting or ambiguous protection fails closed. This is focused fake-transport/provider-
+  contract evidence, not live GitHub evidence.
+- Approval persists the selected tag, provider-resolved commit SHA, provider-verification state,
+  and approval state. Additive migration/model checks cover the approval and provider-policy
+  fields through `DatabaseVersion 282`; legacy compatibility remains readable where required.
+- Build preparation revalidates the approved selector and resolved SHA before persistence. The
+  dispatch primitive revalidates mapped workflow contents and the tag policy immediately before
+  DFP1 encryption, rejects a changed execution SHA, and only then creates the secret-bearing
+  payload. Typed approval, validation, capability, provider, transport, contract, and artifact
+  errors map to bounded safe HTTP/user messages and diagnostics without exposing selectors,
+  provider bodies/URLs, credentials, or encrypted payloads.
+- The provider boundary remains unresolved: GitHub `workflow_dispatch` requires a branch/tag
+  selector and does not provide atomic SHA binding. A theoretical selector move between final
+  validation and the dispatch `POST` can therefore expose DFP1 to a different workflow revision.
+  Secret-bearing production dispatch and live readiness remain gated until provider-side
+  immutable/no-bypass deployment proof or atomic API support is actually evidenced. Local
+  revalidation does not close that provider-side window.
+
+## Latest workflow review/fix state — 2026-08-15
+
+- Modern repository rulesets are the sole protection surface; initial and later list-page,
+  detail, policy, and contract failures fail closed. The former tag-protection LIST
+  compatibility path is **CONFIRMED OBSOLETE**: DeskForge is hard-wired to
+  `https://api.github.com`, has no configurable GHES base URL/provider, and current
+  GitHub documentation marks that legacy surface as closing down/removed. A GHES
+  `enabled`/`pattern` schema is separate historical context, not a DeskForge capability.
+- GitHub's [organization ruleset creation endpoint](https://docs.github.com/en/rest/orgs/rules#create-an-organization-repository-ruleset),
+  `/orgs/{org}/rulesets`, uses repository selectors when authoring a definition. DeskForge instead
+  consumes the repository-scoped list `/repos/{owner}/{repo}/rulesets?targets=tag&includes_parents=true`
+  and detail `/repos/{owner}/{repo}/rulesets/{id}?includes_parents=true`, as described by the
+  [repository ruleset detail docs](https://docs.github.com/en/rest/repos/rules#get-a-repository-ruleset).
+  The repository-scoped `includes_parents=true` response resolves applicability; tag matching
+  requires only `conditions.ref_name`, and DeskForge does not independently evaluate repository
+  selectors. Unknown or malformed condition fields fail closed.
+- Exact authenticated observation on 2026-08-14: `GET
+  https://api.github.com/repos/github/docs/rulesets?targets=tag&includes_parents=true&per_page=100`
+  returned summary `id=18281681`, `target=tag`, `source_type=Organization`, `source=github`,
+  `enforcement=active`, without conditions/rules/bypass metadata. `GET
+  https://api.github.com/repos/github/docs/rulesets/18281681?includes_parents=true` returned
+  `conditions.ref_name` only, rules exactly `deletion`, `non_fast_forward`, `creation`, and
+  `update` with no parameters, and `current_user_can_bypass=never`. Its exact ref patterns are
+  recorded in `api/README.md`. The observed detail omitted `bypass_actors` because the token
+  lacked write access; the positive DeskForge contract therefore requires `bypass_actors: []`
+  and fails closed when it is omitted.
+- Root cause/fix: repository-detail validation incorrectly required exactly one Organization/
+  Enterprise repository selector. The selector evaluator/parsers were removed; the provider
+  scoped repository response now supplies applicability. Rule decoding is target-aware: tag
+  `update` may omit parameters, while present parameters must be a strict object containing
+  boolean `update_allows_fetch_and_merge`; branch `update` still requires that parameter.
+- Follow-up commit `68e7f30` remains pushed to `refactor/deskforge-corrective-pr`, but this
+  documentation update does not mark PR #59 ready or claim live approval, dispatch, runner,
+  release, or completion evidence. The workflow-dispatch selector TOCTOU, PR10/PR11, cross-DB,
+  and offline limitations remain preserved.
+
+## PR10 blueprint — `in-progress`
+
+This section records the PR10 implementation/evidence package within the cumulative
+DeskForge candidate. Packages A–C implementation and focused checks are present, while
+real-kit, release, provider, and other explicitly listed evidence gates remain open.
+Final publication must stay within the candidate boundary and leave secrets and
+unproven capability claims out of the normal operator path.
+
+### Package A — offline-kit freeze and verify-only hardening
+
+**Evidence files:** `offline-kit/freeze.sh`, `offline-kit/versions.env`,
+`offline-kit/README.md`, `offline-kit/FORK-PROCEDURE.md`,
+`offline-kit/artifacts/MANIFEST.txt`, `offline-kit/artifacts/sha256sums`,
+`offline-kit/artifacts/printer_sha256sums`,
+`offline-kit/artifacts/rustdesk-1.4.8.bundle`,
+`offline-kit/artifacts/vendor-1.4.8.tar.gz`, and the frozen source tree's
+`.gitmodules`, `Cargo.lock`, `.cargo/config.vendor.toml`, and license files.
+`win-builder/README.md`, `setup.ps1`, and `agent.ps1` remain fallback evidence,
+not an active release path.
+
+**Blueprint:**
+
+- Separate the online `freeze` operation from an idempotent, no-network
+  `verify-only` operation. Verify-only must not download, mutate a checkout,
+  refresh a branch, or silently regenerate the observed manifest.
+- Require commit/source equality: `RUSTDESK_COMMIT`, the checked-out source
+  `HEAD`, the declared ref/tag, the bundle's contained revision, recursive
+  submodule commits, and the source tree used for vendor/config evidence must
+  agree. A dirty or shallow source checkout fails closed.
+- Verify every expected SHA-256 from a trusted, reviewable expected manifest;
+  `MANIFEST.txt` is observed evidence until its expected values have an
+  independent source. A present file, URL, or first-seen hash is not proof.
+- Treat `versions.env` URLs, especially mutable release channels such as
+  `engine/.../releases/download/main`, as retrieval locations only. Mutable
+  URLs require an independently pinned expected hash and provenance; TOFU is
+  not an acceptable release or sovereignty boundary.
+- Record vendor completeness, source and dependency licenses, submodule
+  provenance, manifest generation time, sizes, and hash results. Missing
+  licenses, unexplained vendored content, or a manifest that cannot be
+  reproduced is a stop condition.
+
+**Focused implementation checks:** Strict offline fixtures and freeze/verify-only
+stage checks pass locally, including fail-closed handling for secret-bearing
+artifact presence and staged manifest/input conditions.
+
+**Real-kit verification boundary:** A real offline-kit verify/freeze run fails
+closed on secret-bearing artifact presence, the legacy manifest, missing engine,
+empty printer digest, and incomplete license evidence. `git bundle verify`, source
+`rev-parse`/clean-tree/recursive submodule checks, independently trusted
+expected-manifest checks, and repeat no-mutation verification remain required
+evidence and are not closed by fixture/stage tests.
+
+**Stop points and risks:** stop on any network attempt, missing expected hash,
+mutable URL without independent pin, source/ref/submodule mismatch, shallow or
+dirty bundle source, missing vendor/license evidence, partial download, or
+manifest rewrite. Risks include the ignored multi-gigabyte artifact store,
+resumable-download state being mistaken for verified state, hash-only
+integrity being mistaken for authenticity, and Windows vcpkg/binary-cache
+requirements remaining outside Linux verification.
+
+### Package B — operator handoff and export verification
+
+**Evidence files:** the immutable build identity in `api/model/custom_build.go`
+and `api/service/custom_build.go`, provenance/identity checks in the existing
+`api/service/build_provenance_test.go`, artifact flow in
+`api/http/controller/admin/custom_build.go` and
+`api/http/controller/admin/github_build_poll_test.go`, plus the configured fork's
+protected workflow files (not a local workflow copy). Handoff output is an
+operator-facing export/manifest, not a secret-bearing API response or release
+publication.
+
+**Blueprint:** the handoff must carry exact source repository, selector/ref,
+source commit/tree SHA and submodule commits; workflow repository/path,
+protected selector, workflow SHA/file identity and action pins; provider/run
+ID, run URLs and run `head_sha`; artifact ID/name; release tag/ID and exact
+asset names/digests; and the final output file list, sizes, per-file hashes,
+service-owned output digest, export path, and verification timestamp/result.
+It must be generated from stored immutable provenance and verified again at
+export time. PATs, payload keys, generated secrets, URLs containing credentials,
+and raw internal secret fields must never be included. Export verification must
+re-read the exact source/workflow/run/artifact/release/assets/output identity,
+compare the checksum manifest and output digest, and fail closed on missing,
+changed, inferred, or provider-only values. It must not upload, publish, or
+claim a release.
+
+**Checks:** Package B implementation and focused tests pass locally: v2
+producer/API manifests, including the private `custom_.txt` declaration;
+deterministic redacted handoff and archive hashes; exact identity, checksum,
+digest, sidecar, and public `custom_.txt` redaction assertions; and offline
+read-back verification without provider access. No live provider evidence is
+inferred.
+
+**Stop points and risks:** stop on incomplete legacy provenance, changed
+workflow contents, missing run/artifact/release identity, digest mismatch,
+secret leakage, non-deterministic export, or any attempted publication. Risks
+include stale provider URLs, metadata drift after an asset is replaced, an
+operator treating an unsigned checksum as a signature, and exports becoming a
+new secret exfiltration path.
+
+### Package C — active artifact retention and exact export boundary
+
+**Evidence files:** `api/service/published_output.go`,
+`api/service/build_output_cleanup.go`, their existing focused tests,
+`api/model/custom_build.go`, and the existing download/poll controller paths.
+The canonical output root and numeric build directories remain service-owned;
+`offline-kit/artifacts/` is not an API output directory.
+
+**Blueprint:** define retention separately for active downloads (`.part`/`.zip`),
+extraction/staging/recovery paths, failed outputs, and completed canonical
+outputs. Cleanup may remove only an exact, stale, service-owned temporary shape;
+active builds are protected; completed output is retained until its explicit
+retention/export policy is satisfied. Exact-file/manifest verification must
+require regular non-symlink files, bounded count/size/aggregate, canonical
+relative names, deterministic name ordering, and the required Windows
+executable. The service-owned digest must bind immutable build/run/artifact and
+release/assets identity to exact file names, sizes, and contents. An export
+sidecar/metadata record must carry the digest and manifest identity and be
+verified against the output before handoff; it is evidence, not a signature or
+release asset.
+
+Preserve the current Windows-only production capability and fail closed for
+Linux/Android until PR11 provides real end-to-end evidence. Do not turn the
+frozen `win-builder/` fallback into an active claim, and do not describe any
+local output or handoff as a live release.
+
+**Checks:** Package C implementation and focused tests pass locally:
+TOCTOU-safe snapshot/archive cleanup, exact-manifest and digest/publication-proof
+checks, retry/partial-output handling, active-versus-terminal retention,
+retention-days and `if-no-files-found: error` workflow contracts, mutation/missing-
+file and symlink/path/name/size-limit rejection, export-sidecar verification, and
+Windows-only capability checks. Cross-DB and live-provider checks remain gates
+below.
+
+**Stop points and risks:** stop on ambiguous ownership, unsafe cleanup scope,
+manifest/digest mismatch, sidecar mismatch, output mutation after proof, missing
+Windows executable, or an attempt to expose Linux/Android or release status.
+Risks include premature deletion, stale recovery trees, digest replay across
+builds, metadata detached from exported bytes, and confusing local artifact
+retention with release retention.
+
+### Explicit PR10 gates and non-claims
+
+The following remain explicit gates and must be recorded as blocked/unverified
+rather than worked around:
+
+- protected/immutable workflow-ref deployment and exact workflow contents at the
+  resolved SHA;
+- RustDesk `hbb_common` submodule publication/clean provenance;
+- live provider, runner, and workflow execution;
+- cryptographic signatures/attestations (SHA-256 evidence is not a signature);
+- MySQL and PostgreSQL cross-DB migration/read-write evidence; and
+- a complete network-denied full build, including Windows toolchain/vcpkg
+  capability and repeat-build evidence.
+
+PR10 may verify local files and prepare a redacted operator handoff, but it may
+not create or publish a tag/release, upload assets, use secrets, claim a live
+provider result, or mark sovereignty/release readiness from repository presence
+alone.
+
+## PR10 implementation and verification boundary — 2026-08-10
+
+- Packages A–C implementation and focused checks pass locally: strict offline
+  fixtures/stage checks; v2 producer/API manifests including private `custom_.txt`
+  declaration; deterministic handoff/archive hashes; TOCTOU-safe snapshot cleanup;
+  retention-days/`if-no-files-found: error`; and public `custom_.txt` redaction.
+- PR10 remains `in-progress`, not `verified-with-notes`. A real offline-kit
+  verify/freeze run fails closed on secret-bearing artifact presence, the legacy
+  manifest, missing engine, empty printer digest, and incomplete license evidence.
+- Completed-output retention/deletion remains an explicit manual operator policy;
+  no completed-output TTL or release-retention policy is claimed. Active fork
+  workflows are the executable evidence boundary; frozen offline-kit and
+  `win-builder/` material is manual/historical-only evidence, not a production fallback.
+- Live provider/runner execution, signatures/attestations, MySQL/PostgreSQL
+  cross-DB evidence, protected immutable workflow-ref deployment, clean published
+  RustDesk `hbb_common` submodule provenance, and a complete network-denied full
+  build remain unverified gates.
+
+## PR11 implementation and verification boundary — 2026-08-10
+
+PR11 is `in-progress`, not verified. The following local static implementation evidence
+is recorded without converting fixtures, source inspection, workflow manifests, or
+focused tests into live Linux/Android/Windows/provider or release claims:
+
+- Bridge staging and hash-restore behavior is implemented and locally evidenced.
+- The DFP1-only workflow/helper boundary is preserved; the helper remains untracked at
+  the remote HEAD.
+- Manifest v2 behavior is implemented and locally evidenced.
+- Android app-id validation and the `applicationId` contract are recorded and covered
+  locally.
+- Android `custom_.txt` runtime-path handling and the fail-closed packaging check are
+  implemented and locally evidenced.
+- Linux deb/RPM `custom_.txt` ordering is implemented and locally evidenced.
+- Portable deterministic traversal/timestamp tests are present and pass locally.
+- Capability gating and the UI disabled state preserve fail-closed exposure for
+  unsupported or unproven platforms.
+
+Bridge/helper source, Android app-id/`applicationId`, custom_.txt runtime-path checks,
+local package assertions, and workflow manifests are static evidence only. No APK/package
+creation, installation/runtime delivery, Android signing/debug, or normal provider
+operation is evidenced; deleted local workflow copies and frozen `rdgen` workflows are
+not proof.
+
+Explicit blockers and non-claims:
+
+- Follow-up commit `68e7f30` (`workflow: harden ruleset failure handling`) was pushed to
+  `refactor/deskforge-corrective-pr`, and PR #59 remains open; the helper is untracked at
+  the remote HEAD.
+- No live Linux, Android, Windows, or provider runs have been performed.
+- No APK/package/install/runtime evidence exists.
+- No protected workflow-ref proof exists.
+- No clean or repeat-build evidence exists.
+- Required toolchains and native validators are unavailable.
+- RustDesk `hbb_common` remains dirty and unpublished.
+- Android signing/debug evidence is unavailable.
+- Cross-DB evidence and cryptographic signature evidence are unavailable.
+
+## Current local verification boundary
+
+- PR1–PR9 and the security-hardening work are recorded as `verified-with-notes`; PR10 and
+  PR11 remain `in-progress`, while PR12 is `verified-with-notes` for its documentation/
+  tracker reconciliation. This does not convert deferred evidence into a release,
+  sovereignty, or platform-support claim.
+- Full Go, API, UI, Swagger, Compose, and diff verification passes locally. On 2026-08-12,
+  `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and
+  `GOWORK=off go test -race ./...` passed after test-only cache diagnostics, opt-in Redis
+  test changes, and test-only lock-test race fixes; production lock code is unchanged. The
+  API build and UI build passed; Swagger was regenerated deterministically with module-pinned
+  `swag v1.16.3`, and JSON/YAML/`docs.go` plus route/auth/schema/redaction parity checks
+  passed. Compose checks and `git diff --check` passed. Swagger metadata remains sparse for
+  legacy operations as a low-usability issue.
+- Full Go vet/tests and the full race suite pass with `GOWORK=off` after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. Specifically, `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` pass. The API build, UI build, deterministic Swagger regeneration/parity, Compose, and `git diff --check` checks pass. Redis integration tests and benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded.
+- Default OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, live provider/runner execution, clean and repeat builds, cross-DB coverage, and Windows/Linux/Android execution remain unverified.
+- Workflow dispatch retains the required branch/tag selector; exact workflow contents are checked at the resolved `WorkflowSHA`, and run `head_sha` must match. GitHub provides no atomic SHA binding, so a theoretical selector move between final validation and `POST` can expose DFP1; protected immutable/no-bypass deployment proof or atomic provider API support remains a gate for secret-bearing production dispatch/live readiness.
+- RustDesk `hbb_common` timestamp work remains dirty and unpublished submodule state; no clean published reproducibility evidence is inferred from it.
+- PR11 local evidence covers bridge staging/hash restore, DFP1-only workflow/helper preservation, manifest v2, Android app-id/applicationId and `custom_.txt` fail-closed packaging contracts, Linux deb/RPM ordering, deterministic portable traversal/timestamp tests, and the capability gate/UI disabled state.
+- PR11 remains blocked by unpublished changes/helper state, absent live Linux/Android/Windows/provider runs, absent APK/package/install/runtime proof, absent protected-ref proof, absent clean/repeat builds, unavailable toolchains/native validators, Android signing/debug, dirty unpublished `hbb_common`, and absent cross-DB/signature evidence.
+
+## PR12 docs/tracker reconciliation — `verified-with-notes`
+
+PR12 records and applies the completed documentation reconciliation boundary. The listed
+DeskForge documents, source Swagger annotations, regenerated API documentation, and
+RustDesk README workflow links were reconciled in this documentation-metadata change
+from the current PR10/PR11 evidence. File presence, local focused checks, or
+implementation notes are not release, sovereignty, or platform-support evidence.
+
+### Audited-document checklist
+
+- [x] PR12 includes source Swagger annotations and regenerated `api/docs/api` plus
+      `api/docs/admin` using module-pinned `swag v1.16.3`; JSON, YAML, and `docs.go`
+      outputs are deterministic, and route/auth/schema/redaction parity checks pass.
+      Swagger metadata remains sparse for legacy operations, recorded as a low-usability
+      issue rather than a correctness or release-readiness blocker.
+- [x] `PLAN.md` — provider-only path, published client 1.4.8 / DeskForge schema 272,
+      local corrective API schema 282 target, ports, Windows-only admitted capability,
+      active/frozen boundaries, DFP1 payload, and no live-provider/clean-build proof
+      are recorded.
+- [x] `README.md` — published/local version labels, key path, ports, combined-work
+      license, fork ownership, and Linux/Android gating are aligned without readiness claims.
+- [x] `CHANGELOG.md` — the current-state note uses the PR10/PR11/PR12 statuses and
+      preserves the provider-only/no-live-run boundary.
+- [x] `BUGS.md` — the tracker preserves the Linux/Android capability gate and
+      pending live evidence; historical closure text must remain labeled and must
+      not be treated as a current run or support result.
+- [x] `CONTRIBUTING.md` and `AGENTS.md` — active workflow ownership, frozen/reference
+      boundaries, development Compose command, and no-publication constraints agree.
+- [x] `github-build/README.md` — the configured fork is the sole executable source;
+      DFP1, retention/handoff boundaries, and Linux/Android gating are explicit.
+- [x] `offline-kit/README.md` and `offline-kit/FORK-PROCEDURE.md` — frozen/local,
+      fail-closed verify-only behavior and missing-engine/manifest/license/signature/
+      network-denied gaps are explicit; no version fallback is claimed.
+- [x] `api/README.md` — handoff metadata is redacted and the service digest is
+      metadata/integrity evidence, not a signature or release publication.
+- [x] `plans/deskforge-corrective-refactor/phases/phase-10.md` and `phase-11.md` —
+      authoritative implementation notes confirm focused local evidence and the
+      remaining PR10/PR11 blockers.
+
+### Exact remaining gates
+
+- [ ] PR10 real offline-kit verification: trusted expected manifest/hashes,
+      clean non-shallow source and bundle, recursive submodule provenance,
+      complete vendor/license evidence, and repeat no-mutation verification;
+      the current real-kit check fails closed on secret-bearing artifacts, the
+      legacy manifest, missing engine, empty printer digest, and incomplete
+      license evidence.
+- [ ] Protected immutable workflow-ref deployment and exact workflow contents at
+      the resolved `WorkflowSHA`, distinct from GitHub's dispatch branch/tag
+      selector.
+- [ ] Clean, published RustDesk `hbb_common` submodule provenance.
+- [ ] Live provider/runner/workflow runs for the claimed platforms, with exact
+      run/artifact identity, matching `head_sha`, and provider-backed streamed
+      download completion; no live provider run is recorded.
+- [ ] Linux/Android APK/package, installation/runtime, and Android signing/debug
+      evidence; until then Linux/Android remain capability-gated, not supported.
+- [ ] Required toolchains/native validators plus clean and repeat-build evidence.
+- [ ] MySQL and PostgreSQL migration/read-write evidence; SQLite-only checks do
+      not close the cross-DB gate.
+- [ ] Cryptographic signatures, attestations, and trusted verification roots;
+      SHA-256 manifests/digests are integrity evidence only.
+- [ ] A complete network-denied full build, including Windows toolchain/vcpkg
+      capability and repeat-build evidence; verify-only and metadata checks do
+      not satisfy this gate.
+- [ ] Explicit completed-output retention/deletion policy; no automatic TTL,
+      release-retention, release, tag, or asset-publication claim is made.
+
+PR12 cannot mark release readiness, sovereignty, Linux/Android support, live
+provider execution, signatures, cross-DB coverage, or a complete offline build.
+The Swagger source/output verification also does not close the preserved PR10/PR11
+external-provider/live-execution, real offline-kit, protected workflow-ref, signature/
+attestation, cross-DB, or publication/release blockers. PR10 and PR11 remain
+`in-progress` until their phase-specific evidence closes.
+
+## Restoration boundary
+
+This directory is the durable plan memory for the intended two-repository publication
+package. PR1–PR9 evidence and limitations are preserved above; PR10 and PR11 remain
+`in-progress`, while PR12 is `verified-with-notes`. The DeskForge candidate contains
+API/UI/Docker/server/offline-kit/Swagger/docs/tests; the separate RustDesk candidate
+contains active workflow/Android/portable/helper/tests. `rdgen` deletion and dirty
+submodule content are excluded. Follow-up commit `68e7f30` (`workflow: harden ruleset
+failure handling`) was pushed to `refactor/deskforge-corrective-pr`, and PR #59 remains
+open. GitHub run `31785951197` passed Go, Rust, Admin UI, and CodeQL/analyzer checks;
+CodeRabbit was skipped because the PR has 191 files. PR10 and PR11 remain `in-progress`;
+their live-provider, TOCTOU, cross-DB, offline, and other preserved limitations are
+unchanged. The PR is not marked ready and no live evidence is claimed.
diff --git a/plans/deskforge-corrective-refactor/todo.md b/plans/deskforge-corrective-refactor/todo.md
new file mode 100644
index 0000000..9ae64e4
--- /dev/null
+++ b/plans/deskforge-corrective-refactor/todo.md
@@ -0,0 +1,209 @@
+# DeskForge Corrective Refactor — Todo
+
+**Plan:** `plans/deskforge-corrective-refactor/plan.md`
+**Boundary:** cumulative PR1–PR12 DeskForge candidate plus a separate RustDesk candidate.
+The DeskForge candidate includes API/UI/Docker/server/offline-kit/Swagger/docs/tests;
+the RustDesk candidate separately includes active workflow/Android/portable/helper/tests.
+`rdgen` deletion and dirty submodule content are excluded. Follow-up commit `68e7f30`
+(`workflow: harden ruleset failure handling`) was pushed to
+`refactor/deskforge-corrective-pr`, and PR #59 remains open. GitHub run `31785951197` passed
+Go, Rust, Admin UI, and CodeQL/analyzer checks; CodeRabbit was skipped because the PR has 191
+files. This does not mark the PR ready, close PR10/PR11, or close their preserved evidence gates.
+No live-provider, full-offline-build, signature/attestation, cross-DB, protected-ref,
+release-readiness, or sovereignty claim is made.
+
+## Status by original PR order
+
+- [x] **PR1 — verified-with-notes**
+  - [x] Typed `BuildSpec` owns settings and canonical persisted `custom_json`.
+  - [x] Platform gate covers `windows`, `linux`, and `android`; unsupported values fail closed.
+  - [x] Preset create/update uses canonicalization and preserves empty/zero compatibility.
+  - [x] Exact files and local commands are recorded in [`phase-1.md`](phases/phase-1.md).
+
+- [x] **PR2 — verified-with-notes**
+  - [x] Endpoint literals, including explicit ports, are preserved; no `stripPort` service transformation.
+  - [x] UI/Docker/public endpoint and `21119` checks are recorded.
+  - [x] Manual browser, docs, and dev-compose gaps remain explicit.
+  - [x] Evidence is recorded in [`phase-2.md`](phases/phase-2.md).
+
+- [x] **PR3 — verified-with-notes**
+  - [x] Dispatch contract under test requires `return_run_details=true` and an exact HTTP `200` response with `workflow_run_id`, `run_url`, and `html_url`; standard `204` is intentionally unsupported because it cannot provide accepted exact run correlation.
+  - [x] No recent-run/list guessing; typed errors, redaction, bounded bodies, artifact identity, and retry policy are covered by local fake-transport checks only. Normal GitHub operation is not verified.
+  - [x] Live provider and poll/download integration remain unverified.
+  - [x] Evidence is recorded in [`phase-3.md`](phases/phase-3.md).
+
+- [x] **PR4 — verified-with-notes**
+  - [x] Record `DatabaseVersion 273`, provenance fields/guards, `AutoMigrate`, SQLite and race evidence.
+  - [x] Record exact dispatch identity, artifact/source write-once guards, snapshot-bound polling/resume, and legacy fail-closed behavior.
+  - [x] Preserve limits: no MySQL/Postgres/live provider/full suite; process-local guard only; no distributed lease/outbox.
+  - [x] Evidence is preserved in [`phase-4.md`](phases/phase-4.md).
+
+- [x] **PR5 — verified-with-notes**
+  - [x] Record `DatabaseVersion 274`, catalog pagination/source-tag SHA checks, and immutable version/build-ref persistence.
+  - [x] Record catalog/repository identity, pagination, source tag/commit/ref, focused checks, and legacy fail-closed behavior.
+  - [x] Preserve the temporary workflow `version` boundary and current hardcoded UI/config fallback findings for PR6.
+  - [x] Preserve exact local commands/evidence and all unverified coverage limits.
+  - [x] Evidence is preserved in [`phase-5.md`](phases/phase-5.md).
+
+- [x] **PR6 — verified-with-notes: workflow ownership/config simplification**
+  - [x] Fixed application workflow mapping owns filenames; catalog identity owns repository/version/build ref; version propagation is overwritten from immutable identity.
+  - [x] User config is Repo/PAT/PayloadKey only; legacy workflow/ref columns remain unread for migration safety.
+  - [x] Provider readiness precedes build-row persistence and production API has no file-queue fallback or PAT-sync machinery.
+  - [x] DeskForge duplicate platform workflows and draft sync workflow deleted; rdgen bridge retained because vendored generator workflows still reference it.
+  - [ ] Live GitHub dispatch/poll and real workflow execution remain deferred to later capability evidence.
+
+- [x] **PR7 — verified-with-notes: streaming artifact**
+  - [x] GitHub-body bounded temp-file streaming is recorded; no runner callback is part of the contract or implementation.
+  - [x] Exact run/artifact binding, compressed/decompressed/public archive limits, and fail-closed mismatch/partial/duplicate/expired handling are recorded.
+  - [x] Temp/staging cleanup, retry/sweep protection, digest/publication proof, atomic/idempotent output, and lifecycle statuses/guards are recorded.
+  - [x] Windows-only fail-closed capability and UI polling/lifecycle checks are recorded; Linux/Android remains PR11.
+  - [x] Focused Go tests, race, targeted vet, and UI build passed locally.
+  - [x] `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` pass after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. Redis integration/benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is configured, with no live Redis run. Live provider/runner, cross-DB, crash/distributed lease/outbox, and browser/manual evidence remain unverified.
+  - [x] Reviewer callback request is explicitly out of scope because the user contract specifies GitHub HTTP body flow.
+
+- [x] **PR8 — verified-with-notes: secret persistence/security hardening**
+  - [x] `SECRET_ENCRYPTION_KEY` is canonical for API secret-at-rest encryption; new non-empty secret writes fail closed when the current key is unavailable.
+  - [x] Legacy plaintext rows remain readable and are encrypted on re-save; malformed ciphertext prefixes are rejected.
+  - [x] Safe DTOs with explicit raw `json` tags preserve redaction boundaries; generated payload keys use `base64.RawURLEncoding`, and one-time generated-key display is intentional.
+  - [x] Docker pass-through, focused secret-persistence tests, race checks, targeted vet, and `npm run build` were verified.
+  - [x] Limitations are recorded: key rotation is unsupported/current key is required; evidence is SQLite-only with no MySQL/PostgreSQL coverage; Redis integration/benchmarks are opt-in through `DESKFORGE_TEST_REDIS_ADDR`, with no live Redis run recorded.
+
+- [x] **PR9 — verified-with-notes: Go/Rust reproducibility + SHA-pinned actions**
+   - [x] Inventory recorded Go/Rust inputs, toolchains, lockfiles, vendored dependencies, generators, and artifact identity checks.
+   - [x] Active workflow actions are pinned to immutable SHAs with ownership/permission review; fork-only workflow ownership is preserved without claiming live execution.
+   - [x] Full Go, API, UI, Swagger, Compose, and diff verification passes locally; the exact full Go vet/test/race commands and the test-only cache/Redis/lock-test fixes are recorded below.
+   - [x] Full `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` pass after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. Redis integration/benchmarks run only when `DESKFORGE_TEST_REDIS_ADDR` is configured; no live Redis run is recorded. Live provider/runner execution, clean-worktree/repeat-build evidence, cross-DB coverage, default OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, and Windows/Linux/Android execution remain unverified.
+   - [x] Active client workflows fail closed without authenticated DFP1 payloads and bind payload source identity to the configured fork.
+   - [x] Nested interrupted build-output download cleanup and direct-model canonical custom-field persistence guards are covered locally.
+    - [x] Local workflow-ref hardening requires provider-reported verified annotated tags,
+      an accepted verification reason, a matching protected-tag pattern, explicit update and
+      deletion protections, no bypass actors, and tag/branch collision rejection before approval
+      and again before DFP1 dispatch; live fork/provider execution remains unverified.
+    - [x] Approval persists the provider-resolved tag SHA and policy state through additive
+      migration evidence at `DatabaseVersion 282`; legacy compatibility remains preserved.
+    - [x] Build preparation and the dispatch primitive revalidate the selector, protected policy,
+      workflow contents, and resolved SHA immediately before secret-bearing DFP1 payload creation;
+      typed provider/approval/validation/contract errors expose only bounded safe messages and
+      diagnostics, not credentials, selectors, response bodies, or encrypted payloads.
+    - [ ] GitHub `workflow_dispatch` still accepts only a branch/tag selector and offers no atomic
+      SHA binding. A theoretical selector move between final validation and `POST` can expose
+      DFP1; production secret-bearing dispatch/live readiness stays gated until provider-side
+      immutable/no-bypass deployment proof or atomic API support is evidenced.
+   - [ ] RustDesk `hbb_common` timestamp work remains dirty and unpublished submodule state.
+
+  - [ ] **PR10 — in-progress: offline-kit/release evidence**
+   - [x] **Package A implementation:** strict offline fixtures and freeze/verify-only stage checks pass locally.
+   - [ ] **Package A real-kit verification:** verify/freeze fails closed on secret-bearing artifact presence, the legacy manifest, missing engine, empty printer digest, and incomplete license evidence; trusted manifest, source/submodule, and repeat no-mutation evidence remain open.
+   - [x] **Package B implementation/tests:** v2 producer/API manifests, including the private `custom_.txt` declaration, deterministic redacted handoff/archive hashes, exact identity/checksum/digest assertions, and public `custom_.txt` redaction pass focused checks.
+   - [x] **Package C implementation/tests:** TOCTOU-safe snapshot/archive cleanup, exact output/manifest and sidecar verification, retention-days and `if-no-files-found: error` contracts, and Windows-only capability checks pass focused tests.
+   - [ ] Completed-output retention/deletion remains an explicit manual operator policy; no completed-output TTL or release-retention policy is claimed.
+   - [x] Active/frozen workflow evidence boundaries are recorded: active fork workflows are executable evidence, while frozen offline-kit and `win-builder/` material remains manual/historical-only evidence.
+   - [ ] Protected workflow ref, clean published RustDesk `hbb_common` submodule, live provider/runner, signatures/attestations, MySQL/PostgreSQL cross-DB, and complete network-denied full-build evidence remain blocked/unverified.
+   - [x] Concrete files, checks, stop points, risks, and all PR10 gates are recorded in [`phase-10.md`](phases/phase-10.md).
+    - [x] Frozen/manual historical semantics are explicit; no tag, release, asset upload, or sovereignty claim is implied by this phase.
+
+
+ - [ ] **PR11 — in-progress: Linux/Android capability (not verified)**
+  - [x] Local bridge staging/hash-restore implementation evidence is recorded.
+  - [x] DFP1-only workflow/helper preservation is recorded; the helper remains untracked at the remote HEAD.
+  - [x] Manifest v2 implementation evidence is recorded.
+  - [x] Android app-id validation and the `applicationId` contract are recorded.
+  - [x] Android `custom_.txt` runtime-path handling and the fail-closed packaging check are recorded.
+  - [x] Linux deb/RPM `custom_.txt` ordering is recorded.
+  - [x] Portable deterministic traversal/timestamp tests and the capability gate/UI disabled state are recorded as local evidence.
+  - [x] Workflow manifests, bridge/helper source, Android app-ID/`applicationId`, custom_.txt runtime-path checks, and package assertions are labeled static only; deleted local copies and frozen `rdgen` workflows are not proof.
+  - [ ] Follow-up commit `68e7f30` was pushed and PR #59 remains open; the helper is untracked at the remote HEAD. This does not close PR11's evidence gates.
+  - [ ] No live Linux, Android, Windows, or provider runs have been performed.
+  - [ ] No APK/package/install/runtime evidence exists.
+  - [ ] No protected workflow-ref proof exists.
+  - [ ] No clean or repeat-build evidence exists.
+  - [ ] Required toolchains and native validators are unavailable.
+  - [ ] RustDesk `hbb_common` remains dirty and unpublished.
+  - [ ] Android signing/debug evidence is unavailable.
+  - [ ] Cross-DB and cryptographic signature evidence are unavailable.
+  - [ ] Re-expose platform choices only after green end-to-end capability evidence and the PR7 streaming boundary.
+
+ - [x] **PR12 — verified-with-notes: docs/tracker reconciliation (not a release step)**
+   - [x] Audit the external docs, tracker, and PR10/PR11 implementation notes listed in [`phase-12.md`](phases/phase-12.md).
+   - [x] Reconcile the canonical record to current PR10/PR11 evidence: focused local implementation checks are recorded, while live/provider/platform/release evidence is not.
+    - [x] Update the separately scoped external docs/tracker sources from current PR10/PR11 evidence; preserve the audited non-claims and do not imply release, sovereignty, Linux/Android support, live provider runs, signatures, cross-DB coverage, or a full offline build.
+    - [x] Every audited source uses the same PR10/PR11 status and remaining-gate wording; PR12 closure preserves the documentation/tracker status and does not close those evidence gates. The cumulative candidate also retains the PR1–PR11 implementation scope.
+  - [x] Source Swagger annotations and regenerated `api/docs/api` plus `api/docs/admin` use module-pinned `swag v1.16.3`; JSON/YAML/`docs.go` outputs are deterministic, and route/auth/schema/redaction parity checks pass.
+  - [x] Swagger metadata remains sparse for legacy operations; this is recorded as a low-usability issue, not a correctness, support, or publication claim.
+
+### PR12 audited-doc and remaining-gate checklist
+
+- [x] Audited `PLAN.md`, `README.md`, `CHANGELOG.md`, `BUGS.md`,
+      `CONTRIBUTING.md`, `AGENTS.md`, `github-build/README.md`,
+      `offline-kit/README.md`, `offline-kit/FORK-PROCEDURE.md`, `api/README.md`,
+      and canonical `phase-10.md`/`phase-11.md`.
+- [x] Recorded current PR10/PR11 local evidence without promoting it to release,
+      sovereignty, Linux/Android support, live provider execution, signatures,
+      cross-DB coverage, or a full offline build.
+- [ ] Close real offline-kit verification and trusted manifest/source/submodule/
+      license/repeatability evidence.
+- [ ] Close protected immutable workflow-ref, clean published `hbb_common`, live
+      provider/runner, exact artifact/download, and required toolchain/native-
+      validator evidence.
+- [ ] Close Linux/Android package/install/runtime and Android signing/debug proof,
+      clean/repeat builds, MySQL/PostgreSQL coverage, signatures/attestations, and
+      the complete network-denied full-build gate.
+- [ ] Keep completed-output retention policy explicit and keep release/tag/asset
+      publication outside this plan restoration.
+
+## Current local verification boundary
+
+- PR1–PR9 and the security-hardening work are `verified-with-notes`; PR10 and PR11 remain
+  `in-progress`, while PR12 is `verified-with-notes` for documentation/tracker reconciliation.
+- Packages A–C implementation and focused checks pass: strict offline fixtures/stage checks; v2 producer/API manifests including private `custom_.txt`; deterministic handoff/archive hashes; TOCTOU/snapshot cleanup; retention-days/`if-no-files-found: error`; and public `custom_.txt` redaction. PR12 source Swagger annotations and regenerated `api/docs/api` plus `api/docs/admin` use module-pinned `swag v1.16.3`; JSON/YAML/`docs.go` outputs are deterministic, and route/auth/schema/redaction parity checks pass.
+- Real offline-kit verify/freeze fails closed on secret-bearing artifact presence, legacy manifest, missing engine, empty printer digest, and incomplete license evidence. Full `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` pass after test-only cache diagnostics, opt-in Redis test changes, and test-only lock-test race fixes; production lock code is unchanged. Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`, with no live Redis run recorded.
+- Full `GOWORK=off go vet ./...`, `GOWORK=off go test ./...`, and `GOWORK=off go test -race ./...` pass after the test-only cache diagnostics, opt-in Redis changes, and lock-test race fixes; production lock code is unchanged. API build, UI build, deterministic Swagger regeneration/parity, Compose checks, and `git diff --check` pass. Redis integration/benchmarks remain opt-in through `DESKFORGE_TEST_REDIS_ADDR`, with no live Redis run recorded. Default OpenSSL/FindBin compatibility, native `actionlint`/`shellcheck`/`pwsh`, live provider/runner execution, clean/repeat builds, cross-DB coverage, and Windows/Linux/Android execution remain unverified. Swagger metadata remains sparse for legacy operations as a low-usability issue.
+- Workflow dispatch requires a branch/tag selector, exact contents-at-`WorkflowSHA` readiness, and a matching run `head_sha`; protected/immutable workflow-ref deployment remains a release gate.
+- Follow-up commit `68e7f30` (`workflow: harden ruleset failure handling`) was pushed to
+  `refactor/deskforge-corrective-pr`, and PR #59 remains open. GitHub run `31785951197` passed
+  Go, Rust, Admin UI, and CodeQL/analyzer checks; CodeRabbit was skipped because the PR has 191
+  files. The PR11 helper is untracked at the remote HEAD, and PR10/PR11 remain `in-progress`
+  with their evidence limitations preserved; the PR is not marked ready and no live evidence is
+  claimed.
+- Latest ruleset review/fix confirmation: modern repository rulesets are the sole protection
+  surface; initial and later list-page/detail/policy/contract failures fail closed. The former
+  tag-protection LIST compatibility path is **CONFIRMED OBSOLETE** because DeskForge is hard-wired
+  to `https://api.github.com`, has no configurable GHES base URL/provider, and current GitHub
+  documentation marks that legacy surface as closing down/removed. A GHES `enabled`/`pattern`
+  schema is separate historical context, not a DeskForge capability.
+- Endpoint distinction is explicit: GitHub's organization authoring endpoint
+  `https://docs.github.com/en/rest/orgs/rules#create-an-organization-repository-ruleset`
+  (`/orgs/{org}/rulesets`) uses repository selectors, while DeskForge consumes the repository
+  list `/repos/{owner}/{repo}/rulesets?targets=tag&includes_parents=true` and detail
+  `/repos/{owner}/{repo}/rulesets/{id}?includes_parents=true` from the [repository ruleset
+  docs](https://docs.github.com/en/rest/repos/rules#get-a-repository-ruleset). The provider-resolved repository detail
+  establishes applicability; only `conditions.ref_name` is required for tag matching, and
+  unknown/malformed condition fields fail closed.
+- Exact authenticated observation on 2026-08-14 for `github/docs`: list returned ruleset
+  `18281681`, `target=tag`, `source_type=Organization`, `source=github`, and
+  `enforcement=active`, with no conditions/rules/bypass metadata. Detail returned
+  `conditions.ref_name` only, rules `deletion`, `non_fast_forward`, `creation`, and parameterless
+  `update`, plus `current_user_can_bypass=never`; `bypass_actors` was omitted because the token
+  lacked write access. The positive contract uses `bypass_actors: []` and omission fails closed;
+  the exact ref patterns are recorded in `api/README.md`.
+- Root cause/fix: repository-scoped inherited Organization/Enterprise details were incorrectly
+  required to contain exactly one repository selector. Selector parsing/evaluation was removed.
+  Tag `update` may omit parameters; present parameters remain strict and branch `update` still
+  requires boolean `update_allows_fetch_and_merge`. The workflow-dispatch selector TOCTOU,
+  live-provider, PR10/PR11, cross-DB, and offline limitations remain unchanged.
+
+## Immediate next action
+
+PR9 is `verified-with-notes`; PR10 and PR11 remain `in-progress`, while PR12 is
+`verified-with-notes` for documentation/tracker reconciliation. Do not mark PR10 or PR11 complete
+without their phase-specific evidence. Do not mark the PR ready or claim live evidence. No live
+provider execution, clean build, or release publication is implied by the PR9 notes. The exact
+scope, gates, and dependencies are maintained in the corresponding phase documents.
+
+## Final restoration checks
+
+- [x] `git diff --check`
+- [x] Verify exactly 14 canonical files: `plan.md`, `todo.md`, and `phases/phase-1.md` through `phases/phase-12.md`.
+- [x] Historical restoration check (2026-08-09): that restoration changed no product/UI/
+      Docker/workflow/RustDesk/external-doc files; it is not the scope of the current
+      cumulative publication candidate.
diff --git a/plans/deskforge-workflow-migration/plan.md b/plans/deskforge-workflow-migration/plan.md
new file mode 100644
index 0000000..7225c1a
--- /dev/null
+++ b/plans/deskforge-workflow-migration/plan.md
@@ -0,0 +1,30 @@
+# DeskForge Workflow Migration Plan
+
+**Date:** 2026-08-16
+**Status:** Workflow migration, external verification, and final PR #59 body synchronization complete.
+**Scope:** Local contract reconciliation and recorded external workflow migration. Only these documentation artifacts are being updated; no source, workflow, secret, or external-repository changes are authorized here.
+
+## Current state
+
+- `rustqs/min-test` was renamed to `rustqs/workflows`. The accepted executable workflow is `rustqs-windows.yml`, producing artifact `rustqs-windows`, at exact head `b11be6aef84aa110884bec8fa5fe827663b8ff01`.
+- The external migration was committed through the GitHub Contents API in `4b77b40` and `b11be6a`. Local DeskForge references, tests, and documentation are migrated; local commit `460b424` was pushed to DeskForge PR #59.
+- PR #5 is open on `rustqs/workflows` after automatic retargeting.
+- The approved GPG key is registered. Signed annotated tag `workflow-v1.0.0` targets RustDesk commit `b11be6aef84aa110884bec8fa5fe827663b8ff01`; GitHub reports `verification=true` and `reason=valid`.
+- Active restored Repository Ruleset `20901403` (`DeskForge workflow tags`) protects `refs/tags/workflow-*` with deletion and update protection; `update_allows_fetch_and_merge=false`, `bypass_actors=[]`, and `current_user_can_bypass=never`.
+- The provider-derived workflow-tag display and approval flow are verified; no new GUI architecture is needed. Final external verification is complete.
+
+## Behavioral contract
+
+- **Operator action:** select and approve a workflow revision for a build.
+- **Value source:** the provider supplies the workflow tag and resolves its commit; the GUI displays the provider-derived tag and approval state.
+- **Required behavior:** preserve provider-derived selection, immutable identity, approval, revalidation, and fail-closed handling. Do not add a raw/manual workflow-ref editor or new GUI architecture.
+
+## Validation and publication
+
+- [x] Current passing runs: PR Build `31889460990`, analyzer `31889459181`, and CodeQL `95023538774`.
+- [x] Credentials/approval, remote, branch, base, commit range, changed files, and validation were checked before publication; publication gates and final external verification are complete.
+- [x] PR #59 body synchronization is complete; the final update was applied after the documentation commit.
+
+## Explicit unresolved TOCTOU
+
+- [ ] The workflow-dispatch provider selector is not atomically bound to a commit. This remains out of scope and unresolved; no secret-bearing dispatch or live-readiness claim is made.
diff --git a/plans/deskforge-workflow-migration/todo.md b/plans/deskforge-workflow-migration/todo.md
new file mode 100644
index 0000000..12d7fd6
--- /dev/null
+++ b/plans/deskforge-workflow-migration/todo.md
@@ -0,0 +1,24 @@
+# DeskForge Workflow Migration — Todo
+
+**Plan:** `plans/deskforge-workflow-migration/plan.md`
+**Status:** Workflow migration, external verification, and final PR #59 body synchronization complete.
+
+## Current state
+
+- [x] Branch renamed from `rustqs/min-test` to `rustqs/workflows`; exact head is `b11be6aef84aa110884bec8fa5fe827663b8ff01`.
+- [x] Accepted workflow is `rustqs-windows.yml`; artifact is `rustqs-windows`. External migration commits are `4b77b40` and `b11be6a`.
+- [x] Local references, tests, and documentation are migrated; local commit `460b424` was pushed to DeskForge PR #59.
+- [x] PR #5 is open on `rustqs/workflows`.
+- [x] Approved GPG key is registered; signed annotated `workflow-v1.0.0` targets `b11be6aef84aa110884bec8fa5fe827663b8ff01` and GitHub reports `verification=true`/`reason=valid`.
+- [x] Active restored Ruleset `20901403` protects `refs/tags/workflow-*` with deletion and update protection; fetch/merge updates are disallowed and there are no bypass actors.
+- [x] Provider-derived workflow-tag display and approval are verified; no new GUI architecture is needed. Final external verification is complete.
+
+## Validation and publication
+
+- [x] Current passing runs: Build `31889460990`, analyzer `31889459181`, and CodeQL `95023538774`.
+- [x] Credentials/approval and publication gates were verified before tag publication and final external verification.
+- [x] PR #59 body updated with the final commits, files, behavior, scope, and validation.
+
+## Explicit unresolved TOCTOU
+
+- [ ] The workflow-dispatch provider selector is not atomically bound to a commit; this remains explicitly excluded and unresolved.
diff --git a/plans/fix-ci-workflow/plan.md b/plans/fix-ci-workflow/plan.md
index be0b92f..cd22bf6 100644
--- a/plans/fix-ci-workflow/plan.md
+++ b/plans/fix-ci-workflow/plan.md
@@ -1,9 +1,23 @@
 # Plan: Fix CI Workflows and Version Management
 
 **Date:** 2026-06-28
-**Status:** 🟡 Implemented — pending live workflow validation
+**Status:** 🟡 Historical/superseded — preserved; no current live-validation claim
 **Priority:** High (workflows were failing)
 
+> **Historical/superseded notice (2026-08-10):** This plan preserves the original
+> CI repair record. Its local `github-build/` copies, multi-branch deployment notes,
+> open-input/debug fallback, and version fallback descriptions are historical and
+> are not the current production contract. Active executable workflows belong only
+> to the configured RustDesk fork; the current payload boundary is authenticated
+> `DFP1`, provider catalog failure has no obsolete version fallback, and PR10/PR11
+> remain `in-progress`. PR12 is a separately tracked, docs-only
+> `verified-with-notes` reconciliation; this historical plan is not current PR12 work
+> and makes no live-run or readiness claim.
+>
+> **Provenance boundary:** broad corrective changes remain uncommitted in the local
+> worktrees; PR12 documentation reconciliation is not an isolated diff and this
+> historical plan does not authorize publication or change the current PR statuses.
+
 ---
 
 ## 1. Context and Problem
@@ -77,7 +91,7 @@ bashrusakh/rustdesk
 
 ---
 
-## 3. What Was Done
+## 3. Historical implementation record (superseded)
 
 ### 3.1. Fixed `bridge.yml` — restored upstream pattern
 
@@ -156,7 +170,7 @@ GET /repos/bashrusakh/rustdesk/releases?per_page=100
 
 ---
 
-## 4. Validation
+## 4. Historical validation record (superseded)
 
 | Check | Result |
 |---|---|
diff --git a/plans/fix-ci-workflow/todo.md b/plans/fix-ci-workflow/todo.md
index 18b202b..bc32894 100644
--- a/plans/fix-ci-workflow/todo.md
+++ b/plans/fix-ci-workflow/todo.md
@@ -2,9 +2,17 @@
 
 **Plan:** `plans/fix-ci-workflow/plan.md`
 
+> **Historical/superseded:** retained for the original CI repair history. Active
+> workflow ownership is now the configured RustDesk fork only; local workflow copies,
+> open-input/debug fallback, and version fallback notes below are not current behavior.
+>
+> **Provenance boundary (2026-08-10):** broad local corrective changes remain
+> uncommitted; the separately tracked PR12 docs-only reconciliation is
+> `verified-with-notes` within that worktree and is not an isolated diff.
+
 ---
 
-## Status
+## Historical/superseded status record
 
 - [x] **Step 1:** Fix `bridge.yml` in fork (3 branches)
   - [x] `rustqs/min-test` — commit `3bdd91b`
diff --git a/server/Cargo.lock b/server/Cargo.lock
index 3b8566b..d8a971b 100644
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -23,7 +23,7 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
  "once_cell",
  "version_check",
 ]
@@ -61,6 +61,56 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.57"
@@ -86,6 +136,17 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "async-speed-limit"
 version = "0.3.1"
@@ -104,7 +165,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed6aa3524a2dfcf9fe180c51eae2b58738348d819517ceadf95789c51fff7600"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "syn 1.0.93",
 ]
 
@@ -146,7 +207,7 @@ dependencies = [
  "bytes",
  "futures-util",
  "headers",
- "http",
+ "http 0.2.7",
  "http-body",
  "hyper",
  "itoa",
@@ -175,7 +236,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http",
+ "http 0.2.7",
  "http-body",
  "mime",
 ]
@@ -221,7 +282,7 @@ checksum = "a7e7c93a3fb23b2fdde989b2c9ec4dd153063ec81f408507f84c090cd91c6641"
 dependencies = [
  "base64 0.13.0",
  "blowfish",
- "getrandom",
+ "getrandom 0.2.15",
  "zeroize",
 ]
 
@@ -241,7 +302,7 @@ dependencies = [
  "log",
  "peeking_take_while",
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "regex",
  "rustc-hash",
  "shlex",
@@ -256,9 +317,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.7.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1be3f42a67d6d345ecd59f675f3f012d6974981560836e938c22b424b85ce1be"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "block-buffer"
@@ -293,13 +354,38 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
 [[package]]
 name = "bytes"
-version = "1.9.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "calloop"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dbf9978365bac10f54d1d4b04f7ce4427e51f71d61f2fe15e3fed5166474df7"
+dependencies = [
+ "bitflags 2.13.1",
+ "polling",
+ "rustix",
+ "slab",
+ "tracing",
+]
+
+[[package]]
+name = "calloop-wayland-source"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "138efcf0940a02ebf0cc8d1eff41a1682a46b431630f4c52450d6265876021fa"
+dependencies = [
+ "calloop",
+ "rustix",
+ "wayland-backend",
+ "wayland-client",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.9"
@@ -383,6 +469,12 @@ dependencies = [
  "vec_map",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -393,6 +485,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "config"
 version = "0.11.0"
@@ -411,7 +512,7 @@ source = "git+https://github.com/rustdesk-org/confy#83db9ec19a2f97e9718aef69e4fc
 dependencies = [
  "directories-next",
  "serde",
- "thiserror",
+ "thiserror 1.0.31",
  "toml 0.5.9",
 ]
 
@@ -425,6 +526,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -525,13 +636,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.8"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf124c720b7686e3c2663cf54062ab0f68a88af2fb6a030e87e30bf721fcb38"
-dependencies = [
- "cfg-if",
- "lazy_static",
-]
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crypto-common"
@@ -543,6 +650,18 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "cursor-icon"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
 [[package]]
 name = "deadpool"
 version = "0.8.2"
@@ -566,6 +685,37 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.3"
@@ -607,6 +757,17 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "dlopen"
 version = "0.1.8"
@@ -654,6 +815,12 @@ version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
 
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
 [[package]]
 name = "ed25519"
 version = "1.5.0"
@@ -678,6 +845,16 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "env_filter"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+dependencies = [
+ "log",
+ "regex",
+]
+
 [[package]]
 name = "env_logger"
 version = "0.9.0"
@@ -693,15 +870,15 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.10.2"
+version = "0.11.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd405aab171cb85d6735e5c8d9db038c17d3ca007a4d2c25f337935c3d90580"
+checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
 dependencies = [
- "humantime",
- "is-terminal",
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
  "log",
- "regex",
- "termcolor",
 ]
 
 [[package]]
@@ -710,6 +887,16 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "event-listener"
 version = "2.5.2"
@@ -733,7 +920,7 @@ checksum = "c0408e2626025178a6a7f7ffc05a25bc47103229f19c113755de7bf63816290c"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.2.13",
  "winapi",
 ]
 
@@ -762,7 +949,7 @@ dependencies = [
  "log",
  "regex",
  "rustversion",
- "thiserror",
+ "thiserror 1.0.31",
  "time",
 ]
 
@@ -781,7 +968,7 @@ dependencies = [
  "log",
  "nu-ansi-term",
  "regex",
- "thiserror",
+ "thiserror 1.0.31",
 ]
 
 [[package]]
@@ -819,11 +1006,10 @@ checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.0.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fc25a87fa4fd2094bffb06925852034d90a17f0d1e05197d4956d3555752191"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
 dependencies = [
- "matches",
  "percent-encoding",
 ]
 
@@ -844,9 +1030,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3083ce4b914124575708913bca19bfe887522d6e2e6d0952943f5eac4a74010"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -854,9 +1040,9 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 
 [[package]]
 name = "futures-executor"
@@ -882,32 +1068,32 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc4045962a5a5e935ee2fdedaa4e08284547402885ab326734432bed5d12966b"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33c1e13800337f4d4d7a316bf45a567dbcb6ffe087f16424852d97e97a91f512"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21163e139fa306126e6eedaf49ecdb4588f939600f0b1e770f4205ee4b7fa868"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 
 [[package]]
 name = "futures-task"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
 [[package]]
 name = "futures-timer"
@@ -917,9 +1103,9 @@ checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
 
 [[package]]
 name = "futures-util"
-version = "0.3.21"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8b7abd5d659d9b90c8cba917f6ec750a74e2dc23902ef9cd4cc8c8b22e6036a"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -929,7 +1115,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -954,6 +1139,29 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
 [[package]]
 name = "gimli"
 version = "0.31.1"
@@ -977,7 +1185,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "futures-util",
- "http",
+ "http 0.2.7",
  "indexmap 2.7.0",
  "slab",
  "tokio",
@@ -1020,6 +1228,7 @@ name = "hbb_common"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "async-recursion",
  "backtrace",
  "base64 0.22.1",
  "bytes",
@@ -1029,7 +1238,7 @@ dependencies = [
  "directories-next",
  "dirs-next",
  "dlopen",
- "env_logger 0.10.2",
+ "env_logger 0.11.10",
  "filetime",
  "flexi_logger 0.27.4",
  "futures",
@@ -1037,33 +1246,42 @@ dependencies = [
  "httparse",
  "lazy_static",
  "libc",
+ "libloading",
  "log",
  "mac_address",
  "machine-uid 0.3.0",
  "osascript",
  "protobuf",
  "protobuf-codegen",
- "rand",
+ "rand 0.8.5",
  "regex",
+ "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
  "serde_derive",
  "serde_json",
  "sha2",
+ "smithay-client-toolkit",
  "socket2 0.3.19",
  "sodiumoxide",
  "sysinfo",
- "thiserror",
+ "thiserror 1.0.31",
  "tokio",
  "tokio-native-tls",
  "tokio-rustls 0.26.1",
  "tokio-socks 0.5.2-1",
+ "tokio-tungstenite 0.26.2",
  "tokio-util",
  "toml 0.7.8",
+ "tungstenite 0.26.2",
  "url",
+ "users",
  "uuid",
+ "webpki-roots 1.0.9",
+ "whoami",
  "winapi",
+ "x11",
  "zstd",
 ]
 
@@ -1083,7 +1301,7 @@ dependencies = [
  "flexi_logger 0.22.3",
  "hbb_common",
  "headers",
- "http",
+ "http 0.2.7",
  "ipnetwork",
  "jsonwebtoken",
  "lazy_static",
@@ -1092,6 +1310,7 @@ dependencies = [
  "machine-uid 0.2.0",
  "minreq",
  "once_cell",
+ "openssl",
  "ping",
  "regex",
  "reqwest",
@@ -1101,9 +1320,9 @@ dependencies = [
  "serde_json",
  "sodiumoxide",
  "sqlx",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.17.1",
  "tower-http",
- "tungstenite",
+ "tungstenite 0.17.2",
  "uuid",
  "whoami",
 ]
@@ -1118,7 +1337,7 @@ dependencies = [
  "bitflags 1.3.2",
  "bytes",
  "headers-core",
- "http",
+ "http 0.2.7",
  "httpdate",
  "mime",
  "sha-1",
@@ -1130,7 +1349,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
 dependencies = [
- "http",
+ "http 0.2.7",
 ]
 
 [[package]]
@@ -1157,6 +1376,12 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
 
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -1174,6 +1399,16 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
 [[package]]
 name = "http-body"
 version = "0.4.4"
@@ -1181,7 +1416,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ff4f84919677303da5f147645dbea6b1881f368d03ac84e1dc09031ebd7b2c6"
 dependencies = [
  "bytes",
- "http",
+ "http 0.2.7",
  "pin-project-lite",
 ]
 
@@ -1193,9 +1428,9 @@ checksum = "0bfe8eed0a9285ef776bb792479ea3834e8b94e13d615c2f66d03dd50a435a29"
 
 [[package]]
 name = "httparse"
-version = "1.9.5"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d71d3574edd2771538b901e6549113b4006ece66150fb69c0fb6d9a2adae946"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpdate"
@@ -1220,7 +1455,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http",
+ "http 0.2.7",
  "http-body",
  "httparse",
  "httpdate",
@@ -1240,7 +1475,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
  "futures-util",
- "http",
+ "http 0.2.7",
  "hyper",
  "rustls 0.21.12",
  "tokio",
@@ -1283,15 +1518,107 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "idna"
-version = "0.2.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418a0a6fab821475f634efe3ccc45c013f742efe03d853e8d3355d5cb850ecf8"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
 dependencies = [
- "matches",
- "unicode-bidi",
- "unicode-normalization",
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
 ]
 
 [[package]]
@@ -1358,6 +1685,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.10.3"
@@ -1373,18 +1706,56 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
 
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "jni"
-version = "0.19.0"
+version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
 dependencies = [
  "cesu8",
+ "cfg-if",
  "combine",
  "jni-sys",
  "log",
- "thiserror",
+ "thiserror 1.0.31",
  "walkdir",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -1428,9 +1799,9 @@ dependencies = [
 
 [[package]]
 name = "lazy_static"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "lazycell"
@@ -1453,9 +1824,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libloading"
@@ -1467,6 +1838,18 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "libredox"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "plain",
+ "redox_syscall 0.9.1",
+]
+
 [[package]]
 name = "libsodium-sys"
 version = "0.2.7"
@@ -1491,14 +1874,26 @@ dependencies = [
 ]
 
 [[package]]
-name = "local-ip-address"
-version = "0.5.3"
+name = "linux-raw-sys"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2815836665de176ba66deaa449ada98fdf208d84730d1a84a22cbeed6151a6fa"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "local-ip-address"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2815836665de176ba66deaa449ada98fdf208d84730d1a84a22cbeed6151a6fa"
 dependencies = [
  "libc",
  "neli",
- "thiserror",
+ "thiserror 1.0.31",
  "windows-sys 0.48.0",
 ]
 
@@ -1514,12 +1909,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.17"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if",
-]
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "mac_address"
@@ -1550,12 +1942,6 @@ dependencies = [
  "winreg 0.11.0",
 ]
 
-[[package]]
-name = "matches"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
-
 [[package]]
 name = "matchit"
 version = "0.5.0"
@@ -1568,6 +1954,15 @@ version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.6.5"
@@ -1620,13 +2015,13 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.3"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "wasi",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1638,10 +2033,10 @@ dependencies = [
  "libc",
  "log",
  "openssl",
- "openssl-probe",
+ "openssl-probe 0.1.5",
  "openssl-sys",
  "schannel",
- "security-framework",
+ "security-framework 2.11.1",
  "security-framework-sys",
  "tempfile",
 ]
@@ -1666,7 +2061,7 @@ checksum = "c168194d373b1e134786274020dae7fc5513d565ea2ebb9bc9ff17ffb69106d4"
 dependencies = [
  "either",
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "serde",
  "syn 1.0.93",
 ]
@@ -1785,13 +2180,19 @@ version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "openssl"
 version = "0.10.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5"
 dependencies = [
- "bitflags 2.7.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -1807,8 +2208,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1817,6 +2218,21 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.104"
@@ -1825,6 +2241,7 @@ checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -1880,7 +2297,7 @@ dependencies = [
  "cfg-if",
  "instant",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.2.13",
  "smallvec",
  "winapi",
 ]
@@ -1893,7 +2310,7 @@ checksum = "09a279cbf25cb0757810394fbc1e359949b59e348145c643a939a525692e6929"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.2.13",
  "smallvec",
  "windows-sys 0.36.1",
 ]
@@ -1921,9 +2338,9 @@ dependencies = [
 
 [[package]]
 name = "percent-encoding"
-version = "2.1.0"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4fd5641d01c8f18a23da7b6fe29298ff4b55afcccdf78973b24cf3175fee32e"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pin-project"
@@ -1941,8 +2358,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d56a66c0c55993aa927429d0f8a0abfd74f084e4d9c192cffed01e418d83eefb"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1951,21 +2368,15 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
 [[package]]
 name = "ping"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69044d1c00894fc1f43d9485aadb6ab6e68df90608fa52cf1074cda6420c6b76"
 dependencies = [
- "rand",
+ "rand 0.8.5",
  "socket2 0.4.4",
- "thiserror",
+ "thiserror 1.0.31",
 ]
 
 [[package]]
@@ -1974,6 +2385,50 @@ version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
 
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi 0.5.2",
+ "pin-project-lite",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.16"
@@ -2007,7 +2462,7 @@ dependencies = [
  "bytes",
  "once_cell",
  "protobuf-support",
- "thiserror",
+ "thiserror 1.0.31",
 ]
 
 [[package]]
@@ -2022,7 +2477,7 @@ dependencies = [
  "protobuf-parse",
  "regex",
  "tempfile",
- "thiserror",
+ "thiserror 1.0.31",
 ]
 
 [[package]]
@@ -2037,7 +2492,7 @@ dependencies = [
  "protobuf",
  "protobuf-support",
  "tempfile",
- "thiserror",
+ "thiserror 1.0.31",
  "which",
 ]
 
@@ -2047,7 +2502,7 @@ version = "3.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b088fd20b938a875ea00843b6faf48579462630015c3788d397ad6a786663252"
 dependencies = [
- "thiserror",
+ "thiserror 1.0.31",
 ]
 
 [[package]]
@@ -2056,13 +2511,22 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9e1dcb320d6839f6edb64f7a4a59d39b30480d4d1765b56873f7c858538a5fe"
 
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quickcheck"
 version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "588f6378e4dd99458b60ec275b4477add41ce4fa9f64dcba6f15adccb19b50d6"
 dependencies = [
- "rand",
+ "rand 0.8.5",
 ]
 
 [[package]]
@@ -2076,13 +2540,25 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2 1.0.93",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -2090,8 +2566,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.3",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2101,7 +2587,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.3",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2110,7 +2606,16 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
 ]
 
 [[package]]
@@ -2142,15 +2647,24 @@ dependencies = [
  "bitflags 1.3.2",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07507be7b4a5f9f26eeb41eeaebb1f5a7ff29dfb29739facc21d35bf8b11c21e"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
 [[package]]
 name = "redox_users"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
 dependencies = [
- "getrandom",
- "redox_syscall",
- "thiserror",
+ "getrandom 0.2.15",
+ "redox_syscall 0.2.13",
+ "thiserror 1.0.31",
 ]
 
 [[package]]
@@ -2203,7 +2717,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http",
+ "http 0.2.7",
  "http-body",
  "hyper",
  "hyper-rustls",
@@ -2218,7 +2732,7 @@ dependencies = [
  "pin-project-lite",
  "rustls 0.21.12",
  "rustls-native-certs 0.6.2",
- "rustls-pemfile 1.0.0",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -2260,7 +2774,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9babe80d5c16becf6594aa32ad2be8fe08498e7ae60b77de8df700e67f191d7e"
 dependencies = [
  "cc",
- "getrandom",
+ "getrandom 0.2.15",
  "libc",
  "spin 0.9.3",
  "untrusted 0.9.0",
@@ -2289,6 +2803,19 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "rustls"
 version = "0.20.4"
@@ -2315,15 +2842,15 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.21"
+version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f287924602bf649d949c63dc8ac8b235fa5387d394020705b80c4eb597ce5b8"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
  "log",
  "once_cell",
  "ring 0.17.3",
  "rustls-pki-types",
- "rustls-webpki 0.102.8",
+ "rustls-webpki 0.103.13",
  "subtle",
  "zeroize",
 ]
@@ -2334,23 +2861,22 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0167bac7a9f490495f3c33013e7722b53cb087ecbe082fb0c6387c96f634ea50"
 dependencies = [
- "openssl-probe",
- "rustls-pemfile 1.0.0",
+ "openssl-probe 0.1.5",
+ "rustls-pemfile",
  "schannel",
- "security-framework",
+ "security-framework 2.11.1",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
- "openssl-probe",
- "rustls-pemfile 2.2.0",
+ "openssl-probe 0.2.1",
  "rustls-pki-types",
  "schannel",
- "security-framework",
+ "security-framework 3.7.0",
 ]
 
 [[package]]
@@ -2363,39 +2889,33 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "2.2.0"
+name = "rustls-pki-types"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
- "rustls-pki-types",
+ "zeroize",
 ]
 
-[[package]]
-name = "rustls-pki-types"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37"
-
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.3.4"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afbb878bdfdf63a336a5e63561b1835e7a8c91524f51621db870169eac84b490"
+checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
 dependencies = [
- "core-foundation",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.21",
- "rustls-native-certs 0.7.3",
+ "rustls 0.23.43",
+ "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.102.8",
- "security-framework",
+ "rustls-webpki 0.103.13",
+ "security-framework 3.7.0",
  "security-framework-sys",
- "webpki-roots 0.26.7",
- "winapi",
+ "webpki-root-certs",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2416,9 +2936,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.102.8"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring 0.17.3",
  "rustls-pki-types",
@@ -2477,19 +2997,31 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.7.0",
- "core-foundation",
+ "bitflags 2.13.1",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
- "num-bigint",
  "security-framework-sys",
 ]
 
 [[package]]
 name = "security-framework-sys"
-version = "2.14.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49db231d56a190491cb4aeda9527f1ad45345af50b0851622a7adb8c03b01c32"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2497,22 +3029,32 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -2558,6 +3100,17 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "006769ba83e921b3085caa8334186b00cf92b4cb1a6cf4632fbccc8eff5c7549"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.2"
@@ -2598,21 +3151,48 @@ checksum = "4a762b1c38b9b990c694b9c2f8abe3372ce6a9ceaae6bca39cfc46e054f45745"
 dependencies = [
  "num-bigint",
  "num-traits",
- "thiserror",
+ "thiserror 1.0.31",
  "time",
 ]
 
 [[package]]
 name = "slab"
-version = "0.4.6"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb703cfe953bccee95685111adeedb76fabe4e97549a58d16f03ea7b9367bb32"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.8.0"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "smithay-client-toolkit"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0512da38f5e2b31201a93524adb8d3136276fa4fe4aafab4e1f727a82b534cc0"
+dependencies = [
+ "bitflags 2.13.1",
+ "calloop",
+ "calloop-wayland-source",
+ "cursor-icon",
+ "libc",
+ "log",
+ "memmap2",
+ "rustix",
+ "thiserror 2.0.20",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-csd-frame",
+ "wayland-cursor",
+ "wayland-protocols",
+ "wayland-protocols-experimental",
+ "wayland-protocols-misc",
+ "wayland-protocols-wlr",
+ "wayland-scanner",
+ "xkeysym",
+]
 
 [[package]]
 name = "socket2"
@@ -2645,6 +3225,16 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "sodiumoxide"
 version = "0.2.7"
@@ -2727,7 +3317,7 @@ dependencies = [
  "paste",
  "percent-encoding",
  "rustls 0.20.4",
- "rustls-pemfile 1.0.0",
+ "rustls-pemfile",
  "serde",
  "serde_json",
  "sha2",
@@ -2735,7 +3325,7 @@ dependencies = [
  "sqlformat",
  "sqlx-rt",
  "stringprep",
- "thiserror",
+ "thiserror 1.0.31",
  "tokio-stream",
  "url",
  "webpki-roots 0.22.4",
@@ -2752,7 +3342,7 @@ dependencies = [
  "heck",
  "once_cell",
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "serde_json",
  "sha2",
  "sqlx-core",
@@ -2772,6 +3362,12 @@ dependencies = [
  "tokio-rustls 0.23.4",
 ]
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -2818,18 +3414,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04066589568b72ec65f42d65a1a52436e954b168773148893c020269563decf2"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "unicode-xid 0.2.3",
 ]
 
 [[package]]
 name = "syn"
-version = "2.0.96"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "unicode-ident",
 ]
 
@@ -2839,6 +3446,17 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "sysinfo"
 version = "0.29.10"
@@ -2860,7 +3478,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
  "bitflags 1.3.2",
- "core-foundation",
+ "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
 
@@ -2883,7 +3501,7 @@ dependencies = [
  "cfg-if",
  "fastrand",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.2.13",
  "remove_dir_all",
  "winapi",
 ]
@@ -2912,7 +3530,16 @@ version = "1.0.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd829fe32373d27f76265620b5309d0340cb8550f523c1dda251d6298069069a"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.31",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -2922,10 +3549,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0396bc89e626244658bef819e22d0cc459e795a5ebe878e6ec336d1674a8d79a"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
+ "quote 1.0.47",
  "syn 1.0.93",
 ]
 
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "time"
 version = "0.3.9"
@@ -2945,6 +3583,16 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42657b1a6f4d817cda8e7a0ace261fe0cc946cf3a80314390b22cc61ae080792"
 
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tinyvec"
 version = "1.6.0"
@@ -2962,31 +3610,30 @@ checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
 
 [[package]]
 name = "tokio"
-version = "1.43.0"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d61fa4ffa3de412bfea335c6ecff681de2b609ba3c77ef3e00e521813a9ed9e"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
- "backtrace",
  "bytes",
  "libc",
  "mio",
  "parking_lot 0.12.0",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.8",
+ "socket2 0.6.5",
  "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.5.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -3026,7 +3673,7 @@ version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
 dependencies = [
- "rustls 0.23.21",
+ "rustls 0.23.43",
  "tokio",
 ]
 
@@ -3041,7 +3688,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "pin-project",
- "thiserror",
+ "thiserror 1.0.31",
  "tokio",
  "tokio-util",
 ]
@@ -3054,7 +3701,7 @@ checksum = "0d4770b8024672c1101b3f6733eab95b18007dbe0847a8afe341fcf79e06043f"
 dependencies = [
  "either",
  "futures-util",
- "thiserror",
+ "thiserror 1.0.31",
  "tokio",
 ]
 
@@ -3078,7 +3725,26 @@ dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite",
+ "tungstenite 0.17.2",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
+dependencies = [
+ "futures-util",
+ "log",
+ "native-tls",
+ "rustls 0.23.43",
+ "rustls-native-certs 0.8.4",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-rustls 0.26.1",
+ "tungstenite 0.26.2",
+ "webpki-roots 0.26.7",
 ]
 
 [[package]]
@@ -3168,7 +3834,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-util",
- "http",
+ "http 0.2.7",
  "http-body",
  "http-range-header",
  "httpdate",
@@ -3215,8 +3881,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3243,16 +3909,38 @@ dependencies = [
  "base64 0.13.0",
  "byteorder",
  "bytes",
- "http",
+ "http 0.2.7",
  "httparse",
  "log",
- "rand",
+ "rand 0.8.5",
  "sha-1",
- "thiserror",
+ "thiserror 1.0.31",
  "url",
  "utf-8",
 ]
 
+[[package]]
+name = "tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4793cb5e56680ecbb1d843515b23b6de9a75eb04b66643e256a396d43be33c13"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http 1.5.0",
+ "httparse",
+ "log",
+ "native-tls",
+ "rand 0.9.5",
+ "rustls 0.23.43",
+ "rustls-native-certs 0.8.4",
+ "rustls-pki-types",
+ "sha1",
+ "thiserror 2.0.20",
+ "utf-8",
+ "webpki-roots 0.26.7",
+]
+
 [[package]]
 name = "typenum"
 version = "1.15.0"
@@ -3333,14 +4021,24 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.2.2"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507c383b2d33b5fc35d1861e77e6b383d158b2da5e14fe51b83dfedf6fd578c"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
  "idna",
- "matches",
  "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "users"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
+dependencies = [
+ "libc",
+ "log",
 ]
 
 [[package]]
@@ -3349,13 +4047,27 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
-version = "1.12.0"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "744018581f9a3454a9e15beb8a33b017183f1e7c0cd170232a2d1453b23a51c4"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
- "getrandom",
+ "getrandom 0.4.3",
+ "js-sys",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -3403,6 +4115,21 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.100"
@@ -3424,8 +4151,8 @@ dependencies = [
  "bumpalo",
  "log",
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
@@ -3448,7 +4175,7 @@ version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
 dependencies = [
- "quote 1.0.38",
+ "quote 1.0.47",
  "wasm-bindgen-macro-support",
 ]
 
@@ -3459,8 +4186,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2 1.0.93",
- "quote 1.0.38",
- "syn 2.0.96",
+ "quote 1.0.47",
+ "syn 2.0.119",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
@@ -3474,6 +4201,124 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wayland-backend"
+version = "0.3.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "016ccf01d1c58b6f8999612813e17c9b2390f7d70671428869913310f83f54b8"
+dependencies = [
+ "cc",
+ "downcast-rs",
+ "rustix",
+ "smallvec",
+ "wayland-sys",
+]
+
+[[package]]
+name = "wayland-client"
+version = "0.31.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c36a0f861ad76d0901f2800b46321410d9f73f2ea88aac0650d86c32688073"
+dependencies = [
+ "bitflags 2.13.1",
+ "rustix",
+ "wayland-backend",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-csd-frame"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625c5029dbd43d25e6aa9615e88b829a5cad13b2819c4ae129fdbb7c31ab4c7e"
+dependencies = [
+ "bitflags 2.13.1",
+ "cursor-icon",
+ "wayland-backend",
+]
+
+[[package]]
+name = "wayland-cursor"
+version = "0.31.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a52d18780be9b1314328a3de5f930b73d2200112e3849ca6cb11822793fb34d"
+dependencies = [
+ "rustix",
+ "wayland-client",
+ "xcursor",
+]
+
+[[package]]
+name = "wayland-protocols"
+version = "0.32.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d0c813de3daa2ed6520af85a3bd49b0e722a3078506899aa9686fea58dc4b6"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-experimental"
+version = "20250721.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40a1f863128dcaaec790d7b4b396cc9b9a7a079e878e18c47e6c2d2c5a8dcbb1"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-misc"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9567599ef23e09b8dad6e429e5738d4509dfc46b3b21f32841a304d16b29c8"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-protocols-wlr"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb04e52f7836d7c7976c78ca0250d61e33873c34156a2a1fc9474828ec268234"
+dependencies = [
+ "bitflags 2.13.1",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-scanner",
+]
+
+[[package]]
+name = "wayland-scanner"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338e30461b3a2b67d70eb30a6d89f8e0c93a833e07d2ae89085cd070c4a00ac0"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quick-xml",
+ "quote 1.0.47",
+]
+
+[[package]]
+name = "wayland-sys"
+version = "0.31.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eab23fefc9e41f8e841df4a9c707e8a8c4ed26e944ef69297184de2785e3be"
+dependencies = [
+ "pkg-config",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.77"
@@ -3494,6 +4339,15 @@ dependencies = [
  "untrusted 0.7.1",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "0.22.4"
@@ -3518,6 +4372,15 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "which"
 version = "4.2.5"
@@ -3531,11 +4394,12 @@ dependencies = [
 
 [[package]]
 name = "whoami"
-version = "1.2.1"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524b58fa5a20a2fb3014dd6358b70e6579692a56ef6fce928834e488f42f65e8"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
- "wasm-bindgen",
+ "libredox",
+ "wasite",
  "web-sys",
 ]
 
@@ -3598,6 +4462,12 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
 [[package]]
 name = "windows-sys"
 version = "0.36.1"
@@ -3611,6 +4481,15 @@ dependencies = [
  "windows_x86_64_msvc 0.36.1",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -3638,6 +4517,30 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -3669,6 +4572,12 @@ dependencies = [
  "windows_x86_64_msvc 0.52.6",
 ]
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -3687,6 +4596,12 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -3705,6 +4620,12 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -3729,6 +4650,12 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -3747,6 +4674,12 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -3759,6 +4692,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -3777,6 +4716,12 @@ version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -3827,12 +4772,123 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "x11"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "502da5464ccd04011667b11c435cb992822c2c0dbde1770c988480d312a0db2e"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "xcursor"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "163b33ed8786455e2fa5d72f554057ce3f3182425434f756cd39c99839d88e23"
+
+[[package]]
+name = "xkeysym"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
 
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.47",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.2"
diff --git a/server/Cargo.toml b/server/Cargo.toml
index d776610..4281255 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -17,7 +17,7 @@ path = "src/utils.rs"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-hbb_common = { path = "libs/hbb_common" }
+hbb_common = { path = "../libs/hbb_common" }
 serde_derive = "1.0"
 serde = "1.0"
 serde_json = "1.0"
@@ -61,11 +61,7 @@ reqwest = { git = "https://github.com/rustdesk-org/reqwest", features = ["blocki
 reqwest = { git = "https://github.com/rustdesk-org/reqwest", features = ["blocking", "socks", "json", "rustls-tls", "rustls-tls-native-roots", "gzip"], default-features=false }
 
 [build-dependencies]
-hbb_common = { path = "libs/hbb_common" }
-
-[workspace]
-members = ["libs/hbb_common"]
-exclude = ["ui"]
+hbb_common = { path = "../libs/hbb_common" }
 
 #https://github.com/johnthagen/min-sized-rust
 #https://doc.rust-lang.org/cargo/reference/profiles.html#default-profiles
diff --git a/server/src/common.rs b/server/src/common.rs
index 0efab01..c11502c 100644
--- a/server/src/common.rs
+++ b/server/src/common.rs
@@ -1,6 +1,8 @@
 use clap::App;
 use hbb_common::{
-    allow_err, anyhow::{Context, Result}, get_version_number, log, tokio, ResultType
+    allow_err,
+    anyhow::{Context, Result},
+    get_version_number, log, tokio, ResultType,
 };
 use ini::Ini;
 use sodiumoxide::crypto::sign;
@@ -189,7 +191,6 @@ pub async fn listen_signal() -> Result<()> {
     unreachable!();
 }
 
-
 pub fn check_software_update() {
     // Disabled - no external update checks
-}
\ No newline at end of file
+}
diff --git a/server/src/hbbr.rs b/server/src/hbbr.rs
index 4c8a784..8c86d4e 100644
--- a/server/src/hbbr.rs
+++ b/server/src/hbbr.rs
@@ -4,7 +4,9 @@ mod relay_server;
 use flexi_logger::*;
 use hbb_common::{config::RELAY_PORT, ResultType};
 use relay_server::*;
-mod version;
+mod version {
+    include!(concat!(env!("OUT_DIR"), "/version.rs"));
+}
 
 fn main() -> ResultType<()> {
     let _logger = Logger::try_with_env_or_str("info")?
diff --git a/server/src/lib.rs b/server/src/lib.rs
index 78aa01f..5f3a8cf 100644
--- a/server/src/lib.rs
+++ b/server/src/lib.rs
@@ -3,5 +3,7 @@ pub use rendezvous_server::*;
 pub mod common;
 mod database;
 mod peer;
-mod version;
-pub mod jwt;
\ No newline at end of file
+mod version {
+    include!(concat!(env!("OUT_DIR"), "/version.rs"));
+}
+pub mod jwt;
diff --git a/server/src/relay_server.rs b/server/src/relay_server.rs
index 55e6537..0bb38ee 100644
--- a/server/src/relay_server.rs
+++ b/server/src/relay_server.rs
@@ -69,8 +69,10 @@ async fn write_set_to_file(file: &str, lock: &RwLock<HashSet<String>>) {
         drop(f);
         std::fs::rename(&tmp, &file_owned)?;
         Ok(())
-    }).await {
-        Ok(Ok(())) => {},
+    })
+    .await
+    {
+        Ok(Ok(())) => {}
         Ok(Err(e)) => log::error!("Failed to write {}: {}", file, e),
         Err(e) => log::error!("spawn_blocking failed for {}: {}", file, e),
     }
diff --git a/win-builder/README.md b/win-builder/README.md
index 3888774..2c0d17b 100644
--- a/win-builder/README.md
+++ b/win-builder/README.md
@@ -1,9 +1,9 @@
-# win-builder — ❄️ FROZEN / FALLBACK
+# win-builder — ❄️ FROZEN / MANUAL-HISTORICAL ONLY
 
 > **Not in use.** Active build path is GitHub Actions
 > ([github-build/](../github-build/README.md)).
 >
-> This is a contingency for when GitHub Actions becomes unavailable.
+> This is manual/historical reference material, not a current production fallback.
 > Code is untested (no Windows host available).
 
 ## What it is
@@ -17,7 +17,7 @@ API channel: SMB share of the `rdgen-data` volume.
 - `agent.ps1` — SMB queue poller: 3 injection layers + build
 - `SERVER-SETUP.md` — detailed deployment guide
 
-## If activated
+## Historical/manual procedure (not the current API path)
 
 1. Windows Server 2022 / Win 11 Pro, 8+ core, 32 GB, 250 GB NVMe
 2. `setup.ps1 -KitPath D:\offline-kit\artifacts`
diff --git a/win-builder/SERVER-SETUP.md b/win-builder/SERVER-SETUP.md
index 8b59904..a73887c 100644
--- a/win-builder/SERVER-SETUP.md
+++ b/win-builder/SERVER-SETUP.md
@@ -1,11 +1,11 @@
-# SERVER-SETUP — ❄️ FROZEN / FALLBACK
+# SERVER-SETUP — ❄️ FROZEN / MANUAL-HISTORICAL ONLY
 
 > **Not active.** Active path is GitHub Actions.
-> Kept as reference in case a standalone Windows builder is ever needed.
+> Kept as manual/historical reference only; it is not a current production fallback.
 
 ---
 
-## Activation checklist
+## Historical/manual reference checklist
 
 - [ ] Windows Server 2022 or Win 11 Pro
 - [ ] 8+ vCPU, 32 GB RAM, 250 GB NVMe
@@ -29,5 +29,5 @@
 ## Security
 
 - Private network only. No public RDP/SMB.
-- Internet can be disabled after setup (`cargo build --offline`).
+- A network-denied full build is not verified by this historical checklist.
 - SMB user `builder` — minimum rights on the share.
diff --git a/win-builder/setup.ps1 b/win-builder/setup.ps1
index e951e32..7e65f18 100644
--- a/win-builder/setup.ps1
+++ b/win-builder/setup.ps1
@@ -12,7 +12,9 @@
 # vcpkg), иначе качает из сети. Для суверенной установки используйте -KitPath.
 #
 # ⚠️ DESIGN-АРТЕФАКТ, НЕ ПРОВЕРЕН на живом Windows-сервере. [VERIFY] = места риска.
-# Версии — пины из offline-kit/versions.env (тег rustdesk 1.4.7).
+# Historical/frozen note: this legacy builder was authored against the dated
+# RustDesk 1.4.7 kit. The published client is 1.4.8; this script is not the
+# current provider-backed API build path.
 # ============================================================================
 param(
     [string]$KitPath = ""