feat(hub): external capability registry for PDF/ASR transforms (ADR-0027)

Introduces the External Capability abstraction: platform-registered, org-enabled document/media transform services invoked as side effects of an AgentRun. The first concrete capability is pdf_to_md_bundle backed by MinerU. This lands the contract, schema, adapter interface, and a fully mock-tested adapter; the real MinerU HTTP client is deferred until credentials and pricing are confirmed. Contract: - spec/Spec/System/Agent/Capability.lean pins ExternalCapability, OrganizationCapabilityConnection (reuses ADR-0024 envelope, distinct from model-provider connection), and CapabilityInvocation.Authorized (workspace containment predicate, ADR-0018). lake build green (41 jobs). - ADR-0027 records why capability credentials are a separate connection type (MinerU/Whisper have their own auth shape, not OpenRouter /v1/models), the adapter seam, and what is deferred (capability invocation record, pricebook, agent-facing tool discovery). Schema: - OrganizationCapabilityConnection + CapabilityCredentialVersion, mirroring the Feishu Application Connection shape. Unique by (organizationId, capabilityId). Migration 20260718130000 applied. Adapter (hub/src/capability): - types.ts: CapabilityId, CapabilityAdapter interface, secret payload, CapabilityConnectionUnavailable. - mineruClient.ts: MineruClient interface + MineruParseResult + errors. Real HTTP client deferred; the interface is the seam. - capabilityConnections.ts: resolveCapabilityCredential — org-scoped, fail-closed, reuses LocalSecretEnvelope with purpose="capability". - pdfToMdBundle.ts: adapter that resolves credential, confines input/output to the run workspace (ADR-0018), calls MineruClient, writes md + images into workspace, and writes a UsageFact (kind=external_capability, quantity=pages, costSource=provider_reported|unknown per ADR-0022). Tests (7, all green): - md + images written to workspace, UsageFact attributes pages + cost - costUsd null -> costSource=unknown (missing cost != zero, ADR-0022) - no ACTIVE connection -> fail-closed, no fact written - input/output path escape -> CapabilityPathEscape - MinerU client error propagates, no fact written - empty markdown -> parse failure Deferred (needs operator): MinerU account/API key/pricing, real MineruClient HTTP implementation, org admin UI for capability connection management, agent-facing tool exposure (MCP vs built-in).
2026-07-18 15:54:00 +08:00
151 changed files with 2575 additions and 7615 deletions
@@ -1,12 +1,12 @@
 name: checker check

 # Builds and lints the Rust implementation crates under crates/ (the rule-based
-# lesson checker).
+# checker that "stands in Lean's position" at product runtime).
 #
-# This is an INTERNAL gate on the implementation's own health
-# (does it build, pass its tests, satisfy clippy + rustfmt?). There is no
-# decision-to-implementation conformance gate — implementations align to the
-# ADRs by human review, not by CI. See the repo README.
+# Like spec-check, this is an INTERNAL gate on the implementation's own health
+# (does it build, pass its tests, satisfy clippy + rustfmt?). It is NOT a
+# spec-to-implementation conformance gate — implementations align to the Lean
+# contract by human review, not by CI. See the repo README.

 on:
  push:
@@ -1,8 +1,8 @@
 name: hub check

 # Builds, type-checks, and tests the Hub TS package under hub/.
-# The Hub is the Feishu-group collaboration + agent runtime half.
-# This is an INTERNAL gate on the Hub's own
+# The Hub is the Feishu-group collaboration + agent runtime half
+# (spec/System implementation). This is an INTERNAL gate on the Hub's own
 # health, like checker-check is for the Rust half.

 on:
@@ -0,0 +1,20 @@
+name: spec check
+
+# Builds the Lean semantic master spec under spec/.
+# This is an INTERNAL well-formedness gate (does the contract type-check?),
+# NOT a spec-to-implementation conformance gate — implementations align to the
+# contract by human review, not by CI. See repo README.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  spec-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: leanprover/lean-action@v1
+        with:
+          lake-package-directory: spec
@@ -1,3 +1,7 @@
+# Lean / Lake build artifacts (spec/ has its own .gitignore too)
+.lake/
+**/.lake/
+
 # Rust / Cargo build artifacts (repo-wide cargo workspace at root)
 /target
 **/*.pdf
@@ -29,7 +29,7 @@ workload brakes.

 The full current-state inventory, accepted behavior, and release evidence are
 recorded in [Initial abuse and capacity controls](../assets/initial-abuse-capacity-controls.md),
-with the durable decision in ADR-0022. Numerical
+with the durable decision in ADR-0022 and `Spec.System.Capacity`. Numerical
 ceilings remain open until production-like calibration.

 The implementation frontier is:
@@ -7,6 +7,6 @@ Blocked by: 01, 02, 03, 04, 05, 06, 07, 09, 10, 11, 12, 13, 14, 15, 16, 17, 18,
 ## Question

 After the readiness investigations and resulting fixes are resolved, can one
-repeatable release procedure prove build/test health, deploy a clean
+repeatable release procedure prove build/test/spec health, deploy a clean
 production-like environment, exercise critical tenant and agent journeys,
 verify observability and recovery, and either roll forward or roll back safely?
@@ -8,7 +8,7 @@ Blocked by: 04

 Separate or unify run-bound audit entries, pre-run security/permission events,
 structured messages, and operational recovery events without weakening
-the pinned AuditEntry-to-run relation. Decide durability,
+`Spec.System.Audit`'s pinned AuditEntry-to-run relation. Decide durability,
 failure, retention, and query semantics; then enforce referential integrity and
 observable/recoverable writes instead of silently swallowing lost evidence.
 Do not merge these customer Project/Run records with ADR-0023's already-decided
@@ -40,7 +40,9 @@ an off-host recovery key, an incident and reason, and issues only an expiring
 Emergency Platform Grant.

 The complete accepted decision and implementation divergences are in
-[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md),
+[ADR-0023](../../../docs/adr/0023-platform-administrator-identity-and-audit.md).
+The pinned semantic invariants are in
+[`Spec.System.PlatformAdministration`](../../../spec/Spec/System/PlatformAdministration.lean),
 and the canonical terms are in [`CONTEXT.md`](../../../CONTEXT.md).

 Exact numeric session/invitation/step-up limits and browser mechanics remain
@@ -1,25 +1,29 @@
 # AGENTS.md —— agent 操作手册(全 repo)

-本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。

 ## 这个 repo 是什么

- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
+  `Spec.System.ProjectWorkspace`)。
 - 每个 org 自选 BYOK 或平台托管 model provider connection;平台托管也必须是该 org
-  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021)。
+  独享的 key/base URL,不得让无关 org 共用 process-global provider key(见 ADR-0021 /
+  `Spec.System.Organization`)。
 - Feishu/provider secret 使用本地版本化 master-key keyring 的信封加密;生产由 systemd
  credential 注入,运行时只允许显式 org/project scope 的 fail-closed resolver,不得回退
  process-global credential;Agent child 只接收 run-scoped loopback proxy capability,
-  不接收 org provider credential(见 ADR-0024)。
+  不接收 org provider credential(见 ADR-0024 / `Spec.System.Organization`)。
 - 生产容量按不可突破的 platform ceiling 与 org 可下调 policy 分层;有效限制取两者较低值。
-  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022)。
+  Agent admission 必须持久、有界、跨 org 公平且显式背压(见 ADR-0022 /
+  `Spec.System.Capacity`)。
 - 平台管理员只通过独立的 platform-owned 飞书应用与可撤销 Platform Session 认证,不复用
  客户 `User`/org membership;平台写操作与 append-only audit 同事务,break-glass 只走
-  双因子的离线恢复流程(见 ADR-0023)。
+  双因子的离线恢复流程(见 ADR-0023 / `Spec.System.PlatformAdministration`)。
 - 受控 alpha 暂采用一 Organization 一具名 systemd Silo:独立 database role/database、
  service identity、workspace、keyring 与 Feishu/provider connection；进程必须由
  `HUB_SILO_ORGANIZATION_ID` fail-closed 绑定唯一 org，平台后台不开放。共享 SaaS
@@ -40,12 +44,12 @@

 ## 纪律

-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。

-2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。

-3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。

-4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。

 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。
@@ -1,23 +1,25 @@
 # CLAUDE.md —— agent 操作手册(全 repo)

-本 repo 是 monorepo。先读根 `README.md` 的"宪法"4 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。
+本 repo 是 monorepo。先读根 `README.md` 的"宪法"5 条,那是一切工作的前提。本文件是给在这里干活的 coding agent 的纪律。

 ## 这个 repo 是什么

- `docs/adr/` 是系统级决策的唯一权威来源;`CONTEXT.md` 是平台语言词汇表;代码注释把关键不变量锚到 ADR 编号,可 grep。
+- `spec/` 是一份**人机共识的契约**(Lean 语义母本),是产品语义的上游参照。
+- 其余部件(将来的 `spec/` 外文件夹)是**向 `spec/` 对齐的实现**。
 - `hub/` 的平台层按 SaaS 形态演进:`Organization` 是 tenant root;`Project`/`Team`
-  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020)。
+  必须归属 org,TEAM→PROJECT 授权不得跨 org(见 ADR-0020 / `Spec.System.Organization`)。
 - org 后台 project explorer 里 `Folder` 是透明组织节点,不是权限资源;project 仍是权限边界。
-  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021)。
+  普通老师可在飞书群自助建 project 但受 org policy 控制(见 ADR-0021 /
+  `Spec.System.ProjectWorkspace`)。

 ## 纪律

-1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。ADR 与 `CONTEXT.md` 是语义的唯一权威来源;没写的,就是没定的。
+1. **不得用预训练先验脑补本领域。** 这个领域很新,你没有相关先验。契约里 prose doc 注释是语义的唯一权威来源;契约没写的,就是没定的。

-2. **凡 ADR 未写明者,不得假设。** 遇到没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。
+2. **凡契约未写明者,不得假设。** 遇到标了 `OPEN` 的地方,或契约根本没覆盖的地方,**显式 surface 出来**让开发者决定,绝不擅自替它选一个解。

-3. **新语义决策进 ADR。** 跨部件的语义分歧点按编号顺延新增 `docs/adr/NNNN-*.md`;代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。已有 ADR 正文不改写历史——推翻旧决策就写新 ADR 标记 supersede。
+3. **改 `spec/` 必须保持其 `lake build` 通过。** 在 `spec/` 目录下跑 `lake build`。新增声明必须带 `/-- … -/` doc 注释和恰当标签(`PINNED` / `OPEN` / `ADR-NNNN`)。规范见 `spec/README.md`。不准用 `sorry` 把 build 糊绿。

-4. **实现向 ADR 对齐;偏离必须 surface。** 没有 CI gate 替你把关 ADR↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与决策不一致时,报告它,不要默默让其中一边将就另一边。
+4. **实现向契约对齐;偏离必须 surface。** 没有 CI gate 替你把关 spec↔实现的一致性(见宪法第 2 条)——这道对齐靠 review 和你巡逻 diff。发现实现与契约不一致时,报告它,不要默默让其中一边将就另一边。

 5. **写操作谨慎。** 线上操作、git 写操作前与开发者确认(这是开发者的全局偏好)。
@@ -2,7 +2,7 @@

 教研生产的数字化解决方案。核心思路:课程像 DAW / 剪辑软件那样有一个**结构化的工程文件**;coding agent 协助编辑它;一个 rule-based checker(类编译器)校验其合法性并给出 helpful fix hint。目标是把教研从一次性的文档,沉淀成**可累积、可校验、可复用的资产**。

-这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`docs/adr/` 是系统级决策的唯一权威来源,代码注释把关键不变量锚到 ADR 编号,可 grep。**
+这是一个 **monorepo**。它的组织方式本身就表达了一条原则:**`spec/` 是上游的语义母本,其余部件是向它对齐的实现。**

 ## 安装 `cph` 命令行

@@ -33,40 +33,47 @@ cph completions zsh > ~/.zfunc/_cph        # 或 bash/fish/powershell/elvish
 ```
 README.md          ← 本文件:总览 + 宪法(下面 5 条)
 CLAUDE.md          ← 全局 agent 操作手册(管整个 repo)
-docs/adr/          ← 系统级架构决策记录(跨部件,决策的唯一权威来源)
-CONTEXT.md         ← 平台语言词汇表(术语与禁用说法)
+docs/adr/          ← 系统级架构决策记录(跨部件,被 spec 契约引用)
+spec/              ← Lean 语义母本(自包含的 Lean 工程)。见 spec/README.md
 Cargo.toml         ← 仓库级 cargo workspace(实现部件共用,便于跨部件复用 crate)
-crates/            ← 实现:rule-based checker(语义由 ADR 锚定)。见 crates/README.md
+crates/            ← 实现:rule-based checker(向 spec 对齐)。见 crates/README.md
  cph-diag / cph-model / cph-schema / cph-typst   ← 可复用基础(模型/校验/typst 引擎)
  cph-check / cph-cli                             ← checker 本体 + `cph` 命令行
-render/            ← typst 渲染包 cph-render(checker 的渲染后端,ADR-0005)
+render/            ← typst 渲染包 cph-render(母本的渲染后端之一,ADR-0005)
 examples/          ← 样例工程文件(如 TH-141),流水线的真实输入
 hub/              ← SaaS Hub:飞书协作、org 管理、agent runtime 与生产部署
-(exporter/ …)     ← 将来的其他部件,平级于 crates/
+(exporter/ …)     ← 将来的其他部件,平级于 spec/
 ```

+`spec/` 与实现部件**物理分离、平级共存**:谁是上游、谁向谁对齐,一眼可见。
 实现部件共用一个仓库根的 cargo workspace,使基础 crate(模型、typst 引擎)能被
 未来部件(如 exporter)复用,而非各自重造。

 ## 宪法

-这 4 条是本仓库的协作约定,是一切工作的前提。
+这 5 条是 `spec/` 这份语义母本的定位与约束,是本仓库一切工作的前提。

-1. **角色 —— ADR 是决策真相。**
-   跨部件的语义决策只记录在 `docs/adr/`,一份决策一份 ADR,编号顺延、正文不改写历史。代码里的关键不变量用注释锚到 ADR 编号,保持可 grep。没有第二份权威文档。
+1. **角色 —— Lean 是研发侧的上游参照。**
+   `spec/` 用 Lean 编写,是开发者(领域专家)与 coding agent **共用**的 spec 工具,用来沉淀产品各部件的**语义**。它**不进入产品运行时**——产品里"站在 Lean 这个位置"的那个 checker 用什么技术实现,尚未决定;但那个东西的语义,先在 `spec/` 里固定下来。

-2. **对齐机制 —— 人肉承载,无机器兜底。**
-   CI 只验各部件自身良构(build / test / clippy),**没有**决策↔实现的一致性 gate。实现对齐 ADR,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。发现漂移,报告它,不要默默让其中一边将就另一边。
+2. **对齐机制 —— Lean 只做上游参照。**
+   不做 extract / codegen,不派生 conformance test,CI 里**没有** spec→实现的 gate。实现对齐 spec,由"开发者 review + agent 巡逻 diff"这个人肉环节承载。
+   (CI 里的 `spec check` 只验 spec **自身**能否 type-check,即契约内部良构,不是 spec↔实现的对齐检查。)

-3. **形态 —— 自包含。**
-   凡 ADR 未明文规定的,开发者与 agent 双方都不该假设;遇到没覆盖的地方,**显式 surface** 出来让开发者决定。
+3. **资产性 —— 由 review 纪律承载,无机器兜底。**
+   这份仓库给你的是"精确、自洽、机器验内部良构的语义共识",**不是**"实现正确性保证"。spec 与实现之间那道缝,是我们自愿用人来守的——清醒地守,它就是资产;放任实现漂移而不回头同步,它就退化成最贵的过期文档。

-4. **深度判据 —— 只收录分歧点。**
-   一条语义该不该写进 ADR,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进 ADR;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
-   深度上限是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。
+4. **形态 —— 它是人机共识的契约。**
+   契约必须**自包含**:凡契约未明文规定的,开发者与 agent 双方都不该假设。这比"文档"严格——type checker 会逼这份契约在结构上无洞。
+
+5. **深度判据 —— 只收录分歧点。**
+   一条语义该不该写进 Lean,取决于一句话:**"不写明,开发者与 agent 会不会各自做出不同假设?"** 会 → 进契约;显然的东西 / 纯 plumbing / 普通 CRUD 字段 → 不进(写进去只稀释信噪比、增加维护面)。
+   深度上限不是 Lean 的表达力,而是**你愿意在每次实现变更时手动回头同步的量**——写得比你能维护的更深,多出来的部分会率先过期、反过来误导实现。

 ## CI

+`.gitea/workflows/spec-check.yml` 在每次 push / PR 时于 `spec/` 下跑 `lake build`,确保契约始终 type-check 通过(从第一天起就是"绿"的)。这是良构 gate,见宪法第 2 条。
+
 Rust checker 的本地与 CI 工具链由根 `rust-toolchain.toml` 固定;`.gitea/workflows/checker-check.yml`
 必须安装同一精确版本并执行 `cargo fmt --all --check`、Clippy `-D warnings` 与 workspace
 全测试。升级 Rust 时这两处必须在同一提交更新并通过完整 checker gate。
@@ -1,8 +1,7 @@
 # crates/

-These crates implement the rule-based lesson checker whose semantics are
-pinned by the ADRs in `docs/adr/`: it reads an engineering-file (one lesson,
-ADR-0005)
+These crates implement the rule-based lesson checker that aligns to the
+semantic master in `spec/`: it reads an engineering-file (one lesson, ADR-0005)
 laid out per ADR-0008 (declarative `manifest.toml` + per-element
 `element.toml`), validates structure and content, and emits diagnostics.
 `cph-diag` (the shared diagnostic vocabulary), `cph-model` (the ADR-0008 loader),
@@ -19,11 +19,13 @@ const DEFAULT_TARGET: &str = "student";

 /// Severity of the render-coverage ("element ignored under a target") diagnostic.
 ///
-/// **PINNED to `warning` by ADR-0005:** when a
+/// **PINNED to `warning` by the contract.** Mirrors the Lean master's
+/// `Spec.Courseware.renderIgnoredSeverity : Severity := .warning`
+/// (`spec/Spec/Courseware/Check/Diagnostic.lean`), itself citing ADR-0005: when a
 /// `(kind, target)` pair has no render rule the checker reports that the element
 /// is ignored under that target and **does not block the export**. Naming the
-/// severity as a const makes "it is a warning, not an error" a greppable
-/// fact rather than an inline literal.
+/// severity as a const makes "it is a warning, not an error" a greppable,
+/// alignable fact rather than an inline literal.
 const RENDER_IGNORED_SEVERITY: Severity = Severity::Warning;

 /// The result of running [`check`] (or the check phases of [`build`]).
@@ -55,12 +57,12 @@ impl CheckReport {

    /// Whether any collected diagnostic is `Error`-severity.
    ///
-    /// **Legality decision (ADR-0010).** `!has_errors()` decides lesson
-    /// legality: a lesson is *legal* iff its diagnostics contain no error-level
-    /// diagnostic (warnings are non-blocking — see `Severity`). There is no CI
-    /// gate enforcing ADR↔implementation alignment (repo constitution); it is
-    /// kept greppable here so a reviewer can tie the orchestrator's gate to
-    /// the ADR.
+    /// **Legality decision (spec alignment).** `!has_errors()` is the
+    /// implementation of `Spec.Courseware.Legal` (`spec/Spec/Courseware/Check/Diagnostic.lean`):
+    /// a lesson is *legal* iff its diagnostics contain no error-level diagnostic
+    /// (warnings are non-blocking — see `Severity` / ADR-0010). There is no CI
+    /// gate enforcing this alignment (repo constitution); it is kept greppable
+    /// here so a reviewer can tie the orchestrator's gate to the Lean master.
    pub fn has_errors(&self) -> bool {
        self.diagnostics
            .iter()
@@ -2,7 +2,7 @@
 //!
 //! Every other crate in the workspace depends on these types to report
 //! problems. The vocabulary is intentionally small and stable: a [`Severity`]
-//! (two-valued, ADR-0010), a closed set of machine-stable [`DiagCode`]s, an
+//! (mirroring the Lean master), a closed set of machine-stable [`DiagCode`]s, an
 //! optional [`SourceSpan`] pointing back at the offending source, and a
 //! [`Diagnostic`] tying them together with a human message and a fix hint.
 //!
@@ -17,27 +17,32 @@ use serde::Serialize;

 /// Severity of a diagnostic.
 ///
-/// **Pinned by ADR-0005 / ADR-0010: exactly two values.**
+/// **Mirrors `Spec.Courseware.Diagnostic.Severity`** in the Lean semantic
+/// master (`spec/Spec/Courseware/Check/Diagnostic.lean`), whose definition is
+/// exactly:
 ///
 /// ```text
-/// warning | error
+/// inductive Severity where
+///   | warning
+///   | error
 /// ```
 ///
-/// This two-valued shape is a **contract decision**, not an accident: the
-/// finer levels (`info` / `hint` / `note`) are deliberately undecided, so we
+/// This two-valued shape is a **contract decision**, not an accident: the Lean
+/// module pins `Severity` to exactly `warning | error` and states the finer
+/// levels (`info` / `hint` / `note`) are deliberately undecided. We therefore
 /// do **not** add an info/note level here. `error` blocks (the artifact is
 /// invalid); `warning` does not block (the artifact still exports, but with
 /// loss / an ignored element — e.g. ADR-0005's "missing render ⇒ warning").
 ///
-/// There is no CI gate enforcing ADR↔implementation alignment (see the repo
-/// constitution); it is maintained by review, which is why the decision is
-/// documented here rather than only in the ADR.
+/// There is no CI gate enforcing this alignment (see the repo constitution);
+/// it is maintained by review, which is why this correspondence is documented
+/// here rather than only in the spec.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum Severity {
    /// Non-blocking: the artifact still exports, but is lossy / has an ignored
-    /// element. ADR-0010 `warning`.
+    /// element. Mirrors Lean `Severity.warning`.
    Warning,
-    /// Blocking: the artifact is invalid. ADR-0010 `error`.
+    /// Blocking: the artifact is invalid. Mirrors Lean `Severity.error`.
    Error,
 }

@@ -3,7 +3,9 @@
 //! This crate is the **loader**, not the full checker. It reads
 //! `<root>/manifest.toml` (project / info / ordered `[[parts]]` / declared
 //! `[targets.*]`) and each part's `<root>/<path>/element.toml`, and produces an
-//! ordered [`Lesson`], where the order of `parts` carries teaching semantics.
+//! ordered [`Lesson`] — mirroring the Lean master's `Lesson = List (Element P)`
+//! (`spec/Spec/Courseware/Model/Lesson.lean`), where the order of `parts` carries
+//! teaching semantics.
 //!
 //! Scope boundaries (deliberately staying in lane):
 //! - It validates **structure** only: manifest shape, element.toml shape, and
@@ -21,7 +23,7 @@ use serde::{Deserialize, Serialize};

 /// An ordered, in-memory lesson loaded from an engineering file.
 ///
-/// `parts` is an ordered
+/// Mirrors the Lean master's `Lesson = List (Element P)`: `parts` is an ordered
 /// `Vec`, and that order is the lesson's order (ADR-0008 §"the lesson manifest
 /// is declarative" — the `[[parts]]` array order is the single source of truth).
 #[derive(Debug, Clone, PartialEq, Serialize)]
@@ -84,8 +86,9 @@ pub struct TargetConfig {
    /// with template `exports/<name>.typ` when no `[[steps]]` are given.
    pub steps: Vec<Step>,
    /// The **render-coverage declaration**: which element kinds this target
-    /// renders. Realizes ADR-0011's "render
-    /// coverage is a declaration, not a payload": the declaration keeps *which
+    /// renders. Realizes `Spec.Courseware.TargetSpec.covers : KindId → Prop`
+    /// (`spec/Spec/Courseware/Export/Render.lean`) and ADR-0011's "render
+    /// coverage is a declaration, not a payload": the contract keeps *which
    /// kinds a target renders* (used by the `renderIgnored` seed diagnostic),
    /// while the rendering "how" lives in the template/steps.
    ///
@@ -99,10 +102,13 @@ pub struct TargetConfig {

 /// The artifact an export target produces (ADR-0009/0011).
 ///
-/// **Pinned by ADR-0011** as an ADT with fields:
+/// **Mirrors `Spec.Courseware.Artifact`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Artifact.lean`), whose definition is exactly:
 ///
 /// ```text
-/// Artifact = singleFile (filepath) | fileTree (root, outputs)
+/// inductive Artifact where
+///   | singleFile (filepath : String)
+///   | fileTree (root : String) (outputs : String)
 /// ```
 ///
 /// ADR-0011 pinned the artifact as an ADT **with fields**: "what the product
@@ -114,20 +120,20 @@ pub struct TargetConfig {
 /// `"single-file"` → [`Artifact::SingleFile`], `"file-tree"` →
 /// [`Artifact::FileTree`].
 ///
-/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing ADR↔
-/// implementation alignment (see the repo constitution) — it is maintained by
-/// review, which is why the decision is documented here.
+/// As with `cph-diag`'s `Severity`, there is no CI gate enforcing this
+/// alignment (see the repo constitution) — it is maintained by review, which is
+/// why the correspondence is documented here.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Artifact {
    /// One bundled document landing at `filepath` (relative to the engineering
-    /// root). ADR-0011 `singleFile`. The default artifact shape.
+    /// root). Mirrors Lean `Artifact.singleFile`. The default artifact shape.
    SingleFile {
        /// Where the single product is written (relative to the engineering
        /// root), e.g. `build/student.pdf`.
        filepath: PathBuf,
    },
-    /// A set of files under `root` matching the `outputs` glob. ADR-0011
-    /// `fileTree`.
+    /// A set of files under `root` matching the `outputs` glob. Mirrors Lean
+    /// `Artifact.fileTree`.
    FileTree {
        /// The output directory (relative to the engineering root).
        root: PathBuf,
@@ -150,10 +156,14 @@ impl Artifact {

 /// One typed build step (ADR-0011).
 ///
-/// **Pinned by ADR-0011** as an ADT:
+/// **Mirrors `Spec.Courseware.Step`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Export/Render.lean`), whose definition is exactly:
 ///
 /// ```text
-/// Step = typstCompile (template) | shell (run) | assembleMarkdown (field)
+/// inductive Step where
+///   | typstCompile (template : String)
+///   | shell (run : String)
+///   | assembleMarkdown (field : String)
 /// ```
 ///
 /// A step is a *typed* operation (extensible): `TypstCompile` compiles a
@@ -173,20 +183,20 @@ impl Artifact {
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub enum Step {
    /// Compile a template file (relative to the engineering root) into the
-    /// artifact; the framework injects the manifest. ADR-0011
-    /// `typstCompile`.
+    /// artifact; the framework injects the manifest. Mirrors Lean
+    /// `Step.typstCompile`.
    TypstCompile {
        /// The template file to compile as main, e.g. `exports/student.typ`.
        template: PathBuf,
    },
-    /// Run a shell command — the escape hatch. ADR-0011 `shell`.
+    /// Run a shell command — the escape hatch. Mirrors Lean `Step.shell`.
    Shell {
        /// The command line to run.
        run: String,
    },
    /// Assemble a single-file markdown deliverable by concatenating each
-    /// element's `field` markdown content file in `[[parts]]` order. ADR-0011
-    /// `assembleMarkdown` (ADR-0015). Not a typst build — the
+    /// element's `field` markdown content file in `[[parts]]` order. Mirrors
+    /// Lean `Step.assembleMarkdown` (ADR-0015). Not a typst build — the
    /// framework owns the read/concatenate/write itself.
    AssembleMarkdown {
        /// The per-element markdown content field to assemble (e.g. `slides`,
@@ -216,11 +226,12 @@ pub struct Project {

 /// `[info]` table (passed through to render targets verbatim).
 ///
-/// The *canonical* model whose
+/// **Mirrors `Spec.Courseware.Info`** in the Lean semantic master
+/// (`spec/Spec/Courseware/Model/Info.lean`): the *canonical* model whose
 /// `authors` is always a list. The authoring-surface form (string-or-array
 /// `author`) is the separate [`RawInfo`] / [`RawAuthor`], normalized into this
-/// at the load boundary. No
-/// CI gate enforces ADR↔implementation alignment (repo constitution); it is kept greppable.
+/// at the load boundary — mirroring the Lean `RawInfo` / `RawAuthor` split. No
+/// CI gate enforces this alignment (repo constitution); it is kept greppable.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 pub struct Info {
    /// Lesson title.
@@ -229,6 +240,7 @@ pub struct Info {
    /// so this is a list, not a single name. Empty when `[info]` declares no
    /// `author`. The on-disk `author` accepts either a bare string (one author)
    /// or an array of strings (see [`RawAuthor`]); both load into this `Vec`.
+    /// Mirrors Lean `Info.authors : List String`.
    pub authors: Vec<String>,
 }

@@ -278,7 +290,8 @@ struct RawProject {
    name: String,
 }

-/// The authoring-surface `[info]`: the raw form that exists for
+/// The authoring-surface `[info]` (mirrors Lean `RawInfo` in
+/// `spec/Spec/Courseware/Model/Info.lean`): the raw form that exists for
 /// fill-in convenience, normalized into the canonical [`Info`] at the load
 /// boundary. Not the form the rest of the model traffics in.
 #[derive(Debug, Deserialize)]
@@ -288,7 +301,7 @@ struct RawInfo {
 }

 /// On-disk `author`: either a single name (`author = "…"`) or a list
-/// (`author = ["…", "…"]`). A fill-in convenience whose
+/// (`author = ["…", "…"]`). Mirrors Lean `RawAuthor`: a fill-in convenience whose
 /// string-or-array union lives **only** at the load boundary — [`RawAuthor::into_vec`]
 /// folds it into the canonical [`Info::authors`] `Vec`, after which it never appears.
 #[derive(Debug, Deserialize)]
@@ -299,7 +312,7 @@ enum RawAuthor {
 }

 impl RawAuthor {
-    /// Flatten to the ordered author list: a single
+    /// Flatten to the ordered author list (Lean `RawAuthor.normalize`): a single
    /// name becomes a one-element list; a list passes through verbatim.
    fn into_vec(self) -> Vec<String> {
        match self {
@@ -32,7 +32,7 @@ App ID 通常以 `cli_` 开头，可以写入交付单。App Secret 必须通过
 | 接收群聊中 @ 机器人的消息 | `im:message.group_at_msg:readonly` |
 | 以应用身份发送消息 | `im:message:send_as_bot` |
 | 读取触发消息和线程上下文 | `im:message:readonly` |
-| 获取消息中的图片/文件，并向飞书上传图片或文件（含 Agent 回答中的图片发送） | `im:resource` |
+| 获取与上传图片或文件 | `im:resource` |
 | 添加、删除消息表情回复 | `im:message.reactions:write_only` |
 | 获取用户基本信息 | `contact:user.base:readonly` |
 | 获取用户基本资料 | `contact:user.basic_profile:readonly` |
@@ -66,9 +66,6 @@ Educraft 机器人以应用身份调用上述 API，因此这些 scope 全部放

 如果 API 调试台提示缺少更细粒度权限，请把错误提示和发生时间截图给部署人员。不要自行开通通讯录全量读取等超出本表的权限。

-说明：`im:resource` 既用于下载用户发来的图片/文件，也用于 Agent 回复时把本地或远程图片上传为飞书 `image_key` 后嵌入消息卡片。缺少该权限时，带图回答会发送失败或降级为无图文本。已开通该 scope 的存量应用一般无需新增权限，但若权限尚未随最新版本发布，请创建新版本并审核发布。
-
-
 ## 4. 配置事件与卡片回调

 进入“事件与回调”。
@@ -5,9 +5,6 @@ dist/
 .env.*
 !.env.example
 .secrets/
-.dev-keyring.json
-.dev-workspaces/
-.dev-skills/
 admin-web/node_modules/
 admin-web/build/
 admin-web/.svelte-kit/
@@ -168,16 +168,6 @@ export interface FeishuApplicationConnection {
 	updatedAt: string;
 }

-export interface CapabilityConnection {
-	id: string;
-	capabilityId: string;
-	status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
-	activeVersion: number | null;
-	keyId: string | null;
-	createdAt: string;
-	updatedAt: string;
-}
-
 export interface UsageTotals {
 	runCount: number;
 	runsWithCost: number;
@@ -193,81 +183,13 @@ export interface ProjectUsageRow extends UsageTotals {
 	folderId: string | null;
 }

-/** Ledger slice from UsageFact (ADR-0026): separates model tokens vs external meters. */
-export interface UsageBreakdownRow {
-	kind: string;
-	provider: string;
-	model: string | null;
-	capabilityId: string | null;
-	unit: string | null;
-	factCount: number;
-	factsWithCost: number;
-	factsWithoutCost: number;
-	inputTokens: number;
-	outputTokens: number;
-	quantity: number | null;
-	costUsd: number | null;
-}
-
 export interface UsageReport {
 	from: string | null;
 	to: string | null;
 	projects: ProjectUsageRow[];
 	totals: UsageTotals;
-	breakdown: UsageBreakdownRow[];
 }

-export interface ProjectUsageReport extends ProjectUsageRow {
-	from: string | null;
-	to: string | null;
-	breakdown: UsageBreakdownRow[];
-}
-
-export interface UsageFactRow {
-	id: string;
-	occurredAt: string;
-	kind: string;
-	provider: string;
-	model: string | null;
-	inputTokens: number | null;
-	outputTokens: number | null;
-	quantity: number | null;
-	unit: string | null;
-	costUsd: number | null;
-	costSource: string;
-	capabilityId: string | null;
-	correlationId: string | null;
-}
-
-export interface SessionRunRow {
-	id: string;
-	status: string;
-	model: string;
-	provider: string;
-	inputTokens: number | null;
-	outputTokens: number | null;
-	costUsd: number | null;
-	costSource: string | null;
-	startedAt: string;
-	finishedAt: string | null;
-	error: string | null;
-	usageFacts: UsageFactRow[];
-}
-
-export interface SessionDetail {
-	id: string;
-	provider: string;
-	roleId: string;
-	model: string;
-	title: string | null;
-	createdAt: string;
-	updatedAt: string;
-	archivedAt: string | null;
-	project: { id: string; name: string };
-	runs: SessionRunRow[];
-}
-
-
 export type CapacityDimension =
 	| 'requestRate'
 	| 'requestBodySize'
@@ -421,8 +343,6 @@ export const api = {
 		get(`${orgBase(slug)}/projects/${projectId}/sessions${limit !== undefined ? `?limit=${limit}` : ''}`) as Promise<{
 			sessions: SessionSummary[];
 		}>,
-	session: (slug: string, sessionId: string) =>
-		get(`${orgBase(slug)}/sessions/${encodeURIComponent(sessionId)}`) as Promise<SessionDetail>,
 	usage: (slug: string, params?: { from?: string; to?: string; folderId?: string }) => {
 		const q = new URLSearchParams();
 		if (params?.from) q.set('from', params.from);
@@ -431,16 +351,6 @@ export const api = {
 		const qs = q.toString();
 		return get(`${orgBase(slug)}/usage${qs ? `?${qs}` : ''}`) as Promise<UsageReport>;
 	},
-	projectUsage: (slug: string, projectId: string, params?: { from?: string; to?: string }) => {
-		const q = new URLSearchParams();
-		if (params?.from) q.set('from', params.from);
-		if (params?.to) q.set('to', params.to);
-		const qs = q.toString();
-		return get(
-			`${orgBase(slug)}/projects/${encodeURIComponent(projectId)}/usage${qs ? `?${qs}` : ''}`,
-		) as Promise<ProjectUsageReport>;
-	},
-

 	providerConnections: (slug: string) =>
 		get(`${orgBase(slug)}/provider-connections`) as Promise<{ connections: ProviderConnectionRow[] }>,
@@ -471,21 +381,6 @@ export const api = {
 	disableFeishuApplication: (slug: string) =>
 		del(`${orgBase(slug)}/feishu-application-connection`) as Promise<FeishuApplicationConnection>,

-	capabilityConnections: (slug: string) =>
-		get(`${orgBase(slug)}/capability-connections`) as Promise<{ connections: CapabilityConnection[] }>,
-	capabilityConnection: (slug: string, capabilityId: string) =>
-		get(`${orgBase(slug)}/capability-connections/${encodeURIComponent(capabilityId)}`) as Promise<{
-			connection: CapabilityConnection | null;
-		}>,
-	rotateCapabilityConnection: (
-		slug: string,
-		capabilityId: string,
-		body: { accessKeyId: string; accessKeySecret: string; endpoint: string },
-	) =>
-		put(`${orgBase(slug)}/capability-connections/${encodeURIComponent(capabilityId)}`, body) as Promise<CapabilityConnection>,
-	disableCapabilityConnection: (slug: string, capabilityId: string) =>
-		del(`${orgBase(slug)}/capability-connections/${encodeURIComponent(capabilityId)}`) as Promise<CapabilityConnection>,
-
 	capacityPolicy: (slug: string) => get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
 	setCapacityPolicy: (slug: string, body: { limits: Partial<Record<CapacityDimension, number | null>> }) =>
 		put(`${orgBase(slug)}/capacity-policy`, body) as Promise<CapacityPolicyView>,
@@ -33,7 +33,7 @@
 <div class="space-y-0.5">
 	{#each childProjects as p (p.id)}
 		<a
-			href={`/admin/projects/${p.id}`}
+			href={`/admin/org/${slug}/projects/${p.id}`}
 			class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
 		>
 			<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">
@@ -29,52 +29,6 @@ export function fmtNum(n: number): string {
 	return n.toLocaleString();
 }

-const USAGE_KIND_LABELS: Record<string, string> = {
-	model_completion: '模型完成',
-	external_capability: '外部能力',
-	tool_proxy: '工具代理',
-};
-
-const METER_UNIT_LABELS: Record<string, string> = {
-	pages: '页',
-	audio_seconds: '音频秒',
-	invocations: '次调用',
-};
-
-export function usageKindLabel(kind: string): string {
-	return USAGE_KIND_LABELS[kind] ?? kind;
-}
-
-export function meterUnitLabel(unit: string | null | undefined): string {
-	if (!unit) return '—';
-	return METER_UNIT_LABELS[unit] ?? unit;
-}
-
-export function fmtQuantity(quantity: number | null | undefined, unit: string | null | undefined): string {
-	if (quantity === null || quantity === undefined) return '—';
-	const u = meterUnitLabel(unit);
-	return u === '—' ? fmtNum(quantity) : `${fmtNum(quantity)} ${u}`;
-}
-
-export function fmtTokens(input: number | null | undefined, output: number | null | undefined): string {
-	const hasIn = input !== null && input !== undefined;
-	const hasOut = output !== null && output !== undefined;
-	if (!hasIn && !hasOut) return '—';
-	return `${fmtNum(input ?? 0)} / ${fmtNum(output ?? 0)}`;
-}
-
-export function runStatusLabel(status: string): string {
-	const key = status.toUpperCase();
-	if (key === 'COMPLETED') return '完成';
-	if (key === 'FAILED') return '失败';
-	if (key === 'CANCELED') return '取消';
-	if (key === 'TIMED_OUT') return '超时';
-	if (key === 'RUNNING') return '运行中';
-	if (key === 'QUEUED') return '排队';
-	return status;
-}
-
-
 export function orgRoleLabel(role: string): string {
 	const key = role.toUpperCase() as OrgRole;
 	return ORG_ROLE_LABELS[key] ?? role;
@@ -1,40 +0,0 @@
-import type { MeResponse, OrgMembership } from './api';
-
-/** Alpha Silo host prefix: <slug>.educraft[.dev].… */
-export function hostOrgSlug(hostname: string = typeof window !== 'undefined' ? window.location.hostname : ''): string | null {
-	const host = hostname.toLowerCase();
-	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
-	return m?.[1] ?? null;
-}
-
-export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
-	if (!org) return false;
-	const role = String(org.role ?? '').toUpperCase();
-	return role === 'OWNER' || role === 'ADMIN';
-}
-
-/**
- * Resolve the tenancy for this browser session.
- * Prefers hostname slug (silo), then ?org=, then first admin membership, then first membership.
- */
-export function resolveOrg(me: MeResponse | null | undefined, search: string = ''): OrgMembership | null {
-	if (!me || me.organizations.length === 0) return null;
-	const host = hostOrgSlug();
-	if (host) {
-		const byHost = me.organizations.find((o) => o.slug === host);
-		if (byHost) return byHost;
-	}
-	const q = new URLSearchParams(search).get('org')?.trim();
-	if (q) {
-		const byQuery = me.organizations.find((o) => o.slug === q);
-		if (byQuery) return byQuery;
-	}
-	const admin = me.organizations.find((o) => isOrgAdmin(o));
-	return admin ?? me.organizations[0] ?? null;
-}
-
-/** SPA paths no longer embed org slug (subdomain carries tenancy). */
-export function adminPath(rest: string = ''): string {
-	const cleaned = rest.replace(/^\/+/, '');
-	return cleaned === '' ? '/admin' : `/admin/${cleaned}`;
-}
@@ -35,9 +35,12 @@ export async function loadSession(): Promise<void> {
 /**
 * Resolve org slug for org-scoped Feishu OAuth (`GET /auth/feishu/:orgSlug`).
 * Unscoped `/auth/feishu` is disabled unless allowLegacyFeishuOAuth is on.
- * Path no longer carries tenancy: prefer hostname silo slug, then ?org=.
 */
 export function resolveLoginOrgSlug(): string | null {
+	const path = window.location.pathname.split('/').filter(Boolean);
+	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
+		return decodeURIComponent(path[2]);
+	}
 	const q = new URLSearchParams(window.location.search).get('org');
 	if (q && q.trim() !== '') return q.trim();

@@ -45,12 +48,6 @@ export function resolveLoginOrgSlug(): string | null {
 	const host = window.location.hostname.toLowerCase();
 	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
 	if (m?.[1]) return m[1];
-
-	// Legacy path while old bookmarks still land briefly before redirect.
-	const path = window.location.pathname.split('/').filter(Boolean);
-	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
-		return decodeURIComponent(path[2]);
-	}
 	return null;
 }

@@ -5,7 +5,6 @@
 	import { page } from '$app/state';
 	import { session, loadSession, logout, redirectToLogin } from '$lib/session';
 	import type { OrgMembership } from '$lib/api';
-	import { adminPath, isOrgAdmin, resolveOrg } from '$lib/org';
 	import { orgRoleLabel } from '$lib/format';
 	import Icon from '$lib/components/Icon.svelte';
 	import ToastHost from '$lib/components/ToastHost.svelte';
@@ -21,7 +20,6 @@

 	const navItems = [
 		{ key: 'overview', label: '概览', icon: 'overview' as const },
-		{ key: 'usage', label: '用量', icon: 'overview' as const },
 		{ key: 'members', label: '成员', icon: 'members' as const },
 		{ key: 'teams', label: '团队', icon: 'teams' as const },
 		{ key: 'projects', label: '项目', icon: 'projects' as const },
@@ -30,52 +28,68 @@
 		{ key: 'skills', label: '技能', icon: 'roles' as const },
 		{ key: 'roles', label: '角色', icon: 'roles' as const },
 		{ key: 'feishu', label: '飞书', icon: 'feishu' as const },
-		{ key: 'capabilities', label: '能力', icon: 'provider' as const },
 	];

+	function isAdmin(org: OrgMembership): boolean {
+		const role = String(org.role ?? '').toUpperCase();
+		return role === 'OWNER' || role === 'ADMIN';
+	}
+
+	function orgSlugFromPath(): string | null {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
+			return decodeURIComponent(parts[2]);
+		}
+		return null;
+	}
+
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
+	}
+
 	function memberships(): OrgMembership[] {
 		return $session.me?.organizations ?? [];
 	}

 	function adminOrgs(): OrgMembership[] {
-		return memberships().filter((o) => isOrgAdmin(o));
+		return memberships().filter(isAdmin);
 	}

 	function currentOrg(): OrgMembership | null {
-		return resolveOrg($session.me, page.url.search);
+		const slug = orgSlugFromPath();
+		if (!slug) return null;
+		return memberships().find((o) => o.slug === slug) ?? null;
 	}

-	function isOnProjectRoute(): boolean {
-		const parts = page.url.pathname.split('/').filter(Boolean);
-		// /admin/projects or /admin/projects/:id
-		return parts[0] === 'admin' && parts[1] === 'projects';
+	function pickHomeOrg(): OrgMembership | null {
+		const admin = adminOrgs()[0];
+		if (admin) return admin;
+		return memberships()[0] ?? null;
 	}

 	function activeKey(): string {
 		const parts = page.url.pathname.split('/').filter(Boolean);
-		if (parts[0] !== 'admin') return '';
-		// /admin → overview; /admin/usage → usage; /admin/projects/x → projects
-		return parts[1] ?? 'overview';
+		if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
+		return parts[3] ?? 'overview';
 	}

 	function navHref(key: string): string {
-		if (key === 'overview') return adminPath();
-		return adminPath(key);
+		const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
+		if (!slug) return '/';
+		if (key === 'overview') return `/admin/org/${slug}`;
+		return `/admin/org/${slug}/${key}`;
 	}

 	function pageTitle(): string {
 		const key = activeKey();
 		if (key === 'overview' || key === '') return '概览';
-		if (key === 'sessions') return '会话详情';
 		return navItems.find((i) => i.key === key)?.label ?? '管理后台';
 	}

 	function switchOrg(nextSlug: string) {
 		if (!nextSlug || nextSlug === currentOrg()?.slug) return;
-		// Path is tenancy-free; keep optional ?org= for local multi-membership debugging.
-		const url = new URL(page.url.href);
-		url.searchParams.set('org', nextSlug);
-		void goto(`${url.pathname}${url.search}`, { replaceState: true });
+		void goto(`/admin/org/${nextSlug}`);
 	}

 	function handleLogout(e: Event) {
@@ -98,23 +112,33 @@
 	$effect(() => {
 		if ($session.loading || !$session.me) return;

-		const path = page.url.pathname;
-		// Legacy /admin/org/:slug… is handled by admin/org/[...path] page.
+		const slug = orgSlugFromPath();
+		const matched = slug ? memberships().find((o) => o.slug === slug) : null;

-		const org = currentOrg();
+		// Org admins: route to their first admin org if none matched as admin.
 		const admins = adminOrgs();
-
-		if (org && isOrgAdmin(org)) {
+		if (matched && isAdmin(matched)) {
 			redirecting = false;
 			return;
 		}
+		if (!matched && admins.length > 0) {
+			const target = `/admin/org/${admins[0].slug}`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+			return;
+		}

-		// Member only: allow project routes; bounce admin-only surfaces to projects.
-		if (org && !isOrgAdmin(org)) {
+		// Members (non-admin): project pages are open to project MANAGE holders;
+		// the org overview and other admin-only surfaces are not for them.
+		if (matched && !isAdmin(matched)) {
 			redirecting = false;
-			if (!isOnProjectRoute()) {
-				const target = adminPath('projects');
-				if (path !== target) {
+			const parts = page.url.pathname.split('/').filter(Boolean);
+			const onOverview = parts.length === 3; // /admin/org/:slug
+			if (onOverview) {
+				const target = `/admin/org/${matched.slug}/projects`;
+				if (page.url.pathname !== target) {
 					redirecting = true;
 					void goto(target, { replaceState: true });
 				}
@@ -122,11 +146,12 @@
 			return;
 		}

-		// No org resolved but user has memberships → land on first org's projects/overview via resolveOrg next tick
-		if (!org && memberships().length > 0) {
-			const home = admins[0] ?? memberships()[0]!;
-			const target = isOrgAdmin(home) ? adminPath() : adminPath('projects');
-			if (path !== target && !path.startsWith(`${target}/`)) {
+		// No matched org and no admin orgs: route a member to their first org's
+		// projects page so they can reach project MANAGE surfaces.
+		if (!matched && memberships().length > 0) {
+			const home = memberships()[0];
+			const target = `/admin/org/${home.slug}/projects`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
 				redirecting = true;
 				void goto(target, { replaceState: true });
 			}
@@ -147,14 +172,14 @@
 					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
 				></path>
 			</svg>
-			<p class="text-sm">加载中…</p>
+			<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
 		</div>
 	</div>
 {:else if $session.error}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<div
-				class="mx-auto mb-3 flex h-12 w-12 items-center justify-center border border-error-200 bg-error-50 text-error-700"
+				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
 			>
 				!
 			</div>
@@ -167,7 +192,7 @@
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<div
-				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-sm font-bold text-white"
+				class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
 			>
 				CPH
 			</div>
@@ -176,7 +201,7 @@
 			<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
 		</div>
 	</div>
-{:else if currentOrg() && isOrgAdmin(currentOrg()!)}
+{:else if currentOrg() && isAdmin(currentOrg()!)}
 	{@const org = currentOrg()!}
 	{@const me = $session.me!}
 	<div class="saas-shell">
@@ -201,19 +226,17 @@
 				</div>
 				<div class="min-w-0">
 					<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
-					<div class="truncate text-xs text-surface-600">{org.name}</div>
+					<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
 				</div>
 			</div>

-			{#if me.organizations.length > 1}
-				<div class="px-3 pb-3">
-					<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
-						<Icon name="org" class="h-3.5 w-3.5" />
-						组织
-					</div>
-					<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			<div class="px-3 pb-3">
+				<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
+					<Icon name="org" class="h-3.5 w-3.5" />
+					组织
 				</div>
-			{/if}
+				<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			</div>

 			<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
 				<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
@@ -283,13 +306,13 @@
 			</main>
 		</div>
 	</div>
-{:else if currentOrg() && !isOrgAdmin(currentOrg()!) && isOnProjectRoute()}
+{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
 	{@const org = currentOrg()!}
 	{@const me = $session.me!}
 	<div class="saas-shell">
 		<div class="saas-main">
 			<header class="saas-topbar">
-				<a href={adminPath('projects')} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
+				<a href={`/admin/org/${org.slug}/projects`} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
 					<Icon name="menu" class="h-5 w-5" />
 				</a>
 				<div class="min-w-0">
@@ -318,7 +341,7 @@
 			</main>
 		</div>
 	</div>
-{:else if currentOrg() && !isOrgAdmin(currentOrg()!)}
+{:else if currentOrg() && !isAdmin(currentOrg()!)}
 	{@const denied = currentOrg()!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
@@ -327,7 +350,7 @@
 				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
 				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
 			</p>
-			<a class="saas-btn-primary" href={adminPath('projects')}>查看我的项目</a>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
 			{#if memberships().length > 1}
 				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
 				<div class="mb-4">
@@ -338,14 +361,14 @@
 		</div>
 	</div>
 {:else if memberships().length > 0}
-	{@const denied = resolveOrg($session.me) ?? memberships()[0]!}
+	{@const denied = pickHomeOrg()!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
 			<p class="mb-5 text-sm text-surface-700">
 				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
 			</p>
-			<a class="saas-btn-primary" href={adminPath('projects')}>立即进入</a>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
 			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
 		</div>
 	</div>
@@ -11,7 +11,7 @@
 			return r === 'OWNER' || r === 'ADMIN';
 		});
 		const target = admin ?? me.organizations[0];
-		return target ? `/admin` : null;
+		return target ? `/admin/org/${target.slug}` : null;
 	}

 	onMount(() => {
@@ -1,205 +0,0 @@
-<script lang="ts">
-	import { page } from '$app/state';
-	import { api, type CapabilityConnection } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
-	import { fmtDate } from '$lib/format';
-	import { Label } from 'bits-ui';
-	import PageHeader from '$lib/components/PageHeader.svelte';
-	import LoadingState from '$lib/components/LoadingState.svelte';
-	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
-	import { toastError, toastSuccess } from '$lib/toast';
-
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
-
-	const KNOWN_CAPABILITIES = [
-		{ id: 'pdf_to_md_bundle', label: 'PDF → Markdown', description: '将 PDF 转换为带图片的 Markdown bundle（阿里云文档智能，含公式 LaTeX 识别）' },
-		{ id: 'audio_video_to_text', label: '音视频 → 文本', description: '将音频/视频转写为文本（阿里云文档智能，按秒计费）' },
-	] as const;
-
-	let connections = $state<Map<string, CapabilityConnection>>(new Map());
-	let loading = $state(true);
-	let error = $state<string | null>(null);
-
-	let editingCap = $state<string | null>(null);
-	let accessKeyId = $state('');
-	let accessKeySecret = $state('');
-	let endpoint = $state('docmind-api.cn-hangzhou.aliyuncs.com');
-	let saving = $state(false);
-	let disabling = $state<string | null>(null);
-
-	async function load() {
-		loading = true;
-		error = null;
-		try {
-			const res = await api.capabilityConnections(slug);
-			connections = new Map(res.connections.map((c) => [c.capabilityId, c]));
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		} finally {
-			loading = false;
-		}
-	}
-
-	function startEdit(capId: string) {
-		editingCap = capId;
-		accessKeyId = '';
-		accessKeySecret = '';
-		endpoint = 'docmind-api.cn-hangzhou.aliyuncs.com';
-	}
-
-	function cancelEdit() {
-		editingCap = null;
-	}
-
-	async function save(capId: string) {
-		if (accessKeyId.trim() === '' || accessKeySecret.trim() === '' || endpoint.trim() === '') {
-			toastError('AccessKey ID、AccessKey Secret、Endpoint 均为必填');
-			return;
-		}
-		saving = true;
-		try {
-			const result = await api.rotateCapabilityConnection(slug, capId, {
-				accessKeyId: accessKeyId.trim(),
-				accessKeySecret: accessKeySecret.trim(),
-				endpoint: endpoint.trim(),
-			});
-			connections.set(capId, result);
-			connections = new Map(connections);
-			editingCap = null;
-			toastSuccess('能力凭据已保存');
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			saving = false;
-		}
-	}
-
-	async function disable(capId: string) {
-		if (!confirm('停用后该能力将不可用，确定停用？')) return;
-		disabling = capId;
-		try {
-			const result = await api.disableCapabilityConnection(slug, capId);
-			connections.set(capId, result);
-			connections = new Map(connections);
-			toastSuccess('已停用能力连接');
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			disabling = null;
-		}
-	}
-
-	function statusBadge(status: string): string {
-		if (status === 'ACTIVE') return 'saas-badge-primary';
-		if (status === 'DISABLED') return 'saas-badge-error';
-		return 'saas-badge-muted';
-	}
-
-	function statusLabel(status: string): string {
-		if (status === 'ACTIVE') return '已启用';
-		if (status === 'DISABLED') return '已停用';
-		return '草稿';
-	}
-
-	$effect(() => {
-		if (slug) load();
-	});
-</script>
-
-<PageHeader
-	title="外部能力"
-	description="管理文档/媒体转换服务的组织级凭据（ADR-0027）。凭据按组织隔离、版本化信封存储，缺失或校验失败即 fail-closed。"
-/>
-
-{#if loading}
-	<LoadingState />
-{:else if error}
-	<ErrorBanner message={error} onretry={load} />
-{:else}
-	<div class="space-y-6">
-		{#each KNOWN_CAPABILITIES as cap}
-			{@const conn = connections.get(cap.id)}
-			<div class="saas-card-pad">
-				<div class="mb-3 flex items-start justify-between gap-3">
-					<div>
-						<div class="flex items-center gap-2">
-							<h3 class="saas-section-title">{cap.label}</h3>
-							{#if conn}
-								<span class={statusBadge(conn.status)}>{statusLabel(conn.status)}</span>
-							{:else}
-								<span class="saas-badge-muted">未配置</span>
-							{/if}
-						</div>
-						<p class="saas-muted mt-1 text-sm">{cap.description}</p>
-						<p class="mt-0.5 font-mono text-xs text-surface-500">{cap.id}</p>
-					</div>
-					<div class="flex items-center gap-2">
-						{#if conn?.status === 'ACTIVE'}
-							<button
-								class="saas-btn-ghost text-sm"
-								onclick={() => disable(cap.id)}
-								disabled={disabling === cap.id}
-							>
-								{disabling === cap.id ? '停用中…' : '停用'}
-							</button>
-						{/if}
-						<button
-							class="saas-btn-primary text-sm"
-							onclick={() => startEdit(cap.id)}
-							disabled={editingCap === cap.id}
-						>
-							{conn ? '轮换凭据' : '配置凭据'}
-						</button>
-					</div>
-				</div>
-
-				{#if conn}
-					<dl class="space-y-1.5 text-sm text-surface-700">
-						<div class="flex justify-between">
-							<dt class="text-surface-500">版本</dt>
-							<dd class="font-mono">{conn.activeVersion ?? '—'}</dd>
-						</div>
-						<div class="flex justify-between">
-							<dt class="text-surface-500">密钥 ID</dt>
-							<dd class="font-mono text-xs">{conn.keyId ?? '—'}</dd>
-						</div>
-						<div class="flex justify-between">
-							<dt class="text-surface-500">更新时间</dt>
-							<dd>{fmtDate(conn.updatedAt)}</dd>
-						</div>
-					</dl>
-				{/if}
-
-				{#if editingCap === cap.id}
-					<div class="mt-4 border-t border-surface-100 pt-4">
-						<p class="saas-muted mb-3 text-sm">
-							阿里云 RAM 用户的 AccessKey。密钥仅写入新版本，旧版本归档。
-						</p>
-						<div class="grid gap-4">
-							<div>
-								<Label.Root class="saas-label" for="ak-id-{cap.id}">AccessKey ID</Label.Root>
-								<input id="ak-id-{cap.id}" class="saas-input font-mono text-sm" bind:value={accessKeyId} />
-							</div>
-							<div>
-								<Label.Root class="saas-label" for="ak-secret-{cap.id}">AccessKey Secret</Label.Root>
-								<input id="ak-secret-{cap.id}" class="saas-input" type="password" bind:value={accessKeySecret} />
-							</div>
-							<div>
-								<Label.Root class="saas-label" for="endpoint-{cap.id}">Endpoint</Label.Root>
-								<input id="endpoint-{cap.id}" class="saas-input font-mono text-sm" bind:value={endpoint} />
-							</div>
-						</div>
-						<div class="mt-4 flex items-center justify-end gap-3">
-							<button class="saas-btn-ghost" onclick={cancelEdit} disabled={saving}>取消</button>
-							<button class="saas-btn-primary" onclick={() => save(cap.id)} disabled={saving}>
-								{saving ? '保存中…' : '保存'}
-							</button>
-						</div>
-					</div>
-				{/if}
-			</div>
-		{/each}
-	</div>
-{/if}
@@ -1,23 +0,0 @@
-<script lang="ts">
-	/**
-	 * Legacy bookmarks: /admin/org/:slug[/...] → /admin[/...]
-	 * Tenancy lives on the silo host, not the path.
-	 */
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { page } from '$app/state';
-
-	onMount(() => {
-		const raw = page.params.path ?? '';
-		const segments = raw.split('/').filter(Boolean);
-		// Drop the old org slug (first segment) when present.
-		const rest = segments.length > 0 ? segments.slice(1).join('/') : '';
-		const target = rest === '' ? '/admin' : `/admin/${rest}`;
-		const q = page.url.search;
-		void goto(`${target}${q}`, { replaceState: true });
-	});
-</script>
-
-<div class="saas-status-panel">
-	<p class="text-sm text-surface-600">正在重定向到新地址…</p>
-</div>
@@ -2,7 +2,6 @@
 	import { page } from '$app/state';
 	import { api, type OrgMembership } from '$lib/api';
 	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import StatCard from '$lib/components/StatCard.svelte';
@@ -11,8 +10,7 @@
 	import SwitchControl from '$lib/components/SwitchControl.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const orgFromSession = $derived(resolveOrg($session.me, page.url.search));
-	let orgSlug = $derived(orgFromSession?.slug ?? '');
+	let orgSlug = $derived(page.params.slug ?? '');
 	let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);

 	let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
@@ -96,56 +94,19 @@
 	<div class="mb-4 flex items-end justify-between gap-3">
 		<div>
 			<h2 class="saas-section-title">用量概览</h2>
-			<p class="saas-muted">totals 含全部 UsageFact；分账明细见用量页。</p>
+			<p class="saas-muted">全组织智能体运行汇总</p>
 		</div>
-		<a class="saas-btn-secondary py-1.5! text-sm" href={`/admin/usage`}>完整用量报告</a>
 	</div>

 	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
 		<StatCard label="运行总数" value={fmtNum(usage.totals.runCount)} />
 		<StatCard label="有成本运行" value={fmtNum(usage.totals.runsWithCost)} />
-		<StatCard label="无成本运行" value={fmtNum(usage.totals.runsWithoutCost)} hint="未知 ≠ $0" />
+		<StatCard label="无成本运行" value={fmtNum(usage.totals.runsWithoutCost)} />
 		<StatCard label="输入 tokens" value={fmtNum(usage.totals.inputTokens)} />
 		<StatCard label="输出 tokens" value={fmtNum(usage.totals.outputTokens)} />
 		<StatCard label="成本 (USD)" value={fmtCost(usage.totals.costUsd)} />
 	</div>

-	{#if usage.breakdown.length > 0}
-		<div class="saas-card overflow-hidden mb-6">
-			<div class="border-b border-surface-200 px-5 py-3 flex items-center justify-between gap-3">
-				<div>
-					<h3 class="text-sm font-semibold text-surface-800">消费来源（Top）</h3>
-					<p class="saas-muted text-xs">模型完成 vs 外部能力，按成本降序前 5</p>
-				</div>
-				<a class="text-sm text-primary-700 hover:underline" href={`/admin/usage`}>查看全部分账</a>
-			</div>
-			<div class="overflow-x-auto">
-				<table class="data-table">
-					<thead>
-						<tr>
-							<th>类型</th>
-							<th>供应方</th>
-							<th>模型 / 能力</th>
-							<th>次数</th>
-							<th>成本</th>
-						</tr>
-					</thead>
-					<tbody>
-						{#each [...usage.breakdown].sort((a, b) => (b.costUsd ?? -1) - (a.costUsd ?? -1)).slice(0, 5) as row}
-							<tr>
-								<td class="text-sm">{row.kind === 'external_capability' ? '外部能力' : row.kind === 'model_completion' ? '模型完成' : row.kind}</td>
-								<td class="font-mono text-xs">{row.provider}</td>
-								<td class="font-mono text-xs">{row.capabilityId ?? row.model ?? '—'}</td>
-								<td class="tabular-nums">{fmtNum(row.factCount)}</td>
-								<td class="tabular-nums">{fmtCost(row.costUsd)}</td>
-							</tr>
-						{/each}
-					</tbody>
-				</table>
-			</div>
-		</div>
-	{/if}
-
 	<div class="saas-card overflow-hidden">
 		<div class="border-b border-surface-200 px-5 py-3">
 			<h3 class="text-sm font-semibold text-surface-800">按项目用量</h3>
@@ -168,11 +129,7 @@
 					<tbody>
 						{#each usage.projects as p}
 							<tr>
-								<td class="font-medium">
-									<a class="hover:text-primary-700 hover:underline" href={`/admin/projects/${p.projectId}`}>
-										{p.projectName}
-									</a>
-								</td>
+								<td class="font-medium">{p.projectName}</td>
 								<td class="tabular-nums">{fmtNum(p.runCount)}</td>
 								<td class="tabular-nums text-surface-600">{fmtNum(p.inputTokens)} / {fmtNum(p.outputTokens)}</td>
 								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
@@ -1,16 +1,13 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');

 	// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
 	const DIMENSION_LABELS: Record<CapacityDimension, string> = {
@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type FeishuApplicationConnection } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -10,8 +8,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');

 	let connection = $state<FeishuApplicationConnection | null>(null);
 	let loading = $state(true);
@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type OrgMember } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -12,8 +10,7 @@
 	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 	const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
 	const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');

@@ -2,7 +2,6 @@
 	import { page } from '$app/state';
 	import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
 	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import FolderTree from '$lib/components/FolderTree.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -14,8 +13,8 @@
 	import { fmtDate } from '$lib/format';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null);
 	const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));

 	let data = $state<ExplorerData | null>(null);
@@ -88,7 +87,7 @@
 			projectName = '';
 			projectFolder = '';
 			showProjectModal = false;
-			window.location.href = `/admin/projects/${res.id}`;
+			window.location.href = `/admin/org/${slug}/projects/${res.id}`;
 		} catch (err) {
 			toastError(err instanceof Error ? err.message : String(err));
 		}
@@ -208,7 +207,7 @@
 				</thead>
 				<tbody>
 					{#each myProjects as p}
-						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/projects/${p.id}`)}>
+						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
 							<td class="font-medium">{p.name}</td>
 							<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
 							<td class="text-surface-700">{fmtDate(p.createdAt)}</td>
@@ -7,19 +7,8 @@
 		type TeamRow,
 		type SessionSummary,
 		type ExplorerData,
-		type ProjectUsageReport,
 	} from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
-	import {
-		fmtCost,
-		fmtDate,
-		fmtNum,
-		fmtQuantity,
-		fmtTokens,
-		permissionRoleLabel,
-		usageKindLabel,
-	} from '$lib/format';
+	import { fmtDate, permissionRoleLabel } from '$lib/format';
 	import { PERMISSION_ROLES, PERMISSION_ROLE_LABELS } from '$lib/constants';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -29,8 +18,7 @@
 	import Icon from '$lib/components/Icon.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 	const projectId = $derived(page.params.projectId ?? '');
 	const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
 	const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
@@ -38,7 +26,6 @@
 	let proj = $state<ProjectDetail | null>(null);
 	let access = $state<TeamAccessEntry[]>([]);
 	let sessions = $state<SessionSummary[]>([]);
-	let projectUsage = $state<ProjectUsageReport | null>(null);
 	let teams = $state<TeamRow[]>([]);
 	let explorer = $state<ExplorerData | null>(null);
 	let loading = $state(true);
@@ -62,18 +49,14 @@
 			// Team list is needed for grant UI whenever the actor has project MANAGE
 			// (org admin or member). Sessions/explorer stay org-admin oversight only.
 			const needTeams = p.actorIsOrgAdmin === true || p.actorCanManageProject === true;
-			const [s, t, e, u] = await Promise.all([
+			const [s, t, e] = await Promise.all([
 				p.actorIsOrgAdmin ? api.sessions(slug, projectId) : Promise.resolve({ sessions: [] as SessionSummary[] }),
 				needTeams ? api.teams(slug) : Promise.resolve({ teams: [] as TeamRow[] }),
 				p.actorIsOrgAdmin ? api.explorer(slug) : Promise.resolve(null as ExplorerData | null),
-				p.actorIsOrgAdmin
-					? api.projectUsage(slug, projectId)
-					: Promise.resolve(null as ProjectUsageReport | null),
 			]);
 			sessions = s.sessions;
 			teams = t.teams;
 			explorer = e;
-			projectUsage = u;
 			if (p.actorIsOrgAdmin) {
 				moveFolder = p.folderId ?? '';
 			}
@@ -112,7 +95,7 @@
 		if (!confirm(`归档项目 ${proj?.name}?`)) return;
 		try {
 			await api.archiveProject(slug, projectId);
-			window.location.href = `/admin/projects`;
+			window.location.href = `/admin/org/${slug}/projects`;
 		} catch (err) {
 			toastError(err instanceof Error ? err.message : String(err));
 		}
@@ -173,7 +156,7 @@
 {:else if proj}
 	<div class="mb-2">
 		<a
-			href={`/admin/projects`}
+			href={`/admin/org/${slug}/projects`}
 			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
 		>
 			<Icon name="arrow-left" class="h-4 w-4" />
@@ -286,67 +269,9 @@
 	</div>

 	{#if actorIsOrgAdmin}
-		{#if projectUsage}
-			<div class="saas-card overflow-hidden mb-6">
-				<div class="border-b border-surface-200 px-5 py-3 flex items-center justify-between gap-3">
-					<div>
-						<h3 class="text-sm font-semibold">项目用量分账</h3>
-						<p class="saas-muted mt-0.5 text-xs">
-							{fmtNum(projectUsage.runCount)} 次运行 · 成本 {fmtCost(projectUsage.costUsd)} · tokens
-							{fmtTokens(projectUsage.inputTokens, projectUsage.outputTokens)}
-						</p>
-					</div>
-					<a class="text-sm text-primary-700 hover:underline" href={`/admin/usage`}>组织报告</a>
-				</div>
-				{#if projectUsage.breakdown.length === 0}
-					<div class="px-5 py-4 text-sm text-surface-600">尚无 UsageFact。</div>
-				{:else}
-					<div class="overflow-x-auto">
-						<table class="data-table">
-							<thead>
-								<tr>
-									<th>类型</th>
-									<th>供应方</th>
-									<th>模型 / 能力</th>
-									<th>次数</th>
-									<th>计量</th>
-									<th>成本</th>
-								</tr>
-							</thead>
-							<tbody>
-								{#each projectUsage.breakdown as row}
-									<tr>
-										<td>
-											<span
-												class={row.kind === 'external_capability' ? 'saas-badge-primary' : 'saas-badge-success'}
-											>
-												{usageKindLabel(row.kind)}
-											</span>
-										</td>
-										<td class="font-mono text-xs">{row.provider}</td>
-										<td class="font-mono text-xs">{row.capabilityId ?? row.model ?? '—'}</td>
-										<td class="tabular-nums">{fmtNum(row.factCount)}</td>
-										<td class="tabular-nums text-xs">
-											{#if row.unit}
-												{fmtQuantity(row.quantity, row.unit)}
-											{:else}
-												{fmtTokens(row.inputTokens, row.outputTokens)}
-											{/if}
-										</td>
-										<td class="tabular-nums">{fmtCost(row.costUsd)}</td>
-									</tr>
-								{/each}
-							</tbody>
-						</table>
-					</div>
-				{/if}
-			</div>
-		{/if}
-
 		<div class="saas-card overflow-hidden">
 			<div class="border-b border-surface-200 px-5 py-3">
 				<h3 class="text-sm font-semibold">智能体会话</h3>
-				<p class="saas-muted mt-0.5 text-xs">点进会话可查看每次 run 的 UsageFact 分账（模型 / 外部能力）。</p>
 			</div>
 			{#if sessions.length === 0}
 				<EmptyState title="暂无会话" description="飞书侧触发智能体后会显示在此。" />
@@ -358,7 +283,6 @@
 							<th>模型</th>
 							<th>运行次数</th>
 							<th>更新</th>
-							<th></th>
 						</tr>
 					</thead>
 					<tbody>
@@ -368,14 +292,6 @@
 								<td class="font-mono text-xs">{s.model}</td>
 								<td class="tabular-nums">{s.runCount}</td>
 								<td class="text-surface-700">{fmtDate(s.updatedAt)}</td>
-								<td class="text-right">
-									<a
-										class="text-sm text-primary-700 hover:underline"
-										href={`/admin/sessions/${s.id}`}
-									>
-										详情
-									</a>
-								</td>
 							</tr>
 						{/each}
 					</tbody>
@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type ProviderConnectionRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate, providerModeLabel } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -10,8 +8,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');

 	let connections = $state<ProviderConnectionRow[]>([]);
 	let loading = $state(true);
@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
@@ -10,8 +8,7 @@
 	import RoleCard from '$lib/components/RoleCard.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');

 	let roles = $state<AgentRoleRow[]>([]);
 	let models = $state<AgentModelRow[]>([]);
@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
@@ -10,8 +8,7 @@
 	import SkillEditor from '$lib/components/SkillEditor.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');

 	let skills = $state<AgentSkillRow[]>([]);
 	let loading = $state(true);
@@ -2,8 +2,6 @@
 	import { Collapsible } from 'bits-ui';
 	import { page } from '$app/state';
 	import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -11,8 +9,7 @@
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';

-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');

 	let teams = $state<TeamRow[]>([]);
 	let loading = $state(true);
@@ -1,238 +0,0 @@
-<script lang="ts">
-	import { page } from '$app/state';
-	import { api, type SessionDetail, type SessionRunRow, type UsageFactRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
-	import {
-		fmtCost,
-		fmtDate,
-		fmtNum,
-		fmtQuantity,
-		fmtTokens,
-		runStatusLabel,
-		usageKindLabel,
-	} from '$lib/format';
-	import PageHeader from '$lib/components/PageHeader.svelte';
-	import LoadingState from '$lib/components/LoadingState.svelte';
-	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
-	import EmptyState from '$lib/components/EmptyState.svelte';
-	import Icon from '$lib/components/Icon.svelte';
-
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
-	const sessionId = $derived(page.params.sessionId ?? '');
-
-	let detail = $state<SessionDetail | null>(null);
-	let loading = $state(true);
-	let error = $state<string | null>(null);
-	let expandedRunId = $state<string | null>(null);
-
-	async function load() {
-		if (!slug || !sessionId) return;
-		loading = true;
-		error = null;
-		try {
-			detail = await api.session(slug, sessionId);
-			if (detail.runs.length > 0) {
-				expandedRunId = detail.runs[0]!.id;
-			}
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		} finally {
-			loading = false;
-		}
-	}
-
-	function statusClass(status: string): string {
-		const key = status.toUpperCase();
-		if (key === 'COMPLETED') return 'saas-badge-success';
-		if (key === 'FAILED' || key === 'TIMED_OUT' || key === 'CANCELED') return 'saas-badge-error';
-		return 'saas-badge-primary';
-	}
-
-	function factMeter(f: UsageFactRow): string {
-		if (f.unit) return fmtQuantity(f.quantity, f.unit);
-		if (f.inputTokens !== null || f.outputTokens !== null) {
-			return fmtTokens(f.inputTokens, f.outputTokens);
-		}
-		return '—';
-	}
-
-	function factSource(f: UsageFactRow): string {
-		if (f.capabilityId) return f.capabilityId;
-		if (f.model) return f.model;
-		return '—';
-	}
-
-	function runCostHint(run: SessionRunRow): string {
-		const factCost = run.usageFacts.reduce<number | null>((acc, f) => {
-			if (f.costUsd === null) return acc;
-			return (acc ?? 0) + f.costUsd;
-		}, null);
-		const cache = run.costUsd;
-		if (factCost !== null && cache !== null && Math.abs(factCost - cache) > 1e-9) {
-			return `运行缓存 ${fmtCost(cache)}；事实合计 ${fmtCost(factCost)}（缓存可能未含外部能力）`;
-		}
-		if (factCost !== null) return `事实合计 ${fmtCost(factCost)}`;
-		if (cache !== null) return `运行缓存 ${fmtCost(cache)}`;
-		return '成本未知';
-	}
-
-	function toggleRun(id: string) {
-		expandedRunId = expandedRunId === id ? null : id;
-	}
-
-	$effect(() => {
-		if (slug && sessionId) void load();
-	});
-</script>
-
-{#if loading}
-	<LoadingState />
-{:else if error}
-	<ErrorBanner message={error} onretry={load} />
-{:else if detail}
-	<div class="mb-2">
-		<a
-			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-700"
-			href={`/admin/projects/${detail.project.id}`}
-		>
-			<Icon name="arrow-left" class="h-4 w-4" />
-			返回项目 {detail.project.name}
-		</a>
-	</div>
-
-	<PageHeader
-		title={detail.title?.trim() || '未命名会话'}
-		description={`${detail.provider} · ${detail.roleId} · ${detail.model}`}
-	/>
-
-	<div class="saas-card-pad mb-6">
-		<dl class="grid gap-x-8 gap-y-3 text-sm sm:grid-cols-2 lg:grid-cols-3">
-			<div>
-				<dt class="text-surface-600">会话 ID</dt>
-				<dd class="mt-0.5 break-all font-mono text-xs">{detail.id}</dd>
-			</div>
-			<div>
-				<dt class="text-surface-600">项目</dt>
-				<dd class="mt-0.5">
-					<a class="text-primary-700 hover:underline" href={`/admin/projects/${detail.project.id}`}>
-						{detail.project.name}
-					</a>
-				</dd>
-			</div>
-			<div>
-				<dt class="text-surface-600">创建 / 更新</dt>
-				<dd class="mt-0.5 text-surface-800">{fmtDate(detail.createdAt)} · {fmtDate(detail.updatedAt)}</dd>
-			</div>
-			{#if detail.archivedAt}
-				<div>
-					<dt class="text-surface-600">已归档</dt>
-					<dd class="mt-0.5">{fmtDate(detail.archivedAt)}</dd>
-				</div>
-			{/if}
-			<div>
-				<dt class="text-surface-600">运行数</dt>
-				<dd class="mt-0.5 tabular-nums">{fmtNum(detail.runs.length)}</dd>
-			</div>
-		</dl>
-	</div>
-
-	<div class="mb-3">
-		<h2 class="saas-section-title">运行与计费事实</h2>
-		<p class="saas-muted">每条 UsageFact 是一次可计费消费；外部能力与模型完成分开列出。</p>
-	</div>
-
-	{#if detail.runs.length === 0}
-		<div class="saas-card">
-			<EmptyState title="尚无运行" description="此会话还没有 Agent run。" />
-		</div>
-	{:else}
-		<div class="space-y-3">
-			{#each detail.runs as run (run.id)}
-				{@const open = expandedRunId === run.id}
-				<div class="saas-card overflow-hidden">
-					<button
-						type="button"
-						class="flex w-full items-start justify-between gap-3 px-5 py-4 text-left hover:bg-surface-50"
-						onclick={() => toggleRun(run.id)}
-					>
-						<div class="min-w-0 space-y-1">
-							<div class="flex flex-wrap items-center gap-2">
-								<span class={statusClass(run.status)}>{runStatusLabel(run.status)}</span>
-								<span class="font-mono text-xs text-surface-700">{run.provider} / {run.model}</span>
-								<span class="font-mono text-[11px] text-surface-500">{run.id}</span>
-							</div>
-							<div class="text-xs text-surface-700">
-								{fmtDate(run.startedAt)}
-								{#if run.finishedAt}
-									→ {fmtDate(run.finishedAt)}
-								{/if}
-							</div>
-							<div class="text-xs text-surface-600">{runCostHint(run)}</div>
-							{#if run.error}
-								<div class="text-xs text-error-700">{run.error}</div>
-							{/if}
-						</div>
-						<div class="shrink-0 text-right text-sm">
-							<div class="tabular-nums text-surface-800">{fmtTokens(run.inputTokens, run.outputTokens)}</div>
-							<div class="tabular-nums font-medium">{fmtCost(run.costUsd)}</div>
-							<div class="mt-1 text-[11px] text-surface-600">{open ? '收起事实' : `${run.usageFacts.length} 条事实`}</div>
-						</div>
-					</button>
-
-					{#if open}
-						<div class="border-t border-surface-200">
-							{#if run.usageFacts.length === 0}
-								<div class="px-5 py-4">
-									<p class="text-sm text-surface-600">此 run 没有 UsageFact（可能尚未结束或未记费）。</p>
-								</div>
-							{:else}
-								<div class="overflow-x-auto">
-									<table class="data-table">
-										<thead>
-											<tr>
-												<th>时间</th>
-												<th>类型</th>
-												<th>供应方</th>
-												<th>模型 / 能力</th>
-												<th>计量</th>
-												<th>成本</th>
-												<th>来源</th>
-												<th>关联 ID</th>
-											</tr>
-										</thead>
-										<tbody>
-											{#each run.usageFacts as fact}
-												<tr>
-													<td class="whitespace-nowrap text-xs text-surface-700">{fmtDate(fact.occurredAt)}</td>
-													<td>
-														<span
-															class={fact.kind === 'external_capability'
-																? 'saas-badge-primary'
-																: 'saas-badge-success'}
-														>
-															{usageKindLabel(fact.kind)}
-														</span>
-													</td>
-													<td class="font-mono text-xs">{fact.provider}</td>
-													<td class="font-mono text-xs">{factSource(fact)}</td>
-													<td class="tabular-nums text-xs">{factMeter(fact)}</td>
-													<td class="tabular-nums">{fmtCost(fact.costUsd)}</td>
-													<td class="font-mono text-[11px] text-surface-600">{fact.costSource}</td>
-													<td class="max-w-[10rem] truncate font-mono text-[11px] text-surface-500" title={fact.correlationId ?? ''}>
-														{fact.correlationId ?? '—'}
-													</td>
-												</tr>
-											{/each}
-										</tbody>
-									</table>
-								</div>
-							{/if}
-						</div>
-					{/if}
-				</div>
-			{/each}
-		</div>
-	{/if}
-{/if}
@@ -1,241 +0,0 @@
-<script lang="ts">
-	import { page } from '$app/state';
-	import { api, type UsageReport, type UsageBreakdownRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
-	import {
-		fmtCost,
-		fmtDateOnly,
-		fmtNum,
-		fmtQuantity,
-		fmtTokens,
-		usageKindLabel,
-	} from '$lib/format';
-	import PageHeader from '$lib/components/PageHeader.svelte';
-	import StatCard from '$lib/components/StatCard.svelte';
-	import LoadingState from '$lib/components/LoadingState.svelte';
-	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
-	import EmptyState from '$lib/components/EmptyState.svelte';
-
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
-
-	let usage = $state<UsageReport | null>(null);
-	let loading = $state(true);
-	let error = $state<string | null>(null);
-	let from = $state('');
-	let to = $state('');
-
-	function toIsoStart(dateLocal: string): string | undefined {
-		if (!dateLocal) return undefined;
-		const d = new Date(`${dateLocal}T00:00:00`);
-		return Number.isNaN(d.getTime()) ? undefined : d.toISOString();
-	}
-
-	function toIsoEnd(dateLocal: string): string | undefined {
-		if (!dateLocal) return undefined;
-		const d = new Date(`${dateLocal}T23:59:59.999`);
-		return Number.isNaN(d.getTime()) ? undefined : d.toISOString();
-	}
-
-	async function load() {
-		if (!slug) return;
-		loading = true;
-		error = null;
-		try {
-			usage = await api.usage(slug, {
-				...(toIsoStart(from) !== undefined ? { from: toIsoStart(from) } : {}),
-				...(toIsoEnd(to) !== undefined ? { to: toIsoEnd(to) } : {}),
-			});
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		} finally {
-			loading = false;
-		}
-	}
-
-	function clearRange() {
-		from = '';
-		to = '';
-		void load();
-	}
-
-	function sourceLabel(row: UsageBreakdownRow): string {
-		if (row.capabilityId) return row.capabilityId;
-		if (row.model) return row.model;
-		return '—';
-	}
-
-	function meterCell(row: UsageBreakdownRow): string {
-		if (row.unit) return fmtQuantity(row.quantity, row.unit);
-		if (row.inputTokens > 0 || row.outputTokens > 0) return fmtTokens(row.inputTokens, row.outputTokens);
-		return '—';
-	}
-
-	function meterHint(row: UsageBreakdownRow): string {
-		if (row.unit) return '非 token 计量';
-		if (row.inputTokens > 0 || row.outputTokens > 0) return 'in / out tokens';
-		return '无计量';
-	}
-
-	$effect(() => {
-		if (slug) void load();
-	});
-</script>
-
-{#if loading && !usage}
-	<LoadingState />
-{:else if error && !usage}
-	<ErrorBanner message={error} onretry={load} />
-{:else if usage}
-	<PageHeader
-		title="用量报告"
-		description="按 UsageFact 分账：模型完成与外部能力（PDF→MD、ASR 等）分开汇总。缺失成本计为未知，不为 0。"
-	/>
-
-	<div class="saas-card-pad mb-6">
-		<div class="flex flex-wrap items-end gap-3">
-			<div>
-				<label class="saas-label" for="usage-from">从</label>
-				<input id="usage-from" class="saas-input" type="date" bind:value={from} />
-			</div>
-			<div>
-				<label class="saas-label" for="usage-to">到</label>
-				<input id="usage-to" class="saas-input" type="date" bind:value={to} />
-			</div>
-			<button class="saas-btn-primary py-1.5! text-sm" type="button" onclick={load} disabled={loading}>
-				{loading ? '加载中…' : '应用筛选'}
-			</button>
-			<button class="saas-btn-secondary py-1.5! text-sm" type="button" onclick={clearRange} disabled={loading}>
-				清除
-			</button>
-			{#if usage.from || usage.to}
-				<p class="saas-muted grow text-right text-xs">
-					窗口：
-					{usage.from ? fmtDateOnly(usage.from) : '—'}
-					→
-					{usage.to ? fmtDateOnly(usage.to) : '—'}
-				</p>
-			{/if}
-		</div>
-		{#if error}
-			<p class="mt-3 text-sm text-error-700">{error}</p>
-		{/if}
-	</div>
-
-	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
-		<StatCard label="运行总数" value={fmtNum(usage.totals.runCount)} />
-		<StatCard
-			label="有成本 / 无成本"
-			value={`${fmtNum(usage.totals.runsWithCost)} / ${fmtNum(usage.totals.runsWithoutCost)}`}
-			hint="无成本 = 成本未知，不是 $0"
-		/>
-		<StatCard label="成本 (USD)" value={fmtCost(usage.totals.costUsd)} hint="仅汇总已知 costUsd" />
-		<StatCard label="输入 tokens" value={fmtNum(usage.totals.inputTokens)} hint="主要来自模型完成" />
-		<StatCard label="输出 tokens" value={fmtNum(usage.totals.outputTokens)} hint="主要来自模型完成" />
-		<StatCard
-			label="分账条目"
-			value={fmtNum(usage.breakdown.reduce((n, b) => n + b.factCount, 0))}
-			hint={`${fmtNum(usage.breakdown.length)} 个分项`}
-		/>
-	</div>
-
-	<div class="saas-card overflow-hidden mb-6">
-		<div class="border-b border-surface-200 px-5 py-3">
-			<h3 class="text-sm font-semibold text-surface-800">按来源分账</h3>
-			<p class="saas-muted mt-0.5 text-xs">
-				kind × provider × model/capability。外部能力显示页数/秒等计量，不与 tokens 混排。
-			</p>
-		</div>
-		{#if usage.breakdown.length === 0}
-			<EmptyState title="暂无用量事实" description="跑过智能体后，模型与外部能力消费会出现在此。" />
-		{:else}
-			<div class="overflow-x-auto">
-				<table class="data-table">
-					<thead>
-						<tr>
-							<th>类型</th>
-							<th>供应方</th>
-							<th>模型 / 能力</th>
-							<th>次数</th>
-							<th>计量</th>
-							<th>有成本 / 未知</th>
-							<th>成本</th>
-						</tr>
-					</thead>
-					<tbody>
-						{#each usage.breakdown as row}
-							<tr>
-								<td>
-									<span
-										class={row.kind === 'external_capability'
-											? 'saas-badge-primary'
-											: row.kind === 'model_completion'
-												? 'saas-badge-success'
-												: 'saas-badge-primary'}
-									>
-										{usageKindLabel(row.kind)}
-									</span>
-								</td>
-								<td class="font-mono text-xs">{row.provider}</td>
-								<td class="font-mono text-xs">{sourceLabel(row)}</td>
-								<td class="tabular-nums">{fmtNum(row.factCount)}</td>
-								<td class="tabular-nums">
-									<div>{meterCell(row)}</div>
-									<div class="text-[11px] text-surface-600">{meterHint(row)}</div>
-								</td>
-								<td class="tabular-nums text-surface-700">
-									{fmtNum(row.factsWithCost)} / {fmtNum(row.factsWithoutCost)}
-								</td>
-								<td class="tabular-nums font-medium">{fmtCost(row.costUsd)}</td>
-							</tr>
-						{/each}
-					</tbody>
-				</table>
-			</div>
-		{/if}
-	</div>
-
-	<div class="saas-card overflow-hidden">
-		<div class="border-b border-surface-200 px-5 py-3">
-			<h3 class="text-sm font-semibold text-surface-800">按项目</h3>
-			<p class="saas-muted mt-0.5 text-xs">项目仍是权限边界；行内成本已含该项目全部 fact 类型。</p>
-		</div>
-		{#if usage.projects.length === 0}
-			<EmptyState title="暂无项目" description="创建项目并触发智能体后会出现用量。" />
-		{:else}
-			<div class="overflow-x-auto">
-				<table class="data-table">
-					<thead>
-						<tr>
-							<th>项目</th>
-							<th>运行</th>
-							<th>有成本 / 未知</th>
-							<th>in / out tokens</th>
-							<th>成本</th>
-							<th></th>
-						</tr>
-					</thead>
-					<tbody>
-						{#each usage.projects as p}
-							<tr>
-								<td class="font-medium">{p.projectName}</td>
-								<td class="tabular-nums">{fmtNum(p.runCount)}</td>
-								<td class="tabular-nums text-surface-700">
-									{fmtNum(p.runsWithCost)} / {fmtNum(p.runsWithoutCost)}
-								</td>
-								<td class="tabular-nums text-surface-600">{fmtTokens(p.inputTokens, p.outputTokens)}</td>
-								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
-								<td class="text-right">
-									<a class="text-sm text-primary-700 hover:underline" href={`/admin/projects/${p.projectId}`}>
-										查看项目
-									</a>
-								</td>
-							</tr>
-						{/each}
-					</tbody>
-				</table>
-			</div>
-		{/if}
-	</div>
-{/if}
@@ -1,23 +0,0 @@
-node_modules
-
-# Output
-.output
-.vercel
-.netlify
-.wrangler
-/.svelte-kit
-/build
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Env
-.env
-.env.*
-!.env.example
-!.env.test
-
-# Vite
-vite.config.js.timestamp-*
-vite.config.ts.timestamp-*
@@ -1 +0,0 @@
-engine-strict=true
@@ -1,4 +0,0 @@
-build
-.svelte-kit
-node_modules
-package-lock.json
@@ -1,9 +0,0 @@
-{
-	"useTabs": true,
-	"singleQuote": true,
-	"semi": true,
-	"trailingComma": "all",
-	"printWidth": 120,
-	"plugins": ["prettier-plugin-svelte"],
-	"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
-}
@@ -1,33 +0,0 @@
-{
-	"name": "database-admin",
-	"private": true,
-	"version": "0.0.1",
-	"type": "module",
-	"scripts": {
-		"dev": "vite dev",
-		"build": "vite build",
-		"preview": "vite preview",
-		"prepare": "svelte-kit sync || echo ''",
-		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
-		"format": "prettier --write .",
-		"format:check": "prettier --check ."
-	},
-	"devDependencies": {
-		"@skeletonlabs/skeleton": "^4.15.2",
-		"@skeletonlabs/skeleton-svelte": "^4.15.2",
-		"@sveltejs/adapter-auto": "^7.0.1",
-		"@sveltejs/adapter-static": "^3.0.10",
-		"@sveltejs/kit": "^2.63.0",
-		"@sveltejs/vite-plugin-svelte": "^7.1.2",
-		"@tailwindcss/vite": "^4.3.2",
-		"bits-ui": "^2.18.1",
-		"prettier": "^3.9.5",
-		"prettier-plugin-svelte": "^4.1.1",
-		"svelte": "^5.56.1",
-		"svelte-check": "^4.6.0",
-		"tailwindcss": "^4.3.2",
-		"typescript": "^6.0.3",
-		"vite": "^8.0.16"
-	}
-}
@@ -1,13 +0,0 @@
-// See https://svelte.dev/docs/kit/types#app.d.ts
-// for information about these interfaces
-declare global {
-	namespace App {
-		// interface Error {}
-		// interface Locals {}
-		// interface PageData {}
-		// interface PageState {}
-		// interface Platform {}
-	}
-}
-
-export {};
@@ -1,29 +0,0 @@
-<!doctype html>
-<html lang="zh-CN">
-	<head>
-		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width, initial-scale=1" />
-		<meta name="description" content="Curriculum Project Hub — 数据库管理后台" />
-		<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
-		<link rel="preconnect" href="https://fonts.googleapis.com" />
-		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-		<link
-			href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap"
-			rel="stylesheet"
-		/>
-		<style>
-			/* Fallback before CSS bundle */
-			html {
-				font-family: 'Inter', system-ui, 'Noto Sans SC', 'PingFang SC', sans-serif;
-			}
-		</style>
-		<title>Database Admin</title>
-		%sveltekit.head%
-	</head>
-	<body
-		data-sveltekit-preload-data="hover"
-		class="relative min-h-screen overflow-x-hidden bg-gradient-to-br from-slate-50 via-white to-indigo-50 text-slate-700"
-	>
-		<div style="display: contents">%sveltekit.body%</div>
-	</body>
-</html>
@@ -1,76 +0,0 @@
-/**
- * Thin API client for the database-admin backend. Same-origin cookie auth,
- * reusing the platform session (`cph_session`) and the admin plane's /api/me.
- */
-
-export class ApiError extends Error {
-	code: string;
-	status: number;
-	constructor(code: string, message: string, status: number) {
-		super(message);
-		this.name = 'ApiError';
-		this.code = code;
-		this.status = status;
-	}
-}
-
-async function request(method: string, url: string, body?: unknown): Promise<unknown> {
-	const init: RequestInit = {
-		method,
-		credentials: 'same-origin',
-		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
-		body: body !== undefined ? JSON.stringify(body) : undefined,
-	};
-	const res = await fetch(url, init);
-	const text = await res.text();
-	let data: unknown = null;
-	if (text !== '') {
-		try {
-			data = JSON.parse(text);
-		} catch {
-			data = text;
-		}
-	}
-	if (!res.ok) {
-		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
-		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
-	}
-	return data;
-}
-
-const get = (u: string) => request('GET', u);
-const post = (u: string, b?: unknown) => request('POST', u, b);
-
-// --- Types ---
-
-export interface OrgMembership {
-	id: string;
-	slug: string;
-	name: string;
-	status: string;
-	role: 'OWNER' | 'ADMIN' | 'MEMBER';
-}
-
-export interface MeResponse {
-	user: {
-		id: string;
-		feishuOpenId: string;
-		displayName: string;
-		avatarUrl: string | null;
-	};
-	organizations: OrgMembership[];
-}
-
-/** Unauthenticated bootstrap the login page needs: which org to OAuth against + dev toggle. */
-export interface DatabaseConfig {
-	siloOrganizationSlug: string;
-	devLoginEnabled: boolean;
-}
-
-// --- API ---
-
-export const api = {
-	me: () => get('/api/me') as Promise<MeResponse>,
-	logout: () => post('/auth/logout'),
-	databaseConfig: () => get('/database/config') as Promise<DatabaseConfig>,
-};
@@ -1,6 +0,0 @@
-<!-- Animated aurora background blobs, shared by both pages (soft pastels on light). -->
-<div class="pointer-events-none fixed inset-0 overflow-hidden">
-	<div class="aurora absolute -left-32 -top-32 h-96 w-96 rounded-full bg-violet-300/50"></div>
-	<div class="aurora absolute right-0 top-1/4 h-96 w-96 rounded-full bg-cyan-300/40" style="animation-delay:-6s"></div>
-	<div class="aurora absolute bottom-0 left-1/3 h-96 w-96 rounded-full bg-indigo-300/40" style="animation-delay:-12s"></div>
-</div>
@@ -1,7 +0,0 @@
-import type { OrgMembership } from './api';
-
-export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
-	if (!org) return false;
-	const role = String(org.role ?? '').toUpperCase();
-	return role === 'OWNER' || role === 'ADMIN';
-}
@@ -1,58 +0,0 @@
-import { writable } from 'svelte/store';
-import { goto } from '$app/navigation';
-import { base } from '$app/paths';
-import { api, type MeResponse } from './api';
-
-interface SessionState {
-	loading: boolean;
-	me: MeResponse | null;
-	error: string | null;
-}
-
-export const session = writable<SessionState>({
-	loading: true,
-	me: null,
-	error: null,
-});
-
-export async function loadSession(): Promise<void> {
-	session.update((s) => ({ ...s, loading: true, error: null }));
-	try {
-		const me = await api.me();
-		session.set({ loading: false, me, error: null });
-	} catch (err) {
-		const status = (err as { status?: number }).status;
-		if (status === 401) {
-			session.set({ loading: false, me: null, error: null });
-			void redirectToLogin();
-			return;
-		}
-		session.set({
-			loading: false,
-			me: null,
-			error: err instanceof Error ? err.message : String(err),
-		});
-	}
-}
-
-/**
- * Send the browser to the login page (`/database/admin`). Unlike admin-web we
- * don't jump straight to Feishu OAuth: the login page reads /database/config
- * to build the org-scoped link and to show the dev bypass when enabled.
- */
-export async function redirectToLogin(): Promise<void> {
-	const loginPath = `${base}/admin`;
-	if (window.location.pathname === loginPath) return;
-	await goto(loginPath, { replaceState: true });
-}
-
-/** Build the org-scoped Feishu OAuth entry point (a backend route, not under base). */
-export function feishuLoginHref(orgSlug: string, returnTo: string = `${base}/dashboard`): string {
-	return `/auth/feishu/${encodeURIComponent(orgSlug)}?returnTo=${encodeURIComponent(returnTo)}`;
-}
-
-export async function logout(): Promise<void> {
-	await api.logout();
-	session.set({ loading: false, me: null, error: null });
-	await redirectToLogin();
-}
@@ -1,7 +0,0 @@
-<script lang="ts">
-	import './app.css';
-
-	let { children } = $props();
-</script>
-
-{@render children()}
@@ -1,30 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { base } from '$app/paths';
-	import { api } from '$lib/api';
-
-	onMount(async () => {
-		// /database entry — route to dashboard if signed in, else the login page.
-		try {
-			await api.me();
-			await goto(`${base}/dashboard`, { replaceState: true });
-		} catch {
-			await goto(`${base}/admin`, { replaceState: true });
-		}
-	});
-</script>
-
-<div class="flex min-h-screen items-center justify-center">
-	<div class="flex flex-col items-center gap-3 text-slate-400">
-		<svg class="h-7 w-7 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
-			<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-			<path
-				class="opacity-90"
-				fill="currentColor"
-				d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-			></path>
-		</svg>
-		<p class="text-sm">正在进入…</p>
-	</div>
-</div>
@@ -1,78 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { base } from '$app/paths';
-	import { api, type DatabaseConfig } from '$lib/api';
-	import { feishuLoginHref } from '$lib/session';
-	import Aurora from '$lib/components/Aurora.svelte';
-
-	let config = $state<DatabaseConfig | null>(null);
-	let error = $state<string | null>(null);
-
-	onMount(async () => {
-		// Already signed in → straight to the dashboard.
-		try {
-			await api.me();
-			await goto(`${base}/dashboard`, { replaceState: true });
-			return;
-		} catch {
-			// Not signed in (401) or backend unreachable — show the login card.
-		}
-		try {
-			config = await api.databaseConfig();
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		}
-	});
-
-	const feishuHref = $derived(config ? feishuLoginHref(config.siloOrganizationSlug) : '#');
-</script>
-
-<Aurora />
-
-<main class="flex min-h-screen items-center justify-center p-4">
-	<div class="rise glass relative w-full max-w-sm rounded-3xl border border-white/80 p-8 shadow-2xl shadow-indigo-200/50">
-		<div class="mb-7 text-center">
-			<div
-				class="mx-auto mb-5 flex h-14 w-14 items-center justify-center rounded-2xl bg-gradient-to-br from-violet-500 to-cyan-400 text-2xl font-bold text-white glow-btn"
-			>
-				D
-			</div>
-			<h1 class="text-2xl font-bold tracking-tight grad-text">Database Admin</h1>
-			<p class="mt-2 text-sm text-slate-500">使用飞书登录以管理数据库</p>
-		</div>
-
-		{#if error}
-			<div class="mb-4 rounded-xl border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-600">
-				无法连接后端：{error}
-			</div>
-		{/if}
-
-		<a
-			href={feishuHref}
-			aria-disabled={config ? 'false' : 'true'}
-			class="rise-2 glow-btn group flex w-full items-center justify-center gap-2 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-3.5 text-sm font-semibold text-white transition hover:from-violet-400 hover:to-indigo-400 aria-disabled:pointer-events-none aria-disabled:opacity-50"
-		>
-			<svg class="h-4 w-4" viewBox="0 0 24 24" fill="currentColor">
-				<path d="M12 2 3 7v10l9 5 9-5V7l-9-5Zm0 2.3 6.5 3.6L12 11.5 5.5 7.9 12 4.3Z" />
-			</svg>
-			使用飞书登录
-		</a>
-
-		{#if config?.devLoginEnabled}
-			<div class="relative my-6 rise-3">
-				<div class="absolute inset-0 flex items-center"><div class="w-full border-t border-slate-200"></div></div>
-				<div class="relative flex justify-center">
-					<span class="bg-white/70 px-3 text-[11px] font-medium uppercase tracking-[0.2em] text-slate-400">开发模式</span>
-				</div>
-			</div>
-			<a
-				href="/database/dev-login"
-				class="rise-3 group flex w-full items-center justify-center gap-2 rounded-xl border border-amber-300 bg-amber-50 px-4 py-3 text-sm font-semibold text-amber-700 transition hover:border-amber-400 hover:bg-amber-100"
-			>
-				<span>⚡</span> 一键登录管理员
-			</a>
-			<p class="rise-3 mt-2 text-center text-xs text-slate-400">仅开发环境可见 · 跳过飞书 OAuth</p>
-		{/if}
-	</div>
-</main>
@@ -1,96 +0,0 @@
-@import 'tailwindcss';
-
-@source './**/*.{html,js,svelte,ts}';
-@source '../lib/**/*.{html,js,svelte,ts}';
-
-/*
- * Design system for the database-admin SPA. Migrated verbatim (in spirit) from
- * the previous server-rendered pages in hub/src/database/routes/databaseRoutes.ts:
- * a light aurora / glassmorphism look with violet→cyan gradients and soft rise-in
- * entrances. Distinct from admin-web's flat industrial theme on purpose.
- */
-
-@theme {
-	--font-sans: 'Inter', system-ui, -apple-system, 'Segoe UI', 'Noto Sans SC', 'PingFang SC', sans-serif;
-}
-
-@keyframes aurora {
-	0% {
-		transform: translate(0, 0) scale(1);
-	}
-	33% {
-		transform: translate(6%, -8%) scale(1.15);
-	}
-	66% {
-		transform: translate(-8%, 6%) scale(0.9);
-	}
-	100% {
-		transform: translate(0, 0) scale(1);
-	}
-}
-
-@keyframes rise {
-	from {
-		opacity: 0;
-		transform: translateY(16px);
-	}
-	to {
-		opacity: 1;
-		transform: translateY(0);
-	}
-}
-
-@keyframes shimmer {
-	0% {
-		background-position: -200% 0;
-	}
-	100% {
-		background-position: 200% 0;
-	}
-}
-
-@layer base {
-	:root {
-		font-family: var(--font-sans);
-	}
-	html {
-		height: 100%;
-		-webkit-font-smoothing: antialiased;
-		-moz-osx-font-smoothing: grayscale;
-	}
-}
-
-@layer components {
-	.aurora {
-		filter: blur(80px);
-		animation: aurora 18s ease-in-out infinite;
-	}
-	.rise {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
-	}
-	.rise-1 {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) both;
-	}
-	.rise-2 {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.1s both;
-	}
-	.rise-3 {
-		animation: rise 0.7s cubic-bezier(0.16, 1, 0.3, 1) 0.2s both;
-	}
-	.grad-text {
-		background: linear-gradient(120deg, #7c3aed, #0891b2, #4f46e5);
-		background-size: 200% auto;
-		-webkit-background-clip: text;
-		background-clip: text;
-		color: transparent;
-		animation: shimmer 6s linear infinite;
-	}
-	.glass {
-		background: rgba(255, 255, 255, 0.7);
-		backdrop-filter: blur(16px);
-		-webkit-backdrop-filter: blur(16px);
-	}
-	.glow-btn {
-		box-shadow: 0 12px 32px -10px rgba(124, 58, 237, 0.45);
-	}
-}
@@ -1,160 +0,0 @@
-<script lang="ts">
-	import { onMount } from 'svelte';
-	import { base } from '$app/paths';
-	import { session, loadSession, logout } from '$lib/session';
-	import { isOrgAdmin } from '$lib/org';
-	import Aurora from '$lib/components/Aurora.svelte';
-
-	onMount(() => {
-		loadSession();
-	});
-
-	// The session is scoped to the silo org, so /api/me returns exactly that org's
-	// membership. Admin gate: only OWNER/ADMIN may use the database console.
-	const me = $derived($session.me);
-	const org = $derived(me?.organizations[0] ?? null);
-	const allowed = $derived(isOrgAdmin(org));
-	const displayName = $derived(me?.user.displayName ?? '');
-	const initial = $derived(displayName.slice(0, 1) || 'U');
-
-	const navItems = [
-		{ label: '概览', href: `${base}/dashboard`, active: true, icon: 'M4 13h6V4H4v9Zm0 7h6v-5H4v5Zm10 0h6V11h-6v9Zm0-16v5h6V4h-6Z' },
-		{ label: '数据表', href: '#', active: false, icon: 'M4 5h16v4H4V5Zm0 6h16v4H4v-4Zm0 6h16v2H4v-2Z' },
-		{ label: '查询', href: '#', active: false, icon: 'm21 21-4.3-4.3M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14Z' },
-		{
-			label: '设置',
-			href: '#',
-			active: false,
-			icon: 'M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6Zm7-3 2 1-2 3-2-1a7 7 0 0 1-2 1l-1 2h-4l-1-2a7 7 0 0 1-2-1l-2 1-2-3 2-1a7 7 0 0 1 0-2l-2-1 2-3 2 1a7 7 0 0 1 2-1l1-2h4l1 2a7 7 0 0 1 2 1l2-1 2 3-2 1a7 7 0 0 1 0 2Z',
-		},
-	];
-
-	const stats = [
-		{ label: '数据表', value: '—', accent: 'from-violet-200/60 to-transparent' },
-		{ label: '记录数', value: '—', accent: 'from-cyan-200/60 to-transparent' },
-		{ label: '最近查询', value: '—', accent: 'from-indigo-200/60 to-transparent' },
-	];
-</script>
-
-<Aurora />
-
-{#if $session.loading}
-	<div class="flex min-h-screen items-center justify-center">
-		<div class="flex flex-col items-center gap-3 text-slate-400">
-			<svg class="h-8 w-8 animate-spin text-violet-500" viewBox="0 0 24 24" fill="none">
-				<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
-				<path
-					class="opacity-90"
-					fill="currentColor"
-					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-				></path>
-			</svg>
-			<p class="text-sm">加载中…</p>
-		</div>
-	</div>
-{:else if $session.error}
-	<div class="flex min-h-screen items-center justify-center p-4">
-		<div class="rise glass w-full max-w-sm rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
-			<h2 class="mb-2 text-lg font-bold text-slate-900">无法连接后端</h2>
-			<p class="mb-5 text-sm text-slate-500">{$session.error}</p>
-			<button
-				class="rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-4 py-2 text-sm font-semibold text-white"
-				onclick={() => loadSession()}>重试</button
-			>
-		</div>
-	</div>
-{:else if !allowed}
-	<div class="flex min-h-screen items-center justify-center p-4">
-		<div class="rise glass w-full max-w-md rounded-3xl border border-white/80 p-8 text-center shadow-2xl shadow-indigo-200/50">
-			<h2 class="mb-2 text-lg font-bold text-slate-900">无权访问</h2>
-			<p class="mb-5 text-sm text-slate-500">数据库管理台仅向组织所有者与管理员开放。</p>
-			<button
-				class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:bg-slate-50"
-				onclick={() => logout()}>退出登录</button
-			>
-		</div>
-	</div>
-{:else}
-	<div class="relative flex min-h-screen">
-		<!-- 左侧菜单栏 -->
-		<aside class="flex w-64 shrink-0 flex-col border-r border-slate-200/80 glass">
-			<div class="flex items-center gap-3 px-5 py-6">
-				<div
-					class="flex h-10 w-10 items-center justify-center rounded-xl bg-gradient-to-br from-violet-500 to-cyan-400 text-lg font-bold text-white glow-btn"
-				>
-					D
-				</div>
-				<span class="text-base font-bold grad-text">Database Admin</span>
-			</div>
-			<nav class="flex flex-1 flex-col gap-1.5 px-3 py-2">
-				{#each navItems as item}
-					<a
-						href={item.href}
-						class={item.active
-							? 'group flex items-center gap-3 rounded-xl bg-gradient-to-r from-violet-500 to-indigo-500 px-3 py-2.5 text-sm font-semibold text-white shadow-lg shadow-indigo-300/50'
-							: 'group flex items-center gap-3 rounded-xl px-3 py-2.5 text-sm font-medium text-slate-500 transition hover:bg-slate-100 hover:text-slate-900'}
-					>
-						<svg
-							class="h-4 w-4 shrink-0"
-							viewBox="0 0 24 24"
-							fill="none"
-							stroke="currentColor"
-							stroke-width="1.8"
-							stroke-linecap="round"
-							stroke-linejoin="round"><path d={item.icon} /></svg
-						>
-						{item.label}
-					</a>
-				{/each}
-			</nav>
-			<div class="m-3 flex items-center gap-3 rounded-xl border border-slate-200 bg-white/60 px-3 py-3">
-				<div
-					class="flex h-9 w-9 items-center justify-center rounded-full bg-gradient-to-br from-violet-500 to-indigo-500 text-sm font-semibold text-white"
-				>
-					{initial}
-				</div>
-				<div class="min-w-0">
-					<p class="text-[11px] uppercase tracking-wider text-slate-400">已登录</p>
-					<p class="truncate text-sm font-medium text-slate-700">{displayName}</p>
-				</div>
-			</div>
-		</aside>
-
-		<!-- 右侧内容 -->
-		<div class="flex flex-1 flex-col">
-			<header class="flex items-center justify-between border-b border-slate-200/80 glass px-8 py-4">
-				<div>
-					<h1 class="text-lg font-bold text-slate-900">概览</h1>
-					<p class="text-xs text-slate-400">欢迎回来，这里是数据库管理台</p>
-				</div>
-				<button
-					onclick={() => logout()}
-					class="rounded-xl border border-slate-200 bg-white px-4 py-2 text-sm font-medium text-slate-600 transition hover:border-slate-300 hover:bg-slate-50 hover:text-slate-900"
-				>
-					退出登录
-				</button>
-			</header>
-
-			<main class="flex-1 p-8">
-				<div class="grid grid-cols-1 gap-5 sm:grid-cols-3">
-					{#each stats as s, i}
-						<div
-							class="rise-{i +
-								1} group relative overflow-hidden rounded-2xl border border-white/80 glass p-5 shadow-lg shadow-slate-200/50 transition hover:-translate-y-0.5 hover:shadow-xl hover:shadow-indigo-200/50"
-						>
-							<div class="absolute inset-0 bg-gradient-to-br {s.accent} opacity-0 transition group-hover:opacity-100"></div>
-							<p class="relative text-sm text-slate-500">{s.label}</p>
-							<p class="relative mt-2 text-3xl font-bold text-slate-900">{s.value}</p>
-						</div>
-					{/each}
-				</div>
-
-				<div
-					class="rise-3 mt-6 flex h-64 items-center justify-center rounded-2xl border border-dashed border-slate-300 glass text-sm text-slate-400"
-				>
-					内容区占位 · 后续数据端点挂在 /database/* 并加 guard
-				</div>
-			</main>
-		</div>
-	</div>
-{/if}
@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
-	<rect width="32" height="32" rx="8" fill="#4F46E5"/>
-	<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
-	<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
-</svg>
@@ -1,3 +0,0 @@
-# allow crawling everything by default
-User-agent: *
-Disallow:
@@ -1,22 +0,0 @@
-import adapter from '@sveltejs/adapter-static';
-import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
-
-/** @type {import('@sveltejs/kit').Config} */
-const config = {
-	preprocess: vitePreprocess(),
-	kit: {
-		adapter: adapter({
-			pages: 'build',
-			assets: 'build',
-			fallback: 'index.html',
-			precompress: false,
-			strict: false,
-		}),
-		// This SPA is served under /database by the Hub. admin-web owns the
-		// root asset paths (/_app, /favicon.svg); a base path moves this app's
-		// assets to /database/_app/* so the two builds never collide.
-		paths: { base: '/database' },
-	},
-};
-
-export default config;
@@ -1,20 +0,0 @@
-{
-	"extends": "./.svelte-kit/tsconfig.json",
-	"compilerOptions": {
-		"rewriteRelativeImportExtensions": true,
-		"allowJs": true,
-		"checkJs": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"resolveJsonModule": true,
-		"skipLibCheck": true,
-		"sourceMap": true,
-		"strict": true,
-		"moduleResolution": "bundler"
-	}
-	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
-	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
-	//
-	// To make changes to top-level options such as include and exclude, we recommend extending
-	// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
-}
@@ -1,17 +0,0 @@
-import { sveltekit } from '@sveltejs/kit/vite';
-import tailwindcss from '@tailwindcss/vite';
-import { defineConfig } from 'vite';
-
-export default defineConfig({
-	plugins: [tailwindcss(), sveltekit()],
-	server: {
-		proxy: {
-			'/api': 'http://127.0.0.1:8788',
-			'/auth': 'http://127.0.0.1:8788',
-			// Backend owns the /database/* HTTP surface (login page, dashboard,
-			// data routes). Proxy it in dev so those paths hit the real server
-			// instead of the SPA fallback.
-			'/database': 'http://127.0.0.1:8788',
-		},
-	},
-});
@@ -82,11 +82,10 @@ REMOTE
  rsync -az --delete \
    --exclude node_modules --exclude dist --exclude .env \
    --exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
-    --exclude database-admin/node_modules --exclude database-admin/build --exclude database-admin/.svelte-kit \
    -e "ssh ${SSH_OPTS[*]}" \
    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"

-  echo "[fleet] npm ci + build (tsc + admin-web & database-admin SPAs)"
+  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
 set -euo pipefail
 flock /var/lock/cph-hub-release-publish bash -c '
@@ -98,11 +97,9 @@ flock /var/lock/cph-hub-release-publish bash -c '
  cd "$HUB_DIR"
  PUPPETEER_SKIP_DOWNLOAD=1 npm ci
  npm ci --prefix admin-web
-  npm ci --prefix database-admin
  npm run audit:production
  npm run build
  test -f admin-web/build/index.html
-  test -f database-admin/build/index.html
  touch "$RELEASE_DIR/.complete"
 '
 REMOTE
@@ -60,11 +60,10 @@ if [ "$release_ready" = false ]; then
    -e "ssh ${SSH_OPTS[*]}" \
    "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"

-  # 2. Install deps (hub + both SPAs), audit hub prod, build tsc + SPAs, mark complete.
-  # `npm run build` → tsc then admin:build + database:build → admin-web/build and
-  # database-admin/build for registerStaticSpa / registerDatabaseSpa.
+  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
+  # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
  ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm ci --prefix database-admin && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi

 # 3. Ensure the service is installed (idempotent), then restart.
@@ -1,16 +1,13 @@
 {
  "name": "@paradigm/hub",
-  "version": "0.0.36",
+  "version": "0.0.31",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@paradigm/hub",
-      "version": "0.0.36",
+      "version": "0.0.31",
      "dependencies": {
-        "@alicloud/credentials": "^2.4.5",
-        "@alicloud/docmind-api20220711": "^1.4.15",
-        "@alicloud/tea-util": "^1.4.11",
        "@anthropic-ai/claude-agent-sdk": "^0.3.202",
        "@fastify/cookie": "^11.0.2",
        "@larksuiteoapi/node-sdk": "^1.70.0",
@@ -77,175 +74,6 @@
        "zod": "^3.25.76 || ^4.1.8"
      }
    },
-    "node_modules/@alicloud/credentials": {
-      "version": "2.4.5",
-      "resolved": "https://registry.npmjs.org/@alicloud/credentials/-/credentials-2.4.5.tgz",
-      "integrity": "sha512-od1ufCxOO7cP2R4EVFliOB0kGo9lUXCibyj/mzmI6yLhxeqhqsegTzVsx5p2NJJsceKJnYcmye7FWKyLJAFBkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.8.0",
-        "httpx": "^2.3.3",
-        "ini": "^1.3.5",
-        "kitx": "^2.0.0"
-      }
-    },
-    "node_modules/@alicloud/darabonba-array": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@alicloud/darabonba-array/-/darabonba-array-0.1.2.tgz",
-      "integrity": "sha512-ZPuQ+bJyjrd8XVVm55kl+ypk7OQoi1ZH/DiToaAEQaGvgEjrTcvQkg71//vUX/6cvbLIF5piQDvhrLb+lUEIPQ==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.7.1"
-      }
-    },
-    "node_modules/@alicloud/darabonba-encode-util": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/@alicloud/darabonba-encode-util/-/darabonba-encode-util-0.0.2.tgz",
-      "integrity": "sha512-mlsNctkeqmR0RtgE1Rngyeadi5snLOAHBCWEtYf68d7tyKskosXDTNeZ6VCD/UfrUu4N51ItO8zlpfXiOgeg3A==",
-      "license": "ISC",
-      "dependencies": {
-        "moment": "^2.29.1"
-      }
-    },
-    "node_modules/@alicloud/darabonba-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/@alicloud/darabonba-map/-/darabonba-map-0.0.1.tgz",
-      "integrity": "sha512-2ep+G3YDvuI+dRYVlmER1LVUQDhf9kEItmVB/bbEu1pgKzelcocCwAc79XZQjTcQGFgjDycf3vH87WLDGLFMlw==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.7.1"
-      }
-    },
-    "node_modules/@alicloud/darabonba-signature-util": {
-      "version": "0.0.4",
-      "resolved": "https://registry.npmjs.org/@alicloud/darabonba-signature-util/-/darabonba-signature-util-0.0.4.tgz",
-      "integrity": "sha512-I1TtwtAnzLamgqnAaOkN0IGjwkiti//0a7/auyVThdqiC/3kyafSAn6znysWOmzub4mrzac2WiqblZKFcN5NWg==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/darabonba-encode-util": "^0.0.1"
-      }
-    },
-    "node_modules/@alicloud/darabonba-signature-util/node_modules/@alicloud/darabonba-encode-util": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/@alicloud/darabonba-encode-util/-/darabonba-encode-util-0.0.1.tgz",
-      "integrity": "sha512-Sl5vCRVAYMqwmvXpJLM9hYoCHOMsQlGxaWSGhGWulpKk/NaUBArtoO1B0yHruJf1C5uHhEJIaylYcM48icFHgw==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.7.1",
-        "moment": "^2.29.1"
-      }
-    },
-    "node_modules/@alicloud/darabonba-string": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@alicloud/darabonba-string/-/darabonba-string-1.0.3.tgz",
-      "integrity": "sha512-NyWwrU8cAIesWk3uHL1Q7pTDTqLkCI/0PmJXC4/4A0MFNAZ9Ouq0iFBsRqvfyUujSSM+WhYLuTfakQXiVLkTMA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.5.1"
-      }
-    },
-    "node_modules/@alicloud/docmind-api20220711": {
-      "version": "1.4.15",
-      "resolved": "https://registry.npmjs.org/@alicloud/docmind-api20220711/-/docmind-api20220711-1.4.15.tgz",
-      "integrity": "sha512-QmjSDPV52d2B5bd/Dk3Zeofu+cJFPKYS+MphIHqlulfYsOynLgOaDqTRMGTK/RhcmVCwG14CyZ/15GBF00GRFw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@alicloud/credentials": "^2.4.2",
-        "@alicloud/openapi-core": "^1.0.0",
-        "@darabonba/typescript": "^1.0.0"
-      }
-    },
-    "node_modules/@alicloud/endpoint-util": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/@alicloud/endpoint-util/-/endpoint-util-0.0.1.tgz",
-      "integrity": "sha512-+pH7/KEXup84cHzIL6UJAaPqETvln4yXlD9JzlrqioyCSaWxbug5FUobsiI6fuUOpw5WwoB3fWAtGbFnJ1K3Yg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.5.1",
-        "kitx": "^2.0.0"
-      }
-    },
-    "node_modules/@alicloud/gateway-pop": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/@alicloud/gateway-pop/-/gateway-pop-0.0.6.tgz",
-      "integrity": "sha512-KF4I+JvfYuLKc3fWeWYIZ7lOVJ9jRW0sQXdXidZn1DKZ978ncfGf7i0LBfONGk4OxvNb/HD3/0yYhkgZgPbKtA==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/credentials": "^2",
-        "@alicloud/darabonba-array": "^0.1.0",
-        "@alicloud/darabonba-encode-util": "^0.0.2",
-        "@alicloud/darabonba-map": "^0.0.1",
-        "@alicloud/darabonba-signature-util": "^0.0.4",
-        "@alicloud/darabonba-string": "^1.0.2",
-        "@alicloud/endpoint-util": "^0.0.1",
-        "@alicloud/gateway-spi": "^0.0.8",
-        "@alicloud/openapi-util": "^0.3.2",
-        "@alicloud/tea-typescript": "^1.7.1",
-        "@alicloud/tea-util": "^1.4.8"
-      }
-    },
-    "node_modules/@alicloud/gateway-spi": {
-      "version": "0.0.8",
-      "resolved": "https://registry.npmjs.org/@alicloud/gateway-spi/-/gateway-spi-0.0.8.tgz",
-      "integrity": "sha512-KM7fu5asjxZPmrz9sJGHJeSU+cNQNOxW+SFmgmAIrITui5hXL2LB+KNRuzWmlwPjnuA2X3/keq9h6++S9jcV5g==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/credentials": "^2",
-        "@alicloud/tea-typescript": "^1.7.1"
-      }
-    },
-    "node_modules/@alicloud/openapi-core": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@alicloud/openapi-core/-/openapi-core-1.0.8.tgz",
-      "integrity": "sha512-xs8LdgMDcEUqv13kZ4nl+Vd+Fc1mixTF0g1lm5QSrNWDaLUUD5vqpuMtvUZnKNnq9PITfUQ+8KunAvNQJpFo8g==",
-      "hasInstallScript": true,
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/credentials": "^2.4.2",
-        "@alicloud/gateway-pop": "0.0.6",
-        "@alicloud/gateway-spi": "^0.0.8",
-        "@darabonba/typescript": "^1.0.5"
-      }
-    },
-    "node_modules/@alicloud/openapi-util": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/@alicloud/openapi-util/-/openapi-util-0.3.3.tgz",
-      "integrity": "sha512-vf0cQ/q8R2U7ZO88X5hDiu1yV3t/WexRj+YycWxRutkH/xVXfkmpRgps8lmNEk7Ar+0xnY8+daN2T+2OyB9F4A==",
-      "license": "ISC",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.7.1",
-        "@alicloud/tea-util": "^1.3.0",
-        "kitx": "^2.1.0",
-        "sm3": "^1.0.3"
-      }
-    },
-    "node_modules/@alicloud/tea-typescript": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@alicloud/tea-typescript/-/tea-typescript-1.8.0.tgz",
-      "integrity": "sha512-CWXWaquauJf0sW30mgJRVu9aaXyBth5uMBCUc+5vKTK1zlgf3hIqRUjJZbjlwHwQ5y9anwcu18r48nOZb7l2QQ==",
-      "license": "ISC",
-      "dependencies": {
-        "@types/node": "^12.0.2",
-        "httpx": "^2.2.6"
-      }
-    },
-    "node_modules/@alicloud/tea-typescript/node_modules/@types/node": {
-      "version": "12.20.55",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.20.55.tgz",
-      "integrity": "sha512-J8xLz7q2OFulZ2cyGTLE1TbbZcjpno7FaN6zdJNrgAdrJ+DZzh/uFR6YrTb4C+nXakvud8Q4+rbhoIWlYQbUFQ==",
-      "license": "MIT"
-    },
-    "node_modules/@alicloud/tea-util": {
-      "version": "1.4.11",
-      "resolved": "https://registry.npmjs.org/@alicloud/tea-util/-/tea-util-1.4.11.tgz",
-      "integrity": "sha512-HyPEEQ8F0WoZegiCp7sVdrdm6eBOB+GCvGl4182u69LDFktxfirGLcAx3WExUr1zFWkq2OSmBroTwKQ4w/+Yww==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.5.1",
-        "@darabonba/typescript": "^1.0.0",
-        "kitx": "^2.0.0"
-      }
-    },
    "node_modules/@anthropic-ai/claude-agent-sdk": {
      "version": "0.3.202",
      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-agent-sdk/-/claude-agent-sdk-0.3.202.tgz",
@@ -406,24 +234,6 @@
        "node": ">=6.9.0"
      }
    },
-    "node_modules/@darabonba/typescript": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/@darabonba/typescript/-/typescript-1.0.5.tgz",
-      "integrity": "sha512-pfxHFVM8I3h8K2o8skpDQLMmR5iAeQ2eNpP1HrKDEm/9ZPF8aKwDKPwwEszT1NnIo0Y3++E7x1YsVkVpGjA/xw==",
-      "license": "Apache License 2.0",
-      "dependencies": {
-        "@alicloud/tea-typescript": "^1.5.1",
-        "http-proxy-agent": "^5.0.0",
-        "https-proxy-agent": "^5.0.1",
-        "httpx": "^2.3.2",
-        "lodash": "^4.17.21",
-        "moment": "^2.30.1",
-        "moment-timezone": "^0.5.45",
-        "socks-proxy-agent": "^6.2.1",
-        "ws": "^8.18.0",
-        "xml2js": "^0.6.2"
-      }
-    },
    "node_modules/@emnapi/core": {
      "version": "1.11.2",
      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
@@ -1586,15 +1396,6 @@
      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
      "license": "MIT"
    },
-    "node_modules/@tootallnate/once": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.1.tgz",
-      "integrity": "sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10"
-      }
-    },
    "node_modules/@tybys/wasm-util": {
      "version": "0.10.3",
      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
@@ -3029,20 +2830,6 @@
        "url": "https://opencollective.com/express"
      }
    },
-    "node_modules/http-proxy-agent": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-5.0.0.tgz",
-      "integrity": "sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==",
-      "license": "MIT",
-      "dependencies": {
-        "@tootallnate/once": "2",
-        "agent-base": "6",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
    "node_modules/https-proxy-agent": {
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
@@ -3056,25 +2843,6 @@
        "node": ">= 6"
      }
    },
-    "node_modules/httpx": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/httpx/-/httpx-2.3.3.tgz",
-      "integrity": "sha512-k1qv94u1b6e+XKCxVbLgYlOypVP9MPGpnN5G/vxFf6tDO4V3xpz3d6FUOY/s8NtPgaq5RBVVgSB+7IHpVxMYzw==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "^20",
-        "debug": "^4.1.1"
-      }
-    },
-    "node_modules/httpx/node_modules/@types/node": {
-      "version": "20.19.43",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",
-      "integrity": "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA==",
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
    "node_modules/iconv-lite": {
      "version": "0.7.3",
      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
@@ -3099,17 +2867,12 @@
      "license": "ISC",
      "peer": true
    },
-    "node_modules/ini": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
-      "license": "ISC"
-    },
    "node_modules/ip-address": {
      "version": "10.2.0",
      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">= 12"
      }
@@ -3209,15 +2972,6 @@
      "license": "BSD-2-Clause",
      "peer": true
    },
-    "node_modules/kitx": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/kitx/-/kitx-2.2.0.tgz",
-      "integrity": "sha512-tBMwe6AALTBQJb0woQDD40734NKzb0Kzi3k7wQj9ar3AbP9oqhoVrdXPh7rk2r00/glIgd0YbToIUJsnxWMiIg==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "^22.5.4"
-      }
-    },
    "node_modules/light-my-request": {
      "version": "6.6.0",
      "resolved": "https://registry.npmjs.org/light-my-request/-/light-my-request-6.6.0.tgz",
@@ -3516,12 +3270,6 @@
        "url": "https://opencollective.com/parcel"
      }
    },
-    "node_modules/lodash": {
-      "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
-      "license": "MIT"
-    },
    "node_modules/lodash.identity": {
      "version": "3.0.0",
      "resolved": "https://registry.npmjs.org/lodash.identity/-/lodash.identity-3.0.0.tgz",
@@ -3609,27 +3357,6 @@
        "node": ">= 0.6"
      }
    },
-    "node_modules/moment": {
-      "version": "2.30.1",
-      "resolved": "https://registry.npmjs.org/moment/-/moment-2.30.1.tgz",
-      "integrity": "sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==",
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/moment-timezone": {
-      "version": "0.5.48",
-      "resolved": "https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.48.tgz",
-      "integrity": "sha512-f22b8LV1gbTO2ms2j2z13MuPogNoh5UzxL3nzNAYKGraILnbGc9NEE6dyiiiLv46DGRb8A4kg8UKWLjPthxBHw==",
-      "license": "MIT",
-      "dependencies": {
-        "moment": "^2.29.4"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
    "node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -4249,15 +3976,6 @@
      "license": "MIT",
      "peer": true
    },
-    "node_modules/sax": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.0.tgz",
-      "integrity": "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=11.0.0"
-      }
-    },
    "node_modules/secure-json-parse": {
      "version": "4.1.0",
      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.0.tgz",
@@ -4475,50 +4193,6 @@
      "dev": true,
      "license": "ISC"
    },
-    "node_modules/sm3": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sm3/-/sm3-1.0.3.tgz",
-      "integrity": "sha512-KyFkIfr8QBlFG3uc3NaljaXdYcsbRy1KrSfc4tsQV8jW68jAktGeOcifu530Vx/5LC+PULHT0Rv8LiI8Gw+c1g==",
-      "license": "MIT"
-    },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks": {
-      "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
-      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "^10.1.1",
-        "smart-buffer": "^4.2.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks-proxy-agent": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-6.2.1.tgz",
-      "integrity": "sha512-a6KW9G+6B3nWZ1yB8G7pJwL3ggLy1uTzKAgCb7ttblwqdz9fMGJUuTy3uFzEP48FAs9FLILlmzDlE2JJhVQaXQ==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^6.0.2",
-        "debug": "^4.3.3",
-        "socks": "^2.6.2"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
    "node_modules/sonic-boom": {
      "version": "4.2.1",
      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
@@ -5026,28 +4700,6 @@
        }
      }
    },
-    "node_modules/xml2js": {
-      "version": "0.6.2",
-      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
-      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
-      "license": "MIT",
-      "dependencies": {
-        "sax": ">=0.6.0",
-        "xmlbuilder": "~11.0.0"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/xmlbuilder": {
-      "version": "11.0.1",
-      "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
-      "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
    "node_modules/zod": {
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
@@ -1,15 +1,12 @@
 {
  "name": "@paradigm/hub",
-  "version": "0.0.36",
+  "version": "0.0.31",
  "private": true,
  "type": "module",
  "engines": {
    "node": ">=24"
  },
  "dependencies": {
-    "@alicloud/credentials": "^2.4.5",
-    "@alicloud/docmind-api20220711": "^1.4.15",
-    "@alicloud/tea-util": "^1.4.11",
    "@anthropic-ai/claude-agent-sdk": "^0.3.202",
    "@fastify/cookie": "^11.0.2",
    "@larksuiteoapi/node-sdk": "^1.70.0",
@@ -30,10 +27,10 @@
      "axios": "1.18.1"
    }
  },
-  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Semantics pinned by docs/adr/ (ADR-0001 through ADR-0027).",
+  "description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
  "scripts": {
    "dev": "npm run prisma:migrate && tsx watch src/server.ts",
-    "build": "tsc -p tsconfig.json && npm run admin:build && npm run database:build",
+    "build": "tsc -p tsconfig.json && npm run admin:build",
    "start": "npm run prisma:migrate && node dist/server.js",
    "check": "tsc -p tsconfig.json --noEmit",
    "audit:production": "npm audit --omit=dev --audit-level=high",
@@ -48,8 +45,6 @@
    "test": "vitest run",
    "test:watch": "vitest",
    "admin:dev": "npm run dev --prefix admin-web",
-    "admin:build": "npm run build --prefix admin-web",
-    "database:dev": "npm run dev --prefix database-admin",
-    "database:build": "npm run build --prefix database-admin"
+    "admin:build": "npm run build --prefix admin-web"
  }
 }
@@ -1,6 +1,6 @@
 -- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
 -- model: the platform administration control plane is a separate identity/session/
-- audit surface, intentionally not built
+-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
 -- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
 -- reader — no guard, route, or service queries it for an authorization decision —
 -- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.
@@ -1,70 +0,0 @@
-- Global, unlimited-depth member group hierarchy (requirement 3.1-3.3).
-- Managed only by the platform super administrator; deliberately NOT
-- org-scoped. Stores membership + nesting only, never permission data.
-- Deletion is soft (archivedAt / revokedAt markers); a group delete
-- cascade-soft-deletes its whole subtree as an application operation.
-- The permission side (GROUP principal, FOLDER resource, grant inheritance)
-- is intentionally deferred to a later migration.
-
-- CreateTable
-CREATE TABLE "MemberGroup" (
-    "id" TEXT NOT NULL,
-    "parentId" TEXT,
-    "name" TEXT NOT NULL,
-    "description" TEXT,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-    "archivedAt" TIMESTAMP(3),
-
-    CONSTRAINT "MemberGroup_pkey" PRIMARY KEY ("id")
-);
-
-- CreateTable
-CREATE TABLE "MemberGroupMembership" (
-    "id" TEXT NOT NULL,
-    "groupId" TEXT NOT NULL,
-    "userId" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "revokedAt" TIMESTAMP(3),
-
-    CONSTRAINT "MemberGroupMembership_pkey" PRIMARY KEY ("id")
-);
-
-- CreateTable
-CREATE TABLE "MemberGroupClosure" (
-    "ancestorId" TEXT NOT NULL,
-    "descendantId" TEXT NOT NULL,
-    "depth" INTEGER NOT NULL,
-
-    CONSTRAINT "MemberGroupClosure_pkey" PRIMARY KEY ("ancestorId", "descendantId")
-);
-
-- CreateIndex
-CREATE INDEX "MemberGroup_parentId_archivedAt_idx" ON "MemberGroup"("parentId", "archivedAt");
-
-- CreateIndex
-CREATE INDEX "MemberGroupMembership_userId_revokedAt_idx" ON "MemberGroupMembership"("userId", "revokedAt");
-
-- CreateIndex
-CREATE INDEX "MemberGroupMembership_groupId_revokedAt_idx" ON "MemberGroupMembership"("groupId", "revokedAt");
-
-- CreateIndex
-CREATE UNIQUE INDEX "MemberGroupMembership_groupId_userId_revokedAt_key" ON "MemberGroupMembership"("groupId", "userId", "revokedAt");
-
-- CreateIndex
-CREATE INDEX "MemberGroupClosure_descendantId_idx" ON "MemberGroupClosure"("descendantId");
-
-- AddForeignKey
-ALTER TABLE "MemberGroup" ADD CONSTRAINT "MemberGroup_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "MemberGroup"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
-
-- AddForeignKey
-ALTER TABLE "MemberGroupMembership" ADD CONSTRAINT "MemberGroupMembership_groupId_fkey" FOREIGN KEY ("groupId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
-- AddForeignKey
-ALTER TABLE "MemberGroupMembership" ADD CONSTRAINT "MemberGroupMembership_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
-- AddForeignKey
-ALTER TABLE "MemberGroupClosure" ADD CONSTRAINT "MemberGroupClosure_ancestorId_fkey" FOREIGN KEY ("ancestorId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
-- AddForeignKey
-ALTER TABLE "MemberGroupClosure" ADD CONSTRAINT "MemberGroupClosure_descendantId_fkey" FOREIGN KEY ("descendantId") REFERENCES "MemberGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -1,6 +1,6 @@
 // Prisma schema for Curriculum Project Hub.
 //
-// Aligns to ADR-0001..0004, 0017. Key divergences from the
+// Aligns to spec/System (ADR-0001..0004, 0017). Key divergences from the
 // legacy teaching-material-host-service schema, each deliberate:
 //
 //  - AgentSession is provider/model-bound. Provider runtime cursors such as
@@ -11,8 +11,8 @@
 //  - ProjectGroupBinding is project→chat only (ADR-0001 1:1); legacy mixed
 //    user/chat targets into one binding table.
 //  - PermissionGrant + PermissionSettings land (ADR-0004), missing in legacy.
-//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (the run-state set is
-//    open — add states without a schema migration war).
+//  - AgentRunStatus adds WAITING_FOR_USER + TIMED_OUT (spec RunState; enum
+//    completeness OPEN — add states without a schema migration war).

 generator client {
  provider = "prisma-client-js"
@@ -61,7 +61,7 @@ enum OrganizationStatus {
 }

 /// Org-scoped membership role. Distinct from project PermissionRole and from
-/// the platform administrator surface (ADR-0023),
+/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
 /// which is a separate control plane not modeled in alpha (ADR-0025).
 model OrganizationMembership {
  id             String                 @id @default(cuid())
@@ -193,7 +193,6 @@ model User {
  heldLocks                    ProjectAgentLock[]                   @relation("lockHolder")
  feishuBindings               ProjectGroupBinding[]                @relation("bindingCreator")
  teamMemberships              TeamMembership[]
-  memberGroupMemberships       MemberGroupMembership[]
  externalPrincipalMemberships ExternalPrincipalMembership[]
  permissionGrants             PermissionGrant[]                    @relation("grantCreator")
  roleTriggerGrants            RoleTriggerGrant[]                   @relation("roleGrantCreator")
@@ -394,67 +393,6 @@ model TeamExternalBinding {
  @@index([teamId, revokedAt])
 }

-// --- Member groups (global, nestable authorization principal) ------------
-
-/// Global, unlimited-depth member group. Managed only by the platform super administrator (ADR-0023);
-/// Deletion is soft: `archivedAt` is a marker.
-/// Deleting a group cascade-soft-deletes its whole subtree — an application
-/// operation (walk the subtree, stamp archivedAt), not a DB constraint.
-model MemberGroup {
-  id          String    @id @default(cuid())
-  parentId    String?
-  name        String
-  description String?
-  createdAt   DateTime  @default(now())
-  updatedAt   DateTime  @updatedAt
-  archivedAt  DateTime?
-
-  parent       MemberGroup?            @relation("groupTree", fields: [parentId], references: [id], onDelete: Restrict)
-  children     MemberGroup[]           @relation("groupTree")
-  memberships  MemberGroupMembership[]
-  asAncestor   MemberGroupClosure[]    @relation("ancestor")
-  asDescendant MemberGroupClosure[]    @relation("descendant")
-
-  @@index([parentId, archivedAt])
-}
-
-/// User↔group many-to-many; a user may belong to multiple groups. Soft delete
-/// via `revokedAt` (same pattern as TeamMembership) allows re-adding a removed
-/// member. `userId, revokedAt` index is the resolution hot path: fetch a user's direct groups.
-model MemberGroupMembership {
-  id        String    @id @default(cuid())
-  groupId   String
-  userId    String
-  createdAt DateTime  @default(now())
-  revokedAt DateTime?
-
-  group MemberGroup @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  user  User        @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@unique([groupId, userId, revokedAt])
-  @@index([userId, revokedAt])
-  @@index([groupId, revokedAt])
-}
-
-/// Transitive closure of the MemberGroup tree. Every group has a depth=0
-/// self row. Turns ancestor/descendant resolution into one indexed join
-/// instead of a recursive CTE; maintained only on create / reparent (rare
-/// super-admin ops, so the write cost is amortized against hot reads). On soft
-/// delete the closure rows are retained; resolution filters by
-/// MemberGroup.archivedAt. Reparent must reject a new parent inside the moved
-/// subtree (cycle guard).
-model MemberGroupClosure {
-  ancestorId   String
-  descendantId String
-  depth        Int
-
-  ancestor   MemberGroup @relation("ancestor", fields: [ancestorId], references: [id], onDelete: Cascade)
-  descendant MemberGroup @relation("descendant", fields: [descendantId], references: [id], onDelete: Cascade)
-
-  @@id([ancestorId, descendantId])
-  @@index([descendantId])
-}
-
 /// Locally synchronized Feishu external principal membership.
 model ExternalDirectoryConnection {
  id               String    @id @default(cuid())
@@ -1,89 +0,0 @@
-/**
- * Smoke test: real Aliyun docmind API call using createReadStream.
- * Run: node --experimental-strip-types scripts/smoke-docmind.ts <pdf-path>
- */
-import DocmindClient from "@alicloud/docmind-api20220711";
-import { RuntimeOptions } from "@alicloud/tea-util";
-import { createReadStream } from "node:fs";
-import { basename } from "node:path";
-
-const accessKeyId = process.env["ALIBABA_CLOUD_ACCESS_KEY_ID"];
-const accessKeySecret = process.env["ALIBABA_CLOUD_ACCESS_KEY_SECRET"];
-if (accessKeyId === undefined || accessKeySecret === undefined) {
-  console.error("Set ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET env vars.");
-  process.exit(1);
-}
-
-const pdfPath = process.argv[2] ?? "../examples/trial/prime_sieve.pdf";
-console.log(`Parsing: ${pdfPath}`);
-
-const client = new DocmindClient.default({
-  endpoint: "docmind-api.cn-hangzhou.aliyuncs.com",
-  accessKeyId,
-  accessKeySecret,
-  type: "access_key",
-  regionId: "cn-hangzhou",
-} as never);
-
-const fileStream = createReadStream(pdfPath);
-const runtime = new RuntimeOptions({});
-
-console.log("Submitting job...");
-const submitResp = await client.submitDocParserJobAdvance(
-  new DocmindClient.SubmitDocParserJobAdvanceRequest({
-    fileUrlObject: fileStream,
-    fileName: basename(pdfPath),
-    outputFormat: ["markdown"],
-    formulaEnhancement: true,
-  }),
-  runtime,
-);
-const jobId = submitResp.body?.data?.id;
-console.log("Job ID:", jobId);
-
-if (jobId === undefined) {
-  console.error("No job id:", JSON.stringify(submitResp.body));
-  process.exit(1);
-}
-
-console.log("Polling...");
-const deadline = Date.now() + 5 * 60_000;
-let status = "";
-let markdownUrl = "";
-let pageCount = 0;
-while (Date.now() < deadline) {
-  await new Promise((r) => setTimeout(r, 10_000));
-  const resp = await client.queryDocParserStatus(
-    new DocmindClient.QueryDocParserStatusRequest({ id: jobId }),
-  );
-  const data = (resp.body as { data?: { status?: string; pageCountEstimate?: number; outputFormatResult?: Array<{ outputFileUrl?: string; outputType?: string }> } }).data;
-  status = data?.status ?? "";
-  console.log(`  status: ${status}`);
-  if (status === "success") {
-    const md = data?.outputFormatResult?.find((r) => r.outputType === "markdown");
-    markdownUrl = md?.outputFileUrl ?? "";
-    pageCount = data?.pageCountEstimate ?? 0;
-    break;
-  }
-  if (status === "fail") {
-    console.error("Job failed!");
-    process.exit(1);
-  }
-}
-
-if (status !== "success" || markdownUrl === "") {
-  console.error("Failed or timed out:", status);
-  process.exit(1);
-}
-
-console.log("Downloading markdown from OSS...");
-const mdResp = await fetch(markdownUrl);
-const markdown = await mdResp.text();
-
-console.log("--- Result ---");
-console.log("Pages:", pageCount);
-console.log("Cost (USD, est):", ((pageCount > 0 ? pageCount : 1) * 0.0056).toFixed(4));
-console.log("Job ID:", jobId);
-console.log("Markdown length:", markdown.length, "chars");
-console.log("--- Markdown (first 1000 chars) ---");
-console.log(markdown.slice(0, 1000));
@@ -1,63 +0,0 @@
---
-name: pdf-to-md
-description: >
-  Convert PDF documents to Markdown bundles using the convert_pdf_to_md tool.
-  Handles PDFs from Feishu messages, local workspace files, and produces
-  high-quality Markdown with LaTeX formulas and extracted images.
---
-
-# PDF to Markdown Conversion
-
-## When to use
-
-Use this skill when the user asks to convert a PDF to Markdown, extract text
-from a PDF, or turn a PDF document into an editable format.
-
-## How it works
-
-The `convert_pdf_to_md` tool (provided by the `cph_hub` MCP server) calls
-Alibaba Cloud Document Mind to parse the PDF. It:
-
- Extracts text in reading order (handles multi-column, scanned, and
-  multi-language documents)
- Converts mathematical formulas to **LaTeX** (`$...$` inline, `$$...$$` block)
- Extracts tables as Markdown tables
- Downloads embedded images into the output directory
- Writes a single `document.md` file plus image files
-
-## Workflow
-
-### PDF from a Feishu message
-
-1. Use `feishu_read_context` to find the `file_key` of the PDF attachment.
-2. Use `feishu_download_resource` to download it into the workspace.
-3. Use `convert_pdf_to_md` with the downloaded file path and an output directory.
-
-### PDF already in the workspace
-
-1. Use `convert_pdf_to_md` directly with the file path and an output directory.
-
-## Important rules
-
- **Always** use `convert_pdf_to_md` for PDF→Markdown. Do NOT attempt to parse
-  PDFs yourself with Read, Bash, Python, or any other method. The tool provides
-  accurate formula, table, and image extraction that manual methods cannot
-  match.
- If `convert_pdf_to_md` fails because no capability connection is configured,
-  tell the user to ask their organization admin to configure the Aliyun
-  docmind credential in the admin web UI (组织后台 → 能力).
- The output directory will be created if it does not exist.
- After conversion, use `send_file` to send the generated markdown back to the
-  user if they requested it.
-
-## Output
-
-The tool returns a list of generated files:
- `document.md` — the main markdown file
- `*.jpg` / `*.png` — extracted images, referenced from the markdown
-
-## Cost
-
-The conversion is billed per page (0.04 CNY/page ≈ $0.0056/page for the
-enhanced formula mode). The cost is automatically recorded on the run's
-usage ledger.
@@ -432,16 +432,16 @@ async function resolvePostLoginRedirect(
      select: { organization: { select: { slug: true, name: true } } },
    });
    if (intended === null) return "/admin?error=not_an_active_org_member";
-    const orgRoot = "/admin";
+    const orgRoot = `/admin/org/${intended.organization.slug}`;
    // Default / missing returnTo sanitizes to "/admin". Always land in the org
    // admin SPA (not the legacy static "close this tab" complete page).
    if (returnTo === "/admin") {
      return orgRoot;
    }
-    return normalizeAdminReturnTo(returnTo) ?? orgRoot;
+    return returnTo === orgRoot || returnTo.startsWith(`${orgRoot}/`) ? returnTo : orgRoot;
  }
  if (returnTo !== "/admin" && returnTo.startsWith("/admin")) {
-    return normalizeAdminReturnTo(returnTo) ?? "/admin";
+    return returnTo;
  }
  const membership = await prisma.organizationMembership.findFirst({
    where: {
@@ -454,7 +454,7 @@ async function resolvePostLoginRedirect(
    orderBy: { createdAt: "asc" },
  });
  if (membership !== null) {
-    return "/admin";
+    return `/admin/org/${membership.organization.slug}`;
  }
  // Member-only or no org: still land on a shell page (SPA will explain).
  const any = await prisma.organizationMembership.findFirst({
@@ -463,7 +463,7 @@ async function resolvePostLoginRedirect(
    orderBy: { createdAt: "asc" },
  });
  if (any !== null) {
-    return "/admin/projects";
+    return `/admin/org/${any.organization.slug}`;
  }
  return "/admin/login?error=no_organization";
 }
@@ -489,18 +489,7 @@ export function sanitizeReturnTo(raw: string): string {
  if (!raw.startsWith("/admin")) {
    return "/admin";
  }
-  return normalizeAdminReturnTo(raw) ?? "/admin";
-}
-
-/** Map legacy `/admin/org/:slug[...]` bookmarks onto slugless `/admin[...]` paths. */
-export function normalizeAdminReturnTo(path: string): string | null {
-  if (!path.startsWith("/admin")) return null;
-  const legacy = path.match(/^\/admin\/org\/[^/]+(\/.*)?$/);
-  if (legacy) {
-    const rest = legacy[1] ?? "";
-    return rest === "" ? "/admin" : `/admin${rest}`;
-  }
-  return path;
+  return raw;
 }

 function trimTrailingSlash(url: string): string {
@@ -1,131 +0,0 @@
-/**
- * ADR-0027: Admin routes for organization-scoped capability connections.
- * GET    /api/org/:orgSlug/capability-connections           — list all
- * GET    /api/org/:orgSlug/capability-connections/:capId    — read one
- * PUT    /api/org/:orgSlug/capability-connections/:capId    — rotate/create
- * DELETE /api/org/:orgSlug/capability-connections/:capId    — disable
- */
-import type { PrismaClient } from "@prisma/client";
-import type { FastifyInstance } from "fastify";
-import { CapabilityConnectionService } from "../../capability/capabilityConnectionService.js";
-import { CapabilityReadinessError, type CapabilityReadinessProbe } from "../../capability/capabilityReadiness.js";
-import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
-import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
-import { handleRouteError } from "../errors.js";
-
-export interface CapabilityConnectionRouteConfig {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  readonly secretEnvelope: LocalSecretEnvelope;
-  readonly readinessProbe?: CapabilityReadinessProbe;
-}
-
-export async function registerCapabilityConnectionRoutes(
-  app: FastifyInstance,
-  config: CapabilityConnectionRouteConfig,
-): Promise<void> {
-  const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
-  const connections = new CapabilityConnectionService(
-    config.prisma,
-    config.secretEnvelope,
-    config.readinessProbe,
-  );
-
-  app.get("/api/org/:orgSlug/capability-connections", async (request, reply) => {
-    try {
-      const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      return { connections: await connections.list(auth.organization.id) };
-    } catch (error) {
-      request.log.error({ requestId: request.id, operation: "capability_connection.list" }, "list failed");
-      return handleRouteError(reply, error);
-    }
-  });
-
-  app.get("/api/org/:orgSlug/capability-connections/:capabilityId", async (request, reply) => {
-    try {
-      const { orgSlug, capabilityId } = request.params as { orgSlug: string; capabilityId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      return { connection: await connections.read(auth.organization.id, capabilityId) };
-    } catch (error) {
-      request.log.error({ requestId: request.id, operation: "capability_connection.read" }, "read failed");
-      return handleRouteError(reply, error);
-    }
-  });
-
-  app.put("/api/org/:orgSlug/capability-connections/:capabilityId", async (request, reply) => {
-    try {
-      const { orgSlug, capabilityId } = request.params as { orgSlug: string; capabilityId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = parseBody(request.body);
-      const result = await connections.rotate({
-        organizationId: auth.organization.id,
-        capabilityId,
-        actorUserId: auth.user.id,
-        ...body,
-      });
-      request.log.info({
-        organizationId: auth.organization.id,
-        capabilityId,
-        connectionId: result.id,
-        status: result.status,
-        secretVersion: result.activeVersion,
-      }, result.created ? "Capability Connection created" : "Capability Connection rotated");
-      const { created, ...metadata } = result;
-      return reply.status(created ? 201 : 200).send(metadata);
-    } catch (error) {
-      const facts = error instanceof CapabilityReadinessError
-        ? {
-            errorCode: error.code,
-            failureCategory: error.category,
-            ...(error.upstreamStatus !== undefined ? { upstreamStatus: error.upstreamStatus } : {}),
-          }
-        : { errorCode: "capability_connection_write_failed" };
-      request.log.error({ requestId: request.id, operation: "capability_connection.rotate", ...facts }, "rotate failed");
-      return handleRouteError(reply, error);
-    }
-  });
-
-  app.delete("/api/org/:orgSlug/capability-connections/:capabilityId", async (request, reply) => {
-    try {
-      const { orgSlug, capabilityId } = request.params as { orgSlug: string; capabilityId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const result = await connections.disable({
-        organizationId: auth.organization.id,
-        capabilityId,
-        actorUserId: auth.user.id,
-      });
-      request.log.info({
-        organizationId: auth.organization.id,
-        capabilityId,
-        connectionId: result.id,
-        status: result.status,
-      }, "Capability Connection disabled");
-      return reply.send(result);
-    } catch (error) {
-      request.log.error({ requestId: request.id, operation: "capability_connection.disable" }, "disable failed");
-      return handleRouteError(reply, error);
-    }
-  });
-}
-
-function parseBody(value: unknown): { readonly accessKeyId: string; readonly accessKeySecret: string; readonly endpoint: string } {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error("invalid capability credential body");
-  }
-  const body = value as Record<string, unknown>;
-  for (const name of ["accessKeyId", "accessKeySecret", "endpoint"] as const) {
-    if (typeof body[name] !== "string" || (body[name] as string).trim() === "") {
-      throw new Error(`${name} is required`);
-    }
-  }
-  return {
-    accessKeyId: body["accessKeyId"] as string,
-    accessKeySecret: body["accessKeySecret"] as string,
-    endpoint: body["endpoint"] as string,
-  };
-}
@@ -22,8 +22,6 @@ import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../../connections/feishuReadiness.js";
 import { registerFeishuApplicationConnectionRoutes } from "./feishuApplicationConnectionRoutes.js";
-import { registerCapabilityConnectionRoutes } from "./capabilityConnectionRoutes.js";
-import type { CapabilityReadinessProbe } from "../../capability/capabilityReadiness.js";

 export interface OrgRouteConfig {
  readonly prisma: PrismaClient;
@@ -32,7 +30,6 @@ export interface OrgRouteConfig {
  readonly secretEnvelope: LocalSecretEnvelope;
  readonly providerReadinessProbe?: ProviderReadinessProbe;
  readonly feishuConnectionReadinessProbe?: FeishuReadinessProbe;
-  readonly capabilityReadinessProbe?: CapabilityReadinessProbe;
 }

 export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteConfig): Promise<void> {
@@ -141,12 +138,4 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
      ? { readinessProbe: config.feishuConnectionReadinessProbe }
      : {}),
  });
-  await registerCapabilityConnectionRoutes(app, {
-    prisma: config.prisma,
-    sessionSecret: config.sessionSecret,
-    secretEnvelope: config.secretEnvelope,
-    ...(config.capabilityReadinessProbe !== undefined
-      ? { readinessProbe: config.capabilityReadinessProbe }
-      : {}),
-  });
 }
@@ -14,7 +14,6 @@ export const CPH_HUB_MCP_TOOL_IDS = [
  "feishu_read_context",
  "feishu_download_resource",
  "request_approval",
-  "convert_pdf_to_md",
 ] as const;

 export type CphHubMcpToolId = (typeof CPH_HUB_MCP_TOOL_IDS)[number];
@@ -51,12 +50,10 @@ const ROLE_TOOL_TO_CPH_HUB_MCP_TOOL = new Map<string, CphHubMcpToolId>([
  ["feishu_read_context", "feishu_read_context"],
  ["feishu_download_resource", "feishu_download_resource"],
  ["request_approval", "request_approval"],
-  ["convert_pdf_to_md", "convert_pdf_to_md"],
  ["mcp__cph_hub__send_file", "send_file"],
  ["mcp__cph_hub__feishu_read_context", "feishu_read_context"],
  ["mcp__cph_hub__feishu_download_resource", "feishu_download_resource"],
  ["mcp__cph_hub__request_approval", "request_approval"],
-  ["mcp__cph_hub__convert_pdf_to_md", "convert_pdf_to_md"],
 ]);

 const SUPPORTED_ROLE_TOOLS = new Set([
@@ -24,10 +24,10 @@
 * denied by default and re-opened only for the workspace plus named system
 * runtimes, and `failIfUnavailable` hard-fails if the sandbox can't start. The
 * subprocess gets a minimal environment and SDK credential protection removes
- * provider secrets from Bash. This upholds the workspace-bounded file-op
- * invariant (ADR-0018) without re-implementing the
+ * provider secrets from Bash. This upholds `AgentFileOp.Authorized`
+ * (ADR-0018 / `Spec.System.AgentSurface`) without re-implementing the
 * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
- * is the mechanism, the ADR pins the invariant.
+ * is the mechanism, the contract pins the invariant.
 */
 import { query, type HookCallback, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage, type SDKSystemMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";
@@ -1,266 +0,0 @@
-/**
- * ADR-0027: Organization-scoped capability connection service. Manages the
- * lifecycle (rotate / read / disable) of capability credentials stored in
- * ADR-0024 encrypted envelopes with purpose="capability".
- *
- * Mirrors FeishuApplicationConnectionService, but keyed by (organizationId,
- * capabilityId) instead of 1:1 — an org may have multiple capabilities.
- */
-import { randomUUID } from "node:crypto";
-import type { Prisma, PrismaClient } from "@prisma/client";
-import { lockActiveOrganization } from "../org/status.js";
-import { LocalSecretEnvelope } from "../security/secretEnvelope.js";
-import { probeDocmindCredential, type CapabilityReadinessProbe } from "./capabilityReadiness.js";
-import type { CapabilitySecretPayload } from "./types.js";
-
-const CAPABILITY_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
-const KNOWN_CAPABILITY_IDS = new Set(["pdf_to_md_bundle", "audio_video_to_text"]);
-
-export interface CapabilityCredentialInput {
-  readonly accessKeyId: string;
-  readonly accessKeySecret: string;
-  readonly endpoint: string;
-}
-
-export interface RotateCapabilityInput extends CapabilityCredentialInput {
-  readonly organizationId: string;
-  readonly capabilityId: string;
-  readonly actorUserId: string;
-}
-
-export interface CapabilityConnectionMetadata {
-  readonly id: string;
-  readonly capabilityId: string;
-  readonly status: "DRAFT" | "ACTIVE" | "DISABLED";
-  readonly activeVersion: number | null;
-  readonly keyId: string | null;
-  readonly createdAt: Date;
-  readonly updatedAt: Date;
-}
-
-export interface CapabilityConnectionWriteResult extends CapabilityConnectionMetadata {
-  readonly created: boolean;
-}
-
-export type CapabilitySecretPayloadV1 = CapabilitySecretPayload;
-
-export class CapabilityConnectionService {
-  constructor(
-    private readonly prisma: PrismaClient,
-    private readonly secrets: LocalSecretEnvelope,
-    private readonly readinessProbe: CapabilityReadinessProbe = probeDocmindCredential,
-  ) {}
-
-  async rotate(input: RotateCapabilityInput): Promise<CapabilityConnectionWriteResult> {
-    if (!CAPABILITY_ID_PATTERN.test(input.capabilityId)) {
-      throw new Error(`invalid capabilityId: ${input.capabilityId}`);
-    }
-    const payload = validateCredential(input);
-    await this.prisma.$transaction(async (tx) => {
-      await requireCapabilityAdmin(tx, input);
-    });
-    await this.readinessProbe({
-      endpoint: payload.endpoint,
-      accessKeyId: payload.accessKeyId,
-      accessKeySecret: payload.accessKeySecret,
-    });
-
-    return this.prisma.$transaction(async (tx) => {
-      await requireCapabilityAdmin(tx, input);
-      const connection = await tx.organizationCapabilityConnection.upsert({
-        where: {
-          organizationId_capabilityId: {
-            organizationId: input.organizationId,
-            capabilityId: input.capabilityId,
-          },
-        },
-        update: {},
-        create: {
-          id: randomUUID(),
-          organizationId: input.organizationId,
-          capabilityId: input.capabilityId,
-          status: "DRAFT",
-        },
-      });
-      await tx.$queryRaw`SELECT "id" FROM "OrganizationCapabilityConnection" WHERE "id" = ${connection.id} FOR UPDATE`;
-      const locked = await tx.organizationCapabilityConnection.findUniqueOrThrow({
-        where: { id: connection.id },
-        include: {
-          activeSecretVersion: true,
-          secretVersions: { orderBy: { version: "desc" }, take: 1, select: { version: true } },
-        },
-      });
-      if (locked.organizationId !== input.organizationId) {
-        throw new Error("Capability Connection scope changed during rotation");
-      }
-      const version = (locked.secretVersions[0]?.version ?? 0) + 1;
-      const secretVersionId = randomUUID();
-      const envelope = this.secrets.encryptJson(
-        {
-          purpose: "capability",
-          organizationId: input.organizationId,
-          connectionId: locked.id,
-          secretVersionId,
-        },
-        payload,
-      );
-      const now = new Date();
-      const secretVersion = await tx.capabilityCredentialVersion.create({
-        data: {
-          id: secretVersionId,
-          connectionId: locked.id,
-          version,
-          envelopeVersion: envelope.version,
-          keyId: envelope.keyId,
-          envelope: envelope as unknown as Prisma.InputJsonValue,
-          createdByUserId: input.actorUserId,
-        },
-      });
-      if (locked.activeSecretVersion !== null) {
-        await tx.capabilityCredentialVersion.update({
-          where: { id: locked.activeSecretVersion.id },
-          data: { retiredAt: now },
-        });
-      }
-      const activated = await tx.organizationCapabilityConnection.update({
-        where: { id: locked.id },
-        data: {
-          status: "ACTIVE",
-          activeSecretVersionId: secretVersion.id,
-          activatedAt: now,
-          disabledAt: null,
-        },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          actorUserId: input.actorUserId,
-          action: version === 1 ? "capability.created" : "capability.rotated",
-          metadata: {
-            connectionId: locked.id,
-            capabilityId: input.capabilityId,
-            status: "ACTIVE",
-            secretVersion: version,
-            keyId: envelope.keyId,
-          },
-        },
-      });
-      return {
-        ...toMetadata(activated, { version, keyId: secretVersion.keyId }),
-        created: version === 1,
-      };
-    });
-  }
-
-  async list(organizationId: string): Promise<CapabilityConnectionMetadata[]> {
-    const connections = await this.prisma.organizationCapabilityConnection.findMany({
-      where: { organizationId },
-      include: { activeSecretVersion: { select: { version: true, keyId: true } } },
-      orderBy: { capabilityId: "asc" },
-    });
-    return connections.map((c) => toMetadata(c, c.activeSecretVersion));
-  }
-
-  async read(organizationId: string, capabilityId: string): Promise<CapabilityConnectionMetadata | null> {
-    const connection = await this.prisma.organizationCapabilityConnection.findFirst({
-      where: { organizationId, capabilityId },
-      include: { activeSecretVersion: { select: { version: true, keyId: true } } },
-    });
-    return connection === null ? null : toMetadata(connection, connection.activeSecretVersion);
-  }
-
-  async disable(input: {
-    readonly organizationId: string;
-    readonly capabilityId: string;
-    readonly actorUserId: string;
-  }): Promise<CapabilityConnectionMetadata> {
-    return this.prisma.$transaction(async (tx) => {
-      await requireCapabilityAdmin(tx, input);
-      const connection = await tx.organizationCapabilityConnection.findFirst({
-        where: { organizationId: input.organizationId, capabilityId: input.capabilityId },
-        select: { id: true },
-      });
-      if (connection === null) throw new Error("Capability Connection not found");
-      await tx.$queryRaw`SELECT "id" FROM "OrganizationCapabilityConnection" WHERE "id" = ${connection.id} FOR UPDATE`;
-      const locked = await tx.organizationCapabilityConnection.findUniqueOrThrow({
-        where: { id: connection.id },
-        include: { activeSecretVersion: { select: { version: true, keyId: true } } },
-      });
-      if (locked.status === "DISABLED") return toMetadata(locked, locked.activeSecretVersion);
-      const disabled = await tx.organizationCapabilityConnection.update({
-        where: { id: locked.id },
-        data: { status: "DISABLED", disabledAt: new Date() },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          actorUserId: input.actorUserId,
-          action: "capability.disabled",
-          metadata: {
-            connectionId: locked.id,
-            capabilityId: input.capabilityId,
-            previousStatus: locked.status,
-            status: "DISABLED",
-          },
-        },
-      });
-      return toMetadata(disabled, locked.activeSecretVersion);
-    });
-  }
-}
-
-function validateCredential(input: RotateCapabilityInput): CapabilitySecretPayloadV1 {
-  if (!KNOWN_CAPABILITY_IDS.has(input.capabilityId)) {
-    throw new Error(`unsupported capabilityId: ${input.capabilityId}`);
-  }
-  const accessKeyId = nonEmpty(input.accessKeyId, "accessKeyId");
-  const accessKeySecret = nonEmpty(input.accessKeySecret, "accessKeySecret");
-  const endpoint = nonEmpty(input.endpoint, "endpoint");
-  return { schemaVersion: 1, accessKeyId, accessKeySecret, endpoint };
-}
-
-function toMetadata(
-  connection: {
-    readonly id: string;
-    readonly capabilityId: string;
-    readonly status: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-  },
-  secret: { readonly version: number; readonly keyId: string } | null,
-): CapabilityConnectionMetadata {
-  return {
-    id: connection.id,
-    capabilityId: connection.capabilityId,
-    status: connection.status as CapabilityConnectionMetadata["status"],
-    activeVersion: secret?.version ?? null,
-    keyId: secret?.keyId ?? null,
-    createdAt: connection.createdAt,
-    updatedAt: connection.updatedAt,
-  };
-}
-
-async function requireCapabilityAdmin(
-  tx: Prisma.TransactionClient,
-  input: { readonly organizationId: string; readonly actorUserId: string },
-): Promise<void> {
-  await lockActiveOrganization(tx, input.organizationId);
-  const membership = await tx.organizationMembership.findFirst({
-    where: {
-      organizationId: input.organizationId,
-      userId: input.actorUserId,
-      role: { in: ["OWNER", "ADMIN"] },
-      revokedAt: null,
-    },
-    select: { id: true },
-  });
-  if (membership === null) {
-    throw new Error("only Organization OWNER or ADMIN may manage capability connections");
-  }
-}
-
-function nonEmpty(value: string, label: string): string {
-  const trimmed = value.trim();
-  if (trimmed === "") throw new Error(`${label} must not be empty`);
-  return trimmed;
-}
@@ -63,8 +63,8 @@ export async function resolveCapabilityCredential(
    organizationId: connection.organizationId,
    capabilityId: connection.capabilityId,
    schemaVersion: 1,
-    accessKeyId: payload.accessKeyId,
-    accessKeySecret: payload.accessKeySecret,
-    endpoint: payload.endpoint,
+    baseUrl: payload.baseUrl,
+    apiToken: payload.apiToken,
+    projectId: payload.projectId,
  };
 }
@@ -1,69 +0,0 @@
-/**
- * ADR-0027: Capability readiness probe. Validates the Alibaba Cloud docmind
- * credential by calling QueryDocParserStatus with a dummy id — a 400 (bad
- * request) means the credential is valid (the API accepted auth but rejected
- * the id); a 401/403 means the credential is bad.
- */
-import { classifyNetworkFailure, type NetworkFailureCategory } from "../connections/networkFailure.js";
-
-export interface CapabilityReadinessInput {
-  readonly endpoint: string;
-  readonly accessKeyId: string;
-  readonly accessKeySecret: string;
-}
-
-export type CapabilityReadinessProbe = (input: CapabilityReadinessInput) => Promise<void>;
-
-export class CapabilityReadinessError extends Error {
-  constructor(
-    readonly code: "capability_readiness_unsupported" | "capability_readiness_unreachable" | "capability_readiness_rejected",
-    message: string,
-    readonly category: NetworkFailureCategory | "configuration" | "http",
-    readonly upstreamStatus?: number,
-  ) {
-    super(message);
-    this.name = "CapabilityReadinessError";
-  }
-}
-
-/**
- * Probe the Alibaba Cloud docmind credential. We call QueryDocParserStatus
- * with a dummy id. The API will return:
- *   - 400 (InvalidParameter) → credential valid, just a bad id → probe passes
- *   - 401/403 (InvalidAccessKey/Forbidden) → credential invalid → probe fails
- *   - network error → unreachable
- */
-export const probeDocmindCredential: CapabilityReadinessProbe = async (input) => {
-  const url = `https://${input.endpoint}/?Action=QueryDocParserStatus&Id=probe-test&Version=2022-07-11`;
-  const authHeader = makeBasicAuth(input.accessKeyId, input.accessKeySecret);
-
-  let response: Response;
-  try {
-    response = await fetch(url, {
-      method: "GET",
-      headers: { authorization: authHeader, accept: "application/json" },
-      redirect: "manual",
-      signal: AbortSignal.timeout(10_000),
-    });
-  } catch (error) {
-    throw new CapabilityReadinessError(
-      "capability_readiness_unreachable",
-      "docmind credential readiness check could not reach the API",
-      classifyNetworkFailure(error),
-    );
-  }
-  await response.body?.cancel();
-  if (response.status === 401 || response.status === 403) {
-    throw new CapabilityReadinessError(
-      "capability_readiness_rejected",
-      `docmind credential rejected: status ${response.status}`,
-      "http",
-      response.status,
-    );
-  }
-};
-
-function makeBasicAuth(accessKeyId: string, accessKeySecret: string): string {
-  const credentials = Buffer.from(`${accessKeyId}:${accessKeySecret}`).toString("base64");
-  return `Basic ${credentials}`;
-}
@@ -1,231 +0,0 @@
-/**
- * ADR-0027: Alibaba Cloud Document Mind (docmind) client.
- *
- * Uses the official @alicloud/docmind-api20220711 SDK to call the document
- * parsing (large model version) API. The API is asynchronous:
- *   1. SubmitDocParserJobAdvance — upload local file as a stream, get job id
- *   2. QueryDocParserStatus — poll until data.status === "success";
- *      the markdown output URL is returned in outputFormatResult
- *   3. Download markdown from OSS, extract and download referenced images
- *
- * Pricing (2025-07, aliyun docmind):
- *   - 图文文档基础链路: 0.02元/页
- *   - 图文文档增强链路 (含公式 LaTeX): 0.04元/页
- *   - 视频: 0.002元/秒
- *   - 音频: 0.00035元/秒
- */
-import $DocmindClient, {
-  SubmitDocParserJobAdvanceRequest,
-  QueryDocParserStatusRequest,
-} from "@alicloud/docmind-api20220711";
-import { RuntimeOptions } from "@alicloud/tea-util";
-import { createReadStream } from "node:fs";
-import { basename } from "node:path";
-import type { CapabilitySecretPayload } from "./types.js";
-
-/** A single extracted image downloaded from the markdown's OSS image URLs. */
-export interface DocmindExtractedImage {
-  readonly filename: string;
-  readonly data: Uint8Array;
-}
-
-/** The structured result of parsing one document. */
-export interface DocmindParseResult {
-  readonly markdown: string;
-  readonly images: readonly DocmindExtractedImage[];
-  readonly pageCount: number;
-  readonly costUsd: number | null;
-  readonly requestId: string | null;
-}
-
-export interface DocmindParseOptions {
-  readonly inputFilePath: string;
-}
-
-export interface CapabilityProviderClient {
-  parse(credential: CapabilitySecretPayload, options: DocmindParseOptions): Promise<DocmindParseResult>;
-}
-
-export class DocmindClientError extends Error {
-  constructor(
-    message: string,
-    readonly code: "docmind_unreachable" | "docmind_rejected" | "docmind_invalid_response" | "docmind_no_output" | "docmind_timeout",
-    readonly upstreamStatus?: number,
-  ) {
-    super(message);
-    this.name = "DocmindClientError";
-  }
-}
-
-/** Cost per page in USD (0.04 CNY/page ≈ 0.0056 USD). */
-const COST_PER_PAGE_USD = 0.0056;
-const POLL_INTERVAL_MS = 10_000;
-const POLL_TIMEOUT_MS = 5 * 60_000;
-
-type DocmindConfig = ConstructorParameters<typeof $DocmindClient.default>[0];
-
-export class AliyunDocmindClient implements CapabilityProviderClient {
-  async parse(credential: CapabilitySecretPayload, options: DocmindParseOptions): Promise<DocmindParseResult> {
-    const config: DocmindConfig = {
-      endpoint: credential.endpoint,
-      accessKeyId: credential.accessKeyId,
-      accessKeySecret: credential.accessKeySecret,
-      type: "access_key",
-      regionId: "cn-hangzhou",
-    } as DocmindConfig;
-    const client = new $DocmindClient.default(config);
-
-    // 1. Submit job with local file as a ReadStream (not a Buffer — the SDK
-    //    serializes Buffers as JSON {type:"Buffer",data:[...]} which the API
-    //    can't read; a Stream is uploaded as multipart form data).
-    const fileName = basename(options.inputFilePath);
-    const fileStream = createReadStream(options.inputFilePath);
-    const advanceRequest = new SubmitDocParserJobAdvanceRequest({
-      fileUrlObject: fileStream,
-      fileName,
-      outputFormat: ["markdown"],
-      formulaEnhancement: true,
-    });
-    const runtime = new RuntimeOptions({});
-    let submitResponse;
-    try {
-      submitResponse = await client.submitDocParserJobAdvance(advanceRequest, runtime);
-    } catch (e) {
-      throw new DocmindClientError(
-        e instanceof Error ? e.message : String(e),
-        "docmind_unreachable",
-      );
-    }
-    const jobId = submitResponse.body?.data?.id;
-    if (jobId === undefined || jobId === null || jobId === "") {
-      throw new DocmindClientError("docmind submit returned no job id", "docmind_invalid_response");
-    }
-
-    // 2. Poll QueryDocParserStatus until data.status === "success" or "fail".
-    const deadline = Date.now() + POLL_TIMEOUT_MS;
-    let status = "";
-    let markdownUrl: string | null = null;
-    let pageCount = 0;
-    while (Date.now() < deadline) {
-      await sleep(POLL_INTERVAL_MS);
-      const statusReq = new QueryDocParserStatusRequest({ id: jobId });
-      const statusResponse = await client.queryDocParserStatus(statusReq);
-      const body = statusResponse.body as {
-        data?: {
-          status?: string;
-          pageCountEstimate?: number;
-          outputFormatResult?: Array<{ outputFileUrl?: string; outputType?: string }>;
-        };
-      };
-      status = body.data?.status ?? "";
-      if (status === "success") {
-        const mdResult = body.data?.outputFormatResult?.find((r) => r.outputType === "markdown");
-        markdownUrl = mdResult?.outputFileUrl ?? null;
-        pageCount = body.data?.pageCountEstimate ?? 0;
-        break;
-      }
-      if (status === "fail") {
-        throw new DocmindClientError(`docmind job ${jobId} failed`, "docmind_rejected");
-      }
-    }
-    if (status !== "success") {
-      throw new DocmindClientError(`docmind job ${jobId} timed out (status: ${status})`, "docmind_timeout");
-    }
-    if (markdownUrl === null) {
-      throw new DocmindClientError("docmind returned no markdown output URL", "docmind_no_output");
-    }
-
-    // 3. Download the markdown file from OSS.
-    let markdown: string;
-    try {
-      const mdResp = await fetch(markdownUrl);
-      if (!mdResp.ok) {
-        throw new DocmindClientError(`failed to download markdown: HTTP ${mdResp.status}`, "docmind_unreachable");
-      }
-      markdown = await mdResp.text();
-    } catch (e) {
-      if (e instanceof DocmindClientError) throw e;
-      throw new DocmindClientError(
-        e instanceof Error ? e.message : String(e),
-        "docmind_unreachable",
-      );
-    }
-    if (markdown === "") {
-      throw new DocmindClientError("docmind returned empty markdown", "docmind_no_output");
-    }
-
-    // 4. Download images referenced in the markdown (OSS URLs).
-    //    Markdown contains ![filename](http://...oss.../image.png?...) entries.
-    //    We rewrite them to local relative paths and download the images.
-    const images: DocmindExtractedImage[] = [];
-    const imageRefRegex = /!\[([^\]]*)\]\((https?:\/\/[^)]+)\)/g;
-    const localMarkdown = markdown.replace(imageRefRegex, (match, altText: string, url: string) => {
-      const idx = images.findIndex((img) => img.filename === extractFilename(altText, url, images.length));
-      if (idx >= 0) {
-        const img = images[idx]!;
-        return `![${altText}](${img.filename})`;
-      }
-      return match;
-    });
-
-    // Collect all image URLs first, then download.
-    const imageUrls: Array<{ url: string; altText: string }> = [];
-    let match: RegExpExecArray | null;
-    const collectRegex = /!\[([^\]]*)\]\((https?:\/\/[^)]+)\)/g;
-    while ((match = collectRegex.exec(markdown)) !== null) {
-      imageUrls.push({ url: match[2]!, altText: match[1]! });
-    }
-
-    for (let i = 0; i < imageUrls.length; i++) {
-      const { url, altText } = imageUrls[i]!;
-      const filename = extractFilename(altText, url, i);
-      try {
-        const imgResp = await fetch(url);
-        if (!imgResp.ok) continue;
-        const data = new Uint8Array(await imgResp.arrayBuffer());
-        images.push({ filename, data });
-      } catch {
-        // Best-effort: skip images that fail to download.
-      }
-    }
-
-    // Rewrite markdown with local image paths.
-    let finalMarkdown = markdown;
-    let imageIdx = 0;
-    finalMarkdown = finalMarkdown.replace(imageRefRegex, (match, altText: string, _url: string) => {
-      if (imageIdx < images.length) {
-        const img = images[imageIdx]!;
-        imageIdx++;
-        return `![${altText}](${img.filename})`;
-      }
-      return match;
-    });
-
-    if (pageCount === 0) {
-      pageCount = Math.max(1, images.length);
-    }
-    const costUsd = (pageCount > 0 ? pageCount : 1) * COST_PER_PAGE_USD;
-
-    return { markdown: finalMarkdown, images, pageCount, costUsd, requestId: jobId };
-  }
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-
-/** Derive a clean filename from the alt text or URL. */
-function extractFilename(altText: string, url: string, index: number): string {
-  // Try alt text first (docmind often puts the original filename).
-  if (altText !== "" && altText.length < 100) {
-    const cleaned = altText.replace(/[^a-zA-Z0-9._-]/g, "_");
-    if (cleaned.length > 0) return cleaned;
-  }
-  // Fall back to URL path.
-  const urlPath = new URL(url).pathname;
-  const base = basename(urlPath);
-  if (base !== "" && base !== "/") return base;
-  return `image_${index + 1}.png`;
-}
@@ -0,0 +1,66 @@
+/**
+ * ADR-0027: MinerU client interface. Isolates the real HTTP client so the
+ * adapter is testable without network access. The real implementation (filling
+ * in actual MinerU API calls) is deferred until credentials and pricing are
+ * confirmed; the interface and a mock implementation land now so the adapter
+ * wiring, UsageFact attribution, and workspace containment are provable.
+ *
+ * MinerU cloud API shape (from mineru.net docs / GitHub README):
+ *   - REST API, async task endpoint POST /tasks (v3.0+) + sync POST /file_parse
+ *   - Auth: Bearer token (apiToken)
+ *   - Output: Markdown + extracted images, returned as a zip or structured JSON
+ *   - Cost: reported per-page (pricing requires account confirmation)
+ *
+ * The interface models the synchronous parse path for simplicity; the real
+ * client may poll the async endpoint internally and is free to do so behind
+ * this signature.
+ */
+import type { CapabilitySecretPayload } from "./types.js";
+
+/** A single extracted image from the parsed document. */
+export interface MineruExtractedImage {
+  /** Suggested relative filename (e.g. "page_1_fig_0.jpg"). */
+  readonly filename: string;
+  /** Raw image bytes. */
+  readonly data: Uint8Array;
+}
+
+/** The structured result of parsing one document. */
+export interface MineruParseResult {
+  /** Markdown text with image references (relative to output dir). */
+  readonly markdown: string;
+  /** Images extracted from the document, to be written alongside the md. */
+  readonly images: readonly MineruExtractedImage[];
+  /** Number of pages processed (for UsageFact quantity, unit "pages"). */
+  readonly pageCount: number;
+  /** USD cost if the API reported it; null if unknown (ADR-0022). */
+  readonly costUsd: number | null;
+  /** External task/request id for the UsageFact correlationId. */
+  readonly requestId: string | null;
+}
+
+/** Options passed to the client. */
+export interface MineruParseOptions {
+  /** Absolute path to the input PDF on the Hub's filesystem. */
+  readonly inputFilePath: string;
+}
+
+/**
+ * Client interface for the MinerU document parsing service. The real
+ * implementation makes authenticated HTTP calls; tests inject a mock.
+ */
+export interface MineruClient {
+  parse(credential: CapabilitySecretPayload, options: MineruParseOptions): Promise<MineruParseResult>;
+}
+
+/** Errors raised by the MinerU client. */
+export class MineruClientError extends Error {
+  constructor(
+    message: string,
+    readonly code: "mineru_unreachable" | "mineru_rejected" | "mineru_invalid_response" | "mineru_no_output",
+    readonly upstreamStatus?: number,
+  ) {
+    super(message);
+    this.name = "MineruClientError";
+  }
+}
@@ -20,7 +20,7 @@ import { join, resolve, relative, isAbsolute } from "node:path";
 import type { PrismaClient } from "@prisma/client";
 import { LocalSecretEnvelope } from "../security/secretEnvelope.js";
 import { resolveCapabilityCredential } from "./capabilityConnections.js";
-import { DocmindClientError, type CapabilityProviderClient } from "./docmindClient.js";
+import { MineruClientError, type MineruClient } from "./mineruClient.js";
 import {
  CAPABILITIES,
  type CapabilityAdapter,
@@ -30,7 +30,7 @@ import {
 } from "./types.js";

 const CAPABILITY_ID = "pdf_to_md_bundle" as const;
-const PROVIDER_ID = "aliyun_docmind";
+const PROVIDER_ID = "mineru";

 /** Thrown when a requested path escapes the workspace root (ADR-0018). */
 export class CapabilityPathEscape extends Error {
@@ -59,11 +59,11 @@ function confineToWorkspace(requestedPath: string, workspaceDir: string): string

 export interface PdfToMdBundleDeps {
  readonly secrets: LocalSecretEnvelope;
-  readonly client: CapabilityProviderClient;
+  readonly client: MineruClient;
  readonly prisma: PrismaClient;
 }

-/** Build the pdf_to_md_bundle adapter. The client is injectable for testing. */
+/** Build the pdf_to_md_bundle adapter. The MineruClient is injectable for testing. */
 export function createPdfToMdBundleAdapter(deps: PdfToMdBundleDeps): CapabilityAdapter {
  return {
    capabilityId: CAPABILITY_ID,
@@ -85,14 +85,14 @@ export function createPdfToMdBundleAdapter(deps: PdfToMdBundleDeps): CapabilityA
      try {
        result = await deps.client.parse(credential, { inputFilePath: absoluteInput });
      } catch (e) {
-        if (e instanceof DocmindClientError) throw e;
-        throw new DocmindClientError(
+        if (e instanceof MineruClientError) throw e;
+        throw new MineruClientError(
          e instanceof Error ? e.message : String(e),
-          "docmind_unreachable",
+          "mineru_unreachable",
        );
      }
      if (result.markdown === "") {
-        throw new DocmindClientError("docmind returned empty markdown", "docmind_no_output");
+        throw new MineruClientError("MinerU returned empty markdown", "mineru_no_output");
      }

      // 4. Write outputs into the workspace.
@@ -80,13 +80,12 @@ export interface CapabilityAdapter {
  invoke(input: CapabilityInvocationInput): Promise<CapabilityInvocationResult>;
 }

-/** Decrypted capability credential (CapabilitySecretPayloadV1, ADR-0027).
- * Alibaba Cloud Document Mind (docmind) uses AccessKey ID + Secret + endpoint. */
+/** Decrypted capability credential (CapabilitySecretPayloadV1, ADR-0027). */
 export interface CapabilitySecretPayload {
  readonly schemaVersion: 1;
-  readonly accessKeyId: string;
-  readonly accessKeySecret: string;
-  readonly endpoint: string;
+  readonly baseUrl: string;
+  readonly apiToken: string;
+  readonly projectId: string | null;
 }

 /** Thrown when an org has no ACTIVE capability connection (fail-closed, ADR-0024). */
@@ -1,6 +1,6 @@
 /**
- * ADR-0022 capacity dimensions.
- * The 23 pinned dimensions; exact numeric ceilings are open and calibrated by
+ * ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
+ * The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
 * capacity testing. This module is the single source of the dimension set shared
 * by the platform-ceiling config and the org capacity-policy service.
 */
@@ -1,107 +0,0 @@
-# src/database/
-
-`/database/*` HTTP 面。代码写在这个目录里，`hub.ts` 通过 `plugin.ts` 挂载它，
-所以服务器启动时能正确识别这些路由。
-
-**前后端分离**：页面已迁到独立的 SvelteKit 静态 SPA `hub/database-admin/`
-（与 `hub/admin-web/` 同一套框架）。本目录的后端只保留三件事：鉴权透传、一个
-免鉴权配置端点、以及把 SPA 构建产物托管出去。页面全部由 SPA 客户端渲染。
-
-后端路由：
-
- `GET /database/config` —— 免鉴权。返回 `{ siloOrganizationSlug, devLoginEnabled }`，
-  给 SPA 登录页拼飞书链接、决定是否显示 dev 按钮用。不含任何敏感数据。
- `GET /database/dev-login` —— 仅开发。见下。
- `GET /database`、`GET /database/*` —— SPA shell / 客户端路由 fallback
-  （`static.ts` 的 `registerDatabaseSpa`）；资产在 `/database/_app/*`。
-
-SPA 页面（`database-admin`，`paths.base='/database'`）：
-
- `/database/admin` —— 飞书登录页。按钮指向 `/auth/feishu/<orgSlug>`（slug 来自
-  `/database/config`），回调由 `src/admin/routes/authRoutes.ts` 处理并种 session cookie。
- `/database/dashboard` —— 后台壳。未登录跳登录页；**登录但非 OWNER/ADMIN 显示无权提示**。
-
-> **注册顺序要点**：concrete 路由（`/database/config`、`/database/dev-login`）必须在
-> `registerDatabaseSpa` 的 `/database/*` fallback 之前注册（已在 `plugin.ts` 保证），
-> 否则通配会 shadow 它们。
-
-## 开发模式：用环境变量开启一键登录
-
-本地开发没有真实飞书 app 时，可以用环境变量开启一键登录，跳过飞书 OAuth，
-直接以现有 OWNER/ADMIN 身份登入后台。**仅限开发，不是生产登录路径。**
-
-### 怎么开
-
-在 `hub/.env` 里设：
-
-```sh
-HUB_DEV_LOGIN_BYPASS="true"
-```
-
-改完重启服务（`npm run dev`，或本地手动 `npx tsx src/server.ts`）。启动日志会
-打印一行 `DEV login bypass enabled: /database/dev-login ...` 作为确认。
-
-开启后：
-
- `/database/config` 返回 `devLoginEnabled: true`，SPA 登录页据此显示
-  「⚡ 一键登录管理员」按钮
- 后端注册 `/database/dev-login` 端点：按钮就是打它，它签发一个和飞书 OAuth
-  回调完全一样的 session，然后跳到 `/database/dashboard`
-
-### 怎么关
-
-把值设成 `false`（或 `0` / `no` / `off`），或删掉这一行。关闭后按钮消失、
-`/database/dev-login` 返回 404 —— 按钮和端点同进同退。
-
-### 双重门禁（重要）
-
-真正的开关是两个条件的**与**（判断在 `plugin.ts`）：
-
-```
-allowDevLoginBypass = (NODE_ENV !== "production") && HUB_DEV_LOGIN_BYPASS 为真
-```
-
-即：**只要 `NODE_ENV=production`，无论 `HUB_DEV_LOGIN_BYPASS` 设成什么，一键登录
-都强制关闭。** 生产始终只能走真实飞书 OAuth。
-
-> 提醒：`HUB_DEV_LOGIN_BYPASS` 是敏感开关，别把开着它的 `.env` 带到任何联网 /
-> 共享环境。整个旁路逻辑自包含在本目录（`plugin.ts` + `routes/databaseRoutes.ts`），
-> `src/admin` 的登录路由未受影响。
-
-## 文件
-
-| 文件 | 职责 |
-|------|------|
-| `plugin.ts` | 模块对外入口，`hub.ts` 调 `registerDatabasePlugin()`；先挂 concrete 路由再挂 SPA |
-| `routes/databaseRoutes.ts` | 后端 JSON / redirect 路由（`/database/config`、`/database/dev-login`），**数据端点加在这里** |
-| `static.ts` | `registerDatabaseSpa`：托管 `database-admin/build` 的 SPA + `/database/*` fallback |
-
-新增一类**数据**端点时：要么直接往 `databaseRoutes.ts` 加 `app.get("/database/...")`，
-要么新建 `routes/xxxRoutes.ts` 并在 `databaseRoutes.ts` 里 `registerXxxRoutes(app, {...})`
-注册一次。**页面**则加在 `database-admin/src/routes/` 下（SvelteKit 路由）。
-
-## SPA 构建与托管
-
- 前端在 `hub/database-admin/`，`npm run build`（或 hub 根的 `npm run database:build`）
-  产出到 `database-admin/build/`。hub 的 `npm run build` 会把两个 SPA 一起带出来。
- `static.ts` 默认从 `../../database-admin/build` 读产物；可用 `CPH_DATABASE_UI_DIR`
-  覆盖。产物缺失时降级：只 warn，不挂 SPA，`/database/config` 与 `/database/dev-login` 仍可用。
- 本地开发：hub 根 `npm run database:dev` 起 Vite，它把 `/api`、`/auth`、`/database`
-  代理到 `127.0.0.1:8788`。
-
-## 约定（与 admin 面一致）
-
-1. 路由用**绝对路径** `"/database/..."`，不用 Fastify prefix —— 每条路由 grep 得到。
-2. **guard 前置、fail closed**：凡碰数据的端点第一行先跑
-   `requireSession` / `requireOrgRole` / `requireProjectPermission`
-   （都在 `../admin/auth/guards.js`）。
-3. **租户隔离**（ADR-0020）：每个 Prisma 查询都 scope 到 `auth.organization.id`，
-   不得跨 org。禁止无鉴权的数据路由。
-4. 数据库通过传入的 `config.prisma` 访问（全进程单例，见 `../db.ts`）；
-   不要在这里 `new PrismaClient()`。
-
-## 为什么代码在 `src/` 下
-
-`tsconfig.json` 固定 `rootDir: "src"` 且 `include: ["src/**/*.ts"]`。只有
-`src/` 下的 `.ts` 会被 `tsc` 编译、被 `tsx watch`（`npm run dev`）加载。放在
-`src/` 之外的目录不会被构建，外部识别不到。
@@ -1,50 +0,0 @@
-/**
- * Registers the `/database/*` HTTP surface onto the Fastify app.
- *
- * Single public entry point (mirrors src/admin/plugin.ts). hub.ts calls
- * registerDatabasePlugin() so the routes are recognized at startup.
- *
- * Register AFTER registerAdminPlugin: it relies on the @fastify/cookie parser
- * and the /auth/feishu/* login routes that the admin plugin adds.
- *
- * The dev login bypass is self-contained in THIS module: the flag is read here
- * (not threaded from hub.ts) and only ever enables the `/database/dev-login`
- * route below. Double-gated: NODE_ENV must not be production AND
- * HUB_DEV_LOGIN_BYPASS must be truthy. Production always requires real Feishu
- * OAuth.
- */
-import type { FastifyInstance } from "fastify";
-import type { PrismaClient } from "@prisma/client";
-import { registerDatabaseRoutes } from "./routes/databaseRoutes.js";
-import { registerDatabaseSpa } from "./static.js";
-
-export interface DatabasePluginConfig {
-  readonly prisma: PrismaClient;
-  readonly sessionSecret: string;
-  readonly siloOrganizationSlug: string;
-}
-
-const FALSY = new Set(["", "0", "false", "no", "off"]);
-
-export async function registerDatabasePlugin(
-  app: FastifyInstance,
-  config: DatabasePluginConfig,
-): Promise<void> {
-  const allowDevLoginBypass =
-    process.env["NODE_ENV"] !== "production" &&
-    !FALSY.has((process.env["HUB_DEV_LOGIN_BYPASS"] ?? "").trim().toLowerCase());
-  if (allowDevLoginBypass) {
-    app.log.warn("DEV login bypass enabled: /database/dev-login mints a session without Feishu OAuth");
-  }
-
-  await registerDatabaseRoutes(app, {
-    prisma: config.prisma,
-    sessionSecret: config.sessionSecret,
-    siloOrganizationSlug: config.siloOrganizationSlug,
-    allowDevLoginBypass,
-  });
-
-  // SPA shell + fallback, registered after the concrete /database/* routes above
-  // so the /database/* wildcard does not shadow them.
-  await registerDatabaseSpa(app);
-}
@@ -1,106 +0,0 @@
-/**
- * `/database/*` route aggregator.
- *
- * Owns the `/database` HTTP surface (single place new sub-routes get wired in).
- * Handlers use ABSOLUTE paths (no Fastify prefix) so every route greps as the
- * literal string it serves.
- *
- * The login page and dashboard are now served by the `database-admin` SvelteKit
- * SPA (see ../static.ts / registerDatabaseSpa). This file keeps only the
- * concrete JSON/redirect routes the SPA depends on:
- *
- *   /database/config     — unauthenticated bootstrap: silo org slug + dev toggle
- *   /database/dev-login  — DEV ONLY bypass, registered only when the flag is on
- *
- * The dev bypass (/database/dev-login) is self-contained here and gated by
- * allowDevLoginBypass (computed in ./plugin.ts from HUB_DEV_LOGIN_BYPASS +
- * NODE_ENV). Production requires real Feishu OAuth.
- *
- * NOTE: concrete routes here MUST be registered before the SPA fallback
- * (registerDatabaseSpa serves /database and /database/*), or the wildcard would
- * shadow them.
- */
-import type { FastifyInstance } from "fastify";
-import type { PrismaClient } from "@prisma/client";
-import { SESSION_COOKIE_NAME, signSession } from "../../admin/auth/session.js";
-
-export interface DatabaseRouteConfig {
-  readonly prisma: PrismaClient;
-  /** HMAC secret for the signed session cookie — reused from the admin plane. */
-  readonly sessionSecret: string;
-  /** Silo Organization slug — the SPA builds the org-scoped Feishu login link from it. */
-  readonly siloOrganizationSlug: string;
-  /** DEV ONLY. Enables the one-click button and the /database/dev-login route. */
-  readonly allowDevLoginBypass: boolean;
-}
-
-export async function registerDatabaseRoutes(
-  app: FastifyInstance,
-  config: DatabaseRouteConfig,
-): Promise<void> {
-  // Unauthenticated bootstrap for the static SPA login page. Exposes only what
-  // the page needs to build the Feishu login link and toggle the dev button —
-  // no secrets, no user data.
-  app.get("/database/config", async () => {
-    return {
-      siloOrganizationSlug: config.siloOrganizationSlug,
-      devLoginEnabled: config.allowDevLoginBypass,
-    };
-  });
-
-  // DEV ONLY bypass — self-contained here, registered only when the flag is on
-  // (see ./plugin.ts). Mints a session for an existing OWNER/ADMIN, reusing the
-  // scoped SessionIdentity shape the Feishu OAuth callback produces so the
-  // session guard behaves identically. Never registered in production.
-  if (config.allowDevLoginBypass) {
-    app.get("/database/dev-login", async (_request, reply) => {
-      const membership = await config.prisma.organizationMembership.findFirst({
-        where: {
-          revokedAt: null,
-          role: { in: ["OWNER", "ADMIN"] },
-          organization: { status: "ACTIVE" },
-        },
-        select: { userId: true, organizationId: true },
-        orderBy: { createdAt: "asc" },
-      });
-      if (membership === null) {
-        return reply.status(404).send({ error: { code: "no_admin", message: "no active OWNER/ADMIN to impersonate" } });
-      }
-      const identity = await config.prisma.feishuUserIdentity.findFirst({
-        where: {
-          userId: membership.userId,
-          connection: { organizationId: membership.organizationId, status: "ACTIVE" },
-        },
-        select: { id: true, connectionId: true, connection: { select: { organizationId: true } } },
-      });
-      if (identity === null) {
-        return reply.status(404).send({ error: { code: "no_identity", message: "admin has no active scoped Feishu identity" } });
-      }
-      const token = signSession(
-        {
-          userId: membership.userId,
-          feishuIdentityId: identity.id,
-          feishuConnectionId: identity.connectionId,
-          feishuOrganizationId: identity.connection.organizationId,
-        },
-        config.sessionSecret,
-      );
-      // Local dev is http://127.0.0.1, so secure:false. This route only ever
-      // runs outside production (double-gated in ./plugin.ts).
-      reply.setCookie(SESSION_COOKIE_NAME, token, {
-        path: "/",
-        httpOnly: true,
-        sameSite: "lax",
-        secure: false,
-        maxAge: 7 * 24 * 60 * 60,
-      });
-      reply.log.warn({ userId: membership.userId, orgId: membership.organizationId }, "DEV database login bypass used");
-      return reply.redirect("/database/dashboard");
-    });
-  }
-
-  // Add more /database/* JSON routes here. Guard data routes with requireSession
-  // / requireOrgRole (../../admin/auth/guards.js) and scope every query to the
-  // caller's org (ADR-0020). Access the DB via config.prisma. Register concrete
-  // routes before registerDatabaseSpa's /database/* fallback (done in ./plugin.ts).
-}
@@ -1,98 +0,0 @@
-/**
- * Serves the database-admin SPA (built by SvelteKit via `database-admin/build/`)
- * and the SPA index fallback for client-side routes under `/database/*`.
- *
- * The SvelteKit project lives in `hub/database-admin/` and is built with
- * `paths.base = '/database'`, so its assets are emitted under `/database/_app/*`
- * (not the root `/_app/*` that admin-web owns — that keeps the two SPAs from
- * colliding). On disk the files still live at `build/_app/*`; this handler maps
- * the `/database`-prefixed URLs back to those files.
- *
- * Run `npm run build` in database-admin/ to produce the static output. In
- * development, `npm run dev` there proxies `/api`, `/auth`, and `/database` to
- * the Hub. Override the UI directory with `CPH_DATABASE_UI_DIR` if needed.
- *
- * Mirrors src/admin/static.ts.
- */
-import { readFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, extname, join, resolve as resolvePath } from "node:path";
-import type { FastifyInstance } from "fastify";
-
-const MIME: Record<string, string> = {
-  ".html": "text/html; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".ico": "image/x-icon",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".json": "application/json; charset=utf-8",
-  ".txt": "text/plain; charset=utf-8",
-};
-
-function resolveUiDir(): string {
-  const override = process.env["CPH_DATABASE_UI_DIR"];
-  if (override && override.trim() !== "") return resolvePath(override);
-  const here = dirname(fileURLToPath(import.meta.url));
-  return resolvePath(join(here, "..", "..", "database-admin", "build"));
-}
-
-export async function registerDatabaseSpa(app: FastifyInstance): Promise<void> {
-  const uiDir = resolveUiDir();
-  if (!existsSync(join(uiDir, "index.html"))) {
-    app.log.warn(
-      { uiDir },
-      "database-admin/build not found; /database SPA shell disabled. Run `npm run build` in database-admin/ to enable. /database/config and /database/dev-login remain functional.",
-    );
-    return;
-  }
-  const indexHtml = await readFile(join(uiDir, "index.html"), "utf8");
-
-  // SvelteKit build assets. base='/database' emits them at /database/_app/*,
-  // but on disk they're under build/_app/*.
-  app.get("/database/_app/*", async (request, reply) => {
-    const rel = (request.params as { "*": string })["*"];
-    const safe = rel.split("/").filter((p) => p !== ".." && p !== "").join("/");
-    try {
-      const buf = await readFile(join(uiDir, "_app", safe));
-      const mime = MIME[extname(safe)] ?? "application/octet-stream";
-      return reply.type(mime).send(buf);
-    } catch {
-      return reply.status(404).send({ error: { code: "not_found", message: "asset not found" } });
-    }
-  });
-
-  // Top-level static files emitted under the base path (favicon.svg, robots.txt).
-  app.get("/database/favicon.svg", async (_request, reply) => {
-    try {
-      const buf = await readFile(join(uiDir, "favicon.svg"));
-      return reply.type("image/svg+xml").send(buf);
-    } catch {
-      return reply.status(404).send();
-    }
-  });
-  app.get("/database/robots.txt", async (_request, reply) => {
-    try {
-      const buf = await readFile(join(uiDir, "robots.txt"));
-      return reply.type("text/plain; charset=utf-8").send(buf);
-    } catch {
-      return reply.status(404).send();
-    }
-  });
-
-  // SPA client-side route fallback. Concrete /database/* routes (/database/config,
-  // /database/dev-login, and the asset routes above) are more specific, so
-  // Fastify's router matches them before this wildcard. Everything else under
-  // /database serves index.html so SvelteKit's client router can resolve the view.
-  app.get("/database", async (_request, reply) => {
-    return reply.type("text/html; charset=utf-8").send(indexHtml);
-  });
-  app.get("/database/*", async (_request, reply) => {
-    return reply.type("text/html; charset=utf-8").send(indexHtml);
-  });
-}
@@ -250,7 +250,6 @@ async function initializeSilo(
      data: {
        organizationId: input.organization.id,
        name: "Inbox",
-        kind: "SYSTEM_INBOX",
        sortKey: "000000",
      },
    });
@@ -2,8 +2,8 @@
 * Silo-wide HTTP request rate limit (ADR-0022 `requestRate`).
 *
 * Counts dynamic traffic only: APIs, auth, and other application handlers.
- * Static SPA assets and the admin HTML shells are exempt so a single page load
- * (dozens of `/_app/*` chunks + favicon) does not exhaust the minute budget.
+ * Static SPA assets and the org-admin HTML shell are exempt so a single page
+ * load (dozens of `/_app/*` chunks + favicon) does not exhaust the minute budget.
 */

 /** Paths that must not consume the silo HTTP request-rate budget. */
@@ -12,21 +12,12 @@ export function isSiloHttpRateLimitExempt(url: string): boolean {

  if (path === "/api/healthz") return true;

-  // admin-web SvelteKit build output at the root, and top-level static files
-  // (see admin/static.ts).
+  // SvelteKit build output and top-level static files (see admin/static.ts).
  if (path === "/_app" || path.startsWith("/_app/")) return true;
  if (path === "/favicon.ico" || path === "/favicon.svg" || path === "/robots.txt") return true;

-  // database-admin SvelteKit build output, served under /database (base path;
-  // see database/static.ts).
-  if (path === "/database/_app" || path.startsWith("/database/_app/")) return true;
-  if (path === "/database/favicon.svg" || path === "/database/robots.txt") return true;
-
-  // SPA index shells for client-side routes (not APIs). The /database/* shell is
-  // blanket-exempt like /admin/* since client routes are unknowable up front;
-  // this also covers the once-per-load /database/config bootstrap.
+  // SPA index shell for client-side routes (not an API).
  if (path === "/admin" || path.startsWith("/admin/")) return true;
-  if (path === "/database" || path.startsWith("/database/")) return true;

  return false;
 }
@@ -12,7 +12,6 @@
 */

 import type { ToolUseTraceStep } from "./trace-store.js";
-import type { CardContentSegment } from "../outboundImages.js";

 // ---------------------------------------------------------------------------
 // Types
@@ -59,7 +58,6 @@ function toolIcon(toolName: string): string {
 export function buildAgentCard(params: {
  phase: CardPhase;
  text: string;
-  contentSegments?: readonly CardContentSegment[] | undefined;
  reasoningText: string | undefined;
  toolUseSteps: ToolUseTraceStep[];
  toolUseElapsedMs: number | undefined;
@@ -67,19 +65,19 @@ export function buildAgentCard(params: {
  interrupted: boolean | undefined;
  runId: string | undefined;
 }): Record<string, unknown> {
-  const { phase, text, contentSegments, reasoningText, toolUseSteps, toolUseElapsedMs, isError, interrupted } = params;
+  const { phase, text, reasoningText, toolUseSteps, toolUseElapsedMs, isError, interrupted } = params;
  const elements: unknown[] = [];

  // Tool-use panel (always present if there are steps)
  if (toolUseSteps.length > 0) {
    elements.push(buildToolUsePanel(toolUseSteps, toolUseElapsedMs, phase !== "complete"));
-  } else if (phase === "thinking" || (phase === "streaming" && text === "" && (contentSegments === undefined || contentSegments.length === 0))) {
+  } else if (phase === "thinking" || (phase === "streaming" && text === "")) {
    elements.push(buildPendingToolUsePanel());
  }

  // Reasoning panel
  if (reasoningText !== undefined && reasoningText !== "") {
-    if (phase === "streaming" && text === "" && (contentSegments === undefined || contentSegments.length === 0)) {
+    if (phase === "streaming" && text === "") {
      // Still thinking: show reasoning inline
      elements.push({
        tag: "markdown",
@@ -92,11 +90,12 @@ export function buildAgentCard(params: {
    }
  }

-  // Main answer: either materialized segments (markdown + Feishu-hosted images)
-  // or a single markdown block.
-  const answerElements = buildAnswerElements(text, contentSegments);
-  if (answerElements.length > 0) {
-    elements.push(...answerElements);
+  // Main text content
+  if (text !== "") {
+    elements.push({
+      tag: "markdown",
+      content: truncateText(text, MAX_TEXT_LENGTH),
+    });
  } else if (phase === "thinking" && toolUseSteps.length === 0 && (reasoningText === undefined || reasoningText === "")) {
    elements.push({
      tag: "markdown",
@@ -402,43 +401,6 @@ function escapeMarkdown(value: string): string {
  return value.replace(/\\/g, "\\\\").replace(/([`*_{}[\]<>])/g, "\\$1");
 }

-function buildAnswerElements(
-  text: string,
-  contentSegments: readonly CardContentSegment[] | undefined,
-): unknown[] {
-  if (contentSegments !== undefined && contentSegments.length > 0) {
-    const elements: unknown[] = [];
-    let remaining = MAX_TEXT_LENGTH;
-    for (const segment of contentSegments) {
-      if (segment.type === "image") {
-        elements.push({
-          tag: "img",
-          img_key: segment.imgKey,
-          alt: { tag: "plain_text", content: segment.alt },
-          mode: "fit_horizontal",
-          preview: true,
-        });
-        continue;
-      }
-      if (segment.content === "" || remaining <= 0) continue;
-      const slice = segment.content.length <= remaining
-        ? segment.content
-        : truncateText(segment.content, remaining);
-      remaining -= slice.length;
-      elements.push({
-        tag: "markdown",
-        content: slice,
-      });
-    }
-    return elements;
-  }
-  if (text === "") return [];
-  return [{
-    tag: "markdown",
-    content: truncateText(text, MAX_TEXT_LENGTH),
-  }];
-}
-
 function truncateText(value: string, maxLength: number): string {
  return value.length <= maxLength ? value : `${value.slice(0, maxLength - 3)}...`;
 }
@@ -18,13 +18,10 @@
 *   4. onToolEnd(name, id, input, result?, error?) — complete a tool step
 *   5. finish(finalText)    — flush + transition to complete card
 *   6. fail(errorText)      — flush + transition to error card
- *
- * On finish, markdown image references (`![](url|path)`) are downloaded /
- * read, uploaded to Feishu as message images, and embedded as native card
- * `img` elements so external URLs never hit Feishu content-security checks.
 */
+
 import type { FeishuRuntime, SendMessageOptions } from "../client.js";
-import { sendCard, patchCard, sendText, sendLongText } from "../client.js";
+import { sendCard, patchCard, sendText } from "../client.js";
 import { DEFAULT_MAX_MESSAGE_LENGTH, splitAtBoundary } from "../textStream.js";
 import {
  startToolUseTraceRun,
@@ -34,12 +31,6 @@ import {
  getToolUseTraceSteps,
 } from "./trace-store.js";
 import { buildAgentCard, type CardPhase } from "./builder.js";
-import {
-  type CardContentSegment,
-  maskMarkdownImagesForStreaming,
-  materializeAnswerSegments,
-  sendImageMessage,
-} from "../outboundImages.js";

 export interface StreamingCardSink {
  readonly create: (card: Record<string, unknown>) => Promise<string | null>;
@@ -53,11 +44,6 @@ export interface StreamingCardOptions {
  readonly sendOptions?: SendMessageOptions | undefined;
  readonly patchIntervalMs: number | undefined;
  readonly maxMessageLength: number | undefined;
-  /** Project workspace root; required to resolve local image paths. */
-  readonly workspaceRoot?: string | undefined;
-  /** Project workspace directory; required to resolve local image paths. */
-  readonly workspaceDir?: string | undefined;
-  readonly maxImageBytes?: number | undefined;
 }

 const DEFAULT_PATCH_INTERVAL_MS = 400;
@@ -79,9 +65,6 @@ export class StreamingAgentCard {
  private readonly sendOptions: SendMessageOptions | undefined;
  private readonly patchIntervalMs: number;
  private readonly maxMessageLength: number;
-  private readonly workspaceRoot: string | undefined;
-  private readonly workspaceDir: string | undefined;
-  private readonly maxImageBytes: number | undefined;

  constructor(options: StreamingCardOptions) {
    this.runId = options.runId;
@@ -90,9 +73,6 @@ export class StreamingAgentCard {
    this.sendOptions = options.sendOptions;
    this.patchIntervalMs = options.patchIntervalMs ?? DEFAULT_PATCH_INTERVAL_MS;
    this.maxMessageLength = options.maxMessageLength ?? DEFAULT_MAX_MESSAGE_LENGTH;
-    this.workspaceRoot = options.workspaceRoot;
-    this.workspaceDir = options.workspaceDir;
-    this.maxImageBytes = options.maxImageBytes;
    startToolUseTraceRun(this.runId);
  }

@@ -126,43 +106,23 @@ export class StreamingAgentCard {
    recordToolUseEnd({ runId: this.runId, ...params });
    this.scheduleFlush();
  }
-
-  async finish(
-    fallbackText: string,
-    options: { readonly interrupted?: boolean; readonly footerText?: string | undefined } = {},
-  ): Promise<void> {
+  async finish(fallbackText: string, options: { readonly interrupted?: boolean; readonly footerText?: string | undefined } = {}): Promise<void> {
    await this.flushChain;
    this.interrupted = options.interrupted === true;
    const footerText = options.footerText ?? "";
    const fallbackWithFooter = appendFooter(fallbackText, footerText);
    try {
-      let answerText =
-        this.text.length > 0 ? appendFooter(this.text, footerText) : fallbackWithFooter;
-      this.text = answerText;
-
-      const { segments, unresolved } = await materializeAnswerSegments(answerText, {
-        rt: this.rt,
-        workspaceRoot: this.workspaceRoot,
-        workspaceDir: this.workspaceDir,
-        maxImageBytes: this.maxImageBytes,
-      });
-      if (unresolved.length > 0) {
-        this.rt.logger.warn(
-          { runId: this.runId, unresolvedCount: unresolved.length, unresolved: unresolved.slice(0, 5) },
-          "some answer images could not be uploaded to Feishu",
-        );
-      }
-
      let updated = true;
-      if (answerText.length > 0 || segments.length > 0) {
-        updated = await this.flushCard("complete", answerText, false, segments);
+      if (this.text.length > 0) {
+        this.text = appendFooter(this.text, footerText);
+        updated = await this.flushCard("complete", this.text);
+      } else if (this.currentMessageId === null && fallbackWithFooter.length > 0) {
+        // No streaming text was sent. If we never created a card, send one now.
+        this.text = fallbackWithFooter;
+        updated = await this.flushCard("complete", this.text);
      } else if (this.currentMessageId !== null) {
-        updated = await this.flushCard("complete", "", false, []);
-      }
-
-      if (!updated) {
-        // Card path failed (e.g. residual content policy). Deliver text + standalone images.
-        updated = await this.deliverPlainFallback(segments, answerText);
+        // Patch the existing card with the final text.
+        updated = await this.flushCard("complete", fallbackWithFooter);
      }
      if (!updated && this.interrupted) {
        await sendText(this.rt, this.chatId, "\u5DF2\u4E2D\u65AD\u5F53\u524D\u8FD0\u884C\u3002", this.sendOptions);
@@ -206,30 +166,15 @@ export class StreamingAgentCard {
    return this.flushCard(this.currentPhase(), this.text);
  }

-  private async flushCard(
-    phase: CardPhase,
-    text: string,
-    isError = false,
-    contentSegments?: readonly CardContentSegment[],
-  ): Promise<boolean> {
-    // During live streaming, strip image URLs so Feishu never fetches remote
-    // ranks mid-run. Materialized segments are only used on the complete pass.
-    const displayText =
-      phase === "complete" && contentSegments !== undefined
-        ? text
-        : maskMarkdownImagesForStreaming(text);
+  private async flushCard(phase: CardPhase, text: string, isError = false): Promise<boolean> {
+    const chunks = splitAtBoundary(text, this.maxMessageLength);
+    const firstChunk = chunks[0];
+    if (firstChunk === undefined) return true;

-    const chunks = splitAtBoundary(displayText, this.maxMessageLength);
-    const firstChunk = chunks[0] ?? "";
-    // When we have segments (complete+images), keep first-card complete content
-    // on segments only; overflow text (rare) falls back to plain chunked cards.
    const toolUseSteps = getToolUseTraceSteps(this.runId);
    const card = buildAgentCard({
      phase,
-      text: contentSegments !== undefined && contentSegments.length > 0 ? "" : firstChunk,
-      contentSegments: contentSegments !== undefined && contentSegments.length > 0
-        ? contentSegments
-        : undefined,
+      text: firstChunk,
      reasoningText: this.reasoningText || undefined,
      toolUseSteps,
      toolUseElapsedMs: this.toolUseElapsedMs,
@@ -241,30 +186,7 @@ export class StreamingAgentCard {
    if (this.currentMessageId === null) {
      this.currentMessageId = await sendCard(this.rt, this.chatId, card, this.sendOptions);
      let updated = this.currentMessageId !== null;
-      // Send overflow chunks as new messages (rare for agent output). Segments
-      // already include the whole answer; only plain text overflows.
-      if (contentSegments === undefined || contentSegments.length === 0) {
-        for (const chunk of chunks.slice(1)) {
-          const overflowCard = buildAgentCard({
-            phase,
-            text: chunk,
-            reasoningText: undefined,
-            toolUseSteps: [],
-            toolUseElapsedMs: undefined,
-            isError,
-            interrupted: this.interrupted,
-            runId: undefined,
-          });
-          const overflowMessageId = await sendCard(this.rt, this.chatId, overflowCard, this.sendOptions);
-          updated = updated && overflowMessageId !== null;
-          this.currentMessageId = overflowMessageId;
-        }
-      }
-      return updated;
-    }
-
-    let updated = await patchCard(this.rt, this.currentMessageId, card);
-    if (contentSegments === undefined || contentSegments.length === 0) {
+      // Send overflow chunks as new messages (rare for agent output)
      for (const chunk of chunks.slice(1)) {
        const overflowCard = buildAgentCard({
          phase,
@@ -280,50 +202,27 @@ export class StreamingAgentCard {
        updated = updated && overflowMessageId !== null;
        this.currentMessageId = overflowMessageId;
      }
-    }
-    return updated;
-  }
-
-  private async deliverPlainFallback(
-    segments: readonly CardContentSegment[],
-    answerText: string,
-  ): Promise<boolean> {
-    const textParts: string[] = [];
-    const imageKeys: string[] = [];
-    if (segments.length > 0) {
-      for (const segment of segments) {
-        if (segment.type === "markdown") {
-          if (segment.content.trim() !== "") textParts.push(segment.content);
-        } else {
-          imageKeys.push(segment.imgKey);
-        }
+      return updated;
+    } else {
+      let updated = await patchCard(this.rt, this.currentMessageId, card);
+      // For overflow, create new messages
+      for (const chunk of chunks.slice(1)) {
+        const overflowCard = buildAgentCard({
+          phase,
+          text: chunk,
+          reasoningText: undefined,
+          toolUseSteps: [],
+          toolUseElapsedMs: undefined,
+          isError,
+          interrupted: this.interrupted,
+          runId: undefined,
+        });
+        const overflowMessageId = await sendCard(this.rt, this.chatId, overflowCard, this.sendOptions);
+        updated = updated && overflowMessageId !== null;
+        this.currentMessageId = overflowMessageId;
      }
-    } else if (answerText.trim() !== "") {
-      textParts.push(maskMarkdownImagesForStreaming(answerText));
+      return updated;
    }
-
-    let any = false;
-    if (textParts.length > 0) {
-      const messageId = await sendLongText(
-        this.rt,
-        this.chatId,
-        textParts.join("\n\n"),
-        this.sendOptions,
-      );
-      any = messageId !== null;
-    }
-    for (const imageKey of imageKeys) {
-      try {
-        const messageId = await sendImageMessage(this.rt, this.chatId, imageKey, this.sendOptions);
-        any = any || messageId !== null;
-      } catch (error) {
-        this.rt.logger.warn(
-          { runId: this.runId, err: error instanceof Error ? error.message : String(error) },
-          "standalone image fallback failed",
-        );
-      }
-    }
-    return any;
  }

  private currentPhase(): CardPhase {
@@ -336,5 +235,5 @@ export class StreamingAgentCard {
 function appendFooter(text: string, footerText: string): string {
  if (footerText === "") return text;
  if (text === "") return footerText;
-  return `${text}\n\n${footerText}`;
+  return `${text.trimEnd()}\n\n${footerText}`;
 }
@@ -316,8 +316,7 @@ export async function sendCard(
      { msgType: "interactive", content: JSON.stringify(card) },
      options,
    );
-  } catch (e) {
-    rt.logger.warn({ chatId, err: errorText(e) }, "sendCard failed");
+  } catch {
    return null;
  }
 }
@@ -335,7 +334,7 @@ export async function patchCard(rt: FeishuRuntime, messageId: string, card: Reco
    });
    return true;
  } catch (e) {
-    rt.logger.warn({ messageId, err: errorText(e) }, "patchCard failed");
+    rt.logger.warn({ messageId, err: e instanceof Error ? e.message : String(e) }, "patchCard failed");
    return false;
  }
 }
@@ -7,16 +7,11 @@ import { readFeishuContext } from "./read.js";
 import type { ApprovalManager } from "./approval.js";
 import { CPH_HUB_MCP_TOOL_IDS, type CphHubMcpToolId } from "../agent/roleTools.js";
 import { WorkspaceFileBoundaryError } from "../security/workspaceFiles.js";
-import type { PrismaClient } from "@prisma/client";
-import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
-import { createPdfToMdBundleAdapter } from "../capability/pdfToMdBundle.js";
-import { AliyunDocmindClient } from "../capability/docmindClient.js";

 export interface FileDeliveryToolOptions {
  readonly rt: FeishuRuntime;
  readonly chatId: string;
  readonly projectId: string;
-  readonly organizationId: string;
  readonly runId: string;
  readonly workspaceRoot?: string | undefined;
  readonly workspaceDir: string;
@@ -25,8 +20,6 @@ export interface FileDeliveryToolOptions {
  readonly approvalManager: ApprovalManager;
  readonly onDelivered?: (path: string) => void;
  readonly tools?: readonly CphHubMcpToolId[] | undefined;
-  readonly prisma: PrismaClient;
-  readonly secretEnvelope: LocalSecretEnvelope;
 }

 export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): McpSdkServerConfigWithInstance {
@@ -237,51 +230,6 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
    );
  }

-  if (enabledTools.has("convert_pdf_to_md")) {
-    const adapter = createPdfToMdBundleAdapter({
-      secrets: options.secretEnvelope,
-      client: new AliyunDocmindClient(),
-      prisma: options.prisma,
-    });
-    tools.push(
-      tool(
-        "convert_pdf_to_md",
-        "Convert a PDF file in the workspace to a Markdown bundle (markdown + extracted images) using Alibaba Cloud Document Mind. The PDF must already be in the workspace (use feishu_download_resource first if it came from Feishu). Returns the path to the generated markdown file and the list of extracted image paths. Mathematical formulas are converted to LaTeX.",
-        {
-          input_path: z.string().describe("Relative path to the input PDF within the workspace."),
-          output_dir: z.string().describe("Relative directory within the workspace to write the markdown and images into. Will be created if it does not exist."),
-        },
-        async (args) => {
-          try {
-            const result = await adapter.invoke({
-              runId: options.runId,
-              organizationId: options.organizationId,
-              projectId: options.projectId,
-              workspaceDir: options.workspaceDir,
-              inputPath: args.input_path,
-              outputDir: args.output_dir,
-              prisma: options.prisma,
-            });
-            const lines = [`Converted PDF to markdown. ${result.artifacts.length} files written:`];
-            for (const artifact of result.artifacts) {
-              lines.push(`  - ${artifact.path} (${artifact.kind})`);
-            }
-            lines.push(`Pages: ${result.consumption.quantity}, Cost: $${(result.consumption.costUsd ?? 0).toFixed(4)}`);
-            return {
-              content: [{ type: "text", text: lines.join("\n") }],
-            };
-          } catch (e) {
-            return {
-              isError: true,
-              content: [{ type: "text", text: e instanceof Error ? e.message : String(e) }],
-            };
-          }
-        },
-        { alwaysLoad: true },
-      ),
-    );
-  }
-
  const instructions = mcpInstructions(enabledTools);
  return createSdkMcpServer({
    name: "cph_hub",
@@ -312,12 +260,5 @@ function mcpInstructions(enabledTools: ReadonlySet<CphHubMcpToolId>): string {
  if (enabledTools.has("request_approval")) {
    instructions.push("Use request_approval when explicit human approval or confirmation is required before continuing.");
  }
-  if (enabledTools.has("convert_pdf_to_md")) {
-    instructions.push(
-      "Use convert_pdf_to_md when the user asks to convert a PDF to Markdown.",
-      "If the PDF came from a Feishu message, first use feishu_download_resource to save it to the workspace, then call convert_pdf_to_md.",
-      "Do NOT attempt to parse PDFs yourself with Read or Bash — always use convert_pdf_to_md for accurate text, formula, and image extraction.",
-    );
-  }
  return instructions.join(" ");
 }
@@ -1,389 +0,0 @@
-/**
- * Resolve markdown image references in agent answers into Feishu-hosted
- * image_keys so cards can embed them without remote URLs (which trip Feishu
- * content-security controls).
- */
-import { isIP } from "node:net";
-import type { FeishuRuntime } from "./client.js";
-import { withRetry } from "./client.js";
-import {
-  WorkspaceFileBoundaryError,
-  readWorkspaceFileNoFollow,
-} from "../security/workspaceFiles.js";
-
-export const FEISHU_MAX_IMAGE_BYTES = 10 * 1024 * 1024;
-export const DEFAULT_MAX_OUTBOUND_IMAGES = 10;
-
-const IMAGE_MARKDOWN_RE = /!\[([^\]\n]*)\]\(([^)\n]+)\)/g;
-const FENCED_CODE_RE = /```[\s\S]*?```/g;
-
-export type CardContentSegment =
-  | { readonly type: "markdown"; readonly content: string }
-  | { readonly type: "image"; readonly imgKey: string; readonly alt: string };
-
-export interface MarkdownImageRef {
-  readonly fullMatch: string;
-  readonly alt: string;
-  readonly src: string;
-  readonly index: number;
-  readonly length: number;
-}
-
-export interface OutboundImageContext {
-  readonly rt: FeishuRuntime;
-  readonly workspaceRoot?: string | undefined;
-  readonly workspaceDir?: string | undefined;
-  readonly maxImageBytes?: number | undefined;
-  readonly maxImages?: number | undefined;
-  readonly fetchImpl?: typeof fetch | undefined;
-}
-
-type ImageCreateResponse = {
-  image_key?: string;
-  data?: { image_key?: string };
-} | null;
-
-type MessageCreateResponse = {
-  message_id?: string;
-  data?: { message_id?: string };
-} | null;
-
-/** Streaming-safe view: drop markdown image URLs so partial cards do not hit Feishu URL checks. */
-export function maskMarkdownImagesForStreaming(text: string): string {
-  return rewriteMarkdownImagesOutsideCode(text, (ref) => {
-    const alt = ref.alt.trim();
-    return alt === "" ? "\u3010\u56fe\u7247\u3011" : alt;
-  });
-}
-
-export function findMarkdownImagesOutsideCode(text: string): MarkdownImageRef[] {
-  const blocked = blockedRanges(text);
-  const refs: MarkdownImageRef[] = [];
-  IMAGE_MARKDOWN_RE.lastIndex = 0;
-  let match: RegExpExecArray | null;
-  while ((match = IMAGE_MARKDOWN_RE.exec(text)) !== null) {
-    const index = match.index;
-    if (blocked.some((range) => index >= range.start && index < range.end)) continue;
-    const fullMatch = match[0];
-    const alt = match[1] ?? "";
-    const rawSrc = (match[2] ?? "").trim();
-    const src = stripUrlTitle(rawSrc);
-    if (src === "") continue;
-    refs.push({ fullMatch, alt, src, index, length: fullMatch.length });
-  }
-  return refs;
-}
-
-/**
- * Upload reachable markdown images and split the answer into card segments
- * (markdown + Feishu img elements). Unresolved images become visible alt text.
- */
-export async function materializeAnswerSegments(
-  text: string,
-  ctx: OutboundImageContext,
-): Promise<{ segments: CardContentSegment[]; unresolved: string[] }> {
-  const refs = findMarkdownImagesOutsideCode(text);
-  if (refs.length === 0) {
-    return {
-      segments: text === "" ? [] : [{ type: "markdown", content: text }],
-      unresolved: [],
-    };
-  }
-
-  const maxImages = ctx.maxImages ?? DEFAULT_MAX_OUTBOUND_IMAGES;
-  const maxBytes = ctx.maxImageBytes ?? FEISHU_MAX_IMAGE_BYTES;
-  const keyBySrc = new Map<string, string>();
-  const unresolved: string[] = [];
-  const uniqueSrcs: string[] = [];
-  for (const ref of refs) {
-    if (!uniqueSrcs.includes(ref.src)) uniqueSrcs.push(ref.src);
-  }
-
-  for (const src of uniqueSrcs.slice(0, maxImages)) {
-    try {
-      const bytes = await resolveOutboundImageBytes(src, ctx, maxBytes);
-      if (bytes === null) {
-        unresolved.push(src);
-        continue;
-      }
-      const imageKey = await uploadMessageImage(ctx.rt, bytes);
-      keyBySrc.set(src, imageKey);
-    } catch (error) {
-      ctx.rt.logger.warn(
-        { src, err: error instanceof Error ? error.message : String(error) },
-        "outbound image materialize failed",
-      );
-      unresolved.push(src);
-    }
-  }
-  for (const src of uniqueSrcs.slice(maxImages)) {
-    unresolved.push(src);
-  }
-
-  const segments: CardContentSegment[] = [];
-  let cursor = 0;
-  for (const ref of refs) {
-    if (ref.index > cursor) {
-      pushMarkdown(segments, text.slice(cursor, ref.index));
-    }
-    const imageKey = keyBySrc.get(ref.src);
-    if (imageKey !== undefined) {
-      segments.push({
-        type: "image",
-        imgKey: imageKey,
-        alt: ref.alt.trim() === "" ? "\u56fe\u7247" : ref.alt.trim(),
-      });
-    } else {
-      const alt = ref.alt.trim();
-      pushMarkdown(segments, alt === "" ? "\u3010\u56fe\u7247\u3011" : alt);
-    }
-    cursor = ref.index + ref.length;
-  }
-  if (cursor < text.length) {
-    pushMarkdown(segments, text.slice(cursor));
-  }
-  return { segments, unresolved };
-}
-
-export async function uploadMessageImage(rt: FeishuRuntime, image: Buffer): Promise<string> {
-  if (image.byteLength === 0) {
-    throw new Error("image is empty");
-  }
-  if (image.byteLength > FEISHU_MAX_IMAGE_BYTES) {
-    throw new Error(`image exceeds Feishu limit of ${FEISHU_MAX_IMAGE_BYTES} bytes`);
-  }
-  const client = rt.client as unknown as {
-    im: { v1: { image: { create: (p: unknown) => Promise<ImageCreateResponse> } } };
-  };
-  const res = await withRetry(async () =>
-    client.im.v1.image.create({
-      data: { image_type: "message", image },
-    }),
-  );
-  const imageKey = res?.image_key ?? res?.data?.image_key;
-  if (imageKey === undefined || imageKey === "") {
-    throw new Error("Feishu image upload response is missing image_key");
-  }
-  return imageKey;
-}
-
-/** Send a standalone image message (fallback if card embed is unavailable). */
-export async function sendImageMessage(
-  rt: FeishuRuntime,
-  chatId: string,
-  imageKey: string,
-  options?: { readonly replyToMessageId?: string | undefined },
-): Promise<string | null> {
-  const client = rt.client as unknown as {
-    im: {
-      v1: {
-        message: {
-          create: (p: unknown) => Promise<MessageCreateResponse>;
-          reply: (p: unknown) => Promise<MessageCreateResponse>;
-        };
-      };
-    };
-  };
-  const replyTo = options?.replyToMessageId;
-  if (replyTo !== undefined && replyTo !== "") {
-    const res = await client.im.v1.message.reply({
-      path: { message_id: replyTo },
-      data: { msg_type: "image", content: JSON.stringify({ image_key: imageKey }) },
-    });
-    return res?.data?.message_id ?? res?.message_id ?? null;
-  }
-  const res = await client.im.v1.message.create({
-    params: { receive_id_type: "chat_id" },
-    data: {
-      receive_id: chatId,
-      msg_type: "image",
-      content: JSON.stringify({ image_key: imageKey }),
-    },
-  });
-  return res?.data?.message_id ?? res?.message_id ?? null;
-}
-
-export async function resolveOutboundImageBytes(
-  src: string,
-  ctx: OutboundImageContext,
-  maxBytes: number,
-): Promise<Buffer | null> {
-  if (isRemoteUrl(src)) {
-    return fetchRemoteImage(src, ctx.fetchImpl ?? fetch, maxBytes);
-  }
-  const root = ctx.workspaceRoot?.trim();
-  const dir = ctx.workspaceDir?.trim();
-  if (root === undefined || root === "" || dir === undefined || dir === "") {
-    return null;
-  }
-  try {
-    const file = await readWorkspaceFileNoFollow(root, dir, src, maxBytes);
-    return file.data;
-  } catch (error) {
-    if (error instanceof WorkspaceFileBoundaryError && error.reason === "not_found") {
-      return null;
-    }
-    throw error;
-  }
-}
-
-function rewriteMarkdownImagesOutsideCode(
-  text: string,
-  replace: (ref: MarkdownImageRef) => string,
-): string {
-  const refs = findMarkdownImagesOutsideCode(text);
-  if (refs.length === 0) return text;
-  let out = "";
-  let cursor = 0;
-  for (const ref of refs) {
-    out += text.slice(cursor, ref.index);
-    out += replace(ref);
-    cursor = ref.index + ref.length;
-  }
-  out += text.slice(cursor);
-  return out;
-}
-
-function pushMarkdown(segments: CardContentSegment[], content: string): void {
-  if (content === "") return;
-  const last = segments[segments.length - 1];
-  if (last !== undefined && last.type === "markdown") {
-    segments[segments.length - 1] = { type: "markdown", content: last.content + content };
-    return;
-  }
-  segments.push({ type: "markdown", content });
-}
-
-function blockedRanges(text: string): Array<{ start: number; end: number }> {
-  const ranges: Array<{ start: number; end: number }> = [];
-  FENCED_CODE_RE.lastIndex = 0;
-  let match: RegExpExecArray | null;
-  while ((match = FENCED_CODE_RE.exec(text)) !== null) {
-    ranges.push({ start: match.index, end: match.index + match[0].length });
-  }
-  return ranges;
-}
-
-function stripUrlTitle(raw: string): string {
-  const trimmed = raw.trim();
-  // Markdown optional title: url "title" or url 'title'
-  const titled = /^(\S+)\s+(".*"|'.*')$/.exec(trimmed);
-  return (titled?.[1] ?? trimmed).trim();
-}
-
-function isRemoteUrl(src: string): boolean {
-  try {
-    const url = new URL(src);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-async function fetchRemoteImage(
-  src: string,
-  fetchImpl: typeof fetch,
-  maxBytes: number,
-): Promise<Buffer | null> {
-  let url: URL;
-  try {
-    url = new URL(src);
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!isPublicHttpHost(url.hostname)) return null;
-
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 15_000);
-  try {
-    const response = await fetchImpl(url, {
-      method: "GET",
-      redirect: "manual",
-      signal: controller.signal,
-      headers: { accept: "image/*,*/*;q=0.8" },
-    });
-    // One safe redirect hop to another public http(s) host.
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (location === null || location === "") return null;
-      let redirected: URL;
-      try {
-        redirected = new URL(location, url);
-      } catch {
-        return null;
-      }
-      if (redirected.protocol !== "http:" && redirected.protocol !== "https:") return null;
-      if (!isPublicHttpHost(redirected.hostname)) return null;
-      const second = await fetchImpl(redirected, {
-        method: "GET",
-        redirect: "manual",
-        signal: controller.signal,
-        headers: { accept: "image/*,*/*;q=0.8" },
-      });
-      return readImageBody(second, maxBytes);
-    }
-    return readImageBody(response, maxBytes);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-async function readImageBody(response: Response, maxBytes: number): Promise<Buffer | null> {
-  if (!response.ok) return null;
-  const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
-  if (
-    contentType !== "" &&
-    !contentType.startsWith("image/") &&
-    !contentType.includes("octet-stream") &&
-    (contentType.startsWith("text/") || contentType.includes("json") || contentType.includes("html"))
-  ) {
-    return null;
-  }
-  const contentLength = Number(response.headers.get("content-length") ?? "NaN");
-  if (Number.isFinite(contentLength) && contentLength > maxBytes) return null;
-  const buf = Buffer.from(await response.arrayBuffer());
-  if (buf.byteLength === 0 || buf.byteLength > maxBytes) return null;
-  return buf;
-}
-
-function isPublicHttpHost(hostname: string): boolean {
-  const host = hostname.trim().toLowerCase().replace(/\.$/, "");
-  if (host === "" || host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) {
-    return false;
-  }
-  if (host === "0.0.0.0" || host === "::" || host === "[::]" || host === "::1" || host === "[::1]") {
-    return false;
-  }
-  const unbracketed = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-  const ipVersion = isIP(unbracketed);
-  if (ipVersion === 4) return !isPrivateIPv4(unbracketed);
-  if (ipVersion === 6) return !isPrivateIPv6(unbracketed);
-  return true;
-}
-
-function isPrivateIPv4(ip: string): boolean {
-  const parts = ip.split(".").map((part) => Number(part));
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return true;
-  }
-  const a = parts[0]!;
-  const b = parts[1]!;
-  if (a === 10 || a === 127 || a === 0) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  if (a >= 224) return true; // multicast / reserved
-  return false;
-}
-
-function isPrivateIPv6(ip: string): boolean {
-  const normalized = ip.toLowerCase();
-  if (normalized === "::1") return true;
-  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true; // unique local
-  if (normalized.startsWith("fe80:")) return true; // link-local
-  const mapped = /^:ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(normalized);
-  if (mapped?.[1] !== undefined) return isPrivateIPv4(mapped[1]);
-  return false;
-}
@@ -14,7 +14,6 @@ import { join } from "node:path";
 import type { Prisma, PrismaClient } from "@prisma/client";
 import { z } from "zod";
 import type { FastifyBaseLogger } from "fastify";
-import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
 import {
  sendText,
  sendTextMessage,
@@ -94,7 +93,6 @@ interface TriggerDeps {
  readonly prisma: PrismaClient;
  readonly settings: RuntimeSettings;
  readonly logger: FastifyBaseLogger;
-  readonly secretEnvelope: LocalSecretEnvelope;
  readonly runAgent?: (req: RunRequest) => Promise<RunResult>;
  readonly authorizer?: PermissionAuthorizer | undefined;
  readonly messageBatcherOptions?: MessageBatcherOptions | undefined;
@@ -488,7 +486,6 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
    // Streaming agent card: single interactive card through the full run
    // lifecycle (thinking → tool calls → streaming text → complete).
    // Shows tool-use trace panel + reasoning panel + answer text.
-    const deliveredFiles: string[] = [];
    const card = new StreamingAgentCard({
      runId: run.id,
      rt,
@@ -496,15 +493,12 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
      sendOptions,
      patchIntervalMs: undefined,
      maxMessageLength: undefined,
-      workspaceRoot: projectWorkspaceRoot,
-      workspaceDir: project.workspaceDir,
-      maxImageBytes: deps.resourceLimits?.maxBytesPerFile,
    });
+    const deliveredFiles: string[] = [];
    const fileDeliveryMcpServer = createFileDeliveryMcpServer({
      rt,
      chatId,
      projectId,
-      organizationId: siloOrganizationId,
      runId: run.id,
      workspaceRoot: projectWorkspaceRoot,
      workspaceDir: project.workspaceDir,
@@ -512,8 +506,6 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
      sendOptions,
      approvalManager,
      tools: cphHubMcpToolsForRole(roleTools),
-      prisma: deps.prisma,
-      secretEnvelope: deps.secretEnvelope,
      onDelivered: (path) => {
        deliveredFiles.push(path);
      },
@@ -1,6 +1,5 @@
 import Fastify from "fastify";
 import { registerAdminPlugin } from "./admin/plugin.js";
-import { registerDatabasePlugin } from "./database/plugin.js";
 import { prisma } from "./db.js";
 import { createLarkClient, startFeishuListenerWithClient } from "./feishu/client.js";
 import { archiveFeishuBindingForLifecycleEvent } from "./feishu/bindingLifecycle.js";
@@ -144,14 +143,6 @@ export async function startHub(): Promise<void> {
    secretEnvelope,
  });

-  // `/database/*` surface. Registered after the admin plugin so the
-  // @fastify/cookie parser and /auth/* login routes are already available.
-  await registerDatabasePlugin(app, {
-    prisma,
-    sessionSecret,
-    siloOrganizationSlug: siloOrganization.slug,
-  });
-
  const feishuListenerEnabled = booleanEnv("HUB_FEISHU_LISTENER_ENABLED", true);
  if (feishuListenerEnabled) {
    const feishuConfig = {
@@ -171,7 +162,6 @@ export async function startHub(): Promise<void> {
      prisma,
      settings: runtimeSettings,
      logger: app.log,
-      secretEnvelope,
      projectWorkspaceRoot,
      publicBaseUrl,
      siloOrganizationId: siloOrganization.id,
@@ -1,9 +1,9 @@
 /**
- * Org capacity policy service (ADR-0022).
+ * Org capacity policy service (ADR-0022 / spec `Spec.System.Capacity`).
 *
 * Stores per-Organization lower `organizationLimit` overrides per
- * `CapacityDimension`. Enforces the layered-limit invariant: a set limit must be ≤ the
- * platform ceiling for that dimension. The effective limit (min of the two)
+ * `CapacityDimension`. Enforces `LayeredLimit.Valid`: a set limit must be ≤ the
+ * platform ceiling for that dimension. `LayeredLimit.effective` (min of the two)
 * is the value capacity admission should use; dimensions with no org override
 * fall back to the platform ceiling.
 */
@@ -1,7 +1,7 @@
 /**
 * Organization membership management for org admin (ADR-0021).
 *
- * Role rules (product pin, not yet recorded in an ADR):
+ * Role rules (product pin, not yet in Lean):
 * 1. Actor must be OWNER or ADMIN (enforced at HTTP layer).
 * 2. Only OWNER can grant/revoke OWNER or modify another OWNER.
 * 3. Cannot revoke or demote the last remaining OWNER.
@@ -9,14 +9,13 @@
 * external-capability consumption (PDF→MD, ASR, …) is attributed correctly,
 * not just the main model loop. A run with no cost-bearing fact is
 * `runsWithoutCost` — ADR-0022: missing cost ≠ zero.
- *
- * Breakdown buckets keep kind / provider / model / capability / unit, so the
- * admin UI can separate model tokens from non-token external meters instead of
- * collapsing everything into a single input/output token total.
 */
 import type { Prisma, PrismaClient } from "@prisma/client";

-export interface UsageTotals {
+export interface ProjectUsageRow {
+  readonly projectId: string;
+  readonly projectName: string;
+  readonly folderId: string | null;
  readonly runCount: number;
  readonly runsWithCost: number;
  readonly runsWithoutCost: number;
@@ -25,50 +24,21 @@ export interface UsageTotals {
  readonly costUsd: number | null;
 }

-export interface ProjectUsageRow extends UsageTotals {
-  readonly projectId: string;
-  readonly projectName: string;
-  readonly folderId: string | null;
-}
-
-/** One ledger slice: kind + provider + model + capability + unit. */
-export interface UsageBreakdownRow {
-  readonly kind: string;
-  readonly provider: string;
-  readonly model: string | null;
-  readonly capabilityId: string | null;
-  readonly unit: string | null;
-  readonly factCount: number;
-  readonly factsWithCost: number;
-  readonly factsWithoutCost: number;
-  readonly inputTokens: number;
-  readonly outputTokens: number;
-  /** Sum of quantity when unit is non-null; null when this bucket is token-only. */
-  readonly quantity: number | null;
-  readonly costUsd: number | null;
-}
-
 export interface UsageReport {
  readonly from: string | null;
  readonly to: string | null;
  readonly projects: readonly ProjectUsageRow[];
-  readonly totals: UsageTotals;
-  readonly breakdown: readonly UsageBreakdownRow[];
-}
-
-export interface ProjectUsageReport extends ProjectUsageRow {
-  readonly from: string | null;
-  readonly to: string | null;
-  readonly breakdown: readonly UsageBreakdownRow[];
+  readonly totals: {
+    readonly runCount: number;
+    readonly runsWithCost: number;
+    readonly runsWithoutCost: number;
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly costUsd: number | null;
+  };
 }

 type FactRow = {
-  readonly kind: string;
-  readonly provider: string;
-  readonly model: string | null;
-  readonly capabilityId: string | null;
-  readonly unit: string | null;
-  readonly quantity: unknown;
  readonly inputTokens: number | null;
  readonly outputTokens: number | null;
  readonly costUsd: unknown;
@@ -79,91 +49,26 @@ type RunWithFacts = {
  readonly usageFacts: readonly FactRow[];
 };

-type MutableTotals = {
-  runCount: number;
-  runsWithCost: number;
-  runsWithoutCost: number;
-  inputTokens: number;
-  outputTokens: number;
-  costUsd: number | null;
-};
-
-type MutableBreakdown = {
-  kind: string;
-  provider: string;
-  model: string | null;
-  capabilityId: string | null;
-  unit: string | null;
-  factCount: number;
-  factsWithCost: number;
-  factsWithoutCost: number;
-  inputTokens: number;
-  outputTokens: number;
-  quantity: number | null;
-  costUsd: number | null;
-};
-
-type MutableProjectRow = MutableTotals & {
-  readonly projectId: string;
-  readonly projectName: string;
-  readonly folderId: string | null;
-};
-
-const FACT_SELECT = {
-  kind: true,
-  provider: true,
-  model: true,
-  capabilityId: true,
-  unit: true,
-  quantity: true,
-  inputTokens: true,
-  outputTokens: true,
-  costUsd: true,
-} as const;
+/** A run is "recorded with cost" if any of its facts carries a known costUsd. */
+function runHasRecordedCost(facts: readonly FactRow[]): boolean {
+  return facts.some((f) => f.costUsd !== null && f.costUsd !== undefined);
+}

+/** Decimal→number for Prisma Decimal; null/undefined → null. */
 function factCostUsdToNumber(value: unknown): number | null {
  if (value === null || value === undefined) return null;
  const n = typeof value === "number" ? value : Number(value);
  return Number.isFinite(n) ? n : null;
 }

-function factQuantityToNumber(value: unknown): number | null {
-  if (value === null || value === undefined) return null;
-  const n = typeof value === "number" ? value : Number(value);
-  return Number.isFinite(n) ? n : null;
-}
-
-function breakdownKey(f: FactRow): string {
-  return [
-    f.kind,
-    f.provider,
-    f.model ?? "",
-    f.capabilityId ?? "",
-    f.unit ?? "",
-  ].join("\u0000");
-}
-
-function emptyMutableTotals(): MutableTotals {
-  return {
-    runCount: 0,
-    runsWithCost: 0,
-    runsWithoutCost: 0,
-    inputTokens: 0,
-    outputTokens: 0,
-    costUsd: null,
-  };
-}
-
-function addCost(existing: number | null, add: number): number {
-  return (existing ?? 0) + add;
-}
-
-function rollupRunTokensAndCost(facts: readonly FactRow[]): {
+interface RunRollup {
  readonly hasCost: boolean;
  readonly inputTokens: number;
  readonly outputTokens: number;
  readonly costUsd: number | null;
-} {
+}
+
+function rollupRun(facts: readonly FactRow[]): RunRollup {
  let inputTokens = 0;
  let outputTokens = 0;
  let costUsd: number | null = null;
@@ -174,118 +79,12 @@ function rollupRunTokensAndCost(facts: readonly FactRow[]): {
    const c = factCostUsdToNumber(f.costUsd);
    if (c !== null) {
      hasCost = true;
-      costUsd = addCost(costUsd, c);
+      costUsd = (costUsd ?? 0) + c;
    }
  }
  return { hasCost, inputTokens, outputTokens, costUsd };
 }

-function accumulateBreakdown(
-  buckets: Map<string, MutableBreakdown>,
-  facts: readonly FactRow[],
-): void {
-  for (const f of facts) {
-    const key = breakdownKey(f);
-    let bucket = buckets.get(key);
-    if (bucket === undefined) {
-      bucket = {
-        kind: f.kind,
-        provider: f.provider,
-        model: f.model,
-        capabilityId: f.capabilityId,
-        unit: f.unit,
-        factCount: 0,
-        factsWithCost: 0,
-        factsWithoutCost: 0,
-        inputTokens: 0,
-        outputTokens: 0,
-        quantity: null,
-        costUsd: null,
-      };
-      buckets.set(key, bucket);
-    }
-    bucket.factCount += 1;
-    bucket.inputTokens += f.inputTokens ?? 0;
-    bucket.outputTokens += f.outputTokens ?? 0;
-    const qty = factQuantityToNumber(f.quantity);
-    if (qty !== null) {
-      bucket.quantity = (bucket.quantity ?? 0) + qty;
-    }
-    const c = factCostUsdToNumber(f.costUsd);
-    if (c !== null) {
-      bucket.factsWithCost += 1;
-      bucket.costUsd = addCost(bucket.costUsd, c);
-    } else {
-      bucket.factsWithoutCost += 1;
-    }
-  }
-}
-
-function freezeBreakdown(buckets: Map<string, MutableBreakdown>): UsageBreakdownRow[] {
-  return [...buckets.values()]
-    .map((b) => ({
-      kind: b.kind,
-      provider: b.provider,
-      model: b.model,
-      capabilityId: b.capabilityId,
-      unit: b.unit,
-      factCount: b.factCount,
-      factsWithCost: b.factsWithCost,
-      factsWithoutCost: b.factsWithoutCost,
-      inputTokens: b.inputTokens,
-      outputTokens: b.outputTokens,
-      quantity: b.quantity,
-      costUsd: b.costUsd,
-    }))
-    .sort((a, b) => {
-      const kindCmp = a.kind.localeCompare(b.kind);
-      if (kindCmp !== 0) return kindCmp;
-      const provCmp = a.provider.localeCompare(b.provider);
-      if (provCmp !== 0) return provCmp;
-      const capA = a.capabilityId ?? "";
-      const capB = b.capabilityId ?? "";
-      const capCmp = capA.localeCompare(capB);
-      if (capCmp !== 0) return capCmp;
-      const modelA = a.model ?? "";
-      const modelB = b.model ?? "";
-      return modelA.localeCompare(modelB);
-    });
-}
-
-function freezeTotals(t: MutableTotals): UsageTotals {
-  return {
-    runCount: t.runCount,
-    runsWithCost: t.runsWithCost,
-    runsWithoutCost: t.runsWithoutCost,
-    inputTokens: t.inputTokens,
-    outputTokens: t.outputTokens,
-    costUsd: t.costUsd,
-  };
-}
-
-function applyRunToTotals(totals: MutableTotals, facts: readonly FactRow[]): void {
-  const roll = rollupRunTokensAndCost(facts);
-  totals.runCount += 1;
-  if (roll.hasCost) {
-    totals.runsWithCost += 1;
-    totals.costUsd = addCost(totals.costUsd, roll.costUsd ?? 0);
-  } else {
-    totals.runsWithoutCost += 1;
-  }
-  totals.inputTokens += roll.inputTokens;
-  totals.outputTokens += roll.outputTokens;
-}
-
-function emptyReport(from?: Date, to?: Date): UsageReport {
-  return {
-    from: from?.toISOString() ?? null,
-    to: to?.toISOString() ?? null,
-    projects: [],
-    totals: freezeTotals(emptyMutableTotals()),
-    breakdown: [],
-  };
-}
-
 export async function getOrgUsage(
  prisma: PrismaClient,
  input: {
@@ -309,65 +108,101 @@ export async function getOrgUsage(
  }

  const projectIds = projects.map((p) => p.id);
+  const runWhere: Prisma.AgentRunWhereInput = {
+    projectId: { in: projectIds },
+    ...(input.from !== undefined || input.to !== undefined
+      ? {
+          startedAt: {
+            ...(input.from !== undefined ? { gte: input.from } : {}),
+            ...(input.to !== undefined ? { lte: input.to } : {}),
+          },
+        }
+      : {}),
+  };
+
  // Date range filters by run.startedAt, matching the pre-ADR-0026 semantics:
  // a run is in or out of the window based on when it started, and all of its
  // facts come along. Filtering facts by occurredAt independently would let a
  // run contribute partial cost to a window it doesn't belong to.
  const runs = await prisma.agentRun.findMany({
-    where: {
-      projectId: { in: projectIds },
-      ...(input.from !== undefined || input.to !== undefined
-        ? {
-            startedAt: {
-              ...(input.from !== undefined ? { gte: input.from } : {}),
-              ...(input.to !== undefined ? { lte: input.to } : {}),
-            },
-          }
-        : {}),
-    },
+    where: runWhere,
    select: {
      projectId: true,
      usageFacts: {
-        select: FACT_SELECT,
+        select: { inputTokens: true, outputTokens: true, costUsd: true },
        orderBy: { occurredAt: "asc" },
      },
    },
  });

-  const byProject = new Map<string, MutableProjectRow>();
+  type MutableRow = {
+    readonly projectId: string;
+    readonly projectName: string;
+    readonly folderId: string | null;
+    runCount: number;
+    runsWithCost: number;
+    runsWithoutCost: number;
+    inputTokens: number;
+    outputTokens: number;
+    costUsd: number | null;
+  };
+
+  const byProject = new Map<string, MutableRow>();
  for (const p of projects) {
    byProject.set(p.id, {
      projectId: p.id,
      projectName: p.name,
      folderId: p.folderId,
-      ...emptyMutableTotals(),
+      runCount: 0,
+      runsWithCost: 0,
+      runsWithoutCost: 0,
+      inputTokens: 0,
+      outputTokens: 0,
+      costUsd: null,
    });
  }

-  const breakdownBuckets = new Map<string, MutableBreakdown>();
  for (const run of runs as readonly RunWithFacts[]) {
    const row = byProject.get(run.projectId);
    if (row === undefined) continue;
-    applyRunToTotals(row, run.usageFacts);
-    accumulateBreakdown(breakdownBuckets, run.usageFacts);
+    const roll = rollupRun(run.usageFacts);
+    row.runCount += 1;
+    if (roll.hasCost) {
+      row.runsWithCost += 1;
+      row.costUsd = (row.costUsd ?? 0) + (roll.costUsd ?? 0);
+    } else {
+      row.runsWithoutCost += 1;
+    }
+    row.inputTokens += roll.inputTokens;
+    row.outputTokens += roll.outputTokens;
  }

  const projectsOut: ProjectUsageRow[] = [...byProject.values()].map((r) => ({
    projectId: r.projectId,
    projectName: r.projectName,
    folderId: r.folderId,
-    ...freezeTotals(r),
+    runCount: r.runCount,
+    runsWithCost: r.runsWithCost,
+    runsWithoutCost: r.runsWithoutCost,
+    inputTokens: r.inputTokens,
+    outputTokens: r.outputTokens,
+    costUsd: r.costUsd,
  }));

-  const totals = emptyMutableTotals();
+  let runCount = 0;
+  let runsWithCost = 0;
+  let runsWithoutCost = 0;
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let costUsd: number | null = null;
  for (const row of projectsOut) {
-    totals.runCount += row.runCount;
-    totals.runsWithCost += row.runsWithCost;
-    totals.runsWithoutCost += row.runsWithoutCost;
-    totals.inputTokens += row.inputTokens;
-    totals.outputTokens += row.outputTokens;
+    runCount += row.runCount;
+    runsWithCost += row.runsWithCost;
+    runsWithoutCost += row.runsWithoutCost;
+    inputTokens += row.inputTokens;
+    outputTokens += row.outputTokens;
    if (row.costUsd !== null) {
-      totals.costUsd = addCost(totals.costUsd, row.costUsd);
+      costUsd = (costUsd ?? 0) + row.costUsd;
    }
  }

@@ -375,8 +210,14 @@ export async function getOrgUsage(
    from: input.from?.toISOString() ?? null,
    to: input.to?.toISOString() ?? null,
    projects: projectsOut,
-    totals: freezeTotals(totals),
-    breakdown: freezeBreakdown(breakdownBuckets),
+    totals: {
+      runCount,
+      runsWithCost,
+      runsWithoutCost,
+      inputTokens,
+      outputTokens,
+      costUsd,
+    },
  };
 }

@@ -388,7 +229,7 @@ export async function getProjectUsage(
    readonly from?: Date | undefined;
    readonly to?: Date | undefined;
  },
-): Promise<ProjectUsageReport> {
+): Promise<ProjectUsageRow> {
  const project = await prisma.project.findFirst({
    where: { id: input.projectId, organizationId: input.organizationId },
    select: { id: true, name: true, folderId: true },
@@ -396,41 +237,39 @@ export async function getProjectUsage(
  if (project === null) {
    throw new Error(`project not found: ${input.projectId}`);
  }
-
-  const runs = await prisma.agentRun.findMany({
-    where: {
-      projectId: project.id,
-      ...(input.from !== undefined || input.to !== undefined
-        ? {
-            startedAt: {
-              ...(input.from !== undefined ? { gte: input.from } : {}),
-              ...(input.to !== undefined ? { lte: input.to } : {}),
-            },
-          }
-        : {}),
-    },
-    select: {
-      usageFacts: {
-        select: FACT_SELECT,
-        orderBy: { occurredAt: "asc" },
-      },
-    },
+  const report = await getOrgUsage(prisma, {
+    organizationId: input.organizationId,
+    from: input.from,
+    to: input.to,
  });
+  const row = report.projects.find((p) => p.projectId === project.id);
+  return (
+    row ?? {
+      projectId: project.id,
+      projectName: project.name,
+      folderId: project.folderId,
+      runCount: 0,
+      runsWithCost: 0,
+      runsWithoutCost: 0,
+      inputTokens: 0,
+      outputTokens: 0,
+      costUsd: null,
+    }
+  );
+}

-  const totals = emptyMutableTotals();
-  const breakdownBuckets = new Map<string, MutableBreakdown>();
-  for (const run of runs) {
-    applyRunToTotals(totals, run.usageFacts as readonly FactRow[]);
-    accumulateBreakdown(breakdownBuckets, run.usageFacts as readonly FactRow[]);
-  }
-
+function emptyReport(from?: Date, to?: Date): UsageReport {
  return {
-    projectId: project.id,
-    projectName: project.name,
-    folderId: project.folderId,
-    ...freezeTotals(totals),
-    from: input.from?.toISOString() ?? null,
-    to: input.to?.toISOString() ?? null,
-    breakdown: freezeBreakdown(breakdownBuckets),
+    from: from?.toISOString() ?? null,
+    to: to?.toISOString() ?? null,
+    projects: [],
+    totals: {
+      runCount: 0,
+      runsWithCost: 0,
+      runsWithoutCost: 0,
+      inputTokens: 0,
+      outputTokens: 0,
+      costUsd: null,
+    },
  };
 }
@@ -558,26 +558,6 @@ async function ensureInboxFolder(prisma: Prisma.TransactionClient, organizationI
    select: { id: true },
  });
  if (existing !== null) return existing;
-
-  // Bootstrap once created a root "Inbox" without kind=SYSTEM_INBOX. Sibling-name
-  // uniqueness then makes a second create fail. Recover by promoting that row.
-  const legacyRootInbox = await prisma.folder.findFirst({
-    where: {
-      organizationId,
-      parentId: null,
-      name: "Inbox",
-      archivedAt: null,
-    },
-    select: { id: true },
-  });
-  if (legacyRootInbox !== null) {
-    return prisma.folder.update({
-      where: { id: legacyRootInbox.id },
-      data: { kind: "SYSTEM_INBOX" },
-      select: { id: true },
-    });
-  }
-
  return prisma.folder.create({
    data: { organizationId, name: "Inbox", kind: "SYSTEM_INBOX", sortKey: "000000" },
    select: { id: true },
@@ -170,7 +170,7 @@ describe("admin auth + org API guards", () => {
    try {
      const res = await app.inject({
        method: "GET",
-        url: "/auth/feishu?returnTo=/admin",
+        url: "/auth/feishu?returnTo=/admin/org/test-default",
      });
      expect(res.statusCode).toBe(302);
      const location = res.headers.location;
@@ -233,7 +233,7 @@ describe("admin auth + org API guards", () => {
    try {
      const nonce = "nonce-test-1";
      const state = signOAuthState(
-        { nonce, returnTo: "/admin" },
+        { nonce, returnTo: "/admin/org/test-default" },
        SESSION_SECRET,
      );
      const res = await app.inject({
@@ -242,7 +242,7 @@ describe("admin auth + org API guards", () => {
        headers: { cookie: `${OAUTH_STATE_COOKIE_NAME}=${nonce}` },
      });
      expect(res.statusCode).toBe(302);
-      expect(res.headers.location).toBe("/admin");
+      expect(res.headers.location).toBe("/admin/org/test-default");
      expect(JSON.stringify(res.headers["set-cookie"])).toContain("cph_session=");

      const user = await prisma.user.findUnique({ where: { feishuOpenId: "ou_new" } });
@@ -293,7 +293,7 @@ describe("admin auth + org API guards", () => {
    try {
      const start = await app.inject({
        method: "GET",
-        url: "/auth/feishu/test-default?returnTo=/admin/settings",
+        url: "/auth/feishu/test-default?returnTo=/admin/org/test-default/settings",
      });
      expect(start.statusCode).toBe(302);
      const authorize = new URL(String(start.headers.location));
@@ -308,7 +308,7 @@ describe("admin auth + org API guards", () => {
        headers: { cookie: nonceCookie },
      });
      expect(callback.statusCode).toBe(302);
-      expect(callback.headers.location).toBe("/admin/settings");
+      expect(callback.headers.location).toBe("/admin/org/test-default/settings");
      const sessionCookie = cookiePair(callback.headers["set-cookie"], "cph_session");
      const me = await app.inject({ method: "GET", url: "/api/me", headers: { cookie: sessionCookie } });
      expect(me.statusCode).toBe(200);
@@ -346,7 +346,7 @@ describe("admin auth + org API guards", () => {
        headers: { cookie: cookiePair(defaultStart.headers["set-cookie"], OAUTH_STATE_COOKIE_NAME) },
      });
      expect(defaultCallback.statusCode).toBe(302);
-      expect(defaultCallback.headers.location).toBe("/admin");
+      expect(defaultCallback.headers.location).toBe("/admin/org/test-default");

      await connections.disable({ organizationId: DEFAULT_ORG_ID, actorUserId: "scoped-owner" });
      const revoked = await app.inject({ method: "GET", url: "/api/me", headers: { cookie: sessionCookie } });
--- a/Show More
+++ b/Show More