diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 62e9b2d..5fd9bc9 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -9,67 +9,17 @@ Participation is governed by [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
 Project decisions and contribution licensing are described in
 [GOVERNANCE.md](../docs/project/GOVERNANCE.md).
 
-## Development Setup
+## Development And Verification
 
-The CI baseline is Rust stable and Node.js 24. Install Rust with `rustfmt` and
-`clippy`, Node.js/npm, `curl`, and a native compiler toolchain. Docker Compose is
-needed for the complete stack.
+Follow [Development](../docs/DEVELOPMENT.md) for the pinned toolchain,
+PostgreSQL setup, and daily commands. Run `scripts/dev.sh check` before a pull
+request; `scripts/dev.sh check --backend` is the Rust-only subset.
 
-Confirm that the current Linux shell uses the pinned toolchain and does not
-resolve Windows-mounted Node/npm binaries:
-
-```bash
-scripts/doctor.sh --development
-```
-
-`scripts/install-deps-ubuntu.sh` installs only native helper packages; it does
-not install Rust, Node.js, npm, Docker, or Playwright browsers.
-
-```bash
-git clone git@github.com:tiammomo/ModelPort.git
-cd ModelPort
-cp .env.example .env
-cp config.example.toml config.toml
-# replace required placeholders; never commit this file
-scripts/config-validate.sh
-scripts/check.sh
-
-cd dashboard
-npm ci
-npm run lint
-npm run build
-```
-
-Full setup and the change-to-test matrix are in
-[docs/DEVELOPMENT.md](../docs/DEVELOPMENT.md).
-
-## Before A Pull Request
-
-Run the aggregate check:
-
-```bash
-scripts/check-all.sh
-```
-
-If working incrementally, `scripts/check.sh` is the backend-only subset and
-`cd dashboard && npm run check` is the dashboard subset.
-Dependency updates must also pass `cargo audit --deny warnings --file Cargo.lock`,
-`cargo deny check`, and `node scripts/audit-dashboard.mjs`; CI runs these
-gates. Never add a broad or non-expiring audit exception.
-
-Then choose checks by risk:
-
-- dashboard behavior: affected Playwright specs or `npm run e2e`;
-- auth, API keys, teams, quota, or backup: `scripts/acceptance.sh`;
-- protocol, SSE, or Tool Use: relevant Rust tests and
-  `scripts/tool-use-acceptance.sh`;
-- provider behavior: `scripts/provider-matrix.sh --model provider:model` and
-  real Tool Use acceptance when certification is intended;
-- Docker/systemd/reverse proxy: build/install the deployment and run smoke
-  through the deployed origin.
-
-Real upstream checks can incur cost and must use your own local secrets. CI and
-ordinary pull requests should prefer mock-backed checks.
+Use the [change-to-test matrix](../docs/DEVELOPMENT.md#change-to-test-matrix)
+for additional checks. Dependency changes must also pass the
+[dependency audits](../docs/DEVELOPMENT.md#dependency-audits). Never add a broad
+or non-expiring audit exception. Ordinary verification uses synthetic data;
+real Provider certification requires explicitly intended, potentially paid calls.
 
 ## Code And Security Conventions
 
diff --git a/README.md b/README.md
index 642c677..e163cfb 100644
--- a/README.md
+++ b/README.md
@@ -89,28 +89,10 @@ project provides no paid edition, hosted service, or community-support SLA.
 
 ## Development
 
-The source-development path requires a reachable PostgreSQL instance; the
-development scripts do not start one. See [Development](docs/DEVELOPMENT.md)
-for a loopback-only disposable database command and the complete prerequisites.
-The [repository map](docs/DEVELOPMENT.md#repository-map) explains where code,
-resources, tests, and project policies belong.
-
-```bash
-cp .env.example .env
-cp config.example.toml config.toml
-# replace required placeholders
-scripts/start.sh
-
-cd dashboard
-npm ci
-npm run dev
-```
-
-Before submitting a change:
-
-```bash
-scripts/check-all.sh
-```
+Use the [development guide](docs/DEVELOPMENT.md) for the repository map,
+pinned tools, PostgreSQL setup, and frontend workflow. Native gateway commands
+share `scripts/dev.sh`; use `scripts/dev.sh help` to see the available actions.
+Before submitting a change, run `scripts/dev.sh check`.
 
 ## License
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index f44de67..a2781ca 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -80,25 +80,9 @@ CIDR、安全 Cookie、CSRF 防护和控制台 API Key。不要提交 `.env`、P
 
 ## 本地开发
 
-参见[开发指南与目录职责](docs/DEVELOPMENT.md#repository-map)。本地开发需要
-可连接的 PostgreSQL；开发脚本不会自动启动数据库。
-
-```bash
-cp .env.example .env
-cp config.example.toml config.toml
-# 替换必填 placeholder
-scripts/start.sh
-
-cd dashboard
-npm ci
-npm run dev
-```
-
-提交变更前：
-
-```bash
-scripts/check-all.sh
-```
+[开发指南](docs/DEVELOPMENT.md)统一说明目录职责、工具版本、PostgreSQL 准备和
+前端开发流程。本地网关统一使用 `scripts/dev.sh`，运行 `scripts/dev.sh help`
+查看启动、停止、状态与排障命令；提交前运行 `scripts/dev.sh check`。
 
 ## 许可证
 
diff --git a/dashboard/e2e/provider-management.spec.ts b/dashboard/e2e/provider-management.spec.ts
index b4fbb34..900f222 100644
--- a/dashboard/e2e/provider-management.spec.ts
+++ b/dashboard/e2e/provider-management.spec.ts
@@ -55,7 +55,7 @@ test.describe('provider management', () => {
     await expect(card.getByText('已禁用')).toHaveCount(0)
   })
 
-  test('exposes credential pool controls on provider cards', async ({ page }) => {
+  test('validates, creates, edits and deletes credentials on provider cards', async ({ page }) => {
     const suffix = Date.now().toString(36)
     const providerId = 'deepseek'
     const credentialId = `e2e_pool_${suffix}`
@@ -70,6 +70,9 @@ test.describe('provider management', () => {
     try {
       await card.getByRole('button', { name: '新增' }).click()
       const credentialDialog = page.getByRole('dialog')
+      await credentialDialog.getByRole('button', { name: '新增账号' }).click()
+      await expect(credentialDialog.locator('#credential-id')).toHaveAttribute('aria-invalid', 'true')
+      await expect(credentialDialog.locator('#credential-id')).toBeFocused()
       await credentialDialog.getByPlaceholder('例如: account-a').fill(credentialId)
       await credentialDialog.getByPlaceholder('例如: Mimo 主账号').fill('Pool Account A')
       await credentialDialog.getByPlaceholder('例如: MIMO_OPENAI_API_KEY_ALT').fill(`E2E_POOL_KEY_${suffix.toUpperCase()}`)
@@ -83,6 +86,20 @@ test.describe('provider management', () => {
       await card.getByRole('combobox').first().click()
       await page.getByRole('option', { name: '轮询' }).click()
       await expect(card).toContainText('轮询')
+
+      await card.getByRole('button', { name: '编辑上游账号 Pool Account A' }).click()
+      const editDialog = page.getByRole('dialog')
+      await expect(editDialog.locator('#credential-id')).toHaveCount(0)
+      await editDialog.locator('#credential-name').fill('Pool Account Updated')
+      await editDialog.getByRole('button', { name: '保存账号' }).click()
+      await expect(editDialog).not.toBeVisible()
+      await expect(card).toContainText('Pool Account Updated')
+
+      await card.getByRole('button', { name: '删除上游账号 Pool Account Updated' }).click()
+      await page.getByRole('dialog').getByRole('button', { name: '删除账号' }).click()
+      await expect(page.getByRole('dialog')).not.toBeVisible()
+      await expect(card).not.toContainText('Pool Account Updated')
+      await expect(card).toContainText('默认凭证')
     } finally {
       await page.request.delete(
         `/admin/providers/${providerId}/credentials/${encodeURIComponent(credentialId)}`,
diff --git a/dashboard/src/features/models/ModelFormField.tsx b/dashboard/src/features/models/ModelFormField.tsx
index c6ab215..6cb0b58 100644
--- a/dashboard/src/features/models/ModelFormField.tsx
+++ b/dashboard/src/features/models/ModelFormField.tsx
@@ -1,3 +1,4 @@
+import { Switch } from '@/components/ui/switch'
 import type { ReactNode } from 'react'
 import { CircleAlert } from 'lucide-react'
 import { Label } from '@/components/ui/label'
@@ -39,3 +40,21 @@ export function Field({
   )
 }
 
+export function SwitchRow({
+  label,
+  checked,
+  disabled,
+  onCheckedChange,
+}: {
+  label: string
+  checked: boolean
+  disabled?: boolean
+  onCheckedChange: (checked: boolean) => void
+}) {
+  return (
+    <div className="flex items-center justify-between gap-3">
+      <Label className={cn('text-sm font-normal', disabled && 'text-muted-foreground')}>{label}</Label>
+      <Switch checked={checked} disabled={disabled} onCheckedChange={onCheckedChange} aria-label={label} />
+    </div>
+  )
+}
diff --git a/dashboard/src/features/models/ProviderCredentials.tsx b/dashboard/src/features/models/ProviderCredentials.tsx
new file mode 100644
index 0000000..e0aee4b
--- /dev/null
+++ b/dashboard/src/features/models/ProviderCredentials.tsx
@@ -0,0 +1,426 @@
+import { Badge } from '@/components/ui/badge'
+import { Button } from '@/components/ui/button'
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog'
+import { Input } from '@/components/ui/input'
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
+import {
+  useCreateProviderCredential,
+  useDeleteProviderCredential,
+  useSelectProviderCredential,
+  useUpdateProviderCredential,
+  useUpdateProviderCredentialPoolMode,
+} from '@/hooks'
+import { focusFirstInvalidDialogField, formatNumber, formatRelativeTime } from '@/lib/utils'
+import type { Provider, ProviderCredential, ProviderCredentialPoolMode, ProviderOnlineBalance } from '@/types'
+import { AlertTriangle, Loader2, Pencil, Plus, Trash2, WalletCards } from 'lucide-react'
+import { useMemo, useState } from 'react'
+import { toast } from 'sonner'
+import {
+  CREDENTIAL_POOL_MODE_LABELS,
+  DEFAULT_CREDENTIAL_FORM,
+  credentialPayloadFromForm,
+  credentialToForm,
+  providerCredentialState,
+  providerDisplayTitle,
+  type ProviderCredentialFormState,
+} from './model-data'
+import { Field, SwitchRow } from './ModelFormField'
+import { validateCredentialForm } from './operator-state'
+
+export function ProviderCredentials({ provider, canManage, onlineBalance, checkingBalance, onCheckBalance }: {
+  provider: Provider
+  canManage: boolean
+  onlineBalance?: ProviderOnlineBalance
+  checkingBalance: boolean
+  onCheckBalance: () => void
+}) {
+  const createProviderCredential = useCreateProviderCredential()
+  const updateProviderCredential = useUpdateProviderCredential()
+  const selectProviderCredential = useSelectProviderCredential()
+  const updateProviderCredentialPoolMode = useUpdateProviderCredentialPoolMode()
+  const deleteProviderCredential = useDeleteProviderCredential()
+  const [credentialSubmitAttempted, setCredentialSubmitAttempted] = useState(false)
+  const [credentialDialogOpen, setCredentialDialogOpen] = useState(false)
+  const [editingCredential, setEditingCredential] = useState<ProviderCredential | null>(null)
+  const [credentialForm, setCredentialForm] = useState<ProviderCredentialFormState>(DEFAULT_CREDENTIAL_FORM)
+  const [credentialDeleteTarget, setCredentialDeleteTarget] = useState<ProviderCredential | null>(null)
+
+  const { credentials, activeCredential, credentialReady, credentialPoolMode } = providerCredentialState(provider)
+  const displayTitle = providerDisplayTitle(provider)
+  const credentialBusy = selectProviderCredential.isPending || updateProviderCredentialPoolMode.isPending || deleteProviderCredential.isPending
+  const credentialValidation = useMemo(
+    () => validateCredentialForm(credentialForm, !editingCredential),
+    [credentialForm, editingCredential],
+  )
+  const openCredentialDialog = (credential?: ProviderCredential) => {
+    setCredentialDialogOpen(true)
+    setEditingCredential(credential ?? null)
+    setCredentialForm(credentialToForm(provider, credential))
+    setCredentialSubmitAttempted(false)
+  }
+
+  const closeCredentialDialog = () => {
+    setCredentialDialogOpen(false)
+    setEditingCredential(null)
+    setCredentialForm(DEFAULT_CREDENTIAL_FORM)
+    setCredentialSubmitAttempted(false)
+  }
+
+  const handleSubmitCredential = () => {
+    if (!credentialDialogOpen) return
+    setCredentialSubmitAttempted(true)
+    if (!credentialValidation.valid) {
+      toast.error('请先修正账号表单中的错误')
+      focusFirstInvalidDialogField()
+      return
+    }
+    const data = credentialPayloadFromForm(credentialForm, !editingCredential)
+    const options = {
+      onSuccess: () => {
+        toast.success(editingCredential
+          ? '账号引用已更新；如环境变量值有变化，请重启进程并重新测试'
+          : '账号引用已新增；注入环境变量、重启进程并重新测试后才会生效')
+        closeCredentialDialog()
+      },
+      onError: (error: unknown) => toast.error(error instanceof Error ? error.message : '保存账号失败'),
+    }
+
+    if (editingCredential) {
+      updateProviderCredential.mutate({
+        providerId: provider.id,
+        credentialId: editingCredential.id,
+        data,
+      }, options)
+    } else {
+      createProviderCredential.mutate({
+        providerId: provider.id,
+        data,
+      }, options)
+    }
+  }
+
+  const handleSelectProviderCredential = (credentialId: string) => {
+    selectProviderCredential.mutate({ providerId: provider.id, credentialId }, {
+      onSuccess: () => toast.success(`已切换 ${provider.displayName} 账号`),
+      onError: (error) => toast.error(error instanceof Error ? error.message : '切换账号失败'),
+    })
+  }
+
+  const handleUpdateProviderCredentialPoolMode = (mode: ProviderCredentialPoolMode) => {
+    updateProviderCredentialPoolMode.mutate({ providerId: provider.id, mode }, {
+      onSuccess: () => toast.success(`已更新 ${provider.displayName} 号池策略`),
+      onError: (error) => toast.error(error instanceof Error ? error.message : '更新号池策略失败'),
+    })
+  }
+
+  const handleDeleteProviderCredential = () => {
+    if (!credentialDeleteTarget) return
+    const credential = credentialDeleteTarget
+    deleteProviderCredential.mutate({ providerId: provider.id, credentialId: credential.id }, {
+      onSuccess: () => {
+        toast.success(`已删除账号 ${credential.name}`)
+        setCredentialDeleteTarget(null)
+      },
+      onError: (error) => toast.error(error instanceof Error ? error.message : '删除账号失败'),
+    })
+  }
+
+  return (
+    <>
+      <div className="rounded-md border bg-muted/20 p-3">
+        <div className="mb-3 grid gap-3 md:grid-cols-[minmax(0,1fr)_220px]">
+          <div>
+            <p className="text-sm font-medium">上游账号</p>
+            <p className="text-xs text-muted-foreground">
+              {credentials.length > 0 ? `${credentials.length} 个账号 · ${CREDENTIAL_POOL_MODE_LABELS[credentialPoolMode]}` : '默认凭证'}
+            </p>
+          </div>
+          <div className="flex min-w-0 items-center gap-2">
+            <Select
+              value={credentialPoolMode}
+              onValueChange={(value) => handleUpdateProviderCredentialPoolMode(value as ProviderCredentialPoolMode)}
+              disabled={!canManage || credentialBusy || credentials.length === 0}
+            >
+              <SelectTrigger className="h-9 min-w-0" aria-label={`${displayTitle} 账号池策略`}>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="manual">手动</SelectItem>
+                <SelectItem value="failover">故障切换</SelectItem>
+                <SelectItem value="round_robin">轮询</SelectItem>
+              </SelectContent>
+            </Select>
+            {canManage && <Button variant="outline" size="sm" onClick={() => openCredentialDialog()}>
+              <Plus className="h-3.5 w-3.5" />
+              新增
+            </Button>}
+          </div>
+        </div>
+        {provider.id === 'deepseek' && canManage && (
+          <div className="mb-3 rounded-md border bg-background/70 p-3">
+            <div className="flex flex-wrap items-center justify-between gap-3">
+              <div className="min-w-0">
+                <div className="flex flex-wrap items-center gap-2">
+                  <p className="text-sm font-medium">DeepSeek 线上余额</p>
+                  {onlineBalance && (
+                    <Badge variant={onlineBalance.isAvailable ? 'success' : 'destructive'}>
+                      {onlineBalance.isAvailable ? '可调用' : '余额不足'}
+                    </Badge>
+                  )}
+                </div>
+                <p className="mt-1 text-xs text-muted-foreground">
+                  实时只读查询；充值、退款与账单以 DeepSeek 控制台为准。
+                </p>
+              </div>
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={onCheckBalance}
+                disabled={checkingBalance || !credentialReady}
+              >
+                {checkingBalance
+                  ? <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  : <WalletCards className="mr-2 h-4 w-4" />}
+                {checkingBalance ? '查询中' : '查询余额'}
+              </Button>
+            </div>
+            {onlineBalance && (
+              <div className="mt-3 grid gap-2 sm:grid-cols-2">
+                {onlineBalance.balanceInfos.map((balance) => (
+                  <div key={balance.currency} className="rounded-md bg-muted/40 px-3 py-2 text-xs">
+                    <p className="text-muted-foreground">{balance.currency} 可用总额</p>
+                    <p className="mt-1 font-mono text-base font-semibold text-foreground">
+                      {balance.totalBalance} {balance.currency}
+                    </p>
+                    <p className="mt-1 text-muted-foreground">
+                      赠金 {balance.grantedBalance} · 充值 {balance.toppedUpBalance}
+                    </p>
+                  </div>
+                ))}
+                <p className="self-end text-xs text-muted-foreground">
+                  最近查询：{formatRelativeTime(onlineBalance.checkedAt)}
+                </p>
+              </div>
+            )}
+          </div>
+        )}
+        {credentials.length === 0 ? (
+          <div className="flex flex-wrap items-center gap-2 text-sm">
+            <Badge variant={credentialReady ? 'success' : 'destructive'}>
+              {credentialReady ? '默认环境变量可用' : '缺少默认密钥'}
+            </Badge>
+            <code className="rounded bg-background px-2 py-1 text-xs">{provider.apiKeyEnv || '无需 API Key'}</code>
+          </div>
+        ) : (
+          <div className="grid gap-3 lg:grid-cols-[minmax(0,1fr)_auto]">
+            <Select
+              value={activeCredential?.id || provider.activeCredentialId || credentials[0]?.id}
+              onValueChange={(id) => handleSelectProviderCredential(id)}
+              disabled={!canManage || credentialBusy}
+            >
+              <SelectTrigger aria-label={`${displayTitle} 当前账号`}>
+                <SelectValue placeholder="选择账号" />
+              </SelectTrigger>
+              <SelectContent>
+                {credentials.map((credential) => (
+                  <SelectItem key={credential.id} value={credential.id} disabled={credential.status === 'disabled'}>
+                    {credential.name} · {credential.apiKeyEnv}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <div className="flex flex-wrap items-center gap-2">
+              {activeCredential && (
+                <>
+                  <Badge variant={activeCredential.hasApiKey ? 'success' : 'destructive'}>
+                    {activeCredential.hasApiKey ? 'Key 可用' : 'Key 缺失'}
+                  </Badge>
+                  {canManage && <Button variant="outline" size="sm" onClick={() => openCredentialDialog(activeCredential)} aria-label={`编辑上游账号 ${activeCredential.name}`} disabled={credentialBusy}>
+                    <Pencil className="h-3.5 w-3.5" />
+                    编辑
+                  </Button>}
+                  {canManage && <Button
+                    variant="outline"
+                    size="sm"
+                    className="text-destructive hover:text-destructive"
+                    onClick={() => setCredentialDeleteTarget(activeCredential)}
+                    aria-label={`删除上游账号 ${activeCredential.name}`}
+                    disabled={credentialBusy}
+                  >
+                    <Trash2 className="h-3.5 w-3.5" />
+                    删除
+                  </Button>}
+                </>
+              )}
+            </div>
+            {activeCredential && (
+              <div className="min-w-0 space-y-1 text-xs text-muted-foreground lg:col-span-2">
+                <p className="truncate">
+                  环境变量：<code className="text-foreground">{activeCredential.apiKeyEnv}</code>
+                </p>
+                {activeCredential.baseUrl && (
+                  <p className="truncate">
+                    Base URL：<code className="text-foreground">{activeCredential.baseUrl}</code>
+                  </p>
+                )}
+              </div>
+            )}
+            <div className="space-y-2 lg:col-span-2">
+              {credentials.map((credential) => {
+                const health = credential.health
+                const healthStatus = health?.status ?? (credential.hasApiKey ? 'healthy' : 'degraded')
+                const credentialRechargeBadge = health?.rechargeRequired ? '等待充值' : null
+                return (
+                  <div key={credential.id} className="grid gap-2 rounded-md border bg-background/70 px-3 py-2 md:grid-cols-[minmax(0,1fr)_auto]">
+                    <div className="min-w-0">
+                      <div className="flex min-w-0 flex-wrap items-center gap-2">
+                        <span className="truncate text-sm font-medium">{credential.name}</span>
+                        {credential.active && <Badge variant="outline">当前</Badge>}
+                        {credential.status === 'disabled' && <Badge variant="secondary">禁用</Badge>}
+                      </div>
+                      <div className="mt-1 flex min-w-0 flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
+                        <code className="max-w-full truncate text-foreground">{credential.apiKeyEnv}</code>
+                        {health?.lastUsedAt && <span>最近 {formatRelativeTime(health.lastUsedAt)}</span>}
+                      </div>
+                    </div>
+                    <div className="flex flex-wrap items-center gap-1.5 md:justify-end">
+                      <Badge variant={credential.hasApiKey ? 'success' : 'destructive'}>
+                        {credential.hasApiKey ? 'Key 可用' : 'Key 缺失'}
+                      </Badge>
+                      <Badge variant={credentialHealthVariant(healthStatus)}>
+                        {credentialHealthLabel(healthStatus)}
+                      </Badge>
+                      {credentialRechargeBadge && <Badge variant="warning">{credentialRechargeBadge}</Badge>}
+                      <span className="rounded bg-muted px-2 py-1 text-xs text-muted-foreground">
+                        {health?.requestsTotal ? `${formatNumber(health.requestsTotal)} 次 · ${Math.round(health.successRate)}%` : '暂无请求'}
+                      </span>
+                    </div>
+                    {health?.lastError && (
+                      <p className="line-clamp-2 text-xs text-muted-foreground md:col-span-2">{health.lastError}</p>
+                    )}
+                  </div>
+                )
+              })}
+            </div>
+          </div>
+        )}
+      </div>
+
+      <Dialog open={credentialDialogOpen} onOpenChange={(open) => { if (!open) closeCredentialDialog() }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>{editingCredential ? '编辑上游账号' : '新增上游账号'}</DialogTitle>
+            <DialogDescription>
+              账号只保存环境变量名；真实 API Key 仍放在 .env、容器 Secret 或系统环境变量中。保存后需重启并重新运行 Provider 连接测试。
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-4">
+            {!editingCredential && (
+              <Field label="账号 ID" htmlFor="credential-id" error={credentialSubmitAttempted ? credentialValidation.errors.id : undefined} description="用于账号池选择，创建后不可修改。" required>
+                <Input
+                  id="credential-id"
+                  value={credentialForm.id}
+                  onChange={(event) => setCredentialForm({ ...credentialForm, id: event.target.value.toLowerCase() })}
+                  placeholder="例如: account-a"
+                  aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.id)}
+                  aria-required="true"
+                />
+              </Field>
+            )}
+            <Field label="显示名称" htmlFor="credential-name" error={credentialSubmitAttempted ? credentialValidation.errors.name : undefined} required>
+              <Input
+                id="credential-name"
+                value={credentialForm.name}
+                onChange={(event) => setCredentialForm({ ...credentialForm, name: event.target.value })}
+                placeholder="例如: Mimo 主账号"
+                aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.name)}
+                aria-required="true"
+              />
+            </Field>
+            <Field label="API Key 环境变量" htmlFor="credential-api-key-env" error={credentialSubmitAttempted ? credentialValidation.errors.apiKeyEnv : undefined} description="只保存变量名；新增变量后必须重启进程才能读取。" required>
+              <Input
+                id="credential-api-key-env"
+                value={credentialForm.apiKeyEnv}
+                onChange={(event) => setCredentialForm({ ...credentialForm, apiKeyEnv: event.target.value })}
+                placeholder="例如: MIMO_OPENAI_API_KEY_ALT"
+                aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.apiKeyEnv)}
+                aria-required="true"
+              />
+            </Field>
+            <Field label="账号专用 Base URL" htmlFor="credential-base-url" error={credentialSubmitAttempted ? credentialValidation.errors.baseUrl : undefined} description="可选；用于同一 Provider 下的不同上游入口，留空沿用 Provider。">
+              <Input
+                id="credential-base-url"
+                value={credentialForm.baseUrl}
+                onChange={(event) => setCredentialForm({ ...credentialForm, baseUrl: event.target.value })}
+                placeholder="可选，不填则沿用供应商 Base URL"
+                aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.baseUrl)}
+              />
+            </Field>
+            <div className="rounded-md border bg-muted/20 p-3">
+              <SwitchRow
+                label="启用账号"
+                checked={credentialForm.status === 'active'}
+                onCheckedChange={(checked) => setCredentialForm({ ...credentialForm, status: checked ? 'active' : 'disabled' })}
+              />
+            </div>
+            {credentialValidation.warnings.length > 0 && (
+              <div className="flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 p-3 text-xs text-amber-900 dark:border-amber-900 dark:bg-amber-950 dark:text-amber-100" role="status">
+                <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" />
+                <span>{credentialValidation.warnings.join(' ')}</span>
+              </div>
+            )}
+          </div>
+          <DialogFooter>
+            <Button variant="outline" onClick={closeCredentialDialog}>取消</Button>
+            <Button
+              onClick={handleSubmitCredential}
+              disabled={
+                createProviderCredential.isPending
+                || updateProviderCredential.isPending
+              }
+            >
+              {createProviderCredential.isPending || updateProviderCredential.isPending
+                ? <><Loader2 className="mr-2 h-4 w-4 animate-spin" />保存中</>
+                : editingCredential ? '保存账号' : '新增账号'}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+
+      <Dialog open={!!credentialDeleteTarget} onOpenChange={(open) => { if (!open) setCredentialDeleteTarget(null) }}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>删除上游账号</DialogTitle>
+            <DialogDescription>账号配置和健康记录会删除；真实环境变量不会被修改。</DialogDescription>
+          </DialogHeader>
+          <div className="rounded-md border bg-muted/30 p-3 text-sm">
+            <p className="font-medium">{credentialDeleteTarget?.name}</p>
+            <p className="mt-1 font-mono text-xs text-muted-foreground">{credentialDeleteTarget?.apiKeyEnv}</p>
+            {credentialDeleteTarget?.active && (
+              <p className="mt-3 text-xs text-amber-700 dark:text-amber-300">这是当前账号；删除后系统会选择其他可用账号，若没有候选则 Provider 可能不可路由。</p>
+            )}
+          </div>
+          <DialogFooter>
+            <Button variant="outline" onClick={() => setCredentialDeleteTarget(null)}>取消</Button>
+            <Button variant="destructive" onClick={handleDeleteProviderCredential} disabled={deleteProviderCredential.isPending}>
+              {deleteProviderCredential.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
+              删除账号
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  )
+}
+
+function credentialHealthLabel(status: string) {
+  if (status === 'cooldown') return '冷却'
+  if (status === 'degraded') return '降级'
+  return '健康'
+}
+
+function credentialHealthVariant(status: string): 'success' | 'warning' {
+  if (status === 'cooldown' || status === 'degraded') return 'warning'
+  return 'success'
+}
+
diff --git a/dashboard/src/features/models/model-data.test.ts b/dashboard/src/features/models/model-data.test.ts
index 3dcffd7..e581c82 100644
--- a/dashboard/src/features/models/model-data.test.ts
+++ b/dashboard/src/features/models/model-data.test.ts
@@ -5,6 +5,7 @@ import {
   defaultToolStreamingArguments,
   parseList,
   providerInventoryItems,
+  providerCredentialState,
   providerOrigin,
   providerPayloadFromForm,
   providerToForm,
@@ -128,3 +129,25 @@ describe('model feature data', () => {
     expect(dependencyLabel('apiKey')).toBe('API 密钥')
   })
 })
+
+describe('provider credential availability', () => {
+  const credential = { id: 'pool-a', providerId: 'openai', name: 'Account A', apiKeyEnv: 'POOL_A_KEY', status: 'active' as const, active: false, hasApiKey: true }
+
+  it('recognizes a resolved pool credential when the default environment key is missing', () => {
+    const source = provider({ hasApiKey: false, credentials: [credential], activeCredentialId: credential.id })
+    expect(providerCredentialState(source).credentialReady).toBe(true)
+    expect(providerCredentialState(source).activeCredential?.id).toBe(credential.id)
+  })
+
+  it('ignores disabled or unresolved pool credentials for readiness', () => {
+    expect(providerCredentialState(provider({ hasApiKey: false, credentials: [{ ...credential, status: 'disabled' }] })).credentialReady).toBe(false)
+    expect(providerCredentialState(provider({ hasApiKey: false, credentials: [{ ...credential, hasApiKey: false }] })).credentialReady).toBe(false)
+    expect(providerCredentialState(provider({ hasApiKey: false, apiKeyRequired: false })).credentialReady).toBe(true)
+  })
+
+  it('keeps the runtime active credential ahead of the configured fallback', () => {
+    const active = { ...credential, id: 'pool-b', active: true }
+    const source = provider({ credentials: [credential, active], activeCredentialId: credential.id })
+    expect(providerCredentialState(source).activeCredential?.id).toBe(active.id)
+  })
+})
diff --git a/dashboard/src/features/models/model-data.ts b/dashboard/src/features/models/model-data.ts
index 3d1348e..e4d4d82 100644
--- a/dashboard/src/features/models/model-data.ts
+++ b/dashboard/src/features/models/model-data.ts
@@ -506,3 +506,16 @@ export function dependencyLabel(type: string): string {
   if (type === 'route') return '路由配置'
   return type
 }
+
+export function providerCredentialState(provider: Provider) {
+  const credentials = provider.credentials ?? []
+  return {
+    credentials,
+    credentialReady: provider.hasApiKey || !provider.apiKeyRequired
+      || credentials.some((credential) => credential.status === 'active' && credential.hasApiKey),
+    activeCredential: credentials.find((credential) => credential.active)
+      ?? credentials.find((credential) => credential.id === provider.activeCredentialId)
+      ?? null,
+    credentialPoolMode: provider.credentialPoolMode ?? 'failover',
+  }
+}
diff --git a/dashboard/src/features/models/operator-state.ts b/dashboard/src/features/models/operator-state.ts
index bbdd157..1f39963 100644
--- a/dashboard/src/features/models/operator-state.ts
+++ b/dashboard/src/features/models/operator-state.ts
@@ -1,5 +1,5 @@
 import type { Provider } from '@/types'
-import { parseList, type ProviderCredentialFormState, type ProviderFormState } from './model-data'
+import { parseList, providerCredentialState, type ProviderCredentialFormState, type ProviderFormState } from './model-data'
 
 export type ProviderReadinessLevel = 'ready' | 'attention' | 'blocked' | 'disabled'
 
@@ -32,9 +32,7 @@ export function providerReadiness(provider: Provider, isDefault = false): Provid
     }
   }
 
-  const credentialReady = provider.hasApiKey
-    || !provider.apiKeyRequired
-    || Boolean(provider.credentials?.some((credential) => credential.status === 'active' && credential.hasApiKey))
+  const { credentialReady } = providerCredentialState(provider)
   if (!credentialReady) {
     return {
       level: 'blocked',
diff --git a/dashboard/src/lib/utils.ts b/dashboard/src/lib/utils.ts
index 29788a7..e0f0f6c 100644
--- a/dashboard/src/lib/utils.ts
+++ b/dashboard/src/lib/utils.ts
@@ -106,3 +106,9 @@ export function debounce<T extends (...args: unknown[]) => unknown>(
     timer = setTimeout(() => fn(...args), ms)
   }
 }
+
+export function focusFirstInvalidDialogField() {
+  window.requestAnimationFrame(() => {
+    document.querySelector<HTMLElement>('[role="dialog"] [aria-invalid="true"]')?.focus()
+  })
+}
diff --git a/dashboard/src/pages/ModelsPage.tsx b/dashboard/src/pages/ModelsPage.tsx
index 58e969d..8b95485 100644
--- a/dashboard/src/pages/ModelsPage.tsx
+++ b/dashboard/src/pages/ModelsPage.tsx
@@ -18,18 +18,15 @@ import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '@
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
 import { apiKeyExpiryState } from '@/features/api-keys/api-key-view'
 import {
-  CREDENTIAL_POOL_MODE_LABELS,
-  DEFAULT_CREDENTIAL_FORM,
   DEFAULT_PROVIDER_FORM,
   PROVIDER_OPERATIONAL_FILTERS,
-  credentialPayloadFromForm,
-  credentialToForm,
   defaultToolStreamingArguments,
   defaultToolUseForProviderForm,
   dependencyLabel,
   modelRouteTitle,
   providerDeleteBlockedFromError,
   providerDisplayTitle,
+  providerCredentialState,
   providerFilterCount,
   providerIdentity,
   providerInventoryGroups,
@@ -41,17 +38,16 @@ import {
   providerPayloadFromForm,
   providerRuntimeState,
   providerToForm,
-  type ProviderCredentialFormState,
   type ProviderFormState,
   type ProviderInventoryGroup,
   type ProviderOperationalFilter,
 } from '@/features/models/model-data'
 import { ModelAdaptationDialog } from '@/features/models/ModelAdaptationDialog'
-import { Field } from '@/features/models/ModelFormField'
+import { Field, SwitchRow } from '@/features/models/ModelFormField'
+import { ProviderCredentials } from '@/features/models/ProviderCredentials'
 import {
   providerReadiness,
   validateAliasForm,
-  validateCredentialForm,
   validateProviderForm,
   type ProviderReadinessLevel,
 } from '@/features/models/operator-state'
@@ -63,22 +59,17 @@ import {
   useCheckProviderBalance,
   useCreateAlias,
   useCreateProvider,
-  useCreateProviderCredential,
   useDeleteAlias,
   useDeleteProvider,
-  useDeleteProviderCredential,
   useDiscoverProviderModels,
   useNow,
   useProviders,
-  useSelectProviderCredential,
   useSetProviderDisabled,
   useSettings,
   useToggleModel,
   useUpdateDefaultModel,
   useUpdateDefaultProvider,
   useUpdateProvider,
-  useUpdateProviderCredential,
-  useUpdateProviderCredentialPoolMode,
   useUpdateProviderOrder,
 } from '@/hooks'
 import { PROVIDER_PROTOCOL_LABELS } from '@/lib/constants'
@@ -91,14 +82,12 @@ import {
   type ProviderTemplate,
 } from '@/lib/model-catalog'
 import { paginateItems } from '@/lib/pagination'
-import { cn, copyToClipboard, formatNumber, formatRelativeTime } from '@/lib/utils'
+import { cn, copyToClipboard, focusFirstInvalidDialogField, formatNumber, formatRelativeTime } from '@/lib/utils'
 import { useAuthStore } from '@/stores'
 import type {
 FidelityMode,
 MaxTokensField,
 Provider,
-ProviderCredential,
-ProviderCredentialPoolMode,
 ProviderDeleteBlocked,
 ProviderModelInventory,
 ProviderOnlineBalance,
@@ -129,7 +118,6 @@ import {
   Search,
   Settings,
   Trash2,
-  WalletCards,
 } from 'lucide-react'
 import { Fragment, useMemo, useState } from 'react'
 import { Link } from 'react-router-dom'
@@ -199,11 +187,6 @@ export function ModelsPage() {
   const createProvider = useCreateProvider()
   const updateProvider = useUpdateProvider()
   const setProviderDisabled = useSetProviderDisabled()
-  const createProviderCredential = useCreateProviderCredential()
-  const updateProviderCredential = useUpdateProviderCredential()
-  const selectProviderCredential = useSelectProviderCredential()
-  const updateProviderCredentialPoolMode = useUpdateProviderCredentialPoolMode()
-  const deleteProviderCredential = useDeleteProviderCredential()
   const deleteProvider = useDeleteProvider()
   const toggleModel = useToggleModel()
   const bulkToggleModels = useBulkToggleModels()
@@ -220,17 +203,13 @@ export function ModelsPage() {
   const [showProviderDialog, setShowProviderDialog] = useState(false)
   const [aliasSubmitAttempted, setAliasSubmitAttempted] = useState(false)
   const [providerSubmitAttempted, setProviderSubmitAttempted] = useState(false)
-  const [credentialSubmitAttempted, setCredentialSubmitAttempted] = useState(false)
-  const [credentialDialogProvider, setCredentialDialogProvider] = useState<Provider | null>(null)
   const [selectedTemplate, setSelectedTemplate] = useState<ProviderTemplate | null>(null)
   const [editingProvider, setEditingProvider] = useState<Provider | null>(null)
-  const [editingCredential, setEditingCredential] = useState<ProviderCredential | null>(null)
   const [editingModelAdaptation, setEditingModelAdaptation] = useState<{
     provider: Provider
     item: ProviderModelInventory
   } | null>(null)
   const [providerForm, setProviderForm] = useState<ProviderFormState>(DEFAULT_PROVIDER_FORM)
-  const [credentialForm, setCredentialForm] = useState<ProviderCredentialFormState>(DEFAULT_CREDENTIAL_FORM)
   const [deleteTarget, setDeleteTarget] = useState<Provider | null>(null)
   const [deleteBlock, setDeleteBlock] = useState<ProviderDeleteBlocked | null>(null)
   const [deleteConfirmation, setDeleteConfirmation] = useState('')
@@ -244,11 +223,6 @@ export function ModelsPage() {
   const [aliasPageSize, setAliasPageSize] = useState(20)
   const [activeTab, setActiveTab] = useState('library')
   const [aliasDeleteTarget, setAliasDeleteTarget] = useState<string | null>(null)
-  const [credentialDeleteTarget, setCredentialDeleteTarget] = useState<{
-    provider: Provider
-    credential: ProviderCredential
-  } | null>(null)
-
   const configuredProviderIds = useMemo(() => new Set(providers.map((provider) => provider.id)), [providers])
   const defaultProvider = settings?.gateway.defaultProvider.trim() ?? ''
   const providerOrder = useMemo(
@@ -354,10 +328,6 @@ export function ModelsPage() {
       }
     : null
   const providerValidation = useMemo(() => validateProviderForm(providerForm), [providerForm])
-  const credentialValidation = useMemo(
-    () => validateCredentialForm(credentialForm, !editingCredential),
-    [credentialForm, editingCredential],
-  )
   const aliasValidation = useMemo(
     () => validateAliasForm(aliasForm.alias, aliasForm.target),
     [aliasForm.alias, aliasForm.target],
@@ -413,20 +383,6 @@ export function ModelsPage() {
     setProviderSubmitAttempted(false)
   }
 
-  const openCredentialDialog = (provider: Provider, credential?: ProviderCredential) => {
-    setCredentialDialogProvider(provider)
-    setEditingCredential(credential ?? null)
-    setCredentialForm(credentialToForm(provider, credential))
-    setCredentialSubmitAttempted(false)
-  }
-
-  const closeCredentialDialog = () => {
-    setCredentialDialogProvider(null)
-    setEditingCredential(null)
-    setCredentialForm(DEFAULT_CREDENTIAL_FORM)
-    setCredentialSubmitAttempted(false)
-  }
-
   const handleSubmitProvider = () => {
     setProviderSubmitAttempted(true)
     if (!providerValidation.valid) {
@@ -452,39 +408,6 @@ export function ModelsPage() {
     }
   }
 
-  const handleSubmitCredential = () => {
-    if (!credentialDialogProvider) return
-    setCredentialSubmitAttempted(true)
-    if (!credentialValidation.valid) {
-      toast.error('请先修正账号表单中的错误')
-      focusFirstInvalidDialogField()
-      return
-    }
-    const data = credentialPayloadFromForm(credentialForm, !editingCredential)
-    const options = {
-      onSuccess: () => {
-        toast.success(editingCredential
-          ? '账号引用已更新；如环境变量值有变化，请重启进程并重新测试'
-          : '账号引用已新增；注入环境变量、重启进程并重新测试后才会生效')
-        closeCredentialDialog()
-      },
-      onError: (error: unknown) => toast.error(error instanceof Error ? error.message : '保存账号失败'),
-    }
-
-    if (editingCredential) {
-      updateProviderCredential.mutate({
-        providerId: credentialDialogProvider.id,
-        credentialId: editingCredential.id,
-        data,
-      }, options)
-    } else {
-      createProviderCredential.mutate({
-        providerId: credentialDialogProvider.id,
-        data,
-      }, options)
-    }
-  }
-
   const handleSetProviderDisabled = (provider: Provider) => {
     const disabled = provider.status !== 'disabled'
     setProviderDisabled.mutate({ providerId: provider.id, disabled }, {
@@ -493,32 +416,6 @@ export function ModelsPage() {
     })
   }
 
-  const handleSelectProviderCredential = (provider: Provider, credentialId: string) => {
-    selectProviderCredential.mutate({ providerId: provider.id, credentialId }, {
-      onSuccess: () => toast.success(`已切换 ${provider.displayName} 账号`),
-      onError: (error) => toast.error(error instanceof Error ? error.message : '切换账号失败'),
-    })
-  }
-
-  const handleUpdateProviderCredentialPoolMode = (provider: Provider, mode: ProviderCredentialPoolMode) => {
-    updateProviderCredentialPoolMode.mutate({ providerId: provider.id, mode }, {
-      onSuccess: () => toast.success(`已更新 ${provider.displayName} 号池策略`),
-      onError: (error) => toast.error(error instanceof Error ? error.message : '更新号池策略失败'),
-    })
-  }
-
-  const handleDeleteProviderCredential = () => {
-    if (!credentialDeleteTarget) return
-    const { provider, credential } = credentialDeleteTarget
-    deleteProviderCredential.mutate({ providerId: provider.id, credentialId: credential.id }, {
-      onSuccess: () => {
-        toast.success(`已删除账号 ${credential.name}`)
-        setCredentialDeleteTarget(null)
-      },
-      onError: (error) => toast.error(error instanceof Error ? error.message : '删除账号失败'),
-    })
-  }
-
   const handleDeleteProvider = (force = false) => {
     if (!deleteTarget) return
     deleteProvider.mutate({ providerId: deleteTarget.id, force }, {
@@ -1081,18 +978,12 @@ export function ModelsPage() {
                 }}
                 onCopy={copyText}
                 onAlias={openAliasDialog}
-                onCreateCredential={() => openCredentialDialog(provider)}
-                onEditCredential={(credential) => openCredentialDialog(provider, credential)}
-                onSelectCredential={(credentialId) => handleSelectProviderCredential(provider, credentialId)}
-                onUpdateCredentialPoolMode={(mode) => handleUpdateProviderCredentialPoolMode(provider, mode)}
-                onDeleteCredential={(credential) => setCredentialDeleteTarget({ provider, credential })}
                 onToggleModel={(model, enabled) => handleToggleProviderModel(provider, model, enabled)}
                 onBulkToggleModels={(enabled) => handleBulkToggleProviderModels(provider, enabled)}
                 onSetDefaultModel={(model) => handleSetDefaultModel(provider, model)}
                 onEditModel={(item) => setEditingModelAdaptation({ provider, item })}
                 modelMutationKey={modelMutationKey}
                 bulkModelMutation={bulkModelMutation}
-                credentialBusy={selectProviderCredential.isPending || updateProviderCredentialPoolMode.isPending || deleteProviderCredential.isPending}
                 defaultModelMutationKey={defaultModelMutationKey}
               />
             ))}
@@ -1712,87 +1603,6 @@ export function ModelsPage() {
         onClose={() => setEditingModelAdaptation(null)}
       />}
 
-      <Dialog open={!!credentialDialogProvider} onOpenChange={(open) => { if (!open) closeCredentialDialog() }}>
-        <DialogContent>
-          <DialogHeader>
-            <DialogTitle>{editingCredential ? '编辑上游账号' : '新增上游账号'}</DialogTitle>
-            <DialogDescription>
-              账号只保存环境变量名；真实 API Key 仍放在 .env、容器 Secret 或系统环境变量中。保存后需重启并重新运行 Provider 连接测试。
-            </DialogDescription>
-          </DialogHeader>
-          <div className="space-y-4">
-            {!editingCredential && (
-              <Field label="账号 ID" htmlFor="credential-id" error={credentialSubmitAttempted ? credentialValidation.errors.id : undefined} description="用于账号池选择，创建后不可修改。" required>
-                <Input
-                  id="credential-id"
-                  value={credentialForm.id}
-                  onChange={(event) => setCredentialForm({ ...credentialForm, id: event.target.value.toLowerCase() })}
-                  placeholder="例如: account-a"
-                  aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.id)}
-                  aria-required="true"
-                />
-              </Field>
-            )}
-            <Field label="显示名称" htmlFor="credential-name" error={credentialSubmitAttempted ? credentialValidation.errors.name : undefined} required>
-              <Input
-                id="credential-name"
-                value={credentialForm.name}
-                onChange={(event) => setCredentialForm({ ...credentialForm, name: event.target.value })}
-                placeholder="例如: Mimo 主账号"
-                aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.name)}
-                aria-required="true"
-              />
-            </Field>
-            <Field label="API Key 环境变量" htmlFor="credential-api-key-env" error={credentialSubmitAttempted ? credentialValidation.errors.apiKeyEnv : undefined} description="只保存变量名；新增变量后必须重启进程才能读取。" required>
-              <Input
-                id="credential-api-key-env"
-                value={credentialForm.apiKeyEnv}
-                onChange={(event) => setCredentialForm({ ...credentialForm, apiKeyEnv: event.target.value })}
-                placeholder="例如: MIMO_OPENAI_API_KEY_ALT"
-                aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.apiKeyEnv)}
-                aria-required="true"
-              />
-            </Field>
-            <Field label="账号专用 Base URL" htmlFor="credential-base-url" error={credentialSubmitAttempted ? credentialValidation.errors.baseUrl : undefined} description="可选；用于同一 Provider 下的不同上游入口，留空沿用 Provider。">
-              <Input
-                id="credential-base-url"
-                value={credentialForm.baseUrl}
-                onChange={(event) => setCredentialForm({ ...credentialForm, baseUrl: event.target.value })}
-                placeholder="可选，不填则沿用供应商 Base URL"
-                aria-invalid={credentialSubmitAttempted && Boolean(credentialValidation.errors.baseUrl)}
-              />
-            </Field>
-            <div className="rounded-md border bg-muted/20 p-3">
-              <SwitchRow
-                label="启用账号"
-                checked={credentialForm.status === 'active'}
-                onCheckedChange={(checked) => setCredentialForm({ ...credentialForm, status: checked ? 'active' : 'disabled' })}
-              />
-            </div>
-            {credentialValidation.warnings.length > 0 && (
-              <div className="flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 p-3 text-xs text-amber-900 dark:border-amber-900 dark:bg-amber-950 dark:text-amber-100" role="status">
-                <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0" />
-                <span>{credentialValidation.warnings.join(' ')}</span>
-              </div>
-            )}
-          </div>
-          <DialogFooter>
-            <Button variant="outline" onClick={closeCredentialDialog}>取消</Button>
-            <Button
-              onClick={handleSubmitCredential}
-              disabled={
-                createProviderCredential.isPending
-                || updateProviderCredential.isPending
-              }
-            >
-              {createProviderCredential.isPending || updateProviderCredential.isPending
-                ? <><Loader2 className="mr-2 h-4 w-4 animate-spin" />保存中</>
-                : editingCredential ? '保存账号' : '新增账号'}
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
-
       <Dialog open={!!deleteTarget} onOpenChange={(open) => {
         if (!open) {
           setDeleteTarget(null)
@@ -1869,29 +1679,6 @@ export function ModelsPage() {
         </DialogContent>
       </Dialog>
 
-      <Dialog open={!!credentialDeleteTarget} onOpenChange={(open) => { if (!open) setCredentialDeleteTarget(null) }}>
-        <DialogContent>
-          <DialogHeader>
-            <DialogTitle>删除上游账号</DialogTitle>
-            <DialogDescription>账号配置和健康记录会删除；真实环境变量不会被修改。</DialogDescription>
-          </DialogHeader>
-          <div className="rounded-md border bg-muted/30 p-3 text-sm">
-            <p className="font-medium">{credentialDeleteTarget?.credential.name}</p>
-            <p className="mt-1 font-mono text-xs text-muted-foreground">{credentialDeleteTarget?.credential.apiKeyEnv}</p>
-            {credentialDeleteTarget?.credential.active && (
-              <p className="mt-3 text-xs text-amber-700 dark:text-amber-300">这是当前账号；删除后系统会选择其他可用账号，若没有候选则 Provider 可能不可路由。</p>
-            )}
-          </div>
-          <DialogFooter>
-            <Button variant="outline" onClick={() => setCredentialDeleteTarget(null)}>取消</Button>
-            <Button variant="destructive" onClick={handleDeleteProviderCredential} disabled={deleteProviderCredential.isPending}>
-              {deleteProviderCredential.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-              删除账号
-            </Button>
-          </DialogFooter>
-        </DialogContent>
-      </Dialog>
-
       <Dialog open={!!aliasDeleteTarget} onOpenChange={(open) => { if (!open) setAliasDeleteTarget(null) }}>
         <DialogContent>
           <DialogHeader>
@@ -1991,7 +1778,7 @@ function ProviderRoutingOverview({
   onOpenRouting: () => void
 }) {
   const credentialReady = defaultProvider
-    ? defaultProvider.hasApiKey || !defaultProvider.apiKeyRequired
+    ? providerCredentialState(defaultProvider).credentialReady
     : false
 
   return (
@@ -2126,18 +1913,12 @@ function ProviderCard({
   onDelete,
   onCopy,
   onAlias,
-  onCreateCredential,
-  onEditCredential,
-  onSelectCredential,
-  onUpdateCredentialPoolMode,
-  onDeleteCredential,
   onToggleModel,
   onBulkToggleModels,
   onSetDefaultModel,
   onEditModel,
   modelMutationKey,
   bulkModelMutation,
-  credentialBusy,
   defaultModelMutationKey,
 }: {
   provider: Provider
@@ -2156,24 +1937,15 @@ function ProviderCard({
   onDelete: () => void
   onCopy: (value: string) => Promise<void>
   onAlias: (alias?: string, target?: string) => void
-  onCreateCredential: () => void
-  onEditCredential: (credential: ProviderCredential) => void
-  onSelectCredential: (credentialId: string) => void
-  onUpdateCredentialPoolMode: (mode: ProviderCredentialPoolMode) => void
-  onDeleteCredential: (credential: ProviderCredential) => void
   onToggleModel: (model: string, enabled: boolean) => void
   onBulkToggleModels: (enabled: boolean) => void
   onSetDefaultModel: (model: string) => void
   onEditModel: (item: ProviderModelInventory) => void
   modelMutationKey: string | null
   bulkModelMutation: { providerId: string; enabled: boolean } | null
-  credentialBusy: boolean
   defaultModelMutationKey: string | null
 }) {
-  const credentials = provider.credentials ?? []
-  const credentialReady = provider.hasApiKey
-    || !provider.apiKeyRequired
-    || credentials.some((credential) => credential.status === 'active' && credential.hasApiKey)
+  const { credentials, credentialReady, activeCredential } = providerCredentialState(provider)
   const lastTest = provider.lastTest
   const connectionVerified = lastTest?.success === true
   const routeReady = provider.status === 'active'
@@ -2186,10 +1958,6 @@ function ProviderCard({
   const modelListId = `provider-models-${provider.id}`
   const identity = providerIdentity(provider)
   const displayTitle = providerDisplayTitle(provider)
-  const activeCredential = credentials.find((credential) => credential.active)
-    ?? credentials.find((credential) => credential.id === provider.activeCredentialId)
-    ?? null
-  const credentialPoolMode = provider.credentialPoolMode ?? 'failover'
   const modelGroups = providerModelGroups(provider)
   const inventoryGroups = providerInventoryGroups(provider)
   const inventoryItems = providerInventoryItems(provider)
@@ -2290,183 +2058,13 @@ function ProviderCard({
           </div>
         )}
 
-        <div className="rounded-md border bg-muted/20 p-3">
-          <div className="mb-3 grid gap-3 md:grid-cols-[minmax(0,1fr)_220px]">
-            <div>
-              <p className="text-sm font-medium">上游账号</p>
-              <p className="text-xs text-muted-foreground">
-                {credentials.length > 0 ? `${credentials.length} 个账号 · ${CREDENTIAL_POOL_MODE_LABELS[credentialPoolMode]}` : '默认凭证'}
-              </p>
-            </div>
-            <div className="flex min-w-0 items-center gap-2">
-              <Select
-                value={credentialPoolMode}
-                onValueChange={(value) => onUpdateCredentialPoolMode(value as ProviderCredentialPoolMode)}
-                disabled={!canManage || credentialBusy || credentials.length === 0}
-              >
-                <SelectTrigger className="h-9 min-w-0" aria-label={`${displayTitle} 账号池策略`}>
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="manual">手动</SelectItem>
-                  <SelectItem value="failover">故障切换</SelectItem>
-                  <SelectItem value="round_robin">轮询</SelectItem>
-                </SelectContent>
-              </Select>
-              {canManage && <Button variant="outline" size="sm" onClick={onCreateCredential}>
-                <Plus className="h-3.5 w-3.5" />
-                新增
-              </Button>}
-            </div>
-          </div>
-          {provider.id === 'deepseek' && canManage && (
-            <div className="mb-3 rounded-md border bg-background/70 p-3">
-              <div className="flex flex-wrap items-center justify-between gap-3">
-                <div className="min-w-0">
-                  <div className="flex flex-wrap items-center gap-2">
-                    <p className="text-sm font-medium">DeepSeek 线上余额</p>
-                    {onlineBalance && (
-                      <Badge variant={onlineBalance.isAvailable ? 'success' : 'destructive'}>
-                        {onlineBalance.isAvailable ? '可调用' : '余额不足'}
-                      </Badge>
-                    )}
-                  </div>
-                  <p className="mt-1 text-xs text-muted-foreground">
-                    实时只读查询；充值、退款与账单以 DeepSeek 控制台为准。
-                  </p>
-                </div>
-                <Button
-                  variant="outline"
-                  size="sm"
-                  onClick={onCheckBalance}
-                  disabled={checkingBalance || !credentialReady}
-                >
-                  {checkingBalance
-                    ? <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-                    : <WalletCards className="mr-2 h-4 w-4" />}
-                  {checkingBalance ? '查询中' : '查询余额'}
-                </Button>
-              </div>
-              {onlineBalance && (
-                <div className="mt-3 grid gap-2 sm:grid-cols-2">
-                  {onlineBalance.balanceInfos.map((balance) => (
-                    <div key={balance.currency} className="rounded-md bg-muted/40 px-3 py-2 text-xs">
-                      <p className="text-muted-foreground">{balance.currency} 可用总额</p>
-                      <p className="mt-1 font-mono text-base font-semibold text-foreground">
-                        {balance.totalBalance} {balance.currency}
-                      </p>
-                      <p className="mt-1 text-muted-foreground">
-                        赠金 {balance.grantedBalance} · 充值 {balance.toppedUpBalance}
-                      </p>
-                    </div>
-                  ))}
-                  <p className="self-end text-xs text-muted-foreground">
-                    最近查询：{formatRelativeTime(onlineBalance.checkedAt)}
-                  </p>
-                </div>
-              )}
-            </div>
-          )}
-          {credentials.length === 0 ? (
-            <div className="flex flex-wrap items-center gap-2 text-sm">
-              <Badge variant={credentialReady ? 'success' : 'destructive'}>
-                {credentialReady ? '默认环境变量可用' : '缺少默认密钥'}
-              </Badge>
-              <code className="rounded bg-background px-2 py-1 text-xs">{provider.apiKeyEnv || '无需 API Key'}</code>
-            </div>
-          ) : (
-            <div className="grid gap-3 lg:grid-cols-[minmax(0,1fr)_auto]">
-              <Select
-                value={activeCredential?.id || provider.activeCredentialId || credentials[0]?.id}
-                onValueChange={onSelectCredential}
-                disabled={!canManage || credentialBusy}
-              >
-                <SelectTrigger aria-label={`${displayTitle} 当前账号`}>
-                  <SelectValue placeholder="选择账号" />
-                </SelectTrigger>
-                <SelectContent>
-                  {credentials.map((credential) => (
-                    <SelectItem key={credential.id} value={credential.id} disabled={credential.status === 'disabled'}>
-                      {credential.name} · {credential.apiKeyEnv}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              <div className="flex flex-wrap items-center gap-2">
-                {activeCredential && (
-                  <>
-                    <Badge variant={activeCredential.hasApiKey ? 'success' : 'destructive'}>
-                      {activeCredential.hasApiKey ? 'Key 可用' : 'Key 缺失'}
-                    </Badge>
-                    {canManage && <Button variant="outline" size="sm" onClick={() => onEditCredential(activeCredential)} disabled={credentialBusy}>
-                      <Pencil className="h-3.5 w-3.5" />
-                      编辑
-                    </Button>}
-                    {canManage && <Button
-                      variant="outline"
-                      size="sm"
-                      className="text-destructive hover:text-destructive"
-                      onClick={() => onDeleteCredential(activeCredential)}
-                      disabled={credentialBusy}
-                    >
-                      <Trash2 className="h-3.5 w-3.5" />
-                      删除
-                    </Button>}
-                  </>
-                )}
-              </div>
-              {activeCredential && (
-                <div className="min-w-0 space-y-1 text-xs text-muted-foreground lg:col-span-2">
-                  <p className="truncate">
-                    环境变量：<code className="text-foreground">{activeCredential.apiKeyEnv}</code>
-                  </p>
-                  {activeCredential.baseUrl && (
-                    <p className="truncate">
-                      Base URL：<code className="text-foreground">{activeCredential.baseUrl}</code>
-                    </p>
-                  )}
-                </div>
-              )}
-              <div className="space-y-2 lg:col-span-2">
-                {credentials.map((credential) => {
-                  const health = credential.health
-                  const healthStatus = health?.status ?? (credential.hasApiKey ? 'healthy' : 'degraded')
-                  const credentialRechargeBadge = health?.rechargeRequired ? '等待充值' : null
-                  return (
-                    <div key={credential.id} className="grid gap-2 rounded-md border bg-background/70 px-3 py-2 md:grid-cols-[minmax(0,1fr)_auto]">
-                      <div className="min-w-0">
-                        <div className="flex min-w-0 flex-wrap items-center gap-2">
-                          <span className="truncate text-sm font-medium">{credential.name}</span>
-                          {credential.active && <Badge variant="outline">当前</Badge>}
-                          {credential.status === 'disabled' && <Badge variant="secondary">禁用</Badge>}
-                        </div>
-                        <div className="mt-1 flex min-w-0 flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
-                          <code className="max-w-full truncate text-foreground">{credential.apiKeyEnv}</code>
-                          {health?.lastUsedAt && <span>最近 {formatRelativeTime(health.lastUsedAt)}</span>}
-                        </div>
-                      </div>
-                      <div className="flex flex-wrap items-center gap-1.5 md:justify-end">
-                        <Badge variant={credential.hasApiKey ? 'success' : 'destructive'}>
-                          {credential.hasApiKey ? 'Key 可用' : 'Key 缺失'}
-                        </Badge>
-                        <Badge variant={credentialHealthVariant(healthStatus)}>
-                          {credentialHealthLabel(healthStatus)}
-                        </Badge>
-                        {credentialRechargeBadge && <Badge variant="warning">{credentialRechargeBadge}</Badge>}
-                        <span className="rounded bg-muted px-2 py-1 text-xs text-muted-foreground">
-                          {health?.requestsTotal ? `${formatNumber(health.requestsTotal)} 次 · ${Math.round(health.successRate)}%` : '暂无请求'}
-                        </span>
-                      </div>
-                      {health?.lastError && (
-                        <p className="line-clamp-2 text-xs text-muted-foreground md:col-span-2">{health.lastError}</p>
-                      )}
-                    </div>
-                  )
-                })}
-              </div>
-            </div>
-          )}
-        </div>
+        <ProviderCredentials
+          provider={provider}
+          canManage={canManage}
+          onlineBalance={onlineBalance}
+          checkingBalance={checkingBalance}
+          onCheckBalance={onCheckBalance}
+        />
 
         <div className="grid gap-2 sm:grid-cols-2">
           {canManage && <Button
@@ -2735,17 +2333,6 @@ function ProviderActivationState({
   )
 }
 
-function credentialHealthLabel(status: string) {
-  if (status === 'cooldown') return '冷却'
-  if (status === 'degraded') return '降级'
-  return '健康'
-}
-
-function credentialHealthVariant(status: string): 'success' | 'warning' {
-  if (status === 'cooldown' || status === 'degraded') return 'warning'
-  return 'success'
-}
-
 function FormSectionHeader({ title, description }: { title: string; description: string }) {
   return (
     <div className="border-b pb-2 md:col-span-2">
@@ -2755,25 +2342,6 @@ function FormSectionHeader({ title, description }: { title: string; description:
   )
 }
 
-function SwitchRow({
-  label,
-  checked,
-  disabled,
-  onCheckedChange,
-}: {
-  label: string
-  checked: boolean
-  disabled?: boolean
-  onCheckedChange: (checked: boolean) => void
-}) {
-  return (
-    <div className="flex items-center justify-between gap-3">
-      <Label className={cn('text-sm font-normal', disabled && 'text-muted-foreground')}>{label}</Label>
-      <Switch checked={checked} disabled={disabled} onCheckedChange={onCheckedChange} aria-label={label} />
-    </div>
-  )
-}
-
 function fidelityModeLabel(value: NonNullable<Provider['fidelityMode']>) {
   if (value === 'strict') return '严格无损'
   if (value === 'stability') return '稳定优先'
@@ -2790,9 +2358,3 @@ function toolStreamingArgumentsLabel(value: NonNullable<Provider['toolUse']>['st
 function errorMessage(error: unknown, fallback: string) {
   return error instanceof Error && error.message ? error.message : fallback
 }
-
-function focusFirstInvalidDialogField() {
-  window.requestAnimationFrame(() => {
-    document.querySelector<HTMLElement>('[role="dialog"] [aria-invalid="true"]')?.focus()
-  })
-}
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 751b82b..55f0fea 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -179,8 +179,11 @@ Tool Use verification evidence is maintained separately in the
 - `src/database.rs`: SQLx PostgreSQL URL/TLS policy, pool bounds, acquisition
   timeout, and credential-safe location rendering.
 - `src/enterprise_ledger.rs`: mandatory-tenant request/attempt lifecycle,
-  operational log, usage-policy aggregation, budget, and append-only audit
-  repository. PostgreSQL is required at runtime; memory is test-only.
+  usage admission, budget settlement, retention, and append-only audit writes.
+  `enterprise_ledger/reporting.rs` owns read-only request/log/dashboard/usage
+  views; `enterprise_ledger/operations.rs` owns optional incident queries,
+  observations, validation, and row mapping. PostgreSQL is required at runtime;
+  memory is test-only.
 - `src/exchange.rs`: typed client-protocol parsing, capability/fidelity checks,
   Provider rendering, and cross-protocol response mapping.
 - `src/stream_lifecycle.rs`: shared upstream terminal state and normalized
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index e8a24fb..ca4138f 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -48,7 +48,7 @@ Before installing project dependencies, verify that the current shell resolves
 only Linux tools and matches the pinned versions:
 
 ```bash
-scripts/doctor.sh --development
+scripts/dev.sh doctor --development
 ```
 
 The check rejects Node/npm or other tools resolved from Windows-mounted
@@ -75,26 +75,41 @@ disposable database with `docker stop modelport-dev-postgres`.
 
 ```bash
 cp .env.example .env
+cp config.example.toml config.toml
 # replace every required placeholder
-scripts/config-validate.sh
+scripts/dev.sh validate
 scripts/dev.sh
 ```
 
-Background lifecycle:
+For daily source development, use one entry point:
 
-```bash
-scripts/start.sh
-scripts/status.sh
-scripts/restart.sh
-scripts/stop.sh
-```
+| Task | Command |
+| --- | --- |
+| Foreground gateway | `scripts/dev.sh` |
+| Background start / restart / stop | `scripts/dev.sh start`, `restart`, or `stop` |
+| Process and health summary | `scripts/dev.sh status` |
+| Recent gateway logs | `scripts/dev.sh logs` |
+| Configuration and runtime diagnosis | `scripts/dev.sh doctor` |
+| Complete repository checks | `scripts/dev.sh check` |
+| Rust-only checks | `scripts/dev.sh check --backend` |
+
+`scripts/dev.sh help` lists these commands without requiring local configuration
+or a toolchain. Commands resolve the checkout from the script location, so they
+also work when invoked by absolute path from another directory. The original
+`start.sh`, `stop.sh`, `restart.sh`, and `status.sh` forward to the same implementation.
+
+Native start/stop only manage binaries under this checkout's `target/debug/`
+or `target/release/`. A reused PID or another program listening on the same
+port is left alone. An existing unhealthy native process must be diagnosed or
+restarted explicitly. Use Compose or systemd to manage those deployments.
 
 The scripts keep PID/log files below `.modelport/` and never require committing
-the local `.env`. Before launching a stopped service, `scripts/start.sh` reuses
+the local `.env`. Before launching a stopped service, `scripts/dev.sh start` reuses
 `target/release/model-port` only when it is newer than `src/`, `crates/`,
 `resources/`, `migrations/`, `Cargo.toml`, `Cargo.lock`, and
-`rust-toolchain.toml`; missing inputs also invalidate the cache. Otherwise it rebuilds with
-`cargo build --release --locked`. `scripts/config-validate.sh` uses the same
+`rust-toolchain.toml`; missing inputs also invalidate the cache. Otherwise it
+rebuilds with
+`cargo build --release --locked --bin model-port`. `scripts/dev.sh validate` uses the same
 freshness helper. Set `MODELPORT_FORCE_BUILD=1` to bypass the cache explicitly.
 
 `model-port config validate` and normal server startup call the same application
@@ -130,7 +145,7 @@ references.
 Fast backend checks:
 
 ```bash
-scripts/check.sh
+scripts/dev.sh check --backend
 ```
 
 This runs `cargo fmt --all -- --check`, locked tests for all targets, and locked
@@ -148,18 +163,32 @@ The aggregate repository check also validates shell syntax, configuration
 examples, dashboard type/lint/unit/build, and Rust targets:
 
 ```bash
-scripts/check-all.sh
+scripts/dev.sh check
 ```
 
+### Dependency Audits
+
 CI additionally audits both locked dependency graphs. Run the same security
 gate locally after dependency changes:
 
 ```bash
 cargo install cargo-audit --locked --version 0.22.2
 cargo audit --deny warnings --file Cargo.lock
-npm --prefix dashboard audit --audit-level=low
+cargo install cargo-deny --locked --version 0.20.2
+cargo deny check
+node scripts/audit-dashboard.mjs
 ```
 
+`cargo audit` downloads the current RustSec advisory database, so this networked
+check is kept separate from the deterministic repository check script. Project
+exceptions live in `.cargo/audit.toml` and must document the exact dependency
+path, why the affected operation is unreachable, and the condition for removing
+the exception. `RUSTSEC-2023-0071` is currently limited to the transitive
+`openidconnect -> rsa` dependency: ModelPort verifies provider-signed ID tokens
+with public JWKs and does not perform the vulnerable RSA private-key operation.
+
+### Runtime And Deployment Checks
+
 Release-oriented backend images must be built with
 `scripts/build-container.sh`. It refuses uncommitted source and records the Git
 revision in OCI labels. Clean builds use an immutable Git archive for all
@@ -170,14 +199,6 @@ The default build produces only gateway and Dashboard images. Add
 `--with-ops-agent` for the optional Agent; workspace tests and release jobs
 continue to cover all three workspace members.
 
-`cargo audit` downloads the current RustSec advisory database, so this networked
-check is kept separate from the deterministic repository check script. Project
-exceptions live in `.cargo/audit.toml` and must document the exact dependency
-path, why the affected operation is unreachable, and the condition for removing
-the exception. `RUSTSEC-2023-0071` is currently limited to the transitive
-`openidconnect -> rsa` dependency: ModelPort verifies provider-signed ID tokens
-with public JWKs and does not perform the vulnerable RSA private-key operation.
-
 Install the Playwright browser and OS dependencies using Playwright's supported
 installer for your host when needed, for example:
 
@@ -188,7 +209,7 @@ npx playwright install --with-deps chromium
 Runtime verification:
 
 ```bash
-scripts/doctor.sh
+scripts/dev.sh doctor
 scripts/smoke-test.sh
 scripts/acceptance.sh
 scripts/tool-use-acceptance.sh
@@ -212,39 +233,29 @@ and may incur cost. Use mock-backed Tool Use acceptance for routine adapter work
 
 ## Code Boundaries
 
-- HTTP route handlers should orchestrate, not absorb protocol conversion.
-- Keep provider-specific behavior behind provider configuration or adapters.
-- Do not log keys, authorization headers, prompts, raw multipart/base64 data, or
-  complete provider bodies.
-- Add regression tests for SSE splitting, Tool Use causality, errors after
-  headers, redirect policy, body limits, and secret redaction.
-- Treat API/README claims as tests: shipped, verified, and proposed must remain
-  distinct.
+Follow [Architecture](ARCHITECTURE.md#backend-boundaries) for module ownership
+and [Contributing](../.github/CONTRIBUTING.md#code-and-security-conventions)
+for code and security conventions. Keep existing protocol and persistence
+regression cases when separating a large module.
 
 ## Documentation Checks
 
-There is not yet a dedicated docs toolchain, so run these repository checks:
+Run the existing link checker after moving or editing documentation:
 
 ```bash
-# Show Markdown targets for manual/existence checking.
-rg -n '\]\([^)]+\)' -g '*.md' README*.md docs dashboard/README.md
-
-# Find stale source/config names and placeholders.
-rg -n 'src/database\.rs|gpt-4o|claude-sonnet-4-20250514|gemini-2\.5-flash' \
-  README*.md docs .env.example dashboard/README.md
-
-# Confirm documented options against scripts that provide a help mode.
-scripts/acceptance.sh --help
-scripts/bench.sh --help
-scripts/doctor.sh --help
-scripts/provider-matrix.sh --help
-scripts/tool-use-acceptance.sh --help
+node scripts/check-doc-links.mjs
 ```
 
-Also validate a minimal environment configuration and any shipped TOML example.
-Aliases in a full catalog must not be presented as a minimal copy/paste example
-when their providers are disabled.
+The complete repository check also validates configuration and Runtime Adapter
+examples. Check changed command examples against `--help` and keep the English
+and Chinese README paths aligned. Maintain one detailed procedure per topic;
+link to it from introductory and contribution pages.
+
+## Local Build Cache
 
-For English/Chinese entry pages, keep the same quick-start commands, endpoint
-names, safety warnings, and documentation links. Prefer links to one maintained
-reference over duplicating large default tables.
+`target/` is disposable build output. For disk pressure, first stop any active
+Cargo command, then remove only `target/debug/incremental/`. This preserves
+compiled dependencies and executables while reclaiming incremental compiler
+state. Subsequent source recompilation may be slower. `cargo clean` removes
+all build output and requires a full rebuild. Neither action removes `.env`,
+configuration, logs, or database volumes.
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index 09f0180..66ae304 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -6,37 +6,27 @@ network commands are in [Docker Compose](DOCKER.md); systemd is covered in
 
 ## Day-One Checks
 
-```bash
-scripts/config-validate.sh
-scripts/status.sh
-scripts/smoke-test.sh
-```
+Choose commands for the deployment you operate:
 
-When the service is not already healthy, `scripts/start.sh` reuses the release
-binary only when it is newer than the Rust sources, Cargo manifest/lockfile,
-and pinned toolchain file; otherwise it rebuilds with
-`cargo build --release --locked`. Use
-`MODELPORT_FORCE_BUILD=1 scripts/start.sh` to force a rebuild.
+| Deployment | Status | Recent gateway logs |
+| --- | --- | --- |
+| Docker Compose | `docker compose ps` | `docker compose logs --tail=80 modelport` |
+| systemd | `systemctl status modelport` | `journalctl -u modelport -n 80` |
+| Native source checkout | `scripts/dev.sh status` | `scripts/dev.sh logs` |
 
-`smoke-test.sh` checks liveness, authenticated diagnostics, and the model list.
-It does not call an upstream by default. A real call can cost money:
+For a non-default Compose manifest, add `-f "$MODELPORT_COMPOSE_FILE"` to
+Compose commands, as described in [Docker Compose](DOCKER.md). For native
+configuration and runtime diagnosis, use `scripts/dev.sh doctor`; startup,
+validation, rebuild behavior, and prerequisites live in
+[Development](DEVELOPMENT.md#backend).
 
-```bash
-scripts/smoke-test.sh --upstream
-```
+`scripts/smoke-test.sh` checks liveness, authenticated readiness, and the model
+list using the endpoint and credentials in the selected local environment.
+It makes no upstream calls by default; `--upstream` explicitly sends a real,
+potentially paid request. Health semantics are documented below.
 
 For a release or production trial, use [Production](PRODUCTION.md).
 
-`scripts/config-validate.sh` uses the same application and deployment preflight
-as server startup. Validation errors—including placeholders, broken
-provider/alias relationships, invalid or zero-valued non-zero guardrails,
-malformed PostgreSQL URLs/pool bounds, enterprise database/TLS policy, lease
-timing, trusted proxies, and allowed origins—also make the server refuse to
-start. Warnings remain visible in the service log but do not block startup.
-The command does not connect to PostgreSQL or prove that the configured root
-certificate and hostname are accepted; startup and authenticated `/readyz`
-cover reachability after the local preflight succeeds.
-
 ## Health Semantics
 
 - `/livez` proves that the HTTP process can answer. It does not inspect storage
@@ -330,7 +320,7 @@ shared or production database.
 
 Safe maintenance sequence:
 
-1. Run `scripts/status.sh` and `scripts/doctor.sh`.
+1. Check deployment status and logs using [Day-One Checks](#day-one-checks).
 2. Create, verify, and restore-drill a backup.
 3. Export the request, usage, routing, and budget evidence required by policy.
 4. Apply only the reviewed retention/archive operation.
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index 8273465..5e9a792 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -4,8 +4,9 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/lib.sh"
+cd "$ROOT_DIR"
 
 setup_cc_fallback
 log "building release binary"
-cargo build --release --locked
+cargo build --release --locked --bin model-port
 log "built $RELEASE_BIN"
diff --git a/scripts/check-all.sh b/scripts/check-all.sh
index 2fb7dfd..82c9f59 100755
--- a/scripts/check-all.sh
+++ b/scripts/check-all.sh
@@ -303,11 +303,8 @@ main() {
   check_shell_syntax
   check_shell_lint
   run_check "checking Markdown links" node "$ROOT_DIR/scripts/check-doc-links.mjs"
-  run_check "checking lifecycle build freshness" node --test "$ROOT_DIR/tests/scripts/"*.test.mjs
-  run_check "checking Rust formatting" cargo fmt --all -- --check
-  run_check "running Rust tests" cargo test --locked --all-targets
-  run_check "running Rust clippy" \
-    cargo clippy --locked --all-targets --all-features -- -D warnings
+  run_check "checking lifecycle scripts" node --test "$ROOT_DIR/tests/scripts/"*.test.mjs
+  run_rust_checks
   run_dashboard_checks
   validate_config_examples
   validate_runtime_adapter_examples
diff --git a/scripts/check.sh b/scripts/check.sh
index bc8a30f..b14229e 100755
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -5,14 +5,4 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/lib.sh"
 
-setup_cc_fallback
-log "checking rustfmt"
-cargo fmt --all -- --check
-
-log "running tests"
-cargo test --locked --all-targets
-
-log "running clippy"
-cargo clippy --locked --all-targets --all-features -- -D warnings
-
-log "all checks passed"
+run_rust_checks
diff --git a/scripts/config-validate.sh b/scripts/config-validate.sh
index 407514a..5bbc4c2 100755
--- a/scripts/config-validate.sh
+++ b/scripts/config-validate.sh
@@ -4,6 +4,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/lib.sh"
+cd "$ROOT_DIR"
 
 load_env
 
@@ -21,4 +22,4 @@ if [[ "${MODELPORT_FORCE_BUILD:-0}" != "1" ]] && release_is_fresh; then
 fi
 
 setup_cc_fallback
-cargo run -- config validate
+cargo run --locked --bin model-port -- config validate
diff --git a/scripts/dev.sh b/scripts/dev.sh
index c70e529..1c9f9e9 100755
--- a/scripts/dev.sh
+++ b/scripts/dev.sh
@@ -4,8 +4,199 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/lib.sh"
+cd "$ROOT_DIR"
 
-load_env
-setup_cc_fallback
-log "starting ModelPort in foreground at $(base_url)"
-exec cargo run
+usage() {
+  cat <<'USAGE'
+Usage: scripts/dev.sh [COMMAND]
+
+Local source development (PostgreSQL must already be available):
+  run                 Run in the foreground (default).
+  start               Build when needed, then start in the background.
+  stop                Stop only native ModelPort processes from this checkout.
+  restart             Stop, then start this checkout's native gateway.
+  status              Show owned processes, liveness and Provider account state.
+  logs                Show the last 80 lines of the native gateway log.
+  validate            Validate configuration without contacting an upstream.
+  doctor [OPTIONS]    Diagnose setup/runtime; --development checks the toolchain.
+  check [--backend]   Run repository checks, or only the Rust checks.
+  help                Show this help; no configuration or toolchain required.
+
+For Docker deployments, use scripts/compose-up.sh and docker compose commands.
+The original start/stop/restart/status scripts remain compatible entry points.
+USAGE
+}
+
+load_optional_env() {
+  if [[ -f "$ENV_FILE" ]]; then
+    load_env
+  else
+    MODELPORT_BIND="${MODELPORT_BIND:-127.0.0.1:38082}"
+  fi
+}
+
+start_gateway() {
+  load_env
+  require_runtime_dir
+  local pid
+  pid="$(pid_from_file || true)"
+  if owned_pid "$pid" || [[ -n "$(project_pids)" ]]; then
+    if health_ok; then
+      log "ModelPort is already running at $(base_url)"
+      return
+    fi
+    die "this checkout already has a running gateway that is not healthy; run scripts/dev.sh doctor or scripts/dev.sh restart"
+  fi
+  if health_ok; then
+    die "$(base_url) already answers but is not managed by this checkout; inspect that deployment before starting another gateway"
+  fi
+  rm -f "$PID_FILE"
+  if ! release_is_fresh || [[ "${MODELPORT_FORCE_BUILD:-0}" == "1" ]]; then
+    "$SCRIPT_DIR/build-release.sh"
+  fi
+  log "starting ModelPort in background at $(base_url)"
+  log "log file: $LOG_FILE"
+  if command -v setsid >/dev/null 2>&1; then
+    setsid "$RELEASE_BIN" >> "$LOG_FILE" 2>&1 < /dev/null &
+  else
+    nohup "$RELEASE_BIN" >> "$LOG_FILE" 2>&1 < /dev/null &
+  fi
+  pid="$!"
+  echo "$pid" > "$PID_FILE"
+  if wait_for_health 30 1; then
+    log "ModelPort started, pid $pid"
+    status_gateway
+  else
+    log "ModelPort failed to become healthy"
+    tail -n 80 "$LOG_FILE" >&2 || true
+    return 1
+  fi
+}
+
+stop_gateway() {
+  load_optional_env
+  local pid
+  local still_running
+  local -A seen=()
+  local pids=()
+  pid="$(pid_from_file || true)"
+  if owned_pid "$pid"; then
+    seen["$pid"]=1
+    pids+=("$pid")
+  elif pid_running "$pid"; then
+    log "ignoring PID file process $pid: it does not belong to this checkout"
+  fi
+  while read -r pid; do
+    if [[ -n "$pid" && -z "${seen[$pid]:-}" ]]; then
+      seen["$pid"]=1
+      pids+=("$pid")
+    fi
+  done < <(project_pids)
+  if [[ "${#pids[@]}" -eq 0 ]]; then
+    log "this checkout has no running native gateway"
+    rm -f "$PID_FILE"
+    return
+  fi
+  log "stopping ModelPort pids: ${pids[*]}"
+  for pid in "${pids[@]}"; do
+    if owned_pid "$pid"; then
+      kill -- "$pid" >/dev/null 2>&1 || true
+    fi
+  done
+  for _ in $(seq 1 10); do
+    still_running=0
+    for pid in "${pids[@]}"; do
+      if owned_pid "$pid"; then
+        still_running=1
+        break
+      fi
+    done
+    [[ "$still_running" -eq 0 ]] && break
+    sleep 1
+  done
+  for pid in "${pids[@]}"; do
+    if owned_pid "$pid"; then
+      log "forcing pid $pid"
+      kill -9 -- "$pid" >/dev/null 2>&1 || true
+    fi
+  done
+  rm -f "$PID_FILE"
+  log "stopped"
+}
+
+status_gateway() {
+  load_optional_env
+  local pid
+  local owned
+  log "bind: $MODELPORT_BIND"
+  log "pid file: $PID_FILE"
+  log "log file: $LOG_FILE"
+  pid="$(pid_from_file || true)"
+  if owned_pid "$pid"; then
+    log "pid file process: running ($pid)"
+  elif pid_running "$pid"; then
+    log "pid file process: belongs to another program ($pid)"
+  else
+    log "pid file process: not running"
+  fi
+  owned="$(project_pids | tr '\n' ' ' | sed 's/[[:space:]]*$//')"
+  log "project processes: ${owned:-none}"
+  if ! health_ok; then
+    log "liveness: not reachable"
+    return
+  fi
+  log "liveness: ok"
+  curl_local -fsS -m 3 "$(base_url)/livez"
+  printf '\n'
+  if [[ -n "${MODELPORT_AUTH_TOKEN:-}" ]] && command -v node >/dev/null 2>&1; then
+    # Parse through stdin so failed diagnostics need no temporary-file cleanup.
+    # shellcheck disable=SC2016
+    curl_local -fsS -m 3 -H "x-api-key: $MODELPORT_AUTH_TOKEN" "$(base_url)/readyz" 2>/dev/null |
+      node -e '
+let input = ""
+process.stdin.setEncoding("utf8").on("data", chunk => { input += chunk })
+process.stdin.on("end", () => {
+  if (!input) return
+  const providers = Object.values(JSON.parse(input).providerHealth || {})
+    .filter(provider => provider && provider.rechargeRequired)
+    .map(provider => `${provider.providerId}${provider.rechargeBadge ? `/${provider.rechargeBadge}` : ""}`)
+  console.log(`[modelport] pending recharge: ${providers.length ? providers.join(", ") : "none"}`)
+})
+      ' || true
+  fi
+}
+
+command_name="${1:-run}"
+if [[ $# -gt 0 ]]; then shift; fi
+case "$command_name" in
+  help|-h|--help) usage; exit 0 ;;
+  doctor) exec "$SCRIPT_DIR/doctor.sh" "$@" ;;
+  check)
+    case "$*" in
+      "") exec "$SCRIPT_DIR/check-all.sh" ;;
+      --backend) exec "$SCRIPT_DIR/check.sh" ;;
+      *) die "use scripts/dev.sh check [--backend]" ;;
+    esac
+    ;;
+  run|start|stop|restart|status|logs|validate)
+    [[ $# -eq 0 ]] || die "unexpected arguments; use scripts/dev.sh help"
+    ;;
+  *) die "unknown command: $command_name; use scripts/dev.sh help" ;;
+esac
+case "$command_name" in
+  run)
+    load_env
+    setup_cc_fallback
+    log "starting ModelPort in foreground at $(base_url)"
+    exec cargo run --locked --bin model-port
+    ;;
+  start) start_gateway ;;
+  stop) stop_gateway ;;
+  restart) stop_gateway; start_gateway ;;
+  status) status_gateway ;;
+  logs)
+    [[ -f "$LOG_FILE" ]] || die "no native gateway log at $LOG_FILE; use scripts/dev.sh status"
+    tail -n 80 "$LOG_FILE"
+    ;;
+  validate) exec "$SCRIPT_DIR/config-validate.sh" ;;
+esac
diff --git a/scripts/doctor.sh b/scripts/doctor.sh
index 117b091..3583b6e 100755
--- a/scripts/doctor.sh
+++ b/scripts/doctor.sh
@@ -122,11 +122,6 @@ check_linux_platform() {
   esac
 }
 
-is_placeholder_value() {
-  local value="${1:-}"
-  [[ -z "$value" || "$value" == replace-with-* || "$value" == *placeholder* ]]
-}
-
 check_required_secret() {
   local name="$1"
   local value="${!name:-}"
diff --git a/scripts/lib.sh b/scripts/lib.sh
index 746229c..28f1f7f 100755
--- a/scripts/lib.sh
+++ b/scripts/lib.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
 ENV_FILE="${MODELPORT_ENV_FILE:-$ROOT_DIR/.env}"
 RUNTIME_DIR="${MODELPORT_RUNTIME_DIR:-$ROOT_DIR/.modelport}"
 PID_FILE="${MODELPORT_PID_FILE:-$RUNTIME_DIR/model-port.pid}"
@@ -62,26 +62,29 @@ pid_from_file() {
   [[ -f "$PID_FILE" ]] && tr -d '[:space:]' < "$PID_FILE"
 }
 
-project_pids() {
-  ps -eo pid=,comm=,args= | awk -v root="$ROOT_DIR" '
-    $2 == "model-port" && (index($0, root "/target/debug/model-port") || index($0, root "/target/release/model-port") || index($0, "./target/debug/model-port") || index($0, "./target/release/model-port")) {
-      print $1
-    }
-  '
+# Only native binaries built in this checkout belong to these lifecycle scripts.
+# A listening port or a stale PID file is not proof of process ownership.
+owned_pid() {
+  local pid="${1:-}"
+  local executable
+  [[ "$pid" =~ ^[1-9][0-9]*$ ]] || return 1
+  executable="$(readlink "/proc/$pid/exe" 2>/dev/null)" || return 1
+  executable="${executable%" (deleted)"}"
+  [[ "$executable" == "$RELEASE_BIN" || "$executable" == "$DEBUG_BIN" ]]
 }
 
-listen_pids() {
-  local port="${MODELPORT_BIND##*:}"
-  ss -ltnp 2>/dev/null | awk -v port=":$port" '
-    index($4, port) && match($0, /pid=[0-9]+/) {
-      print substr($0, RSTART + 4, RLENGTH - 4)
-    }
-  '
+project_pids() {
+  local pid
+  while read -r pid; do
+    if owned_pid "$pid"; then
+      printf '%s\n' "$pid"
+    fi
+  done < <(ps -eo pid=,comm= | awk '$2 == "model-port" { print $1 }')
 }
 
 setup_cc_fallback() {
   if [[ -x /usr/bin/gcc || -x /usr/bin/clang ]]; then
-    return
+    return 0
   fi
 
   if [[ -z "${ZIG_BIN:-}" ]]; then
@@ -92,7 +95,7 @@ setup_cc_fallback() {
     else
       # Leave Cargo's compiler discovery untouched when Zig is unavailable.
       # It may still find a usable clang/cc outside the conventional paths.
-      return
+      return 0
     fi
     export ZIG_BIN
   fi
@@ -175,3 +178,14 @@ is_placeholder_key() {
   value="$(upstream_key_value)"
   is_placeholder_value "$value"
 }
+
+run_rust_checks() (
+  cd "$ROOT_DIR"
+  setup_cc_fallback
+  log "checking Rust formatting"
+  cargo fmt --all -- --check
+  log "running Rust tests"
+  cargo test --locked --all-targets
+  log "running Rust clippy"
+  cargo clippy --locked --all-targets --all-features -- -D warnings
+)
diff --git a/scripts/restart.sh b/scripts/restart.sh
index 73db0b1..0b0f832 100755
--- a/scripts/restart.sh
+++ b/scripts/restart.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Compatibility entry point; implementation lives in dev.sh.
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-"$SCRIPT_DIR/stop.sh"
-"$SCRIPT_DIR/start.sh"
+exec "$SCRIPT_DIR/dev.sh" restart "$@"
diff --git a/scripts/runtime-adapter-check.sh b/scripts/runtime-adapter-check.sh
index 1db2c09..7f0790a 100755
--- a/scripts/runtime-adapter-check.sh
+++ b/scripts/runtime-adapter-check.sh
@@ -4,6 +4,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/lib.sh"
+cd "$ROOT_DIR"
 
 DOCUMENT_PATH="$ROOT_DIR/tests/fixtures/runtime-adapters/qwen-llama-cpp-capabilities-v1alpha1.json"
 JSON=0
diff --git a/scripts/start.sh b/scripts/start.sh
index 735fbde..68c4833 100755
--- a/scripts/start.sh
+++ b/scripts/start.sh
@@ -1,44 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Compatibility entry point; implementation lives in dev.sh.
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/lib.sh"
-
-load_env
-require_runtime_dir
-
-if health_ok; then
-  log "ModelPort is already running at $(base_url)"
-  exit 0
-fi
-
-pid="$(pid_from_file || true)"
-if pid_running "$pid"; then
-  log "found existing process from $PID_FILE: $pid"
-else
-  rm -f "$PID_FILE"
-fi
-
-if ! release_is_fresh || [[ "${MODELPORT_FORCE_BUILD:-0}" == "1" ]]; then
-  "$SCRIPT_DIR/build-release.sh"
-fi
-
-log "starting ModelPort in background at $(base_url)"
-log "log file: $LOG_FILE"
-if command -v setsid >/dev/null 2>&1; then
-  setsid "$RELEASE_BIN" >> "$LOG_FILE" 2>&1 < /dev/null &
-else
-  nohup "$RELEASE_BIN" >> "$LOG_FILE" 2>&1 < /dev/null &
-fi
-pid="$!"
-echo "$pid" > "$PID_FILE"
-
-if wait_for_health 30 1; then
-  log "ModelPort started, pid $(cat "$PID_FILE")"
-  "$SCRIPT_DIR/status.sh"
-else
-  log "ModelPort failed to become healthy"
-  tail -n 80 "$LOG_FILE" >&2 || true
-  exit 1
-fi
+exec "$SCRIPT_DIR/dev.sh" start "$@"
diff --git a/scripts/status.sh b/scripts/status.sh
index a554f67..1b4c47b 100755
--- a/scripts/status.sh
+++ b/scripts/status.sh
@@ -1,69 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Compatibility entry point; implementation lives in dev.sh.
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/lib.sh"
-
-if [[ -f "$ENV_FILE" ]]; then
-  load_env
-else
-  MODELPORT_BIND="${MODELPORT_BIND:-127.0.0.1:38082}"
-fi
-
-log "bind: $MODELPORT_BIND"
-log "pid file: $PID_FILE"
-log "log file: $LOG_FILE"
-
-pid="$(pid_from_file || true)"
-if pid_running "$pid"; then
-  log "pid file process: running ($pid)"
-else
-  log "pid file process: not running"
-fi
-
-project_pids="$(project_pids | tr '\n' ' ' | sed 's/[[:space:]]*$//')"
-if [[ -n "$project_pids" ]]; then
-  log "project processes: $project_pids"
-else
-  log "project processes: none"
-fi
-
-listen_pids="$(listen_pids | tr '\n' ' ' | sed 's/[[:space:]]*$//')"
-if [[ -n "$listen_pids" ]]; then
-  log "listener pids: $listen_pids"
-else
-  log "listener pids: none"
-fi
-
-if health_ok; then
-  log "liveness: ok"
-  curl_local -fsS -m 3 "$(base_url)/livez"
-  printf '\n'
-  if [[ -n "${MODELPORT_AUTH_TOKEN:-}" ]] && command -v node >/dev/null 2>&1; then
-    readyz_file="$(mktemp)"
-    trap 'rm -f "$readyz_file"' EXIT
-    if curl_local -fsS -m 3 \
-      -H "x-api-key: $MODELPORT_AUTH_TOKEN" \
-      "$(base_url)/readyz" > "$readyz_file" 2>/dev/null; then
-      recharge_summary="$(
-        # JavaScript template literals must not be expanded by the shell.
-        # shellcheck disable=SC2016
-        node -e '
-const fs = require("node:fs")
-const body = JSON.parse(fs.readFileSync(process.argv[1], "utf8"))
-const providers = Object.values(body.providerHealth || {})
-  .filter((provider) => provider && provider.rechargeRequired)
-  .map((provider) => {
-    const badge = provider.rechargeBadge ? `/${provider.rechargeBadge}` : ""
-    return `${provider.providerId}${badge}`
-  })
-console.log(providers.length > 0 ? `pending recharge: ${providers.join(", ")}` : "pending recharge: none")
-        ' "$readyz_file"
-      )"
-      log "$recharge_summary"
-    fi
-  fi
-else
-  log "liveness: not reachable"
-fi
+exec "$SCRIPT_DIR/dev.sh" status "$@"
diff --git a/scripts/stop.sh b/scripts/stop.sh
index e7564e5..0ef643b 100755
--- a/scripts/stop.sh
+++ b/scripts/stop.sh
@@ -1,66 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Compatibility entry point; implementation lives in dev.sh.
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/lib.sh"
-
-if [[ -f "$ENV_FILE" ]]; then
-  load_env
-fi
-
-declare -A seen=()
-pids=()
-
-pid="$(pid_from_file || true)"
-if pid_running "$pid"; then
-  seen["$pid"]=1
-  pids+=("$pid")
-fi
-
-while read -r project_pid; do
-  [[ -z "$project_pid" ]] && continue
-  if [[ -z "${seen[$project_pid]:-}" ]]; then
-    seen["$project_pid"]=1
-    pids+=("$project_pid")
-  fi
-done < <(project_pids)
-
-while read -r listen_pid; do
-  [[ -z "$listen_pid" ]] && continue
-  if [[ -z "${seen[$listen_pid]:-}" ]]; then
-    seen["$listen_pid"]=1
-    pids+=("$listen_pid")
-  fi
-done < <(listen_pids)
-
-if [[ "${#pids[@]}" -eq 0 ]]; then
-  log "ModelPort is not running"
-  rm -f "$PID_FILE"
-  exit 0
-fi
-
-log "stopping ModelPort pids: ${pids[*]}"
-kill "${pids[@]}" >/dev/null 2>&1 || true
-
-for _ in $(seq 1 10); do
-  still_running=0
-  for pid in "${pids[@]}"; do
-    if pid_running "$pid"; then
-      still_running=1
-      break
-    fi
-  done
-  [[ "$still_running" -eq 0 ]] && break
-  sleep 1
-done
-
-for pid in "${pids[@]}"; do
-  if pid_running "$pid"; then
-    log "forcing pid $pid"
-    kill -9 "$pid" >/dev/null 2>&1 || true
-  fi
-done
-
-rm -f "$PID_FILE"
-log "stopped"
+exec "$SCRIPT_DIR/dev.sh" stop "$@"
diff --git a/src/enterprise_ledger.rs b/src/enterprise_ledger.rs
index f8c92a4..b085177 100644
--- a/src/enterprise_ledger.rs
+++ b/src/enterprise_ledger.rs
@@ -1,4 +1,5 @@
 mod operations;
+mod reporting;
 
 use std::{
     collections::{BTreeMap, HashMap, HashSet},
@@ -1944,904 +1945,6 @@ impl EnterpriseLedger {
         }
     }
 
-    pub(crate) async fn overview(&self) -> Result<EnterpriseLedgerOverview, AppError> {
-        let mut overview = EnterpriseLedgerOverview {
-            backend: self.backend_name(),
-            location: self.location().to_owned(),
-            lease_ttl_secs: self.lease_ttl.as_secs(),
-            reconcile_interval_secs: self.reconcile_interval.as_secs(),
-            total_requests: 0,
-            started_requests: 0,
-            completed_requests: 0,
-            failed_requests: 0,
-            cancelled_requests: 0,
-            unreconciled_requests: 0,
-            idempotent_requests: 0,
-            active_leases: 0,
-            expired_leases: 0,
-            chargeable_requests: 0,
-            estimate_only_requests: 0,
-            total_cost_microunits: 0,
-            total_billable_cost_microunits: 0,
-            organization_count: 0,
-            project_count: 0,
-            environment_count: 0,
-        };
-
-        match self.backend.as_ref() {
-            LedgerBackend::Memory(ledger) => {
-                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
-                let now = Instant::now();
-                let mut organizations = HashSet::new();
-                let mut projects = HashSet::new();
-                let mut environments = HashSet::new();
-                for request in ledger.requests.values() {
-                    overview.total_requests += 1;
-                    match request.record.state.as_str() {
-                        "started" => overview.started_requests += 1,
-                        "completed" => overview.completed_requests += 1,
-                        "failed" => overview.failed_requests += 1,
-                        "cancelled" => overview.cancelled_requests += 1,
-                        _ => {}
-                    }
-                    if request.record.terminal_reason.as_deref()
-                        == Some("lease_expired_unreconciled")
-                    {
-                        overview.unreconciled_requests += 1;
-                    }
-                    if request.idempotency_key_hash.is_some() {
-                        overview.idempotent_requests += 1;
-                    }
-                    if !request.record.terminal {
-                        if request.record.lease_expires_at > now {
-                            overview.active_leases += 1;
-                        } else {
-                            overview.expired_leases += 1;
-                        }
-                    }
-                    if request.record.chargeable {
-                        overview.chargeable_requests += 1;
-                        if request.record.terminal
-                            && request.record.billable_cost_microunits.is_none()
-                        {
-                            overview.estimate_only_requests += 1;
-                        }
-                    }
-                    overview.total_cost_microunits = overview
-                        .total_cost_microunits
-                        .saturating_add(request.record.cost_amount_microunits);
-                    overview.total_billable_cost_microunits = overview
-                        .total_billable_cost_microunits
-                        .saturating_add(request.record.billable_cost_microunits.unwrap_or(0));
-                    organizations.insert(request.record.tenant.organization_id.clone());
-                    projects.insert((
-                        request.record.tenant.organization_id.clone(),
-                        request.record.tenant.project_id.clone(),
-                    ));
-                    environments.insert((
-                        request.record.tenant.organization_id.clone(),
-                        request.record.tenant.project_id.clone(),
-                        request.record.tenant.environment_id.clone(),
-                    ));
-                }
-                overview.organization_count = usize_to_i64(organizations.len());
-                overview.project_count = usize_to_i64(projects.len());
-                overview.environment_count = usize_to_i64(environments.len());
-            }
-            LedgerBackend::Postgres(pool) => {
-                let row = sqlx::query(
-                    "SELECT
-                        count(*)::bigint AS total_requests,
-                        count(*) FILTER (WHERE state = 'started')::bigint AS started_requests,
-                        count(*) FILTER (WHERE state = 'completed')::bigint AS completed_requests,
-                        count(*) FILTER (WHERE state = 'failed')::bigint AS failed_requests,
-                        count(*) FILTER (WHERE state = 'cancelled')::bigint AS cancelled_requests,
-                        count(*) FILTER (WHERE terminal_reason = 'lease_expired_unreconciled')::bigint AS unreconciled_requests,
-                        count(*) FILTER (WHERE idempotency_key_hash IS NOT NULL)::bigint AS idempotent_requests,
-                        count(*) FILTER (WHERE state = 'started' AND lease_expires_at > now())::bigint AS active_leases,
-                        count(*) FILTER (WHERE state = 'started' AND lease_expires_at <= now())::bigint AS expired_leases,
-                        count(*) FILTER (WHERE chargeable)::bigint AS chargeable_requests,
-                        count(*) FILTER (
-                            WHERE state <> 'started' AND chargeable
-                              AND billable_cost_microunits IS NULL
-                        )::bigint AS estimate_only_requests,
-                        COALESCE(sum(cost_amount_microunits), 0)::bigint AS total_cost_microunits,
-                        COALESCE(sum(billable_cost_microunits), 0)::bigint AS total_billable_cost_microunits,
-                        count(DISTINCT organization_id)::bigint AS organization_count,
-                        count(DISTINCT (organization_id, project_id))::bigint AS project_count,
-                        count(DISTINCT (organization_id, project_id, environment_id))::bigint AS environment_count
-                     FROM modelport_gateway_requests",
-                )
-                .fetch_one(pool)
-                .await?;
-                overview.total_requests = row.try_get("total_requests")?;
-                overview.started_requests = row.try_get("started_requests")?;
-                overview.completed_requests = row.try_get("completed_requests")?;
-                overview.failed_requests = row.try_get("failed_requests")?;
-                overview.cancelled_requests = row.try_get("cancelled_requests")?;
-                overview.unreconciled_requests = row.try_get("unreconciled_requests")?;
-                overview.idempotent_requests = row.try_get("idempotent_requests")?;
-                overview.active_leases = row.try_get("active_leases")?;
-                overview.expired_leases = row.try_get("expired_leases")?;
-                overview.chargeable_requests = row.try_get("chargeable_requests")?;
-                overview.estimate_only_requests = row.try_get("estimate_only_requests")?;
-                overview.total_cost_microunits = row.try_get("total_cost_microunits")?;
-                overview.total_billable_cost_microunits =
-                    row.try_get("total_billable_cost_microunits")?;
-                overview.organization_count = row.try_get("organization_count")?;
-                overview.project_count = row.try_get("project_count")?;
-                overview.environment_count = row.try_get("environment_count")?;
-            }
-        }
-        Ok(overview)
-    }
-
-    pub(crate) async fn list_requests(
-        &self,
-        query: &EnterpriseLedgerQuery,
-    ) -> Result<EnterpriseRequestPage, AppError> {
-        let query = query.normalized()?;
-        match self.backend.as_ref() {
-            LedgerBackend::Memory(ledger) => {
-                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
-                let mut requests = ledger
-                    .requests
-                    .iter()
-                    .filter(|(_, request)| query.matches_memory(request))
-                    .map(|(ledger_id, request)| {
-                        memory_request_row(
-                            ledger_id,
-                            request,
-                            usize_to_i64(
-                                ledger
-                                    .attempts
-                                    .values()
-                                    .filter(|attempt| attempt.request_ledger_id == *ledger_id)
-                                    .count(),
-                            ),
-                        )
-                    })
-                    .collect::<Vec<_>>();
-                requests.sort_by(|left, right| {
-                    right
-                        .created_at_ms
-                        .cmp(&left.created_at_ms)
-                        .then_with(|| right.ledger_id.cmp(&left.ledger_id))
-                });
-                let total = usize_to_i64(requests.len());
-                let start = query.offset().min(requests.len());
-                let end = start.saturating_add(query.page_size).min(requests.len());
-                Ok(EnterpriseRequestPage {
-                    requests: requests[start..end].to_vec(),
-                    total,
-                    page: query.page,
-                    page_size: query.page_size,
-                })
-            }
-            LedgerBackend::Postgres(pool) => {
-                let count = sqlx::query_scalar::<_, i64>(REQUEST_COUNT_SQL)
-                    .bind(query.state.as_deref())
-                    .bind(query.protocol.as_deref())
-                    .bind(query.organization_id.as_deref())
-                    .bind(query.project_id.as_deref())
-                    .bind(query.environment_id.as_deref())
-                    .bind(query.search.as_deref())
-                    .bind(query.traffic_class.as_deref())
-                    .fetch_one(pool)
-                    .await?;
-                let rows = sqlx::query(REQUEST_LIST_SQL)
-                    .bind(query.state.as_deref())
-                    .bind(query.protocol.as_deref())
-                    .bind(query.organization_id.as_deref())
-                    .bind(query.project_id.as_deref())
-                    .bind(query.environment_id.as_deref())
-                    .bind(query.search.as_deref())
-                    .bind(query.traffic_class.as_deref())
-                    .bind(usize_to_i64(query.page_size))
-                    .bind(usize_to_i64(query.offset()))
-                    .bind(None::<i64>)
-                    .fetch_all(pool)
-                    .await?;
-                Ok(EnterpriseRequestPage {
-                    requests: rows
-                        .iter()
-                        .map(request_row_from_pg)
-                        .collect::<Result<_, _>>()?,
-                    total: count,
-                    page: query.page,
-                    page_size: query.page_size,
-                })
-            }
-        }
-    }
-
-    #[cfg(test)]
-    pub(crate) async fn usage_rows(&self) -> Result<Vec<Value>, AppError> {
-        self.usage_rows_since(None).await
-    }
-
-    pub(crate) async fn usage_rows_since(
-        &self,
-        since_ms: Option<u64>,
-    ) -> Result<Vec<Value>, AppError> {
-        let since_ms_i64 = since_ms.map(|value| i64::try_from(value).unwrap_or(i64::MAX));
-        let mut requests = match self.backend.as_ref() {
-            LedgerBackend::Memory(ledger) => {
-                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
-                ledger
-                    .requests
-                    .iter()
-                    .filter(|(_, request)| {
-                        since_ms_i64.is_none_or(|since| request.record.created_at_ms >= since)
-                    })
-                    .map(|(ledger_id, request)| {
-                        memory_request_row(
-                            ledger_id,
-                            request,
-                            usize_to_i64(
-                                ledger
-                                    .attempts
-                                    .values()
-                                    .filter(|attempt| attempt.request_ledger_id == *ledger_id)
-                                    .count(),
-                            ),
-                        )
-                    })
-                    .collect::<Vec<_>>()
-            }
-            LedgerBackend::Postgres(pool) => sqlx::query(REQUEST_LIST_SQL)
-                .bind(None::<&str>)
-                .bind(None::<&str>)
-                .bind(None::<&str>)
-                .bind(None::<&str>)
-                .bind(None::<&str>)
-                .bind(None::<&str>)
-                .bind(None::<&str>)
-                .bind(i64::MAX)
-                .bind(0_i64)
-                .bind(since_ms_i64)
-                .fetch_all(pool)
-                .await?
-                .iter()
-                .map(request_row_from_pg)
-                .collect::<Result<Vec<_>, _>>()?,
-        };
-        requests.retain(|request| request.state != "started");
-        requests.sort_by(|left, right| {
-            right
-                .created_at_ms
-                .cmp(&left.created_at_ms)
-                .then_with(|| right.ledger_id.cmp(&left.ledger_id))
-        });
-        Ok(requests.iter().map(operational_log_row).collect())
-    }
-
-    pub(crate) async fn operational_logs(
-        &self,
-        query: &OperationalLogQuery,
-    ) -> Result<Option<OperationalLogPage>, AppError> {
-        let LedgerBackend::Postgres(pool) = self.backend.as_ref() else {
-            return Ok(None);
-        };
-
-        let mut summary_query = QueryBuilder::<Postgres>::new(
-            "SELECT
-                count(*)::bigint AS total_requests,
-                count(*) FILTER (WHERE r.state = 'completed')::bigint AS success_requests,
-                count(*) FILTER (WHERE r.tool_use_requested)::bigint AS tool_use_requests,
-                count(*) FILTER (
-                    WHERE r.tool_use_requested AND r.state = 'completed'
-                )::bigint AS tool_use_success_requests,
-                COALESCE(sum(r.input_tokens), 0)::bigint AS total_input_tokens,
-                COALESCE(sum(r.output_tokens), 0)::bigint AS total_output_tokens,
-                COALESCE(sum(r.cache_write_tokens), 0)::bigint AS total_cache_write_tokens,
-                COALESCE(sum(r.cache_read_tokens), 0)::bigint AS total_cache_read_tokens,
-                COALESCE(sum(r.cost_amount_microunits), 0)::bigint AS total_cost_microunits,
-                COALESCE(sum(r.actual_cost_microunits), 0)::bigint AS total_actual_cost_microunits,
-                COALESCE(sum(r.billable_cost_microunits), 0)::bigint AS total_billable_cost_microunits,
-                count(*) FILTER (
-                    WHERE r.billable_cost_microunits IS NOT NULL
-                )::bigint AS billable_requests,
-                count(*) FILTER (
-                    WHERE r.billable_cost_microunits IS NULL
-                )::bigint AS estimate_only_requests,
-                percentile_disc(0.95) WITHIN GROUP (ORDER BY r.latency_ms)
-                    FILTER (WHERE r.latency_ms IS NOT NULL) AS latency_p95_ms,
-                count(r.latency_ms)::bigint AS latency_sample_count,
-                percentile_disc(0.95) WITHIN GROUP (ORDER BY r.first_byte_latency_ms)
-                    FILTER (WHERE r.first_byte_latency_ms IS NOT NULL)
-                    AS first_byte_latency_p95_ms,
-                count(r.first_byte_latency_ms)::bigint AS first_byte_latency_sample_count,
-                (EXTRACT(EPOCH FROM min(r.created_at)) * 1000)::bigint AS first_timestamp_ms,
-                (EXTRACT(EPOCH FROM max(r.created_at)) * 1000)::bigint AS last_timestamp_ms
-             FROM modelport_gateway_requests r",
-        );
-        push_operational_log_filters(&mut summary_query, query);
-        let summary_row = summary_query.build().fetch_one(pool).await?;
-        let total: i64 = summary_row.try_get("total_requests")?;
-        let total_input_tokens: i64 = summary_row.try_get("total_input_tokens")?;
-        let total_output_tokens: i64 = summary_row.try_get("total_output_tokens")?;
-        let total_cache_write_tokens: i64 = summary_row.try_get("total_cache_write_tokens")?;
-        let total_cache_read_tokens: i64 = summary_row.try_get("total_cache_read_tokens")?;
-        let total_tokens = total_input_tokens
-            .saturating_add(total_output_tokens)
-            .saturating_add(total_cache_write_tokens)
-            .saturating_add(total_cache_read_tokens);
-        let first_timestamp: Option<i64> = summary_row.try_get("first_timestamp_ms")?;
-        let last_timestamp: Option<i64> = summary_row.try_get("last_timestamp_ms")?;
-        let minutes = match (first_timestamp, last_timestamp) {
-            (Some(first), Some(last)) if last > first => {
-                ((last - first) as f64 / 60_000.0).max(1.0)
-            }
-            _ => 1.0,
-        };
-        let summary = json!({
-            "totalRequests": nonnegative_u64(total),
-            "successRequests": nonnegative_u64(summary_row.try_get("success_requests")?),
-            "toolUseRequests": nonnegative_u64(summary_row.try_get("tool_use_requests")?),
-            "toolUseSuccessRequests": nonnegative_u64(
-                summary_row.try_get("tool_use_success_requests")?
-            ),
-            "totalInputTokens": nonnegative_u64(total_input_tokens),
-            "totalOutputTokens": nonnegative_u64(total_output_tokens),
-            "totalCacheWriteTokens": nonnegative_u64(total_cache_write_tokens),
-            "totalCacheReadTokens": nonnegative_u64(total_cache_read_tokens),
-            "totalTokens": nonnegative_u64(total_tokens),
-            "totalCostEstimate": microunits_usd(
-                summary_row.try_get("total_cost_microunits")?
-            ),
-            "totalActualCost": microunits_usd(
-                summary_row.try_get("total_actual_cost_microunits")?
-            ),
-            "totalBillableCost": microunits_usd(
-                summary_row.try_get("total_billable_cost_microunits")?
-            ),
-            "billableRequests": nonnegative_u64(
-                summary_row.try_get("billable_requests")?
-            ),
-            "estimateOnlyRequests": nonnegative_u64(
-                summary_row.try_get("estimate_only_requests")?
-            ),
-            "latencyP95Ms": summary_row
-                .try_get::<Option<i64>, _>("latency_p95_ms")?
-                .map(nonnegative_u64)
-                .unwrap_or(0),
-            "latencySampleCount": nonnegative_u64(
-                summary_row.try_get("latency_sample_count")?
-            ),
-            "firstByteLatencyP95Ms": summary_row
-                .try_get::<Option<i64>, _>("first_byte_latency_p95_ms")?
-                .map(nonnegative_u64)
-                .unwrap_or(0),
-            "firstByteLatencySampleCount": nonnegative_u64(
-                summary_row.try_get("first_byte_latency_sample_count")?
-            ),
-            "rpm": total.max(0) as f64 / minutes,
-            "tpm": total_tokens.max(0) as f64 / minutes,
-        });
-
-        let mut rows_query = QueryBuilder::<Postgres>::new(OPERATIONAL_LOG_SELECT_SQL);
-        push_operational_log_filters(&mut rows_query, query);
-        rows_query
-            .push(" ORDER BY r.created_at DESC, r.ledger_id DESC LIMIT ")
-            .push_bind(usize_to_i64(query.page_size))
-            .push(" OFFSET ")
-            .push_bind(usize_to_i64(
-                query.page.saturating_sub(1).saturating_mul(query.page_size),
-            ));
-        let rows = rows_query.build().fetch_all(pool).await?;
-        let logs = rows
-            .iter()
-            .map(request_row_from_pg)
-            .collect::<Result<Vec<_>, _>>()?
-            .iter()
-            .map(operational_log_row)
-            .collect();
-
-        Ok(Some(OperationalLogPage {
-            logs,
-            total,
-            summary,
-        }))
-    }
-
-    pub(crate) async fn dashboard_snapshot(
-        &self,
-        start_ms: u64,
-        end_ms: u64,
-        bucket_ms: u64,
-        today_start_ms: u64,
-        api_keys: (u64, u64),
-    ) -> Result<Option<DashboardLedgerSnapshot>, AppError> {
-        let LedgerBackend::Postgres(pool) = self.backend.as_ref() else {
-            return Ok(None);
-        };
-        let start_ms = i64::try_from(start_ms).unwrap_or(i64::MAX);
-        let end_ms = i64::try_from(end_ms).unwrap_or(i64::MAX);
-        let bucket_ms = i64::try_from(bucket_ms.max(1)).unwrap_or(i64::MAX);
-        let today_start_ms = i64::try_from(today_start_ms).unwrap_or(i64::MAX);
-
-        let provider_rows = sqlx::query(
-            "SELECT
-                COALESCE(provider_id, 'unrouted') AS provider_id,
-                count(*)::bigint AS requests,
-                count(*) FILTER (WHERE state = 'completed')::bigint AS successes,
-                COALESCE(sum(latency_ms), 0)::bigint AS duration_ms,
-                COALESCE(sum(input_tokens), 0)::bigint AS input_tokens,
-                COALESCE(sum(output_tokens), 0)::bigint AS output_tokens,
-                COALESCE(sum(cache_write_tokens), 0)::bigint AS cache_write_tokens,
-                COALESCE(sum(cache_read_tokens), 0)::bigint AS cache_read_tokens,
-                COALESCE(sum(cost_amount_microunits), 0)::bigint AS cost_microunits
-             FROM modelport_gateway_requests
-             WHERE state <> 'started'
-               AND traffic_class = 'business'
-               AND created_at >= to_timestamp($1::double precision / 1000.0)
-             GROUP BY COALESCE(provider_id, 'unrouted')",
-        )
-        .bind(today_start_ms)
-        .fetch_all(pool)
-        .await?;
-        let mut usage_summary = UsageSummary {
-            api_keys_total: api_keys.0,
-            api_keys_active: api_keys.1,
-            ..UsageSummary::default()
-        };
-        let mut provider_usage = BTreeMap::new();
-        let mut total_duration_ms = 0u64;
-        for row in provider_rows {
-            let requests = nonnegative_u64(row.try_get("requests")?);
-            let successes = nonnegative_u64(row.try_get("successes")?);
-            let duration_ms = nonnegative_u64(row.try_get("duration_ms")?);
-            let input_tokens = nonnegative_u64(row.try_get("input_tokens")?);
-            let output_tokens = nonnegative_u64(row.try_get("output_tokens")?);
-            let cache_write_tokens = nonnegative_u64(row.try_get("cache_write_tokens")?);
-            let cache_read_tokens = nonnegative_u64(row.try_get("cache_read_tokens")?);
-            let cost_microunits: i64 = row.try_get("cost_microunits")?;
-            usage_summary.total_requests = usage_summary.total_requests.saturating_add(requests);
-            usage_summary.total_successes = usage_summary.total_successes.saturating_add(successes);
-            usage_summary.total_input_tokens = usage_summary
-                .total_input_tokens
-                .saturating_add(input_tokens);
-            usage_summary.total_output_tokens = usage_summary
-                .total_output_tokens
-                .saturating_add(output_tokens);
-            usage_summary.total_cache_write_tokens = usage_summary
-                .total_cache_write_tokens
-                .saturating_add(cache_write_tokens);
-            usage_summary.total_cache_read_tokens = usage_summary
-                .total_cache_read_tokens
-                .saturating_add(cache_read_tokens);
-            usage_summary.total_cost_estimate += microunits_usd(cost_microunits);
-            total_duration_ms = total_duration_ms.saturating_add(duration_ms);
-            provider_usage.insert(
-                row.try_get("provider_id")?,
-                ProviderUsageStats {
-                    requests_total: requests,
-                    successes_total: successes,
-                    duration_ms_total: duration_ms,
-                    input_tokens_total: input_tokens,
-                    output_tokens_total: output_tokens,
-                    cache_write_tokens_total: cache_write_tokens,
-                    cache_read_tokens_total: cache_read_tokens,
-                    cost_estimate_usd_total: microunits_usd(cost_microunits),
-                },
-            );
-        }
-        usage_summary.average_latency_ms = total_duration_ms
-            .checked_div(usage_summary.total_requests)
-            .unwrap_or(0);
-
-        let bucket_count =
-            usize::try_from((end_ms.saturating_sub(start_ms) / bucket_ms).saturating_add(1))
-                .unwrap_or(1)
-                .max(1);
-        let mut requests = vec![0u64; bucket_count];
-        let mut errors = vec![0u64; bucket_count];
-        let mut input_tokens = vec![0u64; bucket_count];
-        let mut output_tokens = vec![0u64; bucket_count];
-        let mut cache_write_tokens = vec![0u64; bucket_count];
-        let mut cache_read_tokens = vec![0u64; bucket_count];
-        let bucket_rows = sqlx::query(
-            "SELECT
-                floor(
-                    ((EXTRACT(EPOCH FROM created_at) * 1000) - $1::double precision)
-                    / $3::double precision
-                )::bigint AS bucket_index,
-                count(*)::bigint AS requests,
-                count(*) FILTER (WHERE state <> 'completed')::bigint AS errors,
-                COALESCE(sum(input_tokens), 0)::bigint AS input_tokens,
-                COALESCE(sum(output_tokens), 0)::bigint AS output_tokens,
-                COALESCE(sum(cache_write_tokens), 0)::bigint AS cache_write_tokens,
-                COALESCE(sum(cache_read_tokens), 0)::bigint AS cache_read_tokens,
-                COALESCE(sum(cost_amount_microunits), 0)::bigint AS cost_microunits
-             FROM modelport_gateway_requests
-             WHERE state <> 'started'
-               AND traffic_class = 'business'
-               AND created_at >= to_timestamp($1::double precision / 1000.0)
-               AND created_at <= to_timestamp($2::double precision / 1000.0)
-             GROUP BY bucket_index
-             ORDER BY bucket_index",
-        )
-        .bind(start_ms)
-        .bind(end_ms)
-        .bind(bucket_ms)
-        .fetch_all(pool)
-        .await?;
-        let mut matched_requests = 0u64;
-        let mut success_requests = 0u64;
-        let mut total_input_tokens = 0u64;
-        let mut total_output_tokens = 0u64;
-        let mut total_cache_write_tokens = 0u64;
-        let mut total_cache_read_tokens = 0u64;
-        let mut total_cost_microunits = 0i64;
-        for row in bucket_rows {
-            let index = usize::try_from(row.try_get::<i64, _>("bucket_index")?)
-                .unwrap_or(bucket_count.saturating_sub(1))
-                .min(bucket_count.saturating_sub(1));
-            let row_requests = nonnegative_u64(row.try_get("requests")?);
-            let row_errors = nonnegative_u64(row.try_get("errors")?);
-            let row_input_tokens = nonnegative_u64(row.try_get("input_tokens")?);
-            let row_output_tokens = nonnegative_u64(row.try_get("output_tokens")?);
-            let row_cache_write_tokens = nonnegative_u64(row.try_get("cache_write_tokens")?);
-            let row_cache_read_tokens = nonnegative_u64(row.try_get("cache_read_tokens")?);
-            let row_cost_microunits: i64 = row.try_get("cost_microunits")?;
-            requests[index] = row_requests;
-            errors[index] = row_errors;
-            input_tokens[index] = row_input_tokens;
-            output_tokens[index] = row_output_tokens;
-            cache_write_tokens[index] = row_cache_write_tokens;
-            cache_read_tokens[index] = row_cache_read_tokens;
-            matched_requests = matched_requests.saturating_add(row_requests);
-            success_requests =
-                success_requests.saturating_add(row_requests.saturating_sub(row_errors));
-            total_input_tokens = total_input_tokens.saturating_add(row_input_tokens);
-            total_output_tokens = total_output_tokens.saturating_add(row_output_tokens);
-            total_cache_write_tokens =
-                total_cache_write_tokens.saturating_add(row_cache_write_tokens);
-            total_cache_read_tokens = total_cache_read_tokens.saturating_add(row_cache_read_tokens);
-            total_cost_microunits = total_cost_microunits.saturating_add(row_cost_microunits);
-        }
-
-        let model_rows = sqlx::query(
-            "SELECT
-                COALESCE(resolved_model, requested_model, 'unknown') AS model,
-                COALESCE(provider_id, 'unknown') AS provider,
-                count(*)::bigint AS requests,
-                COALESCE(sum(
-                    input_tokens + output_tokens + cache_write_tokens + cache_read_tokens
-                ), 0)::bigint AS tokens,
-                COALESCE(sum(cost_amount_microunits), 0)::bigint AS cost_microunits
-             FROM modelport_gateway_requests
-             WHERE state <> 'started'
-               AND traffic_class = 'business'
-               AND created_at >= to_timestamp($1::double precision / 1000.0)
-               AND created_at <= to_timestamp($2::double precision / 1000.0)
-             GROUP BY
-                COALESCE(resolved_model, requested_model, 'unknown'),
-                COALESCE(provider_id, 'unknown')
-             ORDER BY tokens DESC, requests DESC, model ASC
-             LIMIT 200",
-        )
-        .bind(start_ms)
-        .bind(end_ms)
-        .fetch_all(pool)
-        .await?;
-        let model_usage = model_rows
-            .iter()
-            .map(|row| {
-                Ok(json!({
-                    "model": row.try_get::<String, _>("model")?,
-                    "provider": row.try_get::<String, _>("provider")?,
-                    "requests": nonnegative_u64(row.try_get("requests")?),
-                    "tokens": nonnegative_u64(row.try_get("tokens")?),
-                    "cost": microunits_usd(row.try_get("cost_microunits")?),
-                }))
-            })
-            .collect::<Result<Vec<_>, sqlx::Error>>()?;
-        let request_time_series = dashboard_value_series(&requests, start_ms, bucket_ms);
-        let error_time_series = dashboard_value_series(&errors, start_ms, bucket_ms);
-        let token_time_series = (0..bucket_count)
-            .map(|index| {
-                let billed_input = input_tokens[index]
-                    .saturating_add(cache_write_tokens[index])
-                    .saturating_add(cache_read_tokens[index]);
-                json!({
-                    "timestamp": dashboard_bucket_timestamp(start_ms, bucket_ms, index),
-                    "inputTokens": input_tokens[index],
-                    "outputTokens": output_tokens[index],
-                    "cacheWriteTokens": cache_write_tokens[index],
-                    "cacheReadTokens": cache_read_tokens[index],
-                    "cacheHitRate": if billed_input == 0 {
-                        0.0
-                    } else {
-                        cache_read_tokens[index] as f64 / billed_input as f64 * 100.0
-                    },
-                })
-            })
-            .collect();
-        let total_tokens = total_input_tokens
-            .saturating_add(total_output_tokens)
-            .saturating_add(total_cache_write_tokens)
-            .saturating_add(total_cache_read_tokens);
-        let minutes = (end_ms.saturating_sub(start_ms) as f64 / 60_000.0).max(1.0);
-
-        Ok(Some(DashboardLedgerSnapshot {
-            usage_summary,
-            provider_usage,
-            matched_requests,
-            request_time_series,
-            error_time_series,
-            token_time_series,
-            model_usage,
-            summary: json!({
-                "totalRequests": matched_requests,
-                "successRequests": success_requests,
-                "totalInputTokens": total_input_tokens,
-                "totalOutputTokens": total_output_tokens,
-                "totalCacheWriteTokens": total_cache_write_tokens,
-                "totalCacheReadTokens": total_cache_read_tokens,
-                "totalTokens": total_tokens,
-                "totalCostEstimate": microunits_usd(total_cost_microunits),
-                "rpm": matched_requests as f64 / minutes,
-                "tpm": total_tokens as f64 / minutes,
-            }),
-        }))
-    }
-
-    pub(crate) async fn latency_stats_since(
-        &self,
-        since_ms: u64,
-    ) -> Result<Option<Value>, AppError> {
-        let LedgerBackend::Postgres(pool) = self.backend.as_ref() else {
-            return Ok(None);
-        };
-        let since_ms = i64::try_from(since_ms).unwrap_or(i64::MAX);
-        let overall = sqlx::query(
-            "SELECT
-                percentile_disc(0.50) WITHIN GROUP (ORDER BY latency_ms) AS p50,
-                percentile_disc(0.90) WITHIN GROUP (ORDER BY latency_ms) AS p90,
-                percentile_disc(0.95) WITHIN GROUP (ORDER BY latency_ms) AS p95,
-                percentile_disc(0.99) WITHIN GROUP (ORDER BY latency_ms) AS p99,
-                floor(COALESCE(avg(latency_ms), 0))::bigint AS avg,
-                COALESCE(max(latency_ms), 0)::bigint AS max,
-                count(*)::bigint AS count
-             FROM modelport_gateway_requests
-             WHERE state <> 'started'
-               AND created_at >= to_timestamp($1::double precision / 1000.0)",
-        )
-        .bind(since_ms)
-        .fetch_one(pool)
-        .await?;
-        let by_model_rows = sqlx::query(
-            "SELECT
-                COALESCE(resolved_model, requested_model, 'unknown') AS name,
-                percentile_disc(0.50) WITHIN GROUP (ORDER BY latency_ms) AS p50,
-                percentile_disc(0.90) WITHIN GROUP (ORDER BY latency_ms) AS p90,
-                percentile_disc(0.95) WITHIN GROUP (ORDER BY latency_ms) AS p95,
-                percentile_disc(0.99) WITHIN GROUP (ORDER BY latency_ms) AS p99,
-                floor(COALESCE(avg(latency_ms), 0))::bigint AS avg,
-                COALESCE(max(latency_ms), 0)::bigint AS max,
-                count(*)::bigint AS count
-             FROM modelport_gateway_requests
-             WHERE state <> 'started'
-               AND created_at >= to_timestamp($1::double precision / 1000.0)
-             GROUP BY COALESCE(resolved_model, requested_model, 'unknown')
-             ORDER BY count DESC
-             LIMIT 200",
-        )
-        .bind(since_ms)
-        .fetch_all(pool)
-        .await?;
-        let by_provider_rows = sqlx::query(
-            "SELECT
-                COALESCE(provider_id, 'unrouted') AS name,
-                percentile_disc(0.50) WITHIN GROUP (ORDER BY latency_ms) AS p50,
-                percentile_disc(0.90) WITHIN GROUP (ORDER BY latency_ms) AS p90,
-                percentile_disc(0.95) WITHIN GROUP (ORDER BY latency_ms) AS p95,
-                percentile_disc(0.99) WITHIN GROUP (ORDER BY latency_ms) AS p99,
-                floor(COALESCE(avg(latency_ms), 0))::bigint AS avg,
-                COALESCE(max(latency_ms), 0)::bigint AS max,
-                count(*)::bigint AS count
-             FROM modelport_gateway_requests
-             WHERE state <> 'started'
-               AND created_at >= to_timestamp($1::double precision / 1000.0)
-             GROUP BY COALESCE(provider_id, 'unrouted')
-             ORDER BY count DESC
-             LIMIT 200",
-        )
-        .bind(since_ms)
-        .fetch_all(pool)
-        .await?;
-        let grouped = |rows: Vec<PgRow>| -> Result<Value, sqlx::Error> {
-            let mut values = serde_json::Map::new();
-            for row in rows {
-                values.insert(row.try_get("name")?, latency_stats_from_pg(&row)?);
-            }
-            Ok(Value::Object(values))
-        };
-
-        Ok(Some(json!({
-            "p50": optional_nonnegative_u64(&overall, "p50")?,
-            "p90": optional_nonnegative_u64(&overall, "p90")?,
-            "p95": optional_nonnegative_u64(&overall, "p95")?,
-            "p99": optional_nonnegative_u64(&overall, "p99")?,
-            "avg": nonnegative_u64(overall.try_get("avg")?),
-            "max": nonnegative_u64(overall.try_get("max")?),
-            "byModel": grouped(by_model_rows)?,
-            "byProvider": grouped(by_provider_rows)?,
-            "sampleCount": nonnegative_u64(overall.try_get("count")?),
-            "percentilesEstimated": false,
-        })))
-    }
-
-    pub(crate) async fn usage_row(&self, ledger_id: &str) -> Result<Option<Value>, AppError> {
-        let request = match self.backend.as_ref() {
-            LedgerBackend::Memory(ledger) => {
-                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
-                ledger.requests.get(ledger_id).map(|request| {
-                    memory_request_row(
-                        ledger_id,
-                        request,
-                        usize_to_i64(
-                            ledger
-                                .attempts
-                                .values()
-                                .filter(|attempt| attempt.request_ledger_id == ledger_id)
-                                .count(),
-                        ),
-                    )
-                })
-            }
-            LedgerBackend::Postgres(pool) => sqlx::query(REQUEST_DETAIL_SQL)
-                .bind(ledger_id)
-                .fetch_optional(pool)
-                .await?
-                .as_ref()
-                .map(request_row_from_pg)
-                .transpose()?,
-        };
-        Ok(request
-            .filter(|request| request.state != "started")
-            .as_ref()
-            .map(operational_log_row))
-    }
-
-    pub(crate) async fn management_usage(&self) -> Result<ManagementUsageStats, AppError> {
-        match self.backend.as_ref() {
-            LedgerBackend::Memory(ledger) => {
-                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
-                let now = u64::try_from(now_millis()).unwrap_or(u64::MAX);
-                let day_start = current_period("daily", now).0;
-                let month_start = current_period("monthly", now).0;
-                let rolling_day_start = now.saturating_sub(24 * 60 * 60 * 1_000);
-                let mut stats = ManagementUsageStats::default();
-                for request in ledger
-                    .requests
-                    .values()
-                    .filter(|request| request.record.terminal)
-                {
-                    let created_at = u64::try_from(request.record.created_at_ms).unwrap_or(0);
-                    if created_at >= rolling_day_start {
-                        let requests = stats
-                            .users_24h
-                            .entry(request.principal_id.clone())
-                            .or_default();
-                        *requests = requests.saturating_add(1);
-                    }
-                    if let Some(api_key_id) = request.api_key_id.as_deref()
-                        && created_at >= day_start
-                    {
-                        let row = stats.api_keys.entry(api_key_id.to_owned()).or_default();
-                        row.requests_today = row.requests_today.saturating_add(1);
-                        row.tokens_today = row
-                            .tokens_today
-                            .saturating_add(request_total_tokens(&request.record));
-                    }
-                    if let Some(team_id) = request.team_id.as_deref()
-                        && created_at >= month_start
-                    {
-                        let row = stats.teams.entry(team_id.to_owned()).or_default();
-                        let cost = request
-                            .record
-                            .billable_cost_microunits
-                            .map_or(0.0, microunits_usd);
-                        row.monthly_spend_usd += cost;
-                        if created_at >= day_start {
-                            row.requests_today = row.requests_today.saturating_add(1);
-                            row.daily_spend_usd += cost;
-                        }
-                    }
-                }
-                Ok(stats)
-            }
-            LedgerBackend::Postgres(pool) => {
-                let api_key_rows = sqlx::query(
-                    "SELECT
-                        api_key_id,
-                        count(*)::bigint AS requests_today,
-                        COALESCE(sum(
-                            input_tokens + output_tokens
-                            + cache_write_tokens + cache_read_tokens
-                        ), 0)::bigint AS tokens_today
-                     FROM modelport_gateway_requests
-                     WHERE state <> 'started'
-                       AND api_key_id IS NOT NULL
-                       AND created_at >= (
-                           date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
-                       )
-                     GROUP BY api_key_id",
-                )
-                .fetch_all(pool)
-                .await?;
-                let team_rows = sqlx::query(
-                    "SELECT
-                        team_id,
-                        count(*) FILTER (
-                            WHERE created_at >= (
-                                date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
-                            )
-                        )::bigint AS requests_today,
-                        COALESCE(sum(billable_cost_microunits) FILTER (
-                            WHERE chargeable
-                              AND created_at >= (
-                                  date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
-                              )
-                        ), 0)::bigint AS daily_spend_microunits,
-                        COALESCE(sum(billable_cost_microunits) FILTER (
-                            WHERE chargeable
-                        ), 0)::bigint AS monthly_spend_microunits
-                     FROM modelport_gateway_requests
-                     WHERE state <> 'started'
-                       AND team_id IS NOT NULL
-                       AND created_at >= (
-                           date_trunc('month', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
-                       )
-                     GROUP BY team_id",
-                )
-                .fetch_all(pool)
-                .await?;
-                let user_rows = sqlx::query(
-                    "SELECT principal_id, count(*)::bigint AS requests_24h
-                     FROM modelport_gateway_requests
-                     WHERE state <> 'started'
-                       AND created_at >= now() - interval '24 hours'
-                     GROUP BY principal_id",
-                )
-                .fetch_all(pool)
-                .await?;
-                let mut stats = ManagementUsageStats::default();
-                for row in api_key_rows {
-                    stats.api_keys.insert(
-                        row.try_get("api_key_id")?,
-                        ApiKeyUsageStats {
-                            requests_today: nonnegative_u64(row.try_get("requests_today")?),
-                            tokens_today: nonnegative_u64(row.try_get("tokens_today")?),
-                        },
-                    );
-                }
-                for row in team_rows {
-                    stats.teams.insert(
-                        row.try_get("team_id")?,
-                        TeamUsageStats {
-                            requests_today: nonnegative_u64(row.try_get("requests_today")?),
-                            daily_spend_usd: microunits_usd(row.try_get("daily_spend_microunits")?),
-                            monthly_spend_usd: microunits_usd(
-                                row.try_get("monthly_spend_microunits")?,
-                            ),
-                        },
-                    );
-                }
-                for row in user_rows {
-                    stats.users_24h.insert(
-                        row.try_get("principal_id")?,
-                        nonnegative_u64(row.try_get("requests_24h")?),
-                    );
-                }
-                Ok(stats)
-            }
-        }
-    }
-
     pub(crate) async fn check_usage_policy(
         &self,
         policy: &UsagePolicySnapshot,
@@ -3181,52 +2284,6 @@ impl EnterpriseLedger {
         }
     }
 
-    pub(crate) async fn request_detail(
-        &self,
-        ledger_id: &str,
-    ) -> Result<Option<EnterpriseRequestDetail>, AppError> {
-        match self.backend.as_ref() {
-            LedgerBackend::Memory(ledger) => {
-                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
-                let Some(request) = ledger.requests.get(ledger_id) else {
-                    return Ok(None);
-                };
-                let mut attempts = ledger
-                    .attempts
-                    .iter()
-                    .filter(|(_, attempt)| attempt.request_ledger_id == ledger_id)
-                    .map(|(attempt_id, attempt)| memory_attempt_row(attempt_id, attempt))
-                    .collect::<Vec<_>>();
-                attempts.sort_by_key(|attempt| attempt.created_at_ms);
-                Ok(Some(EnterpriseRequestDetail {
-                    request: memory_request_row(ledger_id, request, usize_to_i64(attempts.len())),
-                    attempts,
-                }))
-            }
-            LedgerBackend::Postgres(pool) => {
-                let Some(row) = sqlx::query(REQUEST_DETAIL_SQL)
-                    .bind(ledger_id)
-                    .fetch_optional(pool)
-                    .await?
-                else {
-                    return Ok(None);
-                };
-                let request = request_row_from_pg(&row)?;
-                let attempt_rows = sqlx::query(ATTEMPT_LIST_SQL)
-                    .bind(ledger_id)
-                    .fetch_all(pool)
-                    .await?;
-                Ok(Some(EnterpriseRequestDetail {
-                    request,
-                    attempts: attempt_rows
-                        .iter()
-                        .map(attempt_row_from_pg)
-                        .collect::<Result<_, _>>()?,
-                }))
-            }
-        }
-    }
-
     pub(crate) async fn budget_view(
         &self,
         scope: &EnterpriseBudgetScopeQuery,
@@ -6546,280 +5603,6 @@ fn duration_millis_i64(duration: Duration) -> i64 {
     i64::try_from(duration.as_millis()).unwrap_or(i64::MAX)
 }
 
-fn validate_ops_observation(observation: &OpsObservation) -> Result<(), AppError> {
-    let bounded = [
-        ("eventKey", observation.event_key.as_str(), 240_usize),
-        ("detectorType", observation.detector_type.as_str(), 80),
-        ("title", observation.title.as_str(), 240),
-        ("summary", observation.summary.as_str(), 2_000),
-        (
-            "recoveryCriteria",
-            observation.recovery_criteria.as_str(),
-            1_000,
-        ),
-    ];
-    for (name, value, maximum) in bounded {
-        let length = value.chars().count();
-        if length == 0 || length > maximum {
-            return Err(AppError::InvalidRequest(format!(
-                "{name} must contain 1 to {maximum} characters"
-            )));
-        }
-    }
-    let allowed = match observation.event_key.as_str() {
-        "readiness:gateway" => {
-            observation.detector_type == "readiness_storage"
-                && matches!(observation.severity, OpsSeverity::Sev1 | OpsSeverity::Sev2)
-        }
-        "provider:availability" => {
-            observation.detector_type == "provider_health"
-                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
-        }
-        "requests:failure-ratio" => {
-            observation.detector_type == "request_anomaly"
-                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
-        }
-        "budget:capacity" => {
-            observation.detector_type == "budget_quota"
-                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
-        }
-        "ledger:finalization-backlog" => {
-            observation.detector_type == "ledger_backlog"
-                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
-        }
-        "change:verification" => {
-            observation.detector_type == "post_change_verification"
-                && observation.severity == OpsSeverity::Sev2
-        }
-        _ => false,
-    };
-    if !allowed {
-        return Err(AppError::Forbidden(
-            "observation is outside the versioned operations rule allowlist".to_owned(),
-        ));
-    }
-    if !observation.affected_scope.is_object() || !observation.evidence.is_object() {
-        return Err(AppError::InvalidRequest(
-            "affectedScope and evidence must be JSON objects".to_owned(),
-        ));
-    }
-    if serde_json::to_vec(&observation.evidence)?.len() > 32 * 1_024 {
-        return Err(AppError::InvalidRequest(
-            "incident evidence must not exceed 32 KiB".to_owned(),
-        ));
-    }
-    if serde_json::to_vec(&observation.affected_scope)?.len() > 8 * 1_024 {
-        return Err(AppError::InvalidRequest(
-            "incident affectedScope must not exceed 8 KiB".to_owned(),
-        ));
-    }
-    let now = u64::try_from(now_millis()).unwrap_or_default();
-    if observation.observed_at_ms == 0
-        || observation.observed_at_ms > now.saturating_add(5 * 60 * 1_000)
-    {
-        return Err(AppError::InvalidRequest(
-            "observedAtMs must be a current, non-zero timestamp".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn validate_ops_heartbeat(heartbeat: &OpsHeartbeat) -> Result<(), AppError> {
-    for (name, value, maximum) in [
-        ("instanceId", heartbeat.instance_id.as_str(), 160_usize),
-        ("agentVersion", heartbeat.agent_version.as_str(), 80),
-        ("ruleSetVersion", heartbeat.rule_set_version.as_str(), 80),
-    ] {
-        let length = value.chars().count();
-        if length == 0 || length > maximum {
-            return Err(AppError::InvalidRequest(format!(
-                "{name} must contain 1 to {maximum} characters"
-            )));
-        }
-    }
-    if heartbeat.selected_model.as_deref().is_some_and(|value| {
-        value.is_empty() || value.chars().count() > 320 || value.chars().any(char::is_control)
-    }) {
-        return Err(AppError::InvalidRequest(
-            "heartbeat selectedModel must contain 1 to 320 non-control characters".to_owned(),
-        ));
-    }
-    if !matches!(
-        heartbeat.model_status.as_str(),
-        "disabled" | "configured" | "missing_credential" | "error"
-    ) {
-        return Err(AppError::InvalidRequest(
-            "heartbeat modelStatus is unsupported".to_owned(),
-        ));
-    }
-    if !matches!(
-        heartbeat.mode.as_str(),
-        "disabled" | "replay" | "shadow" | "read_only"
-    ) {
-        return Err(AppError::InvalidRequest(
-            "agent mode must be disabled, replay, shadow, or read_only".to_owned(),
-        ));
-    }
-    if !(10..=3_600).contains(&heartbeat.interval_seconds) {
-        return Err(AppError::InvalidRequest(
-            "agent intervalSeconds must be between 10 and 3600".to_owned(),
-        ));
-    }
-    let now = u64::try_from(now_millis()).unwrap_or_default();
-    if heartbeat.observed_at_ms == 0
-        || heartbeat.observed_at_ms > now.saturating_add(5 * 60 * 1_000)
-    {
-        return Err(AppError::InvalidRequest(
-            "heartbeat observedAtMs must be a current, non-zero timestamp".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn validate_ops_actor(actor_id: &str, actor_name: &str) -> Result<(), AppError> {
-    if actor_id.is_empty()
-        || actor_name.is_empty()
-        || actor_id.chars().count() > 160
-        || actor_name.chars().count() > 160
-    {
-        return Err(AppError::InvalidRequest(
-            "operations actor identity is missing or too long".to_owned(),
-        ));
-    }
-    Ok(())
-}
-
-fn ops_evidence_hash(value: &Value) -> Result<String, AppError> {
-    let encoded = serde_json::to_vec(value)?;
-    Ok(format!("{:x}", Sha256::digest(encoded)))
-}
-
-async fn fetch_ops_incident_row(
-    transaction: &mut sqlx::Transaction<'_, Postgres>,
-    incident_id: &str,
-) -> Result<PgRow, AppError> {
-    Ok(sqlx::query(
-        "SELECT *,
-            (EXTRACT(EPOCH FROM first_seen_at) * 1000)::bigint AS first_seen_at_ms,
-            (EXTRACT(EPOCH FROM last_seen_at) * 1000)::bigint AS last_seen_at_ms,
-            (EXTRACT(EPOCH FROM resolved_at) * 1000)::bigint AS resolved_at_ms
-         FROM modelport_ops_incidents WHERE incident_id = $1",
-    )
-    .bind(incident_id)
-    .fetch_one(&mut **transaction)
-    .await?)
-}
-
-fn ops_incident_summary_from_row(row: &PgRow) -> Result<OpsIncidentSummary, AppError> {
-    let severity: String = row.try_get("severity")?;
-    let status: String = row.try_get("status")?;
-    Ok(OpsIncidentSummary {
-        id: row.try_get("incident_id")?,
-        event_key: row.try_get("event_key")?,
-        detector_type: row.try_get("detector_type")?,
-        severity: parse_ops_severity(&severity)?,
-        status: parse_ops_status(&status)?,
-        title: row.try_get("title")?,
-        summary: row.try_get("summary")?,
-        affected_scope: row.try_get("affected_scope")?,
-        recovery_criteria: row.try_get("recovery_criteria")?,
-        first_seen_at_ms: nonnegative_u64(row.try_get("first_seen_at_ms")?),
-        last_seen_at_ms: nonnegative_u64(row.try_get("last_seen_at_ms")?),
-        resolved_at_ms: row
-            .try_get::<Option<i64>, _>("resolved_at_ms")?
-            .map(nonnegative_u64),
-        occurrence_count: nonnegative_u64(row.try_get("occurrence_count")?),
-    })
-}
-
-fn parse_ops_severity(value: &str) -> Result<OpsSeverity, AppError> {
-    match value {
-        "SEV-1" => Ok(OpsSeverity::Sev1),
-        "SEV-2" => Ok(OpsSeverity::Sev2),
-        "SEV-3" => Ok(OpsSeverity::Sev3),
-        "SEV-4" => Ok(OpsSeverity::Sev4),
-        _ => Err(AppError::Database(
-            "operations incident contains an invalid severity".to_owned(),
-        )),
-    }
-}
-
-fn parse_ops_status(value: &str) -> Result<OpsIncidentStatus, AppError> {
-    match value {
-        "open" => Ok(OpsIncidentStatus::Open),
-        "acknowledged" => Ok(OpsIncidentStatus::Acknowledged),
-        "mitigating" => Ok(OpsIncidentStatus::Mitigating),
-        "monitoring" => Ok(OpsIncidentStatus::Monitoring),
-        "resolved" => Ok(OpsIncidentStatus::Resolved),
-        "suppressed" => Ok(OpsIncidentStatus::Suppressed),
-        _ => Err(AppError::Database(
-            "operations incident contains an invalid status".to_owned(),
-        )),
-    }
-}
-
-fn highest_ops_severity(values: Vec<OpsSeverity>) -> Option<OpsSeverity> {
-    values.into_iter().min_by_key(|severity| match severity {
-        OpsSeverity::Sev1 => 1,
-        OpsSeverity::Sev2 => 2,
-        OpsSeverity::Sev3 => 3,
-        OpsSeverity::Sev4 => 4,
-    })
-}
-
-fn ops_severity_from_rank(value: i32) -> Option<OpsSeverity> {
-    match value {
-        1 => Some(OpsSeverity::Sev1),
-        2 => Some(OpsSeverity::Sev2),
-        3 => Some(OpsSeverity::Sev3),
-        4 => Some(OpsSeverity::Sev4),
-        _ => None,
-    }
-}
-
-fn ops_agent_summary(heartbeat: &OpsHeartbeat) -> OpsAgentSummary {
-    OpsAgentSummary {
-        instance_id: heartbeat.instance_id.clone(),
-        agent_version: heartbeat.agent_version.clone(),
-        mode: heartbeat.mode.clone(),
-        rule_set_version: heartbeat.rule_set_version.clone(),
-        observed_at_ms: heartbeat.observed_at_ms,
-        queue_depth: heartbeat.queue_depth,
-        interval_seconds: heartbeat.interval_seconds,
-        online: u64::try_from(now_millis())
-            .unwrap_or_default()
-            .saturating_sub(heartbeat.observed_at_ms)
-            <= heartbeat.interval_seconds.saturating_mul(3_000),
-        analysis_enabled: heartbeat.analysis_enabled,
-        selected_model: heartbeat.selected_model.clone(),
-        model_status: heartbeat.model_status.clone(),
-        model_last_success_at_ms: heartbeat.model_last_success_at_ms,
-    }
-}
-
-fn ops_agent_summary_from_row(row: &PgRow) -> Result<OpsAgentSummary, AppError> {
-    let observed_at_ms = nonnegative_u64(row.try_get("observed_at_ms")?);
-    Ok(OpsAgentSummary {
-        instance_id: row.try_get("instance_id")?,
-        agent_version: row.try_get("agent_version")?,
-        mode: row.try_get("mode")?,
-        rule_set_version: row.try_get("rule_set_version")?,
-        observed_at_ms,
-        queue_depth: nonnegative_u64(row.try_get("queue_depth")?),
-        interval_seconds: nonnegative_u64(row.try_get("interval_seconds")?),
-        online: u64::try_from(now_millis())
-            .unwrap_or_default()
-            .saturating_sub(observed_at_ms)
-            <= nonnegative_u64(row.try_get("interval_seconds")?).saturating_mul(3_000),
-        analysis_enabled: row.try_get("analysis_enabled")?,
-        selected_model: row.try_get("selected_model")?,
-        model_status: row.try_get("model_status")?,
-        model_last_success_at_ms: row
-            .try_get::<Option<i64>, _>("model_last_success_at_ms")?
-            .map(nonnegative_u64),
-    })
-}
-
 fn now_millis() -> i64 {
     SystemTime::now()
         .duration_since(UNIX_EPOCH)
diff --git a/src/enterprise_ledger/operations.rs b/src/enterprise_ledger/operations.rs
index cb7a68a..3d69f0d 100644
--- a/src/enterprise_ledger/operations.rs
+++ b/src/enterprise_ledger/operations.rs
@@ -897,3 +897,277 @@ impl EnterpriseLedger {
         Ok(())
     }
 }
+
+fn validate_ops_observation(observation: &OpsObservation) -> Result<(), AppError> {
+    let bounded = [
+        ("eventKey", observation.event_key.as_str(), 240_usize),
+        ("detectorType", observation.detector_type.as_str(), 80),
+        ("title", observation.title.as_str(), 240),
+        ("summary", observation.summary.as_str(), 2_000),
+        (
+            "recoveryCriteria",
+            observation.recovery_criteria.as_str(),
+            1_000,
+        ),
+    ];
+    for (name, value, maximum) in bounded {
+        let length = value.chars().count();
+        if length == 0 || length > maximum {
+            return Err(AppError::InvalidRequest(format!(
+                "{name} must contain 1 to {maximum} characters"
+            )));
+        }
+    }
+    let allowed = match observation.event_key.as_str() {
+        "readiness:gateway" => {
+            observation.detector_type == "readiness_storage"
+                && matches!(observation.severity, OpsSeverity::Sev1 | OpsSeverity::Sev2)
+        }
+        "provider:availability" => {
+            observation.detector_type == "provider_health"
+                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
+        }
+        "requests:failure-ratio" => {
+            observation.detector_type == "request_anomaly"
+                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
+        }
+        "budget:capacity" => {
+            observation.detector_type == "budget_quota"
+                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
+        }
+        "ledger:finalization-backlog" => {
+            observation.detector_type == "ledger_backlog"
+                && matches!(observation.severity, OpsSeverity::Sev2 | OpsSeverity::Sev3)
+        }
+        "change:verification" => {
+            observation.detector_type == "post_change_verification"
+                && observation.severity == OpsSeverity::Sev2
+        }
+        _ => false,
+    };
+    if !allowed {
+        return Err(AppError::Forbidden(
+            "observation is outside the versioned operations rule allowlist".to_owned(),
+        ));
+    }
+    if !observation.affected_scope.is_object() || !observation.evidence.is_object() {
+        return Err(AppError::InvalidRequest(
+            "affectedScope and evidence must be JSON objects".to_owned(),
+        ));
+    }
+    if serde_json::to_vec(&observation.evidence)?.len() > 32 * 1_024 {
+        return Err(AppError::InvalidRequest(
+            "incident evidence must not exceed 32 KiB".to_owned(),
+        ));
+    }
+    if serde_json::to_vec(&observation.affected_scope)?.len() > 8 * 1_024 {
+        return Err(AppError::InvalidRequest(
+            "incident affectedScope must not exceed 8 KiB".to_owned(),
+        ));
+    }
+    let now = u64::try_from(now_millis()).unwrap_or_default();
+    if observation.observed_at_ms == 0
+        || observation.observed_at_ms > now.saturating_add(5 * 60 * 1_000)
+    {
+        return Err(AppError::InvalidRequest(
+            "observedAtMs must be a current, non-zero timestamp".to_owned(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_ops_heartbeat(heartbeat: &OpsHeartbeat) -> Result<(), AppError> {
+    for (name, value, maximum) in [
+        ("instanceId", heartbeat.instance_id.as_str(), 160_usize),
+        ("agentVersion", heartbeat.agent_version.as_str(), 80),
+        ("ruleSetVersion", heartbeat.rule_set_version.as_str(), 80),
+    ] {
+        let length = value.chars().count();
+        if length == 0 || length > maximum {
+            return Err(AppError::InvalidRequest(format!(
+                "{name} must contain 1 to {maximum} characters"
+            )));
+        }
+    }
+    if heartbeat.selected_model.as_deref().is_some_and(|value| {
+        value.is_empty() || value.chars().count() > 320 || value.chars().any(char::is_control)
+    }) {
+        return Err(AppError::InvalidRequest(
+            "heartbeat selectedModel must contain 1 to 320 non-control characters".to_owned(),
+        ));
+    }
+    if !matches!(
+        heartbeat.model_status.as_str(),
+        "disabled" | "configured" | "missing_credential" | "error"
+    ) {
+        return Err(AppError::InvalidRequest(
+            "heartbeat modelStatus is unsupported".to_owned(),
+        ));
+    }
+    if !matches!(
+        heartbeat.mode.as_str(),
+        "disabled" | "replay" | "shadow" | "read_only"
+    ) {
+        return Err(AppError::InvalidRequest(
+            "agent mode must be disabled, replay, shadow, or read_only".to_owned(),
+        ));
+    }
+    if !(10..=3_600).contains(&heartbeat.interval_seconds) {
+        return Err(AppError::InvalidRequest(
+            "agent intervalSeconds must be between 10 and 3600".to_owned(),
+        ));
+    }
+    let now = u64::try_from(now_millis()).unwrap_or_default();
+    if heartbeat.observed_at_ms == 0
+        || heartbeat.observed_at_ms > now.saturating_add(5 * 60 * 1_000)
+    {
+        return Err(AppError::InvalidRequest(
+            "heartbeat observedAtMs must be a current, non-zero timestamp".to_owned(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_ops_actor(actor_id: &str, actor_name: &str) -> Result<(), AppError> {
+    if actor_id.is_empty()
+        || actor_name.is_empty()
+        || actor_id.chars().count() > 160
+        || actor_name.chars().count() > 160
+    {
+        return Err(AppError::InvalidRequest(
+            "operations actor identity is missing or too long".to_owned(),
+        ));
+    }
+    Ok(())
+}
+
+fn ops_evidence_hash(value: &Value) -> Result<String, AppError> {
+    let encoded = serde_json::to_vec(value)?;
+    Ok(format!("{:x}", Sha256::digest(encoded)))
+}
+
+async fn fetch_ops_incident_row(
+    transaction: &mut sqlx::Transaction<'_, Postgres>,
+    incident_id: &str,
+) -> Result<PgRow, AppError> {
+    Ok(sqlx::query(
+        "SELECT *,
+            (EXTRACT(EPOCH FROM first_seen_at) * 1000)::bigint AS first_seen_at_ms,
+            (EXTRACT(EPOCH FROM last_seen_at) * 1000)::bigint AS last_seen_at_ms,
+            (EXTRACT(EPOCH FROM resolved_at) * 1000)::bigint AS resolved_at_ms
+         FROM modelport_ops_incidents WHERE incident_id = $1",
+    )
+    .bind(incident_id)
+    .fetch_one(&mut **transaction)
+    .await?)
+}
+
+fn ops_incident_summary_from_row(row: &PgRow) -> Result<OpsIncidentSummary, AppError> {
+    let severity: String = row.try_get("severity")?;
+    let status: String = row.try_get("status")?;
+    Ok(OpsIncidentSummary {
+        id: row.try_get("incident_id")?,
+        event_key: row.try_get("event_key")?,
+        detector_type: row.try_get("detector_type")?,
+        severity: parse_ops_severity(&severity)?,
+        status: parse_ops_status(&status)?,
+        title: row.try_get("title")?,
+        summary: row.try_get("summary")?,
+        affected_scope: row.try_get("affected_scope")?,
+        recovery_criteria: row.try_get("recovery_criteria")?,
+        first_seen_at_ms: nonnegative_u64(row.try_get("first_seen_at_ms")?),
+        last_seen_at_ms: nonnegative_u64(row.try_get("last_seen_at_ms")?),
+        resolved_at_ms: row
+            .try_get::<Option<i64>, _>("resolved_at_ms")?
+            .map(nonnegative_u64),
+        occurrence_count: nonnegative_u64(row.try_get("occurrence_count")?),
+    })
+}
+
+fn parse_ops_severity(value: &str) -> Result<OpsSeverity, AppError> {
+    match value {
+        "SEV-1" => Ok(OpsSeverity::Sev1),
+        "SEV-2" => Ok(OpsSeverity::Sev2),
+        "SEV-3" => Ok(OpsSeverity::Sev3),
+        "SEV-4" => Ok(OpsSeverity::Sev4),
+        _ => Err(AppError::Database(
+            "operations incident contains an invalid severity".to_owned(),
+        )),
+    }
+}
+
+fn parse_ops_status(value: &str) -> Result<OpsIncidentStatus, AppError> {
+    match value {
+        "open" => Ok(OpsIncidentStatus::Open),
+        "acknowledged" => Ok(OpsIncidentStatus::Acknowledged),
+        "mitigating" => Ok(OpsIncidentStatus::Mitigating),
+        "monitoring" => Ok(OpsIncidentStatus::Monitoring),
+        "resolved" => Ok(OpsIncidentStatus::Resolved),
+        "suppressed" => Ok(OpsIncidentStatus::Suppressed),
+        _ => Err(AppError::Database(
+            "operations incident contains an invalid status".to_owned(),
+        )),
+    }
+}
+
+fn highest_ops_severity(values: Vec<OpsSeverity>) -> Option<OpsSeverity> {
+    values.into_iter().min_by_key(|severity| match severity {
+        OpsSeverity::Sev1 => 1,
+        OpsSeverity::Sev2 => 2,
+        OpsSeverity::Sev3 => 3,
+        OpsSeverity::Sev4 => 4,
+    })
+}
+
+fn ops_severity_from_rank(value: i32) -> Option<OpsSeverity> {
+    match value {
+        1 => Some(OpsSeverity::Sev1),
+        2 => Some(OpsSeverity::Sev2),
+        3 => Some(OpsSeverity::Sev3),
+        4 => Some(OpsSeverity::Sev4),
+        _ => None,
+    }
+}
+
+fn ops_agent_summary(heartbeat: &OpsHeartbeat) -> OpsAgentSummary {
+    OpsAgentSummary {
+        instance_id: heartbeat.instance_id.clone(),
+        agent_version: heartbeat.agent_version.clone(),
+        mode: heartbeat.mode.clone(),
+        rule_set_version: heartbeat.rule_set_version.clone(),
+        observed_at_ms: heartbeat.observed_at_ms,
+        queue_depth: heartbeat.queue_depth,
+        interval_seconds: heartbeat.interval_seconds,
+        online: u64::try_from(now_millis())
+            .unwrap_or_default()
+            .saturating_sub(heartbeat.observed_at_ms)
+            <= heartbeat.interval_seconds.saturating_mul(3_000),
+        analysis_enabled: heartbeat.analysis_enabled,
+        selected_model: heartbeat.selected_model.clone(),
+        model_status: heartbeat.model_status.clone(),
+        model_last_success_at_ms: heartbeat.model_last_success_at_ms,
+    }
+}
+
+fn ops_agent_summary_from_row(row: &PgRow) -> Result<OpsAgentSummary, AppError> {
+    let observed_at_ms = nonnegative_u64(row.try_get("observed_at_ms")?);
+    Ok(OpsAgentSummary {
+        instance_id: row.try_get("instance_id")?,
+        agent_version: row.try_get("agent_version")?,
+        mode: row.try_get("mode")?,
+        rule_set_version: row.try_get("rule_set_version")?,
+        observed_at_ms,
+        queue_depth: nonnegative_u64(row.try_get("queue_depth")?),
+        interval_seconds: nonnegative_u64(row.try_get("interval_seconds")?),
+        online: u64::try_from(now_millis())
+            .unwrap_or_default()
+            .saturating_sub(observed_at_ms)
+            <= nonnegative_u64(row.try_get("interval_seconds")?).saturating_mul(3_000),
+        analysis_enabled: row.try_get("analysis_enabled")?,
+        selected_model: row.try_get("selected_model")?,
+        model_status: row.try_get("model_status")?,
+        model_last_success_at_ms: row
+            .try_get::<Option<i64>, _>("model_last_success_at_ms")?
+            .map(nonnegative_u64),
+    })
+}
diff --git a/src/enterprise_ledger/reporting.rs b/src/enterprise_ledger/reporting.rs
new file mode 100644
index 0000000..fd7ca3d
--- /dev/null
+++ b/src/enterprise_ledger/reporting.rs
@@ -0,0 +1,949 @@
+//! Read-only ledger views for the console, request evidence, and usage reporting.
+
+use super::*;
+
+impl EnterpriseLedger {
+    pub(crate) async fn overview(&self) -> Result<EnterpriseLedgerOverview, AppError> {
+        let mut overview = EnterpriseLedgerOverview {
+            backend: self.backend_name(),
+            location: self.location().to_owned(),
+            lease_ttl_secs: self.lease_ttl.as_secs(),
+            reconcile_interval_secs: self.reconcile_interval.as_secs(),
+            total_requests: 0,
+            started_requests: 0,
+            completed_requests: 0,
+            failed_requests: 0,
+            cancelled_requests: 0,
+            unreconciled_requests: 0,
+            idempotent_requests: 0,
+            active_leases: 0,
+            expired_leases: 0,
+            chargeable_requests: 0,
+            estimate_only_requests: 0,
+            total_cost_microunits: 0,
+            total_billable_cost_microunits: 0,
+            organization_count: 0,
+            project_count: 0,
+            environment_count: 0,
+        };
+
+        match self.backend.as_ref() {
+            LedgerBackend::Memory(ledger) => {
+                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
+                let now = Instant::now();
+                let mut organizations = HashSet::new();
+                let mut projects = HashSet::new();
+                let mut environments = HashSet::new();
+                for request in ledger.requests.values() {
+                    overview.total_requests += 1;
+                    match request.record.state.as_str() {
+                        "started" => overview.started_requests += 1,
+                        "completed" => overview.completed_requests += 1,
+                        "failed" => overview.failed_requests += 1,
+                        "cancelled" => overview.cancelled_requests += 1,
+                        _ => {}
+                    }
+                    if request.record.terminal_reason.as_deref()
+                        == Some("lease_expired_unreconciled")
+                    {
+                        overview.unreconciled_requests += 1;
+                    }
+                    if request.idempotency_key_hash.is_some() {
+                        overview.idempotent_requests += 1;
+                    }
+                    if !request.record.terminal {
+                        if request.record.lease_expires_at > now {
+                            overview.active_leases += 1;
+                        } else {
+                            overview.expired_leases += 1;
+                        }
+                    }
+                    if request.record.chargeable {
+                        overview.chargeable_requests += 1;
+                        if request.record.terminal
+                            && request.record.billable_cost_microunits.is_none()
+                        {
+                            overview.estimate_only_requests += 1;
+                        }
+                    }
+                    overview.total_cost_microunits = overview
+                        .total_cost_microunits
+                        .saturating_add(request.record.cost_amount_microunits);
+                    overview.total_billable_cost_microunits = overview
+                        .total_billable_cost_microunits
+                        .saturating_add(request.record.billable_cost_microunits.unwrap_or(0));
+                    organizations.insert(request.record.tenant.organization_id.clone());
+                    projects.insert((
+                        request.record.tenant.organization_id.clone(),
+                        request.record.tenant.project_id.clone(),
+                    ));
+                    environments.insert((
+                        request.record.tenant.organization_id.clone(),
+                        request.record.tenant.project_id.clone(),
+                        request.record.tenant.environment_id.clone(),
+                    ));
+                }
+                overview.organization_count = usize_to_i64(organizations.len());
+                overview.project_count = usize_to_i64(projects.len());
+                overview.environment_count = usize_to_i64(environments.len());
+            }
+            LedgerBackend::Postgres(pool) => {
+                let row = sqlx::query(
+                    "SELECT
+                        count(*)::bigint AS total_requests,
+                        count(*) FILTER (WHERE state = 'started')::bigint AS started_requests,
+                        count(*) FILTER (WHERE state = 'completed')::bigint AS completed_requests,
+                        count(*) FILTER (WHERE state = 'failed')::bigint AS failed_requests,
+                        count(*) FILTER (WHERE state = 'cancelled')::bigint AS cancelled_requests,
+                        count(*) FILTER (WHERE terminal_reason = 'lease_expired_unreconciled')::bigint AS unreconciled_requests,
+                        count(*) FILTER (WHERE idempotency_key_hash IS NOT NULL)::bigint AS idempotent_requests,
+                        count(*) FILTER (WHERE state = 'started' AND lease_expires_at > now())::bigint AS active_leases,
+                        count(*) FILTER (WHERE state = 'started' AND lease_expires_at <= now())::bigint AS expired_leases,
+                        count(*) FILTER (WHERE chargeable)::bigint AS chargeable_requests,
+                        count(*) FILTER (
+                            WHERE state <> 'started' AND chargeable
+                              AND billable_cost_microunits IS NULL
+                        )::bigint AS estimate_only_requests,
+                        COALESCE(sum(cost_amount_microunits), 0)::bigint AS total_cost_microunits,
+                        COALESCE(sum(billable_cost_microunits), 0)::bigint AS total_billable_cost_microunits,
+                        count(DISTINCT organization_id)::bigint AS organization_count,
+                        count(DISTINCT (organization_id, project_id))::bigint AS project_count,
+                        count(DISTINCT (organization_id, project_id, environment_id))::bigint AS environment_count
+                     FROM modelport_gateway_requests",
+                )
+                .fetch_one(pool)
+                .await?;
+                overview.total_requests = row.try_get("total_requests")?;
+                overview.started_requests = row.try_get("started_requests")?;
+                overview.completed_requests = row.try_get("completed_requests")?;
+                overview.failed_requests = row.try_get("failed_requests")?;
+                overview.cancelled_requests = row.try_get("cancelled_requests")?;
+                overview.unreconciled_requests = row.try_get("unreconciled_requests")?;
+                overview.idempotent_requests = row.try_get("idempotent_requests")?;
+                overview.active_leases = row.try_get("active_leases")?;
+                overview.expired_leases = row.try_get("expired_leases")?;
+                overview.chargeable_requests = row.try_get("chargeable_requests")?;
+                overview.estimate_only_requests = row.try_get("estimate_only_requests")?;
+                overview.total_cost_microunits = row.try_get("total_cost_microunits")?;
+                overview.total_billable_cost_microunits =
+                    row.try_get("total_billable_cost_microunits")?;
+                overview.organization_count = row.try_get("organization_count")?;
+                overview.project_count = row.try_get("project_count")?;
+                overview.environment_count = row.try_get("environment_count")?;
+            }
+        }
+        Ok(overview)
+    }
+
+    pub(crate) async fn list_requests(
+        &self,
+        query: &EnterpriseLedgerQuery,
+    ) -> Result<EnterpriseRequestPage, AppError> {
+        let query = query.normalized()?;
+        match self.backend.as_ref() {
+            LedgerBackend::Memory(ledger) => {
+                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
+                let mut requests = ledger
+                    .requests
+                    .iter()
+                    .filter(|(_, request)| query.matches_memory(request))
+                    .map(|(ledger_id, request)| {
+                        memory_request_row(
+                            ledger_id,
+                            request,
+                            usize_to_i64(
+                                ledger
+                                    .attempts
+                                    .values()
+                                    .filter(|attempt| attempt.request_ledger_id == *ledger_id)
+                                    .count(),
+                            ),
+                        )
+                    })
+                    .collect::<Vec<_>>();
+                requests.sort_by(|left, right| {
+                    right
+                        .created_at_ms
+                        .cmp(&left.created_at_ms)
+                        .then_with(|| right.ledger_id.cmp(&left.ledger_id))
+                });
+                let total = usize_to_i64(requests.len());
+                let start = query.offset().min(requests.len());
+                let end = start.saturating_add(query.page_size).min(requests.len());
+                Ok(EnterpriseRequestPage {
+                    requests: requests[start..end].to_vec(),
+                    total,
+                    page: query.page,
+                    page_size: query.page_size,
+                })
+            }
+            LedgerBackend::Postgres(pool) => {
+                let count = sqlx::query_scalar::<_, i64>(REQUEST_COUNT_SQL)
+                    .bind(query.state.as_deref())
+                    .bind(query.protocol.as_deref())
+                    .bind(query.organization_id.as_deref())
+                    .bind(query.project_id.as_deref())
+                    .bind(query.environment_id.as_deref())
+                    .bind(query.search.as_deref())
+                    .bind(query.traffic_class.as_deref())
+                    .fetch_one(pool)
+                    .await?;
+                let rows = sqlx::query(REQUEST_LIST_SQL)
+                    .bind(query.state.as_deref())
+                    .bind(query.protocol.as_deref())
+                    .bind(query.organization_id.as_deref())
+                    .bind(query.project_id.as_deref())
+                    .bind(query.environment_id.as_deref())
+                    .bind(query.search.as_deref())
+                    .bind(query.traffic_class.as_deref())
+                    .bind(usize_to_i64(query.page_size))
+                    .bind(usize_to_i64(query.offset()))
+                    .bind(None::<i64>)
+                    .fetch_all(pool)
+                    .await?;
+                Ok(EnterpriseRequestPage {
+                    requests: rows
+                        .iter()
+                        .map(request_row_from_pg)
+                        .collect::<Result<_, _>>()?,
+                    total: count,
+                    page: query.page,
+                    page_size: query.page_size,
+                })
+            }
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) async fn usage_rows(&self) -> Result<Vec<Value>, AppError> {
+        self.usage_rows_since(None).await
+    }
+
+    pub(crate) async fn usage_rows_since(
+        &self,
+        since_ms: Option<u64>,
+    ) -> Result<Vec<Value>, AppError> {
+        let since_ms_i64 = since_ms.map(|value| i64::try_from(value).unwrap_or(i64::MAX));
+        let mut requests = match self.backend.as_ref() {
+            LedgerBackend::Memory(ledger) => {
+                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
+                ledger
+                    .requests
+                    .iter()
+                    .filter(|(_, request)| {
+                        since_ms_i64.is_none_or(|since| request.record.created_at_ms >= since)
+                    })
+                    .map(|(ledger_id, request)| {
+                        memory_request_row(
+                            ledger_id,
+                            request,
+                            usize_to_i64(
+                                ledger
+                                    .attempts
+                                    .values()
+                                    .filter(|attempt| attempt.request_ledger_id == *ledger_id)
+                                    .count(),
+                            ),
+                        )
+                    })
+                    .collect::<Vec<_>>()
+            }
+            LedgerBackend::Postgres(pool) => sqlx::query(REQUEST_LIST_SQL)
+                .bind(None::<&str>)
+                .bind(None::<&str>)
+                .bind(None::<&str>)
+                .bind(None::<&str>)
+                .bind(None::<&str>)
+                .bind(None::<&str>)
+                .bind(None::<&str>)
+                .bind(i64::MAX)
+                .bind(0_i64)
+                .bind(since_ms_i64)
+                .fetch_all(pool)
+                .await?
+                .iter()
+                .map(request_row_from_pg)
+                .collect::<Result<Vec<_>, _>>()?,
+        };
+        requests.retain(|request| request.state != "started");
+        requests.sort_by(|left, right| {
+            right
+                .created_at_ms
+                .cmp(&left.created_at_ms)
+                .then_with(|| right.ledger_id.cmp(&left.ledger_id))
+        });
+        Ok(requests.iter().map(operational_log_row).collect())
+    }
+
+    pub(crate) async fn operational_logs(
+        &self,
+        query: &OperationalLogQuery,
+    ) -> Result<Option<OperationalLogPage>, AppError> {
+        let LedgerBackend::Postgres(pool) = self.backend.as_ref() else {
+            return Ok(None);
+        };
+
+        let mut summary_query = QueryBuilder::<Postgres>::new(
+            "SELECT
+                count(*)::bigint AS total_requests,
+                count(*) FILTER (WHERE r.state = 'completed')::bigint AS success_requests,
+                count(*) FILTER (WHERE r.tool_use_requested)::bigint AS tool_use_requests,
+                count(*) FILTER (
+                    WHERE r.tool_use_requested AND r.state = 'completed'
+                )::bigint AS tool_use_success_requests,
+                COALESCE(sum(r.input_tokens), 0)::bigint AS total_input_tokens,
+                COALESCE(sum(r.output_tokens), 0)::bigint AS total_output_tokens,
+                COALESCE(sum(r.cache_write_tokens), 0)::bigint AS total_cache_write_tokens,
+                COALESCE(sum(r.cache_read_tokens), 0)::bigint AS total_cache_read_tokens,
+                COALESCE(sum(r.cost_amount_microunits), 0)::bigint AS total_cost_microunits,
+                COALESCE(sum(r.actual_cost_microunits), 0)::bigint AS total_actual_cost_microunits,
+                COALESCE(sum(r.billable_cost_microunits), 0)::bigint AS total_billable_cost_microunits,
+                count(*) FILTER (
+                    WHERE r.billable_cost_microunits IS NOT NULL
+                )::bigint AS billable_requests,
+                count(*) FILTER (
+                    WHERE r.billable_cost_microunits IS NULL
+                )::bigint AS estimate_only_requests,
+                percentile_disc(0.95) WITHIN GROUP (ORDER BY r.latency_ms)
+                    FILTER (WHERE r.latency_ms IS NOT NULL) AS latency_p95_ms,
+                count(r.latency_ms)::bigint AS latency_sample_count,
+                percentile_disc(0.95) WITHIN GROUP (ORDER BY r.first_byte_latency_ms)
+                    FILTER (WHERE r.first_byte_latency_ms IS NOT NULL)
+                    AS first_byte_latency_p95_ms,
+                count(r.first_byte_latency_ms)::bigint AS first_byte_latency_sample_count,
+                (EXTRACT(EPOCH FROM min(r.created_at)) * 1000)::bigint AS first_timestamp_ms,
+                (EXTRACT(EPOCH FROM max(r.created_at)) * 1000)::bigint AS last_timestamp_ms
+             FROM modelport_gateway_requests r",
+        );
+        push_operational_log_filters(&mut summary_query, query);
+        let summary_row = summary_query.build().fetch_one(pool).await?;
+        let total: i64 = summary_row.try_get("total_requests")?;
+        let total_input_tokens: i64 = summary_row.try_get("total_input_tokens")?;
+        let total_output_tokens: i64 = summary_row.try_get("total_output_tokens")?;
+        let total_cache_write_tokens: i64 = summary_row.try_get("total_cache_write_tokens")?;
+        let total_cache_read_tokens: i64 = summary_row.try_get("total_cache_read_tokens")?;
+        let total_tokens = total_input_tokens
+            .saturating_add(total_output_tokens)
+            .saturating_add(total_cache_write_tokens)
+            .saturating_add(total_cache_read_tokens);
+        let first_timestamp: Option<i64> = summary_row.try_get("first_timestamp_ms")?;
+        let last_timestamp: Option<i64> = summary_row.try_get("last_timestamp_ms")?;
+        let minutes = match (first_timestamp, last_timestamp) {
+            (Some(first), Some(last)) if last > first => {
+                ((last - first) as f64 / 60_000.0).max(1.0)
+            }
+            _ => 1.0,
+        };
+        let summary = json!({
+            "totalRequests": nonnegative_u64(total),
+            "successRequests": nonnegative_u64(summary_row.try_get("success_requests")?),
+            "toolUseRequests": nonnegative_u64(summary_row.try_get("tool_use_requests")?),
+            "toolUseSuccessRequests": nonnegative_u64(
+                summary_row.try_get("tool_use_success_requests")?
+            ),
+            "totalInputTokens": nonnegative_u64(total_input_tokens),
+            "totalOutputTokens": nonnegative_u64(total_output_tokens),
+            "totalCacheWriteTokens": nonnegative_u64(total_cache_write_tokens),
+            "totalCacheReadTokens": nonnegative_u64(total_cache_read_tokens),
+            "totalTokens": nonnegative_u64(total_tokens),
+            "totalCostEstimate": microunits_usd(
+                summary_row.try_get("total_cost_microunits")?
+            ),
+            "totalActualCost": microunits_usd(
+                summary_row.try_get("total_actual_cost_microunits")?
+            ),
+            "totalBillableCost": microunits_usd(
+                summary_row.try_get("total_billable_cost_microunits")?
+            ),
+            "billableRequests": nonnegative_u64(
+                summary_row.try_get("billable_requests")?
+            ),
+            "estimateOnlyRequests": nonnegative_u64(
+                summary_row.try_get("estimate_only_requests")?
+            ),
+            "latencyP95Ms": summary_row
+                .try_get::<Option<i64>, _>("latency_p95_ms")?
+                .map(nonnegative_u64)
+                .unwrap_or(0),
+            "latencySampleCount": nonnegative_u64(
+                summary_row.try_get("latency_sample_count")?
+            ),
+            "firstByteLatencyP95Ms": summary_row
+                .try_get::<Option<i64>, _>("first_byte_latency_p95_ms")?
+                .map(nonnegative_u64)
+                .unwrap_or(0),
+            "firstByteLatencySampleCount": nonnegative_u64(
+                summary_row.try_get("first_byte_latency_sample_count")?
+            ),
+            "rpm": total.max(0) as f64 / minutes,
+            "tpm": total_tokens.max(0) as f64 / minutes,
+        });
+
+        let mut rows_query = QueryBuilder::<Postgres>::new(OPERATIONAL_LOG_SELECT_SQL);
+        push_operational_log_filters(&mut rows_query, query);
+        rows_query
+            .push(" ORDER BY r.created_at DESC, r.ledger_id DESC LIMIT ")
+            .push_bind(usize_to_i64(query.page_size))
+            .push(" OFFSET ")
+            .push_bind(usize_to_i64(
+                query.page.saturating_sub(1).saturating_mul(query.page_size),
+            ));
+        let rows = rows_query.build().fetch_all(pool).await?;
+        let logs = rows
+            .iter()
+            .map(request_row_from_pg)
+            .collect::<Result<Vec<_>, _>>()?
+            .iter()
+            .map(operational_log_row)
+            .collect();
+
+        Ok(Some(OperationalLogPage {
+            logs,
+            total,
+            summary,
+        }))
+    }
+
+    pub(crate) async fn dashboard_snapshot(
+        &self,
+        start_ms: u64,
+        end_ms: u64,
+        bucket_ms: u64,
+        today_start_ms: u64,
+        api_keys: (u64, u64),
+    ) -> Result<Option<DashboardLedgerSnapshot>, AppError> {
+        let LedgerBackend::Postgres(pool) = self.backend.as_ref() else {
+            return Ok(None);
+        };
+        let start_ms = i64::try_from(start_ms).unwrap_or(i64::MAX);
+        let end_ms = i64::try_from(end_ms).unwrap_or(i64::MAX);
+        let bucket_ms = i64::try_from(bucket_ms.max(1)).unwrap_or(i64::MAX);
+        let today_start_ms = i64::try_from(today_start_ms).unwrap_or(i64::MAX);
+
+        let provider_rows = sqlx::query(
+            "SELECT
+                COALESCE(provider_id, 'unrouted') AS provider_id,
+                count(*)::bigint AS requests,
+                count(*) FILTER (WHERE state = 'completed')::bigint AS successes,
+                COALESCE(sum(latency_ms), 0)::bigint AS duration_ms,
+                COALESCE(sum(input_tokens), 0)::bigint AS input_tokens,
+                COALESCE(sum(output_tokens), 0)::bigint AS output_tokens,
+                COALESCE(sum(cache_write_tokens), 0)::bigint AS cache_write_tokens,
+                COALESCE(sum(cache_read_tokens), 0)::bigint AS cache_read_tokens,
+                COALESCE(sum(cost_amount_microunits), 0)::bigint AS cost_microunits
+             FROM modelport_gateway_requests
+             WHERE state <> 'started'
+               AND traffic_class = 'business'
+               AND created_at >= to_timestamp($1::double precision / 1000.0)
+             GROUP BY COALESCE(provider_id, 'unrouted')",
+        )
+        .bind(today_start_ms)
+        .fetch_all(pool)
+        .await?;
+        let mut usage_summary = UsageSummary {
+            api_keys_total: api_keys.0,
+            api_keys_active: api_keys.1,
+            ..UsageSummary::default()
+        };
+        let mut provider_usage = BTreeMap::new();
+        let mut total_duration_ms = 0u64;
+        for row in provider_rows {
+            let requests = nonnegative_u64(row.try_get("requests")?);
+            let successes = nonnegative_u64(row.try_get("successes")?);
+            let duration_ms = nonnegative_u64(row.try_get("duration_ms")?);
+            let input_tokens = nonnegative_u64(row.try_get("input_tokens")?);
+            let output_tokens = nonnegative_u64(row.try_get("output_tokens")?);
+            let cache_write_tokens = nonnegative_u64(row.try_get("cache_write_tokens")?);
+            let cache_read_tokens = nonnegative_u64(row.try_get("cache_read_tokens")?);
+            let cost_microunits: i64 = row.try_get("cost_microunits")?;
+            usage_summary.total_requests = usage_summary.total_requests.saturating_add(requests);
+            usage_summary.total_successes = usage_summary.total_successes.saturating_add(successes);
+            usage_summary.total_input_tokens = usage_summary
+                .total_input_tokens
+                .saturating_add(input_tokens);
+            usage_summary.total_output_tokens = usage_summary
+                .total_output_tokens
+                .saturating_add(output_tokens);
+            usage_summary.total_cache_write_tokens = usage_summary
+                .total_cache_write_tokens
+                .saturating_add(cache_write_tokens);
+            usage_summary.total_cache_read_tokens = usage_summary
+                .total_cache_read_tokens
+                .saturating_add(cache_read_tokens);
+            usage_summary.total_cost_estimate += microunits_usd(cost_microunits);
+            total_duration_ms = total_duration_ms.saturating_add(duration_ms);
+            provider_usage.insert(
+                row.try_get("provider_id")?,
+                ProviderUsageStats {
+                    requests_total: requests,
+                    successes_total: successes,
+                    duration_ms_total: duration_ms,
+                    input_tokens_total: input_tokens,
+                    output_tokens_total: output_tokens,
+                    cache_write_tokens_total: cache_write_tokens,
+                    cache_read_tokens_total: cache_read_tokens,
+                    cost_estimate_usd_total: microunits_usd(cost_microunits),
+                },
+            );
+        }
+        usage_summary.average_latency_ms = total_duration_ms
+            .checked_div(usage_summary.total_requests)
+            .unwrap_or(0);
+
+        let bucket_count =
+            usize::try_from((end_ms.saturating_sub(start_ms) / bucket_ms).saturating_add(1))
+                .unwrap_or(1)
+                .max(1);
+        let mut requests = vec![0u64; bucket_count];
+        let mut errors = vec![0u64; bucket_count];
+        let mut input_tokens = vec![0u64; bucket_count];
+        let mut output_tokens = vec![0u64; bucket_count];
+        let mut cache_write_tokens = vec![0u64; bucket_count];
+        let mut cache_read_tokens = vec![0u64; bucket_count];
+        let bucket_rows = sqlx::query(
+            "SELECT
+                floor(
+                    ((EXTRACT(EPOCH FROM created_at) * 1000) - $1::double precision)
+                    / $3::double precision
+                )::bigint AS bucket_index,
+                count(*)::bigint AS requests,
+                count(*) FILTER (WHERE state <> 'completed')::bigint AS errors,
+                COALESCE(sum(input_tokens), 0)::bigint AS input_tokens,
+                COALESCE(sum(output_tokens), 0)::bigint AS output_tokens,
+                COALESCE(sum(cache_write_tokens), 0)::bigint AS cache_write_tokens,
+                COALESCE(sum(cache_read_tokens), 0)::bigint AS cache_read_tokens,
+                COALESCE(sum(cost_amount_microunits), 0)::bigint AS cost_microunits
+             FROM modelport_gateway_requests
+             WHERE state <> 'started'
+               AND traffic_class = 'business'
+               AND created_at >= to_timestamp($1::double precision / 1000.0)
+               AND created_at <= to_timestamp($2::double precision / 1000.0)
+             GROUP BY bucket_index
+             ORDER BY bucket_index",
+        )
+        .bind(start_ms)
+        .bind(end_ms)
+        .bind(bucket_ms)
+        .fetch_all(pool)
+        .await?;
+        let mut matched_requests = 0u64;
+        let mut success_requests = 0u64;
+        let mut total_input_tokens = 0u64;
+        let mut total_output_tokens = 0u64;
+        let mut total_cache_write_tokens = 0u64;
+        let mut total_cache_read_tokens = 0u64;
+        let mut total_cost_microunits = 0i64;
+        for row in bucket_rows {
+            let index = usize::try_from(row.try_get::<i64, _>("bucket_index")?)
+                .unwrap_or(bucket_count.saturating_sub(1))
+                .min(bucket_count.saturating_sub(1));
+            let row_requests = nonnegative_u64(row.try_get("requests")?);
+            let row_errors = nonnegative_u64(row.try_get("errors")?);
+            let row_input_tokens = nonnegative_u64(row.try_get("input_tokens")?);
+            let row_output_tokens = nonnegative_u64(row.try_get("output_tokens")?);
+            let row_cache_write_tokens = nonnegative_u64(row.try_get("cache_write_tokens")?);
+            let row_cache_read_tokens = nonnegative_u64(row.try_get("cache_read_tokens")?);
+            let row_cost_microunits: i64 = row.try_get("cost_microunits")?;
+            requests[index] = row_requests;
+            errors[index] = row_errors;
+            input_tokens[index] = row_input_tokens;
+            output_tokens[index] = row_output_tokens;
+            cache_write_tokens[index] = row_cache_write_tokens;
+            cache_read_tokens[index] = row_cache_read_tokens;
+            matched_requests = matched_requests.saturating_add(row_requests);
+            success_requests =
+                success_requests.saturating_add(row_requests.saturating_sub(row_errors));
+            total_input_tokens = total_input_tokens.saturating_add(row_input_tokens);
+            total_output_tokens = total_output_tokens.saturating_add(row_output_tokens);
+            total_cache_write_tokens =
+                total_cache_write_tokens.saturating_add(row_cache_write_tokens);
+            total_cache_read_tokens = total_cache_read_tokens.saturating_add(row_cache_read_tokens);
+            total_cost_microunits = total_cost_microunits.saturating_add(row_cost_microunits);
+        }
+
+        let model_rows = sqlx::query(
+            "SELECT
+                COALESCE(resolved_model, requested_model, 'unknown') AS model,
+                COALESCE(provider_id, 'unknown') AS provider,
+                count(*)::bigint AS requests,
+                COALESCE(sum(
+                    input_tokens + output_tokens + cache_write_tokens + cache_read_tokens
+                ), 0)::bigint AS tokens,
+                COALESCE(sum(cost_amount_microunits), 0)::bigint AS cost_microunits
+             FROM modelport_gateway_requests
+             WHERE state <> 'started'
+               AND traffic_class = 'business'
+               AND created_at >= to_timestamp($1::double precision / 1000.0)
+               AND created_at <= to_timestamp($2::double precision / 1000.0)
+             GROUP BY
+                COALESCE(resolved_model, requested_model, 'unknown'),
+                COALESCE(provider_id, 'unknown')
+             ORDER BY tokens DESC, requests DESC, model ASC
+             LIMIT 200",
+        )
+        .bind(start_ms)
+        .bind(end_ms)
+        .fetch_all(pool)
+        .await?;
+        let model_usage = model_rows
+            .iter()
+            .map(|row| {
+                Ok(json!({
+                    "model": row.try_get::<String, _>("model")?,
+                    "provider": row.try_get::<String, _>("provider")?,
+                    "requests": nonnegative_u64(row.try_get("requests")?),
+                    "tokens": nonnegative_u64(row.try_get("tokens")?),
+                    "cost": microunits_usd(row.try_get("cost_microunits")?),
+                }))
+            })
+            .collect::<Result<Vec<_>, sqlx::Error>>()?;
+        let request_time_series = dashboard_value_series(&requests, start_ms, bucket_ms);
+        let error_time_series = dashboard_value_series(&errors, start_ms, bucket_ms);
+        let token_time_series = (0..bucket_count)
+            .map(|index| {
+                let billed_input = input_tokens[index]
+                    .saturating_add(cache_write_tokens[index])
+                    .saturating_add(cache_read_tokens[index]);
+                json!({
+                    "timestamp": dashboard_bucket_timestamp(start_ms, bucket_ms, index),
+                    "inputTokens": input_tokens[index],
+                    "outputTokens": output_tokens[index],
+                    "cacheWriteTokens": cache_write_tokens[index],
+                    "cacheReadTokens": cache_read_tokens[index],
+                    "cacheHitRate": if billed_input == 0 {
+                        0.0
+                    } else {
+                        cache_read_tokens[index] as f64 / billed_input as f64 * 100.0
+                    },
+                })
+            })
+            .collect();
+        let total_tokens = total_input_tokens
+            .saturating_add(total_output_tokens)
+            .saturating_add(total_cache_write_tokens)
+            .saturating_add(total_cache_read_tokens);
+        let minutes = (end_ms.saturating_sub(start_ms) as f64 / 60_000.0).max(1.0);
+
+        Ok(Some(DashboardLedgerSnapshot {
+            usage_summary,
+            provider_usage,
+            matched_requests,
+            request_time_series,
+            error_time_series,
+            token_time_series,
+            model_usage,
+            summary: json!({
+                "totalRequests": matched_requests,
+                "successRequests": success_requests,
+                "totalInputTokens": total_input_tokens,
+                "totalOutputTokens": total_output_tokens,
+                "totalCacheWriteTokens": total_cache_write_tokens,
+                "totalCacheReadTokens": total_cache_read_tokens,
+                "totalTokens": total_tokens,
+                "totalCostEstimate": microunits_usd(total_cost_microunits),
+                "rpm": matched_requests as f64 / minutes,
+                "tpm": total_tokens as f64 / minutes,
+            }),
+        }))
+    }
+
+    pub(crate) async fn latency_stats_since(
+        &self,
+        since_ms: u64,
+    ) -> Result<Option<Value>, AppError> {
+        let LedgerBackend::Postgres(pool) = self.backend.as_ref() else {
+            return Ok(None);
+        };
+        let since_ms = i64::try_from(since_ms).unwrap_or(i64::MAX);
+        let overall = sqlx::query(
+            "SELECT
+                percentile_disc(0.50) WITHIN GROUP (ORDER BY latency_ms) AS p50,
+                percentile_disc(0.90) WITHIN GROUP (ORDER BY latency_ms) AS p90,
+                percentile_disc(0.95) WITHIN GROUP (ORDER BY latency_ms) AS p95,
+                percentile_disc(0.99) WITHIN GROUP (ORDER BY latency_ms) AS p99,
+                floor(COALESCE(avg(latency_ms), 0))::bigint AS avg,
+                COALESCE(max(latency_ms), 0)::bigint AS max,
+                count(*)::bigint AS count
+             FROM modelport_gateway_requests
+             WHERE state <> 'started'
+               AND created_at >= to_timestamp($1::double precision / 1000.0)",
+        )
+        .bind(since_ms)
+        .fetch_one(pool)
+        .await?;
+        let by_model_rows = sqlx::query(
+            "SELECT
+                COALESCE(resolved_model, requested_model, 'unknown') AS name,
+                percentile_disc(0.50) WITHIN GROUP (ORDER BY latency_ms) AS p50,
+                percentile_disc(0.90) WITHIN GROUP (ORDER BY latency_ms) AS p90,
+                percentile_disc(0.95) WITHIN GROUP (ORDER BY latency_ms) AS p95,
+                percentile_disc(0.99) WITHIN GROUP (ORDER BY latency_ms) AS p99,
+                floor(COALESCE(avg(latency_ms), 0))::bigint AS avg,
+                COALESCE(max(latency_ms), 0)::bigint AS max,
+                count(*)::bigint AS count
+             FROM modelport_gateway_requests
+             WHERE state <> 'started'
+               AND created_at >= to_timestamp($1::double precision / 1000.0)
+             GROUP BY COALESCE(resolved_model, requested_model, 'unknown')
+             ORDER BY count DESC
+             LIMIT 200",
+        )
+        .bind(since_ms)
+        .fetch_all(pool)
+        .await?;
+        let by_provider_rows = sqlx::query(
+            "SELECT
+                COALESCE(provider_id, 'unrouted') AS name,
+                percentile_disc(0.50) WITHIN GROUP (ORDER BY latency_ms) AS p50,
+                percentile_disc(0.90) WITHIN GROUP (ORDER BY latency_ms) AS p90,
+                percentile_disc(0.95) WITHIN GROUP (ORDER BY latency_ms) AS p95,
+                percentile_disc(0.99) WITHIN GROUP (ORDER BY latency_ms) AS p99,
+                floor(COALESCE(avg(latency_ms), 0))::bigint AS avg,
+                COALESCE(max(latency_ms), 0)::bigint AS max,
+                count(*)::bigint AS count
+             FROM modelport_gateway_requests
+             WHERE state <> 'started'
+               AND created_at >= to_timestamp($1::double precision / 1000.0)
+             GROUP BY COALESCE(provider_id, 'unrouted')
+             ORDER BY count DESC
+             LIMIT 200",
+        )
+        .bind(since_ms)
+        .fetch_all(pool)
+        .await?;
+        let grouped = |rows: Vec<PgRow>| -> Result<Value, sqlx::Error> {
+            let mut values = serde_json::Map::new();
+            for row in rows {
+                values.insert(row.try_get("name")?, latency_stats_from_pg(&row)?);
+            }
+            Ok(Value::Object(values))
+        };
+
+        Ok(Some(json!({
+            "p50": optional_nonnegative_u64(&overall, "p50")?,
+            "p90": optional_nonnegative_u64(&overall, "p90")?,
+            "p95": optional_nonnegative_u64(&overall, "p95")?,
+            "p99": optional_nonnegative_u64(&overall, "p99")?,
+            "avg": nonnegative_u64(overall.try_get("avg")?),
+            "max": nonnegative_u64(overall.try_get("max")?),
+            "byModel": grouped(by_model_rows)?,
+            "byProvider": grouped(by_provider_rows)?,
+            "sampleCount": nonnegative_u64(overall.try_get("count")?),
+            "percentilesEstimated": false,
+        })))
+    }
+
+    pub(crate) async fn usage_row(&self, ledger_id: &str) -> Result<Option<Value>, AppError> {
+        let request = match self.backend.as_ref() {
+            LedgerBackend::Memory(ledger) => {
+                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
+                ledger.requests.get(ledger_id).map(|request| {
+                    memory_request_row(
+                        ledger_id,
+                        request,
+                        usize_to_i64(
+                            ledger
+                                .attempts
+                                .values()
+                                .filter(|attempt| attempt.request_ledger_id == ledger_id)
+                                .count(),
+                        ),
+                    )
+                })
+            }
+            LedgerBackend::Postgres(pool) => sqlx::query(REQUEST_DETAIL_SQL)
+                .bind(ledger_id)
+                .fetch_optional(pool)
+                .await?
+                .as_ref()
+                .map(request_row_from_pg)
+                .transpose()?,
+        };
+        Ok(request
+            .filter(|request| request.state != "started")
+            .as_ref()
+            .map(operational_log_row))
+    }
+
+    pub(crate) async fn management_usage(&self) -> Result<ManagementUsageStats, AppError> {
+        match self.backend.as_ref() {
+            LedgerBackend::Memory(ledger) => {
+                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
+                let now = u64::try_from(now_millis()).unwrap_or(u64::MAX);
+                let day_start = current_period("daily", now).0;
+                let month_start = current_period("monthly", now).0;
+                let rolling_day_start = now.saturating_sub(24 * 60 * 60 * 1_000);
+                let mut stats = ManagementUsageStats::default();
+                for request in ledger
+                    .requests
+                    .values()
+                    .filter(|request| request.record.terminal)
+                {
+                    let created_at = u64::try_from(request.record.created_at_ms).unwrap_or(0);
+                    if created_at >= rolling_day_start {
+                        let requests = stats
+                            .users_24h
+                            .entry(request.principal_id.clone())
+                            .or_default();
+                        *requests = requests.saturating_add(1);
+                    }
+                    if let Some(api_key_id) = request.api_key_id.as_deref()
+                        && created_at >= day_start
+                    {
+                        let row = stats.api_keys.entry(api_key_id.to_owned()).or_default();
+                        row.requests_today = row.requests_today.saturating_add(1);
+                        row.tokens_today = row
+                            .tokens_today
+                            .saturating_add(request_total_tokens(&request.record));
+                    }
+                    if let Some(team_id) = request.team_id.as_deref()
+                        && created_at >= month_start
+                    {
+                        let row = stats.teams.entry(team_id.to_owned()).or_default();
+                        let cost = request
+                            .record
+                            .billable_cost_microunits
+                            .map_or(0.0, microunits_usd);
+                        row.monthly_spend_usd += cost;
+                        if created_at >= day_start {
+                            row.requests_today = row.requests_today.saturating_add(1);
+                            row.daily_spend_usd += cost;
+                        }
+                    }
+                }
+                Ok(stats)
+            }
+            LedgerBackend::Postgres(pool) => {
+                let api_key_rows = sqlx::query(
+                    "SELECT
+                        api_key_id,
+                        count(*)::bigint AS requests_today,
+                        COALESCE(sum(
+                            input_tokens + output_tokens
+                            + cache_write_tokens + cache_read_tokens
+                        ), 0)::bigint AS tokens_today
+                     FROM modelport_gateway_requests
+                     WHERE state <> 'started'
+                       AND api_key_id IS NOT NULL
+                       AND created_at >= (
+                           date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
+                       )
+                     GROUP BY api_key_id",
+                )
+                .fetch_all(pool)
+                .await?;
+                let team_rows = sqlx::query(
+                    "SELECT
+                        team_id,
+                        count(*) FILTER (
+                            WHERE created_at >= (
+                                date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
+                            )
+                        )::bigint AS requests_today,
+                        COALESCE(sum(billable_cost_microunits) FILTER (
+                            WHERE chargeable
+                              AND created_at >= (
+                                  date_trunc('day', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
+                              )
+                        ), 0)::bigint AS daily_spend_microunits,
+                        COALESCE(sum(billable_cost_microunits) FILTER (
+                            WHERE chargeable
+                        ), 0)::bigint AS monthly_spend_microunits
+                     FROM modelport_gateway_requests
+                     WHERE state <> 'started'
+                       AND team_id IS NOT NULL
+                       AND created_at >= (
+                           date_trunc('month', now() AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
+                       )
+                     GROUP BY team_id",
+                )
+                .fetch_all(pool)
+                .await?;
+                let user_rows = sqlx::query(
+                    "SELECT principal_id, count(*)::bigint AS requests_24h
+                     FROM modelport_gateway_requests
+                     WHERE state <> 'started'
+                       AND created_at >= now() - interval '24 hours'
+                     GROUP BY principal_id",
+                )
+                .fetch_all(pool)
+                .await?;
+                let mut stats = ManagementUsageStats::default();
+                for row in api_key_rows {
+                    stats.api_keys.insert(
+                        row.try_get("api_key_id")?,
+                        ApiKeyUsageStats {
+                            requests_today: nonnegative_u64(row.try_get("requests_today")?),
+                            tokens_today: nonnegative_u64(row.try_get("tokens_today")?),
+                        },
+                    );
+                }
+                for row in team_rows {
+                    stats.teams.insert(
+                        row.try_get("team_id")?,
+                        TeamUsageStats {
+                            requests_today: nonnegative_u64(row.try_get("requests_today")?),
+                            daily_spend_usd: microunits_usd(row.try_get("daily_spend_microunits")?),
+                            monthly_spend_usd: microunits_usd(
+                                row.try_get("monthly_spend_microunits")?,
+                            ),
+                        },
+                    );
+                }
+                for row in user_rows {
+                    stats.users_24h.insert(
+                        row.try_get("principal_id")?,
+                        nonnegative_u64(row.try_get("requests_24h")?),
+                    );
+                }
+                Ok(stats)
+            }
+        }
+    }
+
+    pub(crate) async fn request_detail(
+        &self,
+        ledger_id: &str,
+    ) -> Result<Option<EnterpriseRequestDetail>, AppError> {
+        match self.backend.as_ref() {
+            LedgerBackend::Memory(ledger) => {
+                let ledger = ledger.lock().expect("enterprise ledger lock poisoned");
+                let Some(request) = ledger.requests.get(ledger_id) else {
+                    return Ok(None);
+                };
+                let mut attempts = ledger
+                    .attempts
+                    .iter()
+                    .filter(|(_, attempt)| attempt.request_ledger_id == ledger_id)
+                    .map(|(attempt_id, attempt)| memory_attempt_row(attempt_id, attempt))
+                    .collect::<Vec<_>>();
+                attempts.sort_by_key(|attempt| attempt.created_at_ms);
+                Ok(Some(EnterpriseRequestDetail {
+                    request: memory_request_row(ledger_id, request, usize_to_i64(attempts.len())),
+                    attempts,
+                }))
+            }
+            LedgerBackend::Postgres(pool) => {
+                let Some(row) = sqlx::query(REQUEST_DETAIL_SQL)
+                    .bind(ledger_id)
+                    .fetch_optional(pool)
+                    .await?
+                else {
+                    return Ok(None);
+                };
+                let request = request_row_from_pg(&row)?;
+                let attempt_rows = sqlx::query(ATTEMPT_LIST_SQL)
+                    .bind(ledger_id)
+                    .fetch_all(pool)
+                    .await?;
+                Ok(Some(EnterpriseRequestDetail {
+                    request,
+                    attempts: attempt_rows
+                        .iter()
+                        .map(attempt_row_from_pg)
+                        .collect::<Result<_, _>>()?,
+                }))
+            }
+        }
+    }
+}
diff --git a/tests/scripts/lifecycle.test.mjs b/tests/scripts/lifecycle.test.mjs
new file mode 100644
index 0000000..ff22add
--- /dev/null
+++ b/tests/scripts/lifecycle.test.mjs
@@ -0,0 +1,137 @@
+import assert from 'node:assert/strict'
+import { spawn, spawnSync } from 'node:child_process'
+import { once } from 'node:events'
+import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { test } from 'node:test'
+
+const scripts = fileURLToPath(new URL('../../scripts', import.meta.url))
+
+function fixture(t) {
+  const root = mkdtempSync(join(tmpdir(), 'modelport lifecycle '))
+  t.after(() => rmSync(root, { recursive: true, force: true }))
+  cpSync(scripts, join(root, 'scripts'), { recursive: true })
+  mkdirSync(join(root, '.modelport'))
+  mkdirSync(join(root, 'bin'))
+  const commands = join(root, 'commands.log')
+  const env = { ...process.env, PATH: `${join(root, 'bin')}:${process.env.PATH}`,
+    MODELPORT_ENV_FILE: join(root, '.env'), MODELPORT_RUNTIME_DIR: join(root, '.modelport'),
+    MODELPORT_PID_FILE: join(root, '.modelport/model-port.pid'),
+    MODELPORT_TEST_COMMAND_LOG: commands,
+  }
+  writeFileSync(env.MODELPORT_ENV_FILE, 'MODELPORT_BIND=127.0.0.1:38082\nMODELPORT_AUTH_TOKEN=local-test-token\n')
+  function executable(name, source) {
+    writeFileSync(join(root, 'bin', name), `#!/usr/bin/env bash\n${source}\n`, { mode: 0o755 })
+  }
+  executable('curl', 'exit 1')
+  executable('cargo', 'printf "%s|%s\\n" "$PWD" "$*" >> "$MODELPORT_TEST_COMMAND_LOG"')
+  function run(args, legacy) {
+    const result = spawnSync('bash', [join(root, 'scripts', legacy || 'dev.sh'), ...args], {
+      cwd: tmpdir(), env, encoding: 'utf8', timeout: 5000,
+    })
+    assert.ifError(result.error)
+    return result
+  }
+  return { root, env, run, executable, commands }
+}
+
+async function nativeProcess(t, root) {
+  const binary = join(root, 'target/release/model-port')
+  mkdirSync(dirname(binary), { recursive: true })
+  copyFileSync('/bin/sleep', binary)
+  chmodSync(binary, 0o755)
+  const child = spawn(binary, ['120'], { stdio: 'ignore' })
+  await once(child, 'spawn')
+  t.after(async () => {
+    if (child.exitCode === null && child.signalCode === null) {
+      const exited = once(child, 'exit')
+      child.kill('SIGKILL')
+      await exited
+    }
+  })
+  return { child, binary }
+}
+
+function alive(pid) {
+  try { process.kill(pid, 0); return true } catch { return false }
+}
+
+test('help and invalid commands do not need configuration or launch Cargo', t => {
+  const { run, env, commands } = fixture(t)
+  rmSync(env.MODELPORT_ENV_FILE)
+  assert.equal(run(['help']).status, 0)
+  assert.equal(run(['statuz']).status, 1)
+  assert.equal(run(['start', '--unexpected']).status, 1)
+  assert.equal(existsSync(commands), false)
+})
+
+test('foreground, validation and Rust checks run in this checkout from another directory', t => {
+  const { run, root, commands, env } = fixture(t)
+  assert.equal(run([]).status, 0)
+  env.MODELPORT_FORCE_BUILD = '1'
+  assert.equal(run(['validate']).status, 0)
+  assert.equal(run(['check', '--backend']).status, 0)
+  assert.deepEqual(readFileSync(commands, 'utf8').trim().split('\n'), [
+    `${root}|run --locked --bin model-port`,
+    `${root}|run --locked --bin model-port -- config validate`,
+    `${root}|fmt --all -- --check`,
+    `${root}|test --locked --all-targets`,
+    `${root}|clippy --locked --all-targets --all-features -- -D warnings`,
+  ])
+})
+
+test('stop owns its checkout even when a stale PID and listener point to another checkout', async t => {
+  const current = fixture(t)
+  const other = fixture(t)
+  const foreign = await nativeProcess(t, other.root)
+  const own = await nativeProcess(t, current.root)
+  writeFileSync(current.env.MODELPORT_PID_FILE, String(foreign.child.pid))
+  current.executable('ss', `echo 'LISTEN 0 128 127.0.0.1:38082 0.0.0.0:* users:(("model-port",pid=${foreign.child.pid},fd=3))'`)
+  const ownExit = once(own.child, 'exit')
+  const result = current.run(['stop'])
+  assert.equal(result.status, 0, result.stderr)
+  await ownExit
+  assert.equal(alive(foreign.child.pid), true)
+  assert.equal(existsSync(current.env.MODELPORT_PID_FILE), false)
+  assert.match(result.stdout, /does not belong to this checkout/)
+})
+
+test('legacy stop leaves a foreign listener and its process untouched', async t => {
+  const current = fixture(t)
+  const other = fixture(t)
+  const foreign = await nativeProcess(t, other.root)
+  current.executable('ss', `echo 'LISTEN 0 128 127.0.0.1:38082 0.0.0.0:* users:(("model-port",pid=${foreign.child.pid},fd=3))'`)
+  assert.equal(current.run([], 'stop.sh').status, 0)
+  assert.equal(alive(foreign.child.pid), true)
+})
+
+test('a replaced binary can still be stopped by executable ownership', async t => {
+  const current = fixture(t)
+  const own = await nativeProcess(t, current.root)
+  rmSync(own.binary)
+  const exited = once(own.child, 'exit')
+  assert.equal(current.run(['stop']).status, 0)
+  await exited
+})
+
+test('start refuses a second native process when the existing one is unhealthy', async t => {
+  const current = fixture(t)
+  const own = await nativeProcess(t, current.root)
+  writeFileSync(current.env.MODELPORT_PID_FILE, String(own.child.pid))
+  const result = current.run([], 'start.sh')
+  assert.equal(result.status, 1)
+  assert.match(result.stderr, /already has a running gateway/)
+  assert.equal(alive(own.child.pid), true)
+  assert.equal(existsSync(current.commands), false)
+})
+
+test('start identifies a responding endpoint outside this checkout without building', t => {
+  const current = fixture(t)
+  current.executable('curl', 'exit 0')
+  const result = current.run(['start'])
+  assert.equal(result.status, 1)
+  assert.match(result.stderr, /not managed by this checkout/)
+  assert.equal(existsSync(current.commands), false)
+})