diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index d24b483..f1b2cbd 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -19,6 +19,7 @@ jobs:
           npm ci
           npm run build
           cd dist && zip -qr ../dist.zip . && cd ..
+          sha256sum dist.zip > dist.zip.sha256
 
       - name: 提取 CHANGELOG 版本段作为 Release 描述
         run: |
@@ -31,4 +32,6 @@ jobs:
         with:
           token: ${{ secrets.BUILD_TOKEN }}
           body_path: release-notes.md
-          files: dist.zip
+          files: |
+            dist.zip
+            dist.zip.sha256
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63de34f..65e4a14 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,7 @@ jobs:
           npm ci
           npm run build
           cd dist && zip -qr ../dist.zip . && cd ..
+          sha256sum dist.zip > dist.zip.sha256
           ls -lh dist.zip
 
       - name: 提取 CHANGELOG 版本段作为 Release 描述
@@ -37,4 +38,6 @@ jobs:
         with:
           token: ${{ github.token }}
           body_path: release-notes.md
-          files: dist.zip
+          files: |
+            dist.zip
+            dist.zip.sha256
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a986a9..791a7de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,28 @@
 
 格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循语义化版本。
 
+## [0.1.0] - 2026-07-10
+
+### Added
+
+- 设置页「通知渠道」卡片：Webhook（Slack / 飞书 / 钉钉 / 企微预设）、ntfy、Bark、SMTP 与 Telegram 五渠道管理
+- 日志页审计告警规则管理：列表、组合匹配表单与通知模板入口
+- 账号安全新增「撤销全部会话」入口
+- 租户暂停状态三态展示（详情 / 列表 / 总览）
+
+### Changed
+
+- 实例详情 root 密码默认掩码、点击查看；串口控制台移除「复制 root 密码」
+- 修改登录凭据后当前会话无感续期；其余敏感操作同样自动换用新令牌
+- 域选择器仅显示域名（去除许可类型后缀）
+
+### Fixed
+
+- 明暗主题扩散切换时的闪烁
+- 任务表单数字输入框在 small 尺寸下步进按钮溢出
+- 租户详情「用户」「策略」等 Tab 切换域后内容不刷新
+- 实例详情区块加载中时禁用头部操作按钮，防误点
+
 ## [0.0.1] - 2026-07-09
 
 首个版本：OCI Portal 前端。
diff --git a/src/api/auth.ts b/src/api/auth.ts
index 4289b8e..4bdae8e 100644
--- a/src/api/auth.ts
+++ b/src/api/auth.ts
@@ -5,6 +5,7 @@ import type {
   LoginRequest,
   LoginResponse,
   OAuthSettings,
+  SessionRefresh,
   TotpSetup,
   TotpStatus,
   UpdateCredentialsRequest,
@@ -26,6 +27,14 @@ export function logout(): Promise<void> {
   return request('/auth/logout', { method: 'POST' })
 }
 
+// ---- 会话 ----
+
+/** 撤销全部会话:旧 token 全部失效,响应带操作者的新会话 */
+export function revokeSessions(): Promise<SessionRefresh> {
+  if (mockOn) return mocked({ token: 'mock-token-2', expiresAt: '2099-01-01T00:00:00Z' }, 300)
+  return request('/auth/revoke-sessions', { method: 'POST' })
+}
+
 // ---- 登录凭据 ----
 
 export function getCredentials(): Promise<CredentialsInfo> {
@@ -33,15 +42,15 @@ export function getCredentials(): Promise<CredentialsInfo> {
   return request('/auth/credentials')
 }
 
-/** 修改用户名 / 密码;成功后旧 token 随即失效,调用方应登出重登 */
-export function updateCredentials(body: UpdateCredentialsRequest): Promise<void> {
-  if (mockOn) return mocked(undefined, 400)
+/** 修改用户名 / 密码;成功后旧 token 全部失效,响应带操作者的新会话 */
+export function updateCredentials(body: UpdateCredentialsRequest): Promise<SessionRefresh> {
+  if (mockOn) return mocked({ token: 'mock-token-2', expiresAt: '2099-01-01T00:00:00Z' }, 400)
   return request('/auth/credentials', { method: 'PUT', body })
 }
 
-/** 保存密码登录禁用开关;开启要求至少绑定一个外部身份(后端 409) */
-export function updatePasswordLogin(disabled: boolean): Promise<void> {
-  if (mockOn) return mocked(undefined, 300)
+/** 保存密码登录禁用开关;成功后旧 token 全部失效,响应带新会话 */
+export function updatePasswordLogin(disabled: boolean): Promise<SessionRefresh> {
+  if (mockOn) return mocked({ token: 'mock-token-2', expiresAt: '2099-01-01T00:00:00Z' }, 300)
   return request('/auth/password-login', { method: 'PUT', body: { disabled } })
 }
 
@@ -62,14 +71,15 @@ export function setupTotp(): Promise<TotpSetup> {
   return request('/auth/totp/setup', { method: 'POST' })
 }
 
-export function activateTotp(code: string): Promise<void> {
-  if (mockOn) return mocked(undefined, 300)
+/** 激活两步验证;成功后旧 token 全部失效,响应带新会话 */
+export function activateTotp(code: string): Promise<SessionRefresh> {
+  if (mockOn) return mocked({ token: 'mock-token-2', expiresAt: '2099-01-01T00:00:00Z' }, 300)
   return request('/auth/totp/activate', { method: 'POST', body: { code } })
 }
 
-/** 停用两步验证;密码或当前验证码任一确认 */
-export function disableTotp(body: { password?: string; code?: string }): Promise<void> {
-  if (mockOn) return mocked(undefined, 300)
+/** 停用两步验证;密码或当前验证码任一确认,响应带新会话 */
+export function disableTotp(body: { password?: string; code?: string }): Promise<SessionRefresh> {
+  if (mockOn) return mocked({ token: 'mock-token-2', expiresAt: '2099-01-01T00:00:00Z' }, 300)
   return request('/auth/totp/disable', { method: 'POST', body })
 }
 
@@ -92,7 +102,7 @@ export function getOauthProviders(): Promise<{
   return request('/auth/oauth/providers')
 }
 
-/** 获取授权跳转 URL;bind 模式要求已登录(带 JWT) */
+/** 获取授权跳转 URL;bind 模式要求已登录 */
 export function getOauthAuthorizeUrl(
   provider: string,
   mode: 'login' | 'bind',
@@ -111,8 +121,9 @@ export function listIdentities(): Promise<{ items: UserIdentityInfo[] }> {
   return request('/auth/identities')
 }
 
-export function unbindIdentity(id: number): Promise<void> {
-  if (mockOn) return mocked(undefined, 300)
+/** 解绑外部身份;成功后旧 token 全部失效,响应带新会话 */
+export function unbindIdentity(id: number): Promise<SessionRefresh> {
+  if (mockOn) return mocked({ token: 'mock-token-2', expiresAt: '2099-01-01T00:00:00Z' }, 300)
   return request(`/auth/identities/${id}`, { method: 'DELETE' })
 }
 
diff --git a/src/api/logevents.ts b/src/api/logevents.ts
index e07d61a..67e8b33 100644
--- a/src/api/logevents.ts
+++ b/src/api/logevents.ts
@@ -1,6 +1,13 @@
 import { mockLogEvents, mockLogRelays, mockLogWebhooks } from './mock'
 import { mockOn, mocked, request } from './request'
-import type { LogEventPage, LogRelayView, LogWebhookInfo, LogWebhookState } from '@/types/api'
+import type {
+  AlertRule,
+  AlertRuleBody,
+  LogEventPage,
+  LogRelayView,
+  LogWebhookInfo,
+  LogWebhookState,
+} from '@/types/api'
 
 export interface LogEventParams {
   page: number
@@ -23,6 +30,27 @@ export function listLogEvents(params: LogEventParams): Promise<LogEventPage> {
   return request('/log-events', { query: { ...params } })
 }
 
+// ---- 告警规则 ----
+export function listAlertRules(): Promise<AlertRule[]> {
+  if (mockOn) return mocked([])
+  return request<{ items: AlertRule[] }>('/log-events/alert-rules').then((r) => r.items)
+}
+
+export function createAlertRule(body: AlertRuleBody): Promise<AlertRule> {
+  if (mockOn) return mocked({ ...body, id: 1, createdAt: '', updatedAt: '' }, 300)
+  return request('/log-events/alert-rules', { method: 'POST', body })
+}
+
+export function updateAlertRule(id: number, body: AlertRuleBody): Promise<AlertRule> {
+  if (mockOn) return mocked({ ...body, id, createdAt: '', updatedAt: '' }, 300)
+  return request(`/log-events/alert-rules/${id}`, { method: 'PUT', body })
+}
+
+export function deleteAlertRule(id: number): Promise<void> {
+  if (mockOn) return mocked(undefined, 300)
+  return request(`/log-events/alert-rules/${id}`, { method: 'DELETE' })
+}
+
 export function getLogWebhook(cfgId: number): Promise<LogWebhookState> {
   if (mockOn) {
     const info = mockLogWebhooks.get(cfgId)
diff --git a/src/api/request.ts b/src/api/request.ts
index d4b7706..2aa26a9 100644
--- a/src/api/request.ts
+++ b/src/api/request.ts
@@ -15,6 +15,8 @@ interface RequestOptions {
   method?: string
   body?: unknown
   query?: Record<string, string | number | boolean | undefined>
+  /** 附加请求头 */
+  headers?: Record<string, string>
 }
 
 function buildUrl(path: string, query?: RequestOptions['query']): string {
@@ -46,7 +48,7 @@ async function parseError(resp: Response): Promise<never> {
 /** 统一请求封装：注入 JWT、401 登出、错误转 ApiError */
 export async function request<T>(path: string, opts: RequestOptions = {}): Promise<T> {
   const auth = useAuthStore()
-  const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+  const headers: Record<string, string> = { 'Content-Type': 'application/json', ...opts.headers }
   if (auth.token) headers.Authorization = `Bearer ${auth.token}`
   const resp = await fetch(buildUrl(path, opts.query), {
     method: opts.method ?? 'GET',
diff --git a/src/api/settings.ts b/src/api/settings.ts
index 4ba8f26..c574d7a 100644
--- a/src/api/settings.ts
+++ b/src/api/settings.ts
@@ -8,12 +8,15 @@ import {
 import { mockOn, mocked, request } from './request'
 import type {
   AboutInfo,
+  NotifyChannelItem,
+  NotifyChannelType,
   NotifyEventsSetting,
   NotifyTemplateItem,
   SecuritySetting,
   SystemLogPage,
   TaskSetting,
   TelegramSetting,
+  UpdateNotifyChannelBody,
 } from '@/types/api'
 
 export function getTelegramSetting(): Promise<TelegramSetting> {
@@ -46,6 +49,37 @@ export function testTelegram(): Promise<void> {
   return request('/settings/telegram/test', { method: 'POST' })
 }
 
+/** 通知渠道(webhook/ntfy/bark/smtp)脱敏视图列表 */
+export function listNotifyChannels(): Promise<NotifyChannelItem[]> {
+  if (mockOn)
+    return mocked(
+      (['webhook', 'ntfy', 'bark', 'smtp'] as NotifyChannelType[]).map((type) => ({
+        type,
+        enabled: false,
+        secretSet: false,
+      })),
+    )
+  return request<{ items: NotifyChannelItem[] }>('/settings/notify-channels').then((r) => r.items)
+}
+
+/** 保存单渠道配置,返回全渠道最新视图 */
+export function updateNotifyChannel(
+  type: NotifyChannelType,
+  body: UpdateNotifyChannelBody,
+): Promise<NotifyChannelItem[]> {
+  if (mockOn) return mocked([], 400)
+  return request<{ items: NotifyChannelItem[] }>(`/settings/notify-channels/${type}`, {
+    method: 'PUT',
+    body,
+  }).then((r) => r.items)
+}
+
+/** 向指定渠道发送测试消息(用已保存配置,不看启用开关) */
+export function testNotifyChannel(type: NotifyChannelType): Promise<void> {
+  if (mockOn) return mocked(undefined, 800)
+  return request(`/settings/notify-channels/${type}/test`, { method: 'POST' })
+}
+
 export function getNotifyEvents(): Promise<NotifyEventsSetting> {
   if (mockOn) return mocked({ ...mockNotifyEvents })
   return request('/settings/notify-events')
diff --git a/src/api/tenant.ts b/src/api/tenant.ts
index 923dc70..2ed45a3 100644
--- a/src/api/tenant.ts
+++ b/src/api/tenant.ts
@@ -14,6 +14,7 @@ import { mockOn, mocked, request } from './request'
 import type {
   AuditEventsResult,
   IamUser,
+  IdentityDomain,
   IamUserDetail,
   IdentityProvider,
   IdentitySetting,
@@ -83,14 +84,25 @@ export function getSubscription(id: number, subscriptionId: string): Promise<Sub
   return request(`/oci-configs/${id}/subscriptions/${subscriptionId}`)
 }
 
+// ---- 身份域 ----
+/** 租户 ACTIVE 身份域列表;空数组表示无域老租户(隐藏选择器走经典路径) */
+export function listIdentityDomains(id: number): Promise<IdentityDomain[]> {
+  if (mockOn)
+    return mocked([
+      { id: 'ocid1.domain.default', displayName: 'Default', homeRegion: 'us-phoenix-1', type: 'DEFAULT', licenseType: 'free' },
+      { id: 'ocid1.domain.idcs', displayName: 'OracleIdentityCloudService', homeRegion: 'us-phoenix-1', type: 'SECONDARY', licenseType: 'idcs-foundation' },
+    ])
+  return request(`/oci-configs/${id}/domains`)
+}
+
 // ---- 用户 ----
-export function listUsers(id: number): Promise<IamUser[]> {
+export function listUsers(id: number, domainId?: string): Promise<IamUser[]> {
   if (mockOn) return mocked(mockUsers)
-  return request(`/oci-configs/${id}/users`)
+  return request(`/oci-configs/${id}/users`, { query: { domainId } })
 }
 
 // 编辑表单预填充用;不在身份域的经典用户返回 inDomain: false
-export function getUserDetail(id: number, userId: string): Promise<IamUserDetail> {
+export function getUserDetail(id: number, userId: string, domainId?: string): Promise<IamUserDetail> {
   if (mockOn)
     return mocked(
       mockUserDetails[userId] ?? {
@@ -101,7 +113,7 @@ export function getUserDetail(id: number, userId: string): Promise<IamUserDetail
         inAdminGroup: false,
       },
     )
-  return request(`/oci-configs/${id}/users/${userId}`)
+  return request(`/oci-configs/${id}/users/${userId}`, { query: { domainId } })
 }
 
 export interface CreateUserBody {
@@ -115,10 +127,10 @@ export interface CreateUserBody {
   addToAdminGroup?: boolean
 }
 
-export function createUser(id: number, body: CreateUserBody): Promise<IamUser> {
+export function createUser(id: number, body: CreateUserBody, domainId?: string): Promise<IamUser> {
   if (mockOn)
     return mocked({ ...mockUsers[2], id: 'ocid1.user..new', name: body.name, email: body.email ?? '' })
-  return request(`/oci-configs/${id}/users`, { method: 'POST', body })
+  return request(`/oci-configs/${id}/users`, { method: 'POST', body, query: { domainId } })
 }
 
 export interface UpdateUserBody {
@@ -131,29 +143,29 @@ export interface UpdateUserBody {
   addToAdminGroup?: boolean
 }
 
-export function updateUser(id: number, userId: string, body: UpdateUserBody): Promise<IamUser> {
+export function updateUser(id: number, userId: string, body: UpdateUserBody, domainId?: string): Promise<IamUser> {
   if (mockOn) {
     const u = mockUsers.find((x) => x.id === userId) ?? mockUsers[2]
     if (body.description !== undefined) u.description = body.description
     if (body.email !== undefined) u.email = body.email
     return mocked({ ...u })
   }
-  return request(`/oci-configs/${id}/users/${userId}`, { method: 'PUT', body })
+  return request(`/oci-configs/${id}/users/${userId}`, { method: 'PUT', body, query: { domainId } })
 }
 
-export function deleteUser(id: number, userId: string): Promise<void> {
+export function deleteUser(id: number, userId: string, domainId?: string): Promise<void> {
   if (mockOn) return mocked(undefined)
-  return request(`/oci-configs/${id}/users/${userId}`, { method: 'DELETE' })
+  return request(`/oci-configs/${id}/users/${userId}`, { method: 'DELETE', query: { domainId } })
 }
 
-export function resetUserPassword(id: number, userId: string): Promise<{ password: string }> {
+export function resetUserPassword(id: number, userId: string, domainId?: string): Promise<{ password: string }> {
   if (mockOn) return mocked({ password: 'Xy9#kQ2m$Lp8' })
-  return request(`/oci-configs/${id}/users/${userId}/reset-password`, { method: 'POST' })
+  return request(`/oci-configs/${id}/users/${userId}/reset-password`, { method: 'POST', query: { domainId } })
 }
 
-export function clearUserMfa(id: number, userId: string): Promise<{ deletedTotpDevices: number }> {
+export function clearUserMfa(id: number, userId: string, domainId?: string): Promise<{ deletedTotpDevices: number }> {
   if (mockOn) return mocked({ deletedTotpDevices: 1 })
-  return request(`/oci-configs/${id}/users/${userId}/mfa-devices`, { method: 'DELETE' })
+  return request(`/oci-configs/${id}/users/${userId}/mfa-devices`, { method: 'DELETE', query: { domainId } })
 }
 
 export function deleteUserApiKeys(
@@ -169,26 +181,19 @@ export function deleteUserApiKeys(
 }
 
 // ---- 审计日志 ----
-/** 实时查询租户 OCI 审计事件:hours ∈ [1,72] 首查;
- *  截断续查传上次响应的 start/end 与 nextPage(绝对窗+游标断点续翻) */
+/** 批式懒加载查询审计事件:cursor 空自当前时刻首查,
+ *  非空从上次响应游标向更早续取一批(~100 条,服务端分窗回溯) */
 export function listAuditEvents(
   id: number,
-  opts: { hours?: number; region?: string; start?: string; end?: string; page?: string } = {},
+  opts: { region?: string; cursor?: string; limit?: number } = {},
 ): Promise<AuditEventsResult> {
-  // mock 下选 1 小时窗演示截断提示
+  // mock:首批带游标,续查一批后到尽头,演示懒加载链路
   if (mockOn)
     return mocked(
-      {
-        items: mockAuditEvents,
-        truncated: opts.hours === 1,
-        start: '2026-07-06T10:00:00Z',
-        end: '2026-07-07T10:00:00Z',
-      },
+      { items: mockAuditEvents, cursor: opts.cursor ? undefined : 'mock-cursor', exhausted: !!opts.cursor },
       300,
     )
-  const { hours = 24, region, start, end, page } = opts
-  const query = start && end ? { region, start, end, page } : { hours, region }
-  return request(`/oci-configs/${id}/audit-events`, { query })
+  return request(`/oci-configs/${id}/audit-events`, { query: { ...opts } })
 }
 
 /** 取回单条审计事件的原始 JSON;404 表示缓存过期且重查未找回(前端降级展示精简字段) */
@@ -201,45 +206,49 @@ export function getAuditEventDetail(
 }
 
 // ---- 域设置 ----
-export function getNotificationRecipients(id: number): Promise<NotificationRecipients> {
+export function getNotificationRecipients(id: number, domainId?: string): Promise<NotificationRecipients> {
   if (mockOn) return mocked(mockRecipients)
-  return request(`/oci-configs/${id}/notification-recipients`)
+  return request(`/oci-configs/${id}/notification-recipients`, { query: { domainId } })
 }
 
 export function updateNotificationRecipients(
   id: number,
   recipients: string[],
+  domainId?: string,
 ): Promise<NotificationRecipients> {
   if (mockOn) return mocked({ recipients, testModeEnabled: recipients.length > 0 })
   return request(`/oci-configs/${id}/notification-recipients`, {
     method: 'PUT',
     body: { recipients },
+    query: { domainId },
   })
 }
 
-export function listPasswordPolicies(id: number): Promise<PasswordPolicy[]> {
+export function listPasswordPolicies(id: number, domainId?: string): Promise<PasswordPolicy[]> {
   if (mockOn) return mocked(mockPolicies)
-  return request(`/oci-configs/${id}/password-policies`)
+  return request(`/oci-configs/${id}/password-policies`, { query: { domainId } })
 }
 
 export function updatePasswordPolicy(
   id: number,
   policyId: string,
   body: { passwordExpiresAfter?: number; minLength?: number; numPasswordsInHistory?: number },
+  domainId?: string,
 ): Promise<PasswordPolicy> {
   if (mockOn) return mocked({ ...mockPolicies[0], ...body })
-  return request(`/oci-configs/${id}/password-policies/${policyId}`, { method: 'PUT', body })
+  return request(`/oci-configs/${id}/password-policies/${policyId}`, { method: 'PUT', body, query: { domainId } })
 }
 
 // ---- 身份设置 ----
-export function getIdentitySetting(id: number): Promise<IdentitySetting> {
+export function getIdentitySetting(id: number, domainId?: string): Promise<IdentitySetting> {
   if (mockOn) return mocked({ ...mockIdentitySetting })
-  return request(`/oci-configs/${id}/identity-settings`)
+  return request(`/oci-configs/${id}/identity-settings`, { query: { domainId } })
 }
 
 export function updateIdentitySetting(
   id: number,
   primaryEmailRequired: boolean,
+  domainId?: string,
 ): Promise<IdentitySetting> {
   if (mockOn) {
     mockIdentitySetting.primaryEmailRequired = primaryEmailRequired
@@ -248,10 +257,11 @@ export function updateIdentitySetting(
   return request(`/oci-configs/${id}/identity-settings`, {
     method: 'PUT',
     body: { primaryEmailRequired },
+    query: { domainId },
   })
 }
 
-export async function downloadSamlMetadata(id: number): Promise<void> {
+export async function downloadSamlMetadata(id: number, domainId?: string): Promise<void> {
   if (mockOn) {
     const blob = new Blob(['<mock-saml-metadata/>'], { type: 'application/xml' })
     triggerDownload(blob, 'oci-domain-saml-metadata.xml')
@@ -259,7 +269,8 @@ export async function downloadSamlMetadata(id: number): Promise<void> {
   }
   const { useAuthStore } = await import('@/stores/auth')
   const auth = useAuthStore()
-  const resp = await fetch(`/api/v1/oci-configs/${id}/saml-metadata`, {
+  const qs = domainId ? `?domainId=${encodeURIComponent(domainId)}` : ''
+  const resp = await fetch(`/api/v1/oci-configs/${id}/saml-metadata${qs}`, {
     headers: auth.token ? { Authorization: `Bearer ${auth.token}` } : {},
   })
   if (!resp.ok) throw new Error(`下载失败（${resp.status}）`)
@@ -293,7 +304,7 @@ export interface CreateIdpBody {
   jitMapEmail?: boolean
 }
 
-export function createIdp(id: number, body: CreateIdpBody): Promise<IdentityProvider> {
+export function createIdp(id: number, body: CreateIdpBody, domainId?: string): Promise<IdentityProvider> {
   if (mockOn) {
     const created = {
       ...mockIdps[1],
@@ -304,41 +315,43 @@ export function createIdp(id: number, body: CreateIdpBody): Promise<IdentityProv
     mockIdps.push(created)
     return mocked(created, 900)
   }
-  return request(`/oci-configs/${id}/identity-providers`, { method: 'POST', body })
+  return request(`/oci-configs/${id}/identity-providers`, { method: 'POST', body, query: { domainId } })
 }
 
-export function listIdps(id: number): Promise<IdentityProvider[]> {
+export function listIdps(id: number, domainId?: string): Promise<IdentityProvider[]> {
   if (mockOn) return mocked(mockIdps)
-  return request(`/oci-configs/${id}/identity-providers`)
+  return request(`/oci-configs/${id}/identity-providers`, { query: { domainId } })
 }
 
-export function activateIdp(id: number, idpId: string, enabled: boolean): Promise<IdentityProvider> {
+export function activateIdp(id: number, idpId: string, enabled: boolean, domainId?: string): Promise<IdentityProvider> {
   if (mockOn) return mocked({ ...mockIdps[0], enabled })
   return request(`/oci-configs/${id}/identity-providers/${idpId}/activate`, {
     method: 'POST',
     body: { enabled },
+    query: { domainId },
   })
 }
 
-export function deleteIdp(id: number, idpId: string): Promise<void> {
+export function deleteIdp(id: number, idpId: string, domainId?: string): Promise<void> {
   if (mockOn) return mocked(undefined)
-  return request(`/oci-configs/${id}/identity-providers/${idpId}`, { method: 'DELETE' })
+  return request(`/oci-configs/${id}/identity-providers/${idpId}`, { method: 'DELETE', query: { domainId } })
 }
 
-export function listSignOnRules(id: number): Promise<SignOnRule[]> {
+export function listSignOnRules(id: number, domainId?: string): Promise<SignOnRule[]> {
   if (mockOn) return mocked(mockSignOnRules)
-  return request(`/oci-configs/${id}/sign-on-rules`)
+  return request(`/oci-configs/${id}/sign-on-rules`, { query: { domainId } })
 }
 
-export function createSignOnExemption(id: number, identityProviderId: string): Promise<SignOnRule> {
+export function createSignOnExemption(id: number, identityProviderId: string, domainId?: string): Promise<SignOnRule> {
   if (mockOn) return mocked(mockSignOnRules[0])
   return request(`/oci-configs/${id}/sign-on-exemptions`, {
     method: 'POST',
     body: { identityProviderId },
+    query: { domainId },
   })
 }
 
-export function deleteSignOnExemption(id: number, ruleId: string): Promise<void> {
+export function deleteSignOnExemption(id: number, ruleId: string, domainId?: string): Promise<void> {
   if (mockOn) return mocked(undefined)
-  return request(`/oci-configs/${id}/sign-on-exemptions/${ruleId}`, { method: 'DELETE' })
+  return request(`/oci-configs/${id}/sign-on-exemptions/${ruleId}`, { method: 'DELETE', query: { domainId } })
 }
diff --git a/src/assets/main.css b/src/assets/main.css
index fb90bcc..0168434 100644
--- a/src/assets/main.css
+++ b/src/assets/main.css
@@ -136,7 +136,9 @@ body {
   width: 26px;
   margin: 0;
   display: grid;
-  grid-template-rows: 1fr 1fr;
+  /* minmax(0,…) 允许行收缩:small 尺寸下按钮固有高度(18px)大于半行,
+     1fr 的隐式 min-height:auto 会把行撑爆,下箭头溢出框外 */
+  grid-template-rows: minmax(0, 1fr) minmax(0, 1fr);
   border-left: 1px solid var(--color-line-soft);
 }
 .app-input-number .n-input__suffix > :last-child {
@@ -158,6 +160,7 @@ body {
   --n-text-color-focus: var(--color-ink);
   width: 100%;
   height: 100%;
+  min-height: 0;
   border-radius: inherit;
   color: var(--color-ink-3);
 }
@@ -258,3 +261,25 @@ body {
     }
   }
 }
+
+/* 明暗主题扩散切换(useThemeRipple):关掉 View Transitions 默认交叉淡入,
+   由 JS 在 ::view-transition-new(root) 上做以触发点为圆心的 clip-path 揭示;
+   旧快照垫底不动,blend 还原为普通覆盖,避免半透明混色。 */
+::view-transition-old(root),
+::view-transition-new(root) {
+  animation: none;
+  mix-blend-mode: normal;
+}
+::view-transition-old(root) {
+  z-index: 1;
+}
+::view-transition-new(root) {
+  z-index: 2;
+}
+/* 扩散进行中禁掉页面自身的过渡:new 快照是实时层,Naive 等组件的
+   0.3s 颜色渐变会在扩散圆内继续播放,叠加揭示动画表现为闪烁/渗色。 */
+html.theme-switching *,
+html.theme-switching *::before,
+html.theme-switching *::after {
+  transition: none !important;
+}
diff --git a/src/components/AppLogo.vue b/src/components/AppLogo.vue
index 87c56b9..6f5c7bc 100644
--- a/src/components/AppLogo.vue
+++ b/src/components/AppLogo.vue
@@ -1,30 +1,98 @@
 <script setup lang="ts">
-// 项目 logo:星爆贴纸(波普风,十二角星爆 + O!)。
-// 固定品牌色值不走 CSS 变量——favicon 与深浅主题共用同一套颜色。
+// 项目 logo:波普贴纸,双款式跟随 app store(burst 星爆 / seal 波浪封印,
+// 设置 · 关于点击 logo 切换)。固定品牌色值不走 CSS 变量——favicon 与深浅主题共用同一套颜色。
+import { computed } from 'vue'
+
+import { useAppStore } from '@/stores/app'
+
 withDefaults(defineProps<{ size?: number }>(), { size: 48 })
 
 const BURST =
   'M24 5 L27.9 9.5 L33.5 7.5 L34.6 13.4 L40.5 14.5 L38.5 20.1 L43 24 L38.5 27.9 ' +
   'L40.5 33.5 L34.6 34.6 L33.5 40.5 L27.9 38.5 L24 43 L20.1 38.5 L14.5 40.5 L13.4 34.6 ' +
   'L7.5 33.5 L9.5 27.9 L5 24 L9.5 20.1 L7.5 14.5 L13.4 13.4 L14.5 7.5 L20.1 9.5 Z'
+// 十二瓣扇贝圆(经典价签贴纸),内圈虚线封印
+const SEAL =
+  'M39.5 19.9 A5.8 5.8 0 0 0 35.3 12.7 A5.8 5.8 0 0 0 28.1 8.5 A5.8 5.8 0 0 0 19.9 8.5 ' +
+  'A5.8 5.8 0 0 0 12.7 12.7 A5.8 5.8 0 0 0 8.5 19.9 A5.8 5.8 0 0 0 8.5 28.1 ' +
+  'A5.8 5.8 0 0 0 12.7 35.3 A5.8 5.8 0 0 0 19.9 39.5 A5.8 5.8 0 0 0 28.1 39.5 ' +
+  'A5.8 5.8 0 0 0 35.3 35.3 A5.8 5.8 0 0 0 39.5 28.1 A5.8 5.8 0 0 0 39.5 19.9 Z'
+
+const VARIANTS = {
+  burst: { d: BURST, strokeWidth: 2.6, textY: 28.8, fontSize: 13, ring: false },
+  seal: { d: SEAL, strokeWidth: 2.4, textY: 28.6, fontSize: 12.5, ring: true },
+} as const
+
+const app = useAppStore()
+const v = computed(() => VARIANTS[app.logoVariant])
 </script>
 
 <template>
-  <svg :width="size" :height="size" viewBox="0 0 48 48" aria-hidden="true">
-    <g transform="rotate(-8 24 24)">
-      <path :d="BURST" fill="#3A2418" transform="translate(1.9,2.4)"></path>
-      <path :d="BURST" fill="#C96442" stroke="#FFFDF7" stroke-width="2.6" stroke-linejoin="round"></path>
-      <text
-        x="24"
-        y="28.8"
-        text-anchor="middle"
-        font-family="Georgia,'Times New Roman',serif"
-        font-size="13"
-        font-weight="900"
-        fill="#FAF3E3"
-      >
-        O!
-      </text>
-    </g>
-  </svg>
+  <span class="logo-wrap" :style="{ width: `${size}px`, height: `${size}px` }">
+    <Transition name="logo-slide">
+      <svg :key="app.logoVariant" :width="size" :height="size" viewBox="0 0 48 48" aria-hidden="true">
+        <g transform="rotate(-8 24 24)">
+          <path :d="v.d" fill="#3A2418" transform="translate(1.9,2.4)"></path>
+          <path :d="v.d" fill="#C96442" stroke="#FFFDF7" :stroke-width="v.strokeWidth" stroke-linejoin="round"></path>
+          <circle
+            v-if="v.ring"
+            cx="24"
+            cy="24"
+            r="12.5"
+            fill="none"
+            stroke="#FAF3E3"
+            stroke-width="1"
+            stroke-dasharray="2.4 2.6"
+            opacity="0.7"
+          ></circle>
+          <text
+            x="24"
+            :y="v.textY"
+            text-anchor="middle"
+            font-family="Georgia,'Times New Roman',serif"
+            :font-size="v.fontSize"
+            font-weight="900"
+            fill="#FAF3E3"
+          >
+            O!
+          </text>
+        </g>
+      </svg>
+    </Transition>
+  </span>
 </template>
+
+<style scoped>
+/* 款式切换:旧款右滑淡出、新款自左滑入(整体从左到右);
+   离开元素绝对定位避免过渡期双元素撑开布局 */
+.logo-wrap {
+  position: relative;
+  display: inline-block;
+  line-height: 0;
+}
+.logo-slide-enter-active,
+.logo-slide-leave-active {
+  transition:
+    transform 0.35s ease,
+    opacity 0.35s ease;
+}
+.logo-slide-leave-active {
+  position: absolute;
+  left: 0;
+  top: 0;
+}
+.logo-slide-enter-from {
+  transform: translateX(-45%);
+  opacity: 0;
+}
+.logo-slide-leave-to {
+  transform: translateX(45%);
+  opacity: 0;
+}
+@media (prefers-reduced-motion: reduce) {
+  .logo-slide-enter-active,
+  .logo-slide-leave-active {
+    transition: none;
+  }
+}
+</style>
diff --git a/src/components/DeadPlaceholder.vue b/src/components/DeadPlaceholder.vue
index a7d6ebc..b39001a 100644
--- a/src/components/DeadPlaceholder.vue
+++ b/src/components/DeadPlaceholder.vue
@@ -1,7 +1,7 @@
 <script setup lang="ts">
-/** 租户失联占位：租户详情各 tab 与实例 / 网络 / 存储等资源页在
- *  当前租户失联时整体替换内容区，避免各处「无数据」/ 报错造成误判。 */
-defineProps<{ lastError?: string }>()
+/** 租户失联/暂停占位：租户详情各 tab 与实例 / 网络 / 存储等资源页在
+ *  当前租户不可用时整体替换内容区，避免各处「无数据」/ 报错造成误判。 */
+defineProps<{ lastError?: string; suspended?: boolean }>()
 </script>
 
 <template>
@@ -23,12 +23,18 @@ defineProps<{ lastError?: string }>()
       <line x1="16" y1="19" x2="16" y2="22" />
       <line x1="19" y1="16" x2="22" y2="16" />
     </svg>
-    <div class="text-sm font-semibold text-ink-2">租户已失联</div>
+    <div class="text-sm font-semibold text-ink-2">
+      {{ suspended ? '租户已被云端暂停' : '租户已失联' }}
+    </div>
     <div v-if="lastError" class="mono max-w-130 text-xs break-all whitespace-pre-wrap text-ink-3">
       {{ lastError }}
     </div>
     <div class="max-w-95 text-[12.5px] text-ink-3">
-      请检查 API Key 是否有效，修复后在租户页重新测活
+      {{
+        suspended
+          ? '账户被 Oracle 暂停（欠费 / 封禁 / 终止），请到官方控制台或工单处理，恢复后重新测活'
+          : '请检查 API Key 是否有效，修复后在租户页重新测活'
+      }}
     </div>
   </div>
 </template>
diff --git a/src/components/FilePicker.vue b/src/components/FilePicker.vue
index 1ce94f9..ec4becc 100644
--- a/src/components/FilePicker.vue
+++ b/src/components/FilePicker.vue
@@ -1,13 +1,13 @@
 <script setup lang="ts">
-import { useMessage } from 'naive-ui'
 import { computed, ref } from 'vue'
+import { useToast } from '@/composables/useToast'
 
 /** 拖拽或点击上传的文本文件选择区；文件内容仅在浏览器本地读取。
  *  compact：单行紧凑形态，用于表单内与其他字段并排。 */
 const props = defineProps<{ accept?: string; label?: string; hint?: string; compact?: boolean }>()
 const emit = defineEmits<{ load: [text: string, name: string] }>()
 
-const message = useMessage()
+const message = useToast()
 const inputEl = ref<HTMLInputElement>()
 const fileName = ref('')
 const dragging = ref(false)
diff --git a/src/components/JsonBlock.vue b/src/components/JsonBlock.vue
index dcca6fc..756e3c4 100644
--- a/src/components/JsonBlock.vue
+++ b/src/components/JsonBlock.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
-import { NButton, useMessage } from 'naive-ui'
+import { NButton } from 'naive-ui'
 import { computed } from 'vue'
+import { useToast } from '@/composables/useToast'
 
 /** 统一的 JSON 展示块:美化缩进 + 语法高亮 + 复制;三个日志详情共用。
  *  传 title 时渲染工具栏头(左标签 + meta + 右复制按钮),否则复制按钮浮动。
@@ -14,7 +15,7 @@ const props = defineProps<{
   wide?: boolean
 }>()
 
-const message = useMessage()
+const message = useToast()
 
 const pretty = computed(() => {
   const v = props.value
diff --git a/src/components/OcidText.vue b/src/components/OcidText.vue
index f63cc8d..7f5816d 100644
--- a/src/components/OcidText.vue
+++ b/src/components/OcidText.vue
@@ -1,11 +1,12 @@
 <script setup lang="ts">
-import { NButton, NIcon, useMessage } from 'naive-ui'
+import { NButton, NIcon } from 'naive-ui'
 
 import { truncOcid } from '@/composables/useFormat'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{ ocid: string }>()
 
-const message = useMessage()
+const message = useToast()
 
 async function copy() {
   await navigator.clipboard.writeText(props.ocid)
diff --git a/src/components/ai/AiChannelPanel.vue b/src/components/ai/AiChannelPanel.vue
index ca13d85..a718b51 100644
--- a/src/components/ai/AiChannelPanel.vue
+++ b/src/components/ai/AiChannelPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NDataTable, NInput, NSelect, NTooltip, useDialog, useMessage, type DataTableColumns } from 'naive-ui'
+import { NButton, NDataTable, NInput, NSelect, NTooltip, useDialog, type DataTableColumns } from 'naive-ui'
 import { computed, h, reactive, ref } from 'vue'
 
 import { createAiChannel, deleteAiChannel, probeAiChannel, syncAiChannelModels, updateAiChannel } from '@/api/aigateway'
@@ -18,7 +18,6 @@ import type { AiChannel, AiProbeStatus } from '@/types/api'
 defineProps<{ channels: AiChannel[]; loading: boolean }>()
 const emit = defineEmits<{ changed: [] }>()
 
-const message = useMessage()
 const toast = useToast()
 const dialog = useDialog()
 const scope = useScopeStore()
@@ -67,7 +66,7 @@ async function submit() {
   try {
     if (editing.value) {
       await updateAiChannel(editing.value.id, { name: form.name, group: form.group, priority: form.priority, weight: form.weight })
-      message.success('已更新渠道')
+      toast.success('已更新渠道')
       showForm.value = false
       emit('changed')
     } else {
@@ -77,11 +76,11 @@ async function submit() {
       })
       showForm.value = false
       emit('changed')
-      message.success('渠道已添加,正在探测…')
+      toast.success('渠道已添加,正在探测…')
       void doProbe(ch.id)
     }
   } catch (e) {
-    message.error(e instanceof Error ? e.message : '保存失败')
+    toast.error(e instanceof Error ? e.message : '保存失败')
   } finally {
     submitting.value = false
   }
@@ -95,12 +94,12 @@ async function doProbe(id: number) {
     const ch = await probeAiChannel(id)
     const meta = ch.probeStatus ? PROBE_META[ch.probeStatus as Exclude<AiProbeStatus, ''>] : null
     if (ch.probeStatus === 'ok') {
-      message.success('探测完成:可用')
+      toast.success('探测完成:可用')
     } else {
       toast.warning(`探测完成:${meta?.label ?? ch.probeStatus}`, ch.probeError || undefined)
     }
   } catch (e) {
-    message.error(e instanceof Error ? e.message : '探测失败')
+    toast.error(e instanceof Error ? e.message : '探测失败')
   } finally {
     probing.value.delete(id)
     emit('changed')
@@ -110,20 +109,20 @@ async function doProbe(id: number) {
 async function doSync(id: number) {
   try {
     const models = await syncAiChannelModels(id)
-    message.success(`已同步 ${models.length} 个模型`)
+    toast.success(`已同步 ${models.length} 个模型`)
     emit('changed')
   } catch (e) {
-    message.error(e instanceof Error ? e.message : '同步失败')
+    toast.error(e instanceof Error ? e.message : '同步失败')
   }
 }
 
 async function toggle(ch: AiChannel) {
   try {
     await updateAiChannel(ch.id, { enabled: !ch.enabled })
-    message.success(ch.enabled ? '已停用' : '已启用')
+    toast.success(ch.enabled ? '已停用' : '已启用')
     emit('changed')
   } catch (e) {
-    message.error(e instanceof Error ? e.message : '操作失败')
+    toast.error(e instanceof Error ? e.message : '操作失败')
   }
 }
 
@@ -135,7 +134,7 @@ function confirmRemove(ch: AiChannel) {
     negativeText: '取消',
     onPositiveClick: async () => {
       await deleteAiChannel(ch.id)
-      message.success('已删除')
+      toast.success('已删除')
       emit('changed')
     },
   })
diff --git a/src/components/ai/AiKeyPanel.vue b/src/components/ai/AiKeyPanel.vue
index 0d1af54..d41a584 100644
--- a/src/components/ai/AiKeyPanel.vue
+++ b/src/components/ai/AiKeyPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NDataTable, NInput, useDialog, useMessage, type DataTableColumns } from 'naive-ui'
+import { NButton, NDataTable, NInput, useDialog, type DataTableColumns } from 'naive-ui'
 import { computed, h, reactive, ref } from 'vue'
 
 import { createAiKey, deleteAiKey, updateAiKey, updateAiKeyContentLog } from '@/api/aigateway'
@@ -9,11 +9,12 @@ import FormModal from '@/components/FormModal.vue'
 import StatusBadge from '@/components/StatusBadge.vue'
 import { fmtTime } from '@/composables/useFormat'
 import type { AiKey } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{ keys: AiKey[]; loading: boolean; groups: string[] }>()
 const emit = defineEmits<{ changed: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const dialog = useDialog()
 
 // ---- 新建 / 编辑弹窗 ----
diff --git a/src/components/config/EditConfigModal.vue b/src/components/config/EditConfigModal.vue
index 5bef6f9..0fb9161 100644
--- a/src/components/config/EditConfigModal.vue
+++ b/src/components/config/EditConfigModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NInput, NSelect, useMessage } from 'naive-ui'
+import { NInput, NSelect } from 'naive-ui'
 import { computed, reactive, watch } from 'vue'
 import { ref } from 'vue'
 
@@ -12,11 +12,12 @@ import ToggleCard from '@/components/ToggleCard.vue'
 import { useProxyOptions } from '@/composables/useProxyOptions'
 import { useScopeStore } from '@/stores/scope'
 import type { OciConfigSummary } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{ show: boolean; config: OciConfigSummary | null }>()
 const emit = defineEmits<{ 'update:show': [boolean]; updated: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 
 const form = reactive({
diff --git a/src/components/config/ImportConfigModal.vue b/src/components/config/ImportConfigModal.vue
index c03936e..9d3b12a 100644
--- a/src/components/config/ImportConfigModal.vue
+++ b/src/components/config/ImportConfigModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NInput, NSelect, NTabPane, NTabs, useMessage } from 'naive-ui'
+import { NInput, NSelect, NTabPane, NTabs } from 'naive-ui'
 import { computed, reactive, ref, watch } from 'vue'
 
 import { importConfig } from '@/api/configs'
@@ -11,11 +11,12 @@ import ToggleCard from '@/components/ToggleCard.vue'
 import { useProxyOptions } from '@/composables/useProxyOptions'
 import { useScopeStore } from '@/stores/scope'
 import type { ImportConfigRequest } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{ show: boolean }>()
 const emit = defineEmits<{ 'update:show': [boolean]; imported: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const mode = ref<'ini' | 'fields'>('ini')
 const submitting = ref(false)
 
diff --git a/src/components/instance/AttachVnicModal.vue b/src/components/instance/AttachVnicModal.vue
index ae8bd28..0a824bd 100644
--- a/src/components/instance/AttachVnicModal.vue
+++ b/src/components/instance/AttachVnicModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NInput, NSelect, useMessage, type SelectOption } from 'naive-ui'
+import { NInput, NSelect, type SelectOption } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { attachVnic } from '@/api/instances'
@@ -9,6 +9,7 @@ import FormModal from '@/components/FormModal.vue'
 import ToggleCard from '@/components/ToggleCard.vue'
 import { useAsync } from '@/composables/useAsync'
 import { shortAd } from '@/composables/useFormat'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -21,7 +22,7 @@ const props = defineProps<{
 
 const emit = defineEmits<{ 'update:show': [boolean]; attached: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const subnetId = ref<string | null>(null)
 const displayName = ref('')
diff --git a/src/components/instance/AttachVolumeModal.vue b/src/components/instance/AttachVolumeModal.vue
index ff8a27e..32d7806 100644
--- a/src/components/instance/AttachVolumeModal.vue
+++ b/src/components/instance/AttachVolumeModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NCheckbox, NSelect, useMessage, type SelectGroupOption } from 'naive-ui'
+import { NCheckbox, NSelect, type SelectGroupOption } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { listBootVolumes } from '@/api/bootVolumes'
@@ -7,6 +7,7 @@ import { attachVolume, listVolumes } from '@/api/instances'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import { useAsync } from '@/composables/useAsync'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -19,7 +20,7 @@ const props = defineProps<{
 
 const emit = defineEmits<{ 'update:show': [boolean]; attached: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const volumeId = ref<string | null>(null)
 const readOnly = ref(false)
diff --git a/src/components/instance/ConsoleConnModal.vue b/src/components/instance/ConsoleConnModal.vue
index 60cde77..b29f724 100644
--- a/src/components/instance/ConsoleConnModal.vue
+++ b/src/components/instance/ConsoleConnModal.vue
@@ -1,15 +1,16 @@
 <script setup lang="ts">
-import { NInput, useMessage } from 'naive-ui'
+import { NInput } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { createConsoleConnection } from '@/api/instances'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{ show: boolean; cfgId: number; instanceId: string; region?: string }>()
 const emit = defineEmits<{ 'update:show': [boolean]; created: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const publicKey = ref('')
 
diff --git a/src/components/instance/CreateInstanceModal.vue b/src/components/instance/CreateInstanceModal.vue
index 44750c5..ec668f8 100644
--- a/src/components/instance/CreateInstanceModal.vue
+++ b/src/components/instance/CreateInstanceModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NInput, useMessage } from 'naive-ui'
+import { NInput } from 'naive-ui'
 import { computed, reactive, ref, watch } from 'vue'
 
 import { createInstances } from '@/api/instances'
@@ -8,6 +8,7 @@ import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import InstanceSpecForm from '@/components/instance/InstanceSpecForm.vue'
 import { defaultResourceName } from '@/composables/useFormat'
+import { useToast } from '@/composables/useToast'
 
 /** 租户 / 区间 / 区域直接使用父页面当前值，不在表单中出现 */
 const props = defineProps<{
@@ -18,7 +19,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{ 'update:show': [boolean]; created: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const specForm = ref<InstanceType<typeof InstanceSpecForm> | null>(null)
 
diff --git a/src/components/instance/EditBootVolumeModal.vue b/src/components/instance/EditBootVolumeModal.vue
index b025b80..c4a943e 100644
--- a/src/components/instance/EditBootVolumeModal.vue
+++ b/src/components/instance/EditBootVolumeModal.vue
@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import { useMessage } from 'naive-ui'
-
 import AppInputNumber from '@/components/AppInputNumber.vue'
 import { reactive, ref, watch } from 'vue'
 
@@ -8,6 +6,7 @@ import { updateBootVolume } from '@/api/bootVolumes'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import type { BootVolume } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -17,7 +16,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{ 'update:show': [boolean]; updated: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const form = reactive({ sizeInGBs: 50, vpusPerGB: 10 })
 
diff --git a/src/components/instance/ReplaceBootVolumeModal.vue b/src/components/instance/ReplaceBootVolumeModal.vue
index 80b3b25..4145a01 100644
--- a/src/components/instance/ReplaceBootVolumeModal.vue
+++ b/src/components/instance/ReplaceBootVolumeModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NSelect, useMessage } from 'naive-ui'
+import { NSelect } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { listBootVolumes } from '@/api/bootVolumes'
@@ -7,6 +7,7 @@ import { replaceBootVolume } from '@/api/instances'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import { useAsync } from '@/composables/useAsync'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -18,7 +19,7 @@ const props = defineProps<{
 
 const emit = defineEmits<{ 'update:show': [boolean]; replaced: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const bootVolumeId = ref<string | null>(null)
 
diff --git a/src/components/instance/ResizeModal.vue b/src/components/instance/ResizeModal.vue
index 92ffc47..c721040 100644
--- a/src/components/instance/ResizeModal.vue
+++ b/src/components/instance/ResizeModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NSelect, useMessage } from 'naive-ui'
+import { NSelect } from 'naive-ui'
 import { computed, reactive, ref, watch } from 'vue'
 
 import { listShapes, updateInstance } from '@/api/instances'
@@ -7,6 +7,7 @@ import AppInputNumber from '@/components/AppInputNumber.vue'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import { useAsync } from '@/composables/useAsync'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -20,7 +21,7 @@ const props = defineProps<{
 
 const emit = defineEmits<{ 'update:show': [boolean]; resized: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const form = reactive({ shape: props.shape, ocpus: props.ocpus, memoryInGBs: props.memoryInGBs })
 
diff --git a/src/components/instance/SerialConsolePanel.vue b/src/components/instance/SerialConsolePanel.vue
index 43550cb..31e1d79 100644
--- a/src/components/instance/SerialConsolePanel.vue
+++ b/src/components/instance/SerialConsolePanel.vue
@@ -2,11 +2,12 @@
 import { FitAddon } from '@xterm/addon-fit'
 import { Terminal } from '@xterm/xterm'
 import '@xterm/xterm/css/xterm.css'
-import { NSpin, useMessage } from 'naive-ui'
+import { NSpin } from 'naive-ui'
 import { nextTick, onBeforeUnmount, ref, watch } from 'vue'
 
 import { consoleSessionWsUrl, createConsoleSession, deleteConsoleSession } from '@/api/instances'
 import { useAuthStore } from '@/stores/auth'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -14,12 +15,11 @@ const props = defineProps<{
   instanceId: string
   region?: string
   instanceName?: string
-  rootPassword?: string
 }>()
 
 const emit = defineEmits<{ 'update:show': [boolean] }>()
 
-const message = useMessage()
+const message = useToast()
 const auth = useAuthStore()
 
 const termEl = ref<HTMLDivElement | null>(null)
@@ -153,12 +153,6 @@ function syncWinsize() {
   term.focus()
 }
 
-async function copyRootPassword() {
-  await navigator.clipboard.writeText(props.rootPassword ?? '')
-  message.success('已复制 root 密码')
-  term?.focus()
-}
-
 function reconnect() {
   teardown()
   void open()
@@ -250,7 +244,6 @@ onBeforeUnmount(teardown)
         </span>
         <span v-if="phase === 'creating'" class="text-xs">准备连接中…</span>
         <div class="flex-1" />
-        <button v-if="rootPassword" class="ser-btn" @click="copyRootPassword">复制 root 密码</button>
         <button class="ser-btn" :disabled="phase !== 'connected'" @click="pasteFromClipboard">
           粘贴
         </button>
@@ -299,8 +292,8 @@ onBeforeUnmount(teardown)
           <template v-else-if="phase === 'closed'">
             <div class="max-w-[80%] break-all text-center">{{ error || '连接已关闭' }}</div>
             <div class="max-w-[80%] text-center text-xs leading-relaxed">
-              串口登录需实例本地账户密码（SSH 公钥无效）；创建实例时若启用随机 root
-              密码可从顶栏复制。无密码也可查看启动日志或经 GRUB 单用户模式救援。
+              串口登录需实例本地账户密码（SSH 公钥无效）；随机 root 密码可在实例详情
+              验证身份后查看。无密码也可查看启动日志或经 GRUB 单用户模式救援。
             </div>
             <button class="ser-btn !border !border-[#3a3835] !px-3 !py-1" @click="reconnect">
               重新连接
diff --git a/src/components/instance/VnicPanel.vue b/src/components/instance/VnicPanel.vue
index 3b695a0..3b7d76f 100644
--- a/src/components/instance/VnicPanel.vue
+++ b/src/components/instance/VnicPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NPopconfirm, NSpin, useMessage } from 'naive-ui'
+import { NButton, NPopconfirm, NSpin } from 'naive-ui'
 
 import { computed, ref } from 'vue'
 
@@ -10,6 +10,7 @@ import LifecycleBadge from '@/components/LifecycleBadge.vue'
 import OcidText from '@/components/OcidText.vue'
 import { useAsync } from '@/composables/useAsync'
 import { ATTACHMENT_TRANSIENT_STATES, useTransientPoll } from '@/composables/useTransientPoll'
+import { useToast } from '@/composables/useToast'
 
 /** 网卡(VNIC)区块：每卡一主行 + IPv6 副行；IPv6 增删按卡操作。
  *  删除复用实例级接口（后端按地址遍历全部网卡），添加走 per-VNIC 接口。 */
@@ -23,7 +24,7 @@ const props = defineProps<{
 
 const emit = defineEmits<{ changed: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const vnics = useAsync(() => listVnics(props.cfgId, props.instanceId, props.region))
 
 useTransientPoll(
diff --git a/src/components/logs/AiCallLogPanel.vue b/src/components/logs/AiCallLogPanel.vue
index 1084f5e..9c024f4 100644
--- a/src/components/logs/AiCallLogPanel.vue
+++ b/src/components/logs/AiCallLogPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NDataTable, NModal, NTooltip, useMessage, type DataTableColumns } from 'naive-ui'
+import { NDataTable, NModal, NTooltip, type DataTableColumns } from 'naive-ui'
 import { computed, h, onMounted, reactive, ref } from 'vue'
 
 import { listAiCallLogs, listAiContentLogs } from '@/api/aigateway'
@@ -9,8 +9,9 @@ import StatusBadge from '@/components/StatusBadge.vue'
 import { useAutoRefresh } from '@/composables/useAutoRefresh'
 import { fmtTime } from '@/composables/useFormat'
 import type { AiCallLog, AiContentLog } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 const rows = ref<AiCallLog[]>([])
 const loading = ref(false)
 
diff --git a/src/components/logs/AlertRuleModal.vue b/src/components/logs/AlertRuleModal.vue
new file mode 100644
index 0000000..3336391
--- /dev/null
+++ b/src/components/logs/AlertRuleModal.vue
@@ -0,0 +1,313 @@
+<script setup lang="ts">
+import {
+  NButton,
+  NInput,
+  NModal,
+  NPopconfirm,
+  NSelect,
+  NSwitch,
+  type SelectOption,
+} from 'naive-ui'
+import { computed, reactive, ref, watch } from 'vue'
+
+import {
+  createAlertRule,
+  deleteAlertRule,
+  listAlertRules,
+  updateAlertRule,
+} from '@/api/logevents'
+import { listNotifyTemplates } from '@/api/settings'
+import AppInputNumber from '@/components/AppInputNumber.vue'
+import FormField from '@/components/FormField.vue'
+import NotifyTemplateModal from '@/components/settings/NotifyTemplateModal.vue'
+import TenantPicker from '@/components/TenantPicker.vue'
+import { eventLabel } from '@/composables/useEventLabel'
+import { useAsync } from '@/composables/useAsync'
+import { useScopeStore } from '@/stores/scope'
+import type { AlertRule, AlertRuleBody, NotifyTemplateItem } from '@/types/api'
+import { useToast } from '@/composables/useToast'
+
+const show = defineModel<boolean>('show', { required: true })
+
+const message = useToast()
+const scope = useScopeStore()
+
+/** 可选事件短名 = 回传链路的关键事件清单(Connector 侧 filter 一致) */
+const RELAY_EVENTS = [
+  'LaunchInstance', 'TerminateInstance', 'InstanceAction',
+  'CreateUser', 'DeleteUser', 'UpdateUser',
+  'CreateApiKey', 'DeleteApiKey', 'UpdateUserCapabilities',
+  'CreateRegionSubscription', 'CreatePolicy', 'UpdatePolicy', 'DeletePolicy',
+  'InteractiveLogin',
+]
+const eventOptions: SelectOption[] = RELAY_EVENTS.map((e) => ({
+  value: e,
+  label: eventLabel(e) ? `${eventLabel(e)}(${e})` : e,
+}))
+
+const rules = useAsync(listAlertRules, false)
+watch(show, (v) => {
+  if (v) void rules.run()
+})
+
+// ---- 编辑表单:editing 非 null 时进入表单视图,id=0 表示新建 ----
+const editing = ref<AlertRule | null>(null)
+const saving = ref(false)
+const form = reactive({
+  name: '',
+  enabled: true,
+  cfgId: null as number | null,
+  eventTypes: [] as string[],
+  sourceIps: '',
+  sourceIpMode: 'in' as 'in' | 'notin',
+  resourceMatch: '',
+  threshold: 1 as number | null,
+  windowMinutes: 5 as number | null,
+})
+
+function openCreate() {
+  editing.value = {
+    id: 0, name: '', enabled: true, ociConfigId: 0, eventTypes: '', sourceIps: '',
+    sourceIpMode: 'in', resourceMatch: '', threshold: 1, windowMinutes: 5,
+    createdAt: '', updatedAt: '',
+  }
+}
+
+function openEdit(rule: AlertRule) {
+  editing.value = rule
+}
+
+// 进入表单时由所编辑规则回填
+watch(editing, (r) => {
+  if (!r) return
+  form.name = r.name
+  form.enabled = r.enabled
+  form.cfgId = r.ociConfigId || null
+  form.eventTypes = r.eventTypes ? r.eventTypes.split(',') : []
+  form.sourceIps = r.sourceIps
+  form.sourceIpMode = r.sourceIpMode || 'in'
+  form.resourceMatch = r.resourceMatch
+  form.threshold = r.threshold || 1
+  form.windowMinutes = r.windowMinutes || 5
+})
+
+function buildBody(): AlertRuleBody {
+  return {
+    name: form.name.trim(),
+    enabled: form.enabled,
+    ociConfigId: form.cfgId ?? 0,
+    eventTypes: form.eventTypes.join(','),
+    sourceIps: form.sourceIps.trim(),
+    sourceIpMode: form.sourceIpMode,
+    resourceMatch: form.resourceMatch.trim(),
+    threshold: form.threshold ?? 1,
+    windowMinutes: form.windowMinutes ?? 5,
+  }
+}
+
+async function save() {
+  if (!editing.value) return
+  saving.value = true
+  try {
+    const body = buildBody()
+    if (editing.value.id) await updateAlertRule(editing.value.id, body)
+    else await createAlertRule(body)
+    message.success(editing.value.id ? '规则已更新' : '规则已创建')
+    editing.value = null
+    void rules.run()
+  } catch (e) {
+    message.error(e instanceof Error ? e.message : '保存失败')
+  } finally {
+    saving.value = false
+  }
+}
+
+/** 列表行的启停开关:就地整体覆盖保存 */
+async function toggleRule(rule: AlertRule, enabled: boolean) {
+  try {
+    await updateAlertRule(rule.id, { ...rule, enabled })
+    rule.enabled = enabled
+  } catch (e) {
+    message.error(e instanceof Error ? e.message : '操作失败')
+  }
+}
+
+async function removeRule(rule: AlertRule) {
+  try {
+    await deleteAlertRule(rule.id)
+    message.success(`已删除「${rule.name}」`)
+    void rules.run()
+  } catch (e) {
+    message.error(e instanceof Error ? e.message : '删除失败')
+  }
+}
+
+/** 条件摘要:留空条件不出现 */
+function ruleSummary(r: AlertRule): string {
+  const parts: string[] = []
+  const alias = scope.cfgOptions.find((o) => Number(o.value) === r.ociConfigId)?.label
+  parts.push(r.ociConfigId ? `租户 ${alias ?? `#${r.ociConfigId}`}` : '全部租户')
+  parts.push(r.eventTypes ? `${r.eventTypes.split(',').length} 种事件` : '全部事件')
+  if (r.sourceIps) parts.push(`IP ${r.sourceIpMode === 'notin' ? '不在' : '命中'} ${r.sourceIps}`)
+  if (r.resourceMatch) parts.push(`资源含「${r.resourceMatch}」`)
+  parts.push(r.threshold > 1 ? `${r.windowMinutes} 分钟内 ${r.threshold} 次` : '即时触发')
+  return parts.join(' · ')
+}
+
+// ---- 通知模板入口:复用设置页模板编辑弹窗(kind=audit_alert) ----
+const templates = useAsync(listNotifyTemplates, false)
+const tplShow = ref(false)
+const tplItem = ref<NotifyTemplateItem | null>(null)
+
+async function openTemplate() {
+  if (!templates.data.value) await templates.run()
+  const item = (templates.data.value ?? []).find((t) => t.kind === 'audit_alert')
+  if (!item) {
+    message.error('模板加载失败,请稍后再试')
+    return
+  }
+  tplItem.value = item
+  tplShow.value = true
+}
+
+const canSave = computed(() => !!form.name.trim())
+</script>
+
+<template>
+  <NModal
+    v-model:show="show"
+    preset="card"
+    closable
+    title="审计告警规则"
+    :style="{ width: '680px', maxWidth: 'calc(100vw - 24px)' }"
+  >
+    <!-- 表单视图 -->
+    <div v-if="editing" class="flex flex-col">
+      <FormField label="规则名称" required>
+        <NInput v-model:value="form.name" placeholder="如:非白名单终止实例" />
+      </FormField>
+      <div class="grid grid-cols-2 gap-3 max-md:grid-cols-1">
+        <FormField label="租户范围" hint="留空对全部租户生效">
+          <TenantPicker
+            v-model:value="form.cfgId"
+            clearable
+            placeholder="全部租户"
+            :configs="scope.configs.data ?? []"
+            :loading="scope.configs.loading"
+          />
+        </FormField>
+        <FormField label="事件类型" hint="留空匹配全部回传事件">
+          <NSelect
+            v-model:value="form.eventTypes"
+            multiple
+            clearable
+            :options="eventOptions"
+            placeholder="全部事件"
+            :max-tag-count="2"
+          />
+        </FormField>
+      </div>
+      <FormField
+        label="来源 IP 条件"
+        hint="逗号分隔 IP 或 CIDR;「不在列表才告警」适合白名单场景(非我发起的操作)"
+      >
+        <div class="mb-1.5 flex gap-1.5">
+          <button
+            v-for="m in [
+              { v: 'in', t: '命中列表告警' },
+              { v: 'notin', t: '不在列表才告警' },
+            ]"
+            :key="m.v"
+            type="button"
+            class="cursor-pointer rounded-md border px-3 py-1 text-xs"
+            :class="
+              form.sourceIpMode === m.v
+                ? 'border-accent bg-accent/10 font-semibold text-accent'
+                : 'border-line bg-white text-ink-2 hover:border-ink-3'
+            "
+            @click="form.sourceIpMode = m.v as 'in' | 'notin'"
+          >
+            {{ m.t }}
+          </button>
+        </div>
+        <NInput v-model:value="form.sourceIps" class="mono" placeholder="203.0.113.8, 10.0.0.0/8(留空=任意)" />
+      </FormField>
+      <div class="grid grid-cols-3 gap-3 max-md:grid-cols-1">
+        <FormField label="资源名包含" hint="子串匹配,留空=任意">
+          <NInput v-model:value="form.resourceMatch" placeholder="web-" />
+        </FormField>
+        <FormField label="触发阈值(次)" hint="1=每次命中即告警">
+          <AppInputNumber v-model:value="form.threshold" :min="1" :max="100" class="!w-full" />
+        </FormField>
+        <FormField label="聚合窗口(分钟)" hint="阈值>1 时生效,告警后同窗冷却">
+          <AppInputNumber
+            v-model:value="form.windowMinutes"
+            :min="1"
+            :max="1440"
+            :disabled="(form.threshold ?? 1) <= 1"
+            class="!w-full"
+          />
+        </FormField>
+      </div>
+      <div class="flex items-center justify-between rounded-lg bg-wash px-3 py-2">
+        <span class="text-[12.5px]">启用该规则</span>
+        <NSwitch v-model:value="form.enabled" size="small" />
+      </div>
+      <div class="mt-3 flex items-center gap-2">
+        <NButton size="small" type="primary" :loading="saving" :disabled="!canSave" @click="save">
+          保存
+        </NButton>
+        <NButton size="small" @click="editing = null">返回列表</NButton>
+      </div>
+    </div>
+
+    <!-- 列表视图 -->
+    <div v-else class="flex flex-col">
+      <div class="mb-2 flex items-center justify-between gap-2">
+        <div class="text-xs text-ink-3">
+          命中规则的回传事件经「通知方式」的启用渠道推送;仅已建回传链路的租户产生事件
+        </div>
+        <div class="flex flex-none items-center gap-2">
+          <NButton size="tiny" quaternary type="primary" @click="openTemplate">通知模板</NButton>
+          <NButton size="small" type="primary" @click="openCreate">新建规则</NButton>
+        </div>
+      </div>
+      <div
+        v-for="rule in rules.data.value ?? []"
+        :key="rule.id"
+        class="flex items-center gap-3 border-b border-line-soft py-2.5 last:border-b-0"
+      >
+        <div class="min-w-0 flex-1">
+          <div class="text-[13px] font-medium">{{ rule.name }}</div>
+          <div class="mt-0.5 truncate text-xs text-ink-3" :title="ruleSummary(rule)">
+            {{ ruleSummary(rule) }}
+          </div>
+        </div>
+        <NSwitch
+          size="small"
+          :value="rule.enabled"
+          @update:value="(v: boolean) => toggleRule(rule, v)"
+        />
+        <NButton size="tiny" quaternary type="primary" @click="openEdit(rule)">编辑</NButton>
+        <NPopconfirm @positive-click="removeRule(rule)">
+          <template #trigger>
+            <NButton size="tiny" quaternary type="error">删除</NButton>
+          </template>
+          删除规则「{{ rule.name }}」？
+        </NPopconfirm>
+      </div>
+      <div
+        v-if="!rules.loading.value && !(rules.data.value ?? []).length"
+        class="py-8 text-center text-[13px] text-ink-3"
+      >
+        暂无规则,点击「新建规则」创建第一条
+      </div>
+    </div>
+
+    <NotifyTemplateModal
+      v-model:show="tplShow"
+      :item="tplItem"
+      hint="命中告警规则时推送;变量:rule / tenant / event / resource / ip / count"
+    />
+  </NModal>
+</template>
diff --git a/src/components/logs/LogEventPanel.vue b/src/components/logs/LogEventPanel.vue
index d58876c..8e050bb 100644
--- a/src/components/logs/LogEventPanel.vue
+++ b/src/components/logs/LogEventPanel.vue
@@ -1,10 +1,11 @@
 <script setup lang="ts">
-import { NDataTable, NModal, NPopover, useMessage, type DataTableColumns } from 'naive-ui'
+import { NButton, NDataTable, NModal, NPopover, type DataTableColumns } from 'naive-ui'
 import { computed, h, reactive, ref } from 'vue'
 import { useRouter } from 'vue-router'
 
 import { listConfigs } from '@/api/configs'
 import { listLogEvents } from '@/api/logevents'
+import AlertRuleModal from '@/components/logs/AlertRuleModal.vue'
 import DetailFieldList, { type DetailRow } from '@/components/DetailFieldList.vue'
 import DetailHero, { type HeroChip } from '@/components/DetailHero.vue'
 import FootNote from '@/components/FootNote.vue'
@@ -18,8 +19,9 @@ import { useAsync } from '@/composables/useAsync'
 import { useRegionAlias } from '@/composables/useRegionAlias'
 import { useScopeStore } from '@/stores/scope'
 import type { LogEvent, OciConfigSummary } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 const router = useRouter()
 const scope = useScopeStore()
 const { alias: regionAlias } = useRegionAlias()
@@ -39,6 +41,7 @@ const cfgById = computed(() => {
 
 const detail = ref<LogEvent | null>(null)
 const showDetail = ref(false)
+const showRules = ref(false)
 
 /** 受控远程分页:字面量对象会在重渲染时被重建导致状态丢失 */
 const pagination = reactive({
@@ -219,16 +222,19 @@ useAutoRefresh(() => load(true))
           OCI 侧推送的关键审计事件(Connector Hub → Notifications → 面板 webhook)
         </div>
       </div>
-      <TenantPicker
-        v-model:value="cfgFilter"
-        size="small"
-        clearable
-        placeholder="全部租户"
-        class="w-52"
-        :configs="scope.configs.data ?? []"
-        :loading="scope.configs.loading"
-        @update:value="onFilter"
-      />
+      <div class="flex flex-wrap items-center gap-2">
+        <NButton size="small" @click="showRules = true">告警规则</NButton>
+        <TenantPicker
+          v-model:value="cfgFilter"
+          size="small"
+          clearable
+          placeholder="全部租户"
+          class="w-52"
+          :configs="scope.configs.data ?? []"
+          :loading="scope.configs.loading"
+          @update:value="onFilter"
+        />
+      </div>
     </div>
     <NDataTable
       remote
@@ -245,9 +251,12 @@ useAutoRefresh(() => load(true))
       在租户详情「其他」tab 一键创建链路后,实例生命周期(Launch/Terminate/InstanceAction)、
       用户与凭据(Create/Delete/UpdateUser、Create/DeleteApiKey、UpdateUserCapabilities)、
       区域订阅与策略变更等关键审计事件将自动回传;消息按 MessageId 幂等去重,保留 90
-      天、总量超 2 万条时删除最旧,关键事件另经「通知管理 → 云端事件」推送告警
+      天、总量超 2 万条时删除最旧,关键事件另经「通知管理 → 云端事件」推送告警;
+      更细粒度的条件告警(事件/来源 IP/资源/频率)在「告警规则」中配置
     </FootNote>
 
+    <AlertRuleModal v-model:show="showRules" />
+
     <NModal v-model:show="showDetail" preset="card" closable :style="{ width: '720px', maxWidth: 'calc(100vw - 24px)' }">
       <template #header>
         <DetailHero
diff --git a/src/components/logs/SystemLogPanel.vue b/src/components/logs/SystemLogPanel.vue
index 9efc353..d621468 100644
--- a/src/components/logs/SystemLogPanel.vue
+++ b/src/components/logs/SystemLogPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NDataTable, NInput, NModal, useMessage, type DataTableColumns } from 'naive-ui'
+import { NDataTable, NInput, NModal, type DataTableColumns } from 'naive-ui'
 import { computed, h, reactive, ref } from 'vue'
 
 import { listSystemLogs } from '@/api/settings'
@@ -12,8 +12,9 @@ import { actionLabel } from '@/composables/useActionLabel'
 import { useAutoRefresh } from '@/composables/useAutoRefresh'
 import { fmtTime } from '@/composables/useFormat'
 import type { SystemLog } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 
 const rows = ref<SystemLog[]>([])
 const loading = ref(false)
diff --git a/src/components/network/CreateVcnModal.vue b/src/components/network/CreateVcnModal.vue
index 8527058..b2a5ee3 100644
--- a/src/components/network/CreateVcnModal.vue
+++ b/src/components/network/CreateVcnModal.vue
@@ -1,11 +1,12 @@
 <script setup lang="ts">
-import { NCheckbox, NInput, useMessage } from 'naive-ui'
+import { NCheckbox, NInput } from 'naive-ui'
 import { computed, reactive, ref, watch } from 'vue'
 
 import { createVcn } from '@/api/networks'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import { defaultResourceName } from '@/composables/useFormat'
+import { useToast } from '@/composables/useToast'
 
 /** 租户 / 区间 / 区域直接使用父页面当前值，不在表单中出现 */
 const props = defineProps<{
@@ -16,7 +17,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{ 'update:show': [boolean]; created: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 
 const blank = {
diff --git a/src/components/proxy/ProxyPanel.vue b/src/components/proxy/ProxyPanel.vue
index a47c6f0..27e9a0a 100644
--- a/src/components/proxy/ProxyPanel.vue
+++ b/src/components/proxy/ProxyPanel.vue
@@ -7,7 +7,6 @@ import {
   NPopconfirm,
   NRadioButton,
   NRadioGroup,
-  useMessage,
   type DataTableColumns,
 } from 'naive-ui'
 import { computed, h, onUnmounted, ref } from 'vue'
@@ -25,8 +24,9 @@ import FootNote from '@/components/FootNote.vue'
 import FormField from '@/components/FormField.vue'
 import { useAsync } from '@/composables/useAsync'
 import type { ProxyImportResult, ProxyInfo } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 
 const proxies = useAsync(listProxies)
 const rows = computed(() => proxies.data.value?.items ?? [])
diff --git a/src/components/settings/AboutTab.vue b/src/components/settings/AboutTab.vue
index 2b4e504..a4794ef 100644
--- a/src/components/settings/AboutTab.vue
+++ b/src/components/settings/AboutTab.vue
@@ -5,8 +5,12 @@ import { onMounted, ref } from 'vue'
 import { getAbout } from '@/api/settings'
 import AppLogo from '@/components/AppLogo.vue'
 import { useParticles } from '@/composables/useParticles'
+import { useAppStore } from '@/stores/app'
 import type { AboutInfo } from '@/types/api'
 
+// 点击 logo 在星爆 / 波浪封印两款间切换(全局生效并记忆)
+const app = useAppStore()
+
 // GitHub 仓库地址;空串时按钮禁用并显示占位
 const REPO_URL = 'https://github.com/wangdefaa/oci-portal'
 
@@ -45,7 +49,15 @@ function openRepo() {
         <canvas ref="pcanvas" class="absolute inset-0 h-full w-full"></canvas>
       </div>
       <div class="relative">
-        <span class="floaty mx-auto block w-fit"><AppLogo :size="84" /></span>
+        <button
+          type="button"
+          class="floaty logo-btn mx-auto block w-fit"
+          title="切换 logo 款式"
+          aria-label="切换 logo 款式"
+          @click="app.toggleLogoVariant()"
+        >
+          <AppLogo :size="84" />
+        </button>
         <div class="mt-5 font-serif text-[34px] leading-tight font-semibold">OCI Portal</div>
         <div class="mt-1 text-[13px] text-ink-3">OCI 账号批量管理面板 · 自托管</div>
         <div v-if="loading" class="mt-6 flex justify-center"><NSpin size="small" /></div>
@@ -98,6 +110,21 @@ function openRepo() {
   border-radius: 50%;
   border: 1.5px dashed color-mix(in srgb, var(--color-line) 70%, var(--color-accent) 30%);
 }
+/* logo 即款式开关:去按钮底色,悬停轻微放大提示可点 */
+.logo-btn {
+  cursor: pointer;
+  border: none;
+  background: none;
+  padding: 0;
+  line-height: 0;
+  transition: scale 0.25s ease;
+}
+.logo-btn:hover {
+  scale: 1.06;
+}
+.logo-btn:active {
+  scale: 0.96;
+}
 @media (prefers-reduced-motion: no-preference) {
   .spin {
     animation: about-sp 52s linear infinite;
diff --git a/src/components/settings/AccountSecurityCard.vue b/src/components/settings/AccountSecurityCard.vue
index 6b09bd6..bc9de4c 100644
--- a/src/components/settings/AccountSecurityCard.vue
+++ b/src/components/settings/AccountSecurityCard.vue
@@ -1,11 +1,12 @@
 <script setup lang="ts">
-import { NButton, NInput, NModal, NPopconfirm, NQrCode, NSpin, NSwitch, useMessage } from 'naive-ui'
+import { NButton, NInput, NModal, NPopconfirm, NQrCode, NSpin, NSwitch } from 'naive-ui'
 import { computed, reactive, ref } from 'vue'
 import { useRouter } from 'vue-router'
 
 import {
   activateTotp,
   disableTotp,
+  revokeSessions,
   getCredentials,
   getOAuthSettings,
   getOauthAuthorizeUrl,
@@ -24,12 +25,17 @@ import { useAsync } from '@/composables/useAsync'
 import { useAppStore } from '@/stores/app'
 import { useAuthStore } from '@/stores/auth'
 import { fmtTime } from '@/composables/useFormat'
-import type { TotpSetup, UpdateOAuthRequest } from '@/types/api'
+import type { SessionRefresh, TotpSetup, UpdateOAuthRequest } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 const router = useRouter()
 const auth = useAuthStore()
 const app = useAppStore()
+/** 敏感操作响应携带新会话时无感替换;204 降级(undefined)交由 401 流程重登 */
+function applySession(r: SessionRefresh) {
+  if (r?.token) auth.setSession(r.token, r.expiresAt)
+}
 
 const providerLabels: Record<string, string> = { github: 'GitHub', oidc: 'OIDC 单点登录' }
 
@@ -69,7 +75,7 @@ async function confirmTotpActivate() {
   }
   totpBusy.value = true
   try {
-    await activateTotp(totpActivateCode.value)
+    applySession(await activateTotp(totpActivateCode.value))
     message.success('两步验证已启用,下次登录需输入动态验证码')
     showTotpSetup.value = false
     totpPending.value = null
@@ -86,7 +92,7 @@ async function confirmTotpDisable() {
   totpBusy.value = true
   try {
     // 6 位纯数字按验证码提交,其余按密码
-    await disableTotp(/^\d{6}$/.test(input) ? { code: input } : { password: input })
+    applySession(await disableTotp(/^\d{6}$/.test(input) ? { code: input } : { password: input }))
     message.success('两步验证已停用')
     totpDisableInput.value = ''
     showTotpDisable.value = false
@@ -151,15 +157,22 @@ async function saveCredentials() {
   const { nameChanged, pwChanged } = credChanges.value
   savingCred.value = true
   try {
-    await updateCredentials({
+    const refresh = await updateCredentials({
       ...(nameChanged ? { newUsername: credForm.newUsername.trim() } : {}),
       ...(pwChanged ? { newPassword: credForm.newPassword } : {}),
       currentPassword: credForm.currentPassword,
     })
-    message.success('登录凭据已更新,请使用新凭据重新登录')
     showCredModal.value = false
-    auth.logout()
-    void router.push('/login')
+    if (refresh?.token) {
+      // 版本递增使其余会话全部失效;当前会话经新 token 无感延续
+      applySession(refresh)
+      message.success('登录凭据已更新,其他已登录会话已全部失效')
+      void creds.run({ silent: true })
+    } else {
+      message.success('登录凭据已更新,请使用新凭据重新登录')
+      auth.logout()
+      void router.push('/login')
+    }
   } catch (e) {
     message.error(e instanceof Error ? e.message : '保存失败')
   } finally {
@@ -171,7 +184,7 @@ async function saveCredentials() {
 async function togglePasswordLogin(disabled: boolean) {
   togglingPwLogin.value = true
   try {
-    await updatePasswordLogin(disabled)
+    applySession(await updatePasswordLogin(disabled))
     message.success(disabled ? '已禁用密码登录,仅外部身份可登录' : '已恢复密码登录')
   } catch (e) {
     message.error(e instanceof Error ? e.message : '操作失败')
@@ -204,7 +217,7 @@ async function bindProvider(provider: string) {
 
 async function removeIdentity(id: number) {
   try {
-    await unbindIdentity(id)
+    applySession(await unbindIdentity(id))
     message.success('已解绑;该身份后续无法登录面板')
     void identities.run()
   } catch (e) {
@@ -212,6 +225,21 @@ async function removeIdentity(id: number) {
   }
 }
 
+// ---- 撤销全部会话:令牌版本递增,除本会话(换新)外全部立即失效 ----
+const revoking = ref(false)
+
+async function revokeAllSessions() {
+  revoking.value = true
+  try {
+    applySession(await revokeSessions())
+    message.success('已撤销全部会话;其他设备须重新登录')
+  } catch (e) {
+    message.error(e instanceof Error ? e.message : '操作失败')
+  } finally {
+    revoking.value = false
+  }
+}
+
 // ---- 登录方式配置(OAuth provider):表格 + 弹窗增改;禁用仅隐藏登录入口,删除清全部配置 ----
 type ProviderType = 'github' | 'oidc'
 
@@ -419,6 +447,18 @@ async function deleteProvider(p: ProviderType) {
         <NButton size="tiny" quaternary @click="openCredModal">修改</NButton>
       </div>
 
+      <div class="flex items-center justify-between gap-3 border-b border-line-soft py-2.5">
+        <div class="min-w-0">
+          <div class="text-[13px] font-medium">撤销全部会话</div>
+          <div class="mt-0.5 text-xs text-ink-3">
+            怀疑令牌泄露时使用;其他设备与旧令牌立即失效,本会话自动换新
+          </div>
+        </div>
+        <NButton size="tiny" type="error" quaternary :loading="revoking" @click="revokeAllSessions">
+          撤销
+        </NButton>
+      </div>
+
       <div class="flex items-center justify-between gap-3 border-b border-line-soft py-2.5">
         <div class="min-w-0">
           <div class="text-[13px] font-medium">禁用密码登录</div>
diff --git a/src/components/settings/NotifyChannelCard.vue b/src/components/settings/NotifyChannelCard.vue
new file mode 100644
index 0000000..78735a9
--- /dev/null
+++ b/src/components/settings/NotifyChannelCard.vue
@@ -0,0 +1,282 @@
+<script setup lang="ts">
+import { NButton, NCollapseTransition, NInput, NSwitch } from 'naive-ui'
+import { computed, reactive, ref, watch } from 'vue'
+
+import { testNotifyChannel, updateNotifyChannel } from '@/api/settings'
+import AppInputNumber from '@/components/AppInputNumber.vue'
+import FormField from '@/components/FormField.vue'
+import { useToast } from '@/composables/useToast'
+import type { NotifyChannelItem, NotifyChannelType } from '@/types/api'
+
+const props = defineProps<{ item: NotifyChannelItem }>()
+const emit = defineEmits<{ saved: [NotifyChannelItem[]] }>()
+
+const message = useToast()
+
+/** 渠道展示元数据:图标字符 + 名称 + 一句话说明 + 密文字段文案 */
+const CHANNEL_META: Record<
+  NotifyChannelType,
+  { icon: string; name: string; hint: string; secretLabel?: string; secretHint?: string }
+> = {
+  webhook: {
+    icon: 'W',
+    name: 'Webhook',
+    hint: '通用 HTTP POST,可对接飞书 / 钉钉 / Slack / 企业微信机器人',
+  },
+  ntfy: {
+    icon: 'N',
+    name: 'ntfy',
+    hint: '开源推送服务,官方 ntfy.sh 或自建服务端',
+    secretLabel: 'Access Token',
+    secretHint: '服务端开启鉴权时填写;留空表示沿用已保存值',
+  },
+  bark: {
+    icon: 'B',
+    name: 'Bark',
+    hint: 'iOS 推送,官方 api.day.app 或自建服务端',
+    secretLabel: 'Device Key',
+    secretHint: 'Bark App 内的设备 key;留空表示沿用已保存值',
+  },
+  smtp: {
+    icon: 'M',
+    name: 'SMTP 邮件',
+    hint: '465 端口走隐式 TLS,其余端口自动 STARTTLS',
+    secretLabel: '密码',
+    secretHint: 'SMTP 授权码或密码;留空表示沿用已保存值',
+  },
+}
+
+/** Webhook body 模板预设(占位符 {{title}} / {{text}} 发送时替换并做 JSON 转义) */
+const WEBHOOK_PRESETS = [
+  { label: 'Slack', tpl: '{"text": "{{title}}\\n{{text}}"}' },
+  { label: '飞书', tpl: '{"msg_type": "text", "content": {"text": "{{title}}\\n{{text}}"}}' },
+  { label: '钉钉', tpl: '{"msgtype": "text", "text": {"content": "{{title}}\\n{{text}}"}}' },
+  { label: '企业微信', tpl: '{"msgtype": "text", "text": {"content": "{{title}}\\n{{text}}"}}' },
+]
+
+const meta = computed(() => CHANNEL_META[props.item.type])
+const expanded = ref(false)
+const saving = ref(false)
+const testing = ref(false)
+
+const form = reactive({
+  enabled: false,
+  url: '',
+  bodyTemplate: '',
+  server: '',
+  topic: '',
+  host: '',
+  port: 587 as number | null,
+  username: '',
+  from: '',
+  to: '',
+  secret: '',
+})
+
+// 服务端数据到达/保存后回填;密文字段不回明文,输入框留空表示沿用
+watch(
+  () => props.item,
+  (it) => {
+    form.enabled = it.enabled
+    form.url = it.url ?? ''
+    form.bodyTemplate = it.bodyTemplate ?? ''
+    form.server = it.server ?? ''
+    form.topic = it.topic ?? ''
+    form.host = it.host ?? ''
+    form.port = it.port || 587
+    form.username = it.username ?? ''
+    form.from = it.from ?? ''
+    form.to = it.to ?? ''
+    form.secret = ''
+  },
+  { immediate: true },
+)
+
+const secretPlaceholder = computed(() =>
+  props.item.secretSet
+    ? `已配置${props.item.secretTail ? `（尾号 ${props.item.secretTail}）` : ''}，留空沿用`
+    : '',
+)
+
+async function save() {
+  saving.value = true
+  try {
+    const secret = form.secret.trim()
+    const items = await updateNotifyChannel(props.item.type, {
+      enabled: form.enabled,
+      url: form.url.trim(),
+      bodyTemplate: form.bodyTemplate,
+      server: form.server.trim(),
+      topic: form.topic.trim(),
+      host: form.host.trim(),
+      port: form.port ?? 0,
+      username: form.username.trim(),
+      from: form.from.trim(),
+      to: form.to.trim(),
+      // 留空表示沿用已保存的密文字段
+      ...(secret ? { secret } : {}),
+    })
+    message.success(`${meta.value.name} 配置已保存`)
+    form.secret = ''
+    emit('saved', items)
+  } catch (e) {
+    message.error(e instanceof Error ? e.message : '保存失败')
+  } finally {
+    saving.value = false
+  }
+}
+
+async function sendTest() {
+  testing.value = true
+  try {
+    await testNotifyChannel(props.item.type)
+    message.success(`测试消息已发送,请在 ${meta.value.name} 侧查收`)
+  } catch (e) {
+    message.error(e instanceof Error ? e.message : '发送失败')
+  } finally {
+    testing.value = false
+  }
+}
+</script>
+
+<template>
+  <div class="border-b border-line-soft last:border-b-0">
+    <button
+      type="button"
+      class="flex w-full cursor-pointer items-center gap-3 px-4.5 py-3.5 text-left"
+      @click="expanded = !expanded"
+    >
+      <span
+        class="flex h-8.5 w-8.5 flex-none items-center justify-center rounded-full bg-wash text-[15px] font-bold text-ink-2"
+      >
+        {{ meta.icon }}
+      </span>
+      <div class="min-w-0 flex-1">
+        <div class="flex flex-wrap items-center gap-2">
+          <span class="text-[13px] font-medium">{{ meta.name }}</span>
+          <span
+            class="inline-flex items-center gap-1.5 rounded-full bg-wash px-2 py-px text-[11.5px] text-ink-2"
+          >
+            <span
+              class="h-1.5 w-1.5 rounded-full"
+              :class="item.enabled ? 'bg-ok' : 'bg-ink-3/50'"
+            />
+            {{ item.enabled ? '已启用' : '未启用' }}
+          </span>
+        </div>
+        <div class="mt-0.5 text-xs text-ink-3">{{ meta.hint }}</div>
+      </div>
+      <span class="text-xs text-ink-3">{{ expanded ? '收起' : '配置' }}</span>
+    </button>
+
+    <NCollapseTransition :show="expanded">
+      <div class="px-4.5 pb-3.5">
+        <div class="mb-3 flex items-center justify-between rounded-lg bg-wash px-3 py-2">
+          <span class="text-[12.5px]">启用该渠道</span>
+          <NSwitch v-model:value="form.enabled" size="small" />
+        </div>
+
+        <!-- Webhook -->
+        <template v-if="item.type === 'webhook'">
+          <FormField label="Webhook URL" hint="机器人/集成的完整回调地址,含鉴权参数">
+            <NInput v-model:value="form.url" placeholder="https://open.feishu.cn/open-apis/bot/v2/hook/…" />
+          </FormField>
+          <FormField
+            label="Body 模板"
+            hint="发送时 {{title}} / {{text}} 按 JSON 字符串转义后替换;留空按 Slack 形状发送"
+          >
+            <div class="mb-1.5 flex flex-wrap gap-1.5">
+              <NButton
+                v-for="p in WEBHOOK_PRESETS"
+                :key="p.label"
+                size="tiny"
+                quaternary
+                type="primary"
+                @click="form.bodyTemplate = p.tpl"
+              >
+                {{ p.label }}
+              </NButton>
+            </div>
+            <NInput
+              v-model:value="form.bodyTemplate"
+              type="textarea"
+              :autosize="{ minRows: 2, maxRows: 5 }"
+              class="mono"
+              :placeholder="WEBHOOK_PRESETS[0].tpl"
+            />
+          </FormField>
+        </template>
+
+        <!-- ntfy -->
+        <template v-else-if="item.type === 'ntfy'">
+          <div class="grid grid-cols-2 gap-3 max-md:grid-cols-1">
+            <FormField label="服务端" hint="留空用官方 ntfy.sh">
+              <NInput v-model:value="form.server" placeholder="https://ntfy.sh" />
+            </FormField>
+            <FormField label="Topic" hint="订阅的主题名">
+              <NInput v-model:value="form.topic" placeholder="oci-portal" />
+            </FormField>
+          </div>
+          <FormField :label="meta.secretLabel!" :hint="meta.secretHint">
+            <NInput
+              v-model:value="form.secret"
+              type="password"
+              show-password-on="click"
+              :placeholder="secretPlaceholder || 'tk_…(可选)'"
+            />
+          </FormField>
+        </template>
+
+        <!-- Bark -->
+        <template v-else-if="item.type === 'bark'">
+          <FormField label="服务端" hint="留空用官方 api.day.app">
+            <NInput v-model:value="form.server" placeholder="https://api.day.app" />
+          </FormField>
+          <FormField :label="meta.secretLabel!" :hint="meta.secretHint">
+            <NInput
+              v-model:value="form.secret"
+              type="password"
+              show-password-on="click"
+              :placeholder="secretPlaceholder || 'Bark App 内复制'"
+            />
+          </FormField>
+        </template>
+
+        <!-- SMTP -->
+        <template v-else>
+          <div class="grid grid-cols-2 gap-3 max-md:grid-cols-1">
+            <FormField label="主机">
+              <NInput v-model:value="form.host" placeholder="smtp.example.com" />
+            </FormField>
+            <FormField label="端口" hint="465 隐式 TLS,587 STARTTLS">
+              <AppInputNumber v-model:value="form.port" :min="1" :max="65535" class="!w-full" />
+            </FormField>
+            <FormField label="用户名" hint="留空表示免认证">
+              <NInput v-model:value="form.username" placeholder="user@example.com" />
+            </FormField>
+            <FormField :label="meta.secretLabel!" :hint="meta.secretHint">
+              <NInput
+                v-model:value="form.secret"
+                type="password"
+                show-password-on="click"
+                :placeholder="secretPlaceholder || 'SMTP 授权码'"
+              />
+            </FormField>
+            <FormField label="发件人">
+              <NInput v-model:value="form.from" placeholder="noreply@example.com" />
+            </FormField>
+            <FormField label="收件人">
+              <NInput v-model:value="form.to" placeholder="me@example.com" />
+            </FormField>
+          </div>
+        </template>
+
+        <div class="mt-1 flex items-center gap-2">
+          <NButton size="small" type="primary" :loading="saving" @click="save">保存</NButton>
+          <NButton size="small" :loading="testing" @click="sendTest">发送测试消息</NButton>
+          <span class="text-xs text-ink-3">测试使用已保存的配置,修改后请先保存</span>
+        </div>
+      </div>
+    </NCollapseTransition>
+  </div>
+</template>
diff --git a/src/components/settings/NotifyTemplateModal.vue b/src/components/settings/NotifyTemplateModal.vue
index e6c7ffb..90b5f43 100644
--- a/src/components/settings/NotifyTemplateModal.vue
+++ b/src/components/settings/NotifyTemplateModal.vue
@@ -1,9 +1,10 @@
 <script setup lang="ts">
-import { NButton, NInput, NModal, useMessage } from 'naive-ui'
+import { NButton, NInput, NModal } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { testNotifyTemplate, updateNotifyTemplate } from '@/api/settings'
 import type { NotifyTemplateItem } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -18,7 +19,7 @@ const emit = defineEmits<{
   saved: [kind: string, template: string]
 }>()
 
-const message = useMessage()
+const message = useToast()
 const draft = ref('')
 const saving = ref(false)
 const testing = ref(false)
diff --git a/src/components/storage/AttachBootVolumeModal.vue b/src/components/storage/AttachBootVolumeModal.vue
index 8100d2a..63b9504 100644
--- a/src/components/storage/AttachBootVolumeModal.vue
+++ b/src/components/storage/AttachBootVolumeModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NSelect, useMessage } from 'naive-ui'
+import { NSelect } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { attachBootVolume, listInstances } from '@/api/instances'
@@ -8,6 +8,7 @@ import FormModal from '@/components/FormModal.vue'
 import { shortAd } from '@/composables/useFormat'
 import { useAsync } from '@/composables/useAsync'
 import type { BootVolume } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -17,7 +18,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{ 'update:show': [boolean]; attached: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const instanceId = ref<string | null>(null)
 
diff --git a/src/components/storage/EditBootVolumeModal.vue b/src/components/storage/EditBootVolumeModal.vue
index 02f39ad..b2e1c8d 100644
--- a/src/components/storage/EditBootVolumeModal.vue
+++ b/src/components/storage/EditBootVolumeModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NInput, useMessage } from 'naive-ui'
+import { NInput } from 'naive-ui'
 
 import AppInputNumber from '@/components/AppInputNumber.vue'
 import { computed, reactive, ref, watch } from 'vue'
@@ -8,6 +8,7 @@ import { updateBootVolume } from '@/api/bootVolumes'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import type { BootVolume, UpdateBootVolumeRequest } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -17,7 +18,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{ 'update:show': [boolean]; updated: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 
 const form = reactive({ displayName: '', sizeInGBs: 50, vpusPerGB: 10 })
diff --git a/src/components/task/TaskFormModal.vue b/src/components/task/TaskFormModal.vue
index e2b3360..ad8c08a 100644
--- a/src/components/task/TaskFormModal.vue
+++ b/src/components/task/TaskFormModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NInput, NSelect, useMessage } from 'naive-ui'
+import { NInput, NSelect } from 'naive-ui'
 import { computed, nextTick, reactive, ref, watch } from 'vue'
 
 import { listCachedCompartments, listCachedRegions, listConfigs } from '@/api/configs'
@@ -15,6 +15,7 @@ import TenantPicker from '@/components/TenantPicker.vue'
 import { defaultResourceName } from '@/composables/useFormat'
 import { useAsync } from '@/composables/useAsync'
 import type { Task, TaskType } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 /** task 传入即为编辑模式：回填全部字段，任务类型锁定不可切换 */
 const props = defineProps<{ show: boolean; task?: Task | null }>()
@@ -29,7 +30,7 @@ const TYPE_CARDS: { value: TaskType; title: string; desc: string }[] = [
   { value: 'snatch', title: '抢机', desc: '容量不足时反复尝试创建,抢满自停' },
 ]
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const specForm = ref<InstanceType<typeof InstanceSpecForm> | null>(null)
 
diff --git a/src/components/tenant/AuditLogTab.vue b/src/components/tenant/AuditLogTab.vue
index 6ccc749..9c630ba 100644
--- a/src/components/tenant/AuditLogTab.vue
+++ b/src/components/tenant/AuditLogTab.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
-import { NButton, NDataTable, NModal, NSelect, useMessage, type DataTableColumns } from 'naive-ui'
-import { computed, h, onMounted, reactive, ref, watch } from 'vue'
+import { NButton, NDataTable, NModal, type DataTableColumns } from 'naive-ui'
+import { computed, h, onMounted, reactive, ref } from 'vue'
 
 import { getAuditEventDetail, listAuditEvents } from '@/api/tenant'
 import DetailFieldList, { type DetailRow } from '@/components/DetailFieldList.vue'
@@ -11,17 +11,21 @@ import StatusBadge from '@/components/StatusBadge.vue'
 import { eventLabel } from '@/composables/useEventLabel'
 import { fmtTime } from '@/composables/useFormat'
 import type { AuditEvent } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{ cfgId: number }>()
-const message = useMessage()
+const message = useToast()
 
-const hours = ref(24)
-const hourOptions = [
-  { label: '近 1 小时', value: 1 },
-  { label: '近 6 小时', value: 6 },
-  { label: '近 24 小时', value: 24 },
-  { label: '近 72 小时', value: 72 },
-]
+const loading = ref(false)
+const loadingMore = ref(false)
+const error = ref('')
+const rows = ref<AuditEvent[]>([])
+// 服务端分窗回溯游标:空且 exhausted 表示已到 365 天保留期尽头
+const cursor = ref('')
+const exhausted = ref(false)
+
+const pageCount = computed(() => Math.max(1, Math.ceil(rows.value.length / pagination.pageSize)))
+const hasMore = computed(() => cursor.value !== '' && !exhausted.value)
 
 /** 受控分页：字面量对象会在重渲染时被重建导致页大小切换失效 */
 const pagination = reactive({
@@ -29,8 +33,13 @@ const pagination = reactive({
   pageSize: 20,
   showSizePicker: true,
   pageSizes: [20, 50, 100],
+  prefix: () =>
+    `已加载 ${rows.value.length} 条 · ` +
+    (loadingMore.value ? '正在加载更早…' : exhausted.value ? '已到 365 天保留期尽头' : '翻到末页自动加载更早'),
   onUpdatePage: (p: number) => {
     pagination.page = p
+    // 懒加载触发点:翻到已加载数据的最后一页即向后端续取一批
+    if (p >= pageCount.value) void fetchBatch()
   },
   onUpdatePageSize: (ps: number) => {
     pagination.pageSize = ps
@@ -38,55 +47,48 @@ const pagination = reactive({
   },
 })
 
-const loading = ref(false)
-const loadingMore = ref(false)
-const error = ref('')
-const rows = ref<AuditEvent[]>([])
-const truncated = ref(false)
-const nextPage = ref('')
-// 本次查询的绝对时间窗:续查游标绑定查询参数,必须原样带回
-const win = ref<{ start: string; end: string } | null>(null)
-
+/** 重置信息流:回到最新一批 */
 async function load() {
   loading.value = true
   error.value = ''
+  rows.value = []
+  cursor.value = ''
+  exhausted.value = false
+  pagination.page = 1
   try {
-    const r = await listAuditEvents(props.cfgId, { hours: hours.value })
-    rows.value = r.items
-    truncated.value = r.truncated
-    nextPage.value = r.nextPage ?? ''
-    win.value = { start: r.start, end: r.end }
-    pagination.page = 1
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : '查询失败'
+    await fetchBatch(true)
   } finally {
     loading.value = false
   }
 }
 
-/** 截断续查:同一绝对窗带游标断点续翻,追加去重后按时间重排 */
-async function loadMore() {
-  if (!win.value || !nextPage.value || loadingMore.value) return
+/** 向更早方向续取一批(~100 条):追加去重后按时间重排;
+ *  末页不满且还有更早数据时自动补一批,避免首屏残页 */
+async function fetchBatch(first = false) {
+  if (loadingMore.value || (!first && !hasMore.value)) return
   loadingMore.value = true
   try {
-    const r = await listAuditEvents(props.cfgId, { ...win.value, page: nextPage.value })
+    const r = await listAuditEvents(props.cfgId, { cursor: cursor.value || undefined })
     const seen = new Set(rows.value.map((e) => e.eventId))
     rows.value = [...rows.value, ...r.items.filter((e) => !seen.has(e.eventId))].sort((a, b) =>
       (b.eventTime ?? '').localeCompare(a.eventTime ?? ''),
     )
-    truncated.value = r.truncated
-    nextPage.value = r.nextPage ?? ''
+    cursor.value = r.cursor ?? ''
+    exhausted.value = r.exhausted
   } catch (e) {
-    // 追加失败不清空已有列表;游标过期时提示重新查询
-    message.error(e instanceof Error ? e.message : '继续加载失败,请刷新重新查询')
+    if (first) {
+      error.value = e instanceof Error ? e.message : '查询失败'
+    } else {
+      // 追加失败不清空已有列表;游标过期时提示刷新重来
+      message.error(e instanceof Error ? e.message : '继续加载失败,请刷新重新查询')
+    }
   } finally {
     loadingMore.value = false
   }
+  if (hasMore.value && rows.value.length < pagination.pageSize) void fetchBatch()
 }
 
 onMounted(() => void load())
-// 切换时间窗自动重查并回到第一页
-watch(hours, () => void load())
 
 // ---- 行点击详情:原始 JSON 懒取(命中服务端缓存秒开,过期走小窗重查) ----
 const detail = ref<AuditEvent | null>(null)
@@ -202,16 +204,8 @@ const columns: DataTableColumns<AuditEvent> = [
   <div class="panel">
     <div class="flex flex-wrap items-center gap-2.5 border-b border-line-soft px-4.5 py-3">
       <div class="text-sm font-semibold">审计日志</div>
-      <template v-if="truncated">
-        <StatusBadge kind="warn" label="结果已截断" />
-        <NButton v-if="nextPage" size="tiny" :loading="loadingMore" @click="loadMore">
-          继续加载更早
-        </NButton>
-      </template>
+      <StatusBadge v-if="exhausted" kind="run" label="已加载全部保留期数据" :dot="false" />
       <div class="flex-1" />
-      <div class="w-32 max-md:w-full">
-        <NSelect v-model:value="hours" size="small" :options="hourOptions" />
-      </div>
       <NButton size="small" :loading="loading" @click="load()">刷新</NButton>
     </div>
 
@@ -235,7 +229,7 @@ const columns: DataTableColumns<AuditEvent> = [
       OCI Audit 免费且默认开启，事件保留 365 天，无需在云端做任何配置 ·
       实时查询不入库，事件通常延迟数分钟可见 ·
       已默认过滤遥测噪声（SummarizeMetricsData）与内网地址发起的服务互调 ·
-      单次最多翻 10 页，截断时点「继续加载更早」断点续查 · 点击行查看完整详情
+      从最新事件起每批约 100 条，翻到末页自动向更早加载，空档期自动扩窗回溯 · 点击行查看完整详情
     </FootNote>
 
     <NModal v-model:show="showDetail" preset="card" closable :style="{ width: '720px', maxWidth: 'calc(100vw - 24px)' }">
diff --git a/src/components/tenant/IdpFormModal.vue b/src/components/tenant/IdpFormModal.vue
index 092d951..dd303d8 100644
--- a/src/components/tenant/IdpFormModal.vue
+++ b/src/components/tenant/IdpFormModal.vue
@@ -1,16 +1,17 @@
 <script setup lang="ts">
-import { NCheckbox, NInput, NSelect, NSwitch, useMessage } from 'naive-ui'
+import { NCheckbox, NInput, NSelect, NSwitch } from 'naive-ui'
 import { computed, reactive, ref, watch } from 'vue'
 
 import { createIdp, getIdentitySetting, type CreateIdpBody } from '@/api/tenant'
 import FilePicker from '@/components/FilePicker.vue'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
+import { useToast } from '@/composables/useToast'
 
-const props = defineProps<{ show: boolean; cfgId: number }>()
+const props = defineProps<{ show: boolean; cfgId: number; domainId?: string }>()
 const emit = defineEmits<{ 'update:show': [boolean]; created: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 // 「用户需要提供主电子邮件地址」开启时 JIT 必须映射邮箱
 const primaryEmailRequired = ref(false)
@@ -32,7 +33,7 @@ const userAttrOptions = [
 ]
 
 // 默认值与控制台一致：名称 ID 格式「无」、NameID 映射用户名、
-// JIT 开启建用户不更新、分配 Administrators 组
+// JIT 开启建用户不更新、分配租户管理员组
 const blank = {
   name: '',
   metadata: '',
@@ -103,7 +104,7 @@ function buildBody(): CreateIdpBody {
 async function submit() {
   submitting.value = true
   try {
-    const created = await createIdp(props.cfgId, buildBody())
+    const created = await createIdp(props.cfgId, buildBody(), props.domainId)
     message.success(`IdP「${created.name}」已创建（禁用态），激活后显示到登录页`)
     emit('update:show', false)
     emit('created')
@@ -199,7 +200,7 @@ async function submit() {
       <NCheckbox v-model:checked="form.jitCreate">首次联邦登录时自动创建用户</NCheckbox>
       <NCheckbox v-model:checked="form.jitUpdate">每次登录时按断言更新既有用户</NCheckbox>
       <NCheckbox v-model:checked="form.jitAssignAdminGroup">
-        将 JIT 用户加入 Administrators 组
+        将 JIT 用户加入租户管理员组
       </NCheckbox>
       <NCheckbox
         v-model:checked="form.jitMapEmail"
diff --git a/src/components/tenant/IdpTab.vue b/src/components/tenant/IdpTab.vue
index cc1e53d..4defb48 100644
--- a/src/components/tenant/IdpTab.vue
+++ b/src/components/tenant/IdpTab.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NDataTable, NPopconfirm, NSwitch, useDialog, useMessage, type DataTableColumns } from 'naive-ui'
+import { NButton, NDataTable, NPopconfirm, NSwitch, useDialog, type DataTableColumns } from 'naive-ui'
 import { h, ref } from 'vue'
 
 import {
@@ -16,13 +16,14 @@ import StatusBadge from '@/components/StatusBadge.vue'
 import IdpFormModal from '@/components/tenant/IdpFormModal.vue'
 import { useAsync } from '@/composables/useAsync'
 import type { IdentityProvider, SignOnRule } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const props = defineProps<{ cfgId: number }>()
+const props = defineProps<{ cfgId: number; domainId?: string }>()
 
-const message = useMessage()
+const message = useToast()
 const dialog = useDialog()
-const idps = useAsync(() => listIdps(props.cfgId))
-const rules = useAsync(() => listSignOnRules(props.cfgId))
+const idps = useAsync(() => listIdps(props.cfgId, props.domainId))
+const rules = useAsync(() => listSignOnRules(props.cfgId, props.domainId))
 const showCreate = ref(false)
 
 async function act(fn: () => Promise<unknown>, ok: string) {
@@ -74,7 +75,7 @@ const idpColumns: DataTableColumns<IdentityProvider> = [
           size: 'small',
           value: row.enabled,
           onUpdateValue: (v: boolean) =>
-            act(() => activateIdp(props.cfgId, row.id, v), v ? '已激活并显示到登录页' : '已停用'),
+            act(() => activateIdp(props.cfgId, row.id, v, props.domainId), v ? '已激活并显示到登录页' : '已停用'),
         }),
         h(
           NButton,
@@ -123,7 +124,7 @@ const ruleColumns: DataTableColumns<SignOnRule> = [
             NPopconfirm,
             {
               onPositiveClick: () =>
-                act(() => deleteSignOnExemption(props.cfgId, row.id), '已删除免 MFA 规则并恢复优先级'),
+                act(() => deleteSignOnExemption(props.cfgId, row.id, props.domainId), '已删除免 MFA 规则并恢复优先级'),
             },
             {
               trigger: () =>
@@ -136,7 +137,7 @@ const ruleColumns: DataTableColumns<SignOnRule> = [
 
 async function doDownloadMetadata() {
   try {
-    await downloadSamlMetadata(props.cfgId)
+    await downloadSamlMetadata(props.cfgId, props.domainId)
     message.success('SAML 元数据已下载')
   } catch (e) {
     message.error(e instanceof Error ? e.message : '下载失败')
@@ -154,7 +155,7 @@ function confirmDeleteIdp(row: IdentityProvider) {
     positiveText: '确认删除',
     negativeText: '取消',
     onPositiveClick: () =>
-      act(() => deleteIdp(props.cfgId, row.id), `已删除 IdP「${row.name}」及其关联规则`),
+      act(() => deleteIdp(props.cfgId, row.id, props.domainId), `已删除 IdP「${row.name}」及其关联规则`),
   })
 }
 
@@ -165,7 +166,7 @@ function addExemption() {
     return
   }
   void act(
-    () => createSignOnExemption(props.cfgId, enabled.id),
+    () => createSignOnExemption(props.cfgId, enabled.id, props.domainId),
     `已为 ${enabled.name} 创建免 MFA 规则并置顶`,
   )
 }
@@ -211,6 +212,6 @@ function addExemption() {
       </FootNote>
     </div>
 
-    <IdpFormModal v-model:show="showCreate" :cfg-id="cfgId" @created="idps.run()" />
+    <IdpFormModal v-model:show="showCreate" :cfg-id="cfgId" :domain-id="domainId" @created="idps.run()" />
   </div>
 </template>
diff --git a/src/components/tenant/MiscTab.vue b/src/components/tenant/MiscTab.vue
index 8d423b5..abb971b 100644
--- a/src/components/tenant/MiscTab.vue
+++ b/src/components/tenant/MiscTab.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NDynamicTags, NPopconfirm, NSpin, NSwitch, useMessage } from 'naive-ui'
+import { NButton, NDynamicTags, NPopconfirm, NSpin, NSwitch } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import {
@@ -22,14 +22,15 @@ import StatusBadge from '@/components/StatusBadge.vue'
 import PolicyEditModal from '@/components/tenant/PolicyEditModal.vue'
 import { useAsync } from '@/composables/useAsync'
 import type { PasswordPolicy } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const props = defineProps<{ cfgId: number }>()
+const props = defineProps<{ cfgId: number; domainId?: string }>()
 
-const message = useMessage()
+const message = useToast()
 
-const policies = useAsync(() => listPasswordPolicies(props.cfgId))
-const recipients = useAsync(() => getNotificationRecipients(props.cfgId))
-const identity = useAsync(() => getIdentitySetting(props.cfgId))
+const policies = useAsync(() => listPasswordPolicies(props.cfgId, props.domainId))
+const recipients = useAsync(() => getNotificationRecipients(props.cfgId, props.domainId))
+const identity = useAsync(() => getIdentitySetting(props.cfgId, props.domainId))
 const webhook = useAsync(() => getLogWebhook(props.cfgId))
 const relay = useAsync(() => getLogRelay(props.cfgId))
 const savingIdentity = ref(false)
@@ -114,7 +115,7 @@ watch(
 async function saveRecipients() {
   saving.value = true
   try {
-    await updateNotificationRecipients(props.cfgId, emails.value)
+    await updateNotificationRecipients(props.cfgId, emails.value, props.domainId)
     message.success(emails.value.length ? '通知收件人已保存' : '已关闭 test mode，恢复默认发送')
     void recipients.run()
   } catch (e) {
@@ -127,7 +128,7 @@ async function saveRecipients() {
 async function toggleEmailRequired(v: boolean) {
   savingIdentity.value = true
   try {
-    await updateIdentitySetting(props.cfgId, v)
+    await updateIdentitySetting(props.cfgId, v, props.domainId)
     message.success(v ? '已开启：添加用户 / JIT 预配必须提供邮箱' : '已关闭：邮箱变为可选')
     void identity.run()
   } catch (e) {
@@ -402,6 +403,7 @@ function policyDesc(p: PasswordPolicy): string {
     <PolicyEditModal
       v-model:show="showPolicyEdit"
       :cfg-id="cfgId"
+      :domain-id="domainId"
       :policy="editingPolicy"
       @updated="policies.run()"
     />
diff --git a/src/components/tenant/PolicyEditModal.vue b/src/components/tenant/PolicyEditModal.vue
index ccd2998..fd61264 100644
--- a/src/components/tenant/PolicyEditModal.vue
+++ b/src/components/tenant/PolicyEditModal.vue
@@ -1,19 +1,20 @@
 <script setup lang="ts">
-import { NSwitch, useMessage } from 'naive-ui'
+import { NSwitch } from 'naive-ui'
 import { reactive, ref, watch } from 'vue'
 
 import { updatePasswordPolicy } from '@/api/tenant'
 import FormModal from '@/components/FormModal.vue'
 import type { PasswordPolicy } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const props = defineProps<{ show: boolean; cfgId: number; policy: PasswordPolicy | null }>()
+const props = defineProps<{ show: boolean; cfgId: number; domainId?: string; policy: PasswordPolicy | null }>()
 const emit = defineEmits<{ 'update:show': [boolean]; updated: [] }>()
 
 // 关闭开关时写回的控制台默认值
 const DEFAULT_EXPIRES_DAYS = 120
 const DEFAULT_HISTORY_COUNT = 4
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const form = reactive({ neverExpires: true, allowReuse: true })
 
@@ -45,7 +46,7 @@ async function submit() {
   }
   submitting.value = true
   try {
-    await updatePasswordPolicy(props.cfgId, props.policy.id, body)
+    await updatePasswordPolicy(props.cfgId, props.policy.id, body, props.domainId)
     message.success('密码策略已更新')
     emit('update:show', false)
     emit('updated')
diff --git a/src/components/tenant/SubscribeRegionModal.vue b/src/components/tenant/SubscribeRegionModal.vue
index 0e041ac..938476b 100644
--- a/src/components/tenant/SubscribeRegionModal.vue
+++ b/src/components/tenant/SubscribeRegionModal.vue
@@ -1,11 +1,12 @@
 <script setup lang="ts">
-import { NCheckbox, NSelect, useMessage } from 'naive-ui'
+import { NCheckbox, NSelect } from 'naive-ui'
 import { computed, ref, watch } from 'vue'
 
 import { listRegions, subscribeRegion } from '@/api/configs'
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import { useAsync } from '@/composables/useAsync'
+import { useToast } from '@/composables/useToast'
 
 const props = defineProps<{
   show: boolean
@@ -16,7 +17,7 @@ const props = defineProps<{
 }>()
 const emit = defineEmits<{ 'update:show': [boolean]; subscribed: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 const regionKey = ref<string | null>(null)
 const acknowledged = ref(false)
diff --git a/src/components/tenant/UserFormModal.vue b/src/components/tenant/UserFormModal.vue
index af278d6..a8261cb 100644
--- a/src/components/tenant/UserFormModal.vue
+++ b/src/components/tenant/UserFormModal.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NCheckbox, NInput, useMessage } from 'naive-ui'
+import { NCheckbox, NInput } from 'naive-ui'
 import { computed, reactive, ref, watch } from 'vue'
 
 import {
@@ -12,12 +12,13 @@ import {
 import FormField from '@/components/FormField.vue'
 import FormModal from '@/components/FormModal.vue'
 import type { IamUser, IamUserDetail } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 // user 非空即编辑模式：打开时拉取域档案预填充，提交只发送与原值不同的字段
-const props = defineProps<{ show: boolean; cfgId: number; user?: IamUser | null }>()
+const props = defineProps<{ show: boolean; cfgId: number; domainId?: string; user?: IamUser | null }>()
 const emit = defineEmits<{ 'update:show': [boolean]; created: [] }>()
 
-const message = useMessage()
+const message = useToast()
 const submitting = ref(false)
 // 域开启「用户需要提供主电子邮件地址」时邮箱必填
 const emailRequired = ref(false)
@@ -57,7 +58,7 @@ watch(
 
 async function loadIdentitySetting() {
   try {
-    emailRequired.value = (await getIdentitySetting(props.cfgId)).primaryEmailRequired
+    emailRequired.value = (await getIdentitySetting(props.cfgId, props.domainId)).primaryEmailRequired
   } catch {
     emailRequired.value = false
   }
@@ -67,7 +68,7 @@ async function loadIdentitySetting() {
 async function loadDetail(userId: string) {
   detailLoading.value = true
   try {
-    const d = await getUserDetail(props.cfgId, userId)
+    const d = await getUserDetail(props.cfgId, userId, props.domainId)
     if (props.user?.id !== userId) return
     detail.value = d
     if (!d.inDomain) return
@@ -139,20 +140,24 @@ async function submitEdit(u: IamUser) {
     emit('update:show', false)
     return
   }
-  await updateUser(props.cfgId, u.id, body)
+  await updateUser(props.cfgId, u.id, body, props.domainId)
   message.success(`用户「${u.name}」已更新`)
 }
 
 async function submitCreate() {
-  const created = await createUser(props.cfgId, {
-    name: form.name.trim(),
-    givenName: form.givenName.trim(),
-    familyName: form.familyName.trim(),
-    email: form.email.trim() || undefined,
-    description: form.description.trim() || undefined,
-    grantDomainAdmin: form.grantDomainAdmin,
-    addToAdminGroup: form.addToAdminGroup,
-  })
+  const created = await createUser(
+    props.cfgId,
+    {
+      name: form.name.trim(),
+      givenName: form.givenName.trim(),
+      familyName: form.familyName.trim(),
+      email: form.email.trim() || undefined,
+      description: form.description.trim() || undefined,
+      grantDomainAdmin: form.grantDomainAdmin,
+      addToAdminGroup: form.addToAdminGroup,
+    },
+    props.domainId,
+  )
   message.success(`用户「${created.name}」已创建，可再执行「重置密码」下发初始密码`)
 }
 
@@ -225,7 +230,7 @@ async function submit() {
         {{ editing ? '身份域管理员' : '添加到身份域管理员' }}
       </NCheckbox>
       <NCheckbox v-model:checked="form.addToAdminGroup" :disabled="classicUser || detailLoading">
-        {{ editing ? '管理员组（Administrators）成员' : '添加到管理员组（Administrators）' }}
+        {{ editing ? '租户管理员组成员' : '添加到租户管理员组' }}
       </NCheckbox>
       <div v-if="adminHint" class="text-xs text-ink-3">{{ adminHint }}</div>
     </div>
diff --git a/src/components/tenant/UsersTab.vue b/src/components/tenant/UsersTab.vue
index 6e18c31..0edcf56 100644
--- a/src/components/tenant/UsersTab.vue
+++ b/src/components/tenant/UsersTab.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NDataTable, NPopconfirm, useDialog, useMessage, type DataTableColumns } from 'naive-ui'
+import { NButton, NDataTable, NPopconfirm, useDialog, type DataTableColumns } from 'naive-ui'
 import { h, ref } from 'vue'
 
 import { clearUserMfa, deleteUser, deleteUserApiKeys, listUsers, resetUserPassword } from '@/api/tenant'
@@ -9,12 +9,13 @@ import UserFormModal from '@/components/tenant/UserFormModal.vue'
 import { fmtTime } from '@/composables/useFormat'
 import { useAsync } from '@/composables/useAsync'
 import type { IamUser } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const props = defineProps<{ cfgId: number }>()
+const props = defineProps<{ cfgId: number; domainId?: string }>()
 
-const message = useMessage()
+const message = useToast()
 const dialog = useDialog()
-const users = useAsync(() => listUsers(props.cfgId))
+const users = useAsync(() => listUsers(props.cfgId, props.domainId))
 const showForm = ref(false)
 const editingUser = ref<IamUser | null>(null)
 
@@ -48,13 +49,13 @@ function confirmDelete(row: IamUser) {
       ]),
     positiveText: '确认删除',
     negativeText: '取消',
-    onPositiveClick: () => act(() => deleteUser(props.cfgId, row.id), `已删除用户 ${row.name}`),
+    onPositiveClick: () => act(() => deleteUser(props.cfgId, row.id, props.domainId), `已删除用户 ${row.name}`),
   })
 }
 
 async function resetPwd(row: IamUser) {
   try {
-    const { password } = await resetUserPassword(props.cfgId, row.id)
+    const { password } = await resetUserPassword(props.cfgId, row.id, props.domainId)
     dialog.success({
       title: '一次性密码',
       content: () =>
@@ -119,7 +120,7 @@ const columns: DataTableColumns<IamUser> = [
           NPopconfirm,
           {
             onPositiveClick: () =>
-              act(() => clearUserMfa(props.cfgId, row.id), `已清除 ${row.name} 的全部 MFA`),
+              act(() => clearUserMfa(props.cfgId, row.id, props.domainId), `已清除 ${row.name} 的全部 MFA`),
           },
           {
             trigger: () => h(NButton, { size: 'tiny', quaternary: true }, { default: () => '清 MFA' }),
@@ -169,6 +170,7 @@ const columns: DataTableColumns<IamUser> = [
     <UserFormModal
       v-model:show="showForm"
       :cfg-id="cfgId"
+      :domain-id="domainId"
       :user="editingUser"
       @created="users.run()"
     />
diff --git a/src/composables/useAliveStatus.ts b/src/composables/useAliveStatus.ts
new file mode 100644
index 0000000..9beb17e
--- /dev/null
+++ b/src/composables/useAliveStatus.ts
@@ -0,0 +1,17 @@
+import type { AliveStatus } from '@/types/api'
+
+/** 测活状态 → 展示标签与徽标语义;suspended 来自云端账户能力接口的暂停标记 */
+export const aliveStatusMeta: Record<
+  AliveStatus,
+  { label: string; kind: 'run' | 'term' | 'warn' | 'check' }
+> = {
+  alive: { label: '存活', kind: 'run' },
+  dead: { label: '失联', kind: 'term' },
+  suspended: { label: '暂停', kind: 'warn' },
+  unknown: { label: '未测', kind: 'check' },
+}
+
+/** 兜底取值:后端新增状态时前端旧包不至于崩 */
+export function aliveMeta(status: string) {
+  return aliveStatusMeta[status as AliveStatus] ?? aliveStatusMeta.unknown
+}
diff --git a/src/composables/useThemeRipple.ts b/src/composables/useThemeRipple.ts
new file mode 100644
index 0000000..833ef01
--- /dev/null
+++ b/src/composables/useThemeRipple.ts
@@ -0,0 +1,61 @@
+import { nextTick } from 'vue'
+
+import { useAppStore } from '@/stores/app'
+
+/** 扩散揭示时长;与 main.css 中 view-transition 的默认动画禁用配套 */
+const RIPPLE_DURATION = 560
+
+/** 进行中标志:扩散未结束时忽略再次触发,防止打断上一个 transition 造成瞬跳闪烁 */
+let rippling = false
+
+/** 明暗主题切换,新主题以触发元素为圆心向外扩散揭示(View Transitions);
+ *  浏览器不支持或用户偏好减少动效时退化为直接切换 */
+export function useThemeRipple() {
+  const app = useAppStore()
+
+  async function toggleDarkFrom(e: MouseEvent) {
+    const reduced = window.matchMedia('(prefers-reduced-motion: reduce)').matches
+    if (typeof document.startViewTransition !== 'function' || reduced) {
+      app.toggleDark()
+      return
+    }
+    if (rippling) return
+    rippling = true
+    const { x, y } = originOf(e)
+    // 回调内等 nextTick:html.dark 由 store watcher 刷新,须在快照回调结束前落地。
+    // theme-switching 禁掉页面自身的颜色 transition:::view-transition-new(root)
+    // 是新 DOM 的实时替身,组件残留的渐变会在扩散圆内继续播放,观感即闪烁。
+    const transition = document.startViewTransition(async () => {
+      document.documentElement.classList.add('theme-switching')
+      app.toggleDark()
+      await nextTick()
+    })
+    try {
+      await transition.ready
+      const radius = Math.hypot(Math.max(x, innerWidth - x), Math.max(y, innerHeight - y))
+      document.documentElement.animate(
+        { clipPath: [`circle(0px at ${x}px ${y}px)`, `circle(${radius}px at ${x}px ${y}px)`] },
+        { duration: RIPPLE_DURATION, easing: 'ease-in-out', pseudoElement: '::view-transition-new(root)' },
+      )
+    } finally {
+      void transition.finished.finally(() => {
+        document.documentElement.classList.remove('theme-switching')
+        rippling = false
+      })
+    }
+  }
+
+  return { toggleDarkFrom }
+}
+
+/** 扩散圆心:优先触发元素几何中心(键盘触发 clientX/Y 为 0 也稳),兜底点击坐标 */
+function originOf(e: MouseEvent): { x: number; y: number } {
+  const el = e.currentTarget
+  if (el instanceof Element) {
+    const rect = el.getBoundingClientRect()
+    if (rect.width || rect.height) {
+      return { x: rect.left + rect.width / 2, y: rect.top + rect.height / 2 }
+    }
+  }
+  return { x: e.clientX, y: e.clientY }
+}
diff --git a/src/composables/useToast.ts b/src/composables/useToast.ts
index 3b09b2a..94ed172 100644
--- a/src/composables/useToast.ts
+++ b/src/composables/useToast.ts
@@ -4,6 +4,17 @@ import { h, ref, type Ref, type VNodeChild } from 'vue'
 type ToastKind = 'error' | 'warning'
 
 const AUTO_CLOSE_MS = 8000
+/** 超过此长度的消息自动折叠成「标题 + 展开详情」 */
+const LONG_TEXT = 64
+
+/** 长错误提炼标题:优先 hint 分隔符(request.ts 的「hint｜error」),次选首个冒号操作前缀,兜底截断 */
+function summarize(text: string): string {
+  const bar = text.indexOf('｜')
+  if (bar > 0 && bar <= 40) return text.slice(0, bar)
+  const colon = text.search(/：|: /)
+  if (colon > 0 && colon <= 40) return text.slice(0, colon)
+  return [...text].slice(0, 40).join('') + '…'
+}
 
 function renderDetail(kind: ToastKind, detail: string, copied: Ref<boolean>): VNodeChild {
   return h('div', { class: 'toast-code' }, [
@@ -51,6 +62,11 @@ export function useToast() {
   const message = useMessage()
 
   function show(kind: ToastKind, text: string, detail?: string) {
+    // 未显式给 detail 的超长消息(如 OCI 透传错误)自动折叠,避免整段撑爆 toast
+    if (!detail && text.length > LONG_TEXT) {
+      detail = text
+      text = summarize(text)
+    }
     if (!detail) {
       message[kind](text)
       return
diff --git a/src/layouts/AppLayout.vue b/src/layouts/AppLayout.vue
index a1c33be..85cf48f 100644
--- a/src/layouts/AppLayout.vue
+++ b/src/layouts/AppLayout.vue
@@ -225,7 +225,6 @@ async function logout() {
       :instance-id="consoleStore.instanceId"
       :region="consoleStore.region"
       :instance-name="consoleStore.instanceName"
-      :root-password="consoleStore.rootPassword"
     />
   </div>
 </template>
diff --git a/src/stores/app.ts b/src/stores/app.ts
index 2e1c7f9..f8702ba 100644
--- a/src/stores/app.ts
+++ b/src/stores/app.ts
@@ -2,6 +2,10 @@ import { defineStore } from 'pinia'
 import { ref, watch } from 'vue'
 
 const DARK_KEY = 'oci-portal:dark'
+const LOGO_KEY = 'oci-portal:logo'
+
+/** logo 款式:burst 星爆(现款)/ seal 波浪封印 */
+export type LogoVariant = 'burst' | 'seal'
 
 function initialDark(): boolean {
   const saved = localStorage.getItem(DARK_KEY)
@@ -9,6 +13,10 @@ function initialDark(): boolean {
   return window.matchMedia('(prefers-color-scheme: dark)').matches
 }
 
+function initialLogo(): LogoVariant {
+  return localStorage.getItem(LOGO_KEY) === 'seal' ? 'seal' : 'burst'
+}
+
 /** 跨页面共享的界面状态：侧栏收缩、明暗主题 */
 export const useAppStore = defineStore('app', () => {
   const sidebarCollapsed = ref(false)
@@ -25,6 +33,11 @@ export const useAppStore = defineStore('app', () => {
     { immediate: true },
   )
 
+  /** logo 款式:默认星爆,设置 · 关于点击 logo 切换后按选择记忆 */
+  const logoVariant = ref<LogoVariant>(initialLogo())
+
+  watch(logoVariant, (v) => localStorage.setItem(LOGO_KEY, v))
+
   function toggleSidebar() {
     sidebarCollapsed.value = !sidebarCollapsed.value
   }
@@ -33,5 +46,9 @@ export const useAppStore = defineStore('app', () => {
     dark.value = !dark.value
   }
 
-  return { sidebarCollapsed, toggleSidebar, dark, toggleDark }
+  function toggleLogoVariant() {
+    logoVariant.value = logoVariant.value === 'burst' ? 'seal' : 'burst'
+  }
+
+  return { sidebarCollapsed, toggleSidebar, dark, toggleDark, logoVariant, toggleLogoVariant }
 })
diff --git a/src/stores/console.ts b/src/stores/console.ts
index 0f3c094..9f602fd 100644
--- a/src/stores/console.ts
+++ b/src/stores/console.ts
@@ -6,7 +6,6 @@ interface SerialTarget {
   instanceId: string
   region?: string
   instanceName?: string
-  rootPassword?: string
 }
 
 /** 全局串行控制台面板状态：面板挂在 AppLayout，切换路由不销毁会话 */
@@ -16,7 +15,6 @@ export const useConsoleStore = defineStore('console', () => {
   const instanceId = ref('')
   const region = ref<string | undefined>(undefined)
   const instanceName = ref('')
-  const rootPassword = ref('')
 
   /** 打开串行终端；已开着且换了实例时先关旧会话再开新 */
   async function openSerial(target: SerialTarget) {
@@ -29,7 +27,6 @@ export const useConsoleStore = defineStore('console', () => {
     instanceId.value = target.instanceId
     region.value = target.region
     instanceName.value = target.instanceName ?? ''
-    rootPassword.value = target.rootPassword ?? ''
     show.value = true
   }
 
@@ -37,5 +34,5 @@ export const useConsoleStore = defineStore('console', () => {
     show.value = false
   }
 
-  return { show, cfgId, instanceId, region, instanceName, rootPassword, openSerial, close }
+  return { show, cfgId, instanceId, region, instanceName, openSerial, close }
 })
diff --git a/src/types/api.ts b/src/types/api.ts
index dd9e6e7..536e1d0 100644
--- a/src/types/api.ts
+++ b/src/types/api.ts
@@ -16,6 +16,10 @@ export interface LoginResponse {
   expiresAt: string
 }
 
+/** 敏感操作成功后随响应下发的新会话(旧 token 已全部失效);
+ *  204 降级时为 undefined,前端按会话失效走重新登录 */
+export type SessionRefresh = LoginResponse | undefined
+
 /** 两步验证状态 */
 export interface TotpStatus {
   enabled: boolean
@@ -83,7 +87,7 @@ export interface OauthProviderInfo {
 
 // ---- API Key 配置（租户）----
 export type AccountType = 'paid' | 'trial' | 'free' | 'unknown'
-export type AliveStatus = 'alive' | 'dead' | 'unknown'
+export type AliveStatus = 'alive' | 'dead' | 'suspended' | 'unknown'
 
 /** 列表接口（GET /oci-configs）的瘦身摘要：只含列表页与全局选择器消费的字段 */
 export interface OciConfigSummary {
@@ -538,6 +542,16 @@ export interface CostItem {
   unit: string
 }
 
+// ---- 身份域 ----
+// 租户 ACTIVE 身份域;后端只下发元数据,SCIM 端点 URL 由后端解析
+export interface IdentityDomain {
+  id: string
+  displayName: string
+  homeRegion: string
+  type: string
+  licenseType: string
+}
+
 // ---- 租户用户管理 ----
 export interface IamUser {
   id: string
@@ -579,15 +593,12 @@ export interface AuditEvent {
   requestPath: string
 }
 
-// truncated 为 true 表示服务端翻页到限(10 页)被截断;nextPage 为续查游标,
-// 配合 start/end 绝对时间窗可断点加载更早的事件
+// 批式懒加载响应:cursor 供下一批续查原样带回;
+// cursor 为空且 exhausted 为 true 表示已回溯到 365 天保留期尽头
 export interface AuditEventsResult {
   items: AuditEvent[]
-  truncated: boolean
-  nextPage?: string
-  /** 本次实际查询的绝对窗(RFC3339),续查必须原样带回 */
-  start: string
-  end: string
+  cursor?: string
+  exhausted: boolean
 }
 
 // ---- 域通知与密码策略 ----
@@ -724,6 +735,41 @@ export interface TelegramSetting {
   tokenTail: string
 }
 
+/** 通知渠道类型(Telegram 沿用独立接口,不在此枚举) */
+export type NotifyChannelType = 'webhook' | 'ntfy' | 'bark' | 'smtp'
+
+/** 通知渠道脱敏视图;密文字段(ntfy token / bark key / smtp 密码)只回 set/tail */
+export interface NotifyChannelItem {
+  type: NotifyChannelType
+  enabled: boolean
+  url?: string
+  bodyTemplate?: string
+  server?: string
+  topic?: string
+  host?: string
+  port?: number
+  username?: string
+  from?: string
+  to?: string
+  secretSet: boolean
+  secretTail?: string
+}
+
+/** 保存单渠道配置;secret 缺省沿用已存值,空串清除 */
+export interface UpdateNotifyChannelBody {
+  enabled: boolean
+  url?: string
+  bodyTemplate?: string
+  server?: string
+  topic?: string
+  host?: string
+  port?: number
+  username?: string
+  from?: string
+  to?: string
+  secret?: string
+}
+
 /** 通知事件开关（通知管理）；存量部署未保存过时后端按全开返回 */
 export interface NotifyEventsSetting {
   /** 任务由成功转失败时推送 */
@@ -832,6 +878,32 @@ export interface LogEventPage {
   total: number
 }
 
+/** 回传事件告警规则;条件间 AND,空条件视为任意 */
+export interface AlertRule {
+  id: number
+  name: string
+  enabled: boolean
+  /** 0=全部租户 */
+  ociConfigId: number
+  /** 逗号分隔事件短名(如 TerminateInstance),空=全部 */
+  eventTypes: string
+  /** 逗号分隔 IP/CIDR,空=任意 */
+  sourceIps: string
+  /** in:命中列表告警;notin:不在列表才告警(白名单) */
+  sourceIpMode: 'in' | 'notin'
+  /** 资源名子串,空=任意 */
+  resourceMatch: string
+  /** 触发阈值,默认 1(即时) */
+  threshold: number
+  /** 聚合窗口分钟,threshold>1 时必填 */
+  windowMinutes: number
+  createdAt: string
+  updatedAt: string
+}
+
+/** 创建/更新告警规则请求体 */
+export type AlertRuleBody = Omit<AlertRule, 'id' | 'createdAt' | 'updatedAt'>
+
 /** 每租户回传回调地址;path 需以面板公网域名拼接完整 URL */
 export interface LogWebhookInfo {
   path: string
diff --git a/src/views/AiGatewayView.vue b/src/views/AiGatewayView.vue
index e80659a..7e206b0 100644
--- a/src/views/AiGatewayView.vue
+++ b/src/views/AiGatewayView.vue
@@ -1,13 +1,14 @@
 <script setup lang="ts">
-import { NButton, useMessage } from 'naive-ui'
+import { NButton } from 'naive-ui'
 import { computed, ref } from 'vue'
 
 import { listAiChannels, listAiKeys, listAiModels } from '@/api/aigateway'
 import AiChannelPanel from '@/components/ai/AiChannelPanel.vue'
 import AiKeyPanel from '@/components/ai/AiKeyPanel.vue'
 import { useAsync } from '@/composables/useAsync'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 
 const keys = useAsync(listAiKeys)
 const channels = useAsync(listAiChannels)
diff --git a/src/views/BootVolumeListView.vue b/src/views/BootVolumeListView.vue
index e516a70..5b1a61c 100644
--- a/src/views/BootVolumeListView.vue
+++ b/src/views/BootVolumeListView.vue
@@ -7,7 +7,6 @@ import {
   NInputGroupLabel,
   NPopconfirm,
   NSelect,
-  useMessage,
   type DataTableColumns,
 } from 'naive-ui'
 import { computed, h, ref, watch } from 'vue'
@@ -24,6 +23,7 @@ import { fmtTime, shortAd, truncOcid, vpusLabel } from '@/composables/useFormat'
 import { useAsync } from '@/composables/useAsync'
 import { useScopeStore } from '@/stores/scope'
 import type { BootVolume } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 interface BvRow extends BootVolume {
   cfgId: number
@@ -31,7 +31,7 @@ interface BvRow extends BootVolume {
 
 /** 租户 / 区域 / 区间来自侧栏全局作用域 */
 const scope = useScopeStore()
-const message = useMessage()
+const message = useToast()
 
 /** 当前作用域租户失联时整页替换占位,不发起资源请求 */
 const isDead = computed(() => scope.currentConfig?.aliveStatus === 'dead')
diff --git a/src/views/InstanceDetailView.vue b/src/views/InstanceDetailView.vue
index 6464b6b..117f04f 100644
--- a/src/views/InstanceDetailView.vue
+++ b/src/views/InstanceDetailView.vue
@@ -6,7 +6,6 @@ import {
   NPopconfirm,
   NSpin,
   useDialog,
-  useMessage,
   type DataTableColumns,
 } from 'naive-ui'
 import { computed, h, ref, watch } from 'vue'
@@ -49,10 +48,11 @@ import {
   useTransientPoll,
 } from '@/composables/useTransientPoll'
 import type { BootVolume, ConsoleConnection, PowerAction, VolumeAttachment } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const route = useRoute()
 const router = useRouter()
-const message = useMessage()
+const message = useToast()
 const dialog = useDialog()
 const { alias: regionAlias } = useRegionAlias()
 
@@ -133,10 +133,23 @@ const isStopped = computed(() => instance.data.value?.lifecycleState === 'STOPPE
 const isEnded = computed(() =>
   ['TERMINATED', 'TERMINATING'].includes(instance.data.value?.lifecycleState ?? ''),
 )
+
+// 区块数据首次加载中禁用对应头部按钮(loading && !data:静默轮询刷新不闪禁用态)
+const bvLoading = computed(
+  () => (bvAtts.loading.value || bvDetails.loading.value) && !bvDetails.data.value,
+)
+const volLoading = computed(() => volAtts.loading.value && !volAtts.data.value)
+const consolesLoading = computed(() => consoles.loading.value && !consoles.data.value)
 const attachedVolumeIds = computed(() => (volAtts.data.value ?? []).map((a) => a.volumeId))
 
 /** 创建时若选了随机密码，密码写在 TAG RootPassword 中，这里回显 */
 const rootPassword = computed(() => instance.data.value?.freeformTags?.RootPassword ?? '')
+// 密码默认掩码(S-01),点击查看后本页会话内保持可见
+const pwdRevealed = ref(false)
+
+function revealRootPassword() {
+  pwdRevealed.value = true
+}
 
 async function copyRootPassword() {
   await navigator.clipboard.writeText(rootPassword.value)
@@ -181,7 +194,6 @@ function openSerial() {
     instanceId: instanceId.value,
     region: region.value,
     instanceName: instance.data.value?.displayName,
-    rootPassword: rootPassword.value,
   })
 }
 
@@ -492,10 +504,28 @@ const consoleColumns: DataTableColumns<ConsoleConnection> = [
           >
             <div class="w-22 flex-none text-xs text-ink-3 max-md:w-auto">ROOT 密码</div>
             <div class="flex min-w-0 flex-1 items-center gap-1.5">
-              <code class="mono truncate text-[13px]" :title="rootPassword">{{ rootPassword }}</code>
-              <NButton size="tiny" quaternary type="primary" @click="copyRootPassword">
-                复制
-              </NButton>
+              <template v-if="pwdRevealed">
+                <code class="mono truncate text-[13px]" :title="rootPassword">{{ rootPassword }}</code>
+                <NButton size="tiny" quaternary type="primary" @click="copyRootPassword">
+                  复制
+                </NButton>
+              </template>
+              <template v-else>
+                <code class="mono text-[13px] tracking-widest select-none">••••••••</code>
+                <NButton
+                  size="tiny"
+                  quaternary
+                  type="primary"
+                  title="验证身份后查看"
+                  @click="revealRootPassword"
+                >
+                  <svg class="mr-1 h-3.5 w-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                    <path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7Z"></path>
+                    <circle cx="12" cy="12" r="3"></circle>
+                  </svg>
+                  查看
+                </NButton>
+              </template>
             </div>
           </div>
           <div class="flex gap-3 py-2.5 max-md:flex-col max-md:gap-0.5">
@@ -593,7 +623,7 @@ const consoleColumns: DataTableColumns<ConsoleConnection> = [
         <div class="text-sm font-semibold">引导卷</div>
         <NButton
           size="small"
-          :disabled="!isStopped || isEnded"
+          :disabled="!isStopped || isEnded || bvLoading"
           :title="isStopped ? '' : '替换引导卷须实例处于 STOPPED'"
           @click="showReplaceBv = true"
         >
@@ -661,7 +691,12 @@ const consoleColumns: DataTableColumns<ConsoleConnection> = [
     <div class="panel">
       <div class="flex items-center justify-between border-b border-line-soft px-4.5 py-3.5">
         <div class="text-sm font-semibold">块存储卷</div>
-        <NButton size="small" type="primary" :disabled="isEnded" @click="showAttachVol = true">
+        <NButton
+          size="small"
+          type="primary"
+          :disabled="isEnded || volLoading"
+          @click="showAttachVol = true"
+        >
           附加块卷
         </NButton>
       </div>
@@ -682,11 +717,20 @@ const consoleColumns: DataTableColumns<ConsoleConnection> = [
       <div class="flex items-center justify-between border-b border-line-soft px-4.5 py-3.5">
         <div class="text-sm font-semibold">控制台连接（VNC / 串口）</div>
         <div class="flex items-center gap-2">
-          <NButton size="small" type="primary" :disabled="isEnded" @click="openSerial">
+          <NButton
+            size="small"
+            type="primary"
+            :disabled="isEnded || consolesLoading"
+            @click="openSerial"
+          >
             串行终端
           </NButton>
-          <NButton size="small" :disabled="isEnded" @click="openVnc">网页 VNC</NButton>
-          <NButton size="small" :disabled="isEnded" @click="showConsole = true">创建连接</NButton>
+          <NButton size="small" :disabled="isEnded || consolesLoading" @click="openVnc">
+            网页 VNC
+          </NButton>
+          <NButton size="small" :disabled="isEnded || consolesLoading" @click="showConsole = true">
+            创建连接
+          </NButton>
         </div>
       </div>
       <NDataTable
diff --git a/src/views/InstanceListView.vue b/src/views/InstanceListView.vue
index d1e4974..eaec202 100644
--- a/src/views/InstanceListView.vue
+++ b/src/views/InstanceListView.vue
@@ -6,7 +6,6 @@ import {
   NInputGroup,
   NInputGroupLabel,
   NSelect,
-  useMessage,
   type DataTableColumns,
 } from 'naive-ui'
 import { computed, h, ref, watch } from 'vue'
@@ -22,13 +21,14 @@ import { useAsync } from '@/composables/useAsync'
 import { INSTANCE_TRANSIENT_STATES, useTransientPoll } from '@/composables/useTransientPoll'
 import { useScopeStore } from '@/stores/scope'
 import type { Instance, PowerAction } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 interface InstanceRow extends Instance {
   cfgId: number
   cfgAlias: string
 }
 
-const message = useMessage()
+const message = useToast()
 const { alias } = useRegionAlias()
 
 /** 租户 / 区域 / 区间来自侧栏全局作用域，页内只做区间切换与搜索 */
diff --git a/src/views/LoginView.vue b/src/views/LoginView.vue
index 2da54b6..6417319 100644
--- a/src/views/LoginView.vue
+++ b/src/views/LoginView.vue
@@ -8,12 +8,15 @@ import { ApiError } from '@/api/request'
 import AppLogo from '@/components/AppLogo.vue'
 import FullPageBackdrop from '@/components/FullPageBackdrop.vue'
 import OauthProviderIcon from '@/components/OauthProviderIcon.vue'
+import { useThemeRipple } from '@/composables/useThemeRipple'
 import { useAuthStore } from '@/stores/auth'
 import type { OauthProviderInfo } from '@/types/api'
 
 const auth = useAuthStore()
 const route = useRoute()
 const router = useRouter()
+// 点击 logo 切换明暗主题,新主题自 logo 向外扩散
+const { toggleDarkFrom } = useThemeRipple()
 
 const username = ref('admin')
 const password = ref('')
@@ -123,7 +126,15 @@ async function oauthLogin(provider: string) {
           <div class="fpb-ring fpb-ring-dash" style="width: 430px; height: 430px; left: calc(50% - 215px); top: calc(50% - 215px)"></div>
         </div>
         <div class="flex items-center gap-3">
-          <span class="floaty flex-none"><AppLogo :size="58" /></span>
+          <button
+            type="button"
+            class="floaty logo-btn flex-none"
+            title="切换明暗主题"
+            aria-label="切换明暗主题"
+            @click="toggleDarkFrom"
+          >
+            <AppLogo :size="58" />
+          </button>
           <span>
             <span class="block font-serif text-2xl font-semibold">OCI Portal</span>
             <span class="mt-px block text-[12.5px] text-ink-3">自托管 · Self-hosted</span>
@@ -240,6 +251,21 @@ async function oauthLogin(provider: string) {
   height: 7px;
   border-radius: 50%;
 }
+/* logo 即主题开关:去按钮底色,悬停轻微放大提示可点 */
+.logo-btn {
+  cursor: pointer;
+  border: none;
+  background: none;
+  padding: 0;
+  line-height: 0;
+  transition: scale 0.25s ease;
+}
+.logo-btn:hover {
+  scale: 1.06;
+}
+.logo-btn:active {
+  scale: 0.96;
+}
 @media (prefers-reduced-motion: no-preference) {
   .floaty {
     animation: login-fl 7s ease-in-out infinite;
diff --git a/src/views/OverviewView.vue b/src/views/OverviewView.vue
index a8d2d4f..cd34f80 100644
--- a/src/views/OverviewView.vue
+++ b/src/views/OverviewView.vue
@@ -6,6 +6,7 @@ import { getOverview, listConfigs } from '@/api/configs'
 import { listTaskLogs, listTasks } from '@/api/tasks'
 import CostChart from '@/components/CostChart.vue'
 import EmptyCard from '@/components/EmptyCard.vue'
+import { aliveMeta } from '@/composables/useAliveStatus'
 import { fmtRelative } from '@/composables/useFormat'
 import { useRegionAlias } from '@/composables/useRegionAlias'
 import { useAsync } from '@/composables/useAsync'
@@ -175,9 +176,15 @@ const currencySymbol = computed(() => {
             <div class="flex w-14 flex-none items-center gap-1.5 text-[12.5px]">
               <span
                 class="h-1.5 w-1.5 rounded-full"
-                :class="c.aliveStatus === 'alive' ? 'bg-ok' : 'bg-err'"
+                :class="
+                  c.aliveStatus === 'alive'
+                    ? 'bg-ok'
+                    : c.aliveStatus === 'suspended'
+                      ? 'bg-warn'
+                      : 'bg-err'
+                "
               />
-              {{ c.aliveStatus === 'alive' ? '存活' : '失联' }}
+              {{ aliveMeta(c.aliveStatus).label }}
             </div>
             <div class="w-18 flex-none text-right text-xs text-ink-3">{{ fmtRelative(c.lastVerifiedAt) }}</div>
           </div>
diff --git a/src/views/SettingsView.vue b/src/views/SettingsView.vue
index 52b203d..72ae6a6 100644
--- a/src/views/SettingsView.vue
+++ b/src/views/SettingsView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NInput, NSpin, NSwitch, NTabPane, NTabs, useMessage } from 'naive-ui'
+import { NButton, NInput, NSpin, NSwitch, NTabPane, NTabs } from 'naive-ui'
 import { computed, onMounted, ref, watch } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 
@@ -8,6 +8,7 @@ import {
   getSecuritySetting,
   getTaskSetting,
   getTelegramSetting,
+  listNotifyChannels,
   listNotifyTemplates,
   testTelegram,
   updateNotifyEvents,
@@ -20,27 +21,47 @@ import FootNote from '@/components/FootNote.vue'
 import FormField from '@/components/FormField.vue'
 import AboutTab from '@/components/settings/AboutTab.vue'
 import AccountSecurityCard from '@/components/settings/AccountSecurityCard.vue'
+import NotifyChannelCard from '@/components/settings/NotifyChannelCard.vue'
 import NotifyTemplateModal from '@/components/settings/NotifyTemplateModal.vue'
 import { useAsync } from '@/composables/useAsync'
-import type { NotifyEventsSetting, NotifyTemplateItem, SecuritySetting } from '@/types/api'
+import type {
+  NotifyChannelItem,
+  NotifyEventsSetting,
+  NotifyTemplateItem,
+  SecuritySetting,
+} from '@/types/api'
+import { useAuthStore } from '@/stores/auth'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 const route = useRoute()
 const router = useRouter()
+const auth = useAuthStore()
 
 // 设置页以 tab 组织:通知(管理 + 方式)/ 任务(抢机熔断阈值)/ 安全(WAF/网络/账号)
 const tab = ref('notify')
 
-// OAuth 绑定回跳:成功/失败提示后清理 query,并停在安全 tab
+// OAuth 绑定回跳:成功/失败提示后清理 query,并停在安全 tab;
+// 绑定使令牌版本递增,fragment 携带的新 token 须先落地,否则后续请求 401
 onMounted(() => {
   const { oauth, oauthError } = route.query
   if (oauth !== 'bound' && !oauthError) return
+  consumeBindToken()
   tab.value = 'security'
   if (oauth === 'bound') message.success('外部身份绑定成功')
   if (typeof oauthError === 'string' && oauthError) message.error(oauthError)
   void router.replace({ query: {} })
 })
 
+/** 消费绑定回跳 fragment 中的新会话 token(无感换发,不进服务端日志) */
+function consumeBindToken() {
+  const hash = window.location.hash
+  if (!hash.startsWith('#oauthToken=')) return
+  const token = decodeURIComponent(hash.slice('#oauthToken='.length))
+  history.replaceState(null, '', window.location.pathname + window.location.search)
+  if (token) auth.setSession(token, new Date(Date.now() + 24 * 3600e3).toISOString())
+}
+
 // ---- 通知管理：按事件类型的推送开关 ----
 const events = useAsync(getNotifyEvents)
 const eventForm = ref<NotifyEventsSetting>({
@@ -138,6 +159,14 @@ async function saveEvents() {
   }
 }
 
+// ---- 通知方式:多渠道(webhook/ntfy/bark/smtp)----
+const channels = useAsync(listNotifyChannels)
+
+/** 渠道保存接口回全渠道最新视图,就地覆盖免二次拉取 */
+function onChannelsSaved(items: NotifyChannelItem[]) {
+  channels.data.value = items
+}
+
 // ---- 通知方式：Telegram 渠道配置 ----
 const setting = useAsync(getTelegramSetting)
 const enabled = ref(false)
@@ -431,13 +460,24 @@ async function sendTest() {
             拉进群）；③ 浏览器打开 api.telegram.org/bot&lt;token&gt;/getUpdates，响应中
             message.chat.id 即为 chat_id
           </FootNote>
+
+          <!-- 多渠道:与 Telegram 并存,可同时启用任意多个 -->
+          <div class="border-t border-line-soft">
+            <NotifyChannelCard
+              v-for="ch in channels.data.value ?? []"
+              :key="ch.type"
+              :item="ch"
+              @saved="onChannelsSaved"
+            />
+          </div>
         </div>
 
         <div class="panel px-4.5 py-3.5">
           <div class="text-[13px] font-semibold">送达规则</div>
           <div class="mt-1.5 text-xs leading-relaxed text-ink-3">
-            发送为异步、10 秒超时，失败仅记后端日志，不影响任务执行；同一事件按状态变化去重，
-            不会刷屏。云端事件另受「日志回传」链路约束——未建链路的租户不产生该类通知。
+            事件同时投递到全部已启用渠道；发送为异步、10 秒超时，单渠道失败仅记后端日志，
+            不影响其他渠道与任务执行；同一事件按状态变化去重，不会刷屏。
+            云端事件另受「日志回传」链路约束——未建链路的租户不产生该类通知。
           </div>
         </div>
       </div>
diff --git a/src/views/TaskDetailView.vue b/src/views/TaskDetailView.vue
index 1efcffd..c492619 100644
--- a/src/views/TaskDetailView.vue
+++ b/src/views/TaskDetailView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NSpin, useDialog, useMessage } from 'naive-ui'
+import { NButton, NSpin, useDialog } from 'naive-ui'
 import { computed, onUnmounted, ref } from 'vue'
 import { RouterLink, useRoute, useRouter } from 'vue-router'
 
@@ -12,10 +12,11 @@ import { parseSnatch, scopeCfgIds, STATUS_META, TYPE_LABEL } from '@/components/
 import { fmtRelative, fmtTime, regionCity } from '@/composables/useFormat'
 import { useAsync } from '@/composables/useAsync'
 import { useScopeStore } from '@/stores/scope'
+import { useToast } from '@/composables/useToast'
 
 const route = useRoute()
 const router = useRouter()
-const message = useMessage()
+const message = useToast()
 const dialog = useDialog()
 const scope = useScopeStore()
 
diff --git a/src/views/TaskListView.vue b/src/views/TaskListView.vue
index f9553d7..0434eba 100644
--- a/src/views/TaskListView.vue
+++ b/src/views/TaskListView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NSpin, useDialog, useMessage } from 'naive-ui'
+import { NButton, NSpin, useDialog } from 'naive-ui'
 import { computed, onUnmounted, ref } from 'vue'
 
 import { deleteTask, listTasks, runTask, updateTask } from '@/api/tasks'
@@ -10,8 +10,9 @@ import { parseSnatch } from '@/components/task/taskDisplay'
 import { useAsync } from '@/composables/useAsync'
 import { useScopeStore } from '@/stores/scope'
 import type { Task } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 const dialog = useDialog()
 const scope = useScopeStore()
 
diff --git a/src/views/TenantDetailView.vue b/src/views/TenantDetailView.vue
index 7634112..9056929 100644
--- a/src/views/TenantDetailView.vue
+++ b/src/views/TenantDetailView.vue
@@ -1,9 +1,10 @@
 <script setup lang="ts">
-import { NButton, NPopconfirm, NSpin, NTabPane, NTabs, NTooltip, useMessage } from 'naive-ui'
-import { computed, ref } from 'vue'
+import { NButton, NPopconfirm, NSelect, NSpin, NTabPane, NTabs, NTooltip } from 'naive-ui'
+import { computed, ref, watch } from 'vue'
 import { RouterLink, useRoute, useRouter } from 'vue-router'
 
 import { deleteConfig, getConfig, verifyConfig } from '@/api/configs'
+import { listIdentityDomains } from '@/api/tenant'
 import AccountTypeBadge from '@/components/AccountTypeBadge.vue'
 import AuditLogTab from '@/components/tenant/AuditLogTab.vue'
 import CostTab from '@/components/tenant/CostTab.vue'
@@ -15,15 +16,17 @@ import QuotaTab from '@/components/tenant/QuotaTab.vue'
 import StatusBadge from '@/components/StatusBadge.vue'
 import SubsTab from '@/components/tenant/SubsTab.vue'
 import UsersTab from '@/components/tenant/UsersTab.vue'
+import { aliveMeta } from '@/composables/useAliveStatus'
 import { fmtTime } from '@/composables/useFormat'
 import { useRegionAlias } from '@/composables/useRegionAlias'
 import { useAsync } from '@/composables/useAsync'
 import { useScopeStore } from '@/stores/scope'
+import { useToast } from '@/composables/useToast'
 
 const scope = useScopeStore()
 const route = useRoute()
 const router = useRouter()
-const message = useMessage()
+const message = useToast()
 const { alias: regionAlias } = useRegionAlias()
 
 const cfgId = computed(() => Number(route.params.id))
@@ -32,8 +35,33 @@ const verifying = ref(false)
 
 const config = useAsync(() => getConfig(cfgId.value))
 
-/** 失联租户各 tab 拉不到云端数据，内容区整体换失联占位 */
-const isDead = computed(() => config.data.value?.aliveStatus === 'dead')
+/** 失联/暂停租户各 tab 拉不到云端数据，内容区整体换占位 */
+const isBlocked = computed(() =>
+  ['dead', 'suspended'].includes(config.data.value?.aliveStatus ?? ''),
+)
+
+// ---- 身份域:用户 / IDP / 其他 三个 tab 共享的域上下文 ----
+// 拉取失败(无权限/老租户)静默降级:不显示选择器,各 tab 走缺省 Default 路径
+const domains = useAsync(async () => {
+  try {
+    return await listIdentityDomains(cfgId.value)
+  } catch {
+    return []
+  }
+})
+const domainId = ref<string | undefined>(undefined)
+watch(domains.data, (list) => {
+  if (!list?.length) return
+  const preferred = list.find((d) => d.displayName === 'Default') ?? list[0]
+  domainId.value ??= preferred.id
+})
+const domainOptions = computed(
+  () => domains.data.value?.map((d) => ({ label: d.displayName, value: d.id })) ?? [],
+)
+/** 域选择器只在多域租户的域相关 tab 显示 */
+const showDomainPicker = computed(
+  () => (domains.data.value?.length ?? 0) > 1 && ['users', 'idp', 'misc'].includes(tab.value),
+)
 
 async function verify() {
   verifying.value = true
@@ -53,7 +81,7 @@ async function verify() {
 async function remove() {
   try {
     await deleteConfig(cfgId.value)
-    message.success('已删除（仅移除本面板配置，不影响云端资源）')
+    message.success('已删除租户及关联本地数据，OCI 云端资源未受影响')
     void scope.refreshConfigs()
     void router.push({ name: 'tenants' })
   } catch (e) {
@@ -88,19 +116,22 @@ async function remove() {
       <div class="flex flex-wrap items-center gap-3">
         <h1 class="page-title">{{ config.data.value.alias }}</h1>
         <NTooltip
-          v-if="isDead && config.data.value.lastError"
+          v-if="isBlocked && config.data.value.lastError"
           trigger="hover"
           placement="top-start"
         >
           <template #trigger>
-            <StatusBadge kind="term" label="失联" />
+            <StatusBadge
+              :kind="aliveMeta(config.data.value.aliveStatus).kind"
+              :label="aliveMeta(config.data.value.aliveStatus).label"
+            />
           </template>
           <div class="max-w-80 text-xs">{{ config.data.value.lastError }}</div>
         </NTooltip>
         <StatusBadge
           v-else
-          :kind="config.data.value.aliveStatus === 'alive' ? 'run' : 'term'"
-          :label="config.data.value.aliveStatus === 'alive' ? '存活' : '失联'"
+          :kind="aliveMeta(config.data.value.aliveStatus).kind"
+          :label="aliveMeta(config.data.value.aliveStatus).label"
         />
         <AccountTypeBadge :type="config.data.value.accountType" />
         <div class="flex-1" />
@@ -109,7 +140,8 @@ async function remove() {
           <template #trigger>
             <NButton size="small" type="error" ghost>删除租户</NButton>
           </template>
-          删除「{{ config.data.value.alias }}」？仅移除本面板配置与快照，不影响云端资源。
+          删除「{{ config.data.value.alias }}」？将清理本面板中的关联任务、快照、回传事件与 Webhook
+          密钥、告警及 AI 渠道数据；OCI 云端资源不会被删除（云端日志回传链路请先在“其他”页销毁）。
         </NPopconfirm>
       </div>
 
@@ -140,19 +172,30 @@ async function remove() {
         <NTabPane name="subs" tab="订阅" />
         <NTabPane name="audit" tab="审计日志" />
         <NTabPane name="misc" tab="其他" />
+        <template #suffix>
+          <!-- 多域租户:用户/IDP/其他 tab 按选中域读写 -->
+          <div v-if="showDomainPicker" class="w-64 max-md:w-44">
+            <NSelect v-model:value="domainId" size="small" :options="domainOptions" placeholder="身份域" />
+          </div>
+        </template>
       </NTabs>
     </div>
 
     <template v-if="config.data.value">
-      <DeadPlaceholder v-if="isDead" :last-error="config.data.value.lastError" />
+      <DeadPlaceholder
+        v-if="isBlocked"
+        :last-error="config.data.value.lastError"
+        :suspended="config.data.value.aliveStatus === 'suspended'"
+      />
       <template v-else>
         <QuotaTab v-if="tab === 'quota'" :cfg-id="cfgId" />
-        <IdpTab v-else-if="tab === 'idp'" :cfg-id="cfgId" />
-        <UsersTab v-else-if="tab === 'users'" :cfg-id="cfgId" />
+        <!-- 域相关 tab 以 domainId 为 key:切域整组件重挂载,状态与数据全量刷新 -->
+        <IdpTab v-else-if="tab === 'idp'" :key="`idp-${domainId ?? ''}`" :cfg-id="cfgId" :domain-id="domainId" />
+        <UsersTab v-else-if="tab === 'users'" :key="`users-${domainId ?? ''}`" :cfg-id="cfgId" :domain-id="domainId" />
         <CostTab v-else-if="tab === 'cost'" :cfg-id="cfgId" />
         <SubsTab v-else-if="tab === 'subs'" :cfg-id="cfgId" :account-type="config.data.value.accountType" />
         <AuditLogTab v-else-if="tab === 'audit'" :cfg-id="cfgId" />
-        <MiscTab v-else :cfg-id="cfgId" />
+        <MiscTab v-else :key="`misc-${domainId ?? ''}`" :cfg-id="cfgId" :domain-id="domainId" />
       </template>
     </template>
   </div>
diff --git a/src/views/TenantListView.vue b/src/views/TenantListView.vue
index 927eac3..2be514b 100644
--- a/src/views/TenantListView.vue
+++ b/src/views/TenantListView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { NButton, NDataTable, NInput, NInputGroup, NInputGroupLabel, NPopconfirm, NPopover, NSelect, NTooltip, useMessage, type DataTableColumns } from 'naive-ui'
+import { NButton, NDataTable, NInput, NInputGroup, NInputGroupLabel, NPopconfirm, NPopover, NSelect, NTooltip, type DataTableColumns } from 'naive-ui'
 import { computed, h, ref, type VNodeChild } from 'vue'
 import { RouterLink, useRouter } from 'vue-router'
 
@@ -11,13 +11,15 @@ import EditConfigModal from '@/components/config/EditConfigModal.vue'
 import ImportConfigModal from '@/components/config/ImportConfigModal.vue'
 import StatusBadge from '@/components/StatusBadge.vue'
 import { parseSnatch, scopeCfgIds, STATUS_META, TYPE_LABEL } from '@/components/task/taskDisplay'
+import { aliveMeta } from '@/composables/useAliveStatus'
 import { fmtRelative, fmtTime } from '@/composables/useFormat'
 import { useRegionAlias } from '@/composables/useRegionAlias'
 import { useAsync } from '@/composables/useAsync'
 import { useScopeStore } from '@/stores/scope'
 import type { AccountType, OciConfigSummary, Task } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
-const message = useMessage()
+const message = useToast()
 const router = useRouter()
 const { alias: regionAlias } = useRegionAlias()
 const scope = useScopeStore()
@@ -104,7 +106,7 @@ function setGlobal(row: OciConfigSummary) {
 async function remove(row: OciConfigSummary) {
   try {
     await deleteConfig(row.id)
-    message.success(`已删除「${row.alias}」（仅移除本面板配置，不影响云端资源）`)
+    message.success(`已删除「${row.alias}」及关联本地数据，OCI 云端资源未受影响`)
     reloadConfigs()
   } catch (e) {
     message.error(e instanceof Error ? e.message : '删除失败')
@@ -125,13 +127,11 @@ function renderTenant(row: OciConfigSummary): VNodeChild {
   ])
 }
 
-/** 状态列：仅徽标；失联且有错误详情时 hover 徽标以 tooltip 展示完整 lastError */
+/** 状态列：仅徽标；失联/暂停且有错误详情时 hover 徽标以 tooltip 展示完整 lastError */
 function renderStatus(row: OciConfigSummary): VNodeChild {
-  const badge = h(StatusBadge, {
-    kind: row.aliveStatus === 'alive' ? 'run' : row.aliveStatus === 'dead' ? 'term' : 'check',
-    label: row.aliveStatus === 'alive' ? '存活' : row.aliveStatus === 'dead' ? '失联' : '未测',
-  })
-  if (row.aliveStatus !== 'dead' || !row.lastError) return badge
+  const meta = aliveMeta(row.aliveStatus)
+  const badge = h(StatusBadge, { kind: meta.kind, label: meta.label })
+  if (!['dead', 'suspended'].includes(row.aliveStatus) || !row.lastError) return badge
   return h(
     NTooltip,
     { trigger: 'hover', placement: 'top-start' },
@@ -221,7 +221,8 @@ function renderActions(row: OciConfigSummary): VNodeChild {
       {
         trigger: () =>
           h(NButton, { size: 'tiny', quaternary: true, type: 'error' }, { default: () => '删除' }),
-        default: () => `删除「${row.alias}」？仅移除本面板配置与快照，不影响云端资源。`,
+        default: () =>
+          `删除「${row.alias}」？将清理本面板中的关联任务、快照、回传事件与 Webhook 密钥、告警及 AI 渠道数据；OCI 云端资源不会被删除（云端日志回传链路请先在“其他”页销毁）。`,
       },
     ),
   ])
diff --git a/src/views/VcnDetailView.vue b/src/views/VcnDetailView.vue
index 9bb8df8..a69dbd2 100644
--- a/src/views/VcnDetailView.vue
+++ b/src/views/VcnDetailView.vue
@@ -4,7 +4,6 @@ import {
   NDataTable,
   NPopconfirm,
   NSpin,
-  useMessage,
   type DataTableColumns,
 } from 'naive-ui'
 import { computed, h, ref } from 'vue'
@@ -18,10 +17,11 @@ import StatusBadge from '@/components/StatusBadge.vue'
 import { fmtTime } from '@/composables/useFormat'
 import { useAsync } from '@/composables/useAsync'
 import type { Ipv6Step, SecurityList, Subnet } from '@/types/api'
+import { useToast } from '@/composables/useToast'
 
 const route = useRoute()
 const router = useRouter()
-const message = useMessage()
+const message = useToast()
 
 const cfgId = computed(() => Number(route.params.cfgId))
 const vcnId = computed(() => String(route.params.vcnId))
diff --git a/tsconfig.app.json b/tsconfig.app.json
index f54ed27..8b57551 100644
--- a/tsconfig.app.json
+++ b/tsconfig.app.json
@@ -7,7 +7,6 @@
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
-    "baseUrl": ".",
     "paths": {
       "@/*": ["./src/*"]
     }