diff --git a/admin-ui/src/api/credentials.ts b/admin-ui/src/api/credentials.ts
index 9ba8d9c7..d2152dc3 100644
--- a/admin-ui/src/api/credentials.ts
+++ b/admin-ui/src/api/credentials.ts
@@ -224,6 +224,8 @@ export interface BatchImportCredentialsRequest {
   credentials: AddCredentialRequest[]
   /** 顶层统一代理覆盖；缺省时尊重每条凭据字段 */
   proxyUrl?: string
+  proxyId?: number
+  browserEgressIp?: string
   /** 顶层统一 RPM 覆盖；缺省时尊重每条凭据字段 */
   rpmLimit?: number
   /** 并发度，缺省 8，服务端 clamp 到 [1, 16] */
@@ -362,6 +364,17 @@ export async function updateRefreshToken(
   return data
 }
 
+export async function promoteCredential(id: number): Promise<{
+  id: number
+  model: string
+  modelCount: number
+  unary200: boolean
+  sseMessageStop: boolean
+}> {
+  const { data } = await api.post(`/credentials/${id}/promote`)
+  return data
+}
+
 // 更新凭据可编辑字段
 export async function updateCredential(
   id: number,
@@ -695,10 +708,13 @@ export async function startSocialRelogin(
 // 轮询 Social 重新登录状态
 export async function pollSocialRelogin(
   credentialId: number,
-  sessionId: string
+  sessionId: string,
+  sessionNonce?: string,
 ): Promise<PollSocialLoginResponse> {
   const { data } = await api.post<PollSocialLoginResponse>(
-    `/credentials/${credentialId}/relogin/social/poll/${sessionId}`
+    `/credentials/${credentialId}/relogin/social/poll/${sessionId}`,
+    undefined,
+    { headers: sessionNonce ? { 'x-kiro-egress-nonce': sessionNonce } : undefined },
   )
   return data
 }
@@ -707,11 +723,13 @@ export async function pollSocialRelogin(
 export async function completeSocialRelogin(
   credentialId: number,
   sessionId: string,
-  req: CompleteSocialLoginRequest
+  req: CompleteSocialLoginRequest,
+  sessionNonce?: string,
 ): Promise<PollSocialLoginResponse> {
   const { data } = await api.post<PollSocialLoginResponse>(
     `/credentials/${credentialId}/relogin/social/complete/${sessionId}`,
-    req
+    req,
+    { headers: sessionNonce ? { 'x-kiro-egress-nonce': sessionNonce } : undefined },
   )
   return data
 }
@@ -731,10 +749,13 @@ export async function startIdcRelogin(
 // 轮询 IdC 重新登录状态
 export async function pollIdcRelogin(
   credentialId: number,
-  sessionId: string
+  sessionId: string,
+  sessionNonce?: string,
 ): Promise<PollIdcLoginResponse> {
   const { data } = await api.post<PollIdcLoginResponse>(
-    `/credentials/${credentialId}/relogin/idc/poll/${sessionId}`
+    `/credentials/${credentialId}/relogin/idc/poll/${sessionId}`,
+    undefined,
+    { headers: sessionNonce ? { 'x-kiro-egress-nonce': sessionNonce } : undefined },
   )
   return data
 }
diff --git a/admin-ui/src/components/add-credential-dialog.tsx b/admin-ui/src/components/add-credential-dialog.tsx
index 8285e7f0..b254fdfe 100644
--- a/admin-ui/src/components/add-credential-dialog.tsx
+++ b/admin-ui/src/components/add-credential-dialog.tsx
@@ -1,4 +1,5 @@
 import { useState } from 'react'
+import { useQuery } from '@tanstack/react-query'
 import { toast } from 'sonner'
 import {
   Dialog,
@@ -21,6 +22,7 @@ import { useAddCredential } from '@/hooks/use-credentials'
 import { useGroupOptions } from '@/hooks/use-groups'
 import { extractErrorMessage } from '@/lib/utils'
 import { GroupMultiSelect } from '@/components/group-select'
+import { getEgressLoginCapability, getProxyPool } from '@/api/credentials'
 
 interface AddCredentialDialogProps {
   open: boolean
@@ -44,6 +46,8 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
   const [proxyUrl, setProxyUrl] = useState('')
   const [proxyUsername, setProxyUsername] = useState('')
   const [proxyPassword, setProxyPassword] = useState('')
+  const [proxyId, setProxyId] = useState('')
+  const [browserEgressIp, setBrowserEgressIp] = useState('')
   const [endpoint, setEndpoint] = useState('')
   const [groups, setGroups] = useState<string[]>([])
   const [sourceChannel, setSourceChannel] = useState('')
@@ -52,6 +56,18 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
   const groupOptions = useGroupOptions()
 
   const { mutate, isPending } = useAddCredential()
+  const { data: egressCapability } = useQuery({
+    queryKey: ['egress-login-v2'],
+    queryFn: getEgressLoginCapability,
+    enabled: open,
+  })
+  const { data: proxyPool } = useQuery({
+    queryKey: ['proxy-pool'],
+    queryFn: getProxyPool,
+    enabled: open,
+  })
+  const egressEnabled = egressCapability?.enabled === true
+  const enabledProxies = proxyPool?.proxies.filter((proxy) => proxy.enabled) ?? []
 
   const resetForm = () => {
     setRefreshToken('')
@@ -68,6 +84,8 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
     setProxyUrl('')
     setProxyUsername('')
     setProxyPassword('')
+    setProxyId('')
+    setBrowserEgressIp('')
     setEndpoint('')
     setGroups([])
     setSourceChannel('')
@@ -80,6 +98,11 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
   const handleSubmit = (e: React.FormEvent) => {
     e.preventDefault()
 
+    if (egressEnabled && !proxyId) {
+      toast.error('请先选择托管出口')
+      return
+    }
+
     // 验证必填字段
     if (isApiKey) {
       if (!kiroApiKey.trim()) {
@@ -117,9 +140,11 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
         issuerUrl: isExternalIdp ? issuerUrl.trim() || undefined : undefined,
         scopes: isExternalIdp ? scopes.trim() || undefined : undefined,
         machineId: machineId.trim() || undefined,
-        proxyUrl: proxyUrl.trim() || undefined,
-        proxyUsername: proxyUsername.trim() || undefined,
-        proxyPassword: proxyPassword.trim() || undefined,
+        proxyUrl: egressEnabled ? undefined : proxyUrl.trim() || undefined,
+        proxyUsername: egressEnabled ? undefined : proxyUsername.trim() || undefined,
+        proxyPassword: egressEnabled ? undefined : proxyPassword.trim() || undefined,
+        proxyId: egressEnabled ? Number(proxyId) : undefined,
+        browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
         endpoint: endpoint.trim() || undefined,
         groups: groups,
         sourceChannel: sourceChannel.trim() || undefined,
@@ -406,15 +431,34 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
             {/* 代理配置 */}
             <div className="space-y-2">
               <label className="text-sm font-medium">代理配置</label>
-              <Textarea
+              {egressEnabled ? (
+                <>
+                  <Select value={proxyId} onValueChange={setProxyId} disabled={isPending}>
+                    <SelectTrigger><SelectValue placeholder="选择托管出口" /></SelectTrigger>
+                    <SelectContent>
+                      {enabledProxies.map((proxy) => (
+                        <SelectItem key={proxy.id} value={String(proxy.id)}>
+                          {proxy.label || `出口 #${proxy.id}`} ({proxy.health})
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                  <Input
+                    placeholder="浏览器公网 IP（可选，必须与托管出口一致）"
+                    value={browserEgressIp}
+                    onChange={(e) => setBrowserEgressIp(e.target.value)}
+                    disabled={isPending}
+                  />
+                </>
+              ) : <Textarea
                 id="proxyUrl"
                 placeholder='代理 URL，可用逗号/空格/换行分隔多个；direct 表示直连候选'
                 value={proxyUrl}
                 onChange={(e) => setProxyUrl(e.target.value)}
                 disabled={isPending}
                 className="min-h-[76px] font-mono text-sm"
-              />
-              <div className="grid grid-cols-2 gap-2">
+              />}
+              {!egressEnabled && <div className="grid grid-cols-2 gap-2">
                 <Input
                   id="proxyUsername"
                   placeholder="代理用户名"
@@ -430,9 +474,9 @@ export function AddCredentialDialog({ open, onOpenChange }: AddCredentialDialogP
                   onChange={(e) => setProxyPassword(e.target.value)}
                   disabled={isPending}
                 />
-              </div>
+              </div>}
               <p className="text-xs text-muted-foreground">
-                留空使用全局代理；多个代理会随机轮询，失败时自动换下一个，可加入 direct 作为直连兜底
+                {egressEnabled ? '账号会先绑定并探测托管出口，验证通过后才能启用。' : '留空使用全局代理；多个代理会随机轮询，失败时自动换下一个，可加入 direct 作为直连兜底'}
               </p>
             </div>
           </div>
diff --git a/admin-ui/src/components/batch-import-dialog.tsx b/admin-ui/src/components/batch-import-dialog.tsx
index 05026168..f4b97cd0 100644
--- a/admin-ui/src/components/batch-import-dialog.tsx
+++ b/admin-ui/src/components/batch-import-dialog.tsx
@@ -15,6 +15,7 @@ import { useGroupOptions } from '@/hooks/use-groups'
 import { GroupMultiSelect } from '@/components/group-select'
 import {
   batchImportCredentials,
+  getEgressLoginCapability,
   getProxyPool,
   type BatchImportItemEvent,
   type BatchImportSummary,
@@ -263,6 +264,8 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
   const [groups, setGroups] = useState<string[]>([])
   // 统一覆盖导入账号的代理与 RPM；留空表示保留 JSON/现有自动分配逻辑。
   const [uniformProxyUrl, setUniformProxyUrl] = useState('')
+  const [uniformProxyId, setUniformProxyId] = useState('')
+  const [browserEgressIp, setBrowserEgressIp] = useState('')
   const [uniformRpmLimit, setUniformRpmLimit] = useState('')
   const groupOptions = useGroupOptions()
   const fileInputRef = useRef<HTMLInputElement>(null)
@@ -277,6 +280,12 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
     queryFn: getProxyPool,
     enabled: open,
   })
+  const { data: egressCapability } = useQuery({
+    queryKey: ['egress-login-v2'],
+    queryFn: getEgressLoginCapability,
+    enabled: open,
+  })
+  const egressEnabled = egressCapability?.enabled === true
 
   const resetForm = () => {
     setJsonInput('')
@@ -286,6 +295,8 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
     setResults([])
     setGroups([])
     setUniformProxyUrl('')
+    setUniformProxyId('')
+    setBrowserEgressIp('')
     setUniformRpmLimit('')
     if (fileInputRef.current) fileInputRef.current.value = ''
   }
@@ -353,7 +364,12 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
       return
     }
 
-    const proxyOverride = uniformProxyUrl.trim() || undefined
+    if (egressEnabled && !uniformProxyId) {
+      toast.error('请先选择托管出口')
+      return
+    }
+    const proxyOverride = egressEnabled ? undefined : uniformProxyUrl.trim() || undefined
+    const proxyIdOverride = egressEnabled ? Number(uniformProxyId) : undefined
     let rpmOverride: number | undefined
     try {
       rpmOverride = parseUniformRpmLimit(uniformRpmLimit)
@@ -402,7 +418,11 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
         }
 
         // 统一代理优先级最高；否则沿用 JSON 内单条代理；都没有时保持现有随机分配代理池逻辑。
-        if (proxyOverride) {
+        if (egressEnabled) {
+          cred.proxyUrl = undefined
+          cred.proxyUsername = undefined
+          cred.proxyPassword = undefined
+        } else if (proxyOverride) {
           cred.proxyUrl = proxyOverride
         } else if (!cred.proxyUrl?.trim() && enabledProxies.length > 0) {
           const picked = enabledProxies[Math.floor(Math.random() * enabledProxies.length)]
@@ -445,6 +465,8 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
               proxyUrl: cred.proxyUrl?.trim() || undefined,
               proxyUsername: cred.proxyUsername?.trim() || undefined,
               proxyPassword: cred.proxyPassword?.trim() || undefined,
+              proxyId: proxyIdOverride,
+              browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
               groups: mergeGroups(groups, cred.groups),
             },
           })
@@ -522,6 +544,8 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
               proxyUrl: cred.proxyUrl?.trim() || undefined,
               proxyUsername: cred.proxyUsername?.trim() || undefined,
               proxyPassword: cred.proxyPassword?.trim() || undefined,
+              proxyId: proxyIdOverride,
+              browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
               groups: mergeGroups(groups, cred.groups),
             },
           })
@@ -547,6 +571,8 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
           {
             credentials: toImport.map(t => t.req),
             proxyUrl: proxyOverride,
+            proxyId: proxyIdOverride,
+            browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
             rpmLimit: rpmOverride,
             concurrency: 8,
             verify,
@@ -776,8 +802,30 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
             <div className="text-sm font-medium">统一导入设置（可选）</div>
             <div className="grid gap-3 sm:grid-cols-2">
               <div className="space-y-2">
-                <label className="text-sm text-muted-foreground">统一代理</label>
-                <div className="grid gap-2">
+                <label className="text-sm text-muted-foreground">统一出口</label>
+                {egressEnabled ? <div className="grid gap-2">
+                  <select
+                    value={uniformProxyId}
+                    onChange={(e) => setUniformProxyId(e.target.value)}
+                    disabled={importing}
+                    className="h-9 w-full rounded-lg border border-input bg-background px-3 text-sm"
+                  >
+                    <option value="">选择托管出口...</option>
+                    {enabledProxyOptions.map((proxy) => (
+                      <option key={proxy.id} value={String(proxy.id)}>
+                        {proxy.label || `出口 #${proxy.id}`} ({proxy.health})
+                      </option>
+                    ))}
+                  </select>
+                  <input
+                    type="text"
+                    value={browserEgressIp}
+                    onChange={(e) => setBrowserEgressIp(e.target.value)}
+                    disabled={importing}
+                    placeholder="浏览器公网 IP（可选）"
+                    className="h-9 w-full rounded-lg border border-input bg-background px-3 text-sm font-mono"
+                  />
+                </div> : <div className="grid gap-2">
                   <input
                     type="text"
                     value={uniformProxyUrl}
@@ -803,9 +851,9 @@ export function BatchImportDialog({ open, onOpenChange }: BatchImportDialogProps
                       </option>
                     ))}
                   </select>
-                </div>
+                </div>}
                 <p className="text-xs text-muted-foreground">
-                  填写后会覆盖所有导入账号的代理；留空则保留账号自带代理，没有代理字段时继续随机分配代理池。
+                  {egressEnabled ? '所有账号先绑定并探测同一托管出口，导入后保持隔离。' : '填写后会覆盖所有导入账号的代理；留空则保留账号自带代理，没有代理字段时继续随机分配代理池。'}
                 </p>
               </div>
               <div className="space-y-2">
diff --git a/admin-ui/src/components/credential-card.tsx b/admin-ui/src/components/credential-card.tsx
index 0b0dba8d..19c7a93e 100644
--- a/admin-ui/src/components/credential-card.tsx
+++ b/admin-ui/src/components/credential-card.tsx
@@ -55,6 +55,7 @@ import {
   useForceRefreshToken,
   useResetSuccessCount,
   useClearThrottle,
+  usePromoteCredential,
 } from "@/hooks/use-credentials";
 import { setCredentialOverage } from "@/api/credentials";
 import { useQueryClient } from "@tanstack/react-query";
@@ -229,6 +230,7 @@ export function CredentialCard({
   const [showModelsDialog, setShowModelsDialog] = useState(false);
 
   const setDisabled = useSetDisabled();
+  const promoteCredential = usePromoteCredential();
   const setPriority = useSetPriority();
   const resetFailure = useResetFailure();
   const deleteCredential = useDeleteCredential();
@@ -312,6 +314,16 @@ export function CredentialCard({
   };
 
   const handleToggleDisabled = () => {
+    if (credential.disabled && credential.egressProxyId != null) {
+      promoteCredential.mutate(credential.id, {
+        onSuccess: (result) => {
+          toast.success(`promote 通过：${result.model}`);
+          onRefreshBalance();
+        },
+        onError: (err) => toast.error("promote 失败，账号保持隔离: " + extractErrorMessage(err)),
+      });
+      return;
+    }
     // 当前为禁用态 → 这次操作是“启用”，启用成功后顺带刷新一次余额
     const willEnable = credential.disabled;
     setDisabled.mutate(
@@ -438,6 +450,14 @@ export function CredentialCard({
       {credential.disabled && !reasonStyle && (
         <Badge variant="destructive">已禁用</Badge>
       )}
+      {credential.egressProxyId != null && (
+        <Badge
+          variant={credential.egressActivationAt ? "success" : "warning"}
+          title={credential.loginSlotId || `托管出口 #${credential.egressProxyId}`}
+        >
+          {credential.egressActivationAt ? "出口已验证" : "待 promote"}
+        </Badge>
+      )}
       {/* 仍启用但已经达到上限：黄色"已超额"徽章 */}
       {!credential.disabled && isQuotaExceeded && (
         <Badge variant="warning">已超额</Badge>
diff --git a/admin-ui/src/components/relogin-dialog.tsx b/admin-ui/src/components/relogin-dialog.tsx
index d8646dec..12b9aad1 100644
--- a/admin-ui/src/components/relogin-dialog.tsx
+++ b/admin-ui/src/components/relogin-dialog.tsx
@@ -1,5 +1,6 @@
 import { useState, useEffect, useRef } from 'react'
 import { toast } from 'sonner'
+import { useQuery } from '@tanstack/react-query'
 import { ExternalLink, Copy, Loader2, CheckCircle } from 'lucide-react'
 import {
   Dialog,
@@ -11,12 +12,15 @@ import {
 } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
 import {
   startSocialRelogin,
   pollSocialRelogin,
   completeSocialRelogin,
   startIdcRelogin,
   pollIdcRelogin,
+  getProxyPool,
+  getEgressLoginCapability,
 } from '@/api/credentials'
 import {
   useUpdateRefreshToken,
@@ -142,16 +146,31 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
   // IdC 表单
   const [idcRegion, setIdcRegion] = useState('us-east-1')
   const [idcStartUrl, setIdcStartUrl] = useState('')
+  const [proxyId, setProxyId] = useState('')
+  const [browserEgressIp, setBrowserEgressIp] = useState('')
 
   // Manual 字段
   const [manualInput, setManualInput] = useState('')
   const [manualLog, setManualLog] = useState<string[]>([])
 
   const pollTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+  const sessionNonceRef = useRef<string | undefined>(undefined)
   const nextLinkRef = useRef<HTMLTextAreaElement | null>(null)
   const isRemote = isRemoteAccess()
 
   const queryClient = useQueryClient()
+  const { data: proxyPool } = useQuery({
+    queryKey: ['proxy-pool'],
+    queryFn: getProxyPool,
+    enabled: open,
+  })
+  const { data: egressCapability } = useQuery({
+    queryKey: ['egress-login-v2'],
+    queryFn: getEgressLoginCapability,
+    enabled: open,
+  })
+  const egressEnabled = egressCapability?.enabled === true
+  const enabledProxies = proxyPool?.proxies.filter((proxy) => proxy.enabled) ?? []
   const updateRefreshToken = useUpdateRefreshToken()
   const setDisabled = useSetDisabled()
   const resetFailure = useResetFailure()
@@ -167,6 +186,12 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
     return () => clearPollTimer()
   }, [])
 
+  useEffect(() => {
+    if (open && credential.egressProxyId) {
+      setProxyId(String(credential.egressProxyId))
+    }
+  }, [open, credential.egressProxyId])
+
   const invalidate = () => queryClient.invalidateQueries({ queryKey: ['credentials'] })
 
   const selectNextLink = () => {
@@ -205,6 +230,9 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
     setNextUrl('')
     setManualInput('')
     setManualLog([])
+    setProxyId(credential.egressProxyId ? String(credential.egressProxyId) : '')
+    setBrowserEgressIp('')
+    sessionNonceRef.current = undefined
     onOpenChange(false)
   }
 
@@ -215,8 +243,12 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
     // 必须在 await 之前同步打开窗口，否则浏览器弹窗拦截会导致跳转当前页
     const loginWindow = window.open('about:blank', '_blank')
     try {
-      const resp = await startSocialRelogin(credential.id, {})
+      const resp = await startSocialRelogin(credential.id, {
+        proxyId: egressEnabled && proxyId ? Number(proxyId) : undefined,
+        browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
+      })
       setSocialSession(resp)
+      sessionNonceRef.current = resp.sessionNonce
       setStep('waiting')
       if (loginWindow) {
         loginWindow.location.href = resp.portalUrl
@@ -237,7 +269,8 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
     clearPollTimer()
     pollTimerRef.current = setTimeout(async () => {
       try {
-        const result = await pollSocialRelogin(credential.id, sessionId)
+        const result = await pollSocialRelogin(credential.id, sessionId, sessionNonceRef.current)
+        sessionNonceRef.current = 'sessionNonce' in result ? result.sessionNonce : undefined
         if (result.status === 'pending') {
           scheduleSocialPoll(sessionId)
         } else if (result.status === 'continue') {
@@ -285,7 +318,8 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
         clientId: parsed.clientId,
         scopes: parsed.scopes,
         loginHint: parsed.loginHint,
-      })
+      }, sessionNonceRef.current)
+      sessionNonceRef.current = 'sessionNonce' in result ? result.sessionNonce : undefined
       if (result.status === 'continue') {
         const next = getContinueUrl(result)
         if (!next) {
@@ -324,8 +358,11 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
       const resp = await startIdcRelogin(credential.id, {
         region: idcRegion.trim(),
         startUrl: idcStartUrl.trim() || undefined,
+        proxyId: egressEnabled && proxyId ? Number(proxyId) : undefined,
+        browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
       })
       setIdcSession(resp)
+      sessionNonceRef.current = resp.sessionNonce
       setStep('waiting')
       scheduleIdcPoll(resp.sessionId, resp.pollInterval)
     } catch (e) {
@@ -338,7 +375,8 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
   const scheduleIdcPoll = (sessionId: string, interval: number) => {
     pollTimerRef.current = setTimeout(async () => {
       try {
-        const result = await pollIdcRelogin(credential.id, sessionId)
+        const result = await pollIdcRelogin(credential.id, sessionId, sessionNonceRef.current)
+        sessionNonceRef.current = 'sessionNonce' in result ? result.sessionNonce : undefined
         if (result.status === 'pending') {
           scheduleIdcPoll(sessionId, interval)
         } else if (result.status === 'success') {
@@ -382,6 +420,31 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
     setManualLog([])
 
     try {
+      if (egressEnabled) {
+        if (!proxyId) {
+          throw new Error('请先选择账号原托管出口')
+        }
+        addLog('正在复核原托管出口并更新 Token…')
+        await new Promise<void>((resolve, reject) => {
+          updateRefreshToken.mutate(
+            {
+              id: credential.id,
+              req: {
+                refreshToken: extractedToken,
+                proxyId: Number(proxyId),
+                browserEgressIp: browserEgressIp.trim() || undefined,
+              },
+            },
+            { onSuccess: () => resolve(), onError: reject },
+          )
+        })
+        addLog('✓ 原出口、余额、模型、unary 和 SSE promote 已通过')
+        setStep('done')
+        invalidate()
+        toast.success(`凭据 #${credential.id} 已重新验证并启用`)
+        return
+      }
+
       if (!credential.disabled) {
         addLog('正在临时禁用凭据…')
         await new Promise<void>((resolve, reject) => {
@@ -426,7 +489,7 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
         <DialogHeader>
           <DialogTitle>重新登录 — {displayName}</DialogTitle>
           <DialogDescription>
-            选择登录方式，完成后将刷新该凭据的 Token 并自动重新启用。
+            选择登录方式；固定出口复核及 promote 全部通过后才会重新启用。
           </DialogDescription>
         </DialogHeader>
 
@@ -466,6 +529,36 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
           </div>
         )}
 
+        {step === 'form' && egressEnabled && (
+          <div className="space-y-3 rounded-lg border p-3">
+            <div className="space-y-1.5">
+              <label className="text-sm font-medium">原托管出口</label>
+              <Select
+                value={proxyId}
+                onValueChange={setProxyId}
+                disabled={credential.egressProxyId != null}
+              >
+                <SelectTrigger><SelectValue placeholder="选择托管代理" /></SelectTrigger>
+                <SelectContent>
+                  {enabledProxies.map((proxy) => (
+                    <SelectItem key={proxy.id} value={String(proxy.id)}>
+                      {proxy.label || `代理 #${proxy.id}`}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="space-y-1.5">
+              <label className="text-sm font-medium">浏览器出口 IP（可选）</label>
+              <Input
+                value={browserEgressIp}
+                onChange={(event) => setBrowserEgressIp(event.target.value)}
+                placeholder="填写后必须与托管出口一致"
+              />
+            </div>
+          </div>
+        )}
+
         {/* Social 表单 */}
         {step === 'form' && method === 'social' && (
           <div className="py-2 space-y-3">
@@ -651,7 +744,7 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
           {step === 'form' && method === 'social' && (
             <>
               <Button variant="outline" onClick={() => setStep('select')}>返回</Button>
-              <Button onClick={handleStartSocial} disabled={isStarting}>
+              <Button onClick={handleStartSocial} disabled={isStarting || (egressEnabled && !proxyId)}>
                 {isStarting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
                 发起登录
               </Button>
@@ -674,7 +767,7 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
           {step === 'form' && method === 'idc' && (
             <>
               <Button variant="outline" onClick={() => setStep('select')}>返回</Button>
-              <Button onClick={handleStartIdc} disabled={isStarting}>
+              <Button onClick={handleStartIdc} disabled={isStarting || (egressEnabled && !proxyId)}>
                 {isStarting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
                 发起登录
               </Button>
@@ -690,7 +783,7 @@ export function ReloginDialog({ open, onOpenChange, credential }: ReloginDialogP
               <Button variant="outline" onClick={() => setStep('select')} disabled={isManualUpdating}>返回</Button>
               <Button
                 onClick={(e) => handleManualSubmit(e as unknown as React.FormEvent)}
-                disabled={isManualUpdating || !isManualValid}
+                disabled={isManualUpdating || !isManualValid || (egressEnabled && !proxyId)}
               >
                 {isManualUpdating ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
                 {isManualUpdating ? '处理中…' : '确认更新'}
diff --git a/admin-ui/src/components/update-token-dialog.tsx b/admin-ui/src/components/update-token-dialog.tsx
index 284afa57..173f6ba6 100644
--- a/admin-ui/src/components/update-token-dialog.tsx
+++ b/admin-ui/src/components/update-token-dialog.tsx
@@ -1,5 +1,6 @@
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import { toast } from 'sonner'
+import { useQuery } from '@tanstack/react-query'
 import {
   Dialog,
   DialogContent,
@@ -9,6 +10,9 @@ import {
   DialogDescription,
 } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
+import { getEgressLoginCapability, getProxyPool } from '@/api/credentials'
 import { useUpdateRefreshToken, useSetDisabled, useResetFailure, useUpdateCredential } from '@/hooks/use-credentials'
 import { extractErrorMessage } from '@/lib/utils'
 import type { CredentialStatusItem } from '@/types/api'
@@ -86,6 +90,27 @@ export function UpdateTokenDialog({ open, onOpenChange, credential }: UpdateToke
   const [input, setInput] = useState('')
   const [step, setStep] = useState<'idle' | 'updating' | 'done'>('idle')
   const [stepLog, setStepLog] = useState<string[]>([])
+  const [proxyId, setProxyId] = useState('')
+  const [browserEgressIp, setBrowserEgressIp] = useState('')
+
+  const { data: proxyPool } = useQuery({
+    queryKey: ['proxy-pool'],
+    queryFn: getProxyPool,
+    enabled: open,
+  })
+  const { data: egressCapability } = useQuery({
+    queryKey: ['egress-login-v2'],
+    queryFn: getEgressLoginCapability,
+    enabled: open,
+  })
+  const egressEnabled = egressCapability?.enabled === true
+  const enabledProxies = proxyPool?.proxies.filter((proxy) => proxy.enabled) ?? []
+
+  useEffect(() => {
+    if (open && credential.egressProxyId) {
+      setProxyId(String(credential.egressProxyId))
+    }
+  }, [open, credential.egressProxyId])
 
   const updateRefreshToken = useUpdateRefreshToken()
   const updateCredential = useUpdateCredential()
@@ -111,8 +136,11 @@ export function UpdateTokenDialog({ open, onOpenChange, credential }: UpdateToke
     setStepLog([])
 
     try {
+      if (egressEnabled && !proxyId) {
+        throw new Error('请先选择账号原托管出口')
+      }
       // 步骤 1：若凭据未禁用，先禁用（后端要求更新 Token 前必须禁用）
-      if (!credential.disabled) {
+      if (!egressEnabled && !credential.disabled) {
         addLog('正在临时禁用凭据…')
         await new Promise<void>((resolve, reject) => {
           setDisabled.mutate(
@@ -133,32 +161,38 @@ export function UpdateTokenDialog({ open, onOpenChange, credential }: UpdateToke
               refreshToken: extractedToken,
               accessToken: parsed.accessToken,
               expiresAt: parsed.expiresAt,
+              proxyId: egressEnabled ? Number(proxyId) : undefined,
+              browserEgressIp: egressEnabled ? browserEgressIp.trim() || undefined : undefined,
             },
           },
           { onSuccess: () => resolve(), onError: reject }
         )
       })
-      addLog(`✓ refreshToken 已更新${parsed.accessToken ? '（含 accessToken）' : ''}`)
+      addLog(egressEnabled
+        ? '✓ Token 已更新，原出口及 promote 门禁已通过'
+        : `✓ refreshToken 已更新${parsed.accessToken ? '（含 accessToken）' : ''}`)
 
       // 步骤 3：重置失败计数
-      addLog('正在重置失败计数…')
-      await new Promise<void>((resolve, reject) => {
-        resetFailure.mutate(credential.id, {
-          onSuccess: () => resolve(),
-          onError: reject,
+      if (!egressEnabled) {
+        addLog('正在重置失败计数…')
+        await new Promise<void>((resolve, reject) => {
+          resetFailure.mutate(credential.id, {
+            onSuccess: () => resolve(),
+            onError: reject,
+          })
         })
-      })
-      addLog('✓ 失败计数已重置')
+        addLog('✓ 失败计数已重置')
 
-      // 步骤 4：启用凭据
-      addLog('正在重新启用凭据…')
-      await new Promise<void>((resolve, reject) => {
-        setDisabled.mutate(
-          { id: credential.id, disabled: false },
-          { onSuccess: () => resolve(), onError: reject }
-        )
-      })
-      addLog('✓ 凭据已启用')
+        // 步骤 4：启用凭据
+        addLog('正在重新启用凭据…')
+        await new Promise<void>((resolve, reject) => {
+          setDisabled.mutate(
+            { id: credential.id, disabled: false },
+            { onSuccess: () => resolve(), onError: reject }
+          )
+        })
+        addLog('✓ 凭据已启用')
+      }
 
       // 步骤 5：如果 JSON 中包含 email 且与当前不同，同步更新
       if (extractedEmail && extractedEmail !== credential.email) {
@@ -186,6 +220,8 @@ export function UpdateTokenDialog({ open, onOpenChange, credential }: UpdateToke
     setInput('')
     setStep('idle')
     setStepLog([])
+    setProxyId(credential.egressProxyId ? String(credential.egressProxyId) : '')
+    setBrowserEgressIp('')
     onOpenChange(false)
   }
 
@@ -196,12 +232,39 @@ export function UpdateTokenDialog({ open, onOpenChange, credential }: UpdateToke
           <DialogTitle>重新导入凭据 #{credential.id}</DialogTitle>
           <DialogDescription>
             为 {credential.email || `凭据 #${credential.id}`} 粘贴新 Token，
-            系统将自动更新 Token、重置失败计数并重新启用。
+            固定出口、余额、模型、unary 和 SSE 验证全部通过后才会启用。
           </DialogDescription>
         </DialogHeader>
 
         <form onSubmit={handleSubmit}>
           <div className="space-y-4 py-4">
+            {egressEnabled && (
+              <div className="space-y-3 rounded-lg border p-3">
+                <div className="space-y-1.5">
+                  <label className="text-sm font-medium">原托管出口</label>
+                  <Select
+                    value={proxyId}
+                    onValueChange={setProxyId}
+                    disabled={credential.egressProxyId != null || isPending}
+                  >
+                    <SelectTrigger><SelectValue placeholder="选择托管代理" /></SelectTrigger>
+                    <SelectContent>
+                      {enabledProxies.map((proxy) => (
+                        <SelectItem key={proxy.id} value={String(proxy.id)}>
+                          {proxy.label || `代理 #${proxy.id}`}
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                </div>
+                <Input
+                  value={browserEgressIp}
+                  onChange={(event) => setBrowserEgressIp(event.target.value)}
+                  placeholder="浏览器出口 IP（可选，填写后必须一致）"
+                  disabled={isPending}
+                />
+              </div>
+            )}
             <div className="space-y-2">
               <label className="text-sm font-medium">
                 粘贴 KAM 导出 JSON 或直接粘贴 refreshToken 字符串
@@ -250,7 +313,7 @@ export function UpdateTokenDialog({ open, onOpenChange, credential }: UpdateToke
               {step === 'done' ? '关闭' : '取消'}
             </Button>
             {step !== 'done' && (
-              <Button type="submit" disabled={isPending || !isValid}>
+              <Button type="submit" disabled={isPending || !isValid || (egressEnabled && !proxyId)}>
                 {isPending ? '处理中…' : '重新导入并启用'}
               </Button>
             )}
diff --git a/admin-ui/src/hooks/use-credentials.ts b/admin-ui/src/hooks/use-credentials.ts
index 978e1476..468f084a 100644
--- a/admin-ui/src/hooks/use-credentials.ts
+++ b/admin-ui/src/hooks/use-credentials.ts
@@ -12,6 +12,7 @@ import {
   deleteCredential,
   updateCredential,
   updateRefreshToken,
+  promoteCredential,
   getLoadBalancingMode,
   setLoadBalancingMode,
   getAccountThrottleConfig,
@@ -167,6 +168,16 @@ export function useUpdateRefreshToken() {
   })
 }
 
+export function usePromoteCredential() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (id: number) => promoteCredential(id),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['credentials'] })
+    },
+  })
+}
+
 // 更新凭据可编辑字段
 export function useUpdateCredential() {
   const queryClient = useQueryClient()
diff --git a/admin-ui/src/types/api.ts b/admin-ui/src/types/api.ts
index fcbd93f8..713e1ce4 100644
--- a/admin-ui/src/types/api.ts
+++ b/admin-ui/src/types/api.ts
@@ -46,6 +46,9 @@ export interface CredentialStatusItem {
   balance?: BalanceResponse
   /** 余额缓存的更新时间（Unix 秒） */
   balanceUpdatedAt?: number
+  loginSlotId?: string
+  egressProxyId?: number
+  egressActivationAt?: string
 }
 
 // 余额响应
@@ -92,6 +95,7 @@ export interface CredentialResponseTestResponse {
   latencyMs: number
   httpStatus?: number
   responseSnippet?: string
+  streamComplete: boolean
   error?: string
 }
 
@@ -149,6 +153,9 @@ export interface AddCredentialRequest {
   email?: string
   groups?: string[]
   sourceChannel?: string
+  proxyId?: number
+  browserEgressIp?: string
+  loginSlotId?: string
 }
 
 // 添加凭据响应
@@ -178,6 +185,8 @@ export interface UpdateRefreshTokenRequest {
   refreshToken: string
   accessToken?: string
   expiresAt?: string
+  proxyId?: number
+  browserEgressIp?: string
 }
 
 // 代理健康状态
diff --git a/src/admin/handlers.rs b/src/admin/handlers.rs
index dd75b743..c15aa743 100644
--- a/src/admin/handlers.rs
+++ b/src/admin/handlers.rs
@@ -186,6 +186,18 @@ pub async fn test_credential_response(
     }
 }
 
+/// POST /api/admin/credentials/:id/promote
+/// 完成 egress-bound 账号的余额、模型、unary 和 SSE 门禁后启用。
+pub async fn promote_credential(
+    State(state): State<AdminState>,
+    Path(id): Path<u64>,
+) -> impl IntoResponse {
+    match state.service.promote_egress_credential(id).await {
+        Ok(response) => Json(response).into_response(),
+        Err(e) => e.into_http_response(),
+    }
+}
+
 /// POST /api/admin/credentials/disable-quota-exceeded
 /// 一键禁用所有"已超额"凭据（remaining ≤ 0 或 usage_percentage ≥ 100）
 pub async fn disable_quota_exceeded(State(state): State<AdminState>) -> impl IntoResponse {
@@ -250,6 +262,8 @@ pub async fn batch_import_credentials(
         .map(str::trim)
         .filter(|v| !v.is_empty())
         .map(ToOwned::to_owned);
+    let proxy_id_override = req.proxy_id;
+    let browser_egress_ip_override = req.browser_egress_ip.clone();
     let rpm_override = req.rpm_limit;
     let credentials = req.credentials;
     let total = credentials.len();
@@ -263,10 +277,17 @@ pub async fn batch_import_credentials(
             .map(move |(index, mut cred_req)| {
                 let service = Arc::clone(&service);
                 let proxy_override = proxy_override.clone();
+                let browser_egress_ip_override = browser_egress_ip_override.clone();
                 async move {
                     if let Some(proxy_url) = proxy_override {
                         cred_req.proxy_url = Some(proxy_url);
                     }
+                    if let Some(proxy_id) = proxy_id_override {
+                        cred_req.proxy_id = Some(proxy_id);
+                    }
+                    if browser_egress_ip_override.is_some() {
+                        cred_req.browser_egress_ip = browser_egress_ip_override.clone();
+                    }
                     if let Some(rpm_limit) = rpm_override {
                         cred_req.rpm_limit = rpm_limit;
                     }
@@ -382,9 +403,9 @@ pub async fn update_refresh_token(
     Path(id): Path<u64>,
     Json(payload): Json<UpdateRefreshTokenRequest>,
 ) -> impl IntoResponse {
-    match state.service.update_refresh_token(id, payload) {
+    match state.service.update_refresh_token(id, payload).await {
         Ok(_) => Json(SuccessResponse::new(format!(
-            "凭据 #{} refreshToken 已更新（当前仍为禁用状态，请手动启用）",
+            "凭据 #{} refreshToken 已更新并完成所需出口验证",
             id
         )))
         .into_response(),
@@ -450,7 +471,10 @@ pub async fn add_proxy(
     State(state): State<AdminState>,
     Json(payload): Json<AddProxyRequest>,
 ) -> impl IntoResponse {
-    match state.service.add_proxy(payload.url, payload.label) {
+    match state
+        .service
+        .add_proxy(payload.url, payload.label, payload.allow_new_bindings)
+    {
         Ok(entry) => Json(entry).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
@@ -840,8 +864,13 @@ pub async fn start_social_relogin(
 pub async fn poll_social_relogin(
     State(state): State<AdminState>,
     Path((_, session_id)): Path<CredSessionPath>,
+    headers: HeaderMap,
 ) -> impl IntoResponse {
-    match state.service.poll_social_login(&session_id, None).await {
+    match state
+        .service
+        .poll_social_login(&session_id, egress_session_nonce(&headers))
+        .await
+    {
         Ok(response) => Json(response).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
@@ -852,11 +881,12 @@ pub async fn poll_social_relogin(
 pub async fn complete_social_relogin(
     State(state): State<AdminState>,
     Path((_, session_id)): Path<CredSessionPath>,
+    headers: HeaderMap,
     Json(payload): Json<CompleteSocialLoginRequest>,
 ) -> impl IntoResponse {
     match state
         .service
-        .complete_social_login(&session_id, payload, None)
+        .complete_social_login(&session_id, payload, egress_session_nonce(&headers))
         .await
     {
         Ok(response) => Json(response).into_response(),
@@ -882,8 +912,13 @@ pub async fn start_idc_relogin(
 pub async fn poll_idc_relogin(
     State(state): State<AdminState>,
     Path((_, session_id)): Path<CredSessionPath>,
+    headers: HeaderMap,
 ) -> impl IntoResponse {
-    match state.service.poll_idc_login(&session_id, None).await {
+    match state
+        .service
+        .poll_idc_login(&session_id, egress_session_nonce(&headers))
+        .await
+    {
         Ok(response) => Json(response).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
diff --git a/src/admin/proxy_pool.rs b/src/admin/proxy_pool.rs
index d6cb50f7..a96d952a 100644
--- a/src/admin/proxy_pool.rs
+++ b/src/admin/proxy_pool.rs
@@ -44,6 +44,11 @@ pub struct ProxyEntry {
     pub label: Option<String>,
     #[serde(default = "default_true")]
     pub enabled: bool,
+    /// Whether this proxy may be selected for a new credential binding.
+    /// Existing egress-bound credentials may continue using a legacy-only
+    /// proxy for refresh and promote verification.
+    #[serde(default = "default_true")]
+    pub allow_new_bindings: bool,
     /// 健康状态（健康检查结果）
     #[serde(default)]
     pub health: ProxyHealth,
@@ -75,6 +80,14 @@ pub enum GetUrlResult {
     Disabled,
 }
 
+/// Managed proxy lookup for a brand-new binding.
+pub enum GetNewBindingUrlResult {
+    Ok(String),
+    NotFound,
+    Disabled,
+    Restricted,
+}
+
 /// 一次全量健康检查的摘要
 #[derive(Debug, Clone, Default)]
 pub struct CheckSummary {
@@ -166,7 +179,12 @@ impl ProxyPoolManager {
         self.entries.lock().clone()
     }
 
-    pub fn add(&self, url: String, label: Option<String>) -> anyhow::Result<ProxyEntry> {
+    pub fn add(
+        &self,
+        url: String,
+        label: Option<String>,
+        allow_new_bindings: bool,
+    ) -> anyhow::Result<ProxyEntry> {
         let url = url.trim().to_string();
         if url.is_empty() {
             anyhow::bail!("代理 URL 不能为空");
@@ -185,6 +203,7 @@ impl ProxyPoolManager {
             url,
             label,
             enabled: true,
+            allow_new_bindings,
             health: ProxyHealth::Unknown,
             latency_ms: None,
             last_checked_at: None,
@@ -223,6 +242,7 @@ impl ProxyPoolManager {
                 url,
                 label: None,
                 enabled: true,
+                allow_new_bindings: true,
                 health: ProxyHealth::Unknown,
                 latency_ms: None,
                 last_checked_at: None,
@@ -292,12 +312,21 @@ impl ProxyPoolManager {
         }
     }
 
+    pub fn get_new_binding_url(&self, id: u64) -> GetNewBindingUrlResult {
+        match self.entries.lock().iter().find(|e| e.id == id) {
+            None => GetNewBindingUrlResult::NotFound,
+            Some(e) if !e.enabled => GetNewBindingUrlResult::Disabled,
+            Some(e) if !e.allow_new_bindings => GetNewBindingUrlResult::Restricted,
+            Some(e) => GetNewBindingUrlResult::Ok(e.url.clone()),
+        }
+    }
+
     /// 获取所有「可用于分配」的代理 URL：已启用且非 Unhealthy
     pub fn assignable_urls(&self) -> Vec<String> {
         self.entries
             .lock()
             .iter()
-            .filter(|e| e.enabled && e.health != ProxyHealth::Unhealthy)
+            .filter(|e| e.enabled && e.allow_new_bindings && e.health != ProxyHealth::Unhealthy)
             .map(|e| e.url.clone())
             .collect()
     }
@@ -652,6 +681,7 @@ impl ProxyPoolManager {
             url: url.to_string(),
             label: None,
             enabled: true,
+            allow_new_bindings: true,
             health: ProxyHealth::Unknown,
             latency_ms: None,
             last_checked_at: None,
@@ -673,6 +703,7 @@ mod tests {
             url: url.to_string(),
             label: None,
             enabled: true,
+            allow_new_bindings: true,
             health: ProxyHealth::Unknown,
             latency_ms: None,
             last_checked_at: None,
@@ -692,6 +723,22 @@ mod tests {
         assert_eq!(e.latency_ms, None);
         assert_eq!(e.consecutive_failures, 0);
         assert!(!e.auto_disabled);
+        assert!(e.allow_new_bindings);
+    }
+
+    #[test]
+    fn legacy_only_proxy_stays_available_to_bound_credentials_but_not_new_bindings() {
+        let mgr = ProxyPoolManager::new(None, TlsBackend::Rustls);
+        let entry = mgr
+            .add("http://legacy-proxy:8080".to_string(), None, false)
+            .unwrap();
+
+        assert!(matches!(mgr.get_url(entry.id), GetUrlResult::Ok(_)));
+        assert!(matches!(
+            mgr.get_new_binding_url(entry.id),
+            GetNewBindingUrlResult::Restricted
+        ));
+        assert!(mgr.assignable_urls().is_empty());
     }
 
     #[test]
@@ -735,7 +782,7 @@ mod tests {
     fn set_enabled_true_clears_auto_disable_state() {
         let mgr = ProxyPoolManager::new(None, TlsBackend::Rustls);
         let entry = mgr
-            .add("socks5://127.0.0.1:1080".to_string(), None)
+            .add("socks5://127.0.0.1:1080".to_string(), None, true)
             .unwrap();
         // 模拟自动禁用状态
         {
@@ -756,8 +803,10 @@ mod tests {
     #[test]
     fn sticky_mode_reuses_success_proxy_until_failure() {
         let mgr = ProxyPoolManager::new(None, TlsBackend::Rustls);
-        mgr.add("http://proxy-a:8080".to_string(), None).unwrap();
-        mgr.add("http://proxy-b:8080".to_string(), None).unwrap();
+        mgr.add("http://proxy-a:8080".to_string(), None, true)
+            .unwrap();
+        mgr.add("http://proxy-b:8080".to_string(), None, true)
+            .unwrap();
         let proxy_a = ProxyConfig::new("http://proxy-a:8080");
         let proxy_b = ProxyConfig::new("http://proxy-b:8080");
 
@@ -776,8 +825,10 @@ mod tests {
     #[test]
     fn least_load_mode_prefers_lower_in_flight_proxy() {
         let mgr = ProxyPoolManager::new(None, TlsBackend::Rustls);
-        mgr.add("http://proxy-a:8080".to_string(), None).unwrap();
-        mgr.add("http://proxy-b:8080".to_string(), None).unwrap();
+        mgr.add("http://proxy-a:8080".to_string(), None, true)
+            .unwrap();
+        mgr.add("http://proxy-b:8080".to_string(), None, true)
+            .unwrap();
         let proxy_a = ProxyConfig::new("http://proxy-a:8080");
         let proxy_b = ProxyConfig::new("http://proxy-b:8080");
 
diff --git a/src/admin/router.rs b/src/admin/router.rs
index 5dea3b9a..51d3a360 100644
--- a/src/admin/router.rs
+++ b/src/admin/router.rs
@@ -27,7 +27,7 @@ use super::{
         set_log_governance_config, set_proxy_balancing_mode, set_proxy_enabled, set_retry_policy,
         set_update_config, start_idc_login, start_idc_relogin, start_social_login,
         start_social_relogin, stats_by_credential, stats_by_model, stats_overview,
-        stats_timeseries, test_credential_response, trace_failure_stats, update_admin_key,
+        stats_timeseries, test_credential_response, promote_credential, trace_failure_stats, update_admin_key,
         update_client_key, update_credential, update_group, update_refresh_token,
     },
     middleware::{AdminState, admin_auth_middleware},
@@ -89,6 +89,7 @@ pub fn create_admin_router(state: AdminState) -> Router {
         .route("/credentials/{id}/balance", get(get_credential_balance))
         .route("/credentials/{id}/models", get(get_credential_models))
         .route("/credentials/{id}/test", post(test_credential_response))
+        .route("/credentials/{id}/promote", post(promote_credential))
         .route("/credentials/{id}/proxy", post(assign_proxy_to_credential))
         .route("/proxy-pool", get(get_proxy_pool).post(add_proxy))
         .route("/proxy-pool/batch", post(batch_add_proxies))
diff --git a/src/admin/service.rs b/src/admin/service.rs
index 3cfe578c..616a3d7c 100644
--- a/src/admin/service.rs
+++ b/src/admin/service.rs
@@ -24,7 +24,7 @@ use crate::kiro::token_manager::MultiTokenManager;
 use crate::model::config::{Config, RetryMode};
 
 use super::error::AdminServiceError;
-use super::proxy_pool::{GetUrlResult, ProxyPoolManager};
+use super::proxy_pool::{GetNewBindingUrlResult, GetUrlResult, ProxyPoolManager};
 use super::types::{
     AccountThrottleConfigResponse, AddCredentialRequest, AddCredentialResponse, AssignProxyRequest,
     AssignRoundRobinResponse, AvailableModelItem, AvailableModelsResponse, BalanceResponse,
@@ -37,7 +37,7 @@ use super::types::{
     ProxyPoolResponse, QuotaExceededResult, RetryPolicyResponse, SetAccountThrottleConfigRequest,
     SetLoadBalancingModeRequest, SetLogGovernanceConfigRequest, SetProxyBalancingModeRequest,
     SetRetryPolicyRequest, SetUpdateConfigRequest, StartIdcLoginRequest, StartIdcLoginResponse,
-    StartSocialLoginRequest, StartSocialLoginResponse, UpdateCheckInfo, UpdateConfigResponse,
+    StartSocialLoginRequest, StartSocialLoginResponse, PromoteCredentialResponse, UpdateCheckInfo, UpdateConfigResponse,
     UpdateCredentialRequest, UpdateRefreshTokenRequest,
 };
 
@@ -79,6 +79,15 @@ fn normalize_proxy_list(raw: &str) -> Result<Option<String>, AdminServiceError>
     Ok(Some(candidates.join("\n")))
 }
 
+fn valid_login_slot_id(value: &str) -> bool {
+    let len = value.len();
+    (3..=80).contains(&len)
+        && value.as_bytes().first().is_some_and(u8::is_ascii_alphanumeric)
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+}
+
 /// 缓存的余额条目（含时间戳）
 #[derive(Debug, Clone, Serialize, Deserialize)]
 struct CachedBalance {
@@ -274,6 +283,7 @@ impl LoginEgressBinding {
         credential.egress_proxy_version = Some(self.proxy_version.clone());
         credential.egress_fingerprint = Some(self.fingerprint.clone());
         credential.disabled = true;
+        credential.egress_activation_at = None;
     }
 }
 
@@ -614,15 +624,88 @@ impl AdminService {
                 "egress login v2 要求先选择托管代理 proxyId".to_string(),
             )
         })?;
+        let proxy_url = match self.proxy_pool.get_new_binding_url(proxy_id) {
+            GetNewBindingUrlResult::Ok(url) => url,
+            GetNewBindingUrlResult::NotFound => {
+                return Err(AdminServiceError::NotFound { id: proxy_id });
+            }
+            GetNewBindingUrlResult::Disabled => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "选定代理已禁用".to_string(),
+                ));
+            }
+            GetNewBindingUrlResult::Restricted => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "选定代理仅允许历史账号使用原出口恢复，禁止新账号绑定".to_string(),
+                ));
+            }
+        };
+        let proxy = ProxyConfig::new(proxy_url);
+        let probe = egress_login::probe(
+            proxy_id,
+            &proxy,
+            browser_egress_ip,
+            self.token_manager.config().tls_backend,
+        )
+        .await
+        .map_err(|error| AdminServiceError::UpstreamError(error.to_string()))?;
+        let (nonce, nonce_hash) = egress_login::new_nonce();
+        Ok((
+            LoginEgressBinding {
+                slot_id: format!("kiro-rs-{}", Uuid::new_v4()),
+                proxy_id,
+                proxy_version: probe.proxy_version,
+                fingerprint: probe.fingerprint,
+                browser_status: probe.browser_status,
+                nonce_hash,
+                nonce_claimed: false,
+            },
+            proxy,
+            nonce,
+        ))
+    }
+
+    async fn prepare_relogin_egress(
+        &self,
+        target_id: u64,
+        requested_proxy_id: Option<u64>,
+        browser_egress_ip: Option<&str>,
+    ) -> Result<(LoginEgressBinding, ProxyConfig, String), AdminServiceError> {
+        let credential = self
+            .token_manager
+            .clone_all_credentials()
+            .into_iter()
+            .find(|credential| credential.id == Some(target_id))
+            .ok_or(AdminServiceError::NotFound { id: target_id })?;
+        let proxy_id = match (credential.egress_proxy_id, requested_proxy_id) {
+            (Some(bound), Some(requested)) if bound != requested => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "已绑定账号重新登录必须使用原托管代理，禁止迁移出口".to_string(),
+                ));
+            }
+            (Some(bound), _) => bound,
+            (None, Some(requested)) => requested,
+            (None, None) => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "egress login v2 要求先选择托管代理 proxyId".to_string(),
+                ));
+            }
+        };
         let proxy_url = match self.proxy_pool.get_url(proxy_id) {
             GetUrlResult::Ok(url) => url,
             GetUrlResult::NotFound => return Err(AdminServiceError::NotFound { id: proxy_id }),
             GetUrlResult::Disabled => {
                 return Err(AdminServiceError::InvalidCredential(
-                    "选定代理已禁用".to_string(),
+                    "账号绑定的原托管代理已禁用，禁止自动换代理".to_string(),
                 ));
             }
         };
+        let effective = credential.effective_proxy(self.token_manager.proxy().as_ref());
+        if effective.as_ref().map(|proxy| proxy.url.as_str()) != Some(proxy_url.as_str()) {
+            return Err(AdminServiceError::InvalidCredential(
+                "所选托管代理与账号原代理不一致，禁止迁移出口".to_string(),
+            ));
+        }
         let proxy = ProxyConfig::new(proxy_url);
         let probe = egress_login::probe(
             proxy_id,
@@ -632,10 +715,26 @@ impl AdminService {
         )
         .await
         .map_err(|error| AdminServiceError::UpstreamError(error.to_string()))?;
+        if let Some(expected) = credential.egress_proxy_version.as_deref()
+            && expected != probe.proxy_version
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "账号绑定的代理版本发生漂移".to_string(),
+            ));
+        }
+        if let Some(expected) = credential.egress_fingerprint.as_deref()
+            && expected != probe.fingerprint
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "账号绑定的公网出口发生漂移".to_string(),
+            ));
+        }
         let (nonce, nonce_hash) = egress_login::new_nonce();
         Ok((
             LoginEgressBinding {
-                slot_id: format!("kiro-rs-{}", Uuid::new_v4()),
+                slot_id: credential
+                    .login_slot_id
+                    .unwrap_or_else(|| format!("kiro-rs-{}", Uuid::new_v4())),
                 proxy_id,
                 proxy_version: probe.proxy_version,
                 fingerprint: probe.fingerprint,
@@ -648,6 +747,24 @@ impl AdminService {
         ))
     }
 
+    fn bind_relogin_egress(
+        &self,
+        target_id: u64,
+        binding: &LoginEgressBinding,
+        proxy: &ProxyConfig,
+    ) -> Result<(), AdminServiceError> {
+        self.token_manager
+            .bind_relogin_egress(
+                target_id,
+                binding.slot_id.clone(),
+                binding.proxy_id,
+                binding.proxy_version.clone(),
+                binding.fingerprint.clone(),
+                proxy.url.clone(),
+            )
+            .map_err(|error| AdminServiceError::InvalidCredential(error.to_string()))
+    }
+
     async fn verify_login_egress(
         &self,
         binding: &LoginEgressBinding,
@@ -805,6 +922,9 @@ impl AdminService {
                     source_channel: entry.source_channel,
                     balance,
                     balance_updated_at,
+                    login_slot_id: entry.login_slot_id,
+                    egress_proxy_id: entry.egress_proxy_id,
+                    egress_activation_at: entry.egress_activation_at,
                 }
             })
             .collect();
@@ -905,6 +1025,20 @@ impl AdminService {
 
     /// 设置凭据禁用状态
     pub fn set_disabled(&self, id: u64, disabled: bool) -> Result<(), AdminServiceError> {
+        if !disabled && egress_login::enabled() {
+            if let Some(credential) = self
+                .token_manager
+                .clone_all_credentials()
+                .into_iter()
+                .find(|credential| credential.id == Some(id))
+            {
+                if credential.egress_fingerprint.is_some() {
+                    return Err(AdminServiceError::InvalidCredential(
+                        "egress-bound 凭据只能通过 promote 验证后启用，禁止直接启用".to_string(),
+                    ));
+                }
+            }
+        }
         // 先获取当前凭据 ID，用于判断是否需要切换
         let snapshot = self.token_manager.snapshot();
         let current_id = snapshot.current_id;
@@ -929,6 +1063,19 @@ impl AdminService {
 
     /// 重置失败计数并重新启用
     pub fn reset_and_enable(&self, id: u64) -> Result<(), AdminServiceError> {
+        if egress_login::enabled()
+            && self
+                .token_manager
+                .clone_all_credentials()
+                .iter()
+                .any(|credential| {
+                    credential.id == Some(id) && credential.egress_fingerprint.is_some()
+                })
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress-bound 凭据禁止直接重置并启用，请使用 promote 完成原出口复核".to_string(),
+            ));
+        }
         self.token_manager
             .reset_and_enable(id)
             .map_err(|e| self.classify_error(e, id))
@@ -1066,10 +1213,93 @@ impl AdminService {
             latency_ms: result.latency_ms,
             http_status: result.http_status,
             response_snippet: result.response_snippet,
+            stream_complete: result.stream_complete,
             error: result.error,
         })
     }
 
+    /// Run the complete egress-bound promote gate. Failure leaves the
+    /// credential quarantined and never clears its error state.
+    pub async fn promote_egress_credential(
+        &self,
+        id: u64,
+    ) -> Result<PromoteCredentialResponse, AdminServiceError> {
+        if !egress_login::enabled() {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress login v2 未启用".to_string(),
+            ));
+        }
+        let credential = self
+            .token_manager
+            .clone_all_credentials()
+            .into_iter()
+            .find(|credential| credential.id == Some(id))
+            .ok_or(AdminServiceError::NotFound { id })?;
+        let proxy_id = credential.egress_proxy_id.ok_or_else(|| {
+            AdminServiceError::InvalidCredential("凭据未绑定托管出口".to_string())
+        })?;
+        let proxy_url = match self.proxy_pool.get_url(proxy_id) {
+            GetUrlResult::Ok(url) => url,
+            GetUrlResult::NotFound => return Err(AdminServiceError::NotFound { id: proxy_id }),
+            GetUrlResult::Disabled => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "凭据绑定的托管出口已禁用".to_string(),
+                ));
+            }
+        };
+        if credential.proxy_url.as_deref() != Some(proxy_url.as_str()) {
+            return Err(AdminServiceError::InvalidCredential(
+                "凭据代理与绑定托管出口不一致".to_string(),
+            ));
+        }
+        let proxy = ProxyConfig::new(proxy_url);
+        egress_login::verify_bound_credential(
+            &credential,
+            self.token_manager.config(),
+            Some(&proxy),
+        )
+        .await
+        .map_err(|error| AdminServiceError::UpstreamError(error.to_string()))?;
+
+        let balance = self.fetch_balance(id).await?;
+        let models = self.get_available_models(id).await?;
+        let model = models
+            .models
+            .first()
+            .map(|model| model.model_id.clone())
+            .ok_or_else(|| {
+                AdminServiceError::InvalidCredential("账号没有可用模型".to_string())
+            })?;
+        let provider = self.kiro_provider.as_ref().ok_or_else(|| {
+            AdminServiceError::InternalError("KiroProvider 未初始化，无法执行 promote".to_string())
+        })?;
+        let probe = provider
+            .test_credential_response_for_probe(id, &model)
+            .await
+            .map_err(|error| AdminServiceError::UpstreamError(error.to_string()))?;
+        if !probe.success || !probe.stream_complete {
+            return Err(AdminServiceError::UpstreamError(
+                probe
+                    .error
+                    .unwrap_or_else(|| "unary 200 或 SSE message_stop 验证失败".to_string()),
+            ));
+        }
+        self.token_manager
+            .mark_egress_activated(id, Utc::now().to_rfc3339())
+            .map_err(|error| AdminServiceError::InternalError(error.to_string()))?;
+        self.token_manager
+            .set_disabled(id, false)
+            .map_err(|error| self.classify_error(error, id))?;
+        Ok(PromoteCredentialResponse {
+            id,
+            model,
+            model_count: models.models.len(),
+            balance,
+            unary200: true,
+            sse_message_stop: true,
+        })
+    }
+
     /// 批量刷新所有非禁用凭据的余额（用于后台调度）
     ///
     /// 串行执行以避免对上游产生瞬时高并发，每次成功的查询都会更新内存缓存
@@ -1245,7 +1475,11 @@ impl AdminService {
         req: AddCredentialRequest,
     ) -> Result<AddCredentialResponse, AdminServiceError> {
         // 默认获取余额（保持单条添加 / 登录路径的既有行为：加完即可见订阅等级）
-        self.add_credential_inner(req, true).await
+        let response = self.add_credential_inner(req, true).await?;
+        if egress_login::enabled() {
+            self.promote_egress_credential(response.credential_id).await?;
+        }
+        Ok(response)
     }
 
     /// 添加凭据的核心实现。
@@ -1259,6 +1493,51 @@ impl AdminService {
         mut req: AddCredentialRequest,
         fetch_balance: bool,
     ) -> Result<AddCredentialResponse, AdminServiceError> {
+        // Direct JSON/API-Key imports use the same fixed-egress reservation as
+        // online OAuth while v2 is enabled. Raw proxy URLs cannot bypass it.
+        let direct_egress = if egress_login::enabled() {
+            if req.proxy_url.is_some()
+                || req.proxy_username.is_some()
+                || req.proxy_password.is_some()
+            {
+                return Err(AdminServiceError::InvalidCredential(
+                    "egress login v2 禁止直接提交 proxyUrl，请先选择托管代理 proxyId".to_string(),
+                ));
+            }
+            let (mut binding, proxy, _) = self
+                .prepare_login_egress(req.proxy_id, req.browser_egress_ip.as_deref())
+                .await?;
+            if let Some(slot_id) = req
+                .login_slot_id
+                .as_deref()
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+            {
+                if !valid_login_slot_id(slot_id) {
+                    return Err(AdminServiceError::InvalidCredential(
+                        "loginSlotId 格式无效".to_string(),
+                    ));
+                }
+                if self
+                    .token_manager
+                    .clone_all_credentials()
+                    .iter()
+                    .any(|credential| credential.login_slot_id.as_deref() == Some(slot_id))
+                {
+                    return Err(AdminServiceError::InvalidCredential(
+                        "loginSlotId 已存在，不能覆盖活跃账号槽位".to_string(),
+                    ));
+                }
+                binding.slot_id = slot_id.to_string();
+            }
+            req.proxy_url = Some(proxy.url.clone());
+            req.proxy_username = None;
+            req.proxy_password = None;
+            Some(binding)
+        } else {
+            None
+        };
+
         // 校验端点名：未指定则默认合法，指定则必须已注册
         if let Some(ref name) = req.endpoint {
             if !self.known_endpoints.contains(name) {
@@ -1384,22 +1663,28 @@ impl AdminService {
             proxy_url: req.proxy_url,
             proxy_username: req.proxy_username,
             proxy_password: req.proxy_password,
-            disabled: false, // 新添加的凭据默认启用
+            disabled: direct_egress.is_some(),
             kiro_api_key: req.kiro_api_key,
             endpoint: req.endpoint,
             groups: req.groups,
             source_channel: req.source_channel,
-            login_slot_id: None,
-            egress_proxy_id: None,
-            egress_proxy_version: None,
-            egress_fingerprint: None,
+            login_slot_id: direct_egress.as_ref().map(|binding| binding.slot_id.clone()),
+            egress_proxy_id: direct_egress.as_ref().map(|binding| binding.proxy_id),
+            egress_proxy_version: direct_egress
+                .as_ref()
+                .map(|binding| binding.proxy_version.clone()),
+            egress_fingerprint: direct_egress
+                .as_ref()
+                .map(|binding| binding.fingerprint.clone()),
+            egress_activation_at: None,
         };
 
         // 调用 token_manager 添加凭据
-        let credential_id = self
-            .token_manager
-            .add_credential(new_cred)
-            .await
+        let credential_id = if direct_egress.is_some() {
+            self.token_manager.add_quarantined_credential(new_cred).await
+        } else {
+            self.token_manager.add_credential(new_cred).await
+        }
             .map_err(|e| self.classify_add_error(e))?;
 
         // 主动获取余额（含订阅等级 / 邮箱）并写入缓存，添加后立即可见，
@@ -1407,7 +1692,7 @@ impl AdminService {
         // 仅验活路径需要；"直接导入"路径跳过以省掉这次上游往返。
         if fetch_balance {
             if let Err(e) = self.get_balance(credential_id).await {
-                tracing::warn!("添加凭据后刷新余额失败（不影响凭据添加）: {}", e);
+                tracing::warn!("添加凭据后刷新余额失败（账号保持隔离）: {}", e);
             }
         }
 
@@ -1431,6 +1716,7 @@ impl AdminService {
         req: AddCredentialRequest,
         verify: bool,
     ) -> ImportItemResult {
+        let quarantined = egress_login::enabled();
         // 1. add：去重 / 未知端点 / token 刷新失败在此暴露，未插入即无需回滚。
         //    verify=false 时跳过内部余额拉取。
         let resp = match self.add_credential_inner(req, verify).await {
@@ -1468,16 +1754,45 @@ impl AdminService {
         // 3. 验活路径：显式取余额验活（OAuth 正常路径命中 add 内缓存；
         //    API Key 无 token 刷新，余额拉取即真正的验活，失败则回滚）。
         match self.get_balance(resp.credential_id).await {
-            Ok(balance) => ImportItemResult {
-                status: ImportStatus::Verified,
-                credential_id: Some(resp.credential_id),
-                email: resp.email.clone(),
-                balance: Some(balance),
-                error: None,
-                rolled_back: false,
-            },
+            Ok(balance) => {
+                if quarantined {
+                    if let Err(error) = self.promote_egress_credential(resp.credential_id).await {
+                        return ImportItemResult {
+                            status: ImportStatus::Failed,
+                            credential_id: Some(resp.credential_id),
+                            email: resp.email,
+                            balance: Some(balance),
+                            error: Some(format!("promote 失败，账号保持隔离: {error}")),
+                            rolled_back: false,
+                        };
+                    }
+                }
+                ImportItemResult {
+                    status: ImportStatus::Verified,
+                    credential_id: Some(resp.credential_id),
+                    email: resp.email.clone(),
+                    balance: Some(balance),
+                    error: None,
+                    rolled_back: false,
+                }
+            }
             Err(e) => {
                 let msg = e.to_string();
+                if quarantined {
+                    tracing::warn!(
+                        "批量导入凭据 #{} 余额验证失败，保留为隔离账号: {}",
+                        resp.credential_id,
+                        msg
+                    );
+                    return ImportItemResult {
+                        status: ImportStatus::Failed,
+                        credential_id: Some(resp.credential_id),
+                        email: resp.email,
+                        balance: None,
+                        error: Some(format!("余额验证失败，账号保持隔离: {msg}")),
+                        rolled_back: false,
+                    };
+                }
                 tracing::warn!(
                     "批量导入凭据 #{} 验活失败，回滚删除: {}",
                     resp.credential_id,
@@ -1504,6 +1819,22 @@ impl AdminService {
         id: u64,
         req: UpdateCredentialRequest,
     ) -> Result<(), AdminServiceError> {
+        if egress_login::enabled()
+            && (req.proxy_url.is_some()
+                || req.proxy_username.is_some()
+                || req.proxy_password.is_some())
+            && self
+                .token_manager
+                .clone_all_credentials()
+                .iter()
+                .any(|credential| {
+                    credential.id == Some(id) && credential.egress_fingerprint.is_some()
+                })
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress-bound 凭据的代理永久固定，禁止编辑".to_string(),
+            ));
+        }
         let proxy_url = match req.proxy_url {
             Some(raw) => Some(normalize_proxy_list(&raw)?),
             None => None,
@@ -2341,11 +2672,25 @@ impl AdminService {
     }
 
     /// 更新指定凭据的 refreshToken（仅限已禁用凭据）
-    pub fn update_refresh_token(
+    pub async fn update_refresh_token(
         &self,
         id: u64,
         req: UpdateRefreshTokenRequest,
     ) -> Result<(), AdminServiceError> {
+        let relogin_egress = if egress_login::enabled() {
+            let (binding, proxy, _) = self
+                .prepare_relogin_egress(id, req.proxy_id, req.browser_egress_ip.as_deref())
+                .await?;
+            self.bind_relogin_egress(id, &binding, &proxy)?;
+            Some((binding, proxy))
+        } else {
+            None
+        };
+        if relogin_egress.is_none() {
+            self.token_manager
+                .set_disabled(id, true)
+                .map_err(|error| self.classify_error(error, id))?;
+        }
         self.token_manager
             .update_refresh_token(id, req.refresh_token, req.access_token, req.expires_at)
             .map_err(|e| {
@@ -2362,7 +2707,11 @@ impl AdminService {
                 } else {
                     AdminServiceError::InternalError(msg)
                 }
-            })
+            })?;
+        if relogin_egress.is_some() {
+            self.promote_egress_credential(id).await?;
+        }
+        Ok(())
     }
 
     /// 一键开启所有"可开启超额且当前未开启"凭据的超额
@@ -2556,6 +2905,7 @@ impl AdminService {
                     url: p.url,
                     label: p.label,
                     enabled: p.enabled,
+                    allow_new_bindings: p.allow_new_bindings,
                     credential_count: count,
                     health: p.health,
                     latency_ms: p.latency_ms,
@@ -2577,16 +2927,18 @@ impl AdminService {
         &self,
         url: String,
         label: Option<String>,
+        allow_new_bindings: bool,
     ) -> Result<ProxyPoolEntry, AdminServiceError> {
         let entry = self
             .proxy_pool
-            .add(url, label)
+            .add(url, label, allow_new_bindings)
             .map_err(|e| AdminServiceError::InvalidCredential(e.to_string()))?;
         Ok(ProxyPoolEntry {
             id: entry.id,
             url: entry.url,
             label: entry.label,
             enabled: entry.enabled,
+            allow_new_bindings: entry.allow_new_bindings,
             credential_count: 0,
             health: entry.health,
             latency_ms: entry.latency_ms,
@@ -2609,6 +2961,7 @@ impl AdminService {
                 url: e.url,
                 label: e.label,
                 enabled: e.enabled,
+                allow_new_bindings: e.allow_new_bindings,
                 credential_count: 0,
                 health: e.health,
                 latency_ms: e.latency_ms,
@@ -2622,6 +2975,16 @@ impl AdminService {
 
     /// 删除代理池中的代理
     pub fn delete_proxy(&self, id: u64) -> Result<(), AdminServiceError> {
+        if self
+            .token_manager
+            .clone_all_credentials()
+            .iter()
+            .any(|credential| credential.egress_proxy_id == Some(id))
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "代理仍被 egress-bound 凭据使用，禁止删除".to_string(),
+            ));
+        }
         self.proxy_pool.delete(id).map_err(|e| {
             let msg = e.to_string();
             if msg.contains("不存在") {
@@ -2634,6 +2997,20 @@ impl AdminService {
 
     /// 设置代理启用/禁用状态
     pub fn set_proxy_enabled(&self, id: u64, enabled: bool) -> Result<(), AdminServiceError> {
+        if !enabled {
+            for credential in self
+                .token_manager
+                .clone_all_credentials()
+                .into_iter()
+                .filter(|credential| credential.egress_proxy_id == Some(id))
+            {
+                if let Some(credential_id) = credential.id {
+                    self.token_manager
+                        .set_disabled(credential_id, true)
+                        .map_err(|error| self.classify_error(error, credential_id))?;
+                }
+            }
+        }
         self.proxy_pool
             .set_enabled(id, enabled)
             .map_err(|_| AdminServiceError::NotFound { id })
@@ -2645,19 +3022,37 @@ impl AdminService {
         credential_id: u64,
         req: AssignProxyRequest,
     ) -> Result<(), AdminServiceError> {
+        if self
+            .token_manager
+            .clone_all_credentials()
+            .iter()
+            .any(|credential| {
+                credential.id == Some(credential_id) && credential.egress_fingerprint.is_some()
+            })
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress-bound 凭据的代理永久固定，禁止重新分配".to_string(),
+            ));
+        }
         let proxy_url = match req.proxy_id {
             Some(proxy_id) => {
-                let url = match self.proxy_pool.get_url(proxy_id) {
-                    GetUrlResult::Ok(url) => url,
-                    GetUrlResult::NotFound => {
+                let url = match self.proxy_pool.get_new_binding_url(proxy_id) {
+                    GetNewBindingUrlResult::Ok(url) => url,
+                    GetNewBindingUrlResult::NotFound => {
                         return Err(AdminServiceError::NotFound { id: proxy_id });
                     }
-                    GetUrlResult::Disabled => {
+                    GetNewBindingUrlResult::Disabled => {
                         return Err(AdminServiceError::InvalidCredential(format!(
                             "代理 #{} 已被禁用，请先启用后再分配",
                             proxy_id
                         )));
                     }
+                    GetNewBindingUrlResult::Restricted => {
+                        return Err(AdminServiceError::InvalidCredential(format!(
+                            "代理 #{} 仅允许历史账号使用原出口恢复，禁止新绑定",
+                            proxy_id
+                        )));
+                    }
                 };
                 Some(url)
             }
@@ -2747,6 +3142,13 @@ impl AdminService {
             ));
         }
 
+        let bound_ids: HashSet<u64> = self
+            .token_manager
+            .clone_all_credentials()
+            .into_iter()
+            .filter(|credential| credential.egress_fingerprint.is_some())
+            .filter_map(|credential| credential.id)
+            .collect();
         let target_ids: Vec<u64> = match credential_ids {
             Some(ids) if !ids.is_empty() => ids,
             _ => self
@@ -2756,7 +3158,10 @@ impl AdminService {
                 .iter()
                 .map(|c| c.id)
                 .collect(),
-        };
+        }
+        .into_iter()
+        .filter(|id| !bound_ids.contains(id))
+        .collect();
 
         let mut assigned = 0;
         for (i, cred_id) in target_ids.iter().enumerate() {
@@ -3244,8 +3649,13 @@ impl AdminService {
                     "Social 登录未返回 refreshToken，无法更新凭据".to_string(),
                 )
             })?;
-            self.do_relogin_update(target_id, refresh_token)
-                .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
+            self.do_relogin_update(
+                target_id,
+                refresh_token,
+                session.egress.as_ref(),
+                session.proxy.as_ref(),
+            )
+            .await?;
             tracing::info!("Social 重新登录成功，凭据 #{} Token 已更新", target_id);
             return Ok(PollIdcLoginResponse::Success {
                 credential_id: target_id,
@@ -3272,8 +3682,9 @@ impl AdminService {
         }
         .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
-        // 主动刷新余额（含订阅等级 / 邮箱）并写入缓存，登录后立即可见
-        if !quarantined && let Err(e) = self.get_balance(credential_id).await {
+        if quarantined {
+            self.promote_egress_credential(credential_id).await?;
+        } else if let Err(e) = self.get_balance(credential_id).await {
             tracing::warn!("Social 登录后刷新余额失败（不影响登录）: {}", e);
         }
 
@@ -3336,8 +3747,14 @@ impl AdminService {
         .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
         if let Some(target_id) = session.relogin_target_id {
-            self.do_external_idp_relogin_update(target_id, token, external_idp)
-                .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
+            self.do_external_idp_relogin_update(
+                target_id,
+                token,
+                external_idp,
+                session.egress.as_ref(),
+                session.proxy.as_ref(),
+            )
+            .await?;
             tracing::info!(
                 "External IdP 重新登录成功，凭据 #{} Token 与刷新元数据已更新",
                 target_id
@@ -3378,7 +3795,9 @@ impl AdminService {
         }
         .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
-        if !quarantined && let Err(e) = self.get_balance(credential_id).await {
+        if quarantined {
+            self.promote_egress_credential(credential_id).await?;
+        } else if let Err(e) = self.get_balance(credential_id).await {
             tracing::warn!("External IdP 登录后刷新余额失败（不影响登录）: {}", e);
         }
 
@@ -3629,8 +4048,13 @@ impl AdminService {
                 // 重新登录模式：更新已有凭据而非创建新凭据
                 if let Some(target_id) = relogin_target_id {
                     if let Some(refresh_token) = token.refresh_token {
-                        self.do_relogin_update(target_id, refresh_token)
-                            .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
+                        self.do_relogin_update(
+                            target_id,
+                            refresh_token,
+                            egress.as_ref(),
+                            proxy.as_ref(),
+                        )
+                        .await?;
                     }
                     tracing::info!("IdC 重新登录成功，凭据 #{} Token 已更新", target_id);
                     return Ok(PollIdcLoginResponse::Success {
@@ -3654,8 +4078,9 @@ impl AdminService {
                 }
                 .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
-                // 主动刷新余额（含订阅等级 / 邮箱）并写入缓存，登录后立即可见
-                if !quarantined && let Err(e) = self.get_balance(credential_id).await {
+                if quarantined {
+                    self.promote_egress_credential(credential_id).await?;
+                } else if let Err(e) = self.get_balance(credential_id).await {
                     tracing::warn!("IdC 登录后刷新余额失败（不影响登录）: {}", e);
                 }
 
@@ -3666,25 +4091,60 @@ impl AdminService {
     }
 
     /// 内部：重新登录完成后更新已有凭据的 Token（禁用→更新→重置→启用）
-    fn do_relogin_update(&self, target_id: u64, refresh_token: String) -> anyhow::Result<()> {
-        // 先禁用（update_refresh_token 要求凭据处于禁用状态）
-        self.token_manager.set_disabled(target_id, true)?;
+    async fn do_relogin_update(
+        &self,
+        target_id: u64,
+        refresh_token: String,
+        egress: Option<&LoginEgressBinding>,
+        proxy: Option<&ProxyConfig>,
+    ) -> Result<(), AdminServiceError> {
+        if let Some(binding) = egress {
+            let proxy = proxy.ok_or_else(|| {
+                AdminServiceError::InvalidCredential(
+                    "重新登录会话缺少原托管代理".to_string(),
+                )
+            })?;
+            self.bind_relogin_egress(target_id, binding, proxy)?;
+        } else {
+            self.token_manager
+                .set_disabled(target_id, true)
+                .map_err(|error| self.classify_error(error, target_id))?;
+        }
         // 更新 refreshToken（同时清空 accessToken 和 expiresAt，系统会在下次使用时自动刷新）
         self.token_manager
-            .update_refresh_token(target_id, refresh_token, None, None)?;
-        // 重置失败计数并重新启用
-        self.token_manager.reset_and_enable(target_id)?;
+            .update_refresh_token(target_id, refresh_token, None, None)
+            .map_err(|error| AdminServiceError::InvalidCredential(error.to_string()))?;
+        if egress.is_some() {
+            self.promote_egress_credential(target_id).await?;
+        } else {
+            self.token_manager
+                .reset_and_enable(target_id)
+                .map_err(|error| self.classify_error(error, target_id))?;
+        }
         Ok(())
     }
 
     /// 内部：external_idp 重新登录完成后更新已有凭据的 Token 与 IdP 元数据。
-    fn do_external_idp_relogin_update(
+    async fn do_external_idp_relogin_update(
         &self,
         target_id: u64,
         token: social::ExternalIdpToken,
         external_idp: ExternalIdpLoginState,
-    ) -> anyhow::Result<()> {
-        self.token_manager.set_disabled(target_id, true)?;
+        egress: Option<&LoginEgressBinding>,
+        proxy: Option<&ProxyConfig>,
+    ) -> Result<(), AdminServiceError> {
+        if let Some(binding) = egress {
+            let proxy = proxy.ok_or_else(|| {
+                AdminServiceError::InvalidCredential(
+                    "重新登录会话缺少原托管代理".to_string(),
+                )
+            })?;
+            self.bind_relogin_egress(target_id, binding, proxy)?;
+        } else {
+            self.token_manager
+                .set_disabled(target_id, true)
+                .map_err(|error| self.classify_error(error, target_id))?;
+        }
         let expires_at = token
             .expires_in
             .map(|secs| (Utc::now() + Duration::seconds(secs)).to_rfc3339());
@@ -3697,8 +4157,15 @@ impl AdminService {
             external_idp.token_endpoint,
             external_idp.issuer_url,
             external_idp.scopes,
-        )?;
-        self.token_manager.reset_and_enable(target_id)?;
+        )
+        .map_err(|error| AdminServiceError::InvalidCredential(error.to_string()))?;
+        if egress.is_some() {
+            self.promote_egress_credential(target_id).await?;
+        } else {
+            self.token_manager
+                .reset_and_enable(target_id)
+                .map_err(|error| self.classify_error(error, target_id))?;
+        }
         Ok(())
     }
 
@@ -3716,12 +4183,23 @@ impl AdminService {
             }
         }
 
-        let global_proxy = self.token_manager.proxy();
-        let proxy = req
-            .proxy_url
-            .as_deref()
-            .map(ProxyConfig::new)
-            .or(global_proxy);
+        let (egress, proxy, session_nonce) = if egress_login::enabled() {
+            let (binding, proxy, nonce) = self
+                .prepare_relogin_egress(
+                    target_id,
+                    req.proxy_id,
+                    req.browser_egress_ip.as_deref(),
+                )
+                .await?;
+            (Some(binding), Some(proxy), Some(nonce))
+        } else {
+            let global_proxy = self.token_manager.proxy();
+            (
+                None,
+                req.proxy_url.as_deref().map(ProxyConfig::new).or(global_proxy),
+                None,
+            )
+        };
 
         let auth_endpoint = req
             .auth_endpoint
@@ -3753,7 +4231,7 @@ impl AdminService {
             proxy,
             _server_handle: server_handle,
             relogin_target_id: Some(target_id),
-            egress: None,
+            egress: egress.clone(),
         };
 
         self.social_sessions
@@ -3764,11 +4242,13 @@ impl AdminService {
             session_id,
             portal_url,
             expires_at: expires_at.to_rfc3339(),
-            session_nonce: None,
-            slot_id: None,
-            proxy_id: None,
-            egress_fingerprint: None,
-            browser_egress_status: None,
+            session_nonce,
+            slot_id: egress.as_ref().map(|value| value.slot_id.clone()),
+            proxy_id: egress.as_ref().map(|value| value.proxy_id),
+            egress_fingerprint: egress.as_ref().map(|value| value.fingerprint.clone()),
+            browser_egress_status: egress
+                .as_ref()
+                .map(|value| value.browser_status.as_str().to_string()),
         })
     }
 
@@ -3787,13 +4267,23 @@ impl AdminService {
         }
 
         let config = self.token_manager.config();
-        let global_proxy = self.token_manager.proxy();
-
-        let proxy = req
-            .proxy_url
-            .as_deref()
-            .map(ProxyConfig::new)
-            .or(global_proxy);
+        let (egress, proxy, session_nonce) = if egress_login::enabled() {
+            let (binding, proxy, nonce) = self
+                .prepare_relogin_egress(
+                    target_id,
+                    req.proxy_id,
+                    req.browser_egress_ip.as_deref(),
+                )
+                .await?;
+            (Some(binding), Some(proxy), Some(nonce))
+        } else {
+            let global_proxy = self.token_manager.proxy();
+            (
+                None,
+                req.proxy_url.as_deref().map(ProxyConfig::new).or(global_proxy),
+                None,
+            )
+        };
 
         let start_url = req.start_url.as_deref().unwrap_or(BUILDER_ID_START_URL);
 
@@ -3825,7 +4315,7 @@ impl AdminService {
             cred_template: KiroCredentials::default(),
             proxy,
             relogin_target_id: Some(target_id),
-            egress: None,
+            egress: egress.clone(),
         };
 
         let poll_interval = session.poll_interval;
@@ -3838,11 +4328,13 @@ impl AdminService {
             verification_uri_complete: device.verification_uri_complete,
             expires_at: expires_at.to_rfc3339(),
             poll_interval,
-            session_nonce: None,
-            slot_id: None,
-            proxy_id: None,
-            egress_fingerprint: None,
-            browser_egress_status: None,
+            session_nonce,
+            slot_id: egress.as_ref().map(|value| value.slot_id.clone()),
+            proxy_id: egress.as_ref().map(|value| value.proxy_id),
+            egress_fingerprint: egress.as_ref().map(|value| value.fingerprint.clone()),
+            browser_egress_status: egress
+                .as_ref()
+                .map(|value| value.browser_status.as_str().to_string()),
         })
     }
 }
@@ -3872,6 +4364,14 @@ mod tests {
         }
     }
 
+    #[test]
+    fn login_slot_ids_are_stable_and_non_overwriting() {
+        assert!(valid_login_slot_id("free-20260731-abc123"));
+        assert!(!valid_login_slot_id("-starts-with-dash"));
+        assert!(!valid_login_slot_id("ab"));
+        assert!(!valid_login_slot_id("contains space"));
+    }
+
     #[test]
     fn semver_compares_correctly() {
         use std::cmp::Ordering;
diff --git a/src/admin/types.rs b/src/admin/types.rs
index 001c5a84..a2050186 100644
--- a/src/admin/types.rs
+++ b/src/admin/types.rs
@@ -91,6 +91,13 @@ pub struct CredentialStatusItem {
     /// 余额缓存的更新时间（Unix 秒，仅在 balance 有值时返回）
     #[serde(skip_serializing_if = "Option::is_none")]
     pub balance_updated_at: Option<f64>,
+    /// Fixed-egress metadata. No proxy URL or fingerprint is exposed here.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub login_slot_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub egress_proxy_id: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub egress_activation_at: Option<String>,
 }
 
 // ============ 操作请求 ============
@@ -236,6 +243,16 @@ pub struct AddCredentialRequest {
     /// 账号来源渠道（纯备注，可选）
     #[serde(default)]
     pub source_channel: Option<String>,
+    /// Egress login v2 managed proxy ID. Raw proxy URLs are rejected while the
+    /// feature flag is enabled.
+    #[serde(default)]
+    pub proxy_id: Option<u64>,
+    /// Optional browser-observed public IP, checked against the managed proxy.
+    #[serde(default)]
+    pub browser_egress_ip: Option<String>,
+    /// Optional new login slot ID. The server generates one when omitted.
+    #[serde(default)]
+    pub login_slot_id: Option<String>,
 }
 
 fn default_auth_method() -> String {
@@ -259,6 +276,12 @@ pub struct UpdateRefreshTokenRequest {
     /// 可选：同时更新 expiresAt（与 accessToken 配套）
     #[serde(default)]
     pub expires_at: Option<String>,
+    /// Managed egress selected for the re-import. Existing bound credentials
+    /// may only select their original proxy ID.
+    #[serde(default)]
+    pub proxy_id: Option<u64>,
+    #[serde(default)]
+    pub browser_egress_ip: Option<String>,
 }
 
 /// 更新凭据请求（仅可编辑字段，None 表示不修改，Some("") 表示清除）
@@ -309,6 +332,12 @@ pub struct BatchImportRequest {
     /// 顶层统一代理覆盖；为空或缺省时尊重单条凭据字段
     #[serde(default)]
     pub proxy_url: Option<String>,
+    /// Top-level managed proxy ID applied to every imported credential.
+    #[serde(default)]
+    pub proxy_id: Option<u64>,
+    /// Optional browser-observed public IP for the selected managed proxy.
+    #[serde(default)]
+    pub browser_egress_ip: Option<String>,
     /// 顶层统一 RPM 覆盖；缺省时尊重单条凭据字段
     #[serde(default)]
     pub rpm_limit: Option<u32>,
@@ -448,10 +477,24 @@ pub struct CredentialResponseTestResponse {
     pub http_status: Option<u16>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub response_snippet: Option<String>,
+    /// Whether the upstream EventStream ended with terminal metadata.
+    pub stream_complete: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
 }
 
+/// Egress-bound credential promote result.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PromoteCredentialResponse {
+    pub id: u64,
+    pub model: String,
+    pub model_count: usize,
+    pub balance: BalanceResponse,
+    pub unary200: bool,
+    pub sse_message_stop: bool,
+}
+
 // ============ 一键超额 ============
 
 /// 一键超额禁用结果
@@ -607,6 +650,9 @@ pub struct ProxyPoolEntry {
     pub label: Option<String>,
     /// 是否启用
     pub enabled: bool,
+    /// Whether new credentials may bind this proxy. False keeps the proxy
+    /// available only to existing historical credentials using the same URL.
+    pub allow_new_bindings: bool,
     /// 使用此代理的凭据数量
     pub credential_count: u32,
     /// 健康状态
@@ -680,6 +726,12 @@ pub struct AddProxyRequest {
     pub url: String,
     #[serde(default)]
     pub label: Option<String>,
+    #[serde(default = "default_allow_new_bindings")]
+    pub allow_new_bindings: bool,
+}
+
+fn default_allow_new_bindings() -> bool {
+    true
 }
 
 /// 临时探测代理 URL 请求（不写入代理池）
@@ -1373,6 +1425,8 @@ mod tests {
     fn test_batch_import_request_accepts_uniform_proxy_and_rpm() {
         let json = r#"{
             "proxyUrl": "direct",
+            "proxyId": 7,
+            "browserEgressIp": "203.0.113.7",
             "rpmLimit": 3,
             "credentials": [
                 { "refreshToken": "rt", "authMethod": "social" }
@@ -1382,7 +1436,21 @@ mod tests {
         let req: BatchImportRequest = serde_json::from_str(json).unwrap();
 
         assert_eq!(req.proxy_url.as_deref(), Some("direct"));
+        assert_eq!(req.proxy_id, Some(7));
+        assert_eq!(req.browser_egress_ip.as_deref(), Some("203.0.113.7"));
         assert_eq!(req.rpm_limit, Some(3));
         assert_eq!(req.credentials.len(), 1);
     }
+
+    #[test]
+    fn add_proxy_request_defaults_to_new_bindings_and_accepts_legacy_only() {
+        let normal: AddProxyRequest =
+            serde_json::from_str(r#"{"url":"http://proxy-a:8080"}"#).unwrap();
+        assert!(normal.allow_new_bindings);
+
+        let legacy: AddProxyRequest =
+            serde_json::from_str(r#"{"url":"http://legacy:8080","allowNewBindings":false}"#)
+                .unwrap();
+        assert!(!legacy.allow_new_bindings);
+    }
 }
diff --git a/src/anthropic/stream.rs b/src/anthropic/stream.rs
index 4850bd5c..a6605aa3 100644
--- a/src/anthropic/stream.rs
+++ b/src/anthropic/stream.rs
@@ -3,8 +3,10 @@
 //! 实现 Kiro → Anthropic 流式响应转换和 SSE 状态管理
 
 use std::collections::{HashMap, VecDeque};
+use std::sync::OnceLock;
 
 use serde_json::json;
+use sha2::{Digest, Sha256};
 use uuid::Uuid;
 
 use crate::kiro::model::events::Event;
@@ -1318,15 +1320,94 @@ pub(crate) fn canonicalize_structured_json(
     schema: &serde_json::Value,
 ) -> Result<String, (&'static str, String)> {
     let trimmed = text.trim();
-    let candidate = if let Some(inner) = trimmed
-        .strip_prefix("```json\n")
-        .and_then(|value| value.strip_suffix("\n```"))
-    {
-        inner.trim()
+    let normalized;
+    let (candidate, fence_class) = if trimmed.starts_with("```") {
+        normalized = trimmed.replace("\r\n", "\n");
+        let Some((opening, remainder)) = normalized.split_once('\n') else {
+            log_structured_json_failure(
+                "kiro_structured_json_parse_failed",
+                text,
+                trimmed,
+                trimmed,
+                "malformed",
+                None,
+            );
+            return Err((
+                "kiro_structured_json_parse_failed",
+                "Kiro structured output was not valid JSON: malformed fenced block".to_string(),
+            ));
+        };
+        let opening = opening.trim();
+        let class = if opening == "```" {
+            "unlabelled"
+        } else if opening.eq_ignore_ascii_case("```json") {
+            "json"
+        } else {
+            "unsupported"
+        };
+        let (inner, closing) = match remainder.rsplit_once('\n') {
+            Some(parts) => parts,
+            None if remainder.trim() == "```" => ("", remainder),
+            None => {
+                log_structured_json_failure(
+                    "kiro_structured_json_parse_failed",
+                    text,
+                    trimmed,
+                    trimmed,
+                    class,
+                    None,
+                );
+                return Err((
+                    "kiro_structured_json_parse_failed",
+                    "Kiro structured output was not valid JSON: malformed fenced block"
+                        .to_string(),
+                ));
+            }
+        };
+        if class == "unsupported" || closing.trim() != "```" {
+            log_structured_json_failure(
+                "kiro_structured_json_parse_failed",
+                text,
+                trimmed,
+                trimmed,
+                class,
+                None,
+            );
+            return Err((
+                "kiro_structured_json_parse_failed",
+                "Kiro structured output was not valid JSON: unsupported or malformed fenced block"
+                    .to_string(),
+            ));
+        }
+        (inner.trim(), class)
     } else {
-        trimmed
+        (trimmed, "none")
     };
+
+    if candidate.is_empty() {
+        log_structured_json_failure(
+            "kiro_structured_empty_output",
+            text,
+            trimmed,
+            candidate,
+            fence_class,
+            None,
+        );
+        return Err((
+            "kiro_structured_empty_output",
+            "Kiro structured output was empty".to_string(),
+        ));
+    }
+
     let value: serde_json::Value = serde_json::from_str(candidate).map_err(|error| {
+        log_structured_json_failure(
+            "kiro_structured_json_parse_failed",
+            text,
+            trimmed,
+            candidate,
+            fence_class,
+            Some((error.line(), error.column())),
+        );
         (
             "kiro_structured_json_parse_failed",
             format!("Kiro structured output was not valid JSON: {error}"),
@@ -1335,6 +1416,14 @@ pub(crate) fn canonicalize_structured_json(
     let mut errors = Vec::new();
     validate_json_schema(&value, schema, "$", &mut errors);
     if !errors.is_empty() {
+        log_structured_json_failure(
+            "kiro_structured_json_schema_failed",
+            text,
+            trimmed,
+            candidate,
+            fence_class,
+            None,
+        );
         return Err((
             "kiro_structured_json_schema_failed",
             format!(
@@ -1344,6 +1433,14 @@ pub(crate) fn canonicalize_structured_json(
         ));
     }
     serde_json::to_string(&value).map_err(|error| {
+        log_structured_json_failure(
+            "kiro_structured_json_parse_failed",
+            text,
+            trimmed,
+            candidate,
+            fence_class,
+            None,
+        );
         (
             "kiro_structured_json_parse_failed",
             format!("Kiro structured output could not be serialized: {error}"),
@@ -1351,6 +1448,60 @@ pub(crate) fn canonicalize_structured_json(
     })
 }
 
+fn log_structured_json_failure(
+    error_kind: &'static str,
+    text: &str,
+    trimmed: &str,
+    candidate: &str,
+    fence_class: &'static str,
+    parse_position: Option<(usize, usize)>,
+) {
+    static PROCESS_SALT: OnceLock<[u8; 16]> = OnceLock::new();
+    let salt = PROCESS_SALT.get_or_init(|| *Uuid::new_v4().as_bytes());
+    let mut hasher = Sha256::new();
+    hasher.update(salt);
+    hasher.update(candidate.as_bytes());
+    let candidate_process_digest = hex::encode(hasher.finalize());
+    let first_non_whitespace_class = candidate
+        .chars()
+        .find(|value| !value.is_whitespace())
+        .map(classify_structured_json_lead)
+        .unwrap_or("none");
+    let (parse_line, parse_column) = parse_position.unwrap_or((0, 0));
+
+    tracing::warn!(
+        error_kind,
+        input_bytes = text.len(),
+        input_chars = text.chars().count(),
+        trimmed_bytes = trimmed.len(),
+        candidate_bytes = candidate.len(),
+        candidate_chars = candidate.chars().count(),
+        empty = candidate.is_empty(),
+        fence_class,
+        first_non_whitespace_class,
+        candidate_process_digest,
+        parse_line,
+        parse_column,
+        "Kiro structured output validation failed; response content was not logged"
+    );
+}
+
+fn classify_structured_json_lead(value: char) -> &'static str {
+    match value {
+        '{' => "object",
+        '[' => "array",
+        '"' => "string",
+        '-' => "minus",
+        '0'..='9' => "digit",
+        't' | 'f' | 'n' => "literal",
+        '`' => "fence",
+        value if value.is_ascii_alphabetic() => "ascii_alpha",
+        value if value.is_control() => "control",
+        value if !value.is_ascii() => "non_ascii",
+        _ => "other",
+    }
+}
+
 /// SSE 事件
 #[derive(Debug, Clone)]
 pub struct SseEvent {
@@ -3674,6 +3825,17 @@ mod tests {
             canonicalize_structured_json("```json\n{ \"ok\": true }\n```", &schema).unwrap(),
             "{\"ok\":true}"
         );
+        for fenced in [
+            "```\n{ \"ok\": true }\n```",
+            "```JSON\n{ \"ok\": true }\n```",
+            "```Json\r\n{ \"ok\": true }\r\n```",
+            "  ```json\n{ \"ok\": true }\n```  \n",
+        ] {
+            assert_eq!(
+                canonicalize_structured_json(fenced, &schema).unwrap(),
+                "{\"ok\":true}"
+            );
+        }
         assert_eq!(
             canonicalize_structured_json("{\"ok\":\"yes\"}", &schema)
                 .unwrap_err()
@@ -3686,6 +3848,33 @@ mod tests {
                 .0,
             "kiro_structured_json_parse_failed"
         );
+        for empty in [
+            "",
+            " \r\n\t",
+            "```json\n```",
+            "```\r\n```",
+            "```json\n\n```",
+            "```\r\n \r\n```",
+        ] {
+            assert_eq!(
+                canonicalize_structured_json(empty, &schema).unwrap_err().0,
+                "kiro_structured_empty_output"
+            );
+        }
+        for invalid in [
+            "Here is the JSON:\n```json\n{\"ok\":true}\n```",
+            "```json\n{\"ok\":true}\n```\ndone",
+            "```yaml\n{\"ok\":true}\n```",
+            "```json\n```json\n{\"ok\":true}\n```\n```",
+            "```json {\"ok\":true}```",
+        ] {
+            assert_eq!(
+                canonicalize_structured_json(invalid, &schema)
+                    .unwrap_err()
+                    .0,
+                "kiro_structured_json_parse_failed"
+            );
+        }
     }
 
     /// 防回归：统一管道的两个去向（流式 emit_completed_tool_use 与非流式 to_anthropic_block）
diff --git a/src/kiro/egress_login.rs b/src/kiro/egress_login.rs
index 792e2586..3805ebd8 100644
--- a/src/kiro/egress_login.rs
+++ b/src/kiro/egress_login.rs
@@ -83,6 +83,10 @@ pub async fn probe(
     if proxy.url.trim().is_empty() || ProxyConfig::is_direct(&proxy.url) {
         anyhow::bail!("egress login v2 要求显式托管代理，不能使用 direct");
     }
+    let candidates = ProxyConfig::split_candidates(&proxy.url);
+    if candidates.len() != 1 || !ProxyConfig::is_supported_entry(&candidates[0]) {
+        anyhow::bail!("egress login v2 要求一个且仅一个有效托管代理，禁止代理列表和 direct 兜底");
+    }
     let version = proxy_version(proxy_id, &proxy.url);
     let probe_url = std::env::var("KIRO_EGRESS_PROBE_URL")
         .ok()
diff --git a/src/kiro/model/credentials.rs b/src/kiro/model/credentials.rs
index 665b2998..6f6b6224 100644
--- a/src/kiro/model/credentials.rs
+++ b/src/kiro/model/credentials.rs
@@ -175,6 +175,9 @@ pub struct KiroCredentials {
     pub egress_proxy_version: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub egress_fingerprint: Option<String>,
+    /// Set only after the explicit egress-bound promote gate succeeds.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub egress_activation_at: Option<String>,
 }
 
 /// 判断是否为零（用于跳过序列化）
@@ -233,6 +236,7 @@ impl std::fmt::Debug for KiroCredentials {
             .field("egress_proxy_id", &self.egress_proxy_id)
             .field("egress_proxy_version", &self.egress_proxy_version)
             .field("egress_fingerprint", &self.egress_fingerprint)
+            .field("egress_activation_at", &self.egress_activation_at)
             .finish()
     }
 }
@@ -950,6 +954,7 @@ mod tests {
             egress_proxy_id: None,
             egress_proxy_version: None,
             egress_fingerprint: None,
+            egress_activation_at: None,
         };
 
         let json = creds.to_pretty_json().unwrap();
@@ -1194,6 +1199,7 @@ mod tests {
             egress_proxy_id: None,
             egress_proxy_version: None,
             egress_fingerprint: None,
+            egress_activation_at: None,
         };
 
         let json = creds.to_pretty_json().unwrap();
@@ -1237,6 +1243,7 @@ mod tests {
             egress_proxy_id: None,
             egress_proxy_version: None,
             egress_fingerprint: None,
+            egress_activation_at: None,
         };
 
         let json = creds.to_pretty_json().unwrap();
@@ -1363,6 +1370,7 @@ mod tests {
             egress_proxy_id: None,
             egress_proxy_version: None,
             egress_fingerprint: None,
+            egress_activation_at: None,
         };
 
         let json = original.to_pretty_json().unwrap();
diff --git a/src/kiro/provider.rs b/src/kiro/provider.rs
index 41d2db18..bfdbe5cf 100644
--- a/src/kiro/provider.rs
+++ b/src/kiro/provider.rs
@@ -109,6 +109,8 @@ pub struct CredentialTestResult {
     pub latency_ms: u64,
     pub http_status: Option<u16>,
     pub response_snippet: Option<String>,
+    /// Whether the upstream EventStream ended with terminal metadata.
+    pub stream_complete: bool,
     pub error: Option<String>,
 }
 
@@ -153,6 +155,24 @@ fn readable_response_snippet_from_bytes(body: &[u8]) -> Option<String> {
     truncate_snippet(&fallback)
 }
 
+fn event_stream_has_terminal_metadata(body: &[u8]) -> bool {
+    let mut decoder = EventStreamDecoder::new();
+    if decoder.feed(body).is_err() {
+        return false;
+    }
+    let mut terminal = false;
+    for result in decoder.decode_iter() {
+        let Ok(frame) = result else { continue };
+        if let Ok(Event::Metadata(metadata)) = Event::from_frame(frame) {
+            terminal = metadata
+                .stop_reason
+                .as_deref()
+                .is_some_and(|reason| !reason.trim().is_empty());
+        }
+    }
+    terminal && decoder.finish().is_ok()
+}
+
 fn should_try_next_proxy(status: reqwest::StatusCode) -> bool {
     matches!(status.as_u16(), 407 | 502 | 503 | 504)
 }
@@ -284,6 +304,29 @@ impl KiroProvider {
         let global = self.global_proxy_candidates();
         let mut candidates = credentials.effective_proxy_candidates(&global);
 
+        // Egress-bound credentials are permanently pinned to one explicit
+        // managed proxy. They must never inherit the normal direct fallback or
+        // rotate to another candidate when that proxy is unavailable.
+        if credentials.egress_fingerprint.is_some() {
+            let pinned: Vec<ProxyConfig> = candidates.into_iter().flatten().collect();
+            if pinned.len() != 1 {
+                tracing::error!(
+                    "凭据 #{} egress 绑定要求恰好一个代理候选，实际为 {}，拒绝请求",
+                    credential_id,
+                    pinned.len()
+                );
+                return Vec::new();
+            }
+            return if let Some(pool) = &self.proxy_pool {
+                pool.order_candidates(credential_id, pinned, "sticky")
+                    .into_iter()
+                    .map(Some)
+                    .collect()
+            } else {
+                pinned.into_iter().map(Some).collect()
+            };
+        }
+
         let has_direct = candidates.iter().any(|candidate| candidate.is_none());
         candidates.retain(|candidate| candidate.is_some());
 
@@ -702,6 +745,27 @@ impl KiroProvider {
         &self,
         credential_id: u64,
         model: &str,
+    ) -> anyhow::Result<CredentialTestResult> {
+        self.test_credential_response_inner(credential_id, model, false)
+            .await
+    }
+
+    /// Same probe as the admin response test, but explicitly permits a
+    /// quarantined credential. It is only used by the promote gate.
+    pub async fn test_credential_response_for_probe(
+        &self,
+        credential_id: u64,
+        model: &str,
+    ) -> anyhow::Result<CredentialTestResult> {
+        self.test_credential_response_inner(credential_id, model, true)
+            .await
+    }
+
+    async fn test_credential_response_inner(
+        &self,
+        credential_id: u64,
+        model: &str,
+        allow_quarantined: bool,
     ) -> anyhow::Result<CredentialTestResult> {
         let mapped_model = normalize_model_id(model);
         let conversation_id = uuid::Uuid::new_v4().to_string();
@@ -720,10 +784,13 @@ impl KiroProvider {
         };
         let request_body = serde_json::to_string(&request)?;
 
-        let mut ctx = self
-            .token_manager
-            .acquire_context_for_id(credential_id)
-            .await?;
+        let mut ctx = if allow_quarantined {
+            self.token_manager
+                .acquire_context_for_probe(credential_id)
+                .await?
+        } else {
+            self.token_manager.acquire_context_for_id(credential_id).await?
+        };
         let _in_flight = self.token_manager.in_flight_guard(ctx.id);
         self.ensure_profile_arn(&mut ctx).await?;
 
@@ -751,6 +818,7 @@ impl KiroProvider {
                     latency_ms: started.elapsed().as_millis() as u64,
                     http_status: None,
                     response_snippet: None,
+                    stream_complete: false,
                     error: Some(e.to_string()),
                 });
             }
@@ -759,6 +827,7 @@ impl KiroProvider {
         let status = response.status();
         let body = response.bytes().await.unwrap_or_default();
         let success = status.is_success();
+        let stream_complete = success && event_stream_has_terminal_metadata(&body);
         if success {
             self.token_manager.report_success(ctx.id);
         }
@@ -770,6 +839,7 @@ impl KiroProvider {
             latency_ms: started.elapsed().as_millis() as u64,
             http_status: Some(status.as_u16()),
             response_snippet: readable_response_snippet_from_bytes(&body),
+            stream_complete,
             error: if success {
                 None
             } else {
@@ -1978,4 +2048,21 @@ mod tests {
             Some("{\"message\":\"bad request\"}")
         );
     }
+
+    #[test]
+    fn promote_requires_terminal_metadata_and_clean_frame_boundary() {
+        let terminal = event_stream_frame(
+            "metadataEvent",
+            r#"{"stopReason":"end_turn"}"#,
+        );
+        assert!(event_stream_has_terminal_metadata(&terminal));
+
+        let mut truncated = terminal.clone();
+        truncated.pop();
+        assert!(!event_stream_has_terminal_metadata(&truncated));
+        assert!(!event_stream_has_terminal_metadata(&event_stream_frame(
+            "assistantResponseEvent",
+            r#"{"content":"ok"}"#,
+        )));
+    }
 }
diff --git a/src/kiro/token_manager.rs b/src/kiro/token_manager.rs
index f50cf64c..c2f31bf5 100644
--- a/src/kiro/token_manager.rs
+++ b/src/kiro/token_manager.rs
@@ -1010,6 +1010,10 @@ pub struct CredentialEntrySnapshot {
     /// 账号来源渠道（纯备注）
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub source_channel: Option<String>,
+    /// Fixed-egress login metadata exposed without proxy credentials.
+    pub login_slot_id: Option<String>,
+    pub egress_proxy_id: Option<u64>,
+    pub egress_activation_at: Option<String>,
 }
 
 /// 凭据管理器状态快照
@@ -2187,6 +2191,22 @@ impl MultiTokenManager {
         Ok(ctx)
     }
 
+    /// Explicit promote probes may use a quarantined credential, but they still
+    /// bypass scheduling and RPM accounting. Normal traffic cannot call this.
+    pub async fn acquire_context_for_probe(&self, id: u64) -> anyhow::Result<CallContext> {
+        let credentials = {
+            let entries = self.entries.lock();
+            entries
+                .iter()
+                .find(|entry| entry.id == id)
+                .map(|entry| entry.credentials.clone())
+                .ok_or_else(|| anyhow::anyhow!("凭据不存在: {}", id))?
+        };
+        let ctx = self.try_ensure_token(id, &credentials).await?;
+        self.inc_in_flight(ctx.id);
+        Ok(ctx)
+    }
+
     /// 分类并记录一次 Token 刷新错误。
     ///
     /// 上游 429 是临时流控，不代表凭据失效，因此直接保留类型化错误返回，绝不增加
@@ -3050,6 +3070,9 @@ impl MultiTokenManager {
                     endpoint: e.credentials.endpoint.clone(),
                     groups: e.credentials.groups.clone(),
                     source_channel: e.credentials.source_channel.clone(),
+                    login_slot_id: e.credentials.login_slot_id.clone(),
+                    egress_proxy_id: e.credentials.egress_proxy_id,
+                    egress_activation_at: e.credentials.egress_activation_at.clone(),
                 })
                 .collect(),
             current_id,
@@ -3083,6 +3106,24 @@ impl MultiTokenManager {
         Ok(())
     }
 
+    /// Persist the fact that an egress-bound credential passed the explicit
+    /// promote gate. This marker is required before an admin may enable it.
+    pub fn mark_egress_activated(&self, id: u64, at: String) -> anyhow::Result<()> {
+        {
+            let mut entries = self.entries.lock();
+            let entry = entries
+                .iter_mut()
+                .find(|e| e.id == id)
+                .ok_or_else(|| anyhow::anyhow!("凭据不存在: {}", id))?;
+            if entry.credentials.egress_fingerprint.is_none() {
+                anyhow::bail!("凭据 #{} 不是 egress-bound 凭据", id);
+            }
+            entry.credentials.egress_activation_at = Some(at);
+        }
+        self.persist_credentials()?;
+        Ok(())
+    }
+
     /// 标记凭据进入临时冷却期（账号级 429 风控触发）
     ///
     /// 与 `report_failure` 不同：不计入永久禁用，到期自动恢复，可用于"`suspicious activity` 429"
@@ -3245,6 +3286,11 @@ impl MultiTokenManager {
             if entry.disabled_reason == Some(DisabledReason::InvalidConfig) {
                 anyhow::bail!("凭据 #{} 因配置无效被禁用，请修正配置后重启服务", id);
             }
+            if entry.credentials.egress_fingerprint.is_some()
+                && entry.credentials.egress_activation_at.is_none()
+            {
+                anyhow::bail!("egress-bound 凭据 #{} 必须重新通过 promote，不能直接重置并启用", id);
+            }
             entry.failure_count = 0;
             entry.total_failure_count = 0;
             entry.refresh_failure_count = 0;
@@ -3824,6 +3870,7 @@ impl MultiTokenManager {
         validated_cred.egress_proxy_id = new_cred.egress_proxy_id;
         validated_cred.egress_proxy_version = new_cred.egress_proxy_version;
         validated_cred.egress_fingerprint = new_cred.egress_fingerprint;
+        validated_cred.egress_activation_at = new_cred.egress_activation_at;
         validated_cred.disabled = quarantined;
 
         {
@@ -3921,6 +3968,14 @@ impl MultiTokenManager {
                 .find(|e| e.id == id)
                 .ok_or_else(|| anyhow::anyhow!("凭据不存在: {}", id))?;
 
+            if entry.credentials.egress_fingerprint.is_some()
+                && (proxy_url.is_some()
+                    || proxy_username.is_some()
+                    || proxy_password.is_some())
+            {
+                anyhow::bail!("egress-bound 凭据 #{} 的代理永久固定，禁止修改或清除", id);
+            }
+
             if let Some(v) = email {
                 entry.credentials.email = v.filter(|s| !s.is_empty());
             }
@@ -4159,6 +4214,9 @@ impl MultiTokenManager {
             // 否则清空，下次使用时系统会自动刷新
             entry.credentials.access_token = new_access_token;
             entry.credentials.expires_at = new_expires_at;
+            if entry.credentials.egress_fingerprint.is_some() {
+                entry.credentials.egress_activation_at = None;
+            }
             entry.refresh_failure_count = 0;
         }
         self.persist_credentials()?;
@@ -4232,6 +4290,9 @@ impl MultiTokenManager {
             entry.credentials.token_endpoint = Some(token_endpoint);
             entry.credentials.issuer_url = Some(issuer_url);
             entry.credentials.scopes = Some(scopes);
+            if entry.credentials.egress_fingerprint.is_some() {
+                entry.credentials.egress_activation_at = None;
+            }
             entry.refresh_failure_count = 0;
         }
         self.persist_credentials()?;
@@ -4239,6 +4300,49 @@ impl MultiTokenManager {
         Ok(())
     }
 
+    /// Bind an existing disabled credential to the verified relogin egress and
+    /// leave it quarantined until the explicit promote gate succeeds.
+    pub fn bind_relogin_egress(
+        &self,
+        id: u64,
+        slot_id: String,
+        proxy_id: u64,
+        proxy_version: String,
+        fingerprint: String,
+        proxy_url: String,
+    ) -> anyhow::Result<()> {
+        {
+            let mut entries = self.entries.lock();
+            let entry = entries
+                .iter_mut()
+                .find(|entry| entry.id == id)
+                .ok_or_else(|| anyhow::anyhow!("凭据不存在: {}", id))?;
+            if let Some(existing_id) = entry.credentials.egress_proxy_id
+                && existing_id != proxy_id
+            {
+                anyhow::bail!("egress-bound 凭据 #{} 禁止迁移到其它代理", id);
+            }
+            if let Some(existing_url) = entry.credentials.proxy_url.as_deref()
+                && existing_url != proxy_url
+            {
+                anyhow::bail!("egress-bound 凭据 #{} 禁止更换原代理", id);
+            }
+            entry.disabled = true;
+            entry.disabled_reason = Some(DisabledReason::Manual);
+            entry.credentials.disabled = true;
+            entry.credentials.login_slot_id = Some(slot_id);
+            entry.credentials.egress_proxy_id = Some(proxy_id);
+            entry.credentials.egress_proxy_version = Some(proxy_version);
+            entry.credentials.egress_fingerprint = Some(fingerprint);
+            entry.credentials.egress_activation_at = None;
+            entry.credentials.proxy_url = Some(proxy_url);
+            entry.credentials.proxy_username = None;
+            entry.credentials.proxy_password = None;
+        }
+        self.persist_credentials()?;
+        Ok(())
+    }
+
     /// 强制刷新指定凭据的 Token（Admin API）
     ///
     /// 无条件调用上游 API 重新获取 access token，不检查是否过期。