diff --git a/.downstream/native-domains.md b/.downstream/native-domains.md
index 9e3bf1934061..8a940543b523 100644
--- a/.downstream/native-domains.md
+++ b/.downstream/native-domains.md
@@ -17,6 +17,49 @@ other key or a non-boolean value (including `null`), returns HTTP 400 and stores
 nothing. While no Codex runtime row is stored,
 `gateway.openai_codex_request_zstd` decides the compression switch.
 
+## Codex fingerprint simulation
+
+Extensions owns `/admin/codex-fingerprint`. General settings and account
+create/edit/bulk-edit forms no longer submit fingerprint configuration.
+`GET/PUT /admin/settings/codex-fingerprint` uses `enabled`, `user_agent`,
+`client_version` and `version_auto_sync_enabled`; all four fields are required
+on PUT. GET also returns the synced and effective simulation versions and the
+default UA. Existing UA/version/sync setting keys remain authoritative; only
+`codex_fingerprint_enabled` is new. Without that key the startup identity flag
+provides the default. Writes use existing admin authentication and audit, with
+no additional step-up. Legacy settings APIs use the same keys.
+
+`GET/PUT /admin/accounts/:id/codex-fingerprint` applies only to OpenAI OAuth and
+setup-token accounts. GET computes effective identity through the forwarding
+selector, including credential shadows. PUT accepts only `mode`; bulk changes
+use ordinary account jobs with explicit frozen IDs and only that extra key.
+General account edits preserve the latest stored mode when it is omitted.
+Existing seeds and persisted TUI identities are retained, and new accounts still
+default to `device`.
+
+Enabled simulation applies a fixed account TUI identity to HTTP, passthrough,
+WS, account tests and credential refresh. Disabled simulation preserves caller
+identity and identifiers, filling only missing protocol identity headers.
+Mode `off` preserves device/session identifiers while simulation stays enabled;
+`device` changes only device identifiers; `session` keeps separate real threads
+and maps their parent references; `full` combines threads and removes self-parent
+references. Real turn IDs, parent/root turn IDs, window indices and timestamps
+are retained. Sandbox `none`, `external`, permission modes and unknown tags are
+preserved; known platform backends are aligned without inventing a sandbox for
+an absent tag. Explicit custom cache keys are not rewritten.
+
+The built-in protocol/version baseline is official Codex `rust-v0.161.0`.
+The existing six-hour stable-version sync and manual-version precedence remain.
+Successful saves publish an immutable policy; failed saves retain the old one.
+Each attempt shares it across headers/body. WS reuse includes identity and
+policy revision. Setting changes let the current turn finish, then request a
+retryable reconnect before another turn is sent through an old handshake.
+Account mode changes invalidate only that account's next handshake.
+
+Account connection tests exclude and reject `ultra` across every capability
+source before dispatch; stale UI selections reset to default. Codex client
+orchestration catalogs retain their existing capabilities.
+
 ## Codex gateway borrowing
 
 The Extensions sidebar has separate Codex Borrowing and Pelican Tests entries.
diff --git a/backend/internal/handler/admin/codex_fingerprint_handler.go b/backend/internal/handler/admin/codex_fingerprint_handler.go
new file mode 100644
index 000000000000..c44d1462edc0
--- /dev/null
+++ b/backend/internal/handler/admin/codex_fingerprint_handler.go
@@ -0,0 +1,95 @@
+package admin
+
+import (
+	"strconv"
+
+	infraerrors "github.com/Wei-Shaw/sub2api/internal/pkg/errors"
+	"github.com/Wei-Shaw/sub2api/internal/pkg/response"
+	"github.com/Wei-Shaw/sub2api/internal/server/middleware"
+	"github.com/Wei-Shaw/sub2api/internal/service"
+	"github.com/gin-gonic/gin"
+)
+
+func (h *SettingHandler) GetCodexFingerprintSettings(c *gin.Context) {
+	view, err := h.settingService.GetCodexFingerprintSettings(c.Request.Context())
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	response.Success(c, view)
+}
+
+func (h *SettingHandler) UpdateCodexFingerprintSettings(c *gin.Context) {
+	raw, err := c.GetRawData()
+	var config service.CodexFingerprintSettings
+	if err == nil {
+		config, err = service.DecodeCodexFingerprintSettings(raw)
+	}
+	if err != nil {
+		response.BadRequest(c, "Invalid Codex fingerprint settings: "+err.Error())
+		return
+	}
+	view, err := h.settingService.UpdateCodexFingerprintSettings(c.Request.Context(), config)
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	middleware.SetAuditExtra(c, map[string]any{"enabled": config.Enabled, "client_version": config.ClientVersion, "version_auto_sync_enabled": config.VersionAutoSyncEnabled})
+	response.Success(c, view)
+}
+
+func (h *AccountHandler) codexFingerprintAccount(c *gin.Context) (*service.Account, *service.Account, error) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil || id <= 0 {
+		return nil, nil, infraerrors.BadRequest("INVALID_ACCOUNT_ID", "invalid account ID")
+	}
+	account, err := h.adminService.GetAccount(c.Request.Context(), id)
+	if err != nil {
+		return nil, nil, err
+	}
+	if !account.IsOpenAIOAuthLike() {
+		return nil, nil, infraerrors.BadRequest("CODEX_FINGERPRINT_UNSUPPORTED_ACCOUNT", "Codex fingerprint settings require an OpenAI OAuth or setup-token account")
+	}
+	source := account
+	if account.IsShadow() {
+		source, err = h.adminService.GetAccount(c.Request.Context(), *account.ParentAccountID)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	return account, source, nil
+}
+
+func (h *AccountHandler) GetCodexFingerprint(c *gin.Context) {
+	account, source, err := h.codexFingerprintAccount(c)
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	response.Success(c, service.DescribeCodexFingerprintAccount(account, source))
+}
+
+func (h *AccountHandler) UpdateCodexFingerprint(c *gin.Context) {
+	raw, err := c.GetRawData()
+	var mode string
+	if err == nil {
+		mode, err = service.DecodeCodexFingerprintMode(raw)
+	}
+	if err != nil {
+		response.BadRequest(c, "Invalid Codex fingerprint mode: "+err.Error())
+		return
+	}
+	account, _, err := h.codexFingerprintAccount(c)
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	if err := h.adminService.UpdateAccountExtra(c.Request.Context(), account.ID, map[string]any{"codex_fingerprint_mode": mode}); err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+	middleware.SetAuditExtra(c, map[string]any{"account_id": account.ID, "mode": mode})
+	h.GetCodexFingerprint(c)
+}
diff --git a/backend/internal/handler/admin/codex_fingerprint_handler_test.go b/backend/internal/handler/admin/codex_fingerprint_handler_test.go
new file mode 100644
index 000000000000..6e1adb9706a0
--- /dev/null
+++ b/backend/internal/handler/admin/codex_fingerprint_handler_test.go
@@ -0,0 +1,64 @@
+package admin
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/Wei-Shaw/sub2api/internal/service"
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+)
+
+type fingerprintAccountAdmin struct {
+	service.AdminService
+	accounts map[int64]*service.Account
+	updates  map[string]any
+}
+
+func (s *fingerprintAccountAdmin) GetAccount(_ context.Context, id int64) (*service.Account, error) {
+	return s.accounts[id], nil
+}
+func (s *fingerprintAccountAdmin) UpdateAccountExtra(_ context.Context, id int64, updates map[string]any) error {
+	s.updates = updates
+	for key, value := range updates {
+		s.accounts[id].Extra[key] = value
+	}
+	return nil
+}
+
+func TestCodexFingerprintAccountHandlerOnlyChangesModeAndUsesParentIdentity(t *testing.T) {
+	parentID := int64(1)
+	parent := &service.Account{ID: 1, Platform: service.PlatformOpenAI, Type: service.AccountTypeOAuth, Extra: map[string]any{"codex_fingerprint_seed": "ac6a7159-d158-41e8-bd52-3e66fd5c6515", "codex_fingerprint_mode": "device"}}
+	shadow := &service.Account{ID: 2, Platform: service.PlatformOpenAI, Type: service.AccountTypeOAuth, ParentAccountID: &parentID, Extra: map[string]any{"codex_fingerprint_mode": "full", "preserved": "value"}}
+	admin := &fingerprintAccountAdmin{accounts: map[int64]*service.Account{1: parent, 2: shadow}}
+	h := &AccountHandler{adminService: admin}
+	call := func(method, body string) *httptest.ResponseRecorder {
+		rec := httptest.NewRecorder()
+		c, _ := gin.CreateTestContext(rec)
+		c.Request = httptest.NewRequest(method, "/api/v1/admin/accounts/2/codex-fingerprint", strings.NewReader(body))
+		c.Params = gin.Params{{Key: "id", Value: "2"}}
+		if method == http.MethodGet {
+			h.GetCodexFingerprint(c)
+		} else {
+			h.UpdateCodexFingerprint(c)
+		}
+		return rec
+	}
+	read := call(http.MethodGet, "")
+	require.Equal(t, http.StatusOK, read.Code)
+	require.Equal(t, int64(1), gjson.Get(read.Body.String(), "data.identity.identity_account_id").Int())
+	saved := call(http.MethodPut, `{"mode":"off"}`)
+	require.Equal(t, http.StatusOK, saved.Code)
+	require.Equal(t, map[string]any{"codex_fingerprint_mode": "off"}, admin.updates)
+	require.Equal(t, "value", shadow.Extra["preserved"])
+	require.Equal(t, "device", parent.Extra["codex_fingerprint_mode"])
+	for _, body := range []string{`{"mode":"invalid"}`, `{"mode":"full","codex_fingerprint_seed":"injected"}`, `{"mode":null}`} {
+		rejected := call(http.MethodPut, body)
+		require.Equal(t, http.StatusBadRequest, rejected.Code)
+		require.Equal(t, "off", shadow.Extra["codex_fingerprint_mode"])
+	}
+}
diff --git a/backend/internal/server/middleware/audit_log.go b/backend/internal/server/middleware/audit_log.go
index 35d399eb5a2c..cb0dd453f970 100644
--- a/backend/internal/server/middleware/audit_log.go
+++ b/backend/internal/server/middleware/audit_log.go
@@ -147,6 +147,8 @@ var auditActionOverrides = map[string]string{
 	"PUT /api/v1/admin/system-prompts":                        "admin.system_prompts.update",
 	"PUT /api/v1/admin/system-prompts/bindings":               "admin.system_prompts.bindings.update",
 	"PUT /api/v1/admin/reasoning-recovery":                    "admin.reasoning_recovery.update",
+	"PUT /api/v1/admin/settings/codex-fingerprint":            "admin.codex_fingerprint.update",
+	"PUT /api/v1/admin/accounts/:id/codex-fingerprint":        "admin.account.codex_fingerprint.update",
 }
 
 // auditBodyOmittedRoutes 请求体几乎整体由凭证构成的路由（如整块粘贴 auth JSON 的导入接口）。
diff --git a/backend/internal/server/routes/admin.go b/backend/internal/server/routes/admin.go
index 4e2007bd58e5..397eaafb90f9 100644
--- a/backend/internal/server/routes/admin.go
+++ b/backend/internal/server/routes/admin.go
@@ -445,6 +445,8 @@ func registerAccountRoutes(admin *gin.RouterGroup, h *handler.Handlers, stepUpAu
 		accounts.POST("/sync/crs", h.Admin.Account.SyncFromCRS)
 		accounts.POST("/sync/crs/preview", h.Admin.Account.PreviewFromCRS)
 		accounts.PUT("/:id", h.Admin.Account.Update)
+		accounts.GET("/:id/codex-fingerprint", h.Admin.Account.GetCodexFingerprint)
+		accounts.PUT("/:id/codex-fingerprint", h.Admin.Account.UpdateCodexFingerprint)
 		accounts.GET("/:id/grok-media-eligibility", h.Admin.Account.GetGrokMediaEligibility)
 		accounts.PUT("/:id/grok-media-eligibility", h.Admin.Account.UpdateGrokMediaEligibility)
 		accounts.PUT("/:id/upstream-billing-probe", h.Admin.Account.SetUpstreamBillingProbeEnabled)
@@ -645,6 +647,8 @@ func registerSettingsRoutes(admin *gin.RouterGroup, h *handler.Handlers, stepUpA
 		adminSettings.GET("/observability", h.Admin.Setting.GetObservabilitySettings)
 		adminSettings.PUT("/observability", gin.HandlerFunc(stepUpAuth), h.Admin.Setting.UpdateObservabilitySettings)
 		adminSettings.GET("/codex-runtime", h.Admin.Setting.GetCodexRuntimeSettings)
+		adminSettings.GET("/codex-fingerprint", h.Admin.Setting.GetCodexFingerprintSettings)
+		adminSettings.PUT("/codex-fingerprint", h.Admin.Setting.UpdateCodexFingerprintSettings)
 		adminSettings.PUT("/codex-runtime", gin.HandlerFunc(stepUpAuth), h.Admin.Setting.UpdateCodexRuntimeSettings)
 		adminSettings.POST("/test-smtp", h.Admin.Setting.TestSMTPConnection)
 		adminSettings.POST("/send-test-email", h.Admin.Setting.SendTestEmail)
diff --git a/backend/internal/service/account_test_reasoning.go b/backend/internal/service/account_test_reasoning.go
index 7c8c4adfe46d..9fe7acf40f73 100644
--- a/backend/internal/service/account_test_reasoning.go
+++ b/backend/internal/service/account_test_reasoning.go
@@ -17,7 +17,17 @@ const accountTestReasoningContextKey = "account_test_reasoning_effort"
 
 // AccountTestReasoningOptions uses the same account mapping and capability
 // sources as the model catalog. Unknown model capabilities stay unknown.
-func AccountTestReasoningOptions(account *Account, model string) ([]string, string) {
+func AccountTestReasoningOptions(account *Account, model string) (efforts []string, defaultEffort string) {
+	// Ultra coordinates client-side work; it is never a single inference effort.
+	// Filter every capability source, including aliases and upstream metadata.
+	defer func() {
+		efforts = slices.DeleteFunc(slices.Clone(efforts), func(effort string) bool {
+			return normalizeReasoningLevel(effort) == "ultra"
+		})
+		if normalizeReasoningLevel(defaultEffort) == "ultra" {
+			defaultEffort = ""
+		}
+	}()
 	if account == nil || strings.TrimSpace(model) == "" {
 		return nil, ""
 	}
@@ -56,10 +66,6 @@ func AccountTestReasoningOptions(account *Account, model string) ([]string, stri
 	}
 	out := make([]string, 0, len(levels))
 	for _, level := range levels {
-		// Ultra is client orchestration, never a native inference effort.
-		if level.Effort == "ultra" && isOpenAIGPT6SolOrLunaModel(model) {
-			continue
-		}
 		out = append(out, level.Effort)
 	}
 	return out, ""
@@ -109,6 +115,9 @@ func ValidateAccountTestReasoning(account *Account, model, mode, effort string)
 	if effort == "" {
 		return nil
 	}
+	if normalizeReasoningLevel(effort) == "ultra" {
+		return errors.New("reasoning effort is not supported by the selected account model")
+	}
 	if effort != strings.TrimSpace(effort) || len(effort) > 32 || (mode != "" && mode != AccountTestModeDefault && mode != AccountTestModeGrokText) {
 		return errors.New("reasoning effort is unsupported for this test mode")
 	}
diff --git a/backend/internal/service/account_test_reasoning_test.go b/backend/internal/service/account_test_reasoning_test.go
index 6b5451f4efa9..771133572681 100644
--- a/backend/internal/service/account_test_reasoning_test.go
+++ b/backend/internal/service/account_test_reasoning_test.go
@@ -13,11 +13,14 @@ import (
 func TestAccountTestReasoningValidatedAgainstMappedModel(t *testing.T) {
 	a := &Account{Platform: PlatformOpenAI, Type: AccountTypeOAuth, Credentials: map[string]any{"model_mapping": map[string]any{"friendly": "gpt-6-astra"}}}
 	levels, _ := AccountTestReasoningOptions(a, "friendly")
-	require.Contains(t, levels, "ultra")
-	require.NoError(t, ValidateAccountTestReasoning(a, "friendly", "default", "ultra"))
-	require.NoError(t, ValidateAccountTestReasoning(a, "friendly", "text", "ultra"))
-	require.EqualError(t, ValidateAccountTestReasoning(a, "friendly", "compact", "ultra"), "reasoning effort is unsupported for this test mode")
-	require.EqualError(t, ValidateAccountTestReasoning(a, "friendly", "default", " ultra "), "reasoning effort is unsupported for this test mode")
+	require.NotContains(t, levels, "ultra")
+	require.NoError(t, ValidateAccountTestReasoning(a, "friendly", "default", "max"))
+	require.NoError(t, ValidateAccountTestReasoning(a, "friendly", "text", "max"))
+	require.EqualError(t, ValidateAccountTestReasoning(a, "friendly", "compact", "max"), "reasoning effort is unsupported for this test mode")
+	for _, mode := range []string{"default", "text", "compact"} {
+		require.EqualError(t, ValidateAccountTestReasoning(a, "friendly", mode, "ultra"), "reasoning effort is not supported by the selected account model")
+	}
+	require.Error(t, ValidateAccountTestReasoning(a, "friendly", "default", " ultra "))
 	require.EqualError(t, ValidateAccountTestReasoning(a, "friendly", "default", "invented"), "reasoning effort is not supported by the selected account model")
 	require.Error(t, ValidateAccountTestReasoning(a, "gpt-image-2", "default", "high"))
 	require.NoError(t, ValidateAccountTestReasoning(a, "unknown-model", "default", ""))
diff --git a/backend/internal/service/account_test_reasoning_wire_test.go b/backend/internal/service/account_test_reasoning_wire_test.go
index f35dedb034c9..53db38bd1105 100644
--- a/backend/internal/service/account_test_reasoning_wire_test.go
+++ b/backend/internal/service/account_test_reasoning_wire_test.go
@@ -27,22 +27,26 @@ func TestAccountTestReasoningSurvivesMappingAndWireCompression(t *testing.T) {
 	svc := &AccountTestService{accountRepo: &reasoningTestRepo{account: a}, httpUpstream: upstream}
 	c, rec := newTestContext()
 	enableCodexRequestZstd(t)
-	require.NoError(t, svc.TestAccountConnection(c, a.ID, "friendly", "test", AccountTestModeDefault, AccountTestOptions{ReasoningEffort: "ultra"}))
+	require.NoError(t, svc.TestAccountConnection(c, a.ID, "friendly", "test", AccountTestModeDefault, AccountTestOptions{ReasoningEffort: "max"}))
 	require.Len(t, upstream.requests, 1)
 	raw, err := io.ReadAll(upstream.requests[0].Body)
 	require.NoError(t, err)
 	body := zstdDecodeForTest(t, raw)
 	require.Equal(t, "gpt-6-astra", gjson.GetBytes(body, "model").String())
-	require.Equal(t, "ultra", gjson.GetBytes(body, "reasoning.effort").String())
-	require.Contains(t, rec.Body.String(), `"effective_reasoning_effort":"ultra"`)
+	require.Equal(t, "max", gjson.GetBytes(body, "reasoning.effort").String())
+	require.Contains(t, rec.Body.String(), `"effective_reasoning_effort":"max"`)
 	c, rec = newTestContext()
 	require.Error(t, svc.TestAccountConnection(c, a.ID, "friendly", "test", AccountTestModeCompact, AccountTestOptions{ReasoningEffort: "ultra"}))
-	require.Contains(t, rec.Body.String(), `"error":"reasoning effort is unsupported for this test mode"`)
+	require.Contains(t, rec.Body.String(), `"error":"reasoning effort is not supported by the selected account model"`)
 	require.Len(t, upstream.requests, 1, "unsupported mode must fail before any upstream request")
 	c, rec = newTestContext()
 	require.Error(t, svc.TestAccountConnection(c, a.ID, "friendly", "test", AccountTestModeDefault, AccountTestOptions{ReasoningEffort: "invented"}))
 	require.Contains(t, rec.Body.String(), `"error":"reasoning effort is not supported by the selected account model"`)
 	require.Len(t, upstream.requests, 1, "unsupported effort must fail before any upstream request")
+	c, rec = newTestContext()
+	require.Error(t, svc.TestAccountConnection(c, a.ID, "friendly", "test", AccountTestModeDefault, AccountTestOptions{ReasoningEffort: "ultra"}))
+	require.Contains(t, rec.Body.String(), `"error":"reasoning effort is not supported by the selected account model"`)
+	require.Len(t, upstream.requests, 1, "ultra must fail before any upstream request")
 }
 
 func TestAccountTestReasoningOpenCodeGoSerializesNativeProtocol(t *testing.T) {
diff --git a/backend/internal/service/account_test_service.go b/backend/internal/service/account_test_service.go
index 980025e7fe67..a0b47c38d852 100644
--- a/backend/internal/service/account_test_service.go
+++ b/backend/internal/service/account_test_service.go
@@ -996,7 +996,7 @@ func (s *AccountTestService) testOpenAIAccountConnection(c *gin.Context, account
 		setOpenAIChatGPTAccountHeaders(req.Header, credentialAccount)
 		// 与真实转发一致：使用该账号的 Codex TUI 身份，账号级自定义 UA 同样作为管理员
 		// 显式配置传入，否则测试用的身份与该账号真实出站的身份不是同一个。
-		enforceCodexIdentityHeadersForAccount(req.Header, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount))
+		enforceCodexIdentityHeadersForAccount(req.Header, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount), codexFingerprintPolicyForContext(c, account))
 	}
 
 	// 账号级请求头覆写：测试请求与真实转发保持一致的最终头
@@ -1017,7 +1017,7 @@ func (s *AccountTestService) testOpenAIAccountConnection(c *gin.Context, account
 		} else if req, err = prepareOpenAICodexWireRequest(req, account); err != nil {
 			return s.sendErrorAndEnd(c, fmt.Sprintf("Request failed: %s", err.Error()))
 		}
-		base := resolveCodexIdentitySnapshot(account, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount))
+		base := resolveCodexIdentitySnapshot(account, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount), codexFingerprintPolicyForContext(c, account))
 		snapshot := base.withWire(transport, req.Header)
 		s.sendEvent(c, TestEvent{Type: "status", Text: snapshot.summary(), Data: snapshot})
 		s.sendEvent(c, TestEvent{Type: "status", Text: "Codex wire headers", Data: accountTestWireHeaders(req.Header)})
@@ -2347,7 +2347,7 @@ func (s *AccountTestService) testOpenAICompactConnection(c *gin.Context, account
 	if isOAuth {
 		// 与真实转发一致：使用该账号的 Codex TUI 身份，账号级自定义 UA 经 ForceCodexCLI
 		// 策略过滤后作为管理员显式配置传入（同普通 OAuth 连接测试）。
-		enforceCodexIdentityHeadersForAccount(req.Header, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount))
+		enforceCodexIdentityHeadersForAccount(req.Header, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount), codexFingerprintPolicyForContext(c, account))
 	}
 	probeSessionID := compactProbeSessionID(account.ID)
 	req.Header.Set("Session_ID", probeSessionID)
@@ -2359,7 +2359,7 @@ func (s *AccountTestService) testOpenAICompactConnection(c *gin.Context, account
 		// 指纹收敛：探测与真实转发走同一个 /responses 端点，身份也必须同构，
 		// 否则探测流量会以「缺 x-codex-installation-id + 非收敛 session」的
 		// 形态暴露在上游眼里。账号关闭收敛（off）时返回 nil，探测保持原样。
-		if fpIDs := resolveCodexFingerprintIDsFromRequest(account, req.Header); fpIDs != nil {
+		if fpIDs := resolveCodexFingerprintIDsFromRequest(account, req.Header, codexFingerprintPolicyForContext(c, account)); fpIDs != nil {
 			applyCodexFingerprintHeaders(req.Header, fpIDs)
 		}
 	}
@@ -3043,7 +3043,7 @@ func (s *AccountTestService) testOpenAIImageOAuth(c *gin.Context, ctx context.Co
 	setOpenAIChatGPTAccountHeaders(req.Header, credentialAccount)
 	// 与真实转发一致（同普通 OAuth 连接测试）：使用该账号的 Codex TUI 身份，账号级自定义 UA
 	// 经 ForceCodexCLI 策略过滤后作为管理员显式配置传入。
-	enforceCodexIdentityHeadersForAccount(req.Header, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount))
+	enforceCodexIdentityHeadersForAccount(req.Header, credentialAccount, codexAccountIdentityOverrideUA(credentialAccount), codexFingerprintPolicyForContext(c, account))
 
 	proxyURL := ""
 	if account.ProxyID != nil && account.Proxy != nil {
diff --git a/backend/internal/service/admin_account.go b/backend/internal/service/admin_account.go
index 183ec71e52d6..813e47a2b6e8 100644
--- a/backend/internal/service/admin_account.go
+++ b/backend/internal/service/admin_account.go
@@ -1015,7 +1015,13 @@ func (s *adminServiceImpl) UpdateAccountExtra(ctx context.Context, id int64, upd
 	if len(updates) == 0 {
 		return nil
 	}
-	return s.accountRepo.UpdateExtra(ctx, id, updates)
+	if err := s.accountRepo.UpdateExtra(ctx, id, updates); err != nil {
+		return err
+	}
+	if _, changed := updates[codexFingerprintModeExtraKey]; changed {
+		notifyCodexFingerprintAccountChanged(id)
+	}
+	return nil
 }
 
 // BulkUpdateAccounts updates multiple accounts in one request.
diff --git a/backend/internal/service/codex_fingerprint_policy_test.go b/backend/internal/service/codex_fingerprint_policy_test.go
new file mode 100644
index 000000000000..83b12fabc0a8
--- /dev/null
+++ b/backend/internal/service/codex_fingerprint_policy_test.go
@@ -0,0 +1,229 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Wei-Shaw/sub2api/internal/config"
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+)
+
+type codexFingerprintSettingsRepo struct {
+	SettingRepository
+	values map[string]string
+	fail   error
+	writes int
+}
+
+func (r *codexFingerprintSettingsRepo) GetMultiple(context.Context, []string) (map[string]string, error) {
+	return maps.Clone(r.values), nil
+}
+func (r *codexFingerprintSettingsRepo) SetMultiple(_ context.Context, updates map[string]string) error {
+	if r.fail != nil {
+		return r.fail
+	}
+	r.writes++
+	for key, value := range updates {
+		r.values[key] = value
+	}
+	return nil
+}
+
+func fingerprintPolicyTestState(t *testing.T) {
+	t.Helper()
+	previous := publishedCodexFingerprintPolicy.Load()
+	t.Cleanup(func() { publishedCodexFingerprintPolicy.Store(previous) })
+	publishedCodexFingerprintPolicy.Store(nil)
+}
+
+func fingerprintTestPolicy(enabled bool, version string) *codexFingerprintPolicy {
+	ua := buildCodexCLIUserAgent(version)
+	return &codexFingerprintPolicy{enabled: enabled, userAgent: ua, revision: codexFingerprintPolicyRevision(enabled, ua)}
+}
+
+func fingerprintTestAccount(mode string) *Account {
+	return &Account{ID: 42, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Extra: map[string]any{
+		codexFingerprintModeExtraKey: mode, codexFingerprintSeedExtraKey: "ac6a7159-d158-41e8-bd52-3e66fd5c6515",
+	}}
+}
+
+func TestCodexFingerprintSettingsPreserveStorageAndPublishOnlyAfterSave(t *testing.T) {
+	fingerprintPolicyTestState(t)
+	repo := &codexFingerprintSettingsRepo{values: map[string]string{SettingKeyOpenAICodexClientVersionSynced: "0.161.0"}}
+	svc := NewSettingService(repo, &config.Config{})
+	require.NoError(t, svc.LoadCodexFingerprintSettings(context.Background()))
+	before := currentCodexFingerprintPolicy()
+	account := fingerprintTestAccount("session")
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	frozen := stageCodexFingerprintPolicy(c, account)
+	sent := CodexFingerprintSettings{Enabled: false, ClientVersion: "0.162.0", VersionAutoSyncEnabled: false}
+	repo.fail = errors.New("storage unavailable")
+	_, err := svc.UpdateCodexFingerprintSettings(context.Background(), sent)
+	require.Error(t, err)
+	require.Same(t, before, currentCodexFingerprintPolicy())
+	require.Zero(t, repo.writes)
+	repo.fail = nil
+	view, err := svc.UpdateCodexFingerprintSettings(context.Background(), sent)
+	require.NoError(t, err)
+	require.False(t, view.Enabled)
+	require.Equal(t, "0.162.0", view.EffectiveVersion)
+	require.Equal(t, "0.161.0", repo.values[SettingKeyOpenAICodexClientVersionSynced])
+	require.False(t, currentCodexFingerprintPolicy().enabled)
+	require.Same(t, frozen, codexFingerprintPolicyForContext(c, account), "an active attempt keeps its policy")
+	other := fingerprintTestAccount("device")
+	other.ID = 43
+	require.False(t, codexFingerprintPolicyForContext(c, other).enabled, "a new account attempt cannot inherit stale policy")
+}
+
+func TestCodexFingerprintSettingsInitialFlagAndValidation(t *testing.T) {
+	fingerprintPolicyTestState(t)
+	repo := &codexFingerprintSettingsRepo{values: map[string]string{}}
+	cfg := &config.Config{}
+	cfg.Gateway.DisableCodexIdentityEnforcement = true
+	view, err := NewSettingService(repo, cfg).GetCodexFingerprintSettings(context.Background())
+	require.NoError(t, err)
+	require.False(t, view.Enabled)
+	for _, raw := range []string{`null`, `[]`, `{}`, `{"enabled":null,"user_agent":"","client_version":"","version_auto_sync_enabled":true}`, `{"enabled":true,"user_agent":"bad\r\nUA","client_version":"","version_auto_sync_enabled":true}`, `{"enabled":true,"user_agent":"","client_version":"bad","version_auto_sync_enabled":true}`} {
+		_, err := DecodeCodexFingerprintSettings([]byte(raw))
+		require.Error(t, err)
+	}
+	_, err = DecodeCodexFingerprintSettings([]byte(`{"enabled":true,"user_agent":"","client_version":"0.161.0","version_auto_sync_enabled":true}`))
+	require.NoError(t, err)
+	for _, raw := range []string{`{"mode":"invented"}`, `{"mode":"device","codex_fingerprint_seed":"injected"}`, `{"mode":null}`} {
+		_, err := DecodeCodexFingerprintMode([]byte(raw))
+		require.Error(t, err)
+	}
+}
+
+func TestCodexFingerprintLogicalTurnReferencesAndPermissions(t *testing.T) {
+	policy := fingerprintTestPolicy(true, "0.161.0")
+	for _, mode := range []string{"device", "session", "full"} {
+		t.Run(mode, func(t *testing.T) {
+			account := fingerprintTestAccount(mode)
+			headers := http.Header{"Session-Id": {"client-session"}, "Thread-Id": {"child-thread"}, "X-Codex-Window-Id": {"child-thread:8"}, "X-Codex-Parent-Thread-Id": {"parent-thread"}}
+			metadata := map[string]any{"installation_id": "client-device", "session_id": "client-session", "thread_id": "child-thread", "parent_thread_id": "parent-thread", "parent_turn_id": "parent-turn", "root_turn_id": "root-turn", "turn_id": "real-turn", "turn_started_at_unix_ms": float64(12345), "window_id": "child-thread:8", "window_number": float64(8), "sandbox": "none", "sandbox_mode": "danger-full-access"}
+			raw, err := json.Marshal(metadata)
+			require.NoError(t, err)
+			headers.Set("x-codex-turn-metadata", string(raw))
+			body := map[string]any{"prompt_cache_key": "custom-affinity", "client_metadata": map[string]any{"session_id": "client-session", "thread_id": "child-thread", "turn_id": "real-turn", "parent_turn_id": "parent-turn", "root_turn_id": "root-turn", "x-codex-parent-thread-id": "parent-thread", "x-codex-window-id": "child-thread:8", "x-codex-turn-metadata": string(raw)}}
+			ids := resolveCodexFingerprintIDsFromRequest(account, headers, policy)
+			ids.alignSandboxWithUserAgent("codex-tui/0.161.0 (Ubuntu 24.4.0; x86_64) xterm-256color")
+			require.True(t, applyCodexFingerprintClientMetadata(body, ids))
+			applyCodexFingerprintHeaders(headers, ids)
+			wire, err := json.Marshal(body)
+			require.NoError(t, err)
+			require.Equal(t, "custom-affinity", gjson.GetBytes(wire, "prompt_cache_key").String())
+			require.Equal(t, "real-turn", gjson.GetBytes(wire, "client_metadata.turn_id").String())
+			var embedded map[string]any
+			require.NoError(t, json.Unmarshal([]byte(gjson.GetBytes(wire, "client_metadata.x-codex-turn-metadata").String()), &embedded))
+			require.Equal(t, "real-turn", embedded["turn_id"])
+			require.Equal(t, "parent-turn", embedded["parent_turn_id"])
+			require.Equal(t, "root-turn", embedded["root_turn_id"])
+			require.Equal(t, float64(12345), embedded["turn_started_at_unix_ms"])
+			require.Equal(t, "none", embedded["sandbox"])
+			require.Equal(t, float64(8), embedded["window_number"])
+			if mode == "device" {
+				require.Equal(t, "child-thread", embedded["thread_id"])
+			} else {
+				require.Equal(t, headers.Get("thread-id"), embedded["thread_id"])
+				require.Equal(t, headers.Get("x-codex-window-id"), embedded["window_id"])
+				require.Contains(t, embedded["window_id"], ":8")
+				if mode == "full" {
+					require.NotContains(t, embedded, "parent_thread_id")
+					require.Empty(t, headers.Get("x-codex-parent-thread-id"))
+				} else {
+					require.Equal(t, ids.mapThread("parent-thread"), embedded["parent_thread_id"])
+				}
+			}
+		})
+	}
+}
+
+func TestCodexFingerprintMasterOffKeepsClientAndPreventsWSReuse(t *testing.T) {
+	fingerprintPolicyTestState(t)
+	account := fingerprintTestAccount("full")
+	on, off := fingerprintTestPolicy(true, "0.161.0"), fingerprintTestPolicy(false, "0.162.0")
+	publishedCodexFingerprintPolicy.Store(off)
+	client := http.Header{"User-Agent": {"codex-tui/0.150.0 (Ubuntu 24.4.0; x86_64) xterm-256color"}, "Originator": {"codex-tui"}, "Version": {"0.150.0"}, "Session-Id": {"client-session"}, "Thread-Id": {"client-thread"}}
+	raw := []byte(`{"client_metadata":{"session_id":"client-session","thread_id":"client-thread","turn_id":"real-turn"},"prompt_cache_key":"custom"}`)
+	result, changed, err := applyCodexAccountIdentityClientMetadataRaw(raw, account, 7, off)
+	require.NoError(t, err)
+	require.False(t, changed)
+	require.Equal(t, raw, result)
+	require.Nil(t, resolveCodexFingerprintIDsFromRequest(account, client, off))
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest("POST", "/v1/responses", nil)
+	c.Request.Header = client
+	stageCodexFingerprintPolicy(c, account)
+	upstream := http.Header{"User-Agent": {codexCLIUserAgent}, "Originator": {"codex_cli_rs"}, "Version": {codexCLIVersion}, "Session-Id": {"scoped-session"}}
+	svc := &OpenAIGatewayService{}
+	require.NoError(t, svc.finalizeCodexOutboundHeaders(context.Background(), c, account, upstream, "gpt-6-astra", ""))
+	for _, name := range []string{"user-agent", "originator", "version", "session-id", "thread-id"} {
+		require.Equal(t, client.Get(name), upstream.Get(name))
+	}
+	require.NotEqual(t, normalizeOpenAIWSHandshakeCompatibility(account, client, on), normalizeOpenAIWSHandshakeCompatibility(account, client, off))
+}
+
+func TestCodexFingerprintTestEffortsExcludeUltraFromEverySource(t *testing.T) {
+	for _, typ := range []string{AccountTypeOAuth, AccountTypeAPIKey} {
+		for _, model := range []string{"gpt-6-astra", "gpt-6-sol", "gpt-6-luna", "gpt-6.1-sol", "upstream-only-model"} {
+			t.Run(typ+"/"+model, func(t *testing.T) {
+				account := &Account{Platform: PlatformOpenAI, Type: typ, Credentials: map[string]any{"model_mapping": map[string]any{"alias": model}}}
+				supported := true
+				account.SetUpstreamModelMetadataSnapshot(UpstreamModelMetadataSnapshot{Models: map[string]UpstreamModelMetadata{model: {Reasoning: &supported, SupportedReasoningLevels: []string{"high", "ultra"}, DefaultReasoningLevel: "ultra"}}})
+				levels, defaultEffort := AccountTestReasoningOptions(account, "alias")
+				require.Equal(t, []string{"high"}, levels)
+				require.Empty(t, defaultEffort)
+				require.Error(t, ValidateAccountTestReasoning(account, "alias", "default", "ultra"))
+				require.NoError(t, ValidateAccountTestReasoning(account, "alias", "default", "high"))
+			})
+		}
+	}
+}
+
+func TestCodexFingerprintAccountModeEpochAndGeneralEditPreservation(t *testing.T) {
+	fingerprintPolicyTestState(t)
+	account := fingerprintTestAccount("full")
+	previous, existed := codexFingerprintAccountEpochs.Load(account.ID)
+	t.Cleanup(func() {
+		if existed {
+			codexFingerprintAccountEpochs.Store(account.ID, previous)
+		} else {
+			codexFingerprintAccountEpochs.Delete(account.ID)
+		}
+	})
+	before := currentCodexFingerprintPolicyForAccount(account)
+	other := fingerprintTestAccount("device")
+	other.ID = 99
+	unaffected := currentCodexFingerprintPolicyForAccount(other)
+	notifyCodexFingerprintAccountChanged(account.ID)
+	require.NotEqual(t, before.revision, currentCodexFingerprintPolicyForAccount(account).revision)
+	require.Equal(t, unaffected.revision, currentCodexFingerprintPolicyForAccount(other).revision)
+	seed := account.Extra[codexFingerprintSeedExtraKey]
+	updated := prepareCodexFingerprintExtraForUpdate(account, map[string]any{"unrelated": true})
+	require.Equal(t, "full", updated[codexFingerprintModeExtraKey])
+	require.Equal(t, seed, updated[codexFingerprintSeedExtraKey])
+	require.Equal(t, true, updated["unrelated"])
+}
+
+func TestCodexFingerprintSandboxAlignmentPreservesActualPolicy(t *testing.T) {
+	for _, backend := range []string{"none", "external", "custom-sandbox", ""} {
+		metadata := map[string]any{"sandbox": backend, "sandbox_mode": "read-only"}
+		require.False(t, alignCodexSandboxMetadata(metadata, "seatbelt"))
+		require.Equal(t, backend, metadata["sandbox"])
+	}
+	metadata := map[string]any{"sandbox": "windows_mxc", "sandbox_mode": "workspace-write"}
+	require.False(t, alignCodexSandboxMetadata(metadata, "windows_sandbox"))
+	metadata = map[string]any{"sandbox": "seccomp", "sandbox_mode": "workspace-write", "thread_id": "original", "turn_id": "original-turn"}
+	require.True(t, alignCodexSandboxMetadata(metadata, "seatbelt"))
+	require.Equal(t, "workspace-write", metadata["sandbox_mode"])
+	require.Equal(t, "original", metadata["thread_id"])
+	require.Equal(t, "original-turn", metadata["turn_id"])
+}
diff --git a/backend/internal/service/codex_outbound_contract.go b/backend/internal/service/codex_outbound_contract.go
index 4cae91e4eb2c..ba830139c6ad 100644
--- a/backend/internal/service/codex_outbound_contract.go
+++ b/backend/internal/service/codex_outbound_contract.go
@@ -16,9 +16,35 @@ func (s *OpenAIGatewayService) finalizeCodexOutboundHeaders(ctx context.Context,
 	if account == nil || !account.UsesOpenAICodexProtocol() {
 		return nil
 	}
+	policy := codexFingerprintPolicyForContext(c, account)
 	if err := resolveAndSetOpenAIChatGPTAccountHeaders(ctx, s.accountRepo, headers, account); err != nil {
 		return err
 	}
-	enforceCodexIdentityHeadersForAccount(headers, codexAccountIdentitySource(c, account), s.codexIdentityOverrideUA(account))
+	if !policy.enabled && c != nil && c.Request != nil {
+		// Earlier builders provide protocol defaults and account UA overrides.
+		// With simulation off, restore the caller's identity before filling gaps.
+		for _, name := range []string{"user-agent", "originator", "version"} {
+			headers.Del(name)
+			if value := c.Request.Header.Get(name); value != "" {
+				headers.Set(name, value)
+			}
+		}
+		for _, name := range []string{"session-id", "thread-id", "x-client-request-id", "x-codex-window-id", "x-codex-parent-thread-id", "x-codex-turn-metadata"} {
+			if value := c.Request.Header.Get(name); value != "" {
+				headers.Set(name, value)
+			}
+		}
+		if !isOpenAICompatMessagesBridgeContext(c) {
+			ensureCodexIdentityHeaders(headers, policy)
+		} else {
+			headers.Del("originator")
+		}
+	}
+	enforceCodexIdentityHeadersForAccount(headers, codexAccountIdentitySource(c, account), s.codexIdentityOverrideUA(account), policy)
+	if policy.enabled {
+		if aligned, changed := alignCodexSandboxJSON(headers.Get("x-codex-turn-metadata"), codexSandboxForUserAgent(headers.Get("user-agent"))); changed {
+			headers.Set("x-codex-turn-metadata", aligned)
+		}
+	}
 	return nil
 }
diff --git a/backend/internal/service/openai_alpha_search_test.go b/backend/internal/service/openai_alpha_search_test.go
index b677fe665d86..e3cb2dd6a8ee 100644
--- a/backend/internal/service/openai_alpha_search_test.go
+++ b/backend/internal/service/openai_alpha_search_test.go
@@ -95,11 +95,11 @@ func TestForwardAlphaSearchOAuthPreservesWire(t *testing.T) {
 	require.Equal(t, codexCLIVersion, upstream.lastReq.Header.Get("Version"))
 	require.Empty(t, upstream.lastReq.Header.Get("OpenAI-Beta"))
 	require.Equal(t,
-		scopeCodexAccountIdentityValue(account, 0, "search-session"),
+		"search-session",
 		gjson.Get(upstream.lastReq.Header.Get("X-Codex-Turn-Metadata"), "session_id").String(),
 	)
 	require.Equal(t,
-		scopeCodexAccountIdentityValue(account, 0, "search-turn"),
+		"search-turn",
 		gjson.Get(upstream.lastReq.Header.Get("X-Codex-Turn-Metadata"), "turn_id").String(),
 	)
 	require.JSONEq(t, string(body), string(upstream.lastBody))
@@ -168,7 +168,7 @@ func TestForwardAlphaSearchPATUsesResponsesWebSearchFallback(t *testing.T) {
 	require.Equal(t, "responses=experimental", upstream.lastReq.Header.Get("OpenAI-Beta"))
 	require.Equal(t, codexCLIVersion, upstream.lastReq.Header.Get("Version"))
 	require.Equal(t,
-		scopeCodexAccountIdentityValue(account, 0, "turn-1"),
+		"turn-1",
 		gjson.Get(upstream.lastReq.Header.Get("X-Codex-Turn-Metadata"), "turn_id").String(),
 	)
 	require.Equal(t, openai.CodexDefaultOriginator, upstream.lastReq.Header.Get("Originator"))
diff --git a/backend/internal/service/openai_codex_account_identity.go b/backend/internal/service/openai_codex_account_identity.go
index 4a45becefdc0..2dea0b27d86e 100644
--- a/backend/internal/service/openai_codex_account_identity.go
+++ b/backend/internal/service/openai_codex_account_identity.go
@@ -27,6 +27,7 @@ const codexAccountIdentitySourceContextKey = "openai_codex_account_identity_sour
 // attempt. The handler reuses gin.Context across failover attempts, so every entry
 // point overwrites the staged source before projecting outbound identity.
 func (s *OpenAIGatewayService) prepareCodexAccountIdentitySource(ctx context.Context, c *gin.Context, account *Account) (*Account, error) {
+	stageCodexFingerprintPolicy(c, account)
 	source := account
 	if account != nil && account.IsShadow() {
 		resolved, err := resolveCredentialAccount(ctx, s.accountRepo, account)
@@ -162,19 +163,31 @@ var codexAccountIdentityFields = []string{
 	"session-id",
 	"thread_id",
 	"thread-id",
-	"turn_id",
-	"turn-id",
 	"window_id",
 	"x-codex-window-id",
 	"x-client-request-id",
+	"parent_thread_id",
+	"x-codex-parent-thread-id",
+	"forked_from_thread_id",
 }
 
-func applyCodexAccountIdentityFields(values map[string]any, account *Account, apiKeyID int64) bool {
-	if values == nil || codexAccountIdentityNamespace(account) == "" {
+func codexAccountIdentityProjectionFields(account *Account, policy *codexFingerprintPolicy) []string {
+	if account == nil || !policy.enabled || account.GetCodexFingerprintMode() == codexFingerprintOff {
+		return nil
+	}
+	if account.GetCodexFingerprintMode() == codexFingerprintDevice {
+		return []string{"installation_id", "x-codex-installation-id"}
+	}
+	return codexAccountIdentityFields
+}
+
+func applyCodexAccountIdentityFields(values map[string]any, account *Account, apiKeyID int64, policies ...*codexFingerprintPolicy) bool {
+	policy := selectCodexFingerprintPolicy(policies)
+	if values == nil || !policy.enabled || codexAccountIdentityNamespace(account) == "" {
 		return false
 	}
 	changed := false
-	for _, name := range codexAccountIdentityFields {
+	for _, name := range codexAccountIdentityProjectionFields(account, policy) {
 		raw, ok := values[name].(string)
 		if !ok || strings.TrimSpace(raw) == "" {
 			continue
@@ -188,7 +201,7 @@ func applyCodexAccountIdentityFields(values map[string]any, account *Account, ap
 	return changed
 }
 
-func applyCodexAccountIdentityEmbeddedMetadata(values map[string]any, account *Account, apiKeyID int64) bool {
+func applyCodexAccountIdentityEmbeddedMetadata(values map[string]any, account *Account, apiKeyID int64, policies ...*codexFingerprintPolicy) bool {
 	raw, ok := values[openAIWSTurnMetadataHeader].(string)
 	if !ok || strings.TrimSpace(raw) == "" {
 		return false
@@ -197,7 +210,7 @@ func applyCodexAccountIdentityEmbeddedMetadata(values map[string]any, account *A
 	if err := json.Unmarshal([]byte(raw), &metadata); err != nil || metadata == nil {
 		return false
 	}
-	if !applyCodexAccountIdentityFields(metadata, account, apiKeyID) {
+	if !applyCodexAccountIdentityFields(metadata, account, apiKeyID, policies...) {
 		return false
 	}
 	rebuilt, err := marshalCodexTurnMetadata(metadata)
@@ -208,21 +221,23 @@ func applyCodexAccountIdentityEmbeddedMetadata(values map[string]any, account *A
 	return true
 }
 
-func applyCodexAccountIdentityClientMetadataMap(requestBody map[string]any, account *Account, apiKeyID int64) bool {
-	if requestBody == nil || codexAccountIdentityNamespace(account) == "" {
+func applyCodexAccountIdentityClientMetadataMap(requestBody map[string]any, account *Account, apiKeyID int64, policies ...*codexFingerprintPolicy) bool {
+	policy := selectCodexFingerprintPolicy(policies)
+	if requestBody == nil || !policy.enabled || codexAccountIdentityNamespace(account) == "" {
 		return false
 	}
 	changed := false
 	clientMetadata, _ := requestBody["client_metadata"].(map[string]any)
+	originalSessionID := stringMetadataValue(clientMetadata, "session_id")
 	if clientMetadata != nil {
-		if applyCodexAccountIdentityFields(clientMetadata, account, apiKeyID) {
+		if applyCodexAccountIdentityFields(clientMetadata, account, apiKeyID, policy) {
 			changed = true
 		}
-		if applyCodexAccountIdentityEmbeddedMetadata(clientMetadata, account, apiKeyID) {
+		if applyCodexAccountIdentityEmbeddedMetadata(clientMetadata, account, apiKeyID, policy) {
 			changed = true
 		}
 	}
-	if raw, ok := requestBody["prompt_cache_key"].(string); ok && strings.TrimSpace(raw) != "" {
+	if raw, ok := requestBody["prompt_cache_key"].(string); ok && raw != "" && raw == originalSessionID && (account.GetCodexFingerprintMode() == codexFingerprintSession || account.GetCodexFingerprintMode() == codexFingerprintFull) {
 		next := scopeCodexAccountIdentityValue(account, apiKeyID, raw)
 		if next != raw {
 			requestBody["prompt_cache_key"] = next
@@ -235,8 +250,9 @@ func applyCodexAccountIdentityClientMetadataMap(requestBody map[string]any, acco
 // applyCodexAccountIdentityClientMetadataRaw scopes only the small identity
 // subobjects with gjson/sjson. The passthrough hot path never unmarshals the
 // potentially multi-megabyte request body.
-func applyCodexAccountIdentityClientMetadataRaw(body []byte, account *Account, apiKeyID int64) ([]byte, bool, error) {
-	if len(body) == 0 || codexAccountIdentityNamespace(account) == "" {
+func applyCodexAccountIdentityClientMetadataRaw(body []byte, account *Account, apiKeyID int64, policies ...*codexFingerprintPolicy) ([]byte, bool, error) {
+	policy := selectCodexFingerprintPolicy(policies)
+	if len(body) == 0 || !policy.enabled || codexAccountIdentityNamespace(account) == "" {
 		return body, false, nil
 	}
 	root := gjson.ParseBytes(body)
@@ -251,8 +267,8 @@ func applyCodexAccountIdentityClientMetadataRaw(body []byte, account *Account, a
 		if err := json.Unmarshal([]byte(cm.Raw), &clientMetadata); err != nil {
 			return body, false, fmt.Errorf("decode client_metadata for account identity: %w", err)
 		}
-		metadataChanged := applyCodexAccountIdentityFields(clientMetadata, account, apiKeyID)
-		if applyCodexAccountIdentityEmbeddedMetadata(clientMetadata, account, apiKeyID) {
+		metadataChanged := applyCodexAccountIdentityFields(clientMetadata, account, apiKeyID, policy)
+		if applyCodexAccountIdentityEmbeddedMetadata(clientMetadata, account, apiKeyID, policy) {
 			metadataChanged = true
 		}
 		if metadataChanged {
@@ -268,7 +284,7 @@ func applyCodexAccountIdentityClientMetadataRaw(body []byte, account *Account, a
 			changed = true
 		}
 	}
-	if promptCacheKey := gjson.GetBytes(body, "prompt_cache_key"); promptCacheKey.Type == gjson.String && strings.TrimSpace(promptCacheKey.String()) != "" {
+	if promptCacheKey := gjson.GetBytes(body, "prompt_cache_key"); promptCacheKey.Type == gjson.String && promptCacheKey.String() != "" && promptCacheKey.String() == gjson.GetBytes(body, "client_metadata.session_id").String() && (account.GetCodexFingerprintMode() == codexFingerprintSession || account.GetCodexFingerprintMode() == codexFingerprintFull) {
 		raw := promptCacheKey.String()
 		scoped := scopeCodexAccountIdentityValue(account, apiKeyID, raw)
 		if scoped != raw {
@@ -283,11 +299,12 @@ func applyCodexAccountIdentityClientMetadataRaw(body []byte, account *Account, a
 	return next, changed, nil
 }
 
-func applyCodexAccountIdentityHeaders(headers http.Header, account *Account, apiKeyID int64) {
-	if headers == nil || codexAccountIdentityNamespace(account) == "" {
+func applyCodexAccountIdentityHeaders(headers http.Header, account *Account, apiKeyID int64, policies ...*codexFingerprintPolicy) {
+	policy := selectCodexFingerprintPolicy(policies)
+	if headers == nil || !policy.enabled || codexAccountIdentityNamespace(account) == "" {
 		return
 	}
-	for _, name := range codexAccountIdentityFields {
+	for _, name := range codexAccountIdentityProjectionFields(account, policy) {
 		switch name {
 		case "session_id":
 			// Underscore session/conversation headers are rebuilt separately by the
@@ -306,7 +323,7 @@ func applyCodexAccountIdentityHeaders(headers http.Header, account *Account, api
 	}
 	if raw := strings.TrimSpace(headers.Get(openAIWSTurnMetadataHeader)); raw != "" {
 		metadata := map[string]any{}
-		if err := json.Unmarshal([]byte(raw), &metadata); err == nil && metadata != nil && applyCodexAccountIdentityFields(metadata, account, apiKeyID) {
+		if err := json.Unmarshal([]byte(raw), &metadata); err == nil && metadata != nil && applyCodexAccountIdentityFields(metadata, account, apiKeyID, policy) {
 			if rebuilt, err := marshalCodexTurnMetadata(metadata); err == nil {
 				headers.Set(openAIWSTurnMetadataHeader, string(rebuilt))
 			}
diff --git a/backend/internal/service/openai_codex_account_identity_test.go b/backend/internal/service/openai_codex_account_identity_test.go
index 2233790a7c64..d592ddb5e8b4 100644
--- a/backend/internal/service/openai_codex_account_identity_test.go
+++ b/backend/internal/service/openai_codex_account_identity_test.go
@@ -24,8 +24,8 @@ func (s *codexAccountIdentityRepoStub) GetByID(_ context.Context, _ int64) (*Acc
 
 func TestCodexRequestBodyIdentityNamespaceIsStablePerOAuthAccount(t *testing.T) {
 	body := []byte(`{"model":"gpt-5.6-codex","prompt_cache_key":"client-session","client_metadata":{"x-codex-installation-id":"client-installation","session_id":"client-session","thread_id":"client-thread","x-codex-window-id":"client-window","x-codex-turn-metadata":"{\"installation_id\":\"client-installation\",\"session_id\":\"client-session\",\"thread_id\":\"client-thread\",\"turn_id\":\"client-turn\",\"window_id\":\"client-window\"}"}}`)
-	account11 := &Account{ID: 11, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-11"}}
-	account19 := &Account{ID: 19, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-19"}}
+	account11 := &Account{ID: 11, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Extra: map[string]any{codexFingerprintModeExtraKey: "session"}, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-11"}}
+	account19 := &Account{ID: 19, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Extra: map[string]any{codexFingerprintModeExtraKey: "session"}, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-19"}}
 
 	first, changed, err := applyCodexAccountIdentityClientMetadataRaw(body, account11, 77)
 	require.NoError(t, err)
@@ -55,7 +55,9 @@ func TestCodexRequestBodyIdentityNamespaceIsStablePerOAuthAccount(t *testing.T)
 	var embeddedSecond map[string]any
 	require.NoError(t, json.Unmarshal([]byte(gjson.GetBytes(first, "client_metadata.x-codex-turn-metadata").String()), &embeddedFirst))
 	require.NoError(t, json.Unmarshal([]byte(gjson.GetBytes(second, "client_metadata.x-codex-turn-metadata").String()), &embeddedSecond))
-	for _, field := range []string{"installation_id", "session_id", "thread_id", "turn_id", "window_id"} {
+	require.Equal(t, "client-turn", embeddedFirst["turn_id"], "logical turns are preserved")
+	require.Equal(t, "client-turn", embeddedSecond["turn_id"])
+	for _, field := range []string{"installation_id", "session_id", "thread_id", "window_id"} {
 		require.NotEqual(t, embeddedFirst[field], embeddedSecond[field], field)
 	}
 }
@@ -140,8 +142,8 @@ func TestBuildOpenAIWSHeadersNamespacesCodexIdentityByOAuthAccount(t *testing.T)
 	c.Request.Header.Set("x-codex-window-id", "client-window")
 	c.Request.Header.Set("x-client-request-id", "client-request")
 
-	account11 := &Account{ID: 11, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-11"}}
-	account19 := &Account{ID: 19, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-19"}}
+	account11 := &Account{ID: 11, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Extra: map[string]any{codexFingerprintModeExtraKey: "session"}, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-11"}}
+	account19 := &Account{ID: 19, Platform: PlatformOpenAI, Type: AccountTypeOAuth, Extra: map[string]any{codexFingerprintModeExtraKey: "session"}, Credentials: map[string]any{"chatgpt_account_id": "chatgpt-account-19"}}
 	service := &OpenAIGatewayService{}
 	build := func(account *Account) http.Header {
 		headers, _, err := service.buildOpenAIWSHeaders(
@@ -197,6 +199,7 @@ func TestBuildUpstreamRequestNamespacesCodexIdentityByOAuthAccount(t *testing.T)
 			ID:       accountID,
 			Platform: PlatformOpenAI,
 			Type:     AccountTypeOAuth,
+			Extra:    map[string]any{codexFingerprintModeExtraKey: "session"},
 			Credentials: map[string]any{
 				"chatgpt_account_id": chatgptAccountID,
 			},
diff --git a/backend/internal/service/openai_codex_client_identity_test.go b/backend/internal/service/openai_codex_client_identity_test.go
index 4b7f4dec773f..f074aa4f14d8 100644
--- a/backend/internal/service/openai_codex_client_identity_test.go
+++ b/backend/internal/service/openai_codex_client_identity_test.go
@@ -334,7 +334,7 @@ func TestEffectiveCodexOutboundUserAgentFollowsBridgeContract(t *testing.T) {
 	require.Equal(t, codexSandboxForUserAgent(CodexCanonicalUserAgent()), svc.resolveStagedCodexFingerprintIDs(c, account, clientHeaders).sandbox, "桥接 + ForceCodexCLI：跟随规范 UA")
 }
 
-// 全局强制统一关闭时终态只做配对、保留合法客户端 UA，staging 的 sandbox 必须跟随该客户端 UA。
+// 关闭整个模拟后不暂存收敛身份，保留客户端 UA 和实际 sandbox 元数据。
 func TestStagedFingerprintSandboxFollowsPairedClientUAWhenEnforcementOff(t *testing.T) {
 	t.Cleanup(func() { SetCodexIdentityEnforcementEnabled(true) })
 	account := &Account{ID: 22, Platform: PlatformOpenAI, Type: AccountTypeOAuth,
@@ -347,9 +347,11 @@ func TestStagedFingerprintSandboxFollowsPairedClientUAWhenEnforcementOff(t *test
 	SetCodexIdentityEnforcementEnabled(true)
 	require.Equal(t, codexClientSandboxMac, svc.resolveStagedCodexFingerprintIDs(nil, account, clientHeaders).sandbox, "强制统一开启：跟随账号身份")
 	SetCodexIdentityEnforcementEnabled(false)
-	require.Equal(t, codexClientSandboxWindows, svc.resolveStagedCodexFingerprintIDs(nil, account, clientHeaders).sandbox, "强制统一关闭：跟随配对后的客户端 UA")
+	require.Nil(t, svc.resolveStagedCodexFingerprintIDs(nil, account, clientHeaders))
+	require.Equal(t, clientHeaders.Get("user-agent"), svc.effectiveCodexOutboundUserAgent(nil, account, clientHeaders))
 	clientHeaders.Set("user-agent", "curl/8.0")
-	require.Equal(t, codexSandboxForUserAgent(resolveCodexOutboundIdentity("").userAgent), svc.resolveStagedCodexFingerprintIDs(nil, account, clientHeaders).sandbox, "不合法客户端 UA 回落规范身份")
+	require.Nil(t, svc.resolveStagedCodexFingerprintIDs(nil, account, clientHeaders))
+	require.Equal(t, "curl/8.0", svc.effectiveCodexOutboundUserAgent(nil, account, clientHeaders))
 }
 
 // turn metadata 的 sandbox 跟随最终出站 UA，而不是账号身份：管理员显式 UA 覆盖时二者可能不同。
diff --git a/backend/internal/service/openai_codex_fingerprint.go b/backend/internal/service/openai_codex_fingerprint.go
index 1719ebc8ba49..ead5a63019ae 100644
--- a/backend/internal/service/openai_codex_fingerprint.go
+++ b/backend/internal/service/openai_codex_fingerprint.go
@@ -18,8 +18,7 @@ import (
 
 // codexFingerprintIDsContextKey 是暂存在 gin context 的收敛 ID 集合键。
 // 由 Forward（非透传）或 forwardOpenAIPassthrough（透传）解析后写入，请求
-// 构造器读取用于出站头改写——请求体与出站头必须共享同一份 IDs，保证
-// turn_id 等随机字段一致。
+// 构造器读取用于出站头改写——请求体与出站头必须共享同一份 IDs，保证头与体的设备、线程和窗口标识一致。
 const codexFingerprintIDsContextKey = "codex_fingerprint_ids"
 
 // stageCodexFingerprintIDs 将本 attempt 解析出的收敛 ID 暂存到 gin context。
@@ -179,6 +178,13 @@ func prepareCodexFingerprintExtraForUpdate(account *Account, extra map[string]an
 	if prepared == nil {
 		prepared = make(map[string]any, 2)
 	}
+	// General account edits omit the extension-owned mode. Preserve the latest
+	// stored value instead of resetting it or replaying a stale editor draft.
+	if _, submitted := prepared[codexFingerprintModeExtraKey]; !submitted {
+		if existing, exists := account.Extra[codexFingerprintModeExtraKey]; exists {
+			prepared[codexFingerprintModeExtraKey] = existing
+		}
+	}
 	if seed, ok := codexFingerprintSeed(account.Extra); ok {
 		prepared[codexFingerprintSeedExtraKey] = seed
 	} else {
@@ -280,18 +286,19 @@ func resolveConvergedThreadID(seed, clientSessionID string) string {
 
 // codexFingerprintIDs 收敛后的完整 ID 集合。
 // 由 resolveCodexFingerprintIDs 一次性生成，同一个实例在头改写和体改写之间共享，
-// 确保所有载体中的 turn_id 等随机字段一致。体改写时还会补记原始
+// 确保所有载体中的设备、线程和窗口标识一致。体改写时还会补记原始
 // client_metadata.session_id，用于识别 root prompt_cache_key 的默认值。
 type codexFingerprintIDs struct {
+	seed                          string
 	accountID                     int64
 	mode                          codexFingerprintMode
 	installationID                string
 	sessionID                     string
 	threadID                      string
-	turnID                        string
 	windowID                      string
 	sandbox                       string
-	turnStartedAtUnixMs           int64
+	logicalMetadata               map[string]any
+	bodyIdentityCaptured          bool
 	originalBodySessionID         string
 	originalBodySessionIDCaptured bool
 }
@@ -300,7 +307,7 @@ type codexFingerprintIDs struct {
 // clientSessionID 是客户端原始的 session-id 头值（连字符形式），用于 session 模式下
 // 的 thread_id 派生——每个真实 Codex 会话得到一个独立线程。
 // 返回 nil 表示 off 模式，不需要改写。
-// 注意：包含随机生成的 turn_id，调用方必须只调用一次并共享结果给头改写和体改写。
+// 调用方共享同一份结果给头改写和体改写；真实回合 ID 与开始时间不生成、不改写。
 func resolveCodexFingerprintIDs(account *Account, clientSessionID string, mode codexFingerprintMode) *codexFingerprintIDs {
 	if account == nil || mode == codexFingerprintOff {
 		return nil
@@ -311,9 +318,9 @@ func resolveCodexFingerprintIDs(account *Account, clientSessionID string, mode c
 	}
 
 	ids := &codexFingerprintIDs{
-		accountID:           account.ID,
-		mode:                mode,
-		turnStartedAtUnixMs: time.Now().UnixMilli(),
+		seed:      seed,
+		accountID: account.ID,
+		mode:      mode,
 	}
 	if identity, ok := account.CodexClientIdentity(); ok {
 		ids.sandbox = identity.Sandbox
@@ -334,14 +341,12 @@ func resolveCodexFingerprintIDs(account *Account, clientSessionID string, mode c
 		if ids.threadID == "" {
 			ids.threadID = ids.sessionID
 		}
-		ids.turnID = uuid.Must(uuid.NewV7()).String()
 		ids.windowID = ids.threadID + ":0"
 		return ids
 
 	case codexFingerprintFull:
 		ids.sessionID = resolveConvergedSessionID(seed)
 		ids.threadID = ids.sessionID
-		ids.turnID = uuid.Must(uuid.NewV7()).String()
 		ids.windowID = ids.threadID + ":0"
 		return ids
 	}
@@ -362,8 +367,9 @@ func extractClientSessionID(h http.Header) string {
 // resolveCodexFingerprintIDsFromRequest 从客户端原始请求头中提取 session-id，
 // 结合账号配置一次性解析收敛 ID 集合。调用方应将返回的 ids 同时传给
 // applyCodexFingerprintHeaders 和 applyCodexFingerprintClientMetadata。
-func resolveCodexFingerprintIDsFromRequest(account *Account, clientHeaders http.Header) *codexFingerprintIDs {
-	if account == nil {
+func resolveCodexFingerprintIDsFromRequest(account *Account, clientHeaders http.Header, policies ...*codexFingerprintPolicy) *codexFingerprintIDs {
+	policy := selectCodexFingerprintPolicy(policies)
+	if account == nil || !policy.enabled {
 		return nil
 	}
 	mode := account.GetCodexFingerprintMode()
@@ -374,7 +380,11 @@ func resolveCodexFingerprintIDsFromRequest(account *Account, clientHeaders http.
 	if clientHeaders != nil {
 		clientSessionID = extractClientSessionID(clientHeaders)
 	}
-	return resolveCodexFingerprintIDs(account, clientSessionID, mode)
+	ids := resolveCodexFingerprintIDs(account, clientSessionID, mode)
+	if ids != nil {
+		ids.captureThreadAndWindow(clientHeaders.Get("thread-id"), clientHeaders.Get("x-codex-window-id"))
+	}
+	return ids
 }
 
 // applyCodexFingerprintHeaders 按预计算的收敛 ID 改写出站 HTTP 头中的设备指纹。
@@ -389,9 +399,7 @@ func applyCodexFingerprintHeaders(h http.Header, ids *codexFingerprintIDs) {
 	h.Del("x-codex-installation-id")
 
 	if ids.mode == codexFingerprintDevice {
-		rewriteCodexTurnMetadataFields(h, ids.turnMetadataFields(map[string]any{
-			"installation_id": ids.installationID,
-		}))
+		ids.rewriteHeaderTurnMetadata(h)
 		return
 	}
 
@@ -405,14 +413,14 @@ func applyCodexFingerprintHeaders(h http.Header, ids *codexFingerprintIDs) {
 		h.Set("session_id", ids.sessionID)
 	}
 
-	rewriteCodexTurnMetadataFields(h, ids.turnMetadataFields(map[string]any{
-		"installation_id":         ids.installationID,
-		"session_id":              ids.sessionID,
-		"thread_id":               ids.threadID,
-		"turn_id":                 ids.turnID,
-		"window_id":               ids.windowID,
-		"turn_started_at_unix_ms": ids.turnStartedAtUnixMs,
-	}))
+	if parent := h.Get("x-codex-parent-thread-id"); parent != "" {
+		if ids.mode == codexFingerprintFull {
+			h.Del("x-codex-parent-thread-id")
+		} else {
+			h.Set("x-codex-parent-thread-id", ids.mapThread(parent))
+		}
+	}
+	ids.rewriteHeaderTurnMetadata(h)
 }
 
 // alignSandboxWithUserAgent 让 sandbox 跟随最终出站 UA 声明的系统（管理员显式 UA
@@ -424,38 +432,6 @@ func (ids *codexFingerprintIDs) alignSandboxWithUserAgent(userAgent string) {
 	ids.sandbox = codexSandboxForUserAgent(userAgent)
 }
 
-// turnMetadataFields 在身份字段之外补上与出站 UA 配套的 sandbox 标签，使 turn
-// metadata 声明的沙箱与 User-Agent 声明的操作系统一致（seatbelt=macOS、
-// seccomp=Linux、windows_sandbox=Windows）。
-func (ids *codexFingerprintIDs) turnMetadataFields(fields map[string]any) map[string]any {
-	if ids != nil && ids.sandbox != "" {
-		fields["sandbox"] = ids.sandbox
-	}
-	return fields
-}
-
-// rewriteCodexTurnMetadataFields 解析 x-codex-turn-metadata 头中的 JSON，
-// 替换指定字段后回写。合法对象保留未指定字段（如 sandbox、thread_source）；
-// 非法/非对象值重建为最小合法 metadata，避免 flat 与 embedded identity 分裂。
-func rewriteCodexTurnMetadataFields(h http.Header, fields map[string]any) {
-	raw := strings.TrimSpace(h.Get("x-codex-turn-metadata"))
-	if raw == "" {
-		return
-	}
-	var metadata map[string]any
-	if err := json.Unmarshal([]byte(raw), &metadata); err != nil || metadata == nil {
-		metadata = make(map[string]any, len(fields))
-	}
-	for k, v := range fields {
-		metadata[k] = v
-	}
-	rebuilt, err := marshalCodexTurnMetadata(metadata)
-	if err != nil {
-		return
-	}
-	h.Set("x-codex-turn-metadata", string(rebuilt))
-}
-
 // applyCodexFingerprintClientMetadata 按预计算的收敛 ID 改写请求体中的 client_metadata。
 // 使用与头改写相同的 ids 实例，确保 turn_id 等随机字段一致。
 func applyCodexFingerprintClientMetadata(reqBody map[string]any, ids *codexFingerprintIDs) bool {
@@ -489,36 +465,233 @@ func applyCodexFingerprintToClientMetadataMap(existing map[string]any, ids *code
 	}
 
 	modified := false
+	// Body metadata describes the current logical turn. Use it consistently in
+	// the outgoing body and header without manufacturing a new turn or time.
+	ids.captureLogicalMetadata(existing)
 
 	if ids.installationID != "" {
 		existing["x-codex-installation-id"] = ids.installationID
+		if _, exists := existing["installation_id"]; exists {
+			existing["installation_id"] = ids.installationID
+		}
 		modified = true
 	}
 
 	if ids.mode == codexFingerprintDevice {
-		rewriteClientMetadataEmbeddedTurnMetadata(existing, ids.turnMetadataFields(map[string]any{
-			"installation_id": ids.installationID,
-		}))
+		ids.rewriteEmbeddedTurnMetadata(existing)
 		return modified
 	}
 
 	// session / full 模式
 	existing["session_id"] = ids.sessionID
 	existing["thread_id"] = ids.threadID
-	existing["turn_id"] = ids.turnID
 	existing["x-codex-window-id"] = ids.windowID
-
-	rewriteClientMetadataEmbeddedTurnMetadata(existing, ids.turnMetadataFields(map[string]any{
-		"installation_id":         ids.installationID,
-		"session_id":              ids.sessionID,
-		"thread_id":               ids.threadID,
-		"turn_id":                 ids.turnID,
-		"window_id":               ids.windowID,
-		"turn_started_at_unix_ms": ids.turnStartedAtUnixMs,
-	}))
+	ids.rewriteThreadReferences(existing)
+	ids.rewriteEmbeddedTurnMetadata(existing)
 	return true
 }
 
+func stringMetadataValue(metadata map[string]any, key string) string {
+	value, _ := metadata[key].(string)
+	return value
+}
+
+func (ids *codexFingerprintIDs) mapThread(original string) string {
+	if ids.mode == codexFingerprintFull {
+		return ids.threadID
+	}
+	return resolveConvergedThreadID(ids.seed, original)
+}
+
+func (ids *codexFingerprintIDs) captureThreadAndWindow(thread, window string) {
+	if ids.mode == codexFingerprintDevice {
+		return
+	}
+	if ids.mode == codexFingerprintSession && strings.TrimSpace(thread) != "" {
+		ids.threadID = ids.mapThread(thread)
+	}
+	suffix := "0"
+	if index := strings.LastIndexByte(window, ':'); index >= 0 && index < len(window)-1 {
+		suffix = window[index+1:]
+	} else if index := strings.LastIndexByte(ids.windowID, ':'); index >= 0 {
+		suffix = ids.windowID[index+1:]
+	}
+	ids.windowID = ids.threadID + ":" + suffix
+}
+
+func (ids *codexFingerprintIDs) rewriteThreadReferences(metadata map[string]any) {
+	if ids.mode == codexFingerprintDevice {
+		return
+	}
+	for _, key := range []string{"parent_thread_id", "x-codex-parent-thread-id", "forked_from_thread_id"} {
+		if original := stringMetadataValue(metadata, key); original != "" {
+			if ids.mode == codexFingerprintFull {
+				delete(metadata, key)
+				if key == "forked_from_thread_id" {
+					delete(metadata, "forked_from_ordinal_exclusive")
+				}
+			} else {
+				metadata[key] = ids.mapThread(original)
+			}
+		}
+	}
+}
+
+func (ids *codexFingerprintIDs) rewriteTurnMetadata(metadata map[string]any) {
+	for key, value := range ids.logicalMetadata {
+		metadata[key] = value
+	}
+	metadata["installation_id"] = ids.installationID
+	if ids.mode != codexFingerprintDevice {
+		metadata["session_id"] = ids.sessionID
+		metadata["thread_id"] = ids.threadID
+		metadata["window_id"] = ids.windowID
+		ids.rewriteThreadReferences(metadata)
+	}
+	alignCodexSandboxMetadata(metadata, ids.sandbox)
+}
+
+func (ids *codexFingerprintIDs) captureLogicalMetadata(clientMetadata map[string]any) {
+	if ids.bodyIdentityCaptured {
+		return
+	}
+	ids.bodyIdentityCaptured = true
+	embedded := map[string]any{}
+	if raw := stringMetadataValue(clientMetadata, "x-codex-turn-metadata"); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &embedded)
+	}
+	if ids.logicalMetadata == nil {
+		ids.logicalMetadata = map[string]any{}
+	}
+	for _, key := range []string{"turn_id", "turn_started_at_unix_ms", "parent_turn_id", "root_turn_id", "window_number", "context_window_id"} {
+		if value, ok := embedded[key]; ok {
+			ids.logicalMetadata[key] = value
+		}
+		if value, ok := clientMetadata[key]; ok {
+			ids.logicalMetadata[key] = value
+		}
+	}
+	thread, window := stringMetadataValue(clientMetadata, "thread_id"), stringMetadataValue(clientMetadata, "x-codex-window-id")
+	if thread == "" {
+		thread = stringMetadataValue(embedded, "thread_id")
+	}
+	if window == "" {
+		window = stringMetadataValue(embedded, "window_id")
+	}
+	ids.captureThreadAndWindow(thread, window)
+}
+
+func alignCodexSandboxMetadata(metadata map[string]any, target string) bool {
+	// These describe actual execution permissions, not an OS-only fingerprint.
+	mode := stringMetadataValue(metadata, "sandbox_mode")
+	sandbox := stringMetadataValue(metadata, "sandbox")
+	if mode == "external-sandbox" {
+		metadata["sandbox"] = "external"
+		return sandbox != "external"
+	}
+	if sandbox == "none" || sandbox == "external" {
+		return false
+	}
+	if mode == "danger-full-access" && sandbox == "" {
+		return false
+	}
+	switch sandbox {
+	case "seatbelt", "seccomp", "windows_sandbox", "windows_elevated", "windows_mxc":
+		if strings.HasPrefix(sandbox, "windows_") && strings.HasPrefix(target, "windows_") {
+			return false
+		}
+		if target != "" && target != sandbox {
+			metadata["sandbox"] = target
+			return true
+		}
+	}
+	return false
+}
+
+func alignCodexSandboxJSON(raw, target string) (string, bool) {
+	var metadata map[string]any
+	if json.Unmarshal([]byte(raw), &metadata) != nil || metadata == nil || !alignCodexSandboxMetadata(metadata, target) {
+		return raw, false
+	}
+	encoded, err := marshalCodexTurnMetadata(metadata)
+	if err != nil {
+		return raw, false
+	}
+	return string(encoded), true
+}
+
+func alignCodexSandboxClientMetadata(body map[string]any, target string) bool {
+	metadata, _ := body["client_metadata"].(map[string]any)
+	if metadata == nil {
+		return false
+	}
+	if raw := stringMetadataValue(metadata, "x-codex-turn-metadata"); raw != "" {
+		if aligned, changed := alignCodexSandboxJSON(raw, target); changed {
+			metadata["x-codex-turn-metadata"] = aligned
+			return true
+		}
+	}
+	return false
+}
+
+func alignCodexSandboxClientMetadataRaw(body []byte, target string) ([]byte, error) {
+	raw := gjson.GetBytes(body, "client_metadata.x-codex-turn-metadata")
+	if raw.Type != gjson.String {
+		return body, nil
+	}
+	if aligned, changed := alignCodexSandboxJSON(raw.String(), target); changed {
+		return sjson.SetBytes(body, "client_metadata.x-codex-turn-metadata", aligned)
+	}
+	return body, nil
+}
+
+func resolveCodexFingerprintIDsWithSource(routed, source *Account, headers http.Header, policy *codexFingerprintPolicy) *codexFingerprintIDs {
+	if routed == nil || source == nil {
+		return nil
+	}
+	account := *source
+	account.Extra = maps.Clone(source.Extra)
+	if account.Extra == nil {
+		account.Extra = map[string]any{}
+	}
+	account.Extra[codexFingerprintModeExtraKey] = string(routed.GetCodexFingerprintMode())
+	ids := resolveCodexFingerprintIDsFromRequest(&account, headers, policy)
+	if ids != nil {
+		ids.accountID = routed.ID
+	}
+	return ids
+}
+
+func (ids *codexFingerprintIDs) rewriteHeaderTurnMetadata(headers http.Header) {
+	raw := headers.Get("x-codex-turn-metadata")
+	if raw == "" {
+		return
+	}
+	var metadata map[string]any
+	if json.Unmarshal([]byte(raw), &metadata) != nil || metadata == nil {
+		metadata = map[string]any{}
+	}
+	ids.rewriteTurnMetadata(metadata)
+	if encoded, err := marshalCodexTurnMetadata(metadata); err == nil {
+		headers.Set("x-codex-turn-metadata", string(encoded))
+	}
+}
+
+func (ids *codexFingerprintIDs) rewriteEmbeddedTurnMetadata(clientMetadata map[string]any) {
+	raw := stringMetadataValue(clientMetadata, "x-codex-turn-metadata")
+	if raw == "" {
+		return
+	}
+	var metadata map[string]any
+	if json.Unmarshal([]byte(raw), &metadata) != nil || metadata == nil {
+		metadata = map[string]any{}
+	}
+	ids.rewriteTurnMetadata(metadata)
+	if encoded, err := marshalCodexTurnMetadata(metadata); err == nil {
+		clientMetadata["x-codex-turn-metadata"] = string(encoded)
+	}
+}
+
 func captureCodexFingerprintOriginalBodySessionID(ids *codexFingerprintIDs, clientMetadata any) {
 	if ids == nil || ids.originalBodySessionIDCaptured {
 		return
@@ -626,23 +799,3 @@ func applyCodexFingerprintClientMetadataRaw(body []byte, ids *codexFingerprintID
 	}
 	return next, modified, nil
 }
-
-// rewriteClientMetadataEmbeddedTurnMetadata 改写 client_metadata 中内嵌的
-// x-codex-turn-metadata JSON 字符串里的指定字段。非法/非对象值会重建，
-// 避免 flat client_metadata 与 embedded metadata 暴露两套身份。
-func rewriteClientMetadataEmbeddedTurnMetadata(clientMetadata map[string]any, fields map[string]any) {
-	raw, ok := clientMetadata["x-codex-turn-metadata"].(string)
-	if !ok || raw == "" {
-		return
-	}
-	var metadata map[string]any
-	if err := json.Unmarshal([]byte(raw), &metadata); err != nil || metadata == nil {
-		metadata = make(map[string]any, len(fields))
-	}
-	for k, v := range fields {
-		metadata[k] = v
-	}
-	if rebuilt, err := marshalCodexTurnMetadata(metadata); err == nil {
-		clientMetadata["x-codex-turn-metadata"] = string(rebuilt)
-	}
-}
diff --git a/backend/internal/service/openai_codex_fingerprint_test.go b/backend/internal/service/openai_codex_fingerprint_test.go
index 922d33f6ce8d..906a5bde0f8c 100644
--- a/backend/internal/service/openai_codex_fingerprint_test.go
+++ b/backend/internal/service/openai_codex_fingerprint_test.go
@@ -253,7 +253,7 @@ func TestApplyCodexFingerprintHeaders_SessionMode(t *testing.T) {
 	assert.Equal(t, convergedInstall, meta["installation_id"])
 	assert.Equal(t, convergedSession, meta["session_id"])
 	assert.Equal(t, convergedThread, meta["thread_id"])
-	assert.NotEqual(t, "user-turn", meta["turn_id"], "turn_id 应被新生成的值替换")
+	assert.Equal(t, "user-turn", meta["turn_id"], "真实回合标识保持原样")
 	assert.Equal(t, identity.Sandbox, meta["sandbox"], "sandbox 跟随账号身份的操作系统")
 	assert.Equal(t, "user", meta["thread_source"], "thread_source 保留原样")
 }
@@ -332,7 +332,7 @@ func TestFingerprintIDs_HeaderAndBody_TurnID_Consistent(t *testing.T) {
 
 	// 头改写
 	h := http.Header{}
-	h.Set("x-codex-turn-metadata", `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`)
+	h.Set("x-codex-turn-metadata", `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","turn_started_at_unix_ms":12345,"window_id":"x:0"}`)
 	applyCodexFingerprintHeaders(h, ids)
 
 	// 体改写（使用同一份 ids）
@@ -341,7 +341,7 @@ func TestFingerprintIDs_HeaderAndBody_TurnID_Consistent(t *testing.T) {
 			"x-codex-installation-id": "x",
 			"session_id":              "x",
 			"turn_id":                 "x",
-			"x-codex-turn-metadata":   `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`,
+			"x-codex-turn-metadata":   `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","turn_started_at_unix_ms":12345,"window_id":"x:0"}`,
 		},
 	}
 	applyCodexFingerprintClientMetadata(reqBody, ids)
@@ -372,9 +372,9 @@ func TestFingerprintIDs_HeaderAndBody_TurnID_Consistent(t *testing.T) {
 
 	assert.Equal(t, headerTurnID, bodyTurnID, "头和体的 turn_id 必须一致")
 	assert.Equal(t, headerTurnID, bodyEmbeddedTurnID, "头和体内嵌 turn-metadata 的 turn_id 必须一致")
-	assert.Equal(t, ids.turnID, headerTurnID, "所有 turn_id 都应来自同一份 ids")
+	assert.Equal(t, "x", headerTurnID, "真实 turn_id 保持原样")
 	assert.Equal(t, headerTurnStartedAt, bodyTurnStartedAt, "头和体内嵌 turn-metadata 的开始时间必须一致")
-	assert.Equal(t, ids.turnStartedAtUnixMs, int64(headerTurnStartedAt), "所有开始时间都应来自同一份 ids")
+	assert.Equal(t, float64(12345), headerTurnStartedAt, "真实开始时间保持原样")
 }
 
 func TestFingerprintIDs_MalformedEmbeddedMetadataRebuiltConsistently(t *testing.T) {
@@ -485,7 +485,7 @@ func TestApplyCodexFingerprintClientMetadata_SessionMode(t *testing.T) {
 	require.True(t, ok)
 	convergedInstall := resolveConvergedInstallationID(account, seed)
 	convergedSession := resolveConvergedSessionID(seed)
-	convergedThread := resolveConvergedThreadID(seed, "client-session-aaa")
+	convergedThread := resolveConvergedThreadID(seed, "x")
 
 	assert.Equal(t, convergedInstall, cm["x-codex-installation-id"])
 	assert.Equal(t, convergedSession, cm["session_id"])
@@ -797,7 +797,7 @@ func TestApplyCodexFingerprintClientMetadataRaw_PreservesUnrelatedFields(t *test
 	cm, _ := decoded["client_metadata"].(map[string]any)
 	require.NotNil(t, cm)
 	assert.Equal(t, ids.sessionID, cm["session_id"])
-	assert.Equal(t, ids.turnID, cm["turn_id"])
+	assert.NotContains(t, cm, "turn_id", "未提供的回合标识不应被伪造")
 }
 
 func TestApplyCodexFingerprintClientMetadataRaw_Noop(t *testing.T) {
diff --git a/backend/internal/service/openai_codex_identity.go b/backend/internal/service/openai_codex_identity.go
index 6fcd6ef567e0..2d612e10b3ef 100644
--- a/backend/internal/service/openai_codex_identity.go
+++ b/backend/internal/service/openai_codex_identity.go
@@ -108,7 +108,11 @@ func CodexCanonicalUserAgent() string {
 // （codex-rs login/default_client.rs 的 default_headers()），version 门槛
 // （issue #3901）只存在于 /backend-api/codex 推理面。
 func CodexCanonicalAuthIdentity() (userAgent, originator string) {
-	identity := resolveCodexOutboundIdentity("")
+	policy := currentCodexFingerprintPolicy()
+	if !policy.enabled {
+		return codexCLIUserAgent, openai.CodexDefaultOriginator
+	}
+	identity := resolveCodexOutboundIdentity("", policy)
 	return identity.userAgent, identity.originator
 }
 
@@ -156,8 +160,12 @@ type codexOutboundIdentity struct {
 // 其自带的版本段一律用当前生效版本重建：一条填写于某个历史版本的 UA 否则会把出站身份
 // 永久钉死在陈旧版本上，绕过版本自动同步，落回上游优先降载的那一侧。
 // 需要固定版本请填「Codex 客户端版本号」并关闭自动同步。
-func resolveCodexOutboundIdentity(candidateUA string) codexOutboundIdentity {
-	canonical := codexCanonicalUserAgent()
+func resolveCodexOutboundIdentity(candidateUA string, policies ...*codexFingerprintPolicy) codexOutboundIdentity {
+	policy := selectCodexFingerprintPolicy(policies)
+	canonical := policy.userAgent
+	if !policy.enabled {
+		canonical = codexCLIUserAgent
+	}
 	if _, _, ok := openai.PairCodexClientIdentity(canonical); !ok {
 		canonical = codexCLIUserAgent
 	}
@@ -192,11 +200,21 @@ func codexClientVersionFromUA(ua string) string {
 
 // ensureCodexIdentityHeaders 补齐 OAuth（ChatGPT 内部接口）出站请求所需的 Codex 身份头。
 // 已有 User-Agent 与 version 保持不变，交给紧随其后的 enforceCodexIdentityHeaders 收口。
-func ensureCodexIdentityHeaders(h http.Header) {
+func ensureCodexIdentityHeaders(h http.Header, policies ...*codexFingerprintPolicy) {
 	if h == nil {
 		return
 	}
-	identity := resolveCodexOutboundIdentity("")
+	policy := selectCodexFingerprintPolicy(policies)
+	identity := resolveCodexOutboundIdentity("", policy)
+	if !policy.enabled {
+		// Fill only missing headers, deriving them from the actual caller's UA.
+		if originator, _, ok := openai.PairCodexClientIdentity(h.Get("user-agent")); ok {
+			identity.originator = originator
+			if version := NormalizeCodexClientVersion(openai.CodexUserAgentVersion(h.Get("user-agent"))); version != "" {
+				identity.version = version
+			}
+		}
+	}
 	if strings.TrimSpace(h.Get("user-agent")) == "" {
 		h.Set("user-agent", identity.userAgent)
 	}
@@ -238,42 +256,30 @@ func enforceCodexIdentityHeaders(h http.Header) {
 // 仅对携带 originator 的请求生效：compat 桥接等非 ChatGPT 内部接口路径会显式删除 originator，
 // 不应被补回。需要从缺失身份头恢复的调用方应先调用 ensureCodexIdentityHeaders。
 // 必须在所有 User-Agent 改写之后调用。
-func enforceCodexIdentityHeadersWithUA(h http.Header, overrideUA string) {
+func enforceCodexIdentityHeadersWithUA(h http.Header, overrideUA string, policies ...*codexFingerprintPolicy) {
 	if h == nil || h.Get("originator") == "" {
 		return
 	}
-	if !codexIdentityEnforcement.Load() {
-		pairCodexIdentityHeaders(h)
+	policy := selectCodexFingerprintPolicy(policies)
+	if !policy.enabled {
 		return
 	}
-	identity := resolveCodexOutboundIdentity(overrideUA)
+	identity := resolveCodexOutboundIdentity(overrideUA, policy)
 	h.Set("user-agent", identity.userAgent)
 	h.Set("originator", identity.originator)
 	h.Set("version", identity.version)
 }
 
-// pairCodexIdentityHeaders 是关闭强制统一后的兜底收口：保留客户端真实身份，
-// 仅保证 originator 与最终 User-Agent 首段配套、version 不低于上游门槛（issue #3901）。
-func pairCodexIdentityHeaders(h http.Header) {
-	originator, pairedUA, ok := openai.PairCodexClientIdentity(h.Get("user-agent"))
-	if !ok {
-		identity := resolveCodexOutboundIdentity("")
-		originator, pairedUA = identity.originator, identity.userAgent
-		h.Set("version", identity.version)
-	}
-	h.Set("user-agent", pairedUA)
-	h.Set("originator", originator)
-	if v := strings.TrimSpace(h.Get("version")); v != "" && CompareVersions(v, codexUpstreamMinVersion) < 0 {
-		h.Set("version", resolveCodexOutboundIdentity("").version)
-	}
-}
-
 // resolveCodexOutboundIdentityForAccount 返回某个 OAuth 账号的出站身份三元组。
 // 优先级：管理员显式配置的账号级 User-Agent（只贡献客户端名与 OS / 架构 / 终端指纹，
 // 版本段仍由生效版本重建）> 账号持久化 / 种子派生的 Codex TUI 身份 > 全局规范身份。
 // 版本号三处同源：UA 首段、UA 尾部括号组与 version 头都取当前生效的官方版本。
-func resolveCodexOutboundIdentityForAccount(account *Account, overrideUA string) codexOutboundIdentity {
-	canonical := resolveCodexOutboundIdentity(overrideUA)
+func resolveCodexOutboundIdentityForAccount(account *Account, overrideUA string, policies ...*codexFingerprintPolicy) codexOutboundIdentity {
+	policy := selectCodexFingerprintPolicy(policies)
+	canonical := resolveCodexOutboundIdentity(overrideUA, policy)
+	if !policy.enabled {
+		return resolveCodexOutboundIdentity("", policy)
+	}
 	if overrideUA != "" {
 		return canonical
 	}
@@ -291,15 +297,15 @@ func resolveCodexOutboundIdentityForAccount(account *Account, overrideUA string)
 // enforceCodexIdentityHeadersForAccount 与 enforceCodexIdentityHeadersWithUA 语义相同，
 // 但强制统一时使用账号级身份而不是全局规范身份，使同一账号的所有出站请求
 // 表现为同一台机器上的同一个 Codex TUI。
-func enforceCodexIdentityHeadersForAccount(h http.Header, account *Account, overrideUA string) {
+func enforceCodexIdentityHeadersForAccount(h http.Header, account *Account, overrideUA string, policies ...*codexFingerprintPolicy) {
 	if h == nil || h.Get("originator") == "" {
 		return
 	}
-	if !codexIdentityEnforcement.Load() {
-		pairCodexIdentityHeaders(h)
+	policy := selectCodexFingerprintPolicy(policies)
+	if !policy.enabled {
 		return
 	}
-	identity := resolveCodexOutboundIdentityForAccount(account, overrideUA)
+	identity := resolveCodexOutboundIdentityForAccount(account, overrideUA, policy)
 	h.Set("user-agent", identity.userAgent)
 	h.Set("originator", identity.originator)
 	h.Set("version", identity.version)
diff --git a/backend/internal/service/openai_codex_identity_snapshot.go b/backend/internal/service/openai_codex_identity_snapshot.go
index e500bcd7fd95..7a74361704ad 100644
--- a/backend/internal/service/openai_codex_identity_snapshot.go
+++ b/backend/internal/service/openai_codex_identity_snapshot.go
@@ -43,14 +43,15 @@ type codexIdentitySnapshot struct {
 // resolveCodexIdentitySnapshot computes the identity and fingerprint state
 // from the routed account and the credential source used for this attempt.
 // It intentionally contains no credential, seed, cookie, or proxy URL data.
-func resolveCodexIdentitySnapshot(routed, source *Account, overrideUA string) codexIdentitySnapshot {
+func resolveCodexIdentitySnapshot(routed, source *Account, overrideUA string, policies ...*codexFingerprintPolicy) codexIdentitySnapshot {
+	policy := selectCodexFingerprintPolicy(policies)
 	if source == nil {
 		source = routed
 	}
 
 	snapshot := codexIdentitySnapshot{
 		SchemaVersion:      1,
-		EnforcementEnabled: codexIdentityEnforcement.Load(),
+		EnforcementEnabled: policy.enabled,
 		ForceCodexCLI:      codexForceCLI.Load(),
 		UAOverridePresent:  strings.TrimSpace(overrideUA) != "",
 	}
@@ -69,10 +70,13 @@ func resolveCodexIdentitySnapshot(routed, source *Account, overrideUA string) co
 		if !routed.IsOpenAIOAuthLike() {
 			snapshot.FingerprintModeEffective = string(codexFingerprintOff)
 			snapshot.FingerprintReason = "non_oauth"
+		} else if !policy.enabled {
+			snapshot.FingerprintModeEffective = string(codexFingerprintOff)
+			snapshot.FingerprintReason = "simulation_disabled"
 		} else if snapshot.FingerprintModeConfigured == string(codexFingerprintOff) {
 			snapshot.FingerprintReason = "explicit_off"
 		} else if codexFingerprintModeRequiresSeed(codexFingerprintMode(snapshot.FingerprintModeEffective)) {
-			if _, ok := codexFingerprintSeed(routed.Extra); !ok {
+			if _, ok := codexFingerprintSeed(source.Extra); !ok {
 				snapshot.FingerprintModeEffective = string(codexFingerprintOff)
 				snapshot.FingerprintReason = "seed_missing"
 			}
@@ -90,12 +94,14 @@ func resolveCodexIdentitySnapshot(routed, source *Account, overrideUA string) co
 		}()
 	}
 
-	identity := resolveCodexOutboundIdentityForAccount(source, overrideUA)
+	identity := resolveCodexOutboundIdentityForAccount(source, overrideUA, policy)
 	snapshot.UserAgent = identity.userAgent
 	snapshot.Originator = identity.originator
 	snapshot.Version = identity.version
 	snapshot.IdentitySource = "canonical"
-	if strings.TrimSpace(overrideUA) != "" {
+	if !policy.enabled {
+		snapshot.IdentitySource = "protocol_fallback"
+	} else if strings.TrimSpace(overrideUA) != "" {
 		// The selector rebuilds the effective version. Comparing complete UA
 		// strings would mislabel a valid override carrying an older version.
 		if _, _, ok := openai.PairCodexClientIdentity(overrideUA); ok {
diff --git a/backend/internal/service/openai_codex_identity_test.go b/backend/internal/service/openai_codex_identity_test.go
index 15768e5ea5e0..374853d7a217 100644
--- a/backend/internal/service/openai_codex_identity_test.go
+++ b/backend/internal/service/openai_codex_identity_test.go
@@ -260,7 +260,7 @@ func TestEnforceCodexIdentityHeaders_EnforcementDisabled(t *testing.T) {
 	require.Equal(t, "0.145.2", h.Get("version"))
 }
 
-// 关闭强制统一后，第三方 UA 仍整体回退为规范身份并对齐 version。
+// 关闭模拟后保留已声明的客户端身份，兜底只补缺失头。
 func TestEnforceCodexIdentityHeaders_EnforcementDisabledThirdPartyFallback(t *testing.T) {
 	SetCodexIdentityEnforcementEnabled(false)
 	t.Cleanup(func() { SetCodexIdentityEnforcementEnabled(true) })
@@ -272,9 +272,9 @@ func TestEnforceCodexIdentityHeaders_EnforcementDisabledThirdPartyFallback(t *te
 
 	enforceCodexIdentityHeaders(h)
 
-	require.Equal(t, openai.CodexDefaultOriginator, h.Get("originator"))
-	require.Equal(t, codexCLIUserAgent, h.Get("user-agent"))
-	require.Equal(t, codexCLIVersion, h.Get("version"))
+	require.Equal(t, "opencode", h.Get("originator"))
+	require.Equal(t, "luna/1.0.0", h.Get("user-agent"))
+	require.Equal(t, "2.1.0", h.Get("version"))
 }
 
 // 收口必须幂等：透传等路径可能先后多次经过收口。
diff --git a/backend/internal/service/openai_codex_version_sync_service.go b/backend/internal/service/openai_codex_version_sync_service.go
index c42399cbec46..4d04cab9e2b2 100644
--- a/backend/internal/service/openai_codex_version_sync_service.go
+++ b/backend/internal/service/openai_codex_version_sync_service.go
@@ -141,6 +141,11 @@ func (s *OpenAICodexVersionSyncService) runOnce() {
 		return
 	}
 	s.settingService.InvalidateOpenAICodexClientVersionCache()
+	if s.settingService != nil && s.settingService.settingRepo != nil && publishedCodexFingerprintPolicy.Load() != nil {
+		if err := s.settingService.LoadCodexFingerprintSettings(ctx); err != nil {
+			slog.Warn("openai_codex_fingerprint_policy_refresh_failed", "error", err)
+		}
+	}
 	slog.Info("openai_codex_version_synced", "previous", current, "version", latest)
 }
 
diff --git a/backend/internal/service/openai_compat_model_test.go b/backend/internal/service/openai_compat_model_test.go
index 604be7530758..862f781f5fe1 100644
--- a/backend/internal/service/openai_compat_model_test.go
+++ b/backend/internal/service/openai_compat_model_test.go
@@ -1127,8 +1127,8 @@ func TestForwardAsAnthropic_KeepsInboundHyphenSessionHeaderOverCacheKeyFallback(
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	require.Len(t, upstream.requests, 1)
-	scoped := scopeCodexAccountIdentityValue(account, 0, inboundSession)
-	require.Equal(t, scoped, upstream.requests[0].Header.Get("session-id"), "入站 R 只作用域改写一次，不被 K 回退覆盖")
+	scoped := inboundSession
+	require.Equal(t, scoped, upstream.requests[0].Header.Get("session-id"), "设备模式保留入站 R，不被 K 回退覆盖")
 	require.Equal(t, scoped, upstream.requests[0].Header.Get("thread-id"))
 	require.NotEqual(t, generateSessionUUID(isolateOpenAIUpstreamSessionID(0, account, "stable-cache-key")), upstream.requests[0].Header.Get("session-id"))
 	require.Empty(t, upstream.requests[0].Header.Get("session_id"))
diff --git a/backend/internal/service/openai_gateway_forward.go b/backend/internal/service/openai_gateway_forward.go
index 626dc4eff541..40e4f361aa3e 100644
--- a/backend/internal/service/openai_gateway_forward.go
+++ b/backend/internal/service/openai_gateway_forward.go
@@ -559,10 +559,10 @@ func (s *OpenAIGatewayService) Forward(ctx context.Context, c *gin.Context, acco
 			markDecodedModified()
 		}
 		// 带真实 device_id 时补齐 client_metadata 安装标识，与真实 Codex 对齐（compact 形态不同，跳过）。
-		if !isCompactRequest && applyCodexClientMetadata(decoded, account) {
+		if !isCompactRequest && codexFingerprintPolicyForContext(c, account).enabled && applyCodexClientMetadata(decoded, account) {
 			markDecodedModified()
 		}
-		if !isCompactRequest && applyCodexAccountIdentityClientMetadataMap(decoded, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c)) {
+		if !isCompactRequest && applyCodexAccountIdentityClientMetadataMap(decoded, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account)) {
 			markDecodedModified()
 		}
 		stageCodexFingerprintIDs(c, nil)
@@ -583,6 +583,11 @@ func (s *OpenAIGatewayService) Forward(ctx context.Context, c *gin.Context, acco
 			// 无条件覆写（含 nil）：failover 从收敛账号切到 off 账号时，上一
 			// 账号的 IDs 不得残留（stageCodexFingerprintIDs 注释）。
 			stageCodexFingerprintIDs(c, fpIDs)
+			if fpIDs == nil && codexFingerprintPolicyForContext(c, account).enabled {
+				if alignCodexSandboxClientMetadata(decoded, codexSandboxForUserAgent(s.effectiveCodexOutboundUserAgent(c, account, clientHeaders))) {
+					markDecodedModified()
+				}
+			}
 		}
 		if codexResult.NormalizedModel != "" {
 			upstreamModel = codexResult.NormalizedModel
@@ -1597,7 +1602,7 @@ func (s *OpenAIGatewayService) buildUpstreamRequest(ctx context.Context, c *gin.
 		req.Header.Set("user-agent", CodexCanonicalUserAgent())
 	}
 
-	applyCodexAccountIdentityHeaders(req.Header, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+	applyCodexAccountIdentityHeaders(req.Header, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 	// 指纹收敛：使用 Forward() 中预计算的收敛 ID 改写出站头，与请求体使用同一份 IDs。
 	applyStagedCodexFingerprintHeaders(c, account, req.Header)
 	// 真实 Codex 必带的连字符会话头：入站缺失时以最终请求体的 prompt_cache_key
@@ -1646,7 +1651,14 @@ func (s *OpenAIGatewayService) codexIdentityOverrideUA(account *Account) string
 // 最终出站 UA：UA 来源与构造器/收口点一致——影子账号取 staged 的父账号身份，账号显式 UA
 // 按 ForceCodexCLI 策略生效——否则父/子系统不同或显式 UA 覆盖时 sandbox 会与 UA 分裂。
 func (s *OpenAIGatewayService) resolveStagedCodexFingerprintIDs(c *gin.Context, account *Account, clientHeaders http.Header) *codexFingerprintIDs {
-	ids := resolveCodexFingerprintIDsFromRequest(account, clientHeaders)
+	policy := codexFingerprintPolicyForContext(c, account)
+	source := codexAccountIdentitySource(c, account)
+	scopedHeaders := clientHeaders.Clone()
+	if scopedHeaders == nil {
+		scopedHeaders = http.Header{}
+	}
+	applyCodexAccountIdentityHeaders(scopedHeaders, source, getAPIKeyIDFromContext(c), policy)
+	ids := resolveCodexFingerprintIDsWithSource(account, source, scopedHeaders, policy)
 	if ids == nil {
 		return nil
 	}
@@ -1661,6 +1673,13 @@ func (s *OpenAIGatewayService) resolveStagedCodexFingerprintIDs(c *gin.Context,
 //     保留构造器写入的 UA——ForceCodexCLI 时为规范 UA，否则账号显式 UA，否则客户端 UA；
 //     不合法的 UA 回落规范身份。该全局开关与 fingerprint mode 是不同门控。
 func (s *OpenAIGatewayService) effectiveCodexOutboundUserAgent(c *gin.Context, account *Account, clientHeaders http.Header) string {
+	policy := codexFingerprintPolicyForContext(c, account)
+	if !policy.enabled {
+		if ua := clientHeaders.Get("user-agent"); ua != "" {
+			return ua
+		}
+		return codexCLIUserAgent
+	}
 	if isOpenAICompatMessagesBridgeContext(c) {
 		// 兼容 Messages 桥接：构造器删除 originator，终态收口早退，不做 ForAccount 统一；
 		// 线上 UA 就是构造器写入的值（ForceCodexCLI 规范 UA > 账号显式 UA > 客户端 UA），
@@ -1677,8 +1696,8 @@ func (s *OpenAIGatewayService) effectiveCodexOutboundUserAgent(c *gin.Context, a
 		return ""
 	}
 	overrideUA := s.codexIdentityOverrideUA(account)
-	if codexIdentityEnforcement.Load() {
-		return resolveCodexOutboundIdentityForAccount(codexAccountIdentitySource(c, account), overrideUA).userAgent
+	if policy.enabled {
+		return resolveCodexOutboundIdentityForAccount(codexAccountIdentitySource(c, account), overrideUA, policy).userAgent
 	}
 	candidate := overrideUA
 	if candidate == "" {
@@ -1706,6 +1725,9 @@ func (s *OpenAIGatewayService) stageCodexFingerprintForWSFrame(c *gin.Context, a
 	ids := s.resolveStagedCodexFingerprintIDs(c, account, clientHeaders)
 	stageCodexFingerprintIDs(c, ids)
 	if ids == nil {
+		if codexFingerprintPolicyForContext(c, account).enabled && account != nil && account.IsOpenAIOAuthLike() {
+			return alignCodexSandboxClientMetadataRaw(frame, codexSandboxForUserAgent(s.effectiveCodexOutboundUserAgent(c, account, clientHeaders)))
+		}
 		return frame, nil
 	}
 	next, changed, err := applyCodexFingerprintClientMetadataRaw(frame, ids)
diff --git a/backend/internal/service/openai_gateway_passthrough.go b/backend/internal/service/openai_gateway_passthrough.go
index 2a9a91c373af..6bff6f7a0047 100644
--- a/backend/internal/service/openai_gateway_passthrough.go
+++ b/backend/internal/service/openai_gateway_passthrough.go
@@ -196,7 +196,7 @@ func (s *OpenAIGatewayService) forwardOpenAIPassthrough(
 
 		// 账号作用域：body client_metadata / prompt_cache_key 与出站头共用同一映射，
 		// 否则头已按账号改写而 body 仍是客户端原值，同一请求会暴露两套身份。
-		accountScopedBody, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(body, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+		accountScopedBody, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(body, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 		if scopeErr != nil {
 			return nil, scopeErr
 		}
@@ -225,6 +225,13 @@ func (s *OpenAIGatewayService) forwardOpenAIPassthrough(
 				}
 			}
 			stageCodexFingerprintIDs(c, fpIDs)
+			if fpIDs == nil && codexFingerprintPolicyForContext(c, account).enabled {
+				var alignErr error
+				body, alignErr = alignCodexSandboxClientMetadataRaw(body, codexSandboxForUserAgent(s.effectiveCodexOutboundUserAgent(c, account, clientHeaders)))
+				if alignErr != nil {
+					return nil, alignErr
+				}
+			}
 		}
 	}
 	if account != nil && account.IsOpenAI() {
@@ -815,7 +822,7 @@ func (s *OpenAIGatewayService) buildUpstreamRequestOpenAIPassthrough(
 	if s.cfg != nil && s.cfg.Gateway.ForceCodexCLI {
 		req.Header.Set("user-agent", CodexCanonicalUserAgent())
 	}
-	applyCodexAccountIdentityHeaders(req.Header, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+	applyCodexAccountIdentityHeaders(req.Header, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 	// 指纹收敛：使用 forwardOpenAIPassthrough 中预计算的收敛 ID 改写出站头，
 	// 与请求体 client_metadata 共享同一份 IDs（与非透传路径相同的相对位置：
 	// 会话隔离之后、终态身份收口之前）。
diff --git a/backend/internal/service/openai_gateway_service.go b/backend/internal/service/openai_gateway_service.go
index 2157012c0d9b..e8a36b344ce5 100644
--- a/backend/internal/service/openai_gateway_service.go
+++ b/backend/internal/service/openai_gateway_service.go
@@ -61,7 +61,7 @@ const (
 	// 陈旧版本会被优先丢弃（HTTP 200 + 流内 server_is_overloaded）；非官方客户端配不出
 	// 官方身份时整体回退到本常量，因此它必须跟随官方 CLI 的当前发布版本，
 	// 落后多个版本会让这些请求稳定落在被优先丢弃的一侧。
-	codexCLIVersion = "0.146.0"
+	codexCLIVersion = "0.161.0"
 	// Codex 限额快照仅用于后台展示/诊断，不需要每个成功请求都立即落库。
 	openAICodexSnapshotPersistMinInterval = 30 * time.Second
 	// 配额自动暂停时，超过该时长仍未刷新的 used% 快照视为陈旧，不再据此暂停账号。
diff --git a/backend/internal/service/openai_oauth_passthrough_test.go b/backend/internal/service/openai_oauth_passthrough_test.go
index 7f1d79237de8..b48bcf6b0db5 100644
--- a/backend/internal/service/openai_oauth_passthrough_test.go
+++ b/backend/internal/service/openai_oauth_passthrough_test.go
@@ -2670,7 +2670,7 @@ func TestOpenAIGatewayService_CodexFingerprintHTTPTransformedHeaderBodyParityAnd
 	require.True(t, ok)
 	wantInstall := resolveConvergedInstallationID(account, seed)
 	wantSession := resolveConvergedSessionID(seed)
-	wantThread := resolveConvergedThreadID(seed, "header-session")
+	wantThread := resolveConvergedThreadID(seed, scopeCodexAccountIdentityValue(account, 0, "body-thread"))
 
 	require.Empty(t, upstream.lastReq.Header.Get("x-codex-installation-id"), "installation id 只在 body client_metadata")
 	require.Equal(t, wantInstall, gjson.GetBytes(upstream.lastBody, "client_metadata.x-codex-installation-id").String())
@@ -2733,7 +2733,7 @@ func TestOpenAIGatewayService_CodexFingerprintHTTPRawPassthroughHeaderBodyParity
 	require.True(t, ok)
 	wantInstall := resolveConvergedInstallationID(account, seed)
 	wantSession := resolveConvergedSessionID(seed)
-	wantThread := resolveConvergedThreadID(seed, "header-session")
+	wantThread := resolveConvergedThreadID(seed, scopeCodexAccountIdentityValue(account, 0, "body-thread"))
 
 	require.Empty(t, upstream.lastReq.Header.Get("x-codex-installation-id"), "installation id 只在 body client_metadata")
 	require.Equal(t, wantInstall, gjson.GetBytes(upstream.lastBody, "client_metadata.x-codex-installation-id").String())
diff --git a/backend/internal/service/openai_ws_forwarder_ingress.go b/backend/internal/service/openai_ws_forwarder_ingress.go
index 720cec14aa42..bb291c727469 100644
--- a/backend/internal/service/openai_ws_forwarder_ingress.go
+++ b/backend/internal/service/openai_ws_forwarder_ingress.go
@@ -238,6 +238,7 @@ func (s *OpenAIGatewayService) ProxyResponsesWebSocketFromClient(
 	}
 
 	parseClientPayload := func(turn int, raw []byte) (openAIWSClientPayload, error) {
+		stageCodexFingerprintPolicy(c, account)
 		trimmed := bytes.TrimSpace(raw)
 		if len(trimmed) == 0 {
 			return openAIWSClientPayload{}, NewOpenAIWSClientCloseError(coderws.StatusPolicyViolation, "empty websocket request payload", nil)
@@ -336,7 +337,7 @@ func (s *OpenAIGatewayService) ProxyResponsesWebSocketFromClient(
 			normalized = next
 		}
 		accountIdentitySourceRaw := append([]byte(nil), normalized...)
-		accountScopedPayload, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(normalized, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+		accountScopedPayload, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(normalized, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 		if scopeErr != nil {
 			return openAIWSClientPayload{}, NewOpenAIWSClientCloseError(coderws.StatusPolicyViolation, "invalid websocket identity metadata", scopeErr)
 		}
@@ -864,9 +865,10 @@ func (s *OpenAIGatewayService) ProxyResponsesWebSocketFromClient(
 	}
 	turnState = strings.TrimSpace(wsHeaders.Get(openAIWSTurnStateHeader))
 	baseAcquireReq := openAIWSAcquireRequest{
-		Account: account,
-		WSURL:   wsURL,
-		Headers: wsHeaders,
+		FingerprintPolicy: codexFingerprintPolicyForContext(c, account),
+		Account:           account,
+		WSURL:             wsURL,
+		Headers:           wsHeaders,
 		HeadersFactory: func(factoryCtx context.Context, headers http.Header) (http.Header, error) {
 			return s.refreshOpenAIAgentIdentityHeaders(factoryCtx, account, headers)
 		},
@@ -1777,6 +1779,15 @@ func (s *OpenAIGatewayService) ProxyResponsesWebSocketFromClient(
 		if headerErr != nil {
 			return headerErr
 		}
+		if sessionLease != nil && baseAcquireReq.FingerprintPolicy != nil &&
+			baseAcquireReq.FingerprintPolicy.revision != codexFingerprintPolicyForContext(c, account).revision {
+			// The preceding turn is complete. Ask the client to reopen so a new
+			// handshake cannot inherit this socket's old identity or anchor.
+			resetSessionLease(false)
+			return NewOpenAIWSClientCloseError(coderws.StatusTryAgainLater, openAIWSNonInitialTurnRetryCloseReason,
+				errors.New("codex fingerprint settings changed; a new handshake is required"))
+		}
+		baseAcquireReq.FingerprintPolicy = codexFingerprintPolicyForContext(c, account)
 		baseAcquireReq.Headers = finalHeaders
 		if borrowTurn == nil {
 			borrowPreviousID := currentPreviousResponseID
diff --git a/backend/internal/service/openai_ws_forwarder_ingress_session_test.go b/backend/internal/service/openai_ws_forwarder_ingress_session_test.go
index 1caeeed317e5..20d6d854f265 100644
--- a/backend/internal/service/openai_ws_forwarder_ingress_session_test.go
+++ b/backend/internal/service/openai_ws_forwarder_ingress_session_test.go
@@ -1592,16 +1592,14 @@ func TestOpenAIGatewayService_ProxyResponsesWebSocketFromClient_PassthroughHeade
 	}
 
 	require.Empty(t, captureDialer.lastHeaders.Get("session_id"), "真实 Codex 不发下划线 session_id")
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "pcache_passthrough"), captureDialer.lastHeaders.Get("session-id"), "只做一次账号作用域映射")
+	require.Equal(t, "pcache_passthrough", captureDialer.lastHeaders.Get("session-id"), "设备模式保留客户端会话标识")
 	require.Empty(t, captureDialer.lastHeaders.Get(openAIWSTurnStateHeader), "client turn state without account provenance must fail closed")
 	// 握手 turn metadata 经指纹层重建：非 JSON 的客户端值被替换为最小合法 metadata，
 	// installation 收敛为账号级设备，sandbox 跟随最终 UA 的系统。
 	handshakeTurnMetadata := captureDialer.lastHeaders.Get(openAIWSTurnMetadataHeader)
 	require.True(t, gjson.Valid(handshakeTurnMetadata), handshakeTurnMetadata)
 	require.Equal(t, resolveConvergedInstallationID(account, "5d2e8c1a-7b4f-4e3d-9a6c-0f1e2d3c4b5a"), gjson.Get(handshakeTurnMetadata, "installation_id").String())
-	passthroughIdentity, ok := account.CodexClientIdentity()
-	require.True(t, ok)
-	require.Equal(t, passthroughIdentity.Sandbox, gjson.Get(handshakeTurnMetadata, "sandbox").String())
+	require.False(t, gjson.Get(handshakeTurnMetadata, "sandbox").Exists(), "未提供实际沙箱时不生成 OS 推断值")
 	require.Len(t, upstreamConn.writes, 2)
 	forwarded := requestToJSONString(upstreamConn.writes[0])
 	require.Equal(t, gjson.Get(forwarded, "prompt_cache_key").String(), captureDialer.lastHeaders.Get("session-id"), "握手回退与首帧 prompt_cache_key 同源")
diff --git a/backend/internal/service/openai_ws_forwarder_payload.go b/backend/internal/service/openai_ws_forwarder_payload.go
index cacdb34a1e43..a364db29b62c 100644
--- a/backend/internal/service/openai_ws_forwarder_payload.go
+++ b/backend/internal/service/openai_ws_forwarder_payload.go
@@ -136,7 +136,7 @@ func (s *OpenAIGatewayService) buildOpenAIWSHeaders(
 	if metadata := strings.TrimSpace(turnMetadata); metadata != "" {
 		headers.Set(openAIWSTurnMetadataHeader, metadata)
 	}
-	applyCodexAccountIdentityHeaders(headers, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+	applyCodexAccountIdentityHeaders(headers, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 	applyStagedCodexFingerprintHeaders(c, account, headers)
 	if account != nil && account.UsesOpenAICodexProtocol() {
 		// 入站缺失连字符会话头时补齐：来自帧体 prompt_cache_key 的回退值由调用方传入最终线上值
diff --git a/backend/internal/service/openai_ws_forwarder_success_test.go b/backend/internal/service/openai_ws_forwarder_success_test.go
index 59eaf5cad3c1..e56d6f4e5cbb 100644
--- a/backend/internal/service/openai_ws_forwarder_success_test.go
+++ b/backend/internal/service/openai_ws_forwarder_success_test.go
@@ -464,10 +464,10 @@ func TestOpenAIGatewayService_BuildOpenAIWSHeadersDeviceModePreservesNamespacedC
 
 	require.NoError(t, err)
 	require.Empty(t, headers.Get("x-codex-installation-id"), "installation id 只在 body client_metadata")
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "client-window"), headers.Get("x-codex-window-id"))
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "client-session"), headers.Get("session-id"))
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "client-thread"), headers.Get("thread-id"))
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "client-request"), headers.Get("x-client-request-id"))
+	require.Equal(t, "client-window", headers.Get("x-codex-window-id"))
+	require.Equal(t, "client-session", headers.Get("session-id"))
+	require.Equal(t, "client-thread", headers.Get("thread-id"))
+	require.Equal(t, "client-request", headers.Get("x-client-request-id"))
 }
 
 func TestLogOpenAIWSBindResponseAccountWarn(t *testing.T) {
@@ -1158,7 +1158,7 @@ func TestOpenAIGatewayService_Forward_WSv2_CodexFingerprintHandshakeBodyParityAn
 	require.True(t, ok)
 	wantInstall := resolveConvergedInstallationID(account, seed)
 	wantSession := resolveConvergedSessionID(seed)
-	wantThread := resolveConvergedThreadID(seed, "header-session")
+	wantThread := resolveConvergedThreadID(seed, scopeCodexAccountIdentityValue(account, 0, "body-thread"))
 	payloadJSON := requestToJSONString(captureConn.lastWrite)
 
 	require.Empty(t, captureDialer.lastHeaders.Get("x-codex-installation-id"), "installation id 只在 body client_metadata")
@@ -1182,7 +1182,7 @@ func TestOpenAIGatewayService_Forward_WSv2_CodexFingerprintHandshakeBodyParityAn
 	require.Equal(t, wantThread, gjson.Get(bodyTurnMetadata, "thread_id").String())
 	require.Equal(t, wantSession, gjson.Get(headerTurnMetadata, "session_id").String())
 	require.Equal(t, gjson.Get(bodyTurnMetadata, "turn_id").String(), gjson.Get(headerTurnMetadata, "turn_id").String())
-	require.NotZero(t, gjson.Get(bodyTurnMetadata, "turn_started_at_unix_ms").Int())
+	require.False(t, gjson.Get(bodyTurnMetadata, "turn_started_at_unix_ms").Exists(), "未提供的真实时间不生成")
 	require.Equal(t,
 		gjson.Get(bodyTurnMetadata, "turn_started_at_unix_ms").Int(),
 		gjson.Get(headerTurnMetadata, "turn_started_at_unix_ms").Int(),
diff --git a/backend/internal/service/openai_ws_forwarder_v2.go b/backend/internal/service/openai_ws_forwarder_v2.go
index 69fc1f33c241..186f612e9c88 100644
--- a/backend/internal/service/openai_ws_forwarder_v2.go
+++ b/backend/internal/service/openai_ws_forwarder_v2.go
@@ -74,7 +74,10 @@ func (s *OpenAIGatewayService) forwardOpenAIWSV2(
 		turnState = strings.TrimSpace(c.GetHeader(openAIWSTurnStateHeader))
 		turnMetadata = strings.TrimSpace(c.GetHeader(openAIWSTurnMetadataHeader))
 	}
-	setOpenAIWSTurnMetadata(payload, turnMetadata)
+	clientMetadata, _ := payload["client_metadata"].(map[string]any)
+	if stringMetadataValue(clientMetadata, openAIWSTurnMetadataHeader) == "" {
+		setOpenAIWSTurnMetadata(payload, turnMetadata)
+	}
 	applyStagedCodexFingerprintClientMetadata(c, account, payload)
 	wirePayload, promptErr := s.finalizeResponsesForSend(c, account, payloadAsJSONBytes(payload))
 	if promptErr != nil {
@@ -251,9 +254,10 @@ func (s *OpenAIGatewayService) forwardOpenAIWSV2(
 	defer acquireCancel()
 
 	acquireReq := openAIWSAcquireRequest{
-		Account: account,
-		WSURL:   wsURL,
-		Headers: wsHeaders,
+		FingerprintPolicy: codexFingerprintPolicyForContext(c, account),
+		Account:           account,
+		WSURL:             wsURL,
+		Headers:           wsHeaders,
 		HeadersFactory: func(factoryCtx context.Context, headers http.Header) (http.Header, error) {
 			return s.refreshOpenAIAgentIdentityHeaders(factoryCtx, account, headers)
 		},
diff --git a/backend/internal/service/openai_ws_http_bridge_resume_test.go b/backend/internal/service/openai_ws_http_bridge_resume_test.go
index 3dc427919286..21afea49ebcf 100644
--- a/backend/internal/service/openai_ws_http_bridge_resume_test.go
+++ b/backend/internal/service/openai_ws_http_bridge_resume_test.go
@@ -253,11 +253,11 @@ func TestOpenAIWSHTTPBridgeLaterTurn429RetriesCurrentTurnOnReplacementAccount(t
 	}
 	require.Len(t, upstream.bodies, 3)
 	require.Contains(t, string(upstream.bodies[0]), "first")
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "client-session"), gjson.GetBytes(upstream.bodies[1], "client_metadata.session_id").String())
-	require.Equal(t, scopeCodexAccountIdentityValue(account, 0, "client-thread"), gjson.GetBytes(upstream.bodies[1], "client_metadata.thread_id").String())
+	require.Equal(t, "client-session", gjson.GetBytes(upstream.bodies[1], "client_metadata.session_id").String())
+	require.Equal(t, "client-thread", gjson.GetBytes(upstream.bodies[1], "client_metadata.thread_id").String())
 	require.NotContains(t, string(upstream.bodies[2]), "previous_response_id")
 	require.Contains(t, string(upstream.bodies[2]), "second")
-	require.Equal(t, scopeCodexAccountIdentityValue(&nextAccount, 0, "client-session"), gjson.GetBytes(upstream.bodies[2], "client_metadata.session_id").String())
-	require.Equal(t, scopeCodexAccountIdentityValue(&nextAccount, 0, "client-thread"), gjson.GetBytes(upstream.bodies[2], "client_metadata.thread_id").String())
+	require.Equal(t, "client-session", gjson.GetBytes(upstream.bodies[2], "client_metadata.session_id").String())
+	require.Equal(t, "client-thread", gjson.GetBytes(upstream.bodies[2], "client_metadata.thread_id").String())
 	require.Empty(t, upstream.requests[2].Header.Get(openAIWSTurnStateHeader))
 }
diff --git a/backend/internal/service/openai_ws_pool.go b/backend/internal/service/openai_ws_pool.go
index 8e41d323e8df..524efd71acd3 100644
--- a/backend/internal/service/openai_ws_pool.go
+++ b/backend/internal/service/openai_ws_pool.go
@@ -68,9 +68,10 @@ func (e *openAIWSDialError) Unwrap() error {
 }
 
 type openAIWSAcquireRequest struct {
-	Account *Account
-	WSURL   string
-	Headers http.Header
+	FingerprintPolicy *codexFingerprintPolicy
+	Account           *Account
+	WSURL             string
+	Headers           http.Header
 	// HeadersFactory is evaluated inside dialConn. It exists so credentials
 	// whose authorization is per-dial (Agent Identity) are never cached in
 	// lastAcquire or delayed prewarm state.
@@ -87,6 +88,11 @@ type openAIWSAcquireRequest struct {
 }
 
 type openAIWSHandshakeCompatibilityKey struct {
+	codexPolicyRevision uint64
+	codexMode           string
+	userAgent           string
+	originator          string
+	version             string
 	anchorScope         string
 	betaFeatures        string
 	codexInstallationID string
@@ -2349,7 +2355,7 @@ func sameOpenAIWSPrewarmTarget(a, b openAIWSAcquireRequest) bool {
 }
 
 func normalizeOpenAIWSAcquireCompatibility(req openAIWSAcquireRequest) openAIWSHandshakeCompatibilityKey {
-	key := normalizeOpenAIWSHandshakeCompatibility(req.Account, req.Headers)
+	key := normalizeOpenAIWSHandshakeCompatibility(req.Account, req.Headers, req.FingerprintPolicy)
 	key.anchorScope = stringsTrim(req.AnchorScope)
 	return key
 }
@@ -2379,11 +2385,25 @@ func normalizeOpenAIWSBetaFeatures(headers http.Header) string {
 	return strings.Join(normalized, ",")
 }
 
-func normalizeOpenAIWSHandshakeCompatibility(account *Account, headers http.Header) openAIWSHandshakeCompatibilityKey {
+func normalizeOpenAIWSHandshakeCompatibility(account *Account, headers http.Header, policies ...*codexFingerprintPolicy) openAIWSHandshakeCompatibilityKey {
+	policy := selectCodexFingerprintPolicy(policies)
+	if len(policies) == 0 || policies[0] == nil {
+		policy = currentCodexFingerprintPolicyForAccount(account)
+	}
 	key := openAIWSHandshakeCompatibilityKey{
 		betaFeatures: normalizeOpenAIWSBetaFeatures(headers),
 	}
-	mode := activeCodexFingerprintMode(account)
+	if account != nil && account.IsOpenAIOAuthLike() {
+		key.codexPolicyRevision = policy.revision
+		key.codexMode = string(account.GetCodexFingerprintMode())
+		key.userAgent = headers.Get("user-agent")
+		key.originator = headers.Get("originator")
+		key.version = headers.Get("version")
+	}
+	if !policy.enabled || account == nil {
+		return key
+	}
+	mode := activeCodexFingerprintMode(account, policy)
 	if mode == codexFingerprintOff {
 		return key
 	}
@@ -2399,8 +2419,9 @@ func normalizeOpenAIWSHandshakeCompatibility(account *Account, headers http.Head
 	return key
 }
 
-func activeCodexFingerprintMode(account *Account) codexFingerprintMode {
-	if account == nil || account.GetCodexFingerprintMode() == codexFingerprintOff {
+func activeCodexFingerprintMode(account *Account, policies ...*codexFingerprintPolicy) codexFingerprintMode {
+	policy := selectCodexFingerprintPolicy(policies)
+	if account == nil || !policy.enabled || account.GetCodexFingerprintMode() == codexFingerprintOff {
 		return codexFingerprintOff
 	}
 	if _, ok := codexFingerprintSeed(account.Extra); !ok {
diff --git a/backend/internal/service/openai_ws_v2_passthrough_adapter.go b/backend/internal/service/openai_ws_v2_passthrough_adapter.go
index 1ea826ac14df..97f9c404f71e 100644
--- a/backend/internal/service/openai_ws_v2_passthrough_adapter.go
+++ b/backend/internal/service/openai_ws_v2_passthrough_adapter.go
@@ -786,7 +786,7 @@ func (s *OpenAIGatewayService) proxyResponsesWebSocketV2PassthroughAttempt(
 	} else if changed {
 		firstClientMessage = normalized
 	}
-	accountScopedFirst, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(firstClientMessage, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+	accountScopedFirst, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(firstClientMessage, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 	if scopeErr != nil {
 		return NewOpenAIWSClientCloseError(coderws.StatusPolicyViolation, "invalid websocket identity metadata", scopeErr)
 	}
@@ -798,6 +798,7 @@ func (s *OpenAIGatewayService) proxyResponsesWebSocketV2PassthroughAttempt(
 		return NewOpenAIWSClientCloseError(coderws.StatusPolicyViolation, "invalid websocket identity metadata", fingerprintErr)
 	}
 	firstClientMessage = fingerprintFirst
+	connectionFingerprintPolicy := codexFingerprintPolicyForContext(c, account)
 	usageMeta := newOpenAIWSPassthroughUsageMeta(initialRequestModel, firstClientMessage)
 	updatedFirst, blocked, policyErr := s.applyOpenAIFastPolicyToWSResponseCreate(ctx, account, capturedSessionModel, firstClientMessage)
 	if policyErr != nil {
@@ -1079,6 +1080,10 @@ func (s *OpenAIGatewayService) proxyResponsesWebSocketV2PassthroughAttempt(
 			responseCreateAt := time.Time{}
 			acceptedTurn := false
 			if isResponseCreate {
+				if account.IsOpenAIOAuthLike() && currentCodexFingerprintPolicyForAccount(account).revision != connectionFingerprintPolicy.revision {
+					return payload, nil, NewOpenAIWSClientCloseError(coderws.StatusTryAgainLater, openAIWSNonInitialTurnRetryCloseReason,
+						errors.New("codex fingerprint settings changed; a new handshake is required"))
+				}
 				responseCreateAt = time.Now()
 				if !turnLifecycle.beginResponseCreate(clientFrameConn.markTurnStarted) {
 					err := errors.New("overlapping response.create is not supported")
@@ -1101,7 +1106,7 @@ func (s *OpenAIGatewayService) proxyResponsesWebSocketV2PassthroughAttempt(
 				}
 			}
 			if isResponseCreate || eventType == "session.update" {
-				accountScopedPayload, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(payload, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c))
+				accountScopedPayload, accountScoped, scopeErr := applyCodexAccountIdentityClientMetadataRaw(payload, codexAccountIdentitySource(c, account), getAPIKeyIDFromContext(c), codexFingerprintPolicyForContext(c, account))
 				if scopeErr != nil {
 					return payload, nil, NewOpenAIWSClientCloseError(coderws.StatusPolicyViolation, "invalid websocket identity metadata", scopeErr)
 				}
diff --git a/backend/internal/service/setting_codex_fingerprint.go b/backend/internal/service/setting_codex_fingerprint.go
new file mode 100644
index 000000000000..dde3366e6bf8
--- /dev/null
+++ b/backend/internal/service/setting_codex_fingerprint.go
@@ -0,0 +1,278 @@
+package service
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"github.com/Wei-Shaw/sub2api/internal/pkg/openai"
+	"github.com/gin-gonic/gin"
+)
+
+const SettingKeyCodexFingerprintEnabled = "codex_fingerprint_enabled"
+
+type CodexFingerprintSettings struct {
+	Enabled                bool   `json:"enabled"`
+	UserAgent              string `json:"user_agent"`
+	ClientVersion          string `json:"client_version"`
+	VersionAutoSyncEnabled bool   `json:"version_auto_sync_enabled"`
+}
+
+type CodexFingerprintSettingsView struct {
+	CodexFingerprintSettings
+	SyncedVersion      string `json:"synced_version"`
+	EffectiveVersion   string `json:"effective_version"`
+	EffectiveUserAgent string `json:"effective_user_agent"`
+}
+
+// An immutable policy is shared by the body, headers and connection selection of
+// one upstream attempt. Publishing new settings never mutates an active attempt.
+type codexFingerprintPolicy struct {
+	enabled   bool
+	userAgent string
+	revision  uint64
+}
+
+var publishedCodexFingerprintPolicy atomic.Pointer[codexFingerprintPolicy]
+
+var codexFingerprintAccountEpochs sync.Map
+var codexFingerprintAccountEpoch atomic.Uint64
+
+// Account mode edits invalidate only that account's subsequent WS handshakes.
+func notifyCodexFingerprintAccountChanged(accountID int64) {
+	codexFingerprintAccountEpochs.Store(accountID, codexFingerprintAccountEpoch.Add(1))
+}
+
+func currentCodexFingerprintPolicyForAccount(account *Account) *codexFingerprintPolicy {
+	policy := currentCodexFingerprintPolicy()
+	if account == nil {
+		return policy
+	}
+	if value, ok := codexFingerprintAccountEpochs.Load(account.ID); ok {
+		epoch, valid := value.(uint64)
+		if !valid {
+			return policy
+		}
+		copy := *policy
+		copy.revision ^= epoch * 0x9e3779b97f4a7c15
+		return &copy
+	}
+	return policy
+}
+
+func codexFingerprintPolicyRevision(enabled bool, userAgent string) uint64 {
+	digest := sha256.Sum256([]byte(strconv.FormatBool(enabled) + "\x00" + userAgent))
+	return binary.BigEndian.Uint64(digest[:8])
+}
+
+func currentCodexFingerprintPolicy() *codexFingerprintPolicy {
+	if policy := publishedCodexFingerprintPolicy.Load(); policy != nil {
+		return policy
+	}
+	// Keep standalone tools and existing test construction working without Wire.
+	ua := codexCanonicalUserAgent()
+	enabled := codexIdentityEnforcement.Load()
+	return &codexFingerprintPolicy{enabled: enabled, userAgent: ua, revision: codexFingerprintPolicyRevision(enabled, ua)}
+}
+
+type stagedCodexFingerprintPolicy struct {
+	accountID int64
+	policy    *codexFingerprintPolicy
+}
+
+const codexFingerprintPolicyContextKey = "codex_fingerprint_policy"
+
+func stageCodexFingerprintPolicy(c *gin.Context, account *Account) *codexFingerprintPolicy {
+	policy := currentCodexFingerprintPolicyForAccount(account)
+	if c != nil && account != nil {
+		c.Set(codexFingerprintPolicyContextKey, stagedCodexFingerprintPolicy{accountID: account.ID, policy: policy})
+	}
+	return policy
+}
+
+func codexFingerprintPolicyForContext(c *gin.Context, account *Account) *codexFingerprintPolicy {
+	if c != nil && account != nil {
+		if value, ok := c.Get(codexFingerprintPolicyContextKey); ok {
+			if staged, ok := value.(stagedCodexFingerprintPolicy); ok && staged.accountID == account.ID {
+				return staged.policy
+			}
+		}
+	}
+	return stageCodexFingerprintPolicy(c, account)
+}
+
+func selectCodexFingerprintPolicy(policies []*codexFingerprintPolicy) *codexFingerprintPolicy {
+	if len(policies) > 0 && policies[0] != nil {
+		return policies[0]
+	}
+	return currentCodexFingerprintPolicy()
+}
+
+func DecodeCodexFingerprintSettings(raw []byte) (CodexFingerprintSettings, error) {
+	var config CodexFingerprintSettings
+	if err := decodeCodexFingerprintObject(raw, &config, "enabled", "user_agent", "client_version", "version_auto_sync_enabled"); err != nil {
+		return config, err
+	}
+	config.UserAgent = strings.TrimSpace(config.UserAgent)
+	config.ClientVersion = strings.TrimSpace(config.ClientVersion)
+	if len(config.UserAgent) > 512 || strings.ContainsAny(config.UserAgent, "\r\n") {
+		return config, errors.New("user_agent must be a valid single-line Codex User-Agent of at most 512 bytes")
+	}
+	if config.ClientVersion != "" && NormalizeCodexClientVersion(config.ClientVersion) == "" {
+		return config, errors.New("client_version must be empty or a valid Codex version")
+	}
+	return config, nil
+}
+
+func decodeCodexFingerprintObject(raw []byte, target any, keys ...string) error {
+	var fields map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &fields); err != nil || fields == nil || len(fields) != len(keys) {
+		return errors.New("expected a JSON object with exactly the supported settings")
+	}
+	for _, key := range keys {
+		value, ok := fields[key]
+		if !ok || bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
+			return fmt.Errorf("%s is required and must not be null", key)
+		}
+	}
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		return err
+	}
+	if err := decoder.Decode(new(any)); err != io.EOF {
+		return errors.New("expected one JSON object")
+	}
+	return nil
+}
+
+var codexFingerprintSettingKeys = []string{
+	SettingKeyCodexFingerprintEnabled, SettingKeyOpenAICodexUserAgent,
+	SettingKeyOpenAICodexClientVersion, SettingKeyOpenAICodexVersionAutoSyncEnabled,
+	SettingKeyOpenAICodexClientVersionSynced,
+}
+
+func (s *SettingService) codexFingerprintSettingsFromValues(values map[string]string) (CodexFingerprintSettingsView, error) {
+	config := CodexFingerprintSettings{Enabled: s.cfg == nil || !s.cfg.Gateway.DisableCodexIdentityEnforcement, VersionAutoSyncEnabled: true}
+	if raw := values[SettingKeyCodexFingerprintEnabled]; raw != "" {
+		value, err := strconv.ParseBool(raw)
+		if err != nil {
+			return CodexFingerprintSettingsView{}, fmt.Errorf("invalid %s", SettingKeyCodexFingerprintEnabled)
+		}
+		config.Enabled = value
+	}
+	config.UserAgent = values[SettingKeyOpenAICodexUserAgent]
+	config.ClientVersion = values[SettingKeyOpenAICodexClientVersion]
+	if raw := strings.TrimSpace(values[SettingKeyOpenAICodexVersionAutoSyncEnabled]); raw != "" {
+		config.VersionAutoSyncEnabled = raw == "true"
+	}
+	synced := NormalizeCodexClientVersion(values[SettingKeyOpenAICodexClientVersionSynced])
+	version := NormalizeCodexClientVersion(config.ClientVersion)
+	if version == "" {
+		version = synced
+	}
+	if version == "" || CompareVersions(version, codexUpstreamMinVersion) < 0 {
+		version = codexCLIVersion
+	}
+	ua := buildCodexCLIUserAgent(version)
+	if _, paired, ok := openai.PairCodexClientIdentity(config.UserAgent); ok {
+		if rebuilt := openai.SetCodexUserAgentVersion(paired, version); rebuilt != "" {
+			ua = rebuilt
+		}
+	}
+	return CodexFingerprintSettingsView{CodexFingerprintSettings: config, SyncedVersion: synced, EffectiveVersion: version, EffectiveUserAgent: ua}, nil
+}
+
+func publishCodexFingerprintSettings(view CodexFingerprintSettingsView) {
+	publishedCodexFingerprintPolicy.Store(&codexFingerprintPolicy{
+		enabled: view.Enabled, userAgent: view.EffectiveUserAgent,
+		revision: codexFingerprintPolicyRevision(view.Enabled, view.EffectiveUserAgent),
+	})
+}
+
+func (s *SettingService) GetCodexFingerprintSettings(ctx context.Context) (CodexFingerprintSettingsView, error) {
+	values, err := s.settingRepo.GetMultiple(ctx, codexFingerprintSettingKeys)
+	if err != nil {
+		return CodexFingerprintSettingsView{}, err
+	}
+	return s.codexFingerprintSettingsFromValues(values)
+}
+
+func (s *SettingService) LoadCodexFingerprintSettings(ctx context.Context) error {
+	s.codexFingerprintMu.Lock()
+	defer s.codexFingerprintMu.Unlock()
+	view, err := s.GetCodexFingerprintSettings(ctx)
+	if err != nil {
+		return err
+	}
+	publishCodexFingerprintSettings(view)
+	return nil
+}
+
+func (s *SettingService) UpdateCodexFingerprintSettings(ctx context.Context, config CodexFingerprintSettings) (CodexFingerprintSettingsView, error) {
+	s.codexFingerprintMu.Lock()
+	defer s.codexFingerprintMu.Unlock()
+	values, err := s.settingRepo.GetMultiple(ctx, codexFingerprintSettingKeys)
+	if err != nil {
+		return CodexFingerprintSettingsView{}, err
+	}
+	updates := map[string]string{
+		SettingKeyCodexFingerprintEnabled:           strconv.FormatBool(config.Enabled),
+		SettingKeyOpenAICodexUserAgent:              config.UserAgent,
+		SettingKeyOpenAICodexClientVersion:          config.ClientVersion,
+		SettingKeyOpenAICodexVersionAutoSyncEnabled: strconv.FormatBool(config.VersionAutoSyncEnabled),
+	}
+	for key, value := range updates {
+		values[key] = value
+	}
+	view, err := s.codexFingerprintSettingsFromValues(values)
+	if err != nil {
+		return CodexFingerprintSettingsView{}, err
+	}
+	if err := s.settingRepo.SetMultiple(ctx, updates); err != nil {
+		return CodexFingerprintSettingsView{}, err
+	}
+	s.InvalidateOpenAICodexClientVersionCache()
+	s.openAICodexUASF.Forget("openai_codex_user_agent")
+	s.openAICodexUACache.Store((*cachedOpenAICodexUserAgent)(nil))
+	publishCodexFingerprintSettings(view)
+	return view, nil
+}
+
+// CodexFingerprintAccountView uses the same identity selector as forwarding.
+type CodexFingerprintAccountView struct {
+	Mode              string                `json:"mode"`
+	Identity          codexIdentitySnapshot `json:"identity"`
+	SimulationEnabled bool                  `json:"simulation_enabled"`
+}
+
+func DescribeCodexFingerprintAccount(routed, source *Account) CodexFingerprintAccountView {
+	policy := currentCodexFingerprintPolicy()
+	return CodexFingerprintAccountView{
+		Mode:              string(routed.GetCodexFingerprintMode()),
+		Identity:          resolveCodexIdentitySnapshot(routed, source, codexAccountIdentityOverrideUA(source), policy),
+		SimulationEnabled: policy.enabled,
+	}
+}
+
+func DecodeCodexFingerprintMode(raw []byte) (string, error) {
+	var config struct {
+		Mode string `json:"mode"`
+	}
+	if err := decodeCodexFingerprintObject(raw, &config, "mode"); err != nil {
+		return "", err
+	}
+	if _, ok := codexFingerprintModeExplicit(map[string]any{codexFingerprintModeExtraKey: config.Mode}); !ok {
+		return "", errors.New("mode must be off, device, session or full")
+	}
+	return strings.TrimSpace(config.Mode), nil
+}
diff --git a/backend/internal/service/setting_service.go b/backend/internal/service/setting_service.go
index 3e0cc3e815db..6c2111767adf 100644
--- a/backend/internal/service/setting_service.go
+++ b/backend/internal/service/setting_service.go
@@ -117,6 +117,7 @@ type WebSearchManagerBuilder func(cfg *WebSearchEmulationConfig, proxyURLs map[i
 
 // SettingService 系统设置服务
 type SettingService struct {
+	codexFingerprintMu          sync.Mutex
 	settingRepo                 SettingRepository
 	defaultSubGroupReader       DefaultSubscriptionGroupReader
 	proxyRepo                   ProxyRepository // for resolving websearch provider proxy URLs
diff --git a/backend/internal/service/setting_update.go b/backend/internal/service/setting_update.go
index 7efbc72291af..1b4a38a5ccca 100644
--- a/backend/internal/service/setting_update.go
+++ b/backend/internal/service/setting_update.go
@@ -48,6 +48,11 @@ func (s *SettingService) UpdateSettingsOmitting(ctx context.Context, settings *S
 		return err
 	}
 	s.refreshCachedSettingsAfterWrite(ctx, settings, omitted)
+	if publishedCodexFingerprintPolicy.Load() != nil {
+		if err := s.LoadCodexFingerprintSettings(ctx); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
@@ -78,6 +83,11 @@ func (s *SettingService) UpdateSettingsWithAuthSourceDefaultsOmitting(ctx contex
 		return err
 	}
 	s.refreshCachedSettingsAfterWrite(ctx, settings, omitted)
+	if publishedCodexFingerprintPolicy.Load() != nil {
+		if err := s.LoadCodexFingerprintSettings(ctx); err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
diff --git a/backend/internal/service/wire.go b/backend/internal/service/wire.go
index 506084d9a655..f50386bf90e1 100644
--- a/backend/internal/service/wire.go
+++ b/backend/internal/service/wire.go
@@ -929,7 +929,7 @@ func ProvideSettingService(settingRepo SettingRepository, groupRepo GroupReposit
 	svc := NewSettingService(settingRepo, cfg)
 	// Observability and Codex request compression switches are read by
 	// package-level gates before the gateway starts.
-	for _, load := range []func(context.Context) error{svc.LoadAdminObservabilityConfig, svc.LoadCodexRuntimeConfig} {
+	for _, load := range []func(context.Context) error{svc.LoadAdminObservabilityConfig, svc.LoadCodexRuntimeConfig, svc.LoadCodexFingerprintSettings} {
 		if err := load(context.Background()); err != nil {
 			return nil, err
 		}
diff --git a/frontend/src/api/admin/codexFingerprint.ts b/frontend/src/api/admin/codexFingerprint.ts
new file mode 100644
index 000000000000..af90affef771
--- /dev/null
+++ b/frontend/src/api/admin/codexFingerprint.ts
@@ -0,0 +1,51 @@
+import { apiClient } from '../client'
+
+export type CodexFingerprintMode = 'off' | 'device' | 'session' | 'full'
+
+export interface CodexFingerprintSettings {
+  enabled: boolean
+  user_agent: string
+  client_version: string
+  version_auto_sync_enabled: boolean
+}
+
+export interface CodexFingerprintSettingsView extends CodexFingerprintSettings {
+  synced_version: string
+  effective_version: string
+  effective_user_agent: string
+}
+
+export interface CodexFingerprintAccountView {
+  mode: CodexFingerprintMode
+  simulation_enabled: boolean
+  identity: {
+    user_agent: string
+    originator: string
+    version: string
+    identity_source: string
+    identity_account_id: number
+    fingerprint_mode_effective: CodexFingerprintMode
+    fingerprint_reason: string
+  }
+}
+
+export const codexFingerprintAPI = {
+  async getSettings(): Promise<CodexFingerprintSettingsView> {
+    const { data } = await apiClient.get<CodexFingerprintSettingsView>('/admin/settings/codex-fingerprint')
+    if (typeof data.enabled !== 'boolean' || typeof data.user_agent !== 'string' || typeof data.client_version !== 'string' ||
+      typeof data.version_auto_sync_enabled !== 'boolean' || typeof data.effective_version !== 'string') throw new Error('Invalid Codex fingerprint settings')
+    return data
+  },
+  async saveSettings(config: CodexFingerprintSettings): Promise<CodexFingerprintSettingsView> {
+    const { data } = await apiClient.put<CodexFingerprintSettingsView>('/admin/settings/codex-fingerprint', config)
+    return data
+  },
+  async getAccount(id: number): Promise<CodexFingerprintAccountView> {
+    const { data } = await apiClient.get<CodexFingerprintAccountView>(`/admin/accounts/${id}/codex-fingerprint`)
+    return data
+  },
+  async saveAccount(id: number, mode: CodexFingerprintMode): Promise<CodexFingerprintAccountView> {
+    const { data } = await apiClient.put<CodexFingerprintAccountView>(`/admin/accounts/${id}/codex-fingerprint`, { mode })
+    return data
+  }
+}
diff --git a/frontend/src/components/account/BulkEditAccountModal.vue b/frontend/src/components/account/BulkEditAccountModal.vue
index 4475d731c19a..ab4e45a65ade 100644
--- a/frontend/src/components/account/BulkEditAccountModal.vue
+++ b/frontend/src/components/account/BulkEditAccountModal.vue
@@ -974,24 +974,7 @@
         </div>
       </div>
 
-      <!-- Codex 指纹收敛模式（仅 OpenAI OAuth） -->
-      <div v-if="allOpenAIOAuth" class="border-t border-gray-200 pt-4 dark:border-dark-600">
-        <div class="mb-3 flex items-center justify-between">
-          <label class="input-label mb-0">{{ t('admin.accounts.openai.codexFingerprintMode') }}</label>
-          <input
-            id="bulk-edit-openai-codex-fingerprint-mode-enabled"
-            v-model="enableCodexFingerprintMode"
-            type="checkbox"
-            class="rounded border-gray-300 text-primary-600 focus:ring-primary-500"
-          />
-        </div>
-        <div :class="!enableCodexFingerprintMode && 'pointer-events-none opacity-50'">
-          <p class="mb-2 text-xs text-gray-500 dark:text-gray-400">
-            {{ t('admin.accounts.openai.codexFingerprintModeDesc') }}
-          </p>
-          <Select v-model="codexFingerprintMode" data-testid="bulk-codex-fingerprint-mode-select" :options="codexFingerprintModeOptions" />
-        </div>
-      </div>
+
 
       <!-- Upstream billing auto probe (any API-key platform) -->
       <div v-if="allBillingProbeCapable" class="border-t border-gray-200 pt-4 dark:border-dark-600">
@@ -1710,15 +1693,6 @@ const openaiAPIKeyResponsesWebSocketV2Mode = ref<OpenAIWSMode>(OPENAI_WS_MODE_OF
 const upstreamBillingAutoProbeMode = ref<'enabled' | 'disabled'>('enabled')
 const codexCLIOnlyEnabled = ref(false)
 const codexCLIOnlyAppServerEnabled = ref(false)
-type CodexFingerprintMode = 'off' | 'device' | 'session' | 'full'
-const enableCodexFingerprintMode = ref(false)
-const codexFingerprintMode = ref<CodexFingerprintMode>('device')
-const codexFingerprintModeOptions = computed(() => [
-  { value: 'off' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintOff') },
-  { value: 'device' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintDevice') },
-  { value: 'session' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintSession') },
-  { value: 'full' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintFull') },
-])
 const openAICompactMode = ref<OpenAICompactMode>('auto')
 const openAICompactModelMappings = ref<ModelMapping[]>([])
 const rpmLimitEnabled = ref(false)
@@ -2093,26 +2067,6 @@ const buildUpdatePayload = (): Record<string, unknown> | null => {
     extra.codex_cli_only_allow_app_server = codexCLIOnlyAppServerEnabled.value
   }
 
-  if (enableCodexFingerprintMode.value) {
-    const extra = ensureExtra()
-    // off 必须显式落键，不能靠删本地键表达。批量更新走 JSONB 顶层合并
-    // （extra = COALESCE(extra,'{}') || payload），删掉 payload 里的键只表示
-    // "本次不更新该键"，清不掉账号上已有的 device/session/full；而且只删不写会让
-    // 整个 payload 退化成 {extra:{}}，被后端 len(req.Extra) > 0 判为空更新直接 400
-    // "No updates provided"（#6327）。
-    //
-    // Create/Edit 那两个表单可以删键，是因为它们提交完整 extra 对象、后端整体
-    // SetExtra 覆盖；批量接口只合并增量键，两种持久化语义不能共用同一套写法。
-    //
-    // 读取侧对缺失键默认 device，因此显式 off 必须落键才能真正关闭收敛；
-    // ShouldEnsureCodexFingerprintSeedForExtraUpdates 只在显式 device/session/full
-    // 时要种子，off 不会触发。
-    //
-    // 与本函数里其它"关闭/清除"字段的写法一致：codex_cli_only 直接落 false，
-    // load_factor 落 0，proxy_id 落 0 —— 批量路径一律用显式哨兵值，不用省略。
-    extra.codex_fingerprint_mode = codexFingerprintMode.value
-  }
-
   if (enableOpenAICompactMode.value) {
     const extra = ensureExtra()
     extra.openai_compact_mode = openAICompactMode.value
@@ -2226,7 +2180,6 @@ const handleSubmit = async () => {
     enableUpstreamBillingAutoProbe.value ||
     enableCodexCLIOnly.value ||
     enableCodexCLIOnlyAppServer.value ||
-    enableCodexFingerprintMode.value ||
     enableOpenAICompactMode.value ||
     enableOpenAICompactModelMapping.value ||
     enableRpmLimit.value ||
@@ -2353,8 +2306,6 @@ watch(
       enableUpstreamBillingAutoProbe.value = false
       enableCodexCLIOnly.value = false
       enableCodexCLIOnlyAppServer.value = false
-      enableCodexFingerprintMode.value = false
-      codexFingerprintMode.value = 'device'
       enableOpenAICompactMode.value = false
       enableOpenAICompactModelMapping.value = false
       enableRpmLimit.value = false
diff --git a/frontend/src/components/account/CreateAccountModal.vue b/frontend/src/components/account/CreateAccountModal.vue
index 875746744e0e..e079129c038c 100644
--- a/frontend/src/components/account/CreateAccountModal.vue
+++ b/frontend/src/components/account/CreateAccountModal.vue
@@ -3392,23 +3392,7 @@
         </div>
       </div>
 
-      <!-- Codex 指纹收敛模式（仅 OpenAI OAuth） -->
-      <div
-        v-if="form.platform === 'openai' && accountCategory === 'oauth-based'"
-        class="border-t border-gray-200 pt-4 dark:border-dark-600"
-      >
-        <div class="flex items-center justify-between gap-4">
-          <div class="min-w-0">
-            <label class="input-label mb-0">{{ t('admin.accounts.openai.codexFingerprintMode') }}</label>
-            <p class="mt-1 text-xs text-gray-500 dark:text-gray-400">
-              {{ t('admin.accounts.openai.codexFingerprintModeDesc') }}
-            </p>
-          </div>
-          <div class="w-52 flex-shrink-0">
-            <Select v-model="codexFingerprintMode" data-testid="create-codex-fingerprint-mode-select" :options="codexFingerprintModeOptions" />
-          </div>
-        </div>
-      </div>
+
 
       <!-- OpenAI Compact 能力配置 -->
       <div
@@ -4575,14 +4559,6 @@ const openaiOAuthResponsesWebSocketV2Mode = ref<OpenAIWSMode>(OPENAI_WS_MODE_OFF
 const openaiAPIKeyResponsesWebSocketV2Mode = ref<OpenAIWSMode>(OPENAI_WS_MODE_OFF)
 const codexCLIOnlyEnabled = ref(false)
 const codexCLIOnlyAppServerEnabled = ref(false)
-type CodexFingerprintMode = 'off' | 'device' | 'session' | 'full'
-const codexFingerprintMode = ref<CodexFingerprintMode>('device')
-const codexFingerprintModeOptions = computed(() => [
-  { value: 'off' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintOff') },
-  { value: 'device' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintDevice') },
-  { value: 'session' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintSession') },
-  { value: 'full' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintFull') },
-])
 type AnthropicAPIKeyAuthScheme = 'x_api_key' | 'authorization_bearer'
 const anthropicPassthroughEnabled = ref(false)
 const anthropicAPIKeyAuthScheme = ref<AnthropicAPIKeyAuthScheme>('x_api_key')
@@ -5581,7 +5557,6 @@ const resetForm = () => {
   openaiAPIKeyResponsesWebSocketV2Mode.value = OPENAI_WS_MODE_OFF
   codexCLIOnlyEnabled.value = false
   codexCLIOnlyAppServerEnabled.value = false
-  codexFingerprintMode.value = 'device'
   anthropicPassthroughEnabled.value = false
   anthropicAPIKeyAuthScheme.value = 'x_api_key'
   webSearchEmulationMode.value = 'default'
@@ -5682,10 +5657,6 @@ const buildOpenAIExtra = (base?: Record<string, unknown>): Record<string, unknow
   } else {
     delete extra.codex_cli_only_allow_app_server
   }
-  // 后端对缺失键默认按 device 处理；显式 off 必须落键，否则会被当成默认 device。
-  if (accountCategory.value === 'oauth-based') {
-    extra.codex_fingerprint_mode = codexFingerprintMode.value
-  }
   if (openAICompactMode.value !== 'auto') {
     extra.openai_compact_mode = openAICompactMode.value
   } else {
diff --git a/frontend/src/components/account/EditAccountModal.vue b/frontend/src/components/account/EditAccountModal.vue
index eaebc222dc50..fecb78db3385 100644
--- a/frontend/src/components/account/EditAccountModal.vue
+++ b/frontend/src/components/account/EditAccountModal.vue
@@ -2418,23 +2418,7 @@
         </div>
       </div>
 
-      <!-- Codex 指纹收敛模式（仅 OpenAI OAuth） -->
-      <div
-        v-if="account?.platform === 'openai' && account?.type === 'oauth'"
-        class="border-t border-gray-200 pt-4 dark:border-dark-600"
-      >
-        <div class="flex items-center justify-between gap-4">
-          <div class="min-w-0">
-            <label class="input-label mb-0">{{ t('admin.accounts.openai.codexFingerprintMode') }}</label>
-            <p class="mt-1 text-xs text-gray-500 dark:text-gray-400">
-              {{ t('admin.accounts.openai.codexFingerprintModeDesc') }}
-            </p>
-          </div>
-          <div class="w-52 flex-shrink-0">
-            <Select v-model="codexFingerprintMode" data-testid="edit-codex-fingerprint-mode-select" :options="codexFingerprintModeOptions" />
-          </div>
-        </div>
-      </div>
+
 
       <!-- OpenAI 订阅档位手动覆盖（Plus/Pro/Free），仅 OAuth 非影子账号 -->
       <div
@@ -3811,8 +3795,6 @@ const openaiOAuthResponsesWebSocketV2Mode = ref<OpenAIWSMode>(OPENAI_WS_MODE_OFF
 const openaiAPIKeyResponsesWebSocketV2Mode = ref<OpenAIWSMode>(OPENAI_WS_MODE_OFF)
 const codexCLIOnlyEnabled = ref(false)
 const codexCLIOnlyAppServerEnabled = ref(false)
-type CodexFingerprintMode = 'off' | 'device' | 'session' | 'full'
-const codexFingerprintMode = ref<CodexFingerprintMode>('device')
 type CodexImageToolMode = 'inherit' | 'enabled' | 'disabled' | 'block'
 const codexImageToolMode = ref<CodexImageToolMode>('inherit')
 type AnthropicAPIKeyAuthScheme = 'x_api_key' | 'authorization_bearer'
@@ -3844,12 +3826,6 @@ const editWeeklyResetMode = ref<'rolling' | 'fixed' | null>(null)
 const editWeeklyResetDay = ref<number | null>(null)
 const editWeeklyResetHour = ref<number | null>(null)
 const editResetTimezone = ref<string | null>(null)
-const codexFingerprintModeOptions = computed(() => [
-  { value: 'off' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintOff') },
-  { value: 'device' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintDevice') },
-  { value: 'session' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintSession') },
-  { value: 'full' as CodexFingerprintMode, label: t('admin.accounts.openai.codexFingerprintFull') },
-])
 
 const openAIWSModeOptions = computed(() => [
   { value: OPENAI_WS_MODE_OFF, label: t('admin.accounts.openai.wsModeOff') },
@@ -4287,7 +4263,6 @@ const syncFormFromAccount = (newAccount: Account | null) => {
   openaiAPIKeyResponsesWebSocketV2Mode.value = OPENAI_WS_MODE_OFF
   codexCLIOnlyEnabled.value = false
   codexCLIOnlyAppServerEnabled.value = false
-  codexFingerprintMode.value = 'device'
   codexImageToolMode.value = 'inherit'
   anthropicPassthroughEnabled.value = false
   anthropicAPIKeyAuthScheme.value = 'x_api_key'
@@ -4336,13 +4311,6 @@ const syncFormFromAccount = (newAccount: Account | null) => {
       codexCLIOnlyAppServerEnabled.value =
         extra?.codex_cli_only_allow_app_server === true
     }
-    if (newAccount.type === 'oauth') {
-      const fpMode = extra?.codex_fingerprint_mode as string | undefined
-      // 缺省/非法值按 device 呈现，与后端 codexFingerprintModeFromExtra 的默认值一致
-      codexFingerprintMode.value = (['off', 'device', 'session', 'full'].includes(fpMode || '')
-        ? fpMode as CodexFingerprintMode
-        : 'device')
-    }
     const credentials = newAccount.credentials as Record<string, unknown> | undefined
     const compactMappings = credentials?.compact_model_mapping as Record<string, string> | undefined
     if (compactMappings && typeof compactMappings === 'object') {
@@ -5924,12 +5892,6 @@ const handleSubmit = async () => {
         }
       }
 
-      // 指纹收敛模式：后端对缺失键默认按 device 处理；显式 off 必须落键，
-      // 否则会被当成默认 device。
-      if (props.account.type === 'oauth') {
-        newExtra.codex_fingerprint_mode = codexFingerprintMode.value
-      }
-
       updatePayload.extra = newExtra
     }
 
@@ -6007,6 +5969,7 @@ const handleSubmit = async () => {
     }
 
     if (updatePayload.extra) {
+      delete (updatePayload.extra as Record<string, unknown>).codex_fingerprint_mode
       updatePayload.extra = withoutManagedCapacityExtra(updatePayload.extra as Record<string, unknown>)
     }
     const overrides = buildCapacityPatch()
diff --git a/frontend/src/components/account/__tests__/BulkEditAccountModal.spec.ts b/frontend/src/components/account/__tests__/BulkEditAccountModal.spec.ts
index c943b9a7645a..e29a0eca5a1e 100644
--- a/frontend/src/components/account/__tests__/BulkEditAccountModal.spec.ts
+++ b/frontend/src/components/account/__tests__/BulkEditAccountModal.spec.ts
@@ -919,61 +919,13 @@ describe('BulkEditAccountModal', () => {
       status: 'active'
     })
   })
-  // issue #6327：批量编辑无法把 Codex 指纹收敛关掉。
-  //
-  // 批量更新走 JSONB 顶层合并（extra = COALESCE(extra,'{}') || payload），删掉 payload
-  // 里的键只表示「本次不更新该键」，清不掉账号已有的 device/session/full；而且只删不写会让
-  // payload 退化成 {extra:{}}，被后端 len(req.Extra) > 0 判为空更新直接 400
-  // "No updates provided"。Create/Edit 那两个表单能删键，是因为它们提交完整 extra 对象、
-  // 后端整体 SetExtra 覆盖——两种持久化语义不能共用同一套写法。
-  it('OpenAI OAuth 批量编辑选择「关闭」时应显式提交 codex_fingerprint_mode=off（issue #6327）', async () => {
-    const wrapper = mountModal({
-      selectedPlatforms: ['openai'],
-      selectedTypes: ['oauth']
-    })
-
-    // 下拉框默认是 device（后端对缺失键的默认值），显式选择 off 后提交——
-    // 必须落显式 off，缺失键会被后端当作 device。
-    await wrapper.get('#bulk-edit-openai-codex-fingerprint-mode-enabled').setValue(true)
-    await wrapper
-      .get('[data-testid="bulk-codex-fingerprint-mode-select"]')
-      .setValue('off')
-    await wrapper.get('#bulk-edit-account-form').trigger('submit.prevent')
-    await flushPromises()
-
-    expect(adminAPI.accounts.bulkUpdate).toHaveBeenCalledTimes(1)
-    expect(adminAPI.accounts.bulkUpdate).toHaveBeenCalledWith([1, 2], {
-      extra: {
-        codex_fingerprint_mode: 'off'
-      }
-    })
-
-    // 缺陷时期的形状：extra 为空对象，后端必然回 400。显式钉死不得回退。
-    const payload = vi.mocked(adminAPI.accounts.bulkUpdate).mock.calls[0][1] as {
-      extra: Record<string, unknown>
-    }
-    expect(Object.keys(payload.extra).length).toBeGreaterThan(0)
-  })
-
-  // 与兄弟字段 codex_cli_only 的写法对齐：关闭态同样落显式值，不靠省略表达。
-  it('OpenAI OAuth 批量编辑显式 opt-in 模式仍原样提交', async () => {
-    const wrapper = mountModal({
-      selectedPlatforms: ['openai'],
-      selectedTypes: ['oauth']
-    })
-
-    await wrapper.get('#bulk-edit-openai-codex-fingerprint-mode-enabled').setValue(true)
-    await wrapper
-      .get('[data-testid="bulk-codex-fingerprint-mode-select"]')
-      .setValue('session')
+  it('leaves fingerprint mode changes to the extension page without submitting a phantom update', async () => {
+    const wrapper = mountModal({ selectedPlatforms: ['openai'], selectedTypes: ['oauth'] })
+    expect(wrapper.find('[data-testid="bulk-codex-fingerprint-mode-select"]').exists()).toBe(false)
     await wrapper.get('#bulk-edit-account-form').trigger('submit.prevent')
     await flushPromises()
-
-    expect(adminAPI.accounts.bulkUpdate).toHaveBeenCalledWith([1, 2], {
-      extra: {
-        codex_fingerprint_mode: 'session'
-      }
-    })
+    expect(adminAPI.accounts.bulkUpdate).not.toHaveBeenCalled()
+    wrapper.unmount()
   })
 
   // 未勾选「编辑该项」时不得写入该键，否则批量编辑别的字段会顺手清掉账号的收敛设置。
diff --git a/frontend/src/components/account/__tests__/CreateAccountModal.spec.ts b/frontend/src/components/account/__tests__/CreateAccountModal.spec.ts
index 60fb179277ef..d81e1db5ea5d 100644
--- a/frontend/src/components/account/__tests__/CreateAccountModal.spec.ts
+++ b/frontend/src/components/account/__tests__/CreateAccountModal.spec.ts
@@ -526,21 +526,21 @@ describe('CreateAccountModal OpenAI long-context billing', () => {
     wrapper.unmount()
   })
 
-  it('submits the Codex fingerprint mode of an OAuth-based account, explicit off included, and none for an API-key account', async () => {
+  it('leaves fingerprint modes to the extension page and the backend default when creating accounts', async () => {
     const untouched = await openCodexImportStep()
     await untouched.get('[data-testid="import-codex-session"]').trigger('click')
     await flushPromises()
-    expect(importCodexSessionMock.mock.calls[0]?.[0]?.extra?.codex_fingerprint_mode).toBe('device')
+    expect(importCodexSessionMock.mock.calls[0]?.[0]?.extra).not.toHaveProperty('codex_fingerprint_mode')
     untouched.unmount()
 
     const wrapper = mountModal()
     await selectButtonByText(wrapper, 'OpenAI')
-    await wrapper.get('[data-testid="create-codex-fingerprint-mode-select"]').setValue('off')
+    expect(wrapper.find('[data-testid="create-codex-fingerprint-mode-select"]').exists()).toBe(false)
     await wrapper.get('form#create-account-form input[type="text"]').setValue('Codex import')
     await wrapper.get('form#create-account-form').trigger('submit.prevent')
     await wrapper.get('[data-testid="import-codex-pat"]').trigger('click')
     await flushPromises()
-    expect(createOpenAICodexPATMock.mock.calls[0]?.[0]?.extra?.codex_fingerprint_mode).toBe('off')
+    expect(createOpenAICodexPATMock.mock.calls[0]?.[0]?.extra).not.toHaveProperty('codex_fingerprint_mode')
     wrapper.unmount()
 
     const apiKey = await submitApiKeyAccount('openai')
diff --git a/frontend/src/components/account/__tests__/EditAccountModal.spec.ts b/frontend/src/components/account/__tests__/EditAccountModal.spec.ts
index 03b416346e0a..8da3c14d6d3a 100644
--- a/frontend/src/components/account/__tests__/EditAccountModal.spec.ts
+++ b/frontend/src/components/account/__tests__/EditAccountModal.spec.ts
@@ -440,6 +440,20 @@ async function changeRestrictionMode(wrapper: ReturnType<typeof mountModal>, mod
 }
 
 describe('EditAccountModal', () => {
+  it('omits the extension-owned fingerprint mode while saving an unrelated OAuth account edit', async () => {
+    const account = buildOpenAIOAuthParentAccount()
+    account.extra = { codex_fingerprint_mode: 'full', unrelated_setting: 'preserved' }
+    updateAccountMock.mockReset().mockResolvedValue(account)
+    const wrapper = mountModal(account)
+    await flushPromises()
+    expect(wrapper.find('[data-testid="edit-codex-fingerprint-mode-select"]').exists()).toBe(false)
+    await wrapper.get('form#edit-account-form').trigger('submit.prevent')
+    await flushPromises()
+    const payload = updateAccountMock.mock.calls.at(-1)?.[1]
+    expect(payload?.extra).not.toHaveProperty('codex_fingerprint_mode')
+    expect(payload?.extra?.unrelated_setting).toBe('preserved')
+    wrapper.unmount()
+  })
   beforeEach(() => {
     authIsSimpleMode.value = true
     showErrorMock.mockReset()
diff --git a/frontend/src/components/admin/account/AccountTestReasoningSelect.vue b/frontend/src/components/admin/account/AccountTestReasoningSelect.vue
index a139a58a13f6..5e7e0ee35dc8 100644
--- a/frontend/src/components/admin/account/AccountTestReasoningSelect.vue
+++ b/frontend/src/components/admin/account/AccountTestReasoningSelect.vue
@@ -2,20 +2,23 @@
   <label v-if="levels.length || modelValue" class="mt-3 block text-sm">
     {{ t('admin.accounts.testReasoning.label') }}
     <select :value="modelValue" class="input mt-1 w-full" :disabled="disabled" :aria-invalid="!valid" @change="emit('update:modelValue', ($event.target as HTMLSelectElement).value)">
-      <option v-if="modelValue && !valid" :value="modelValue" disabled>{{ modelValue }}</option>
-      <option value="">{{ t('admin.accounts.testReasoning.default') }}{{ model?.default_reasoning_effort ? ` (${model.default_reasoning_effort})` : '' }}</option>
+      <option v-if="modelValue && !valid && !isUltra" :value="modelValue" disabled>{{ modelValue }}</option>
+      <option value="">{{ t('admin.accounts.testReasoning.default') }}{{ defaultEffort ? ` (${defaultEffort})` : '' }}</option>
       <option v-for="level in levels" :key="level" :value="level">{{ level }}</option>
     </select>
   </label>
 </template>
 <script setup lang="ts">
-import { computed } from 'vue'
+import { computed, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 import type { AccountAvailableModel } from '@/types'
-import { isAccountTestReasoningValid } from '@/utils/accountTestModels'
+import { accountTestReasoningLevels, isAccountTestReasoningValid } from '@/utils/accountTestModels'
 const props = defineProps<{ modelValue: string; model?: AccountAvailableModel; disabled?: boolean }>()
 const emit = defineEmits<{ 'update:modelValue': [value: string] }>()
 const { t } = useI18n()
-const levels = computed(() => props.model?.reasoning_efforts || [])
+const levels = computed(() => accountTestReasoningLevels(props.model))
+const isUltra = computed(() => props.modelValue.trim().toLowerCase() === 'ultra')
+const defaultEffort = computed(() => props.model?.default_reasoning_effort?.trim().toLowerCase() === 'ultra' ? '' : props.model?.default_reasoning_effort)
 const valid = computed(() => isAccountTestReasoningValid(props.model, props.modelValue))
+watch(isUltra, value => { if (value) emit('update:modelValue', '') }, { immediate: true })
 </script>
diff --git a/frontend/src/components/admin/account/__tests__/AccountTestReasoningSelect.spec.ts b/frontend/src/components/admin/account/__tests__/AccountTestReasoningSelect.spec.ts
new file mode 100644
index 000000000000..b4636e87a4b7
--- /dev/null
+++ b/frontend/src/components/admin/account/__tests__/AccountTestReasoningSelect.spec.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it, vi } from 'vitest'
+import { mount } from '@vue/test-utils'
+import AccountTestReasoningSelect from '../AccountTestReasoningSelect.vue'
+import { isAccountTestReasoningValid } from '@/utils/accountTestModels'
+
+vi.mock('vue-i18n', () => ({ useI18n: () => ({ t: (key: string) => key }) }))
+
+describe('AccountTestReasoningSelect native efforts', () => {
+  it('never displays ultra from a stale capability list, default or selected value, and resets the old selection', () => {
+    const model = { id: 'alias', display_name: 'Astra', reasoning_efforts: ['high', 'max', 'ultra'], default_reasoning_effort: 'ultra' }
+    const wrapper = mount(AccountTestReasoningSelect, { props: { model, modelValue: 'ultra' } })
+    expect(wrapper.text()).not.toContain('ultra')
+    expect(wrapper.findAll('option').map(option => option.attributes('value'))).toEqual(['', 'high', 'max'])
+    expect(wrapper.emitted('update:modelValue')).toEqual([['']])
+    expect(isAccountTestReasoningValid(model, 'ultra')).toBe(false)
+    expect(isAccountTestReasoningValid(model, 'max')).toBe(true)
+    wrapper.unmount()
+  })
+})
diff --git a/frontend/src/components/layout/AppSidebar.vue b/frontend/src/components/layout/AppSidebar.vue
index 7273aa782465..417ccec70de7 100644
--- a/frontend/src/components/layout/AppSidebar.vue
+++ b/frontend/src/components/layout/AppSidebar.vue
@@ -833,6 +833,7 @@ const personalNavItems = computed((): NavItem[] => finalizeNav(buildSelfNavItems
 const adminExtensionNavItems = computed((): NavItem[] => [
   { path: '/admin/system-prompts', label: t('nav.systemPrompts'), icon: DocumentIcon },
   { path: '/admin/codex-runtime', label: t('nav.codexRuntime'), icon: PluginIcon },
+  { path: '/admin/codex-fingerprint', label: t('nav.codexFingerprint'), icon: ShieldIcon },
   { path: '/admin/codex-gateway-borrow', label: t('nav.codexGatewayBorrow'), icon: GatewayBorrowIcon },
   { path: '/admin/pelican-tests', label: t('nav.pelicanTests'), icon: GatewayBorrowIcon },
   { path: '/admin/reasoning-recovery', label: t('nav.reasoningRecovery'), icon: RecoveryIcon },
diff --git a/frontend/src/components/layout/__tests__/AppSidebar.simple-mode.spec.ts b/frontend/src/components/layout/__tests__/AppSidebar.simple-mode.spec.ts
index 22801b32254e..9be669024be2 100644
--- a/frontend/src/components/layout/__tests__/AppSidebar.simple-mode.spec.ts
+++ b/frontend/src/components/layout/__tests__/AppSidebar.simple-mode.spec.ts
@@ -111,6 +111,7 @@ describe('AppSidebar simple mode extensions', () => {
     expect(extensionLinks(wrapper)).toEqual([
       '/admin/system-prompts',
       '/admin/codex-runtime',
+      '/admin/codex-fingerprint',
       '/admin/codex-gateway-borrow',
       '/admin/pelican-tests',
       '/admin/reasoning-recovery',
diff --git a/frontend/src/i18n/locales/en/common.ts b/frontend/src/i18n/locales/en/common.ts
index 662082bf6b17..c21053e94367 100644
--- a/frontend/src/i18n/locales/en/common.ts
+++ b/frontend/src/i18n/locales/en/common.ts
@@ -189,6 +189,7 @@ export default {
     accounts: 'Accounts',
     plugins: 'Plugins',
     codexRuntime: 'Codex runtime settings',
+    codexFingerprint: 'Codex fingerprint',
     proxies: 'Proxies',
     redeemCodes: 'Redeem Codes',
     ops: 'Ops',
diff --git a/frontend/src/i18n/locales/zh/admin/accounts.ts b/frontend/src/i18n/locales/zh/admin/accounts.ts
index b0415043422a..3034f6acfffc 100644
--- a/frontend/src/i18n/locales/zh/admin/accounts.ts
+++ b/frontend/src/i18n/locales/zh/admin/accounts.ts
@@ -1017,10 +1017,10 @@ export default {accounts: {
         codexCLIOnlyAppServerDesc: '仅在上方开关开启时生效。开启后本账号额外放行内嵌 Codex 引擎、经 app-server 协议接入的第三方客户端（如 Claude Code 的 codex 插件），仍需通过全局引擎指纹门；与全局 app-server 开关取 OR（任一开即放行）。',
         codexFingerprintMode: 'Codex 指纹收敛',
         codexFingerprintModeDesc: '多人共享同一 OAuth 账号时，将各用户的设备/会话标识收敛为账号级恒定值，减少上游可见的设备数和会话数。默认“仅设备”：一个账号对上游只表现为一台设备，并配合账号级的 Codex 客户端身份；选择关闭则原样透传客户端标识。',
-        codexFingerprintOff: '关闭（透传）',
+        codexFingerprintOff: '保留设备／会话标识',
         codexFingerprintDevice: '仅设备',
         codexFingerprintSession: '设备+会话',
-        codexFingerprintFull: '完全收敛',
+        codexFingerprintFull: '设备＋会话＋线程',
         codexImageTool: 'Codex 图片桥接策略',
         codexImageToolDesc:
           '统一控制 Codex /responses 文本请求的 hosted image_generation 桥接和客户端图片工具声明。hosted 工具自动注入仅适用于非 Responses Lite 请求；账号级策略优先于渠道和全局配置，不影响独立图片生成接口。',
diff --git a/frontend/src/i18n/locales/zh/common.ts b/frontend/src/i18n/locales/zh/common.ts
index 55ee64e3a5d2..79c67a1902d1 100644
--- a/frontend/src/i18n/locales/zh/common.ts
+++ b/frontend/src/i18n/locales/zh/common.ts
@@ -189,6 +189,7 @@ export default {
     accounts: '账号管理',
     plugins: '插件管理',
     codexRuntime: 'Codex 运行设置',
+    codexFingerprint: 'Codex 指纹',
     proxies: 'IP管理',
     redeemCodes: '兑换码',
     ops: '运维监控',
diff --git a/frontend/src/router/index.ts b/frontend/src/router/index.ts
index a1ec28c64dbe..e305923fa475 100644
--- a/frontend/src/router/index.ts
+++ b/frontend/src/router/index.ts
@@ -543,6 +543,12 @@ const routes: RouteRecordRaw[] = [
     component: () => import('@/views/admin/CodexRuntimeView.vue'),
     meta: { requiresAuth: true, requiresAdmin: true, title: 'Codex runtime settings', titleKey: 'nav.codexRuntime' }
   },
+  {
+    path: '/admin/codex-fingerprint',
+    name: 'AdminCodexFingerprint',
+    component: () => import('@/views/admin/CodexFingerprintView.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true, title: 'Codex fingerprint', titleKey: 'nav.codexFingerprint' }
+  },
   {
     path: '/admin/codex-gateway-borrow',
     name: 'AdminCodexGatewayBorrow',
diff --git a/frontend/src/utils/accountTestModels.ts b/frontend/src/utils/accountTestModels.ts
index 15c828d79b9c..397c6a55eaa2 100644
--- a/frontend/src/utils/accountTestModels.ts
+++ b/frontend/src/utils/accountTestModels.ts
@@ -1,7 +1,11 @@
 import type { AccountAvailableModel, AccountTestPlanView } from '@/types'
 
 export function isAccountTestReasoningValid(model: AccountAvailableModel | undefined, effort: string): boolean {
-  return effort === '' || model?.reasoning_efforts?.includes(effort) === true
+  return effort === '' || (effort.trim().toLowerCase() !== 'ultra' && model?.reasoning_efforts?.includes(effort) === true)
+}
+
+export function accountTestReasoningLevels(model: AccountAvailableModel | undefined): string[] {
+  return (model?.reasoning_efforts || []).filter(effort => effort.trim().toLowerCase() !== 'ultra')
 }
 
 export function validateAccountTestPlan(value: unknown, accountID: number): AccountTestPlanView {
@@ -14,6 +18,8 @@ export function validateAccountTestPlan(value: unknown, accountID: number): Acco
     if (!model || typeof model.id !== 'string' || !model.id || ids.has(model.id) ||
         typeof model.display_name !== 'string' || !model.display_name) throw new Error('Invalid account test model')
     ids.add(model.id)
+    if (model.reasoning_efforts) model.reasoning_efforts = accountTestReasoningLevels(model)
+    if (model.default_reasoning_effort?.trim().toLowerCase() === 'ultra') delete model.default_reasoning_effort
   }
   for (const view of Object.values(plan.mode_views)) {
     if (!view || !Array.isArray(view.model_ids) || new Set(view.model_ids).size !== view.model_ids.length ||
diff --git a/frontend/src/views/admin/CodexFingerprintView.vue b/frontend/src/views/admin/CodexFingerprintView.vue
new file mode 100644
index 000000000000..24fb1a90d476
--- /dev/null
+++ b/frontend/src/views/admin/CodexFingerprintView.vue
@@ -0,0 +1,228 @@
+<template>
+  <AppLayout>
+    <section class="space-y-6" data-ui="codex-fingerprint">
+      <div>
+        <h1 class="text-xl font-semibold text-ink">{{ text('Codex 指纹', 'Codex fingerprint') }}</h1>
+        <p class="mt-2 text-sm text-muted">{{ text('统一管理 OpenAI OAuth 和 Setup Token 账号的 Codex TUI 身份及设备、会话标识。', 'Manage the Codex TUI identity and device/session identifiers of OpenAI OAuth and setup-token accounts.') }}</p>
+      </div>
+      <p v-if="error" role="alert" class="text-sm text-red-600 dark:text-red-400">{{ error }}</p>
+      <p v-if="message" role="status" class="text-sm text-ink">{{ message }}</p>
+      <form class="space-y-4 rounded-lg border border-line p-4" @submit.prevent="saveSettings">
+        <fieldset :disabled="!settings || settingsBusy" class="space-y-4 disabled:opacity-60">
+          <label class="flex items-center gap-3 text-sm font-medium text-ink">
+            <input v-model="draft.enabled" data-test="fingerprint-enabled" type="checkbox" />
+            {{ text('启用 Codex 指纹模拟', 'Enable Codex fingerprint simulation') }}
+          </label>
+          <p class="text-sm text-muted">{{ text('开启：使用每账号固定 TUI 身份，并按账号模式收敛标识。关闭：新请求保留客户端指纹；保存的配置和账号身份继续保留。', 'On: use a fixed TUI identity per account and converge identifiers according to its mode. Off: new requests retain the client fingerprint; saved configuration and account identities are preserved.') }}</p>
+          <div class="grid gap-4 lg:grid-cols-2">
+            <label class="block text-sm text-ink lg:col-span-2" for="codex-fingerprint-ua">
+              {{ text('全局 UA', 'Global User-Agent') }}
+              <input id="codex-fingerprint-ua" v-model.trim="draft.user_agent" data-test="fingerprint-ua" type="text" maxlength="512" class="input mt-1 w-full font-mono" />
+              <span class="mt-1 block text-xs text-muted">{{ text('作为没有账号身份时的默认 UA；留空使用官方标准形态。UA 的版本由下方生效版本统一重建。', 'Default UA when no account identity is available; leave empty for the official format. Its version is rebuilt from the effective client version below.') }}</span>
+            </label>
+            <label class="block text-sm text-ink" for="codex-fingerprint-version">
+              {{ text('手动版本', 'Pinned client version') }}
+              <input id="codex-fingerprint-version" v-model.trim="draft.client_version" data-test="fingerprint-version" type="text" maxlength="64" class="input mt-1 w-full font-mono" :placeholder="text('留空使用同步值或内置版本', 'Leave empty for the synced or built-in version')" />
+            </label>
+            <label class="flex items-center gap-3 text-sm text-ink">
+              <input v-model="draft.version_auto_sync_enabled" data-test="fingerprint-auto-sync" type="checkbox" />
+              {{ text('每 6 小时自动同步官方稳定版', 'Sync the official stable version every 6 hours') }}
+            </label>
+          </div>
+          <dl v-if="settings" class="grid gap-3 text-sm sm:grid-cols-2">
+            <div><dt class="text-muted">{{ text('同步版本', 'Synced version') }}</dt><dd class="font-mono text-ink">{{ settings.synced_version || '—' }}</dd></div>
+            <div><dt class="text-muted">{{ settings.enabled ? text('生效模拟版本', 'Effective simulated version') : text('待启用模拟版本', 'Saved simulation version') }}</dt><dd class="font-mono text-ink" data-test="fingerprint-effective-version">{{ settings.effective_version }}</dd></div>
+            <div class="sm:col-span-2"><dt class="text-muted">{{ text('全局默认身份', 'Global default identity') }}</dt><dd class="break-words font-mono text-ink">{{ settings.effective_user_agent }}</dd></div>
+          </dl>
+          <button data-test="fingerprint-save" type="submit" :disabled="settingsBusy || !settingsDirty" class="btn btn-primary">{{ text('保存设置', 'Save settings') }}</button>
+        </fieldset>
+        <p v-if="!settings" class="text-sm text-muted">{{ t('common.loading') }}</p>
+      </form>
+
+      <section class="space-y-4" :aria-label="text('账号收敛设置', 'Account convergence settings')">
+        <div class="flex flex-wrap items-end justify-between gap-3">
+          <div><h2 class="text-lg font-semibold text-ink">{{ text('账号收敛设置', 'Account convergence settings') }}</h2><p class="mt-1 text-sm text-muted">{{ text('模式只控制标识收敛；上方总开关控制整个模拟功能。', 'Modes control identifier convergence; the master switch above controls the entire simulation.') }}</p></div>
+          <form class="flex items-center gap-2" @submit.prevent="searchAccounts">
+            <label class="sr-only" for="codex-fingerprint-search">{{ text('搜索账号', 'Search accounts') }}</label>
+            <input id="codex-fingerprint-search" v-model="search" class="input w-48" :placeholder="text('搜索账号', 'Search accounts')" />
+            <button type="submit" class="btn btn-secondary" :disabled="rowsLoading">{{ text('搜索', 'Search') }}</button>
+          </form>
+        </div>
+        <div class="flex flex-wrap items-center gap-3">
+          <label class="text-sm text-ink" for="codex-fingerprint-bulk-mode">{{ text('选中账号的模式', 'Mode for selected accounts') }} ({{ selectedIDs.length }})</label>
+          <select id="codex-fingerprint-bulk-mode" v-model="bulkMode" data-test="fingerprint-bulk-mode" class="input w-auto" :disabled="bulkBusy">
+            <option v-for="mode in modes" :key="mode.value" :value="mode.value">{{ mode.label }}</option>
+          </select>
+          <button data-test="fingerprint-bulk-save" type="button" class="btn btn-secondary" :disabled="!selectedIDs.length || bulkBusy" @click="saveBulk">{{ text('应用到选中账号', 'Apply to selected accounts') }}</button>
+          <button type="button" class="btn btn-secondary" :disabled="rowsLoading" @click="loadRows">{{ text('刷新账号', 'Refresh accounts') }}</button>
+        </div>
+        <div class="overflow-x-auto rounded-lg border border-line" :aria-busy="rowsLoading">
+          <table class="w-full text-left text-sm">
+            <thead class="border-b border-line bg-surface text-muted"><tr>
+              <th class="p-3"><input type="checkbox" :checked="allPageSelected" :indeterminate="somePageSelected && !allPageSelected" :aria-label="text('选择本页账号', 'Select accounts on this page')" @change="selectPage(($event.target as HTMLInputElement).checked)" /></th>
+              <th class="p-3">{{ text('账号', 'Account') }}</th><th class="p-3">{{ text('标识收敛模式', 'Identifier convergence mode') }}</th><th class="p-3">{{ text('操作', 'Actions') }}</th>
+            </tr></thead>
+            <tbody class="divide-y divide-line text-ink">
+              <template v-for="account in rows" :key="account.id">
+                <tr>
+                  <td class="p-3"><input type="checkbox" :checked="selectedIDs.includes(account.id)" :aria-label="text('选择账号 ', 'Select account ') + account.name" @change="selectAccount(account.id, ($event.target as HTMLInputElement).checked)" /></td>
+                  <td class="p-3"><span class="block font-medium">{{ account.name }}</span><span class="text-xs text-muted">#{{ account.id }} · {{ account.type }}{{ account.parent_account_id ? text(' · 影子账号', ' · shadow account') : '' }}</span></td>
+                  <td class="p-3"><select v-model="draftModes[account.id]" :data-test="`fingerprint-mode-${account.id}`" :aria-label="text('账号模式 ', 'Account mode ') + account.name" class="input w-auto" :disabled="rowBusy[account.id]"><option v-for="mode in modes" :key="mode.value" :value="mode.value">{{ mode.label }}</option></select></td>
+                  <td class="p-3"><div class="flex flex-wrap gap-2"><button type="button" class="btn btn-secondary btn-sm" :data-test="`fingerprint-account-save-${account.id}`" :disabled="rowBusy[account.id] || draftModes[account.id] === savedMode(account)" @click="saveAccount(account)">{{ text('保存', 'Save') }}</button><button type="button" class="btn btn-secondary btn-sm" :disabled="rowBusy[account.id]" @click="showIdentity(account.id)">{{ text('查看生效身份', 'View effective identity') }}</button></div></td>
+                </tr>
+                <tr v-if="accountViews[account.id]"><td colspan="4" class="bg-surface p-4"><dl class="grid gap-3 text-sm sm:grid-cols-2">
+                  <div class="sm:col-span-2"><dt class="text-muted">User-Agent</dt><dd class="break-words font-mono">{{ accountViews[account.id]!.identity.user_agent }}</dd></div>
+                  <div><dt class="text-muted">{{ text('身份来源', 'Identity source') }}</dt><dd>{{ identitySource(accountViews[account.id]!.identity.identity_source) }} · #{{ accountViews[account.id]!.identity.identity_account_id }}</dd></div>
+                  <div><dt class="text-muted">Originator / Version</dt><dd class="font-mono">{{ accountViews[account.id]!.identity.originator }} / {{ accountViews[account.id]!.identity.version }}</dd></div>
+                  <div><dt class="text-muted">{{ text('当前收敛状态', 'Effective convergence') }}</dt><dd>{{ effectiveMode(accountViews[account.id]!) }}</dd></div>
+                </dl></td></tr>
+              </template>
+              <tr v-if="!rows.length"><td colspan="4" class="p-6 text-center text-muted">{{ rowsLoading ? t('common.loading') : text('没有符合条件的账号', 'No matching accounts') }}</td></tr>
+            </tbody>
+          </table>
+        </div>
+        <div class="flex items-center justify-between gap-3 text-sm text-muted"><span>{{ page }} / {{ Math.max(1, Math.ceil(total / pageSize)) }} · {{ total }}</span><div class="flex gap-2"><button class="btn btn-secondary btn-sm" :disabled="rowsLoading || page <= 1" @click="changePage(-1)">{{ text('上一页', 'Previous') }}</button><button class="btn btn-secondary btn-sm" :disabled="rowsLoading || page * pageSize >= total" @click="changePage(1)">{{ text('下一页', 'Next') }}</button></div></div>
+      </section>
+    </section>
+  </AppLayout>
+</template>
+
+<script setup lang="ts">
+import { computed, onBeforeUnmount, onMounted, reactive, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import AppLayout from '@/components/layout/AppLayout.vue'
+import accountsAPI from '@/api/admin/accounts'
+import { codexFingerprintAPI, type CodexFingerprintSettings, type CodexFingerprintSettingsView, type CodexFingerprintMode, type CodexFingerprintAccountView } from '@/api/admin/codexFingerprint'
+import { useAccountJobsStore, isTerminalAccountJob } from '@/stores/accountJobs'
+import { extractApiErrorMessage } from '@/utils/apiError'
+import type { AccountListItem } from '@/types'
+
+const { t, locale } = useI18n()
+const text = (zh: string, en: string) => locale.value.startsWith('en') ? en : zh
+const jobs = useAccountJobsStore()
+const settings = ref<CodexFingerprintSettingsView | null>(null)
+const draft = reactive<CodexFingerprintSettings>({ enabled: true, user_agent: '', client_version: '', version_auto_sync_enabled: true })
+const settingsBusy = ref(false), rowsLoading = ref(false), bulkBusy = ref(false)
+const error = ref(''), message = ref('')
+const rows = ref<AccountListItem[]>([]), selectedIDs = ref<number[]>([])
+const draftModes = reactive<Record<number, CodexFingerprintMode>>({})
+const rowBusy = reactive<Record<number, boolean>>({})
+const accountViews = reactive<Record<number, CodexFingerprintAccountView>>({})
+const page = ref(1), total = ref(0), search = ref(''), activeSearch = ref(''), bulkMode = ref<CodexFingerprintMode>('device')
+const pageSize = 20
+let generation = 0, listSerial = 0
+const ownedJobID = ref(0)
+let listController: AbortController | null = null
+const modes = computed(() => [
+  { value: 'off' as const, label: text('保留设备／会话标识', 'Preserve device/session identifiers') },
+  { value: 'device' as const, label: text('仅设备', 'Device only') },
+  { value: 'session' as const, label: text('设备＋会话', 'Device + session') },
+  { value: 'full' as const, label: text('设备＋会话＋线程', 'Device + session + thread') }
+])
+const settingsDirty = computed(() => settings.value && (draft.enabled !== settings.value.enabled || draft.user_agent !== settings.value.user_agent || draft.client_version !== settings.value.client_version || draft.version_auto_sync_enabled !== settings.value.version_auto_sync_enabled))
+const allPageSelected = computed(() => rows.value.length > 0 && rows.value.every(row => selectedIDs.value.includes(row.id)))
+const somePageSelected = computed(() => rows.value.some(row => selectedIDs.value.includes(row.id)))
+
+function savedMode(account: AccountListItem): CodexFingerprintMode {
+  const value = accountViews[account.id]?.mode || account.extra?.codex_fingerprint_mode
+  return modes.value.some(mode => mode.value === value) ? value as CodexFingerprintMode : 'device'
+}
+function selectAccount(id: number, selected: boolean) {
+  selectedIDs.value = selected ? [...new Set([...selectedIDs.value, id])] : selectedIDs.value.filter(value => value !== id)
+}
+function selectPage(selected: boolean) { for (const row of rows.value) selectAccount(row.id, selected) }
+function identitySource(source: string): string {
+  const labels: Record<string, string> = { account: text('账号固定 TUI', 'Fixed account TUI'), override_ua: text('账号自定义 UA', 'Account UA override'), canonical: text('全局默认', 'Global default'), protocol_fallback: text('协议兜底；实际请求保留客户端身份', 'Protocol fallback; actual requests retain the client identity') }
+  return labels[source] || source
+}
+function effectiveMode(view: CodexFingerprintAccountView): string {
+  if (!view.simulation_enabled) return text('总开关已关闭', 'Master switch is off')
+  if (view.identity.fingerprint_reason === 'seed_missing') return text('身份种子缺失，未收敛', 'Missing identity seed; no convergence')
+  return modes.value.find(mode => mode.value === view.identity.fingerprint_mode_effective)?.label || view.identity.fingerprint_reason
+}
+async function loadSettings() {
+  const current = generation
+  try {
+    const value = await codexFingerprintAPI.getSettings()
+    if (current !== generation) return
+    settings.value = value; Object.assign(draft, value)
+  } catch (cause) { if (current === generation) error.value = extractApiErrorMessage(cause, t('common.error')) }
+}
+async function saveSettings() {
+  if (!settings.value || settingsBusy.value) return
+  const current = generation
+  const sent: CodexFingerprintSettings = { enabled: draft.enabled, user_agent: draft.user_agent, client_version: draft.client_version, version_auto_sync_enabled: draft.version_auto_sync_enabled }
+  settingsBusy.value = true; error.value = ''; message.value = ''
+  try {
+    const value = await codexFingerprintAPI.saveSettings(sent)
+    if (current !== generation) return
+    settings.value = value; Object.assign(draft, value)
+    for (const id of Object.keys(accountViews)) delete accountViews[Number(id)]
+    message.value = text('设置已保存，新请求立即生效', 'Settings saved; new requests use the new policy')
+  } catch (cause) { if (current === generation) error.value = extractApiErrorMessage(cause, t('common.error')) }
+  finally { if (current === generation) settingsBusy.value = false }
+}
+async function loadRows() {
+  const current = ++listSerial
+  listController?.abort(); listController = new AbortController(); rowsLoading.value = true
+  try {
+    const result = await accountsAPI.list(page.value, pageSize, { platform: 'openai', types: 'oauth,setup-token', search: activeSearch.value, lite: '0' }, { signal: listController.signal })
+    if (current !== listSerial) return
+    rows.value = result.items; total.value = result.total
+    for (const row of rows.value) { delete accountViews[row.id]; draftModes[row.id] = savedMode(row) }
+  } catch (cause) { if (current === listSerial && !listController.signal.aborted) error.value = extractApiErrorMessage(cause, t('common.error')) }
+  finally { if (current === listSerial) rowsLoading.value = false }
+}
+function searchAccounts() { page.value = 1; activeSearch.value = search.value.trim(); void loadRows() }
+function changePage(delta: number) { page.value += delta; void loadRows() }
+async function showIdentity(id: number) {
+  if (accountViews[id]) { delete accountViews[id]; return }
+  const current = generation
+  const account = rows.value.find(row => row.id === id)
+  const dirty = account && draftModes[id] !== savedMode(account)
+  rowBusy[id] = true
+  try {
+    const view = await codexFingerprintAPI.getAccount(id)
+    if (current === generation) {
+      if (account) account.extra = { ...account.extra, codex_fingerprint_mode: view.mode }
+      accountViews[id] = view
+      if (!dirty) draftModes[id] = view.mode
+    }
+  }
+  catch (cause) { if (current === generation) error.value = extractApiErrorMessage(cause, t('common.error')) }
+  finally { if (current === generation) rowBusy[id] = false }
+}
+async function saveAccount(account: AccountListItem) {
+  const current = generation, mode = draftModes[account.id]
+  if (!mode || rowBusy[account.id]) return
+  rowBusy[account.id] = true; error.value = ''; message.value = ''
+  try {
+    const view = await codexFingerprintAPI.saveAccount(account.id, mode)
+    if (current !== generation) return
+    accountViews[account.id] = view
+    account.extra = { ...account.extra, codex_fingerprint_mode: view.mode }
+    draftModes[account.id] = view.mode
+    message.value = text('账号模式已保存', 'Account mode saved')
+  } catch (cause) { if (current === generation) error.value = extractApiErrorMessage(cause, t('common.error')) }
+  finally { if (current === generation) rowBusy[account.id] = false }
+}
+async function saveBulk() {
+  if (!selectedIDs.value.length || bulkBusy.value) return
+  const ids = [...selectedIDs.value], mode = bulkMode.value, current = generation
+  bulkBusy.value = true; error.value = ''; message.value = ''
+  try {
+    const job = await accountsAPI.bulkUpdate(ids, { extra: { codex_fingerprint_mode: mode } })
+    if (current !== generation) return
+    ownedJobID.value = job.id; jobs.track(job)
+    selectedIDs.value = selectedIDs.value.filter(id => !ids.includes(id))
+    message.value = text('批量任务已提交，可在操作记录中查看结果', 'Batch operation submitted; results are available in operation history')
+  } catch (cause) { if (current === generation) error.value = extractApiErrorMessage(cause, t('common.error')) }
+  finally { if (current === generation) bulkBusy.value = false }
+}
+watch(() => jobs.visibleJobs.find(job => job.id === ownedJobID.value)?.status, () => {
+  const job = jobs.visibleJobs.find(job => job.id === ownedJobID.value)
+  if (job && isTerminalAccountJob(job)) { ownedJobID.value = 0; void loadRows() }
+})
+onMounted(() => { void loadSettings(); void loadRows() })
+onBeforeUnmount(() => { generation++; listSerial++; listController?.abort() })
+</script>
diff --git a/frontend/src/views/admin/SettingsView.vue b/frontend/src/views/admin/SettingsView.vue
index 746e401f3be6..6351e4a9592a 100644
--- a/frontend/src/views/admin/SettingsView.vue
+++ b/frontend/src/views/admin/SettingsView.vue
@@ -5806,100 +5806,6 @@
                 </p>
               </div>
 
-              <!-- OpenAI Codex UA -->
-              <div>
-                <label
-                  class="mb-2 block text-sm font-medium text-gray-700 dark:text-gray-300"
-                >
-                  {{
-                    t(
-                      "admin.settings.gatewayForwarding.openaiCodexUserAgent",
-                    )
-                  }}
-                </label>
-                <input
-                  v-model="form.openai_codex_user_agent"
-                  type="text"
-                  class="input w-full font-mono text-sm"
-                  :placeholder="
-                    t(
-                      'admin.settings.gatewayForwarding.openaiCodexUserAgentPlaceholder',
-                    )
-                  "
-                />
-                <p class="mt-1.5 text-xs text-gray-500 dark:text-gray-400">
-                  {{
-                    t(
-                      "admin.settings.gatewayForwarding.openaiCodexUserAgentHint",
-                    )
-                  }}
-                </p>
-              </div>
-
-              <!-- Codex 客户端版本号 -->
-              <div>
-                <label
-                  class="mb-2 block text-sm font-medium text-gray-700 dark:text-gray-300"
-                >
-                  {{
-                    t(
-                      "admin.settings.gatewayForwarding.openaiCodexClientVersion",
-                    )
-                  }}
-                </label>
-                <input
-                  v-model="form.openai_codex_client_version"
-                  data-testid="openai-codex-client-version-input"
-                  type="text"
-                  class="input w-full font-mono text-sm"
-                  :placeholder="
-                    t(
-                      'admin.settings.gatewayForwarding.openaiCodexClientVersionPlaceholder',
-                    )
-                  "
-                />
-                <p class="mt-1.5 text-xs text-gray-500 dark:text-gray-400">
-                  {{
-                    t(
-                      "admin.settings.gatewayForwarding.openaiCodexClientVersionHint",
-                    )
-                  }}
-                </p>
-              </div>
-
-              <!-- Codex 版本号自动同步 -->
-              <div class="flex items-center justify-between" data-ui="setting-row">
-                <div>
-                  <label
-                    class="text-sm font-medium text-gray-700 dark:text-gray-300"
-                  >
-                    {{
-                      t(
-                        "admin.settings.gatewayForwarding.openaiCodexVersionAutoSync",
-                      )
-                    }}
-                  </label>
-                  <p class="mt-0.5 text-xs text-gray-500 dark:text-gray-400">
-                    {{
-                      t(
-                        "admin.settings.gatewayForwarding.openaiCodexVersionAutoSyncHint",
-                      )
-                    }}
-                  </p>
-                  <p
-                    v-if="codexSyncedVersionLabel"
-                    data-testid="openai-codex-synced-version"
-                    class="mt-0.5 text-xs text-gray-500 dark:text-gray-400"
-                  >
-                    {{ codexSyncedVersionLabel }}
-                  </p>
-                </div>
-                <Toggle
-                  v-model="form.openai_codex_version_auto_sync_enabled"
-                  data-testid="openai-codex-version-auto-sync-toggle"
-                />
-              </div>
-
               <!-- Claude Code 客户端版本号 -->
               <div>
                 <label
@@ -9912,6 +9818,10 @@ type SettingsForm = Omit<
   | "wechat_connect_mp_enabled"
   | "wechat_connect_mobile_enabled"
   | "openai_oauth_scheduling_rate_multiplier"
+  | "openai_codex_user_agent"
+  | "openai_codex_client_version"
+  | "openai_codex_client_version_synced"
+  | "openai_codex_version_auto_sync_enabled"
 > & {
   /** Form always binds a concrete boolean (SystemSettings marks this optional). */
   channel_monitor_hide_throughput: boolean;
@@ -10221,11 +10131,7 @@ const form = reactive<SettingsForm>({
   rewrite_message_cache_control: false,
   enable_client_dateline_normalization: true,
   antigravity_user_agent_version: "",
-  openai_codex_user_agent: "",
-  openai_codex_client_version: "",
   // 只读展示：自动同步任务写入的官方最新稳定版，不参与提交（提交载荷按字段显式构造）
-  openai_codex_client_version_synced: "",
-  openai_codex_version_auto_sync_enabled: true,
   claude_code_client_version: "",
   // 只读展示：自动同步任务写入的官方最新稳定版，不参与提交（提交载荷按字段显式构造）
   claude_code_client_version_synced: "",
@@ -11348,14 +11254,6 @@ function removeCodexWhitelistRow(i: number): void {
   codexWhitelistRows.value.splice(i, 1);
 }
 
-const codexSyncedVersionLabel = computed(() => {
-  const synced = form.openai_codex_client_version_synced?.trim();
-  if (!synced) return "";
-  return t("admin.settings.gatewayForwarding.openaiCodexVersionSyncedValue", {
-    version: synced,
-  });
-});
-
 const claudeSyncedVersionLabel = computed(() => {
   const synced = form.claude_code_client_version_synced?.trim();
   if (!synced) return "";
@@ -12082,12 +11980,6 @@ async function saveSettings() {
         form.enable_client_dateline_normalization,
       antigravity_user_agent_version:
         form.antigravity_user_agent_version?.trim() || "",
-      openai_codex_user_agent:
-        form.openai_codex_user_agent?.trim() || "",
-      openai_codex_client_version:
-        form.openai_codex_client_version?.trim() || "",
-      openai_codex_version_auto_sync_enabled:
-        form.openai_codex_version_auto_sync_enabled,
       claude_code_client_version: form.claude_code_client_version?.trim() || "",
       claude_code_version_auto_sync_enabled:
         form.claude_code_version_auto_sync_enabled,
diff --git a/frontend/src/views/admin/__tests__/CodexFingerprintView.spec.ts b/frontend/src/views/admin/__tests__/CodexFingerprintView.spec.ts
new file mode 100644
index 000000000000..02ed8b79896a
--- /dev/null
+++ b/frontend/src/views/admin/__tests__/CodexFingerprintView.spec.ts
@@ -0,0 +1,90 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { flushPromises, mount } from '@vue/test-utils'
+import { ref } from 'vue'
+import CodexFingerprintView from '../CodexFingerprintView.vue'
+
+const { getSettings, saveSettings, getAccount, saveAccount, list, bulkUpdate, track } = vi.hoisted(() => ({
+  getSettings: vi.fn(), saveSettings: vi.fn(), getAccount: vi.fn(), saveAccount: vi.fn(), list: vi.fn(), bulkUpdate: vi.fn(), track: vi.fn()
+}))
+vi.mock('@/api/admin/codexFingerprint', () => ({ codexFingerprintAPI: { getSettings, saveSettings, getAccount, saveAccount } }))
+vi.mock('@/api/admin/accounts', () => ({ default: { list, bulkUpdate } }))
+vi.mock('@/stores/accountJobs', () => ({ useAccountJobsStore: () => ({ visibleJobs: [], track }), isTerminalAccountJob: () => false }))
+vi.mock('vue-i18n', async importOriginal => ({
+  ...await importOriginal<typeof import('vue-i18n')>(),
+  useI18n: () => ({ t: (key: string) => key, locale: ref('zh') })
+}))
+
+const settings = { enabled: true, user_agent: '', client_version: '', version_auto_sync_enabled: true, synced_version: '0.161.0', effective_version: '0.161.0', effective_user_agent: 'codex_cli_rs/0.161.0 (Ubuntu 24.4.0; x86_64) xterm-256color' }
+const accountView = { mode: 'full', simulation_enabled: true, identity: { user_agent: settings.effective_user_agent, originator: 'codex_cli_rs', version: '0.161.0', identity_source: 'account', identity_account_id: 1, fingerprint_mode_effective: 'full', fingerprint_reason: 'ok' } }
+async function open() {
+  const wrapper = mount(CodexFingerprintView, { global: { stubs: { AppLayout: { template: '<div><slot /></div>' } } } })
+  await flushPromises()
+  return wrapper
+}
+
+describe('CodexFingerprintView', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    getSettings.mockResolvedValue({ ...settings })
+    saveSettings.mockImplementation(async config => ({ ...settings, ...config }))
+    getAccount.mockResolvedValue({ ...accountView })
+    saveAccount.mockImplementation(async (_id, mode) => ({ ...accountView, mode }))
+    list.mockResolvedValue({ items: [{ id: 1, name: 'First', type: 'oauth', extra: { codex_fingerprint_mode: 'full' } }, { id: 2, name: 'Second', type: 'setup-token', extra: { codex_fingerprint_mode: 'off' } }], total: 2 })
+    bulkUpdate.mockResolvedValue({ id: 8, status: 'pending' })
+  })
+
+  it('loads the effective version and saves only the four global settings without resetting account identity', async () => {
+    const wrapper = await open()
+    expect(wrapper.get('[data-test="fingerprint-effective-version"]').text()).toBe('0.161.0')
+    await wrapper.get('[data-test="fingerprint-enabled"]').setValue(false)
+    await wrapper.find('form').trigger('submit.prevent')
+    await flushPromises()
+    expect(saveSettings).toHaveBeenCalledWith({ enabled: false, user_agent: '', client_version: '', version_auto_sync_enabled: true })
+    expect(saveAccount).not.toHaveBeenCalled()
+    expect(bulkUpdate).not.toHaveBeenCalled()
+    wrapper.unmount()
+  })
+
+  it('updates a single mode through the bounded endpoint and displays the shared effective identity', async () => {
+    const wrapper = await open()
+    await wrapper.get('[data-test="fingerprint-mode-1"]').setValue('session')
+    await wrapper.get('[data-test="fingerprint-account-save-1"]').trigger('click')
+    await flushPromises()
+    expect(saveAccount).toHaveBeenCalledWith(1, 'session')
+    expect(wrapper.text()).toContain(settings.effective_user_agent)
+    expect(wrapper.get<HTMLButtonElement>('[data-test="fingerprint-account-save-1"]').element.disabled).toBe(true)
+    await wrapper.findAll('button').find(button => button.text() === '查看生效身份')!.trigger('click')
+    expect(wrapper.get<HTMLButtonElement>('[data-test="fingerprint-account-save-1"]').element.disabled).toBe(true)
+    wrapper.unmount()
+  })
+
+  it('freezes selected IDs and submits an explicit off mode as the only bulk update', async () => {
+    let finish!: (job: unknown) => void
+    bulkUpdate.mockImplementationOnce(() => new Promise(resolve => { finish = resolve }))
+    const wrapper = await open()
+    await wrapper.get('input[aria-label="选择本页账号"]').setValue(true)
+    await wrapper.get('[data-test="fingerprint-bulk-mode"]').setValue('off')
+    await wrapper.get('[data-test="fingerprint-bulk-save"]').trigger('click')
+    await wrapper.get('input[aria-label="选择账号 First"]').setValue(false)
+    expect(bulkUpdate).toHaveBeenCalledWith([1, 2], { extra: { codex_fingerprint_mode: 'off' } })
+    finish({ id: 8, status: 'pending' }); await flushPromises()
+    expect(track).toHaveBeenCalledWith({ id: 8, status: 'pending' })
+    expect(list.mock.calls[0]?.[2]).toEqual({ platform: 'openai', types: 'oauth,setup-token', search: '', lite: '0' })
+    wrapper.unmount()
+  })
+
+  it('retains an unsaved draft after storage failure and disables controls when the initial settings load fails', async () => {
+    saveSettings.mockRejectedValueOnce(new Error('save failed'))
+    const wrapper = await open()
+    await wrapper.get('[data-test="fingerprint-enabled"]').setValue(false)
+    await wrapper.find('form').trigger('submit.prevent'); await flushPromises()
+    expect(wrapper.get('[role="alert"]').text()).toContain('save failed')
+    expect(wrapper.get<HTMLInputElement>('[data-test="fingerprint-enabled"]').element.checked).toBe(false)
+    wrapper.unmount()
+    getSettings.mockRejectedValueOnce(new Error('load failed'))
+    const refused = await open()
+    expect(refused.get('fieldset').attributes('disabled')).toBeDefined()
+    expect(refused.get('[role="alert"]').text()).toContain('load failed')
+    refused.unmount()
+  })
+})
diff --git a/frontend/src/views/admin/__tests__/SettingsView.spec.ts b/frontend/src/views/admin/__tests__/SettingsView.spec.ts
index d0d46fd33594..c1277d11361f 100644
--- a/frontend/src/views/admin/__tests__/SettingsView.spec.ts
+++ b/frontend/src/views/admin/__tests__/SettingsView.spec.ts
@@ -1224,36 +1224,17 @@ describe("admin SettingsView payment visible method controls", () => {
     );
   });
 
-  it("loads and saves Codex version synchronization settings", async () => {
-    getSettings.mockResolvedValueOnce({
-      ...baseSettingsResponse,
-      openai_codex_client_version: "0.145.0",
-      openai_codex_client_version_synced: "0.146.0",
-      openai_codex_version_auto_sync_enabled: true,
-    });
+  it("leaves Codex fingerprint configuration to the extension page when saving general settings", async () => {
+    getSettings.mockResolvedValueOnce({ ...baseSettingsResponse, openai_codex_client_version: "0.145.0", openai_codex_client_version_synced: "0.146.0", openai_codex_version_auto_sync_enabled: false });
     const wrapper = mountView();
     await flushPromises();
     await openGatewayTab(wrapper);
-
-    const versionInput = wrapper.get(
-      '[data-testid="openai-codex-client-version-input"]',
-    );
-    expect((versionInput.element as HTMLInputElement).value).toBe("0.145.0");
-    expect(wrapper.get('[data-testid="openai-codex-synced-version"]').text()).toContain(
-      "0.146.0",
-    );
-    await versionInput.setValue("0.147.0");
-    await wrapper
-      .get('[data-testid="openai-codex-version-auto-sync-toggle"]')
-      .setValue(false);
-
+    expect(wrapper.find('[data-testid="openai-codex-client-version-input"]').exists()).toBe(false);
+    expect(wrapper.find('[data-testid="openai-codex-version-auto-sync-toggle"]').exists()).toBe(false);
     await wrapper.find("form").trigger("submit.prevent");
     await flushPromises();
-
     const payload = updateSettings.mock.calls.at(-1)?.[0] as Record<string, unknown>;
-    expect(payload.openai_codex_client_version).toBe("0.147.0");
-    expect(payload.openai_codex_version_auto_sync_enabled).toBe(false);
-    expect(payload).not.toHaveProperty("openai_codex_client_version_synced");
+    for (const key of ["openai_codex_user_agent", "openai_codex_client_version", "openai_codex_client_version_synced", "openai_codex_version_auto_sync_enabled"]) expect(payload).not.toHaveProperty(key);
   });
 
   it("disables passkey sign-in when the RP configuration is unavailable", async () => {