diff --git a/README.md b/README.md
index a59c3fb..5947348 100644
--- a/README.md
+++ b/README.md
@@ -71,7 +71,7 @@
 
 ## 主题
 
-GitHub `tree` 地址对应的目录需提供 `index.html` 和 `assets/`，并使用 NodeFlare 公开 API 读取数据。启用第三方主题前请确认来源可信。
+GitHub `tree` 地址对应的目录需提供 `index.html` 和 `assets/`，并使用 NodeFlare 公开 API 读取数据。可选的 `theme.json` 可声明后台显示的主题设置项。启用第三方主题前请确认来源可信。
 
 ## 鸣谢
 
diff --git a/agent/src/main.rs b/agent/src/main.rs
index dadf040..5f88bde 100644
--- a/agent/src/main.rs
+++ b/agent/src/main.rs
@@ -11,6 +11,7 @@ use std::path::Path;
 use std::process::Command;
 #[cfg(target_os = "windows")]
 use std::process::Stdio;
+use std::sync::{mpsc, Arc, Mutex};
 use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
@@ -32,6 +33,8 @@ const PROBE_ATTEMPTS: usize = 4;
 const PROBE_TIMEOUT: Duration = Duration::from_secs(1);
 const MAX_AGENT_BINARY_BYTES: u64 = 64 * 1024 * 1024;
 const MAX_LATENCY_TASKS: usize = 128;
+const LATENCY_WORKERS: usize = 4;
+const MAX_PENDING_LATENCY_RESULTS: usize = 4096;
 const MAX_REPORT_AGE_SECONDS: i64 = 7_000;
 const REPORT_RETRY_MIN: Duration = Duration::from_secs(5);
 const REPORT_RETRY_MAX: Duration = Duration::from_secs(300);
@@ -94,13 +97,80 @@ struct LatencyResult {
     packet_loss: f64,
 }
 
+struct LatencyExecutor {
+    task_tx: mpsc::SyncSender<LatencyTask>,
+    result_rx: mpsc::Receiver<LatencyResult>,
+    in_flight: HashSet<String>,
+}
+
+impl LatencyExecutor {
+    fn new() -> Result<Self> {
+        let (task_tx, task_rx) = mpsc::sync_channel::<LatencyTask>(MAX_LATENCY_TASKS);
+        let (result_tx, result_rx) = mpsc::channel();
+        let task_rx = Arc::new(Mutex::new(task_rx));
+
+        for index in 0..LATENCY_WORKERS {
+            let task_rx = Arc::clone(&task_rx);
+            let result_tx = result_tx.clone();
+            thread::Builder::new()
+                .name(format!("nodeflare-latency-{index}"))
+                .spawn(move || loop {
+                    let task = match task_rx.lock() {
+                        Ok(receiver) => receiver.try_recv(),
+                        Err(_) => return,
+                    };
+                    match task {
+                        Ok(task) => {
+                            if result_tx.send(execute_latency_task(task)).is_err() {
+                                return;
+                            }
+                        }
+                        Err(mpsc::TryRecvError::Empty) => {
+                            thread::sleep(Duration::from_millis(25));
+                        }
+                        Err(mpsc::TryRecvError::Disconnected) => return,
+                    };
+                })?;
+        }
+
+        Ok(Self {
+            task_tx,
+            result_rx,
+            in_flight: HashSet::new(),
+        })
+    }
+
+    fn enqueue(&mut self, task: LatencyTask) -> bool {
+        if self.in_flight.contains(&task.id) {
+            return false;
+        }
+        let task_id = task.id.clone();
+        match self.task_tx.try_send(task) {
+            Ok(()) => {
+                self.in_flight.insert(task_id);
+                true
+            }
+            Err(mpsc::TrySendError::Full(_)) => false,
+            Err(mpsc::TrySendError::Disconnected(_)) => false,
+        }
+    }
+
+    fn drain(&mut self) -> Vec<LatencyResult> {
+        let results = self.result_rx.try_iter().collect::<Vec<_>>();
+        for result in &results {
+            self.in_flight.remove(&result.task_id);
+        }
+        results
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct RemoteConfig {
     report_interval: u64,
     collect_interval: u64,
     network_interface: String,
-    auto_update: i64,
+    auto_update: bool,
     latency_tasks: Vec<LatencyTask>,
 }
 
@@ -117,13 +187,6 @@ struct GithubReleaseAsset {
     digest: Option<String>,
 }
 
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct ReportResponse {
-    success: bool,
-    config: RemoteConfig,
-}
-
 struct SubmitResult {
     config: Option<RemoteConfig>,
     config_hash: String,
@@ -152,7 +215,7 @@ struct DiskMetric {
 #[derive(Debug, Clone, Serialize)]
 struct GpuMetric {
     model: String,
-    usage: f64,
+    usage: Option<f64>,
     memory_used: i64,
     memory_total: i64,
 }
@@ -195,7 +258,6 @@ struct Report {
     disk_utilization: f64,
     disks: Vec<DiskMetric>,
     gpus: Vec<GpuMetric>,
-    message: String,
     latency_results: Vec<LatencyResult>,
 }
 
@@ -619,38 +681,21 @@ fn unix_timestamp() -> i64 {
         .as_secs() as i64
 }
 
-fn execute_latency_tasks(tasks: &[LatencyTask]) -> Vec<LatencyResult> {
-    let mut results = Vec::with_capacity(tasks.len());
-    thread::scope(|scope| {
-        let handles = tasks
-            .iter()
-            .cloned()
-            .map(|task| {
-                scope.spawn(move || {
-                    let (latency_ms, packet_loss) = match task.task_type.as_str() {
-                        "tcp" => tcp_latency_probe(&task.target),
-                        "icmp" => icmp_latency_probe(&task.target),
-                        _ => (-1.0, 100.0),
-                    };
-                    LatencyResult {
-                        task_id: task.id,
-                        timestamp: unix_timestamp(),
-                        latency_ms,
-                        packet_loss,
-                    }
-                })
-            })
-            .collect::<Vec<_>>();
-        for handle in handles {
-            if let Ok(result) = handle.join() {
-                results.push(result);
-            }
-        }
-    });
-    results
+fn execute_latency_task(task: LatencyTask) -> LatencyResult {
+    let (latency_ms, packet_loss) = match task.task_type.as_str() {
+        "tcp" => tcp_latency_probe(&task.target),
+        "icmp" => icmp_latency_probe(&task.target),
+        _ => (-1.0, 100.0),
+    };
+    LatencyResult {
+        task_id: task.id,
+        timestamp: unix_timestamp(),
+        latency_ms,
+        packet_loss,
+    }
 }
 
-fn gpu_info() -> Vec<GpuMetric> {
+fn nvidia_gpu_info() -> Vec<GpuMetric> {
     let gpu = command(
         "nvidia-smi",
         &[
@@ -664,8 +709,11 @@ fn gpu_info() -> Vec<GpuMetric> {
             if fields.len() < 4 {
                 return None;
             }
+            if fields[1].is_empty() {
+                return None;
+            }
             Some(GpuMetric {
-                usage: fields[0].parse().unwrap_or(0.0),
+                usage: fields[0].parse().ok(),
                 model: fields[1].to_string(),
                 memory_used: fields[2]
                     .parse::<i64>()
@@ -680,6 +728,172 @@ fn gpu_info() -> Vec<GpuMetric> {
         .collect()
 }
 
+fn basic_gpu_metrics(names: impl IntoIterator<Item = String>) -> Vec<GpuMetric> {
+    let mut seen = HashSet::new();
+    names
+        .into_iter()
+        .filter_map(|name| {
+            let name = name.split(" (rev ").next().unwrap_or(&name).trim();
+            let lower = name.to_ascii_lowercase();
+            if name.is_empty()
+                || [
+                    "sensor hub",
+                    "management engine",
+                    "ethernet",
+                    "wireless",
+                    "audio controller",
+                    "usb controller",
+                    "sata controller",
+                    "virtio",
+                    "vmware",
+                    "qxl",
+                    "hyper-v",
+                    "cirrus",
+                    "microsoft basic display",
+                ]
+                .iter()
+                .any(|pattern| lower.contains(pattern))
+                || !seen.insert(name.to_string())
+            {
+                return None;
+            }
+            Some(GpuMetric {
+                model: name.to_string(),
+                usage: None,
+                memory_used: 0,
+                memory_total: 0,
+            })
+        })
+        .collect()
+}
+
+#[cfg(any(target_os = "linux", test))]
+fn parse_lspci_gpu_names(output: &str) -> Vec<String> {
+    output
+        .lines()
+        .filter(|line| {
+            let lower = line.to_ascii_lowercase();
+            lower.contains("vga compatible controller")
+                || lower.contains("3d controller")
+                || lower.contains("display controller")
+        })
+        .filter_map(|line| line.split_once(": ").map(|(_, name)| name.to_string()))
+        .collect()
+}
+
+#[cfg(any(target_os = "linux", test))]
+fn gpu_name_from_uevent(output: &str) -> Option<String> {
+    let driver = output
+        .lines()
+        .find_map(|line| line.strip_prefix("DRIVER="))?;
+    let pci_class = output
+        .lines()
+        .find_map(|line| line.strip_prefix("PCI_CLASS="))
+        .unwrap_or_default();
+    if u32::from_str_radix(pci_class, 16)
+        .ok()
+        .map(|class| class >> 16)
+        != Some(3)
+    {
+        return None;
+    }
+    match driver {
+        "i915" | "xe" => Some("Intel Integrated Graphics".to_string()),
+        "amdgpu" | "radeon" => Some("AMD Radeon Graphics".to_string()),
+        "nvidia" | "nouveau" => Some("NVIDIA GPU".to_string()),
+        "msm" | "msm_drm" => Some("Qualcomm Adreno GPU".to_string()),
+        "panfrost" | "lima" => Some("ARM Mali GPU".to_string()),
+        "vc4" | "v3d" => Some("Broadcom VideoCore Graphics".to_string()),
+        "virtio-pci" | "virtio_gpu" | "bochs-drm" | "qxl" | "vmwgfx" | "cirrus" | "vboxvideo"
+        | "hyperv_fb" | "simpledrm" | "simplefb" => None,
+        other if !other.is_empty() => Some(format!("GPU ({other})")),
+        _ => None,
+    }
+}
+
+#[cfg(target_os = "linux")]
+fn sysfs_gpu_names() -> Vec<String> {
+    let Ok(entries) = fs::read_dir("/sys/class/drm") else {
+        return Vec::new();
+    };
+    entries
+        .filter_map(|entry| entry.ok())
+        .filter(|entry| {
+            let name = entry.file_name();
+            let name = name.to_string_lossy();
+            name.strip_prefix("card").is_some_and(|suffix| {
+                !suffix.is_empty() && suffix.chars().all(|c| c.is_ascii_digit())
+            })
+        })
+        .filter_map(|entry| gpu_name_from_uevent(&text(entry.path().join("device/uevent"))))
+        .collect()
+}
+
+#[cfg(any(target_os = "macos", test))]
+fn parse_system_profiler_gpu_names(output: &str) -> Vec<String> {
+    output
+        .lines()
+        .filter_map(|line| {
+            line.trim()
+                .strip_prefix("Chipset Model:")
+                .map(|name| name.trim().to_string())
+        })
+        .collect()
+}
+
+#[cfg(target_os = "linux")]
+fn basic_gpu_info() -> Vec<GpuMetric> {
+    let names = parse_lspci_gpu_names(&command("lspci", &[]));
+    basic_gpu_metrics(if names.is_empty() {
+        sysfs_gpu_names()
+    } else {
+        names
+    })
+}
+
+#[cfg(target_os = "windows")]
+fn basic_gpu_info() -> Vec<GpuMetric> {
+    basic_gpu_metrics(
+        command(
+            "powershell.exe",
+            &[
+                "-NoProfile",
+                "-NonInteractive",
+                "-Command",
+                "Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name }",
+            ],
+        )
+        .lines()
+        .map(str::to_string),
+    )
+}
+
+#[cfg(target_os = "macos")]
+fn basic_gpu_info() -> Vec<GpuMetric> {
+    basic_gpu_metrics(parse_system_profiler_gpu_names(&command(
+        "system_profiler",
+        &["SPDisplaysDataType"],
+    )))
+}
+
+fn gpu_info() -> Vec<GpuMetric> {
+    let detailed = nvidia_gpu_info();
+    if detailed.is_empty() {
+        basic_gpu_info()
+    } else {
+        detailed
+    }
+}
+
+fn average_gpu_usage(gpus: &[GpuMetric]) -> f64 {
+    let usages = gpus.iter().filter_map(|gpu| gpu.usage).collect::<Vec<_>>();
+    if usages.is_empty() {
+        0.0
+    } else {
+        usages.iter().sum::<f64>() / usages.len() as f64
+    }
+}
+
 #[cfg(any(target_os = "windows", target_os = "macos"))]
 fn u64_to_i64(value: u64) -> i64 {
     value.min(i64::MAX as u64) as i64
@@ -732,11 +946,7 @@ fn collect(config: &RuntimeConfig, latency_results: Vec<LatencyResult>) -> Repor
     let disk_used = disks.iter().map(|disk| disk.used).sum();
     let disk_total = disks.iter().map(|disk| disk.total).sum();
     let gpus = gpu_info();
-    let gpu_usage = if gpus.is_empty() {
-        0.0
-    } else {
-        gpus.iter().map(|gpu| gpu.usage).sum::<f64>() / gpus.len() as f64
-    };
+    let gpu_usage = average_gpu_usage(&gpus);
     let gpu_model = gpus
         .iter()
         .map(|gpu| gpu.model.as_str())
@@ -781,7 +991,6 @@ fn collect(config: &RuntimeConfig, latency_results: Vec<LatencyResult>) -> Repor
         gpu_usage,
         gpu_model,
         agent_version: VERSION.to_string(),
-        message: String::new(),
         disk_read_bps: io_after
             .read_sectors
             .saturating_sub(io_before.read_sectors)
@@ -854,11 +1063,7 @@ fn collect(config: &RuntimeConfig, latency_results: Vec<LatencyResult>) -> Repor
     let disk_total = disk_metrics.iter().map(|disk| disk.total).sum();
     let load = System::load_average();
     let gpus = gpu_info();
-    let gpu_usage = if gpus.is_empty() {
-        0.0
-    } else {
-        gpus.iter().map(|gpu| gpu.usage).sum::<f64>() / gpus.len() as f64
-    };
+    let gpu_usage = average_gpu_usage(&gpus);
     let gpu_model = gpus
         .iter()
         .map(|gpu| gpu.model.as_str())
@@ -907,7 +1112,6 @@ fn collect(config: &RuntimeConfig, latency_results: Vec<LatencyResult>) -> Repor
         disk_utilization: 0.0,
         disks: disk_metrics,
         gpus,
-        message: String::new(),
         latency_results,
     }
 }
@@ -971,11 +1175,7 @@ fn submit(
     let remote = if response.status().as_u16() == 204 {
         None
     } else {
-        let payload = response.body_mut().read_json::<ReportResponse>()?;
-        if !payload.success {
-            return Err("Worker rejected the report".into());
-        }
-        Some(payload.config)
+        Some(response.body_mut().read_json::<RemoteConfig>()?)
     };
     Ok(SubmitResult {
         config: remote,
@@ -993,7 +1193,7 @@ fn apply_remote(config: &mut RuntimeConfig, remote: &RemoteConfig) -> bool {
     config
         .network_interface
         .clone_from(&remote.network_interface);
-    config.auto_update = remote.auto_update == 1;
+    config.auto_update = remote.auto_update;
     let tasks = sanitize_latency_tasks(&remote.latency_tasks);
     let changed = config.latency_tasks != tasks;
     config.latency_tasks = tasks;
@@ -1063,6 +1263,16 @@ fn report_retry_delay(failures: u32, report_interval: u64) -> Duration {
 
 fn prune_report_samples(samples: &mut Vec<Report>, now: i64) {
     samples.retain(|report| (report.timestamp - now).abs() <= MAX_REPORT_AGE_SECONDS);
+    let mut remaining = MAX_PENDING_LATENCY_RESULTS;
+    for report in samples.iter_mut().rev() {
+        if report.latency_results.len() > remaining {
+            let discard = report.latency_results.len() - remaining;
+            report.latency_results.drain(..discard);
+            remaining = 0;
+        } else {
+            remaining -= report.latency_results.len();
+        }
+    }
 }
 
 fn normalized_version(value: &str) -> &str {
@@ -1280,12 +1490,14 @@ fn run(options: &CliOptions, once: bool, print_only: bool) -> Result<()> {
     let mut next_report = Instant::now();
     let mut next_collect = Instant::now();
     let mut next_latency: HashMap<String, Instant> = HashMap::new();
+    let mut latency_executor = LatencyExecutor::new()?;
     let mut pending_results = Vec::new();
     let mut pending_samples = Vec::new();
     let mut report_failures = 0_u32;
     let mut next_update_check = Instant::now();
     let mut config_hash = String::new();
     loop {
+        pending_results.extend(latency_executor.drain());
         let current = Instant::now();
         let due = config
             .latency_tasks
@@ -1298,13 +1510,13 @@ fn run(options: &CliOptions, once: bool, print_only: bool) -> Result<()> {
             .cloned()
             .collect::<Vec<_>>();
         if !due.is_empty() {
-            pending_results.extend(execute_latency_tasks(&due));
             let scheduled_at = Instant::now();
             for task in due {
-                next_latency.insert(
-                    task.id,
-                    scheduled_at + Duration::from_secs(task.interval_seconds.clamp(30, 3600)),
-                );
+                let task_id = task.id.clone();
+                let interval = task.interval_seconds.clamp(30, 3600);
+                if latency_executor.enqueue(task) {
+                    next_latency.insert(task_id, scheduled_at + Duration::from_secs(interval));
+                }
             }
         }
 
@@ -1399,11 +1611,12 @@ mod tests {
     use std::time::Duration;
 
     use super::{
-        agent_artifact_name, executable_format_valid, is_public_probe_ip, median,
-        normalized_version, parse_probe_target, ping_latency, prune_report_samples,
-        release_asset_sha256, report_retry_delay, sanitize_latency_tasks, selected_interface,
-        tcp_latency_probe_address, valid_endpoint, version_triplet, CliOptions, GithubReleaseAsset,
-        LatencyTask, Report, MAX_LATENCY_TASKS, PROBE_ATTEMPTS,
+        agent_artifact_name, executable_format_valid, gpu_name_from_uevent, is_public_probe_ip,
+        median, normalized_version, parse_lspci_gpu_names, parse_probe_target,
+        parse_system_profiler_gpu_names, ping_latency, prune_report_samples, release_asset_sha256,
+        report_retry_delay, sanitize_latency_tasks, selected_interface, tcp_latency_probe_address,
+        valid_endpoint, version_triplet, CliOptions, GithubReleaseAsset, LatencyResult,
+        LatencyTask, Report, MAX_LATENCY_TASKS, MAX_PENDING_LATENCY_RESULTS, PROBE_ATTEMPTS,
     };
 
     #[cfg(any(target_os = "windows", target_os = "macos"))]
@@ -1418,6 +1631,32 @@ mod tests {
         assert!(selected_interface("ens3", "eth0, ens3"));
     }
 
+    #[test]
+    fn parses_platform_gpu_names() {
+        let lspci = "00:02.0 VGA compatible controller: Intel Corporation CometLake-S GT2 [UHD Graphics 630] (rev 05)\n\
+                     01:00.0 Audio device: NVIDIA Corporation HDMI Audio\n\
+                     02:00.0 3D controller: NVIDIA Corporation GA102 [GeForce RTX 3090] (rev a1)";
+        assert_eq!(
+            parse_lspci_gpu_names(lspci),
+            [
+                "Intel Corporation CometLake-S GT2 [UHD Graphics 630] (rev 05)",
+                "NVIDIA Corporation GA102 [GeForce RTX 3090] (rev a1)",
+            ]
+        );
+
+        let profiler = "Graphics/Displays:\n\n    Apple M3 Max:\n\n      Chipset Model: Apple M3 Max\n      Metal Support: Metal 3";
+        assert_eq!(parse_system_profiler_gpu_names(profiler), ["Apple M3 Max"]);
+
+        assert_eq!(
+            gpu_name_from_uevent("DRIVER=i915\nPCI_CLASS=30000\nPCI_ID=8086:591B"),
+            Some("Intel Integrated Graphics".to_string())
+        );
+        assert_eq!(
+            gpu_name_from_uevent("DRIVER=virtio_gpu\nPCI_CLASS=30000"),
+            None
+        );
+    }
+
     #[cfg(target_os = "linux")]
     #[test]
     fn selects_whole_disk_devices() {
@@ -1552,6 +1791,32 @@ mod tests {
         assert_eq!(samples[0].timestamp, 8_500);
     }
 
+    #[test]
+    fn bounds_pending_latency_results() {
+        let mut samples = (0..MAX_PENDING_LATENCY_RESULTS + 10)
+            .map(|index| Report {
+                timestamp: index as i64 + 1,
+                latency_results: vec![LatencyResult {
+                    task_id: format!("task-{index}"),
+                    timestamp: index as i64 + 1,
+                    latency_ms: 10.0,
+                    packet_loss: 0.0,
+                }],
+                ..Report::default()
+            })
+            .collect::<Vec<_>>();
+        prune_report_samples(&mut samples, MAX_PENDING_LATENCY_RESULTS as i64 + 10);
+        assert_eq!(
+            samples
+                .iter()
+                .map(|sample| sample.latency_results.len())
+                .sum::<usize>(),
+            MAX_PENDING_LATENCY_RESULTS
+        );
+        assert!(samples.first().unwrap().latency_results.is_empty());
+        assert_eq!(samples.last().unwrap().latency_results.len(), 1);
+    }
+
     #[cfg(any(target_os = "windows", target_os = "macos"))]
     #[test]
     fn parses_netstat_connection_counts() {
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 602e9e4..c5c4fca 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -104,7 +104,7 @@ export default function App() {
     document.documentElement.classList.toggle("dark", dark);
     document.documentElement.style.colorScheme = dark ? "dark" : "light";
     document.documentElement.dataset.blur = blur ? "on" : "off";
-    document.documentElement.lang = config.locale || "zh-CN";
+    document.documentElement.lang = config.locale;
   }, [blur, config.locale, dark]);
 
   useEffect(() => {
@@ -137,7 +137,7 @@ export default function App() {
   }, [config.site_name, configReady, selectedId, servers]);
 
   useEffect(() => {
-    if (loading || !config.websocket || !config.public_dashboard || demoMode) return;
+    if (loading || !config.public_dashboard || demoMode) return;
     if (config.turnstile_enabled && !getTurnstileProof()) return;
     const reconnects: number[] = [];
     let cancelled = false;
@@ -161,9 +161,9 @@ export default function App() {
         if (event.data === "pong") return;
         try {
           const message = JSON.parse(event.data);
-          if (message.type !== "metrics") return;
-          setServers((current) => current.map((server) => server.id === message.server_id
-            ? { ...server, ...message.metrics, timestamp: message.timestamp }
+          if (message.type !== "server" || !message.server?.id) return;
+          setServers((current) => current.map((server) => server.id === message.server.id
+            ? message.server
             : server));
         } catch { /* Ignore non-protocol messages. */ }
       };
@@ -177,7 +177,7 @@ export default function App() {
       wsRef.current.forEach((socket) => socket.close());
       wsRef.current = [];
     };
-  }, [config.websocket, config.public_dashboard, config.turnstile_enabled, load, loading, needsVerification, selectedId]);
+  }, [config.public_dashboard, config.turnstile_enabled, load, loading, needsVerification, selectedId]);
 
   const groups = useMemo(() => ["__all__", ...Array.from(new Set(servers.map((server) => server.group_name || "默认")))], [servers]);
   const visible = useMemo(() => servers.filter((server) => {
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 565322a..1839da2 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -38,6 +38,7 @@ async function request<T>(path: string, init: RequestInit = {}, admin = false):
     if (response.status === 401 && admin) setToken("");
     throw new ApiError(payload.error ?? "请求失败", response.status);
   }
+  if (response.status === 204) return undefined as T;
   return response.json() as Promise<T>;
 }
 
@@ -47,7 +48,6 @@ export const api = {
   refreshExchangeRates: () => request<ExchangeRates>("/api/admin/exchange-rates/refresh", { method: "POST" }, true),
   servers: () => request<{ servers: Server[] }>("/api/servers"),
   adminServers: () => request<{ servers: AdminServer[] }>("/api/admin/servers", {}, true),
-  server: (id: string) => request<Server>(`/api/servers/${encodeURIComponent(id)}`),
   history: (id: string, hours: number) =>
     request<{ points: HistoryPoint[] }>(`/api/history/${encodeURIComponent(id)}?hours=${hours}`),
   latencyHistory: (id: string, hours: number) =>
@@ -64,26 +64,26 @@ export const api = {
   createLatencyTask: (input: LatencyTaskInput) =>
     request<{ id: string }>("/api/admin/latency-tasks", { method: "POST", body: JSON.stringify(input) }, true),
   updateLatencyTask: (id: string, input: LatencyTaskInput) =>
-    request<{ success: boolean }>(`/api/admin/latency-tasks/${encodeURIComponent(id)}`, { method: "PATCH", body: JSON.stringify(input) }, true),
+    request<void>(`/api/admin/latency-tasks/${encodeURIComponent(id)}`, { method: "PATCH", body: JSON.stringify(input) }, true),
   deleteLatencyTask: (id: string) =>
-    request<{ success: boolean }>(`/api/admin/latency-tasks/${encodeURIComponent(id)}`, { method: "DELETE" }, true),
+    request<void>(`/api/admin/latency-tasks/${encodeURIComponent(id)}`, { method: "DELETE" }, true),
   alertRules: () => request<{ rules: AlertRule[] }>("/api/admin/alert-rules", {}, true),
   createAlertRule: (input: AlertRuleInput) =>
     request<{ id: string }>("/api/admin/alert-rules", { method: "POST", body: JSON.stringify(input) }, true),
   updateAlertRule: (id: string, input: AlertRuleInput) =>
-    request<{ success: boolean }>(`/api/admin/alert-rules/${encodeURIComponent(id)}`, { method: "PATCH", body: JSON.stringify(input) }, true),
+    request<void>(`/api/admin/alert-rules/${encodeURIComponent(id)}`, { method: "PATCH", body: JSON.stringify(input) }, true),
   deleteAlertRule: (id: string) =>
-    request<{ success: boolean }>(`/api/admin/alert-rules/${encodeURIComponent(id)}`, { method: "DELETE" }, true),
+    request<void>(`/api/admin/alert-rules/${encodeURIComponent(id)}`, { method: "DELETE" }, true),
   themeSettings: () => request<ThemeSettingsSchema>("/api/admin/theme-settings", {}, true),
   themes: () => request<{ themes: Theme[] }>("/api/admin/themes", {}, true),
   addTheme: (input: Pick<Theme, "name" | "description" | "url">) =>
     request<{ id: string }>("/api/admin/themes", { method: "POST", body: JSON.stringify(input) }, true),
   activateTheme: (id: string) =>
-    request<{ success: boolean }>(`/api/admin/themes/${encodeURIComponent(id)}/activate`, { method: "POST" }, true),
+    request<void>(`/api/admin/themes/${encodeURIComponent(id)}/activate`, { method: "POST" }, true),
   previewTheme: (id: string) =>
     request<{ preview_url: string }>(`/api/admin/themes/${encodeURIComponent(id)}/preview`, { method: "POST" }, true),
   deleteTheme: (id: string) =>
-    request<{ success: boolean }>(`/api/admin/themes/${encodeURIComponent(id)}`, { method: "DELETE" }, true),
+    request<void>(`/api/admin/themes/${encodeURIComponent(id)}`, { method: "DELETE" }, true),
   saveSettings: (input: Partial<Settings>) =>
     request<{ settings: Settings; token: string | null }>("/api/admin/settings", { method: "PATCH", body: JSON.stringify(input) }, true),
   createServer: (input: ServerInput) =>
@@ -93,19 +93,19 @@ export const api = {
       true,
     ),
   updateServer: (id: string, input: ServerInput) =>
-    request<{ success: boolean }>(
+    request<void>(
       `/api/admin/servers/${encodeURIComponent(id)}`,
       { method: "PATCH", body: JSON.stringify(input) },
       true,
     ),
   deleteServer: (id: string) =>
-    request<{ success: boolean }>(
+    request<void>(
       `/api/admin/servers/${encodeURIComponent(id)}`,
       { method: "DELETE" },
       true,
     ),
   deleteServers: (ids: string[]) =>
-    request<{ success: boolean }>("/api/admin/servers", {
+    request<void>("/api/admin/servers", {
       method: "DELETE",
       body: JSON.stringify({ ids }),
     }, true),
@@ -116,13 +116,13 @@ export const api = {
       true,
     ),
   reorderServers: (ids: string[]) =>
-    request<{ success: boolean }>(
+    request<void>(
       "/api/admin/servers/order",
       { method: "PATCH", body: JSON.stringify({ ids }) },
       true,
     ),
   databaseStats: () => request<DatabaseStats>("/api/admin/database", {}, true),
   cloudflareUsage: () => request<CloudflareUsage>("/api/admin/cloudflare-usage", {}, true),
-  clearHistory: () => request<{ success: boolean }>("/api/admin/history", { method: "DELETE" }, true),
-  testNotification: () => request<{ success: boolean }>("/api/admin/notifications/test", { method: "POST" }, true),
+  clearHistory: () => request<void>("/api/admin/history", { method: "DELETE" }, true),
+  testNotification: () => request<void>("/api/admin/notifications/test", { method: "POST" }, true),
 };
diff --git a/frontend/src/components/AdminPanel.tsx b/frontend/src/components/AdminPanel.tsx
index a6f864b..3d00858 100644
--- a/frontend/src/components/AdminPanel.tsx
+++ b/frontend/src/components/AdminPanel.tsx
@@ -84,23 +84,23 @@ function toInput(server: AdminServer): ServerInput {
     group_name: server.group_name,
     tags: server.tags,
     note: server.note,
-    hidden: !!server.hidden,
+    hidden: server.hidden,
     expires_at: server.expires_at,
     traffic_limit: server.traffic_limit,
-    traffic_limit_type: server.traffic_limit_type || "sum",
+    traffic_limit_type: server.traffic_limit_type,
     price: server.price,
     billing_cycle: server.billing_cycle,
     currency: server.currency,
-    auto_renewal: !!server.auto_renewal,
+    auto_renewal: server.auto_renewal,
     public_remark: server.public_remark,
-    network_interface: server.network_interface || "",
-    reset_day: server.reset_day || 1,
-    report_interval: server.report_interval || 60,
-    collect_interval: server.collect_interval || 5,
-    rx_correction: server.rx_correction || 0,
-    tx_correction: server.tx_correction || 0,
-    offline_notify_disabled: !!server.offline_notify_disabled,
-    auto_update: !!server.auto_update,
+    network_interface: server.network_interface,
+    reset_day: server.reset_day,
+    report_interval: server.report_interval,
+    collect_interval: server.collect_interval,
+    rx_correction: server.rx_correction,
+    tx_correction: server.tx_correction,
+    offline_notify_disabled: server.offline_notify_disabled,
+    auto_update: server.auto_update,
   };
 }
 
@@ -167,15 +167,7 @@ export function AdminPanel({
       const [serverResult, settingsResult, themesResult] = await Promise.all([api.adminServers(), api.settings(), api.themes()]);
       setServers(serverResult.servers);
       setThemes(themesResult.themes);
-      setSettings({
-        ...settingsResult,
-        site_announcement: settingsResult.site_announcement || "",
-        theme_options: settingsResult.theme_options || {},
-        cloudflare_account_id: settingsResult.cloudflare_account_id || "",
-        cloudflare_api_token: settingsResult.cloudflare_api_token || "",
-        favicon_url: settingsResult.favicon_url || "",
-        locale: settingsResult.locale || "zh-CN",
-      });
+      setSettings(settingsResult);
       setAuthenticated(true);
     } catch (reason) {
       setError(reason instanceof Error ? reason.message : "加载失败");
@@ -533,7 +525,7 @@ export function AdminPanel({
               ) : tab === "themes" && settings ? (
                 <div className="theme-store-page">
                   <section className="admin-section">
-                    <div className="section-head"><div><h3>主题列表</h3><span>内置主题始终可用，远程主题由 Worker 代理前台页面和资源。</span></div></div>
+                    <div className="section-head"><div><h3>主题列表</h3><span>内置主题始终可用，远程主题由 Worker 代理前台页面和资源；可选的 theme.json 提供主题设置。</span></div></div>
                     <div className="theme-store-grid">
                       {themes.map((theme) => <article className={`theme-store-card ${theme.active ? "active" : ""}`} key={theme.id}>
                         <div className="theme-card-icon"><Palette size={20} /></div>
@@ -632,7 +624,7 @@ export function AdminPanel({
         <div className="form-grid three"><label><span>流量限额（GB）</span><input min="0" type="number" value={Math.round(form.traffic_limit / 1024 ** 3)} onChange={(event) => updateForm("traffic_limit", Number(event.target.value) * 1024 ** 3)} /></label><label><span>流量口径</span><select value={form.traffic_limit_type} onChange={(event) => updateForm("traffic_limit_type", event.target.value as ServerInput["traffic_limit_type"])}><option value="sum">上下行合计</option><option value="max">取较大值</option><option value="min">取较小值</option><option value="up">仅上行</option><option value="down">仅下行</option></select></label><label><span>流量重置日</span><input min="1" max="31" type="number" value={form.reset_day} onChange={(event) => updateForm("reset_day", Number(event.target.value))} /></label></div>
         <div className="form-grid three"><label><span>价格（0 隐藏，-1 免费）</span><input min="-1" step="0.01" type="number" value={form.price} onChange={(event) => updateForm("price", Number(event.target.value))} /></label><label><span>币种</span><select value={form.currency} onChange={(event) => updateForm("currency", event.target.value)}>{ASSET_CURRENCIES.map((code) => <option key={code}>{code}</option>)}</select></label><label><span>计费周期（天）</span><input min="1" max="3650" type="number" value={form.billing_cycle} onChange={(event) => updateForm("billing_cycle", Number(event.target.value))} /></label></div>
         <div className="form-grid three"><label><span>到期日期</span><input type="date" value={formatDate(form.expires_at)} onChange={(event) => updateForm("expires_at", event.target.value ? Math.floor(new Date(`${event.target.value}T00:00:00Z`).getTime() / 1000) : null)} /></label><label><span>Agent 上报间隔（秒）</span><input min="15" max="3600" type="number" value={form.report_interval} onChange={(event) => updateForm("report_interval", Number(event.target.value))} /></label><label><span>指标采样间隔（秒）</span><input min="2" max="60" type="number" value={form.collect_interval} onChange={(event) => updateForm("collect_interval", Number(event.target.value))} /></label></div>
-        <div className="form-grid"><label><span>统计网卡（逗号分隔，留空自动）</span><input value={form.network_interface} onChange={(event) => updateForm("network_interface", event.target.value)} placeholder="eth0,ens3" /></label><label><span>下行流量修正（GB）</span><input min="0" step="0.1" type="number" value={form.rx_correction / 1024 ** 3} onChange={(event) => updateForm("rx_correction", Number(event.target.value) * 1024 ** 3)} /></label><label><span>上行流量修正（GB）</span><input min="0" step="0.1" type="number" value={form.tx_correction / 1024 ** 3} onChange={(event) => updateForm("tx_correction", Number(event.target.value) * 1024 ** 3)} /></label></div>
+        <div className="form-grid"><label><span>统计网卡（逗号分隔，留空自动）</span><input value={form.network_interface} onChange={(event) => updateForm("network_interface", event.target.value)} placeholder="eth0,ens3" /></label><label><span>下行流量修正（GB）</span><input min="0" step="0.1" type="number" value={form.rx_correction / 1024 ** 3} onChange={(event) => updateForm("rx_correction", Math.round(Number(event.target.value) * 1024 ** 3))} /></label><label><span>上行流量修正（GB）</span><input min="0" step="0.1" type="number" value={form.tx_correction / 1024 ** 3} onChange={(event) => updateForm("tx_correction", Math.round(Number(event.target.value) * 1024 ** 3))} /></label></div>
         <label><span>公开备注</span><textarea rows={2} value={form.public_remark} onChange={(event) => updateForm("public_remark", event.target.value)} /></label><label><span>管理备注</span><textarea rows={2} value={form.note} onChange={(event) => updateForm("note", event.target.value)} /></label>
         <div className="settings-toggles editor-toggles"><Toggle label="自动续费" checked={form.auto_renewal} onChange={(value) => updateForm("auto_renewal", value)} /><Toggle label="Agent 自动更新" checked={form.auto_update} onChange={(value) => updateForm("auto_update", value)} /><Toggle label="隐藏节点" checked={form.hidden} onChange={(value) => updateForm("hidden", value)} /><Toggle label="关闭离线告警" checked={form.offline_notify_disabled} onChange={(value) => updateForm("offline_notify_disabled", value)} /></div>
         <div className="form-actions"><button type="button" className="secondary-btn" onClick={() => setEditing(null)}>取消</button><button className="primary-btn" disabled={busy}><Save size={16} />保存节点</button></div>
diff --git a/frontend/src/components/AlertRuleManager.tsx b/frontend/src/components/AlertRuleManager.tsx
index ffbb4ab..f190f50 100644
--- a/frontend/src/components/AlertRuleManager.tsx
+++ b/frontend/src/components/AlertRuleManager.tsx
@@ -1,7 +1,7 @@
 import { Pencil, Plus, Save, Trash2 } from "lucide-react";
 import { useCallback, useEffect, useState } from "react";
 import { api } from "../api";
-import type { AlertRule, AlertRuleInput, Server } from "../types";
+import type { AdminServer, AlertRule, AlertRuleInput } from "../types";
 import { Checkbox } from "./Checkbox";
 
 const emptyRule: AlertRuleInput = {
@@ -23,7 +23,7 @@ const metricLabels = {
 };
 
 export function AlertRuleManager({ servers, onError, onNotice }: {
-  servers: Server[];
+  servers: AdminServer[];
   onError: (message: string) => void;
   onNotice: (message: string) => void;
 }) {
@@ -48,7 +48,7 @@ export function AlertRuleManager({ servers, onError, onNotice }: {
       threshold: rule.threshold,
       duration_minutes: rule.duration_minutes,
       aggregation: rule.aggregation,
-      enabled: !!rule.enabled,
+      enabled: rule.enabled,
       server_ids: [...rule.server_ids],
     } : { ...emptyRule, server_ids: [] });
     setAllServers(!rule?.server_ids.length);
@@ -95,7 +95,7 @@ export function AlertRuleManager({ servers, onError, onNotice }: {
     <div className="section-head"><div><h3>资源告警规则</h3><span>最多 20 条，可指定服务器和统计窗口</span></div><button type="button" className="primary-btn compact" onClick={() => open()}><Plus size={14} />新建规则</button></div>
     <div className="alert-rule-list">
       {rules.map((rule) => <div className="alert-rule-row" key={rule.id}>
-        <Checkbox checked={!!rule.enabled} onChange={() => void toggle(rule)} ariaLabel={`${rule.name}启用状态`} />
+        <Checkbox checked={rule.enabled} onChange={() => void toggle(rule)} ariaLabel={`${rule.name}启用状态`} />
         <div><strong>{rule.name}</strong><small>{metricLabels[rule.metric]} ≥ {rule.threshold} {rule.metric.startsWith("net_") ? "MiB/s" : "%"} · {rule.duration_minutes} 分钟{rule.aggregation === "continuous" ? "持续" : "平均"} · {rule.server_ids.length ? `${rule.server_ids.length} 台服务器` : "全部服务器"}</small></div>
         <button type="button" className="icon-btn" title="编辑规则" onClick={() => open(rule)}><Pencil size={14} /></button>
         <button type="button" className="icon-btn danger" title="删除规则" onClick={() => void remove(rule)}><Trash2 size={14} /></button>
diff --git a/frontend/src/components/LatencyManager.tsx b/frontend/src/components/LatencyManager.tsx
index 0e57811..527546f 100644
--- a/frontend/src/components/LatencyManager.tsx
+++ b/frontend/src/components/LatencyManager.tsx
@@ -1,7 +1,7 @@
 import { Pencil, Plus, RadioTower, Save, Search, Trash2 } from "lucide-react";
 import { type FormEvent, useCallback, useEffect, useMemo, useState } from "react";
 import { api } from "../api";
-import type { LatencyTask, LatencyTaskInput, Server } from "../types";
+import type { AdminServer, LatencyTask, LatencyTaskInput } from "../types";
 import { Checkbox } from "./Checkbox";
 
 const emptyTask: LatencyTaskInput = {
@@ -40,7 +40,7 @@ export function LatencyManager({
   onError,
   onNotice,
 }: {
-  servers: Server[];
+  servers: AdminServer[];
   onError: (message: string) => void;
   onNotice: (message: string) => void;
 }) {
@@ -137,8 +137,8 @@ export function LatencyManager({
 
   return <div className="admin-section latency-section">
     <div className="section-head">
-      <div><h3>延迟任务</h3><span>{tasks.length} 个任务 · TCP / ICMP</span></div>
-      <button className="primary-btn compact" type="button" onClick={() => open()}><Plus size={16} />添加</button>
+      <div><h3>延迟任务</h3><span>{tasks.length} / 128 个任务 · TCP / ICMP</span></div>
+      <button className="primary-btn compact" type="button" disabled={tasks.length >= 128} onClick={() => open()}><Plus size={16} />添加</button>
     </div>
     <div className="latency-task-list">
       {tasks.map((task) => <div className="latency-task-row" key={task.id}>
diff --git a/frontend/src/components/NodeCard.tsx b/frontend/src/components/NodeCard.tsx
index 7057f53..ef6e2a2 100644
--- a/frontend/src/components/NodeCard.tsx
+++ b/frontend/src/components/NodeCard.tsx
@@ -1,5 +1,4 @@
 import {
-  AlertTriangle,
   CalendarDays,
   ChevronDown,
   ChevronUp,
@@ -72,7 +71,7 @@ export function NodeCard({ server, config, onOpen }: { server: Server; config: C
   const usedTraffic = trafficUsed(server);
   const traffic = server.traffic_limit > 0 ? Math.min(100, (usedTraffic / server.traffic_limit) * 100) : 0;
   const quality = useNodeLatency(server, config.show_latency);
-  const locale = config.locale || "zh-CN";
+  const locale = config.locale;
   const price = formatPrice(server, locale);
   const remainingValue = remainingAssetValue(server.price, server.billing_cycle, server.expires_at);
   const showExpiryPanel = config.show_expiry && (server.price !== 0 || server.expires_at !== null);
@@ -82,7 +81,6 @@ export function NodeCard({ server, config, onOpen }: { server: Server; config: C
       <header className="node-header">
         <span className={`status-dot ${online ? "online" : ""}`} />
         <strong title={server.name}>{server.name}</strong>
-        {server.message?.trim() ? <AlertTriangle className="node-alert" size={15}><title>{server.message}</title></AlertTriangle> : null}
         <OSIcon os={server.os} size={16} />
         <Flag region={server.region} size={19} locale={locale} />
       </header>
diff --git a/frontend/src/components/NodeDetails.tsx b/frontend/src/components/NodeDetails.tsx
index bb43087..7c51404 100644
--- a/frontend/src/components/NodeDetails.tsx
+++ b/frontend/src/components/NodeDetails.tsx
@@ -24,7 +24,7 @@ import {
 } from "recharts";
 import { api } from "../api";
 import { demoHistory, demoLatencyHistory, demoLatencyTasks } from "../demo";
-import { formatBytes, formatSpeed, formatUptime, isOnline, number } from "../format";
+import { displayGpuDevices, formatBytes, formatCpuName, formatSpeed, formatUptime, isOnline, number } from "../format";
 import type { HistoryPoint, LatencySample, LatencyTestPoint, Server } from "../types";
 import { Flag, regionDisplayName } from "./Flag";
 import { OSIcon } from "./OSIcon";
@@ -83,7 +83,7 @@ export function NodeDetails({ server, threshold, retentionDays, locale, demo = f
     setError("");
     const requestHours = hours === 0 ? 1 : hours;
     if (demo) {
-      const taskIds = new Set((server.latency ?? []).map((point) => point.task_id));
+      const taskIds = new Set(server.latency.map((point) => point.task_id));
       const tasks = demoLatencyTasks.filter((task) => taskIds.has(task.id));
       setPoints(demoHistory(server.id, requestHours));
       setLatencyTasks(tasks);
@@ -100,6 +100,11 @@ export function NodeDetails({ server, threshold, retentionDays, locale, demo = f
   }, [server.id, hours, demo, locale]);
 
   const online = isOnline(server, threshold);
+  const gpuDevices = useMemo(() => displayGpuDevices(server.gpus), [server.gpus]);
+  const gpuNames = gpuDevices.map((gpu) => gpu.model).join(" · ");
+  const gpuMemory = gpuDevices.map((gpu) => gpu.memory_total > 0
+    ? `${formatBytes(gpu.memory_used)} / ${formatBytes(gpu.memory_total)}`
+    : ui(locale, "共享内存", "Shared memory")).join(" · ");
   const loadRanges = [
     { value: 0, label: ui(locale, "实时", "Live") },
     { value: 1, label: ui(locale, "1 小时", "1 hour") },
@@ -164,10 +169,13 @@ export function NodeDetails({ server, threshold, retentionDays, locale, demo = f
 
       <div className="info-groups">
         <InfoGroup title={ui(locale, "硬件信息", "Hardware")} icon={<Cpu size={16} />}>
-          <InfoItem icon={<Cpu size={14} />} label={ui(locale, "处理器", "Processor")} value={`${server.cpu_model || "--"} (x${server.cpu_cores || 0})`} />
+          <InfoItem icon={<Cpu size={14} />} label="CPU" value={formatCpuName(server.cpu_model, server.cpu_cores)} />
           <InfoItem icon={<Box size={14} />} label={ui(locale, "架构", "Architecture")} value={server.arch || "--"} />
-          <InfoItem icon={<Cpu size={14} />} label={ui(locale, "图形设备", "Graphics")} value={server.gpus?.length ? server.gpus.map((gpu) => `${gpu.model} ${gpu.usage.toFixed(1)}%`).join(" · ") : server.gpu_model || ui(locale, "未检测到", "Not detected")} />
-          <InfoItem icon={<HardDrive size={14} />} label={ui(locale, "存储设备", "Storage")} value={server.disks?.length ? server.disks.map((disk) => `${disk.mount_point} ${formatBytes(disk.used)} / ${formatBytes(disk.total)}`).join(" · ") : `${formatBytes(server.disk_used)} / ${formatBytes(server.disk_total)}`} />
+          {gpuDevices.length ? <>
+            <InfoItem icon={<Cpu size={14} />} label="GPU" value={gpuNames} />
+            <InfoItem icon={<Cpu size={14} />} label={ui(locale, "GPU 显存", "GPU Memory")} value={gpuMemory} />
+          </> : null}
+          <InfoItem icon={<HardDrive size={14} />} label={ui(locale, "存储设备", "Storage")} value={server.disks.length ? server.disks.map((disk) => `${disk.mount_point} ${formatBytes(disk.used)} / ${formatBytes(disk.total)}`).join(" · ") : `${formatBytes(server.disk_used)} / ${formatBytes(server.disk_total)}`} />
           <InfoItem icon={<ServerCog size={14} />} label={ui(locale, "虚拟化", "Virtualization")} value={server.virtualization || "--"} />
         </InfoGroup>
         <InfoGroup title={ui(locale, "系统信息", "System")} icon={<ServerCog size={16} />}>
diff --git a/frontend/src/components/StatsBar.tsx b/frontend/src/components/StatsBar.tsx
index 7c1e1f2..b57607c 100644
--- a/frontend/src/components/StatsBar.tsx
+++ b/frontend/src/components/StatsBar.tsx
@@ -16,7 +16,7 @@ interface Stat {
 export function StatsBar({ servers, config, exchangeRates }: { servers: Server[]; config: Config; exchangeRates: ExchangeRates | null }) {
   if (!config.show_stats) return null;
   const displayCurrency = assetCurrency(config);
-  const locale = config.locale || "zh-CN";
+  const locale = config.locale;
   const showOnline = themeToggle(config, "showOnline");
   const onlineServers = servers.filter((server) => isOnline(server, config.offline_threshold_seconds));
   const trafficUp = servers.reduce((sum, server) => sum + number(server.net_tx_total), 0);
diff --git a/frontend/src/demo.ts b/frontend/src/demo.ts
index fdef873..b70ced9 100644
--- a/frontend/src/demo.ts
+++ b/frontend/src/demo.ts
@@ -27,7 +27,6 @@ export const demoConfig: Config = {
   turnstile_login_enabled: true,
   turnstile_site_key: "",
   password_client_salt: "nodeflare-demo-password-kdf",
-  websocket: true,
 };
 
 export const demoExchangeRates: ExchangeRates = {
@@ -85,7 +84,7 @@ const baseServer: Server = {
   price: 0,
   billing_cycle: 30,
   currency: "CNY",
-  auto_renewal: 0,
+  auto_renewal: false,
   public_remark: "",
   reset_day: 1,
   timestamp: now - 12,
@@ -124,7 +123,6 @@ const baseServer: Server = {
   disk_utilization: 8.4,
   disks: [],
   gpus: [],
-  message: "",
   latency: [],
 };
 
@@ -142,7 +140,7 @@ export const demoServers: Server[] = [
   node({ id: "frankfurt-lab", name: "法兰克福 Lab", region: "DE", group_name: "实验服务", tags: "Lab,IPv6", price: -1, expires_at: null, mem_total: 16 * 1024 ** 3, mem_used: 6.72 * 1024 ** 3, cpu: 52, uptime: 134 * 86400 }),
   node({ id: "taipei-homelab", name: "台北 HomeLab", region: "TW", group_name: "家庭网络", tags: "HomeLab,自建", price: -1, expires_at: null, mem_total: 24 * 1024 ** 3, mem_used: 10.08 * 1024 ** 3, cpu: 59, uptime: 122 * 86400 }),
   node({ id: "london-archive", name: "伦敦 Archive", region: "GB", group_name: "存储服务", tags: "Archive,HDD", price: 18, currency: "EUR", billing_cycle: 365, expires_at: now + 110 * 86400, disk_total: 4 * 1024 ** 4, disk_used: 2.7 * 1024 ** 4, cpu: 66, latency: [] }),
-  node({ id: "toronto-standby", name: "多伦多 Standby", region: "CA", group_name: "备用节点", tags: "Standby", price: 16, currency: "CAD", expires_at: now + 18 * 86400, timestamp: now - 640, cpu: 0, net_in: 0, net_out: 0, message: "节点维护中" }),
+  node({ id: "toronto-standby", name: "多伦多 Standby", region: "CA", group_name: "备用节点", tags: "Standby", price: 16, currency: "CAD", expires_at: now + 18 * 86400, timestamp: now - 640, cpu: 0, net_in: 0, net_out: 0 }),
 ];
 
 export function demoHistory(serverId: string, hours: number): HistoryPoint[] {
diff --git a/frontend/src/format.ts b/frontend/src/format.ts
index e8960f9..676a6ae 100644
--- a/frontend/src/format.ts
+++ b/frontend/src/format.ts
@@ -22,6 +22,52 @@ export function formatSpeed(value: number | null | undefined) {
   return `${formatBytes(value)}/s`;
 }
 
+export function formatCpuName(model: string | null | undefined, cores: number | null | undefined) {
+  const name = (model ?? "").replace(/\s+/g, " ").trim() || "--";
+  const count = Math.max(0, Math.trunc(number(cores)));
+  return count > 0 ? `${name} ×${count}` : name;
+}
+
+const GPU_MODEL_HINT = /(graphics|geforce|radeon|\bgpu\b|\buhd\b|\biris\b|\barc\b|quadro|tesla|\brtx\b|\bgtx\b|apple|adreno|mali|videocore)/i;
+const GPU_DEVICE_HINT = new RegExp(`${GPU_MODEL_HINT.source}|nvidia|amd|intel`, "i");
+const GPU_REJECT = /(sensor hub|management engine|ethernet|wireless|audio controller|usb controller|sata controller)/i;
+
+function conciseGpuName(raw: string | null | undefined) {
+  const original = (raw ?? "").replace(/\s+/g, " ").trim();
+  if (!original || /^(?:-|0|none|null|unknown|n\/a)$/i.test(original) || GPU_REJECT.test(original)) return "";
+
+  const bracketModels = Array.from(original.matchAll(/\[([^\]]+)]/g), (match) => match[1].trim());
+  const bracketModel = [...bracketModels].reverse().find((part) => GPU_MODEL_HINT.test(part));
+  let model = bracketModel ?? original;
+  if (!GPU_DEVICE_HINT.test(model)) return "";
+
+  model = model
+    .replace(/\bIntel Corporation\b/gi, "Intel")
+    .replace(/\bNVIDIA Corporation\b/gi, "NVIDIA")
+    .replace(/\bAdvanced Micro Devices,?\s*Inc\.?/gi, "AMD")
+    .replace(/\bAMD\/ATI\b/gi, "AMD")
+    .replace(/\s*\[(?:AMD|ATI|AMD\/ATI)]\s*/gi, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+
+  if (bracketModel) {
+    if (/Intel/i.test(original) && !/^Intel\b/i.test(model)) model = `Intel ${model}`;
+    else if (/NVIDIA/i.test(original) && !/^NVIDIA\b/i.test(model)) model = `NVIDIA ${model}`;
+    else if (/(AMD|Advanced Micro Devices|ATI)/i.test(original) && !/^AMD\b/i.test(model)) model = `AMD ${model}`;
+  }
+  return model;
+}
+
+export function displayGpuDevices(gpus: Server["gpus"]) {
+  const seen = new Set<string>();
+  return gpus.flatMap((gpu) => {
+    const name = conciseGpuName(gpu.model);
+    if (!name || seen.has(name)) return [];
+    seen.add(name);
+    return [{ ...gpu, model: name }];
+  });
+}
+
 export function formatUptime(seconds: number | null | undefined, locale: UiLocale = "zh-CN") {
   const days = Math.floor(number(seconds) / 86400);
   if (days > 0) return ui(locale, `${days} 天`, `${days} days`);
@@ -31,7 +77,7 @@ export function formatUptime(seconds: number | null | undefined, locale: UiLocal
   return ui(locale, `${minutes} 分钟`, `${minutes} minutes`);
 }
 
-export function isOnline(server: Server, threshold: number, at = Date.now() / 1000) {
+export function isOnline(server: Pick<Server, "timestamp">, threshold: number, at = Date.now() / 1000) {
   return !!server.timestamp && at - server.timestamp <= threshold;
 }
 
@@ -53,7 +99,7 @@ export function countryFlag(region: string) {
 export function trafficUsed(server: Pick<Server, "net_rx_total" | "net_tx_total" | "traffic_limit_type">) {
   const down = number(server.net_rx_total);
   const up = number(server.net_tx_total);
-  const type: TrafficLimitType = server.traffic_limit_type || "sum";
+  const type: TrafficLimitType = server.traffic_limit_type;
   if (type === "max") return Math.max(up, down);
   if (type === "min") return Math.min(up, down);
   if (type === "up") return up;
@@ -81,7 +127,7 @@ export function formatPrice(server: Pick<Server, "price" | "billing_cycle" | "cu
     : server.billing_cycle >= 87 && server.billing_cycle <= 95 ? ui(locale, "季", "quarter")
       : server.billing_cycle >= 175 && server.billing_cycle <= 185 ? ui(locale, "半年", "half-year")
         : server.billing_cycle >= 360 && server.billing_cycle <= 370 ? ui(locale, "年", "year")
-          : server.billing_cycle === -1 ? ui(locale, "一次", "one-time") : ui(locale, `${server.billing_cycle} 天`, `${server.billing_cycle} days`);
+          : ui(locale, `${server.billing_cycle} 天`, `${server.billing_cycle} days`);
   return `${formatCurrency(server.price, server.currency)} / ${cycle}`;
 }
 
diff --git a/frontend/src/hooks/useNodeLatency.ts b/frontend/src/hooks/useNodeLatency.ts
index bf4ae1a..bf77e4c 100644
--- a/frontend/src/hooks/useNodeLatency.ts
+++ b/frontend/src/hooks/useNodeLatency.ts
@@ -61,13 +61,13 @@ function tasksFromSamples(points: LatencySample[]): LatencyTestPoint[] {
 }
 
 export function useNodeLatency(server: Server, enabled: boolean) {
-  const initial = server.latency ?? [];
+  const initial = server.latency;
   const [tasks, setTasks] = useState<LatencyTestPoint[]>(() => tasksFromSamples(initial));
   const [points, setPoints] = useState<LatencySample[]>(initial);
   const [loading, setLoading] = useState(enabled);
 
   useEffect(() => {
-    if (!server.latency?.length) return;
+    if (!server.latency.length) return;
     setTasks(tasksFromSamples(server.latency));
     setPoints(server.latency);
   }, [server.latency]);
diff --git a/frontend/src/styles.css b/frontend/src/styles.css
index 8ff28d0..16ec473 100644
--- a/frontend/src/styles.css
+++ b/frontend/src/styles.css
@@ -83,7 +83,7 @@ html[data-blur="off"] .glass-panel { background: color-mix(in srgb, var(--card-s
 .brand { display: flex; min-width: 0; align-items: center; gap: 10px; padding: 0; color: inherit; text-align: left; }
 .brand img { flex: 0 0 auto; object-fit: contain; }
 .brand strong { overflow: hidden; font-size: 17px; text-overflow: ellipsis; white-space: nowrap; }
-.header-actions, .header-buttons, .row-actions, .section-actions { display: flex; align-items: center; gap: 3px; }
+.header-actions, .row-actions, .section-actions { display: flex; align-items: center; gap: 3px; }
 .header-actions { gap: 4px; }
 .header-actions .icon-btn { color: var(--foreground); }
 .icon-btn { display: inline-flex; width: 36px; height: 36px; flex: 0 0 auto; align-items: center; justify-content: center; border-radius: 8px; color: var(--muted-foreground); }
@@ -131,7 +131,6 @@ html[data-blur="off"] .glass-panel { background: color-mix(in srgb, var(--card-s
 .status-dot { width: 10px; height: 10px; flex: 0 0 auto; border-radius: 50%; background: var(--danger); box-shadow: 0 0 0 0 color-mix(in srgb, var(--danger) 40%, transparent); animation: status-pulse 2s ease-out infinite; }
 .status-dot.online { background: var(--success); box-shadow: 0 0 0 0 color-mix(in srgb, var(--success) 40%, transparent); }
 @keyframes status-pulse { 70%, 100% { box-shadow: 0 0 0 6px transparent; } }
-.node-alert { flex: 0 0 auto; color: var(--warning); }
 .os-icon, .os-icon-fallback { width: 16px; height: 16px; flex: 0 0 auto; object-fit: contain; }
 .os-icon-fallback { color: var(--muted-foreground); }
 .region-flag { display: inline-flex; min-width: 18px; flex: 0 0 auto; align-items: center; justify-content: center; line-height: 1; }
@@ -248,9 +247,7 @@ html[data-blur="off"] .offline-layer { backdrop-filter: none; }
 .admin-login-stage { position: relative; display: grid; min-height: calc(100dvh - 32px); place-items: center; }
 .admin-back { position: absolute; top: 3px; left: 3px; display: inline-flex; min-height: 36px; align-items: center; gap: 6px; border: 1px solid var(--border); border-radius: 7px; padding: 7px 12px; color: var(--muted-foreground); background: var(--card-solid); font-size: 10px; }
 .admin-back:hover { color: var(--foreground); }
-.modal-header { display: flex; min-width: 0; min-height: 70px; align-items: center; justify-content: space-between; gap: 20px; border-bottom: 1px solid var(--border); padding: 17px 20px; }
 .eyebrow { display: block; margin-bottom: 3px; color: var(--primary); font-size: 8px; font-weight: 750; text-transform: uppercase; }
-.modal-header h2 { margin: 0; font-size: 18px; }
 .admin-body { display: grid; height: calc(100% - 70px); min-height: 0; grid-template-columns: 140px minmax(0, 1fr); }
 .admin-tabs { display: flex; flex-direction: column; gap: 4px; border-right: 1px solid var(--border); padding: 14px 9px; }
 .admin-tabs button { display: flex; min-height: 38px; align-items: center; gap: 8px; border-radius: 6px; padding: 0 10px; color: var(--muted-foreground); font-size: 11px; text-align: left; }
@@ -451,7 +448,6 @@ label > span { color: var(--muted-foreground); font-size: 9px; }
   .admin-login-stage { min-height: 100dvh; }
   .admin-back { top: 12px; left: 12px; }
   .login-form { width: calc(100% - 26px); padding: 24px 20px; }
-  .modal-header { min-height: 62px; padding: 13px 14px; }
   .admin-body { display: flex; height: calc(100vh - 62px); min-height: 0; flex-direction: column; }
   .admin-tabs { overflow-x: auto; flex-direction: row; border-right: 0; border-bottom: 1px solid var(--border); padding: 7px 10px; }
   .admin-tabs button { min-height: 33px; flex: 0 0 auto; }
diff --git a/frontend/src/types.ts b/frontend/src/types.ts
index 436ea75..3839e69 100644
--- a/frontend/src/types.ts
+++ b/frontend/src/types.ts
@@ -25,7 +25,6 @@ export interface Config {
   turnstile_login_enabled: boolean;
   turnstile_site_key: string;
   password_client_salt: string;
-  websocket: boolean;
 }
 
 export type ThemeSettingValue = string | number | boolean;
@@ -54,7 +53,7 @@ export interface ThemeSettingField {
 
 export interface ThemeSettingsSchema {
   schema: number;
-  source: "builtin";
+  source: "builtin" | "remote";
   settings: ThemeSettingField[];
 }
 
@@ -91,7 +90,7 @@ interface DiskMetric {
 
 interface GpuMetric {
   model: string;
-  usage: number;
+  usage: number | null;
   memory_used: number;
   memory_total: number;
 }
@@ -129,7 +128,7 @@ export interface LatencyTask {
 
 export type LatencyTaskInput = Pick<LatencyTask, "name" | "task_type" | "target" | "interval_seconds" | "default_enabled" | "server_ids">;
 
-export interface Server {
+interface ServerSummary {
   id: string;
   name: string;
   region: string;
@@ -141,7 +140,7 @@ export interface Server {
   price: number;
   billing_cycle: number;
   currency: string;
-  auto_renewal: number;
+  auto_renewal: boolean;
   public_remark: string;
   reset_day: number;
   timestamp: number | null;
@@ -178,22 +177,24 @@ export interface Server {
   disk_write_iops: number | null;
   disk_await_ms: number | null;
   disk_utilization: number | null;
-  disks?: DiskMetric[];
-  gpus?: GpuMetric[];
-  message: string | null;
-  latency?: LatencySample[];
 }
 
-export interface AdminServer extends Server {
+export interface Server extends ServerSummary {
+  disks: DiskMetric[];
+  gpus: GpuMetric[];
+  latency: LatencySample[];
+}
+
+export interface AdminServer extends ServerSummary {
   note: string;
-  hidden: number;
+  hidden: boolean;
   network_interface: string;
   report_interval: number;
   collect_interval: number;
   rx_correction: number;
   tx_correction: number;
-  offline_notify_disabled: number;
-  auto_update: number;
+  offline_notify_disabled: boolean;
+  auto_update: boolean;
 }
 
 export interface HistoryPoint {
@@ -249,7 +250,7 @@ export interface ServerInput {
   auto_update: boolean;
 }
 
-export interface Settings extends Omit<Config, "websocket" | "password_client_salt"> {
+export interface Settings extends Omit<Config, "password_client_salt"> {
   admin_username: string;
   admin_password_configured: boolean;
   new_password?: string;
@@ -274,7 +275,7 @@ export interface AlertRule {
   threshold: number;
   duration_minutes: number;
   aggregation: AlertAggregation;
-  enabled: number;
+  enabled: boolean;
   server_ids: string[];
 }
 
diff --git a/migrations/0001_initial.sql b/migrations/0001_initial.sql
index f367471..cf60d19 100644
--- a/migrations/0001_initial.sql
+++ b/migrations/0001_initial.sql
@@ -73,8 +73,18 @@ CREATE TABLE IF NOT EXISTS latest_metrics (
   disk_await_ms REAL NOT NULL DEFAULT 0,
   disk_utilization REAL NOT NULL DEFAULT 0,
   disk_info TEXT NOT NULL DEFAULT '[]',
-  gpu_info TEXT NOT NULL DEFAULT '[]',
-  message TEXT NOT NULL DEFAULT ''
+  gpu_info TEXT NOT NULL DEFAULT '[]'
+);
+
+CREATE TABLE IF NOT EXISTS traffic_cycles (
+  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+  cycle_key INTEGER NOT NULL,
+  reset_day INTEGER NOT NULL DEFAULT 1,
+  timestamp INTEGER NOT NULL,
+  raw_rx INTEGER NOT NULL DEFAULT 0,
+  raw_tx INTEGER NOT NULL DEFAULT 0,
+  used_rx INTEGER NOT NULL DEFAULT 0,
+  used_tx INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE TABLE IF NOT EXISTS metric_history (
diff --git a/migrations/0002_traffic_cycles.sql b/migrations/0002_traffic_cycles.sql
new file mode 100644
index 0000000..8d2fa9e
--- /dev/null
+++ b/migrations/0002_traffic_cycles.sql
@@ -0,0 +1,11 @@
+-- Current schema: persist per-node traffic counters across monthly resets and agent restarts.
+CREATE TABLE IF NOT EXISTS traffic_cycles (
+  server_id TEXT PRIMARY KEY REFERENCES servers(id) ON DELETE CASCADE,
+  cycle_key INTEGER NOT NULL,
+  reset_day INTEGER NOT NULL DEFAULT 1,
+  timestamp INTEGER NOT NULL,
+  raw_rx INTEGER NOT NULL DEFAULT 0,
+  raw_tx INTEGER NOT NULL DEFAULT 0,
+  used_rx INTEGER NOT NULL DEFAULT 0,
+  used_tx INTEGER NOT NULL DEFAULT 0
+);
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 7779505..e4d5b76 100644
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -53,6 +53,12 @@ login_json=$(request -H 'Content-Type: application/json' \
   "$MONITOR_BASE_URL/api/admin/login")
 admin_token=$(printf '%s' "$login_json" | jq -er '.token')
 
+# Login protection defaults to enabled, but without a complete Turnstile pair it
+# remains inactive so the first admin settings save must still work.
+request -H "Authorization: Bearer $admin_token" -H 'Content-Type: application/json' -X PATCH \
+  --data '{"site_description":"Smoke settings"}' \
+  "$MONITOR_BASE_URL/api/admin/settings" | jq -e '.settings.site_description == "Smoke settings"' >/dev/null
+
 request -H "Authorization: Bearer $admin_token" \
   "$MONITOR_BASE_URL/api/exchange-rates" | \
   jq -e '.base == "CNY" and .rates.CNY == 1 and .rates.USD > 0 and .rates.CAD > 0 and (has("cny") | not)' >/dev/null
@@ -106,20 +112,29 @@ sample=$(jq -nc --arg agent_version "$agent_version" '{
   disk_read_iops:120,disk_write_iops:48,disk_await_ms:1.4,disk_utilization:8.2,
   disks:[{name:"/dev/vda1",mount_point:"/",used:21474836480,total:53687091200,read_bps:4194304,write_bps:2097152,read_iops:120,write_iops:48,await_ms:1.4,utilization:8.2}],
   gpus:[{model:"NVIDIA T4",usage:32.5,memory_used:1073741824,memory_total:17179869184}],
-  agent_version:$agent_version,message:"smoke",latency_results:[]
+  agent_version:$agent_version,latency_results:[]
 }')
 report=$(jq -nc --arg server_id "$server_id" --argjson sample "$sample" '{server_id:$server_id,samples:[$sample]}')
 report_response=$(request -H "Authorization: Bearer $agent_token" -H 'Content-Type: application/json' \
   --data "$report" "$MONITOR_BASE_URL/api/agent/report")
 printf '%s' "$report_response" | jq -e \
   --arg task_id "$latency_task_id" \
-  '.success == true and .config.collect_interval == 5 and .config.auto_update == 1 and (.config.latency_tasks | any(.id == $task_id and .task_type == "tcp" and .target == "example.com:443"))' >/dev/null
+  '.collect_interval == 5 and .auto_update == true and (.latency_tasks | any(.id == $task_id and .task_type == "tcp" and .target == "example.com:443"))' >/dev/null
 
 latency_report=$(printf '%s' "$report" | jq --arg task_id "$latency_task_id" '.samples[0].timestamp=(now|floor) | .samples[0].latency_results=[{task_id:$task_id,timestamp:(now|floor),latency_ms:28.4,packet_loss:25}]')
 request -H "Authorization: Bearer $agent_token" -H 'Content-Type: application/json' \
-  --data "$latency_report" "$MONITOR_BASE_URL/api/agent/report" | jq -e '.success == true' >/dev/null
+  --data "$latency_report" "$MONITOR_BASE_URL/api/agent/report" | jq -e '.collect_interval == 5' >/dev/null
 
-request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/servers/$server_id" | jq -e --arg task_id "$latency_task_id" '.cpu == 18.5 and .gpu_usage == 32.5 and .disk_await_ms == 1.4 and (.gpus | length) == 1 and (.disks | length) == 1 and .disk_used == 21474836480 and .traffic_limit == 107374182400 and .price == 9.9 and (has("note") | not) and .public_remark == "public" and (.latency | any(.task_id == $task_id and .latency_ms == 28.4 and .packet_loss == 25))' >/dev/null
+# Traffic counters may reset when a host reboots. Cycle usage must retain the
+# bytes already observed before the reset and continue from the new counter.
+traffic_report=$(printf '%s' "$report" | jq '.samples[0].timestamp += 2 | .samples[0].net_rx_total=2147483648 | .samples[0].net_tx_total=1073741824')
+request -H "Authorization: Bearer $agent_token" -H 'Content-Type: application/json' \
+  --data "$traffic_report" "$MONITOR_BASE_URL/api/agent/report" | jq -e '.collect_interval == 5' >/dev/null
+reset_report=$(printf '%s' "$report" | jq '.samples[0].timestamp += 3 | .samples[0].net_rx_total=268435456 | .samples[0].net_tx_total=134217728')
+request -H "Authorization: Bearer $agent_token" -H 'Content-Type: application/json' \
+  --data "$reset_report" "$MONITOR_BASE_URL/api/agent/report" | jq -e '.collect_interval == 5' >/dev/null
+
+request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/servers" | jq -e --arg id "$server_id" --arg task_id "$latency_task_id" '.servers | any(.id == $id and .cpu == 18.5 and .gpu_usage == 32.5 and .disk_await_ms == 1.4 and (.gpus | length) == 1 and (.disks | length) == 1 and .disk_used == 21474836480 and .traffic_limit == 107374182400 and .net_rx_total == 2415919104 and .net_tx_total == 1207959552 and .price == 9.9 and (has("note") | not) and .public_remark == "public" and (.latency | any(.task_id == $task_id and .latency_ms == 28.4 and .packet_loss == 25)))' >/dev/null
 request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/history/$server_id?hours=1" | jq -e '.points | length >= 1 and any(.gpu_usage == 32.5)' >/dev/null
 history_cache_header=$(monitor_curl --silent --dump-header - --output /dev/null \
   -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/history/$server_id?hours=1" | \
@@ -131,17 +146,18 @@ request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/latency/$
 # assignment. The stale result must not block delivery of the new task list.
 request -H "Authorization: Bearer $admin_token" -H 'Content-Type: application/json' -X PATCH \
   --data '{"name":"Smoke TCP","task_type":"tcp","target":"example.com:443","interval_seconds":60,"default_enabled":true,"server_ids":[]}' \
-  "$MONITOR_BASE_URL/api/admin/latency-tasks/$latency_task_id" | jq -e '.success == true' >/dev/null
+  "$MONITOR_BASE_URL/api/admin/latency-tasks/$latency_task_id" >/dev/null
+request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/latency/$server_id?hours=1" | jq -e --arg task_id "$latency_task_id" '(.tasks | all(.id != $task_id)) and (.points | all(.task_id != $task_id))' >/dev/null
 stale_latency_response=$(request -H "Authorization: Bearer $agent_token" -H 'Content-Type: application/json' \
   --data "$latency_report" "$MONITOR_BASE_URL/api/agent/report")
 printf '%s' "$stale_latency_response" | jq -e --arg task_id "$latency_task_id" \
-  '.success == true and (.config.latency_tasks | all(.id != $task_id))' >/dev/null
+  '.latency_tasks | all(.id != $task_id)' >/dev/null
 
 alert_rule_json=$(request -H "Authorization: Bearer $admin_token" -H 'Content-Type: application/json' \
   --data "$(jq -nc --arg server_id "$server_id" '{name:"Smoke CPU",metric:"cpu",threshold:80,duration_minutes:5,aggregation:"average",enabled:true,server_ids:[$server_id]}')" \
   "$MONITOR_BASE_URL/api/admin/alert-rules")
 alert_rule_id=$(printf '%s' "$alert_rule_json" | jq -er '.id')
-request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/admin/alert-rules" | jq -e --arg id "$alert_rule_id" --arg server_id "$server_id" '.rules | any(.id == $id and .metric == "cpu" and (.server_ids | index($server_id)))' >/dev/null
+request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/admin/alert-rules" | jq -e --arg id "$alert_rule_id" --arg server_id "$server_id" '.rules | any(.id == $id and .metric == "cpu" and .enabled == true and (.server_ids | index($server_id)))' >/dev/null
 rotated_json=$(request -H "Authorization: Bearer $admin_token" -X POST \
   "$MONITOR_BASE_URL/api/admin/servers/$server_id/token")
 rotated_token=$(printf '%s' "$rotated_json" | jq -er '.agent_token')
@@ -151,18 +167,16 @@ revoked_token_status=$(monitor_curl --silent --output /dev/null --write-out '%{h
   --data "$report" "$MONITOR_BASE_URL/api/agent/report")
 [ "$revoked_token_status" = "401" ]
 request -H "Authorization: Bearer $rotated_token" -H 'Content-Type: application/json' \
-  --data "$latency_report" "$MONITOR_BASE_URL/api/agent/report" | jq -e '.success == true' >/dev/null
+  --data "$latency_report" "$MONITOR_BASE_URL/api/agent/report" | jq -e '.collect_interval == 5' >/dev/null
 
 request -H "Authorization: Bearer $admin_token" -H 'Content-Type: application/json' -X PATCH \
   --data "$(printf '%s' "$server_input" | jq '.hidden=true')" \
-  "$MONITOR_BASE_URL/api/admin/servers/$server_id" | jq -e '.success == true' >/dev/null
-hidden_detail_status=$(monitor_curl --silent --output /dev/null --write-out '%{http_code}' \
-  -H "Authorization: Bearer $admin_token" \
-  "$MONITOR_BASE_URL/api/servers/$server_id")
+  "$MONITOR_BASE_URL/api/admin/servers/$server_id" >/dev/null
+request -H "Authorization: Bearer $admin_token" "$MONITOR_BASE_URL/api/servers" | \
+  jq -e --arg id "$server_id" '.servers | all(.id != $id)' >/dev/null
 hidden_history_status=$(monitor_curl --silent --output /dev/null --write-out '%{http_code}' \
   -H "Authorization: Bearer $admin_token" \
   "$MONITOR_BASE_URL/api/history/$server_id?hours=1")
-[ "$hidden_detail_status" = "404" ]
 [ "$hidden_history_status" = "404" ]
 
 echo "Smoke test passed"
diff --git a/src/db.rs b/src/db.rs
index 2134c58..4de3aa1 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -18,16 +18,16 @@ SELECT
   s.created_at,
   m.timestamp, m.cpu, m.load1, m.load5, m.load15, m.mem_used, m.mem_total,
   m.swap_used, m.swap_total, m.disk_used, m.disk_total, m.net_in, m.net_out,
-  CASE WHEN m.net_rx_total IS NULL THEN NULL ELSE m.net_rx_total + s.rx_correction END AS net_rx_total,
-  CASE WHEN m.net_tx_total IS NULL THEN NULL ELSE m.net_tx_total + s.tx_correction END AS net_tx_total,
+  CASE WHEN m.net_rx_total IS NULL THEN NULL ELSE COALESCE(c.used_rx, m.net_rx_total) + s.rx_correction END AS net_rx_total,
+  CASE WHEN m.net_tx_total IS NULL THEN NULL ELSE COALESCE(c.used_tx, m.net_tx_total) + s.tx_correction END AS net_tx_total,
   m.uptime, m.processes, m.tcp_connections,
   m.udp_connections, m.cpu_cores, m.cpu_model, m.os, m.kernel, m.arch,
   m.virtualization, m.gpu_usage, m.gpu_model, m.agent_version,
   m.disk_read_bps, m.disk_write_bps, m.disk_read_iops, m.disk_write_iops,
-  m.disk_await_ms, m.disk_utilization, m.disk_info, m.gpu_info,
-  m.message
+  m.disk_await_ms, m.disk_utilization, m.disk_info, m.gpu_info
 FROM servers s
 LEFT JOIN latest_metrics m ON m.server_id = s.id
+LEFT JOIN traffic_cycles c ON c.server_id = s.id
 "#;
 
 pub const SECRET_MASK: &str = "********";
@@ -69,6 +69,15 @@ struct AgentConfigRow {
     auto_update: i64,
 }
 
+#[derive(Serialize)]
+struct TrafficCounterSample {
+    timestamp: i64,
+    cycle_key: i64,
+    reset_day: i64,
+    raw_rx: i64,
+    raw_tx: i64,
+}
+
 #[derive(Debug, Clone, Serialize)]
 pub struct SettingsView {
     pub site_name: String,
@@ -181,6 +190,41 @@ fn number(value: impl ToString) -> JsValue {
     JsValue::from_f64(value.to_string().parse::<f64>().unwrap_or(0.0))
 }
 
+fn civil_date_from_unix_days(days: i64) -> (i64, i64, i64) {
+    let z = days + 719_468;
+    let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
+    let day_of_era = z - era * 146_097;
+    let year_of_era =
+        (day_of_era - day_of_era / 1_460 + day_of_era / 36_524 - day_of_era / 146_096) / 365;
+    let mut year = year_of_era + era * 400;
+    let day_of_year = day_of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
+    let month_prime = (5 * day_of_year + 2) / 153;
+    let day = day_of_year - (153 * month_prime + 2) / 5 + 1;
+    let month = month_prime + if month_prime < 10 { 3 } else { -9 };
+    year += i64::from(month <= 2);
+    (year, month, day)
+}
+
+fn days_in_month(year: i64, month: i64) -> i64 {
+    match month {
+        2 if year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
+}
+
+fn traffic_cycle_key(timestamp: i64, reset_day: i64) -> i64 {
+    let (year, month, day) = civil_date_from_unix_days(timestamp.div_euclid(86_400));
+    let boundary = reset_day.clamp(1, 31).min(days_in_month(year, month));
+    let current_month = year * 12 + month - 1;
+    if day >= boundary {
+        current_month
+    } else {
+        current_month - 1
+    }
+}
+
 pub async fn list_servers(db: &D1Database, include_hidden: bool) -> Result<Vec<ServerView>> {
     let filter = if include_hidden {
         ""
@@ -228,7 +272,7 @@ pub async fn agent_config(db: &D1Database, id: &str) -> Result<Option<AgentConfi
         report_interval: row.report_interval,
         collect_interval: row.collect_interval,
         network_interface: row.network_interface.trim().to_string(),
-        auto_update: row.auto_update,
+        auto_update: row.auto_update != 0,
         latency_tasks: crate::latency::tasks_for_server(db, id).await?,
     }))
 }
@@ -401,7 +445,7 @@ pub async fn list_alert_rules(db: &D1Database) -> Result<Vec<AlertRuleView>> {
             threshold: row.threshold,
             duration_minutes: row.duration_minutes,
             aggregation: row.aggregation,
-            enabled: row.enabled,
+            enabled: row.enabled != 0,
             server_ids: servers.into_iter().map(|row| row.server_id).collect(),
         });
     }
@@ -648,11 +692,11 @@ pub async fn save_reports(db: &D1Database, server_id: &str, reports: &[AgentRepo
               udp_connections, cpu_cores, cpu_model, os, kernel, arch,
               virtualization, gpu_usage, gpu_model, agent_version,
               disk_read_bps, disk_write_bps, disk_read_iops, disk_write_iops,
-              disk_await_ms, disk_utilization, disk_info, gpu_info, message
+              disk_await_ms, disk_utilization, disk_info, gpu_info
             ) VALUES (
               ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14,
               ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26,
-              ?27, ?28, ?29, ?30, ?31, ?32, ?33, ?34, ?35, ?36, ?37, ?38
+              ?27, ?28, ?29, ?30, ?31, ?32, ?33, ?34, ?35, ?36, ?37
             ) ON CONFLICT(server_id) DO UPDATE SET
               timestamp=excluded.timestamp, cpu=excluded.cpu, load1=excluded.load1,
               load5=excluded.load5, load15=excluded.load15, mem_used=excluded.mem_used,
@@ -670,8 +714,7 @@ pub async fn save_reports(db: &D1Database, server_id: &str, reports: &[AgentRepo
               disk_read_iops=excluded.disk_read_iops, disk_write_iops=excluded.disk_write_iops,
               disk_await_ms=excluded.disk_await_ms,
               disk_utilization=excluded.disk_utilization,
-              disk_info=excluded.disk_info, gpu_info=excluded.gpu_info,
-              message=excluded.message
+              disk_info=excluded.disk_info, gpu_info=excluded.gpu_info
             WHERE excluded.timestamp >= latest_metrics.timestamp"#,
         )
         .bind(&report_values(server_id, latest_report, latest_timestamp))?;
@@ -684,10 +727,34 @@ pub async fn save_reports(db: &D1Database, server_id: &str, reports: &[AgentRepo
               tcp_connections, udp_connections, gpu_usage,
               disk_read_bps, disk_write_bps, disk_read_iops, disk_write_iops,
               disk_await_ms, disk_utilization
-            ) VALUES (
-              ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14,
-              ?15, ?16, ?17, ?18, ?19, ?20, ?21, ?22, ?23, ?24, ?25, ?26
-            ) ON CONFLICT(server_id, timestamp) DO UPDATE SET
+            ) SELECT
+              ?1, CAST(json_extract(value, '$.timestamp') AS INTEGER),
+              CAST(json_extract(value, '$.cpu') AS REAL),
+              CAST(json_extract(value, '$.load1') AS REAL),
+              CAST(json_extract(value, '$.load5') AS REAL),
+              CAST(json_extract(value, '$.load15') AS REAL),
+              CAST(json_extract(value, '$.mem_used') AS INTEGER),
+              CAST(json_extract(value, '$.mem_total') AS INTEGER),
+              CAST(json_extract(value, '$.swap_used') AS INTEGER),
+              CAST(json_extract(value, '$.swap_total') AS INTEGER),
+              CAST(json_extract(value, '$.disk_used') AS INTEGER),
+              CAST(json_extract(value, '$.disk_total') AS INTEGER),
+              CAST(json_extract(value, '$.net_in') AS REAL),
+              CAST(json_extract(value, '$.net_out') AS REAL),
+              CAST(json_extract(value, '$.net_rx_total') AS INTEGER),
+              CAST(json_extract(value, '$.net_tx_total') AS INTEGER),
+              CAST(json_extract(value, '$.processes') AS INTEGER),
+              CAST(json_extract(value, '$.tcp_connections') AS INTEGER),
+              CAST(json_extract(value, '$.udp_connections') AS INTEGER),
+              CAST(json_extract(value, '$.gpu_usage') AS REAL),
+              CAST(json_extract(value, '$.disk_read_bps') AS REAL),
+              CAST(json_extract(value, '$.disk_write_bps') AS REAL),
+              CAST(json_extract(value, '$.disk_read_iops') AS REAL),
+              CAST(json_extract(value, '$.disk_write_iops') AS REAL),
+              CAST(json_extract(value, '$.disk_await_ms') AS REAL),
+              CAST(json_extract(value, '$.disk_utilization') AS REAL)
+            FROM json_each(?2) WHERE true
+            ON CONFLICT(server_id, timestamp) DO UPDATE SET
               cpu=excluded.cpu, load1=excluded.load1, load5=excluded.load5,
               load15=excluded.load15, mem_used=excluded.mem_used,
               mem_total=excluded.mem_total, swap_used=excluded.swap_used,
@@ -711,16 +778,96 @@ pub async fn save_reports(db: &D1Database, server_id: &str, reports: &[AgentRepo
     for report in reports {
         minute_samples.insert(report.timestamp / 60 * 60, report);
     }
-    let mut statements = Vec::with_capacity(minute_samples.len() + 1);
-    statements.push(latest);
-    for (timestamp, report) in minute_samples {
-        statements.push(
-            history_statement
-                .clone()
-                .bind(&history_values(server_id, report, timestamp))?,
-        );
-    }
-    db.batch(statements).await?;
+    let history_samples = minute_samples
+        .into_iter()
+        .map(|(timestamp, report)| HistoryPoint {
+            timestamp,
+            cpu: report.cpu,
+            load1: report.load1,
+            load5: report.load5,
+            load15: report.load15,
+            mem_used: report.mem_used,
+            mem_total: report.mem_total,
+            swap_used: report.swap_used,
+            swap_total: report.swap_total,
+            disk_used: report.disk_used,
+            disk_total: report.disk_total,
+            net_in: report.net_in,
+            net_out: report.net_out,
+            net_rx_total: report.net_rx_total,
+            net_tx_total: report.net_tx_total,
+            processes: report.processes,
+            tcp_connections: report.tcp_connections,
+            udp_connections: report.udp_connections,
+            gpu_usage: report.gpu_usage,
+            disk_read_bps: report.disk_read_bps,
+            disk_write_bps: report.disk_write_bps,
+            disk_read_iops: report.disk_read_iops,
+            disk_write_iops: report.disk_write_iops,
+            disk_await_ms: report.disk_await_ms,
+            disk_utilization: report.disk_utilization,
+        })
+        .collect::<Vec<_>>();
+    let history_json = serde_json::to_string(&history_samples)?;
+    let history = history_statement.bind(&[text(server_id), text(&history_json)])?;
+    let reset_day = db
+        .prepare("SELECT reset_day FROM servers WHERE id = ?1")
+        .bind(&[text(server_id)])?
+        .first::<i64>(Some("reset_day"))
+        .await?
+        .unwrap_or(1);
+    let mut traffic_samples = reports
+        .iter()
+        .map(|report| TrafficCounterSample {
+            timestamp: report.timestamp,
+            cycle_key: traffic_cycle_key(report.timestamp, reset_day),
+            reset_day,
+            raw_rx: report.net_rx_total,
+            raw_tx: report.net_tx_total,
+        })
+        .collect::<Vec<_>>();
+    traffic_samples.sort_by_key(|sample| sample.timestamp);
+    let traffic_json = serde_json::to_string(&traffic_samples)?;
+    let traffic = db
+        .prepare(
+            r#"INSERT INTO traffic_cycles(
+                 server_id, cycle_key, reset_day, timestamp, raw_rx, raw_tx, used_rx, used_tx
+               ) SELECT
+                 ?1,
+                 CAST(json_extract(value, '$.cycle_key') AS INTEGER),
+                 CAST(json_extract(value, '$.reset_day') AS INTEGER),
+                 CAST(json_extract(value, '$.timestamp') AS INTEGER),
+                 CAST(json_extract(value, '$.raw_rx') AS INTEGER),
+                 CAST(json_extract(value, '$.raw_tx') AS INTEGER),
+                 CAST(json_extract(value, '$.raw_rx') AS INTEGER),
+                 CAST(json_extract(value, '$.raw_tx') AS INTEGER)
+               FROM json_each(?2) WHERE true ORDER BY CAST(json_extract(value, '$.timestamp') AS INTEGER)
+               ON CONFLICT(server_id) DO UPDATE SET
+                 cycle_key=excluded.cycle_key,
+                 reset_day=excluded.reset_day,
+                 timestamp=excluded.timestamp,
+                 raw_rx=excluded.raw_rx,
+                 raw_tx=excluded.raw_tx,
+                 used_rx=CASE
+                   WHEN excluded.cycle_key != traffic_cycles.cycle_key THEN 0
+                   WHEN excluded.reset_day != traffic_cycles.reset_day
+                     THEN 0
+                   WHEN excluded.raw_rx >= traffic_cycles.raw_rx
+                     THEN traffic_cycles.used_rx + excluded.raw_rx - traffic_cycles.raw_rx
+                   ELSE traffic_cycles.used_rx + excluded.raw_rx
+                 END,
+                 used_tx=CASE
+                   WHEN excluded.cycle_key != traffic_cycles.cycle_key THEN 0
+                   WHEN excluded.reset_day != traffic_cycles.reset_day
+                     THEN 0
+                   WHEN excluded.raw_tx >= traffic_cycles.raw_tx
+                     THEN traffic_cycles.used_tx + excluded.raw_tx - traffic_cycles.raw_tx
+                   ELSE traffic_cycles.used_tx + excluded.raw_tx
+                 END
+               WHERE excluded.timestamp > traffic_cycles.timestamp"#,
+        )
+        .bind(&[text(server_id), text(&traffic_json)])?;
+    db.batch(vec![latest, history, traffic]).await?;
     Ok(())
 }
 
@@ -763,38 +910,6 @@ fn report_values(server_id: &str, report: &AgentReport, timestamp: i64) -> Vec<J
         number(report.disk_utilization),
         text(&serde_json::to_string(&report.disks).unwrap_or_else(|_| "[]".to_string())),
         text(&serde_json::to_string(&report.gpus).unwrap_or_else(|_| "[]".to_string())),
-        text(&report.message),
-    ]
-}
-
-fn history_values(server_id: &str, report: &AgentReport, timestamp: i64) -> Vec<JsValue> {
-    vec![
-        text(server_id),
-        number(timestamp),
-        number(report.cpu),
-        number(report.load1),
-        number(report.load5),
-        number(report.load15),
-        number(report.mem_used),
-        number(report.mem_total),
-        number(report.swap_used),
-        number(report.swap_total),
-        number(report.disk_used),
-        number(report.disk_total),
-        number(report.net_in),
-        number(report.net_out),
-        number(report.net_rx_total),
-        number(report.net_tx_total),
-        number(report.processes),
-        number(report.tcp_connections),
-        number(report.udp_connections),
-        number(report.gpu_usage),
-        number(report.disk_read_bps),
-        number(report.disk_write_bps),
-        number(report.disk_read_iops),
-        number(report.disk_write_iops),
-        number(report.disk_await_ms),
-        number(report.disk_utilization),
     ]
 }
 
@@ -1133,8 +1248,7 @@ pub async fn delete_theme(db: &D1Database, id: &str) -> Result<bool> {
 }
 
 pub async fn cleanup_history(db: &D1Database, retention_days: i64) -> Result<()> {
-    let cutoff = now() - retention_days.clamp(1, 365) * 86_400;
-    let recent_cutoff = now() - 7 * 86_400;
+    let (cutoff, recent_cutoff) = history_cutoffs(now(), retention_days);
     let compact = db
         .prepare(
             r#"INSERT INTO metric_history_hourly (
@@ -1180,6 +1294,12 @@ pub async fn cleanup_history(db: &D1Database, retention_days: i64) -> Result<()>
     Ok(())
 }
 
+fn history_cutoffs(current: i64, retention_days: i64) -> (i64, i64) {
+    let cutoff = current - retention_days.clamp(1, 365) * 86_400;
+    let recent_cutoff = (current - 7 * 86_400).max(cutoff);
+    (cutoff, recent_cutoff)
+}
+
 pub async fn clear_history(db: &D1Database) -> Result<()> {
     db.batch(vec![
         db.prepare("DELETE FROM metric_history"),
@@ -1292,6 +1412,19 @@ pub async fn save_setting(db: &D1Database, key: &str, value: &str) -> Result<()>
     Ok(())
 }
 
+pub async fn increment_setting(db: &D1Database, key: &str) -> Result<()> {
+    db.prepare(
+        "INSERT INTO settings(key, value, updated_at) VALUES (?1, '1', ?2) \
+         ON CONFLICT(key) DO UPDATE SET \
+           value = CAST(CAST(settings.value AS INTEGER) + 1 AS TEXT), \
+           updated_at = excluded.updated_at",
+    )
+    .bind(&[text(key), number(now())])?
+    .run()
+    .await?;
+    Ok(())
+}
+
 pub async fn update_expiry(db: &D1Database, id: &str, expires_at: i64) -> Result<()> {
     db.prepare("UPDATE servers SET expires_at = ?2, updated_at = ?3 WHERE id = ?1")
         .bind(&[text(id), number(expires_at), number(now())])?
@@ -1302,7 +1435,10 @@ pub async fn update_expiry(db: &D1Database, id: &str, expires_at: i64) -> Result
 
 #[cfg(test)]
 mod tests {
-    use super::{alert_window_covered, secret_for_api, AlertMetricRow, SECRET_MASK};
+    use super::{
+        alert_window_covered, history_cutoffs, secret_for_api, traffic_cycle_key, AlertMetricRow,
+        SECRET_MASK,
+    };
 
     fn row(samples: i64, last_timestamp: i64, report_interval: i64) -> AlertMetricRow {
         AlertMetricRow {
@@ -1342,4 +1478,33 @@ mod tests {
         assert_eq!(secret_for_api(""), "");
         assert_eq!(secret_for_api("stored-secret"), SECRET_MASK);
     }
+
+    #[test]
+    fn honors_short_and_long_history_retention() {
+        let current = 10_000_000;
+        let (one_day, one_day_recent) = history_cutoffs(current, 1);
+        assert_eq!(one_day, current - 86_400);
+        assert_eq!(one_day_recent, one_day);
+
+        let (thirty_days, thirty_days_recent) = history_cutoffs(current, 30);
+        assert_eq!(thirty_days, current - 30 * 86_400);
+        assert_eq!(thirty_days_recent, current - 7 * 86_400);
+    }
+
+    #[test]
+    fn assigns_monthly_traffic_cycles_with_short_months() {
+        let timestamp = |year: i64, month: i64, day: i64| {
+            let year = year - i64::from(month <= 2);
+            let era = year.div_euclid(400);
+            let year_of_era = year - era * 400;
+            let month_prime = month + if month > 2 { -3 } else { 9 };
+            let day_of_year = (153 * month_prime + 2) / 5 + day - 1;
+            let day_of_era = year_of_era * 365 + year_of_era / 4 - year_of_era / 100 + day_of_year;
+            (era * 146_097 + day_of_era - 719_468) * 86_400
+        };
+        assert_eq!(traffic_cycle_key(timestamp(2026, 8, 9), 10), 2026 * 12 + 6);
+        assert_eq!(traffic_cycle_key(timestamp(2026, 8, 10), 10), 2026 * 12 + 7);
+        assert_eq!(traffic_cycle_key(timestamp(2028, 2, 28), 31), 2028 * 12);
+        assert_eq!(traffic_cycle_key(timestamp(2028, 2, 29), 31), 2028 * 12 + 1);
+    }
 }
diff --git a/src/latency.rs b/src/latency.rs
index a797530..05accf2 100644
--- a/src/latency.rs
+++ b/src/latency.rs
@@ -5,6 +5,10 @@ use worker::{wasm_bindgen::JsValue, D1Database, Date, Result};
 
 use crate::models::{AgentLatencyResult, AgentLatencyTask, LatencyTaskInput};
 
+pub const MAX_LATENCY_TASKS: usize = 128;
+const MAX_HISTORY_ROWS_PER_REPORT: usize = 4096;
+const MAX_HISTORY_RESPONSE_ROWS: i64 = 4000;
+
 #[derive(Debug, Deserialize)]
 struct TaskRow {
     id: String,
@@ -21,6 +25,14 @@ struct AssignmentRow {
     server_id: String,
 }
 
+#[derive(Clone, Debug, PartialEq, Serialize)]
+struct StoredLatencyResult {
+    task_id: String,
+    timestamp: i64,
+    latency_ms: f64,
+    packet_loss: f64,
+}
+
 #[derive(Debug, Clone, Serialize)]
 pub struct LatencyTaskView {
     pub id: String,
@@ -91,6 +103,13 @@ pub async fn list_tasks(db: &D1Database) -> Result<Vec<LatencyTaskView>> {
         .collect())
 }
 
+pub async fn task_count(db: &D1Database) -> Result<i64> {
+    db.prepare("SELECT COUNT(*) AS count FROM latency_tasks")
+        .first(Some("count"))
+        .await?
+        .ok_or_else(|| worker::Error::RustError("无法读取延迟任务数量".to_string()))
+}
+
 pub async fn tasks_for_server(db: &D1Database, server_id: &str) -> Result<Vec<AgentLatencyTask>> {
     db.prepare(
         "SELECT t.id, t.name, t.task_type, t.target, t.interval_seconds \
@@ -110,8 +129,9 @@ pub async fn create_task(
     input: &LatencyTaskInput,
     timestamp: i64,
 ) -> Result<()> {
-    let mut statements = vec![db
-        .prepare(
+    let server_ids = serde_json::to_string(&input.server_ids)?;
+    let statements = vec![
+        db.prepare(
             "INSERT INTO latency_tasks( \
                id, name, task_type, target, interval_seconds, default_enabled, \
                sort_order, created_at, updated_at \
@@ -126,12 +146,13 @@ pub async fn create_task(
             number(input.interval_seconds),
             JsValue::from_bool(input.default_enabled),
             number(timestamp),
-        ])?];
-    let assignment =
-        db.prepare("INSERT INTO latency_task_servers(task_id, server_id) VALUES (?1, ?2)");
-    for server_id in &input.server_ids {
-        statements.push(assignment.clone().bind(&[text(id), text(server_id)])?);
-    }
+        ])?,
+        db.prepare(
+            "INSERT INTO latency_task_servers(task_id, server_id) \
+             SELECT ?1, CAST(value AS TEXT) FROM json_each(?2)",
+        )
+        .bind(&[text(id), text(&server_ids)])?,
+    ];
     db.batch(statements).await?;
     Ok(())
 }
@@ -150,9 +171,12 @@ pub async fn update_task(
         .bind(&[text(id)])?
         .first(None)
         .await?;
-    if exists.is_none() {
+    let Some(existing) = exists else {
         return Ok(false);
-    }
+    };
+    let reset_history =
+        existing.task_type != input.task_type.trim() || existing.target != input.target.trim();
+    let server_ids = serde_json::to_string(&input.server_ids)?;
     let mut statements = vec![
         db.prepare(
             "UPDATE latency_tasks SET name = ?2, task_type = ?3, target = ?4, \
@@ -169,11 +193,42 @@ pub async fn update_task(
         ])?,
         db.prepare("DELETE FROM latency_task_servers WHERE task_id = ?1")
             .bind(&[text(id)])?,
+        db.prepare(
+            "INSERT INTO latency_task_servers(task_id, server_id) \
+             SELECT ?1, CAST(value AS TEXT) FROM json_each(?2)",
+        )
+        .bind(&[text(id), text(&server_ids)])?,
     ];
-    let assignment =
-        db.prepare("INSERT INTO latency_task_servers(task_id, server_id) VALUES (?1, ?2)");
-    for server_id in &input.server_ids {
-        statements.push(assignment.clone().bind(&[text(id), text(server_id)])?);
+    if reset_history {
+        statements.push(
+            db.prepare("DELETE FROM latency_latest WHERE task_id = ?1")
+                .bind(&[text(id)])?,
+        );
+        statements.push(
+            db.prepare("DELETE FROM latency_history WHERE task_id = ?1")
+                .bind(&[text(id)])?,
+        );
+    } else {
+        statements.push(
+            db.prepare(
+                "DELETE FROM latency_latest WHERE task_id = ?1 AND NOT EXISTS ( \
+                   SELECT 1 FROM latency_task_servers a \
+                   WHERE a.task_id = latency_latest.task_id \
+                     AND a.server_id = latency_latest.server_id \
+                 )",
+            )
+            .bind(&[text(id)])?,
+        );
+        statements.push(
+            db.prepare(
+                "DELETE FROM latency_history WHERE task_id = ?1 AND NOT EXISTS ( \
+                   SELECT 1 FROM latency_task_servers a \
+                   WHERE a.task_id = latency_history.task_id \
+                     AND a.server_id = latency_history.server_id \
+                 )",
+            )
+            .bind(&[text(id)])?,
+        );
     }
     db.batch(statements).await?;
     Ok(true)
@@ -213,23 +268,53 @@ pub async fn save_results(
         .into_iter()
         .map(|task| task.id)
         .collect();
-    let latest = db.prepare(
-        "INSERT INTO latency_latest( \
-           task_id, server_id, timestamp, latency_ms, packet_loss \
-         ) VALUES (?1, ?2, ?3, ?4, ?5) \
-         ON CONFLICT(task_id, server_id) DO UPDATE SET \
-           timestamp=excluded.timestamp, latency_ms=excluded.latency_ms, \
-           packet_loss=excluded.packet_loss \
-         WHERE excluded.timestamp >= latency_latest.timestamp",
-    );
-    let historical = db.prepare(
-        "INSERT INTO latency_history( \
-           task_id, server_id, timestamp, latency_ms, packet_loss \
-         ) VALUES (?1, ?2, ?3, ?4, ?5) \
-         ON CONFLICT(task_id, server_id, timestamp) DO UPDATE SET \
-           latency_ms=excluded.latency_ms, packet_loss=excluded.packet_loss",
-    );
-    let mut statements = Vec::with_capacity(results.len() * 2);
+    let (latest, history) = compact_results(results, &assigned, received_at);
+    if latest.is_empty() {
+        return Ok(());
+    }
+    let latest_json = serde_json::to_string(&latest)?;
+    let history_json = serde_json::to_string(&history)?;
+    let latest_statement = db
+        .prepare(
+            "INSERT INTO latency_latest( \
+               task_id, server_id, timestamp, latency_ms, packet_loss \
+             ) SELECT \
+               json_extract(value, '$.task_id'), ?1, \
+               CAST(json_extract(value, '$.timestamp') AS INTEGER), \
+               CAST(json_extract(value, '$.latency_ms') AS REAL), \
+               CAST(json_extract(value, '$.packet_loss') AS REAL) \
+             FROM json_each(?2) WHERE true \
+             ON CONFLICT(task_id, server_id) DO UPDATE SET \
+               timestamp=excluded.timestamp, latency_ms=excluded.latency_ms, \
+               packet_loss=excluded.packet_loss \
+             WHERE excluded.timestamp >= latency_latest.timestamp",
+        )
+        .bind(&[text(server_id), text(&latest_json)])?;
+    let history_statement = db
+        .prepare(
+            "INSERT INTO latency_history( \
+               task_id, server_id, timestamp, latency_ms, packet_loss \
+             ) SELECT \
+               json_extract(value, '$.task_id'), ?1, \
+               CAST(json_extract(value, '$.timestamp') AS INTEGER), \
+               CAST(json_extract(value, '$.latency_ms') AS REAL), \
+               CAST(json_extract(value, '$.packet_loss') AS REAL) \
+             FROM json_each(?2) WHERE true \
+             ON CONFLICT(task_id, server_id, timestamp) DO UPDATE SET \
+               latency_ms=excluded.latency_ms, packet_loss=excluded.packet_loss",
+        )
+        .bind(&[text(server_id), text(&history_json)])?;
+    db.batch(vec![latest_statement, history_statement]).await?;
+    Ok(())
+}
+
+fn compact_results(
+    results: &[AgentLatencyResult],
+    assigned: &HashSet<String>,
+    received_at: i64,
+) -> (Vec<StoredLatencyResult>, Vec<StoredLatencyResult>) {
+    let mut latest: HashMap<String, StoredLatencyResult> = HashMap::new();
+    let mut history = std::collections::BTreeMap::new();
     for result in results
         .iter()
         .filter(|result| assigned.contains(&result.task_id))
@@ -239,21 +324,35 @@ pub async fn save_results(
         } else {
             received_at
         };
-        let values = [
-            text(&result.task_id),
-            text(server_id),
-            number(timestamp),
-            number(result.latency_ms),
-            number(result.packet_loss),
-        ];
-        statements.push(latest.clone().bind(&values)?);
-        statements.push(historical.clone().bind(&values)?);
+        let stored = StoredLatencyResult {
+            task_id: result.task_id.clone(),
+            timestamp,
+            latency_ms: result.latency_ms,
+            packet_loss: result.packet_loss,
+        };
+        if latest
+            .get(&result.task_id)
+            .is_none_or(|current| timestamp >= current.timestamp)
+        {
+            latest.insert(result.task_id.clone(), stored.clone());
+        }
+        let minute = timestamp / 60 * 60;
+        history.insert(
+            (minute, result.task_id.clone()),
+            StoredLatencyResult {
+                timestamp: minute,
+                ..stored
+            },
+        );
     }
-    if statements.is_empty() {
-        return Ok(());
-    }
-    db.batch(statements).await?;
-    Ok(())
+    let mut latest = latest.into_values().collect::<Vec<_>>();
+    latest.sort_by(|left, right| left.task_id.cmp(&right.task_id));
+    let skip = history.len().saturating_sub(MAX_HISTORY_ROWS_PER_REPORT);
+    let history = history
+        .into_values()
+        .skip(skip)
+        .collect::<Vec<StoredLatencyResult>>();
+    (latest, history)
 }
 
 pub async fn latest_all(db: &D1Database) -> Result<Vec<LatencySample>> {
@@ -261,6 +360,8 @@ pub async fn latest_all(db: &D1Database) -> Result<Vec<LatencySample>> {
         "SELECT l.task_id, l.server_id, t.name, t.task_type, t.target, \
          l.timestamp, l.latency_ms, l.packet_loss \
          FROM latency_latest l INNER JOIN latency_tasks t ON t.id = l.task_id \
+         INNER JOIN latency_task_servers a \
+           ON a.task_id = l.task_id AND a.server_id = l.server_id \
          ORDER BY t.sort_order ASC, t.created_at ASC",
     )
     .all()
@@ -268,21 +369,71 @@ pub async fn latest_all(db: &D1Database) -> Result<Vec<LatencySample>> {
     .results()
 }
 
-pub async fn history(db: &D1Database, server_id: &str, hours: i64) -> Result<Vec<LatencySample>> {
-    let cutoff = (Date::now().as_millis() as i64 / 1000) - hours.clamp(1, 24 * 365) * 3600;
+pub async fn latest_for_server(db: &D1Database, server_id: &str) -> Result<Vec<LatencySample>> {
     db.prepare(
-        "SELECT h.task_id, h.server_id, t.name, t.task_type, t.target, \
-         h.timestamp, h.latency_ms, h.packet_loss \
-         FROM latency_history h INNER JOIN latency_tasks t ON t.id = h.task_id \
-         WHERE h.server_id = ?1 AND h.timestamp >= ?2 \
-         ORDER BY h.timestamp ASC, t.sort_order ASC",
+        "SELECT l.task_id, l.server_id, t.name, t.task_type, t.target, \
+         l.timestamp, l.latency_ms, l.packet_loss \
+         FROM latency_latest l INNER JOIN latency_tasks t ON t.id = l.task_id \
+         INNER JOIN latency_task_servers a \
+           ON a.task_id = l.task_id AND a.server_id = l.server_id \
+         WHERE l.server_id = ?1 \
+         ORDER BY t.sort_order ASC, t.created_at ASC",
     )
-    .bind(&[text(server_id), number(cutoff)])?
+    .bind(&[text(server_id)])?
     .all()
     .await?
     .results()
 }
 
+pub async fn history(db: &D1Database, server_id: &str, hours: i64) -> Result<Vec<LatencySample>> {
+    let hours = hours.clamp(1, 24 * 365);
+    let cutoff = (Date::now().as_millis() as i64 / 1000) - hours * 3600;
+    let task_count = db
+        .prepare("SELECT COUNT(*) AS count FROM latency_task_servers WHERE server_id = ?1")
+        .bind(&[text(server_id)])?
+        .first::<i64>(Some("count"))
+        .await?
+        .unwrap_or(0);
+    if task_count == 0 {
+        return Ok(Vec::new());
+    }
+    let bucket = history_bucket_seconds(hours, task_count);
+    let query = format!(
+        "SELECT h.task_id, h.server_id, t.name, t.task_type, t.target, \
+         (h.timestamp / {bucket}) * {bucket} AS timestamp, \
+         CASE WHEN SUM(CASE WHEN h.latency_ms >= 0 THEN 1 ELSE 0 END) > 0 \
+           THEN AVG(CASE WHEN h.latency_ms >= 0 THEN h.latency_ms END) ELSE -1 END AS latency_ms, \
+         AVG(h.packet_loss) AS packet_loss \
+         FROM latency_history h INNER JOIN latency_tasks t ON t.id = h.task_id \
+         INNER JOIN latency_task_servers a \
+           ON a.task_id = h.task_id AND a.server_id = h.server_id \
+         WHERE h.server_id = ?1 AND h.timestamp >= ?2 \
+         GROUP BY h.task_id, h.server_id, t.name, t.task_type, t.target, h.timestamp / {bucket} \
+         ORDER BY timestamp ASC, t.sort_order ASC LIMIT {MAX_HISTORY_RESPONSE_ROWS}"
+    );
+    db.prepare(query)
+        .bind(&[text(server_id), number(cutoff)])?
+        .all()
+        .await?
+        .results()
+}
+
+fn history_bucket_seconds(hours: i64, task_count: i64) -> i64 {
+    let hours = hours.clamp(1, 24 * 365);
+    let task_count = task_count.clamp(1, MAX_LATENCY_TASKS as i64);
+    let base = match hours {
+        1 => 60,
+        2..=4 => 120,
+        5..=24 => 600,
+        25..=168 => 3600,
+        169..=720 => 14_400,
+        _ => 86_400,
+    };
+    let points_per_task = (MAX_HISTORY_RESPONSE_ROWS / task_count).max(1);
+    let bounded = (hours * 3600 + points_per_task - 1) / points_per_task;
+    base.max(bounded)
+}
+
 pub async fn cleanup_history(db: &D1Database, cutoff: i64) -> Result<()> {
     db.prepare("DELETE FROM latency_history WHERE timestamp < ?1")
         .bind(&[number(cutoff)])?
@@ -295,3 +446,73 @@ pub async fn clear_history(db: &D1Database) -> Result<()> {
     db.prepare("DELETE FROM latency_history").run().await?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{compact_results, history_bucket_seconds, MAX_HISTORY_ROWS_PER_REPORT};
+    use crate::models::AgentLatencyResult;
+    use std::collections::HashSet;
+
+    #[test]
+    fn compacts_latency_results_by_task_and_minute() {
+        let assigned = HashSet::from(["task-a".to_string()]);
+        let results = vec![
+            AgentLatencyResult {
+                task_id: "task-a".to_string(),
+                timestamp: 121,
+                latency_ms: 10.0,
+                packet_loss: 0.0,
+            },
+            AgentLatencyResult {
+                task_id: "task-a".to_string(),
+                timestamp: 149,
+                latency_ms: 20.0,
+                packet_loss: 25.0,
+            },
+            AgentLatencyResult {
+                task_id: "unassigned".to_string(),
+                timestamp: 149,
+                latency_ms: 1.0,
+                packet_loss: 0.0,
+            },
+        ];
+        let (latest, history) = compact_results(&results, &assigned, 150);
+        assert_eq!(latest.len(), 1);
+        assert_eq!(latest[0].timestamp, 149);
+        assert_eq!(history.len(), 1);
+        assert_eq!(history[0].timestamp, 120);
+        assert_eq!(history[0].latency_ms, 20.0);
+    }
+
+    #[test]
+    fn bounds_compacted_latency_history() {
+        let assigned = (0..128)
+            .map(|index| format!("task-{index}"))
+            .collect::<HashSet<_>>();
+        let results = (0..40)
+            .flat_map(|minute| {
+                (0..128).map(move |task| AgentLatencyResult {
+                    task_id: format!("task-{task}"),
+                    timestamp: 1_000_000 + minute * 60,
+                    latency_ms: task as f64,
+                    packet_loss: 0.0,
+                })
+            })
+            .collect::<Vec<_>>();
+        let (_, history) = compact_results(&results, &assigned, results.last().unwrap().timestamp);
+        assert_eq!(history.len(), MAX_HISTORY_ROWS_PER_REPORT);
+        assert_eq!(
+            history.last().unwrap().timestamp,
+            results.last().unwrap().timestamp / 60 * 60
+        );
+    }
+
+    #[test]
+    fn bounds_latency_history_response_across_tasks() {
+        assert_eq!(history_bucket_seconds(1, 1), 60);
+        assert_eq!(history_bucket_seconds(24, 1), 600);
+        assert!(history_bucket_seconds(1, 128) >= 117);
+        assert!(24 * 3600 / history_bucket_seconds(24, 128) * 128 <= 4000);
+        assert_eq!(history_bucket_seconds(720, 1), 14_400);
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index 00823f7..04b728d 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -22,9 +22,9 @@ use crate::auth::{
     verify_theme_preview_proof, verify_turnstile_proof,
 };
 use crate::models::{
-    AgentReport, AgentReportBatch, AlertRuleInput, ApiError, LatencyTaskInput, LoginRequest,
-    ServerBatchInput, ServerInput, ServerOrderInput, ServerView, SettingsInput, ThemeInput,
-    ThemeView, TurnstileVerifyRequest,
+    AgentDiskMetric, AgentGpuMetric, AgentReport, AgentReportBatch, AlertRuleInput, ApiError,
+    LatencyTaskInput, LoginRequest, ServerBatchInput, ServerInput, ServerOrderInput, ServerView,
+    SettingsInput, ThemeInput, ThemeView, TurnstileVerifyRequest,
 };
 
 const ADMIN_HTML: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/admin.html"));
@@ -33,11 +33,8 @@ const ADMIN_STYLE: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/admin.css")
 const HISTORY_CACHE_SECONDS: i64 = 30;
 const API_JSON_MAX_BYTES: usize = 1024 * 1024;
 const AGENT_JSON_MAX_BYTES: usize = 16 * 1024 * 1024;
-
-#[derive(Serialize)]
-struct Success {
-    success: bool,
-}
+const MAX_AGENT_SAMPLES: usize = 720;
+const MAX_AGENT_LATENCY_RESULTS: usize = 4096;
 
 #[derive(Serialize)]
 struct PublicServer {
@@ -52,7 +49,7 @@ struct PublicServer {
     price: f64,
     billing_cycle: i64,
     currency: String,
-    auto_renewal: i64,
+    auto_renewal: bool,
     public_remark: String,
     reset_day: i64,
     timestamp: Option<i64>,
@@ -89,9 +86,8 @@ struct PublicServer {
     disk_write_iops: Option<f64>,
     disk_await_ms: Option<f64>,
     disk_utilization: Option<f64>,
-    message: Option<String>,
-    disks: serde_json::Value,
-    gpus: serde_json::Value,
+    disks: Vec<AgentDiskMetric>,
+    gpus: Vec<AgentGpuMetric>,
     latency: Vec<latency::LatencySample>,
 }
 
@@ -122,6 +118,11 @@ fn env_secret_text(env: &Env, key: &str) -> String {
 
 fn json<T: Serialize>(value: &T, status: u16) -> Result<Response> {
     let mut response = Response::from_json(value)?.with_status(status);
+    set_api_headers(&mut response)?;
+    Ok(response)
+}
+
+fn set_api_headers(response: &mut Response) -> Result<()> {
     let headers = response.headers_mut();
     headers.set("Cache-Control", "no-store")?;
     headers.set("X-Content-Type-Options", "nosniff")?;
@@ -130,6 +131,12 @@ fn json<T: Serialize>(value: &T, status: u16) -> Result<Response> {
         "Permissions-Policy",
         "camera=(), microphone=(), geolocation=()",
     )?;
+    Ok(())
+}
+
+fn no_content() -> Result<Response> {
+    let mut response = Response::empty()?.with_status(204);
+    set_api_headers(&mut response)?;
     Ok(response)
 }
 
@@ -643,8 +650,8 @@ fn validate_report(report: &AgentReport) -> Option<&'static str> {
     if counters.iter().any(|value| *value < 0) {
         return Some("计数指标不能为负数");
     }
-    if report.message.chars().count() > 500 || report.gpu_model.chars().count() > 240 {
-        return Some("探针文本字段过长");
+    if report.gpu_model.chars().count() > 240 {
+        return Some("GPU 型号字段过长");
     }
     if report.agent_version.chars().count() > 80 {
         return Some("探针版本字段过长");
@@ -671,8 +678,9 @@ fn validate_report(report: &AgentReport) -> Option<&'static str> {
             gpu.model.chars().count() > 240
                 || gpu.memory_used < 0
                 || gpu.memory_total < 0
-                || !gpu.usage.is_finite()
-                || !(0.0..=100.0).contains(&gpu.usage)
+                || gpu
+                    .usage
+                    .is_some_and(|usage| !usage.is_finite() || !(0.0..=100.0).contains(&usage))
         })
     {
         return Some("磁盘或 GPU 明细无效");
@@ -706,13 +714,13 @@ fn public_server(server: ServerView, latency: Vec<latency::LatencySample>) -> Pu
     let disks = server
         .disk_info
         .as_deref()
-        .and_then(|value| serde_json::from_str::<serde_json::Value>(value).ok())
-        .unwrap_or_else(|| serde_json::json!([]));
+        .and_then(|value| serde_json::from_str::<Vec<AgentDiskMetric>>(value).ok())
+        .unwrap_or_default();
     let gpus = server
         .gpu_info
         .as_deref()
-        .and_then(|value| serde_json::from_str::<serde_json::Value>(value).ok())
-        .unwrap_or_else(|| serde_json::json!([]));
+        .and_then(|value| serde_json::from_str::<Vec<AgentGpuMetric>>(value).ok())
+        .unwrap_or_default();
     PublicServer {
         id: server.id,
         name: server.name,
@@ -725,7 +733,7 @@ fn public_server(server: ServerView, latency: Vec<latency::LatencySample>) -> Pu
         price: server.price,
         billing_cycle: server.billing_cycle,
         currency: server.currency,
-        auto_renewal: server.auto_renewal,
+        auto_renewal: server.auto_renewal != 0,
         public_remark: server.public_remark,
         reset_day: server.reset_day,
         timestamp: server.timestamp,
@@ -762,7 +770,6 @@ fn public_server(server: ServerView, latency: Vec<latency::LatencySample>) -> Pu
         disk_write_iops: server.disk_write_iops,
         disk_await_ms: server.disk_await_ms,
         disk_utilization: server.disk_utilization,
-        message: server.message,
         disks,
         gpus,
         latency,
@@ -811,6 +818,13 @@ fn rate_limit_key(req: &Request) -> String {
     sha256_hex(&identity)
 }
 
+fn agent_rate_limit_key(req: &Request) -> String {
+    bearer_token(req)
+        .filter(|value| !value.is_empty())
+        .map(|value| sha256_hex(&value))
+        .unwrap_or_else(|| rate_limit_key(req))
+}
+
 fn allow_on_rate_limit_failure(binding: &str) -> bool {
     binding != "AUTH_RATE_LIMITER"
 }
@@ -941,7 +955,7 @@ async fn handle_agent_report(
     if batch.server_id.is_empty() || batch.server_id.len() > 80 {
         return error("节点 ID 无效", 400);
     }
-    if batch.samples.is_empty() || batch.samples.len() > 720 {
+    if batch.samples.is_empty() || batch.samples.len() > MAX_AGENT_SAMPLES {
         return error("每批应包含 1 至 720 个样本", 400);
     }
     let received_at = now();
@@ -965,6 +979,9 @@ async fn handle_agent_report(
         .flat_map(|report| report.latency_results.iter())
         .cloned()
         .collect::<Vec<_>>();
+    if latency_results.len() > MAX_AGENT_LATENCY_RESULTS {
+        return error("每批最多包含 4096 条延迟结果", 400);
+    }
     db::save_reports(database, &batch.server_id, &batch.samples).await?;
     latency::save_results(database, &batch.server_id, &latency_results, received_at).await?;
 
@@ -972,38 +989,38 @@ async fn handle_agent_report(
         .await?
         .is_none_or(|value| value == "true");
     if row.hidden == 0 && public_dashboard {
-        let latest = batch
-            .samples
-            .iter()
-            .max_by_key(|report| report.timestamp)
-            .expect("batch is non-empty");
-        let metrics = serde_json::to_value(latest)?;
-        let payload = serde_json::to_string(&serde_json::json!({
-            "type": "metrics",
-            "server_id": batch.server_id,
-            "timestamp": latest.timestamp,
-            "metrics": metrics
-        }))?;
+        let server = db::get_server(database, &batch.server_id, false).await?;
+        let samples = latency::latest_for_server(database, &batch.server_id).await?;
+        let payload = server
+            .map(|server| public_server(server, samples))
+            .map(|server| {
+                serde_json::to_string(&serde_json::json!({
+                    "type": "server",
+                    "server": server
+                }))
+            })
+            .transpose()?;
         let server_id = batch.server_id.clone();
-        ctx.wait_until(async move {
-            let _ = live::broadcast(&env, &server_id, &payload).await;
-        });
+        if let Some(payload) = payload {
+            ctx.wait_until(async move {
+                let _ = live::broadcast(&env, &server_id, &payload).await;
+            });
+        }
     }
-    let config = db::agent_config(database, &batch.server_id).await?;
+    let Some(config) = db::agent_config(database, &batch.server_id).await? else {
+        return error("节点不存在", 404);
+    };
     let config_json = serde_json::to_string(&config)?;
     let config_hash = sha256_hex(&config_json);
     if agent_config_hash == config_hash {
-        let mut response = Response::empty()?.with_status(204);
+        let mut response = no_content()?;
         response
             .headers_mut()
             .set("X-Agent-Config-Sha256", &config_hash)?;
         response.headers_mut().set("Cache-Control", "no-store")?;
         return Ok(response);
     }
-    let mut response = json(
-        &serde_json::json!({ "success": true, "config": config }),
-        202,
-    )?;
+    let mut response = json(&config, 202)?;
     response
         .headers_mut()
         .set("X-Agent-Config-Sha256", &config_hash)?;
@@ -1095,8 +1112,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
                 "turnstile_enabled": public_turnstile_enabled,
                 "turnstile_login_enabled": login_protection_enabled || public_turnstile_enabled,
                 "turnstile_site_key": turnstile_site_key,
-                "password_client_salt": settings.password_client_salt,
-                "websocket": true
+                "password_client_salt": settings.password_client_salt
             }),
             200,
         );
@@ -1180,7 +1196,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         response.headers_mut().append(
             "Set-Cookie",
             &format!(
-                "nodeflare_turnstile={proof}; Path=/; Max-Age=3600; HttpOnly; SameSite=Strict"
+                "nodeflare_turnstile={proof}; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Strict"
             ),
         )?;
         return Ok(response);
@@ -1243,29 +1259,6 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         return json(&serde_json::json!({ "servers": servers }), 200);
     }
 
-    if method == Method::Get && path.starts_with("/api/servers/") {
-        if !turnstile_verified {
-            return error("请先完成 Cloudflare 人机验证", 403);
-        }
-        if !settings.public_dashboard && !admin {
-            return error("仪表盘未公开", 401);
-        }
-        let Some(id) = server_id(&path, "/api/servers/") else {
-            return error("节点 ID 无效", 400);
-        };
-        return match db::get_server(&database, &id, false).await? {
-            Some(server) => {
-                let samples = latency::latest_all(&database)
-                    .await?
-                    .into_iter()
-                    .filter(|sample| sample.server_id == id)
-                    .collect();
-                json(&public_server(server, samples), 200)
-            }
-            None => error("节点不存在", 404),
-        };
-    }
-
     if method == Method::Get && path.starts_with("/api/history/") {
         if !turnstile_verified {
             return error("请先完成 Cloudflare 人机验证", 403);
@@ -1349,6 +1342,9 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         if let Some(message) = validate_latency_task(&input) {
             return error(message, 400);
         }
+        if latency::task_count(&database).await? >= latency::MAX_LATENCY_TASKS as i64 {
+            return error("最多可创建 128 个延迟任务", 400);
+        }
         let server_ids: HashSet<String> = db::list_servers(&database, true)
             .await?
             .into_iter()
@@ -1365,6 +1361,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             .take(16)
             .collect::<String>();
         latency::create_task(&database, &id, &input, now()).await?;
+        db::increment_setting(&database, "history_cache_version").await?;
         return json(&serde_json::json!({ "id": id }), 201);
     }
 
@@ -1376,7 +1373,8 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         };
         if method == Method::Delete {
             return if latency::delete_task(&database, &id).await? {
-                json(&Success { success: true }, 200)
+                db::increment_setting(&database, "history_cache_version").await?;
+                no_content()
             } else {
                 error("延迟任务不存在", 404)
             };
@@ -1401,7 +1399,8 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             return error("延迟任务包含不存在的服务器", 400);
         }
         return if latency::update_task(&database, &id, &input, now()).await? {
-            json(&Success { success: true }, 200)
+            db::increment_setting(&database, "history_cache_version").await?;
+            no_content()
         } else {
             error("延迟任务不存在", 404)
         };
@@ -1452,7 +1451,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         };
         if method == Method::Delete {
             return if db::delete_alert_rule(&database, &id).await? {
-                json(&Success { success: true }, 200)
+                no_content()
             } else {
                 error("告警规则不存在", 404)
             };
@@ -1477,7 +1476,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             return error("告警规则包含不存在的服务器", 400);
         }
         return if db::update_alert_rule(&database, &id, &input).await? {
-            json(&Success { success: true }, 200)
+            no_content()
         } else {
             error("告警规则不存在", 404)
         };
@@ -1501,7 +1500,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             return error("批量删除列表无效", 400);
         }
         db::delete_servers(&database, &input.ids).await?;
-        return json(&Success { success: true }, 200);
+        return no_content();
     }
 
     if method == Method::Patch && path == "/api/admin/servers/order" {
@@ -1523,7 +1522,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             return error("排序列表必须包含全部节点", 400);
         }
         db::reorder_servers(&database, &input.ids).await?;
-        return json(&Success { success: true }, 200);
+        return no_content();
     }
 
     if method == Method::Post && path == "/api/admin/servers" {
@@ -1570,7 +1569,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         };
         if method == Method::Delete {
             return if db::delete_server(&database, &id).await? {
-                json(&Success { success: true }, 200)
+                no_content()
             } else {
                 error("节点不存在", 404)
             };
@@ -1583,7 +1582,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             return error(message, 400);
         }
         return if db::update_server(&database, &id, &input).await? {
-            json(&Success { success: true }, 200)
+            no_content()
         } else {
             error("节点不存在", 404)
         };
@@ -1695,7 +1694,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         if !db::set_active_theme(&database, id).await? {
             return error("主题不存在", 404);
         }
-        return json(&Success { success: true }, 200);
+        return no_content();
     }
 
     if method == Method::Delete && path.starts_with("/api/admin/themes/") {
@@ -1706,14 +1705,26 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             return error("内置主题不能删除", 400);
         }
         return if db::delete_theme(&database, &id).await? {
-            json(&Success { success: true }, 200)
+            no_content()
         } else {
             error("主题不存在", 404)
         };
     }
 
     if method == Method::Get && path == "/api/admin/theme-settings" {
-        return json(&theme::settings_schema(), 200);
+        if settings.active_theme_id == theme::BUILTIN_THEME_ID {
+            return json(&theme::builtin_settings_schema(), 200);
+        }
+        let Some(url) = db::theme_url(&database, &settings.active_theme_id).await? else {
+            return error("当前主题不存在", 404);
+        };
+        return match theme::remote_settings_schema(&url).await {
+            Ok(schema) => json(&schema, 200),
+            Err(err) => {
+                console_warn!("theme settings validation failed for {url}: {err}");
+                error("当前主题的 theme.json 设置格式无效", 422)
+            }
+        };
     }
 
     if method == Method::Post && path == "/api/admin/exchange-rates/refresh" {
@@ -1762,8 +1773,8 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
 
     if method == Method::Delete && path == "/api/admin/history" {
         db::clear_history(&database).await?;
-        db::save_setting(&database, "history_cache_version", &now().to_string()).await?;
-        return json(&Success { success: true }, 200);
+        db::increment_setting(&database, "history_cache_version").await?;
+        return no_content();
     }
 
     if method == Method::Post && path == "/api/admin/notifications/test" {
@@ -1775,7 +1786,7 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
             console_error!("test notification failed: {err}");
             return error("测试通知发送失败，请检查 Bot Token 和 Chat ID", 502);
         }
-        return json(&Success { success: true }, 200);
+        return no_content();
     }
 
     if method == Method::Patch && path == "/api/admin/settings" {
@@ -1870,9 +1881,6 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         {
             return error("新密码派生值无效", 400);
         }
-        let enabled = input
-            .turnstile_enabled
-            .unwrap_or(settings.turnstile_enabled);
         let configured_site_key = input
             .turnstile_site_key
             .as_deref()
@@ -1892,7 +1900,10 @@ async fn handle(mut req: Request, env: Env, ctx: Context) -> Result<Response> {
         } else {
             configured_secret_key
         };
-        if enabled && (site_key.is_empty() || secret_key.is_empty()) {
+        let protection_activated = input.turnstile_enabled == Some(true)
+            && !settings.turnstile_enabled
+            || input.turnstile_login_enabled == Some(true) && !settings.turnstile_login_enabled;
+        if protection_activated && (site_key.is_empty() || secret_key.is_empty()) {
             return error("启用 Turnstile 前必须填写站点密钥和私钥", 400);
         }
         if input
@@ -2023,7 +2034,11 @@ async fn fetch(req: Request, env: Env, ctx: Context) -> Result<Response> {
     }
 
     if let Some(binding) = rate_limit_binding(method, &path) {
-        let key = rate_limit_key(&req);
+        let key = if binding == "AGENT_RATE_LIMITER" {
+            agent_rate_limit_key(&req)
+        } else {
+            rate_limit_key(&req)
+        };
         if !request_within_rate_limit(&env, binding, key).await {
             return rate_limited();
         }
@@ -2082,6 +2097,9 @@ async fn scheduled(_event: ScheduledEvent, env: Env, _ctx: ScheduleContext) {
         Ok((_, false)) => {}
         Err(err) => console_error!("exchange-rate refresh failed: {err}"),
     }
+    if let Err(err) = notify::renew_servers(&database).await {
+        console_error!("server renewal failed: {err}");
+    }
     if let Ok(settings) = settings {
         if let Err(err) = notify::check_alerts(&database, &settings).await {
             console_error!("alert check failed: {err}");
diff --git a/src/models.rs b/src/models.rs
index 3de17e7..33916a0 100644
--- a/src/models.rs
+++ b/src/models.rs
@@ -1,4 +1,11 @@
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize, Serializer};
+
+fn serialize_sqlite_bool<S>(value: &i64, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    serializer.serialize_bool(*value != 0)
+}
 
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -161,7 +168,7 @@ pub struct AgentDiskMetric {
 #[serde(deny_unknown_fields)]
 pub struct AgentGpuMetric {
     pub model: String,
-    pub usage: f64,
+    pub usage: Option<f64>,
     pub memory_used: i64,
     pub memory_total: i64,
 }
@@ -212,7 +219,6 @@ pub struct AgentReport {
     pub disk_utilization: f64,
     pub disks: Vec<AgentDiskMetric>,
     pub gpus: Vec<AgentGpuMetric>,
-    pub message: String,
     pub latency_results: Vec<AgentLatencyResult>,
 }
 
@@ -224,6 +230,7 @@ pub struct ServerView {
     pub group_name: String,
     pub tags: String,
     pub note: String,
+    #[serde(serialize_with = "serialize_sqlite_bool")]
     pub hidden: i64,
     pub expires_at: Option<i64>,
     pub traffic_limit: i64,
@@ -231,6 +238,7 @@ pub struct ServerView {
     pub price: f64,
     pub billing_cycle: i64,
     pub currency: String,
+    #[serde(serialize_with = "serialize_sqlite_bool")]
     pub auto_renewal: i64,
     pub public_remark: String,
     pub network_interface: String,
@@ -239,7 +247,9 @@ pub struct ServerView {
     pub collect_interval: i64,
     pub rx_correction: i64,
     pub tx_correction: i64,
+    #[serde(serialize_with = "serialize_sqlite_bool")]
     pub offline_notify_disabled: i64,
+    #[serde(serialize_with = "serialize_sqlite_bool")]
     pub auto_update: i64,
     #[serde(skip_serializing)]
     pub created_at: i64,
@@ -281,7 +291,6 @@ pub struct ServerView {
     pub disk_info: Option<String>,
     #[serde(skip_serializing)]
     pub gpu_info: Option<String>,
-    pub message: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Serialize)]
@@ -324,7 +333,7 @@ pub struct AgentConfigView {
     pub report_interval: i64,
     pub collect_interval: i64,
     pub network_interface: String,
-    pub auto_update: i64,
+    pub auto_update: bool,
     pub latency_tasks: Vec<AgentLatencyTask>,
 }
 
@@ -348,7 +357,7 @@ pub struct AlertRuleView {
     pub threshold: f64,
     pub duration_minutes: i64,
     pub aggregation: String,
-    pub enabled: i64,
+    pub enabled: bool,
     pub server_ids: Vec<String>,
 }
 
diff --git a/src/notify.rs b/src/notify.rs
index 09dd9b0..a37613d 100644
--- a/src/notify.rs
+++ b/src/notify.rs
@@ -56,6 +56,34 @@ pub async fn send(settings: &SettingsView, message: &str) -> Result<()> {
     Ok(())
 }
 
+fn renewed_expiry(expires_at: i64, billing_cycle_days: i64, current_time: i64) -> Option<i64> {
+    let renew_before = i128::from(current_time) + 86_400;
+    let expires_at = i128::from(expires_at);
+    if expires_at > renew_before {
+        return None;
+    }
+    let cycle = i128::from(billing_cycle_days.clamp(1, 3650)) * 86_400;
+    let elapsed = renew_before - expires_at;
+    let cycles = elapsed / cycle + 1;
+    Some((expires_at + cycles * cycle).min(i128::from(i64::MAX)) as i64)
+}
+
+pub async fn renew_servers(db_conn: &D1Database) -> Result<()> {
+    let current_time = worker::Date::now().as_millis() as i64 / 1000;
+    for server in db::list_servers(db_conn, true).await? {
+        if server.auto_renewal == 0 {
+            continue;
+        }
+        let Some(expires_at) = server.expires_at else {
+            continue;
+        };
+        if let Some(next_expiry) = renewed_expiry(expires_at, server.billing_cycle, current_time) {
+            db::update_expiry(db_conn, &server.id, next_expiry).await?;
+        }
+    }
+    Ok(())
+}
+
 pub async fn check_alerts(db_conn: &D1Database, settings: &SettingsView) -> Result<()> {
     if !settings.notification_enabled || settings.notification_endpoint.trim().is_empty() {
         return Ok(());
@@ -90,21 +118,8 @@ pub async fn check_alerts(db_conn: &D1Database, settings: &SettingsView) -> Resu
             messages.push(format!("[恢复] {} 已恢复上报", server.name));
         }
 
-        let mut expires_at = server.expires_at;
-        if server.auto_renewal != 0 {
-            if let Some(mut value) = expires_at {
-                let cycle = server.billing_cycle.clamp(1, 3650) * 86_400;
-                if value <= current_time + 86_400 {
-                    while value <= current_time + 86_400 {
-                        value += cycle;
-                    }
-                    db::update_expiry(db_conn, &server_id, value).await?;
-                    expires_at = Some(value);
-                }
-            }
-        }
         if settings.expiry_alert_days > 0 {
-            if let Some(value) = expires_at {
+            if let Some(value) = server.expires_at {
                 let days = (value - current_time + 86_399) / 86_400;
                 if days >= 0 && days <= settings.expiry_alert_days {
                     let key = format!("{server_id}:{value}");
@@ -122,7 +137,7 @@ pub async fn check_alerts(db_conn: &D1Database, settings: &SettingsView) -> Resu
     let mut evaluated_resources = HashSet::new();
     let mut eligible_resources = HashSet::new();
     for rule in db::list_alert_rules(db_conn).await? {
-        if rule.enabled == 0 {
+        if !rule.enabled {
             continue;
         }
         if rule.server_ids.is_empty() {
@@ -195,3 +210,21 @@ pub async fn check_alerts(db_conn: &D1Database, settings: &SettingsView) -> Resu
     }
     db::sync_active_alert_states(db_conn, &previous_resources, &current_resources).await
 }
+
+#[cfg(test)]
+mod tests {
+    use super::renewed_expiry;
+
+    #[test]
+    fn advances_expired_servers_without_looping() {
+        let day = 86_400;
+        assert_eq!(renewed_expiry(80 * day, 30, 100 * day), Some(110 * day));
+        assert_eq!(renewed_expiry(101 * day, 30, 100 * day), Some(131 * day));
+        assert_eq!(renewed_expiry(102 * day, 30, 100 * day), None);
+    }
+
+    #[test]
+    fn saturates_pathological_expiry_values() {
+        assert_eq!(renewed_expiry(i64::MIN, 1, i64::MAX), Some(i64::MAX));
+    }
+}
diff --git a/src/theme.rs b/src/theme.rs
index 0beddb1..6fc0c02 100644
--- a/src/theme.rs
+++ b/src/theme.rs
@@ -6,6 +6,7 @@ pub const BUILTIN_THEME_ID: &str = "builtin-komari-glass";
 pub const BUILTIN_THEME_NAME: &str = "Komari Glass";
 pub const INDEX_MAX_BYTES: usize = 4 * 1024 * 1024;
 pub const ASSET_MAX_BYTES: usize = 16 * 1024 * 1024;
+const SETTINGS_MAX_BYTES: usize = 64 * 1024;
 
 pub struct ResolvedTheme {
     pub source_url: String,
@@ -133,6 +134,10 @@ pub fn index_url(base: &str) -> Option<String> {
     raw_github_base(base).map(|base| remote_url(base.as_str(), "index.html"))
 }
 
+fn settings_url(base: &str) -> Option<String> {
+    raw_github_base(base).map(|base| remote_url(base.as_str(), "theme.json"))
+}
+
 pub async fn read_response_limited(
     response: &mut Response,
     limit: usize,
@@ -181,7 +186,7 @@ pub async fn validate_remote(base: &str) -> Result<()> {
     Ok(())
 }
 
-pub fn settings_schema() -> Value {
+pub fn builtin_settings_schema() -> Value {
     let currencies = [
         "CNY", "USD", "HKD", "EUR", "GBP", "JPY", "RUB", "CHF", "INR", "VND", "THB", "CAD",
     ];
@@ -214,19 +219,164 @@ pub fn settings_schema() -> Value {
     })
 }
 
+fn empty_settings_schema(source: &str) -> Value {
+    serde_json::json!({ "schema": 1, "source": source, "settings": [] })
+}
+
+fn valid_setting_value(value: &Value) -> bool {
+    value.is_string() || value.is_boolean() || value.as_f64().is_some()
+}
+
+fn validate_settings_schema(value: Value) -> Option<Value> {
+    let object = value.as_object()?;
+    if object.get("schema")?.as_u64()? != 1 {
+        return None;
+    }
+    let fields = object.get("settings")?.as_array()?;
+    if fields.len() > 40 {
+        return None;
+    }
+    let allowed_types = [
+        "text", "textarea", "url", "color", "select", "toggle", "number",
+    ];
+    let mut keys = std::collections::HashSet::new();
+    for field in fields {
+        let field = field.as_object()?;
+        let key = field.get("key")?.as_str()?;
+        let label = field.get("label")?.as_str()?;
+        let field_type = field.get("type")?.as_str()?;
+        if key.is_empty()
+            || key.len() > 64
+            || !key
+                .chars()
+                .all(|character| character.is_ascii_alphanumeric() || "_-".contains(character))
+            || !keys.insert(key)
+            || label.is_empty()
+            || label.chars().count() > 80
+            || !allowed_types.contains(&field_type)
+            || field.keys().any(|key| {
+                !matches!(
+                    key.as_str(),
+                    "key"
+                        | "label"
+                        | "type"
+                        | "default"
+                        | "placeholder"
+                        | "options"
+                        | "min"
+                        | "max"
+                        | "step"
+                )
+            })
+            || field
+                .get("default")
+                .is_some_and(|value| !valid_setting_value(value))
+            || field
+                .get("placeholder")
+                .is_some_and(|value| value.as_str().is_none_or(|text| text.chars().count() > 160))
+            || ["min", "max", "step"].iter().any(|key| {
+                field
+                    .get(*key)
+                    .is_some_and(|value| value.as_f64().is_none())
+            })
+        {
+            return None;
+        }
+        let options = field.get("options").and_then(Value::as_array);
+        if field_type == "select"
+            && options.is_none_or(|choices| {
+                choices.is_empty()
+                    || choices.len() > 64
+                    || choices.iter().any(|choice| {
+                        choice.as_object().is_none_or(|choice| {
+                            choice.len() != 2
+                                || choice
+                                    .get("label")
+                                    .and_then(Value::as_str)
+                                    .is_none_or(|text| text.is_empty() || text.chars().count() > 80)
+                                || choice
+                                    .get("value")
+                                    .and_then(Value::as_str)
+                                    .is_none_or(|text| {
+                                        text.is_empty() || text.chars().count() > 160
+                                    })
+                        })
+                    })
+            })
+        {
+            return None;
+        }
+    }
+    Some(serde_json::json!({
+        "schema": 1,
+        "source": "remote",
+        "settings": fields
+    }))
+}
+
+pub async fn remote_settings_schema(base: &str) -> Result<Value> {
+    let url = settings_url(base)
+        .ok_or_else(|| Error::RustError("主题资源地址不是 GitHub Raw 地址".to_string()))?;
+    let request = Request::new(&url, Method::Get)?;
+    let mut response = Fetch::Request(request).send().await?;
+    if response.status_code() == 404 {
+        return Ok(empty_settings_schema("remote"));
+    }
+    if !(200..300).contains(&response.status_code()) {
+        return Err(Error::RustError(format!(
+            "主题 theme.json 返回 HTTP {}",
+            response.status_code()
+        )));
+    }
+    let body = read_response_limited(&mut response, SETTINGS_MAX_BYTES)
+        .await?
+        .ok_or_else(|| Error::RustError("主题 theme.json 内容无效".to_string()))?;
+    let value = serde_json::from_slice(body.as_slice())
+        .map_err(|_| Error::RustError("主题 theme.json 不是有效 JSON".to_string()))?;
+    validate_settings_schema(value)
+        .ok_or_else(|| Error::RustError("主题 theme.json 设置格式无效".to_string()))
+}
+
 #[cfg(test)]
 mod tests {
-    use super::{asset_url, normalize_url, resolve_url, settings_schema};
+    use super::{
+        asset_url, builtin_settings_schema, normalize_url, resolve_url, validate_settings_schema,
+    };
 
     #[test]
     fn exposes_builtin_glass_theme_settings() {
-        let schema = settings_schema();
+        let schema = builtin_settings_schema();
         let settings = schema["settings"].as_array().expect("settings");
         assert!(settings.iter().any(|field| field["key"] == "assetCurrency"));
         assert!(settings.iter().any(|field| field["key"] == "enableBlur"));
         assert_eq!(schema["source"], "builtin");
     }
 
+    #[test]
+    fn validates_remote_theme_settings() {
+        let schema = validate_settings_schema(serde_json::json!({
+            "schema": 1,
+            "settings": [{
+                "key": "accent",
+                "label": "强调色",
+                "type": "color",
+                "default": "#00aaff"
+            }]
+        }))
+        .expect("valid schema");
+        assert_eq!(schema["source"], "remote");
+        assert!(validate_settings_schema(serde_json::json!({
+            "schema": 1,
+            "settings": [{ "key": "../bad", "label": "Bad", "type": "text" }]
+        }))
+        .is_none());
+        assert!(validate_settings_schema(serde_json::json!({
+            "schema": 1,
+            "settings": [{ "key": "mode", "label": "Mode", "type": "select" }]
+        }))
+        .is_none());
+    }
+
     #[test]
     fn accepts_only_github_tree_urls() {
         assert_eq!(