diff --git a/apps/web/src/features/aiProviders/AiProvidersClaudeEditPage.tsx b/apps/web/src/features/aiProviders/AiProvidersClaudeEditPage.tsx
index b424ed386..b59f40bc2 100644
--- a/apps/web/src/features/aiProviders/AiProvidersClaudeEditPage.tsx
+++ b/apps/web/src/features/aiProviders/AiProvidersClaudeEditPage.tsx
@@ -394,6 +394,7 @@ export function AiProvidersClaudeEditPage() {
               </div>
 
               <div className={styles.sectionHint}>{t('ai_providers.claude_models_hint')}</div>
+              <div className={styles.sectionHint}>{t('ai_providers.model_alias_scope_hint')}</div>
 
               <ModelInputList
                 entries={form.modelEntries}
diff --git a/apps/web/src/features/aiProviders/AiProvidersPage.tsx b/apps/web/src/features/aiProviders/AiProvidersPage.tsx
index 249487b00..dbb9ef789 100644
--- a/apps/web/src/features/aiProviders/AiProvidersPage.tsx
+++ b/apps/web/src/features/aiProviders/AiProvidersPage.tsx
@@ -87,6 +87,8 @@ export function AiProvidersPage() {
   );
 
   const [configSwitchingKey, setConfigSwitchingKey] = useState<string | null>(null);
+  /** Synchronous lock so double-clicks in the same tick cannot start two enable/disable writes. */
+  const configSwitchingLockRef = useRef(false);
 
   // 表格筛选 / 排序 / 详情状态
   const [kindFilter, setKindFilter] = useState<ProviderKindFilter>('all');
@@ -319,6 +321,7 @@ export function AiProvidersPage() {
     actions: Map<string, ProviderHealthCheckApplyAction>
   ) => {
     if (actions.size === 0) return;
+    if (configSwitchingLockRef.current || configSwitchingKey) return;
 
     const rowByKey = new Map(rows.map((row) => [row.key, row]));
     const previous = {
@@ -428,6 +431,7 @@ export function AiProvidersPage() {
       return;
     }
 
+    configSwitchingLockRef.current = true;
     setConfigSwitchingKey('health-check');
 
     const applyLocalState = (
@@ -552,8 +556,9 @@ export function AiProvidersPage() {
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
       throw err;
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   const setHealthCheckProviderEnabled = async (providerKey: string, enabled: boolean) => {
@@ -566,12 +571,15 @@ export function AiProvidersPage() {
     index: number,
     enabled: boolean
   ) => {
+    if (configSwitchingLockRef.current || configSwitchingKey) return;
+
     if (provider === 'gemini' || provider === 'interactions') {
       const source = provider === 'gemini' ? geminiKeys : interactionsKeys;
       const current = source[index];
       if (!current) return;
 
       const switchingKey = `${provider}:${current.apiKey}`;
+      configSwitchingLockRef.current = true;
       setConfigSwitchingKey(switchingKey);
 
       const previousList = source;
@@ -615,6 +623,7 @@ export function AiProvidersPage() {
         }
         showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
       } finally {
+        configSwitchingLockRef.current = false;
         setConfigSwitchingKey(null);
       }
       return;
@@ -632,6 +641,7 @@ export function AiProvidersPage() {
     if (!current) return;
 
     const switchingKey = `${provider}:${current.apiKey}`;
+    configSwitchingLockRef.current = true;
     setConfigSwitchingKey(switchingKey);
 
     const previousList = source;
@@ -695,15 +705,18 @@ export function AiProvidersPage() {
       }
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   const setOpenAIProviderEnabled = async (index: number, enabled: boolean) => {
+    if (configSwitchingLockRef.current || configSwitchingKey) return;
     const current = openaiProviders[index];
     if (!current) return;
 
     const switchingKey = `openai:${current.name}:${index}`;
+    configSwitchingLockRef.current = true;
     setConfigSwitchingKey(switchingKey);
 
     const previousList = openaiProviders;
@@ -728,8 +741,9 @@ export function AiProvidersPage() {
       clearCache('openai-compatibility');
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   const setProviderWebsocketsEnabled = async (
@@ -742,7 +756,9 @@ export function AiProvidersPage() {
     const current = source[index];
     if (!current) return;
 
+    if (configSwitchingLockRef.current || configSwitchingKey) return;
     const switchingKey = `${provider}:${current.apiKey}:websockets`;
+    configSwitchingLockRef.current = true;
     setConfigSwitchingKey(switchingKey);
 
     const previousList = source;
@@ -794,8 +810,9 @@ export function AiProvidersPage() {
       }
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   const setProviderCloakEnabled = async (
@@ -807,7 +824,9 @@ export function AiProvidersPage() {
     const current = source[index];
     if (!current) return;
 
+    if (configSwitchingLockRef.current || configSwitchingKey) return;
     const switchingKey = `${provider}:${current.apiKey}:cloak`;
+    configSwitchingLockRef.current = true;
     setConfigSwitchingKey(switchingKey);
 
     const previousList = source;
@@ -852,8 +871,9 @@ export function AiProvidersPage() {
       }
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   const setProviderDisableCoolingEnabled = async (
@@ -911,6 +931,7 @@ export function AiProvidersPage() {
         }
         showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
       } finally {
+        configSwitchingLockRef.current = false;
         setConfigSwitchingKey(null);
       }
       return;
@@ -942,6 +963,7 @@ export function AiProvidersPage() {
         clearCache('openai-compatibility');
         showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
       } finally {
+        configSwitchingLockRef.current = false;
         setConfigSwitchingKey(null);
       }
       return;
@@ -1004,8 +1026,9 @@ export function AiProvidersPage() {
       }
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   const setProviderPriority = async (row: ProviderRow, priority: number) => {
@@ -1062,6 +1085,7 @@ export function AiProvidersPage() {
         }
         showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
       } finally {
+        configSwitchingLockRef.current = false;
         setConfigSwitchingKey(null);
       }
       return;
@@ -1095,6 +1119,7 @@ export function AiProvidersPage() {
         clearCache('openai-compatibility');
         showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
       } finally {
+        configSwitchingLockRef.current = false;
         setConfigSwitchingKey(null);
       }
       return;
@@ -1174,8 +1199,9 @@ export function AiProvidersPage() {
       }
       showNotification(`${t('notification.update_failed')}: ${message}`, 'error');
     } finally {
-      setConfigSwitchingKey(null);
-    }
+        configSwitchingLockRef.current = false;
+        setConfigSwitchingKey(null);
+      }
   };
 
   // 删除（按 provider 分派，沿用既有 API 契约）
diff --git a/apps/web/src/features/authFiles/AuthFilesOAuthModelAliasEditPage.tsx b/apps/web/src/features/authFiles/AuthFilesOAuthModelAliasEditPage.tsx
index 613ae079d..65b669861 100644
--- a/apps/web/src/features/authFiles/AuthFilesOAuthModelAliasEditPage.tsx
+++ b/apps/web/src/features/authFiles/AuthFilesOAuthModelAliasEditPage.tsx
@@ -16,6 +16,7 @@ import type { AuthFileItem, OAuthModelAliasEntry } from '@/types';
 import { generateId, getErrorMessage } from '@/utils/helpers';
 import styles from './AuthFilesOAuthModelAliasEditPage.module.scss';
 import { isOAuthAliasDraftDirty } from './oauthEditorState';
+import { normalizeOAuthAliasEntries } from './oauthAliasValidation';
 
 type AuthFileModelItem = { id: string; display_name?: string; type?: string; owned_by?: string };
 
@@ -336,23 +337,34 @@ export function AuthFilesOAuthModelAliasEditPage() {
       return;
     }
 
-    const seen = new Set<string>();
-    const normalized = mappings
-      .map((entry) => {
-        const name = String(entry.name ?? '').trim();
-        const alias = String(entry.alias ?? '').trim();
-        if (!name || !alias) return null;
-        const key = `${name.toLowerCase()}::${alias.toLowerCase()}::${entry.fork ? '1' : '0'}::${entry.forceMapping ? '1' : '0'}`;
-        if (seen.has(key)) return null;
-        seen.add(key);
-        return {
-          name,
-          alias,
-          ...(entry.fork ? { fork: true } : {}),
-          ...(entry.forceMapping ? { forceMapping: true } : {}),
-        };
-      })
-      .filter(Boolean) as OAuthModelAliasEntry[];
+    const normalization = normalizeOAuthAliasEntries(mappings);
+    // Whole-form validation: refuse to save when any row would be dropped by CPA rules.
+    // This keeps the draft visible so the user can fix invalid rows instead of silently
+    // persisting a partial subset.
+    const firstIssue = normalization.issues[0];
+    if (firstIssue) {
+      if (firstIssue.code === 'same_as_name') {
+        showNotification(t('oauth_model_alias.alias_same_as_name'), 'error');
+        return;
+      }
+      if (firstIssue.code === 'duplicate_alias') {
+        showNotification(
+          t('oauth_model_alias.alias_duplicate', { alias: firstIssue.alias ?? '' }),
+          'error'
+        );
+        return;
+      }
+      if (firstIssue.code === 'empty_fields' || firstIssue.code === 'duplicate_entry') {
+        showNotification(t('oauth_model_alias.alias_incomplete'), 'error');
+        return;
+      }
+    }
+
+    const normalized = normalization.accepted;
+    if (normalized.length === 0 && mappings.some((entry) => entry.name.trim() || entry.alias.trim())) {
+      showNotification(t('oauth_model_alias.alias_incomplete'), 'error');
+      return;
+    }
 
     setSaving(true);
     try {
@@ -434,6 +446,11 @@ export function AuthFilesOAuthModelAliasEditPage() {
               <div className={styles.settingsHeaderHint}>{headerHint}</div>
             </div>
 
+            <div className={styles.settingsSection}>
+              <div className={styles.settingsDesc}>{t('oauth_model_alias.scope_hint')}</div>
+              <div className={styles.settingsDesc}>{t('oauth_model_alias.usage_hint')}</div>
+            </div>
+
             <div className={styles.settingsSection}>
               <div className={styles.settingsRow}>
                 <div className={styles.settingsInfo}>
diff --git a/apps/web/src/features/authFiles/AuthFilesPage.module.scss b/apps/web/src/features/authFiles/AuthFilesPage.module.scss
index cd4c01321..52d0905ec 100644
--- a/apps/web/src/features/authFiles/AuthFilesPage.module.scss
+++ b/apps/web/src/features/authFiles/AuthFilesPage.module.scss
@@ -1949,6 +1949,13 @@
   gap: $spacing-sm;
 }
 
+.cardScopeHint {
+  margin: 0 0 $spacing-sm;
+  color: var(--text-secondary);
+  font-size: 12px;
+  line-height: 1.45;
+}
+
 .excludedItem {
   display: flex;
   justify-content: space-between;
diff --git a/apps/web/src/features/authFiles/components/OAuthExcludedCard.tsx b/apps/web/src/features/authFiles/components/OAuthExcludedCard.tsx
index a163bc2ff..676535bb0 100644
--- a/apps/web/src/features/authFiles/components/OAuthExcludedCard.tsx
+++ b/apps/web/src/features/authFiles/components/OAuthExcludedCard.tsx
@@ -29,6 +29,9 @@ export function OAuthExcludedCard(props: OAuthExcludedCardProps) {
         </Button>
       }
     >
+      {loadState === 'ready' ? (
+        <div className={styles.cardScopeHint}>{t('oauth_excluded.scope_hint')}</div>
+      ) : null}
       {loadState === 'unsupported' ? (
         <EmptyState
           title={t('oauth_excluded.upgrade_required_title')}
@@ -58,6 +61,15 @@ export function OAuthExcludedCard(props: OAuthExcludedCardProps) {
                     ? t('oauth_excluded.model_count', { count: models.length })
                     : t('oauth_excluded.no_models')}
                 </div>
+                {models?.length ? (
+                  <div
+                    className={styles.excludedModels}
+                    title={models.join(', ')}
+                  >
+                    {models.slice(0, 3).join(' · ')}
+                    {models.length > 3 ? ` · +${models.length - 3}` : ''}
+                  </div>
+                ) : null}
               </div>
               <div className={styles.excludedActions}>
                 <Button
diff --git a/apps/web/src/features/authFiles/components/OAuthModelAliasCard.tsx b/apps/web/src/features/authFiles/components/OAuthModelAliasCard.tsx
index be9f2205d..217ef8904 100644
--- a/apps/web/src/features/authFiles/components/OAuthModelAliasCard.tsx
+++ b/apps/web/src/features/authFiles/components/OAuthModelAliasCard.tsx
@@ -7,6 +7,7 @@ import { ModelMappingDiagram, type ModelMappingDiagramRef } from '@/components/m
 import { IconChevronUp } from '@/components/ui/icons';
 import type { OAuthModelAliasEntry } from '@/types';
 import type { AuthFileModelItem, OAuthConfigLoadState } from '@/features/authFiles/constants';
+import { formatOAuthAliasPreview } from '@/features/authFiles/oauthAliasValidation';
 import styles from '@/features/authFiles/AuthFilesPage.module.scss';
 type ViewMode = 'diagram' | 'list';
 
@@ -84,6 +85,9 @@ export function OAuthModelAliasCard(props: OAuthModelAliasCardProps) {
         </div>
       }
     >
+      {loadState === 'ready' ? (
+        <div className={styles.cardScopeHint}>{t('oauth_model_alias.scope_hint')}</div>
+      ) : null}
       {loadState === 'unsupported' ? (
         <EmptyState
           title={t('oauth_model_alias.upgrade_required_title')}
@@ -147,6 +151,11 @@ export function OAuthModelAliasCard(props: OAuthModelAliasCardProps) {
                     ? t('oauth_model_alias.model_count', { count: mappings.length })
                     : t('oauth_model_alias.no_models')}
                 </div>
+                {mappings?.length ? (
+                  <div className={styles.excludedModels} title={formatOAuthAliasPreview(mappings, 20)}>
+                    {formatOAuthAliasPreview(mappings)}
+                  </div>
+                ) : null}
               </div>
               <div className={styles.excludedActions}>
                 <Button
diff --git a/apps/web/src/features/authFiles/hooks/useAuthFilesOauth.tsx b/apps/web/src/features/authFiles/hooks/useAuthFilesOauth.tsx
index e90a56732..87e37b02c 100644
--- a/apps/web/src/features/authFiles/hooks/useAuthFilesOauth.tsx
+++ b/apps/web/src/features/authFiles/hooks/useAuthFilesOauth.tsx
@@ -5,6 +5,16 @@ import { useNotificationStore } from '@/stores';
 import type { AuthFileItem, OAuthModelAliasEntry } from '@/types';
 import type { AuthFileModelItem, OAuthConfigLoadState } from '@/features/authFiles/constants';
 import { normalizeProviderKey } from '@/features/authFiles/constants';
+import {
+  createSerialAsyncQueue,
+  findChannelMappings,
+  getHttpStatusCode,
+  isMissingOrMethodNotAllowedStatus,
+  mergeOAuthAliasLink,
+  normalizeOAuthAliasEntries,
+  planOAuthAliasRename,
+} from '@/features/authFiles/oauthAliasValidation';
+
 type ViewMode = 'diagram' | 'list';
 
 export type UseAuthFilesOauthResult = {
@@ -50,15 +60,22 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
 
   const excludedUnsupportedRef = useRef(false);
   const mappingsUnsupportedRef = useRef(false);
-  const excludedReadyRef = useRef(false);
-  const modelAliasReadyRef = useRef(false);
+  /**
+   * Baseline writes are allowed only after at least one successful GET.
+   * Soft refresh after mutations must not clear this, otherwise concurrent
+   * diagram writes race with loadModelAlias and get rejected as "not ready".
+   */
+  const excludedBaselineOkRef = useRef(false);
+  const modelAliasBaselineOkRef = useRef(false);
   const excludedLoadRequestRef = useRef(0);
   const modelAliasLoadRequestRef = useRef(0);
+  const modelAliasWriteQueueRef = useRef(createSerialAsyncQueue());
+  const excludedWriteQueueRef = useRef(createSerialAsyncQueue());
 
   useEffect(
     () => () => {
-      excludedReadyRef.current = false;
-      modelAliasReadyRef.current = false;
+      excludedBaselineOkRef.current = false;
+      modelAliasBaselineOkRef.current = false;
       excludedLoadRequestRef.current += 1;
       modelAliasLoadRequestRef.current += 1;
     },
@@ -127,72 +144,127 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
     };
   }, [providerList, viewMode]);
 
-  const loadExcluded = useCallback(async () => {
-    const requestId = ++excludedLoadRequestRef.current;
-    excludedReadyRef.current = false;
-    setExcludedError('loading');
-    try {
-      const res = await authFilesApi.getOauthExcludedModels();
-      if (requestId !== excludedLoadRequestRef.current) return;
-      excludedUnsupportedRef.current = false;
-      excludedReadyRef.current = true;
-      setExcluded(res || {});
-      setExcludedError('ready');
-    } catch (err: unknown) {
-      if (requestId !== excludedLoadRequestRef.current) return;
-      const status =
-        typeof err === 'object' && err !== null && 'status' in err
-          ? (err as { status?: unknown }).status
-          : undefined;
-
-      if (status === 404) {
-        setExcluded({});
-        setExcludedError('unsupported');
-        if (!excludedUnsupportedRef.current) {
-          excludedUnsupportedRef.current = true;
-          showNotification(t('oauth_excluded.upgrade_required'), 'warning');
+  const loadExcluded = useCallback(
+    async (options?: { soft?: boolean }) => {
+      const soft = options?.soft === true;
+      const requestId = ++excludedLoadRequestRef.current;
+      if (!soft) {
+        excludedBaselineOkRef.current = false;
+        setExcludedError('loading');
+      }
+      try {
+        const res = await authFilesApi.getOauthExcludedModels();
+        if (requestId !== excludedLoadRequestRef.current) return;
+        excludedUnsupportedRef.current = false;
+        excludedBaselineOkRef.current = true;
+        setExcluded(res || {});
+        setExcludedError('ready');
+      } catch (err: unknown) {
+        if (requestId !== excludedLoadRequestRef.current) return;
+        const status = getHttpStatusCode(err);
+
+        if (status === 404) {
+          setExcluded({});
+          setExcludedError('unsupported');
+          excludedBaselineOkRef.current = false;
+          if (!excludedUnsupportedRef.current) {
+            excludedUnsupportedRef.current = true;
+            showNotification(t('oauth_excluded.upgrade_required'), 'warning');
+          }
+          return;
+        }
+        if (!soft) {
+          setExcludedError('error');
+          excludedBaselineOkRef.current = false;
         }
-        return;
       }
-      setExcludedError('error');
-    }
-  }, [showNotification, t]);
+    },
+    [showNotification, t]
+  );
 
-  const loadModelAlias = useCallback(async () => {
-    const requestId = ++modelAliasLoadRequestRef.current;
-    modelAliasReadyRef.current = false;
-    setModelAliasError('loading');
-    try {
-      const res = await authFilesApi.getOauthModelAlias();
-      if (requestId !== modelAliasLoadRequestRef.current) return;
-      mappingsUnsupportedRef.current = false;
-      modelAliasReadyRef.current = true;
-      setModelAlias(res || {});
-      setModelAliasError('ready');
-    } catch (err: unknown) {
-      if (requestId !== modelAliasLoadRequestRef.current) return;
-      const status =
-        typeof err === 'object' && err !== null && 'status' in err
-          ? (err as { status?: unknown }).status
-          : undefined;
-
-      if (status === 404) {
-        setModelAlias({});
-        setModelAliasError('unsupported');
-        if (!mappingsUnsupportedRef.current) {
-          mappingsUnsupportedRef.current = true;
-          showNotification(t('oauth_model_alias.upgrade_required'), 'warning');
+  const loadModelAlias = useCallback(
+    async (options?: { soft?: boolean }) => {
+      const soft = options?.soft === true;
+      const requestId = ++modelAliasLoadRequestRef.current;
+      if (!soft) {
+        modelAliasBaselineOkRef.current = false;
+        setModelAliasError('loading');
+      }
+      try {
+        const res = await authFilesApi.getOauthModelAlias();
+        if (requestId !== modelAliasLoadRequestRef.current) return;
+        mappingsUnsupportedRef.current = false;
+        modelAliasBaselineOkRef.current = true;
+        setModelAlias(res || {});
+        setModelAliasError('ready');
+      } catch (err: unknown) {
+        if (requestId !== modelAliasLoadRequestRef.current) return;
+        const status = getHttpStatusCode(err);
+
+        if (status === 404) {
+          setModelAlias({});
+          setModelAliasError('unsupported');
+          modelAliasBaselineOkRef.current = false;
+          if (!mappingsUnsupportedRef.current) {
+            mappingsUnsupportedRef.current = true;
+            showNotification(t('oauth_model_alias.upgrade_required'), 'warning');
+          }
+          return;
+        }
+        if (!soft) {
+          setModelAliasError('error');
+          modelAliasBaselineOkRef.current = false;
         }
-        return;
       }
-      setModelAliasError('error');
-    }
-  }, [showNotification, t]);
+    },
+    [showNotification, t]
+  );
 
   const showLoadRequired = useCallback(() => {
     showNotification(t('notification.refresh_failed'), 'error');
   }, [showNotification, t]);
 
+  const persistChannelMappings = useCallback(
+    async (channel: string, mappings: OAuthModelAliasEntry[]) => {
+      const normalized = normalizeOAuthAliasEntries(mappings);
+      if (normalized.accepted.length === 0) {
+        await authFilesApi.deleteOauthModelAlias(channel);
+        return;
+      }
+      await authFilesApi.saveOauthModelAlias(channel, normalized.accepted);
+    },
+    []
+  );
+
+  const runModelAliasMutation = useCallback(
+    async (task: () => Promise<void>) => {
+      if (!modelAliasBaselineOkRef.current) {
+        showLoadRequired();
+        return;
+      }
+      try {
+        await modelAliasWriteQueueRef.current(async () => {
+          // Re-check after waiting in queue: hard load failure may have cleared baseline.
+          if (!modelAliasBaselineOkRef.current) {
+            throw new Error(t('notification.refresh_failed'));
+          }
+          await task();
+          await loadModelAlias({ soft: true });
+        });
+      } catch (err: unknown) {
+        const errorMessage = err instanceof Error ? err.message : '';
+        showNotification(
+          errorMessage
+            ? `${t('oauth_model_alias.save_failed')}: ${errorMessage}`
+            : t('oauth_model_alias.save_failed'),
+          'error'
+        );
+        await loadModelAlias({ soft: true });
+      }
+    },
+    [loadModelAlias, showLoadRequired, showNotification, t]
+  );
+
   const deleteExcluded = useCallback(
     (provider: string) => {
       const providerLabel = provider.trim() || provider;
@@ -202,7 +274,7 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
         variant: 'danger',
         confirmText: t('common.confirm'),
         onConfirm: async () => {
-          if (!excludedReadyRef.current) {
+          if (!excludedBaselineOkRef.current) {
             showLoadRequired();
             return;
           }
@@ -212,29 +284,33 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
             return;
           }
           try {
-            await authFilesApi.deleteOauthExcludedEntry(providerKey);
-            await loadExcluded();
+            await excludedWriteQueueRef.current(async () => {
+              if (!excludedBaselineOkRef.current) {
+                throw new Error(t('notification.refresh_failed'));
+              }
+              try {
+                await authFilesApi.deleteOauthExcludedEntry(providerKey);
+              } catch (err: unknown) {
+                const status = getHttpStatusCode(err);
+                if (!isMissingOrMethodNotAllowedStatus(status)) {
+                  throw err;
+                }
+                // Fallback for CPA builds without DELETE: rewrite the full map from latest GET.
+                const current = await authFilesApi.getOauthExcludedModels();
+                const next: Record<string, string[]> = {};
+                Object.entries(current).forEach(([key, models]) => {
+                  if (normalizeProviderKey(key) === providerKey) return;
+                  next[key] = models;
+                });
+                await authFilesApi.replaceOauthExcludedModels(next);
+              }
+              await loadExcluded({ soft: true });
+            });
             showNotification(t('oauth_excluded.delete_success'), 'success');
-          } catch (err: unknown) {
-            try {
-              const current = await authFilesApi.getOauthExcludedModels();
-              const next: Record<string, string[]> = {};
-              Object.entries(current).forEach(([key, models]) => {
-                if (normalizeProviderKey(key) === providerKey) return;
-                next[key] = models;
-              });
-              await authFilesApi.replaceOauthExcludedModels(next);
-              await loadExcluded();
-              showNotification(t('oauth_excluded.delete_success'), 'success');
-            } catch (fallbackErr: unknown) {
-              const errorMessage =
-                fallbackErr instanceof Error
-                  ? fallbackErr.message
-                  : err instanceof Error
-                    ? err.message
-                    : '';
-              showNotification(`${t('oauth_excluded.delete_failed')}: ${errorMessage}`, 'error');
-            }
+          } catch (fallbackErr: unknown) {
+            const errorMessage = fallbackErr instanceof Error ? fallbackErr.message : '';
+            showNotification(`${t('oauth_excluded.delete_failed')}: ${errorMessage}`, 'error');
+            await loadExcluded({ soft: true });
           }
         },
       });
@@ -250,69 +326,57 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
         variant: 'danger',
         confirmText: t('common.confirm'),
         onConfirm: async () => {
-          if (!modelAliasReadyRef.current) {
-            showLoadRequired();
-            return;
-          }
-          try {
-            await authFilesApi.deleteOauthModelAlias(provider);
-            await loadModelAlias();
+          await runModelAliasMutation(async () => {
+            const latest = await authFilesApi.getOauthModelAlias();
+            const { channelKey } = findChannelMappings(latest, provider);
+            if (!channelKey) return;
+            await authFilesApi.deleteOauthModelAlias(channelKey);
             showNotification(t('oauth_model_alias.delete_success'), 'success');
-          } catch (err: unknown) {
-            const errorMessage = err instanceof Error ? err.message : '';
-            showNotification(`${t('oauth_model_alias.delete_failed')}: ${errorMessage}`, 'error');
-          }
+          });
         },
       });
     },
-    [loadModelAlias, showConfirmation, showLoadRequired, showNotification, t]
+    [runModelAliasMutation, showConfirmation, showNotification, t]
   );
 
   const handleMappingUpdate = useCallback(
     async (provider: string, sourceModel: string, newAlias: string) => {
-      if (!modelAliasReadyRef.current) {
-        showLoadRequired();
-        return;
-      }
       if (!provider || !sourceModel || !newAlias) return;
       const normalizedProvider = normalizeProviderKey(provider);
       if (!normalizedProvider) return;
 
-      const providerKey = Object.keys(modelAlias).find(
-        (key) => normalizeProviderKey(key) === normalizedProvider
-      );
-      const currentMappings = (providerKey ? modelAlias[providerKey] : null) ?? [];
-
       const nameTrim = sourceModel.trim();
       const aliasTrim = newAlias.trim();
-      const nameKey = nameTrim.toLowerCase();
-      const aliasKey = aliasTrim.toLowerCase();
+      if (!nameTrim || !aliasTrim) return;
 
-      if (
-        currentMappings.some(
-          (m) =>
-            (m.name ?? '').trim().toLowerCase() === nameKey &&
-            (m.alias ?? '').trim().toLowerCase() === aliasKey
-        )
-      ) {
+      if (nameTrim.toLowerCase() === aliasTrim.toLowerCase()) {
+        showNotification(t('oauth_model_alias.alias_same_as_name'), 'error');
         return;
       }
 
-      const nextMappings: OAuthModelAliasEntry[] = [
-        ...currentMappings,
-        { name: nameTrim, alias: aliasTrim, fork: true },
-      ];
+      await runModelAliasMutation(async () => {
+        const latest = await authFilesApi.getOauthModelAlias();
+        const { mappings: currentMappings } = findChannelMappings(latest, normalizedProvider);
+        const mergeResult = mergeOAuthAliasLink(currentMappings, nameTrim, aliasTrim);
 
-      try {
-        await authFilesApi.saveOauthModelAlias(normalizedProvider, nextMappings);
-        await loadModelAlias();
+        if (mergeResult.kind === 'unchanged') return;
+        if (mergeResult.kind === 'rejected') {
+          if (mergeResult.reason === 'same_as_name') {
+            showNotification(t('oauth_model_alias.alias_same_as_name'), 'error');
+            return;
+          }
+          showNotification(
+            t('oauth_model_alias.alias_duplicate', { alias: mergeResult.alias }),
+            'error'
+          );
+          return;
+        }
+
+        await persistChannelMappings(normalizedProvider, mergeResult.mappings);
         showNotification(t('oauth_model_alias.save_success'), 'success');
-      } catch (err: unknown) {
-        const errorMessage = err instanceof Error ? err.message : '';
-        showNotification(`${t('oauth_model_alias.save_failed')}: ${errorMessage}`, 'error');
-      }
+      });
     },
-    [loadModelAlias, modelAlias, showLoadRequired, showNotification, t]
+    [persistChannelMappings, runModelAliasMutation, showNotification, t]
   );
 
   const handleDeleteLink = useCallback(
@@ -333,141 +397,116 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
         variant: 'danger',
         confirmText: t('common.confirm'),
         onConfirm: async () => {
-          if (!modelAliasReadyRef.current) {
-            showLoadRequired();
-            return;
-          }
-          const normalizedProvider = normalizeProviderKey(provider);
-          const providerKey = Object.keys(modelAlias).find(
-            (key) => normalizeProviderKey(key) === normalizedProvider
-          );
-          const currentMappings = (providerKey ? modelAlias[providerKey] : null) ?? [];
-          const nameKey = nameTrim.toLowerCase();
-          const aliasKey = aliasTrim.toLowerCase();
-          const nextMappings = currentMappings.filter(
-            (m) =>
-              (m.name ?? '').trim().toLowerCase() !== nameKey ||
-              (m.alias ?? '').trim().toLowerCase() !== aliasKey
-          );
-          if (nextMappings.length === currentMappings.length) return;
-
-          try {
-            if (nextMappings.length === 0) {
-              await authFilesApi.deleteOauthModelAlias(normalizedProvider);
-            } else {
-              await authFilesApi.saveOauthModelAlias(normalizedProvider, nextMappings);
-            }
-            await loadModelAlias();
+          await runModelAliasMutation(async () => {
+            const normalizedProvider = normalizeProviderKey(provider);
+            if (!normalizedProvider) return;
+            const latest = await authFilesApi.getOauthModelAlias();
+            const { mappings: currentMappings } = findChannelMappings(latest, normalizedProvider);
+            const nameKey = nameTrim.toLowerCase();
+            const aliasKey = aliasTrim.toLowerCase();
+            const nextMappings = currentMappings.filter(
+              (mapping) =>
+                (mapping.name ?? '').trim().toLowerCase() !== nameKey ||
+                (mapping.alias ?? '').trim().toLowerCase() !== aliasKey
+            );
+            if (nextMappings.length === currentMappings.length) return;
+            await persistChannelMappings(normalizedProvider, nextMappings);
             showNotification(t('oauth_model_alias.save_success'), 'success');
-          } catch (err: unknown) {
-            const errorMessage = err instanceof Error ? err.message : '';
-            showNotification(`${t('oauth_model_alias.save_failed')}: ${errorMessage}`, 'error');
-          }
+          });
         },
       });
     },
-    [loadModelAlias, modelAlias, showConfirmation, showLoadRequired, showNotification, t]
+    [persistChannelMappings, runModelAliasMutation, showConfirmation, showNotification, t]
   );
 
   const handleToggleFork = useCallback(
     async (provider: string, sourceModel: string, alias: string, fork: boolean) => {
-      if (!modelAliasReadyRef.current) {
-        showLoadRequired();
-        return;
-      }
       const normalizedProvider = normalizeProviderKey(provider);
       if (!normalizedProvider) return;
 
-      const providerKey = Object.keys(modelAlias).find(
-        (key) => normalizeProviderKey(key) === normalizedProvider
-      );
-      const currentMappings = (providerKey ? modelAlias[providerKey] : null) ?? [];
-      const nameKey = sourceModel.trim().toLowerCase();
-      const aliasKey = alias.trim().toLowerCase();
-      let changed = false;
-
-      const nextMappings = currentMappings.map((m) => {
-        const mName = (m.name ?? '').trim().toLowerCase();
-        const mAlias = (m.alias ?? '').trim().toLowerCase();
-        if (mName === nameKey && mAlias === aliasKey) {
-          changed = true;
-          if (fork) return { ...m, fork: true };
-          const next = { ...m };
-          delete next.fork;
-          return next;
-        }
-        return m;
-      });
-
-      if (!changed) return;
+      await runModelAliasMutation(async () => {
+        const latest = await authFilesApi.getOauthModelAlias();
+        const { mappings: currentMappings } = findChannelMappings(latest, normalizedProvider);
+        const nameKey = sourceModel.trim().toLowerCase();
+        const aliasKey = alias.trim().toLowerCase();
+        let changed = false;
+
+        const nextMappings = currentMappings.map((mapping) => {
+          const mappingName = (mapping.name ?? '').trim().toLowerCase();
+          const mappingAlias = (mapping.alias ?? '').trim().toLowerCase();
+          if (mappingName === nameKey && mappingAlias === aliasKey) {
+            changed = true;
+            if (fork) return { ...mapping, fork: true };
+            const next = { ...mapping };
+            delete next.fork;
+            return next;
+          }
+          return mapping;
+        });
 
-      try {
-        await authFilesApi.saveOauthModelAlias(normalizedProvider, nextMappings);
-        await loadModelAlias();
+        if (!changed) return;
+        await persistChannelMappings(normalizedProvider, nextMappings);
         showNotification(t('oauth_model_alias.save_success'), 'success');
-      } catch (err: unknown) {
-        const errorMessage = err instanceof Error ? err.message : '';
-        showNotification(`${t('oauth_model_alias.save_failed')}: ${errorMessage}`, 'error');
-      }
+      });
     },
-    [loadModelAlias, modelAlias, showLoadRequired, showNotification, t]
+    [persistChannelMappings, runModelAliasMutation, showNotification, t]
   );
 
   const handleRenameAlias = useCallback(
     async (oldAlias: string, newAlias: string) => {
-      if (!modelAliasReadyRef.current) {
-        showLoadRequired();
-        return;
-      }
       const oldTrim = oldAlias.trim();
       const newTrim = newAlias.trim();
       if (!oldTrim || !newTrim || oldTrim === newTrim) return;
 
-      const oldKey = oldTrim.toLowerCase();
-      const providersToUpdate = Object.entries(modelAlias).filter(([_, mappings]) =>
-        mappings.some((m) => (m.alias ?? '').trim().toLowerCase() === oldKey)
-      );
-
-      if (providersToUpdate.length === 0) return;
+      await runModelAliasMutation(async () => {
+        const latest = await authFilesApi.getOauthModelAlias();
+        const planResult = planOAuthAliasRename(latest, oldTrim, newTrim);
 
-      let hadFailure = false;
-      let failureMessage = '';
-
-      try {
-        const results = await Promise.allSettled(
-          providersToUpdate.map(([provider, mappings]) => {
-            const nextMappings = mappings.map((m) =>
-              (m.alias ?? '').trim().toLowerCase() === oldKey ? { ...m, alias: newTrim } : m
+        if (!planResult.ok) {
+          if (planResult.reason === 'duplicate_alias') {
+            showNotification(
+              t('oauth_model_alias.alias_duplicate', { alias: planResult.alias ?? newTrim }),
+              'error'
             );
-            return authFilesApi.saveOauthModelAlias(provider, nextMappings);
-          })
-        );
+            return;
+          }
+          if (planResult.reason === 'same_as_name') {
+            showNotification(t('oauth_model_alias.alias_same_as_name'), 'error');
+            return;
+          }
+          return;
+        }
 
-        const failures = results.filter(
-          (result): result is PromiseRejectedResult => result.status === 'rejected'
+        // Capture pre-write snapshots so a mid-loop network failure can best-effort roll back.
+        const previousByChannel = new Map(
+          planResult.plans.map((plan) => {
+            const { mappings } = findChannelMappings(latest, plan.channel);
+            return [plan.channel, mappings] as const;
+          })
         );
+        const appliedChannels: string[] = [];
 
-        if (failures.length > 0) {
-          hadFailure = true;
-          const reason = failures[0].reason;
-          failureMessage = reason instanceof Error ? reason.message : String(reason ?? '');
+        try {
+          for (const plan of planResult.plans) {
+            await persistChannelMappings(plan.channel, plan.nextMappings);
+            appliedChannels.push(plan.channel);
+          }
+        } catch (writeErr: unknown) {
+          for (const channel of appliedChannels) {
+            const previous = previousByChannel.get(channel) ?? [];
+            try {
+              await persistChannelMappings(channel, previous);
+            } catch {
+              // Best-effort rollback; surface the original write error below.
+            }
+          }
+          throw writeErr;
         }
-      } finally {
-        await loadModelAlias();
-      }
 
-      if (hadFailure) {
-        showNotification(
-          failureMessage
-            ? `${t('oauth_model_alias.save_failed')}: ${failureMessage}`
-            : t('oauth_model_alias.save_failed'),
-          'error'
-        );
-      } else {
         showNotification(t('oauth_model_alias.save_success'), 'success');
-      }
+      });
     },
-    [loadModelAlias, modelAlias, showLoadRequired, showNotification, t]
+    [persistChannelMappings, runModelAliasMutation, showNotification, t]
   );
 
   const handleDeleteAlias = useCallback(
@@ -475,11 +514,6 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
       const aliasTrim = aliasName.trim();
       if (!aliasTrim) return;
       const aliasKey = aliasTrim.toLowerCase();
-      const providersToUpdate = Object.entries(modelAlias).filter(([_, mappings]) =>
-        mappings.some((m) => (m.alias ?? '').trim().toLowerCase() === aliasKey)
-      );
-
-      if (providersToUpdate.length === 0) return;
 
       showConfirmation({
         title: t('oauth_model_alias.delete_alias_title', { defaultValue: 'Delete Alias' }),
@@ -493,53 +527,26 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
         variant: 'danger',
         confirmText: t('common.confirm'),
         onConfirm: async () => {
-          if (!modelAliasReadyRef.current) {
-            showLoadRequired();
-            return;
-          }
-          let hadFailure = false;
-          let failureMessage = '';
-
-          try {
-            const results = await Promise.allSettled(
-              providersToUpdate.map(([provider, mappings]) => {
-                const nextMappings = mappings.filter(
-                  (m) => (m.alias ?? '').trim().toLowerCase() !== aliasKey
-                );
-                if (nextMappings.length === 0) {
-                  return authFilesApi.deleteOauthModelAlias(provider);
-                }
-                return authFilesApi.saveOauthModelAlias(provider, nextMappings);
-              })
-            );
-
-            const failures = results.filter(
-              (result): result is PromiseRejectedResult => result.status === 'rejected'
+          await runModelAliasMutation(async () => {
+            const latest = await authFilesApi.getOauthModelAlias();
+            const providersToUpdate = Object.entries(latest).filter(([, mappings]) =>
+              mappings.some((mapping) => (mapping.alias ?? '').trim().toLowerCase() === aliasKey)
             );
+            if (providersToUpdate.length === 0) return;
 
-            if (failures.length > 0) {
-              hadFailure = true;
-              const reason = failures[0].reason;
-              failureMessage = reason instanceof Error ? reason.message : String(reason ?? '');
+            for (const [channel, mappings] of providersToUpdate) {
+              const nextMappings = mappings.filter(
+                (mapping) => (mapping.alias ?? '').trim().toLowerCase() !== aliasKey
+              );
+              await persistChannelMappings(channel, nextMappings);
             }
-          } finally {
-            await loadModelAlias();
-          }
 
-          if (hadFailure) {
-            showNotification(
-              failureMessage
-                ? `${t('oauth_model_alias.delete_failed')}: ${failureMessage}`
-                : t('oauth_model_alias.delete_failed'),
-              'error'
-            );
-          } else {
             showNotification(t('oauth_model_alias.delete_success'), 'success');
-          }
+          });
         },
       });
     },
-    [loadModelAlias, modelAlias, showConfirmation, showLoadRequired, showNotification, t]
+    [persistChannelMappings, runModelAliasMutation, showConfirmation, showNotification, t]
   );
 
   return {
@@ -549,8 +556,8 @@ export function useAuthFilesOauth(options: UseAuthFilesOauthOptions): UseAuthFil
     modelAliasError,
     allProviderModels,
     providerList,
-    loadExcluded,
-    loadModelAlias,
+    loadExcluded: () => loadExcluded(),
+    loadModelAlias: () => loadModelAlias(),
     deleteExcluded,
     deleteModelAlias,
     handleMappingUpdate,
diff --git a/apps/web/src/features/authFiles/oauthAliasValidation.test.ts b/apps/web/src/features/authFiles/oauthAliasValidation.test.ts
new file mode 100644
index 000000000..98ad6e42b
--- /dev/null
+++ b/apps/web/src/features/authFiles/oauthAliasValidation.test.ts
@@ -0,0 +1,207 @@
+import { describe, expect, it } from 'vitest';
+import {
+  createSerialAsyncQueue,
+  findChannelMappings,
+  formatOAuthAliasPreview,
+  isMissingOrMethodNotAllowedStatus,
+  mergeOAuthAliasLink,
+  normalizeOAuthAliasEntries,
+  planOAuthAliasRename,
+} from './oauthAliasValidation';
+
+describe('normalizeOAuthAliasEntries', () => {
+  it('accepts multiple aliases for the same upstream name', () => {
+    const result = normalizeOAuthAliasEntries([
+      { name: 'claude-sonnet-4-5-20250929', alias: 'cs4.5', fork: true },
+      { name: 'claude-sonnet-4-5-20250929', alias: 'sonnet', fork: true },
+    ]);
+
+    expect(result.accepted).toHaveLength(2);
+    expect(result.rejectedCount).toBe(0);
+    expect(result.issues).toEqual([]);
+  });
+
+  it('rejects name === alias and duplicate aliases', () => {
+    const result = normalizeOAuthAliasEntries([
+      { name: 'claude-sonnet-4-5', alias: 'claude-sonnet-4-5' },
+      { name: 'upstream-a', alias: 'shared' },
+      { name: 'upstream-b', alias: 'SHARED' },
+      { name: '', alias: 'only-alias' },
+    ]);
+
+    expect(result.accepted).toEqual([{ name: 'upstream-a', alias: 'shared' }]);
+    expect(result.rejectedCount).toBe(2);
+    expect(result.incompleteCount).toBe(1);
+    expect(result.issues.map((issue) => issue.code)).toEqual([
+      'same_as_name',
+      'duplicate_alias',
+      'empty_fields',
+    ]);
+  });
+
+  it('preserves fork and forceMapping flags', () => {
+    const result = normalizeOAuthAliasEntries([
+      {
+        name: 'gpt-5',
+        alias: 'g5',
+        fork: true,
+        forceMapping: true,
+      },
+    ]);
+
+    expect(result.accepted).toEqual([
+      {
+        name: 'gpt-5',
+        alias: 'g5',
+        fork: true,
+        forceMapping: true,
+      },
+    ]);
+  });
+});
+
+describe('findChannelMappings', () => {
+  it('matches channels case-insensitively', () => {
+    const result = findChannelMappings(
+      {
+        Claude: [{ name: 'a', alias: 'b' }],
+      },
+      'claude'
+    );
+
+    expect(result.channelKey).toBe('Claude');
+    expect(result.mappings).toEqual([{ name: 'a', alias: 'b' }]);
+  });
+});
+
+describe('formatOAuthAliasPreview', () => {
+  it('summarizes mappings and overflow count', () => {
+    const preview = formatOAuthAliasPreview(
+      [
+        { name: 'a', alias: '1' },
+        { name: 'b', alias: '2' },
+        { name: 'c', alias: '3' },
+        { name: 'd', alias: '4' },
+      ],
+      2
+    );
+
+    expect(preview).toBe('a → 1 · b → 2 · +2');
+  });
+});
+
+describe('createSerialAsyncQueue', () => {
+  it('runs tasks sequentially even when started together', async () => {
+    const enqueue = createSerialAsyncQueue();
+    const order: number[] = [];
+
+    const first = enqueue(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      order.push(1);
+      return 'one';
+    });
+    const second = enqueue(async () => {
+      order.push(2);
+      return 'two';
+    });
+
+    await expect(Promise.all([first, second])).resolves.toEqual(['one', 'two']);
+    expect(order).toEqual([1, 2]);
+  });
+
+  it('serializes GET-merge-save style concurrent alias updates without lost writes', async () => {
+    const enqueue = createSerialAsyncQueue();
+    let stored: Array<{ name: string; alias: string; fork?: boolean }> = [];
+
+    const link = async (name: string, alias: string) =>
+      enqueue(async () => {
+        const latest = [...stored];
+        await new Promise((resolve) => setTimeout(resolve, 15));
+        const mergeResult = mergeOAuthAliasLink(latest, name, alias);
+        if (mergeResult.kind !== 'updated') return;
+        stored = mergeResult.mappings;
+      });
+
+    await Promise.all([link('upstream-a', 'alias-a'), link('upstream-b', 'alias-b')]);
+
+    expect(stored).toEqual([
+      { name: 'upstream-a', alias: 'alias-a', fork: true },
+      { name: 'upstream-b', alias: 'alias-b', fork: true },
+    ]);
+  });
+});
+
+describe('mergeOAuthAliasLink', () => {
+  it('rejects identity and duplicate aliases', () => {
+    expect(mergeOAuthAliasLink([], 'same', 'same')).toEqual({
+      kind: 'rejected',
+      reason: 'same_as_name',
+      alias: 'same',
+    });
+    expect(
+      mergeOAuthAliasLink([{ name: 'a', alias: 'shared' }], 'b', 'SHARED')
+    ).toEqual({ kind: 'rejected', reason: 'duplicate_alias', alias: 'SHARED' });
+  });
+});
+
+describe('planOAuthAliasRename', () => {
+  it('validates all channels before returning plans', () => {
+    const ok = planOAuthAliasRename(
+      {
+        claude: [{ name: 'upstream-a', alias: 'shared' }],
+        codex: [{ name: 'upstream-b', alias: 'shared' }],
+      },
+      'shared',
+      'renamed'
+    );
+    expect(ok.ok).toBe(true);
+    if (ok.ok) {
+      expect(ok.plans).toHaveLength(2);
+      expect(ok.plans.map((plan) => plan.channel).sort()).toEqual(['claude', 'codex']);
+      expect(ok.plans.every((plan) => plan.nextMappings[0]?.alias === 'renamed')).toBe(true);
+    }
+
+    const conflict = planOAuthAliasRename(
+      {
+        claude: [{ name: 'upstream-a', alias: 'shared' }],
+        codex: [
+          { name: 'upstream-b', alias: 'shared' },
+          { name: 'upstream-c', alias: 'taken' },
+        ],
+      },
+      'shared',
+      'taken'
+    );
+    expect(conflict).toEqual({
+      ok: false,
+      reason: 'duplicate_alias',
+      alias: 'taken',
+      channel: 'codex',
+    });
+  });
+
+  it('rejects renames that would make alias equal source name', () => {
+    const result = planOAuthAliasRename(
+      {
+        claude: [{ name: 'renamed', alias: 'shared' }],
+      },
+      'shared',
+      'renamed'
+    );
+    expect(result).toEqual({
+      ok: false,
+      reason: 'same_as_name',
+      alias: 'renamed',
+      channel: 'claude',
+    });
+  });
+});
+
+describe('isMissingOrMethodNotAllowedStatus', () => {
+  it('only allows safe DELETE fallbacks', () => {
+    expect(isMissingOrMethodNotAllowedStatus(404)).toBe(true);
+    expect(isMissingOrMethodNotAllowedStatus(405)).toBe(true);
+    expect(isMissingOrMethodNotAllowedStatus(500)).toBe(false);
+    expect(isMissingOrMethodNotAllowedStatus(undefined)).toBe(false);
+  });
+});
diff --git a/apps/web/src/features/authFiles/oauthAliasValidation.ts b/apps/web/src/features/authFiles/oauthAliasValidation.ts
new file mode 100644
index 000000000..5a79eda8e
--- /dev/null
+++ b/apps/web/src/features/authFiles/oauthAliasValidation.ts
@@ -0,0 +1,271 @@
+import type { OAuthModelAliasEntry } from '@/types';
+
+export type OAuthAliasValidationIssueCode =
+  | 'empty_fields'
+  | 'same_as_name'
+  | 'duplicate_alias'
+  | 'duplicate_entry';
+
+export type OAuthAliasValidationIssue = {
+  code: OAuthAliasValidationIssueCode;
+  index: number;
+  name?: string;
+  alias?: string;
+};
+
+export type OAuthAliasNormalizationResult = {
+  accepted: OAuthModelAliasEntry[];
+  issues: OAuthAliasValidationIssue[];
+  /** Entries that had both name and alias but were dropped by CPA-compatible rules. */
+  rejectedCount: number;
+  /** Rows skipped because either name or alias was empty (draft rows). */
+  incompleteCount: number;
+};
+
+const toEntry = (entry: OAuthModelAliasEntry): OAuthModelAliasEntry => {
+  const name = String(entry.name ?? '').trim();
+  const alias = String(entry.alias ?? '').trim();
+  return {
+    name,
+    alias,
+    ...(entry.fork === true ? { fork: true } : {}),
+    ...(entry.forceMapping === true ? { forceMapping: true } : {}),
+  };
+};
+
+/**
+ * Normalize OAuth model alias rows with the same rules CPA applies server-side:
+ * - require non-empty name and alias
+ * - drop name === alias (case-insensitive)
+ * - keep the first occurrence of each alias within the channel
+ */
+export const normalizeOAuthAliasEntries = (
+  entries: OAuthModelAliasEntry[]
+): OAuthAliasNormalizationResult => {
+  const accepted: OAuthModelAliasEntry[] = [];
+  const issues: OAuthAliasValidationIssue[] = [];
+  const seenAlias = new Set<string>();
+  const seenEntry = new Set<string>();
+  let incompleteCount = 0;
+  let rejectedCount = 0;
+
+  entries.forEach((rawEntry, index) => {
+    const entry = toEntry(rawEntry);
+    if (!entry.name && !entry.alias) {
+      incompleteCount += 1;
+      return;
+    }
+    if (!entry.name || !entry.alias) {
+      incompleteCount += 1;
+      issues.push({ code: 'empty_fields', index, name: entry.name, alias: entry.alias });
+      return;
+    }
+
+    if (entry.name.toLowerCase() === entry.alias.toLowerCase()) {
+      rejectedCount += 1;
+      issues.push({
+        code: 'same_as_name',
+        index,
+        name: entry.name,
+        alias: entry.alias,
+      });
+      return;
+    }
+
+    const aliasKey = entry.alias.toLowerCase();
+    if (seenAlias.has(aliasKey)) {
+      rejectedCount += 1;
+      issues.push({
+        code: 'duplicate_alias',
+        index,
+        name: entry.name,
+        alias: entry.alias,
+      });
+      return;
+    }
+
+    const entryKey = `${entry.name.toLowerCase()}::${aliasKey}::${entry.fork ? '1' : '0'}::${entry.forceMapping ? '1' : '0'}`;
+    if (seenEntry.has(entryKey)) {
+      rejectedCount += 1;
+      issues.push({
+        code: 'duplicate_entry',
+        index,
+        name: entry.name,
+        alias: entry.alias,
+      });
+      return;
+    }
+
+    seenAlias.add(aliasKey);
+    seenEntry.add(entryKey);
+    accepted.push(entry);
+  });
+
+  return { accepted, issues, rejectedCount, incompleteCount };
+};
+
+export const findChannelMappings = (
+  modelAlias: Record<string, OAuthModelAliasEntry[]>,
+  channel: string
+): { channelKey: string | null; mappings: OAuthModelAliasEntry[] } => {
+  const normalizedChannel = channel.trim().toLowerCase();
+  if (!normalizedChannel) {
+    return { channelKey: null, mappings: [] };
+  }
+  const channelKey =
+    Object.keys(modelAlias).find((key) => key.trim().toLowerCase() === normalizedChannel) ?? null;
+  return {
+    channelKey,
+    mappings: channelKey ? (modelAlias[channelKey] ?? []) : [],
+  };
+};
+
+export const createSerialAsyncQueue = () => {
+  let chain: Promise<unknown> = Promise.resolve();
+
+  return <T>(task: () => Promise<T>): Promise<T> => {
+    const run = chain.then(task, task);
+    chain = run.then(
+      () => undefined,
+      () => undefined
+    );
+    return run;
+  };
+};
+
+export const getHttpStatusCode = (err: unknown): number | undefined => {
+  if (!err || typeof err !== 'object' || !('status' in err)) return undefined;
+  const status = (err as { status?: unknown }).status;
+  return typeof status === 'number' && Number.isFinite(status) ? status : undefined;
+};
+
+/** DELETE fallback is only safe when the endpoint is missing or method is unsupported. */
+export const isMissingOrMethodNotAllowedStatus = (status: number | undefined): boolean =>
+  status === 404 || status === 405;
+
+export type OAuthAliasRenamePlan = {
+  channel: string;
+  nextMappings: OAuthModelAliasEntry[];
+};
+
+export type OAuthAliasRenamePlanResult =
+  | { ok: true; plans: OAuthAliasRenamePlan[] }
+  | {
+      ok: false;
+      reason: 'not_found' | 'duplicate_alias' | 'same_as_name';
+      alias?: string;
+      channel?: string;
+    };
+
+/**
+ * Build a multi-channel rename plan. Validates every channel before any write so
+ * callers can avoid partial updates when one channel would fail.
+ */
+export const planOAuthAliasRename = (
+  modelAlias: Record<string, OAuthModelAliasEntry[]>,
+  oldAlias: string,
+  newAlias: string
+): OAuthAliasRenamePlanResult => {
+  const oldTrim = oldAlias.trim();
+  const newTrim = newAlias.trim();
+  if (!oldTrim || !newTrim || oldTrim.toLowerCase() === newTrim.toLowerCase()) {
+    return { ok: false, reason: 'not_found' };
+  }
+
+  const oldKey = oldTrim.toLowerCase();
+  const newKey = newTrim.toLowerCase();
+  const plans: OAuthAliasRenamePlan[] = [];
+
+  for (const [channel, mappings] of Object.entries(modelAlias)) {
+    if (!mappings.some((mapping) => (mapping.alias ?? '').trim().toLowerCase() === oldKey)) {
+      continue;
+    }
+
+    const aliasConflict = mappings.some((mapping) => {
+      const mappingAlias = (mapping.alias ?? '').trim().toLowerCase();
+      return mappingAlias === newKey && mappingAlias !== oldKey;
+    });
+    if (aliasConflict) {
+      return { ok: false, reason: 'duplicate_alias', alias: newTrim, channel };
+    }
+
+    const nextMappings: OAuthModelAliasEntry[] = [];
+    for (const mapping of mappings) {
+      if ((mapping.alias ?? '').trim().toLowerCase() !== oldKey) {
+        nextMappings.push(mapping);
+        continue;
+      }
+      if ((mapping.name ?? '').trim().toLowerCase() === newKey) {
+        return { ok: false, reason: 'same_as_name', alias: newTrim, channel };
+      }
+      nextMappings.push({ ...mapping, alias: newTrim });
+    }
+    plans.push({ channel, nextMappings });
+  }
+
+  if (plans.length === 0) {
+    return { ok: false, reason: 'not_found' };
+  }
+  return { ok: true, plans };
+};
+
+/**
+ * Merge a new source→alias link into the latest channel mappings (GET-then-merge).
+ * Returns `unchanged` when the link already exists, `rejected` for CPA-incompatible rows,
+ * or `updated` with the merged mapping list.
+ */
+export const mergeOAuthAliasLink = (
+  currentMappings: OAuthModelAliasEntry[],
+  sourceModel: string,
+  newAlias: string
+):
+  | { kind: 'unchanged' }
+  | { kind: 'updated'; mappings: OAuthModelAliasEntry[] }
+  | { kind: 'rejected'; reason: 'same_as_name' | 'duplicate_alias'; alias: string } => {
+  const nameTrim = sourceModel.trim();
+  const aliasTrim = newAlias.trim();
+  if (!nameTrim || !aliasTrim) {
+    return { kind: 'unchanged' };
+  }
+  if (nameTrim.toLowerCase() === aliasTrim.toLowerCase()) {
+    return { kind: 'rejected', reason: 'same_as_name', alias: aliasTrim };
+  }
+
+  const nameKey = nameTrim.toLowerCase();
+  const aliasKey = aliasTrim.toLowerCase();
+  if (
+    currentMappings.some(
+      (mapping) =>
+        (mapping.name ?? '').trim().toLowerCase() === nameKey &&
+        (mapping.alias ?? '').trim().toLowerCase() === aliasKey
+    )
+  ) {
+    return { kind: 'unchanged' };
+  }
+  if (
+    currentMappings.some((mapping) => (mapping.alias ?? '').trim().toLowerCase() === aliasKey)
+  ) {
+    return { kind: 'rejected', reason: 'duplicate_alias', alias: aliasTrim };
+  }
+
+  return {
+    kind: 'updated',
+    mappings: [...currentMappings, { name: nameTrim, alias: aliasTrim, fork: true }],
+  };
+};
+
+export const formatOAuthAliasPreview = (
+  mappings: OAuthModelAliasEntry[],
+  maxItems = 3
+): string => {
+  if (!mappings.length) return '';
+  const previews = mappings.slice(0, maxItems).map((entry) => {
+    const name = String(entry.name ?? '').trim();
+    const alias = String(entry.alias ?? '').trim();
+    return `${name} → ${alias}`;
+  });
+  if (mappings.length > maxItems) {
+    previews.push(`+${mappings.length - maxItems}`);
+  }
+  return previews.join(' · ');
+};
diff --git a/apps/web/src/features/demo/demoApi.ts b/apps/web/src/features/demo/demoApi.ts
index 22792a08b..9784e48c2 100644
--- a/apps/web/src/features/demo/demoApi.ts
+++ b/apps/web/src/features/demo/demoApi.ts
@@ -119,10 +119,16 @@ export async function handleDemoApiRequest<T = unknown>(
   if (pathname === '/oauth-model-alias') {
     if (method === 'get') {
       return {
-        items: [
-          { provider: 'codex', source: 'gpt-5-codex', target: 'gpt-4.1' },
-          { provider: 'claude', source: 'claude-sonnet-4-5', target: 'claude-sonnet-4-5' },
-        ],
+        'oauth-model-alias': {
+          codex: [
+            { name: 'gpt-5-codex', alias: 'team-codex', fork: true },
+            { name: 'gpt-5', alias: 'g5', fork: true },
+          ],
+          claude: [
+            { name: 'claude-sonnet-4-5-20250929', alias: 'claude-sonnet-4-5', fork: true },
+            { name: 'claude-opus-4-1-20250805', alias: 'claude-opus-4-1', fork: true },
+          ],
+        },
       } as T;
     }
     return ok as T;
diff --git a/apps/web/src/i18n/locales/en.json b/apps/web/src/i18n/locales/en.json
index 11f795e75..0548b717f 100644
--- a/apps/web/src/i18n/locales/en.json
+++ b/apps/web/src/i18n/locales/en.json
@@ -692,6 +692,7 @@
     "rebuild_mid_system_message_label": "Rebuild Mid-conversation System Messages",
     "rebuild_mid_system_message_hint": "Move Claude messages with role system into the top-level system field before forwarding.",
     "force_mapping_label": "Rewrite response model to alias",
+    "model_alias_scope_hint": "These aliases apply to this API-key provider only. OAuth / auth-file mappings are configured under Auth Files → OAuth Model Aliases.",
     "input_modalities_placeholder": "Input modalities: text, image",
     "output_modalities_placeholder": "Output modalities: text, image",
     "model_discovery_already_added": "Added",
@@ -1272,7 +1273,8 @@
     "scope_provider": "Scope: {{provider}}",
     "upgrade_required": "Current CPA version does not support OAuth model disablement. Please upgrade.",
     "upgrade_required_title": "Please upgrade CLI Proxy API",
-    "upgrade_required_desc": "The current server version does not support fetching OAuth model disablement. Please upgrade to the latest CPA (CLI Proxy API) version and try again."
+    "upgrade_required_desc": "The current server version does not support fetching OAuth model disablement. Please upgrade to the latest CPA (CLI Proxy API) version and try again.",
+    "scope_hint": "Applies only to OAuth / auth-file channels (for example claude, codex). API-key providers use their own model alias settings."
   },
   "oauth_model_alias": {
     "title": "OAuth Model Aliases",
@@ -1281,6 +1283,8 @@
     "provider_label": "Provider",
     "provider_placeholder": "e.g. vertex / codex",
     "provider_hint": "Defaults to the current filter; pick an existing provider or type a new name.",
+    "scope_hint": "Applies only to OAuth / auth-file channels (claude, codex, vertex, …). Claude API Key entries under AI Providers are separate and do not use this mapping.",
+    "usage_hint": "Clients must request the alias. Source model name is the upstream ID; alias is the client-visible name. Source and alias must differ, and each alias must be unique within the provider.",
     "model_source_loading": "Loading models...",
     "model_source_unsupported": "The current CPA version does not support fetching model lists (manual input still works).",
     "model_source_loaded": "{{count}} models loaded. Use the dropdown in 'Source model name', or type custom values. Saving an empty list removes that provider. Enable 'Keep original' to keep the original name while adding the alias.",
@@ -1289,6 +1293,9 @@
     "alias_placeholder": "Alias (required)",
     "alias_fork_label": "Keep original",
     "alias_force_mapping_label": "Rewrite response model",
+    "alias_same_as_name": "Source model name and alias must be different.",
+    "alias_duplicate": "Alias \"{{alias}}\" is already used for this provider.",
+    "alias_incomplete": "Each mapping needs both a source model name and an alias.",
     "add_alias": "Add alias",
     "save": "Save/Update",
     "save_success": "Model aliases updated",
diff --git a/apps/web/src/i18n/locales/ru.json b/apps/web/src/i18n/locales/ru.json
index 6d8947b77..37a096944 100644
--- a/apps/web/src/i18n/locales/ru.json
+++ b/apps/web/src/i18n/locales/ru.json
@@ -692,6 +692,7 @@
     "rebuild_mid_system_message_label": "Переносить промежуточные system-сообщения",
     "rebuild_mid_system_message_hint": "Перед отправкой переносить сообщения Claude с ролью system в верхнее поле system.",
     "force_mapping_label": "Переписывать модель ответа в alias",
+    "model_alias_scope_hint": "Эти псевдонимы относятся только к текущему API-key провайдеру. OAuth / auth-file сопоставления настраиваются в Auth Files → OAuth Model Aliases.",
     "input_modalities_placeholder": "Входные модальности: text, image",
     "output_modalities_placeholder": "Выходные модальности: text, image",
     "model_discovery_already_added": "Добавлено",
@@ -1272,7 +1273,8 @@
     "scope_provider": "Область: {{provider}}",
     "upgrade_required": "Текущая версия CPA не поддерживает отключение OAuth-моделей. Пожалуйста, обновите систему.",
     "upgrade_required_title": "Пожалуйста, обновите CLI Proxy API",
-    "upgrade_required_desc": "Текущая версия сервера не поддерживает получение отключения OAuth-моделей. Обновите CPA (CLI Proxy API) до последней версии и повторите попытку."
+    "upgrade_required_desc": "Текущая версия сервера не поддерживает получение отключения OAuth-моделей. Обновите CPA (CLI Proxy API) до последней версии и повторите попытку.",
+    "scope_hint": "Применяется только к OAuth / auth-file каналам (например claude, codex). Для API-key провайдеров настраивайте псевдонимы в разделе AI Providers."
   },
   "oauth_model_alias": {
     "title": "Псевдонимы моделей OAuth",
@@ -1281,6 +1283,8 @@
     "provider_label": "Провайдер",
     "provider_placeholder": "например: vertex / codex",
     "provider_hint": "По умолчанию используется текущий фильтр; выберите существующего провайдера или введите новое имя.",
+    "scope_hint": "Только для OAuth / auth-file каналов (claude, codex, vertex, …). Записи Claude API Key в AI Providers — отдельный путь и не используют эти сопоставления.",
+    "usage_hint": "Клиент должен запрашивать псевдоним. Исходное имя — upstream ID; псевдоним — имя, видимое клиенту. Они должны отличаться, и псевдоним должен быть уникален в рамках провайдера.",
     "model_source_loading": "Загрузка моделей...",
     "model_source_unsupported": "Текущая версия CPA не поддерживает загрузку списка моделей (ручной ввод остаётся доступным).",
     "model_source_loaded": "Загружено моделей: {{count}}. Используйте выпадающий список \"Исходная модель\" или введите своё значение. Сохранение пустого списка удаляет провайдера. Включите \"Сохранить оригинал\", чтобы оставить исходное имя вместе с псевдонимом.",
@@ -1289,6 +1293,9 @@
     "alias_placeholder": "Псевдоним (обязательно)",
     "alias_fork_label": "Сохранить оригинал",
     "alias_force_mapping_label": "Переписывать модель в ответе",
+    "alias_same_as_name": "Исходное имя модели и псевдоним должны отличаться.",
+    "alias_duplicate": "Псевдоним «{{alias}}» уже используется для этого провайдера.",
+    "alias_incomplete": "Для каждой записи нужны и исходное имя, и псевдоним.",
     "add_alias": "Добавить псевдоним",
     "save": "Сохранить/обновить",
     "save_success": "Псевдонимы моделей обновлены",
diff --git a/apps/web/src/i18n/locales/zh-CN.json b/apps/web/src/i18n/locales/zh-CN.json
index 0f9a039be..5a412e964 100644
--- a/apps/web/src/i18n/locales/zh-CN.json
+++ b/apps/web/src/i18n/locales/zh-CN.json
@@ -692,6 +692,7 @@
     "rebuild_mid_system_message_label": "重建对话中途的 System 消息",
     "rebuild_mid_system_message_hint": "转发前将 Claude 对话中 role 为 system 的消息移动到顶层 system 字段。",
     "force_mapping_label": "将响应模型名回写为别名",
+    "model_alias_scope_hint": "此处别名仅作用于当前 API Key 提供商。OAuth / 认证文件的映射请在「认证文件 → OAuth 模型别名」中配置。",
     "input_modalities_placeholder": "输入模态：text, image",
     "output_modalities_placeholder": "输出模态：text, image",
     "model_discovery_already_added": "已添加",
@@ -1272,7 +1273,8 @@
     "scope_provider": "当前范围：{{provider}}",
     "upgrade_required": "当前 CPA 版本不支持 OAuth 模型禁用，请升级 CPA 版本",
     "upgrade_required_title": "需要升级 CPA 版本",
-    "upgrade_required_desc": "当前服务器版本不支持获取 OAuth 模型禁用功能，请升级到最新版本的 CPA（CLI Proxy API）后重试。"
+    "upgrade_required_desc": "当前服务器版本不支持获取 OAuth 模型禁用功能，请升级到最新版本的 CPA（CLI Proxy API）后重试。",
+    "scope_hint": "仅作用于 OAuth / 认证文件渠道（如 claude、codex）。API Key 提供商请在「AI 提供商」中配置各自的模型别名。"
   },
   "oauth_model_alias": {
     "title": "OAuth 模型别名",
@@ -1281,6 +1283,8 @@
     "provider_label": "提供商",
     "provider_placeholder": "例如 vertex / codex",
     "provider_hint": "默认选中当前筛选的提供商，也可直接输入或选择其他名称。",
+    "scope_hint": "仅作用于 OAuth / 认证文件渠道（claude、codex、vertex 等）。「AI 提供商」里的 Claude API Key 不走这里的映射。",
+    "usage_hint": "客户端应请求「别名」。原模型名称是上游真实 ID；别名是客户端可见名称。二者不能相同，且同一提供商内别名必须唯一。",
     "model_source_loading": "正在加载模型列表...",
     "model_source_unsupported": "当前 CPA 版本不支持获取模型列表（仍可手动输入）。",
     "model_source_loaded": "已加载 {{count}} 个模型，可在“原模型名称”中下拉选择；也可手动输入。留空保存将删除该提供商记录；开启“保留原名”会在保留原模型名的同时新增别名。",
@@ -1289,6 +1293,9 @@
     "alias_placeholder": "别名 (必填)",
     "alias_fork_label": "保留原名",
     "alias_force_mapping_label": "回写响应模型名",
+    "alias_same_as_name": "原模型名称与别名不能相同。",
+    "alias_duplicate": "别名「{{alias}}」在该提供商下已存在。",
+    "alias_incomplete": "每条映射都需要填写原模型名称和别名。",
     "add_alias": "添加别名",
     "save": "保存/更新",
     "save_success": "模型别名已更新",
diff --git a/apps/web/src/i18n/locales/zh-TW.json b/apps/web/src/i18n/locales/zh-TW.json
index fc345fa3b..0013f0a04 100644
--- a/apps/web/src/i18n/locales/zh-TW.json
+++ b/apps/web/src/i18n/locales/zh-TW.json
@@ -692,6 +692,7 @@
     "rebuild_mid_system_message_label": "重建對話中途的 System 訊息",
     "rebuild_mid_system_message_hint": "轉送前將 Claude 對話中 role 為 system 的訊息移動到頂層 system 欄位。",
     "force_mapping_label": "將回應模型名稱回寫為別名",
+    "model_alias_scope_hint": "此處別名僅作用於目前 API Key 供應商。OAuth / 認證檔案的映射請在「驗證檔案 → OAuth 模型別名」中設定。",
     "input_modalities_placeholder": "輸入模態：text, image",
     "output_modalities_placeholder": "輸出模態：text, image",
     "model_discovery_already_added": "已新增",
@@ -1272,7 +1273,8 @@
     "scope_provider": "目前範圍：{{provider}}",
     "upgrade_required": "目前 CPA 版本不支援 OAuth 模型停用，請升級 CPA 版本",
     "upgrade_required_title": "需要升級 CPA 版本",
-    "upgrade_required_desc": "目前伺服器版本不支援取得 OAuth 模型停用功能，請升級到最新版本的 CPA（CLI Proxy API）後重試。"
+    "upgrade_required_desc": "目前伺服器版本不支援取得 OAuth 模型停用功能，請升級到最新版本的 CPA（CLI Proxy API）後重試。",
+    "scope_hint": "僅作用於 OAuth / 認證檔案渠道（如 claude、codex）。API Key 供應商請在「AI 供應商」中設定各自的模型別名。"
   },
   "oauth_model_alias": {
     "title": "OAuth 模型別名",
@@ -1281,6 +1283,8 @@
     "provider_label": "供應商",
     "provider_placeholder": "例如 vertex / codex",
     "provider_hint": "預設選取目前篩選的供應商，也可直接輸入或選擇其他名稱。",
+    "scope_hint": "僅作用於 OAuth / 認證檔案渠道（claude、codex、vertex 等）。「AI 供應商」中的 Claude API Key 不走這裡的映射。",
+    "usage_hint": "用戶端應請求「別名」。原模型名稱是上游真實 ID；別名是用戶端可見名稱。二者不能相同，且同一供應商內別名必須唯一。",
     "model_source_loading": "正在載入模型清單...",
     "model_source_unsupported": "目前 CPA 版本不支援取得模型清單（仍可手動輸入）。",
     "model_source_loaded": "已載入 {{count}} 個模型，可在「原模型名稱」中下拉選擇；也可手動輸入。留空儲存將刪除該供應商記錄；開啟「保留原名」會在保留原模型名的同時新增別名。",
@@ -1289,6 +1293,9 @@
     "alias_placeholder": "別名（必填）",
     "alias_fork_label": "保留原名",
     "alias_force_mapping_label": "回寫回應模型名稱",
+    "alias_same_as_name": "原模型名稱與別名不能相同。",
+    "alias_duplicate": "別名「{{alias}}」在此供應商下已存在。",
+    "alias_incomplete": "每條映射都需要填寫原模型名稱和別名。",
     "add_alias": "新增別名",
     "save": "儲存/更新",
     "save_success": "模型別名已更新",
diff --git a/apps/web/src/services/api/authFiles.test.ts b/apps/web/src/services/api/authFiles.test.ts
index 8fe06b132..6bb1a6d5e 100644
--- a/apps/web/src/services/api/authFiles.test.ts
+++ b/apps/web/src/services/api/authFiles.test.ts
@@ -76,6 +76,25 @@ describe('authFilesApi OAuth model alias normalization', () => {
       ],
     });
   });
+
+  it('drops identity mappings and duplicate aliases before patch', async () => {
+    mocks.patch.mockResolvedValue({ status: 'ok' });
+
+    await authFilesApi.saveOauthModelAlias('claude', [
+      { name: 'claude-sonnet-4-5', alias: 'claude-sonnet-4-5' },
+      { name: 'claude-sonnet-4-5-20250929', alias: 'cs4.5', fork: true },
+      { name: 'claude-opus-4-1-20250805', alias: 'CS4.5' },
+      { name: 'claude-opus-4-1-20250805', alias: 'opus' },
+    ]);
+
+    expect(mocks.patch).toHaveBeenCalledWith('/oauth-model-alias', {
+      channel: 'claude',
+      aliases: [
+        { name: 'claude-sonnet-4-5-20250929', alias: 'cs4.5', fork: true },
+        { name: 'claude-opus-4-1-20250805', alias: 'opus' },
+      ],
+    });
+  });
 });
 
 describe('authFilesApi list normalization', () => {
diff --git a/apps/web/src/services/api/authFiles.ts b/apps/web/src/services/api/authFiles.ts
index f1fe7550e..5d27863c3 100644
--- a/apps/web/src/services/api/authFiles.ts
+++ b/apps/web/src/services/api/authFiles.ts
@@ -594,6 +594,8 @@ const normalizeOauthModelAlias = (payload: unknown): Record<string, OAuthModelAl
         const name = String(entry.name ?? entry.id ?? entry.model ?? '').trim();
         const alias = String(entry.alias ?? '').trim();
         if (!name || !alias) return null;
+        // Match CPA SanitizeOAuthModelAlias: drop identity mappings.
+        if (name.toLowerCase() === alias.toLowerCase()) return null;
         const fork = entry.fork === true;
         const forceMapping =
           entry['force-mapping'] === true ||
@@ -609,9 +611,10 @@ const normalizeOauthModelAlias = (payload: unknown): Record<string, OAuthModelAl
       .filter(Boolean)
       .filter((entry) => {
         const aliasEntry = entry as OAuthModelAliasEntry;
-        const dedupeKey = `${aliasEntry.name.toLowerCase()}::${aliasEntry.alias.toLowerCase()}::${aliasEntry.fork ? '1' : '0'}::${aliasEntry.forceMapping ? '1' : '0'}`;
-        if (seen.has(dedupeKey)) return false;
-        seen.add(dedupeKey);
+        // Match CPA: aliases must be unique within a channel (first wins).
+        const aliasKey = aliasEntry.alias.toLowerCase();
+        if (seen.has(aliasKey)) return false;
+        seen.add(aliasKey);
         return true;
       }) as OAuthModelAliasEntry[];
 
diff --git a/apps/web/src/services/api/providers.ts b/apps/web/src/services/api/providers.ts
index b0f151310..4a3eb86f2 100644
--- a/apps/web/src/services/api/providers.ts
+++ b/apps/web/src/services/api/providers.ts
@@ -409,14 +409,31 @@ export const replaceLatestProviderRecord = (
   );
 };
 
+/** Serializes read-modify-write updates per CPA config section to avoid lost updates. */
+const providerSectionWriteQueues = new Map<string, Promise<unknown>>();
+
+const enqueueProviderSectionWrite = <T>(section: string, task: () => Promise<T>): Promise<T> => {
+  const previous = providerSectionWriteQueues.get(section) ?? Promise.resolve();
+  const run = previous.then(task, task);
+  providerSectionWriteQueues.set(
+    section,
+    run.then(
+      () => undefined,
+      () => undefined
+    )
+  );
+  return run;
+};
+
 const mutateLatestProviderList = async (
   section: string,
   mutate: (latestItems: unknown[]) => unknown[]
-) => {
-  const rawConfig = await apiClient.get('/config');
-  const latestItems = getRawSectionList(rawConfig, section);
-  await apiClient.put(`/${section}`, mutate(latestItems));
-};
+) =>
+  enqueueProviderSectionWrite(section, async () => {
+    const rawConfig = await apiClient.get('/config');
+    const latestItems = getRawSectionList(rawConfig, section);
+    await apiClient.put(`/${section}`, mutate(latestItems));
+  });
 
 const matchesProviderConfig = (
   record: Record<string, unknown>,