refactor: extract runtime state backends

apps/aether-gateway/Cargo.toml

@@ -22,6 +22,7 @@ aether-oauth.workspace = true
 aether-provider-transport.workspace = true
 aether-scheduler-core.workspace = true
 aether-runtime.workspace = true
+aether-runtime-state.workspace = true
 aether-usage-runtime.workspace = true
 aether-video-tasks-core.workspace = true
 aether-wallet.workspace = true
@@ -42,7 +43,6 @@ http.workspace = true
 ldap3 = { version = "0.11", default-features = false, features = ["sync", "tls-rustls"] }
 parking_lot = "0.12"
 regex.workspace = true
-redis.workspace = true
 reqwest.workspace = true
 rustls.workspace = true
 serde.workspace = true

apps/aether-gateway/examples/execution_runtime_harness.rs

@@ -4,10 +4,8 @@ use clap::Parser;
 use tracing::info;
 
 use aether_gateway::{serve_execution_runtime_tcp, serve_execution_runtime_unix};
-use aether_runtime::{
-    init_service_runtime, DistributedConcurrencyGate, RedisDistributedConcurrencyConfig,
-    ServiceRuntimeConfig,
-};
+use aether_runtime::{init_service_runtime, ServiceRuntimeConfig};
+use aether_runtime_state::{RedisClientConfig, RuntimeSemaphoreConfig, RuntimeState};
 
 #[derive(Parser, Debug)]
 #[command(
@@ -93,13 +91,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                 .ok_or_else(|| {
                         std::io::Error::new(
                             std::io::ErrorKind::InvalidInput,
-                            "AETHER_EXECUTION_RUNTIME_DISTRIBUTED_REQUEST_REDIS_URL is required when distributed request limit is enabled",
-                        )
+                    "AETHER_EXECUTION_RUNTIME_DISTRIBUTED_REQUEST_REDIS_URL is required when distributed request limit is enabled",
+                )
                 })?;
-            Some(DistributedConcurrencyGate::new_redis(
-                "execution_runtime_requests_distributed",
-                limit,
-                RedisDistributedConcurrencyConfig {
+            let runtime = RuntimeState::redis(
+                RedisClientConfig {
                     url: redis_url.to_string(),
                     key_prefix: args
                         .distributed_request_redis_key_prefix
@@ -107,6 +103,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                         .map(str::trim)
                         .filter(|value| !value.is_empty())
                         .map(ToOwned::to_owned),
+                },
+                Some(args.distributed_request_command_timeout_ms.max(1)),
+            )
+            .await?;
+            Some(runtime.semaphore(
+                "execution_runtime_requests_distributed",
+                limit,
+                RuntimeSemaphoreConfig {
                     lease_ttl_ms: args.distributed_request_lease_ttl_ms.max(1),
                     renew_interval_ms: args.distributed_request_renew_interval_ms.max(1),
                     command_timeout_ms: Some(args.distributed_request_command_timeout_ms.max(1)),

apps/aether-gateway/examples/tunnel_runtime_harness.rs

@@ -5,10 +5,8 @@ use aether_gateway::{
     build_tunnel_runtime_router_with_state, TunnelConnConfig, TunnelControlPlaneClient,
     TunnelRuntimeState,
 };
-use aether_runtime::{
-    init_service_runtime, DistributedConcurrencyGate, RedisDistributedConcurrencyConfig,
-    ServiceRuntimeConfig,
-};
+use aether_runtime::{init_service_runtime, ServiceRuntimeConfig};
+use aether_runtime_state::{RedisClientConfig, RuntimeSemaphoreConfig, RuntimeState};
 use clap::Parser;
 use tracing::info;
 
@@ -122,11 +120,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                     std::io::ErrorKind::InvalidInput,
                     "AETHER_TUNNEL_STANDALONE_DISTRIBUTED_REQUEST_REDIS_URL is required when distributed request limit is enabled",
                 )
-            })?;
-        state = state.with_distributed_request_gate(DistributedConcurrencyGate::new_redis(
-            "tunnel_requests_distributed",
-            limit,
-            RedisDistributedConcurrencyConfig {
+                })?;
+        let runtime = RuntimeState::redis(
+            RedisClientConfig {
                 url: redis_url.to_string(),
                 key_prefix: args
                     .distributed_request_redis_key_prefix
@@ -134,6 +130,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                     .map(str::trim)
                     .filter(|value| !value.is_empty())
                     .map(ToOwned::to_owned),
+            },
+            Some(args.distributed_request_command_timeout_ms.max(1)),
+        )
+        .await?;
+        state = state.with_distributed_request_gate(runtime.semaphore(
+            "tunnel_requests_distributed",
+            limit,
+            RuntimeSemaphoreConfig {
                 lease_ttl_ms: args.distributed_request_lease_ttl_ms.max(1),
                 renew_interval_ms: args.distributed_request_renew_interval_ms.max(1),
                 command_timeout_ms: Some(args.distributed_request_command_timeout_ms.max(1)),

apps/aether-gateway/src/ai_serving/planner/pool_scheduler.rs

@@ -106,21 +106,19 @@ async fn schedule_pool_page_candidates(
     let key_context_by_id = read_pool_catalog_key_contexts_by_id(state, &candidates).await;
 
     let mut runtime_by_provider = BTreeMap::new();
-    let redis_runner = state.app().redis_kv_runner();
     for (provider_id, (pool_config, key_ids)) in provider_runtime_requirements {
         let key_ids = key_ids.into_iter().collect::<Vec<_>>();
-        let runtime = match redis_runner.as_ref() {
-            Some(runner) if !key_ids.is_empty() => {
-                read_admin_provider_pool_runtime_state(
-                    runner,
-                    provider_id.as_str(),
-                    &key_ids,
-                    &pool_config,
-                    sticky_session_token,
-                )
-                .await
-            }
-            _ => AdminProviderPoolRuntimeState::default(),
+        let runtime = if key_ids.is_empty() {
+            AdminProviderPoolRuntimeState::default()
+        } else {
+            read_admin_provider_pool_runtime_state(
+                state.app().runtime_state.as_ref(),
+                provider_id.as_str(),
+                &key_ids,
+                &pool_config,
+                sticky_session_token,
+            )
+            .await
         };
         runtime_by_provider.insert(provider_id, runtime);
     }

apps/aether-gateway/src/data/config.rs

@@ -1,5 +1,4 @@
 use aether_data::driver::postgres::PostgresPoolConfig;
-use aether_data::driver::redis::RedisClientConfig;
 use aether_data::{DataLayerConfig, SqlDatabaseConfig};
 use std::fmt;
 
@@ -7,7 +6,6 @@ use std::fmt;
 pub struct GatewayDataConfig {
     database: Option<SqlDatabaseConfig>,
     postgres: Option<PostgresPoolConfig>,
-    redis: Option<RedisClientConfig>,
     encryption_key: Option<String>,
 }
 
@@ -16,7 +14,6 @@ impl fmt::Debug for GatewayDataConfig {
         f.debug_struct("GatewayDataConfig")
             .field("database", &self.database)
             .field("postgres", &self.postgres)
-            .field("redis", &self.redis)
             .field("has_encryption_key", &self.encryption_key.is_some())
             .finish()
     }
@@ -31,7 +28,6 @@ impl GatewayDataConfig {
         Self {
             database: Some(SqlDatabaseConfig::from_postgres_config(postgres.clone())),
             postgres: Some(postgres),
-            redis: None,
             encryption_key: None,
         }
     }
@@ -41,7 +37,6 @@ impl GatewayDataConfig {
         Self {
             database: Some(database),
             postgres,
-            redis: None,
             encryption_key: None,
         }
     }
@@ -61,26 +56,6 @@ impl GatewayDataConfig {
         self.database.as_ref()
     }
 
-    pub fn redis(&self) -> Option<&RedisClientConfig> {
-        self.redis.as_ref()
-    }
-
-    pub fn with_redis_config(mut self, redis: RedisClientConfig) -> Self {
-        self.redis = Some(redis);
-        self
-    }
-
-    pub fn with_redis_url(
-        self,
-        url: impl Into<String>,
-        key_prefix: Option<impl Into<String>>,
-    ) -> Self {
-        self.with_redis_config(RedisClientConfig {
-            url: url.into(),
-            key_prefix: key_prefix.map(Into::into),
-        })
-    }
-
     pub fn with_encryption_key(mut self, encryption_key: impl Into<String>) -> Self {
         let encryption_key = encryption_key.into();
         let encryption_key = encryption_key.trim();
@@ -96,15 +71,22 @@ impl GatewayDataConfig {
         self.encryption_key.as_deref()
     }
 
+    pub fn with_redis_url(
+        self,
+        _url: impl Into<String>,
+        _key_prefix: Option<impl Into<String>>,
+    ) -> Self {
+        self
+    }
+
     pub fn is_enabled(&self) -> bool {
-        self.database.is_some() || self.postgres.is_some() || self.redis.is_some()
+        self.database.is_some() || self.postgres.is_some()
     }
 
     pub fn to_data_layer_config(&self) -> DataLayerConfig {
         DataLayerConfig {
             database: self.database.clone(),
             postgres: self.postgres.clone(),
-            redis: self.redis.clone(),
         }
     }
 }

apps/aether-gateway/src/data/state/catalog.rs

@@ -195,27 +195,6 @@ impl GatewayDataState {
         }
     }
 
-    pub(crate) async fn cache_set_string_with_ttl(
-        &self,
-        key: &str,
-        value: &str,
-        ttl_seconds: u64,
-    ) -> Result<(), DataLayerError> {
-        let Some(runner) = self.kv_runner() else {
-            return Ok(());
-        };
-        runner.setex(key, value, Some(ttl_seconds)).await?;
-        Ok(())
-    }
-
-    pub(crate) async fn cache_delete_key(&self, key: &str) -> Result<(), DataLayerError> {
-        let Some(runner) = self.kv_runner() else {
-            return Ok(());
-        };
-        let _deleted = runner.del(key).await?;
-        Ok(())
-    }
-
     pub(crate) async fn list_provider_catalog_providers_by_ids(
         &self,
         provider_ids: &[String],

apps/aether-gateway/src/data/state/core.rs

@@ -1,5 +1,6 @@
-use aether_data::driver::redis::{RedisKvRunner, RedisKvRunnerConfig, RedisLockRunner};
 use aether_data::{DataBackends, DataLayerError, DatabaseDriver};
+use aether_runtime_state::RuntimeQueueStore;
+use std::sync::Arc;
 
 use super::{GatewayDataConfig, GatewayDataState, StoredSystemConfigEntry};
 
@@ -48,7 +49,7 @@ impl GatewayDataState {
                 usage_writer: None,
                 user_reader: None,
                 user_preferences: None,
-                usage_worker_runner: None,
+                usage_worker_queue: None,
                 video_task_reader: None,
                 video_task_writer: None,
                 wallet_reader: None,
@@ -86,7 +87,7 @@ impl GatewayDataState {
         let usage_reader = backends.read().usage();
         let usage_writer = backends.write().usage();
         let user_reader = backends.read().users();
-        let usage_worker_runner = backends.workers().redis();
+        let usage_worker_queue = None;
         let video_task_reader = backends.read().video_tasks();
         let video_task_writer = backends.write().video_tasks();
         let wallet_reader = backends.read().wallets();
@@ -124,7 +125,7 @@ impl GatewayDataState {
             usage_writer,
             user_reader,
             user_preferences: None,
-            usage_worker_runner,
+            usage_worker_queue,
             video_task_reader,
             video_task_writer,
             wallet_reader,
@@ -138,6 +139,14 @@ impl GatewayDataState {
         self.backends.is_some()
     }
 
+    pub(crate) fn with_usage_worker_queue(
+        mut self,
+        queue: Option<Arc<dyn RuntimeQueueStore>>,
+    ) -> Self {
+        self.usage_worker_queue = queue;
+        self
+    }
+
     pub(crate) fn has_database_maintenance_backend(&self) -> bool {
         self.backends
             .as_ref()
@@ -219,13 +228,6 @@ impl GatewayDataState {
         self.global_model_writer.is_some()
     }
 
-    pub(crate) fn has_redis_backend(&self) -> bool {
-        self.backends
-            .as_ref()
-            .and_then(|backends| backends.redis())
-            .is_some()
-    }
-
     #[allow(dead_code)]
     pub(crate) fn has_minimal_candidate_selection_reader(&self) -> bool {
         self.minimal_candidate_selection_reader.is_some()
@@ -263,19 +265,6 @@ impl GatewayDataState {
                 .is_some_and(|backends| backends.has_system_config_backend())
     }
 
-    pub(crate) fn oauth_refresh_lock_runner(&self) -> Option<RedisLockRunner> {
-        self.backends
-            .as_ref()
-            .and_then(|backends| backends.locks().redis())
-    }
-
-    pub(crate) fn kv_runner(&self) -> Option<RedisKvRunner> {
-        self.backends
-            .as_ref()
-            .and_then(|backends| backends.redis())
-            .and_then(|backend| backend.kv_runner(RedisKvRunnerConfig::default()).ok())
-    }
-
     pub(crate) fn database_driver(&self) -> Option<DatabaseDriver> {
         self.backends
             .as_ref()
@@ -298,8 +287,8 @@ impl GatewayDataState {
         self.usage_writer.is_some()
     }
 
-    pub(crate) fn has_usage_worker_runner(&self) -> bool {
-        self.usage_worker_runner.is_some()
+    pub(crate) fn has_usage_worker_queue(&self) -> bool {
+        self.usage_worker_queue.is_some()
     }
 
     pub(crate) fn has_video_task_reader(&self) -> bool {

apps/aether-gateway/src/data/state/integrations.rs

@@ -1,6 +1,5 @@
 use aether_billing::enrich_usage_event_with_billing;
 use aether_billing::BillingModelContextLookup;
-use aether_data::driver::redis::RedisStreamRunner;
 use aether_data::repository::audit::RequestAuditReader;
 use aether_data::repository::auth::{
     AuthApiKeyLookupKey, ResolvedAuthApiKeySnapshotReader, StoredAuthApiKeySnapshot,
@@ -15,6 +14,7 @@ use aether_data_contracts::repository::provider_catalog::{
 use aether_data_contracts::repository::settlement::{StoredUsageSettlement, UsageSettlementInput};
 use aether_data_contracts::repository::usage::{StoredRequestUsageAudit, UpsertUsageRecord};
 use aether_data_contracts::repository::video_tasks::{StoredVideoTask, VideoTaskLookupKey};
+use aether_runtime_state::RuntimeQueueStore;
 use aether_usage_runtime::{
     UsageBillingEventEnricher, UsageBodyCapturePolicy, UsageEvent, UsageRecordWriter,
     UsageRequestRecordLevel, UsageRuntimeAccess, UsageSettlementWriter,
@@ -242,12 +242,12 @@ impl UsageRuntimeAccess for GatewayDataState {
         GatewayDataState::has_usage_writer(self)
     }
 
-    fn has_usage_worker_runner(&self) -> bool {
-        GatewayDataState::has_usage_worker_runner(self)
+    fn has_usage_worker_queue(&self) -> bool {
+        GatewayDataState::has_usage_worker_queue(self)
     }
 
-    fn usage_worker_runner(&self) -> Option<RedisStreamRunner> {
-        GatewayDataState::usage_worker_runner(self)
+    fn usage_worker_queue(&self) -> Option<std::sync::Arc<dyn RuntimeQueueStore>> {
+        GatewayDataState::usage_worker_queue(self)
     }
 
     async fn body_capture_policy(&self) -> Result<UsageBodyCapturePolicy, DataLayerError> {

apps/aether-gateway/src/data/state/mod.rs

@@ -11,9 +11,6 @@ use crate::provider_transport::{
     read_provider_transport_snapshot, GatewayProviderTransportSnapshot,
 };
 use crate::video_tasks::LocalVideoTaskReadResponse;
-use aether_data::driver::redis::{
-    RedisKvRunner, RedisKvRunnerConfig, RedisLockRunner, RedisStreamRunner,
-};
 use aether_data::repository::announcements::{
     AnnouncementListQuery, AnnouncementReadRepository, AnnouncementWriteRepository,
     CreateAnnouncementRecord, StoredAnnouncement, StoredAnnouncementPage, UpdateAnnouncementRecord,
@@ -122,6 +119,7 @@ use aether_data_contracts::repository::video_tasks::{
     StoredVideoTask, UpsertVideoTask, VideoTaskLookupKey, VideoTaskModelCount,
     VideoTaskQueryFilter, VideoTaskReadRepository, VideoTaskStatusCount, VideoTaskWriteRepository,
 };
+use aether_runtime_state::RuntimeQueueStore;
 
 #[derive(Clone, Default)]
 pub(crate) struct GatewayDataState {
@@ -155,7 +153,7 @@ pub(crate) struct GatewayDataState {
     usage_writer: Option<Arc<dyn UsageWriteRepository>>,
     user_reader: Option<Arc<dyn UserReadRepository>>,
     user_preferences: Option<Arc<RwLock<BTreeMap<String, StoredUserPreferenceRecord>>>>,
-    usage_worker_runner: Option<RedisStreamRunner>,
+    usage_worker_queue: Option<Arc<dyn RuntimeQueueStore>>,
     video_task_reader: Option<Arc<dyn VideoTaskReadRepository>>,
     video_task_writer: Option<Arc<dyn VideoTaskWriteRepository>>,
     wallet_reader: Option<Arc<dyn WalletReadRepository>>,
@@ -253,10 +251,7 @@ impl fmt::Debug for GatewayDataState {
             .field("has_usage_reader", &self.usage_reader.is_some())
             .field("has_usage_writer", &self.usage_writer.is_some())
             .field("has_user_preferences", &self.user_preferences.is_some())
-            .field(
-                "has_usage_worker_runner",
-                &self.usage_worker_runner.is_some(),
-            )
+            .field("has_usage_worker_queue", &self.usage_worker_queue.is_some())
             .field("has_video_task_reader", &self.video_task_reader.is_some())
             .field("has_video_task_writer", &self.video_task_writer.is_some())
             .field("has_wallet_reader", &self.wallet_reader.is_some())

apps/aether-gateway/src/data/state/runtime.rs

@@ -13,27 +13,28 @@ use super::{
     DisableAdminRedeemCodeBatchInput, DisableAdminRedeemCodeInput, FailAdminWalletRefundInput,
     GatewayDataState, GatewayProviderTransportSnapshot, LocalVideoTaskReadResponse,
     ProcessAdminWalletRefundInput, ProcessPaymentCallbackInput, ProcessPaymentCallbackOutcome,
-    RedeemWalletCodeInput, RedeemWalletCodeOutcome, RedisStreamRunner, RequestAuditBundle,
-    RequestCandidateTrace, StoredAdminAuditLogPage, StoredAdminPaymentCallbackPage,
-    StoredAdminPaymentOrder, StoredAdminPaymentOrderPage, StoredAdminRedeemCodeBatch,
-    StoredAdminRedeemCodeBatchPage, StoredAdminRedeemCodePage, StoredAdminWalletLedgerPage,
-    StoredAdminWalletListPage, StoredAdminWalletRefund, StoredAdminWalletRefundPage,
-    StoredAdminWalletRefundRequestPage, StoredAdminWalletTransaction,
-    StoredAdminWalletTransactionPage, StoredAnnouncement, StoredAnnouncementPage,
-    StoredBillingModelContext, StoredProviderQuotaSnapshot, StoredProviderUsageSummary,
-    StoredRequestUsageAudit, StoredSuspiciousActivity, StoredUsageSettlement,
-    StoredUserAuditLogPage, StoredUserAuthRecord, StoredUserExportRow, StoredUserSummary,
-    StoredVideoTask, StoredWalletDailyUsageLedger, StoredWalletDailyUsageLedgerPage,
-    StoredWalletSnapshot, UpdateAnnouncementRecord, UpsertUsageRecord, UpsertVideoTask,
-    UsageSettlementInput, VideoTaskLookupKey, VideoTaskModelCount, VideoTaskQueryFilter,
-    VideoTaskStatusCount, WalletDailyUsageAggregationInput, WalletDailyUsageAggregationResult,
-    WalletLookupKey, WalletMutationOutcome,
+    RedeemWalletCodeInput, RedeemWalletCodeOutcome, RequestAuditBundle, RequestCandidateTrace,
+    StoredAdminAuditLogPage, StoredAdminPaymentCallbackPage, StoredAdminPaymentOrder,
+    StoredAdminPaymentOrderPage, StoredAdminRedeemCodeBatch, StoredAdminRedeemCodeBatchPage,
+    StoredAdminRedeemCodePage, StoredAdminWalletLedgerPage, StoredAdminWalletListPage,
+    StoredAdminWalletRefund, StoredAdminWalletRefundPage, StoredAdminWalletRefundRequestPage,
+    StoredAdminWalletTransaction, StoredAdminWalletTransactionPage, StoredAnnouncement,
+    StoredAnnouncementPage, StoredBillingModelContext, StoredProviderQuotaSnapshot,
+    StoredProviderUsageSummary, StoredRequestUsageAudit, StoredSuspiciousActivity,
+    StoredUsageSettlement, StoredUserAuditLogPage, StoredUserAuthRecord, StoredUserExportRow,
+    StoredUserSummary, StoredVideoTask, StoredWalletDailyUsageLedger,
+    StoredWalletDailyUsageLedgerPage, StoredWalletSnapshot, UpdateAnnouncementRecord,
+    UpsertUsageRecord, UpsertVideoTask, UsageSettlementInput, VideoTaskLookupKey,
+    VideoTaskModelCount, VideoTaskQueryFilter, VideoTaskStatusCount,
+    WalletDailyUsageAggregationInput, WalletDailyUsageAggregationResult, WalletLookupKey,
+    WalletMutationOutcome,
 };
 use aether_data_contracts::repository::usage::{
     PendingUsageCleanupSummary, ProviderApiKeyWindowUsageRequest,
     StoredProviderApiKeyWindowUsageSummary, StoredUsageDailySummary, UsageAuditListQuery,
     UsageCleanupSummary, UsageCleanupWindow, UsageDailyHeatmapQuery,
 };
+use aether_runtime_state::RuntimeQueueStore;
 use aether_video_tasks_core::read_data_backed_video_task_response;
 
 impl GatewayDataState {
@@ -1477,8 +1478,8 @@ impl GatewayDataState {
         }
     }
 
-    pub(crate) fn usage_worker_runner(&self) -> Option<RedisStreamRunner> {
-        self.usage_worker_runner.clone()
+    pub(crate) fn usage_worker_queue(&self) -> Option<std::sync::Arc<dyn RuntimeQueueStore>> {
+        self.usage_worker_queue.clone()
     }
 
     pub(crate) async fn find_billing_model_context(

apps/aether-gateway/src/data/state/testing/announcements.rs

@@ -40,7 +40,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -90,7 +90,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,

apps/aether-gateway/src/data/state/testing/mod.rs

@@ -73,7 +73,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -122,7 +122,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -167,7 +167,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -300,7 +300,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -361,7 +361,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -415,7 +415,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -478,7 +478,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -523,7 +523,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -569,7 +569,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -626,7 +626,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -685,7 +685,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -728,7 +728,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -786,7 +786,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: Some(repository),
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -837,7 +837,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: Some(user_repository),
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -893,7 +893,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: Some(user_repository),
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -950,7 +950,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: Some(user_repository),
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -1006,7 +1006,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1051,7 +1051,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1096,7 +1096,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1153,7 +1153,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1215,7 +1215,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1260,7 +1260,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1310,7 +1310,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1377,7 +1377,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1439,7 +1439,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1485,7 +1485,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1531,7 +1531,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1579,7 +1579,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1625,7 +1625,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1671,7 +1671,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1725,7 +1725,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1780,7 +1780,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1838,7 +1838,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1902,7 +1902,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -1967,7 +1967,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -2036,7 +2036,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -2112,7 +2112,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -2170,7 +2170,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -2219,7 +2219,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -2264,7 +2264,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,
@@ -2315,7 +2315,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -2370,7 +2370,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -2426,7 +2426,7 @@ impl GatewayDataState {
             usage_writer: Some(usage_writer),
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: Some(wallet_reader),
@@ -2475,7 +2475,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: None,
             video_task_writer: None,
             wallet_reader: None,

apps/aether-gateway/src/data/state/testing/video_tasks.rs

@@ -44,7 +44,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: Some(repository),
             video_task_writer: None,
             wallet_reader: None,
@@ -96,7 +96,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: Some(video_task_reader),
             video_task_writer: Some(video_task_writer),
             wallet_reader: None,
@@ -145,7 +145,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: Some(video_task_reader),
             video_task_writer: Some(video_task_writer),
             wallet_reader: None,
@@ -198,7 +198,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: Some(video_task_reader),
             video_task_writer: Some(video_task_writer),
             wallet_reader: None,
@@ -255,7 +255,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: Some(video_task_reader),
             video_task_writer: Some(video_task_writer),
             wallet_reader: None,
@@ -321,7 +321,7 @@ impl GatewayDataState {
             usage_writer: None,
             user_reader: None,
             user_preferences: None,
-            usage_worker_runner: None,
+            usage_worker_queue: None,
             video_task_reader: Some(video_task_reader),
             video_task_writer: Some(video_task_writer),
             wallet_reader: None,

apps/aether-gateway/src/execution_runtime/server.rs

@@ -4,10 +4,9 @@ use std::sync::Arc;
 use aether_contracts::ExecutionPlan;
 use aether_runtime::{
     maybe_hold_axum_response_permit, prometheus_response, service_up_sample, AdmissionPermit,
-    ConcurrencyError, ConcurrencyGate, ConcurrencySnapshot, DistributedConcurrencyError,
-    DistributedConcurrencyGate, DistributedConcurrencySnapshot, MetricKind, MetricLabel,
-    MetricSample,
+    ConcurrencyError, ConcurrencyGate, ConcurrencySnapshot, MetricKind, MetricLabel, MetricSample,
 };
+use aether_runtime_state::{RuntimeSemaphore, RuntimeSemaphoreError, RuntimeSemaphoreSnapshot};
 use axum::body::{to_bytes, Body};
 use axum::extract::{Request, State};
 use axum::http::StatusCode;
@@ -30,7 +29,7 @@ const DISTRIBUTED_REQUEST_GATE_NAME: &str = "execution_runtime_requests_distribu
 struct ExecutionRuntimeAppState {
     execution_runtime: DirectSyncExecutionRuntime,
     request_gate: Option<Arc<ConcurrencyGate>>,
-    distributed_request_gate: Option<Arc<DistributedConcurrencyGate>>,
+    distributed_request_gate: Option<Arc<RuntimeSemaphore>>,
 }
 
 impl ExecutionRuntimeAppState {
@@ -44,7 +43,7 @@ impl ExecutionRuntimeAppState {
         }
     }
 
-    fn with_distributed_request_gate(mut self, gate: DistributedConcurrencyGate) -> Self {
+    fn with_distributed_request_gate(mut self, gate: RuntimeSemaphore) -> Self {
         self.distributed_request_gate = Some(Arc::new(gate));
         self
     }
@@ -55,7 +54,7 @@ impl ExecutionRuntimeAppState {
 
     async fn distributed_request_concurrency_snapshot(
         &self,
-    ) -> Result<Option<DistributedConcurrencySnapshot>, DistributedConcurrencyError> {
+    ) -> Result<Option<RuntimeSemaphoreSnapshot>, RuntimeSemaphoreError> {
         match self.distributed_request_gate.as_ref() {
             Some(gate) => gate.snapshot().await.map(Some),
             None => Ok(None),
@@ -122,7 +121,7 @@ pub fn build_execution_runtime_router_with_request_concurrency_limit(
 
 pub fn build_execution_runtime_router_with_request_gates(
     limit: Option<usize>,
-    distributed_gate: Option<DistributedConcurrencyGate>,
+    distributed_gate: Option<RuntimeSemaphore>,
 ) -> Router {
     let state = match distributed_gate {
         Some(gate) => ExecutionRuntimeAppState::with_request_concurrency_limit(limit)
@@ -142,7 +141,7 @@ pub fn build_execution_runtime_router_with_request_gates(
 pub async fn serve_execution_runtime_tcp(
     bind: &str,
     max_in_flight_requests: Option<usize>,
-    distributed_request_gate: Option<DistributedConcurrencyGate>,
+    distributed_request_gate: Option<RuntimeSemaphore>,
 ) -> Result<(), Box<dyn std::error::Error>> {
     let listener = tokio::net::TcpListener::bind(bind).await?;
     axum::serve(
@@ -159,7 +158,7 @@ pub async fn serve_execution_runtime_tcp(
 pub async fn serve_execution_runtime_unix(
     socket_path: &Path,
     max_in_flight_requests: Option<usize>,
-    distributed_request_gate: Option<DistributedConcurrencyGate>,
+    distributed_request_gate: Option<RuntimeSemaphore>,
 ) -> Result<(), Box<dyn std::error::Error>> {
     if let Some(parent) = socket_path.parent() {
         std::fs::create_dir_all(parent)?;
@@ -262,11 +261,11 @@ async fn acquire_request_permit(
     match state.try_acquire_request_permit().await {
         Ok(permit) => Ok(permit),
         Err(RequestAdmissionError::Local(ConcurrencyError::Saturated { gate, limit }))
-        | Err(RequestAdmissionError::Distributed(DistributedConcurrencyError::Saturated {
+        | Err(RequestAdmissionError::Distributed(RuntimeSemaphoreError::Saturated {
             gate,
             limit,
         }))
-        | Err(RequestAdmissionError::Distributed(DistributedConcurrencyError::Unavailable {
+        | Err(RequestAdmissionError::Distributed(RuntimeSemaphoreError::Unavailable {
             gate,
             limit,
             ..
@@ -278,9 +277,9 @@ async fn acquire_request_permit(
                 "execution runtime request concurrency gate {gate} is closed"
             ))),
         ),
-        Err(RequestAdmissionError::Distributed(
-            DistributedConcurrencyError::InvalidConfiguration(message),
-        )) => Err(ExecutionRuntimeAppError(
+        Err(RequestAdmissionError::Distributed(RuntimeSemaphoreError::InvalidConfiguration(
+            message,
+        ))) => Err(ExecutionRuntimeAppError(
             ExecutionRuntimeServerError::RequestRead(message),
         )),
     }
@@ -289,7 +288,7 @@ async fn acquire_request_permit(
 #[derive(Debug)]
 enum RequestAdmissionError {
     Local(ConcurrencyError),
-    Distributed(DistributedConcurrencyError),
+    Distributed(RuntimeSemaphoreError),
 }
 
 async fn parse_request_json<T>(request: Request) -> Result<T, ExecutionRuntimeAppError>
@@ -380,6 +379,9 @@ mod tests {
         build_execution_runtime_router_with_request_gates, DISTRIBUTED_REQUEST_GATE_NAME,
     };
     use aether_contracts::{ExecutionPlan, ExecutionTimeouts, RequestBody};
+    use aether_runtime_state::{
+        MemoryRuntimeStateConfig, RuntimeSemaphore, RuntimeSemaphoreConfig, RuntimeState,
+    };
     use axum::body::{Body, Bytes};
     use axum::response::Response;
     use axum::routing::any;
@@ -389,6 +391,12 @@ mod tests {
     use std::sync::atomic::{AtomicUsize, Ordering};
     use std::sync::Arc;
 
+    fn distributed_gate(gate: &'static str, limit: usize) -> RuntimeSemaphore {
+        RuntimeState::memory(MemoryRuntimeStateConfig::default())
+            .semaphore(gate, limit, RuntimeSemaphoreConfig::default())
+            .expect("distributed semaphore")
+    }
+
     async fn start_server(app: Router) -> (String, tokio::task::JoinHandle<()>) {
         let listener = crate::test_support::bind_loopback_listener()
             .await
@@ -517,10 +525,7 @@ mod tests {
             }),
         );
         let (upstream_url, upstream_handle) = start_server(upstream).await;
-        let distributed_gate = aether_runtime::DistributedConcurrencyGate::new_in_memory(
-            DISTRIBUTED_REQUEST_GATE_NAME,
-            1,
-        );
+        let distributed_gate = distributed_gate(DISTRIBUTED_REQUEST_GATE_NAME, 1);
         let runtime_a =
             build_execution_runtime_router_with_request_gates(None, Some(distributed_gate.clone()));
         let runtime_b =
@@ -571,10 +576,7 @@ mod tests {
     async fn execution_runtime_exposes_request_concurrency_metrics() {
         let runtime = build_execution_runtime_router_with_request_gates(
             Some(4),
-            Some(aether_runtime::DistributedConcurrencyGate::new_in_memory(
-                DISTRIBUTED_REQUEST_GATE_NAME,
-                6,
-            )),
+            Some(distributed_gate(DISTRIBUTED_REQUEST_GATE_NAME, 6)),
         );
         let (runtime_url, runtime_handle) = start_server(runtime).await;
 

apps/aether-gateway/src/handlers/admin/model/external_cache.rs

@@ -25,19 +25,16 @@ async fn store_admin_external_models_cache(
     state: &AdminAppState<'_>,
     payload: &serde_json::Value,
 ) -> Result<(), GatewayError> {
-    let Some(runner) = state.redis_kv_runner() else {
-        return Ok(());
-    };
     let serialized =
         serde_json::to_string(payload).map_err(|err| GatewayError::Internal(err.to_string()))?;
-    runner
-        .setex(
+    state
+        .as_ref()
+        .runtime_kv_setex(
             ADMIN_EXTERNAL_MODELS_CACHE_KEY,
             &serialized,
-            Some(ADMIN_EXTERNAL_MODELS_CACHE_TTL_SECS),
+            ADMIN_EXTERNAL_MODELS_CACHE_TTL_SECS,
         )
-        .await
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
+        .await?;
     Ok(())
 }
 
@@ -64,37 +61,21 @@ async fn fetch_admin_external_models_from_source(
 pub(crate) async fn read_admin_external_models_cache(
     state: &AdminAppState<'_>,
 ) -> Result<Option<serde_json::Value>, GatewayError> {
-    if let Some(runner) = state.redis_kv_runner() {
-        match runner.client().get_multiplexed_async_connection().await {
-            Ok(mut connection) => {
-                let namespaced_key = runner.keyspace().key(ADMIN_EXTERNAL_MODELS_CACHE_KEY);
-                match redis::cmd("GET")
-                    .arg(&namespaced_key)
-                    .query_async::<Option<String>>(&mut connection)
-                    .await
-                {
-                    Ok(Some(raw)) => match serde_json::from_str::<serde_json::Value>(&raw) {
-                        Ok(payload) => {
-                            let payload = normalize_admin_external_models_payload(payload);
-                            if let Err(err) =
-                                store_admin_external_models_cache(state, &payload).await
-                            {
-                                warn!(error = ?err, "failed to refresh external models cache ttl");
-                            }
-                            return Ok(Some(payload));
-                        }
-                        Err(err) => {
-                            warn!(error = %err, "failed to parse cached external models payload");
-                        }
-                    },
-                    Ok(None) => {}
-                    Err(err) => {
-                        warn!(error = %err, "failed to read external models cache");
-                    }
+    if let Some(raw) = state
+        .as_ref()
+        .runtime_kv_get(ADMIN_EXTERNAL_MODELS_CACHE_KEY)
+        .await?
+    {
+        match serde_json::from_str::<serde_json::Value>(&raw) {
+            Ok(payload) => {
+                let payload = normalize_admin_external_models_payload(payload);
+                if let Err(err) = store_admin_external_models_cache(state, &payload).await {
+                    warn!(error = ?err, "failed to refresh external models cache ttl");
                 }
+                return Ok(Some(payload));
             }
             Err(err) => {
-                warn!(error = %err, "failed to connect to redis for external models cache");
+                warn!(error = %err, "failed to parse cached external models payload");
             }
         }
     }
@@ -116,19 +97,13 @@ pub(crate) async fn read_admin_external_models_cache(
 pub(crate) async fn clear_admin_external_models_cache(
     state: &AdminAppState<'_>,
 ) -> Result<serde_json::Value, GatewayError> {
-    let Some(runner) = state.redis_kv_runner() else {
-        return Ok(json!({
-            "cleared": false,
-            "message": "Redis 未启用",
-        }));
-    };
-    let deleted = runner
-        .del(ADMIN_EXTERNAL_MODELS_CACHE_KEY)
-        .await
-        .map_err(|err| GatewayError::Internal(err.to_string()))?;
+    let deleted = state
+        .as_ref()
+        .runtime_kv_del(ADMIN_EXTERNAL_MODELS_CACHE_KEY)
+        .await?;
     Ok(json!({
-        "cleared": deleted > 0,
-        "message": if deleted > 0 { "缓存已清除" } else { "缓存不存在" },
+        "cleared": deleted,
+        "message": if deleted { "缓存已清除" } else { "缓存不存在" },
     }))
 }
 

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_affinity.rs

@@ -426,22 +426,13 @@ pub(super) async fn delete_admin_monitoring_cache_affinity_raw_keys(
         return Ok(0);
     }
 
-    if let Some(runner) = state.redis_kv_runner() {
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| {
-                GatewayError::Internal(format!("admin monitoring redis connect failed: {err}"))
-            })?;
-        let deleted = redis::cmd("DEL")
-            .arg(raw_keys)
-            .query_async::<i64>(&mut connection)
-            .await
-            .map_err(|err| {
-                GatewayError::Internal(format!("admin monitoring redis delete failed: {err}"))
-            })?;
-        return Ok(usize::try_from(deleted).unwrap_or(0));
+    let deleted = state
+        .runtime_state()
+        .kv_delete_many(raw_keys)
+        .await
+        .map_err(|err| GatewayError::Internal(format!("runtime cache delete failed: {err}")))?;
+    if deleted > 0 {
+        return Ok(deleted);
     }
 
     Ok(delete_admin_monitoring_cache_affinity_entries_for_tests(

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_model_mapping.rs

@@ -1,7 +1,5 @@
 use super::cache_config::ADMIN_MONITORING_REDIS_CACHE_CATEGORIES;
-use super::cache_store::{
-    admin_monitoring_has_test_redis_keys, list_admin_monitoring_namespaced_keys,
-};
+use super::cache_store::list_admin_monitoring_namespaced_keys;
 use crate::handlers::admin::request::AdminAppState;
 use crate::GatewayError;
 use axum::{
@@ -14,17 +12,6 @@ use serde_json::json;
 pub(super) async fn build_admin_monitoring_model_mapping_stats_response(
     state: &AdminAppState<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    if state.redis_kv_runner().is_none() && !admin_monitoring_has_test_redis_keys(state) {
-        return Ok(Json(json!({
-            "status": "ok",
-            "data": {
-                "available": false,
-                "message": "Redis 未启用，模型映射缓存不可用",
-            }
-        }))
-        .into_response());
-    };
-
     let model_id_keys = list_admin_monitoring_namespaced_keys(state, "model:id:*").await?;
     let global_model_id_keys =
         list_admin_monitoring_namespaced_keys(state, "global_model:id:*").await?;
@@ -49,6 +36,7 @@ pub(super) async fn build_admin_monitoring_model_mapping_stats_response(
         "status": "ok",
         "data": {
             "available": true,
+            "backend": state.runtime_state().backend_kind().as_str(),
             "ttl_seconds": 300,
             "total_keys": total_keys,
             "breakdown": {
@@ -69,17 +57,6 @@ pub(super) async fn build_admin_monitoring_model_mapping_stats_response(
 pub(super) async fn build_admin_monitoring_redis_cache_categories_response(
     state: &AdminAppState<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    if state.redis_kv_runner().is_none() && !admin_monitoring_has_test_redis_keys(state) {
-        return Ok(Json(json!({
-            "status": "ok",
-            "data": {
-                "available": false,
-                "message": "Redis 未启用",
-            }
-        }))
-        .into_response());
-    };
-
     let mut categories = Vec::with_capacity(ADMIN_MONITORING_REDIS_CACHE_CATEGORIES.len());
     let mut total_keys = 0usize;
 
@@ -101,6 +78,7 @@ pub(super) async fn build_admin_monitoring_redis_cache_categories_response(
         "status": "ok",
         "data": {
             "available": true,
+            "backend": state.runtime_state().backend_kind().as_str(),
             "categories": categories,
             "total_keys": total_keys,
         }

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_mutations/affinity.rs

@@ -3,15 +3,8 @@ use super::super::cache_affinity::{
     delete_admin_monitoring_cache_affinity_raw_keys,
 };
 use super::super::cache_identity::admin_monitoring_list_export_api_key_records_by_ids;
-use super::super::cache_route_helpers::{
-    admin_monitoring_cache_affinity_delete_params_from_path,
-    admin_monitoring_cache_affinity_unavailable_response,
-};
-use super::super::cache_store::{
-    admin_monitoring_has_runtime_scheduler_affinity_entries,
-    list_admin_monitoring_cache_affinity_records_by_affinity_keys,
-    load_admin_monitoring_cache_affinity_entries_for_tests,
-};
+use super::super::cache_route_helpers::admin_monitoring_cache_affinity_delete_params_from_path;
+use super::super::cache_store::list_admin_monitoring_cache_affinity_records_by_affinity_keys;
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::GatewayError;
 use aether_admin::observability::monitoring::{
@@ -76,13 +69,6 @@ pub(in super::super) async fn build_admin_monitoring_cache_affinity_delete_respo
         ));
     };
 
-    if state.redis_kv_runner().is_none()
-        && load_admin_monitoring_cache_affinity_entries_for_tests(state).is_empty()
-        && !admin_monitoring_has_runtime_scheduler_affinity_entries(state)
-    {
-        return Ok(admin_monitoring_cache_affinity_unavailable_response());
-    }
-
     let target_affinity_keys =
         std::iter::once(affinity_key.clone()).collect::<std::collections::BTreeSet<_>>();
     let delete_filter = admin_monitoring_cache_affinity_delete_filter_from_query(

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_mutations/flush.rs

@@ -2,7 +2,6 @@ use super::super::cache_affinity::{
     clear_admin_monitoring_scheduler_affinity_entries,
     delete_admin_monitoring_cache_affinity_raw_keys,
 };
-use super::super::cache_route_helpers::admin_monitoring_cache_affinity_unavailable_response;
 use super::super::cache_store::list_admin_monitoring_cache_affinity_records;
 use crate::handlers::admin::request::AdminAppState;
 use crate::GatewayError;
@@ -13,10 +12,6 @@ pub(in super::super) async fn build_admin_monitoring_cache_flush_response(
     state: &AdminAppState<'_>,
 ) -> Result<Response<Body>, GatewayError> {
     let raw_affinities = list_admin_monitoring_cache_affinity_records(state).await?;
-    if state.redis_kv_runner().is_none() && raw_affinities.is_empty() {
-        return Ok(admin_monitoring_cache_affinity_unavailable_response());
-    }
-
     let raw_keys = raw_affinities
         .iter()
         .map(|item| item.raw_key.clone())

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_mutations/model_mapping.rs

@@ -1,10 +1,9 @@
 use super::super::cache_route_helpers::{
     admin_monitoring_cache_model_mapping_provider_params_from_path,
-    admin_monitoring_cache_model_name_from_path, admin_monitoring_redis_unavailable_response,
+    admin_monitoring_cache_model_name_from_path,
 };
 use super::super::cache_store::{
-    admin_monitoring_has_test_redis_keys, delete_admin_monitoring_namespaced_keys,
-    list_admin_monitoring_namespaced_keys,
+    delete_admin_monitoring_namespaced_keys, list_admin_monitoring_namespaced_keys,
 };
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::GatewayError;
@@ -19,10 +18,6 @@ use axum::{body::Body, response::Response};
 pub(in super::super) async fn build_admin_monitoring_model_mapping_delete_response(
     state: &AdminAppState<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    if state.redis_kv_runner().is_none() && !admin_monitoring_has_test_redis_keys(state) {
-        return Ok(admin_monitoring_redis_unavailable_response());
-    }
-
     let mut raw_keys = list_admin_monitoring_namespaced_keys(state, "model:*").await?;
     raw_keys.extend(list_admin_monitoring_namespaced_keys(state, "global_model:*").await?);
     raw_keys.sort();
@@ -41,10 +36,6 @@ pub(in super::super) async fn build_admin_monitoring_model_mapping_delete_model_
     else {
         return Ok(admin_monitoring_bad_request_response("缺少 model_name"));
     };
-    if state.redis_kv_runner().is_none() && !admin_monitoring_has_test_redis_keys(state) {
-        return Ok(admin_monitoring_redis_unavailable_response());
-    }
-
     let candidate_keys = [
         format!("global_model:resolve:{model_name}"),
         format!("global_model:name:{model_name}"),
@@ -85,10 +76,6 @@ pub(in super::super) async fn build_admin_monitoring_model_mapping_delete_provid
             "缺少 provider_id 或 global_model_id",
         ));
     };
-    if state.redis_kv_runner().is_none() && !admin_monitoring_has_test_redis_keys(state) {
-        return Ok(admin_monitoring_redis_unavailable_response());
-    }
-
     let candidate_keys = [
         format!("model:provider_global:{provider_id}:{global_model_id}"),
         format!("model:provider_global:hits:{provider_id}:{global_model_id}"),

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_mutations/provider.rs

@@ -2,10 +2,7 @@ use super::super::cache_affinity::{
     clear_admin_monitoring_scheduler_affinity_entries,
     delete_admin_monitoring_cache_affinity_raw_keys,
 };
-use super::super::cache_route_helpers::{
-    admin_monitoring_cache_affinity_unavailable_response,
-    admin_monitoring_cache_provider_id_from_path,
-};
+use super::super::cache_route_helpers::admin_monitoring_cache_provider_id_from_path;
 use super::super::cache_store::list_admin_monitoring_cache_affinity_records;
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::GatewayError;
@@ -26,10 +23,6 @@ pub(in super::super) async fn build_admin_monitoring_cache_provider_delete_respo
     };
 
     let raw_affinities = list_admin_monitoring_cache_affinity_records(state).await?;
-    if state.redis_kv_runner().is_none() && raw_affinities.is_empty() {
-        return Ok(admin_monitoring_cache_affinity_unavailable_response());
-    }
-
     let target_affinities = raw_affinities
         .into_iter()
         .filter(|item| item.provider_id.as_deref() == Some(provider_id.as_str()))

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_mutations/redis_keys.rs

@@ -1,10 +1,7 @@
 use super::super::cache_config::ADMIN_MONITORING_REDIS_CACHE_CATEGORIES;
-use super::super::cache_route_helpers::{
-    admin_monitoring_cache_redis_category_from_path, admin_monitoring_redis_unavailable_response,
-};
+use super::super::cache_route_helpers::admin_monitoring_cache_redis_category_from_path;
 use super::super::cache_store::{
-    admin_monitoring_has_test_redis_keys, delete_admin_monitoring_namespaced_keys,
-    list_admin_monitoring_namespaced_keys,
+    delete_admin_monitoring_namespaced_keys, list_admin_monitoring_namespaced_keys,
 };
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::GatewayError;
@@ -31,10 +28,6 @@ pub(in super::super) async fn build_admin_monitoring_redis_keys_delete_response(
         return Ok(admin_monitoring_unknown_cache_category_response(&category));
     };
 
-    if state.redis_kv_runner().is_none() && !admin_monitoring_has_test_redis_keys(state) {
-        return Ok(admin_monitoring_redis_unavailable_response());
-    }
-
     let raw_keys = list_admin_monitoring_namespaced_keys(state, pattern).await?;
     let deleted_count = delete_admin_monitoring_namespaced_keys(state, &raw_keys).await?;
 

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_mutations/users.rs

@@ -6,15 +6,10 @@ use super::super::cache_identity::{
     admin_monitoring_find_user_summary_by_id, admin_monitoring_list_export_api_key_records_by_ids,
 };
 use super::super::cache_route_helpers::{
-    admin_monitoring_cache_affinity_unavailable_response,
     admin_monitoring_cache_users_not_found_response,
     admin_monitoring_cache_users_user_identifier_from_path,
 };
-use super::super::cache_store::{
-    admin_monitoring_has_runtime_scheduler_affinity_entries,
-    list_admin_monitoring_cache_affinity_records_by_affinity_keys,
-    load_admin_monitoring_cache_affinity_entries_for_tests,
-};
+use super::super::cache_store::list_admin_monitoring_cache_affinity_records_by_affinity_keys;
 use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::GatewayError;
 use aether_admin::observability::monitoring::{
@@ -36,13 +31,6 @@ pub(in super::super) async fn build_admin_monitoring_cache_users_delete_response
         ));
     };
 
-    if state.redis_kv_runner().is_none()
-        && load_admin_monitoring_cache_affinity_entries_for_tests(state).is_empty()
-        && !admin_monitoring_has_runtime_scheduler_affinity_entries(state)
-    {
-        return Ok(admin_monitoring_cache_affinity_unavailable_response());
-    }
-
     let direct_api_key_by_id = admin_monitoring_list_export_api_key_records_by_ids(
         state,
         std::slice::from_ref(&user_identifier),

apps/aether-gateway/src/handlers/admin/observability/monitoring/cache_store.rs

@@ -22,41 +22,6 @@ async fn count_admin_monitoring_cache_affinity_entries(state: &AdminAppState<'_>
         })
 }
 
-async fn scan_admin_monitoring_namespaced_keys(
-    runner: &aether_data::driver::redis::RedisKvRunner,
-    pattern: &str,
-) -> Result<Vec<String>, GatewayError> {
-    let mut connection = runner
-        .client()
-        .get_multiplexed_async_connection()
-        .await
-        .map_err(|err| {
-            GatewayError::Internal(format!("admin monitoring redis connect failed: {err}"))
-        })?;
-    let namespaced_pattern = runner.keyspace().key(pattern);
-    let mut cursor = 0u64;
-    let mut keys = Vec::new();
-    loop {
-        let (next_cursor, batch) = redis::cmd("SCAN")
-            .arg(cursor)
-            .arg("MATCH")
-            .arg(&namespaced_pattern)
-            .arg("COUNT")
-            .arg(200)
-            .query_async::<(u64, Vec<String>)>(&mut connection)
-            .await
-            .map_err(|err| {
-                GatewayError::Internal(format!("admin monitoring redis scan failed: {err}"))
-            })?;
-        keys.extend(batch);
-        if next_cursor == 0 {
-            break;
-        }
-        cursor = next_cursor;
-    }
-    Ok(keys)
-}
-
 #[cfg(test)]
 pub(super) fn load_admin_monitoring_cache_affinity_entries_for_tests(
     state: &AdminAppState<'_>,
@@ -116,8 +81,13 @@ pub(super) async fn list_admin_monitoring_namespaced_keys(
     state: &AdminAppState<'_>,
     pattern: &str,
 ) -> Result<Vec<String>, GatewayError> {
-    if let Some(runner) = state.redis_kv_runner() {
-        return scan_admin_monitoring_namespaced_keys(&runner, pattern).await;
+    let keys = state
+        .runtime_state()
+        .scan_keys(pattern, 200)
+        .await
+        .map_err(|err| GatewayError::Internal(format!("runtime cache scan failed: {err}")))?;
+    if !keys.is_empty() {
+        return Ok(keys);
     }
 
     let mut keys = load_admin_monitoring_redis_keys_for_tests(state)
@@ -136,22 +106,13 @@ pub(super) async fn delete_admin_monitoring_namespaced_keys(
         return Ok(0);
     }
 
-    if let Some(runner) = state.redis_kv_runner() {
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| {
-                GatewayError::Internal(format!("admin monitoring redis connect failed: {err}"))
-            })?;
-        let deleted = redis::cmd("DEL")
-            .arg(raw_keys)
-            .query_async::<i64>(&mut connection)
-            .await
-            .map_err(|err| {
-                GatewayError::Internal(format!("admin monitoring redis delete failed: {err}"))
-            })?;
-        return Ok(usize::try_from(deleted).unwrap_or(0));
+    let deleted = state
+        .runtime_state()
+        .kv_delete_many(raw_keys)
+        .await
+        .map_err(|err| GatewayError::Internal(format!("runtime cache delete failed: {err}")))?;
+    if deleted > 0 {
+        return Ok(deleted);
     }
 
     Ok(delete_admin_monitoring_redis_keys_for_tests(
@@ -197,85 +158,63 @@ async fn list_admin_monitoring_cache_affinity_records_matching(
         }
     };
 
-    if let Some(runner) = state.redis_kv_runner() {
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| {
-                GatewayError::Internal(format!("admin monitoring redis connect failed: {err}"))
-            })?;
+    {
         let patterns = affinity_keys
             .map(|keys| {
                 keys.iter()
                     .flat_map(|affinity_key| {
                         [
-                            runner
-                                .keyspace()
-                                .key(&format!("cache_affinity:{affinity_key}:*")),
-                            runner
-                                .keyspace()
-                                .key(&format!("scheduler_affinity:{affinity_key}:*")),
-                            runner
-                                .keyspace()
-                                .key(&format!("scheduler_affinity:v2:{affinity_key}:*")),
+                            format!("cache_affinity:{affinity_key}:*"),
+                            format!("scheduler_affinity:{affinity_key}:*"),
+                            format!("scheduler_affinity:v2:{affinity_key}:*"),
                         ]
                     })
                     .collect::<Vec<_>>()
             })
             .unwrap_or_else(|| {
                 vec![
-                    runner.keyspace().key("cache_affinity:*"),
-                    runner.keyspace().key("scheduler_affinity:*"),
+                    "cache_affinity:*".to_string(),
+                    "scheduler_affinity:*".to_string(),
                 ]
             });
 
         for pattern in patterns {
-            let mut cursor = 0u64;
-            loop {
-                let (next_cursor, keys) = redis::cmd("SCAN")
-                    .arg(cursor)
-                    .arg("MATCH")
-                    .arg(&pattern)
-                    .arg("COUNT")
-                    .arg(200)
-                    .query_async::<(u64, Vec<String>)>(&mut connection)
+            let keys = state
+                .runtime_state()
+                .scan_keys(&pattern, 200)
+                .await
+                .map_err(|err| {
+                    GatewayError::Internal(format!("runtime cache scan failed: {err}"))
+                })?;
+            if !keys.is_empty() {
+                let raw_keys = keys
+                    .iter()
+                    .map(|key| state.runtime_state().strip_namespace(key).to_string())
+                    .collect::<Vec<_>>();
+                let values = state
+                    .runtime_state()
+                    .kv_get_many(&raw_keys)
                     .await
                     .map_err(|err| {
-                        GatewayError::Internal(format!("admin monitoring redis scan failed: {err}"))
+                        GatewayError::Internal(format!("runtime cache mget failed: {err}"))
                     })?;
-                if !keys.is_empty() {
-                    let values = redis::cmd("MGET")
-                        .arg(&keys)
-                        .query_async::<Vec<Option<String>>>(&mut connection)
-                        .await
-                        .map_err(|err| {
-                            GatewayError::Internal(format!(
-                                "admin monitoring redis mget failed: {err}"
-                            ))
-                        })?;
-                    for (key, raw_value) in keys.into_iter().zip(values) {
-                        let Some(raw_value) = raw_value else {
-                            continue;
-                        };
-                        let record = if key.contains("scheduler_affinity:") {
-                            admin_monitoring_scheduler_affinity_record_from_raw(&key, &raw_value)
-                        } else {
-                            admin_monitoring_cache_affinity_record(&key, &raw_value)
-                        };
-                        let Some(record) = record else {
-                            continue;
-                        };
-                        if affinity_keys.is_some_and(|keys| !keys.contains(&record.affinity_key)) {
-                            continue;
-                        }
-                        push_record(record);
+                for (key, raw_value) in keys.into_iter().zip(values) {
+                    let Some(raw_value) = raw_value else {
+                        continue;
+                    };
+                    let record = if key.contains("scheduler_affinity:") {
+                        admin_monitoring_scheduler_affinity_record_from_raw(&key, &raw_value)
+                    } else {
+                        admin_monitoring_cache_affinity_record(&key, &raw_value)
+                    };
+                    let Some(record) = record else {
+                        continue;
+                    };
+                    if affinity_keys.is_some_and(|keys| !keys.contains(&record.affinity_key)) {
+                        continue;
                     }
+                    push_record(record);
                 }
-                if next_cursor == 0 {
-                    break;
-                }
-                cursor = next_cursor;
             }
         }
     }
@@ -350,11 +289,7 @@ pub(super) async fn build_admin_monitoring_cache_snapshot(
         round_to(cache_hits as f64 / usage_summary.total_requests as f64, 4)
     };
     let total_affinities = count_admin_monitoring_cache_affinity_entries(state).await;
-    let storage_type = if state.redis_kv_runner().is_some() {
-        "redis"
-    } else {
-        "memory"
-    };
+    let storage_type = state.runtime_state().backend_kind().as_str();
     let scheduler_name = if scheduling_mode == "cache_affinity" {
         "cache_aware".to_string()
     } else {

apps/aether-gateway/src/handlers/admin/observability/monitoring/tests/basics.rs

@@ -1,4 +1,3 @@
-use super::super::cache_config::ADMIN_MONITORING_REDIS_REQUIRED_DETAIL;
 use super::super::test_support::{request_context, sample_key, sample_provider, sample_usage};
 use super::local_monitoring_response;
 use crate::AppState;
@@ -69,7 +68,7 @@ fn admin_monitoring_matches_cache_delete_shapes_and_trailing_slashes() {
 }
 
 #[tokio::test]
-async fn admin_monitoring_model_mapping_delete_requires_redis_without_runtime_or_test_entries() {
+async fn admin_monitoring_model_mapping_delete_returns_empty_runtime_payload_without_entries() {
     let state = AppState::new().expect("state should build");
     let context = request_context(
         http::Method::DELETE,
@@ -80,15 +79,13 @@ async fn admin_monitoring_model_mapping_delete_requires_redis_without_runtime_or
         .expect("handler should not error")
         .expect("monitoring route should be handled locally");
 
-    assert_eq!(response.status(), http::StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(response.status(), http::StatusCode::OK);
     let body = to_bytes(response.into_body(), usize::MAX)
         .await
         .expect("body should read");
     let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
-    assert_eq!(
-        payload,
-        json!({ "detail": ADMIN_MONITORING_REDIS_REQUIRED_DETAIL })
-    );
+    assert_eq!(payload["status"], json!("ok"));
+    assert_eq!(payload["deleted_count"], json!(0));
 }
 
 #[tokio::test]

apps/aether-gateway/src/handlers/admin/observability/monitoring/tests/mod.rs

@@ -1086,11 +1086,9 @@ async fn admin_monitoring_model_mapping_stats_returns_local_payload_without_redi
         .expect("body should read");
     let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
     assert_eq!(payload["status"], json!("ok"));
-    assert_eq!(payload["data"]["available"], json!(false));
-    assert_eq!(
-        payload["data"]["message"],
-        json!("Redis 未启用，模型映射缓存不可用")
-    );
+    assert_eq!(payload["data"]["available"], json!(true));
+    assert_eq!(payload["data"]["backend"], json!("memory"));
+    assert_eq!(payload["data"]["total_keys"], json!(0));
 }
 
 #[tokio::test]
@@ -1193,12 +1191,13 @@ async fn admin_monitoring_redis_keys_returns_local_payload_without_redis() {
         .expect("body should read");
     let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
     assert_eq!(payload["status"], json!("ok"));
-    assert_eq!(payload["data"]["available"], json!(false));
-    assert_eq!(payload["data"]["message"], json!("Redis 未启用"));
+    assert_eq!(payload["data"]["available"], json!(true));
+    assert_eq!(payload["data"]["backend"], json!("memory"));
+    assert_eq!(payload["data"]["total_keys"], json!(0));
 }
 
 #[tokio::test]
-async fn admin_monitoring_redis_keys_delete_returns_unavailable_without_redis() {
+async fn admin_monitoring_redis_keys_delete_returns_empty_runtime_payload_without_redis() {
     let state = AppState::new().expect("state should build");
     let context = request_context(
         http::Method::DELETE,
@@ -1210,12 +1209,14 @@ async fn admin_monitoring_redis_keys_delete_returns_unavailable_without_redis()
         .expect("handler should not error")
         .expect("route should be handled locally");
 
-    assert_eq!(response.status(), http::StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(response.status(), http::StatusCode::OK);
     let body = to_bytes(response.into_body(), usize::MAX)
         .await
         .expect("body should read");
     let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
-    assert_eq!(payload["detail"], json!("Redis 未启用"));
+    assert_eq!(payload["status"], json!("ok"));
+    assert_eq!(payload["category"], json!("upstream_models"));
+    assert_eq!(payload["deleted_count"], json!(0));
 }
 
 #[tokio::test]

apps/aether-gateway/src/handlers/admin/provider/ops/providers/balance_cache.rs

@@ -49,27 +49,11 @@ pub(super) async fn read_admin_provider_ops_balance_cache(
     state: &AdminAppState<'_>,
     provider_id: &str,
 ) -> AdminProviderOpsBalanceCacheLookup {
-    let Some(runner) = state.redis_kv_runner() else {
-        return AdminProviderOpsBalanceCacheLookup::Unavailable;
-    };
-    let mut connection = match runner.client().get_multiplexed_async_connection().await {
-        Ok(connection) => connection,
-        Err(err) => {
-            warn!(error = %err, provider_id, "failed to connect to redis for provider ops balance cache");
-            return AdminProviderOpsBalanceCacheLookup::Unavailable;
-        }
-    };
-    let namespaced_key = runner.keyspace().key(&format!(
-        "{ADMIN_PROVIDER_OPS_BALANCE_CACHE_PREFIX}{provider_id}"
-    ));
-    let raw = match redis::cmd("GET")
-        .arg(&namespaced_key)
-        .query_async::<Option<String>>(&mut connection)
-        .await
-    {
+    let raw_key = format!("{ADMIN_PROVIDER_OPS_BALANCE_CACHE_PREFIX}{provider_id}");
+    let raw = match state.runtime_state().kv_get(&raw_key).await {
         Ok(raw) => raw,
         Err(err) => {
-            warn!(error = %err, provider_id, "failed to read provider ops balance cache");
+            warn!(error = %err, provider_id, "failed to read provider ops balance runtime cache");
             return AdminProviderOpsBalanceCacheLookup::Unavailable;
         }
     };
@@ -93,9 +77,6 @@ pub(super) async fn store_admin_provider_ops_balance_cache(
     let Some(ttl_seconds) = balance_cache_ttl_seconds(payload) else {
         return;
     };
-    let Some(runner) = state.redis_kv_runner() else {
-        return;
-    };
     let serialized = match serde_json::to_string(payload) {
         Ok(serialized) => serialized,
         Err(err) => {
@@ -107,11 +88,12 @@ pub(super) async fn store_admin_provider_ops_balance_cache(
             return;
         }
     };
-    if let Err(err) = runner
-        .setex(
+    if let Err(err) = state
+        .runtime_state()
+        .kv_set(
             &format!("{ADMIN_PROVIDER_OPS_BALANCE_CACHE_PREFIX}{provider_id}"),
-            &serialized,
-            Some(ttl_seconds),
+            serialized,
+            Some(Duration::from_secs(ttl_seconds)),
         )
         .await
     {
@@ -123,11 +105,9 @@ pub(super) async fn clear_admin_provider_ops_balance_cache(
     state: &AdminAppState<'_>,
     provider_id: &str,
 ) {
-    let Some(runner) = state.redis_kv_runner() else {
-        return;
-    };
-    if let Err(err) = runner
-        .del(&format!(
+    if let Err(err) = state
+        .runtime_state()
+        .kv_delete(&format!(
             "{ADMIN_PROVIDER_OPS_BALANCE_CACHE_PREFIX}{provider_id}"
         ))
         .await
@@ -243,15 +223,11 @@ fn balance_cache_ttl_seconds(payload: &Value) -> Option<u64> {
 
 fn admin_provider_ops_balance_refresh_key(state: &AdminAppState<'_>, provider_id: &str) -> String {
     let raw_key = format!("{ADMIN_PROVIDER_OPS_BALANCE_REFRESH_PREFIX}{provider_id}");
-    if let Some(runner) = state.redis_kv_runner() {
-        format!(
-            "{:p}:{}",
-            state.app(),
-            runner.keyspace().key(raw_key.as_str())
-        )
-    } else {
-        format!("{:p}:{raw_key}", state.app())
-    }
+    format!(
+        "{:p}:{}",
+        state.app(),
+        state.runtime_state().namespace_key(raw_key.as_str())
+    )
 }
 
 async fn finish_refresh_provider(refresh_key: &str) {

apps/aether-gateway/src/handlers/admin/provider/ops/providers/routes/actions.rs

@@ -102,7 +102,9 @@ pub(super) async fn handle_admin_provider_ops_action(
                 cached
             }
             AdminProviderOpsBalanceCacheLookup::Miss => {
-                if query_param_bool(query_string, "refresh", true) {
+                if query_param_bool(query_string, "refresh", true)
+                    && !state.runtime_state().is_memory()
+                {
                     spawn_admin_provider_ops_balance_refresh(state, provider_id).await;
                     admin_provider_ops_pending_balance_response("余额数据加载中，请稍后刷新")
                 } else {

apps/aether-gateway/src/handlers/admin/provider/ops/providers/routes/batch.rs

@@ -86,8 +86,25 @@ pub(super) async fn handle_admin_provider_ops_batch_balance(
                         cached
                     }
                     AdminProviderOpsBalanceCacheLookup::Miss => {
-                        spawn_admin_provider_ops_balance_refresh(state, &provider_id).await;
-                        admin_provider_ops_pending_balance_response("余额数据加载中，请稍后刷新")
+                        if state.runtime_state().is_memory() {
+                            let payload = admin_provider_ops_local_action_response(
+                                state,
+                                &provider_id,
+                                provider.as_ref(),
+                                &provider_endpoints,
+                                "query_balance",
+                                None,
+                            )
+                            .await;
+                            store_admin_provider_ops_balance_cache(state, &provider_id, &payload)
+                                .await;
+                            payload
+                        } else {
+                            spawn_admin_provider_ops_balance_refresh(state, &provider_id).await;
+                            admin_provider_ops_pending_balance_response(
+                                "余额数据加载中，请稍后刷新",
+                            )
+                        }
                     }
                     AdminProviderOpsBalanceCacheLookup::Unavailable => {
                         let payload = admin_provider_ops_local_action_response(

apps/aether-gateway/src/handlers/admin/provider/pool/runtime/keys.rs

@@ -1,51 +1,33 @@
-use aether_data::driver::redis::RedisKeyspace;
-
-pub(super) fn pool_sticky_pattern(keyspace: &RedisKeyspace, provider_id: &str) -> String {
-    keyspace.key(&format!("ap:{provider_id}:sticky:*"))
+pub(super) fn pool_sticky_pattern(provider_id: &str) -> String {
+    format!("ap:{provider_id}:sticky:*")
 }
 
-pub(super) fn pool_sticky_key(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    session_token: &str,
-) -> String {
-    keyspace.key(&format!("ap:{provider_id}:sticky:{session_token}"))
+pub(super) fn pool_sticky_key(provider_id: &str, session_token: &str) -> String {
+    format!("ap:{provider_id}:sticky:{session_token}")
 }
 
-pub(super) fn pool_lru_key(keyspace: &RedisKeyspace, provider_id: &str) -> String {
-    keyspace.key(&format!("ap:{provider_id}:lru"))
+pub(super) fn pool_lru_key(provider_id: &str) -> String {
+    format!("ap:{provider_id}:lru")
 }
 
-pub(super) fn pool_cooldown_key(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    key_id: &str,
-) -> String {
-    keyspace.key(&format!("ap:{provider_id}:cooldown:{key_id}"))
+pub(super) fn pool_cooldown_key(provider_id: &str, key_id: &str) -> String {
+    format!("ap:{provider_id}:cooldown:{key_id}")
 }
 
-pub(super) fn pool_cooldown_index_key(keyspace: &RedisKeyspace, provider_id: &str) -> String {
-    keyspace.key(&format!("ap:{provider_id}:cooldown_idx"))
+pub(super) fn pool_cooldown_index_key(provider_id: &str) -> String {
+    format!("ap:{provider_id}:cooldown_idx")
 }
 
-pub(super) fn pool_cost_key(keyspace: &RedisKeyspace, provider_id: &str, key_id: &str) -> String {
-    keyspace.key(&format!("ap:{provider_id}:cost:{key_id}"))
+pub(super) fn pool_cost_key(provider_id: &str, key_id: &str) -> String {
+    format!("ap:{provider_id}:cost:{key_id}")
 }
 
-pub(super) fn pool_latency_key(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    key_id: &str,
-) -> String {
-    keyspace.key(&format!("ap:{provider_id}:latency:{key_id}"))
+pub(super) fn pool_latency_key(provider_id: &str, key_id: &str) -> String {
+    format!("ap:{provider_id}:latency:{key_id}")
 }
 
-pub(super) fn pool_stream_timeout_key(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    key_id: &str,
-) -> String {
-    keyspace.key(&format!("ap:{provider_id}:stream_timeout:{key_id}"))
+pub(super) fn pool_stream_timeout_key(provider_id: &str, key_id: &str) -> String {
+    format!("ap:{provider_id}:stream_timeout:{key_id}")
 }
 
 pub(super) fn parse_pool_cost_member(member: &str) -> u64 {
@@ -62,35 +44,23 @@ pub(super) fn parse_pool_latency_member(member: &str) -> u64 {
         .unwrap_or(0)
 }
 
-pub(super) fn pool_cooldown_keys(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    key_ids: &[String],
-) -> Vec<String> {
+pub(super) fn pool_cooldown_keys(provider_id: &str, key_ids: &[String]) -> Vec<String> {
     key_ids
         .iter()
-        .map(|key_id| pool_cooldown_key(keyspace, provider_id, key_id))
+        .map(|key_id| pool_cooldown_key(provider_id, key_id))
         .collect()
 }
 
-pub(super) fn pool_cost_keys(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    key_ids: &[String],
-) -> Vec<String> {
+pub(super) fn pool_cost_keys(provider_id: &str, key_ids: &[String]) -> Vec<String> {
     key_ids
         .iter()
-        .map(|key_id| pool_cost_key(keyspace, provider_id, key_id))
+        .map(|key_id| pool_cost_key(provider_id, key_id))
         .collect()
 }
 
-pub(super) fn pool_latency_keys(
-    keyspace: &RedisKeyspace,
-    provider_id: &str,
-    key_ids: &[String],
-) -> Vec<String> {
+pub(super) fn pool_latency_keys(provider_id: &str, key_ids: &[String]) -> Vec<String> {
     key_ids
         .iter()
-        .map(|key_id| pool_latency_key(keyspace, provider_id, key_id))
+        .map(|key_id| pool_latency_key(provider_id, key_id))
         .collect()
 }

apps/aether-gateway/src/handlers/admin/provider/pool/runtime/mutations.rs

@@ -1,29 +1,18 @@
 use super::keys::{pool_cooldown_index_key, pool_cooldown_key};
 use crate::handlers::admin::request::AdminAppState;
-use tracing::warn;
 
 pub(crate) async fn clear_admin_provider_pool_cooldown(
     state: &AdminAppState<'_>,
     provider_id: &str,
     key_id: &str,
 ) {
-    let Some(runner) = state.redis_kv_runner() else {
-        return;
-    };
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis to clear cooldown for key {key_id}");
-        return;
-    };
-    let keyspace = runner.keyspace().clone();
-    let _: Result<(), _> = redis::pipe()
-        .cmd("DEL")
-        .arg(pool_cooldown_key(&keyspace, provider_id, key_id))
-        .ignore()
-        .cmd("SREM")
-        .arg(pool_cooldown_index_key(&keyspace, provider_id))
-        .arg(key_id)
-        .ignore()
-        .query_async(&mut connection)
+    let _ = state
+        .runtime_state()
+        .kv_delete(&pool_cooldown_key(provider_id, key_id))
+        .await;
+    let _ = state
+        .runtime_state()
+        .set_remove(&pool_cooldown_index_key(provider_id), key_id)
         .await;
 }
 
@@ -32,8 +21,8 @@ pub(crate) async fn reset_admin_provider_pool_cost(
     provider_id: &str,
     key_id: &str,
 ) {
-    let Some(runner) = state.redis_kv_runner() else {
-        return;
-    };
-    let _ = runner.del(&format!("ap:{provider_id}:cost:{key_id}")).await;
+    let _ = state
+        .runtime_state()
+        .score_remove_by_score(&format!("ap:{provider_id}:cost:{key_id}"), f64::INFINITY)
+        .await;
 }

apps/aether-gateway/src/handlers/admin/provider/pool/runtime/reads.rs

@@ -4,10 +4,9 @@ use super::keys::{
     pool_sticky_pattern,
 };
 use crate::handlers::admin::provider::shared::support::{
-    AdminProviderPoolConfig, AdminProviderPoolRuntimeState, ADMIN_PROVIDER_POOL_SCAN_BATCH,
+    AdminProviderPoolConfig, AdminProviderPoolRuntimeState,
 };
-use crate::GatewayError;
-use aether_data::driver::redis::RedisKvRunner;
+use aether_runtime_state::RuntimeState;
 use std::collections::BTreeMap;
 use std::time::{SystemTime, UNIX_EPOCH};
 use tracing::warn;
@@ -19,165 +18,78 @@ fn current_unix_secs() -> u64 {
         .as_secs()
 }
 
-async fn scan_redis_keys(
-    connection: &mut redis::aio::MultiplexedConnection,
-    pattern: &str,
-) -> Result<Vec<String>, GatewayError> {
-    let mut cursor = 0u64;
-    let mut keys = Vec::new();
-    loop {
-        let (next_cursor, batch): (u64, Vec<String>) = redis::cmd("SCAN")
-            .arg(cursor)
-            .arg("MATCH")
-            .arg(pattern)
-            .arg("COUNT")
-            .arg(ADMIN_PROVIDER_POOL_SCAN_BATCH)
-            .query_async(connection)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        keys.extend(batch);
-        if next_cursor == 0 {
-            break;
-        }
-        cursor = next_cursor;
-    }
-    Ok(keys)
-}
-
 pub(crate) async fn read_admin_provider_pool_cooldown_counts(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_ids: &[String],
 ) -> BTreeMap<String, usize> {
-    if provider_ids.is_empty() {
-        return BTreeMap::new();
-    }
-
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis for cooldown counts");
-        return BTreeMap::new();
-    };
-    let keyspace = runner.keyspace().clone();
-    let mut pipeline = redis::pipe();
+    let mut counts = BTreeMap::new();
     for provider_id in provider_ids {
-        pipeline
-            .cmd("SCARD")
-            .arg(pool_cooldown_index_key(&keyspace, provider_id));
-    }
-
-    match pipeline.query_async::<Vec<u64>>(&mut connection).await {
-        Ok(counts) => provider_ids
-            .iter()
-            .cloned()
-            .zip(counts)
-            .map(|(provider_id, count)| (provider_id, count as usize))
-            .collect(),
-        Err(err) => {
-            warn!(
-                "gateway admin provider pool: failed to batch read cooldown counts: {:?}",
-                err
-            );
-            BTreeMap::new()
-        }
+        let count = runtime
+            .set_len(&pool_cooldown_index_key(provider_id))
+            .await
+            .unwrap_or(0);
+        counts.insert(provider_id.clone(), count);
     }
+    counts
 }
 
 pub(crate) async fn read_admin_provider_pool_runtime_state(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_ids: &[String],
     pool_config: &AdminProviderPoolConfig,
     sticky_session_token: Option<&str>,
 ) -> AdminProviderPoolRuntimeState {
-    let mut runtime = AdminProviderPoolRuntimeState::default();
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis for provider {provider_id}");
-        return runtime;
-    };
-    let keyspace = runner.keyspace().clone();
-    let cooldown_keys = pool_cooldown_keys(&keyspace, provider_id, key_ids);
-    let cost_keys = pool_cost_keys(&keyspace, provider_id, key_ids);
-    let latency_keys = pool_latency_keys(&keyspace, provider_id, key_ids);
+    let mut state = AdminProviderPoolRuntimeState::default();
+    let cooldown_keys = pool_cooldown_keys(provider_id, key_ids);
+    let cost_keys = pool_cost_keys(provider_id, key_ids);
+    let latency_keys = pool_latency_keys(provider_id, key_ids);
 
     if let Some(sticky_session_token) = sticky_session_token
         .map(str::trim)
         .filter(|value| !value.is_empty())
         .filter(|_| pool_config.sticky_session_ttl_seconds > 0)
     {
-        let sticky_key = pool_sticky_key(&keyspace, provider_id, sticky_session_token);
-        let sticky_bound_key_id = redis::cmd("GET")
-            .arg(&sticky_key)
-            .query_async::<Option<String>>(&mut connection)
-            .await
-            .unwrap_or_else(|err| {
-                warn!(
-                    "gateway admin provider pool: failed to read sticky binding for provider {provider_id}: {:?}",
-                    err
-                );
-                None
-            });
-        if let Some(bound_key_id) = sticky_bound_key_id {
-            let cooldown_key = pool_cooldown_key(&keyspace, provider_id, &bound_key_id);
-            runtime.sticky_bound_key_id = match redis::cmd("EXISTS")
-                .arg(&cooldown_key)
-                .query_async::<u64>(&mut connection)
-                .await
-            {
-                Ok(0) => {
-                    let _: Result<bool, _> = redis::cmd("EXPIRE")
-                        .arg(&sticky_key)
-                        .arg(pool_config.sticky_session_ttl_seconds)
-                        .query_async(&mut connection)
+        let sticky_key = pool_sticky_key(provider_id, sticky_session_token);
+        if let Ok(Some(bound_key_id)) = runtime.kv_get(&sticky_key).await {
+            let cooldown_key = pool_cooldown_key(provider_id, &bound_key_id);
+            match runtime.kv_exists(&cooldown_key).await {
+                Ok(false) => {
+                    let _ = runtime
+                        .key_expire(
+                            &sticky_key,
+                            std::time::Duration::from_secs(pool_config.sticky_session_ttl_seconds),
+                        )
                         .await;
-                    Some(bound_key_id)
+                    state.sticky_bound_key_id = Some(bound_key_id);
                 }
-                Ok(_) => {
-                    let _: Result<i64, _> = redis::cmd("DEL")
-                        .arg(&sticky_key)
-                        .query_async(&mut connection)
-                        .await;
-                    None
+                Ok(true) => {
+                    let _ = runtime.kv_delete(&sticky_key).await;
                 }
                 Err(err) => {
                     warn!(
                         "gateway admin provider pool: failed to validate sticky cooldown for provider {provider_id}: {:?}",
                         err
                     );
-                    Some(bound_key_id)
+                    state.sticky_bound_key_id = Some(bound_key_id);
                 }
-            };
+            }
         }
     }
 
-    let sticky_keys = match scan_redis_keys(
-        &mut connection,
-        &pool_sticky_pattern(&keyspace, provider_id),
-    )
-    .await
-    {
-        Ok(keys) => keys,
-        Err(err) => {
-            warn!(
-                "gateway admin provider pool: failed to scan sticky keys for provider {provider_id}: {:?}",
-                err
-            );
-            Vec::new()
-        }
-    };
-    runtime.total_sticky_sessions = sticky_keys.len();
+    let sticky_keys = runtime
+        .scan_keys(&pool_sticky_pattern(provider_id), 200)
+        .await
+        .unwrap_or_default();
+    state.total_sticky_sessions = sticky_keys.len();
     if !sticky_keys.is_empty() {
-        for chunk in sticky_keys.chunks(ADMIN_PROVIDER_POOL_SCAN_BATCH as usize) {
-            let values = redis::cmd("MGET")
-                .arg(chunk)
-                .query_async::<Vec<Option<String>>>(&mut connection)
-                .await;
-            let Ok(values) = values else {
-                warn!(
-                    "gateway admin provider pool: failed to read sticky bindings for provider {provider_id}"
-                );
-                break;
-            };
+        let raw_keys = sticky_keys
+            .iter()
+            .map(|key| runtime.strip_namespace(key).to_string())
+            .collect::<Vec<_>>();
+        if let Ok(values) = runtime.kv_get_many(&raw_keys).await {
             for bound_key_id in values.into_iter().flatten() {
-                *runtime
+                *state
                     .sticky_sessions_by_key
                     .entry(bound_key_id)
                     .or_insert(0) += 1;
@@ -186,120 +98,61 @@ pub(crate) async fn read_admin_provider_pool_runtime_state(
     }
 
     if !cooldown_keys.is_empty() {
-        let cooldown_reasons = redis::cmd("MGET")
-            .arg(&cooldown_keys)
-            .query_async::<Vec<Option<String>>>(&mut connection)
+        let cooldown_reasons = runtime
+            .kv_get_many(&cooldown_keys)
             .await
-            .unwrap_or_else(|err| {
-                warn!(
-                    "gateway admin provider pool: failed to batch read cooldown reasons for provider {provider_id}: {:?}",
-                    err
-                );
-                vec![None; cooldown_keys.len()]
-            });
-        let mut ttl_pipeline = redis::pipe();
-        for cooldown_key in &cooldown_keys {
-            ttl_pipeline.cmd("TTL").arg(cooldown_key);
-        }
-        let cooldown_ttls = ttl_pipeline
-            .query_async::<Vec<i64>>(&mut connection)
-            .await
-            .unwrap_or_else(|err| {
-                warn!(
-                    "gateway admin provider pool: failed to batch read cooldown ttl for provider {provider_id}: {:?}",
-                    err
-                );
-                vec![-1; cooldown_keys.len()]
-            });
-
-        for (((key_id, _cooldown_key), reason), ttl) in key_ids
+            .unwrap_or_else(|_| vec![None; cooldown_keys.len()]);
+        for (key_id, (cooldown_key, reason)) in key_ids
             .iter()
-            .zip(cooldown_keys.iter())
-            .zip(cooldown_reasons)
-            .zip(cooldown_ttls)
+            .zip(cooldown_keys.iter().zip(cooldown_reasons))
         {
             if let Some(reason) = reason {
-                runtime
-                    .cooldown_reason_by_key
-                    .insert(key_id.clone(), reason);
-                if let Ok(ttl_seconds) = u64::try_from(ttl) {
-                    if ttl_seconds > 0 {
-                        runtime
-                            .cooldown_ttl_by_key
-                            .insert(key_id.clone(), ttl_seconds);
+                state.cooldown_reason_by_key.insert(key_id.clone(), reason);
+                if let Ok(Some(ttl)) = runtime.kv_ttl_seconds(cooldown_key).await {
+                    if let Ok(ttl_seconds) = u64::try_from(ttl) {
+                        if ttl_seconds > 0 {
+                            state
+                                .cooldown_ttl_by_key
+                                .insert(key_id.clone(), ttl_seconds);
+                        }
                     }
                 }
             }
         }
     }
 
-    if !cost_keys.is_empty() {
-        let window_start = current_unix_secs().saturating_sub(pool_config.cost_window_seconds);
-        let mut cost_pipeline = redis::pipe();
-        for cost_key in &cost_keys {
-            cost_pipeline
-                .cmd("ZRANGEBYSCORE")
-                .arg(cost_key)
-                .arg(window_start)
-                .arg("+inf");
-        }
-        let members_by_key = cost_pipeline
-            .query_async::<Vec<Vec<String>>>(&mut connection)
+    let now = current_unix_secs();
+    for (key_id, cost_key) in key_ids.iter().zip(cost_keys) {
+        let window_start = now.saturating_sub(pool_config.cost_window_seconds) as f64;
+        let total = runtime
+            .score_range_by_min(&cost_key, window_start)
             .await
-            .unwrap_or_else(|err| {
-                warn!(
-                    "gateway admin provider pool: failed to batch read cost windows for provider {provider_id}: {:?}",
-                    err
-                );
-                vec![Vec::new(); cost_keys.len()]
-            });
-        for (key_id, members) in key_ids.iter().zip(members_by_key) {
-            let total = members
-                .iter()
-                .map(|member| parse_pool_cost_member(member))
-                .sum::<u64>();
-            runtime
-                .cost_window_usage_by_key
-                .insert(key_id.clone(), total);
+            .unwrap_or_default()
+            .iter()
+            .map(|member| parse_pool_cost_member(member))
+            .sum::<u64>();
+        if total > 0 {
+            state.cost_window_usage_by_key.insert(key_id.clone(), total);
         }
     }
 
-    if !latency_keys.is_empty() {
-        let window_start = current_unix_secs().saturating_sub(pool_config.latency_window_seconds);
-        let mut latency_pipeline = redis::pipe();
-        for latency_key in &latency_keys {
-            latency_pipeline
-                .cmd("ZRANGEBYSCORE")
-                .arg(latency_key)
-                .arg(window_start)
-                .arg("+inf");
-        }
-        let members_by_key = latency_pipeline
-            .query_async::<Vec<Vec<String>>>(&mut connection)
+    for (key_id, latency_key) in key_ids.iter().zip(latency_keys) {
+        let window_start = now.saturating_sub(pool_config.latency_window_seconds) as f64;
+        let samples = runtime
+            .score_range_by_min(&latency_key, window_start)
             .await
-            .unwrap_or_else(|err| {
-                warn!(
-                    "gateway admin provider pool: failed to batch read latency windows for provider {provider_id}: {:?}",
-                    err
-                );
-                vec![Vec::new(); latency_keys.len()]
-            });
-        for (key_id, members) in key_ids.iter().zip(members_by_key) {
-            let samples = members
-                .iter()
-                .map(|member| parse_pool_latency_member(member))
-                .filter(|value| *value > 0)
-                .collect::<Vec<_>>();
-            if samples.is_empty() {
-                continue;
-            }
-            let total = samples.iter().sum::<u64>() as f64;
-            let average = total / samples.len() as f64;
-            if average.is_finite() && average >= 0.0 {
-                runtime
-                    .latency_avg_ms_by_key
-                    .insert(key_id.clone(), average);
-            }
+            .unwrap_or_default()
+            .iter()
+            .map(|member| parse_pool_latency_member(member))
+            .filter(|value| *value > 0)
+            .collect::<Vec<_>>();
+        if samples.is_empty() {
+            continue;
+        }
+        let total = samples.iter().sum::<u64>() as f64;
+        let average = total / samples.len() as f64;
+        if average.is_finite() && average >= 0.0 {
+            state.latency_avg_ms_by_key.insert(key_id.clone(), average);
         }
     }
 
@@ -310,55 +163,37 @@ pub(crate) async fn read_admin_provider_pool_runtime_state(
             .any(|item| item.enabled))
         && !key_ids.is_empty()
     {
-        let mut command = redis::cmd("ZMSCORE");
-        command.arg(pool_lru_key(&keyspace, provider_id));
-        for key_id in key_ids {
-            command.arg(key_id);
-        }
-        if let Ok(scores) = command
-            .query_async::<Vec<Option<f64>>>(&mut connection)
+        if let Ok(scores) = runtime
+            .score_many(&pool_lru_key(provider_id), key_ids)
             .await
         {
             for (key_id, score) in key_ids.iter().zip(scores) {
                 if let Some(score) = score {
-                    runtime.lru_score_by_key.insert(key_id.clone(), score);
+                    state.lru_score_by_key.insert(key_id.clone(), score);
                 }
             }
         }
     }
 
-    runtime
+    state
 }
 
 pub(crate) async fn read_admin_provider_pool_cooldown_count(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
 ) -> usize {
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis for provider {provider_id}");
-        return 0;
-    };
-    let keyspace = runner.keyspace().clone();
-    redis::cmd("SCARD")
-        .arg(pool_cooldown_index_key(&keyspace, provider_id))
-        .query_async::<u64>(&mut connection)
+    runtime
+        .set_len(&pool_cooldown_index_key(provider_id))
         .await
-        .map(|value| value as usize)
         .unwrap_or(0)
 }
 
 pub(crate) async fn read_admin_provider_pool_cooldown_key_ids(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
 ) -> Vec<String> {
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis for provider {provider_id}");
-        return Vec::new();
-    };
-    let keyspace = runner.keyspace().clone();
-    redis::cmd("SMEMBERS")
-        .arg(pool_cooldown_index_key(&keyspace, provider_id))
-        .query_async::<Vec<String>>(&mut connection)
+    runtime
+        .set_members(&pool_cooldown_index_key(provider_id))
         .await
         .unwrap_or_default()
 }

apps/aether-gateway/src/handlers/admin/provider/pool/runtime/status.rs

@@ -1,6 +1,5 @@
 use super::reads::read_admin_provider_pool_runtime_state;
 use crate::handlers::admin::provider::pool::config::admin_provider_pool_config;
-use crate::handlers::admin::provider::shared::support::AdminProviderPoolRuntimeState;
 use crate::handlers::admin::request::AdminAppState;
 use serde_json::json;
 
@@ -34,19 +33,14 @@ pub(crate) async fn build_admin_provider_pool_status_payload(
         .ok()
         .unwrap_or_default();
     let key_ids = keys.iter().map(|key| key.id.clone()).collect::<Vec<_>>();
-    let runtime = match state.redis_kv_runner() {
-        Some(runner) => {
-            read_admin_provider_pool_runtime_state(
-                &runner,
-                &provider.id,
-                &key_ids,
-                &pool_config,
-                None,
-            )
-            .await
-        }
-        None => AdminProviderPoolRuntimeState::default(),
-    };
+    let runtime = read_admin_provider_pool_runtime_state(
+        state.runtime_state(),
+        &provider.id,
+        &key_ids,
+        &pool_config,
+        None,
+    )
+    .await;
     let key_payloads = keys
         .into_iter()
         .map(|key| {

apps/aether-gateway/src/handlers/admin/provider/pool/runtime/writes.rs

@@ -5,7 +5,7 @@ use super::keys::{
 use crate::handlers::admin::provider::shared::support::{
     AdminProviderPoolConfig, AdminProviderPoolUnschedulableRule,
 };
-use aether_data::driver::redis::RedisKvRunner;
+use aether_runtime_state::RuntimeState;
 use regex::Regex;
 use std::collections::BTreeMap;
 use std::time::{SystemTime, UNIX_EPOCH};
@@ -277,7 +277,7 @@ fn resolve_transient_cooldown_ttl(
 }
 
 async fn set_pool_cooldown(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_id: &str,
     reason: &str,
@@ -288,39 +288,32 @@ async fn set_pool_cooldown(
     }
     let ttl_seconds = ttl_seconds.min(MAX_POOL_COOLDOWN_SECONDS);
 
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!(
-            "gateway admin provider pool: failed to connect redis to set cooldown for key {key_id}"
-        );
-        return;
-    };
-    let keyspace = runner.keyspace().clone();
-    let result: Result<(), _> = redis::pipe()
-        .cmd("SETEX")
-        .arg(pool_cooldown_key(&keyspace, provider_id, key_id))
-        .arg(ttl_seconds)
-        .arg(reason)
-        .ignore()
-        .cmd("SADD")
-        .arg(pool_cooldown_index_key(&keyspace, provider_id))
-        .arg(key_id)
-        .ignore()
-        .cmd("EXPIRE")
-        .arg(pool_cooldown_index_key(&keyspace, provider_id))
-        .arg(ttl_seconds.saturating_add(60))
-        .ignore()
-        .query_async(&mut connection)
-        .await;
-    if let Err(err) = result {
+    if let Err(err) = runtime
+        .kv_set(
+            &pool_cooldown_key(provider_id, key_id),
+            reason.to_string(),
+            Some(std::time::Duration::from_secs(ttl_seconds)),
+        )
+        .await
+    {
         warn!(
             "gateway admin provider pool: failed to set cooldown for provider {provider_id} key {key_id}: {:?}",
             err
         );
     }
+    let _ = runtime
+        .set_add(&pool_cooldown_index_key(provider_id), key_id)
+        .await;
+    let _ = runtime
+        .key_expire(
+            &pool_cooldown_index_key(provider_id),
+            std::time::Duration::from_secs(ttl_seconds.saturating_add(60)),
+        )
+        .await;
 }
 
-async fn invalidate_pool_oauth_cache(runner: &RedisKvRunner, key_id: &str) {
-    if let Err(err) = runner.del(&oauth_cache_key(key_id)).await {
+async fn invalidate_pool_oauth_cache(runtime: &RuntimeState, key_id: &str) {
+    if let Err(err) = runtime.kv_delete(&oauth_cache_key(key_id)).await {
         warn!(
             "gateway admin provider pool: failed to invalidate oauth cache for key {key_id}: {:?}",
             err
@@ -339,7 +332,7 @@ fn matching_unschedulable_rule<'a>(
 }
 
 pub(crate) async fn record_admin_provider_pool_success(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_id: &str,
     pool_config: &AdminProviderPoolConfig,
@@ -347,111 +340,72 @@ pub(crate) async fn record_admin_provider_pool_success(
     tokens_used: u64,
     ttfb_ms: Option<u64>,
 ) {
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis to record success for key {key_id}");
-        return;
-    };
-    let keyspace = runner.keyspace().clone();
     let now = current_unix_secs_f64();
-    let mut pipeline = redis::pipe();
-    let mut has_commands = false;
 
     if let Some(sticky_session_token) = sticky_session_token
         .map(str::trim)
         .filter(|value| !value.is_empty())
         .filter(|_| pool_config.sticky_session_ttl_seconds > 0)
     {
-        pipeline
-            .cmd("SETEX")
-            .arg(pool_sticky_key(
-                &keyspace,
-                provider_id,
-                sticky_session_token,
-            ))
-            .arg(pool_config.sticky_session_ttl_seconds)
-            .arg(key_id)
-            .ignore();
-        has_commands = true;
+        let _ = runtime
+            .kv_set(
+                &pool_sticky_key(provider_id, sticky_session_token),
+                key_id.to_string(),
+                Some(std::time::Duration::from_secs(
+                    pool_config.sticky_session_ttl_seconds,
+                )),
+            )
+            .await;
     }
 
     if should_touch_lru(pool_config) {
-        pipeline
-            .cmd("ZADD")
-            .arg(pool_lru_key(&keyspace, provider_id))
-            .arg(now)
-            .arg(key_id)
-            .ignore();
-        has_commands = true;
+        let _ = runtime
+            .score_set(&pool_lru_key(provider_id), key_id, now)
+            .await;
     }
 
     if tokens_used > 0 && pool_config.cost_limit_per_key_tokens.is_some() {
-        let cost_key = pool_cost_key(&keyspace, provider_id, key_id);
+        let cost_key = pool_cost_key(provider_id, key_id);
         let window_seconds = pool_config.cost_window_seconds.max(1);
         let member = format!("{}:{tokens_used}", Uuid::new_v4().simple());
-        pipeline
-            .cmd("ZADD")
-            .arg(&cost_key)
-            .arg(now)
-            .arg(member)
-            .ignore()
-            .cmd("ZREMRANGEBYSCORE")
-            .arg(&cost_key)
-            .arg("-inf")
-            .arg(now - window_seconds as f64)
-            .ignore()
-            .cmd("EXPIRE")
-            .arg(&cost_key)
-            .arg(window_seconds.saturating_add(600))
-            .ignore();
-        has_commands = true;
+        let _ = runtime.score_set(&cost_key, &member, now).await;
+        let _ = runtime
+            .score_remove_by_score(&cost_key, now - window_seconds as f64)
+            .await;
+        let _ = runtime
+            .key_expire(
+                &cost_key,
+                std::time::Duration::from_secs(window_seconds.saturating_add(600)),
+            )
+            .await;
     }
 
     if let Some(ttfb_ms) = ttfb_ms
         .filter(|value| should_record_latency(pool_config))
         .filter(|_| pool_config.latency_window_seconds > 0)
     {
-        let latency_key = pool_latency_key(&keyspace, provider_id, key_id);
+        let latency_key = pool_latency_key(provider_id, key_id);
         let window_seconds = pool_config.latency_window_seconds.max(1);
         let sample_limit = pool_config.latency_sample_limit.max(1);
         let member = format!("{}:{ttfb_ms}", Uuid::new_v4().simple());
-        pipeline
-            .cmd("ZADD")
-            .arg(&latency_key)
-            .arg(now)
-            .arg(member)
-            .ignore()
-            .cmd("ZREMRANGEBYSCORE")
-            .arg(&latency_key)
-            .arg("-inf")
-            .arg(now - window_seconds as f64)
-            .ignore()
-            .cmd("ZREMRANGEBYRANK")
-            .arg(&latency_key)
-            .arg(0)
-            .arg(-((sample_limit as i64) + 1))
-            .ignore()
-            .cmd("EXPIRE")
-            .arg(&latency_key)
-            .arg(window_seconds.saturating_add(600))
-            .ignore();
-        has_commands = true;
-    }
-
-    if !has_commands {
-        return;
-    }
-
-    let result: Result<(), _> = pipeline.query_async(&mut connection).await;
-    if let Err(err) = result {
-        warn!(
-            "gateway admin provider pool: failed to record success feedback for provider {provider_id} key {key_id}: {:?}",
-            err
-        );
+        let _ = runtime.score_set(&latency_key, &member, now).await;
+        let _ = runtime
+            .score_remove_by_score(&latency_key, now - window_seconds as f64)
+            .await;
+        let _ = runtime
+            .score_remove_by_rank(&latency_key, 0, -((sample_limit as i64) + 1))
+            .await;
+        let _ = runtime
+            .key_expire(
+                &latency_key,
+                std::time::Duration::from_secs(window_seconds.saturating_add(600)),
+            )
+            .await;
     }
 }
 
 pub(crate) async fn record_admin_provider_pool_error(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_id: &str,
     pool_config: &AdminProviderPoolConfig,
@@ -466,7 +420,7 @@ pub(crate) async fn record_admin_provider_pool_error(
     let error_message = extract_error_message(error_body).to_ascii_lowercase();
 
     if status_code == 401 {
-        invalidate_pool_oauth_cache(runner, key_id).await;
+        invalidate_pool_oauth_cache(runtime, key_id).await;
         return;
     }
 
@@ -482,7 +436,7 @@ pub(crate) async fn record_admin_provider_pool_error(
             return;
         }
         set_pool_cooldown(
-            runner,
+            runtime,
             provider_id,
             key_id,
             "forbidden_403",
@@ -503,7 +457,7 @@ pub(crate) async fn record_admin_provider_pool_error(
     {
         let ttl_seconds = (rule.duration_minutes.max(1)).saturating_mul(60).max(60);
         set_pool_cooldown(
-            runner,
+            runtime,
             provider_id,
             key_id,
             &format!("rule:{}", rule.keyword),
@@ -520,13 +474,20 @@ pub(crate) async fn record_admin_provider_pool_error(
                 .or_else(|| parse_google_quota_cooldown_seconds(error_body)),
             pool_config,
         );
-        set_pool_cooldown(runner, provider_id, key_id, "rate_limited_429", ttl_seconds).await;
+        set_pool_cooldown(
+            runtime,
+            provider_id,
+            key_id,
+            "rate_limited_429",
+            ttl_seconds,
+        )
+        .await;
         return;
     }
 
     if status_code == 529 {
         set_pool_cooldown(
-            runner,
+            runtime,
             provider_id,
             key_id,
             "overloaded_529",
@@ -555,12 +516,12 @@ pub(crate) async fn record_admin_provider_pool_error(
             parse_retry_after_seconds(response_headers),
             pool_config,
         );
-        set_pool_cooldown(runner, provider_id, key_id, &reason, ttl_seconds).await;
+        set_pool_cooldown(runtime, provider_id, key_id, &reason, ttl_seconds).await;
     }
 }
 
 pub(crate) async fn record_admin_provider_pool_stream_timeout(
-    runner: &RedisKvRunner,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_id: &str,
     pool_config: &AdminProviderPoolConfig,
@@ -569,49 +530,25 @@ pub(crate) async fn record_admin_provider_pool_stream_timeout(
         return;
     }
 
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        warn!("gateway admin provider pool: failed to connect redis to record stream timeout for key {key_id}");
-        return;
-    };
-    let keyspace = runner.keyspace().clone();
-    let timeout_key = pool_stream_timeout_key(&keyspace, provider_id, key_id);
+    let timeout_key = pool_stream_timeout_key(provider_id, key_id);
     let now = current_unix_secs_f64();
     let window_seconds = pool_config.stream_timeout_window_seconds.max(1);
     let member = Uuid::new_v4().simple().to_string();
-    let results = redis::pipe()
-        .cmd("ZREMRANGEBYSCORE")
-        .arg(&timeout_key)
-        .arg("-inf")
-        .arg(now - window_seconds as f64)
-        .cmd("ZADD")
-        .arg(&timeout_key)
-        .arg(now)
-        .arg(member)
-        .cmd("ZCARD")
-        .arg(&timeout_key)
-        .cmd("EXPIRE")
-        .arg(&timeout_key)
-        .arg(window_seconds.saturating_add(60))
-        .query_async::<Vec<redis::Value>>(&mut connection)
+    let _ = runtime
+        .score_remove_by_score(&timeout_key, now - window_seconds as f64)
+        .await;
+    let _ = runtime.score_set(&timeout_key, &member, now).await;
+    let count = runtime.score_len(&timeout_key).await.unwrap_or(0) as u64;
+    let _ = runtime
+        .key_expire(
+            &timeout_key,
+            std::time::Duration::from_secs(window_seconds.saturating_add(60)),
+        )
         .await;
-
-    let count = match results
-        .ok()
-        .and_then(|values| values.get(2).cloned())
-        .and_then(|value| redis::from_redis_value::<u64>(&value).ok())
-    {
-        Some(count) => count,
-        None => {
-            warn!(
-                "gateway admin provider pool: failed to compute stream timeout count for provider {provider_id} key {key_id}"
-            );
-            return;
-        }
-    };
 
     if count >= pool_config.stream_timeout_threshold {
         set_pool_cooldown(
-            runner,
+            runtime,
             provider_id,
             key_id,
             &format!("stream_timeout_x{count}"),
@@ -628,13 +565,13 @@ mod tests {
         record_admin_provider_pool_error, record_admin_provider_pool_stream_timeout,
         record_admin_provider_pool_success,
     };
-    use crate::data::{GatewayDataConfig, GatewayDataState};
     use crate::handlers::admin::provider::pool::runtime::reads::read_admin_provider_pool_runtime_state;
     use crate::handlers::admin::provider::shared::support::{
         AdminProviderPoolConfig, AdminProviderPoolSchedulingPreset,
         AdminProviderPoolUnschedulableRule,
     };
     use crate::AppState;
+    use aether_runtime_state::{RedisClientConfig, RuntimeState, RuntimeStateConfig};
     use aether_testkit::ManagedRedisServer;
     use std::collections::BTreeMap;
 
@@ -682,14 +619,17 @@ mod tests {
         }
     }
 
-    fn build_runner_app(redis_url: &str, key_prefix: &str) -> AppState {
-        let data_state = GatewayDataState::from_config(
-            GatewayDataConfig::disabled().with_redis_url(redis_url, Some(key_prefix)),
-        )
-        .expect("data state should build");
+    async fn build_runner_app(redis_url: &str, key_prefix: &str) -> AppState {
+        let runtime_state =
+            RuntimeState::from_config(RuntimeStateConfig::redis(RedisClientConfig {
+                url: redis_url.to_string(),
+                key_prefix: Some(key_prefix.to_string()),
+            }))
+            .await
+            .expect("runtime state should build");
         AppState::new()
             .expect("app state should build")
-            .with_data_state_for_tests(data_state)
+            .with_runtime_state(std::sync::Arc::new(runtime_state))
     }
 
     #[test]
@@ -798,13 +738,13 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_success_feedback");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_success_feedback").await;
+        let runtime = app.runtime_state.as_ref();
         let pool_config = sample_pool_config();
         let key_ids = vec!["key-1".to_string()];
 
         record_admin_provider_pool_success(
-            &runner,
+            runtime,
             "provider-1",
             "key-1",
             &pool_config,
@@ -815,7 +755,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -836,14 +776,15 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_no_sticky_without_affinity");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app =
+            build_runner_app(redis.redis_url(), "pool_runtime_no_sticky_without_affinity").await;
+        let runtime = app.runtime_state.as_ref();
         let mut pool_config = sample_pool_config();
         pool_config.sticky_session_ttl_seconds = 0;
         let key_ids = vec!["key-1".to_string()];
 
         record_admin_provider_pool_success(
-            &runner,
+            runtime,
             "provider-1",
             "key-1",
             &pool_config,
@@ -854,7 +795,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -874,13 +815,13 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_error_feedback");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_error_feedback").await;
+        let runtime = app.runtime_state.as_ref();
         let pool_config = sample_pool_config();
         let key_ids = vec!["key-2".to_string()];
 
         record_admin_provider_pool_error(
-            &runner,
+            runtime,
             "provider-1",
             "key-2",
             &pool_config,
@@ -894,7 +835,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -920,13 +861,13 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_google_quota_cooldown");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_google_quota_cooldown").await;
+        let runtime = app.runtime_state.as_ref();
         let pool_config = sample_pool_config();
         let key_ids = vec!["key-google-429".to_string()];
 
         record_admin_provider_pool_error(
-            &runner,
+            runtime,
             "provider-1",
             "key-google-429",
             &pool_config,
@@ -949,7 +890,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -975,13 +916,13 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_capped_cooldown");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_capped_cooldown").await;
+        let runtime = app.runtime_state.as_ref();
         let pool_config = sample_pool_config();
         let key_ids = vec!["key-long-cooldown".to_string()];
 
         record_admin_provider_pool_error(
-            &runner,
+            runtime,
             "provider-1",
             "key-long-cooldown",
             &pool_config,
@@ -995,7 +936,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -1021,8 +962,8 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_circuit_no_cooldown");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_circuit_no_cooldown").await;
+        let runtime = app.runtime_state.as_ref();
         let pool_config = sample_pool_config();
         let key_ids = vec!["key-account-disabled".to_string()];
 
@@ -1035,7 +976,7 @@ mod tests {
             Some("account_deactivated_401")
         );
         record_admin_provider_pool_error(
-            &runner,
+            runtime,
             "provider-1",
             "key-account-disabled",
             &pool_config,
@@ -1046,7 +987,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -1067,8 +1008,8 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_unschedulable_rule");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_unschedulable_rule").await;
+        let runtime = app.runtime_state.as_ref();
         let mut pool_config = sample_pool_config();
         pool_config.unschedulable_rules = vec![AdminProviderPoolUnschedulableRule {
             keyword: "review required".to_string(),
@@ -1077,7 +1018,7 @@ mod tests {
         let key_ids = vec!["key-3".to_string()];
 
         record_admin_provider_pool_error(
-            &runner,
+            runtime,
             "provider-1",
             "key-3",
             &pool_config,
@@ -1088,7 +1029,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -1114,8 +1055,8 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_ignore_400");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_ignore_400").await;
+        let runtime = app.runtime_state.as_ref();
         let mut pool_config = sample_pool_config();
         pool_config.unschedulable_rules = vec![AdminProviderPoolUnschedulableRule {
             keyword: "review required".to_string(),
@@ -1124,7 +1065,7 @@ mod tests {
         let key_ids = vec!["key-client-400".to_string()];
 
         record_admin_provider_pool_error(
-            &runner,
+            runtime,
             "provider-1",
             "key-client-400",
             &pool_config,
@@ -1135,7 +1076,7 @@ mod tests {
         .await;
 
         let runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -1154,21 +1095,31 @@ mod tests {
         let Some(redis) = start_managed_redis_or_skip().await else {
             return;
         };
-        let app = build_runner_app(redis.redis_url(), "pool_runtime_stream_timeout");
-        let runner = app.redis_kv_runner().expect("redis runner should exist");
+        let app = build_runner_app(redis.redis_url(), "pool_runtime_stream_timeout").await;
+        let runtime_state = app.runtime_state.as_ref();
         let mut pool_config = sample_pool_config();
         pool_config.stream_timeout_threshold = 2;
         pool_config.stream_timeout_window_seconds = 300;
         pool_config.stream_timeout_cooldown_seconds = 90;
         let key_ids = vec!["key-4".to_string()];
 
-        record_admin_provider_pool_stream_timeout(&runner, "provider-1", "key-4", &pool_config)
-            .await;
-        record_admin_provider_pool_stream_timeout(&runner, "provider-1", "key-4", &pool_config)
-            .await;
+        record_admin_provider_pool_stream_timeout(
+            runtime_state,
+            "provider-1",
+            "key-4",
+            &pool_config,
+        )
+        .await;
+        record_admin_provider_pool_stream_timeout(
+            runtime_state,
+            "provider-1",
+            "key-4",
+            &pool_config,
+        )
+        .await;
 
         let mut runtime = read_admin_provider_pool_runtime_state(
-            &runner,
+            runtime_state,
             "provider-1",
             &key_ids,
             &pool_config,
@@ -1186,7 +1137,7 @@ mod tests {
             }
             tokio::time::sleep(std::time::Duration::from_millis(10)).await;
             runtime = read_admin_provider_pool_runtime_state(
-                &runner,
+                runtime_state,
                 "provider-1",
                 &key_ids,
                 &pool_config,

apps/aether-gateway/src/handlers/admin/provider/pool_admin/read_routes/keys.rs

@@ -139,11 +139,8 @@ pub(super) async fn build_admin_pool_list_keys_response(
     let page_offset = page.saturating_sub(1).saturating_mul(page_size);
 
     let (keys, total) = if status == "cooldown" {
-        let cooldown_key_ids = if let Some(runner) = state.redis_kv_runner() {
-            read_admin_provider_pool_cooldown_key_ids(&runner, &provider.id).await
-        } else {
-            Vec::new()
-        };
+        let cooldown_key_ids =
+            read_admin_provider_pool_cooldown_key_ids(state.runtime_state(), &provider.id).await;
         let mut keys = if cooldown_key_ids.is_empty() {
             Vec::new()
         } else {
@@ -240,10 +237,10 @@ pub(super) async fn build_admin_pool_list_keys_response(
     let endpoints = state
         .list_provider_catalog_endpoints_by_provider_ids(std::slice::from_ref(&provider.id))
         .await?;
-    let runtime = match (state.redis_kv_runner(), pool_config.as_ref()) {
-        (Some(runner), Some(pool_config)) if !key_ids.is_empty() => {
+    let runtime = match pool_config.as_ref() {
+        Some(pool_config) if !key_ids.is_empty() => {
             read_admin_provider_pool_runtime_state(
-                &runner,
+                state.runtime_state(),
                 &provider.id,
                 &key_ids,
                 pool_config,

apps/aether-gateway/src/handlers/admin/provider/pool_admin/read_routes/overview.rs

@@ -1,3 +1,5 @@
+use std::collections::BTreeMap;
+
 use super::{
     admin_provider_pool_config, build_admin_pool_error_response,
     read_admin_provider_pool_cooldown_counts,
@@ -12,7 +14,6 @@ use axum::{
     response::{IntoResponse, Response},
     Json,
 };
-use std::collections::BTreeMap;
 
 pub(super) async fn build_admin_pool_overview_response(
     state: &AdminAppState<'_>,
@@ -35,7 +36,6 @@ pub(super) async fn build_admin_pool_overview_response(
         .iter()
         .map(|(provider, _)| provider.id.clone())
         .collect::<Vec<_>>();
-    let redis_runner = state.redis_kv_runner();
     let (key_stats_result, cooldown_counts_by_provider) = tokio::join!(
         async {
             if provider_ids.is_empty() {
@@ -47,11 +47,10 @@ pub(super) async fn build_admin_pool_overview_response(
             }
         },
         async {
-            match redis_runner.as_ref() {
-                Some(runner) if !provider_ids.is_empty() => {
-                    read_admin_provider_pool_cooldown_counts(runner, &provider_ids).await
-                }
-                _ => BTreeMap::new(),
+            if provider_ids.is_empty() {
+                std::collections::BTreeMap::new()
+            } else {
+                read_admin_provider_pool_cooldown_counts(state.runtime_state(), &provider_ids).await
             }
         },
     );

apps/aether-gateway/src/handlers/admin/provider/query/models.rs

@@ -1553,20 +1553,8 @@ async fn provider_query_read_cached_models(
     provider_id: &str,
     key_id: &str,
 ) -> Option<Vec<Value>> {
-    let runner = state.app().redis_kv_runner()?;
-    let cache_key = runner
-        .keyspace()
-        .key(&format!("upstream_models:{provider_id}:{key_id}"));
-    let mut connection = runner
-        .client()
-        .get_multiplexed_async_connection()
-        .await
-        .ok()?;
-    let raw = redis::cmd("GET")
-        .arg(&cache_key)
-        .query_async::<Option<String>>(&mut connection)
-        .await
-        .ok()??;
+    let cache_key = format!("upstream_models:{provider_id}:{key_id}");
+    let raw = state.runtime_state().kv_get(&cache_key).await.ok()??;
     let parsed = serde_json::from_str::<Vec<Value>>(&raw).ok()?;
     Some(aggregate_models_for_cache(&parsed))
 }
@@ -1575,20 +1563,8 @@ async fn provider_query_read_provider_cached_models(
     state: &AdminAppState<'_>,
     provider_id: &str,
 ) -> Option<Vec<Value>> {
-    let runner = state.app().redis_kv_runner()?;
-    let cache_key = runner.keyspace().key(&format!(
-        "{ANTIGRAVITY_PROVIDER_CACHE_KEY_PREFIX}{provider_id}"
-    ));
-    let mut connection = runner
-        .client()
-        .get_multiplexed_async_connection()
-        .await
-        .ok()?;
-    let raw = redis::cmd("GET")
-        .arg(&cache_key)
-        .query_async::<Option<String>>(&mut connection)
-        .await
-        .ok()??;
+    let cache_key = format!("{ANTIGRAVITY_PROVIDER_CACHE_KEY_PREFIX}{provider_id}");
+    let raw = state.runtime_state().kv_get(&cache_key).await.ok()??;
     let parsed = serde_json::from_str::<Vec<Value>>(&raw).ok()?;
     Some(aggregate_models_for_cache(&parsed))
 }
@@ -1598,18 +1574,18 @@ async fn provider_query_write_provider_cached_models(
     provider_id: &str,
     models: &[Value],
 ) {
-    let Some(runner) = state.app().redis_kv_runner() else {
-        return;
-    };
     let Ok(serialized) = serde_json::to_string(&aggregate_models_for_cache(models)) else {
         return;
     };
     let cache_key = format!("{ANTIGRAVITY_PROVIDER_CACHE_KEY_PREFIX}{provider_id}");
-    let _ = runner
-        .setex(
+    let _ = state
+        .runtime_state()
+        .kv_set(
             &cache_key,
-            &serialized,
-            Some(aether_model_fetch::model_fetch_interval_minutes().saturating_mul(60)),
+            serialized,
+            Some(std::time::Duration::from_secs(
+                aether_model_fetch::model_fetch_interval_minutes().saturating_mul(60),
+            )),
         )
         .await;
 }

apps/aether-gateway/src/handlers/admin/request/capabilities.rs

@@ -116,8 +116,8 @@ impl<'a> AdminAppState<'a> {
         self.app.mark_provider_key_rpm_reset(key_id, now_unix_secs)
     }
 
-    pub(crate) fn redis_kv_runner(&self) -> Option<aether_data::driver::redis::RedisKvRunner> {
-        self.app.redis_kv_runner()
+    pub(crate) fn runtime_state(&self) -> &aether_runtime_state::RuntimeState {
+        self.app.runtime_state.as_ref()
     }
 
     pub(crate) fn provider_key_rpm_reset_at(

apps/aether-gateway/src/handlers/admin/request/provider/oauth.rs

@@ -84,22 +84,12 @@ impl<'a> AdminAppState<'a> {
         });
         let key = provider_oauth_state_storage_key(&nonce);
         let value = payload.to_string();
-        if let Some(runner) = self.redis_kv_runner() {
-            runner
-                .setex(&key, &value, Some(PROVIDER_OAUTH_STATE_TTL_SECS))
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            return Ok(nonce);
-        }
-        if self
-            .as_ref()
-            .save_provider_oauth_state_for_tests(&key, &value)
-        {
-            return Ok(nonce);
-        }
-        Err(GatewayError::Internal(
-            "provider oauth redis unavailable".to_string(),
-        ))
+        self.as_ref()
+            .runtime_kv_setex(&key, &value, PROVIDER_OAUTH_STATE_TTL_SECS)
+            .await?;
+        self.as_ref()
+            .save_provider_oauth_state_for_tests(&key, &value);
+        Ok(nonce)
     }
 
     pub(crate) async fn consume_provider_oauth_state(
@@ -107,21 +97,7 @@ impl<'a> AdminAppState<'a> {
         nonce: &str,
     ) -> Result<Option<StoredAdminProviderOAuthState>, GatewayError> {
         let key = provider_oauth_state_storage_key(nonce);
-        let raw = if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = runner
-                .client()
-                .get_multiplexed_async_connection()
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            let namespaced_key = runner.keyspace().key(&key);
-            redis::cmd("GETDEL")
-                .arg(&namespaced_key)
-                .query_async::<Option<String>>(&mut connection)
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?
-        } else {
-            self.as_ref().take_provider_oauth_state_for_tests(&key)
-        };
+        let raw = self.as_ref().runtime_kv_getdel(&key).await?;
         raw.map(|value| {
             serde_json::from_str::<StoredAdminProviderOAuthState>(&value)
                 .map_err(|err| GatewayError::Internal(err.to_string()))
@@ -172,35 +148,12 @@ impl<'a> AdminAppState<'a> {
         let serialized = serde_json::to_string(task_state)
             .map_err(|err| GatewayError::Internal(err.to_string()))?;
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await
-            else {
-                return Err(GatewayError::Internal(
-                    "provider oauth batch task redis unavailable".to_string(),
-                ));
-            };
-            let redis_key = runner.keyspace().key(&key);
-            redis::cmd("SET")
-                .arg(redis_key)
-                .arg(&serialized)
-                .arg("EX")
-                .arg(PROVIDER_OAUTH_BATCH_TASK_TTL_SECS)
-                .query_async::<()>(&mut connection)
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            return Ok(());
-        }
-
-        if self
-            .as_ref()
-            .save_provider_oauth_batch_task_for_tests(&key, &serialized)
-        {
-            return Ok(());
-        }
-
-        Err(GatewayError::Internal(
-            "provider oauth batch task redis unavailable".to_string(),
-        ))
+        self.as_ref()
+            .runtime_kv_setex(&key, &serialized, PROVIDER_OAUTH_BATCH_TASK_TTL_SECS)
+            .await?;
+        self.as_ref()
+            .save_provider_oauth_batch_task_for_tests(&key, &serialized);
+        Ok(())
     }
 
     pub(crate) async fn read_provider_oauth_batch_task_payload(
@@ -209,22 +162,7 @@ impl<'a> AdminAppState<'a> {
         task_id: &str,
     ) -> Result<Option<serde_json::Value>, GatewayError> {
         let key = provider_oauth_batch_task_storage_key(task_id);
-        let raw = if let Some(runner) = self.redis_kv_runner() {
-            let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await
-            else {
-                return Err(GatewayError::Internal(
-                    "provider oauth batch task redis unavailable".to_string(),
-                ));
-            };
-            let redis_key = runner.keyspace().key(&key);
-            redis::cmd("GET")
-                .arg(redis_key)
-                .query_async(&mut connection)
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?
-        } else {
-            self.as_ref().load_provider_oauth_batch_task_for_tests(&key)
-        };
+        let raw = self.as_ref().runtime_kv_get(&key).await?;
         let Some(raw) = raw else {
             return Ok(None);
         };
@@ -262,28 +200,18 @@ impl<'a> AdminAppState<'a> {
                 "provider oauth redis unavailable",
             )
         })?;
-        if let Some(runner) = self.redis_kv_runner() {
-            runner
-                .setex(&key, &value, Some(ttl_seconds))
-                .await
-                .map_err(|_| {
-                    build_internal_control_error_response(
-                        http::StatusCode::SERVICE_UNAVAILABLE,
-                        "provider oauth redis unavailable",
-                    )
-                })?;
-            return Ok(());
-        }
-        if self
-            .as_ref()
-            .save_provider_oauth_device_session_for_tests(&key, &value)
-        {
-            return Ok(());
-        }
-        Err(build_internal_control_error_response(
-            http::StatusCode::SERVICE_UNAVAILABLE,
-            "provider oauth redis unavailable",
-        ))
+        self.as_ref()
+            .runtime_kv_setex(&key, &value, ttl_seconds)
+            .await
+            .map_err(|_| {
+                build_internal_control_error_response(
+                    http::StatusCode::SERVICE_UNAVAILABLE,
+                    "provider oauth redis unavailable",
+                )
+            })?;
+        self.as_ref()
+            .save_provider_oauth_device_session_for_tests(&key, &value);
+        Ok(())
     }
 
     pub(crate) async fn read_provider_oauth_device_session(
@@ -291,22 +219,7 @@ impl<'a> AdminAppState<'a> {
         session_id: &str,
     ) -> Result<Option<StoredAdminProviderOAuthDeviceSession>, GatewayError> {
         let key = provider_oauth_device_session_storage_key(session_id);
-        let raw = if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = runner
-                .client()
-                .get_multiplexed_async_connection()
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            let namespaced_key = runner.keyspace().key(&key);
-            redis::cmd("GET")
-                .arg(&namespaced_key)
-                .query_async::<Option<String>>(&mut connection)
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?
-        } else {
-            self.as_ref()
-                .load_provider_oauth_device_session_for_tests(&key)
-        };
+        let raw = self.as_ref().runtime_kv_get(&key).await?;
         raw.map(|value| {
             serde_json::from_str::<StoredAdminProviderOAuthDeviceSession>(&value)
                 .map_err(|err| GatewayError::Internal(err.to_string()))

apps/aether-gateway/src/handlers/proxy/mod.rs

@@ -689,10 +689,10 @@ pub(crate) async fn proxy_request(
             )));
         }
         Err(RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::Saturated { gate, limit },
+            aether_runtime_state::RuntimeSemaphoreError::Saturated { gate, limit },
         ))
         | Err(RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::Unavailable { gate, limit, .. },
+            aether_runtime_state::RuntimeSemaphoreError::Unavailable { gate, limit, .. },
         )) => {
             let trace_id = extract_or_generate_trace_id(request.headers());
             let response = build_local_overloaded_response(&trace_id, None, gate, limit)?;
@@ -714,7 +714,7 @@ pub(crate) async fn proxy_request(
             ));
         }
         Err(RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::InvalidConfiguration(message),
+            aether_runtime_state::RuntimeSemaphoreError::InvalidConfiguration(message),
         )) => return Err(GatewayError::Internal(message)),
     };
     let request_admission_ms = started_at.elapsed().as_millis() as u64;

apps/aether-gateway/src/handlers/public/support/auth_email.rs

@@ -41,67 +41,6 @@ pub(super) fn auth_email_verified_key(email: &str) -> String {
     format!("{AUTH_EMAIL_VERIFIED_PREFIX}{email}")
 }
 
-pub(super) fn load_auth_email_verification_entry_for_tests(
-    _state: &AppState,
-    _key: &str,
-) -> Option<String> {
-    #[cfg(test)]
-    {
-        return _state
-            .auth_email_verification_store
-            .as_ref()
-            .and_then(|store| {
-                store
-                    .lock()
-                    .expect("auth email verification store should lock")
-                    .get(_key)
-                    .cloned()
-            });
-    }
-
-    #[allow(unreachable_code)]
-    None
-}
-
-pub(super) fn save_auth_email_verification_entry_for_tests(
-    _state: &AppState,
-    _key: &str,
-    _value: &str,
-) -> bool {
-    #[cfg(test)]
-    {
-        if let Some(store) = _state.auth_email_verification_store.as_ref() {
-            store
-                .lock()
-                .expect("auth email verification store should lock")
-                .insert(_key.to_string(), _value.to_string());
-            return true;
-        }
-    }
-
-    false
-}
-
-pub(super) fn delete_auth_email_verification_entries_for_tests(
-    _state: &AppState,
-    _keys: &[String],
-) -> bool {
-    #[cfg(test)]
-    {
-        if let Some(store) = _state.auth_email_verification_store.as_ref() {
-            let mut guard = store
-                .lock()
-                .expect("auth email verification store should lock");
-            for key in _keys {
-                guard.remove(key);
-            }
-            return true;
-        }
-    }
-
-    false
-}
-
 pub(super) fn record_auth_email_delivery_for_tests(
     _state: &AppState,
     _payload: serde_json::Value,
@@ -418,21 +357,7 @@ pub(super) async fn read_auth_email_verification_code(
     email: &str,
 ) -> Result<Option<StoredAuthEmailVerificationCode>, GatewayError> {
     let key = auth_email_verification_key(email);
-    let raw = if let Some(runner) = state.redis_kv_runner() {
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        let namespaced_key = runner.keyspace().key(&key);
-        redis::cmd("GET")
-            .arg(&namespaced_key)
-            .query_async::<Option<String>>(&mut connection)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?
-    } else {
-        load_auth_email_verification_entry_for_tests(state, &key)
-    };
+    let raw = state.runtime_kv_get(&key).await?;
     raw.map(|value| {
         serde_json::from_str::<StoredAuthEmailVerificationCode>(&value)
             .map_err(|err| GatewayError::Internal(err.to_string()))
@@ -445,21 +370,7 @@ pub(super) async fn auth_email_is_verified(
     email: &str,
 ) -> Result<bool, GatewayError> {
     let key = auth_email_verified_key(email);
-    if let Some(runner) = state.redis_kv_runner() {
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        let namespaced_key = runner.keyspace().key(&key);
-        let exists = redis::cmd("EXISTS")
-            .arg(&namespaced_key)
-            .query_async::<i64>(&mut connection)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        return Ok(exists > 0);
-    }
-    Ok(load_auth_email_verification_entry_for_tests(state, &key).is_some())
+    state.runtime_kv_exists(&key).await
 }
 
 pub(super) async fn mark_auth_email_verified(
@@ -467,16 +378,10 @@ pub(super) async fn mark_auth_email_verified(
     email: &str,
 ) -> Result<bool, GatewayError> {
     let key = auth_email_verified_key(email);
-    if let Some(runner) = state.redis_kv_runner() {
-        runner
-            .setex(&key, "verified", Some(AUTH_EMAIL_VERIFIED_TTL_SECS))
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        return Ok(true);
-    }
-    Ok(save_auth_email_verification_entry_for_tests(
-        state, &key, "verified",
-    ))
+    state
+        .runtime_kv_setex(&key, "verified", AUTH_EMAIL_VERIFIED_TTL_SECS)
+        .await?;
+    Ok(true)
 }
 
 pub(super) async fn clear_auth_email_pending_code(
@@ -484,17 +389,7 @@ pub(super) async fn clear_auth_email_pending_code(
     email: &str,
 ) -> Result<bool, GatewayError> {
     let verification_key = auth_email_verification_key(email);
-    if let Some(runner) = state.redis_kv_runner() {
-        let _ = runner
-            .del(&verification_key)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        return Ok(true);
-    }
-    Ok(delete_auth_email_verification_entries_for_tests(
-        state,
-        &[verification_key],
-    ))
+    state.runtime_kv_del(&verification_key).await
 }
 
 pub(super) async fn clear_auth_email_verification(
@@ -503,21 +398,9 @@ pub(super) async fn clear_auth_email_verification(
 ) -> Result<bool, GatewayError> {
     let verification_key = auth_email_verification_key(email);
     let verified_key = auth_email_verified_key(email);
-    if let Some(runner) = state.redis_kv_runner() {
-        let _ = runner
-            .del(&verification_key)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        let _ = runner
-            .del(&verified_key)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        return Ok(true);
-    }
-    Ok(delete_auth_email_verification_entries_for_tests(
-        state,
-        &[verification_key, verified_key],
-    ))
+    let deleted_pending = state.runtime_kv_del(&verification_key).await?;
+    let deleted_verified = state.runtime_kv_del(&verified_key).await?;
+    Ok(deleted_pending || deleted_verified)
 }
 
 pub(super) async fn store_auth_email_verification_code(
@@ -533,16 +416,8 @@ pub(super) async fn store_auth_email_verification_code(
         "created_at": created_at.to_rfc3339(),
     })
     .to_string();
-    if let Some(runner) = state.redis_kv_runner() {
-        runner
-            .setex(&key, &value, Some(ttl_seconds))
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        return Ok(true);
-    }
-    Ok(save_auth_email_verification_entry_for_tests(
-        state, &key, &value,
-    ))
+    state.runtime_kv_setex(&key, &value, ttl_seconds).await?;
+    Ok(true)
 }
 
 pub(super) async fn read_auth_smtp_config(

apps/aether-gateway/src/main.rs

@@ -3,12 +3,12 @@
 static GLOBAL: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
 
 use std::path::PathBuf;
+use std::sync::Arc;
 
 use clap::{Args as ClapArgs, Parser, Subcommand, ValueEnum};
 use tracing::{debug, info, warn};
 
 use aether_crypto::warm_python_fernet_secret;
-use aether_data::driver::redis::RedisClientConfig;
 use aether_data::lifecycle::export::{export_database_jsonl, import_database_jsonl, ExportDomain};
 use aether_data::{DatabaseDriver, SqlDatabaseConfig, SqlPoolConfig, DEFAULT_SQLITE_DATABASE_URL};
 use aether_gateway::{
@@ -17,8 +17,12 @@ use aether_gateway::{
     VideoTaskTruthSourceMode,
 };
 use aether_runtime::{
-    init_service_runtime, DistributedConcurrencyGate, FileLoggingConfig, LogDestination, LogFormat,
-    LogRotation, RedisDistributedConcurrencyConfig, ServiceRuntimeConfig,
+    init_service_runtime, FileLoggingConfig, LogDestination, LogFormat, LogRotation,
+    ServiceRuntimeConfig,
+};
+use aether_runtime_state::{
+    RedisClientConfig, RuntimeSemaphoreConfig, RuntimeState, RuntimeStateBackendMode,
+    RuntimeStateConfig,
 };
 
 #[derive(Copy, Clone, Debug, Eq, PartialEq, ValueEnum)]
@@ -126,6 +130,7 @@ impl NodeRoleArg {
 
 #[derive(Copy, Clone, Debug, Eq, PartialEq, ValueEnum)]
 enum RuntimeBackendArg {
+    Auto,
     Redis,
     Memory,
 }
@@ -133,10 +138,19 @@ enum RuntimeBackendArg {
 impl RuntimeBackendArg {
     const fn as_str(self) -> &'static str {
         match self {
+            Self::Auto => "auto",
             Self::Redis => "redis",
             Self::Memory => "memory",
         }
     }
+
+    const fn to_runtime_state_backend(self) -> RuntimeStateBackendMode {
+        match self {
+            Self::Auto => RuntimeStateBackendMode::Auto,
+            Self::Redis => RuntimeStateBackendMode::Redis,
+            Self::Memory => RuntimeStateBackendMode::Memory,
+        }
+    }
 }
 
 #[derive(Copy, Clone, Debug, Eq, PartialEq, ValueEnum)]
@@ -394,25 +408,12 @@ impl GatewayDataArgs {
 
     fn to_config(&self) -> GatewayDataConfig {
         let database = self.effective_sql_database_config();
-        let redis_url = self.effective_redis_url();
 
-        let mut config = match database {
+        let config = match database {
             Some(database) => GatewayDataConfig::from_database_config(database),
             None => GatewayDataConfig::disabled(),
         };
 
-        if let Some(redis_url) = redis_url.as_deref() {
-            config = config.with_redis_config(RedisClientConfig {
-                url: redis_url.to_string(),
-                key_prefix: self
-                    .redis_key_prefix
-                    .as_deref()
-                    .map(str::trim)
-                    .filter(|value| !value.is_empty())
-                    .map(ToOwned::to_owned),
-            });
-        }
-
         match self.effective_encryption_key() {
             Some(value) => {
                 warm_python_fernet_secret(&value);
@@ -754,6 +755,12 @@ struct Args {
     #[arg(long, env = "AETHER_RUNTIME_BACKEND", value_enum)]
     runtime_backend: Option<RuntimeBackendArg>,
 
+    #[arg(long, env = "AETHER_RUNTIME_REDIS_URL")]
+    runtime_redis_url: Option<String>,
+
+    #[arg(long, env = "AETHER_RUNTIME_REDIS_KEY_PREFIX")]
+    runtime_redis_key_prefix: Option<String>,
+
     #[command(flatten)]
     data: GatewayDataArgs,
 
@@ -777,7 +784,9 @@ impl Args {
         data_redis_url: Option<&str>,
     ) -> RuntimeBackendArg {
         if let Some(runtime_backend) = self.runtime_backend {
-            return runtime_backend;
+            if !matches!(runtime_backend, RuntimeBackendArg::Auto) {
+                return runtime_backend;
+            }
         }
         if matches!(self.deployment_topology, DeploymentTopologyArg::MultiNode) {
             return RuntimeBackendArg::Redis;
@@ -792,6 +801,49 @@ impl Args {
         }
     }
 
+    fn effective_runtime_redis_url(&self, data_redis_url: Option<&str>) -> Option<String> {
+        self.runtime_redis_url
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(ToOwned::to_owned)
+            .or_else(|| data_redis_url.map(ToOwned::to_owned))
+    }
+
+    fn effective_runtime_redis_key_prefix(&self) -> Option<String> {
+        self.runtime_redis_key_prefix
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(ToOwned::to_owned)
+            .or_else(|| {
+                self.data
+                    .redis_key_prefix
+                    .as_deref()
+                    .map(str::trim)
+                    .filter(|value| !value.is_empty())
+                    .map(ToOwned::to_owned)
+            })
+    }
+
+    fn runtime_state_config(
+        &self,
+        runtime_backend: RuntimeBackendArg,
+        data_redis_url: Option<&str>,
+    ) -> RuntimeStateConfig {
+        let redis = self
+            .effective_runtime_redis_url(data_redis_url)
+            .map(|url| RedisClientConfig {
+                url,
+                key_prefix: self.effective_runtime_redis_key_prefix(),
+            });
+        RuntimeStateConfig {
+            backend: runtime_backend.to_runtime_state_backend(),
+            redis,
+            ..RuntimeStateConfig::default()
+        }
+    }
+
     fn runtime_config(&self) -> Result<ServiceRuntimeConfig, std::io::Error> {
         let default_log_filter = if self.command.is_some()
             || self.migrate
@@ -990,12 +1042,20 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
     let data_redis_url = args.data.effective_redis_url();
     let runtime_backend =
         args.effective_runtime_backend(sql_database_config.as_ref(), data_redis_url.as_deref());
+    let runtime_redis_url = args.effective_runtime_redis_url(data_redis_url.as_deref());
     validate_deployment_topology(
         &args,
         sql_database_config.as_ref(),
-        data_redis_url.as_deref(),
+        runtime_redis_url.as_deref(),
         runtime_backend,
     )?;
+    let runtime_state = Arc::new(
+        RuntimeState::from_config(
+            args.runtime_state_config(runtime_backend, data_redis_url.as_deref()),
+        )
+        .await
+        .map_err(|err| std::io::Error::new(std::io::ErrorKind::InvalidInput, err.to_string()))?,
+    );
     let data_config = args.data.to_config();
     let rate_limit_config = if matches!(args.deployment_topology, DeploymentTopologyArg::MultiNode)
     {
@@ -1045,7 +1105,7 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
         distributed_request_redis_configured = args
             .distributed_request_redis_url
             .as_deref()
-            .or(data_redis_url.as_deref())
+            .or(runtime_redis_url.as_deref())
             .is_some(),
         data_database_configured = sql_database_config.is_some(),
         data_database_driver = sql_database_config
@@ -1053,13 +1113,15 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
             .map(|database| database.driver.as_str())
             .unwrap_or("-"),
         data_postgres_configured = data_postgres_url.is_some(),
-        data_redis_configured = data_redis_url.is_some(),
+        runtime_redis_configured = matches!(runtime_backend, RuntimeBackendArg::Redis),
+        data_redis_url_supplied = data_redis_url.is_some(),
         data_has_encryption_key = data_config.encryption_key().is_some(),
         data_postgres_require_ssl = args.data.postgres_require_ssl,
         "aether-gateway startup configuration"
     );
 
     let mut state = AppState::new()?
+        .with_runtime_state(runtime_state)
         .with_data_config(data_config)?
         .with_usage_runtime_config(args.usage.to_config())?
         .with_video_task_truth_source_mode(args.video_task_truth_source_mode.into());
@@ -1088,35 +1150,21 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
         state = state.with_request_concurrency_limit(limit);
     }
     if let Some(limit) = args.distributed_request_limit.filter(|limit| *limit > 0) {
-        let redis_url = args
-            .distributed_request_redis_url
-            .as_deref()
-            .map(str::trim)
-            .filter(|value| !value.is_empty())
-            .or(data_redis_url.as_deref())
-            .ok_or_else(|| {
-                std::io::Error::new(
-                    std::io::ErrorKind::InvalidInput,
-                    "AETHER_GATEWAY_DISTRIBUTED_REQUEST_REDIS_URL or REDIS_URL/AETHER_GATEWAY_DATA_REDIS_URL is required when distributed request limit is enabled",
-                )
-            })?;
-        state =
-            state.with_distributed_request_concurrency_gate(DistributedConcurrencyGate::new_redis(
+        let distributed_gate = state
+            .runtime_state()
+            .semaphore(
                 "gateway_requests_distributed",
                 limit,
-                RedisDistributedConcurrencyConfig {
-                    url: redis_url.to_string(),
-                    key_prefix: args
-                        .distributed_request_redis_key_prefix
-                        .as_deref()
-                        .map(str::trim)
-                        .filter(|value| !value.is_empty())
-                        .map(ToOwned::to_owned),
+                RuntimeSemaphoreConfig {
                     lease_ttl_ms: args.distributed_request_lease_ttl_ms.max(1),
                     renew_interval_ms: args.distributed_request_renew_interval_ms.max(1),
                     command_timeout_ms: Some(args.distributed_request_command_timeout_ms.max(1)),
                 },
-            )?);
+            )
+            .map_err(|err| {
+                std::io::Error::new(std::io::ErrorKind::InvalidInput, err.to_string())
+            })?;
+        state = state.with_distributed_request_concurrency_gate(distributed_gate);
     }
     if matches!(args.deployment_topology, DeploymentTopologyArg::MultiNode)
         && !state.has_usage_data_writer()
@@ -1531,6 +1579,8 @@ mod tests {
             distributed_request_renew_interval_ms: 10_000,
             distributed_request_command_timeout_ms: 1_000,
             runtime_backend: None,
+            runtime_redis_url: None,
+            runtime_redis_key_prefix: None,
             data: GatewayDataArgs {
                 database_driver: None,
                 database_url: None,
@@ -1649,6 +1699,46 @@ mod tests {
         );
     }
 
+    #[test]
+    fn memory_runtime_data_config_keeps_redis_out_of_data_layer() {
+        let mut args = test_args();
+        args.data.database_driver = Some(DatabaseDriverArg::Sqlite);
+        args.data.database_url = Some("sqlite://./data/aether.db".to_string());
+        args.data.redis_url = Some("redis://127.0.0.1/0".to_string());
+
+        let config = args.data.to_config();
+
+        assert_eq!(
+            config
+                .database()
+                .expect("database should be configured")
+                .driver,
+            DatabaseDriver::Sqlite
+        );
+    }
+
+    #[test]
+    fn redis_runtime_config_owns_redis_connection() {
+        let mut args = test_args();
+        args.data.database_driver = Some(DatabaseDriverArg::Postgres);
+        args.data.database_url = Some("postgres://postgres:postgres@localhost/aether".to_string());
+        args.data.redis_url = Some("redis://127.0.0.1/0".to_string());
+
+        let config = args.runtime_state_config(
+            RuntimeBackendArg::Redis,
+            args.data.effective_redis_url().as_deref(),
+        );
+
+        assert_eq!(
+            config
+                .redis
+                .as_ref()
+                .expect("redis should be configured for runtime state")
+                .url,
+            "redis://127.0.0.1/0"
+        );
+    }
+
     #[test]
     fn redis_url_defaults_to_redis_runtime_backend_for_server_database() {
         let args = test_args();

apps/aether-gateway/src/maintenance/runtime/pool_quota_probe.rs

@@ -1,10 +1,10 @@
 use std::collections::BTreeMap;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
-use aether_data::driver::redis::{RedisKvRunner, RedisLockLease, RedisLockRunner};
 use aether_data_contracts::repository::provider_catalog::{
     StoredProviderCatalogEndpoint, StoredProviderCatalogKey, StoredProviderCatalogProvider,
 };
+use aether_runtime_state::{RuntimeLockLease, RuntimeState};
 use serde_json::Value;
 use tracing::{debug, info, warn};
 
@@ -177,31 +177,20 @@ fn probe_stamp_key(provider_id: &str, key_id: &str) -> String {
 }
 
 async fn load_probe_timestamps(
-    runner: Option<&RedisKvRunner>,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_ids: &[String],
 ) -> BTreeMap<String, u64> {
-    let Some(runner) = runner else {
-        return BTreeMap::new();
-    };
     if key_ids.is_empty() {
         return BTreeMap::new();
     }
 
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        debug!("gateway pool quota probe: failed to connect redis for stamp read");
-        return BTreeMap::new();
-    };
-    let redis_keys = key_ids
+    let runtime_keys = key_ids
         .iter()
-        .map(|key_id| runner.keyspace().key(&probe_stamp_key(provider_id, key_id)))
+        .map(|key_id| probe_stamp_key(provider_id, key_id))
         .collect::<Vec<_>>();
-    let Ok(values) = redis::cmd("MGET")
-        .arg(redis_keys)
-        .query_async::<Vec<Option<String>>>(&mut connection)
-        .await
-    else {
-        debug!("gateway pool quota probe: failed to read redis probe stamps");
+    let Ok(values) = runtime.kv_get_many(&runtime_keys).await else {
+        debug!("gateway pool quota probe: failed to read runtime probe stamps");
         return BTreeMap::new();
     };
 
@@ -215,55 +204,43 @@ async fn load_probe_timestamps(
 }
 
 async fn mark_probe_timestamps(
-    runner: Option<&RedisKvRunner>,
+    runtime: &RuntimeState,
     provider_id: &str,
     key_ids: &[String],
     now_ts: u64,
     interval_seconds: u64,
 ) {
-    let Some(runner) = runner else {
-        return;
-    };
     if key_ids.is_empty() {
         return;
     }
 
-    let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await else {
-        debug!("gateway pool quota probe: failed to connect redis for stamp write");
-        return;
-    };
     let ttl_seconds = interval_seconds.saturating_mul(2).max(120);
     let value = now_ts.to_string();
-    let mut pipeline = redis::pipe();
     for key_id in key_ids {
-        pipeline
-            .cmd("SETEX")
-            .arg(runner.keyspace().key(&probe_stamp_key(provider_id, key_id)))
-            .arg(ttl_seconds)
-            .arg(&value)
-            .ignore();
-    }
-    if pipeline.query_async::<()>(&mut connection).await.is_err() {
-        debug!("gateway pool quota probe: failed to write redis probe stamps");
+        if runtime
+            .kv_set(
+                &probe_stamp_key(provider_id, key_id),
+                value.clone(),
+                Some(Duration::from_secs(ttl_seconds)),
+            )
+            .await
+            .is_err()
+        {
+            debug!("gateway pool quota probe: failed to write runtime probe stamp");
+        }
     }
 }
 
 async fn acquire_provider_probe_lock(
-    runner: Option<&RedisLockRunner>,
+    runtime: &RuntimeState,
     provider_id: &str,
-) -> Option<RedisLockLease> {
-    let Some(runner) = runner else {
-        return None;
-    };
-    let lock_key = runner
-        .keyspace()
-        .lock_key(&format!("pool_quota_probe:{provider_id}"));
+) -> Option<RuntimeLockLease> {
     let owner = format!("aether-gateway-pool-probe-{}", std::process::id());
-    match runner
-        .try_acquire(
-            &lock_key,
+    match runtime
+        .lock_try_acquire(
+            &format!("pool_quota_probe:{provider_id}"),
             &owner,
-            Some(POOL_QUOTA_PROBE_PROVIDER_LOCK_TTL_MS),
+            Duration::from_millis(POOL_QUOTA_PROBE_PROVIDER_LOCK_TTL_MS),
         )
         .await
     {
@@ -272,40 +249,36 @@ async fn acquire_provider_probe_lock(
             debug!(
                 provider_id,
                 error = %err,
-                "gateway pool quota probe: failed to acquire redis provider lock"
+                "gateway pool quota probe: failed to acquire runtime provider lock"
             );
             None
         }
     }
 }
 
-async fn release_provider_probe_lock(
-    runner: Option<&RedisLockRunner>,
-    lease: Option<RedisLockLease>,
-) {
-    let (Some(runner), Some(lease)) = (runner, lease) else {
+async fn release_provider_probe_lock(runtime: &RuntimeState, lease: Option<RuntimeLockLease>) {
+    let Some(lease) = lease else {
         return;
     };
-    if let Err(err) = runner.release(&lease).await {
+    if let Err(err) = runtime.lock_release(&lease).await {
         debug!(
             error = %err,
-            "gateway pool quota probe: failed to release redis provider lock"
+            "gateway pool quota probe: failed to release runtime provider lock"
         );
     }
 }
 
 async fn select_keys_for_provider(
     state: &AppState,
-    redis_kv: Option<&RedisKvRunner>,
-    redis_lock: Option<&RedisLockRunner>,
+    runtime: &RuntimeState,
     provider: &StoredProviderCatalogProvider,
     provider_type: &str,
     interval_seconds: u64,
     max_keys_per_provider: usize,
     now_ts: u64,
 ) -> Result<Vec<StoredProviderCatalogKey>, GatewayError> {
-    let lease = acquire_provider_probe_lock(redis_lock, &provider.id).await;
-    if redis_lock.is_some() && lease.is_none() {
+    let lease = acquire_provider_probe_lock(runtime, &provider.id).await;
+    if lease.is_none() {
         return Ok(Vec::new());
     }
 
@@ -321,7 +294,7 @@ async fn select_keys_for_provider(
         }
 
         let key_ids = keys.iter().map(|key| key.id.clone()).collect::<Vec<_>>();
-        let probe_stamps = load_probe_timestamps(redis_kv, &provider.id, &key_ids).await;
+        let probe_stamps = load_probe_timestamps(runtime, &provider.id, &key_ids).await;
         let selected_ids = select_pool_quota_probe_key_ids(
             &keys,
             provider_type,
@@ -335,7 +308,7 @@ async fn select_keys_for_provider(
         }
 
         mark_probe_timestamps(
-            redis_kv,
+            runtime,
             &provider.id,
             &selected_ids,
             now_ts,
@@ -354,7 +327,7 @@ async fn select_keys_for_provider(
     }
     .await;
 
-    release_provider_probe_lock(redis_lock, lease).await;
+    release_provider_probe_lock(runtime, lease).await;
     result
 }
 
@@ -461,8 +434,6 @@ pub(crate) async fn perform_pool_quota_probe_once_with_config(
             .push(endpoint);
     }
 
-    let redis_kv = state.redis_kv_runner();
-    let redis_lock = state.data.oauth_refresh_lock_runner();
     let admin_state = AdminAppState::new(state);
     let now_ts = now_unix_secs();
     let mut summary = PoolQuotaProbeRunSummary {
@@ -487,8 +458,7 @@ pub(crate) async fn perform_pool_quota_probe_once_with_config(
         let interval_seconds = interval_minutes.clamp(1, 1440).saturating_mul(60);
         let keys = select_keys_for_provider(
             state,
-            redis_kv.as_ref(),
-            redis_lock.as_ref(),
+            state.runtime_state.as_ref(),
             &provider,
             &provider_type,
             interval_seconds,

apps/aether-gateway/src/oauth/state_store.rs

@@ -75,19 +75,9 @@ pub(crate) async fn save_identity_oauth_state(
     let key = identity_oauth_state_storage_key(&record.nonce);
     let value =
         serde_json::to_string(record).map_err(|err| GatewayError::Internal(err.to_string()))?;
-    if let Some(runner) = state.redis_kv_runner() {
-        runner
-            .setex(&key, &value, Some(IDENTITY_OAUTH_STATE_TTL_SECS))
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        return Ok(());
-    }
-    if state.save_provider_oauth_state_for_tests(&key, &value) {
-        return Ok(());
-    }
-    Err(GatewayError::Internal(
-        "identity oauth state store unavailable".to_string(),
-    ))
+    state
+        .runtime_kv_setex(&key, &value, IDENTITY_OAUTH_STATE_TTL_SECS)
+        .await
 }
 
 pub(crate) async fn consume_identity_oauth_state(
@@ -95,21 +85,7 @@ pub(crate) async fn consume_identity_oauth_state(
     nonce: &str,
 ) -> Result<Option<StoredIdentityOAuthState>, GatewayError> {
     let key = identity_oauth_state_storage_key(nonce);
-    let raw = if let Some(runner) = state.redis_kv_runner() {
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        let namespaced_key = runner.keyspace().key(&key);
-        redis::cmd("GETDEL")
-            .arg(&namespaced_key)
-            .query_async::<Option<String>>(&mut connection)
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?
-    } else {
-        state.take_provider_oauth_state_for_tests(&key)
-    };
+    let raw = state.runtime_kv_getdel(&key).await?;
     raw.map(|value| {
         serde_json::from_str::<StoredIdentityOAuthState>(&value)
             .map_err(|err| GatewayError::Internal(err.to_string()))

apps/aether-gateway/src/orchestration/effects.rs

@@ -96,7 +96,6 @@ pub(crate) enum LocalExecutionEffect<'a> {
 }
 
 struct PoolFeedbackContext {
-    runner: aether_data::driver::redis::RedisKvRunner,
     pool_config: AdminProviderPoolConfig,
     sticky_session_token: Option<String>,
 }
@@ -251,10 +250,6 @@ async fn resolve_pool_feedback_context(
     state: &AppState,
     context: LocalExecutionEffectContext<'_>,
 ) -> Option<PoolFeedbackContext> {
-    let Some(runner) = state.redis_kv_runner() else {
-        return None;
-    };
-
     let plan = context.plan;
     let transport = match state
         .read_provider_transport_snapshot(&plan.provider_id, &plan.endpoint_id, &plan.key_id)
@@ -281,7 +276,6 @@ async fn resolve_pool_feedback_context(
         .and_then(extract_pool_sticky_session_token);
 
     Some(PoolFeedbackContext {
-        runner,
         pool_config,
         sticky_session_token,
     })
@@ -333,7 +327,7 @@ async fn record_sync_pool_success_effect(
     let usage_outcome =
         build_sync_terminal_usage_outcome(context.plan, context.report_context, payload);
     record_admin_provider_pool_success(
-        &pool_context.runner,
+        state.runtime_state.as_ref(),
         &context.plan.provider_id,
         &context.plan.key_id,
         &pool_context.pool_config,
@@ -552,7 +546,7 @@ async fn record_stream_pool_success_effect(
     let usage_outcome =
         build_stream_terminal_usage_outcome(context.plan, context.report_context, payload);
     record_admin_provider_pool_success(
-        &pool_context.runner,
+        state.runtime_state.as_ref(),
         &context.plan.provider_id,
         &context.plan.key_id,
         &pool_context.pool_config,
@@ -588,7 +582,7 @@ async fn record_pool_error_effect(
     }
 
     record_admin_provider_pool_error(
-        &pool_context.runner,
+        state.runtime_state.as_ref(),
         &context.plan.provider_id,
         &context.plan.key_id,
         &pool_context.pool_config,
@@ -747,7 +741,7 @@ async fn record_pool_stream_timeout_effect(
     };
 
     record_admin_provider_pool_stream_timeout(
-        &pool_context.runner,
+        state.runtime_state.as_ref(),
         &context.plan.provider_id,
         &context.plan.key_id,
         &pool_context.pool_config,

apps/aether-gateway/src/rate_limit.rs

@@ -4,56 +4,13 @@ use std::sync::Mutex as StdMutex;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use aether_cache::ExpiringMap;
-use redis::Script;
+use aether_runtime_state::{RateLimitCheck, RateLimitInput, RateLimitScope};
 use tokio::sync::Mutex;
 use tracing::warn;
 
 use crate::control::GatewayControlDecision;
 use crate::{AppState, GatewayError};
 
-const RPM_CHECK_AND_CONSUME_SCRIPT: &str = r#"
-local user_key = KEYS[1]
-local key_key = KEYS[2]
-local user_limit = tonumber(ARGV[1])
-local key_limit = tonumber(ARGV[2])
-local ttl = tonumber(ARGV[3])
-local retry_after = tonumber(ARGV[4])
-
-local user_count = 0
-if user_limit > 0 then
-    user_count = tonumber(redis.call('GET', user_key) or '0')
-    if user_count >= user_limit then
-        return {0, 1, user_limit, 0, retry_after}
-    end
-end
-
-local key_count = 0
-if key_limit > 0 then
-    key_count = tonumber(redis.call('GET', key_key) or '0')
-    if key_count >= key_limit then
-        return {0, 2, key_limit, 0, retry_after}
-    end
-end
-
-local remaining = -1
-if user_limit > 0 then
-    user_count = redis.call('INCR', user_key)
-    redis.call('EXPIRE', user_key, ttl)
-    remaining = user_limit - user_count
-end
-
-if key_limit > 0 then
-    key_count = redis.call('INCR', key_key)
-    redis.call('EXPIRE', key_key, ttl)
-    local key_remaining = key_limit - key_count
-    if remaining == -1 or key_remaining < remaining then
-        remaining = key_remaining
-    end
-end
-
-return {1, 0, 0, remaining, 0}
-"#;
-
 const SYSTEM_RPM_CONFIG_KEY: &str = "rate_limit_per_minute";
 const SYSTEM_RPM_CONFIG_CACHE_TTL: Duration = Duration::from_secs(15);
 const SYSTEM_RPM_CONFIG_CACHE_MAX_ENTRIES: usize = 8;
@@ -189,19 +146,11 @@ impl FrontdoorUserRpmLimiter {
         scope_key: &str,
         bucket: u64,
     ) -> Result<u32, GatewayError> {
-        if let Some(runner) = state.redis_kv_runner() {
-            let mut connection = runner
-                .client()
-                .get_multiplexed_async_connection()
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            let namespaced_key = runner.keyspace().key(scope_key);
-            let raw = redis::cmd("GET")
-                .arg(&namespaced_key)
-                .query_async::<Option<u32>>(&mut connection)
-                .await
-                .map_err(|err| GatewayError::Internal(err.to_string()))?;
-            return Ok(raw.unwrap_or(0));
+        if !state.runtime_state.is_memory() {
+            let raw = state.runtime_state.kv_get(scope_key).await.map_err(|err| {
+                GatewayError::Internal(format!("frontdoor user rpm runtime read failed: {err}"))
+            })?;
+            return Ok(raw.and_then(|value| value.parse::<u32>().ok()).unwrap_or(0));
         }
 
         let counts = self.memory_counts.lock().await;
@@ -234,8 +183,8 @@ impl FrontdoorUserRpmLimiter {
             return Ok(FrontdoorUserRpmOutcome::Allowed);
         }
 
-        if let Some(runner) = state.data.kv_runner() {
-            match self.check_and_consume_redis(&runner, &plan).await {
+        if !state.runtime_state.is_memory() {
+            match self.check_and_consume_runtime(state, &plan).await {
                 Ok(outcome) => return Ok(outcome),
                 Err(err) => {
                     warn!(
@@ -249,7 +198,7 @@ impl FrontdoorUserRpmLimiter {
                     }
                     if !self.config.allow_local_fallback() {
                         return Err(GatewayError::Internal(
-                            "frontdoor user rpm redis backend is unavailable and local fallback is disabled for the current deployment mode".to_string(),
+                            "frontdoor user rpm runtime backend is unavailable and local fallback is disabled for the current deployment mode".to_string(),
                         ));
                     }
                 }
@@ -261,7 +210,8 @@ impl FrontdoorUserRpmLimiter {
                 return Ok(FrontdoorUserRpmOutcome::NotApplicable);
             }
             return Err(GatewayError::Internal(
-                "frontdoor user rpm requires redis in the current deployment mode".to_string(),
+                "frontdoor user rpm requires shared runtime state in the current deployment mode"
+                    .to_string(),
             ));
         }
 
@@ -306,59 +256,39 @@ impl FrontdoorUserRpmLimiter {
         self
     }
 
-    async fn check_and_consume_redis(
+    async fn check_and_consume_runtime(
         &self,
-        runner: &aether_data::driver::redis::RedisKvRunner,
+        state: &AppState,
         plan: &RpmPlan,
     ) -> Result<FrontdoorUserRpmOutcome, GatewayError> {
-        let user_key = runner.keyspace().key(&plan.user_rpm_key);
-        let key_key = runner.keyspace().key(&plan.key_rpm_key);
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
-            .await
-            .map_err(|err| GatewayError::Internal(err.to_string()))?;
-        let raw_result: Vec<i64> = Script::new(RPM_CHECK_AND_CONSUME_SCRIPT)
-            .key(user_key)
-            .key(key_key)
-            .arg(i64::from(plan.user_rpm_limit))
-            .arg(i64::from(plan.key_rpm_limit))
-            .arg(i64::try_from(self.config.key_ttl_seconds()).unwrap_or(i64::MAX))
-            .arg(i64::try_from(plan.retry_after).unwrap_or(i64::MAX))
-            .invoke_async::<Vec<i64>>(&mut connection)
+        let result = state
+            .runtime_state
+            .check_and_consume_rate_limit(RateLimitInput {
+                user_key: &plan.user_rpm_key,
+                key_key: &plan.key_rpm_key,
+                bucket: plan.bucket,
+                user_limit: plan.user_rpm_limit,
+                key_limit: plan.key_rpm_limit,
+                ttl_seconds: self.config.key_ttl_seconds(),
+            })
             .await
             .map_err(|err| GatewayError::Internal(err.to_string()))?;
 
-        let allowed = raw_result.first().copied().unwrap_or_default() == 1;
-        if allowed {
+        if matches!(result, RateLimitCheck::Allowed { .. }) {
             return Ok(FrontdoorUserRpmOutcome::Allowed);
         }
 
-        let scope = match raw_result.get(1).copied().unwrap_or_default() {
-            2 => "key",
-            _ => "user",
+        let RateLimitCheck::Rejected { scope, limit } = result else {
+            unreachable!("allowed returned above");
         };
-        let limit = raw_result
-            .get(2)
-            .copied()
-            .and_then(|value| u32::try_from(value).ok())
-            .unwrap_or_else(|| {
-                if scope == "key" {
-                    plan.key_rpm_limit
-                } else {
-                    plan.user_rpm_limit
-                }
-            });
-        let retry_after = raw_result
-            .get(4)
-            .copied()
-            .and_then(|value| u64::try_from(value).ok())
-            .unwrap_or(plan.retry_after);
         Ok(FrontdoorUserRpmOutcome::Rejected(
             FrontdoorUserRpmRejection {
-                scope,
+                scope: match scope {
+                    RateLimitScope::User => "user",
+                    RateLimitScope::Key => "key",
+                },
                 limit,
-                retry_after,
+                retry_after: plan.retry_after,
             },
         ))
     }
@@ -630,7 +560,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn limiter_rejects_missing_redis_when_local_fallback_disabled() {
+    async fn limiter_rejects_missing_shared_runtime_when_local_fallback_disabled() {
         let limiter = FrontdoorUserRpmLimiter::new(
             FrontdoorUserRpmConfig::new(60, 120, false).with_local_fallback(false),
         );
@@ -652,10 +582,10 @@ mod tests {
         let err = limiter
             .check_and_consume(&state, Some(&decision))
             .await
-            .expect_err("missing redis should fail in strict mode");
+            .expect_err("missing shared runtime should fail in strict mode");
         match err {
             crate::GatewayError::Internal(message) => {
-                assert!(message.contains("requires redis"));
+                assert!(message.contains("requires shared runtime state"));
             }
             other => panic!("expected internal error, got {other:?}"),
         }

apps/aether-gateway/src/router.rs

@@ -9,7 +9,8 @@ use tower::ServiceExt;
 use tower_http::services::{ServeDir, ServeFile};
 use tracing::warn;
 
-use aether_runtime::{prometheus_response, ConcurrencyError, DistributedConcurrencyError};
+use aether_runtime::{prometheus_response, ConcurrencyError};
+use aether_runtime_state::RuntimeSemaphoreError;
 
 use super::{api, handlers::proxy::proxy_request, middleware, state::AppState};
 
@@ -124,7 +125,7 @@ pub(crate) async fn metrics(
 #[derive(Debug)]
 pub(crate) enum RequestAdmissionError {
     Local(ConcurrencyError),
-    Distributed(DistributedConcurrencyError),
+    Distributed(RuntimeSemaphoreError),
 }
 
 pub async fn serve_tcp(bind: &str) -> Result<(), Box<dyn std::error::Error>> {

apps/aether-gateway/src/state/app.rs

@@ -2,7 +2,8 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::sync::Mutex as StdMutex;
 
-use aether_runtime::{ConcurrencyGate, DistributedConcurrencyGate};
+use aether_runtime::ConcurrencyGate;
+use aether_runtime_state::{RuntimeSemaphore, RuntimeState};
 
 use super::super::async_task::{VideoTaskPollerConfig, VideoTaskService};
 use super::super::cache::{
@@ -47,11 +48,12 @@ pub struct AppState {
     #[cfg(test)]
     pub(crate) execution_runtime_sync_override: Option<TestExecutionRuntimeSyncOverride>,
     pub(crate) data: Arc<GatewayDataState>,
+    pub(crate) runtime_state: Arc<RuntimeState>,
     pub(crate) usage_runtime: Arc<usage::UsageRuntime>,
     pub(crate) video_tasks: Arc<VideoTaskService>,
     pub(crate) video_task_poller: Option<VideoTaskPollerConfig>,
     pub(crate) request_gate: Option<Arc<ConcurrencyGate>>,
-    pub(crate) distributed_request_gate: Option<Arc<DistributedConcurrencyGate>>,
+    pub(crate) distributed_request_gate: Option<Arc<RuntimeSemaphore>>,
     pub(crate) client: reqwest::Client,
     pub(crate) auth_context_cache: Arc<AuthContextCache>,
     pub(crate) auth_api_key_last_used_cache: Arc<AuthApiKeyLastUsedCache>,

apps/aether-gateway/src/state/core.rs

@@ -9,9 +9,12 @@ use aether_data::repository::proxy_nodes::{
 };
 use aether_http::{build_http_client, HttpClientConfig};
 use aether_runtime::{
-    service_up_sample, AdmissionPermit, ConcurrencyGate, ConcurrencySnapshot,
-    DistributedConcurrencyError, DistributedConcurrencyGate, DistributedConcurrencySnapshot,
-    MetricKind, MetricLabel, MetricSample,
+    service_up_sample, AdmissionPermit, ConcurrencyGate, ConcurrencySnapshot, MetricKind,
+    MetricLabel, MetricSample,
+};
+use aether_runtime_state::{
+    MemoryRuntimeStateConfig, RuntimeQueueStore, RuntimeSemaphore, RuntimeSemaphoreError,
+    RuntimeSemaphoreSnapshot, RuntimeState,
 };
 use aether_scheduler_core::PROVIDER_KEY_RPM_WINDOW_SECS;
 use tokio::task::JoinHandle;
@@ -53,21 +56,32 @@ use crate::maintenance::spawn_wallet_daily_usage_aggregation_worker;
 const SYSTEM_CONFIG_CACHE_TTL: Duration = Duration::from_secs(3);
 
 impl AppState {
+    fn usage_worker_queue_for(
+        runtime_state: &Arc<RuntimeState>,
+    ) -> Option<Arc<dyn RuntimeQueueStore>> {
+        if runtime_state.is_redis() {
+            let queue: Arc<dyn RuntimeQueueStore> = runtime_state.clone();
+            Some(queue)
+        } else {
+            None
+        }
+    }
+
     fn spawn_scheduler_affinity_redis_write(
         &self,
         cache_key: &str,
         target: &SchedulerAffinityTarget,
         ttl: Duration,
     ) {
-        let Some(runner) = self.redis_kv_runner() else {
+        if self.runtime_state.is_memory() {
             return;
-        };
+        }
         let Ok(handle) = tokio::runtime::Handle::try_current() else {
             return;
         };
 
         let cache_key = cache_key.to_string();
-        let namespaced_cache_key = runner.keyspace().key(&cache_key);
+        let runtime_state = self.runtime_state.clone();
         let provider_id = target.provider_id.clone();
         let endpoint_id = target.endpoint_id.clone();
         let key_id = target.key_id.clone();
@@ -76,56 +90,55 @@ impl AppState {
         let expire_at = now_unix_secs.saturating_add(ttl_seconds);
 
         handle.spawn(async move {
-            let Ok(mut connection) = runner.client().get_multiplexed_async_connection().await
-            else {
-                return;
-            };
-            let script = r#"
-local existing = redis.call('GET', KEYS[1])
-local request_count = 0
-local created_at = tonumber(ARGV[4])
-if existing then
-  local ok, payload = pcall(cjson.decode, existing)
-  if ok and type(payload) == 'table' then
-    if type(payload['request_count']) == 'number' then
-      request_count = payload['request_count']
-    end
-    if type(payload['created_at']) == 'number' then
-      created_at = payload['created_at']
-    end
-  end
-end
-request_count = request_count + 1
-local payload = {
-  provider_id = ARGV[1],
-  endpoint_id = ARGV[2],
-  key_id = ARGV[3],
-  created_at = created_at,
-  expire_at = tonumber(ARGV[5]),
-  request_count = request_count
-}
-redis.call('SETEX', KEYS[1], tonumber(ARGV[6]), cjson.encode(payload))
-return request_count
-"#;
-            let _ = redis::cmd("EVAL")
-                .arg(script)
-                .arg(1)
-                .arg(&namespaced_cache_key)
-                .arg(&provider_id)
-                .arg(&endpoint_id)
-                .arg(&key_id)
-                .arg(now_unix_secs)
-                .arg(expire_at)
-                .arg(ttl_seconds)
-                .query_async::<i64>(&mut connection)
-                .await;
+            let existing = runtime_state
+                .kv_get(&cache_key)
+                .await
+                .ok()
+                .flatten()
+                .and_then(|raw| serde_json::from_str::<serde_json::Value>(&raw).ok());
+            let request_count = existing
+                .as_ref()
+                .and_then(|value| value.get("request_count"))
+                .and_then(serde_json::Value::as_u64)
+                .unwrap_or_default()
+                .saturating_add(1);
+            let created_at = existing
+                .as_ref()
+                .and_then(|value| value.get("created_at"))
+                .and_then(serde_json::Value::as_u64)
+                .unwrap_or(now_unix_secs);
+            let payload = serde_json::json!({
+                "provider_id": provider_id,
+                "endpoint_id": endpoint_id,
+                "key_id": key_id,
+                "created_at": created_at,
+                "expire_at": expire_at,
+                "request_count": request_count,
+            });
+            if let Ok(serialized) = serde_json::to_string(&payload) {
+                let _ = runtime_state
+                    .kv_set(
+                        &cache_key,
+                        serialized,
+                        Some(Duration::from_secs(ttl_seconds)),
+                    )
+                    .await;
+            }
         });
     }
 
     pub(crate) fn replace_data_state(&mut self, data: Arc<GatewayDataState>) {
         self.clear_provider_transport_snapshot_cache();
         self.system_config_cache.clear();
-        self.tunnel = crate::tunnel::EmbeddedTunnelState::with_data(Arc::clone(&data));
+        let data = Arc::new(
+            (*data)
+                .clone()
+                .with_usage_worker_queue(Self::usage_worker_queue_for(&self.runtime_state)),
+        );
+        self.tunnel = crate::tunnel::EmbeddedTunnelState::with_data_and_runtime_state(
+            Arc::clone(&data),
+            self.runtime_state.clone(),
+        );
         self.data = data;
     }
 
@@ -153,7 +166,11 @@ return request_count
     }
 
     fn build(execution_runtime_override_base_url: Option<String>) -> Result<Self, reqwest::Error> {
-        let data = Arc::new(GatewayDataState::disabled());
+        let runtime_state = Arc::new(RuntimeState::memory(MemoryRuntimeStateConfig::default()));
+        let data = Arc::new(
+            GatewayDataState::disabled()
+                .with_usage_worker_queue(Self::usage_worker_queue_for(&runtime_state)),
+        );
         let client = build_http_client(&HttpClientConfig {
             connect_timeout_ms: Some(10_000),
             request_timeout_ms: Some(300_000),
@@ -168,6 +185,7 @@ return request_count
             #[cfg(test)]
             execution_runtime_sync_override: None,
             data: Arc::clone(&data),
+            runtime_state: runtime_state.clone(),
             usage_runtime: Arc::new(usage::UsageRuntime::disabled()),
             video_tasks: Arc::new(VideoTaskService::new(
                 VideoTaskTruthSourceMode::PythonSyncReport,
@@ -188,7 +206,10 @@ return request_count
             frontdoor_user_rpm: Arc::new(FrontdoorUserRpmLimiter::new(
                 FrontdoorUserRpmConfig::default(),
             )),
-            tunnel: crate::tunnel::EmbeddedTunnelState::with_data(data),
+            tunnel: crate::tunnel::EmbeddedTunnelState::with_data_and_runtime_state(
+                data,
+                runtime_state.clone(),
+            ),
             provider_transport_snapshot_cache: Arc::new(StdMutex::new(HashMap::new())),
             provider_key_rpm_resets: Arc::new(StdMutex::new(HashMap::new())),
             local_execution_runtime_miss_diagnostics: Arc::new(StdMutex::new(HashMap::new())),
@@ -261,11 +282,12 @@ return request_count
         instance_id: impl Into<String>,
         relay_base_url: Option<impl Into<String>>,
     ) -> Self {
-        self.tunnel = crate::tunnel::EmbeddedTunnelState::with_data_and_identity(
+        self.tunnel = crate::tunnel::EmbeddedTunnelState::with_data_identity_and_runtime_state(
             Arc::clone(&self.data),
             instance_id,
             relay_base_url,
             90,
+            self.runtime_state.clone(),
         );
         self
     }
@@ -334,10 +356,21 @@ return request_count
         self
     }
 
-    pub fn with_distributed_request_concurrency_gate(
-        mut self,
-        gate: DistributedConcurrencyGate,
-    ) -> Self {
+    pub fn with_runtime_state(mut self, runtime_state: Arc<RuntimeState>) -> Self {
+        self.runtime_state = runtime_state;
+        self.data = Arc::new(
+            (*self.data)
+                .clone()
+                .with_usage_worker_queue(Self::usage_worker_queue_for(&self.runtime_state)),
+        );
+        self.tunnel = crate::tunnel::EmbeddedTunnelState::with_data_and_runtime_state(
+            Arc::clone(&self.data),
+            self.runtime_state.clone(),
+        );
+        self
+    }
+
+    pub fn with_distributed_request_concurrency_gate(mut self, gate: RuntimeSemaphore) -> Self {
         self.distributed_request_gate = Some(Arc::new(gate));
         self
     }
@@ -624,7 +657,7 @@ return request_count
 
     pub(crate) async fn distributed_request_concurrency_snapshot(
         &self,
-    ) -> Result<Option<DistributedConcurrencySnapshot>, DistributedConcurrencyError> {
+    ) -> Result<Option<RuntimeSemaphoreSnapshot>, RuntimeSemaphoreError> {
         match self.distributed_request_gate.as_ref() {
             Some(gate) => gate.snapshot().await.map(Some),
             None => Ok(None),
@@ -767,11 +800,62 @@ return request_count
     }
 
     pub fn has_redis_data_backend(&self) -> bool {
-        self.data.has_redis_backend()
+        self.runtime_state.is_redis()
     }
 
-    pub(crate) fn redis_kv_runner(&self) -> Option<aether_data::driver::redis::RedisKvRunner> {
-        self.data.kv_runner()
+    pub(crate) fn runtime_state_backend(&self) -> &'static str {
+        self.runtime_state.backend_kind().as_str()
+    }
+
+    pub fn runtime_state(&self) -> &RuntimeState {
+        self.runtime_state.as_ref()
+    }
+
+    pub(crate) async fn runtime_kv_setex(
+        &self,
+        key: &str,
+        value: &str,
+        ttl_seconds: u64,
+    ) -> Result<(), GatewayError> {
+        self.runtime_state
+            .kv_set(
+                key,
+                value.to_string(),
+                Some(Duration::from_secs(ttl_seconds)),
+            )
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
+    pub(crate) async fn runtime_kv_get(&self, key: &str) -> Result<Option<String>, GatewayError> {
+        self.runtime_state
+            .kv_get(key)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
+    pub(crate) async fn runtime_kv_getdel(
+        &self,
+        key: &str,
+    ) -> Result<Option<String>, GatewayError> {
+        self.runtime_state
+            .kv_take(key)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
+    pub(crate) async fn runtime_kv_del(&self, key: &str) -> Result<bool, GatewayError> {
+        self.runtime_state
+            .kv_delete(key)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
+    pub(crate) async fn runtime_kv_exists(&self, key: &str) -> Result<bool, GatewayError> {
+        self.runtime_state
+            .kv_exists(key)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
     pub(crate) fn remove_scheduler_affinity_cache_entry(&self, cache_key: &str) -> bool {

apps/aether-gateway/src/state/integrations.rs

@@ -159,19 +159,19 @@ impl ModelFetchRuntimeState for AppState {
         key_id: &str,
         cached_models: &[Value],
     ) {
-        let Some(runner) = AppState::redis_kv_runner(self) else {
-            return;
-        };
         let Ok(serialized) = serde_json::to_string(&aggregate_models_for_cache(cached_models))
         else {
             return;
         };
         let cache_key = format!("upstream_models:{provider_id}:{key_id}");
-        if let Err(err) = runner
-            .setex(
+        if let Err(err) = self
+            .runtime_state
+            .kv_set(
                 &cache_key,
-                &serialized,
-                Some(model_fetch_interval_minutes().saturating_mul(60)),
+                serialized,
+                Some(std::time::Duration::from_secs(
+                    model_fetch_interval_minutes().saturating_mul(60),
+                )),
             )
             .await
         {

apps/aether-gateway/src/state/oauth.rs

@@ -833,7 +833,7 @@ impl AppState {
         &self,
         transport: &provider_transport::GatewayProviderTransportSnapshot,
     ) -> Result<Option<provider_transport::LocalResolvedOAuthRequestAuth>, GatewayError> {
-        let distributed_lock = self.data.oauth_refresh_lock_runner();
+        let distributed_lock = self.runtime_state.as_ref();
         let lock_owner = format!("aether-gateway-{}", std::process::id());
         let mut current_transport = transport.clone();
         let executor = GatewayLocalOAuthHttpExecutor { state: self };
@@ -844,7 +844,7 @@ impl AppState {
                 .resolve_with_result(
                     &executor,
                     &current_transport,
-                    distributed_lock.as_ref(),
+                    Some(distributed_lock),
                     Some(lock_owner.as_str()),
                 )
                 .await
@@ -929,7 +929,7 @@ impl AppState {
         Option<provider_transport::CachedOAuthEntry>,
         provider_transport::LocalOAuthRefreshError,
     > {
-        let distributed_lock = self.data.oauth_refresh_lock_runner();
+        let distributed_lock = self.runtime_state.as_ref();
         let lock_owner = format!("aether-gateway-admin-{}", std::process::id());
         let mut current_transport = transport.clone();
         current_transport.key.decrypted_api_key = "__placeholder__".to_string();
@@ -958,7 +958,7 @@ impl AppState {
                 .force_refresh_with_result(
                     &executor,
                     &current_transport,
-                    distributed_lock.as_ref(),
+                    Some(distributed_lock),
                     Some(lock_owner.as_str()),
                 )
                 .await?;

apps/aether-gateway/src/state/runtime/gemini_files.rs

@@ -77,16 +77,21 @@ impl AppState {
         value: &str,
         ttl_seconds: u64,
     ) -> Result<(), GatewayError> {
-        self.data
-            .cache_set_string_with_ttl(key, value, ttl_seconds)
+        self.runtime_state
+            .kv_set(
+                key,
+                value.to_string(),
+                Some(std::time::Duration::from_secs(ttl_seconds)),
+            )
             .await
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
     pub(crate) async fn cache_delete_key(&self, key: &str) -> Result<(), GatewayError> {
-        self.data
-            .cache_delete_key(key)
+        self.runtime_state
+            .kv_delete(key)
             .await
+            .map(|_| ())
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 }

apps/aether-gateway/src/state/runtime/mod.rs

@@ -67,7 +67,7 @@ impl AppState {
     }
 
     pub fn has_usage_worker_backend(&self) -> bool {
-        self.data.has_usage_worker_runner()
+        self.data.has_usage_worker_queue()
     }
 
     pub fn has_wallet_data_reader(&self) -> bool {

apps/aether-gateway/src/state/runtime/security.rs

@@ -10,41 +10,16 @@ impl AppState {
     ) -> Result<bool, GatewayError> {
         const ADMIN_SECURITY_BLACKLIST_PREFIX: &str = "ip:blacklist:";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            let key = runner
-                .keyspace()
-                .key(&format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}{ip_address}"));
-            let result = if let Some(ttl_seconds) = ttl_seconds {
-                redis::cmd("SETEX")
-                    .arg(&key)
-                    .arg(ttl_seconds)
-                    .arg(reason)
-                    .query_async::<String>(&mut connection)
-                    .await
-            } else {
-                redis::cmd("SET")
-                    .arg(&key)
-                    .arg(reason)
-                    .query_async::<String>(&mut connection)
-                    .await
-            };
-            return Ok(result.is_ok());
-        }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_blacklist_store.as_ref() {
-            store
-                .lock()
-                .expect("admin security blacklist store should lock")
-                .insert(ip_address.to_string(), reason.to_string());
-            return Ok(true);
-        }
-
-        Ok(false)
+        let key = format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}{ip_address}");
+        self.runtime_state
+            .kv_set(
+                &key,
+                reason.to_string(),
+                ttl_seconds.map(std::time::Duration::from_secs),
+            )
+            .await
+            .map(|_| true)
+            .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
     pub(crate) async fn remove_admin_security_blacklist(
@@ -53,36 +28,11 @@ impl AppState {
     ) -> Result<bool, GatewayError> {
         const ADMIN_SECURITY_BLACKLIST_PREFIX: &str = "ip:blacklist:";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            let key = runner
-                .keyspace()
-                .key(&format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}{ip_address}"));
-            let deleted = match redis::cmd("DEL")
-                .arg(&key)
-                .query_async::<i64>(&mut connection)
-                .await
-            {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            return Ok(deleted > 0);
-        }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_blacklist_store.as_ref() {
-            let removed = store
-                .lock()
-                .expect("admin security blacklist store should lock")
-                .remove(ip_address)
-                .is_some();
-            return Ok(removed);
-        }
-
-        Ok(false)
+        let key = format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}{ip_address}");
+        self.runtime_state
+            .kv_delete(&key)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
     pub(crate) async fn admin_security_blacklist_stats(
@@ -90,48 +40,13 @@ impl AppState {
     ) -> Result<(bool, usize, Option<String>), GatewayError> {
         const ADMIN_SECURITY_BLACKLIST_PREFIX: &str = "ip:blacklist:";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok((false, 0, Some("Redis 不可用".to_string()))),
-            };
-            let pattern = runner
-                .keyspace()
-                .key(&format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}*"));
-            let mut cursor = 0u64;
-            let mut total = 0usize;
-            loop {
-                let (next_cursor, keys) = match redis::cmd("SCAN")
-                    .arg(cursor)
-                    .arg("MATCH")
-                    .arg(&pattern)
-                    .arg("COUNT")
-                    .arg(100)
-                    .query_async::<(u64, Vec<String>)>(&mut connection)
-                    .await
-                {
-                    Ok(value) => value,
-                    Err(err) => return Ok((false, 0, Some(err.to_string()))),
-                };
-                total += keys.len();
-                if next_cursor == 0 {
-                    break;
-                }
-                cursor = next_cursor;
-            }
-            return Ok((true, total, None));
-        }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_blacklist_store.as_ref() {
-            let total = store
-                .lock()
-                .expect("admin security blacklist store should lock")
-                .len();
-            return Ok((true, total, None));
-        }
-
-        Ok((false, 0, Some("Redis 不可用".to_string())))
+        let total = self
+            .runtime_state
+            .scan_keys(&format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}*"), 100)
+            .await
+            .map(|keys| keys.len())
+            .map_err(|err| GatewayError::Internal(err.to_string()))?;
+        Ok((true, total, None))
     }
 
     pub(crate) async fn list_admin_security_blacklist(
@@ -139,83 +54,40 @@ impl AppState {
     ) -> Result<Vec<AdminSecurityBlacklistEntry>, GatewayError> {
         const ADMIN_SECURITY_BLACKLIST_PREFIX: &str = "ip:blacklist:";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok(Vec::new()),
+        let keys = self
+            .runtime_state
+            .scan_keys(&format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}*"), 100)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))?;
+        let mut entries = Vec::new();
+        for full_key in keys {
+            let raw_key = self.runtime_state.strip_namespace(&full_key);
+            let ip_address = raw_key
+                .strip_prefix(ADMIN_SECURITY_BLACKLIST_PREFIX)
+                .unwrap_or(raw_key)
+                .to_string();
+            let Some(reason) = self
+                .runtime_state
+                .kv_get(raw_key)
+                .await
+                .map_err(|err| GatewayError::Internal(err.to_string()))?
+            else {
+                continue;
             };
-            let pattern = runner
-                .keyspace()
-                .key(&format!("{ADMIN_SECURITY_BLACKLIST_PREFIX}*"));
-            let prefix = runner.keyspace().key(ADMIN_SECURITY_BLACKLIST_PREFIX);
-            let mut cursor = 0u64;
-            let mut entries = Vec::new();
-            loop {
-                let (next_cursor, keys) = match redis::cmd("SCAN")
-                    .arg(cursor)
-                    .arg("MATCH")
-                    .arg(&pattern)
-                    .arg("COUNT")
-                    .arg(100)
-                    .query_async::<(u64, Vec<String>)>(&mut connection)
-                    .await
-                {
-                    Ok(value) => value,
-                    Err(_) => break,
-                };
-                for full_key in keys {
-                    let ip_address = full_key
-                        .strip_prefix(prefix.as_str())
-                        .map(|value| value.to_string())
-                        .unwrap_or_else(|| full_key.clone());
-                    let reason: Result<String, _> = redis::cmd("GET")
-                        .arg(&full_key)
-                        .query_async(&mut connection)
-                        .await;
-                    let reason = match reason {
-                        Ok(value) => value,
-                        Err(_) => continue,
-                    };
-                    let ttl = match redis::cmd("TTL")
-                        .arg(&full_key)
-                        .query_async::<i64>(&mut connection)
-                        .await
-                    {
-                        Ok(value) if value >= 0 => Some(value),
-                        _ => None,
-                    };
-                    entries.push(AdminSecurityBlacklistEntry {
-                        ip_address,
-                        reason,
-                        ttl_seconds: ttl,
-                    });
-                }
-                if next_cursor == 0 {
-                    break;
-                }
-                cursor = next_cursor;
-            }
-            entries.sort_by(|a, b| a.ip_address.cmp(&b.ip_address));
-            return Ok(entries);
+            let ttl_seconds = self
+                .runtime_state
+                .kv_ttl_seconds(raw_key)
+                .await
+                .map_err(|err| GatewayError::Internal(err.to_string()))?
+                .filter(|ttl| *ttl >= 0);
+            entries.push(AdminSecurityBlacklistEntry {
+                ip_address,
+                reason,
+                ttl_seconds,
+            });
         }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_blacklist_store.as_ref() {
-            let mut entries = store
-                .lock()
-                .expect("admin security blacklist store should lock")
-                .iter()
-                .map(|(ip, reason)| AdminSecurityBlacklistEntry {
-                    ip_address: ip.clone(),
-                    reason: reason.clone(),
-                    ttl_seconds: None,
-                })
-                .collect::<Vec<_>>();
-            entries.sort_by(|a, b| a.ip_address.cmp(&b.ip_address));
-            return Ok(entries);
-        }
-
-        Ok(Vec::new())
+        entries.sort_by(|a, b| a.ip_address.cmp(&b.ip_address));
+        Ok(entries)
     }
 
     pub(crate) async fn add_admin_security_whitelist(
@@ -224,34 +96,11 @@ impl AppState {
     ) -> Result<bool, GatewayError> {
         const ADMIN_SECURITY_WHITELIST_KEY: &str = "ip:whitelist";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            let key = runner.keyspace().key(ADMIN_SECURITY_WHITELIST_KEY);
-            let added = match redis::cmd("SADD")
-                .arg(&key)
-                .arg(ip_address)
-                .query_async::<i64>(&mut connection)
-                .await
-            {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            return Ok(added >= 0);
-        }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_whitelist_store.as_ref() {
-            store
-                .lock()
-                .expect("admin security whitelist store should lock")
-                .insert(ip_address.to_string());
-            return Ok(true);
-        }
-
-        Ok(false)
+        self.runtime_state
+            .set_add(ADMIN_SECURITY_WHITELIST_KEY, ip_address)
+            .await
+            .map(|_| true)
+            .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
     pub(crate) async fn remove_admin_security_whitelist(
@@ -260,67 +109,18 @@ impl AppState {
     ) -> Result<bool, GatewayError> {
         const ADMIN_SECURITY_WHITELIST_KEY: &str = "ip:whitelist";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            let key = runner.keyspace().key(ADMIN_SECURITY_WHITELIST_KEY);
-            let removed = match redis::cmd("SREM")
-                .arg(&key)
-                .arg(ip_address)
-                .query_async::<i64>(&mut connection)
-                .await
-            {
-                Ok(value) => value,
-                Err(_) => return Ok(false),
-            };
-            return Ok(removed > 0);
-        }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_whitelist_store.as_ref() {
-            let removed = store
-                .lock()
-                .expect("admin security whitelist store should lock")
-                .remove(ip_address);
-            return Ok(removed);
-        }
-
-        Ok(false)
+        self.runtime_state
+            .set_remove(ADMIN_SECURITY_WHITELIST_KEY, ip_address)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
     pub(crate) async fn list_admin_security_whitelist(&self) -> Result<Vec<String>, GatewayError> {
         const ADMIN_SECURITY_WHITELIST_KEY: &str = "ip:whitelist";
 
-        if let Some(runner) = self.redis_kv_runner() {
-            let mut connection = match runner.client().get_multiplexed_async_connection().await {
-                Ok(value) => value,
-                Err(_) => return Ok(Vec::new()),
-            };
-            let key = runner.keyspace().key(ADMIN_SECURITY_WHITELIST_KEY);
-            let mut whitelist = match redis::cmd("SMEMBERS")
-                .arg(&key)
-                .query_async::<Vec<String>>(&mut connection)
-                .await
-            {
-                Ok(value) => value,
-                Err(_) => return Ok(Vec::new()),
-            };
-            whitelist.sort();
-            return Ok(whitelist);
-        }
-
-        #[cfg(test)]
-        if let Some(store) = self.admin_security_whitelist_store.as_ref() {
-            return Ok(store
-                .lock()
-                .expect("admin security whitelist store should lock")
-                .iter()
-                .cloned()
-                .collect());
-        }
-
-        Ok(Vec::new())
+        self.runtime_state
+            .set_members(ADMIN_SECURITY_WHITELIST_KEY)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 }

apps/aether-gateway/src/state/testing.rs

@@ -1,5 +1,6 @@
 use std::collections::HashMap;
 use std::sync::{Arc, Mutex as StdMutex};
+use std::time::Duration;
 
 use aether_contracts::{ExecutionPlan, ExecutionResult};
 use aether_data_contracts::repository::candidates::RequestCandidateReadRepository;
@@ -207,6 +208,13 @@ impl AppState {
             .lock()
             .expect("provider oauth state store should lock")
             .insert(format!("provider_oauth_state:{nonce}"), payload.to_string());
+        self.runtime_state.kv_set_local_nowait(
+            &format!("provider_oauth_state:{nonce}"),
+            payload.to_string(),
+            Some(Duration::from_secs(
+                aether_data::repository::provider_oauth::PROVIDER_OAUTH_STATE_TTL_SECS,
+            )),
+        );
         self
     }
 
@@ -225,6 +233,11 @@ impl AppState {
                 format!("device_auth_session:{session_id}"),
                 payload.to_string(),
             );
+        self.runtime_state.kv_set_local_nowait(
+            &format!("device_auth_session:{session_id}"),
+            payload.to_string(),
+            Some(Duration::from_secs(3600)),
+        );
         self
     }
 
@@ -243,6 +256,13 @@ impl AppState {
                 format!("provider_oauth_batch_task:{task_id}"),
                 payload.to_string(),
             );
+        self.runtime_state.kv_set_local_nowait(
+            &format!("provider_oauth_batch_task:{task_id}"),
+            payload.to_string(),
+            Some(Duration::from_secs(
+                aether_data::repository::provider_oauth::PROVIDER_OAUTH_BATCH_TASK_TTL_SECS,
+            )),
+        );
         self
     }
 
@@ -417,6 +437,11 @@ impl AppState {
             .lock()
             .expect("admin security blacklist store should lock");
         for (ip_address, reason) in entries {
+            self.runtime_state.kv_set_local_nowait(
+                &format!("ip:blacklist:{ip_address}"),
+                reason.clone(),
+                None,
+            );
             guard.insert(ip_address, reason);
         }
         drop(guard);
@@ -434,6 +459,8 @@ impl AppState {
             .lock()
             .expect("admin security whitelist store should lock");
         for ip_address in entries {
+            self.runtime_state
+                .set_add_local_nowait("ip:whitelist", &ip_address);
             guard.insert(ip_address);
         }
         drop(guard);
@@ -552,6 +579,15 @@ impl AppState {
                 })
                 .to_string(),
             );
+        self.runtime_state.kv_set_local_nowait(
+            &format!("email:verification:{}", email.trim().to_ascii_lowercase()),
+            json!({
+                "code": code,
+                "created_at": created_at.to_rfc3339(),
+            })
+            .to_string(),
+            Some(Duration::from_secs(600)),
+        );
         self
     }
 
@@ -566,6 +602,11 @@ impl AppState {
                 format!("email:verified:{}", email.trim().to_ascii_lowercase()),
                 "verified".to_string(),
             );
+        self.runtime_state.kv_set_local_nowait(
+            &format!("email:verified:{}", email.trim().to_ascii_lowercase()),
+            "verified".to_string(),
+            Some(Duration::from_secs(3600)),
+        );
         self
     }
 

apps/aether-gateway/src/tests/architecture/runtime_and_security.rs

@@ -2,6 +2,15 @@ use std::path::{Path, PathBuf};
 
 use super::*;
 
+fn production_workspace_source(path: &Path) -> String {
+    let source = std::fs::read_to_string(path).expect("source file should be readable");
+    source
+        .split("#[cfg(test)]")
+        .next()
+        .unwrap_or(&source)
+        .to_string()
+}
+
 #[test]
 fn gateway_small_runtime_shims_stay_deleted() {
     for path in [
@@ -79,6 +88,120 @@ fn gateway_small_runtime_shims_stay_deleted() {
     }
 }
 
+#[test]
+fn runtime_state_owns_redis_runtime_boundaries() {
+    let forbidden_business_patterns = [
+        "use redis::",
+        "redis::cmd",
+        "::redis::cmd",
+        "::redis::Script",
+        "aether_data::driver::redis",
+        "RedisKvRunner",
+        "RedisLockRunner",
+        "RedisStreamRunner",
+        "redis_kv_runner(",
+    ];
+    let mut violations = Vec::new();
+    for root in [
+        "apps/aether-gateway/src",
+        "crates/aether-runtime/src",
+        "crates/aether-usage-runtime/src",
+        "crates/aether-provider-transport/src",
+    ] {
+        for path in collect_workspace_rust_files(root) {
+            if path
+                .components()
+                .any(|component| component.as_os_str() == "tests")
+            {
+                continue;
+            }
+            let source = production_workspace_source(&path);
+            let hits = forbidden_business_patterns
+                .iter()
+                .filter(|pattern| source.contains(**pattern))
+                .copied()
+                .collect::<Vec<_>>();
+            if !hits.is_empty() {
+                violations.push(format!("{} -> {}", path.display(), hits.join(", ")));
+            }
+        }
+    }
+    assert!(
+        violations.is_empty(),
+        "business/runtime crates must use aether-runtime-state instead of Redis directly:\n{}",
+        violations.join("\n")
+    );
+
+    let mut runtime_state_violations = Vec::new();
+    for path in collect_workspace_rust_files("crates/aether-runtime-state/src") {
+        if path
+            .components()
+            .any(|component| component.as_os_str() == "redis")
+        {
+            continue;
+        }
+        let source = production_workspace_source(&path);
+        let hits = [
+            "use redis::",
+            "redis::cmd",
+            "::redis::cmd",
+            "::redis::Script",
+        ]
+        .iter()
+        .filter(|pattern| source.contains(**pattern))
+        .copied()
+        .collect::<Vec<_>>();
+        if !hits.is_empty() {
+            runtime_state_violations.push(format!("{} -> {}", path.display(), hits.join(", ")));
+        }
+    }
+    assert!(
+        runtime_state_violations.is_empty(),
+        "only crates/aether-runtime-state/src/redis may depend on the redis crate directly:\n{}",
+        runtime_state_violations.join("\n")
+    );
+}
+
+#[test]
+fn aether_data_stays_free_of_redis_runtime_backends() {
+    let cargo = read_workspace_file("crates/aether-data/Cargo.toml");
+    assert!(
+        !cargo.contains("redis.workspace"),
+        "aether-data should not depend on redis; runtime Redis belongs to aether-runtime-state"
+    );
+
+    for removed_path in [
+        "crates/aether-data/src/backend/redis.rs",
+        "crates/aether-data/src/backend/locks.rs",
+        "crates/aether-data/src/backend/workers.rs",
+        "crates/aether-data/src/driver/redis/mod.rs",
+    ] {
+        assert!(
+            !workspace_file_exists(removed_path),
+            "{removed_path} should stay removed from aether-data"
+        );
+    }
+
+    for path in collect_workspace_rust_files("crates/aether-data/src") {
+        let source = production_workspace_source(&path);
+        for forbidden in [
+            "pub mod redis",
+            "driver::redis",
+            "RedisBackend",
+            "DataLockBackends",
+            "DataWorkerBackends",
+            "redis::cmd",
+            "use redis::",
+        ] {
+            assert!(
+                !source.contains(forbidden),
+                "{} should not keep Redis runtime backend surface {forbidden}",
+                path.display()
+            );
+        }
+    }
+}
+
 #[test]
 fn gateway_request_candidate_trace_type_is_owned_by_aether_data_contracts() {
     let gateway_candidates = read_workspace_file("apps/aether-gateway/src/data/candidates.rs");

apps/aether-gateway/src/tests/concurrency.rs

@@ -17,9 +17,18 @@ use aether_data::repository::candidate_selection::InMemoryMinimalCandidateSelect
 use aether_data::repository::candidates::InMemoryRequestCandidateRepository;
 use aether_data::repository::provider_catalog::InMemoryProviderCatalogReadRepository;
 use aether_data::repository::usage::InMemoryUsageReadRepository;
+use aether_runtime_state::{
+    MemoryRuntimeStateConfig, RuntimeSemaphore, RuntimeSemaphoreConfig, RuntimeState,
+};
 
 use crate::data::GatewayDataState;
 
+fn memory_runtime_semaphore(gate: &'static str, limit: usize) -> RuntimeSemaphore {
+    RuntimeState::memory(MemoryRuntimeStateConfig::default())
+        .semaphore(gate, limit, RuntimeSemaphoreConfig::default())
+        .expect("memory runtime semaphore should build")
+}
+
 fn sample_decision() -> crate::control::GatewayControlDecision {
     crate::control::GatewayControlDecision {
         public_path: "/v1/chat/completions".to_string(),
@@ -104,10 +113,7 @@ async fn gateway_rejects_second_in_flight_stream_request_with_distributed_overlo
     );
 
     let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
-    let distributed_gate = aether_runtime::DistributedConcurrencyGate::new_in_memory(
-        "gateway_requests_distributed",
-        1,
-    );
+    let distributed_gate = memory_runtime_semaphore("gateway_requests_distributed", 1);
     let gateway_a = build_router_with_state(
         build_local_openai_gateway_state(execution_runtime_url.clone())
             .with_distributed_request_concurrency_gate(distributed_gate.clone()),
@@ -262,12 +268,10 @@ async fn gateway_exposes_request_concurrency_metrics() {
         AppState::new()
             .expect("gateway state should build")
             .with_request_concurrency_limit(3)
-            .with_distributed_request_concurrency_gate(
-                aether_runtime::DistributedConcurrencyGate::new_in_memory(
-                    "gateway_requests_distributed",
-                    5,
-                ),
-            ),
+            .with_distributed_request_concurrency_gate(memory_runtime_semaphore(
+                "gateway_requests_distributed",
+                5,
+            )),
     );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
 

apps/aether-gateway/src/tests/control/admin/models/external.rs

@@ -130,7 +130,7 @@ async fn gateway_clears_admin_external_models_cache_locally_with_trusted_admin_p
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["cleared"], false);
-    assert_eq!(payload["message"], "Redis 未启用");
+    assert_eq!(payload["message"], "缓存不存在");
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();

apps/aether-gateway/src/tests/control/admin/monitoring.rs

@@ -1307,9 +1307,11 @@ async fn gateway_handles_admin_monitoring_cache_redis_keys_delete_locally_with_t
         .await
         .expect("request should succeed");
 
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    assert_eq!(payload["detail"], json!("Redis 未启用"));
+    assert_eq!(payload["status"], json!("ok"));
+    assert_eq!(payload["category"], json!("upstream_models"));
+    assert_eq!(payload["deleted_count"], json!(0));
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -1485,11 +1487,9 @@ async fn gateway_handles_admin_monitoring_model_mapping_stats_locally_with_trust
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["status"], json!("ok"));
-    assert_eq!(payload["data"]["available"], json!(false));
-    assert_eq!(
-        payload["data"]["message"],
-        json!("Redis 未启用，模型映射缓存不可用")
-    );
+    assert_eq!(payload["data"]["available"], json!(true));
+    assert_eq!(payload["data"]["backend"], json!("memory"));
+    assert_eq!(payload["data"]["total_keys"], json!(0));
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -1707,8 +1707,9 @@ async fn gateway_handles_admin_monitoring_redis_keys_locally_with_trusted_admin_
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["status"], json!("ok"));
-    assert_eq!(payload["data"]["available"], json!(false));
-    assert_eq!(payload["data"]["message"], json!("Redis 未启用"));
+    assert_eq!(payload["data"]["available"], json!(true));
+    assert_eq!(payload["data"]["backend"], json!("memory"));
+    assert_eq!(payload["data"]["total_keys"], json!(0));
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -1118,9 +1118,16 @@ async fn gateway_handles_admin_provider_oauth_start_key_locally_with_trusted_adm
         .await
         .expect("request should succeed");
 
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    assert_eq!(payload["detail"], "provider oauth redis unavailable");
+    assert_eq!(payload["provider_type"], "codex");
+    assert_eq!(
+        payload["redirect_uri"],
+        "http://localhost:1455/auth/callback"
+    );
+    assert!(payload["authorization_url"]
+        .as_str()
+        .is_some_and(|url| url.contains("state=")));
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -1174,9 +1181,16 @@ async fn gateway_handles_admin_provider_oauth_start_provider_locally_with_truste
         .await
         .expect("request should succeed");
 
-    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    assert_eq!(payload["detail"], "provider oauth redis unavailable");
+    assert_eq!(payload["provider_type"], "codex");
+    assert_eq!(
+        payload["redirect_uri"],
+        "http://localhost:1455/auth/callback"
+    );
+    assert!(payload["authorization_url"]
+        .as_str()
+        .is_some_and(|url| url.contains("state=")));
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();

apps/aether-gateway/src/tests/control/admin/provider_ops.rs

@@ -9,6 +9,7 @@ use aether_crypto::{
 use aether_data::repository::provider_catalog::InMemoryProviderCatalogReadRepository;
 use aether_data::repository::proxy_nodes::InMemoryProxyNodeRepository;
 use aether_data_contracts::repository::provider_catalog::ProviderCatalogReadRepository;
+use aether_runtime_state::{RedisClientConfig, RuntimeState};
 use aether_testkit::ManagedRedisServer;
 use axum::body::to_bytes;
 use axum::body::Body;
@@ -42,6 +43,23 @@ async fn start_managed_redis_or_skip() -> Option<ManagedRedisServer> {
     }
 }
 
+async fn redis_runtime_state_for_test(
+    redis: &ManagedRedisServer,
+    key_prefix: &str,
+) -> Arc<RuntimeState> {
+    Arc::new(
+        RuntimeState::redis(
+            RedisClientConfig {
+                url: redis.redis_url().to_string(),
+                key_prefix: Some(key_prefix.to_string()),
+            },
+            None,
+        )
+        .await
+        .expect("redis runtime state should build"),
+    )
+}
+
 #[tokio::test]
 async fn gateway_handles_admin_provider_ops_architectures_locally_with_trusted_admin_principal() {
     let upstream_hits = Arc::new(Mutex::new(0usize));
@@ -3529,16 +3547,16 @@ async fn gateway_handles_admin_provider_ops_balance_cache_refresh_modes_with_red
         vec![],
     ));
     let data_state = GatewayDataState::from_config(
-        GatewayDataConfig::disabled()
-            .with_redis_url(redis.redis_url(), Some("provider_ops_balance_cache"))
-            .with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
+        GatewayDataConfig::disabled().with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
     )
     .expect("data state should build")
     .attach_provider_catalog_repository_for_tests(Arc::clone(&provider_catalog_repository));
+    let runtime_state = redis_runtime_state_for_test(&redis, "provider_ops_balance_cache").await;
     let gateway = build_router_with_state(
         AppState::new()
             .expect("gateway should build")
-            .with_data_state_for_tests(data_state),
+            .with_data_state_for_tests(data_state)
+            .with_runtime_state(runtime_state),
     );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
     let client = reqwest::Client::new();
@@ -3683,19 +3701,17 @@ async fn gateway_handles_admin_provider_ops_balance_cache_miss_without_refresh_r
         vec![],
     ));
     let data_state = GatewayDataState::from_config(
-        GatewayDataConfig::disabled()
-            .with_redis_url(
-                redis.redis_url(),
-                Some("provider_ops_balance_cache_sync_miss"),
-            )
-            .with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
+        GatewayDataConfig::disabled().with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
     )
     .expect("data state should build")
     .attach_provider_catalog_repository_for_tests(Arc::clone(&provider_catalog_repository));
+    let runtime_state =
+        redis_runtime_state_for_test(&redis, "provider_ops_balance_cache_sync_miss").await;
     let gateway = build_router_with_state(
         AppState::new()
             .expect("gateway should build")
-            .with_data_state_for_tests(data_state),
+            .with_data_state_for_tests(data_state)
+            .with_runtime_state(runtime_state),
     );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
     let client = reqwest::Client::new();
@@ -3841,19 +3857,17 @@ async fn gateway_clears_admin_provider_ops_balance_cache_after_config_save_with_
         vec![],
     ));
     let data_state = GatewayDataState::from_config(
-        GatewayDataConfig::disabled()
-            .with_redis_url(
-                redis.redis_url(),
-                Some("provider_ops_balance_cache_config_save"),
-            )
-            .with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
+        GatewayDataConfig::disabled().with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
     )
     .expect("data state should build")
     .attach_provider_catalog_repository_for_tests(Arc::clone(&provider_catalog_repository));
+    let runtime_state =
+        redis_runtime_state_for_test(&redis, "provider_ops_balance_cache_config_save").await;
     let gateway = build_router_with_state(
         AppState::new()
             .expect("gateway should build")
-            .with_data_state_for_tests(data_state),
+            .with_data_state_for_tests(data_state)
+            .with_runtime_state(runtime_state),
     );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
     let client = reqwest::Client::new();
@@ -4058,19 +4072,17 @@ async fn gateway_verify_does_not_pollute_balance_cache_and_balance_uses_saved_ac
         vec![],
     ));
     let data_state = GatewayDataState::from_config(
-        GatewayDataConfig::disabled()
-            .with_redis_url(
-                redis.redis_url(),
-                Some("provider_ops_verify_cache_isolation"),
-            )
-            .with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
+        GatewayDataConfig::disabled().with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
     )
     .expect("data state should build")
     .attach_provider_catalog_repository_for_tests(Arc::clone(&provider_catalog_repository));
+    let runtime_state =
+        redis_runtime_state_for_test(&redis, "provider_ops_verify_cache_isolation").await;
     let gateway = build_router_with_state(
         AppState::new()
             .expect("gateway should build")
-            .with_data_state_for_tests(data_state),
+            .with_data_state_for_tests(data_state)
+            .with_runtime_state(runtime_state),
     );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
     let client = reqwest::Client::new();
@@ -4232,16 +4244,16 @@ async fn gateway_handles_admin_provider_ops_batch_balance_with_pending_cache_hit
         vec![],
     ));
     let data_state = GatewayDataState::from_config(
-        GatewayDataConfig::disabled()
-            .with_redis_url(redis.redis_url(), Some("provider_ops_batch_balance"))
-            .with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
+        GatewayDataConfig::disabled().with_encryption_key(DEVELOPMENT_ENCRYPTION_KEY),
     )
     .expect("data state should build")
     .attach_provider_catalog_repository_for_tests(Arc::clone(&provider_catalog_repository));
+    let runtime_state = redis_runtime_state_for_test(&redis, "provider_ops_batch_balance").await;
     let gateway = build_router_with_state(
         AppState::new()
             .expect("gateway should build")
-            .with_data_state_for_tests(data_state),
+            .with_data_state_for_tests(data_state)
+            .with_runtime_state(runtime_state),
     );
     let (gateway_url, gateway_handle) = start_server(gateway).await;
     let client = reqwest::Client::new();

apps/aether-gateway/src/tunnel/embedded/local_relay.rs

@@ -134,16 +134,16 @@ fn map_request_admission_error(error: super::RequestAdmissionError) -> String {
             ..
         })
         | super::RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::Saturated { .. },
+            aether_runtime_state::RuntimeSemaphoreError::Saturated { .. },
         )
         | super::RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::Unavailable { .. },
+            aether_runtime_state::RuntimeSemaphoreError::Unavailable { .. },
         ) => "overloaded: hub relay overloaded".to_string(),
         super::RequestAdmissionError::Local(aether_runtime::ConcurrencyError::Closed {
             ..
         }) => "overloaded: hub relay gate closed".to_string(),
         super::RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::InvalidConfiguration(_),
+            aether_runtime_state::RuntimeSemaphoreError::InvalidConfiguration(_),
         ) => "overloaded: hub relay distributed gate invalid".to_string(),
     }
 }
@@ -174,10 +174,10 @@ pub async fn relay_request(
             ..
         }))
         | Err(super::RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::Saturated { .. },
+            aether_runtime_state::RuntimeSemaphoreError::Saturated { .. },
         ))
         | Err(super::RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::Unavailable { .. },
+            aether_runtime_state::RuntimeSemaphoreError::Unavailable { .. },
         )) => {
             return tunnel_error_response(
                 StatusCode::SERVICE_UNAVAILABLE,
@@ -195,7 +195,7 @@ pub async fn relay_request(
             );
         }
         Err(super::RequestAdmissionError::Distributed(
-            aether_runtime::DistributedConcurrencyError::InvalidConfiguration(_),
+            aether_runtime_state::RuntimeSemaphoreError::InvalidConfiguration(_),
         )) => {
             return tunnel_error_response(
                 StatusCode::SERVICE_UNAVAILABLE,

apps/aether-gateway/src/tunnel/embedded/mod.rs

@@ -8,10 +8,9 @@ use std::sync::Arc;
 
 use aether_runtime::{
     hold_admission_permit_until, prometheus_response, service_up_sample, AdmissionPermit,
-    ConcurrencyError, ConcurrencyGate, ConcurrencySnapshot, DistributedConcurrencyError,
-    DistributedConcurrencyGate, DistributedConcurrencySnapshot, MetricKind, MetricLabel,
-    MetricSample,
+    ConcurrencyError, ConcurrencyGate, ConcurrencySnapshot, MetricKind, MetricLabel, MetricSample,
 };
+use aether_runtime_state::{RuntimeSemaphore, RuntimeSemaphoreError, RuntimeSemaphoreSnapshot};
 use axum::extract::ws::WebSocketUpgrade;
 use axum::extract::State;
 use axum::response::{IntoResponse, Json};
@@ -33,13 +32,13 @@ pub struct AppState {
     pub max_streams: usize,
     data: Arc<GatewayDataState>,
     request_gate: Option<Arc<ConcurrencyGate>>,
-    distributed_request_gate: Option<Arc<DistributedConcurrencyGate>>,
+    distributed_request_gate: Option<Arc<RuntimeSemaphore>>,
 }
 
 #[derive(Debug)]
 enum RequestAdmissionError {
     Local(ConcurrencyError),
-    Distributed(DistributedConcurrencyError),
+    Distributed(RuntimeSemaphoreError),
 }
 
 impl AppState {
@@ -70,7 +69,7 @@ impl AppState {
         self
     }
 
-    pub fn with_distributed_request_gate(mut self, gate: DistributedConcurrencyGate) -> Self {
+    pub fn with_distributed_request_gate(mut self, gate: RuntimeSemaphore) -> Self {
         self.distributed_request_gate = Some(Arc::new(gate));
         self
     }
@@ -81,7 +80,7 @@ impl AppState {
 
     async fn distributed_request_concurrency_snapshot(
         &self,
-    ) -> Result<Option<DistributedConcurrencySnapshot>, DistributedConcurrencyError> {
+    ) -> Result<Option<RuntimeSemaphoreSnapshot>, RuntimeSemaphoreError> {
         match self.distributed_request_gate.as_ref() {
             Some(gate) => gate.snapshot().await.map(Some),
             None => Ok(None),
@@ -225,12 +224,10 @@ pub async fn ws_proxy(
     let request_permit = match state.try_acquire_request_permit().await {
         Ok(permit) => permit,
         Err(RequestAdmissionError::Local(ConcurrencyError::Saturated { .. }))
-        | Err(RequestAdmissionError::Distributed(DistributedConcurrencyError::Saturated {
-            ..
-        }))
-        | Err(RequestAdmissionError::Distributed(DistributedConcurrencyError::Unavailable {
-            ..
-        })) => return axum::http::StatusCode::SERVICE_UNAVAILABLE.into_response(),
+        | Err(RequestAdmissionError::Distributed(RuntimeSemaphoreError::Saturated { .. }))
+        | Err(RequestAdmissionError::Distributed(RuntimeSemaphoreError::Unavailable { .. })) => {
+            return axum::http::StatusCode::SERVICE_UNAVAILABLE.into_response()
+        }
         Err(RequestAdmissionError::Local(ConcurrencyError::Closed { gate })) => {
             warn!(
                 gate = gate,
@@ -238,9 +235,9 @@ pub async fn ws_proxy(
             );
             return axum::http::StatusCode::SERVICE_UNAVAILABLE.into_response();
         }
-        Err(RequestAdmissionError::Distributed(
-            DistributedConcurrencyError::InvalidConfiguration(message),
-        )) => {
+        Err(RequestAdmissionError::Distributed(RuntimeSemaphoreError::InvalidConfiguration(
+            message,
+        ))) => {
             warn!(
                 error = %message,
                 "standalone tunnel relay distributed request gate is invalid"

apps/aether-gateway/src/tunnel/mod.rs

@@ -14,6 +14,7 @@ use aether_data::repository::proxy_nodes::{
     ProxyNodeHeartbeatMutation, ProxyNodeTunnelStatusMutation, StoredProxyNode,
 };
 use aether_runtime::MetricSample;
+use aether_runtime_state::{MemoryRuntimeStateConfig, RuntimeState};
 use async_stream::stream;
 use axum::body::{Body, Bytes};
 use axum::extract::ws::WebSocketUpgrade;
@@ -102,6 +103,7 @@ pub(crate) struct TunnelAttachmentRecord {
 #[derive(Debug, Clone)]
 pub(crate) struct TunnelAttachmentDirectory {
     identity: Arc<TunnelInstanceIdentity>,
+    runtime_state: Arc<RuntimeState>,
 }
 
 impl TunnelAttachmentDirectory {
@@ -118,6 +120,7 @@ impl TunnelAttachmentDirectory {
                     .map(|value| value.clamp(15, 3600))
                     .unwrap_or(DEFAULT_ATTACHMENT_TTL_SECS),
             }),
+            runtime_state: Arc::new(RuntimeState::memory(MemoryRuntimeStateConfig::default())),
         }
     }
 
@@ -132,9 +135,15 @@ impl TunnelAttachmentDirectory {
                 relay_base_url: relay_base_url.map(Into::into),
                 attachment_ttl_secs,
             }),
+            runtime_state: Arc::new(RuntimeState::memory(MemoryRuntimeStateConfig::default())),
         }
     }
 
+    fn with_runtime_state(mut self, runtime_state: Arc<RuntimeState>) -> Self {
+        self.runtime_state = runtime_state;
+        self
+    }
+
     #[cfg(test)]
     pub(crate) fn for_tests(
         instance_id: &str,
@@ -257,7 +266,7 @@ impl TunnelAttachmentDirectory {
         data: &GatewayDataState,
         node_id: &str,
     ) -> Result<Option<TunnelAttachmentRecord>, String> {
-        match self.read_attachment_record_from_redis(data, node_id).await {
+        match self.read_attachment_record_from_runtime(node_id).await {
             Ok(Some(record)) => return Ok(Some(record)),
             Ok(None) => {}
             Err(error) => {
@@ -272,28 +281,18 @@ impl TunnelAttachmentDirectory {
             .await
     }
 
-    async fn read_attachment_record_from_redis(
+    async fn read_attachment_record_from_runtime(
         &self,
-        data: &GatewayDataState,
         node_id: &str,
     ) -> Result<Option<TunnelAttachmentRecord>, String> {
-        let Some(runner) = data.kv_runner() else {
-            return Ok(None);
-        };
-        let mut connection = runner
-            .client()
-            .get_multiplexed_async_connection()
+        let raw = self
+            .runtime_state
+            .kv_get(&tunnel_attachment_redis_key(node_id))
             .await
-            .map_err(|err| format!("attachment redis connect failed: {err}"))?;
-        let namespaced_key = runner.keyspace().key(&tunnel_attachment_redis_key(node_id));
-        let raw = redis::cmd("GET")
-            .arg(&namespaced_key)
-            .query_async::<Option<String>>(&mut connection)
-            .await
-            .map_err(|err| format!("attachment redis read failed: {err}"))?;
+            .map_err(|err| format!("attachment runtime read failed: {err}"))?;
         raw.map(|value| {
             serde_json::from_str::<TunnelAttachmentRecord>(&value)
-                .map_err(|err| format!("invalid redis tunnel attachment record: {err}"))
+                .map_err(|err| format!("invalid runtime tunnel attachment record: {err}"))
         })
         .transpose()
     }
@@ -323,21 +322,20 @@ impl TunnelAttachmentDirectory {
     ) -> Result<(), String> {
         let serialized = serde_json::to_string(record)
             .map_err(|err| format!("attachment serialization failed: {err}"))?;
-        if let Some(runner) = data.kv_runner() {
-            if let Err(error) = runner
-                .setex(
-                    &tunnel_attachment_redis_key(node_id),
-                    &serialized,
-                    Some(self.identity.attachment_ttl_secs),
-                )
-                .await
-            {
-                warn!(
-                    error = %error,
-                    node_id = %node_id,
-                    "failed to write tunnel attachment to redis; keeping system_config shadow only"
-                );
-            }
+        if let Err(error) = self
+            .runtime_state
+            .kv_set(
+                &tunnel_attachment_redis_key(node_id),
+                serialized.clone(),
+                Some(Duration::from_secs(self.identity.attachment_ttl_secs)),
+            )
+            .await
+        {
+            warn!(
+                error = %error,
+                node_id = %node_id,
+                "failed to write tunnel attachment to runtime state; keeping system_config shadow only"
+            );
         }
         let value = serde_json::to_value(record)
             .map_err(|err| format!("attachment serialization failed: {err}"))?;
@@ -352,14 +350,16 @@ impl TunnelAttachmentDirectory {
         data: &GatewayDataState,
         node_id: &str,
     ) -> Result<(), String> {
-        if let Some(runner) = data.kv_runner() {
-            if let Err(error) = runner.del(&tunnel_attachment_redis_key(node_id)).await {
-                warn!(
-                    error = %error,
-                    node_id = %node_id,
-                    "failed to delete tunnel attachment from redis; clearing system_config shadow anyway"
-                );
-            }
+        if let Err(error) = self
+            .runtime_state
+            .kv_delete(&tunnel_attachment_redis_key(node_id))
+            .await
+        {
+            warn!(
+                error = %error,
+                node_id = %node_id,
+                "failed to delete tunnel attachment from runtime state; clearing system_config shadow anyway"
+            );
         }
         data.delete_system_config_value(&tunnel_attachment_key(node_id))
             .await
@@ -396,6 +396,16 @@ impl EmbeddedTunnelState {
         Self::with_data_and_directory(data, TunnelAttachmentDirectory::from_environment())
     }
 
+    pub(crate) fn with_data_and_runtime_state(
+        data: Arc<GatewayDataState>,
+        runtime_state: Arc<RuntimeState>,
+    ) -> Self {
+        Self::with_data_and_directory(
+            data,
+            TunnelAttachmentDirectory::from_environment().with_runtime_state(runtime_state),
+        )
+    }
+
     pub(crate) fn with_data_and_identity(
         data: Arc<GatewayDataState>,
         instance_id: impl Into<String>,
@@ -408,6 +418,20 @@ impl EmbeddedTunnelState {
         )
     }
 
+    pub(crate) fn with_data_identity_and_runtime_state(
+        data: Arc<GatewayDataState>,
+        instance_id: impl Into<String>,
+        relay_base_url: Option<impl Into<String>>,
+        attachment_ttl_secs: u64,
+        runtime_state: Arc<RuntimeState>,
+    ) -> Self {
+        Self::with_data_and_directory(
+            data,
+            TunnelAttachmentDirectory::from_parts(instance_id, relay_base_url, attachment_ttl_secs)
+                .with_runtime_state(runtime_state),
+        )
+    }
+
     pub(crate) fn with_data_and_directory(
         data: Arc<GatewayDataState>,
         attachment_directory: TunnelAttachmentDirectory,