diff --git a/backend/internal/app/cloud_agent_canvas_event_size_test.go b/backend/internal/app/cloud_agent_canvas_event_size_test.go
new file mode 100644
index 000000000..e6c92033f
--- /dev/null
+++ b/backend/internal/app/cloud_agent_canvas_event_size_test.go
@@ -0,0 +1,155 @@
+package app
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"yingce/backend/internal/database"
+	"yingce/backend/internal/model"
+	"yingce/backend/internal/repository"
+)
+
+// TestAgentApprovalLargeCanvasEvent 验证完整审批路径，不只检查事件生成 helper。
+// 所有数据保存在临时数据库中，禁止启动 Pi 或调用收费模型。
+func TestAgentApprovalLargeCanvasEvent(t *testing.T) {
+	for _, large := range []bool{false, true} {
+		name := "small"
+		if large {
+			name = "large"
+		}
+		t.Run(name, func(t *testing.T) {
+			db := agentPermissionsDB(t)
+			if err := db.AutoMigrate(database.Models()...); err != nil {
+				t.Fatal(err)
+			}
+			s := &Service{repo: repository.New(db), dataDir: t.TempDir(), disablePiRuntime: true}
+			if err := os.WriteFile(filepath.Join(s.dataDir, ".settings-key"), make([]byte, 32), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			content := "保留正文"
+			if large {
+				content = strings.Repeat("分镜正文", 18000)
+			}
+			doc := map[string]any{"nodes": []any{map[string]any{"id": "story", "type": "text", "title": "原标题", "content": content}}, "connections": []any{}}
+			raw, err := json.Marshal(doc)
+			if err != nil {
+				t.Fatal(err)
+			}
+			profile := mustEncodeModelCapabilityConfig(t, DefaultModelCapabilityConfigForModel("chat-completion", "text-test"))
+			for _, row := range []any{
+				&model.CanvasProject{ID: "agent-canvas", UserID: "user", PayloadJSON: string(raw)},
+				&model.ModelChannel{ID: "channel", Scope: model.ChannelScopeSystem, Name: "测试", Enabled: true},
+				&model.ChannelModel{ID: "cm", ChannelID: "channel", ModelKey: "text-test", Capability: "text", Protocol: model.ChannelInterfaceChatCompletion, CapabilityConfigJSON: profile, BillingMode: "fixed_request", UnitPriceMicrocredits: 100, PriceConfigured: true, Enabled: true},
+				&model.ChannelModelPriceTier{ID: "tier", ChannelModelID: "cm", SelectorKey: "{}", SelectorJSON: "{}", BillingMode: "fixed_request", UnitPriceMicrocredits: 100, PriceConfigured: true, Enabled: true},
+				&model.CreditAccount{UserID: "user", AvailableMicrocredits: 10000},
+			} {
+				if err := db.Create(row).Error; err != nil {
+					t.Fatal(err)
+				}
+			}
+			req := agentTestRequest()
+			req.PermissionMode = "request_approval"
+			root, err := s.CreateCloudAgentRun("user", req, "")
+			if err != nil {
+				t.Fatal(err)
+			}
+			run, state := agentInterjectionState(t, s, root.ID)
+			call := cloudAgentCall{ID: "rename-story"}
+			call.Function.Name = "canvas_apply_ops"
+			args, err := json.Marshal(map[string]any{"snapshotHash": cloudAgentCanvasHash(doc), "ops": []any{map[string]any{"type": "update_node", "id": "story", "patch": map[string]any{"title": "新标题"}}}})
+			if err != nil {
+				t.Fatal(err)
+			}
+			call.Function.Arguments = string(args)
+			state.Calls = []cloudAgentCall{call}
+			state.CallIndex = 0
+			run.Status = "running"
+			approvalPauseSaveState(t, s, db, run, &state)
+			run, state = agentInterjectionState(t, s, root.ID)
+			if err := s.advanceCloudAgentTool(run, &state); err != nil {
+				t.Fatal(err)
+			}
+			_, state = agentInterjectionState(t, s, root.ID)
+			if state.Approval == nil {
+				t.Fatal("missing approval")
+			}
+			approvalID := state.Approval.ID
+			if err := s.DecideCloudAgentApproval("user", root.ID, approvalID, "approve", ""); err != nil {
+				t.Fatal(err)
+			}
+			_, state = agentInterjectionState(t, s, root.ID)
+			if state.Approval != nil || state.CallIndex != 1 {
+				t.Fatal("approval did not complete")
+			}
+			payload := agentCanvasPatchForOperation(t, state, "canvas_apply_ops")
+			if large {
+				if payload["requiresRefresh"] != true || payload["canvasPatch"] != nil {
+					t.Fatal("large event must request a snapshot refresh")
+				}
+				if len(creationMaps(payload["actions"])) != 1 || payload["preview"] == nil {
+					t.Fatal("refresh notification lost its bounded operation summary")
+				}
+			} else if payload["canvasPatch"] == nil || payload["requiresRefresh"] == true {
+				t.Fatal("small event must retain its delta")
+			}
+			for _, event := range state.Events {
+				body, err := json.Marshal(event.Payload)
+				if err != nil || len(body) > cloudAgentEventPayloadLimit {
+					t.Fatal("event exceeded checkpoint limit")
+				}
+			}
+			canvas, err := s.repo.CanvasProjectForUser("user", "agent-canvas")
+			if err != nil {
+				t.Fatal(err)
+			}
+			after, err := creationDocument(canvas.PayloadJSON)
+			if err != nil {
+				t.Fatal(err)
+			}
+			node := creationMaps(after["nodes"])[0]
+			if node["title"] != "新标题" || node["content"] != content {
+				t.Fatal("saved canvas lost its title or full content")
+			}
+			if canvas.Revision != 2 {
+				t.Fatalf("unexpected canvas revision: %d", canvas.Revision)
+			}
+			// 审批重送必须复用已经完成的结果，不再写一次画布。
+			if err := s.DecideCloudAgentApproval("user", root.ID, approvalID, "approve", ""); err != nil {
+				t.Fatal(err)
+			}
+			canvas, err = s.repo.CanvasProjectForUser("user", "agent-canvas")
+			if err != nil || canvas.Revision != 2 {
+				t.Fatal("duplicate approval changed the canvas")
+			}
+			var mutations int64
+			if err := db.Model(&model.CloudAgentCanvasMutation{}).Where("run_id = ?", root.ID).Count(&mutations).Error; err != nil || mutations != 1 {
+				t.Fatalf("unexpected mutation count: %d, error: %v", mutations, err)
+			}
+		})
+	}
+}
+
+func TestAgentOversizedCanvasPreviewRequestsRefresh(t *testing.T) {
+	db := agentPermissionsDB(t)
+	repo := repository.New(db)
+	canvas := &model.CanvasProject{ID: "canvas", UserID: "user", PayloadJSON: `{"nodes":[],"connections":[]}`}
+	if err := db.Create(canvas).Error; err != nil {
+		t.Fatal(err)
+	}
+	state := cloudAgentRuntime{}
+	input := cloudAgentMutationInput{UserID: "user", CanvasID: canvas.ID, BeforeJSON: canvas.PayloadJSON, Operation: "canvas_apply_ops", Preview: &cloudAgentApprovalPreview{Description: strings.Repeat("摘要", cloudAgentEventPayloadLimit)}}
+	if err := emitCloudAgentCanvasChange(repo, "run", &state, input); err != nil {
+		t.Fatal(err)
+	}
+	payload := agentCanvasPatchForOperation(t, state, input.Operation)
+	if payload["requiresRefresh"] != true || payload["canvasPatch"] != nil || payload["preview"] != nil {
+		t.Fatal("oversized summary must use a bounded refresh notification")
+	}
+	raw, err := json.Marshal(payload)
+	if err != nil || len(raw) > cloudAgentEventPayloadLimit {
+		t.Fatal("refresh notification exceeded the event limit")
+	}
+}
diff --git a/backend/internal/app/cloud_agent_canvas_events.go b/backend/internal/app/cloud_agent_canvas_events.go
index 4b6aca368..dd40aac02 100644
--- a/backend/internal/app/cloud_agent_canvas_events.go
+++ b/backend/internal/app/cloud_agent_canvas_events.go
@@ -1,6 +1,7 @@
 package app
 
 import (
+	"encoding/json"
 	"reflect"
 
 	"yingce/backend/internal/repository"
@@ -85,6 +86,8 @@ func cloudAgentShrinkChange(before, after map[string]any) (map[string]any, map[s
 	return shrunkBefore, shrunkAfter
 }
 
+// emitCloudAgentCanvasChange 生成与画布写入同事务保存的事件。
+// 增量无法完整表达变更或超过事件上限时通知客户端重新读取，不截断真实画布内容。
 func emitCloudAgentCanvasChange(repo *repository.Repository, runID string, state *cloudAgentRuntime, input cloudAgentMutationInput) error {
 	before, err := creationDocument(input.BeforeJSON)
 	if err != nil {
@@ -190,6 +193,24 @@ func emitCloudAgentCanvasChange(repo *repository.Repository, runID string, state
 	if state.CallIndex >= 0 && state.CallIndex < len(state.Calls) {
 		payload["callId"] = state.Calls[state.CallIndex].ID
 	}
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	if len(raw) > cloudAgentEventPayloadLimit {
+		// 修改标题或关联素材也可能携带整份分镜正文的 before/after，导致审批事务回滚。
+		// 大增量沿用已有的快照刷新路径；画布、撤销记录和工具回执仍由原事务完整保存。
+		delete(payload, "canvasPatch")
+		payload["requiresRefresh"] = true
+		raw, err = json.Marshal(payload)
+		if err != nil {
+			return err
+		}
+		if len(raw) > cloudAgentEventPayloadLimit {
+			// 摘要本身也超限时不截断字段，退回既有的完整刷新通知。
+			payload = map[string]any{"canvasId": input.CanvasID, "operation": input.Operation, "requiresRefresh": true}
+		}
+	}
 	state.event(runID, "canvas_updated", payload)
 	return nil
 }
diff --git a/backend/internal/app/cloud_agent_runtime_state.go b/backend/internal/app/cloud_agent_runtime_state.go
index 820b9ab6d..641c86ce4 100644
--- a/backend/internal/app/cloud_agent_runtime_state.go
+++ b/backend/internal/app/cloud_agent_runtime_state.go
@@ -11,6 +11,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log"
 	"sort"
 	"strings"
 	"unicode/utf8"
@@ -19,6 +20,8 @@ import (
 	"yingce/backend/internal/prompts"
 )
 
+const cloudAgentEventPayloadLimit = 128 << 10
+
 func cloudAgentDecode(run *model.CloudAgentExecution) (cloudAgentRuntime, error) {
 	var state cloudAgentRuntime
 	if run == nil || strings.TrimSpace(run.StateJSON) == "" {
@@ -262,7 +265,7 @@ func validateCloudAgentRuntime(run *model.CloudAgentExecution, state *cloudAgent
 			return err
 		}
 		raw, err := json.Marshal(event.Payload)
-		if err != nil || len(raw) > 128<<10 {
+		if err != nil || len(raw) > cloudAgentEventPayloadLimit {
 			return errors.New("Agent runtime event payload is too large")
 		}
 	}
@@ -471,6 +474,9 @@ func cloudAgentSave(run *model.CloudAgentExecution, state *cloudAgentRuntime) er
 	}
 	if run.ID != "" {
 		if err := validateCloudAgentRuntime(run, state); err != nil {
+			// HTTP 日志只记录错误类型；在首次校验失败处保留原因，避免被后续模型错误掩盖。
+			// 不记录完整检查点、提示词或工具参数，日志仅用于定位失败步骤。
+			log.Printf("[Agent] checkpoint validation failed run=%s step=%d call_index=%d: %v", run.ID, state.Step, state.CallIndex, err)
 			return cloudAgentCheckpointFailure("runtime validation", err)
 		}
 		for index, event := range state.Events {
diff --git a/docs/content/docs/backend/http-api.mdx b/docs/content/docs/backend/http-api.mdx
index 7b29608e2..fb276d5e4 100644
--- a/docs/content/docs/backend/http-api.mdx
+++ b/docs/content/docs/backend/http-api.mdx
@@ -5,6 +5,12 @@ description: 信封、错误码与 OpenAPI
 
 # HTTP API 合同
 
+## Agent 画布权限与大事件
+
+自由画布和项目关联画布均使用 `canvas_projects`。Agent 运行时按登录账号和画布 ID 查询归属，不能把所属项目 ID 当作画布 ID；画布不存在、属于其他账号或数据库读取失败时，不声明读写及导出权限。
+
+`canvas_updated` 的画布增量超过单事件 128 KiB 上限时，复用 `requiresRefresh: true` 通知客户端重新读取完整画布，优先保留操作摘要；摘要仍超限则仅发送刷新通知。画布正文、历史和操作回执仍完整保存，普通大小事件继续携带 `canvasPatch`。不提高事件上限、不截断正文、不修改审批暂停或模型调度判断。
+
 ## 注册邮箱等价检查
 
 公开注册与邮箱绑定的唯一性检查将 `gmail.com` 和 `googlemail.com` 视为同一域，移除本地部分的点及 `+` 后缀。例如 `a.b+x@googlemail.com` 与 `ab@gmail.com` 不允许创建两个账号。其他域保留点和 `+`；现有域名白名单规则保持不变。
diff --git a/docs/content/docs/progress/pending-test.mdx b/docs/content/docs/progress/pending-test.mdx
index d2e08f1b6..a54333e64 100644
--- a/docs/content/docs/progress/pending-test.mdx
+++ b/docs/content/docs/progress/pending-test.mdx
@@ -5,6 +5,14 @@ description: 当前项目已实现功能的手工验证清单与未确认边界
 
 # 待测试
 
+## Agent 画布权限与大事件审批
+
+- 已修复：权限查询使用 `canvas_projects`；大画布增量超过事件上限时改为完整快照刷新通知，避免审批执行事务回滚。
+- [x] PostgreSQL 独立临时 schema 验证独立和项目关联画布、跨账号、缺失画布、项目 ID 误用以及数据库读取失败。
+- [x] 专项测试复现修改前大节点审批失败；修改后覆盖完整批准、执行、回执保存、正文保留、重复批准不再写入、小事件保留增量及超大摘要刷新。
+- [x] 本地用户确认原审批失败场景可以继续执行；前端画布事件与版本同步专项测试通过。
+- [ ] 验证跨浏览器、多实例及刷新失败时的恢复；本次不改既有审批恢复和模型调度流程。
+
 ## 复制生图节点后节点消失
 
 - 已修复：副本不再继承原节点的 `generationEffectKeys`，避免普通保存把它误判为未确认的生成结果。图片内容、提示词和参考字段仍保留，原节点不受影响。