diff --git a/client/src/api.ts b/client/src/api.ts
index 2e9dfa0..a196ad1 100644
--- a/client/src/api.ts
+++ b/client/src/api.ts
@@ -60,6 +60,8 @@ http.interceptors.response.use(
       ) {
         err.config._retried = true
         if (await refreshAccessToken()) return http(err.config)
+        // 刷新失败但 refresh token 还在，说明只是网络问题：保留登录，下次请求再试
+        if (hasLogin()) return Promise.reject(err)
       }
       switch (err.response.status) {
         case 401: // 未授权
@@ -277,7 +279,7 @@ export const Submission = {
     username?: string
     user_id?: number
     flag?: string | null
-    zone?: string
+    zone?: string | null
     task_id?: number
     task_type?: string
     score_min?: number
@@ -553,7 +555,11 @@ export const TaskAssets = {
     ).data
   },
   async deleteChallenge(display: number, name: string) {
-    return (await http.delete(`/assets/challenge/${display}/${name}`)).data
+    return (
+      await http.delete(
+        `/assets/challenge/${display}/${encodeURIComponent(name)}`,
+      )
+    ).data
   },
   async listTutorial(display: number): Promise<TaskAsset[]> {
     return (await http.get<TaskAsset[]>(`/assets/tutorial/${display}`)).data
@@ -573,6 +579,10 @@ export const TaskAssets = {
     ).data
   },
   async deleteTutorial(display: number, name: string) {
-    return (await http.delete(`/assets/tutorial/${display}/${name}`)).data
+    return (
+      await http.delete(
+        `/assets/tutorial/${display}/${encodeURIComponent(name)}`,
+      )
+    ).data
   },
 }
diff --git a/client/src/components/ai/PromptHistoryPanel.vue b/client/src/components/ai/PromptHistoryPanel.vue
index 304d7a8..fa05257 100644
--- a/client/src/components/ai/PromptHistoryPanel.vue
+++ b/client/src/components/ai/PromptHistoryPanel.vue
@@ -210,8 +210,15 @@ function selectItem(item: HistoryViewItem) {
   })
 }
 
+// 加载中又要求刷新（比如自动提交了新代码、换了任务），等这次完成后再加载一次
+let reloadAfter = false
+
 async function load(force = true) {
-  if (!props.taskId || loading.value) return
+  if (!props.taskId) return
+  if (loading.value) {
+    reloadAfter = true
+    return
+  }
   if (!force && loadedTaskId === props.taskId) return
   loading.value = true
   try {
@@ -230,6 +237,10 @@ async function load(force = true) {
     loadedTaskId = props.taskId
   } finally {
     loading.value = false
+    if (reloadAfter) {
+      reloadAfter = false
+      load(true)
+    }
   }
 }
 
diff --git a/client/src/components/editor/Toolbar.vue b/client/src/components/editor/Toolbar.vue
index fa6e01e..8c10636 100644
--- a/client/src/components/editor/Toolbar.vue
+++ b/client/src/components/editor/Toolbar.vue
@@ -107,9 +107,13 @@ function handleLogin() {
 }
 
 async function handleLogout() {
-  await Account.logout()
-  user.username = ""
-  user.role = Role.Normal
+  // token 已经先清掉了，退出请求失败（比如断网）界面也要显示为已退出
+  try {
+    await Account.logout()
+  } finally {
+    user.username = ""
+    user.role = Role.Normal
+  }
 }
 </script>
 <style scoped>
diff --git a/client/src/pages/Gradebook.vue b/client/src/pages/Gradebook.vue
index f49b51c..4237a44 100644
--- a/client/src/pages/Gradebook.vue
+++ b/client/src/pages/Gradebook.vue
@@ -317,20 +317,28 @@ async function loadClasses() {
   }
 }
 
+// 快速切换班级时只用最后一次请求的结果
+let loadSeq = 0
+
 async function loadGradebook() {
+  const seq = ++loadSeq
   if (!query.classname) {
     gradebook.value = null
+    loading.value = false
     return
   }
   loading.value = true
   loadError.value = ""
   try {
-    gradebook.value = await Gradebook.get(query)
-    classes.value = gradebook.value.classes
+    const data = await Gradebook.get(query)
+    if (seq !== loadSeq) return
+    gradebook.value = data
+    classes.value = data.classes
   } catch (err: any) {
+    if (seq !== loadSeq) return
     loadError.value = err.response?.data?.detail ?? "成绩册加载失败"
   } finally {
-    loading.value = false
+    if (seq === loadSeq) loading.value = false
   }
 }
 
@@ -358,8 +366,10 @@ watchDebounced(
 )
 
 onMounted(async () => {
+  const before = query.classname
   await loadClasses()
-  await loadGradebook()
+  // loadClasses 选了默认班级时，上面的 watch 已经会加载
+  if (query.classname === before) loadGradebook()
 })
 </script>
 
diff --git a/server/src/routes/files.ts b/server/src/routes/files.ts
index cba4591..16c222d 100644
--- a/server/src/routes/files.ts
+++ b/server/src/routes/files.ts
@@ -1,6 +1,5 @@
 import { Hono } from "hono"
-import { mkdir, rm } from "node:fs/promises"
-import { existsSync } from "node:fs"
+import { mkdir, rename, rm } from "node:fs/promises"
 import { dirname, extname, join, resolve, sep } from "node:path"
 import { config } from "../config"
 import { all, get, run } from "../db"
@@ -22,20 +21,6 @@ export function mediaPath(relative: string) {
   return full
 }
 
-async function saveFile(relative: string, file: File) {
-  let target = relative
-  // 同名文件已存在时加随机后缀（Django 存储的行为）
-  while (existsSync(mediaPath(target))) {
-    const ext = extname(relative)
-    const suffix = Math.random().toString(36).slice(2, 9)
-    target = relative.slice(0, relative.length - ext.length) + "_" + suffix + ext
-  }
-  const full = mediaPath(target)
-  await mkdir(dirname(full), { recursive: true })
-  await Bun.write(full, file)
-  return target
-}
-
 async function formFile(c: Ctx, field: string) {
   const form = await c.req.formData().catch(() => null)
   const value = form?.get(field)
@@ -88,21 +73,35 @@ for (const kind of ["challenge", "tutorial"] as const) {
     if (typeof name !== "string" || !name) {
       throw new ValidationError([{ loc: ["body", "name"], msg: "缺少文件名" }])
     }
-    const existing = get<{ id: number; file: string }>(
-      `SELECT id, file FROM task_taskasset WHERE task_id = $task_id AND name = $name`,
+    // 学生代码按这个名字引用素材（<base href> 指向素材目录），存储的文件名必须和它一致
+    if (name !== validFilename(name) || name.length > 100) {
+      throw new ValidationError([
+        { loc: ["body", "name"], msg: "文件名只能包含字母、数字和 - _ .，最多 100 个字符" },
+      ])
+    }
+    const existing = get<{ file: string }>(
+      `SELECT file FROM task_taskasset WHERE task_id = $task_id AND name = $name`,
       { task_id: task.id, name },
     )
-    if (existing?.file) await rm(mediaPath(existing.file), { force: true })
-    const stored = await saveFile(
-      `tasks/${task.task_type}/${task.display}/${validFilename(name)}`,
-      file,
-    )
+    // 先写临时文件再 rename 覆盖：写失败时旧文件还在，并发上传同名文件也不会留下坏文件
+    const stored = `tasks/${task.task_type}/${task.display}/${name}`
+    const full = mediaPath(stored)
+    const tmp = `${full}.${crypto.randomUUID()}.uploading`
+    await mkdir(dirname(full), { recursive: true })
+    try {
+      await Bun.write(tmp, file)
+      await rename(tmp, full)
+    } finally {
+      await rm(tmp, { force: true })
+    }
     // 上面 await 期间可能有同名上传先写入了，用 upsert 而不是按 existing 选 INSERT / UPDATE
     run(
       `INSERT INTO task_taskasset (name, file, task_id) VALUES ($name, $file, $task_id)
        ON CONFLICT (task_id, name) DO UPDATE SET file = excluded.file`,
       { name, file: stored, task_id: task.id },
     )
+    // 旧数据里同名素材可能存在带随机后缀的文件
+    if (existing?.file && existing.file !== stored) await rm(mediaPath(existing.file), { force: true })
     return c.json(assetOut({ name, file: stored }))
   })
 
diff --git a/server/src/routes/submission.ts b/server/src/routes/submission.ts
index 2936b31..ea76b04 100644
--- a/server/src/routes/submission.ts
+++ b/server/src/routes/submission.ts
@@ -53,9 +53,11 @@ const SUBMISSION_SELECT = `SELECT s.id, s.user_id, u.username, s.task_id, t.disp
     s.view_count, s.created, s.modified,
     (SELECT r.score FROM submission_rating r WHERE r.user_id = $me AND r.submission_id = s.id LIMIT 1) AS my_score`
 
+// +s.task_id：不让 SQLite 从 task_task 出发、用 task_id 单列索引去找提交（那样要回表读
+// html/css/js 大行，6 万条提交时列表要几百毫秒），改走 slim 覆盖索引；按 task_id 筛选不受影响
 const SUBMISSION_FROM = `FROM submission_submission s
   JOIN account_user u ON u.id = s.user_id
-  JOIN task_task t ON t.id = s.task_id`
+  JOIN task_task t ON t.id = +s.task_id`
 
 function submissionOut(s: any) {
   return {
@@ -269,7 +271,8 @@ router.get("/", (c) => {
     score: "s.score ASC",
     "-created": "s.created DESC",
   }
-  const orderBy = orderings[f.ordering ?? ""] ?? "s.created DESC"
+  // 同分、同一时间的提交很多，加上 rowid 让排序唯一，翻页才不会重复或漏掉
+  const orderBy = `${orderings[f.ordering ?? ""] ?? "s.created DESC"}, s.rowid DESC`
   const whereSql = where.length ? `WHERE ${where.join(" AND ")}` : ""
   const { limit, offset } = pageWindow(f)
 
diff --git a/server/src/services/cascade.ts b/server/src/services/cascade.ts
index 615fd1d..09f7314 100644
--- a/server/src/services/cascade.ts
+++ b/server/src/services/cascade.ts
@@ -1,13 +1,17 @@
-import { run } from "../db"
+import { all, run } from "../db"
 
 // Django 的 on_delete=CASCADE 是在应用层做的，这里手动按依赖顺序删除。
 // 调用方负责包在事务里。
 
 export function deleteSubmissions(where: string, params: Record<string, unknown>) {
-  const ids = `SELECT id FROM submission_submission WHERE ${where}`
-  run(`DELETE FROM submission_rating WHERE submission_id IN (${ids})`, params)
-  run(`DELETE FROM submission_submissionaward WHERE submission_id IN (${ids})`, params)
-  run(`DELETE FROM prompt_message WHERE submission_id IN (${ids})`, params)
+  // 先查出 id 再逐个按等值删：prompt_message.submission_id 绝大多数是 NULL，
+  // 统计信息会让 SQLite 觉得这个索引没用，写成 IN (子查询) 时它会扫整张大表（几百毫秒）
+  const ids = all<{ id: string }>(`SELECT id FROM submission_submission WHERE ${where}`, params)
+  for (const { id } of ids) {
+    run(`DELETE FROM submission_rating WHERE submission_id = $id`, { id })
+    run(`DELETE FROM submission_submissionaward WHERE submission_id = $id`, { id })
+    run(`DELETE FROM prompt_message WHERE submission_id = $id`, { id })
+  }
   run(`DELETE FROM submission_submission WHERE ${where}`, params)
 }
 
diff --git a/server/tests/api.test.ts b/server/tests/api.test.ts
index 18886cf..169e5c3 100644
--- a/server/tests/api.test.ts
+++ b/server/tests/api.test.ts
@@ -1,5 +1,10 @@
 import { beforeEach, describe, expect, test } from "bun:test"
 import { get, all } from "../src/db"
+import { app } from "../src/app"
+import { config } from "../src/config"
+import { mkdtemp, readFile, readdir, rm } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
 import { client, freshDb, makeSubmission, makeTask, makeUser, uuid } from "./helpers"
 
 beforeEach(freshDb)
@@ -373,3 +378,40 @@ describe("自由创作", () => {
     expect((await me("POST", "/api/submission/", { task_id: c.task_id })).json.detail).toBe("自由创作不需要提交")
   })
 })
+
+describe("任务素材", () => {
+  test("同名上传原地覆盖，文件名不合法 422", async () => {
+    const media = await mkdtemp(join(tmpdir(), "media-"))
+    const saved = config.mediaRoot
+    config.mediaRoot = media
+    try {
+      makeUser("adm", "admin")
+      makeTask("挑战", "challenge", 3)
+      const adm = await client("adm")
+      const upload = (name: string, body: string) => {
+        const form = new FormData()
+        form.append("name", name)
+        form.append("file", new File([body], "x"))
+        return app.request("/api/assets/challenge/3", {
+          method: "POST",
+          headers: { authorization: `Bearer ${adm.tokens.access_token}` },
+          body: form,
+        })
+      }
+      expect((await upload("a.css", "v1")).status).toBe(200)
+      const res = await upload("a.css", "v2")
+      expect(((await res.json()) as any).url).toBe("/media/tasks/challenge/3/a.css")
+      const dir = join(media, "tasks/challenge/3")
+      expect(await readdir(dir)).toEqual(["a.css"])
+      expect(await readFile(join(dir, "a.css"), "utf8")).toBe("v2")
+      for (const bad of ["a b.png", "../x.png", "a/b.png", "x#.png"]) {
+        expect((await upload(bad, "x")).status).toBe(422)
+      }
+      expect((await adm("DELETE", "/api/assets/challenge/3/a.css")).status).toBe(200)
+      expect(await readdir(dir)).toEqual([])
+    } finally {
+      config.mediaRoot = saved
+      await rm(media, { recursive: true, force: true })
+    }
+  })
+})