本批迁移已完成：

原生化后台只读接口：GET /api/admin/candidates
GET /api/admin/registrations
GET /api/admin/payments

保持超级、校级、班级管理员的数据范围一致。
保持证件号脱敏、审批流、考试科目、缴费信息及座位号前导零兼容。
新增灰度开关：ADMIN_NATIVE_OPERATIONAL_READS_ENABLED=true
归档、审核、缴费更新等写操作暂时继续转发 Node。

scripts/smoke-dotnet-migration.ps1

@@ -442,6 +442,7 @@ try {
         ADMIN_NATIVE_CONFIGURATION_ENABLED = 'true'
         ADMIN_NATIVE_NOTICE_MANAGEMENT_ENABLED = 'true'
         ADMIN_NATIVE_CENTERS_ENABLED = 'true'
+        ADMIN_NATIVE_OPERATIONAL_READS_ENABLED = 'true'
         ADMIN_NATIVE_ALLOW_MEMORY   = 'true'
         LegacyNode__Enabled         = 'true'
         LegacyNode__BaseUrl         = $legacyBaseUrl
@@ -802,6 +803,22 @@ try {
         throw 'Native admins route did not preserve the class-admin boundary'
     }
 
+    $operationalSessions = @(
+        @{ Level = 'super'; Legacy = $session; Native = $nativeSession },
+        @{ Level = 'school'; Legacy = $legacySchoolSession; Native = $nativeSchoolSession },
+        @{ Level = 'class'; Legacy = $legacyClassSession; Native = $nativeClassSession }
+    )
+    foreach ($operationalSession in $operationalSessions) {
+        foreach ($operationalRoute in @('candidates', 'registrations', 'payments')) {
+            $legacyOperationalRead = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/$operationalRoute" -WebSession $operationalSession.Legacy
+            $nativeOperationalRead = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$operationalRoute" -WebSession $operationalSession.Native
+            if ($nativeOperationalRead.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
+                throw "Admin operational route '$operationalRoute' for $($operationalSession.Level) admin did not use ASP.NET Core"
+            }
+            Assert-JsonEquivalent -Expected $legacyOperationalRead.Content -Actual $nativeOperationalRead.Content -Label "Admin operational route '$operationalRoute' for $($operationalSession.Level) admin"
+        }
+    }
+
     $legacyCenters = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/centers" -WebSession $session
     $nativeCenters = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/centers" -WebSession $nativeSession
     if ($nativeCenters.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
@@ -1270,6 +1287,7 @@ try {
         NativeAdminConfiguration = 'passed'
         NativeAdminNoticeManagement = 'passed'
         NativeAdminCenters = 'passed'
+        NativeAdminOperationalReads = 'passed'
     } | Format-List
 }
 finally {