diff --git a/apps/web/src/api/client.ts b/apps/web/src/api/client.ts
index ebb9394..f800ad8 100644
--- a/apps/web/src/api/client.ts
+++ b/apps/web/src/api/client.ts
@@ -50,6 +50,15 @@ function ensureVisitorId(): string {
   }
 }
 
+export function resetVisitorId(): void {
+  memoryVisitorId = null;
+  try {
+    window.localStorage.removeItem(ANONYMOUS_VISITOR_KEY);
+  } catch {
+    // 隐私模式等场景下 localStorage 不可用，忽略即可
+  }
+}
+
 let desktopDeviceId: Promise<string> | null = null;
 
 async function getDesktopDeviceId(): Promise<string> {
diff --git a/apps/web/src/auth/AuthProvider.tsx b/apps/web/src/auth/AuthProvider.tsx
index 134c11d..2f50b6b 100644
--- a/apps/web/src/auth/AuthProvider.tsx
+++ b/apps/web/src/auth/AuthProvider.tsx
@@ -6,7 +6,7 @@ import {
   SafetyCertificateOutlined, UserOutlined, WarningOutlined,
 } from '@ant-design/icons';
 
-import { clientFetch, getClientMode, type ClientMode } from '../api/client';
+import { clientFetch, getClientMode, resetVisitorId, type ClientMode } from '../api/client';
 
 export type AuthUser = {
   user_id: string;
@@ -184,6 +184,7 @@ export function AuthProvider(props: { children: ReactNode }) {
       await clientFetch('/api/auth/logout', { method: 'POST' });
     } finally {
       clearSensitiveBrowserState();
+      resetVisitorId();
       await refresh();
     }
   }, [refresh]);
diff --git a/server/gateway/app.py b/server/gateway/app.py
index b26b47a..945dd57 100644
--- a/server/gateway/app.py
+++ b/server/gateway/app.py
@@ -73,7 +73,7 @@ from server.contracts import INTERFACE_VERSION, IntentResult  # 跨层握手与
 from server.state.checkpoints import get_checkpoints   # 成对快照仓（时间线）
 from server.state.store import get_store               # 世界状态单例
 from server.auth.context import get_identity
-from server.auth.middleware import AuthenticationMiddleware
+from server.auth.middleware import ANONYMOUS_COOKIE, AuthenticationMiddleware
 from server.auth.licenses import (
     DESKTOP_COOKIE,
     WEB_LICENSE_COOKIE,
@@ -1219,6 +1219,7 @@ def create_app() -> FastAPI:
         response.delete_cookie("aps_session", path="/")
         response.delete_cookie(DESKTOP_COOKIE, path="/")
         response.delete_cookie(WEB_LICENSE_COOKIE, path="/")
+        response.delete_cookie(ANONYMOUS_COOKIE, path="/")
         return {"ok": True}
 
     @app.get("/api/auth/users")