diff --git a/README.md b/README.md
index acfa8dd3..5932c524 100644
--- a/README.md
+++ b/README.md
@@ -42,16 +42,18 @@ before the client runs them.
   Cursor, Continue and Antigravity CLI come with instructions. Switching
   upstreams then happens in the gateway alone.
 - **Protection against relays.** A relay sees every request in full and can
-  rewrite every answer. Outbound redaction swaps API keys, private keys, JWTs,
+  rewrite every answer. Secrets & privacy swaps API keys, private keys, JWTs,
   connection-string passwords, Chinese resident ID numbers and bank card numbers
   for placeholders before a request leaves, so the relay never holds the real
   values. When an answer carries a tool call
   that downloads and runs code, sends out environment variables or credential
   files, reads private keys or installs a startup item or scheduled job,
-  tool-call inspection cuts the answer off before the client can run it.
+  Dangerous commands cuts the answer off before the client can run it.
   The content filter deletes instructions hidden in invisible characters before
-  a request leaves and can refuse prompt injection. Each protection starts in
-  Observe, which only records, and is switched over one at a time.
+  a request leaves, can refuse prompt injection, and can delete or replace
+  chosen words in requests and in the model's answers. Each protection starts in
+  Monitor, which records and notifies, and is switched on one at a time; every
+  rule has its own action.
 - **Upstreams, cross-checked.** Each upstream is compared with the others
   serving the same model: answers naming a different model, reported input well
   above or below theirs and low prompt-cache reads are marked on its row in the
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 0ef9a0b6..e0f6a2dc 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -31,7 +31,7 @@ Claude Code、Codex 等 AI 客户端的本地网关，支持 macOS、Windows 与
 ## 要点
 
 - **一次接入，随时切换。** Claude Code、Claude Desktop、Codex、opencode、Pi、oh-my-pi、Grok Build、Qwen Code、Hermes Agent、Zed、Aider 与 DeepSeek Harness 可一键指向网关，写入前预览改动、备份原文件，随时可以还原；Cursor、Continue 与 Antigravity CLI 提供配置说明。此后切换上游只在网关中完成。
-- **防范中转站。** 中转站能看到请求的全部内容，也能改写每一次回答。出站脱敏在请求发出前把 API 密钥、私钥、JWT、连接串口令、身份证号与银行卡号换成占位符，中转站拿不到原值。回答中若出现下载即执行、外发环境变量或凭据文件、读取私钥、写入开机启动项或定时任务之类的工具调用，工具调用审查会在客户端执行之前切断回答。内容过滤在请求发出前删除藏在不可见字符里的指令，也可以直接拒绝提示注入。各项防护出厂只记录，逐项切换后生效。
+- **防范中转站。** 中转站能看到请求的全部内容，也能改写每一次回答。「密钥与隐私」在请求发出前把 API 密钥、私钥、JWT、连接串口令、身份证号与银行卡号换成占位符，中转站拿不到原值。回答中若出现下载即执行、外发环境变量或凭据文件、读取私钥、写入开机启动项或定时任务之类的工具调用，「危险命令」会在客户端执行之前切断回答。「内容过滤」在请求发出前删除藏在不可见字符里的指令，可以直接拒绝提示注入，也可以删除或替换请求和模型回答中的指定词语。各项防护出厂处于「监控」状态，只记录并发出通知，逐项开启后生效；每条规则可单独设定动作。
 - **上游互相对照。** 每个上游都与服务同一模型的其他上游对照：回答中的模型名与发出的不同、报告的输入明显偏多或偏少、提示缓存读取偏低，都会在上游列表的那一行标出，悬停可见证据与样本数。
 - **扫描 MCP、技能与钩子。** 十三款客户端的 MCP 服务器并列显示并标出第三方服务器；客户端配置、技能、钩子与项目指令中的隐藏字符、提示注入、危险命令与过宽权限会被找出。
 - **每个请求都可追溯。** 命中的规则、尝试过的每个上游、API 格式转换与费用的计算依据都在请求详情中；已结束的请求可以重放到另一个上游，并排对比。全部请求记录都可以搜索，包括请求与回答的内容。
diff --git a/package.json b/package.json
index af275ae2..003a5fd4 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "thinkwatch-lite",
   "private": true,
   "description": "Desktop app for a local AI API gateway on macOS, Windows and Linux",
-  "version": "2026.10.18",
+  "version": "2026.10.19",
   "type": "module",
   "packageManager": "pnpm@11.13.0",
   "scripts": {
diff --git a/release-notes/2026.10.19.md b/release-notes/2026.10.19.md
new file mode 100644
index 00000000..91f7ba97
--- /dev/null
+++ b/release-notes/2026.10.19.md
@@ -0,0 +1,24 @@
+**Upgrade notes:**
+- The bundled core is now 0.73.0, with control-plane protocol 48. A remote server must run core 0.73.0; servers on 0.72.x do not connect until they are upgraded.
+- Nothing is cleared; the request history, stored payloads and settings carry over, and every existing rule keeps its behaviour.
+
+**Security page:**
+- The three protections are now named for what they guard against: **Secrets & privacy** (formerly Outbound redaction), **Dangerous commands** (formerly Tool-call inspection) and **Content filter**. Each has three states, **On**, **Monitor** and **Off**, shown as a dot on its tab.
+- **Monitor** records every match in the log and raises a system notification, and changes nothing. **Record only** on a single rule does the same under On. The same rule notifies at most once every 5 minutes, matches arriving together are merged into one notification, and a notification never contains the matched text.
+- Every rule has its own switch and action, set directly in the list: Secrets & privacy rules replace with a placeholder or record only; Dangerous commands rules cut off or record only; Content filter rules refuse, delete, replace or record only. While a protection is in Monitor, rules show their action with "Monitoring" next to it.
+- Built-in rules are grouped by category, with a checkbox on each group to switch all of its rules at once, and a search box filters rules by name and pattern.
+- **Match case** in the Secrets & privacy rule dialog is now a switch.
+
+**Content filter for answers:**
+- A content rule now says what it checks: **Request**, **Answer** or **Request and answer**. A rule on answers checks the text the model writes, including Codex's freeform tool input; tool calls stay with Dangerous commands, and thinking is not checked.
+- **Replace** writes the rule's replacement text (default `***`) in place of the match, on requests and answers. It is not undone in the answer. **Delete** removes the match without a trace.
+- Answers keep streaming: only the few characters that could still become a match are held back. A rule on answers cannot refuse and cannot match code points; those options are disabled in the dialog with the reason given.
+- The test box tries a sample as a request or as an answer.
+- While a rule on answers can delete or replace, token probabilities (logprobs) are left out of streamed answers.
+
+**Log and traffic:**
+- Matches in answers show where they were found, and the outcome says how many places were deleted or replaced. Requests whose text was replaced carry a **Replaced** mark in the traffic list.
+- Secrets that a Record only rule let through are counted as such instead of being shown as redacted.
+
+**Fixed:**
+- Rule dialogs fit small windows and scroll inside instead of pushing the buttons out of view.
diff --git a/scripts/shots/mock/core.ts b/scripts/shots/mock/core.ts
index 0d08879d..03b5658f 100644
--- a/scripts/shots/mock/core.ts
+++ b/scripts/shots/mock/core.ts
@@ -199,6 +199,7 @@ export const CORE: { [N in WebviewEndpoint]: Handler<N> } = {
   SetSecurityMode: refuse,
   ToggleBuiltinRule: refuse,
   SetBuiltinRuleAction: refuse,
+  SetRulesEnabled: refuse,
   CreateCustomRule: refuse,
   UpdateCustomRule: refuse,
   DeleteCustomRule: refuse,
diff --git a/scripts/shots/mock/traffic.ts b/scripts/shots/mock/traffic.ts
index c5b60bb4..301ecc01 100644
--- a/scripts/shots/mock/traffic.ts
+++ b/scripts/shots/mock/traffic.ts
@@ -657,6 +657,7 @@ export function summary(from: number, to = Infinity): Summary {
       content: count("content"),
       content_blocked: count("content", ["blocked"]),
       content_stripped: count("content", ["stripped"]),
+      content_replaced: count("content", ["replaced"]),
     },
     pricing_date: AS_OF,
   };
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 292a5939..ae6d126a 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -4832,7 +4832,7 @@ dependencies = [
 
 [[package]]
 name = "thinkwatch-lite"
-version = "2026.10.18"
+version = "2026.10.19"
 dependencies = [
  "anyhow",
  "block2",
@@ -5335,8 +5335,8 @@ dependencies = [
 
 [[package]]
 name = "tw-api"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
  "serde",
  "serde_json",
@@ -5347,8 +5347,8 @@ dependencies = [
 
 [[package]]
 name = "tw-dialect"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
  "memchr",
  "serde",
@@ -5357,13 +5357,15 @@ dependencies = [
 
 [[package]]
 name = "tw-guard"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
+ "aho-corasick",
  "base64 0.22.1",
  "bytes",
  "memchr",
  "regex",
+ "regex-syntax",
  "serde",
  "serde_json",
  "serde_yaml_ng",
@@ -5374,8 +5376,8 @@ dependencies = [
 
 [[package]]
 name = "tw-link"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
  "serde",
  "serde_json",
@@ -5401,8 +5403,8 @@ dependencies = [
 
 [[package]]
 name = "tw-types"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
  "serde",
  "ts-rs",
@@ -5410,8 +5412,8 @@ dependencies = [
 
 [[package]]
 name = "tw-watch"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
  "libc",
  "notify",
@@ -5421,8 +5423,8 @@ dependencies = [
 
 [[package]]
 name = "tw-yaml"
-version = "0.72.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.72.0#226a9bd816d2c1aa81c5bc6bf0eca6ea79cbe383"
+version = "0.73.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
 dependencies = [
  "saphyr-parser",
  "thiserror 2.0.21",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index c0f4016c..88920950 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "thinkwatch-lite"
-version = "2026.10.18"
+version = "2026.10.19"
 edition = "2024"
 # **这个数决定依赖能升到哪一版。**edition 2024 的解析器只挑声明的 Rust
 # 版本编得动的依赖：写 1.85 的时候，`cargo update` 一直停在旧的 time 和
@@ -26,12 +26,12 @@ license = "MIT"
 # twcore 二进制必须和这里编译进去的协议镜像来自同一个 core 版本 —— 打包脚本正是
 # 从 tw-api 锁到的 tag 去取二进制的（见 scripts/fetch-core.sh）。
 [workspace.dependencies]
-tw-api = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.72.0" }
-tw-types = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.72.0" }
-tw-yaml = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.72.0" }
-tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.72.0" }
-tw-watch = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.72.0" }
-tw-link = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.72.0" }
+tw-api = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
+tw-types = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
+tw-yaml = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
+tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
+tw-watch = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
+tw-link = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
 
 [lib]
 name = "thinkwatch_lite_lib"
diff --git a/src-tauri/src/call.rs b/src-tauri/src/call.rs
index 1d316bd9..099f3474 100644
--- a/src-tauri/src/call.rs
+++ b/src-tauri/src/call.rs
@@ -148,6 +148,7 @@ webview_endpoints![
     SetSecurityMode,
     ToggleBuiltinRule,
     SetBuiltinRuleAction,
+    SetRulesEnabled,
     CreateCustomRule,
     UpdateCustomRule,
     DeleteCustomRule,
diff --git a/src-tauri/src/core_text.rs b/src-tauri/src/core_text.rs
index 40c5c127..79f6aa98 100644
--- a/src-tauri/src/core_text.rs
+++ b/src-tauri/src/core_text.rs
@@ -44,6 +44,11 @@ pub fn text(m: &Msg) -> String {
     tr!(zh(m).unwrap_or_else(|| m.text.clone()), m.text.clone())
 }
 
+/// 词表里的一项（`guard`、`secret_rule`、`content_rule`…），中文。表或项不在是 `None`
+pub fn table_zh(table: &str, key: &str) -> Option<String> {
+    self::table().tables.get(table)?.get(key).cloned()
+}
+
 /// 同 [`text`]，去掉句末的句号：后面还要接自己的一句时用
 pub fn clause(m: &Msg) -> String {
     let s = text(m);
diff --git a/src-tauri/src/notices/mod.rs b/src-tauri/src/notices/mod.rs
index 93d9def1..a9f3f3c7 100644
--- a/src-tauri/src/notices/mod.rs
+++ b/src-tauri/src/notices/mod.rs
@@ -82,6 +82,13 @@ const COOLDOWN: Duration = Duration::from_secs(300);
 /// 通知中心里原地贴一次。10 秒里合成一次，列表上的次数晚几秒跟上，没有别的代价
 const GATHER: Duration = Duration::from_secs(10);
 
+/// 同时命中的几条安全规则（[`Signal::merged`]）：要弹的先等这么久，这段时间里要弹的合成一条。
+///
+/// **2 秒**：一个请求里几条规则一起命中时，core 是一条接一条发事件的（同一个请求的事件前后
+/// 相差几毫秒），流式回答里的命中也在同一秒里到；再长，第一条通知就晚得让人觉得和那次请求
+/// 对不上了
+const MERGE: Duration = Duration::from_secs(2);
+
 #[derive(
     Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
 )]
@@ -146,6 +153,8 @@ pub struct Signal {
     pub times: u32,
     /// 级别只是 info，也弹系统通知（见 [`Signal::tell`]）
     pub tell: bool,
+    /// 同时要弹的几条合成一条通知时，这一条写成的那一行（见 [`Signal::merged`]）
+    pub merge: Option<String>,
 }
 
 impl Signal {
@@ -163,6 +172,7 @@ impl Signal {
             gather: false,
             times: 1,
             tell: false,
+            merge: None,
         }
     }
 
@@ -180,6 +190,7 @@ impl Signal {
             gather: false,
             times: 1,
             tell: false,
+            merge: None,
         }
     }
 
@@ -245,6 +256,16 @@ impl Signal {
         self
     }
 
+    /// 同时要弹的几件事合成一条通知（安全规则「仅记录」的命中）：要弹的时候先等 [`MERGE`]，
+    /// 这段时间里别的合成通知也要弹的，一起说成一条，`line` 是这一件在那一条里的样子。
+    ///
+    /// **只合成要弹的那一下**：列表里还是各是各的一条，去重、冷却照旧按各自的键。合成的那一条
+    /// 只取一个令牌
+    pub fn merged(mut self, line: impl Into<String>) -> Self {
+        self.merge = Some(line.into());
+        self
+    }
+
     /// 这一条算几次
     pub fn times(mut self, n: u32) -> Self {
         self.times = n.max(1);
@@ -298,6 +319,8 @@ struct Open {
     cool_until: Option<tokio::time::Instant>,
     /// 冷却期间又发生、还没为它弹过的次数。冷却结束时合成一条说
     unsaid: u32,
+    /// 要弹时和同时要弹的合成一条（[`Signal::merged`]），这是它那一行
+    merge: Option<String>,
 }
 
 #[derive(Debug, Default)]
@@ -327,6 +350,8 @@ pub struct Notices {
     /// 正在攒的那几件事，按键（[`Signal::gathered`]）。**和 `state` 分开一把锁**：攒只是
     /// 记一笔，不碰列表
     gathering: Mutex<HashMap<String, Gathering>>,
+    /// 等着合成一条再弹的那几件事的键，按先后（[`Signal::merged`]）
+    merging: Mutex<Vec<String>>,
 }
 
 /// 一个键这一阵攒下的
@@ -362,6 +387,7 @@ impl Notices {
                                 intermittent: false,
                                 cool_until: None,
                                 unsaid: 0,
+                                merge: None,
                             },
                         )
                     })
@@ -373,6 +399,7 @@ impl Notices {
             mode: Mutex::new(mode),
             store,
             gathering: Mutex::new(HashMap::new()),
+            merging: Mutex::new(Vec::new()),
         })
     }
 
@@ -684,7 +711,10 @@ impl Notices {
             let interrupts = mode == Mode::System && (signal.level.interrupts() || signal.tell);
             let wants = interrupts && !quiet;
             let due = (wants && signal.hold).then(|| now + HOLD);
-            let deliver = wants && !signal.hold && take_token(&mut g, &signal.key, signal.level);
+            // 合成的那几条到点一起只取一个令牌（`flush_merged`）
+            let merged = signal.merge.is_some();
+            let deliver =
+                wants && !signal.hold && (merged || take_token(&mut g, &signal.key, signal.level));
             let mut sum_up = None;
             if signal.event {
                 if deliver {
@@ -707,6 +737,7 @@ impl Notices {
                     intermittent: false,
                     cool_until,
                     unsaid,
+                    merge: signal.merge.clone(),
                 },
             );
             (notice, deliver, due, sum_up)
@@ -788,14 +819,14 @@ impl Notices {
                     .open
                     .get(&key)
                     .filter(|o| o.cool_until == Some(at) && o.unsaid > 0)
-                    .map(|o| (o.notice.clone(), o.unsaid, o.muted_until));
-                let Some((notice, unsaid, muted)) = pending else {
+                    .map(|o| (o.notice.clone(), o.unsaid, o.muted_until, o.merge.is_some()));
+                let Some((notice, unsaid, muted, merged)) = pending else {
                     return;
                 };
                 let say = wants
                     && !notice.read
                     && !hushed(&g, &key, muted, Instant::now())
-                    && take_token(&mut g, &key, notice.level);
+                    && (merged || take_token(&mut g, &key, notice.level));
                 if let Some(o) = g.open.get_mut(&key) {
                     o.unsaid = 0;
                     if say {
@@ -815,7 +846,11 @@ impl Notices {
         });
     }
 
-    fn deliver(&self, notice: &Notice) {
+    fn deliver(self: &Arc<Self>, notice: &Notice) {
+        if self.merges(&notice.key) {
+            self.merge_later(&notice.key);
+            return;
+        }
         let held = {
             let mut g = self.state.lock().expect("锁未中毒");
             if let Some(o) = g.open.get_mut(&notice.key) {
@@ -828,20 +863,109 @@ impl Notices {
         };
         let mut shown = notice.clone();
         shown.notified = true;
-        if held > 0 {
-            // 被限流压下去的那些，在这一条里带一句
-            shown.body = tr!(
-                format!("{}（另有 {held} 项待处理）", shown.body),
-                if held == 1 {
-                    format!("{} (1 more notice pending)", shown.body)
-                } else {
-                    format!("{} ({held} more notices pending)", shown.body)
-                }
-            );
+        shown.body = with_held(shown.body, held);
+        for s in &self.sinks {
+            s.show(&shown);
+        }
+    }
+
+    /// 这一条要和同时要弹的合成一条（[`Signal::merged`]）
+    fn merges(&self, key: &str) -> bool {
+        self.state
+            .lock()
+            .expect("锁未中毒")
+            .open
+            .get(key)
+            .is_some_and(|o| o.merge.is_some())
+    }
+
+    /// 排进等着合成的那一批。这一批的头一条排上到点合成的那个时刻
+    fn merge_later(self: &Arc<Self>, key: &str) {
+        let first = {
+            let mut m = self.merging.lock().expect("锁未中毒");
+            if m.iter().any(|k| k == key) {
+                return;
+            }
+            m.push(key.to_string());
+            m.len() == 1
+        };
+        if !first {
+            return;
         }
+        // 时刻在这里定，不等任务头一次跑起来（和攒、冷却的计时器一样）
+        let at = tokio::time::Instant::now() + MERGE;
+        let me = self.clone();
+        tokio::spawn(async move {
+            tokio::time::sleep_until(at).await;
+            me.flush_merged();
+        });
+    }
+
+    /// 到点：这一批里还开着、用户还没看过的，合成一条弹出去。**只有一条就照它自己的样子说**；
+    /// 几条就说「N 条安全规则命中」，正文逐条写规则和上游。
+    ///
+    /// 合成的那一条用第一条的键：点它落到第一条的页面、标它已读时撤掉的也是它。只有这个键算
+    /// 弹过（`notified`），别的几条之后原地更新时不会在通知中心里各冒出一条
+    fn flush_merged(&self) {
+        let keys = std::mem::take(&mut *self.merging.lock().expect("锁未中毒"));
+        if self.mode() != Mode::System {
+            return;
+        }
+        let shown = {
+            let mut g = self.state.lock().expect("锁未中毒");
+            let batch: Vec<(Notice, String)> = keys
+                .iter()
+                .filter_map(|k| g.open.get(k))
+                .filter(|o| !o.notice.read)
+                .map(|o| (o.notice.clone(), o.merge.clone().unwrap_or_default()))
+                .collect();
+            let Some((first, _)) = batch.first() else {
+                return;
+            };
+            let level = batch
+                .iter()
+                .map(|(n, _)| n.level)
+                .max()
+                .unwrap_or(first.level);
+            if !take_token(&mut g, MERGED_KEY, level) {
+                // 限流压下去的按各自的键记着，下一条弹出去的通知里带一句「另有 N 项」
+                g.held_back.remove(MERGED_KEY);
+                for (n, _) in &batch {
+                    g.held_back.insert(n.key.clone());
+                }
+                return;
+            }
+            let first = first.clone();
+            if let Some(o) = g.open.get_mut(&first.key) {
+                o.notice.notified = true;
+            }
+            let mut held = std::mem::take(&mut g.held_back);
+            for (n, _) in &batch {
+                held.remove(&n.key);
+            }
+            let mut shown = if batch.len() == 1 {
+                first.clone()
+            } else {
+                Notice {
+                    level,
+                    title: tr!(
+                        format!("{} 条安全规则命中", batch.len()),
+                        format!("{} Security Rules Matched", batch.len())
+                    ),
+                    body: merged_body(batch.iter().map(|(_, line)| line.as_str()).collect()),
+                    count: 1,
+                    ..first.clone()
+                }
+            };
+            shown.notified = true;
+            shown.body = with_held(shown.body, held.len());
+            shown
+        };
         for s in &self.sinks {
             s.show(&shown);
         }
+        self.persist();
+        self.changed();
     }
 
     fn clear(&self, key: &str, at_ms: u64) {
@@ -889,6 +1013,7 @@ impl Notices {
                             intermittent: true,
                             cool_until: None,
                             unsaid: 0,
+                            merge: None,
                         },
                     );
                 }
@@ -946,6 +1071,55 @@ impl Notices {
     }
 }
 
+/// 合成的那一条取令牌时用的键（被限流时不记它，记那一批各自的键）
+const MERGED_KEY: &str = "secwatch";
+
+/// 一条合成通知里最多逐条写几件，其余写「等 N 条」
+const MERGED_LINES: usize = 4;
+
+/// 合成那一条的正文：逐条写规则和上游，多了截住
+fn merged_body(lines: Vec<&str>) -> String {
+    let n = lines.len();
+    let shown = &lines[..n.min(MERGED_LINES)];
+    let rest = n - shown.len();
+    tr!(
+        {
+            let more = if rest > 0 {
+                format!("等 {n} 条")
+            } else {
+                String::new()
+            };
+            format!("{}{more}。均已记入安全日志。", shown.join("；"))
+        },
+        {
+            let more = if rest > 0 {
+                format!("; and {rest} more")
+            } else {
+                String::new()
+            };
+            format!(
+                "{}{more}. All were recorded in the security log.",
+                shown.join("; ")
+            )
+        }
+    )
+}
+
+/// 被限流压下去的那些，在弹出去的这一条里带一句
+fn with_held(body: String, held: usize) -> String {
+    if held == 0 {
+        return body;
+    }
+    tr!(
+        format!("{body}（另有 {held} 项待处理）"),
+        if held == 1 {
+            format!("{body} (1 more notice pending)")
+        } else {
+            format!("{body} ({held} more notices pending)")
+        }
+    )
+}
+
 /// 开着的全部，最近的在前
 fn newest_first(state: &State) -> Vec<Notice> {
     let mut out: Vec<Notice> = state.open.values().map(|o| o.notice.clone()).collect();
diff --git a/src-tauri/src/notices/rules.rs b/src-tauri/src/notices/rules.rs
index b7165cb1..d74b9e2f 100644
--- a/src-tauri/src/notices/rules.rs
+++ b/src-tauri/src/notices/rules.rs
@@ -57,7 +57,7 @@ const LISTEN_SETTINGS: &str = "settings:listen";
 pub fn default_view(key: &str) -> &'static str {
     match key.split(':').next().unwrap_or(key) {
         "upstream" | "quota" | "credential" | "auth" | "writeback" | "proxy" => UPSTREAMS,
-        "toolwall" => SECURITY,
+        "toolwall" | "secwatch" => SECURITY,
         // 客户端配置里的可疑内容在 MCP 页：服务器、技能、钩子和扫描发现都在那儿
         "scan" => MCP,
         "plugin" => PLUGINS,
@@ -80,6 +80,7 @@ pub fn suppresses(key: &str) -> &'static [&'static str] {
             "auth:",
             "proxy:",
             "toolwall:",
+            "secwatch:",
             "writeback:",
         ],
         _ => &[],
@@ -352,8 +353,8 @@ pub fn from_event(ev: &Event) -> Vec<Signal> {
                 .now(),
             ]
         }
-        // 客户端此刻正在弹批准提示，**这一条要立刻说**。只说处置为「切断」的
-        // 那些规则：「仅记录」的那一类本来就是用户说了不必打断的。
+        // 客户端此刻正在弹批准提示，**这一条要立刻说**。只说真的切断了的：防护处于「监控」时
+        // 命中「切断」规则、或者规则本来就是「仅记录」的，走下面「只记录」那一类。
         //
         // **每拦下一次都是一件新的事**（`event`）：用户看过上一次之后再拦下，照样要说；
         // 同一家接连拦下的，由冷却合成一条，不刷屏
@@ -362,34 +363,18 @@ pub fn from_event(ev: &Event) -> Vec<Signal> {
             tool,
             rule,
             action,
-            blocked,
+            blocked: true,
             ..
         } if action == "cut" => {
-            let title = if *blocked {
-                tr!(
-                    format!("已拦截 {provider} 返回的 {tool} 调用"),
-                    format!("Blocked {tool} Call from “{provider}”")
-                )
-            } else {
-                tr!(
-                    format!("{provider} 返回了可疑的 {tool} 调用"),
-                    format!("Suspicious {tool} Call from “{provider}”")
-                )
-            };
+            let title = tr!(
+                format!("已拦截 {provider} 返回的 {tool} 调用"),
+                format!("Blocked {tool} Call from “{provider}”")
+            );
             let name = tool_rule_name(rule);
-            let body = if *blocked {
-                tr!(
-                    format!("命中规则「{name}」，响应已切断。"),
-                    format!("It matched the rule “{name}”, so the response was cut off.")
-                )
-            } else {
-                tr!(
-                    format!("命中规则「{name}」。建议在客户端拒绝此调用。"),
-                    format!(
-                        "It matched the rule “{name}”. Rejecting this call in the client is recommended."
-                    )
-                )
-            };
+            let body = tr!(
+                format!("命中规则「{name}」，响应已切断。"),
+                format!("It matched the rule “{name}”, so the response was cut off.")
+            );
             // **正文不带调用内容**：系统通知在锁屏上也看得见
             vec![
                 Signal::raised(format!("toolwall:{provider}"), Level::Warning, title)
@@ -398,6 +383,31 @@ pub fn from_event(ev: &Event) -> Vec<Signal> {
                     .event(),
             ]
         }
+        Event::ToolCallFlagged {
+            provider,
+            rule,
+            custom,
+            detail,
+            ..
+        } => watched("inspect_tools", provider, rule, *custom, detail)
+            .into_iter()
+            .collect(),
+        Event::ContentMatched {
+            provider,
+            rule,
+            custom,
+            detail,
+            ..
+        } => watched("content", provider, rule, *custom, detail)
+            .into_iter()
+            .collect(),
+        // 一次请求里找到的每个值各一项；同一条规则找到几个值，就是同一条规则命中了几次
+        Event::SecretsFound {
+            provider, items, ..
+        } => items
+            .iter()
+            .filter_map(|i| watched("redact", provider, &i.rule, i.custom, &i.detail))
+            .collect(),
         Event::KeyLimitAlert { .. } => key_limit(ev),
         Event::PluginFailed {
             plugin_id,
@@ -788,6 +798,96 @@ pub fn from_snapshot(s: &Snapshot<'_>, now_ms: u64) -> Vec<Signal> {
         .collect()
 }
 
+/// 「仅记录」的命中：规则的动作就是仅记录，或者防护处于「监控」（那时每条规则都按仅记录
+/// 处理）。**只认 core 说的结局**（`outcome_detail` 是 `recorded`），不自己按档位和动作推。
+///
+/// 规格（安全页重整 §3）：仅记录 = 记入安全日志并发出系统通知。正文**只有规则名和上游**，
+/// 不带命中的原文（锁屏上也看得见）。键按规则分（`secwatch:<防护>:<b|c>:<规则>`），所以
+/// **同一条规则 5 分钟里至多弹一次**（[`Signal::event`] 的冷却）；同时命中的几条规则由总线
+/// 合成一条通知（[`Signal::merged`]，那一行是这条规则在合成通知里的样子）。
+fn watched(
+    guard: &'static str,
+    provider: &str,
+    rule: &str,
+    custom: bool,
+    detail: &tw_api::SecurityHitDetail,
+) -> Option<Signal> {
+    if !matches!(detail.outcome_detail, tw_api::OutcomeDetail::Recorded {}) {
+        return None;
+    }
+    let name = guard_rule_name(guard, rule, custom, &detail.rule_snapshot.name);
+    let what = guard_name(guard);
+    let answer = detail.direction == tw_api::SecurityDirection::Response;
+    let body = match (answer, crate::i18n::current()) {
+        (false, crate::i18n::Lang::Zh) => {
+            format!("{what}：经上游「{provider}」的请求命中此规则，已记入安全日志。")
+        }
+        (true, crate::i18n::Lang::Zh) => {
+            format!("{what}：上游「{provider}」的回答命中此规则，已记入安全日志。")
+        }
+        (false, crate::i18n::Lang::En) => format!(
+            "{what}: a request through upstream “{provider}” matched this rule. It was recorded in the security log."
+        ),
+        (true, crate::i18n::Lang::En) => format!(
+            "{what}: an answer from upstream “{provider}” matched this rule. It was recorded in the security log."
+        ),
+    };
+    let kind = if custom { "c" } else { "b" };
+    Some(
+        Signal::raised(
+            format!("secwatch:{guard}:{kind}:{rule}"),
+            Level::Warning,
+            tr!(
+                format!("安全规则「{name}」命中"),
+                format!("Security Rule “{name}” Matched")
+            ),
+        )
+        .body(body)
+        .view(SECURITY)
+        .event()
+        .merged(tr!(
+            format!("「{name}」· {provider}"),
+            format!("“{name}” · {provider}")
+        )),
+    )
+}
+
+/// 防护的名字，和安全页的页签一样
+fn guard_name(guard: &str) -> String {
+    tr!(
+        crate::core_text::table_zh("guard", guard).unwrap_or_else(|| guard.to_string()),
+        match guard {
+            "redact" => "Secrets & privacy",
+            "inspect_tools" => "Dangerous commands",
+            _ => "Content filter",
+        }
+        .to_string()
+    )
+}
+
+/// 规则的名字，和安全页上的一样：自定义规则就是用户起的名字；内置的中文查词表（和界面同一张），
+/// 查不到、或者英文界面，用 core 给的英文名
+fn guard_rule_name(guard: &str, rule: &str, custom: bool, english: &str) -> String {
+    if custom {
+        return rule.to_string();
+    }
+    let english = if english.is_empty() { rule } else { english };
+    match guard {
+        "inspect_tools" => tool_rule_name(rule),
+        _ => {
+            let table = if guard == "redact" {
+                "secret_rule"
+            } else {
+                "content_rule"
+            };
+            tr!(
+                crate::core_text::table_zh(table, rule).unwrap_or_else(|| english.to_string()),
+                english.to_string()
+            )
+        }
+    }
+}
+
 /// 工具调用规则的名字，和安全页上的一样。**只有内置的这些**：自定义规则的
 /// id 就是用户起的名字，原样用。
 fn tool_rule_name(rule: &str) -> String {
diff --git a/src-tauri/src/notices/tests.rs b/src-tauri/src/notices/tests.rs
index 3372ee87..ed5964b9 100644
--- a/src-tauri/src/notices/tests.rs
+++ b/src-tauri/src/notices/tests.rs
@@ -849,23 +849,260 @@ async fn each_plugin_is_gathered_on_its_own() {
     assert_eq!(b.titles().len(), 2, "{:?}", b.titles());
 }
 
-#[test]
-fn a_rule_that_only_records_does_not_interrupt_anyone() {
-    // 「仅记录」的那一类是用户说了不必打断的
-    let signals = rules::from_event(&tw_api::Event::ToolCallFlagged {
+// ---------------------------------------------------------------- 仅记录与监控（安全页重整）
+
+/// 一次命中的细节。`recorded`：core 说的结局是只记录（规则是「仅记录」，或者防护处于「监控」）
+fn hit_detail(
+    direction: tw_api::SecurityDirection,
+    id: &str,
+    name: &str,
+    recorded: bool,
+) -> tw_api::SecurityHitDetail {
+    tw_api::SecurityHitDetail {
+        direction,
+        locations: Vec::new(),
+        more_locations: 0,
+        rule_snapshot: tw_api::RuleSnapshot {
+            builtin: true,
+            id: id.into(),
+            name: name.into(),
+            core_version: "0.73.0".into(),
+            ..Default::default()
+        },
+        outcome_detail: if recorded {
+            tw_api::OutcomeDetail::Recorded {}
+        } else {
+            tw_api::OutcomeDetail::Stripped { segments: 1 }
+        },
+    }
+}
+
+/// 危险命令的一次命中，没有切断（`blocked: false`）
+fn flagged(provider: &str, rule: &str, action: tw_api::RuleAction) -> tw_api::Event {
+    tw_api::Event::ToolCallFlagged {
         id: 1,
-        provider: "relay".into(),
+        provider: provider.into(),
         tool: "Bash".into(),
-        rule: "rm-rf-root".into(),
+        rule: rule.into(),
         custom: false,
         why: "Deletes the whole home directory or the root".into(),
         excerpt: "rm -rf ~".into(),
-        action: tw_api::RuleAction::Record,
+        action,
         blocked: false,
         at_ms: T0,
-        detail: flag_detail(),
+        detail: hit_detail(
+            tw_api::SecurityDirection::Response,
+            rule,
+            "Delete home or root",
+            true,
+        ),
+    }
+}
+
+/// 内容过滤的一次命中。`custom` 时规则名就是用户起的名字
+fn content_hit(provider: &str, rule: &str, custom: bool, recorded: bool) -> tw_api::Event {
+    tw_api::Event::ContentMatched {
+        id: 2,
+        provider: provider.into(),
+        direction: tw_api::SecurityDirection::Response,
+        rule: rule.into(),
+        custom,
+        matching: tw_api::ContentMatch::Contains,
+        action: if recorded {
+            tw_api::RuleAction::Record
+        } else {
+            tw_api::RuleAction::Strip
+        },
+        outcome: if recorded {
+            tw_api::ContentOutcome::Recorded
+        } else {
+            tw_api::ContentOutcome::Stripped
+        },
+        in_tool_result: false,
+        excerpt: "SECRET-CODENAME".into(),
+        count: 1,
+        revealed: None,
+        detail: hit_detail(
+            tw_api::SecurityDirection::Response,
+            rule,
+            "Jailbreak",
+            recorded,
+        ),
+        at_ms: T0,
+    }
+}
+
+/// 密钥与隐私的一次请求里找到的几个值
+fn secrets(provider: &str, items: &[(&str, bool)]) -> tw_api::Event {
+    tw_api::Event::SecretsFound {
+        id: 3,
+        provider: provider.into(),
+        replaced: false,
+        items: items
+            .iter()
+            .map(|(rule, recorded)| tw_api::SecretItem {
+                rule: (*rule).into(),
+                custom: false,
+                kind: tw_api::SecretKind::Personal,
+                masked: "z…@example.com".into(),
+                count: 1,
+                replaced: !*recorded,
+                detail: hit_detail(
+                    tw_api::SecurityDirection::Request,
+                    rule,
+                    "Email address",
+                    *recorded,
+                ),
+            })
+            .collect(),
+        at_ms: T0,
+    }
+}
+
+/// 「仅记录」= 记入日志并发出系统通知（规格 §3）。三项防护都说；**正文只有规则和上游**，
+/// 不带命中的原文
+#[test]
+fn a_record_only_hit_of_every_guard_is_told_with_rule_and_upstream_only() {
+    with_lang(Lang::Zh, || {
+        let tool = rules::from_event(&flagged("relay", "rm-rf-root", tw_api::RuleAction::Record));
+        let content = rules::from_event(&content_hit("relay", "项目代号", true, true));
+        let redact = rules::from_event(&secrets("relay", &[("email", true)]));
+        for (signals, key, name) in [
+            (
+                &tool,
+                "secwatch:inspect_tools:b:rm-rf-root",
+                "删除主目录或根目录",
+            ),
+            (&content, "secwatch:content:c:项目代号", "项目代号"),
+            (&redact, "secwatch:redact:b:email", "邮箱地址"),
+        ] {
+            assert_eq!(signals.len(), 1, "{key}");
+            let s = &signals[0];
+            assert_eq!(s.key, key);
+            assert_eq!(s.level, Level::Warning, "要发系统通知");
+            assert!(s.event && !s.hold, "每次命中都是一件新的事，不去抖");
+            assert!(s.merge.is_some(), "同时命中的要合成一条");
+            assert!(s.title.contains(name), "{}", s.title);
+            assert!(s.body.contains("relay"), "{}", s.body);
+            assert_eq!(s.view, Some("security"));
+            for leak in ["rm -rf", "SECRET-CODENAME", "example.com"] {
+                assert!(
+                    !s.body.contains(leak) && !s.title.contains(leak),
+                    "{leak} 进了通知"
+                );
+            }
+        }
+        // 防护名用新的叫法，回答一侧说「回答」
+        assert!(
+            redact[0].body.starts_with("密钥与隐私："),
+            "{}",
+            redact[0].body
+        );
+        assert!(
+            content[0].body.contains("的回答命中"),
+            "{}",
+            content[0].body
+        );
+        assert!(tool[0].body.starts_with("危险命令："), "{}", tool[0].body);
     });
-    assert!(signals.is_empty());
+}
+
+/// 防护处于「监控」时每条规则都按仅记录处理：「切断」规则命中了也没切，**照「仅记录」说**，
+/// 不再说「可疑调用、建议在客户端拒绝」
+#[test]
+fn a_cut_rule_in_monitor_is_told_like_record_only() {
+    let signals = rules::from_event(&flagged("relay", "curl-pipe-sh", tw_api::RuleAction::Cut));
+    assert_eq!(signals.len(), 1);
+    assert!(
+        signals[0].key.starts_with("secwatch:"),
+        "{}",
+        signals[0].key
+    );
+}
+
+/// 改了内容的（替换为占位符、删除、替换）只记日志，不通知；一次请求里只有仅记录的那几项说
+#[test]
+fn only_what_was_merely_recorded_is_told() {
+    assert!(rules::from_event(&content_hit("relay", "jailbreak", false, false)).is_empty());
+    let s = rules::from_event(&secrets(
+        "relay",
+        &[("email", true), ("anthropic-api-key", false)],
+    ));
+    assert_eq!(
+        s.iter().map(|s| s.key.as_str()).collect::<Vec<_>>(),
+        ["secwatch:redact:b:email"]
+    );
+}
+
+/// 几条规则同时命中：**合成一条通知**，逐条写规则和上游；列表里还是各是各的
+#[tokio::test(start_paused = true)]
+async fn hits_that_arrive_together_are_told_in_one_notification() {
+    // 测试里缺省是中文（合成那一条在另一个任务里写，`with_lang` 管不到）
+    {
+        let b = bed();
+        for s in rules::from_event(&content_hit("relay", "项目代号", true, true)) {
+            b.bus.ingest(s, T0);
+        }
+        for s in rules::from_event(&secrets("anthropic", &[("email", true)])) {
+            b.bus.ingest(s, T0 + 5);
+        }
+        assert!(b.titles().is_empty(), "要等同时到的几条一起说");
+        wait(MERGE).await;
+        assert_eq!(b.titles(), ["2 条安全规则命中"], "{:?}", b.bodies());
+        let body = b.bodies()[0].clone();
+        assert!(
+            body.contains("「项目代号」· relay") && body.contains("「邮箱地址」· anthropic"),
+            "{body}"
+        );
+        assert_eq!(b.bus.list().len(), 2, "列表里各是一条");
+    }
+}
+
+/// 同一条规则 5 分钟内至多通知一次；冷却结束时还有没说的，合成一条再说
+#[tokio::test(start_paused = true)]
+async fn the_same_rule_is_told_at_most_once_in_five_minutes() {
+    let b = bed();
+    let hit = || rules::from_event(&content_hit("relay", "项目代号", true, true)).remove(0);
+    b.bus.ingest(hit(), T0);
+    wait(MERGE).await;
+    assert_eq!(b.titles().len(), 1);
+    b.bus.ingest(hit(), T0 + 60_000);
+    wait(MERGE).await;
+    b.bus.ingest(hit(), T0 + 120_000);
+    wait(MERGE).await;
+    assert_eq!(b.titles().len(), 1, "冷却期间不再弹：{:?}", b.titles());
+    assert_eq!(b.bus.list()[0].count, 3, "次数照记");
+    wait(COOLDOWN).await;
+    wait(MERGE).await;
+    assert_eq!(b.titles().len(), 2, "冷却结束时说一次：{:?}", b.titles());
+    // 另一条规则不受这一条的冷却影响
+    for s in rules::from_event(&secrets("relay", &[("email", true)])) {
+        b.bus.ingest(s, T0 + 130_000);
+    }
+    wait(MERGE).await;
+    assert_eq!(b.titles().len(), 3, "{:?}", b.titles());
+}
+
+/// 只在应用内的提醒：列表里有，不弹
+#[tokio::test(start_paused = true)]
+async fn in_app_only_a_record_only_hit_is_listed_but_not_shown() {
+    let b = bed();
+    b.bus.set_mode(Mode::App);
+    for s in rules::from_event(&content_hit("relay", "项目代号", true, true)) {
+        b.bus.ingest(s, T0);
+    }
+    wait(MERGE).await;
+    assert!(b.titles().is_empty());
+    assert_eq!(b.bus.list().len(), 1);
+}
+
+/// 切断的那一条照旧单独、立刻说，不等合成
+#[tokio::test(start_paused = true)]
+async fn the_cut_notification_is_kept_and_not_merged() {
+    let b = bed();
+    b.bus.ingest(blocked("relay"), T0);
+    assert_eq!(b.titles().len(), 1, "切断要立刻说");
+    assert!(b.bus.list()[0].key.starts_with("toolwall:"));
 }
 
 #[test]
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 909cd0bb..b5b8168d 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ThinkWatch Lite",
-  "version": "2026.10.18",
+  "version": "2026.10.19",
   "identifier": "app.thinkwatch.lite",
   "build": {
     "beforeDevCommand": "pnpm dev",
diff --git a/src/control.ts b/src/control.ts
index e0e85b47..01b20dec 100644
--- a/src/control.ts
+++ b/src/control.ts
@@ -100,6 +100,7 @@ export const WEBVIEW_ENDPOINTS = [
   "SetSecurityMode",
   "ToggleBuiltinRule",
   "SetBuiltinRuleAction",
+  "SetRulesEnabled",
   "CreateCustomRule",
   "UpdateCustomRule",
   "DeleteCustomRule",
diff --git a/src/events.test.ts b/src/events.test.ts
index 8e04f459..6317034e 100644
--- a/src/events.test.ts
+++ b/src/events.test.ts
@@ -745,21 +745,24 @@ describe("对账时行对象换不换", () => {
   });
 
   /**
-   * 内容过滤：**只有删过文字的进这一行**（「已删除」徽标）。拒绝的随后有一条失败事件，
-   * 只记录的照常发出，都不用在列表上说；`applyBatch` 也只为删过的那一条换新对象。
+   * 内容过滤：**只有删过、换过文字的进这一行**（「已删除」「已替换」徽标）。拒绝的随后有
+   * 一条失败事件，只记录的照常发出，都不用在列表上说；`applyBatch` 也只为改过的那几条
+   * 换新对象。
    */
-  it("内容过滤删过文字的记在这一行，拒绝和只记录的不记", () => {
+  it("内容过滤删过、换过文字的记在这一行，拒绝和只记录的不记", () => {
     const rows = new Map<number, RequestRow>();
     applyEvent(rows, started());
-    const matched = (outcome: "recorded" | "stripped" | "blocked", rule: string) =>
+    const matched = (outcome: "recorded" | "stripped" | "replaced" | "blocked", rule: string) =>
       ({
         kind: "content_matched",
         id: 1,
         provider: "relay",
+        direction: outcome === "replaced" ? "response" : "request",
         rule,
         custom: false,
         match: "codepoints",
-        action: outcome === "stripped" ? "strip" : outcome === "blocked" ? "block" : "record",
+        action:
+          outcome === "stripped" ? "strip" : outcome === "replaced" ? "replace" : outcome === "blocked" ? "block" : "record",
         outcome,
         in_tool_result: true,
         excerpt: "summarize ‹U+E0049 ×74› the diff",
@@ -774,6 +777,8 @@ describe("对账时行对象换不换", () => {
           outcome_detail:
             outcome === "stripped"
               ? { action: "stripped", segments: 1 }
+              : outcome === "replaced"
+                ? { action: "replaced", placeholders: [], segments: 2, replacement: "***" }
               : outcome === "blocked"
                 ? { action: "blocked", client_notice: "[ThinkWatch] refused" }
                 : { action: "recorded" },
@@ -784,8 +789,14 @@ describe("对账时行对象换不换", () => {
     expect(rows.get(1)).toBe(before);
     expect(applyBatch(rows, [matched("stripped", "unicode-tags")])).toBe(true);
     expect(rows.get(1)).not.toBe(before);
+    const afterStrip = rows.get(1);
+    expect(applyBatch(rows, [matched("replaced", "project")])).toBe(true);
+    expect(rows.get(1)).not.toBe(afterStrip);
     applyEvent(rows, matched("blocked", "jailbreak"));
-    expect(rows.get(1)?.stripped).toEqual([{ rule: "unicode-tags", custom: false, count: 74 }]);
+    expect(rows.get(1)?.stripped).toEqual([
+      { rule: "unicode-tags", custom: false, count: 74, replaced: false },
+      { rule: "project", custom: false, count: 74, replaced: true },
+    ]);
   });
 });
 
diff --git a/src/generated/tw-api.ts b/src/generated/tw-api.ts
index 2dcfeb09..8cfac321 100644
--- a/src/generated/tw-api.ts
+++ b/src/generated/tw-api.ts
@@ -1,6 +1,6 @@
 // Generated by tw-api (`tw_api::ts::export_all`). Do not edit by hand.
 
-export const CONTROL_API_VERSION = 47;
+export const CONTROL_API_VERSION = 48;
 
 /**
  * 手动中止（`POST /request/{id}/abort`、`POST /sessions/{id}/abort`）叫停了哪几个请求。
@@ -36,12 +36,12 @@ email?: string | null,
 plan?: ChatgptPlan | null, };
 
 /**
- * 改一条内置规则在第三档下做什么。只有工具调用审查和内容过滤的规则有这一项 ——
- * 出站脱敏的规则命中就替换。
+ * 改一条内置规则在第三档下做什么。
  */
 export type ActionSave = { 
 /**
- * 工具调用审查：`cut` / `record`；内容过滤：`block` / `strip` / `record`
+ * 出站脱敏：`placeholder` / `record`；工具调用审查：`cut` / `record`；内容过滤：`block` /
+ * `strip` / `replace` / `record`
  */
 action: RuleAction, base_version?: string | null, };
 
@@ -904,7 +904,12 @@ export type ContentMatch = "contains" | "regex" | "codepoints";
 /**
  * 一条命中最后怎么样了。
  */
-export type ContentOutcome = "recorded" | "stripped" | "blocked";
+export type ContentOutcome = "recorded" | "stripped" | "replaced" | "blocked";
+
+/**
+ * 一条内容规则查哪一边。
+ */
+export type ContentScope = "request" | "response";
 
 /**
  * 正文里的哪一边。
@@ -1061,18 +1066,29 @@ export type CustomRuleSave = { name: string,
  */
 pattern: string, 
 /**
- * 工具调用审查：`cut` / `record`；内容过滤：`block` / `strip` / `record`。不给按 `record`
+ * 出站脱敏：`placeholder` / `record`，不给按 `placeholder`；工具调用审查：`cut` /
+ * `record`；内容过滤：`block` / `strip` / `replace` / `record`（查回答的不能 `block`）。
+ * 后两项不给按 `record`
  */
 action?: RuleAction | null, 
 /**
- * 怎么认。内容过滤：`contains`（不分大小写的子串）/ `regex` / `codepoints`；出站脱敏：
- * `contains`（按原样找这段文字）/ `regex`。不给按 `contains`。工具调用审查的都是正则
+ * 怎么认。内容过滤：`contains`（按原样找这段文字）/ `regex` / `codepoints`（只查请求）；
+ * 出站脱敏：`contains` / `regex`。不给按 `contains`。工具调用审查的都是正则
  */
 match?: ContentMatch | null, 
 /**
- * 出站脱敏才有：分大小写。不给是不分
+ * 出站脱敏、内容过滤：分大小写。不给是不分
  */
 case_sensitive?: boolean | null, 
+/**
+ * 内容过滤才有：查哪一边，`request` / `response`，两边都查的两个都给。不给是
+ * `["request"]`
+ */
+scope?: Array<ContentScope> | null, 
+/**
+ * 内容过滤才有：动作是替换时换成的文字。不给是 `***`
+ */
+replacement?: string | null, 
 /**
  * 出站脱敏才有：占位符名称，`PROJECT` 换成 `<<TW_PROJECT_1>>`。大写字母开头，其余是
  * 大写字母、数字、下划线，最多 24 个字符。不给是 `SECRET`
@@ -1486,9 +1502,13 @@ billing: Billing,
  */
 egress?: string | null, } | { "kind": "content_matched", id: number, 
 /**
- * 这时要发往的上游（故障转移之前的首选）
+ * 请求里的：这时要发往的上游（故障转移之前的首选）。回答里的：回答它的那一家
  */
 provider: string, 
+/**
+ * 命中在请求里（`request`）还是回答的正文里（`response`）
+ */
+direction: SecurityDirection, 
 /**
  * 内置规则的 id，或者自定义规则的名字
  */
@@ -1498,7 +1518,7 @@ rule: string, custom: boolean,
  */
 match: ContentMatch, 
 /**
- * 这条规则在处置档下做什么：`block` / `strip` / `record`
+ * 这条规则在处置档下做什么：`block` / `strip` / `replace` / `record`
  */
 action: RuleAction, 
 /**
@@ -1506,16 +1526,16 @@ action: RuleAction,
  */
 outcome: ContentOutcome, 
 /**
- * 第一处在工具结果里，而不是调用方自己打的字
+ * 第一处在工具结果里，而不是调用方自己打的字。回答里的是 false
  */
 in_tool_result: boolean, 
 /**
- * 第一处前后的一小段，**已截断**。码位规则命中的字符画成 `‹U+E0049›`，连成一串
- * 的写成 `‹U+E0049 ×12›`
+ * 第一处前后的一小段，**已截断、已打码**。码位规则命中的字符画成 `‹U+E0049›`，连成
+ * 一串的写成 `‹U+E0049 ×12›`
  */
 excerpt: string, 
 /**
- * 这条规则在整个请求里命中了几处；码位规则是几个字符
+ * 这条规则在整个请求（或者这次回答）里命中了几处；码位规则是几个字符
  */
 count: number, 
 /**
@@ -2593,12 +2613,12 @@ base_version?: string | null, };
  */
 export type Matcher = { "kind": "prefix", prefix: string, min_tail: number, } | { "kind": "openai-legacy", min_len: number, } | { "kind": "pem" } | { "kind": "jwt" } | { "kind": "conn-string" } | { "kind": "private-ip" } | { "kind": "domain-suffix", suffixes: Array<string>, } | { "kind": "cn-resident-id", born_since: number, } | { "kind": "bank-card", networks: Array<CardNetwork>, } | { "kind": "email" } | { "kind": "cn-mobile-phone" } | { "kind": "regex", pattern: string, 
 /**
- * 分大小写：工具调用审查的规则（开头写了 `(?i)` 的除外）、写明了要分的出站脱敏
- * 自定义规则。内容过滤的不分
+ * 分大小写：工具调用审查的规则（开头写了 `(?i)` 的除外）、写明了要分的出站脱敏和
+ * 内容过滤的自定义规则。内容过滤的内置规则不分
  */
 case_sensitive?: boolean, } | { "kind": "contains", text: string, 
 /**
- * 分大小写：写明了要分的出站脱敏自定义规则。内容过滤的不分
+ * 分大小写：写明了要分的自定义规则。内容过滤的内置规则不分
  */
 case_sensitive?: boolean, } | { "kind": "codepoints", ranges: Array<string>, } | { "kind": "builtin", check: string, };
 
@@ -2899,7 +2919,7 @@ export type OnProxyFail = "fail" | "direct";
  * 具体做了什么（[`SecurityEventView::outcome_detail`]），按 `action` 分，和
  * [`SecurityOutcome`] 一一对应。
  */
-export type OutcomeDetail = { "action": "recorded", } | { "action": "replaced", placeholders: Array<string>, } | { "action": "cut", tool: string, arguments: string, truncated: boolean, client_notice: string, } | { "action": "blocked", client_notice: string, } | { "action": "stripped", segments: number, };
+export type OutcomeDetail = { "action": "recorded", } | { "action": "replaced", placeholders: Array<string>, segments?: number, replacement?: string, } | { "action": "cut", tool: string, arguments: string, truncated: boolean, client_notice: string, } | { "action": "blocked", client_notice: string, } | { "action": "stripped", segments: number, };
 
 /**
  * 界面要显示的配置概览。
@@ -4219,10 +4239,10 @@ denied_by?: string | null,
 affinity?: AffinityView | null, attempts: Array<AttemptView>, };
 
 /**
- * 一条规则在第三档下做什么。工具调用审查是 `cut` / `record`，内容过滤是 `block` /
- * `strip` / `record`；出站脱敏的规则命中即替换，没有这一项。
+ * 一条规则在第三档下做什么。出站脱敏是 `placeholder` / `record`，工具调用审查是 `cut` /
+ * `record`，内容过滤是 `block` / `strip` / `replace` / `record`。
  */
-export type RuleAction = "cut" | "block" | "strip" | "record";
+export type RuleAction = "placeholder" | "cut" | "block" | "strip" | "replace" | "record";
 
 /**
  * 一条命中的规则起了什么作用。
@@ -4399,6 +4419,20 @@ phase_two: boolean,
  */
 shadowed: boolean, };
 
+/**
+ * 一次启用或停用一项防护里的几条规则（组标题上的复选框）：内置的按 id，自定义的按名字，
+ * **写一次配置**。和出厂一样的不写进文件。
+ */
+export type RulesToggle = { 
+/**
+ * 内置规则的 id
+ */
+builtin: Array<string>, 
+/**
+ * 自定义规则的名字
+ */
+custom: Array<string>, enabled: boolean, base_version?: string | null, };
+
 /**
  * 一个在跑的请求。
  */
@@ -4463,6 +4497,11 @@ kind: SecretKind,
  * 只留最后四位（`…1234`），邮箱只留第一个字和域名（`z…@example.com`）
  */
 masked: string, count: number, 
+/**
+ * 换成了占位符：拦截档下、规则的动作是换成占位符。`false` 是只记录（观察档，或者规则的
+ * 动作是「仅记录」），原值照发
+ */
+replaced: boolean, 
 /**
  * 每一处在哪儿、当时的规则、具体做了什么（见 [`SecurityHitDetail`]）
  */
@@ -4504,7 +4543,11 @@ content_blocked: number,
 /**
  * 其中命中的文字删掉之后发出的
  */
-content_stripped: number, };
+content_stripped: number, 
+/**
+ * 其中命中的文字换成替换文本之后发出的
+ */
+content_replaced: number, };
 
 /**
  * 三项防护。
@@ -4521,7 +4564,7 @@ export type SecurityDirection = "request" | "response";
  *
  * **一条是一次命中**：出站脱敏是「一个请求里的一个值」（出现几次合成
  * 一条，`count` 说几次），工具调用审查是「一个工具调用命中一条规则」，内容过滤是
- * 「一个请求命中一条规则」。
+ * 「一个请求（或者一次回答）命中一条规则」。
  */
 export type SecurityEventView = { id: number, at_ms: number, request_id: number, guard: Guard, 
 /**
@@ -4529,8 +4572,9 @@ export type SecurityEventView = { id: number, at_ms: number, request_id: number,
  */
 rule: string, custom: boolean, 
 /**
- * 做了什么：`recorded`（只记录）/ `replaced`（已替换）/ `cut`（已切断）/
- * `stripped`（命中的文字删掉之后发出）/ `blocked`（请求被拒，没有发出去）
+ * 做了什么：`recorded`（只记录）/ `replaced`（出站脱敏换成了占位符，内容过滤换成了
+ * 替换文本）/ `cut`（已切断）/ `stripped`（命中的文字删掉之后发出）/ `blocked`（请求被拒，
+ * 没有发出去）
  */
 action: SecurityOutcome, 
 /**
@@ -4592,7 +4636,7 @@ session?: string | null,
  */
 sent_model?: string | null, 
 /**
- * 查的是请求（出站脱敏、内容过滤）还是回答（工具调用审查）
+ * 查的是请求（出站脱敏、内容过滤）还是回答（工具调用审查、查回答的内容过滤）
  */
 direction: SecurityDirection, 
 /**
@@ -4717,7 +4761,8 @@ kind: string, matcher: Matcher, enabled: boolean,
  */
 on_by_default: boolean, 
 /**
- * 工具调用审查、内容过滤：第三档下做什么
+ * 第三档下做什么：出站脱敏 `placeholder` / `record`，工具调用审查 `cut` / `record`，
+ * 内容过滤 `block` / `strip` / `replace` / `record`
  */
 action?: RuleAction | null, 
 /**
@@ -4728,7 +4773,17 @@ default_action?: RuleAction | null,
  * 出站脱敏：占位符里的标签，`SECRET` 换成 `<<TW_SECRET_1>>`。内置和自定义的都有，
  * 别的防护没有
  */
-label?: string | null, };
+label?: string | null, 
+/**
+ * 内容过滤：查哪一边，`request` / `response`，两边都查的两个都在。内置规则只查请求。
+ * 别的防护没有
+ */
+scope?: Array<ContentScope> | null, 
+/**
+ * 内容过滤：动作是替换时换成的文字（不写是 `***`，这里写明）。内置规则是 `***`。
+ * 别的防护没有
+ */
+replacement?: string | null, };
 
 /**
  * 试出来的一处。
@@ -4749,7 +4804,7 @@ start: number, end: number,
  */
 excerpt: string, 
 /**
- * 工具调用审查、内容过滤：第三档下做什么
+ * 第三档下做什么
  */
 action?: RuleAction | null, };
 
@@ -4767,7 +4822,7 @@ pattern?: string | null,
  */
 match?: ContentMatch | null, 
 /**
- * 出站脱敏试 `pattern` 时分不分大小写。不给是不分
+ * 出站脱敏、内容过滤试 `pattern` 时分不分大小写。不给是不分
  */
 case_sensitive?: boolean | null, 
 /**
@@ -4781,12 +4836,21 @@ rule?: string | null,
 label?: string | null, 
 /**
  * 试的这一条在第三档下做什么，`output` 和 `refused` 按它算：试一条还没存的规则
- * （`pattern`），或者预览一条内置规则改了处置之后（`rule`）。工具调用审查是 `cut` /
- * `record`，内容过滤是 `block` / `strip` / `record`，出站脱敏没有这一项。不给就按配置
- * 里的处置（还没存的规则按自定义规则不写处置时的那个：仅记录）。都没给 `pattern`、
- * `rule` 时用不上
+ * （`pattern`），或者预览一条内置规则改了动作之后（`rule`）。出站脱敏是 `placeholder` /
+ * `record`，工具调用审查是 `cut` / `record`，内容过滤是 `block` / `strip` / `replace` /
+ * `record`。不给就按配置里的动作（还没存的规则按自定义规则不写动作时的那个：出站脱敏
+ * 换成占位符，别的仅记录）。都没给 `pattern`、`rule` 时用不上
  */
-action?: RuleAction | null, };
+action?: RuleAction | null, 
+/**
+ * 内容过滤：样本当成哪一边测，`request`（调用方发来的正文，不给就是它）或者 `response`
+ * （模型回答的正文）。按回答测时只用查回答的规则，试的 `pattern` 也当成查回答的规则
+ */
+scope?: ContentScope | null, 
+/**
+ * 内容过滤试 `pattern`、动作是替换时换成的文字。不给是 `***`
+ */
+replacement?: string | null, };
 
 /**
  * 试的结果。
@@ -4797,8 +4861,8 @@ export type SecurityTestResult = {
  */
 hits: Array<SecurityTestHit>, 
 /**
- * 第三档下发出去的样子：出站脱敏是换过占位符的样本，内容过滤是删过的样本。没有
- * 变化（或者内容过滤会拒绝这个请求）是 null
+ * 第三档下发出去的样子：出站脱敏是换过占位符的样本，内容过滤是删过、换过的样本（按
+ * 回答测时是客户端收到的那一段）。没有变化（或者内容过滤会拒绝这个请求）是 null
  */
 output: string | null, 
 /**
@@ -5597,6 +5661,7 @@ export const ENDPOINTS = {
   SetSecurityMode: { method: "PUT", path: "/security/{guard}/mode", params: ["guard"], format: "json" },
   ToggleBuiltinRule: { method: "PUT", path: "/security/{guard}/builtin/{id}", params: ["guard", "id"], format: "json" },
   SetBuiltinRuleAction: { method: "PUT", path: "/security/{guard}/builtin/{id}/action", params: ["guard", "id"], format: "json" },
+  SetRulesEnabled: { method: "PUT", path: "/security/{guard}/rules/enabled", params: ["guard"], format: "json" },
   CreateCustomRule: { method: "POST", path: "/security/{guard}/custom", params: ["guard"], format: "json" },
   UpdateCustomRule: { method: "PUT", path: "/security/{guard}/custom/{name}", params: ["guard", "name"], format: "json" },
   DeleteCustomRule: { method: "DELETE", path: "/security/{guard}/custom/{name}", params: ["guard", "name"], format: "json" },
@@ -5726,6 +5791,7 @@ export type Endpoints = {
   SetSecurityMode: { req: ModeSave; res: ConfigWritten };
   ToggleBuiltinRule: { req: RuleToggle; res: ConfigWritten };
   SetBuiltinRuleAction: { req: ActionSave; res: ConfigWritten };
+  SetRulesEnabled: { req: RulesToggle; res: ConfigWritten };
   CreateCustomRule: { req: CustomRuleSave; res: ConfigWritten };
   UpdateCustomRule: { req: CustomRuleSave; res: ConfigWritten };
   DeleteCustomRule: { req: BaseVersion; res: ConfigWritten };
diff --git a/src/guide/guide.i18n.ts b/src/guide/guide.i18n.ts
index b91c8bf8..b7a43d55 100644
--- a/src/guide/guide.i18n.ts
+++ b/src/guide/guide.i18n.ts
@@ -56,8 +56,8 @@ export const guideText = messages(
 
     // 安全页
     /** 此刻停在「观察」的有几项 */
-    observeTitle: (n: number) => `${n} 项防护处于「观察」`,
-    observeBody: "命中时只记录。在日志中确认没有误报后，再切换到「替换」「切断」或「处置」。",
+    observeTitle: (n: number) => `${n} 项防护处于「监控」`,
+    observeBody: "命中时只记录并发出通知。在日志中确认没有误报后，再切换为「开启」。",
 
     // 设置
     hintsLabel: "引导提示",
@@ -105,9 +105,9 @@ export const guideText = messages(
     openRowTitle: "Open a request for its details",
     openRowBody: "The routing rule it matched, the upstreams it tried, its usage and cost, and any redacted values.",
 
-    observeTitle: (n: number) => (n === 1 ? "1 protection is set to Observe" : `${n} protections are set to Observe`),
+    observeTitle: (n: number) => (n === 1 ? "1 protection is set to Monitor" : `${n} protections are set to Monitor`),
     observeBody:
-      "Matches are only recorded. Once the log shows no false positives, switch to Replace, Cut off or Enforce.",
+      "Matches are only recorded and notified. Once the log shows no false positives, switch to On.",
 
     hintsLabel: "Guidance",
     hintsHint: "Hints set to “Don’t show again” and ignored warnings reappear.",
diff --git a/src/i18n/core.zh.json b/src/i18n/core.zh.json
index 6ce53549..e97cd479 100644
--- a/src/i18n/core.zh.json
+++ b/src/i18n/core.zh.json
@@ -9,8 +9,8 @@
       "rule": "规则",
       "group": "策略组",
       "gateway key": "网关密钥",
-      "redaction rule": "出站脱敏规则",
-      "tool-call rule": "工具调用审查规则",
+      "redaction rule": "密钥与隐私规则",
+      "tool-call rule": "危险命令规则",
       "content rule": "内容过滤规则",
       "plugin": "插件",
       "alias": "别名"
@@ -21,8 +21,8 @@
       "boolean": "true 或 false"
     },
     "rule_line": {
-      "redaction": "出站脱敏",
-      "tool-call": "工具调用审查",
+      "redaction": "密钥与隐私",
+      "tool-call": "危险命令",
       "content": "内容过滤"
     },
     "pattern_of": {
@@ -115,8 +115,8 @@
       "private_use": "私用区码位"
     },
     "guard": {
-      "redact": "出站脱敏",
-      "inspect_tools": "工具调用审查",
+      "redact": "密钥与隐私",
+      "inspect_tools": "危险命令",
       "content": "内容过滤"
     },
     "scan_rule": {
@@ -142,6 +142,38 @@
       "thinkwatch-data": "读写 ThinkWatch 自己的数据",
       "upload-file-to-host": "上传本地文件到外部主机"
     },
+    "secret_rule": {
+      "anthropic-api-key": "Anthropic API 密钥",
+      "openai-api-key": "OpenAI API 密钥",
+      "openai-project-key": "OpenAI 项目密钥",
+      "github-personal-token": "GitHub 个人令牌",
+      "github-oauth-token": "GitHub OAuth 令牌",
+      "github-server-token": "GitHub 服务器令牌",
+      "github-user-token": "GitHub 用户令牌",
+      "github-fine-grained-token": "GitHub 细粒度令牌",
+      "slack-bot-token": "Slack 机器人令牌",
+      "slack-user-token": "Slack 用户令牌",
+      "slack-app-token": "Slack 应用令牌",
+      "aws-access-key-id": "AWS 访问密钥 ID",
+      "aws-temporary-key-id": "AWS 临时访问密钥 ID",
+      "google-api-key": "Google API 密钥",
+      "google-oauth-token": "Google OAuth 令牌",
+      "gitlab-token": "GitLab 令牌",
+      "stripe-live-key": "Stripe 生产密钥",
+      "stripe-restricted-key": "Stripe 受限密钥",
+      "npm-token": "npm 令牌",
+      "digitalocean-token": "DigitalOcean 令牌",
+      "sendgrid-key": "SendGrid 密钥",
+      "private-key": "私钥",
+      "jwt": "JWT",
+      "conn-string-password": "连接串口令",
+      "cn-resident-id": "居民身份证号",
+      "bank-card": "银行卡号",
+      "email": "邮箱地址",
+      "cn-mobile-phone": "中国大陆手机号",
+      "internal-ip": "内网地址",
+      "internal-domain": "内部域名"
+    },
     "content_rule": {
       "unicode-tags": "Unicode 标签字符",
       "bidi-controls": "双向控制符",
@@ -493,14 +525,18 @@
     "security.unknown_rule": "没有名为「{rule}」的内置规则。",
     "security.rule_name_empty": "规则需要一个名称。",
     "security.bad_pattern": "正则表达式有误：{detail}",
-    "security.unknown_action": "「{action}」不是一种处置，只能是 cut 或 record。",
-    "security.content_action_unknown": "「{action}」不是一种处置，只能是 block、strip 或 record。",
+    "security.unknown_action": "「{action}」不是可用的动作，只能是 cut 或 record。",
+    "security.content_action_bad": "「{action}」不是可用的动作，只能是 block、strip、replace 或 record。",
+    "security.redact_action_unknown": "「{action}」不是可用的动作，只能是 placeholder 或 record。",
     "security.bad_content_pattern": "匹配内容无法使用：{detail}",
     "security.bad_codepoints": "码位写法有误：{detail}",
     "security.bad_label": "占位符名称「{label}」不可用：须以大写字母开头，由 1 到 24 个大写字母、数字或下划线组成。",
-    "security.redact_match_bad": "出站脱敏规则只能按「包含」或「正则」匹配，不支持「{matching}」。",
+    "security.redact_match_bad": "密钥与隐私规则只能按「包含」或「正则」匹配，不支持「{matching}」。",
     "security.pattern_empty": "匹配内容为空。",
-    "security.no_action_of_its_own": "{guard:guard}的规则不单独设处置，命中后的处理由档位决定。",
+    "security.unknown_custom_rule": "没有名为「{rule}」的自定义规则。",
+    "security.rule_scope_empty": "内容规则须至少检查请求或回答中的一项。",
+    "security.rule_scope_block": "检查回答的规则不能拒绝：发现命中时，回答已在发送途中。请选择删除、替换或仅记录。",
+    "security.rule_scope_codepoints": "码位只在请求中检查，检查回答的规则须按「包含」或「正则」匹配。",
     "control.session_not_found": "未找到会话 {id}。",
     "control.session_not_running": "会话 {id} 没有正在进行的请求。",
     "control.client_unknown": "未知的客户端「{client}」。",
@@ -684,8 +720,11 @@
     "config.rule_pattern_empty": "自定义{what:rule_line}规则「{name}」的{what:pattern_of}为空。",
     "config.rule_pattern_bad": "自定义{what:rule_line}规则「{name}」的{what:pattern_of}有误：{detail}",
     "config.rule_codepoints_bad": "自定义内容过滤规则「{name}」的码位写法有误：{detail}",
-    "config.rule_label_bad": "自定义出站脱敏规则「{name}」的占位符名称为「{label}」，须以大写字母开头，由 1 到 24 个大写字母、数字或下划线组成。",
-    "config.rule_match_bad": "自定义出站脱敏规则「{name}」的匹配方式为「{matching}」，出站脱敏规则只能为 contains 或 regex。",
+    "config.rule_label_bad": "密钥与隐私的自定义规则「{name}」的占位符名称为「{label}」，须以大写字母开头，由 1 到 24 个大写字母、数字或下划线组成。",
+    "config.rule_scope_empty": "自定义内容过滤规则「{name}」的检查对象（scope）为空，须至少包含 request 或 response。",
+    "config.rule_scope_block": "自定义内容过滤规则「{name}」检查回答，动作却为 block。发现命中时回答已在发送途中，检查回答的规则只能为 strip、replace 或 record。",
+    "config.rule_scope_codepoints": "自定义内容过滤规则「{name}」检查回答，匹配方式却为 codepoints。码位只在请求中检查，检查回答的规则只能为 contains 或 regex。",
+    "config.rule_match_bad": "密钥与隐私的自定义规则「{name}」的匹配方式为「{matching}」，密钥与隐私规则只能为 contains 或 regex。",
     "config.unknown_rule": "security.{guard} 中的「{rule}」不是内置规则。",
     "config.failover_range": "failover.{field} 为 {value}，须在 {min} 到 {max} 之间。",
     "config.plugin.bad_id": "插件 ID「{plugin}」写法有误：只能使用小写字母、数字和连字符，1 到 {max} 个字符。",
diff --git a/src/i18n/terminology.md b/src/i18n/terminology.md
index d16bff36..321be533 100644
--- a/src/i18n/terminology.md
+++ b/src/i18n/terminology.md
@@ -100,14 +100,15 @@ known colloquialisms.
 | 尝试链 | attempts | |
 | 命中规则 / 经过策略组 | Matched rule / Via group | |
 | 格式转换 / 丢弃字段 | format conversion / dropped fields | |
-| 出站脱敏 / 脱敏 / 已脱敏 | outbound redaction / redaction / Redacted | |
-| 工具调用审查 | tool-call inspection | |
-| 内容过滤 | content filter | hidden characters are one group of its built-in rules |
+| 密钥与隐私 / 脱敏 / 已脱敏 | Secrets & privacy / redaction / Redacted | the protection (config key `security.redact`) |
+| 危险命令 | Dangerous commands | the protection (config key `security.inspect_tools`) |
+| 内容过滤 | Content filter | checks request text and answer text per rule (检查对象 / Checks); hidden characters are one group of its built-in rules |
 | 可疑工具调用 / 已拦截 | suspicious tool call / Blocked | traffic badges |
 | 配置面扫描 | config scan | scanning client configuration files |
-| 关闭 / 观察 | Off / Observe | the first two modes of every protection |
-| 替换 / 切断 / 处置 | Replace / Cut off / Enforce | the third mode, named per protection: redaction / tool-call inspection / content filter; counted together in the page header as 处置 (enforcing) |
-| 拒绝 / 删除 / 仅记录 / 切断 | Refuse / Delete / Record only / Cut off | what a rule does in the third mode (column 处置 / Action) |
+| 开启 / 监控 / 关闭 | On / Monitor / Off | the three states of every protection (`enforce` / `observe` / `off`); under 监控 every rule only records, and the action column adds 监控中 / Monitoring |
+| 替换为占位符 / 切断 / 拒绝 / 删除 / 替换 / 仅记录 | Replace with placeholder / Cut off / Refuse / Delete / Replace / Record only | what a rule does when its protection is On (column 动作 / Action); 仅记录 also raises a system notification |
+| 检查对象：请求 / 回答 / 请求和回答 | Checks: Request / Answer / Request and answer | content rules; 按请求测试 / 按回答测试 = Test as request / Test as answer |
+| 替换文本 | Replacement text | content rules, default `***` |
 | 已拒绝 / 已删除 / 已替换 / 已切断 / 仅记录 | Refused / Deleted / Replaced / Cut off / Recorded | what happened, in the security log |
 | 匹配方式：包含 / 正则 / 码位 | Match by: Contains / Regex / Code points | content rules |
 | 占位符名称 | placeholder name | `<<TW_NAME_n>>` in redaction |
diff --git a/src/labels.i18n.ts b/src/labels.i18n.ts
index 8d003c4b..1f42a83a 100644
--- a/src/labels.i18n.ts
+++ b/src/labels.i18n.ts
@@ -1,4 +1,6 @@
 import { messages } from "@/i18n";
+// 密钥与隐私的规则名和 core 消息的中文是同一张表（Rust 写系统通知时也读它）
+import CORE_ZH from "@/i18n/core.zh.json";
 
 /** `labels.ts` 里那些名称表和说法 */
 export const labelsText = messages(
@@ -114,38 +116,8 @@ export const labelsText = messages(
     },
 
     // ------------------------------------------------------------ 安全
-    secrets: {
-      "anthropic-api-key": "Anthropic API 密钥",
-      "openai-api-key": "OpenAI API 密钥",
-      "openai-project-key": "OpenAI 项目密钥",
-      "github-personal-token": "GitHub 个人令牌",
-      "github-oauth-token": "GitHub OAuth 令牌",
-      "github-server-token": "GitHub 服务器令牌",
-      "github-user-token": "GitHub 用户令牌",
-      "github-fine-grained-token": "GitHub 细粒度令牌",
-      "slack-bot-token": "Slack 机器人令牌",
-      "slack-user-token": "Slack 用户令牌",
-      "slack-app-token": "Slack 应用令牌",
-      "aws-access-key-id": "AWS 访问密钥 ID",
-      "aws-temporary-key-id": "AWS 临时访问密钥 ID",
-      "google-api-key": "Google API 密钥",
-      "google-oauth-token": "Google OAuth 令牌",
-      "gitlab-token": "GitLab 令牌",
-      "stripe-live-key": "Stripe 生产密钥",
-      "stripe-restricted-key": "Stripe 受限密钥",
-      "npm-token": "npm 令牌",
-      "digitalocean-token": "DigitalOcean 令牌",
-      "sendgrid-key": "SendGrid 密钥",
-      "private-key": "私钥",
-      jwt: "JWT",
-      "conn-string-password": "连接串口令",
-      "cn-resident-id": "居民身份证号",
-      "bank-card": "银行卡号",
-      email: "邮箱地址",
-      "cn-mobile-phone": "中国大陆手机号",
-      "internal-ip": "内网地址",
-      "internal-domain": "内部域名",
-    },
+    /** 密钥与隐私的内置规则名。和系统通知（Rust）共用 core.zh.json 里的同一张表 */
+    secrets: CORE_ZH.tables.secret_rule as Record<string, string>,
 
     // ------------------------------------------------------------ 客户端接管
     takesEffect: {
diff --git a/src/overview/overview.i18n.ts b/src/overview/overview.i18n.ts
index fa064d0a..0cc7a490 100644
--- a/src/overview/overview.i18n.ts
+++ b/src/overview/overview.i18n.ts
@@ -22,7 +22,7 @@ export const overviewText = messages(
     /** 失败过半集中在一个上游时点出它；全在一个上游时说「均」 */
     attnFailed: (n: number, top: { name: string; n: number } | null) =>
       `${n} 次请求失败` + (top ? (top.n === n ? `，均发生在 ${top.name}` : `，其中 ${top.name} ${top.n} 次`) : ""),
-    attnToolCut: (n: number) => `工具调用审查切断了 ${n} 个可疑工具调用`,
+    attnToolCut: (n: number) => `危险命令防护切断了 ${n} 个可疑工具调用`,
     attnUpstream: (name: string, why: string) => `${name} ${why}`,
     attnUpstreams: (n: number, names: string[]) =>
       `${n} 个上游不可用：${names.slice(0, 3).join("、")}${names.length > 3 ? " 等" : ""}`,
@@ -151,7 +151,7 @@ export const overviewText = messages(
       (n === 1 ? "1 request failed" : `${n} requests failed`) +
       (top ? (top.n === n ? (n === 1 ? ` on ${top.name}` : `, all on ${top.name}`) : `, ${top.n} of them on ${top.name}`) : ""),
     attnToolCut: (n: number) =>
-      n === 1 ? "Tool-call inspection cut off 1 suspicious tool call" : `Tool-call inspection cut off ${n} suspicious tool calls`,
+      n === 1 ? "Dangerous-command protection cut off 1 suspicious tool call" : `Dangerous-command protection cut off ${n} suspicious tool calls`,
     attnUpstream: (name: string, why: string) => `${name}: ${why}`,
     attnUpstreams: (n: number, names: string[]) =>
       `${n} upstreams unavailable: ${names.slice(0, 3).join(", ")}${names.length > 3 ? ", …" : ""}`,
diff --git a/src/overview/series.test.ts b/src/overview/series.test.ts
index 1a775468..6083232e 100644
--- a/src/overview/series.test.ts
+++ b/src/overview/series.test.ts
@@ -46,6 +46,7 @@ function summary(over: Partial<Summary> = {}): Summary {
       content: 0,
       content_blocked: 0,
       content_stripped: 0,
+      content_replaced: 0,
     },
     pricing_date: "2026-09-20",
     ...over,
diff --git a/src/security/GuardTab.i18n.tsx b/src/security/GuardTab.i18n.tsx
index 6754d9d2..bba14364 100644
--- a/src/security/GuardTab.i18n.tsx
+++ b/src/security/GuardTab.i18n.tsx
@@ -1,125 +1,88 @@
 import { messages } from "@/i18n";
-import type { GuardMode } from "@/types";
-
-/** 一项防护在三档下各做什么。**代价写在切换之前** */
-export interface GuardCopy {
-  /** 这项防护做什么，一句话 */
-  lead: string;
-  now: Record<GuardMode, string>;
-  /** 第三档在这一项上做的事 */
-  effect: string;
-  /** 第三档的代价 */
-  risk: string;
-}
+import type { Guard, GuardMode } from "@/types";
 
 const plural = (n: number, one: string, many: string) => `${n} ${n === 1 ? one : many}`;
 
 export const guardTabText = messages(
   {
-    redact: {
-      lead: "请求发出前，按以下规则查找凭据和个人信息。",
-      now: {
-        off: "当前：不检查，不记录。",
-        observe: "当前：检出的内容记入日志，请求原样发出。",
-        enforce: "当前：检出的内容替换为占位符后发出，响应中的占位符还原为原值。",
-      },
-      effect: "检出的内容替换为占位符后发出，响应中的占位符还原为原值。",
-      risk: "请求内容改变后，上游缓存可能无法命中。",
-    } as GuardCopy,
-    inspect_tools: {
-      lead: "检查上游返回的工具调用参数。",
-      now: {
-        off: "当前：不检查，不记录。",
-        observe: "当前：命中的调用记入日志，照常返回。",
-        enforce:
-          "当前：命中「切断」规则的调用不会完整到达客户端，因而无法执行；命中「仅记录」规则的调用照常返回。两类都记入日志。",
-      },
-      effect: "命中「切断」规则的调用不会完整到达客户端，因而无法执行。",
-      risk: "误判时，回答会在该调用处中断。",
-    } as GuardCopy,
-    content: {
-      lead: "按以下规则检查请求中的用户消息和工具结果。",
-      now: {
-        off: "当前：不检查，不记录。",
-        observe: "当前：命中的内容记入日志，请求原样发出。",
-        enforce:
-          "当前：命中「拒绝」规则的请求不发出，客户端收到拒绝的原因；命中「删除」规则的内容删除后发出；命中「仅记录」规则的请求照常发出。三类都记入日志。",
+    /**
+     * 状态选择右边那一句：当前状态下命中之后怎样。「开启」各项一样（按每条规则的动作）；
+     * 「监控」说清记录、通知、内容不变
+     */
+    now: {
+      enforce: "开启：命中内容按各条规则设定的动作处理。",
+      observe: {
+        redact: "监控：命中内容记入日志并发出通知，请求不作修改。",
+        inspect_tools: "监控：命中的工具调用记入日志并发出通知，照常返回客户端。",
+        content: "监控：命中内容记入日志并发出通知，请求与回答不作修改。",
       },
-      effect: "命中「拒绝」规则的请求不发出，命中「删除」规则的内容删除后发出。",
-      risk: "误判时，正常的请求会被拒绝，或正常的文字被删除。",
-    } as GuardCopy,
-    /** 不在第三档时，档位下面那一句：切过去之后会怎样，代价是什么 */
-    ifEnforced: (mode: string, effect: string, risk: string) => `切换到「${mode}」后：${effect}${risk}`,
-    rules: "规则",
-    ruleCount: (on: number, all: number) => `已启用 ${on} 条，共 ${all} 条`,
+      off: "关闭：不检查，不记录。",
+    } as { enforce: string; observe: Record<Guard, string>; off: string },
+    ruleCount: (on: number, all: number) => `已启用 ${on} 条，共 ${all} 条。`,
+    /** 规则表上方的检索框 */
+    search: "检索规则",
+    noMatch: "无匹配的规则",
     test: "测试…",
     newRule: "新建规则",
-    rule: "规则",
-    match: "匹配",
-    /** 规则在第三档下做什么 */
-    action: "处置",
     enabled: "启用",
-    builtinGroup: "内置",
-    view: "查看规则",
+    rule: "规则",
+    match: "匹配内容",
+    /** 内容规则查哪一边 */
+    scope: "检查对象",
+    /** 规则在「开启」状态下做什么 */
+    action: "动作",
+    /** 组标题：「隐藏字符 · 内置 · 已启用 2 条，共 3 条」 */
+    builtin: "内置",
+    groupCount: (on: number, all: number) => `已启用 ${on} 条，共 ${all} 条`,
+    /** 组标题的复选框 */
+    groupToggle: (group: string) => `启用「${group}」中的全部规则`,
+    /** 行内的动作选择，给读屏 */
+    actionFor: (name: string) => `「${name}」的动作`,
+    /** 动作为「替换」时，行内选项写出换成什么 */
+    replaceWith: (text: string) => `替换为 ${text}`,
     turnOn: "启用",
     turnOff: "停用",
     copyAsCustom: "复制为自定义规则",
     actionsFor: (name: string) => `${name} 的操作`,
     toggleFor: (name: string) => `启用「${name}」`,
-    modeFor: (guard: string) => `${guard}的档位`,
+    modeFor: (guard: string) => `${guard}的状态`,
   },
   {
-    redact: {
-      lead: "Before a request is sent, it is searched for credentials and personal information using the rules below.",
-      now: {
-        off: "Currently: nothing is checked or recorded.",
-        observe: "Currently: what is found is recorded in the log, and the request is sent unchanged.",
-        enforce:
-          "Currently: what is found is replaced with placeholders before sending, and the placeholders in the response are restored to the original values.",
-      },
-      effect:
-        "what is found is replaced with placeholders before sending, and the placeholders in the response are restored to the original values. ",
-      risk: "Once the request content changes, the upstream cache may no longer be hit.",
-    },
-    inspect_tools: {
-      lead: "Tool-call arguments returned by the upstream are checked.",
-      now: {
-        off: "Currently: nothing is checked or recorded.",
-        observe: "Currently: matching calls are recorded in the log and returned as usual.",
-        enforce:
-          "Currently: calls that match a “cut off” rule never fully reach the client, so they cannot run; calls that match a “record only” rule are returned as usual. Both are recorded in the log.",
-      },
-      effect: "calls that match a “cut off” rule never fully reach the client, so they cannot run. ",
-      risk: "On a false match, the answer stops at that call.",
-    },
-    content: {
-      lead: "User messages and tool results in each request are checked against the rules below.",
-      now: {
-        off: "Currently: nothing is checked or recorded.",
-        observe: "Currently: matches are recorded in the log, and the request is sent unchanged.",
-        enforce:
-          "Currently: a request that matches a “refuse” rule is not sent, and the client is told why; text that matches a “delete” rule is deleted before sending; a request that matches a “record only” rule is sent as usual. All three are recorded in the log.",
+    now: {
+      enforce: "On: matches are handled by the action set on each rule.",
+      observe: {
+        redact: "Monitor: matches are recorded in the log and notified; requests are not changed.",
+        inspect_tools:
+          "Monitor: matching tool calls are recorded in the log and notified, and are returned to the client as usual.",
+        content: "Monitor: matches are recorded in the log and notified; requests and answers are not changed.",
       },
-      effect:
-        "a request that matches a “refuse” rule is not sent, and text that matches a “delete” rule is deleted before sending. ",
-      risk: "On a false match, an ordinary request is refused, or ordinary text is deleted.",
+      off: "Off: nothing is checked or recorded.",
     },
-    ifEnforced: (mode: string, effect: string, risk: string) => `After switching to ${mode}: ${effect}${risk}`,
-    rules: "Rules",
-    ruleCount: (on: number, all: number) => `${on} of ${plural(all, "rule", "rules")} on`,
+    ruleCount: (on: number, all: number) => `${on} of ${plural(all, "rule", "rules")} on.`,
+    search: "Search rules",
+    noMatch: "No matching rules",
     test: "Test…",
     newRule: "New rule",
+    enabled: "On",
     rule: "Rule",
     match: "Match",
+    scope: "Checks",
     action: "Action",
-    enabled: "On",
-    builtinGroup: "Built-in",
-    view: "View rule",
+    builtin: "Built-in",
+    groupCount: (on: number, all: number) => `${on} of ${all} on`,
+    groupToggle: (group: string) => `Turn on all rules in “${group}”`,
+    actionFor: (name: string) => `Action for “${name}”`,
+    replaceWith: (text: string) => `Replace with ${text}`,
     turnOn: "Turn on",
     turnOff: "Turn off",
     copyAsCustom: "Copy as a custom rule",
     actionsFor: (name: string) => `Actions for ${name}`,
     toggleFor: (name: string) => `Turn on “${name}”`,
-    modeFor: (guard: string) => `${guard} mode`,
+    modeFor: (guard: string) => `${guard} state`,
   },
 );
+
+/** 「开启」「监控」「关闭」下那一句 */
+export function nowText(t: typeof guardTabText.zh, guard: Guard, mode: GuardMode): string {
+  return mode === "observe" ? t.now.observe[guard] : t.now[mode];
+}
diff --git a/src/security/GuardTab.tsx b/src/security/GuardTab.tsx
index eedefb20..079c84cc 100644
--- a/src/security/GuardTab.tsx
+++ b/src/security/GuardTab.tsx
@@ -1,8 +1,11 @@
-import { Fragment } from "react";
-import { FlaskConicalIcon, PlusIcon } from "lucide-react";
+import { Fragment, useMemo, useState } from "react";
+import { FlaskConicalIcon, PlusIcon, SearchIcon } from "lucide-react";
+import { Badge } from "@/ui/badge";
 import { Button } from "@/ui/button";
+import { Checkbox } from "@/ui/checkbox";
+import { InputGroup, InputGroupAddon, InputGroupInput } from "@/ui/input-group";
 import { rowMotion, usePresentList } from "@/ui/motion";
-import { PageSection } from "@/ui/page";
+import { NativeSelect, NativeSelectOption } from "@/ui/native-select";
 import { RowMenu, RowMenuButton, type MenuItems } from "@/ui/row-menu";
 import { Segmented } from "@/ui/segmented";
 import { Skeleton } from "@/ui/skeleton";
@@ -14,25 +17,41 @@ import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@
 import { cn } from "@/lib/utils";
 import { useText } from "@/i18n";
 import { commonText } from "@/i18n/common.i18n";
-import type { Guard, GuardDetail, GuardMode, SecurityRuleView } from "@/types";
-import { hasAction, type ActionGuard } from "./api";
-import { Code, MatcherText, modeName, modeTone, ruleWhy, viewName } from "./labels";
+import { ACTIONS } from "./api";
+import type { Guard, GuardDetail, GuardMode, RuleAction, SecurityRuleView } from "@/types";
+import { MatcherText, modeName, modeTone, ruleWhy, viewName } from "./labels";
 import { securityLabelsText } from "./labels.i18n";
-import { guardTabText } from "./GuardTab.i18n";
+import { guardTabText, nowText } from "./GuardTab.i18n";
 import { patternOf } from "./RuleDialog";
-import { GroupRow, ROW_FOCUS, rowNav, stop } from "./rows";
+import {
+  actionAllowed,
+  actionOf,
+  DEFAULT_REPLACEMENT,
+  groupChecked,
+  groupRules,
+  groupTarget,
+  ruleMatches,
+  scopeChoice,
+  scopeOf,
+} from "./rules";
+import { ROW_FOCUS, rowNav, stop } from "./rows";
 
-const MODES: readonly GuardMode[] = ["off", "observe", "enforce"];
+/** 状态的先后，和规格的示意一致：开启、监控、关闭 */
+const MODES: readonly GuardMode[] = ["enforce", "observe", "off"];
 
 /** 规则表上能做的事。**都由页面接住** —— 它们要写配置、要开对话框 */
 export interface RuleActions {
   mode: (mode: GuardMode) => void;
   toggle: (r: SecurityRuleView, enabled: boolean) => void;
-  /** 这条规则的开关正在写 */
+  /** 一组规则一起启用或停用（组标题的复选框） */
+  bulk: (rules: SecurityRuleView[], enabled: boolean) => void;
+  /** 行内改一条规则的动作 */
+  setAction: (r: SecurityRuleView, action: RuleAction) => void;
+  /** 这条规则正在写（开关、动作） */
   pending: (r: SecurityRuleView) => boolean;
-  /** 内置规则：只读查看；自定义规则：编辑 */
+  /** 打开对话框：内置规则改动作、试；自定义规则编辑 */
   open: (r: SecurityRuleView) => void;
-  /** 复制成自定义规则。只有写得出等价写法的那几项有，而且只给写得出来的规则（见 `patternOf`） */
+  /** 复制成自定义规则。只给写得出等价写法的规则（见 `patternOf`） */
   copy?: (r: SecurityRuleView) => void;
   remove: (r: SecurityRuleView) => void;
   create: () => void;
@@ -43,98 +62,77 @@ export interface RuleActions {
 const keyOf = (r: SecurityRuleView) => `${r.custom ? "c" : "b"}:${r.id}`;
 
 /**
- * 一项防护的档位：名字、一句它做什么，右边三档；下面一行是现在的样子（状态点
- * 和页头、标签上的同色），再下面把切到第三档的代价说在切之前。
- *
- * **第三档按这一项做的事命名**（替换、切断、处置），见 `modeName`。
+ * 一项防护的状态：开启、监控、关闭，右边一句当前状态下命中之后怎样，以及启用了几条规则。
+ * 圆点和页签上的同色。
  */
-export function ModeCard({
+export function ModeBar({
   guard,
   mode,
+  on,
+  all,
   pending,
   onMode,
 }: {
   guard: Guard;
   mode: GuardMode;
-  /** 档位正在写 */
+  /** 启用的规则条数 */
+  on: number;
+  all: number;
+  /** 状态正在写 */
   pending: boolean;
   onMode: (mode: GuardMode) => void;
 }) {
   const t = useText(guardTabText);
   const lt = useText(securityLabelsText);
-  const copy = t[guard];
   return (
-    <section data-slot="mode-card" className="rounded-lg border border-border bg-surface/40 px-4 py-3.5">
-      <div className="flex flex-wrap items-start gap-x-4 gap-y-2.5">
-        <div className="min-w-0 flex-1">
-          <h2 className="tw-head text-foreground">{lt.guards[guard]}</h2>
-          <p className="mt-0.5 tw-body text-muted-foreground">{copy.lead}</p>
-        </div>
-        <div className="flex items-center gap-2">
-          {pending && <Spinner className="size-3.5 text-muted-foreground" aria-hidden />}
-          <Segmented<GuardMode>
-            label={t.modeFor(lt.guards[guard])}
-            value={mode}
-            options={MODES.map((m) => ({ id: m, label: modeName(guard, m) }))}
-            onChange={(v) => v !== mode && onMode(v)}
-          />
-        </div>
-      </div>
-      <div className="mt-3 border-t border-border/70 pt-3">
-        <p className="flex items-start gap-2 tw-body text-foreground">
-          <StatusDot tone={modeTone(mode)} className="mt-[7px]" />
-          <span key={mode} className="motion-fade">
-            {copy.now[mode]}
-          </span>
-        </p>
-        <p className="mt-1 pl-3.5 tw-label text-muted-foreground">
-          {mode === "enforce" ? copy.risk : t.ifEnforced(modeName(guard, "enforce"), copy.effect, copy.risk)}
-        </p>
-      </div>
+    <section data-slot="mode-bar" className="flex flex-wrap items-center gap-x-3 gap-y-2">
+      <Segmented<GuardMode>
+        label={t.modeFor(lt.guards[guard])}
+        value={mode}
+        options={MODES.map((m) => ({ id: m, label: modeName(m) }))}
+        onChange={(v) => v !== mode && onMode(v)}
+      />
+      {pending && <Spinner className="size-3.5 text-muted-foreground" aria-hidden />}
+      <p className="flex min-w-0 flex-1 items-start gap-2 tw-body">
+        <StatusDot tone={modeTone(mode)} className="mt-[7px]" />
+        <span key={mode} className="min-w-0 motion-fade">
+          <span className="text-foreground">{nowText(t, guard, mode)}</span>{" "}
+          <span className="text-muted-foreground">{t.ruleCount(on, all)}</span>
+        </span>
+      </p>
     </section>
   );
 }
 
-/** 档位那一块和规则表还没读到时的样子：和读到之后同一个形状，不跳 */
+/** 状态那一行和规则表还没读到时的样子：和读到之后同一个形状，不跳 */
 export function GuardSkeleton() {
   return (
     <div className="flex flex-col" role="status" aria-busy="true">
-      <div className="rounded-lg border border-border bg-surface/40 px-4 py-3.5">
-        <div className="flex items-start gap-4">
-          <div className="flex flex-1 flex-col gap-2 pt-0.5">
-            <Skeleton className="h-3.5 w-28 rounded-sm" />
-            <Skeleton className="h-3 w-64 max-w-full rounded-sm" />
-          </div>
-          <Skeleton className="h-7 w-40 rounded-lg" />
-        </div>
-        <div className="mt-3 flex flex-col gap-2 border-t border-border/70 pt-3">
-          <Skeleton className="h-3 w-3/5 rounded-sm" />
-          <Skeleton className="h-2.5 w-4/5 rounded-sm opacity-70" />
-        </div>
+      <div className="flex items-center gap-3">
+        <Skeleton className="h-7 w-36 rounded-lg" />
+        <Skeleton className="h-3 w-80 max-w-full rounded-sm" />
       </div>
-      <div className="mt-8">
-        <div className="mb-3 flex items-end justify-between">
-          <div className="flex flex-col gap-2">
-            <Skeleton className="h-3.5 w-12 rounded-sm" />
-            <Skeleton className="h-3 w-32 rounded-sm opacity-70" />
-          </div>
+      <div className="mt-5">
+        <div className="mb-3 flex items-center justify-between">
+          <Skeleton className="h-7 w-56 rounded-lg" />
           <Skeleton className="h-7 w-44 rounded-lg" />
         </div>
-        <TableSkeleton rows={6} cols={3} />
+        <TableSkeleton rows={6} cols={4} />
       </div>
     </div>
   );
 }
 
 /**
- * 一项防护：上面是档位，下面是全部规则。
+ * 一项防护：上面是状态，下面是全部规则。
+ *
+ * **状态和规则都是全局的**，对所有上游、所有密钥一样。
  *
- * **档位和规则都是全局的**，对所有上游、所有密钥一样。这一页没有「按上游」
- * 的任何设置 —— 同一个请求走哪家，不该决定它里面的密钥会不会被换掉。
+ * 规则的实际处理按这个顺序定（规格 §4.3）：防护关闭不检查；规则停用不检查；防护处于
+ * 「监控」时一律仅记录（动作列照写用户设的动作，后面标「监控中」）；其余按规则的动作。
  *
- * 内置规则可以启停；工具调用和内容规则还能改第三档下的处置，改写法要先复制成
- * 自定义规则。自定义规则在对话框里改。每次改动由 core 写成一个配置版本。点一行
- * 打开它（内置的查看或改处置，自定义的编辑）。
+ * 内置规则按类别分组，组标题上的复选框一次启用或停用这一组（部分启用时半选）；自定义
+ * 规则在最后一组。检索框按名字和写法筛。每一行的开关、动作就地改；点一行打开它的对话框。
  */
 export function GuardTab({
   guard,
@@ -148,40 +146,52 @@ export function GuardTab({
   actions: RuleActions;
 }) {
   const t = useText(guardTabText);
+  const [query, setQuery] = useState("");
   const on = detail.rules.filter((r) => r.enabled).length;
 
   return (
     <div className="flex flex-col">
-      <ModeCard guard={guard} mode={detail.mode} pending={modePending} onMode={actions.mode} />
+      <ModeBar
+        guard={guard}
+        mode={detail.mode}
+        on={on}
+        all={detail.rules.length}
+        pending={modePending}
+        onMode={actions.mode}
+      />
 
-      <PageSection
-        title={t.rules}
-        description={t.ruleCount(on, detail.rules.length)}
-        actions={
-          <>
-            <Button variant="outline" size="sm" onClick={actions.test}>
-              <FlaskConicalIcon />
-              {t.test}
-            </Button>
-            <Button size="sm" onClick={actions.create}>
-              <PlusIcon />
-              {t.newRule}
-            </Button>
-          </>
-        }
-      >
-        {guard === "redact" ? (
-          <RedactRules rules={detail.rules} actions={actions} />
-        ) : (
-          <ActionRules guard={guard} rules={detail.rules} actions={actions} />
-        )}
-      </PageSection>
+      <div className="mt-5 mb-3 flex flex-wrap items-center gap-2">
+        <InputGroup className="h-7 w-64 rounded-[min(var(--radius-md),10px)]">
+          <InputGroupAddon align="inline-start">
+            <SearchIcon />
+          </InputGroupAddon>
+          <InputGroupInput
+            className="h-full py-0.5"
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+            placeholder={t.search}
+            aria-label={t.search}
+            spellCheck={false}
+          />
+        </InputGroup>
+        <span className="flex-1" />
+        <Button variant="outline" size="sm" onClick={actions.test}>
+          <FlaskConicalIcon />
+          {t.test}
+        </Button>
+        <Button size="sm" onClick={actions.create}>
+          <PlusIcon />
+          {t.newRule}
+        </Button>
+      </div>
+
+      <RuleTable guard={guard} mode={detail.mode} rules={detail.rules} query={query} actions={actions} />
     </div>
   );
 }
 
-/** 行菜单：内置的查看或编辑、复制；自定义的编辑、删除 */
-function useMenu(guard: Guard, actions: RuleActions) {
+/** 行菜单：内置的编辑、启停、复制；自定义的编辑、启停、删除 */
+function useMenu(actions: RuleActions) {
   const t = useText(guardTabText);
   const common = useText(commonText);
   return (r: SecurityRuleView): MenuItems => {
@@ -198,12 +208,10 @@ function useMenu(guard: Guard, actions: RuleActions) {
         { kind: "sep" },
         { kind: "item", label: common.delete, onSelect: () => actions.remove(r), danger: true },
       ];
-    // 出站脱敏的内置规则只能启停，也写不出等价的自定义规则
-    if (!hasAction(guard)) return [{ kind: "item", label: t.view, onSelect: () => actions.open(r) }, toggle];
-    // 代码里做的检查没有写法可抄
+    // 写不出等价写法的（出站的凭据种类、代码里做的检查）没有可抄的
     const copy = patternOf(r) ? actions.copy : undefined;
     return [
-      // 内置的工具调用和内容规则能改第三档下的处置，所以是「编辑」不是「查看」
+      // 内置规则能改动作，所以是「编辑」不是「查看」
       { kind: "item", label: common.edit, onSelect: () => actions.open(r) },
       toggle,
       ...(copy ? [{ kind: "sep" as const }, { kind: "item" as const, label: t.copyAsCustom, onSelect: () => copy(r) }] : []),
@@ -211,45 +219,161 @@ function useMenu(guard: Guard, actions: RuleActions) {
   };
 }
 
-/** 按顺序把规则分成几段，每段一个标题。core 给的顺序就是界面的顺序 */
-function groups<K extends string, T extends { item: SecurityRuleView }>(rows: T[], key: (r: SecurityRuleView) => K) {
-  const out: { key: K; rows: T[] }[] = [];
-  for (const row of rows) {
-    const k = key(row.item);
-    const last = out[out.length - 1];
-    if (last && last.key === k) last.rows.push(row);
-    else out.push({ key: k, rows: [row] });
-  }
-  return out;
+/**
+ * 全部规则，一张表：启用、规则、匹配内容、（内容过滤：检查对象）、动作。
+ *
+ * **动作一列三种颜色**：拒绝、切断是红的（请求或回答的结局变了），删除、替换、替换为占位符
+ * 是正文色（改了内容照常发出），仅记录是次要色。
+ */
+function RuleTable({
+  guard,
+  mode,
+  rules,
+  query,
+  actions,
+}: {
+  guard: Guard;
+  mode: GuardMode;
+  rules: SecurityRuleView[];
+  query: string;
+  actions: RuleActions;
+}) {
+  const t = useText(guardTabText);
+  const lt = useText(securityLabelsText);
+  const menu = useMenu(actions);
+  const content = guard === "content";
+  const span = content ? 6 : 5;
+  // 淡入淡出按全部规则算：检索筛掉的行直接不画，不播淡出
+  const present = usePresentList(rules, keyOf);
+  const groups = useMemo(() => {
+    const shown = present.filter(
+      ({ item: r, presence }) => presence === "exit" || ruleMatches(r, viewName(guard, r), query),
+    );
+    return groupRules(shown, (p) => p.item);
+  }, [present, guard, query]);
+
+  return (
+    <Table className={cn("table-fixed", content ? "min-w-[760px]" : "min-w-[660px]")}>
+      <colgroup>
+        <col className="w-12" />
+        <col className="w-[220px]" />
+        <col />
+        {content && <col className="w-[104px]" />}
+        <col className="w-[196px]" />
+        <col className="w-9" />
+      </colgroup>
+      <TableHeader>
+        <TableRow>
+          <TableHead>{t.enabled}</TableHead>
+          <TableHead>{t.rule}</TableHead>
+          <TableHead>{t.match}</TableHead>
+          {content && <TableHead>{t.scope}</TableHead>}
+          <TableHead>{t.action}</TableHead>
+          <TableHead />
+        </TableRow>
+      </TableHeader>
+      <TableBody>
+        {groups.length === 0 && (
+          <TableRow className="hover:bg-transparent">
+            <TableCell colSpan={span} className="h-16 text-center text-muted-foreground">
+              {t.noMatch}
+            </TableCell>
+          </TableRow>
+        )}
+        {groups.map((g) => {
+          const live = g.rows.filter((p) => p.presence !== "exit").map((p) => p.item);
+          const title = (g.custom ? lt.kinds.custom : lt.kinds[g.key]) ?? g.key;
+          return (
+            <Fragment key={g.key}>
+              <GroupHead
+                span={span}
+                title={title}
+                builtin={!g.custom && g.key !== "command"}
+                rules={live}
+                pending={live.some(actions.pending)}
+                onToggle={(enabled) => actions.bulk(live, enabled)}
+              />
+              {g.rows.map(({ item: r, key, presence }) => (
+                <RuleRow
+                  key={key}
+                  guard={guard}
+                  mode={mode}
+                  r={r}
+                  presence={presence}
+                  items={menu(r)}
+                  actions={actions}
+                />
+              ))}
+            </Fragment>
+          );
+        })}
+      </TableBody>
+    </Table>
+  );
 }
 
-function RuleSwitch({ r, name, actions }: { r: SecurityRuleView; name: string; actions: RuleActions }) {
+/**
+ * 一组的标题行：复选框一次启用或停用组内（检索筛出来的）全部规则，部分启用时半选；后面是
+ * 「隐藏字符 · 内置 · 已启用 2 条，共 3 条」。**复选框只是批量操作的入口**，组本身没有开关
+ */
+function GroupHead({
+  span,
+  title,
+  builtin,
+  rules,
+  pending,
+  onToggle,
+}: {
+  span: number;
+  title: string;
+  /** 标题后面写「内置」（工具调用的内置组本来就叫「内置」，不重复） */
+  builtin: boolean;
+  rules: SecurityRuleView[];
+  pending: boolean;
+  onToggle: (enabled: boolean) => void;
+}) {
   const t = useText(guardTabText);
+  const on = rules.filter((r) => r.enabled).length;
   return (
-    <Switch
-      size="sm"
-      checked={r.enabled}
-      pending={actions.pending(r)}
-      aria-label={t.toggleFor(name)}
-      onCheckedChange={(v) => actions.toggle(r, v)}
-    />
+    <TableRow className="hover:bg-transparent" data-slot="rule-group">
+      <TableCell className="h-8 bg-surface/70 py-0">
+        <Checkbox
+          checked={groupChecked(rules)}
+          disabled={pending || rules.length === 0}
+          aria-label={t.groupToggle(title)}
+          onCheckedChange={() => onToggle(groupTarget(rules))}
+        />
+      </TableCell>
+      <TableCell colSpan={span - 1} className="h-8 bg-surface/70 py-0 tw-label text-muted-foreground">
+        <span className="font-medium text-foreground/80">{title}</span>
+        {builtin && ` · ${t.builtin}`}
+        {` · ${t.groupCount(on, rules.length)}`}
+      </TableCell>
+    </TableRow>
   );
 }
 
 /** 一行规则：点它、按 Enter 打开，右键和行尾是同一份菜单 */
 function RuleRow({
+  guard,
+  mode,
   r,
   presence,
   items,
   actions,
-  children,
 }: {
+  guard: Guard;
+  mode: GuardMode;
   r: SecurityRuleView;
   presence: Parameters<typeof rowMotion>[0];
   items: MenuItems;
   actions: RuleActions;
-  children: React.ReactNode;
 }) {
+  const t = useText(guardTabText);
+  const lt = useText(securityLabelsText);
+  const name = viewName(guard, r);
+  const why = ruleWhy(guard, r);
+  const pattern = r.matcher.kind === "regex" ? r.matcher.pattern : "";
   return (
     <RowMenu items={items}>
       <TableRow
@@ -257,166 +381,107 @@ function RuleRow({
         onClick={() => actions.open(r)}
         {...rowNav(() => actions.open(r))}
       >
-        {children}
+        <TableCell {...stop}>
+          <Switch
+            size="sm"
+            checked={r.enabled}
+            pending={actions.pending(r)}
+            aria-label={t.toggleFor(name)}
+            onCheckedChange={(v) => actions.toggle(r, v)}
+          />
+        </TableCell>
+        <TableCell className="py-2">
+          <div className={cn("truncate", r.enabled ? "text-foreground" : "text-muted-foreground")}>{name}</div>
+          {why && (
+            <div className="truncate tw-label text-muted-foreground" title={why}>
+              {why}
+            </div>
+          )}
+        </TableCell>
+        {guard === "inspect_tools" && r.matcher.kind === "regex" ? (
+          // 工具调用的正则又长又密：照写，悬停看全
+          <TableCell className="truncate font-mono tw-label text-muted-foreground" title={pattern}>
+            {pattern}
+          </TableCell>
+        ) : (
+          <TableCell className="truncate text-muted-foreground">
+            <MatcherText m={r.matcher} />
+          </TableCell>
+        )}
+        {guard === "content" && (
+          <TableCell>
+            <span className="flex gap-1">
+              {scopeOf(r).map((s) => (
+                <Badge key={s} variant="outline">
+                  {lt.directions[s]}
+                </Badge>
+              ))}
+            </span>
+          </TableCell>
+        )}
+        <TableCell {...stop}>
+          <ActionCell guard={guard} mode={mode} r={r} name={name} actions={actions} />
+        </TableCell>
+        <TableCell className="text-right" {...stop}>
+          <RowMenuButton items={items} label={t.actionsFor(name)} />
+        </TableCell>
       </TableRow>
     </RowMenu>
   );
 }
 
-/** 启用开关和行尾菜单那两格 */
-function RuleTail({ r, name, items, actions }: { r: SecurityRuleView; name: string; items: MenuItems; actions: RuleActions }) {
-  const t = useText(guardTabText);
-  return (
-    <>
-      <TableCell className="text-right" {...stop}>
-        <RuleSwitch r={r} name={name} actions={actions} />
-      </TableCell>
-      <TableCell className="text-right" {...stop}>
-        <RowMenuButton items={items} label={t.actionsFor(name)} />
-      </TableCell>
-    </>
-  );
-}
-
-function RuleName({ r, name, why }: { r: SecurityRuleView; name: string; why?: string }) {
-  return (
-    <>
-      <div className={cn("truncate", r.enabled ? "text-foreground" : "text-muted-foreground")}>{name}</div>
-      {why && (
-        <div className="truncate tw-label text-muted-foreground" title={why}>
-          {why}
-        </div>
-      )}
-    </>
-  );
-}
-
-function RedactRules({ rules, actions }: { rules: SecurityRuleView[]; actions: RuleActions }) {
-  const t = useText(guardTabText);
-  const lt = useText(securityLabelsText);
-  const menu = useMenu("redact", actions);
-  const shown = usePresentList(rules, keyOf);
-  return (
-    <Table className="table-fixed min-w-[560px]">
-      <colgroup>
-        <col className="w-[210px]" />
-        <col />
-        <col className="w-14" />
-        <col className="w-9" />
-      </colgroup>
-      <TableHeader>
-        <TableRow>
-          <TableHead>{t.rule}</TableHead>
-          <TableHead>{t.match}</TableHead>
-          <TableHead className="text-right">{t.enabled}</TableHead>
-          <TableHead />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {groups(shown, (r) => r.kind).map((g) => (
-          <Fragment key={g.key}>
-            <GroupRow span={4} title={lt.kinds[g.key] ?? g.key} count={g.rows.length > 1 ? g.rows.length : undefined} />
-            {g.rows.map(({ item: r, key, presence }) => {
-              const items = menu(r);
-              const name = viewName("redact", r);
-              return (
-                <RuleRow key={key} r={r} presence={presence} items={items} actions={actions}>
-                  <TableCell>
-                    <RuleName r={r} name={name} />
-                  </TableCell>
-                  <TableCell className="truncate text-muted-foreground">
-                    <MatcherText m={r.matcher} />
-                  </TableCell>
-                  <RuleTail r={r} name={name} items={items} actions={actions} />
-                </RuleRow>
-              );
-            })}
-          </Fragment>
-        ))}
-      </TableBody>
-    </Table>
-  );
-}
-
 /**
- * 工具调用审查、内容过滤：规则、写法、第三档下做什么。
- *
- * 工具调用的内置规则一组；内容规则按 core 给的类别分组（隐藏字符、指令覆盖、
- * 身份与提示词、中文说法），自定义的在最后。「匹配」一列：工具调用的正则照写，代码里
- * 做的检查（凭据发往陌生主机这类）说一句它查什么；码位规则写出码位范围。
- *
- * **处置一列三种颜色**：拒绝、切断是红的（请求或回答的结局变了），删除是正文色（改了
- * 内容照常发出），仅记录是次要色。
+ * 动作那一格：就地改的选择。**防护处于「监控」时照写用户设的动作**，后面淡色标「监控中」 ——
+ * 实际只记录，切回「开启」就按这里的动作处理。查回答的内容规则不能选「拒绝」（选项置灰）
  */
-function ActionRules({ guard, rules, actions }: { guard: ActionGuard; rules: SecurityRuleView[]; actions: RuleActions }) {
+function ActionCell({
+  guard,
+  mode,
+  r,
+  name,
+  actions,
+}: {
+  guard: Guard;
+  mode: GuardMode;
+  r: SecurityRuleView;
+  name: string;
+  actions: RuleActions;
+}) {
   const t = useText(guardTabText);
   const lt = useText(securityLabelsText);
-  const menu = useMenu(guard, actions);
-  const content = guard === "content";
-  const key = (r: SecurityRuleView) => (r.custom ? "custom" : content ? r.kind : "builtin");
-  const shown = usePresentList(rules, keyOf);
+  const action = actionOf(guard, r);
+  const scope = scopeChoice(scopeOf(r));
+  const hard = action === "cut" || action === "block";
+  const soft = action === "record";
+  const label = (a: RuleAction) =>
+    a === "replace" ? t.replaceWith(clipped(r.replacement ?? DEFAULT_REPLACEMENT)) : (lt.ruleActions[a] ?? a);
   return (
-    <Table className="table-fixed min-w-[640px]">
-      <colgroup>
-        <col className="w-[230px]" />
-        <col />
-        <col className="w-[84px]" />
-        <col className="w-14" />
-        <col className="w-9" />
-      </colgroup>
-      <TableHeader>
-        <TableRow>
-          <TableHead>{t.rule}</TableHead>
-          <TableHead>{t.match}</TableHead>
-          <TableHead>{t.action}</TableHead>
-          <TableHead className="text-right">{t.enabled}</TableHead>
-          <TableHead />
-        </TableRow>
-      </TableHeader>
-      <TableBody>
-        {groups(shown, key).map((g) => (
-          <Fragment key={g.key}>
-            <GroupRow
-              span={5}
-              title={g.key === "builtin" ? t.builtinGroup : (lt.kinds[g.key] ?? g.key)}
-              count={g.rows.length > 1 ? g.rows.length : undefined}
-            />
-            {g.rows.map(({ item: r, key: k, presence }) => {
-              const items = menu(r);
-              const name = viewName(guard, r);
-              const pattern = r.matcher.kind === "regex" ? r.matcher.pattern : "";
-              const hard = r.action === "cut" || r.action === "block";
-              const soft = r.action === "record" || r.action == null;
-              return (
-                <RuleRow key={k} r={r} presence={presence} items={items} actions={actions}>
-                  <TableCell className="py-2">
-                    <RuleName r={r} name={name} why={ruleWhy(guard, r)} />
-                  </TableCell>
-                  {content ? (
-                    <TableCell className="truncate text-muted-foreground">
-                      {/* 表里只写那段文字；「不区分大小写」对每一条都一样，在对话框里说 */}
-                      {r.matcher.kind === "contains" ? <Code>{r.matcher.text}</Code> : <MatcherText m={r.matcher} />}
-                    </TableCell>
-                  ) : r.matcher.kind === "regex" ? (
-                    <TableCell className="truncate font-mono tw-label text-muted-foreground" title={pattern}>
-                      {pattern}
-                    </TableCell>
-                  ) : (
-                    // 代码里做的检查：说它查什么
-                    <TableCell className="truncate text-muted-foreground">
-                      <MatcherText m={r.matcher} />
-                    </TableCell>
-                  )}
-                  <TableCell className={hard ? "text-destructive" : soft ? "text-muted-foreground" : "text-foreground"}>
-                    {lt.ruleActions[r.action ?? "record"] ?? r.action}
-                  </TableCell>
-                  <RuleTail r={r} name={name} items={items} actions={actions} />
-                </RuleRow>
-              );
-            })}
-          </Fragment>
+    <span className="flex min-w-0 items-center gap-1.5">
+      <NativeSelect
+        size="inline"
+        className={cn(
+          "min-w-0 shrink",
+          hard ? "text-destructive" : soft ? "text-muted-foreground" : "text-foreground",
+        )}
+        value={action}
+        disabled={actions.pending(r)}
+        aria-label={t.actionFor(name)}
+        onChange={(e) => actions.setAction(r, e.target.value as RuleAction)}
+      >
+        {ACTIONS[guard].map((a) => (
+          <NativeSelectOption key={a} value={a} disabled={!actionAllowed(guard, a, scope)}>
+            {label(a)}
+          </NativeSelectOption>
         ))}
-      </TableBody>
-    </Table>
+      </NativeSelect>
+      {mode === "observe" && (
+        <span className="shrink-0 tw-label text-muted-foreground">{lt.monitoring}</span>
+      )}
+    </span>
   );
 }
+
+/** 行内选项里的替换文字：太长的截一截，全文在对话框里 */
+function clipped(s: string): string {
+  return [...s].length > 12 ? `${[...s].slice(0, 12).join("")}…` : s;
+}
diff --git a/src/security/HitDetail.i18n.ts b/src/security/HitDetail.i18n.tsx
similarity index 67%
rename from src/security/HitDetail.i18n.ts
rename to src/security/HitDetail.i18n.tsx
index a2365526..e8dd6566 100644
--- a/src/security/HitDetail.i18n.ts
+++ b/src/security/HitDetail.i18n.tsx
@@ -1,3 +1,4 @@
+import type { ReactNode } from "react";
 import { messages } from "@/i18n";
 
 /** 英文的单复数 */
@@ -41,8 +42,24 @@ export const hitDetailText = messages(
     /** 已拒绝 */
     notSent: "请求未发往上游。",
     clientReply: "客户端收到的回复",
-    /** 已删除：发出之前删去了几段 */
-    stripped: (n: number) => `发往上游之前删除了 ${n.toLocaleString()} 处命中的内容。`,
+    /** 已删除：发出（或返回）之前删去了几段 */
+    stripped: {
+      request: (n: number) => `删除 ${n.toLocaleString()} 处：命中内容在发往上游之前删除。`,
+      response: (n: number) => `删除 ${n.toLocaleString()} 处：命中内容在返回客户端之前删除。`,
+    },
+    /** 内容过滤的「替换」：几处换成了规则指定的文字 */
+    replacedText: {
+      request: (n: number, text: ReactNode) => (
+        <>
+          替换 {n.toLocaleString()} 处：命中内容在发往上游之前替换为 {text}，不可还原。
+        </>
+      ),
+      response: (n: number, text: ReactNode) => (
+        <>
+          替换 {n.toLocaleString()} 处：命中内容在返回客户端之前替换为 {text}，不可还原。
+        </>
+      ),
+    },
     /** 实际发给上游的模型名（和客户端要的不同时） */
     sentModel: (model: string) => `发往上游的模型为 ${model}`,
     openRequest: (id: number) => `打开请求 #${id}`,
@@ -70,8 +87,26 @@ export const hitDetailText = messages(
     clientNotice: "Notice the client received",
     notSent: "The request was not sent to the upstream.",
     clientReply: "Reply the client received",
-    stripped: (n: number) =>
-      `${count(n, "matched segment was", "matched segments were")} deleted before the request was sent.`,
+    stripped: {
+      request: (n: number) =>
+        `${count(n, "matched segment was", "matched segments were")} deleted before the request was sent.`,
+      response: (n: number) =>
+        `${count(n, "matched segment was", "matched segments were")} deleted before the answer reached the client.`,
+    },
+    replacedText: {
+      request: (n: number, text: ReactNode) => (
+        <>
+          {count(n, "matched segment was", "matched segments were")} replaced with {text} before the request was sent; this
+          cannot be restored.
+        </>
+      ),
+      response: (n: number, text: ReactNode) => (
+        <>
+          {count(n, "matched segment was", "matched segments were")} replaced with {text} before the answer reached the
+          client; this cannot be restored.
+        </>
+      ),
+    },
     sentModel: (model: string) => `sent to the upstream as ${model}`,
     openRequest: (id: number) => `Open request #${id}`,
     openSession: "View session",
diff --git a/src/security/HitDetail.tsx b/src/security/HitDetail.tsx
index faefa763..fd9ee126 100644
--- a/src/security/HitDetail.tsx
+++ b/src/security/HitDetail.tsx
@@ -6,6 +6,7 @@ import { useText } from "@/i18n";
 import { prettyJson } from "@/prettyJson";
 import { clip } from "@/traffic/transcript";
 import type { HitLocation, OutcomeDetail, SecurityEventView } from "@/types";
+import { replacedOf } from "./rules";
 import { Highlight, toneOf, type Mark } from "./Highlight";
 import { Code, matchingOf, partLabel, snapshotName } from "./labels";
 import { securityLabelsText } from "./labels.i18n";
@@ -214,15 +215,24 @@ function OutcomeText({ d, direction }: { d: OutcomeDetail; direction: SecurityEv
   switch (d.action) {
     case "recorded":
       return <span className="text-muted-foreground">{t.recorded[direction]}</span>;
-    case "replaced":
+    case "replaced": {
+      const r = replacedOf(d);
+      // 内容过滤的「替换」：几处换成了同一段文字，不可还原
+      if (r.kind === "text")
+        return (
+          <span className="flex flex-wrap items-center gap-x-1.5 gap-y-1 text-muted-foreground">
+            {t.replacedText[direction](r.segments, <Code key="r">{r.replacement}</Code>)}
+          </span>
+        );
       return (
         <span className="flex flex-wrap items-center gap-x-1.5 gap-y-1">
           <span className="text-muted-foreground">{t.replacedWith}</span>
-          {d.placeholders.map((p) => (
+          {r.placeholders.map((p) => (
             <Code key={p}>{p}</Code>
           ))}
         </span>
       );
+    }
     case "cut":
       return (
         <>
@@ -242,7 +252,7 @@ function OutcomeText({ d, direction }: { d: OutcomeDetail; direction: SecurityEv
         </>
       );
     case "stripped":
-      return <span className="text-muted-foreground">{t.stripped(d.segments)}</span>;
+      return <span className="text-muted-foreground">{t.stripped[direction](d.segments)}</span>;
   }
 }
 
diff --git a/src/security/LogTab.tsx b/src/security/LogTab.tsx
index 1a70f4ab..8cf5ffd3 100644
--- a/src/security/LogTab.tsx
+++ b/src/security/LogTab.tsx
@@ -17,7 +17,8 @@ import { KeyLabel } from "@/KeyLabel";
 import { useText } from "@/i18n";
 import { useNav } from "@/nav";
 import RequestDrawer from "@/traffic/drawer/RequestDrawer";
-import { GUARDS, type Guard, type SecurityDetail, type SecurityEventView } from "@/types";
+import { GUARDS } from "@/types";
+import type { Guard, SecurityDetail, SecurityEventView } from "@/types";
 import { api } from "./api";
 import { fetchAll, fileName, toCsv, toJson, type ExportFormat } from "./export";
 import { HitDetail } from "./HitDetail";
diff --git a/src/security/RuleDialog.i18n.ts b/src/security/RuleDialog.i18n.ts
index caaebd17..675a855f 100644
--- a/src/security/RuleDialog.i18n.ts
+++ b/src/security/RuleDialog.i18n.ts
@@ -4,51 +4,54 @@ import { messages } from "@/i18n";
 export const ruleDialogText = messages(
   {
     title: {
-      redact: { create: "新建脱敏规则", edit: "编辑脱敏规则" },
-      inspect_tools: { create: "新建审查规则", edit: "编辑审查规则" },
+      redact: { create: "新建密钥与隐私规则", edit: "编辑密钥与隐私规则" },
+      inspect_tools: { create: "新建危险命令规则", edit: "编辑危险命令规则" },
       content: { create: "新建内容规则", edit: "编辑内容规则" },
     },
     testTitle: {
-      redact: "测试出站脱敏",
-      inspect_tools: "测试工具调用审查",
+      redact: "测试密钥与隐私",
+      inspect_tools: "测试危险命令",
       content: "测试内容过滤",
     },
     name: "名称",
-    nameHint: {
-      redact: "记入日志时显示此名称。",
-      inspect_tools: "记入日志和通知时显示此名称。",
-      content: "记入日志和拒绝原因时显示此名称。",
-    },
+    nameHint: "记入日志及发出通知时显示此名称。",
     namePlaceholder: {
       redact: "内部令牌",
       inspect_tools: "删除集群资源",
       content: "项目代号",
     },
-    /** 内容规则怎么认 */
+    /** 内容规则查哪一边 */
+    scope: "检查对象",
+    scopes: {
+      request: "请求",
+      response: "回答",
+      both: "请求和回答",
+    },
+    scopeHint: "请求：用户消息与工具结果。回答：模型输出的正文，不含工具调用与思考过程。",
+    /** 规则怎么认 */
     matchKind: "匹配方式",
     matchKinds: {
       contains: "包含",
       regex: "正则",
       codepoints: "码位",
     },
-    patternLabel: {
-      contains: "匹配内容",
-      regex: "匹配（正则表达式）",
-      codepoints: "码位",
-    },
-    toolHint: "按工具调用的参数匹配。",
-    /** 出站脱敏的自定义规则：怎么找、分不分大小写 */
-    redactHint: {
-      contains: (cased: boolean) =>
-        `在整个请求中按原样查找这段文字，. * 等字符没有特殊含义；${cased ? "区分" : "不区分"}大小写。找到的内容按凭据替换。`,
-      regex: (cased: boolean) => `按正则表达式匹配，${cased ? "区分" : "不区分"}大小写。匹配到的整段内容按凭据替换。`,
-    },
     caseSensitive: "区分大小写",
-    contentHint: {
-      contains: "在用户消息和工具结果中查找这段文字，不区分大小写，首尾空格也参与匹配。",
-      regex: "在用户消息和工具结果中匹配，不区分大小写。",
-      codepoints: "码位或码位范围，多个之间用逗号分隔，如 U+200B, U+E0000–U+E007F。在用户消息和工具结果中查找这些字符。",
+    patternLabel: "匹配内容",
+    toolHint: "按工具调用的参数匹配，使用正则表达式。",
+    /** 匹配方式下面那一句。`cased`：区分大小写 */
+    matchHint: {
+      contains: (cased: boolean) =>
+        `按原文查找，「.」「*」等字符不作特殊处理；${cased ? "区分" : "不区分"}大小写。`,
+      regex: (cased: boolean) => `按正则表达式匹配；${cased ? "区分" : "不区分"}大小写。`,
+      codepoints: "码位或码位范围，多个之间用逗号分隔，如 U+200B, U+E0000–U+E007F。",
     },
+    /** 检查对象含回答时，「码位」为何不可选 */
+    codepointsRequestOnly: "码位仅适用于请求。",
+    /** 检查对象含回答的正则规则：流式回答只暂缓有限的末尾 */
+    regexAnswerLimit: "回答中超过 256 个字符的命中，起始部分可能已送达客户端。",
+    /** 改了检查对象，选着的那一项不可选了，自动换成可选的 */
+    switchedMatch: "检查对象含回答，匹配方式已改为「包含」。",
+    switchedAction: "检查对象含回答，动作已改为「删除」。",
     /** 码位输入框里的样子 */
     codepointsExample: "U+200B, U+E0000–U+E007F",
     /** 码位写错时，输入框下面那一句 */
@@ -59,24 +62,35 @@ export const ruleDialogText = messages(
       order: (item: string) => `「${item}」的起点大于终点。`,
       count: (max: number) => `最多 ${max} 项。`,
     },
-    /** 出站脱敏：换成的占位符叫什么 */
+    /** 密钥与隐私：换成的占位符叫什么 */
     label: "占位符名称",
     labelHint: "替换为 <<TW_名称_序号>>。只能使用大写字母、数字和下划线。",
     labelBad: "须以大写字母开头，只能使用大写字母、数字和下划线，最多 24 个字符。",
     match: "匹配",
-    /** 规则在第三档下做什么 */
-    action: "处置",
-    /** 选了某一种处置时下面那一句 */
+    /** 规则在「开启」状态下做什么 */
+    action: "动作",
+    /** 选了某一种动作时下面那一句 */
     actionWhat: {
-      cut: "命中的调用不会完整到达客户端，因而无法执行。",
+      placeholder: "命中内容替换为占位符后发出，回答中出现该占位符时还原为原值。",
+      cut: "命中的调用不完整送达客户端，客户端无法执行该调用。",
       block: "命中的请求不发出，客户端收到拒绝的原因。",
-      strip: "命中的文字从用户消息和工具结果中删除，请求照常发出。",
+      strip: "删除命中内容，不保留任何标记。",
+      replace: "命中内容替换为下方的替换文本。",
       record: {
-        inspect_tools: "命中的调用照常返回，只记入日志。",
-        content: "命中的请求照常发出，只记入日志。",
+        redact: "命中内容照常发出，记入日志并发出系统通知。",
+        inspect_tools: "命中的调用照常返回，记入日志并发出系统通知。",
+        content: "命中内容不作修改，记入日志并发出系统通知。",
       },
     },
-    /** 内置规则：出厂时的处置 */
+    /** 检查对象含回答时，「拒绝」为何不可选 */
+    blockRequestOnly: "拒绝仅适用于请求：回答以流式输出，已送达的内容无法撤回。",
+    /** 内容规则：换成什么 */
+    replacement: "替换文本",
+    replacementHint: "命中内容替换为此文本，不可还原。",
+    replacementRequired: "请填写替换文本",
+    /** 内置规则选了「替换」：换成的文字固定 */
+    builtinReplace: (text: string) => `命中内容替换为 ${text}，不可还原。`,
+    /** 内置规则：出厂时的动作 */
     factory: (what: string) => `出厂设置为「${what}」。`,
     state: "状态",
     on: "已启用",
@@ -85,22 +99,29 @@ export const ruleDialogText = messages(
     replacedWith: "替换为",
     category: (kind: string) => `类别：${kind}`,
     sample: "测试文本",
+    /** 测试文本当作哪一边来试 */
+    testAs: {
+      request: "按请求测试",
+      response: "按回答测试",
+    },
     samplePlaceholder: {
       redact: "粘贴一段文本，例如一段含有密钥的环境变量",
       inspect_tools: "粘贴一段工具调用的参数，例如一条要执行的命令",
       content: "粘贴一段用户消息或工具结果",
     },
+    sampleAnswer: "粘贴一段模型回答的正文",
     hits: (n: number) => `命中 ${n} 处`,
     rule: "规则",
     noHit: "未命中",
     content: "内容",
-    position: "位置",
     line: (n: number) => `第 ${n} 行`,
     testDesc: "按当前启用的规则检查一段文本，不发出任何请求。",
-    /** 测试结果：替换、删除之后真正发出去的那一份 */
-    output: "发出的内容",
+    /** 测试结果：处理后的样子 */
+    output: "处理后",
     /** 测试结果：有「拒绝」规则命中 */
-    refused: (mode: string) => `在「${mode}」档下，此请求不会发出，客户端收到拒绝的原因。`,
+    refused: (mode: string) => `在「${mode}」状态下，此请求不会发出，客户端收到拒绝的原因。`,
+    /** 防护处于「监控」时，对话框底部那一句 */
+    monitoring: "当前分项处于监控状态，规则仅记录命中，不修改内容。",
     builtin: "内置",
     copyAsCustom: "复制为自定义规则",
     nameRequired: "请填写名称",
@@ -119,52 +140,49 @@ export const ruleDialogText = messages(
   },
   {
     title: {
-      redact: { create: "New redaction rule", edit: "Edit redaction rule" },
-      inspect_tools: { create: "New inspection rule", edit: "Edit inspection rule" },
+      redact: { create: "New secrets & privacy rule", edit: "Edit secrets & privacy rule" },
+      inspect_tools: { create: "New dangerous command rule", edit: "Edit dangerous command rule" },
       content: { create: "New content rule", edit: "Edit content rule" },
     },
     testTitle: {
-      redact: "Test outbound redaction",
-      inspect_tools: "Test tool-call inspection",
+      redact: "Test secrets & privacy",
+      inspect_tools: "Test dangerous commands",
       content: "Test the content filter",
     },
     name: "Name",
-    nameHint: {
-      redact: "Shown in the log.",
-      inspect_tools: "Shown in the log and in notifications.",
-      content: "Shown in the log and in the reason given for a refusal.",
-    },
+    nameHint: "Shown in the log and in notifications.",
     namePlaceholder: {
       redact: "Internal token",
       inspect_tools: "Delete cluster resources",
       content: "Project codename",
     },
+    scope: "Checks",
+    scopes: {
+      request: "Request",
+      response: "Answer",
+      both: "Request and answer",
+    },
+    scopeHint:
+      "Request: user messages and tool results. Answer: the text the model writes, excluding tool calls and thinking.",
     matchKind: "Match by",
     matchKinds: {
       contains: "Contains",
       regex: "Regex",
       codepoints: "Code points",
     },
-    patternLabel: {
-      contains: "Text to find",
-      regex: "Match (regular expression)",
-      codepoints: "Code points",
-    },
-    toolHint: "Matched against the arguments of each tool call.",
-    redactHint: {
-      contains: (cased: boolean) =>
-        `Looked for as written anywhere in the request; characters such as . and * have no special meaning. ${cased ? "Case must match" : "Case is ignored"}. What is found is replaced like a credential.`,
-      regex: (cased: boolean) =>
-        `A regular expression; ${cased ? "case must match" : "case is ignored"}. Everything it matches is replaced like a credential.`,
-    },
     caseSensitive: "Match case",
-    contentHint: {
-      contains:
-        "Searched for in user messages and tool results, ignoring case. Leading and trailing spaces count.",
-      regex: "Matched against user messages and tool results, ignoring case.",
-      codepoints:
-        "Code points or ranges, separated by commas, such as U+200B, U+E0000–U+E007F. These characters are searched for in user messages and tool results.",
+    patternLabel: "Match",
+    toolHint: "A regular expression matched against the arguments of each tool call.",
+    matchHint: {
+      contains: (cased: boolean) =>
+        `Looked for as written; characters such as . and * have no special meaning. ${cased ? "Case must match" : "Case is ignored"}.`,
+      regex: (cased: boolean) => `A regular expression. ${cased ? "Case must match" : "Case is ignored"}.`,
+      codepoints: "Code points or ranges, separated by commas, such as U+200B, U+E0000–U+E007F.",
     },
+    codepointsRequestOnly: "Code points apply to requests only.",
+    regexAnswerLimit: "In answers, the beginning of a match longer than 256 characters may already have reached the client.",
+    switchedMatch: "The rule checks answers, so the match was changed to Contains.",
+    switchedAction: "The rule checks answers, so the action was changed to Delete.",
     codepointsExample: "U+200B, U+E0000–U+E007F",
     codepointsBad: {
       syntax: (item: string) => `“${item}” is not a code point; write U+200B or U+E0000–U+E007F.`,
@@ -179,14 +197,24 @@ export const ruleDialogText = messages(
     match: "Match",
     action: "Action",
     actionWhat: {
-      cut: "A matching call never fully reaches the client, so it cannot run. ",
+      placeholder:
+        "Matches are replaced with placeholders before sending; a placeholder that appears in the answer is restored to the original value. ",
+      cut: "A matching call never fully reaches the client, so the client cannot run it. ",
       block: "A matching request is not sent, and the client is told why. ",
-      strip: "Matching text is deleted from user messages and tool results, and the request is sent. ",
+      strip: "Matches are deleted without leaving any marker. ",
+      replace: "Matches are replaced with the replacement text below. ",
       record: {
-        inspect_tools: "A matching call is returned as usual and recorded in the log. ",
-        content: "A matching request is sent as usual and recorded in the log. ",
+        redact: "Matches are sent as usual, recorded in the log and notified. ",
+        inspect_tools: "A matching call is returned as usual, recorded in the log and notified. ",
+        content: "Matches are left unchanged, recorded in the log and notified. ",
       },
     },
+    blockRequestOnly:
+      "Refuse applies to requests only: answers are streamed, and text already delivered cannot be withdrawn.",
+    replacement: "Replacement text",
+    replacementHint: "Matches are replaced with this text, which cannot be restored.",
+    replacementRequired: "Enter the replacement text",
+    builtinReplace: (text: string) => `Matches are replaced with ${text}, which cannot be restored. `,
     factory: (what: string) => `The factory setting is “${what}”.`,
     state: "State",
     on: "On",
@@ -194,20 +222,25 @@ export const ruleDialogText = messages(
     replacedWith: "Replaced with",
     category: (kind: string) => `Category: ${kind}`,
     sample: "Test text",
+    testAs: {
+      request: "Test as request",
+      response: "Test as answer",
+    },
     samplePlaceholder: {
       redact: "Paste some text, such as environment variables that contain a key",
       inspect_tools: "Paste the arguments of a tool call, such as a command to run",
       content: "Paste a user message or a tool result",
     },
+    sampleAnswer: "Paste the text of a model answer",
     hits: (n: number) => (n === 1 ? "1 match" : `${n} matches`),
     rule: "Rule",
     noHit: "No match",
     content: "Content",
-    position: "Position",
     line: (n: number) => `Line ${n}`,
     testDesc: "Checks a piece of text against the rules that are on. No request is sent.",
-    output: "What is sent",
-    refused: (mode: string) => `In ${mode} mode this request is not sent, and the client is told why.`,
+    output: "After processing",
+    refused: (mode: string) => `When the protection is ${mode}, this request is not sent, and the client is told why.`,
+    monitoring: "This protection is in Monitor: rules only record matches and change nothing.",
     builtin: "Built-in",
     copyAsCustom: "Copy as a custom rule",
     nameRequired: "Enter a name",
diff --git a/src/security/RuleDialog.tsx b/src/security/RuleDialog.tsx
index 7a76c120..0283db7e 100644
--- a/src/security/RuleDialog.tsx
+++ b/src/security/RuleDialog.tsx
@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { CaseSensitiveIcon, CopyIcon } from "lucide-react";
+import { CopyIcon } from "lucide-react";
 import {
   AlertDialog,
   AlertDialogCancel,
@@ -26,37 +26,56 @@ import { Spinner } from "@/ui/spinner";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/ui/table";
 import { Segmented } from "@/ui/segmented";
 import { StatusLabel } from "@/ui/status-dot";
+import { Switch } from "@/ui/switch";
 import { Textarea } from "@/ui/textarea";
-import { Toggle } from "@/ui/toggle";
 import { cn } from "@/lib/utils";
 import { useText } from "@/i18n";
 import { commonText } from "@/i18n/common.i18n";
 import { errorText } from "@/i18n/core.i18n";
-import type { ContentMatch, Guard, RuleAction, SecurityRuleView, SecurityTestHit } from "@/types";
-import { hasAction, type ActionGuard, type RuleSave } from "./api";
+import { ACTIONS, type RuleSave } from "./api";
 import { checkCodepoints, DEFAULT_LABEL, labelOk, MAX_CODEPOINT_ITEMS, placeholderOf, type CodepointsProblem } from "./check";
+import type {
+  ContentMatch,
+  ContentScope,
+  Guard,
+  GuardMode,
+  RuleAction,
+  SecurityRuleView,
+  SecurityTestHit,
+} from "@/types";
 import { Highlight, lineOf, type Mark } from "./Highlight";
 import { MatcherText, modeName, ruleName, ruleWhy, viewName } from "./labels";
 import { securityLabelsText } from "./labels.i18n";
 import { ruleDialogText } from "./RuleDialog.i18n";
+import {
+  actionAllowed,
+  actionOf,
+  adjustForScope,
+  coversAnswer,
+  DEFAULT_REPLACEMENT,
+  matchAllowed,
+  scopeChoice,
+  scopeOf,
+  scopeOfChoice,
+  type ScopeChoice,
+} from "./rules";
 import { useTrial, type Trial } from "./useTrial";
 
-/** 每一项防护的规则在第三档下能做的几件事，按选项的顺序 */
-const ACTIONS: Record<ActionGuard, readonly RuleAction[]> = {
-  inspect_tools: ["cut", "record"],
-  content: ["block", "strip", "record"],
-};
-
-/** 自定义规则能选的写法：内容规则三种，出站脱敏不认码位。工具调用审查只有正则，不选 */
+/** 自定义规则能选的写法：内容规则三种，密钥与隐私不认码位。危险命令只有正则，不选 */
 const MATCHES: Record<"redact" | "content", readonly ContentMatch[]> = {
   redact: ["contains", "regex"],
   content: ["contains", "regex", "codepoints"],
 };
 
+const SCOPES: readonly ScopeChoice[] = ["request", "response", "both"];
+
+/** 新建的规则缺省做什么：内容规则仅记录（规格 §5.1），密钥与隐私替换为占位符，危险命令切断 */
+const NEW_ACTION: Record<Guard, RuleAction> = { redact: "placeholder", inspect_tools: "cut", content: "record" };
+
 /**
  * 一条规则写的是什么，以及怎么认、分不分大小写。码位写成一行，和输入框里的写法一样。
  *
- * **写不出来的是 `null`**：出站脱敏那几种（前缀、PEM、身份证号…）和代码里做的检查
+ * **写不出来的是 `null`**：密钥与隐私那几种（前缀、PEM、身份证号…）和代码里做的检查
  * （`builtin`）没有一条能填进自定义规则的写法，所以也没有「复制为自定义规则」。
  */
 export function patternOf(r: SecurityRuleView): { pattern: string; match: ContentMatch; cased: boolean } | null {
@@ -77,10 +96,11 @@ export interface RuleSeed {
   name: string;
   pattern: string;
   match?: ContentMatch;
+  cased?: boolean;
   action?: RuleAction;
 }
 
-/** 一处命中标成什么样：会被切断、拒绝的红，会被删掉的划掉，会被替换或只记录的黄 */
+/** 一处命中标成什么样：会被切断、拒绝的红，会被删掉的划掉，替换和只记录的黄 */
 function tone(action: string | null | undefined): Mark["tone"] {
   return action === "cut" || action === "block" ? "bad" : action === "strip" ? "strip" : "warn";
 }
@@ -90,6 +110,7 @@ function Field({
   htmlFor,
   hint,
   error,
+  notes,
   children,
 }: {
   label: string;
@@ -97,6 +118,8 @@ function Field({
   hint?: string;
   /** 写错了：代替说明，红字 */
   error?: string | null;
+  /** 说明下面再接的几句：不可选的原因（淡色）、自动换了哪一项（提醒色） */
+  notes?: { text: string; tone?: "muted" | "warn" }[];
   children: React.ReactNode;
 }) {
   return (
@@ -110,36 +133,59 @@ function Field({
       ) : (
         hint && <p className="tw-label text-muted-foreground">{hint}</p>
       )}
+      {notes?.map((n) => (
+        <p
+          key={n.text}
+          className={cn("tw-label", n.tone === "warn" ? "text-warning-foreground" : "text-muted-foreground")}
+          role={n.tone === "warn" ? "status" : undefined}
+        >
+          {n.text}
+        </p>
+      ))}
     </div>
   );
 }
 
 /**
- * 第三档下做什么：工具调用是切断或仅记录，内容规则是拒绝、删除或仅记录。**自定义规则和
- * 内置规则用同一个** —— 内置规则提供的只是一条写法，命中之后怎么处置和自定义规则一样
- * 由用户定。
+ * 规则在「开启」状态下做什么。**自定义规则和内置规则用同一个** —— 内置规则提供的只是一条
+ * 写法，命中之后怎么处理由用户定。查回答的内容规则「拒绝」置灰（不隐藏），下面说原因；
+ * 换检查对象时自动换掉的，`switched` 说一句
  */
 function ActionField({
   guard,
   value,
   onChange,
+  scope = "request",
   factory,
+  switched = false,
+  extra,
 }: {
-  guard: ActionGuard;
+  guard: Guard;
   value: RuleAction;
   onChange: (a: RuleAction) => void;
-  /** 内置规则出厂时的处置，标在下面那一句里 */
+  scope?: ScopeChoice;
+  /** 内置规则出厂时的动作，标在下面那一句里 */
   factory?: RuleAction | null;
+  switched?: boolean;
+  /** 代替动作说明的那一句（内置规则「替换」：换成的文字固定） */
+  extra?: string;
 }) {
   const t = useText(ruleDialogText);
   const lt = useText(securityLabelsText);
-  const what = value === "record" ? t.actionWhat.record[guard] : t.actionWhat[value];
+  const what = extra ?? (value === "record" ? t.actionWhat.record[guard] : t.actionWhat[value]);
+  const notes: { text: string; tone?: "muted" | "warn" }[] = [];
+  if (guard === "content" && coversAnswer(scope)) notes.push({ text: t.blockRequestOnly });
+  if (switched) notes.push({ text: t.switchedAction, tone: "warn" });
   return (
-    <Field label={t.action} hint={factory ? what + t.factory(lt.ruleActions[factory] ?? factory) : what}>
+    <Field label={t.action} hint={factory ? what + t.factory(lt.ruleActions[factory] ?? factory) : what} notes={notes}>
       <Segmented<RuleAction>
         label={t.action}
         value={value}
-        options={ACTIONS[guard].map((a) => ({ id: a, label: lt.ruleActions[a] ?? a }))}
+        options={ACTIONS[guard].map((a) => ({
+          id: a,
+          label: lt.ruleActions[a] ?? a,
+          disabled: !actionAllowed(guard, a, scope),
+        }))}
         onChange={onChange}
       />
     </Field>
@@ -160,10 +206,67 @@ function codepointsError(t: typeof ruleDialogText.zh, p: CodepointsProblem | nul
 }
 
 /**
- * 试出来的结果：命中几处，在原文里标出来；替换、删除之后真正发出去的那一份；第三档下
- * 会不会被拒。
+ * 测试文本：内容规则先选这段当作请求还是回答来试（规则不查的那一边置灰），下面是文本框
+ * 和试出来的结果
+ */
+function SampleField({
+  id,
+  guard,
+  sample,
+  onSample,
+  side,
+  onSide,
+  sides,
+  children,
+}: {
+  id: string;
+  guard: Guard;
+  sample: string;
+  onSample: (s: string) => void;
+  side: ContentScope;
+  onSide: (s: ContentScope) => void;
+  /** 规则查的那几边。不给（测试全部规则、非内容规则）就两边都能选 */
+  sides?: readonly ContentScope[];
+  children: React.ReactNode;
+}) {
+  const t = useText(ruleDialogText);
+  const content = guard === "content";
+  return (
+    <Field label={t.sample} htmlFor={id}>
+      {content && (
+        <Segmented<ContentScope>
+          label={t.sample}
+          value={side}
+          options={(["request", "response"] as const).map((s) => ({
+            id: s,
+            label: t.testAs[s],
+            disabled: sides != null && !sides.includes(s),
+          }))}
+          onChange={onSide}
+        />
+      )}
+      <Textarea
+        id={id}
+        className="min-h-16 font-mono"
+        value={sample}
+        spellCheck={false}
+        placeholder={content && side === "response" ? t.sampleAnswer : t.samplePlaceholder[guard]}
+        onChange={(e) => onSample(e.target.value)}
+      />
+      {children}
+    </Field>
+  );
+}
+
+/** 测试那一边：规则查的那几边里，原来选的还在就留着，否则换成它查的第一边 */
+function sideWithin(side: ContentScope, sides: readonly ContentScope[]): ContentScope {
+  return sides.includes(side) ? side : (sides[0] ?? "request");
+}
+
+/**
+ * 试出来的结果：命中几处，在原文里标出来；处理后的样子；「开启」状态下会不会被拒。
  *
- * **标的是 core 给的位置**（见 `Highlight`），发出去的样子也是 core 给的 —— 界面不自己
+ * **标的是 core 给的位置**（见 `Highlight`），处理后的样子也是 core 给的 —— 界面不自己
  * 再找一遍、再删一遍。
  */
 function TrialBox({
@@ -175,9 +278,9 @@ function TrialBox({
 }: {
   trial: Trial;
   sample: string;
-  /** 标成什么颜色。不给就按每一处自己的处置 */
+  /** 标成什么颜色。不给就按每一处自己的动作 */
   action?: RuleAction;
-  /** 显示发出去的样子（core 给了的话） */
+  /** 显示处理后的样子（core 给了的话） */
   output?: boolean;
   /** 会被拒时说的那句话。不给就不说 */
   refusal?: string;
@@ -223,15 +326,27 @@ function TrialBox({
   );
 }
 
+/** 对话框底部左边那一句：还缺什么；都齐了、防护处于「监控」时说规则只记录 */
+function FooterNote({ missing, mode }: { missing: string | null; mode: GuardMode }) {
+  const t = useText(ruleDialogText);
+  const text = missing ?? (mode === "observe" ? t.monitoring : null);
+  return text ? <span className="mr-auto tw-label text-muted-foreground">{text}</span> : null;
+}
+
 /**
  * 新建或编辑一条自定义规则。
  *
  * **写法由 core 检查**：保存时写错了当场拒绝，并说明错在哪；测试文本随输入
  * 标出命中，用的也是 core，和网关用同一个引擎。码位和占位符名称的写法简单、
  * 写错的样子固定，敲完就在框下面说（见 `check.ts`），不用等保存。
+ *
+ * 内容规则按规格 §5：检查对象、匹配方式（同一行右边是「区分大小写」开关）、匹配内容、
+ * 动作、替换文本（动作为「替换」时）、测试文本。检查对象含回答时「拒绝」和「码位」置灰，
+ * 已选着的自动换成「删除」「包含」并在控件下方说明。
  */
 export function RuleDialog({
   guard,
+  mode,
   editing,
   seed,
   taken,
@@ -239,6 +354,8 @@ export function RuleDialog({
   onSave,
 }: {
   guard: Guard;
+  /** 这项防护现在的状态。处于「监控」时底部说一句规则只记录 */
+  mode: GuardMode;
   /** 编辑哪一条。不给就是新建 */
   editing: SecurityRuleView | null;
   seed?: RuleSeed;
@@ -254,36 +371,46 @@ export function RuleDialog({
   const redact = guard === "redact";
   const [name, setName] = useState(editing?.id ?? seed?.name ?? "");
   const [pattern, setPattern] = useState(was?.pattern ?? seed?.pattern ?? "");
-  // 内容过滤和出站脱敏能选，默认按原样找；工具调用审查的自定义规则都是正则
+  // 内容过滤和密钥与隐私能选，缺省按原样找；危险命令的自定义规则都是正则
   const choosable = content ? "content" : redact ? "redact" : null;
   const [match, setMatch] = useState<ContentMatch>(choosable ? (was?.match ?? seed?.match ?? "contains") : "regex");
-  // 出站脱敏：分不分大小写，默认不分
-  const [cased, setCased] = useState(was?.cased ?? false);
-  // 新建的规则默认是最重的那一种：专门写一条规则，多半就是要拦它
-  const acts = hasAction(guard) ? guard : null;
+  // 分不分大小写，缺省不分
+  const [cased, setCased] = useState(was?.cased ?? seed?.cased ?? false);
   const [action, setAction] = useState<RuleAction>(
-    editing?.action ?? seed?.action ?? (acts ? ACTIONS[acts][0]! : "record"),
+    editing ? actionOf(guard, editing) : (seed?.action ?? NEW_ACTION[guard]),
   );
-  // 出站脱敏：占位符名称。默认值显式填在框里，不留空
+  // 内容规则：查哪一边、换成什么。缺省值直接填在框里
+  const [scope, setScope] = useState<ScopeChoice>(editing ? scopeChoice(scopeOf(editing)) : "request");
+  const [replacement, setReplacement] = useState(editing?.replacement ?? DEFAULT_REPLACEMENT);
+  /** 换检查对象时自动换掉了哪一项，在那个控件下方说一句；动手改了那一项就不再说 */
+  const [switched, setSwitched] = useState({ action: false, match: false });
+  // 密钥与隐私：占位符名称。缺省值显式填在框里，不留空
   const [label, setLabel] = useState(editing?.label ?? DEFAULT_LABEL);
   const [sample, setSample] = useState("");
+  const [side, setSide] = useState<ContentScope>(scope === "response" ? "response" : "request");
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
-  const codepoints = content && match === "codepoints";
-  const cpProblem = codepoints && pattern.length > 0 ? checkCodepoints(pattern) : null;
+  const sides = scopeOfChoice(scope);
+  const testSide = sideWithin(side, sides);
+  const codepoints = match === "codepoints";
+  const cpProblem = content && codepoints && pattern.length > 0 ? checkCodepoints(pattern) : null;
+  const placeholder = redact && action === "placeholder";
   const labelValid = labelOk(label);
-  const labelError = redact && label.length > 0 && !labelValid ? t.labelBad : null;
-  // 选着的处置一起带上：发出去的样子、会不会被拒按它算
+  const labelError = placeholder && label.length > 0 && !labelValid ? t.labelBad : null;
+  const replacing = content && action === "replace";
+  // 选着的动作一起带上：处理后的样子、会不会被拒按它算
   const trial = useTrial(
     guard,
     sample,
     {
       pattern,
       match: choosable ? match : undefined,
-      case_sensitive: redact ? cased : undefined,
+      case_sensitive: choosable && !codepoints ? cased : undefined,
       label: redact && labelValid ? label : undefined,
-      action: acts ? action : undefined,
+      action,
+      scope: content ? testSide : undefined,
+      replacement: replacing ? replacement : undefined,
     },
     pattern.length > 0 && !cpProblem,
   );
@@ -296,9 +423,20 @@ export function RuleDialog({
         ? t.nameTaken
         : pattern.length === 0
           ? t.patternRequired[match]
-          : redact && label.length === 0
+          : placeholder && label.length === 0
             ? t.labelRequired
-            : null;
+            : replacing && replacement.length === 0
+              ? t.replacementRequired
+              : null;
+
+  function changeScope(c: ScopeChoice) {
+    setError(null);
+    setScope(c);
+    const next = adjustForScope(c, action, match);
+    setAction(next.action);
+    setMatch(next.match);
+    setSwitched({ action: next.changed.action, match: next.changed.match });
+  }
 
   async function save() {
     setSaving(true);
@@ -307,10 +445,12 @@ export function RuleDialog({
       await onSave({
         name: name.trim(),
         pattern,
-        action: acts ? action : undefined,
+        action,
         match: choosable ? match : undefined,
-        case_sensitive: redact ? cased : undefined,
+        case_sensitive: choosable && !codepoints ? cased : undefined,
         label: redact ? label : undefined,
+        scope: content ? scopeOfChoice(scope) : undefined,
+        replacement: replacing ? replacement : undefined,
         enabled: editing?.enabled ?? true,
       });
     } catch (e) {
@@ -319,15 +459,23 @@ export function RuleDialog({
     }
   }
 
+  // 匹配方式下面：怎么找、分不分大小写；查回答时码位为何不可选、正则的长度限制、自动换了什么
+  const matchNotes: { text: string; tone?: "muted" | "warn" }[] = [];
+  if (content && coversAnswer(scope)) {
+    matchNotes.push({ text: t.codepointsRequestOnly });
+    if (match === "regex") matchNotes.push({ text: t.regexAnswerLimit });
+  }
+  if (switched.match) matchNotes.push({ text: t.switchedMatch, tone: "warn" });
+
   return (
     <Dialog open onOpenChange={(o) => !o && onClose()}>
-      <DialogContent className="sm:max-w-xl">
+      <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-xl">
         <DialogHeader>
           <DialogTitle>{t.title[guard][editing ? "edit" : "create"]}</DialogTitle>
         </DialogHeader>
 
         <div className="flex flex-col gap-4">
-          <Field label={t.name} htmlFor="rule-name" hint={t.nameHint[guard]}>
+          <Field label={t.name} htmlFor="rule-name" hint={t.nameHint}>
             <Input
               id="rule-name"
               value={name}
@@ -340,46 +488,59 @@ export function RuleDialog({
             />
           </Field>
 
+          {content && (
+            <Field label={t.scope} hint={t.scopeHint}>
+              <Segmented<ScopeChoice>
+                label={t.scope}
+                value={scope}
+                options={SCOPES.map((c) => ({ id: c, label: t.scopes[c] }))}
+                onChange={changeScope}
+              />
+            </Field>
+          )}
+
           {choosable && (
-            <Field label={t.matchKind}>
-              <div className="flex items-center gap-2">
+            <Field
+              label={t.matchKind}
+              hint={match === "codepoints" ? t.matchHint.codepoints : t.matchHint[match](cased)}
+              notes={matchNotes}
+            >
+              <div className="flex flex-wrap items-center gap-x-4 gap-y-2">
                 <Segmented<ContentMatch>
                   label={t.matchKind}
                   value={match}
-                  options={MATCHES[choosable].map((m) => ({ id: m, label: t.matchKinds[m] }))}
+                  options={MATCHES[choosable].map((m) => ({
+                    id: m,
+                    label: t.matchKinds[m],
+                    disabled: !matchAllowed(m, scope),
+                  }))}
                   onChange={(m) => {
                     setError(null);
                     setMatch(m);
+                    setSwitched((s) => ({ ...s, match: false }));
                   }}
                 />
-                {redact && (
-                  <Toggle
-                    variant="outline"
+                {/* 开 / 关两态用开关；码位不分大小写，置灰 */}
+                <label className="flex items-center gap-2 tw-body">
+                  <Switch
                     size="sm"
-                    pressed={cased}
-                    onPressedChange={(on) => {
+                    checked={cased && !codepoints}
+                    disabled={codepoints}
+                    onCheckedChange={(on) => {
                       setError(null);
                       setCased(on);
                     }}
-                  >
-                    <CaseSensitiveIcon />
-                    {t.caseSensitive}
-                  </Toggle>
-                )}
+                  />
+                  <span className={cn(codepoints && "text-muted-foreground")}>{t.caseSensitive}</span>
+                </label>
               </div>
             </Field>
           )}
 
           <Field
-            label={t.patternLabel[match]}
+            label={t.patternLabel}
             htmlFor="rule-pattern"
-            hint={
-              content
-                ? t.contentHint[match]
-                : redact
-                  ? t.redactHint[match === "regex" ? "regex" : "contains"](cased)
-                  : t.toolHint
-            }
+            hint={choosable ? undefined : t.toolHint}
             error={codepointsError(t, cpProblem)}
           >
             <Input
@@ -398,7 +559,35 @@ export function RuleDialog({
             />
           </Field>
 
-          {redact && (
+          <ActionField
+            guard={guard}
+            value={action}
+            scope={scope}
+            switched={switched.action}
+            onChange={(a) => {
+              setAction(a);
+              setSwitched((s) => ({ ...s, action: false }));
+            }}
+          />
+
+          {replacing && (
+            <Field label={t.replacement} htmlFor="rule-replacement" hint={t.replacementHint}>
+              <Input
+                id="rule-replacement"
+                className="w-48 font-mono"
+                value={replacement}
+                spellCheck={false}
+                autoCapitalize="off"
+                autoCorrect="off"
+                onChange={(e) => {
+                  setError(null);
+                  setReplacement(e.target.value);
+                }}
+              />
+            </Field>
+          )}
+
+          {placeholder && (
             <Field label={t.label} htmlFor="rule-label" hint={t.labelHint} error={labelError}>
               <div className="flex min-w-0 items-center gap-3">
                 <Input
@@ -422,25 +611,23 @@ export function RuleDialog({
             </Field>
           )}
 
-          {acts && <ActionField guard={acts} value={action} onChange={setAction} />}
-
-          <Field label={t.sample} htmlFor="rule-sample">
-            <Textarea
-              id="rule-sample"
-              className="min-h-16 font-mono"
-              value={sample}
-              spellCheck={false}
-              placeholder={t.samplePlaceholder[guard]}
-              onChange={(e) => setSample(e.target.value)}
-            />
+          <SampleField
+            id="rule-sample"
+            guard={guard}
+            sample={sample}
+            onSample={setSample}
+            side={testSide}
+            onSide={setSide}
+            sides={sides}
+          >
             <TrialBox
               trial={trial}
               sample={sample}
-              action={acts ? action : undefined}
-              output={labelValid}
-              refusal={content ? t.refused(modeName("content", "enforce")) : undefined}
+              action={action}
+              output={!redact || labelValid}
+              refusal={content && testSide === "request" ? t.refused(modeName("enforce")) : undefined}
             />
-          </Field>
+          </SampleField>
         </div>
 
         <Banner layout="inline" tone="error" title={t.saveFailed} show={error !== null}>
@@ -448,7 +635,7 @@ export function RuleDialog({
         </Banner>
 
         <DialogFooter className="items-center">
-          {missing && <span className="mr-auto tw-label text-muted-foreground">{missing}</span>}
+          <FooterNote missing={missing} mode={mode} />
           <Button variant="outline" onClick={onClose}>
             {common.cancel}
           </Button>
@@ -466,39 +653,47 @@ export function RuleDialog({
 }
 
 /**
- * 一条内置规则：可以试，可以复制成自定义规则再改；工具调用和内容规则还能改
- * 第三档下的处置（出厂是哪一种标在下面）。出站脱敏的规则写明换成的占位符。
+ * 一条内置规则：可以试，可以改「开启」状态下的动作（出厂是哪一种标在下面），可以复制成
+ * 自定义规则再改写法。密钥与隐私的规则写明换成的占位符；内置的内容规则只查请求。
  *
  * **停用着的也能试** —— 出厂停用的那几条，就是要先试过才知道该不该开。
  */
 export function BuiltinRuleDialog({
   guard,
+  mode,
   rule,
   onClose,
   onCopy,
   onSaveAction,
 }: {
   guard: Guard;
+  mode: GuardMode;
   rule: SecurityRuleView;
   onClose: () => void;
-  /** 复制成自定义规则。写不出等价写法的（出站脱敏）不给 */
+  /** 复制成自定义规则。写不出等价写法的不给 */
   onCopy?: () => void;
-  /** 改第三档下的处置。只有工具调用审查和内容过滤的规则有 */
+  /** 改「开启」状态下的动作 */
   onSaveAction: (a: RuleAction) => Promise<void>;
 }) {
   const t = useText(ruleDialogText);
   const lt = useText(securityLabelsText);
   const common = useText(commonText);
   const [sample, setSample] = useState("");
-  const [action, setAction] = useState<RuleAction>(rule.action ?? "record");
+  const was = actionOf(guard, rule);
+  const [action, setAction] = useState<RuleAction>(was);
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const written = patternOf(rule);
-  const acts = hasAction(guard) ? guard : null;
-  // 改了处置还没保存：按选着的那一种试
-  const trial = useTrial(guard, sample, { rule: rule.id, action: acts ? action : undefined });
+  const sides = scopeOf(rule);
+  // 改了动作还没保存：按选着的那一种试
+  const trial = useTrial(guard, sample, {
+    rule: rule.id,
+    action,
+    scope: guard === "content" ? sides[0] : undefined,
+  });
   const why = ruleWhy(guard, rule);
-  const changed = acts != null && action !== (rule.action ?? "record");
+  const changed = action !== was;
+  const replacement = rule.replacement ?? DEFAULT_REPLACEMENT;
 
   async function save() {
     setSaving(true);
@@ -513,7 +708,7 @@ export function BuiltinRuleDialog({
 
   return (
     <Dialog open onOpenChange={(o) => !o && onClose()}>
-      <DialogContent className="sm:max-w-xl">
+      <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-xl">
         <DialogHeader>
           <DialogTitle className="flex items-center gap-2">
             {viewName(guard, rule)}
@@ -523,7 +718,7 @@ export function BuiltinRuleDialog({
         </DialogHeader>
 
         <div className="flex flex-col gap-4">
-          <Field label={written?.match === "regex" ? t.patternLabel.regex : t.match}>
+          <Field label={written?.match === "regex" ? t.patternLabel : t.match}>
             <div className="rounded-md border border-border bg-surface/60 px-3 py-2 tw-body">
               {written?.match === "regex" ? (
                 <span className="font-mono tw-label break-all">{written.pattern}</span>
@@ -533,9 +728,14 @@ export function BuiltinRuleDialog({
             </div>
           </Field>
 
-          {acts && (
-            <ActionField guard={acts} value={action} onChange={setAction} factory={rule.default_action ?? null} />
-          )}
+          <ActionField
+            guard={guard}
+            value={action}
+            onChange={setAction}
+            scope={scopeChoice(sides)}
+            factory={rule.default_action ?? null}
+            extra={action === "replace" ? t.builtinReplace(replacement) : undefined}
+          />
 
           <dl className="grid grid-cols-[88px_minmax(0,1fr)] gap-y-1 tw-body">
             <dt className="text-muted-foreground">{t.state}</dt>
@@ -544,7 +744,13 @@ export function BuiltinRuleDialog({
                 {rule.enabled ? t.on : t.off}
               </StatusLabel>
             </dd>
-            {rule.label && (
+            {guard === "content" && (
+              <>
+                <dt className="text-muted-foreground">{t.scope}</dt>
+                <dd>{sides.map((s) => lt.directions[s]).join(" · ")}</dd>
+              </>
+            )}
+            {rule.label && action === "placeholder" && (
               <>
                 <dt className="text-muted-foreground">{t.replacedWith}</dt>
                 <dd className="font-mono">{placeholderOf(rule.label)}</dd>
@@ -552,22 +758,22 @@ export function BuiltinRuleDialog({
             )}
           </dl>
 
-          <Field label={t.sample} htmlFor="builtin-sample">
-            <Textarea
-              id="builtin-sample"
-              className="min-h-16 font-mono"
-              value={sample}
-              spellCheck={false}
-              placeholder={t.samplePlaceholder[guard]}
-              onChange={(e) => setSample(e.target.value)}
-            />
+          <SampleField
+            id="builtin-sample"
+            guard={guard}
+            sample={sample}
+            onSample={setSample}
+            side={sides[0] ?? "request"}
+            onSide={() => {}}
+            sides={sides}
+          >
             <TrialBox
               trial={trial}
               sample={sample}
-              action={acts ? action : undefined}
-              refusal={guard === "content" ? t.refused(modeName("content", "enforce")) : undefined}
+              action={action}
+              refusal={guard === "content" ? t.refused(modeName("enforce")) : undefined}
             />
-          </Field>
+          </SampleField>
         </div>
 
         <Banner layout="inline" tone="error" title={t.saveFailed} show={error !== null}>
@@ -583,18 +789,15 @@ export function BuiltinRuleDialog({
           ) : (
             <span />
           )}
-          {acts ? (
-            <div className="flex gap-2">
-              <Button variant="outline" onClick={onClose}>
-                {common.cancel}
-              </Button>
-              <Button onClick={() => void save()} pending={saving} disabled={!changed}>
-                {common.save}
-              </Button>
-            </div>
-          ) : (
-            <Button onClick={onClose}>{common.close}</Button>
-          )}
+          <div className="flex items-center gap-2">
+            {mode === "observe" && <span className="tw-label text-muted-foreground">{t.monitoring}</span>}
+            <Button variant="outline" onClick={onClose}>
+              {common.cancel}
+            </Button>
+            <Button onClick={() => void save()} pending={saving} disabled={!changed}>
+              {common.save}
+            </Button>
+          </div>
         </DialogFooter>
       </DialogContent>
     </Dialog>
@@ -603,85 +806,81 @@ export function BuiltinRuleDialog({
 
 /**
  * 按现在启用的全部规则试一段文本。**不发出任何请求** —— 试的是网关手里的
- * 那一份规则，结论和真的请求一致：命中了哪几条，替换、删除之后发出去的是什么，
- * 内容过滤在第三档下会不会拒掉它。
+ * 那一份规则，结论和真的请求一致：命中了哪几条，处理后是什么样子，内容过滤在
+ * 「开启」状态下会不会拒掉它。内容过滤先选这段当作请求还是回答来试。
  */
 export function TestDialog({ guard, onClose }: { guard: Guard; onClose: () => void }) {
   const t = useText(ruleDialogText);
   const lt = useText(securityLabelsText);
   const common = useText(commonText);
   const [sample, setSample] = useState("");
-  const trial = useTrial(guard, sample, {});
+  const [side, setSide] = useState<ContentScope>("request");
+  const content = guard === "content";
+  const trial = useTrial(guard, sample, { scope: content ? side : undefined });
   const hits = trial.state === "done" ? trial.hits : [];
-  const acts = hasAction(guard);
 
   return (
     <Dialog open onOpenChange={(o) => !o && onClose()}>
-      <DialogContent className="sm:max-w-2xl">
+      <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-2xl">
         <DialogHeader>
           <DialogTitle>{t.testTitle[guard]}</DialogTitle>
           <DialogDescription>{t.testDesc}</DialogDescription>
         </DialogHeader>
 
         <div className="flex flex-col gap-4">
-          <Field label={t.sample} htmlFor="test-sample">
-            <Textarea
-              id="test-sample"
-              className="min-h-24 font-mono"
-              value={sample}
-              spellCheck={false}
-              placeholder={t.samplePlaceholder[guard]}
-              onChange={(e) => setSample(e.target.value)}
-            />
-          </Field>
-
-          {trial.state !== "idle" && (
-            <div className="flex flex-col gap-2">
-              <TrialBox
-                trial={trial}
-                sample={sample}
-                refusal={guard === "content" ? t.refused(modeName("content", "enforce")) : undefined}
-              />
-              {hits.length > 0 && (
-                <Table className="table-fixed">
-                  <colgroup>
-                    <col className="w-[200px]" />
-                    <col />
-                    <col className="w-[88px]" />
-                  </colgroup>
-                  <TableHeader>
-                    <TableRow>
-                      <TableHead>{t.rule}</TableHead>
-                      <TableHead>{t.content}</TableHead>
-                      <TableHead>{acts ? t.action : t.position}</TableHead>
-                    </TableRow>
-                  </TableHeader>
-                  <TableBody>
-                    {hits.map((h, i) => (
-                      <TableRow key={`${h.rule}:${h.start}:${i}`}>
-                        <TableCell className="truncate">
-                          {ruleName(guard, h.rule, h.custom)}
-                          {h.custom && (
-                            <Badge variant="outline" className="ml-1.5">
-                              {lt.custom}
-                            </Badge>
-                          )}
-                        </TableCell>
-                        <TableCell className="truncate font-mono tw-label text-muted-foreground">{h.excerpt}</TableCell>
-                        {acts ? (
-                          <TableCell className={tone(h.action) === "bad" ? "text-destructive" : "text-muted-foreground"}>
-                            {lt.ruleActions[h.action ?? "record"] ?? h.action}
-                          </TableCell>
-                        ) : (
-                          <TableCell className="text-muted-foreground">{t.line(lineOf(sample, h.start))}</TableCell>
-                        )}
+          <SampleField id="test-sample" guard={guard} sample={sample} onSample={setSample} side={side} onSide={setSide}>
+            {trial.state !== "idle" && (
+              <div className="flex flex-col gap-2">
+                <TrialBox
+                  trial={trial}
+                  sample={sample}
+                  refusal={content && side === "request" ? t.refused(modeName("enforce")) : undefined}
+                />
+                {hits.length > 0 && (
+                  <Table className="table-fixed">
+                    <colgroup>
+                      <col className="w-[200px]" />
+                      <col />
+                      <col className="w-[120px]" />
+                    </colgroup>
+                    <TableHeader>
+                      <TableRow>
+                        <TableHead>{t.rule}</TableHead>
+                        <TableHead>{t.content}</TableHead>
+                        <TableHead>{t.action}</TableHead>
                       </TableRow>
-                    ))}
-                  </TableBody>
-                </Table>
-              )}
-            </div>
-          )}
+                    </TableHeader>
+                    <TableBody>
+                      {hits.map((h, i) => {
+                        const a = h.action ?? (guard === "redact" ? "placeholder" : "record");
+                        return (
+                          <TableRow key={`${h.rule}:${h.start}:${i}`}>
+                            <TableCell className="truncate">
+                              {ruleName(guard, h.rule, h.custom)}
+                              {h.custom && (
+                                <Badge variant="outline" className="ml-1.5">
+                                  {lt.custom}
+                                </Badge>
+                              )}
+                            </TableCell>
+                            <TableCell className="truncate font-mono tw-label text-muted-foreground">
+                              {h.excerpt}
+                              <span className="ml-1.5 font-sans">· {t.line(lineOf(sample, h.start))}</span>
+                            </TableCell>
+                            <TableCell
+                              className={cn("truncate", tone(a) === "bad" ? "text-destructive" : "text-muted-foreground")}
+                            >
+                              {lt.ruleActions[a] ?? a}
+                            </TableCell>
+                          </TableRow>
+                        );
+                      })}
+                    </TableBody>
+                  </Table>
+                )}
+              </div>
+            )}
+          </SampleField>
         </div>
 
         <DialogFooter>
diff --git a/src/security/SecurityPage.i18n.tsx b/src/security/SecurityPage.i18n.tsx
index ee43a243..7b6d8b9d 100644
--- a/src/security/SecurityPage.i18n.tsx
+++ b/src/security/SecurityPage.i18n.tsx
@@ -9,13 +9,10 @@ export const securityPageText = messages(
   {
     /** 和源列表里那一项同一个词 */
     log: "日志",
-    /**
-     * 页头上几项防护各在哪一档：「2 项处置」。第三档在各项上叫法不同（替换、切断、处置），
-     * 合在一起数时统称「处置」
-     */
+    /** 页头上几项防护各处于哪种状态：「2 项开启」 */
     modes: {
-      enforce: "项处置",
-      observe: "项观察",
+      enforce: "项开启",
+      observe: "项监控",
       off: "项关闭",
     },
     /**
@@ -35,24 +32,21 @@ export const securityPageText = messages(
       replaced: "已替换",
       recorded: "仅记录",
     } satisfies Record<SecurityOutcome, string>,
-    /** 标签上的名字。和源列表、规则表里的名字一致 */
-    tabs: {
-      redact: "出站脱敏",
-      inspect_tools: "工具调用审查",
-      content: "内容过滤",
-    },
     loadFailed: "安全设置读取失败",
     /** 撤销提示 */
     ruleOn: (name: string) => `已启用「${name}」`,
     ruleOff: (name: string) => `已停用「${name}」`,
-    modeSet: (guard: string, mode: string) => `${guard}已切换到「${mode}」`,
+    groupOn: (n: number) => `已启用 ${n} 条规则`,
+    groupOff: (n: number) => `已停用 ${n} 条规则`,
+    actionSet: (name: string, action: string) => `「${name}」的动作已改为「${action}」`,
+    modeSet: (guard: string, mode: string) => `${guard}已切换为「${mode}」`,
     ruleCreated: (name: string) => `已创建规则「${name}」`,
   },
   {
     log: "Log",
     modes: {
-      enforce: "enforcing",
-      observe: "observing",
+      enforce: "on",
+      observe: "monitoring",
       off: "off",
     },
     hits: (count: number, n: ReactNode, range: string, custom: boolean) => (
@@ -67,15 +61,12 @@ export const securityPageText = messages(
       replaced: "replaced",
       recorded: "recorded",
     },
-    // 英文名长，标签用短名；全名在每一项的档位那一块上
-    tabs: {
-      redact: "Redaction",
-      inspect_tools: "Tool calls",
-      content: "Content",
-    },
     loadFailed: "The security settings could not be loaded",
     ruleOn: (name: string) => `“${name}” turned on`,
     ruleOff: (name: string) => `“${name}” turned off`,
+    groupOn: (n: number) => (n === 1 ? "1 rule turned on" : `${n} rules turned on`),
+    groupOff: (n: number) => (n === 1 ? "1 rule turned off" : `${n} rules turned off`),
+    actionSet: (name: string, action: string) => `Action for “${name}” set to ${action}`,
     modeSet: (guard: string, mode: string) => `${guard} set to ${mode}`,
     ruleCreated: (name: string) => `Rule “${name}” created`,
   },
diff --git a/src/security/SecurityPage.tsx b/src/security/SecurityPage.tsx
index a33c1f8a..793f4d38 100644
--- a/src/security/SecurityPage.tsx
+++ b/src/security/SecurityPage.tsx
@@ -9,15 +9,10 @@ import { Loadable } from "@/ui/states";
 import { StatusDot } from "@/ui/status-dot";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/ui/tabs";
 import { useText } from "@/i18n";
-import {
-  GUARDS,
-  type ConfigWritten,
-  type Guard,
-  type GuardMode,
-  type SecurityDetail,
-  type SecurityRuleView,
-} from "@/types";
-import { api, hasAction, type RuleSave } from "./api";
+import { GUARDS } from "@/types";
+import { api, type RuleSave } from "./api";
+import type { ConfigWritten, Guard, GuardMode, RuleAction, SecurityDetail, SecurityRuleView } from "@/types";
+import { actionOf, scopeOf } from "./rules";
 import { GuardSkeleton, GuardTab, type RuleActions } from "./GuardTab";
 import { modeName, modeTone, OUTCOMES, outcomeTone, viewName } from "./labels";
 import { securityLabelsText } from "./labels.i18n";
@@ -43,15 +38,20 @@ type DialogState =
   | { kind: "test"; guard: Guard }
   | { kind: "delete"; guard: Guard; rule: SecurityRuleView };
 
-/** 自定义规则现在的样子，改一处（启停）时原样带回去 */
-function saveOf(guard: Guard, r: SecurityRuleView, enabled: boolean): RuleSave {
+/** 自定义规则现在的样子，改一处（启停、动作）时其余原样带回去 */
+function saveOf(guard: Guard, r: SecurityRuleView, enabled: boolean, action = actionOf(guard, r)): RuleSave {
   const written = patternOf(r);
+  // 工具调用的自定义规则只有正则一种写法，不带怎么认、分不分大小写
+  const choosable = guard !== "inspect_tools";
   return {
     name: r.id,
     pattern: written?.pattern ?? "",
-    action: r.action ?? undefined,
-    match: guard === "content" ? written?.match : undefined,
+    action,
+    match: choosable ? written?.match : undefined,
+    case_sensitive: choosable && written?.match !== "codepoints" ? written?.cased : undefined,
     label: guard === "redact" ? (r.label ?? undefined) : undefined,
+    scope: guard === "content" ? scopeOf(r) : undefined,
+    replacement: guard === "content" ? (r.replacement ?? undefined) : undefined,
     enabled,
   };
 }
@@ -61,20 +61,20 @@ const same = (a: SecurityRuleView, b: SecurityRuleView) => a.id === b.id && a.cu
 const ruleKey = (guard: Guard, r: SecurityRuleView) => `${guard}/${r.custom ? "c" : "b"}/${r.id}`;
 
 /**
- * 安全页：日志，以及三项防护 —— 出站脱敏、工具调用审查、内容过滤。出站脱敏管
- * 发出去的凭据和个人信息，工具调用审查管回来的工具调用，内容过滤管调用方发来的
- * 正文（隐藏字符是它的一组内置规则）。
+ * 安全页：日志，以及三项防护 —— 密钥与隐私、危险命令、内容过滤。密钥与隐私管
+ * 发出去的凭据和个人信息，危险命令管回答里的工具调用，内容过滤管请求和回答的正文
+ * （每条规则自己定查哪一边；隐藏字符是它的一组内置规则）。
  *
  * **各项防护都是全局的。**档位和规则对所有上游、所有密钥一样，上游、路由、
  * 密钥上没有任何安全设置。MCP 服务器、技能、钩子这些客户端配置的检查在
  * MCP 页，不在这里：这一页只管经过网关的请求。
  *
- * 页头一行是全貌：几项在第三档（各项叫法不同，页头统称「处置」）、几项在观察、
- * 几项关着（状态点和标签上的同色），以及日志那段时间里一共命中了几次、各做了
- * 什么。日志在第一个标签：开着一项防护却不知道它查到了什么，等于没开。
+ * 页头一行是全貌：几项开启、几项监控、几项关闭（状态点和页签上的同色），以及日志
+ * 那段时间里一共命中了几次、各做了什么。日志在第一个页签：开着一项防护却不知道它查到
+ * 了什么，等于没开。
  *
- * **改动先画出来再写**：启停规则、换档都是先改界面，写完给一个带「撤销」的
- * 提示；几处连着改时一个接一个写（每一次写都要带上一次写完的版本号）。
+ * **改动先画出来再写**：启停规则（一条或一组）、改动作、换状态都是先改界面，写完给一个
+ * 带「撤销」的提示；几处连着改时一个接一个写（每一次写都要带上一次写完的版本号）。
  */
 export default function SecurityPage({
   configVersion,
@@ -129,14 +129,21 @@ export default function SecurityPage({
     return p;
   }, []);
 
-  /** 正在写的开关和档位。开关画成「进行中」，档位旁边转一个圈 */
+  /** 正在写的开关、动作和状态。开关画成「进行中」，状态旁边转一个圈。一组一起写时组内每一条都算 */
   const [pending, setPending] = useState<Record<string, number>>({});
-  async function tracked<T>(key: string, run: () => Promise<T>): Promise<T> {
-    setPending((p) => ({ ...p, [key]: (p[key] ?? 0) + 1 }));
+  async function tracked<T>(keys: string | string[], run: () => Promise<T>): Promise<T> {
+    const ks = typeof keys === "string" ? [keys] : keys;
+    const bump = (d: number) =>
+      setPending((p) => {
+        const next = { ...p };
+        for (const k of ks) next[k] = Math.max(0, (next[k] ?? 0) + d);
+        return next;
+      });
+    bump(1);
     try {
       return await run();
     } finally {
-      setPending((p) => ({ ...p, [key]: Math.max(0, (p[key] ?? 0) - 1) }));
+      bump(-1);
     }
   }
   const busy = (key: string) => (pending[key] ?? 0) > 0;
@@ -176,13 +183,72 @@ export default function SecurityPage({
     });
   }
 
-  /** 换档。可撤销：切到第三档会改变请求的结局，切错了要能一下回去 */
+  /**
+   * 一组规则一起启用或停用（组标题的复选框）。只写状态要变的那几条，一次写配置；撤销把
+   * 这几条拨回去
+   */
+  function bulk(guard: Guard, rules: SecurityRuleView[], enabled: boolean) {
+    const targets = rules.filter((r) => r.enabled !== enabled);
+    if (targets.length === 0) return;
+    const hit = (x: SecurityRuleView) => targets.some((r) => same(r, x));
+    const send = (on: boolean) =>
+      tracked(
+        targets.map((r) => ruleKey(guard, r)),
+        () =>
+          write((base) =>
+            api.setEnabled(guard, {
+              builtin: targets.filter((r) => !r.custom).map((r) => r.id),
+              custom: targets.filter((r) => r.custom).map((r) => r.id),
+              enabled: on,
+              base_version: base,
+            }),
+          ),
+      );
+    void undoable({
+      message: enabled ? t.groupOn(targets.length) : t.groupOff(targets.length),
+      apply: () =>
+        detail.mutate((d) => ({
+          ...d!,
+          [guard]: { ...d![guard], rules: d![guard].rules.map((x) => (hit(x) ? { ...x, enabled } : x)) },
+        })),
+      do: () => send(enabled),
+      undo: () => send(!enabled),
+      after: settle,
+    });
+  }
+
+  /** 行内改一条规则的动作。可撤销 */
+  function setAction(guard: Guard, r: SecurityRuleView, action: RuleAction) {
+    const before = actionOf(guard, r);
+    if (before === action) return;
+    const send = (a: RuleAction) =>
+      tracked(ruleKey(guard, r), () =>
+        write((base) =>
+          r.custom
+            ? api.updateRule(guard, r.id, { ...saveOf(guard, r, r.enabled, a), base_version: base })
+            : api.setAction(guard, r.id, a, base),
+        ),
+      );
+    void undoable({
+      message: t.actionSet(viewName(guard, r), lt.ruleActions[action] ?? action),
+      apply: () =>
+        detail.mutate((d) => ({
+          ...d!,
+          [guard]: { ...d![guard], rules: d![guard].rules.map((x) => (same(x, r) ? { ...x, action } : x)) },
+        })),
+      do: () => send(action),
+      undo: () => send(before),
+      after: settle,
+    });
+  }
+
+  /** 换状态。可撤销：切到「开启」会改变请求的结局，切错了要能一下回去 */
   function setMode(guard: Guard, mode: GuardMode) {
     const before = detail.data?.[guard].mode;
     if (!before || before === mode) return;
     const send = (m: GuardMode) => tracked(`mode/${guard}`, () => write((base) => api.setMode(guard, m, base)));
     void undoable({
-      message: t.modeSet(lt.guards[guard], modeName(guard, mode)),
+      message: t.modeSet(lt.guards[guard], modeName(mode)),
       apply: () => detail.mutate((d) => ({ ...d!, [guard]: { ...d![guard], mode } })),
       do: () => send(mode),
       undo: () => send(before),
@@ -193,26 +259,27 @@ export default function SecurityPage({
   const actions = (guard: Guard): RuleActions => ({
     mode: (mode) => setMode(guard, mode),
     toggle: (r, enabled) => toggle(guard, r, enabled),
+    bulk: (rules, enabled) => bulk(guard, rules, enabled),
+    setAction: (r, a) => setAction(guard, r, a),
     pending: (r) => busy(ruleKey(guard, r)),
     open: (r) =>
       setDialog(r.custom ? { kind: "rule", guard, editing: r } : { kind: "builtin", guard, rule: r }),
-    // 内置规则只有工具调用和内容规则写得出等价的自定义规则（内容规则的码位也写得出）
-    copy: hasAction(guard)
-      ? (r) => {
-          const written = patternOf(r);
-          setDialog({
-            kind: "rule",
-            guard,
-            editing: null,
-            seed: {
-              name: viewName(guard, r),
-              pattern: written?.pattern ?? "",
-              match: written?.match,
-              action: r.action ?? undefined,
-            },
-          });
-        }
-      : undefined,
+    // 写得出等价写法的内置规则（工具调用的正则、内容规则的文字和码位）可以复制成自定义规则
+    copy: (r) => {
+      const written = patternOf(r);
+      setDialog({
+        kind: "rule",
+        guard,
+        editing: null,
+        seed: {
+          name: viewName(guard, r),
+          pattern: written?.pattern ?? "",
+          match: written?.match,
+          cased: written?.cased,
+          action: r.action ?? undefined,
+        },
+      });
+    },
     remove: (r) => setDialog({ kind: "delete", guard, rule: r }),
     create: () => setDialog({ kind: "rule", guard, editing: null }),
     test: () => setDialog({ kind: "test", guard }),
@@ -263,15 +330,16 @@ export default function SecurityPage({
               <TabsTrigger value="log">{t.log}</TabsTrigger>
               {GUARDS.map((g) => (
                 <TabsTrigger key={g} value={g}>
-                  {t.tabs[g]}
-                  {d && <StatusDot tone={modeTone(d[g].mode)} label={modeName(g, d[g].mode)} />}
+                  {/* 名字前面的圆点是这一项的状态：开启绿、监控黄、关闭灰 */}
+                  {d && <StatusDot tone={modeTone(d[g].mode)} label={modeName(d[g].mode)} />}
+                  {lt.guards[g]}
                 </TabsTrigger>
               ))}
             </TabsList>
           }
         />
 
-        {/* 有防护停在「观察」：说一句确认没有误报之后可以切到第三档 */}
+        {/* 有防护处于「监控」：说一句确认没有误报之后可以开启 */}
         <ObserveHint count={d ? GUARDS.filter((g) => d[g].mode === "observe").length : 0} className="mt-4" />
 
         <TabsContent value="log" className="pt-4">
@@ -294,6 +362,7 @@ export default function SecurityPage({
           guard={dialog.guard}
           editing={dialog.editing}
           seed={dialog.seed}
+          mode={d?.[dialog.guard].mode ?? "observe"}
           taken={(d?.[dialog.guard].rules ?? [])
             .filter((r) => r.custom && r.id !== dialog.editing?.id)
             .map((r) => r.id)}
@@ -307,9 +376,9 @@ export default function SecurityPage({
           rule={dialog.rule}
           onClose={() => setDialog(null)}
           onCopy={copyOf(dialog.guard, dialog.rule)}
+          mode={d?.[dialog.guard].mode ?? "observe"}
           onSaveAction={async (a) => {
             const g = dialog.guard;
-            if (!hasAction(g)) return;
             await write((base) => api.setAction(g, dialog.rule.id, a, base));
             setDialog(null);
             settle();
diff --git a/src/security/api.ts b/src/security/api.ts
index 46435893..e18d9694 100644
--- a/src/security/api.ts
+++ b/src/security/api.ts
@@ -8,10 +8,12 @@ import { invoke } from "@tauri-apps/api/core";
 import { call } from "@/control";
 import type {
   ContentMatch,
+  ContentScope,
   CustomRuleSave,
   Guard,
   GuardMode,
   RuleAction,
+  RulesToggle,
   SecurityEventsQuery,
 } from "@/types";
 
@@ -23,14 +25,21 @@ export interface TrialOnly {
   rule?: string;
   label?: string;
   action?: RuleAction;
+  /** 内容过滤：这段文本当作请求还是回答来试 */
+  scope?: ContentScope;
+  /** 内容过滤：动作为「替换」时换成的文字 */
+  replacement?: string;
 }
 
 /** 自定义规则保存时带的内容。版本号由页面在写的那一刻补上 */
 export type RuleSave = Omit<CustomRuleSave, "base_version">;
 
-/** 内置规则能单独改处置的那几项。出站脱敏的规则命中就替换，没有自己的处置 */
-export type ActionGuard = "inspect_tools" | "content";
-export const hasAction = (g: Guard): g is ActionGuard => g === "inspect_tools" || g === "content";
+/** 每一项防护的规则在「开启」档下能做的几件事，按选项的顺序 */
+export const ACTIONS: Record<Guard, readonly RuleAction[]> = {
+  redact: ["placeholder", "record"],
+  inspect_tools: ["cut", "record"],
+  content: ["block", "strip", "replace", "record"],
+};
 
 export const api = {
   detail: () => call("Security", null),
@@ -47,22 +56,24 @@ export const api = {
   /** 启用或停用一条内置规则 */
   toggleBuiltin: (guard: Guard, id: string, enabled: boolean, baseVersion: string) =>
     call("ToggleBuiltinRule", { enabled, base_version: baseVersion }, guard, id),
-  /** 一条内置规则在第三档下做什么 */
-  setAction: (guard: ActionGuard, id: string, action: RuleAction, baseVersion: string) =>
+  /** 一组规则一起启用或停用：一次写配置 */
+  setEnabled: (guard: Guard, save: RulesToggle) => call("SetRulesEnabled", save, guard),
+  /** 一条内置规则在「开启」档下做什么 */
+  setAction: (guard: Guard, id: string, action: RuleAction, baseVersion: string) =>
     call("SetBuiltinRuleAction", { action, base_version: baseVersion }, guard, id),
-  createRule: (guard: Guard, save: CustomRuleSave) => call("CreateCustomRule", save, guard),
-  updateRule: (guard: Guard, name: string, save: CustomRuleSave) => call("UpdateCustomRule", save, guard, name),
+  createRule: (guard: Guard, save: CustomRuleSave) =>
+    call("CreateCustomRule", save, guard),
+  updateRule: (guard: Guard, name: string, save: CustomRuleSave) =>
+    call("UpdateCustomRule", save, guard, name),
   deleteRule: (guard: Guard, name: string, baseVersion: string) =>
     call("DeleteCustomRule", { base_version: baseVersion }, guard, name),
   /**
-   * 拿一段文本试一试。给了 `pattern` 就只试这一条（按 `match` 认，出站脱敏按
-   * `case_sensitive` 分不分大小写、按 `label` 写占位符），给了 `rule` 就只试这一条内置规则（停用着的也能试），都不给就按
-   * 现在启用的全部规则。`action` 是对话框里选着、还没保存的处置：发出去的样子和会不会
-   * 被拒按它算
+   * 拿一段文本试一试。给了 `pattern` 就只试这一条（按 `match` 认、按 `case_sensitive` 分不分
+   * 大小写，密钥与隐私按 `label` 写占位符），给了 `rule` 就只试这一条内置规则（停用着的也能
+   * 试），都不给就按现在启用的全部规则。`action` 是对话框里选着、还没保存的动作：处理后的
+   * 样子和会不会被拒按它算。内容过滤的 `scope` 说这段当作请求还是回答来试，`replacement`
+   * 是还没保存的替换文字
    */
-  test: (
-    guard: Guard,
-    sample: string,
-    only: TrialOnly = {},
-  ) => call("TestSecurity", { sample, ...only }, guard),
+  test: (guard: Guard, sample: string, only: TrialOnly = {}) =>
+    call("TestSecurity", { sample, ...only }, guard),
 };
diff --git a/src/security/export.i18n.ts b/src/security/export.i18n.ts
index 4f22ec12..8fcca93d 100644
--- a/src/security/export.i18n.ts
+++ b/src/security/export.i18n.ts
@@ -40,6 +40,7 @@ export const exportText = messages(
     outcome: {
       recorded: "仅记录",
       replaced: (placeholders: string) => `替换为 ${placeholders}`,
+      replacedText: (n: number, text: string) => `替换 ${n} 处，替换为 ${text}`,
       cut: (tool: string, args: string, truncated: boolean) => `切断 ${tool} 调用，参数${truncated ? "（仅开头）" : ""}：${args}`,
       clientNotice: (text: string) => `客户端收到：${text}`,
       blocked: "请求未发往上游",
@@ -81,6 +82,8 @@ export const exportText = messages(
     outcome: {
       recorded: "Recorded only",
       replaced: (placeholders: string) => `Replaced with ${placeholders}`,
+      replacedText: (n: number, text: string) =>
+        n === 1 ? `Replaced 1 segment with ${text}` : `Replaced ${n} segments with ${text}`,
       cut: (tool: string, args: string, truncated: boolean) =>
         `Cut off the ${tool} call; arguments${truncated ? " (beginning only)" : ""}: ${args}`,
       clientNotice: (text: string) => `Client received: ${text}`,
diff --git a/src/security/export.test.ts b/src/security/export.test.ts
index bd804472..b704c51f 100644
--- a/src/security/export.test.ts
+++ b/src/security/export.test.ts
@@ -94,7 +94,7 @@ describe("命中的位置", () => {
     expect(partLabel(loc({ part: "tool_result", tool: "Bash", role: "user" }))).toBe("工具结果 · Bash");
     expect(partLabel(loc({ part: "tool_call", tool: null }))).toBe("工具调用");
     expect(partLabel(loc({ part: "system", message_index: null, role: null }))).toBe("系统提示");
-    expect(partLabel(loc({ part: "response_text", message_index: null, role: null }))).toBe("回答正文");
+    expect(partLabel(loc({ part: "response_text", message_index: null, role: null }))).toBe("回答 · 正文");
     expect(partLabel(loc({ role: "critic" }))).toBe("第 4 条消息 · critic");
     setLang("en");
     expect(partLabel(loc({ role: "developer", message_index: 0 }))).toBe("Message 1 · Developer");
@@ -145,7 +145,7 @@ describe("导出的文件", () => {
     expect(csv.charCodeAt(0)).toBe(0xfeff);
     const lines = csv.slice(1).split("\r\n");
     expect(lines[0]?.startsWith("时间,处置,类型,规则,规则 ID,规则来源,")).toBe(true);
-    expect(lines[1]).toContain("2026-10-10 16:42:07,已替换,出站脱敏,Anthropic API 密钥,anthropic-api-key,内置,,,0.68.0,");
+    expect(lines[1]).toContain("2026-10-10 16:42:07,已替换,密钥与隐私,Anthropic API 密钥,anthropic-api-key,内置,,,0.68.0,");
     expect(csv).toContain('"第 4 条消息 · 用户 (messages[3].content[0].text): deploy with «sk-ant-api03-…Q3xA» then\n工具结果 · Read (messages[5].content[0].content): deploy with «sk-ant-api03-…Q3xA» then\n另有 2 处未列出"');
     expect(lines[1]).toContain(",48123,s012,claude-code,tw-9Wm…b1Qs,anthropic,claude-sonnet-5,claude-sonnet-5,Claude Code,");
     expect(lines.at(-1)).toBe("");
diff --git a/src/security/export.ts b/src/security/export.ts
index 5d2bc189..9cd7f92f 100644
--- a/src/security/export.ts
+++ b/src/security/export.ts
@@ -9,7 +9,14 @@
  */
 import { textOf } from "@/i18n";
 import { appLabel } from "@/labels";
-import type { HitLocation, OutcomeDetail, SecurityEventView, SecurityEventsPage, SecurityEventsQuery } from "@/types";
+import type {
+  HitLocation,
+  OutcomeDetail,
+  SecurityEventView,
+  SecurityEventsPage,
+  SecurityEventsQuery,
+} from "@/types";
+import { replacedOf } from "./rules";
 import { exportText } from "./export.i18n";
 import { matchingOf, partLabel, snapshotName } from "./labels";
 import { securityLabelsText } from "./labels.i18n";
@@ -62,8 +69,10 @@ export function outcomeLine(d: OutcomeDetail): string {
   switch (d.action) {
     case "recorded":
       return t.recorded;
-    case "replaced":
-      return t.replaced(d.placeholders.join(", "));
+    case "replaced": {
+      const r = replacedOf(d);
+      return r.kind === "text" ? t.replacedText(r.segments, r.replacement) : t.replaced(r.placeholders.join(", "));
+    }
     case "cut":
       return `${t.cut(d.tool, d.arguments, d.truncated)}\n${t.clientNotice(d.client_notice)}`;
     case "blocked":
diff --git a/src/security/labels.i18n.tsx b/src/security/labels.i18n.tsx
index 9caffce9..f4c9c274 100644
--- a/src/security/labels.i18n.tsx
+++ b/src/security/labels.i18n.tsx
@@ -13,33 +13,30 @@ const or = (xs: ReactNode[], sep: ReactNode, last: ReactNode) =>
   xs.flatMap((x, i) => (i === 0 ? [x] : [i === xs.length - 1 ? last : sep, x]));
 
 /**
- * 各项防护共用的名称：档位、处置、类别、规则名，以及内置规则的匹配判据。
+ * 各项防护共用的名称：状态、动作、类别、规则名，以及内置规则的匹配判据。
  *
  * **规则名只收内置的。**自定义规则的名字就是用户起的，原样显示；表里没有
  * 的，退回 core 给的英文名或 id。
  *
- * **第三档按各项做的事命名**（替换、切断、处置），前两档各项一样。
+ * **三种状态各项一样**：开启、监控、关闭（配置里是 `enforce` / `observe` / `off`）。
  */
 export const securityLabelsText = messages(
   {
     guards: CORE_ZH.tables.guard,
     /** 日志「类型」一栏，短一点 */
     guardShort: {
-      redact: "出站脱敏",
-      inspect_tools: "工具调用",
+      redact: "密钥与隐私",
+      inspect_tools: "危险命令",
       content: "内容过滤",
     },
-    /** 前两档，各项一样 */
+    /** 一项防护的三种状态，各项一样 */
     modes: {
+      enforce: "开启",
+      observe: "监控",
       off: "关闭",
-      observe: "观察",
-    },
-    /** 第三档，按这一项做的事命名：命中的换成占位符、调用切断、规则各自拒绝或删除 */
-    enforce: {
-      redact: "替换",
-      inspect_tools: "切断",
-      content: "处置",
     },
+    /** 防护处于「监控」时，规则的动作后面那一句：实际只记录 */
+    monitoring: "监控中",
     /** 日志里每一条做了什么 */
     actions: {
       recorded: "仅记录",
@@ -48,11 +45,13 @@ export const securityLabelsText = messages(
       stripped: "已删除",
       blocked: "已拒绝",
     } as Record<string, string>,
-    /** 工具调用规则、内容规则在第三档下做什么 */
+    /** 规则在「开启」状态下做什么 */
     ruleActions: {
+      placeholder: "替换为占位符",
       cut: "切断",
       block: "拒绝",
       strip: "删除",
+      replace: "替换",
       record: "仅记录",
     } as Record<string, string>,
     kinds: {
@@ -78,7 +77,7 @@ export const securityLabelsText = messages(
       message: (n: number) => `第 ${n} 条消息`,
       tool_result: "工具结果",
       tool_call: "工具调用",
-      response_text: "回答正文",
+      response_text: "回答 · 正文",
     },
     /** 消息的角色，按客户端写的查；表里没有的照写 */
     roles: {
@@ -181,24 +180,21 @@ export const securityLabelsText = messages(
   },
   {
     guards: {
-      redact: "Outbound redaction",
-      inspect_tools: "Tool-call inspection",
+      redact: "Secrets & privacy",
+      inspect_tools: "Dangerous commands",
       content: "Content filter",
     },
     guardShort: {
-      redact: "Redaction",
-      inspect_tools: "Tool call",
+      redact: "Secrets",
+      inspect_tools: "Commands",
       content: "Content",
     },
     modes: {
+      enforce: "On",
+      observe: "Monitor",
       off: "Off",
-      observe: "Observe",
-    },
-    enforce: {
-      redact: "Replace",
-      inspect_tools: "Cut off",
-      content: "Enforce",
     },
+    monitoring: "Monitoring",
     actions: {
       recorded: "Recorded",
       replaced: "Replaced",
@@ -207,9 +203,11 @@ export const securityLabelsText = messages(
       blocked: "Refused",
     },
     ruleActions: {
+      placeholder: "Replace with placeholder",
       cut: "Cut off",
       block: "Refuse",
       strip: "Delete",
+      replace: "Replace",
       record: "Record only",
     },
     kinds: {
@@ -233,7 +231,7 @@ export const securityLabelsText = messages(
       message: (n: number) => `Message ${n}`,
       tool_result: "Tool result",
       tool_call: "Tool call",
-      response_text: "Answer text",
+      response_text: "Answer · text",
     },
     roles: {
       user: "User",
diff --git a/src/security/labels.test.ts b/src/security/labels.test.ts
index 01f6eb56..f810a1c2 100644
--- a/src/security/labels.test.ts
+++ b/src/security/labels.test.ts
@@ -72,26 +72,15 @@ describe("状态的颜色", () => {
   });
 });
 
-/**
- * 第三档按各项做的事命名：出站脱敏「替换」、工具调用审查「切断」、内容过滤「处置」。
- * 前两档各项一样。
- */
-describe("档位的名字", () => {
-  it("第三档各项各叫各的", () => {
-    expect(modeName("redact", "enforce")).toBe("替换");
-    expect(modeName("inspect_tools", "enforce")).toBe("切断");
-    expect(modeName("content", "enforce")).toBe("处置");
-    expect(modeName("content", "observe")).toBe("观察");
-    expect(modeName("redact", "off")).toBe("关闭");
+/** 三种状态各项一样：开启、监控、关闭 */
+describe("状态的名字", () => {
+  it("中文", () => {
+    expect((["enforce", "observe", "off"] as const).map(modeName)).toEqual(["开启", "监控", "关闭"]);
   });
 
   it("英文", () => {
     setLang("en");
-    expect(["redact", "inspect_tools", "content"].map((g) => modeName(g as "redact", "enforce"))).toEqual([
-      "Replace",
-      "Cut off",
-      "Enforce",
-    ]);
+    expect((["enforce", "observe", "off"] as const).map(modeName)).toEqual(["On", "Monitor", "Off"]);
   });
 });
 
diff --git a/src/security/labels.tsx b/src/security/labels.tsx
index 3bc4d6e8..a34ec4b1 100644
--- a/src/security/labels.tsx
+++ b/src/security/labels.tsx
@@ -15,23 +15,19 @@ import type {
 import { securityLabelsText } from "./labels.i18n";
 
 /**
- * 一项防护的档位，画成状态点的语气。
+ * 一项防护的状态，画成状态点的语气。
  *
- * **第三档是绿的**（防护在起作用），**观察是琥珀的**（命中照常放行，只记下来 ——
+ * **开启是绿的**（防护在起作用），**监控是琥珀的**（命中照常放行，只记录并通知 ——
  * 要留意，但它在工作），**关闭是灰的**（没有在工作，也不是故障）。页头、标签、
- * 档位那一块用同一套，一眼对得上。
+ * 状态那一块用同一套，一眼对得上。
  */
 export function modeTone(mode: GuardMode): StatusTone {
   return mode === "enforce" ? "ok" : mode === "observe" ? "warn" : "idle";
 }
 
-/**
- * 一项防护的一档叫什么。前两档各项一样（关闭、观察）；**第三档按这一项做的事命名**：
- * 出站脱敏「替换」、工具调用审查「切断」、内容过滤「处置」（规则各自拒绝或删除）。
- */
-export function modeName(guard: Guard, mode: GuardMode): string {
-  const t = textOf(securityLabelsText);
-  return mode === "enforce" ? t.enforce[guard] : t.modes[mode];
+/** 一项防护的状态叫什么：开启、监控、关闭，各项一样 */
+export function modeName(mode: GuardMode): string {
+  return textOf(securityLabelsText).modes[mode];
 }
 
 /**
@@ -99,10 +95,12 @@ export function ruleWhy(guard: Guard, r: SecurityRuleView): string {
   return rest.charAt(0).toUpperCase() + rest.slice(1);
 }
 
-/** 命中在哪儿：工具调用审查是哪个工具，内容过滤是「工具结果」 */
+/** 命中在哪儿：危险命令是哪个工具；内容过滤是「工具结果」，或者「回答」（查的是回答正文） */
 export function whereOf(e: SecurityEventView): string | null {
+  const t = textOf(securityLabelsText);
+  if (e.guard === "content" && e.direction === "response") return t.directions.response;
   if (!e.tool) return null;
-  return e.tool === "tool_result" ? textOf(securityLabelsText).toolResult : e.tool;
+  return e.tool === "tool_result" ? t.toolResult : e.tool;
 }
 
 /**
diff --git a/src/security/marks.test.ts b/src/security/marks.test.ts
index ec5db45d..0f79f8a7 100644
--- a/src/security/marks.test.ts
+++ b/src/security/marks.test.ts
@@ -48,15 +48,26 @@ describe("历史记录的安全徽标", () => {
     expect(marksFromEvents([ev({ action: "replaced" })]).secrets?.replaced).toBe(true);
   });
 
-  it("内容过滤：只有删过文字的挂「已删除」", () => {
+  it("拦截档下有「仅记录」的规则：不算全部替换，每一项各记换没换", () => {
+    const m = marksFromEvents([ev({ action: "replaced" }), ev({ id: 2, rule: "email", action: "recorded" })]);
+    expect(m.secrets?.replaced).toBe(false);
+    expect(m.secrets?.items.map((i) => [i.rule, i.replaced])).toEqual([
+      ["anthropic-api-key", true],
+      ["email", false],
+    ]);
+  });
+
+  it("内容过滤：只有删过、换过文字的挂「已删除」「已替换」", () => {
     const m = marksFromEvents([
       ev({ guard: "content", rule: "unicode-tags", action: "stripped", tool: "tool_result", excerpt: "a‹U+E0049 ×74›b", count: 74 }),
       ev({ id: 2, guard: "content", rule: "act-as", action: "recorded", excerpt: "act as", count: 1 }),
       ev({ id: 3, guard: "content", rule: "项目代号", custom: true, action: "stripped", excerpt: "project falcon", count: 2 }),
+      ev({ id: 4, guard: "content", rule: "北极星", custom: true, action: "replaced", direction: "response", count: 3 }),
     ]);
     expect(m.stripped).toEqual([
-      { rule: "unicode-tags", custom: false, count: 74 },
-      { rule: "项目代号", custom: true, count: 2 },
+      { rule: "unicode-tags", custom: false, count: 74, replaced: false },
+      { rule: "项目代号", custom: true, count: 2, replaced: false },
+      { rule: "北极星", custom: true, count: 3, replaced: true },
     ]);
     expect(m.secrets).toBeUndefined();
     expect(marksFromEvents([ev({ guard: "content", rule: "jailbreak", action: "blocked" })]).stripped).toBeUndefined();
diff --git a/src/security/marks.ts b/src/security/marks.ts
index 77e4962c..4f8e7e2f 100644
--- a/src/security/marks.ts
+++ b/src/security/marks.ts
@@ -2,7 +2,7 @@ import type { FlaggedCall, RequestRow, SecurityEventView } from "@/types";
 
 /**
  * 一条请求的安全记录 → 流量页上那几个徽标要的样子：已脱敏 / 含凭据、已拦截 / 可疑调用、
- * 已删除。
+ * 已删除 / 已替换。
  *
  * 实时事件和历史记录说的是同一件事，只是来路不同：刚发生的那条由事件填，
  * 翻历史时由这里填。**两条路给出同一个形状**，徽标才不会因为关窗再开而
@@ -14,18 +14,20 @@ export function marksFromEvents(
   if (!events || events.length === 0) return {};
   const redact = events.filter((e) => e.guard === "redact");
   const tools = events.filter((e) => e.guard === "inspect_tools");
-  // 内容过滤只有删过文字的上徽标，和实时那一路（`applyEvent`）一样
-  const stripped = events.filter((e) => e.guard === "content" && e.action === "stripped");
+  // 内容过滤只有删过、换过文字的上徽标，和实时那一路（`applyEvent`）一样
+  const stripped = events.filter((e) => e.guard === "content" && (e.action === "stripped" || e.action === "replaced"));
   return {
     secrets:
       redact.length > 0
         ? {
-            replaced: redact.some((e) => e.action === "replaced"),
+            // 每一项都换成了占位符才算，和实时那一路一样
+            replaced: redact.every((e) => e.action === "replaced"),
             items: redact.map((e) => ({
               rule: e.rule,
               custom: e.custom === true,
               masked: e.excerpt,
               count: e.count,
+              replaced: e.action === "replaced",
               // 和实时事件那一项（`SecretItem.detail`）同一个形状
               detail: {
                 direction: e.direction,
@@ -51,7 +53,7 @@ export function marksFromEvents(
         : undefined,
     stripped:
       stripped.length > 0
-        ? stripped.map((e) => ({ rule: e.rule, custom: e.custom === true, count: e.count }))
+        ? stripped.map((e) => ({ rule: e.rule, custom: e.custom === true, count: e.count, replaced: e.action === "replaced" }))
         : undefined,
   };
 }
diff --git a/src/security/rules.test.ts b/src/security/rules.test.ts
new file mode 100644
index 00000000..4e56b6d1
--- /dev/null
+++ b/src/security/rules.test.ts
@@ -0,0 +1,138 @@
+import { describe, expect, it } from "vitest";
+import type { SecurityRuleView } from "@/types";
+import {
+  actionAllowed,
+  actionOf,
+  adjustForScope,
+  groupChecked,
+  groupRules,
+  groupTarget,
+  matchAllowed,
+  patternText,
+  ruleMatches,
+  scopeChoice,
+  scopeOf,
+  scopeOfChoice,
+} from "./rules";
+
+const rule = (x: Partial<SecurityRuleView>): SecurityRuleView => ({
+  id: "r",
+  custom: false,
+  name: "Rule",
+  kind: "invisible",
+  matcher: { kind: "codepoints", ranges: ["U+200B"] },
+  enabled: true,
+  on_by_default: true,
+  ...x,
+});
+
+describe("分组", () => {
+  it("内置规则按类别各一组，先后按第一次出现；自定义的总在最后", () => {
+    const rules = [
+      rule({ id: "a", kind: "invisible" }),
+      rule({ id: "c1", custom: true, kind: "custom" }),
+      rule({ id: "b", kind: "injection" }),
+      rule({ id: "a2", kind: "invisible" }),
+    ];
+    const groups = groupRules(rules, (r) => r);
+    expect(groups.map((g) => [g.key, g.rows.map((r) => r.id)])).toEqual([
+      ["invisible", ["a", "a2"]],
+      ["injection", ["b"]],
+      ["custom", ["c1"]],
+    ]);
+    expect(groups.map((g) => g.custom)).toEqual([false, false, true]);
+  });
+});
+
+describe("组标题的复选框", () => {
+  it("全部启用、部分启用（半选）、全部停用", () => {
+    expect(groupChecked([{ enabled: true }, { enabled: true }])).toBe(true);
+    expect(groupChecked([{ enabled: true }, { enabled: false }])).toBe("indeterminate");
+    expect(groupChecked([{ enabled: false }])).toBe(false);
+  });
+
+  it("全部启用时点它全部停用，否则全部启用", () => {
+    expect(groupTarget([{ enabled: true }, { enabled: true }])).toBe(false);
+    expect(groupTarget([{ enabled: true }, { enabled: false }])).toBe(true);
+    expect(groupTarget([{ enabled: false }])).toBe(true);
+  });
+});
+
+describe("检索", () => {
+  it("按界面上的名字、英文名、id 和写法找，不分大小写", () => {
+    const r = rule({
+      id: "project-codename",
+      custom: true,
+      name: "project-codename",
+      matcher: { kind: "contains", text: "北极星", case_sensitive: false },
+    });
+    expect(ruleMatches(r, "项目代号", "代号")).toBe(true);
+    expect(ruleMatches(r, "项目代号", "CODENAME")).toBe(true);
+    expect(ruleMatches(r, "项目代号", "北极")).toBe(true);
+    expect(ruleMatches(r, "项目代号", "南极")).toBe(false);
+    expect(ruleMatches(r, "项目代号", "  ")).toBe(true);
+  });
+
+  it("写法：正则、文字、码位、前缀、域名后缀；没有写法的是空的", () => {
+    expect(patternText(rule({ matcher: { kind: "regex", pattern: "TKT-\\d{6}" } }))).toBe("TKT-\\d{6}");
+    expect(patternText(rule({ matcher: { kind: "codepoints", ranges: ["U+200B", "U+E0000–U+E007F"] } }))).toBe(
+      "U+200B U+E0000–U+E007F",
+    );
+    expect(patternText(rule({ matcher: { kind: "prefix", prefix: "sk-ant-", min_tail: 20 } }))).toBe("sk-ant-");
+    expect(patternText(rule({ matcher: { kind: "domain-suffix", suffixes: [".corp", ".internal"] } }))).toBe(
+      ".corp .internal",
+    );
+    expect(patternText(rule({ matcher: { kind: "jwt" } }))).toBe("");
+  });
+});
+
+describe("缺省值", () => {
+  it("不给检查对象就是只查请求", () => {
+    expect(scopeOf(rule({}))).toEqual(["request"]);
+    expect(scopeOf(rule({ scope: [] }))).toEqual(["request"]);
+    expect(scopeOf(rule({ scope: ["response"] }))).toEqual(["response"]);
+  });
+
+  it("不给动作：密钥与隐私替换为占位符，其余仅记录", () => {
+    expect(actionOf("redact", {})).toBe("placeholder");
+    expect(actionOf("content", {})).toBe("record");
+    expect(actionOf("inspect_tools", { action: "cut" })).toBe("cut");
+  });
+});
+
+/** 规格 §5.2 */
+describe("检查对象与动作、匹配方式的联动", () => {
+  it("三个选项和配置里的写法互换", () => {
+    expect(scopeChoice(["request"])).toBe("request");
+    expect(scopeChoice(["response"])).toBe("response");
+    expect(scopeChoice(["response", "request"])).toBe("both");
+    expect(scopeOfChoice("both")).toEqual(["request", "response"]);
+    expect(scopeOfChoice("response")).toEqual(["response"]);
+  });
+
+  it("含回答时「拒绝」「码位」不可选；只查请求时都可选", () => {
+    for (const c of ["response", "both"] as const) {
+      expect(actionAllowed("content", "block", c)).toBe(false);
+      expect(matchAllowed("codepoints", c)).toBe(false);
+      for (const a of ["strip", "replace", "record"] as const) expect(actionAllowed("content", a, c)).toBe(true);
+    }
+    expect(actionAllowed("content", "block", "request")).toBe(true);
+    expect(matchAllowed("codepoints", "request")).toBe(true);
+    // 别的防护没有检查对象
+    expect(actionAllowed("inspect_tools", "cut", "request")).toBe(true);
+  });
+
+  it("改成含回答：已选「拒绝」换成「删除」、「码位」换成「包含」，并说明换了哪几项", () => {
+    expect(adjustForScope("both", "block", "codepoints")).toEqual({
+      action: "strip",
+      match: "contains",
+      changed: { action: true, match: true },
+    });
+    expect(adjustForScope("response", "replace", "regex")).toEqual({
+      action: "replace",
+      match: "regex",
+      changed: { action: false, match: false },
+    });
+    expect(adjustForScope("request", "block", "codepoints").changed).toEqual({ action: false, match: false });
+  });
+});
diff --git a/src/security/rules.ts b/src/security/rules.ts
new file mode 100644
index 00000000..7534bfff
--- /dev/null
+++ b/src/security/rules.ts
@@ -0,0 +1,148 @@
+/**
+ * 规则表和规则对话框里不画东西的那部分：分组、检索、组标题复选框的状态、内容规则
+ * 「检查对象」和「动作」「匹配方式」的联动。拆出来是为了能单独测。
+ */
+import type { ContentMatch, ContentScope, Guard, OutcomeDetail, RuleAction, SecurityRuleView } from "@/types";
+
+/** 规则表里的一组：内置规则按类别各一组，自定义规则在最后一组 */
+export interface RuleGroup<T> {
+  /** 类别（`api-keys`、`invisible`…）；工具调用的内置规则是 `command`；自定义的是 `custom` */
+  key: string;
+  custom: boolean;
+  rows: T[];
+}
+
+/**
+ * 按 core 给的顺序把规则分成几组。**同一类别不连着的也归进同一组**（core 给的顺序里同类
+ * 本来就挨着，这里不依赖它），组的先后按各类第一次出现的位置；自定义的总在最后。
+ */
+export function groupRules<T>(rows: readonly T[], ruleOf: (row: T) => SecurityRuleView): RuleGroup<T>[] {
+  const out: RuleGroup<T>[] = [];
+  const byKey = new Map<string, RuleGroup<T>>();
+  let custom: RuleGroup<T> | null = null;
+  for (const row of rows) {
+    const r = ruleOf(row);
+    if (r.custom) {
+      custom ??= { key: "custom", custom: true, rows: [] };
+      custom.rows.push(row);
+      continue;
+    }
+    let g = byKey.get(r.kind);
+    if (!g) {
+      g = { key: r.kind, custom: false, rows: [] };
+      byKey.set(r.kind, g);
+      out.push(g);
+    }
+    g.rows.push(row);
+  }
+  if (custom) out.push(custom);
+  return out;
+}
+
+/** 组标题复选框：全部启用、部分启用（半选）、全部停用 */
+export function groupChecked(rules: readonly Pick<SecurityRuleView, "enabled">[]): boolean | "indeterminate" {
+  const on = rules.filter((r) => r.enabled).length;
+  return on === 0 ? false : on === rules.length ? true : "indeterminate";
+}
+
+/** 点组标题复选框之后要的状态：全部启用时全部停用，否则全部启用 */
+export function groupTarget(rules: readonly Pick<SecurityRuleView, "enabled">[]): boolean {
+  return groupChecked(rules) !== true;
+}
+
+/**
+ * 一条规则写的是什么，拿来检索：正则、要找的文字、码位、前缀、域名后缀。代码里做的检查
+ * 和没有写法的内置规则（PEM、JWT…）是空的，只按名字找得到
+ */
+export function patternText(r: SecurityRuleView): string {
+  const m = r.matcher;
+  switch (m.kind) {
+    case "regex":
+      return m.pattern;
+    case "contains":
+      return m.text;
+    case "codepoints":
+      return m.ranges.join(" ");
+    case "prefix":
+      return m.prefix;
+    case "domain-suffix":
+      return m.suffixes.join(" ");
+    default:
+      return "";
+  }
+}
+
+/** 检索框里的字能不能在这条规则的名字（界面上的、英文的、id）或写法里找到。不分大小写 */
+export function ruleMatches(r: SecurityRuleView, shownName: string, query: string): boolean {
+  const q = query.trim().toLowerCase();
+  if (q.length === 0) return true;
+  return [shownName, r.name, r.id, patternText(r)].some((s) => s.toLowerCase().includes(q));
+}
+
+// ------------------------------------------------------------------ 缺省值
+
+/** 内容规则「替换」的缺省文字 */
+export const DEFAULT_REPLACEMENT = "***";
+
+/** 一条规则查哪一边。core 不给（内置规则、别的防护）就是只查请求 */
+export function scopeOf(r: Pick<SecurityRuleView, "scope">): ContentScope[] {
+  return r.scope && r.scope.length > 0 ? r.scope : ["request"];
+}
+
+/** 一条规则在「开启」档下做什么。不给时：密钥与隐私是替换为占位符，其余是仅记录 */
+export function actionOf(guard: Guard, r: Pick<SecurityRuleView, "action">): RuleAction {
+  return r.action ?? (guard === "redact" ? "placeholder" : "record");
+}
+
+/**
+ * 「已替换」具体换成了什么：密钥与隐私是一组占位符，内容过滤是几处换成同一段文字
+ * （带着 `replacement` 的是内容过滤）
+ */
+export function replacedOf(
+  d: Extract<OutcomeDetail, { action: "replaced" }>,
+): { kind: "placeholders"; placeholders: string[] } | { kind: "text"; segments: number; replacement: string } {
+  if (d.replacement != null) return { kind: "text", segments: d.segments ?? 1, replacement: d.replacement };
+  return { kind: "placeholders", placeholders: d.placeholders };
+}
+
+// ------------------------------------------------------------------ 内容规则对话框的联动
+
+/** 检查对象的三个选项 */
+export type ScopeChoice = "request" | "response" | "both";
+
+export function scopeChoice(scope: readonly ContentScope[]): ScopeChoice {
+  const req = scope.includes("request");
+  const res = scope.includes("response");
+  return req && res ? "both" : res ? "response" : "request";
+}
+
+export function scopeOfChoice(c: ScopeChoice): ContentScope[] {
+  return c === "both" ? ["request", "response"] : [c];
+}
+
+/** 查回答吗。查回答时「拒绝」和「码位」不可选（规格 §5.2） */
+export const coversAnswer = (c: ScopeChoice) => c !== "request";
+
+/** 这个动作在这个检查对象下能不能选 */
+export function actionAllowed(guard: Guard, action: RuleAction, c: ScopeChoice): boolean {
+  return !(guard === "content" && action === "block" && coversAnswer(c));
+}
+
+/** 这种匹配方式在这个检查对象下能不能选 */
+export function matchAllowed(match: ContentMatch, c: ScopeChoice): boolean {
+  return !(match === "codepoints" && coversAnswer(c));
+}
+
+/**
+ * 换了检查对象之后：选着的动作、匹配方式在新的检查对象下不可选的，自动换成可选的那一个
+ * （拒绝 → 删除，码位 → 包含），并说明换了哪几项（对话框在对应控件下方提示）
+ */
+export function adjustForScope(
+  c: ScopeChoice,
+  action: RuleAction,
+  match: ContentMatch,
+): { action: RuleAction; match: ContentMatch; changed: { action: boolean; match: boolean } } {
+  const a = actionAllowed("content", action, c) ? action : "strip";
+  const m = matchAllowed(match, c) ? match : "contains";
+  return { action: a, match: m, changed: { action: a !== action, match: m !== match } };
+}
diff --git a/src/security/useTrial.ts b/src/security/useTrial.ts
index 53d82113..28cb91e2 100644
--- a/src/security/useTrial.ts
+++ b/src/security/useTrial.ts
@@ -26,7 +26,7 @@ export function useTrial(
   ready = true,
 ): Trial {
   const [trial, setTrial] = useState<Trial>({ state: "idle" });
-  const { pattern, match, case_sensitive, rule, label, action } = only;
+  const { pattern, match, case_sensitive, rule, label, action, scope, replacement } = only;
   useEffect(() => {
     if (!ready || sample.length === 0) {
       setTrial({ state: "idle" });
@@ -36,7 +36,7 @@ export function useTrial(
     setTrial((t) => (t.state === "done" ? t : { state: "running" }));
     const h = setTimeout(() => {
       api
-        .test(guard, sample, { pattern, match, case_sensitive, rule, label, action })
+        .test(guard, sample, { pattern, match, case_sensitive, rule, label, action, scope, replacement })
         .then((r) => alive && setTrial({ state: "done", ...r }))
         .catch((e) => alive && setTrial({ state: "failed", error: errorText(e) }));
     }, 250);
@@ -44,6 +44,6 @@ export function useTrial(
       alive = false;
       clearTimeout(h);
     };
-  }, [guard, sample, pattern, match, case_sensitive, rule, label, action, ready]);
+  }, [guard, sample, pattern, match, case_sensitive, rule, label, action, scope, replacement, ready]);
   return trial;
 }
diff --git a/src/traffic/RequestTable.tsx b/src/traffic/RequestTable.tsx
index 3c973d0c..ca588c2a 100644
--- a/src/traffic/RequestTable.tsx
+++ b/src/traffic/RequestTable.tsx
@@ -393,6 +393,23 @@ function useSizers(items: Item[], t: Text, ts: (typeof sessionsText)["zh"], toda
   }, [items, cache, t, ts, today, via]);
 }
 
+/**
+ * 脱敏徽标说什么：每一项都换成了占位符是「已脱敏」（全部的次数）；有原样发出的（观察档，
+ * 或者动作是「仅记录」的规则）是「含凭据」，只算、只列原样发出的那几项
+ */
+function secretsMark(s: NonNullable<RequestRow["secrets"]>) {
+  const items = s.replaced ? s.items : s.items.filter((x) => !x.replaced);
+  return { replaced: s.replaced, items, count: items.reduce((a, x) => a + x.count, 0) };
+}
+
+/** 内容过滤改过的文字按「删除」「替换」分开，各一个徽标 */
+function contentEdits(hits: RequestRow["stripped"]) {
+  return {
+    stripped: (hits ?? []).filter((x) => !x.replaced),
+    replaced: (hits ?? []).filter((x) => x.replaced),
+  };
+}
+
 /**
  * 请求行各列大约多宽：和 `requestCell` 写的是同样的字；图标、徽标的边距按一两个字宽算。
  * 名字按画出来的宽度封顶（`capped`，上限见 `NAME_PX`）
@@ -409,9 +426,10 @@ function requestWidths(r: RequestRow, t: Text, today: number, via: ViaConfig | n
   const badges = [
     ...(mark ? [textWidth(t.pinned) + 1] : []),
     ...(r.secrets && r.secrets.items.length > 0
-      ? [textWidth((r.secrets.replaced ? t.redacted : t.withSecrets)(r.secrets.items.reduce((a, x) => a + x.count, 0))) + 2]
+      ? [textWidth((r.secrets.replaced ? t.redacted : t.withSecrets)(secretsMark(r.secrets).count)) + 2]
       : []),
-    ...(r.stripped && r.stripped.length > 0 ? [textWidth(t.stripped) + 2] : []),
+    ...(contentEdits(r.stripped).stripped.length > 0 ? [textWidth(t.stripped) + 2] : []),
+    ...(contentEdits(r.stripped).replaced.length > 0 ? [textWidth(t.contentReplaced) + 2] : []),
     ...(r.translated
       ? [textWidth(r.translated.dropped.length > 0 ? t.convertedDropped(r.translated.dropped.length) : t.converted) + 2]
       : []),
@@ -1177,6 +1195,8 @@ function UpstreamCell({ r, via }: { r: RequestRow; via: ViaConfig | null }) {
   const t = useText(trafficText);
   const sent = notSent(r);
   const mark = rowMark(r, via);
+  const secrets = r.secrets && r.secrets.items.length > 0 ? secretsMark(r.secrets) : null;
+  const edits = contentEdits(r.stripped);
   return (
     <div className="flex flex-wrap items-center gap-x-1.5 gap-y-0.5">
       {/*
@@ -1230,24 +1250,32 @@ function UpstreamCell({ r, via }: { r: RequestRow; via: ViaConfig | null }) {
       )}
       {/* **看不见的安全功能会被用户关掉**，因为他们会怀疑是脱敏搞坏了功能。
           所以脱敏发生了就要在列表这一层看得见，而不是藏在详情里 */}
-      {r.secrets && r.secrets.items.length > 0 && (
+      {secrets && (
         <Mark
           // 换掉了是灰的；原样发出去的要看得出来
-          variant={r.secrets.replaced ? "secondary" : "warning"}
-          tip={(r.secrets.replaced ? t.redactedTip : t.secretsTip)(
-            r.secrets.items.map((x) => `${ruleName("redact", x.rule, x.custom)} ×${x.count}`),
+          variant={secrets.replaced ? "secondary" : "warning"}
+          tip={(secrets.replaced ? t.redactedTip : t.secretsTip)(
+            secrets.items.map((x) => `${ruleName("redact", x.rule, x.custom)} ×${x.count}`),
           )}
         >
-          {(r.secrets.replaced ? t.redacted : t.withSecrets)(r.secrets.items.reduce((a, x) => a + x.count, 0))}
+          {(secrets.replaced ? t.redacted : t.withSecrets)(secrets.count)}
         </Mark>
       )}
-      {/* 内容过滤删掉过命中的文字：和脱敏一样，改了请求就要在列表这一层看得见。灰的 ——
-          防护在起作用，请求照常发出 */}
-      {r.stripped && r.stripped.length > 0 && (
-        <Mark variant="secondary" tip={t.strippedTip(r.stripped.map((x) => ruleName("content", x.rule, x.custom)))}>
+      {/* 内容过滤删掉、替换过命中的文字：和脱敏一样，改了请求或回答就要在列表这一层看得见。
+          灰的 —— 防护在起作用，请求照常发出 */}
+      {edits.stripped.length > 0 && (
+        <Mark variant="secondary" tip={t.strippedTip(edits.stripped.map((x) => ruleName("content", x.rule, x.custom)))}>
           {t.stripped}
         </Mark>
       )}
+      {edits.replaced.length > 0 && (
+        <Mark
+          variant="secondary"
+          tip={t.contentReplacedTip(edits.replaced.map((x) => ruleName("content", x.rule, x.custom)))}
+        >
+          {t.contentReplaced}
+        </Mark>
+      )}
       {/* 格式转换。**转了就要看得见，丢了字段更要看得见** —— 「扩展思考开了却
           没生效」这个症状在客户端那头完全无从下手，只有这里知道原因 */}
       {r.translated && (
diff --git a/src/traffic/Traffic.i18n.tsx b/src/traffic/Traffic.i18n.tsx
index 137d165c..65bfa71a 100644
--- a/src/traffic/Traffic.i18n.tsx
+++ b/src/traffic/Traffic.i18n.tsx
@@ -150,9 +150,11 @@ export const trafficText = messages(
     redacted: (n: number) => `已脱敏 ${n}`,
     secretsTip: (items: string[]) => `请求中含有凭据，已原样发出：${items.join("、")}`,
     withSecrets: (n: number) => `含凭据 ${n}`,
-    /** 内容过滤删掉过命中的文字。悬停列出是哪几条规则 */
+    /** 内容过滤删掉、替换过命中的文字（请求或回答）。悬停列出是哪几条规则 */
     stripped: "已删除",
-    strippedTip: (rules: string[]) => `发送前已删除命中以下内容规则的文字：${rules.join("、")}`,
+    strippedTip: (rules: string[]) => `已删除命中以下内容规则的文字：${rules.join("、")}`,
+    contentReplaced: "已替换",
+    contentReplacedTip: (rules: string[]) => `已替换命中以下内容规则的文字：${rules.join("、")}`,
     sentConverted: (formats: string) => `请求已转换格式后发送：${formats}。`,
     droppedFields: (fields: string[]) => `\n\n目标格式不支持、已丢弃的字段：${fields.join("、")}`,
     noneDropped: "\n未丢弃任何字段。",
@@ -295,7 +297,9 @@ export const trafficText = messages(
     secretsTip: (items: string[]) => `Sent as is, with credentials in it: ${items.join(", ")}`,
     withSecrets: (n: number) => `Credentials ${n}`,
     stripped: "Deleted",
-    strippedTip: (rules: string[]) => `Text matching these content rules was deleted before sending: ${rules.join(", ")}`,
+    strippedTip: (rules: string[]) => `Text matching these content rules was deleted: ${rules.join(", ")}`,
+    contentReplaced: "Replaced",
+    contentReplacedTip: (rules: string[]) => `Text matching these content rules was replaced: ${rules.join(", ")}`,
     sentConverted: (formats: string) => `Sent after format conversion: ${formats}.`,
     droppedFields: (fields: string[]) =>
       `\n\nFields dropped because the target format does not support them: ${fields.join(", ")}`,
diff --git a/src/traffic/drawer/RequestDrawer.i18n.tsx b/src/traffic/drawer/RequestDrawer.i18n.tsx
index a0f07dc0..0eb2b00c 100644
--- a/src/traffic/drawer/RequestDrawer.i18n.tsx
+++ b/src/traffic/drawer/RequestDrawer.i18n.tsx
@@ -189,7 +189,7 @@ export const requestDrawerText = messages(
     quote: (upstream: ReactNode, bytes: number, tokens: number) => (
       <>将向 {upstream} 发送 {bytes} 字节，约 {tokens} 个输入 token。</>
     ),
-    willRedact: "发送前将按出站脱敏的规则替换凭据。",
+    willRedact: "发送前将按密钥与隐私的规则替换凭据。",
     pricingDate: (date: string) => `价目表日期 ${date}。`,
     confirmSend: "确认发送",
     originalColumn: (upstream: string) => `${upstream}（原请求）`,
@@ -354,7 +354,7 @@ export const requestDrawerText = messages(
         {count(tokens, "input token", "input tokens")}.
       </>
     ),
-    willRedact: "Credentials are replaced by the outbound redaction rules before sending.",
+    willRedact: "Credentials are replaced by the secrets & privacy rules before sending.",
     pricingDate: (date: string) => `Price sheet data as of ${date}.`,
     confirmSend: "Confirm and send",
     originalColumn: (upstream: string) => `${upstream} (original)`,
diff --git a/src/types.ts b/src/types.ts
index 4314a87f..c321cfae 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -57,11 +57,16 @@ export interface FlaggedCall {
   blocked: boolean;
 }
 
-/** 内容过滤从这次请求里删掉了命中的文字：哪条规则、几处（码位规则是几个字符） */
+/**
+ * 内容过滤删掉或替换了这次请求（或它的回答）里命中的文字：哪条规则、几处（码位规则是
+ * 几个字符），以及是换成了替换文字还是删掉
+ */
 export interface StrippedHit {
   rule: string;
   custom: boolean;
   count: number;
+  /** 换成了替换文字（「替换」）；`false` 是删掉了（「删除」） */
+  replaced: boolean;
 }
 
 /** 一行请求，由四类事件缝出来。 */
@@ -148,7 +153,8 @@ export interface RequestRow {
    * 是在画的时候才定的，存成句子的话换了语言它不会跟着换 */
   error?: Msg;
   /**
-   * 出站脱敏在这次请求里找到的东西（已打码），以及换没换。
+   * 出站脱敏在这次请求里找到的东西（已打码），以及换没换。`replaced` 是**每一项都换成了
+   * 占位符**：拦截档下也有动作是「仅记录」的规则，它们的值原样发出（`items[].replaced`）。
    *
    * **不带类别。**翻历史时是从安全日志拼回来的，日志里没有类别；徽标也只用
    * 规则名和次数
@@ -161,8 +167,8 @@ export interface RequestRow {
   /** 插件改写过这次请求或回答（库里那一行的 `plugin_changed`）。只来自历史：实时事件里没有它 */
   pluginChanged?: boolean;
   /**
-   * 内容过滤删掉过命中的文字（第三档下「删除」规则命中）。**只记删过的** —— 拒绝的那一行
-   * 本来就标成失败，只记录的照常发出，没有要在列表上说的
+   * 内容过滤删掉或替换过命中的文字（第三档下「删除」「替换」规则命中，请求和回答都算）。
+   * **只记改过的** —— 拒绝的那一行本来就标成失败，只记录的照常发出，没有要在列表上说的
    */
   stripped?: StrippedHit[];
   /**
@@ -292,16 +298,21 @@ export function applyEvent(rows: Map<number, RequestRow>, ev: CoreEvent): void {
       // 而这张表装的是「刚才发生过什么」。App 单独接。
       break;
     case "content_matched": {
-      // 只有删过文字的进列表（「已删除」徽标）。拒绝的请求随后有一条失败事件，那一行
-      // 照常标成失败；只记录的在安全日志和请求详情里
+      // 只有删过、换过文字的进列表（「已删除」「已替换」徽标）。拒绝的请求随后有一条失败
+      // 事件，那一行照常标成失败；只记录的在安全日志和请求详情里
       const r = rows.get(ev.id);
-      if (r && ev.outcome === "stripped")
-        r.stripped = [...(r.stripped ?? []), { rule: ev.rule, custom: ev.custom, count: ev.count }];
+      if (r && (ev.outcome === "stripped" || ev.outcome === "replaced"))
+        r.stripped = [
+          ...(r.stripped ?? []),
+          { rule: ev.rule, custom: ev.custom, count: ev.count, replaced: ev.outcome === "replaced" },
+        ];
       break;
     }
     case "secrets_found": {
       const r = rows.get(ev.id);
-      if (r) r.secrets = { replaced: ev.replaced, items: ev.items };
+      // 事件上的 `replaced` 只说是不是拦截档；动作是「仅记录」的规则在拦截档下也原样发出，
+      // 要按每一项算
+      if (r) r.secrets = { replaced: ev.items.every((x) => x.replaced), items: ev.items };
       break;
     }
     case "tool_call_flagged": {
diff --git a/src/ui/checkbox.tsx b/src/ui/checkbox.tsx
index dea03e7c..83bab84b 100644
--- a/src/ui/checkbox.tsx
+++ b/src/ui/checkbox.tsx
@@ -1,8 +1,9 @@
+// 加过半选：`checked="indeterminate"` 画成一道横线，底色和勾选时一样（规则表的组标题用）。
 import * as React from "react"
 import { cn } from "@/lib/utils"
 import { Checkbox as CheckboxPrimitive } from "radix-ui"
 
-import { CheckIcon } from "lucide-react"
+import { CheckIcon, MinusIcon } from "lucide-react"
 
 function Checkbox({
   className,
@@ -12,7 +13,7 @@ function Checkbox({
     <CheckboxPrimitive.Root
       data-slot="checkbox"
       className={cn(
-        "peer relative flex size-4 shrink-0 items-center justify-center rounded-[4px] border border-input transition-colors outline-none group-has-disabled/field:opacity-50 group-has-[:focus-visible]/field-label:ring-0 group-has-[:focus-visible]/field-label:not-data-checked:border-input after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground group-has-[:focus-visible]/field-label:data-checked:border-primary dark:data-checked:bg-primary",
+        "peer relative flex size-4 shrink-0 items-center justify-center rounded-[4px] border border-input transition-colors outline-none group-has-disabled/field:opacity-50 group-has-[:focus-visible]/field-label:ring-0 group-has-[:focus-visible]/field-label:not-data-checked:border-input after:absolute after:-inset-x-3 after:-inset-y-2 focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 aria-invalid:aria-checked:border-primary dark:bg-input/30 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 data-checked:border-primary data-checked:bg-primary data-checked:text-primary-foreground data-[state=indeterminate]:border-primary data-[state=indeterminate]:bg-primary data-[state=indeterminate]:text-primary-foreground dark:data-[state=indeterminate]:bg-primary group-has-[:focus-visible]/field-label:data-checked:border-primary dark:data-checked:bg-primary",
         className
       )}
       {...props}
@@ -21,7 +22,7 @@ function Checkbox({
         data-slot="checkbox-indicator"
         className="grid place-content-center text-current transition-none [&>svg]:size-3.5"
       >
-        <CheckIcon />
+        {props.checked === "indeterminate" ? <MinusIcon /> : <CheckIcon />}
       </CheckboxPrimitive.Indicator>
     </CheckboxPrimitive.Root>
   )
diff --git a/src/useRequests.ts b/src/useRequests.ts
index c03f36ad..5d99add3 100644
--- a/src/useRequests.ts
+++ b/src/useRequests.ts
@@ -210,9 +210,9 @@ function touches(ev: CoreEvent): number | null {
     case "tool_call_flagged":
     case "translated":
       return ev.id;
-    // 内容过滤只有删过文字的那一条会改这一行（「已删除」徽标）
+    // 内容过滤只有删过、换过文字的那一条会改这一行（「已删除」「已替换」徽标）
     case "content_matched":
-      return ev.outcome === "stripped" ? ev.id : null;
+      return ev.outcome === "stripped" || ev.outcome === "replaced" ? ev.id : null;
     default:
       return null;
   }