diff --git a/package.json b/package.json
index 003a5fd..4474746 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "thinkwatch-lite",
   "private": true,
   "description": "Desktop app for a local AI API gateway on macOS, Windows and Linux",
-  "version": "2026.10.19",
+  "version": "2026.10.20",
   "type": "module",
   "packageManager": "pnpm@11.13.0",
   "scripts": {
diff --git a/release-notes/2026.10.20.md b/release-notes/2026.10.20.md
new file mode 100644
index 0000000..4b90881
--- /dev/null
+++ b/release-notes/2026.10.20.md
@@ -0,0 +1,17 @@
+**Upgrade notes:**
+- The bundled core is now 0.74.0. The control-plane protocol stays at 48, so remote servers on core 0.73.0 keep working.
+- Nothing is cleared; the request history, stored payloads and settings carry over.
+
+**Secrets & privacy:**
+- Only the text written in a request is searched: system prompts, the messages of every role, reasoning, tool-call arguments, tool results and tool descriptions. Ids, model names, signatures and other values the protocol needs are sent as they are. With the mobile-number rule on, a run of digits inside a Codex reasoning item id used to be replaced, and Codex then failed on every later turn of that conversation with `invalid 'input[n].id'`.
+- Requests to paths the app does not recognize, and request fields outside the written text such as `metadata`, are no longer searched.
+
+**Notifications:**
+- A rule that matches again within 5 minutes of its notification no longer brings a second notification when those 5 minutes end; its count in the notification list goes up instead. The next match after the 5 minutes notifies right away.
+
+**Security page:**
+- Rule groups no longer have a checkbox that switches all of their rules at once.
+- The action menus in the rule list no longer cut off the bottom of their text.
+
+**Upstreams:**
+- In the connection step of the upstream dialog, the locked auth-header row names the header (for example `Authorization: Bearer` or `x-api-key`) as soon as a protocol is chosen, before the address is filled in.
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index ae6d126..26ee732 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -4832,7 +4832,7 @@ dependencies = [
 
 [[package]]
 name = "thinkwatch-lite"
-version = "2026.10.19"
+version = "2026.10.20"
 dependencies = [
  "anyhow",
  "block2",
@@ -5335,8 +5335,8 @@ dependencies = [
 
 [[package]]
 name = "tw-api"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "serde",
  "serde_json",
@@ -5347,8 +5347,8 @@ dependencies = [
 
 [[package]]
 name = "tw-dialect"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "memchr",
  "serde",
@@ -5357,8 +5357,8 @@ dependencies = [
 
 [[package]]
 name = "tw-guard"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "aho-corasick",
  "base64 0.22.1",
@@ -5376,8 +5376,8 @@ dependencies = [
 
 [[package]]
 name = "tw-link"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "serde",
  "serde_json",
@@ -5403,8 +5403,8 @@ dependencies = [
 
 [[package]]
 name = "tw-types"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "serde",
  "ts-rs",
@@ -5412,8 +5412,8 @@ dependencies = [
 
 [[package]]
 name = "tw-watch"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "libc",
  "notify",
@@ -5423,8 +5423,8 @@ dependencies = [
 
 [[package]]
 name = "tw-yaml"
-version = "0.73.0"
-source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.73.0#befc76ed2929e49906f76559040a027e49d657d8"
+version = "0.74.0"
+source = "git+https://github.com/ThinkWatchProject/ThinkWatch-Core.git?tag=v0.74.0#21e560cdfa0cb197d1688b329b18123547ce1d8f"
 dependencies = [
  "saphyr-parser",
  "thiserror 2.0.21",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 8892095..3aaf937 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "thinkwatch-lite"
-version = "2026.10.19"
+version = "2026.10.20"
 edition = "2024"
 # **这个数决定依赖能升到哪一版。**edition 2024 的解析器只挑声明的 Rust
 # 版本编得动的依赖：写 1.85 的时候，`cargo update` 一直停在旧的 time 和
@@ -26,12 +26,12 @@ license = "MIT"
 # twcore 二进制必须和这里编译进去的协议镜像来自同一个 core 版本 —— 打包脚本正是
 # 从 tw-api 锁到的 tag 去取二进制的（见 scripts/fetch-core.sh）。
 [workspace.dependencies]
-tw-api = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
-tw-types = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
-tw-yaml = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
-tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
-tw-watch = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
-tw-link = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.73.0" }
+tw-api = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
+tw-types = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
+tw-yaml = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
+tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
+tw-watch = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
+tw-link = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
 
 [lib]
 name = "thinkwatch_lite_lib"
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index b5b8168..24da550 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ThinkWatch Lite",
-  "version": "2026.10.19",
+  "version": "2026.10.20",
   "identifier": "app.thinkwatch.lite",
   "build": {
     "beforeDevCommand": "pnpm dev",