diff --git a/Cargo.lock b/Cargo.lock
index 1999b0a6..01b85ea8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3670,7 +3670,7 @@ dependencies = [
 
 [[package]]
 name = "tw-api"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3681,7 +3681,7 @@ dependencies = [
 
 [[package]]
 name = "tw-bedrock"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -3702,7 +3702,7 @@ dependencies = [
 
 [[package]]
 name = "tw-breaker"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3710,7 +3710,7 @@ dependencies = [
 
 [[package]]
 name = "tw-config"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "blake3",
  "libc",
@@ -3736,7 +3736,7 @@ dependencies = [
 
 [[package]]
 name = "tw-control"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "axum",
  "base64 0.22.1",
@@ -3782,7 +3782,7 @@ dependencies = [
 
 [[package]]
 name = "tw-dialect"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "memchr",
  "serde",
@@ -3791,7 +3791,7 @@ dependencies = [
 
 [[package]]
 name = "tw-engine"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "chrono",
  "serde",
@@ -3805,7 +3805,7 @@ dependencies = [
 
 [[package]]
 name = "tw-gateway"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "arc-swap",
  "async-stream",
@@ -3856,7 +3856,7 @@ dependencies = [
 
 [[package]]
 name = "tw-guard"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "aho-corasick",
  "base64 0.22.1",
@@ -3877,7 +3877,7 @@ dependencies = [
 
 [[package]]
 name = "tw-handover"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "libc",
  "serde",
@@ -3890,7 +3890,7 @@ dependencies = [
 
 [[package]]
 name = "tw-link"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -3904,7 +3904,7 @@ dependencies = [
 
 [[package]]
 name = "tw-observe"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "tokio",
  "tracing",
@@ -3913,7 +3913,7 @@ dependencies = [
 
 [[package]]
 name = "tw-pack"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "age",
  "blake3",
@@ -3937,7 +3937,7 @@ dependencies = [
 
 [[package]]
 name = "tw-plugin"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "libc",
  "rand 0.10.2",
@@ -3953,7 +3953,7 @@ dependencies = [
 
 [[package]]
 name = "tw-pricing"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "arc-swap",
  "flate2",
@@ -3966,14 +3966,14 @@ dependencies = [
 
 [[package]]
 name = "tw-secret"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "tw-store"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "blake3",
  "bytes",
@@ -3993,7 +3993,7 @@ dependencies = [
 
 [[package]]
 name = "tw-sync"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "age",
  "axum",
@@ -4021,7 +4021,7 @@ dependencies = [
 
 [[package]]
 name = "tw-types"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -4030,7 +4030,7 @@ dependencies = [
 
 [[package]]
 name = "tw-watch"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "libc",
  "notify",
@@ -4041,7 +4041,7 @@ dependencies = [
 
 [[package]]
 name = "tw-yaml"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "saphyr-parser",
  "serde_yaml_ng",
@@ -4051,7 +4051,7 @@ dependencies = [
 
 [[package]]
 name = "twcore"
-version = "0.87.1"
+version = "0.88.0"
 dependencies = [
  "anyhow",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index 70ceddb0..a333129c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -61,7 +61,7 @@ categories = ["network-programming", "web-programming::http-server"]
 
 # 二进制走 CalVer，crate 走 SemVer —— 两者是两回事，卖给不同的人。
 # 这里是 crate 的版本。
-version = "0.87.1"
+version = "0.88.0"
 
 [workspace.dependencies]
 # ── 内部 crate ───────────────────────────────────────────
diff --git a/release-notes/0.88.0.md b/release-notes/0.88.0.md
new file mode 100644
index 00000000..b5fc9c28
--- /dev/null
+++ b/release-notes/0.88.0.md
@@ -0,0 +1,15 @@
+This release expands outbound privacy filtering to UUIDs, wallet secrets, trading credentials and blockchain account identifiers. The built-in catalog grows from 120 to 131 rules, with 102 enabled by default.
+
+**Upgrade notes**
+
+- The control-plane protocol stays at 58 and the request-store schema stays at 28. Existing configurations remain valid.
+- The 11 new rules default to placeholder replacement. In `observe` mode they only record findings; in `enforce` mode they replace matching text unless a rule has been disabled or set to record only.
+- UUIDs include ordinary order and trace IDs, and compact 32-character hexadecimal values also include MD5-shaped identifiers. The raw 64-character hex rule covers both wallet private keys and indistinguishable transaction hashes. Existing installations using `enforce` will therefore hide more identifiers after upgrading.
+
+**Wallet material.** Adds raw EVM/TRON private-key shapes, verified Solana Ed25519 keypairs in Base58 or pasted byte-array form, Sui Bech32 private keys, Stellar secret seeds and XRP family seeds. Expands BIP32 / SLIP-0132 extended private keys to all ten supported versions and validates their private payloads. Existing BIP39 recovery-phrase, WIF and PEM rules remain available.
+
+**Trading credentials.** Named fields and authentication headers protect opaque keys, secrets, passphrases, signing memos, OTPs and signatures used by major exchanges, Polymarket CLOB/Builder/Relayer and predict.fun. These rules use context rather than assuming a fixed key length or alphabet. Short and symbol-first passphrases, numeric credentials, escaped JSON fields, recovery arrays, YAML recovery blocks, keystores and known RPC URL credentials are covered.
+
+**Account privacy and reporting.** Blockchain addresses and extended public keys have a separate privacy rule. UUIDs, raw hashes and public accounts do not by themselves trigger credential-exfiltration blocking. Findings for wallet secrets and the new credential-field rules are fully masked. Saved-secret priority, per-rule actions, exceptions, reversible and streamed restoration, and scan-cache equivalence are preserved.
+
+Filtering keeps the existing protocol and JSON boundaries. Keypair arrays are protected when pasted as text; actual JSON numeric values and protocol metadata retain their existing treatment. Coverage and limits are listed in the [blockchain redaction reference](https://github.com/ThinkWatchProject/ThinkWatch-Core/blob/v0.88.0/docs/security/blockchain-redaction.zh-CN.md).