diff --git a/Cargo.lock b/Cargo.lock
index 6969b37d..507b6e42 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -501,9 +501,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -839,7 +839,7 @@ checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 [[package]]
 name = "elide"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "elide-codec",
@@ -875,7 +875,7 @@ dependencies = [
 [[package]]
 name = "elide-codec"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "bytes",
@@ -899,7 +899,7 @@ dependencies = [
 [[package]]
 name = "elide-context"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "elide-core",
@@ -910,7 +910,7 @@ dependencies = [
 [[package]]
 name = "elide-core"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "bytes",
@@ -928,7 +928,7 @@ dependencies = [
 [[package]]
 name = "elide-detection"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "elide-core",
@@ -941,7 +941,7 @@ dependencies = [
 [[package]]
 name = "elide-lingua"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "elide-core",
@@ -952,7 +952,7 @@ dependencies = [
 [[package]]
 name = "elide-llm"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "derive_builder",
@@ -972,7 +972,7 @@ dependencies = [
 [[package]]
 name = "elide-ner"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "derive_builder",
@@ -986,7 +986,7 @@ dependencies = [
 [[package]]
 name = "elide-ocr"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "elide-core",
@@ -996,7 +996,7 @@ dependencies = [
 [[package]]
 name = "elide-orchestration"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "bytes",
  "elide-codec",
@@ -1010,7 +1010,7 @@ dependencies = [
 [[package]]
 name = "elide-pattern"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "aho-corasick",
  "async-trait",
@@ -1030,7 +1030,7 @@ dependencies = [
 [[package]]
 name = "elide-redaction"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "bytes",
@@ -1045,7 +1045,7 @@ dependencies = [
 [[package]]
 name = "elide-stt"
 version = "0.1.0"
-source = "git+https://github.com/nvisycom/elide?branch=main#5bc8557ff10c0d9a28413a11a932981582f16314"
+source = "git+https://github.com/nvisycom/elide?branch=main#b0fbfbade1f51610ec31e8a200a6fc1abc3ac76e"
 dependencies = [
  "async-trait",
  "elide-core",
diff --git a/crates/nvisy-engine/src/analyzer/audio.rs b/crates/nvisy-engine/src/analyzer/audio.rs
index 67e2cc8b..584812c9 100644
--- a/crates/nvisy-engine/src/analyzer/audio.rs
+++ b/crates/nvisy-engine/src/analyzer/audio.rs
@@ -16,18 +16,22 @@
 //! [`AnalyzerParams`]: nvisy_schema::plan::AnalyzerParams
 
 use elide::detection::Analyzer;
+use elide_core::Error;
 use elide_core::modality::audio::Audio;
-use elide_core::{Error, ErrorKind};
-#[cfg(feature = "test-utils")]
-use elide_stt::{MockBackend as MockSttBackend, SttEnricher};
 use nvisy_core::ner::NerConfig;
-use nvisy_schema::plan::{AnalyzerParams, SttBackendParams, SttEnricherParams};
+use nvisy_schema::plan::AnalyzerParams;
 
-use super::common::{attach_dedup, attach_pattern};
-use super::ner::attach_ner_lineup;
+use super::PatternGuardrails;
+use super::enricher::attach_stt;
+use super::layer::attach_dedup;
+use super::recognizer::{attach_ner_lineup, attach_pattern};
 
 /// Compile `spec` into an audio-modality [`Analyzer`].
-pub(super) fn compile(spec: &AnalyzerParams, ner: &NerConfig) -> Result<Analyzer<Audio>, Error> {
+pub(super) fn compile(
+    spec: &AnalyzerParams,
+    ner: &NerConfig,
+    guardrails: &PatternGuardrails,
+) -> Result<Analyzer<Audio>, Error> {
     let mut analyzer = Analyzer::<Audio>::new();
 
     if let Some(stt) = &spec.enrichers.stt {
@@ -35,7 +39,7 @@ pub(super) fn compile(spec: &AnalyzerParams, ner: &NerConfig) -> Result<Analyzer
     }
 
     if let Some(pattern) = &spec.recognizers.pattern {
-        analyzer = attach_pattern(analyzer, pattern)?;
+        analyzer = attach_pattern(analyzer, pattern, guardrails)?;
     }
     if spec.recognizers.ner {
         analyzer = attach_ner_lineup(analyzer, ner)?;
@@ -43,33 +47,3 @@ pub(super) fn compile(spec: &AnalyzerParams, ner: &NerConfig) -> Result<Analyzer
 
     Ok(attach_dedup(analyzer, &spec.deduplication))
 }
-
-/// Attach an [`SttEnricher`] for the audio modality. The
-/// deployment's `Bento` backend returns a clean "not wired yet"
-/// error until `elide-bento` ships a `BentoStt` client;
-/// unknown variants surface as Validation.
-///
-/// [`SttEnricher`]: elide_stt::SttEnricher
-fn attach_stt(
-    analyzer: Analyzer<Audio>,
-    spec: &SttEnricherParams,
-) -> Result<Analyzer<Audio>, Error> {
-    #[cfg(not(feature = "test-utils"))]
-    let _ = analyzer;
-    match &spec.backend {
-        SttBackendParams::Bento { .. } => Err(Error::new(
-            ErrorKind::Validation,
-            "analyzer compile: BentoML STT backend needs an elide-bento `BentoStt` \
-             client; not wired into the compile surface yet",
-        )),
-        #[cfg(feature = "test-utils")]
-        SttBackendParams::Mock => Ok(analyzer.with_enricher(SttEnricher::new(MockSttBackend))),
-        // `SttBackendParams` is `#[non_exhaustive]`. Unknown
-        // variants surface as Validation.
-        _ => Err(Error::new(
-            ErrorKind::Validation,
-            "analyzer compile: STT enricher uses a backend kind this engine binary \
-             doesn't understand; upgrade the engine or downgrade the config",
-        )),
-    }
-}
diff --git a/crates/nvisy-engine/src/analyzer/common.rs b/crates/nvisy-engine/src/analyzer/common.rs
deleted file mode 100644
index f39bb161..00000000
--- a/crates/nvisy-engine/src/analyzer/common.rs
+++ /dev/null
@@ -1,112 +0,0 @@
-//! Modality-generic compile helpers shared by every per-modality
-//! analyzer compile function.
-//!
-//! `PatternRecognizer` is itself modality-generic (impls
-//! `Recognizer<M>` for any `M: TextRecognizable`), so this
-//! module hosts the pattern-attach helper here alongside the
-//! language enricher for text and the dedup pipeline that runs
-//! after every modality. NER and LLM attach live in
-//! [`super::ner`] and [`super::llm`].
-
-use elide::detection::Analyzer;
-use elide::detection::calibrate::CalibrateLayer;
-use elide::detection::filter::FilterLayer;
-use elide::detection::reconcile::scoring::{MaxConfidence, NoisyOrConfidence};
-use elide::detection::reconcile::tiebreaker::{HighestConfidence, LongestSpan};
-use elide::detection::reconcile::{Merging, ReconcileLayer, Structural};
-use elide::enrichment::lingua::LinguaEnricher;
-use elide::recognition::context::Enhanced;
-use elide::recognition::pattern::PatternRecognizer;
-use elide_core::Error;
-use elide_core::modality::text::Text;
-use elide_core::modality::{Modality, TextRecognizable};
-use elide_core::primitive::ConfidenceThreshold;
-use elide_core::recognition::Recognizer;
-use nvisy_schema::plan::{
-    DeduplicationParams, LanguageEnricherParams, MergingStrategyParams, PatternRecognizerParams,
-    TiebreakerParams,
-};
-
-/// Attach the lingua language-detection [`Enricher<Text>`] built
-/// from `spec`. An empty `candidates` list yields the
-/// unrestricted detector (every language lingua was compiled
-/// with); a non-empty list scopes detection to that pool.
-///
-/// [`Enricher<Text>`]: elide_core::recognition::Enricher
-pub(super) fn attach_language(
-    analyzer: Analyzer<Text>,
-    spec: &LanguageEnricherParams,
-) -> Analyzer<Text> {
-    let enricher = if spec.candidates.is_empty() {
-        LinguaEnricher::unrestricted()
-    } else {
-        LinguaEnricher::with_candidates(spec.candidates.iter().cloned())
-    };
-    analyzer.with_enricher(enricher)
-}
-
-/// Attach a [`PatternRecognizer`] built from `spec`. The same
-/// recognizer instance — bare or wrapped in elide's `Enhanced`
-/// layer — serves any `M: TextRecognizable`, so the helper is
-/// uniform across modalities.
-pub(super) fn attach_pattern<M>(
-    analyzer: Analyzer<M>,
-    spec: &PatternRecognizerParams,
-) -> Result<Analyzer<M>, Error>
-where
-    M: TextRecognizable,
-    PatternRecognizer: Recognizer<M> + 'static,
-    Enhanced<PatternRecognizer>: Recognizer<M> + 'static,
-{
-    let mut builder = PatternRecognizer::builder();
-    if spec.builtins {
-        builder = builder.with_builtin_patterns().with_builtin_dictionaries();
-    }
-    if spec.context_enhanced {
-        Ok(analyzer.with_recognizer(builder.build_context_enhanced()?))
-    } else {
-        Ok(analyzer.with_recognizer(builder.build()?))
-    }
-}
-
-/// Append the deduplication layers: calibrate → reconcile
-/// (merging same-label overlaps) → reconcile (tiebreaking
-/// cross-label overlaps) → filter. Calibrate is skipped when the
-/// calibration map is empty.
-pub(super) fn attach_dedup<M>(mut analyzer: Analyzer<M>, spec: &DeduplicationParams) -> Analyzer<M>
-where
-    M: Modality,
-{
-    if !spec.calibration.is_empty() {
-        // Wire type is `HashMap<String, f64>`; elide's
-        // `CalibrationMap` is `FromIterator<(K, V)>` where K:
-        // Into<String> and V: Into<f64>.
-        analyzer = analyzer.with_layer(CalibrateLayer::new(
-            spec.calibration
-                .iter()
-                .map(|(k, &v)| (k.clone(), v))
-                .collect(),
-        ));
-    }
-
-    analyzer = match spec.merging {
-        MergingStrategyParams::Max => {
-            analyzer.with_layer(ReconcileLayer::same_label(Merging::new(MaxConfidence)))
-        }
-        MergingStrategyParams::NoisyOr => {
-            analyzer.with_layer(ReconcileLayer::same_label(Merging::new(NoisyOrConfidence)))
-        }
-    };
-
-    analyzer = match spec.tiebreaker {
-        TiebreakerParams::HighestConfidence => analyzer.with_layer(ReconcileLayer::cross_label(
-            Structural::standard().with_tiebreaker(HighestConfidence),
-        )),
-        TiebreakerParams::LongestSpan => analyzer.with_layer(ReconcileLayer::cross_label(
-            Structural::standard().with_tiebreaker(LongestSpan),
-        )),
-    };
-
-    let threshold = spec.min_confidence.unwrap_or(ConfidenceThreshold::BASELINE);
-    analyzer.with_layer(FilterLayer::new().with_threshold(threshold))
-}
diff --git a/crates/nvisy-engine/src/analyzer/enricher/language.rs b/crates/nvisy-engine/src/analyzer/enricher/language.rs
new file mode 100644
index 00000000..28383490
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/enricher/language.rs
@@ -0,0 +1,29 @@
+//! Attach the lingua language-detection [`Enricher<Text>`].
+//!
+//! Text-modality only — writes the detected language into the
+//! per-request recognizer context, so pattern/NER/LLM downstream
+//! see what it wrote.
+//!
+//! [`Enricher<Text>`]: elide_core::recognition::Enricher
+
+use elide::detection::Analyzer;
+use elide::enrichment::lingua::LinguaEnricher;
+use elide_core::modality::text::Text;
+use nvisy_schema::plan::LanguageEnricherParams;
+
+/// Attach the lingua language-detection enricher built from `spec`.
+///
+/// An empty `candidates` list yields the unrestricted detector
+/// (every language lingua was compiled with); a non-empty list
+/// scopes detection to that pool.
+pub(in crate::analyzer) fn attach(
+    analyzer: Analyzer<Text>,
+    spec: &LanguageEnricherParams,
+) -> Analyzer<Text> {
+    let enricher = if spec.candidates.is_empty() {
+        LinguaEnricher::unrestricted()
+    } else {
+        LinguaEnricher::with_candidates(spec.candidates.iter().cloned())
+    };
+    analyzer.with_enricher(enricher)
+}
diff --git a/crates/nvisy-engine/src/analyzer/enricher/mod.rs b/crates/nvisy-engine/src/analyzer/enricher/mod.rs
new file mode 100644
index 00000000..048d2ac2
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/enricher/mod.rs
@@ -0,0 +1,19 @@
+//! Per-enricher compile helpers: `language`, `ocr`, `stt`.
+//!
+//! Symmetric with [`super::recognizer`]. Enrichers run before
+//! recognition and stamp side-channel data (language hint,
+//! OCR'd text layout, audio transcript segments) onto the
+//! per-request context so downstream recognizers pick it up
+//! transparently.
+//!
+//! Every enricher is at-most-one per analyzer; the caller-facing
+//! spec is the corresponding slot on
+//! [`nvisy_schema::plan::EnricherParams`].
+
+mod language;
+mod ocr;
+mod stt;
+
+pub(super) use self::language::attach as attach_language;
+pub(super) use self::ocr::attach as attach_ocr;
+pub(super) use self::stt::attach as attach_stt;
diff --git a/crates/nvisy-engine/src/analyzer/enricher/ocr.rs b/crates/nvisy-engine/src/analyzer/enricher/ocr.rs
new file mode 100644
index 00000000..fafec2b8
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/enricher/ocr.rs
@@ -0,0 +1,40 @@
+//! Attach the OCR enricher to an image-modality [`Analyzer`].
+//!
+//! Image-modality only. The deployment's `Bento` backend wraps
+//! elide-bento's `BentoOcr` client; unknown non-exhaustive
+//! variants surface as Validation instead of silently skipping
+//! OCR.
+
+use elide::detection::Analyzer;
+use elide_bento::BentoOcr;
+use elide_core::Error;
+use elide_core::modality::image::Image;
+#[cfg(feature = "test-utils")]
+use elide_ocr::MockBackend as MockOcrBackend;
+use elide_ocr::OcrEnricher;
+use nvisy_schema::plan::{OcrBackendParams, OcrEnricherParams};
+
+/// Attach an [`OcrEnricher`] for the image modality.
+pub(in crate::analyzer) fn attach(
+    analyzer: Analyzer<Image>,
+    spec: &OcrEnricherParams,
+) -> Result<Analyzer<Image>, Error> {
+    let enricher = match &spec.backend {
+        OcrBackendParams::Bento { base_url, model } => {
+            OcrEnricher::new(BentoOcr::new(base_url.clone(), model.clone())?)
+        }
+        #[cfg(feature = "test-utils")]
+        OcrBackendParams::Mock => OcrEnricher::new(MockOcrBackend),
+        // `OcrBackendParams` is `#[non_exhaustive]`. Unknown
+        // variants surface as Validation instead of silently
+        // skipping OCR.
+        _ => {
+            return Err(elide_core::Error::new(
+                elide_core::ErrorKind::Validation,
+                "OCR enricher uses a backend kind this engine binary doesn't \
+                 understand; upgrade the engine or downgrade the config",
+            ));
+        }
+    };
+    Ok(analyzer.with_enricher(enricher))
+}
diff --git a/crates/nvisy-engine/src/analyzer/enricher/stt.rs b/crates/nvisy-engine/src/analyzer/enricher/stt.rs
new file mode 100644
index 00000000..014878d8
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/enricher/stt.rs
@@ -0,0 +1,40 @@
+//! Attach the STT enricher to an audio-modality [`Analyzer`].
+//!
+//! Audio-modality only. The deployment's `Bento` backend returns
+//! a clean "not wired yet" error until `elide-bento` ships a
+//! `BentoStt` client; unknown non-exhaustive variants surface as
+//! Validation.
+
+use elide::detection::Analyzer;
+use elide_core::modality::audio::Audio;
+use elide_core::{Error, ErrorKind};
+#[cfg(feature = "test-utils")]
+use elide_stt::{MockBackend as MockSttBackend, SttEnricher};
+use nvisy_schema::plan::{SttBackendParams, SttEnricherParams};
+
+/// Attach an [`SttEnricher`] for the audio modality.
+///
+/// [`SttEnricher`]: elide_stt::SttEnricher
+pub(in crate::analyzer) fn attach(
+    analyzer: Analyzer<Audio>,
+    spec: &SttEnricherParams,
+) -> Result<Analyzer<Audio>, Error> {
+    #[cfg(not(feature = "test-utils"))]
+    let _ = analyzer;
+    match &spec.backend {
+        SttBackendParams::Bento { .. } => Err(Error::new(
+            ErrorKind::Validation,
+            "analyzer compile: BentoML STT backend needs an elide-bento `BentoStt` \
+             client; not wired into the compile surface yet",
+        )),
+        #[cfg(feature = "test-utils")]
+        SttBackendParams::Mock => Ok(analyzer.with_enricher(SttEnricher::new(MockSttBackend))),
+        // `SttBackendParams` is `#[non_exhaustive]`. Unknown
+        // variants surface as Validation.
+        _ => Err(Error::new(
+            ErrorKind::Validation,
+            "analyzer compile: STT enricher uses a backend kind this engine binary \
+             doesn't understand; upgrade the engine or downgrade the config",
+        )),
+    }
+}
diff --git a/crates/nvisy-engine/src/analyzer/image.rs b/crates/nvisy-engine/src/analyzer/image.rs
index 2ae63c78..e5c1ead2 100644
--- a/crates/nvisy-engine/src/analyzer/image.rs
+++ b/crates/nvisy-engine/src/analyzer/image.rs
@@ -19,25 +19,23 @@
 //! [`LlmConfig`]: nvisy_core::llm::LlmConfig
 
 use elide::detection::Analyzer;
-use elide_bento::BentoOcr;
 use elide_core::Error;
 use elide_core::modality::image::Image;
-#[cfg(feature = "test-utils")]
-use elide_ocr::MockBackend as MockOcrBackend;
-use elide_ocr::OcrEnricher;
 use nvisy_core::llm::{LlmConfig, LlmRecognizerModality};
 use nvisy_core::ner::NerConfig;
-use nvisy_schema::plan::{AnalyzerParams, OcrBackendParams, OcrEnricherParams};
+use nvisy_schema::plan::AnalyzerParams;
 
-use super::common::{attach_dedup, attach_pattern};
-use super::llm::attach_llm_lineup;
-use super::ner::attach_ner_lineup;
+use super::PatternGuardrails;
+use super::enricher::attach_ocr;
+use super::layer::attach_dedup;
+use super::recognizer::{attach_llm_lineup, attach_ner_lineup, attach_pattern};
 
 /// Compile `spec` into an image-modality [`Analyzer`].
 pub(super) fn compile(
     spec: &AnalyzerParams,
     ner: &NerConfig,
     llm: &LlmConfig,
+    guardrails: &PatternGuardrails,
 ) -> Result<Analyzer<Image>, Error> {
     let mut analyzer = Analyzer::<Image>::new();
 
@@ -46,7 +44,7 @@ pub(super) fn compile(
     }
 
     if let Some(pattern) = &spec.recognizers.pattern {
-        analyzer = attach_pattern(analyzer, pattern)?;
+        analyzer = attach_pattern(analyzer, pattern, guardrails)?;
     }
     if spec.recognizers.ner {
         analyzer = attach_ner_lineup(analyzer, ner)?;
@@ -57,27 +55,3 @@ pub(super) fn compile(
 
     Ok(attach_dedup(analyzer, &spec.deduplication))
 }
-
-fn attach_ocr(
-    analyzer: Analyzer<Image>,
-    spec: &OcrEnricherParams,
-) -> Result<Analyzer<Image>, Error> {
-    let enricher = match &spec.backend {
-        OcrBackendParams::Bento { base_url, model } => {
-            OcrEnricher::new(BentoOcr::new(base_url.clone(), model.clone())?)
-        }
-        #[cfg(feature = "test-utils")]
-        OcrBackendParams::Mock => OcrEnricher::new(MockOcrBackend),
-        // `OcrBackendParams` is `#[non_exhaustive]`. Unknown
-        // variants surface as Validation instead of silently
-        // skipping OCR.
-        _ => {
-            return Err(elide_core::Error::new(
-                elide_core::ErrorKind::Validation,
-                "OCR enricher uses a backend kind this engine binary doesn't \
-                 understand; upgrade the engine or downgrade the config",
-            ));
-        }
-    };
-    Ok(analyzer.with_enricher(enricher))
-}
diff --git a/crates/nvisy-engine/src/analyzer/layer/dedup.rs b/crates/nvisy-engine/src/analyzer/layer/dedup.rs
new file mode 100644
index 00000000..ffb6721d
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/layer/dedup.rs
@@ -0,0 +1,75 @@
+//! Deduplication pipeline: calibrate → reconcile → filter.
+//!
+//! Runs after recognition, on every modality. Wire spec is
+//! [`nvisy_schema::plan::DeduplicationParams`]. Layers assemble
+//! in canonical order:
+//!
+//! 1. **Calibrate** — reweight recognizer scores against the
+//!    per-request calibration map (skipped when the map is
+//!    empty).
+//! 2. **Reconcile same-label** — merge overlapping findings that
+//!    share a label into one entity, using either max-confidence
+//!    or noisy-or.
+//! 3. **Reconcile cross-label** — pick a winner when overlapping
+//!    entities carry different labels, using either
+//!    highest-confidence or longest-span tiebreaker.
+//! 4. **Filter** — drop entities below the min-confidence
+//!    threshold (falls back to
+//!    [`ConfidenceThreshold::BASELINE`] when unset).
+//!
+//! [`ConfidenceThreshold::BASELINE`]: elide_core::primitive::ConfidenceThreshold::BASELINE
+
+use elide::detection::Analyzer;
+use elide::detection::calibrate::CalibrateLayer;
+use elide::detection::filter::FilterLayer;
+use elide::detection::reconcile::scoring::{MaxConfidence, NoisyOrConfidence};
+use elide::detection::reconcile::tiebreaker::{HighestConfidence, LongestSpan};
+use elide::detection::reconcile::{Merging, ReconcileLayer, Structural};
+use elide_core::modality::Modality;
+use elide_core::primitive::ConfidenceThreshold;
+use nvisy_schema::plan::{DeduplicationParams, MergingStrategyParams, TiebreakerParams};
+
+/// Append the deduplication layers to `analyzer`.
+///
+/// See the module doc for the layer order. Calibrate is skipped
+/// when the calibration map is empty.
+pub(in crate::analyzer) fn attach<M>(
+    mut analyzer: Analyzer<M>,
+    spec: &DeduplicationParams,
+) -> Analyzer<M>
+where
+    M: Modality,
+{
+    if !spec.calibration.is_empty() {
+        // Wire type is `HashMap<String, f64>`; elide's
+        // `CalibrationMap` is `FromIterator<(K, V)>` where K:
+        // Into<String> and V: Into<f64>.
+        analyzer = analyzer.with_layer(CalibrateLayer::new(
+            spec.calibration
+                .iter()
+                .map(|(k, &v)| (k.clone(), v))
+                .collect(),
+        ));
+    }
+
+    analyzer = match spec.merging {
+        MergingStrategyParams::Max => {
+            analyzer.with_layer(ReconcileLayer::same_label(Merging::new(MaxConfidence)))
+        }
+        MergingStrategyParams::NoisyOr => {
+            analyzer.with_layer(ReconcileLayer::same_label(Merging::new(NoisyOrConfidence)))
+        }
+    };
+
+    analyzer = match spec.tiebreaker {
+        TiebreakerParams::HighestConfidence => analyzer.with_layer(ReconcileLayer::cross_label(
+            Structural::standard().with_tiebreaker(HighestConfidence),
+        )),
+        TiebreakerParams::LongestSpan => analyzer.with_layer(ReconcileLayer::cross_label(
+            Structural::standard().with_tiebreaker(LongestSpan),
+        )),
+    };
+
+    let threshold = spec.min_confidence.unwrap_or(ConfidenceThreshold::BASELINE);
+    analyzer.with_layer(FilterLayer::new().with_threshold(threshold))
+}
diff --git a/crates/nvisy-engine/src/analyzer/layer/mod.rs b/crates/nvisy-engine/src/analyzer/layer/mod.rs
new file mode 100644
index 00000000..4f69d14e
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/layer/mod.rs
@@ -0,0 +1,10 @@
+//! Post-recognition analyzer layers.
+//!
+//! Runs after every recognizer + enricher has attached. Today
+//! this is just [`dedup`] (calibrate → reconcile → filter); the
+//! module is a placeholder for future post-processing layers
+//! (e.g. entity resolution, cross-modality dedup).
+
+mod dedup;
+
+pub(super) use self::dedup::attach as attach_dedup;
diff --git a/crates/nvisy-engine/src/analyzer/mod.rs b/crates/nvisy-engine/src/analyzer/mod.rs
index ab7a2306..e8c8cd3f 100644
--- a/crates/nvisy-engine/src/analyzer/mod.rs
+++ b/crates/nvisy-engine/src/analyzer/mod.rs
@@ -29,11 +29,11 @@
 #[cfg(feature = "internal_audio")]
 mod audio;
 mod catalog;
-mod common;
+mod enricher;
 #[cfg(feature = "internal_image")]
 mod image;
-mod llm;
-mod ner;
+mod layer;
+mod recognizer;
 #[cfg(feature = "internal_tabular")]
 mod tabular;
 mod text;
@@ -52,6 +52,7 @@ use nvisy_core::ner::NerConfig;
 use nvisy_schema::plan::AnalyzerParams;
 
 pub(crate) use self::catalog::LabelCatalogCompile;
+pub use self::recognizer::PatternGuardrails;
 
 /// Compile a [`nvisy_schema::plan::AnalyzerParams`] into a
 /// per-modality [`elide::detection::Analyzer`].
@@ -62,39 +63,77 @@ pub(crate) use self::catalog::LabelCatalogCompile;
 /// compile fn consults the deployment [`NerConfig`] when the
 /// request toggles `recognizers.ner = true`; text and image
 /// also consult [`LlmConfig`] when `recognizers.llm = true`.
+/// Every method consults [`PatternGuardrails`] when the pattern
+/// recognizer is enabled.
 ///
 /// Non-text methods are gated on their modality's feature.
 pub(crate) trait AnalyzerCompile {
     /// Build the text-modality analyzer.
-    fn compile_text(&self, ner: &NerConfig, llm: &LlmConfig) -> Result<Analyzer<Text>, Error>;
+    fn compile_text(
+        &self,
+        ner: &NerConfig,
+        llm: &LlmConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Text>, Error>;
     /// Build the tabular-modality analyzer.
     #[cfg(feature = "internal_tabular")]
-    fn compile_tabular(&self, ner: &NerConfig) -> Result<Analyzer<Tabular>, Error>;
+    fn compile_tabular(
+        &self,
+        ner: &NerConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Tabular>, Error>;
     /// Build the image-modality analyzer.
     #[cfg(feature = "internal_image")]
-    fn compile_image(&self, ner: &NerConfig, llm: &LlmConfig) -> Result<Analyzer<Image>, Error>;
+    fn compile_image(
+        &self,
+        ner: &NerConfig,
+        llm: &LlmConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Image>, Error>;
     /// Build the audio-modality analyzer.
     #[cfg(feature = "internal_audio")]
-    fn compile_audio(&self, ner: &NerConfig) -> Result<Analyzer<Audio>, Error>;
+    fn compile_audio(
+        &self,
+        ner: &NerConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Audio>, Error>;
 }
 
 impl AnalyzerCompile for AnalyzerParams {
-    fn compile_text(&self, ner: &NerConfig, llm: &LlmConfig) -> Result<Analyzer<Text>, Error> {
-        self::text::compile(self, ner, llm)
+    fn compile_text(
+        &self,
+        ner: &NerConfig,
+        llm: &LlmConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Text>, Error> {
+        self::text::compile(self, ner, llm, guardrails)
     }
 
     #[cfg(feature = "internal_tabular")]
-    fn compile_tabular(&self, ner: &NerConfig) -> Result<Analyzer<Tabular>, Error> {
-        self::tabular::compile(self, ner)
+    fn compile_tabular(
+        &self,
+        ner: &NerConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Tabular>, Error> {
+        self::tabular::compile(self, ner, guardrails)
     }
 
     #[cfg(feature = "internal_image")]
-    fn compile_image(&self, ner: &NerConfig, llm: &LlmConfig) -> Result<Analyzer<Image>, Error> {
-        self::image::compile(self, ner, llm)
+    fn compile_image(
+        &self,
+        ner: &NerConfig,
+        llm: &LlmConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Image>, Error> {
+        self::image::compile(self, ner, llm, guardrails)
     }
 
     #[cfg(feature = "internal_audio")]
-    fn compile_audio(&self, ner: &NerConfig) -> Result<Analyzer<Audio>, Error> {
-        self::audio::compile(self, ner)
+    fn compile_audio(
+        &self,
+        ner: &NerConfig,
+        guardrails: &PatternGuardrails,
+    ) -> Result<Analyzer<Audio>, Error> {
+        self::audio::compile(self, ner, guardrails)
     }
 }
diff --git a/crates/nvisy-engine/src/analyzer/recognizer/guardrails.rs b/crates/nvisy-engine/src/analyzer/recognizer/guardrails.rs
new file mode 100644
index 00000000..e8062e89
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/recognizer/guardrails.rs
@@ -0,0 +1,94 @@
+//! Pattern-recognizer guardrail configuration.
+//!
+//! Deployment-owned caps that bound the ReDoS attack surface
+//! and automaton compile cost when callers inline custom regex
+//! rules and dictionaries on
+//! `nvisy_schema::plan::PatternRecognizerParams`.
+//!
+//! Every knob has a conservative default; a deployment can
+//! tighten below the default but not raise past a hard ceiling
+//! also enforced at the wire layer (see
+//! `nvisy_schema::plan::MAX_REGEX_SOURCE_LEN` for the regex
+//! source-length ceiling).
+
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+/// Deployment-side caps applied to
+/// [`PatternRecognizerParams`]-driven recognizer builds.
+///
+/// Loaded from the deployment's `[pattern.guardrails]` config
+/// section; passed into the engine via
+/// [`Engine::with_pattern_guardrails`].
+///
+/// [`PatternRecognizerParams`]: nvisy_schema::plan::PatternRecognizerParams
+/// [`Engine::with_pattern_guardrails`]: crate::Engine::with_pattern_guardrails
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase", default)]
+pub struct PatternGuardrails {
+    /// Maximum accepted length, in bytes, of one custom regex
+    /// source.
+    ///
+    /// Enforced at engine compile time. May tighten below the
+    /// wire-layer ceiling of 512 bytes (checked at deserialize
+    /// in `nvisy-schema`) but not raise above it. Values above
+    /// the ceiling are clamped at engine construction.
+    pub max_regex_source_len: usize,
+    /// Maximum number of caller-inlined rules per request across
+    /// `custom` and `custom_dictionaries` combined.
+    ///
+    /// Bounds request-level compile cost: elide compiles each
+    /// regex and every dictionary term into the recognizer's
+    /// automata at analyze time. A permissive cap here would let
+    /// a caller pin a worker on compile alone.
+    pub max_custom_rules: usize,
+    /// Aggregate cap on total dictionary terms across every
+    /// dictionary — builtin and custom.
+    ///
+    /// All dictionaries compile into one shared Aho-Corasick
+    /// automaton; this is the total-terms cap, not
+    /// per-dictionary.
+    pub max_dictionary_term_count: usize,
+    /// Aggregate byte budget across every dictionary's terms.
+    ///
+    /// Finer proxy for the same automaton cost that
+    /// [`max_dictionary_term_count`] bounds; both apply, and
+    /// whichever hits first fails the build. Dictionaries are
+    /// literal-match, so this is a compile-cost bound, not a
+    /// match-time hazard.
+    ///
+    /// [`max_dictionary_term_count`]: PatternGuardrails::max_dictionary_term_count
+    pub max_dictionary_term_bytes: usize,
+}
+
+impl Default for PatternGuardrails {
+    fn default() -> Self {
+        Self {
+            max_regex_source_len: nvisy_schema::plan::MAX_REGEX_SOURCE_LEN,
+            max_custom_rules: 32,
+            max_dictionary_term_count: 100_000,
+            max_dictionary_term_bytes: 8 * 1024 * 1024,
+        }
+    }
+}
+
+impl PatternGuardrails {
+    /// Clamp `max_regex_source_len` to the wire-layer ceiling.
+    ///
+    /// The schema deserialize check enforces
+    /// [`MAX_REGEX_SOURCE_LEN`] at the wire boundary; a
+    /// deployment can only tighten below it, never raise above.
+    /// [`Engine::with_pattern_guardrails`] applies this before
+    /// storing the config so callers can't set a permissive
+    /// value that would never actually take effect.
+    ///
+    /// [`MAX_REGEX_SOURCE_LEN`]: nvisy_schema::plan::MAX_REGEX_SOURCE_LEN
+    /// [`Engine::with_pattern_guardrails`]: crate::Engine::with_pattern_guardrails
+    #[must_use]
+    pub fn clamped(mut self) -> Self {
+        self.max_regex_source_len = self
+            .max_regex_source_len
+            .min(nvisy_schema::plan::MAX_REGEX_SOURCE_LEN);
+        self
+    }
+}
diff --git a/crates/nvisy-engine/src/analyzer/llm.rs b/crates/nvisy-engine/src/analyzer/recognizer/llm.rs
similarity index 100%
rename from crates/nvisy-engine/src/analyzer/llm.rs
rename to crates/nvisy-engine/src/analyzer/recognizer/llm.rs
diff --git a/crates/nvisy-engine/src/analyzer/recognizer/mod.rs b/crates/nvisy-engine/src/analyzer/recognizer/mod.rs
new file mode 100644
index 00000000..f6b2d7c0
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/recognizer/mod.rs
@@ -0,0 +1,28 @@
+//! Per-recognizer compile helpers: `pattern`, `ner`, `llm`.
+//!
+//! Symmetric with [`super::enricher`]: each helper here takes a
+//! per-recognizer spec from
+//! [`nvisy_schema::plan::RecognizerParams`] plus whatever
+//! deployment-side config the recognizer needs
+//! (`NerConfig`/`LlmConfig` for those two lineups,
+//! [`PatternGuardrails`] for the pattern recognizer), and
+//! attaches the compiled recognizer to a
+//! [`elide::detection::Analyzer<M>`].
+//!
+//! Pattern is modality-generic
+//! (`M: TextRecognizable`); NER and LLM constrain over their
+//! upstream `Recognizer<M>` / `LlmModality<M>` impls
+//! respectively — modalities that lack the impl either fail the
+//! compile with a Validation error (NER: cheap trait bound) or
+//! are silently skipped upstream (LLM: no `LlmModality` impl for
+//! Tabular / Audio).
+
+mod guardrails;
+mod llm;
+mod ner;
+mod pattern;
+
+pub use self::guardrails::PatternGuardrails;
+pub(super) use self::llm::attach_llm_lineup;
+pub(super) use self::ner::attach_ner_lineup;
+pub(super) use self::pattern::attach as attach_pattern;
diff --git a/crates/nvisy-engine/src/analyzer/ner.rs b/crates/nvisy-engine/src/analyzer/recognizer/ner.rs
similarity index 98%
rename from crates/nvisy-engine/src/analyzer/ner.rs
rename to crates/nvisy-engine/src/analyzer/recognizer/ner.rs
index cfab1f81..b6df3da5 100644
--- a/crates/nvisy-engine/src/analyzer/ner.rs
+++ b/crates/nvisy-engine/src/analyzer/recognizer/ner.rs
@@ -22,7 +22,7 @@ use nvisy_core::ner::{NerBackendConfig, NerConfig, NerRecognizer as ConfigNerRec
 /// the request toggled `ner = true`, so "no recognizers
 /// configured" is user-visible). Modality-generic for any
 /// `M: TextRecognizable`.
-pub(super) fn attach_ner_lineup<M>(
+pub(in crate::analyzer) fn attach_ner_lineup<M>(
     mut analyzer: Analyzer<M>,
     ner: &NerConfig,
 ) -> Result<Analyzer<M>, Error>
diff --git a/crates/nvisy-engine/src/analyzer/recognizer/pattern.rs b/crates/nvisy-engine/src/analyzer/recognizer/pattern.rs
new file mode 100644
index 00000000..88aa9ff7
--- /dev/null
+++ b/crates/nvisy-engine/src/analyzer/recognizer/pattern.rs
@@ -0,0 +1,198 @@
+//! Attach [`elide::recognition::pattern::PatternRecognizer`] to
+//! a per-modality [`Analyzer`]. Modality-generic — a single
+//! recognizer instance (bare or `Enhanced`-wrapped) serves every
+//! `M: TextRecognizable`.
+//!
+//! Wire specs the compile path consumes:
+//!
+//! - [`PatternRecognizerParams`] — the top-level toggle: builtins,
+//!   context enhancement, and the two caller-inlined slots.
+//! - [`CustomPatternRule`] / [`CustomPatternVariant`] — inline
+//!   regex rules; converted one field at a time to
+//!   [`elide_pattern::Regex`] / [`Variant`].
+//! - [`CustomDictionary`] / [`CustomDictionaryTerm`] — inline
+//!   literal-term rules; converted to
+//!   [`elide_pattern::Dictionary`] / [`Term`].
+//!
+//! [`PatternGuardrails`] bounds runaway compile cost from any of
+//! those slots. See [`guardrails`](super::guardrails) for the
+//! per-request budget shape.
+
+use std::collections::HashMap;
+
+use elide::detection::Analyzer;
+use elide::recognition::context::Enhanced;
+use elide::recognition::pattern::{
+    Context as PatternContext, Dictionary, PatternRecognizer, PatternRecognizerBuilder, Regex,
+    Scoring, Term, Variant,
+};
+use elide_core::Error;
+use elide_core::modality::TextRecognizable;
+use elide_core::primitive::LanguageTag;
+use elide_core::recognition::Recognizer;
+use nvisy_schema::plan::{
+    CustomDictionary, CustomDictionaryTerm, CustomPatternContext, CustomPatternRule,
+    CustomPatternVariant, PatternRecognizerParams,
+};
+
+use super::PatternGuardrails;
+
+/// Attach a [`PatternRecognizer`] built from `spec`.
+///
+/// The same recognizer instance — bare or wrapped in elide's
+/// `Enhanced` layer — serves any `M: TextRecognizable`, so the
+/// helper is uniform across modalities.
+///
+/// `guardrails` bounds runaway compile cost: rule count,
+/// dictionary automaton size, and (below the wire ceiling)
+/// per-regex source length.
+pub(in crate::analyzer) fn attach<M>(
+    analyzer: Analyzer<M>,
+    spec: &PatternRecognizerParams,
+    guardrails: &PatternGuardrails,
+) -> Result<Analyzer<M>, Error>
+where
+    M: TextRecognizable,
+    PatternRecognizer: Recognizer<M> + 'static,
+    Enhanced<PatternRecognizer>: Recognizer<M> + 'static,
+{
+    check_custom_count(spec, guardrails)?;
+
+    let mut builder = with_limits(PatternRecognizer::builder(), guardrails);
+    if spec.builtins {
+        builder = builder.with_builtin_patterns().with_builtin_dictionaries();
+    }
+    for rule in &spec.custom {
+        builder = builder.with_pattern(compile_custom_rule(rule, guardrails)?);
+    }
+    for dict in &spec.custom_dictionaries {
+        builder = builder.with_dictionary(compile_custom_dictionary(dict)?);
+    }
+    if spec.context_enhanced {
+        Ok(analyzer.with_recognizer(builder.build_context_enhanced()?))
+    } else {
+        Ok(analyzer.with_recognizer(builder.build()?))
+    }
+}
+
+/// Apply the request-level dictionary-size limits to the pattern
+/// recognizer builder.
+///
+/// Every attach path — with or without builtins, with or without
+/// customs — inherits the same budgets.
+///
+/// The regex NFA/DFA `size_limit` / `dfa_size_limit` knobs are
+/// not applied here: elide's single-budget API cannot separate
+/// "individual regex NFA size" from "shared `RegexSet` union
+/// size", and the two want very different bounds — the shipped
+/// builtins union past any budget that would still catch a
+/// runaway custom rule. See #317 for the follow-up plan.
+fn with_limits(
+    builder: PatternRecognizerBuilder,
+    guardrails: &PatternGuardrails,
+) -> PatternRecognizerBuilder {
+    builder
+        .with_term_count_limit(guardrails.max_dictionary_term_count)
+        .with_term_bytes_limit(guardrails.max_dictionary_term_bytes)
+}
+
+fn check_custom_count(
+    spec: &PatternRecognizerParams,
+    guardrails: &PatternGuardrails,
+) -> Result<(), Error> {
+    let total = spec.custom.len() + spec.custom_dictionaries.len();
+    if total > guardrails.max_custom_rules {
+        return Err(Error::new(
+            elide_core::ErrorKind::Validation,
+            format!(
+                "pattern recognizer: {} custom rules requested \
+                 (custom={} + customDictionaries={}) exceeds the \
+                 per-request cap of {}",
+                total,
+                spec.custom.len(),
+                spec.custom_dictionaries.len(),
+                guardrails.max_custom_rules,
+            ),
+        ));
+    }
+    Ok(())
+}
+
+fn compile_custom_rule(
+    rule: &CustomPatternRule,
+    guardrails: &PatternGuardrails,
+) -> Result<Regex, Error> {
+    let variants = rule
+        .variants
+        .iter()
+        .map(|variant| compile_custom_variant(variant, guardrails))
+        .collect::<Result<Vec<_>, _>>()?;
+    Regex::builder()
+        .with_name(rule.name.clone())
+        .with_label(rule.label.clone())
+        .with_variants(variants)
+        .with_context(compile_context(&rule.context))
+        .with_languages(rule.languages.clone())
+        .with_countries(rule.countries.clone())
+        .build()
+}
+
+fn compile_custom_variant(
+    variant: &CustomPatternVariant,
+    guardrails: &PatternGuardrails,
+) -> Result<Variant, Error> {
+    if variant.regex.len() > guardrails.max_regex_source_len {
+        return Err(Error::new(
+            elide_core::ErrorKind::Validation,
+            format!(
+                "pattern recognizer: regex source of {} bytes exceeds \
+                 the deployment cap of {} bytes",
+                variant.regex.len(),
+                guardrails.max_regex_source_len,
+            ),
+        ));
+    }
+    let mut out = Variant::new(variant.regex.clone())?.with_score(variant.score);
+    if let Some(validator) = &variant.validator {
+        out = out.with_validator(validator.clone());
+    }
+    Ok(out)
+}
+
+fn compile_custom_dictionary(dict: &CustomDictionary) -> Result<Dictionary, Error> {
+    let terms = dict
+        .terms
+        .iter()
+        .map(compile_custom_term)
+        .collect::<Vec<_>>();
+    Dictionary::builder()
+        .with_name(dict.name.clone())
+        .with_label(dict.label.clone())
+        .with_terms(terms)
+        .with_scoring(Scoring::Uniform(dict.score))
+        .with_context(compile_context(&dict.context))
+        .with_languages(dict.languages.clone())
+        .with_countries(dict.countries.clone())
+        .build()
+}
+
+fn compile_custom_term(term: &CustomDictionaryTerm) -> Term {
+    let mut out = Term::new(term.term.clone());
+    if let Some(score) = term.score {
+        out = out.with_score(score);
+    }
+    out
+}
+
+fn compile_context(context: &CustomPatternContext) -> PatternContext {
+    match context {
+        CustomPatternContext::Global(kws) => PatternContext::Global(kws.clone()),
+        CustomPatternContext::PerLanguage(map) => {
+            let converted: HashMap<LanguageTag, Vec<String>> = map
+                .iter()
+                .map(|(lang, kws)| (lang.clone(), kws.clone()))
+                .collect();
+            PatternContext::PerLanguage(converted)
+        }
+    }
+}
diff --git a/crates/nvisy-engine/src/analyzer/tabular.rs b/crates/nvisy-engine/src/analyzer/tabular.rs
index a282d778..e74fc04e 100644
--- a/crates/nvisy-engine/src/analyzer/tabular.rs
+++ b/crates/nvisy-engine/src/analyzer/tabular.rs
@@ -20,15 +20,20 @@ use elide_core::modality::tabular::Tabular;
 use nvisy_core::ner::NerConfig;
 use nvisy_schema::plan::AnalyzerParams;
 
-use super::common::{attach_dedup, attach_pattern};
-use super::ner::attach_ner_lineup;
+use super::PatternGuardrails;
+use super::layer::attach_dedup;
+use super::recognizer::{attach_ner_lineup, attach_pattern};
 
 /// Compile `spec` into a tabular-modality [`Analyzer`].
-pub(super) fn compile(spec: &AnalyzerParams, ner: &NerConfig) -> Result<Analyzer<Tabular>, Error> {
+pub(super) fn compile(
+    spec: &AnalyzerParams,
+    ner: &NerConfig,
+    guardrails: &PatternGuardrails,
+) -> Result<Analyzer<Tabular>, Error> {
     let mut analyzer = Analyzer::<Tabular>::new();
 
     if let Some(pattern) = &spec.recognizers.pattern {
-        analyzer = attach_pattern(analyzer, pattern)?;
+        analyzer = attach_pattern(analyzer, pattern, guardrails)?;
     }
     if spec.recognizers.ner {
         analyzer = attach_ner_lineup(analyzer, ner)?;
diff --git a/crates/nvisy-engine/src/analyzer/text.rs b/crates/nvisy-engine/src/analyzer/text.rs
index 1552ed8b..06aade23 100644
--- a/crates/nvisy-engine/src/analyzer/text.rs
+++ b/crates/nvisy-engine/src/analyzer/text.rs
@@ -22,9 +22,10 @@ use nvisy_core::llm::{LlmConfig, LlmRecognizerModality};
 use nvisy_core::ner::NerConfig;
 use nvisy_schema::plan::AnalyzerParams;
 
-use super::common::{attach_dedup, attach_language, attach_pattern};
-use super::llm::attach_llm_lineup;
-use super::ner::attach_ner_lineup;
+use super::PatternGuardrails;
+use super::enricher::attach_language;
+use super::layer::attach_dedup;
+use super::recognizer::{attach_llm_lineup, attach_ner_lineup, attach_pattern};
 
 /// Compile `spec` into a text-modality [`Analyzer`]. Scope is
 /// built separately and lives on the orchestrator.
@@ -32,6 +33,7 @@ pub(super) fn compile(
     spec: &AnalyzerParams,
     ner: &NerConfig,
     llm: &LlmConfig,
+    guardrails: &PatternGuardrails,
 ) -> Result<Analyzer<Text>, Error> {
     let mut analyzer = Analyzer::<Text>::new();
 
@@ -40,7 +42,7 @@ pub(super) fn compile(
     }
 
     if let Some(pattern) = &spec.recognizers.pattern {
-        analyzer = attach_pattern(analyzer, pattern)?;
+        analyzer = attach_pattern(analyzer, pattern, guardrails)?;
     }
     if spec.recognizers.ner {
         analyzer = attach_ner_lineup(analyzer, ner)?;
diff --git a/crates/nvisy-engine/src/anonymizer/audio.rs b/crates/nvisy-engine/src/anonymizer/audio.rs
index 7cc6a518..2392d956 100644
--- a/crates/nvisy-engine/src/anonymizer/audio.rs
+++ b/crates/nvisy-engine/src/anonymizer/audio.rs
@@ -2,19 +2,20 @@
 //! [`Anonymizer<Audio>`].
 
 use elide::redaction::Anonymizer;
-use elide::redaction::operators::{Beep, Erase, Keep, Silence};
 use elide_core::Error;
 use elide_core::modality::audio::Audio;
 use nvisy_schema::policy::PolicyAction;
-use nvisy_schema::policy::redaction::{AudioRedaction, ModalityRedactions};
+use nvisy_schema::policy::redaction::ModalityRedactions;
 use uuid::Uuid;
 
-use super::dispatch::{Target, attach_one_override, attach_policies};
+use super::compile::{Target, attach_one_override, attach_policies};
+use super::operator::audio::AudioOp;
 
 /// Attach every audio-applicable rule from `policies` onto an
-/// already-constructed anonymizer. Takes an iterator so the
-/// apply pipeline can pre-filter by [`Policy::applies_when`]
-/// without cloning.
+/// already-constructed anonymizer.
+///
+/// Takes an iterator so the apply pipeline can pre-filter by
+/// [`Policy::applies_when`] without cloning.
 ///
 /// [`Policy::applies_when`]: nvisy_schema::policy::Policy::applies_when
 pub(crate) fn attach_policies_audio<'a>(
@@ -41,34 +42,5 @@ fn compile_one(
     let Some(spec) = &redactions.audio else {
         return Ok(target.passthrough());
     };
-    Ok(match build(spec) {
-        AudioOp::Erase => target.attach_with(Erase),
-        AudioOp::Keep => target.attach_with(Keep),
-        AudioOp::Silence => target.attach_with(Silence),
-        AudioOp::Beep(op) => target.attach_with(op),
-    })
-}
-
-enum AudioOp {
-    Erase,
-    Keep,
-    Silence,
-    Beep(Beep),
-}
-
-fn build(spec: &AudioRedaction) -> AudioOp {
-    match spec {
-        AudioRedaction::Erase => AudioOp::Erase,
-        AudioRedaction::Keep => AudioOp::Keep,
-        AudioRedaction::Silence => AudioOp::Silence,
-        AudioRedaction::Beep {
-            hz,
-            amplitude,
-            waveform,
-        } => AudioOp::Beep(
-            Beep::new(*hz)
-                .with_amplitude(*amplitude)
-                .with_waveform(*waveform),
-        ),
-    }
+    Ok(AudioOp::from(spec).attach_to(target))
 }
diff --git a/crates/nvisy-engine/src/anonymizer/dispatch.rs b/crates/nvisy-engine/src/anonymizer/compile/dispatch.rs
similarity index 94%
rename from crates/nvisy-engine/src/anonymizer/dispatch.rs
rename to crates/nvisy-engine/src/anonymizer/compile/dispatch.rs
index 746ac4f3..1afdfa42 100644
--- a/crates/nvisy-engine/src/anonymizer/dispatch.rs
+++ b/crates/nvisy-engine/src/anonymizer/compile/dispatch.rs
@@ -33,7 +33,7 @@ use super::selector::{attach, attach_override, fallback_attribution, rule_attrib
 /// Where an operator is being attached. The per-modality `Op`
 /// dispatcher takes one of these and feeds the carried
 /// `Anonymizer<M>` through the right elide entry point.
-pub(super) enum Target<'a, M: Modality> {
+pub(in crate::anonymizer) enum Target<'a, M: Modality> {
     /// Rule attachment: predicate-guarded redaction with a
     /// `policy_id` + `reason` attribution. Maps to
     /// [`super::selector::attach`].
@@ -62,7 +62,7 @@ impl<'a, M: Modality + 'static> Target<'a, M> {
     /// needs exactly one match on its own variants — no separate
     /// `attach_rule` / `attach_fallback` / `attach_override`
     /// dispatchers per modality.
-    pub(super) fn attach_with<O>(self, operator: O) -> Anonymizer<M>
+    pub(in crate::anonymizer) fn attach_with<O>(self, operator: O) -> Anonymizer<M>
     where
         O: elide_core::operator::Operator<M> + Clone + 'static,
     {
@@ -86,7 +86,7 @@ impl<'a, M: Modality + 'static> Target<'a, M> {
     /// Recover the anonymizer unchanged. Per-modality callbacks
     /// use this when this modality's redaction slot is absent —
     /// they take no action, return the input.
-    pub(super) fn passthrough(self) -> Anonymizer<M> {
+    pub(in crate::anonymizer) fn passthrough(self) -> Anonymizer<M> {
         match self {
             Target::Rule { anonymizer, .. } => anonymizer,
             Target::Fallback { anonymizer, .. } => anonymizer,
@@ -104,7 +104,7 @@ impl<'a, M: Modality + 'static> Target<'a, M> {
 /// redaction spec is absent or wrong-modality — those are no-ops
 /// at the per-modality dispatch boundary. Operator build errors
 /// propagate.
-pub(super) fn attach_policies<'a, M, F>(
+pub(in crate::anonymizer) fn attach_policies<'a, M, F>(
     mut anonymizer: Anonymizer<M>,
     policies: impl Iterator<Item = &'a Policy>,
     mut compile_one: F,
@@ -143,7 +143,7 @@ where
 /// Apply a reviewer override on one entity. `compile_one` is the
 /// same per-modality bridge as in [`attach_policies`]; called
 /// once with a [`Target::Override`].
-pub(super) fn attach_one_override<M, F>(
+pub(in crate::anonymizer) fn attach_one_override<M, F>(
     anonymizer: Anonymizer<M>,
     entity_id: Uuid,
     action: &PolicyAction,
diff --git a/crates/nvisy-engine/src/anonymizer/compile/mod.rs b/crates/nvisy-engine/src/anonymizer/compile/mod.rs
new file mode 100644
index 00000000..3d362e3e
--- /dev/null
+++ b/crates/nvisy-engine/src/anonymizer/compile/mod.rs
@@ -0,0 +1,25 @@
+//! Modality-generic dispatch machinery for
+//! [`nvisy_schema::policy::Policy`] compilation.
+//!
+//! Two files:
+//!
+//! - [`dispatch`] — the modality-generic outer loop that walks
+//!   `&[Policy]` in precedence order, per-rule dispatches through
+//!   a caller-supplied bridge callback. Defines the [`Target`]
+//!   enum (rule / fallback / override) that per-modality entries
+//!   attach their built operator onto.
+//! - [`selector`] — attribution builders (per-rule, per-fallback,
+//!   per-override) plus the predicate compiler that maps a wire
+//!   [`Predicate`] to an elide selector.
+//!
+//! Nothing modality-specific lives here. The per-modality entry
+//! files ([`super::text`] etc.) pass their [`operator::Op`]
+//! builders in as callbacks.
+//!
+//! [`Predicate`]: nvisy_schema::policy::predicate::Predicate
+//! [`operator::Op`]: super::operator
+
+mod dispatch;
+mod selector;
+
+pub(in crate::anonymizer) use self::dispatch::{Target, attach_one_override, attach_policies};
diff --git a/crates/nvisy-engine/src/anonymizer/selector.rs b/crates/nvisy-engine/src/anonymizer/compile/selector.rs
similarity index 100%
rename from crates/nvisy-engine/src/anonymizer/selector.rs
rename to crates/nvisy-engine/src/anonymizer/compile/selector.rs
diff --git a/crates/nvisy-engine/src/anonymizer/image.rs b/crates/nvisy-engine/src/anonymizer/image.rs
index 8285a2e9..e9afdaec 100644
--- a/crates/nvisy-engine/src/anonymizer/image.rs
+++ b/crates/nvisy-engine/src/anonymizer/image.rs
@@ -2,19 +2,20 @@
 //! [`Anonymizer<Image>`].
 
 use elide::redaction::Anonymizer;
-use elide::redaction::operators::{Blackbox, Blur, Erase, Keep, Pixelate};
 use elide_core::Error;
 use elide_core::modality::image::Image;
 use nvisy_schema::policy::PolicyAction;
-use nvisy_schema::policy::redaction::{ImageRedaction, ModalityRedactions};
+use nvisy_schema::policy::redaction::ModalityRedactions;
 use uuid::Uuid;
 
-use super::dispatch::{Target, attach_one_override, attach_policies};
+use super::compile::{Target, attach_one_override, attach_policies};
+use super::operator::image::ImageOp;
 
 /// Attach every image-applicable rule from `policies` onto an
-/// already-constructed anonymizer. Takes an iterator so the
-/// apply pipeline can pre-filter by [`Policy::applies_when`]
-/// without cloning.
+/// already-constructed anonymizer.
+///
+/// Takes an iterator so the apply pipeline can pre-filter by
+/// [`Policy::applies_when`] without cloning.
 ///
 /// [`Policy::applies_when`]: nvisy_schema::policy::Policy::applies_when
 pub(crate) fn attach_policies_image<'a>(
@@ -41,29 +42,5 @@ fn compile_one(
     let Some(spec) = &redactions.image else {
         return Ok(target.passthrough());
     };
-    Ok(match build(spec) {
-        ImageOp::Erase => target.attach_with(Erase),
-        ImageOp::Keep => target.attach_with(Keep),
-        ImageOp::Blur(op) => target.attach_with(op),
-        ImageOp::Pixelate(op) => target.attach_with(op),
-        ImageOp::Blackbox(op) => target.attach_with(op),
-    })
-}
-
-enum ImageOp {
-    Erase,
-    Keep,
-    Blur(Blur),
-    Pixelate(Pixelate),
-    Blackbox(Blackbox),
-}
-
-fn build(spec: &ImageRedaction) -> ImageOp {
-    match spec {
-        ImageRedaction::Erase => ImageOp::Erase,
-        ImageRedaction::Keep => ImageOp::Keep,
-        ImageRedaction::Blur { sigma } => ImageOp::Blur(Blur::new(*sigma)),
-        ImageRedaction::Pixelate { block_size } => ImageOp::Pixelate(Pixelate::new(*block_size)),
-        ImageRedaction::Blackbox { color } => ImageOp::Blackbox(Blackbox::new(*color)),
-    }
+    Ok(ImageOp::from(spec).attach_to(target))
 }
diff --git a/crates/nvisy-engine/src/anonymizer/mod.rs b/crates/nvisy-engine/src/anonymizer/mod.rs
index 369f2f87..56699db8 100644
--- a/crates/nvisy-engine/src/anonymizer/mod.rs
+++ b/crates/nvisy-engine/src/anonymizer/mod.rs
@@ -36,14 +36,13 @@
 
 #[cfg(feature = "internal_audio")]
 mod audio;
-mod dispatch;
+mod compile;
 #[cfg(feature = "internal_image")]
 mod image;
-mod selector;
+mod operator;
 #[cfg(feature = "internal_tabular")]
 mod tabular;
 mod text;
-mod text_op;
 
 #[cfg(feature = "internal_audio")]
 pub(crate) use self::audio::{attach_override_audio, attach_policies_audio};
diff --git a/crates/nvisy-engine/src/anonymizer/operator/audio.rs b/crates/nvisy-engine/src/anonymizer/operator/audio.rs
new file mode 100644
index 00000000..92847263
--- /dev/null
+++ b/crates/nvisy-engine/src/anonymizer/operator/audio.rs
@@ -0,0 +1,57 @@
+//! Audio-modality operator builder.
+//!
+//! Symmetric with [`super::text`] and [`super::image`]: builds
+//! an [`AudioOp`] from an `AudioRedaction` spec, dispatches it
+//! onto a [`Target`] with the right concrete elide operator
+//! type. Audio operators do not cross modalities.
+
+use elide::redaction::Anonymizer;
+use elide::redaction::operators::{Beep, Erase, Keep, Silence};
+use elide_core::modality::audio::Audio;
+use nvisy_schema::policy::redaction::AudioRedaction;
+
+use crate::anonymizer::compile::Target;
+
+/// Discriminated builder result so [`Target::attach_with`] can
+/// attach the right concrete operator type. Same reason as
+/// [`super::text::TextOp`] — [`Anonymizer::with_label`] takes
+/// `O: Operator<M> + 'static` by value.
+///
+/// [`Anonymizer::with_label`]: elide::redaction::Anonymizer::with_label
+pub(in crate::anonymizer) enum AudioOp {
+    Erase,
+    Keep,
+    Silence,
+    Beep(Beep),
+}
+
+impl AudioOp {
+    /// Attach `self` to `target`.
+    pub(in crate::anonymizer) fn attach_to(self, target: Target<'_, Audio>) -> Anonymizer<Audio> {
+        match self {
+            AudioOp::Erase => target.attach_with(Erase),
+            AudioOp::Keep => target.attach_with(Keep),
+            AudioOp::Silence => target.attach_with(Silence),
+            AudioOp::Beep(op) => target.attach_with(op),
+        }
+    }
+}
+
+impl From<&AudioRedaction> for AudioOp {
+    fn from(spec: &AudioRedaction) -> Self {
+        match spec {
+            AudioRedaction::Erase => Self::Erase,
+            AudioRedaction::Keep => Self::Keep,
+            AudioRedaction::Silence => Self::Silence,
+            AudioRedaction::Beep {
+                hz,
+                amplitude,
+                waveform,
+            } => Self::Beep(
+                Beep::new(*hz)
+                    .with_amplitude(*amplitude)
+                    .with_waveform(*waveform),
+            ),
+        }
+    }
+}
diff --git a/crates/nvisy-engine/src/anonymizer/operator/image.rs b/crates/nvisy-engine/src/anonymizer/operator/image.rs
new file mode 100644
index 00000000..8e5e764e
--- /dev/null
+++ b/crates/nvisy-engine/src/anonymizer/operator/image.rs
@@ -0,0 +1,53 @@
+//! Image-modality operator builder.
+//!
+//! Symmetric with [`super::text`]: builds an [`ImageOp`] from an
+//! `ImageRedaction` spec, dispatches it onto a [`Target`] with
+//! the right concrete elide operator type. Image operators do
+//! not cross modalities, so the vocabulary lives on its own.
+
+use elide::redaction::Anonymizer;
+use elide::redaction::operators::{Blackbox, Blur, Erase, Keep, Pixelate};
+use elide_core::modality::image::Image;
+use nvisy_schema::policy::redaction::ImageRedaction;
+
+use crate::anonymizer::compile::Target;
+
+/// Discriminated builder result so [`Target::attach_with`] can
+/// attach the right concrete operator type. Same reason as
+/// [`super::text::TextOp`] — [`Anonymizer::with_label`] takes
+/// `O: Operator<M> + 'static` by value, so a `Box<dyn Operator>`
+/// won't do.
+///
+/// [`Anonymizer::with_label`]: elide::redaction::Anonymizer::with_label
+pub(in crate::anonymizer) enum ImageOp {
+    Erase,
+    Keep,
+    Blur(Blur),
+    Pixelate(Pixelate),
+    Blackbox(Blackbox),
+}
+
+impl ImageOp {
+    /// Attach `self` to `target`.
+    pub(in crate::anonymizer) fn attach_to(self, target: Target<'_, Image>) -> Anonymizer<Image> {
+        match self {
+            ImageOp::Erase => target.attach_with(Erase),
+            ImageOp::Keep => target.attach_with(Keep),
+            ImageOp::Blur(op) => target.attach_with(op),
+            ImageOp::Pixelate(op) => target.attach_with(op),
+            ImageOp::Blackbox(op) => target.attach_with(op),
+        }
+    }
+}
+
+impl From<&ImageRedaction> for ImageOp {
+    fn from(spec: &ImageRedaction) -> Self {
+        match spec {
+            ImageRedaction::Erase => Self::Erase,
+            ImageRedaction::Keep => Self::Keep,
+            ImageRedaction::Blur { sigma } => Self::Blur(Blur::new(*sigma)),
+            ImageRedaction::Pixelate { block_size } => Self::Pixelate(Pixelate::new(*block_size)),
+            ImageRedaction::Blackbox { color } => Self::Blackbox(Blackbox::new(*color)),
+        }
+    }
+}
diff --git a/crates/nvisy-engine/src/anonymizer/operator/mod.rs b/crates/nvisy-engine/src/anonymizer/operator/mod.rs
new file mode 100644
index 00000000..1687d037
--- /dev/null
+++ b/crates/nvisy-engine/src/anonymizer/operator/mod.rs
@@ -0,0 +1,19 @@
+//! Per-modality operator vocabularies.
+//!
+//! Each submodule owns the `Op` enum plus a wire → runtime
+//! conversion — `From<&{Image,Audio}Redaction>` (infallible) or
+//! `TryFrom<&TextRedaction>` (fallible; text has stateful
+//! operators that aren't wired yet). Per-modality entry files in
+//! [`super`] dispatch a converted `Op` onto a
+//! [`super::compile::Target`] via `Op::attach_to`.
+//!
+//! Text and tabular share the text vocabulary — cells in a
+//! tabular are `TextBacked` in elide, so every text operator
+//! also implements `Operator<Tabular>`. Image and audio each own
+//! their vocabulary; the operators don't cross modalities.
+
+#[cfg(feature = "internal_audio")]
+pub(super) mod audio;
+#[cfg(feature = "internal_image")]
+pub(super) mod image;
+pub(super) mod text;
diff --git a/crates/nvisy-engine/src/anonymizer/text_op.rs b/crates/nvisy-engine/src/anonymizer/operator/text.rs
similarity index 61%
rename from crates/nvisy-engine/src/anonymizer/text_op.rs
rename to crates/nvisy-engine/src/anonymizer/operator/text.rs
index de8f6297..16b1bf00 100644
--- a/crates/nvisy-engine/src/anonymizer/text_op.rs
+++ b/crates/nvisy-engine/src/anonymizer/operator/text.rs
@@ -1,5 +1,4 @@
-//! Shared text-operator builder consumed by both
-//! [`super::text`] and [`super::tabular`].
+//! Text-modality operator builder, shared with `tabular`.
 //!
 //! Cells in a tabular are `TextBacked` in elide, so the same
 //! concrete operators (`Erase`, `Keep`, `Mask`, `Replace`,
@@ -15,7 +14,7 @@ use elide_core::operator::Operator;
 use elide_core::{Error, ErrorKind};
 use nvisy_schema::policy::redaction::{HashAlgorithm, TextRedaction};
 
-use super::dispatch::Target;
+use crate::anonymizer::compile::Target;
 
 /// Runtime conversion from the wire's [`HashAlgorithm`] to
 /// elide's [`Sha2Algorithm`]. Lives here rather than as a
@@ -34,7 +33,7 @@ fn to_sha2(algorithm: HashAlgorithm) -> Sha2Algorithm {
 /// takes `O: Operator<M> + 'static` by value.
 ///
 /// [`Anonymizer::with_label`]: elide::redaction::Anonymizer::with_label
-pub(super) enum TextOp {
+pub(in crate::anonymizer) enum TextOp {
     Erase,
     Keep,
     Mask(Mask),
@@ -47,7 +46,7 @@ impl TextOp {
     /// anonymizer accepts the text operator set (elide ships
     /// `impl Operator<Text>` and `impl Operator<Tabular>` on all
     /// five concrete ops).
-    pub(super) fn attach_to<M>(self, target: Target<'_, M>) -> Anonymizer<M>
+    pub(in crate::anonymizer) fn attach_to<M>(self, target: Target<'_, M>) -> Anonymizer<M>
     where
         M: Modality + 'static,
         Erase: Operator<M>,
@@ -66,38 +65,42 @@ impl TextOp {
     }
 }
 
-/// Build a [`TextOp`] from the wire spec. `Pseudonymize` and
-/// `Encrypt` need engine-side infrastructure (vault, key
-/// provider) that isn't wired yet, so they error at compile
-/// time — the wire declares them, the runtime rejects them.
-pub(super) fn build_text_op(spec: &TextRedaction) -> Result<TextOp, Error> {
-    Ok(match spec {
-        TextRedaction::Erase => TextOp::Erase,
-        TextRedaction::Keep => TextOp::Keep,
-        TextRedaction::Mask {
-            mask_char,
-            keep_prefix,
-            keep_suffix,
-        } => TextOp::Mask(
-            Mask::new(*mask_char)
-                .with_keep_prefix(*keep_prefix)
-                .with_keep_suffix(*keep_suffix),
-        ),
-        TextRedaction::Replace { template } => TextOp::Replace(Replace::new(template.clone())),
-        TextRedaction::Hash { algorithm, salt } => {
-            let mut op = Sha2Hash::new(to_sha2(*algorithm));
-            if let Some(s) = salt {
-                op = op.with_salt(s.as_bytes().to_vec());
+impl TryFrom<&TextRedaction> for TextOp {
+    type Error = Error;
+
+    /// `Pseudonymize` and `Encrypt` need engine-side
+    /// infrastructure (vault, key provider) that isn't wired
+    /// yet, so they error here — the wire declares them, the
+    /// runtime rejects them.
+    fn try_from(spec: &TextRedaction) -> Result<Self, Self::Error> {
+        Ok(match spec {
+            TextRedaction::Erase => Self::Erase,
+            TextRedaction::Keep => Self::Keep,
+            TextRedaction::Mask {
+                mask_char,
+                keep_prefix,
+                keep_suffix,
+            } => Self::Mask(
+                Mask::new(*mask_char)
+                    .with_keep_prefix(*keep_prefix)
+                    .with_keep_suffix(*keep_suffix),
+            ),
+            TextRedaction::Replace { template } => Self::Replace(Replace::new(template.clone())),
+            TextRedaction::Hash { algorithm, salt } => {
+                let mut op = Sha2Hash::new(to_sha2(*algorithm));
+                if let Some(s) = salt {
+                    op = op.with_salt(s.as_bytes().to_vec());
+                }
+                Self::Hash(op)
             }
-            TextOp::Hash(op)
-        }
-        TextRedaction::Pseudonymize => {
-            return Err(stateful_not_wired("pseudonymize", "vault + generator"));
-        }
-        TextRedaction::Encrypt => {
-            return Err(stateful_not_wired("encrypt", "key provider"));
-        }
-    })
+            TextRedaction::Pseudonymize => {
+                return Err(stateful_not_wired("pseudonymize", "vault + generator"));
+            }
+            TextRedaction::Encrypt => {
+                return Err(stateful_not_wired("encrypt", "key provider"));
+            }
+        })
+    }
 }
 
 fn stateful_not_wired(operator: &'static str, infrastructure: &'static str) -> Error {
diff --git a/crates/nvisy-engine/src/anonymizer/tabular.rs b/crates/nvisy-engine/src/anonymizer/tabular.rs
index e42c6046..4beafd60 100644
--- a/crates/nvisy-engine/src/anonymizer/tabular.rs
+++ b/crates/nvisy-engine/src/anonymizer/tabular.rs
@@ -2,9 +2,9 @@
 //! an [`Anonymizer<Tabular>`].
 //!
 //! Tabular cells are `TextBacked` in elide, so cell-level ops
-//! share the [`super::text_op`] builder with the text modality.
-//! The two structural operators — [`DropRow`] and [`DropColumn`]
-//! — sit alongside as tabular-only.
+//! share the [`super::operator::text`] builder with the text
+//! modality. The two structural operators — [`DropRow`] and
+//! [`DropColumn`] — sit alongside as tabular-only.
 //!
 //! [`DropRow`]: elide::redaction::operators::DropRow
 //! [`DropColumn`]: elide::redaction::operators::DropColumn
@@ -17,8 +17,8 @@ use nvisy_schema::policy::PolicyAction;
 use nvisy_schema::policy::redaction::{ModalityRedactions, TabularRedaction};
 use uuid::Uuid;
 
-use super::dispatch::{Target, attach_one_override, attach_policies};
-use super::text_op::build_text_op;
+use super::compile::{Target, attach_one_override, attach_policies};
+use super::operator::text::TextOp;
 
 /// Attach every tabular-applicable rule from `policies` onto an
 /// already-constructed anonymizer. Takes an iterator so the
@@ -51,7 +51,7 @@ fn compile_one(
         return Ok(target.passthrough());
     };
     Ok(match spec {
-        TabularRedaction::Cell { spec } => build_text_op(spec)?.attach_to(target),
+        TabularRedaction::Cell { spec } => TextOp::try_from(spec)?.attach_to(target),
         TabularRedaction::DropRow => target.attach_with(DropRow),
         TabularRedaction::DropColumn => target.attach_with(DropColumn),
     })
diff --git a/crates/nvisy-engine/src/anonymizer/text.rs b/crates/nvisy-engine/src/anonymizer/text.rs
index f9491687..34b0d3b2 100644
--- a/crates/nvisy-engine/src/anonymizer/text.rs
+++ b/crates/nvisy-engine/src/anonymizer/text.rs
@@ -8,8 +8,8 @@ use nvisy_schema::policy::PolicyAction;
 use nvisy_schema::policy::redaction::ModalityRedactions;
 use uuid::Uuid;
 
-use super::dispatch::{Target, attach_one_override, attach_policies};
-use super::text_op::build_text_op;
+use super::compile::{Target, attach_one_override, attach_policies};
+use super::operator::text::TextOp;
 
 /// Attach every text-applicable rule from `policies` onto an
 /// already-constructed anonymizer. The apply pipeline calls this
@@ -45,5 +45,5 @@ fn compile_one(
     let Some(spec) = &redactions.text else {
         return Ok(target.passthrough());
     };
-    Ok(build_text_op(spec)?.attach_to(target))
+    Ok(TextOp::try_from(spec)?.attach_to(target))
 }
diff --git a/crates/nvisy-engine/src/lib.rs b/crates/nvisy-engine/src/lib.rs
index 72041dc2..20997a23 100644
--- a/crates/nvisy-engine/src/lib.rs
+++ b/crates/nvisy-engine/src/lib.rs
@@ -23,6 +23,7 @@ mod analyzer;
 mod anonymizer;
 mod pipeline;
 
+pub use self::analyzer::PatternGuardrails;
 pub use self::pipeline::{
     AnalyzedDocument, AnonymizedDocument, Engine, EntityRecord, RecognizedGroup,
 };
diff --git a/crates/nvisy-engine/src/pipeline/mod.rs b/crates/nvisy-engine/src/pipeline/mod.rs
index 8bae0ee0..e5bc260d 100644
--- a/crates/nvisy-engine/src/pipeline/mod.rs
+++ b/crates/nvisy-engine/src/pipeline/mod.rs
@@ -108,12 +108,14 @@ const COMPONENT: &str = "pipeline";
 /// Cheaply-cloneable pipeline adapter over [`elide`].
 ///
 /// Bundles the codec registry, the deployment's NER / LLM
-/// lineups, and the per-request orchestrator constructor.
+/// lineups, the pattern-recognizer guardrails, and the
+/// per-request orchestrator constructor.
 #[derive(Clone, Default)]
 pub struct Engine {
     formats: Arc<FormatRegistry>,
     ner: Arc<nvisy_core::ner::NerConfig>,
     llm: Arc<nvisy_core::llm::LlmConfig>,
+    pattern_guardrails: crate::PatternGuardrails,
 }
 
 /// The redacted output of [`Engine::anonymize_document`].
@@ -138,6 +140,7 @@ impl Engine {
             formats: Arc::new(FormatRegistry::with_builtin()),
             ner: Arc::new(nvisy_core::ner::NerConfig::default()),
             llm: Arc::new(nvisy_core::llm::LlmConfig::default()),
+            pattern_guardrails: crate::PatternGuardrails::default(),
         }
     }
 
@@ -163,6 +166,22 @@ impl Engine {
         self
     }
 
+    /// Set the pattern-recognizer guardrails.
+    ///
+    /// Bounds the ReDoS attack surface and automaton compile
+    /// cost when callers inline custom regex rules and
+    /// dictionaries on
+    /// [`PatternRecognizerParams`]. `max_regex_source_len` is
+    /// clamped to the wire-layer ceiling on construction; every
+    /// other knob applies as-is at analyzer-compile time.
+    ///
+    /// [`PatternRecognizerParams`]: nvisy_schema::plan::PatternRecognizerParams
+    #[must_use]
+    pub fn with_pattern_guardrails(mut self, guardrails: crate::PatternGuardrails) -> Self {
+        self.pattern_guardrails = guardrails.clamped();
+        self
+    }
+
     /// The codec registry.
     ///
     /// Pipeline calls reach for it to decode raw bytes into an
diff --git a/crates/nvisy-engine/src/pipeline/orchestrator.rs b/crates/nvisy-engine/src/pipeline/orchestrator.rs
index c4f42288..bf0321f3 100644
--- a/crates/nvisy-engine/src/pipeline/orchestrator.rs
+++ b/crates/nvisy-engine/src/pipeline/orchestrator.rs
@@ -90,7 +90,7 @@ impl Engine {
 
         let text_anon = assemble_empty::<Text>(&catalog);
         let text_analyzer = spec
-            .compile_text(&self.ner, &self.llm)
+            .compile_text(&self.ner, &self.llm, &self.pattern_guardrails)
             .map_err(compile_err)?;
 
         #[allow(unused_mut)]
@@ -101,7 +101,9 @@ impl Engine {
         #[cfg(feature = "internal_tabular")]
         {
             let anon = assemble_empty::<Tabular>(&catalog);
-            let analyzer = spec.compile_tabular(&self.ner).map_err(compile_err)?;
+            let analyzer = spec
+                .compile_tabular(&self.ner, &self.pattern_guardrails)
+                .map_err(compile_err)?;
             orchestrator = orchestrator.with_modality::<Tabular>(analyzer, anon);
         }
 
@@ -109,7 +111,7 @@ impl Engine {
         {
             let anon = assemble_empty::<Image>(&catalog);
             let analyzer = spec
-                .compile_image(&self.ner, &self.llm)
+                .compile_image(&self.ner, &self.llm, &self.pattern_guardrails)
                 .map_err(compile_err)?;
             orchestrator = orchestrator.with_modality::<Image>(analyzer, anon);
         }
@@ -117,7 +119,9 @@ impl Engine {
         #[cfg(feature = "internal_audio")]
         {
             let anon = assemble_empty::<Audio>(&catalog);
-            let analyzer = spec.compile_audio(&self.ner).map_err(compile_err)?;
+            let analyzer = spec
+                .compile_audio(&self.ner, &self.pattern_guardrails)
+                .map_err(compile_err)?;
             orchestrator = orchestrator.with_modality::<Audio>(analyzer, anon);
         }
 
diff --git a/crates/nvisy-engine/tests/custom_patterns.rs b/crates/nvisy-engine/tests/custom_patterns.rs
new file mode 100644
index 00000000..d26a2f88
--- /dev/null
+++ b/crates/nvisy-engine/tests/custom_patterns.rs
@@ -0,0 +1,256 @@
+//! Wire → engine tests for caller-inlined custom patterns and
+//! dictionaries on [`PatternRecognizerParams`], plus the two
+//! request-level guardrails currently enforced end-to-end (source
+//! length, rule count). See #317 for the automaton-size follow-up.
+
+use bytes::Bytes;
+use elide_core::entity::LabelRef;
+use elide_core::primitive::Confidence;
+use nvisy_engine::{Engine, PatternGuardrails, RecognizedGroup};
+use nvisy_schema::file::Document;
+use nvisy_schema::plan::{
+    AnalyzerParams, CustomDictionary, CustomDictionaryTerm, CustomPatternContext,
+    CustomPatternRule, CustomPatternVariant, MAX_REGEX_SOURCE_LEN, PatternRecognizerParams,
+};
+
+const SAMPLE_DOCX: &[u8] = include_bytes!("testdata/sample.docx");
+
+fn raw_docx() -> Document {
+    Document::new(Bytes::from_static(SAMPLE_DOCX), "docx")
+}
+
+fn engine() -> Engine {
+    Engine::new()
+}
+
+fn spec_with_pattern_params(params: PatternRecognizerParams) -> AnalyzerParams {
+    AnalyzerParams {
+        recognizers: nvisy_schema::plan::RecognizerParams {
+            pattern: Some(params),
+            ner: false,
+            llm: false,
+        },
+        ..Default::default()
+    }
+}
+
+fn one_variant(regex: &str) -> CustomPatternVariant {
+    CustomPatternVariant {
+        regex: regex.to_owned(),
+        score: Confidence::MAX,
+        validator: None,
+    }
+}
+
+fn one_rule(name: &str, label: &str, regex: &str) -> CustomPatternRule {
+    CustomPatternRule {
+        name: name.to_owned(),
+        label: LabelRef::new(label),
+        variants: vec![one_variant(regex)],
+        context: CustomPatternContext::default(),
+        languages: Vec::new(),
+        countries: Vec::new(),
+    }
+}
+
+#[tokio::test]
+async fn custom_regex_produces_entity_with_caller_label() {
+    let engine = engine();
+    let spec = spec_with_pattern_params(PatternRecognizerParams {
+        builtins: false,
+        context_enhanced: false,
+        custom: vec![one_rule("alice_rule", "alice_id", r"\balice\b")],
+        custom_dictionaries: Vec::new(),
+    });
+
+    let analyzed = engine
+        .analyze_document(raw_docx(), &spec, &[])
+        .await
+        .expect("analyze succeeds");
+
+    let body = analyzed.body.as_ref().expect("body group present");
+    let RecognizedGroup::Text { entities } = body else {
+        panic!("expected Text body, got {body:?}");
+    };
+    let alice = LabelRef::new("alice_id");
+    assert!(
+        entities.iter().any(|e| e.entity.label == alice),
+        "expected at least one entity with label alice_id; got labels: {:?}",
+        entities.iter().map(|e| &e.entity.label).collect::<Vec<_>>(),
+    );
+}
+
+#[tokio::test]
+async fn custom_dictionary_produces_entity_with_caller_label() {
+    let engine = engine();
+    let spec = spec_with_pattern_params(PatternRecognizerParams {
+        builtins: false,
+        context_enhanced: false,
+        custom: Vec::new(),
+        custom_dictionaries: vec![CustomDictionary {
+            name: "greetings".to_owned(),
+            label: LabelRef::new("greeting"),
+            terms: vec![CustomDictionaryTerm {
+                term: "alice".to_owned(),
+                score: None,
+            }],
+            score: Confidence::MAX,
+            context: CustomPatternContext::default(),
+            languages: Vec::new(),
+            countries: Vec::new(),
+        }],
+    });
+
+    let analyzed = engine
+        .analyze_document(raw_docx(), &spec, &[])
+        .await
+        .expect("analyze succeeds");
+
+    let body = analyzed.body.as_ref().expect("body group present");
+    let RecognizedGroup::Text { entities } = body else {
+        panic!("expected Text body, got {body:?}");
+    };
+    let greeting = LabelRef::new("greeting");
+    assert!(
+        entities.iter().any(|e| e.entity.label == greeting),
+        "expected at least one entity with label greeting; got labels: {:?}",
+        entities.iter().map(|e| &e.entity.label).collect::<Vec<_>>(),
+    );
+}
+
+#[test]
+fn overlong_regex_source_rejects_at_deserialize() {
+    let src = "a".repeat(MAX_REGEX_SOURCE_LEN + 1);
+    let json = serde_json::json!({
+        "regex": src,
+        "score": 1.0,
+    });
+    let err = serde_json::from_value::<CustomPatternVariant>(json)
+        .expect_err("regex over the cap must reject at deserialize");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("regex source too long"),
+        "expected `regex source too long` error, got: {msg}",
+    );
+    assert!(
+        msg.contains(&MAX_REGEX_SOURCE_LEN.to_string()),
+        "expected the cap value in the error, got: {msg}",
+    );
+}
+
+#[tokio::test]
+async fn too_many_custom_rules_rejects_at_analyze() {
+    let engine = engine();
+    let rules: Vec<CustomPatternRule> = (0..33)
+        .map(|i| one_rule(&format!("rule_{i}"), "custom", r"\balice\b"))
+        .collect();
+    let spec = spec_with_pattern_params(PatternRecognizerParams {
+        builtins: false,
+        context_enhanced: false,
+        custom: rules,
+        custom_dictionaries: Vec::new(),
+    });
+
+    let err = engine
+        .analyze_document(raw_docx(), &spec, &[])
+        .await
+        .expect_err("33 rules must exceed the per-request cap");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("exceeds the per-request cap"),
+        "expected `exceeds the per-request cap` error, got: {msg}",
+    );
+}
+
+#[tokio::test]
+async fn tightened_rule_count_guardrail_takes_effect() {
+    // A deployment tightens the per-request rule cap to 4; five
+    // rules must now fail even though they'd pass the default of
+    // 32.
+    let engine = Engine::new().with_pattern_guardrails(PatternGuardrails {
+        max_custom_rules: 4,
+        ..PatternGuardrails::default()
+    });
+    let rules: Vec<CustomPatternRule> = (0..5)
+        .map(|i| one_rule(&format!("rule_{i}"), "custom", r"\balice\b"))
+        .collect();
+    let spec = spec_with_pattern_params(PatternRecognizerParams {
+        builtins: false,
+        context_enhanced: false,
+        custom: rules,
+        custom_dictionaries: Vec::new(),
+    });
+
+    let err = engine
+        .analyze_document(raw_docx(), &spec, &[])
+        .await
+        .expect_err("5 rules must exceed a tightened cap of 4");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("per-request cap of 4"),
+        "expected the tightened cap in the error, got: {msg}",
+    );
+}
+
+#[tokio::test]
+async fn tightened_regex_source_len_guardrail_takes_effect() {
+    // A deployment tightens the regex source cap to 16 bytes; a
+    // wire-legal 60-byte source (well below the 512 ceiling) must
+    // now fail at engine-side.
+    let engine = Engine::new().with_pattern_guardrails(PatternGuardrails {
+        max_regex_source_len: 16,
+        ..PatternGuardrails::default()
+    });
+    let regex = "a".repeat(60);
+    let spec = spec_with_pattern_params(PatternRecognizerParams {
+        builtins: false,
+        context_enhanced: false,
+        custom: vec![one_rule("long_source", "custom", &regex)],
+        custom_dictionaries: Vec::new(),
+    });
+
+    let err = engine
+        .analyze_document(raw_docx(), &spec, &[])
+        .await
+        .expect_err("60-byte source must exceed a tightened cap of 16 bytes");
+    let msg = err.to_string();
+    assert!(
+        msg.contains("deployment cap of 16 bytes"),
+        "expected the tightened cap in the error, got: {msg}",
+    );
+}
+
+#[tokio::test]
+async fn regex_source_len_config_above_ceiling_is_clamped() {
+    // A deployment tries to raise the source-length cap above the
+    // wire-layer ceiling. `Engine::with_pattern_guardrails` clamps
+    // it. A source between the ceiling and the requested (would-be)
+    // cap must still fail — either at the wire (if it goes through
+    // deserialize) or engine-side.
+    let engine = Engine::new().with_pattern_guardrails(PatternGuardrails {
+        max_regex_source_len: 4096,
+        ..PatternGuardrails::default()
+    });
+    // Just over the wire ceiling. Building via the struct
+    // literal skips the schema's `Deserialize` check, so a
+    // pathological caller who constructs `CustomPatternVariant`
+    // in code (not via the wire) still gets rejected at engine
+    // compile time — the ceiling is enforced there too.
+    let regex = "a".repeat(MAX_REGEX_SOURCE_LEN + 1);
+    let spec = spec_with_pattern_params(PatternRecognizerParams {
+        builtins: false,
+        context_enhanced: false,
+        custom: vec![one_rule("above_ceiling", "custom", &regex)],
+        custom_dictionaries: Vec::new(),
+    });
+
+    let err = engine
+        .analyze_document(raw_docx(), &spec, &[])
+        .await
+        .expect_err("engine must clamp max_regex_source_len to the wire ceiling");
+    let msg = err.to_string();
+    assert!(
+        msg.contains(&format!("deployment cap of {MAX_REGEX_SOURCE_LEN} bytes")),
+        "expected the clamped ceiling in the error, got: {msg}",
+    );
+}
diff --git a/crates/nvisy-engine/tests/multimodal.rs b/crates/nvisy-engine/tests/multimodal.rs
index 0e58bb5e..b31af5d4 100644
--- a/crates/nvisy-engine/tests/multimodal.rs
+++ b/crates/nvisy-engine/tests/multimodal.rs
@@ -37,6 +37,7 @@ fn default_spec() -> AnalyzerParams {
             pattern: Some(PatternRecognizerParams {
                 builtins: true,
                 context_enhanced: true,
+                ..Default::default()
             }),
             ner: false,
             llm: false,
diff --git a/crates/nvisy-schema/src/entity.rs b/crates/nvisy-schema/src/entity.rs
index f4f6de99..54632c65 100644
--- a/crates/nvisy-schema/src/entity.rs
+++ b/crates/nvisy-schema/src/entity.rs
@@ -1,9 +1,9 @@
 //! Entity-domain types re-exported from `elide_core::entity`.
 //!
-//! Wire types on [`policy`] and [`plan`] carry [`Label`]
-//! directly.
+//! Wire types on [`policy`] and [`plan`] carry [`Label`] and
+//! [`LabelRef`] directly.
 //!
 //! [`plan`]: crate::plan
 //! [`policy`]: crate::policy
 
-pub use elide_core::entity::Label;
+pub use elide_core::entity::{Label, LabelRef};
diff --git a/crates/nvisy-schema/src/plan/mod.rs b/crates/nvisy-schema/src/plan/mod.rs
index 8bf1a2f7..fe39a7d6 100644
--- a/crates/nvisy-schema/src/plan/mod.rs
+++ b/crates/nvisy-schema/src/plan/mod.rs
@@ -34,6 +34,7 @@ mod analyzer;
 mod deduplication;
 mod enricher;
 mod label;
+mod pattern;
 mod recognizer;
 
 pub use self::analyzer::{AnalyzerParams, ScopeParams};
@@ -43,4 +44,8 @@ pub use self::enricher::{
     SttEnricherParams,
 };
 pub use self::label::LabelCatalogParams;
+pub use self::pattern::{
+    CustomDictionary, CustomDictionaryTerm, CustomPatternContext, CustomPatternRule,
+    CustomPatternVariant, MAX_REGEX_SOURCE_LEN,
+};
 pub use self::recognizer::{PatternRecognizerParams, RecognizerParams};
diff --git a/crates/nvisy-schema/src/plan/pattern.rs b/crates/nvisy-schema/src/plan/pattern.rs
new file mode 100644
index 00000000..b25dbb0c
--- /dev/null
+++ b/crates/nvisy-schema/src/plan/pattern.rs
@@ -0,0 +1,230 @@
+//! Caller-inlined patterns + dictionaries for the pattern
+//! recognizer.
+//!
+//! Two kinds:
+//!
+//! - [`CustomPatternRule`] — regex-based rule. One or more
+//!   [`CustomPatternVariant`]s share a label plus optional
+//!   language / country / context scoping.
+//! - [`CustomDictionary`] — literal-term rule. Aho-Corasick over
+//!   a closed [`CustomDictionaryTerm`] list; faster and safer
+//!   than regex when the vocabulary is known ahead of time.
+//!
+//! Both mirror their `elide-pattern` counterparts one field at a
+//! time; the engine converts each wire value into the elide
+//! runtime type at analyzer-compile time.
+//!
+//! ## ReDoS guardrails
+//!
+//! Custom rules are executable code inside the analyzer, so the
+//! wire is bounded:
+//!
+//! - [`MAX_REGEX_SOURCE_LEN`] caps `CustomPatternVariant.regex`
+//!   at deserialize.
+//! - Analyzer compile caps the per-request rule count across
+//!   `custom` + `custom_dictionaries` combined.
+//! - Dictionaries share aggregate term-count and term-byte
+//!   limits enforced inside elide's `PatternRecognizerBuilder`.
+//!
+//! An automaton byte-size budget on regex compile is still an
+//! open follow-up — elide's single-budget API cannot separate
+//! the per-regex NFA size from the shared `RegexSet` union that
+//! the shipped builtins live in. See #317.
+
+use std::collections::HashMap;
+
+use elide_core::entity::LabelRef;
+use elide_core::primitive::{Confidence, CountryCode, LanguageTag};
+use schemars::JsonSchema;
+use serde::{Deserialize, Deserializer, Serialize};
+
+/// Maximum accepted length, in bytes, of one regex source string.
+///
+/// Rejects at deserialize. Long regex sources are the strongest
+/// wire-side signal for a catastrophic-backtracking payload; this
+/// cap keeps the ReDoS surface small without touching every regex.
+pub const MAX_REGEX_SOURCE_LEN: usize = 512;
+
+/// One caller-supplied regex rule for the pattern recognizer.
+///
+/// Mirrors `elide_pattern::Regex`. Serialize + Deserialize +
+/// JsonSchema end-to-end so SDK callers can inline rules on the
+/// wire; the engine converts each rule to an elide `Regex` at
+/// analyzer-compile time.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct CustomPatternRule {
+    /// Human-readable identifier surfaced in provenance.
+    pub name: String,
+    /// Entity label every variant emits.
+    pub label: LabelRef,
+    /// Regex sources + per-variant confidence + optional
+    /// validator.
+    ///
+    /// At least one required; the recognizer skips rules with an
+    /// empty variant list at compile time.
+    pub variants: Vec<CustomPatternVariant>,
+    /// Context keywords lifting confidence when they appear near
+    /// a match.
+    ///
+    /// Either a flat list (any language) or a per-language map.
+    /// Consumed only when the analyzer's
+    /// [`PatternRecognizerParams`]`.context_enhanced` is `true`.
+    ///
+    /// [`PatternRecognizerParams`]: super::PatternRecognizerParams
+    #[serde(default, skip_serializing_if = "CustomPatternContext::is_empty")]
+    pub context: CustomPatternContext,
+    /// BCP-47 language tags scoping the rule.
+    ///
+    /// Empty means "any language"; otherwise the recognizer skips
+    /// the rule when the per-call language hint is not in the
+    /// list.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub languages: Vec<LanguageTag>,
+    /// ISO 3166-1 alpha-2 country codes scoping the rule.
+    ///
+    /// Empty means "any country"; otherwise the recognizer skips
+    /// the rule when the per-call jurisdiction hint is not in the
+    /// list.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub countries: Vec<CountryCode>,
+}
+
+/// One regex variant inside a [`CustomPatternRule`].
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct CustomPatternVariant {
+    /// Regex source.
+    ///
+    /// Capped at [`MAX_REGEX_SOURCE_LEN`] bytes; longer sources
+    /// reject at deserialize. Compiled by the engine at
+    /// analyzer-compile time.
+    #[serde(deserialize_with = "deserialize_bounded_regex")]
+    pub regex: String,
+    /// Confidence stamped on every match, before any
+    /// post-recognition keyword boost.
+    ///
+    /// Defaults to [`Confidence::MAX`].
+    #[serde(default = "confidence_max")]
+    pub score: Confidence,
+    /// Optional validator name.
+    ///
+    /// Resolved against elide's `ValidatorRegistry` at compile
+    /// time (e.g. `"ssn"`, `"credit_card"`, `"iban"`). Unknown
+    /// names error at compile. `None` means "no validation".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub validator: Option<String>,
+}
+
+/// Context keywords for a custom rule.
+///
+/// Either a flat list applied regardless of language, or a
+/// per-language map. Matches the shape of `elide_pattern`'s
+/// `Context` — untagged so the wire looks like either
+/// `["kw1", "kw2"]` or `{ "en": ["kw1"], "es": ["kw2"] }`.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
+#[serde(untagged)]
+pub enum CustomPatternContext {
+    /// One flat keyword list applied regardless of language.
+    Global(Vec<String>),
+    /// Per-language keyword lists.
+    PerLanguage(HashMap<LanguageTag, Vec<String>>),
+}
+
+impl Default for CustomPatternContext {
+    fn default() -> Self {
+        Self::Global(Vec::new())
+    }
+}
+
+impl CustomPatternContext {
+    /// True when no keywords are declared in any scope.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        match self {
+            Self::Global(kws) => kws.is_empty(),
+            Self::PerLanguage(map) => map.values().all(Vec::is_empty),
+        }
+    }
+}
+
+/// One caller-supplied dictionary for the pattern recognizer.
+///
+/// Mirrors `elide_pattern::Dictionary`. Literal-term matching via
+/// Aho-Corasick; faster and safer than regex for closed sets.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct CustomDictionary {
+    /// Human-readable identifier surfaced in provenance.
+    pub name: String,
+    /// Entity label every match emits.
+    pub label: LabelRef,
+    /// Literal terms + per-term confidence overrides.
+    ///
+    /// At least one required; the recognizer skips dictionaries
+    /// with an empty term list at compile time.
+    pub terms: Vec<CustomDictionaryTerm>,
+    /// Default confidence stamped on matches when a term has no
+    /// per-term override.
+    ///
+    /// Defaults to [`Confidence::MAX`].
+    #[serde(default = "confidence_max")]
+    pub score: Confidence,
+    /// Context keywords lifting confidence near matches.
+    ///
+    /// Consumed only when the analyzer's
+    /// [`PatternRecognizerParams`]`.context_enhanced` is `true`.
+    ///
+    /// [`PatternRecognizerParams`]: super::PatternRecognizerParams
+    #[serde(default, skip_serializing_if = "CustomPatternContext::is_empty")]
+    pub context: CustomPatternContext,
+    /// BCP-47 language tags scoping the dictionary.
+    ///
+    /// Empty means "any language"; otherwise the recognizer skips
+    /// the dictionary when the per-call language hint is not in
+    /// the list.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub languages: Vec<LanguageTag>,
+    /// ISO 3166-1 alpha-2 country codes scoping the dictionary.
+    ///
+    /// Empty means "any country"; otherwise the recognizer skips
+    /// the dictionary when the per-call jurisdiction hint is not
+    /// in the list.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub countries: Vec<CountryCode>,
+}
+
+/// One term inside a [`CustomDictionary`].
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct CustomDictionaryTerm {
+    /// The literal scanned for.
+    pub term: String,
+    /// Per-term score override.
+    ///
+    /// `None` falls back to the parent dictionary's `score`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub score: Option<Confidence>,
+}
+
+fn confidence_max() -> Confidence {
+    Confidence::MAX
+}
+
+fn deserialize_bounded_regex<'de, D>(deserializer: D) -> Result<String, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    use serde::de::Error;
+    let regex = String::deserialize(deserializer)?;
+    if regex.len() > MAX_REGEX_SOURCE_LEN {
+        return Err(D::Error::custom(format!(
+            "regex source too long: {} bytes exceeds the {}-byte cap; \
+             wire-side ReDoS guardrail — split the pattern or lift the \
+             match into a validator",
+            regex.len(),
+            MAX_REGEX_SOURCE_LEN,
+        )));
+    }
+    Ok(regex)
+}
diff --git a/crates/nvisy-schema/src/plan/recognizer.rs b/crates/nvisy-schema/src/plan/recognizer.rs
index 792afdca..47fd4939 100644
--- a/crates/nvisy-schema/src/plan/recognizer.rs
+++ b/crates/nvisy-schema/src/plan/recognizer.rs
@@ -5,7 +5,10 @@
 //! - **Pattern** is at-most-one, per-request. Single
 //!   regex/dictionary engine per analyzer; multi-pattern means
 //!   accumulating into one instance's pattern list, not running
-//!   two engines.
+//!   two engines. Callers may inline custom regex rules
+//!   ([`CustomPatternRule`]) and dictionaries
+//!   ([`CustomDictionary`]) alongside the shipped `builtins`;
+//!   the engine compiles them per request.
 //! - **NER** is a **deployment-owned lineup** gated by a
 //!   boolean toggle. Provider, model, and (future) credentials
 //!   live in the deployment config; the wire only opts in or
@@ -23,6 +26,8 @@
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
+use super::pattern::{CustomDictionary, CustomPatternRule};
+
 /// Recognizer slots an analyzer can fill.
 ///
 /// Pattern is at-most-one (per-request); NER and LLM are
@@ -60,7 +65,7 @@ fn is_false(b: &bool) -> bool {
 }
 
 /// Params for the `elide-pattern` recognizer.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Default, PartialEq)]
 #[derive(Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct PatternRecognizerParams {
@@ -78,4 +83,21 @@ pub struct PatternRecognizerParams {
     /// the recognizer.
     #[serde(default)]
     pub context_enhanced: bool,
+    /// Caller-inlined regex rules.
+    ///
+    /// Compiled per-request. See [`CustomPatternRule`] for the
+    /// shape; the engine bounds request-level cost with a rule-
+    /// count cap and a per-regex NFA-size limit at compile time,
+    /// on top of the deserialize-time source-length cap in
+    /// [`MAX_REGEX_SOURCE_LEN`].
+    ///
+    /// [`MAX_REGEX_SOURCE_LEN`]: super::MAX_REGEX_SOURCE_LEN
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub custom: Vec<CustomPatternRule>,
+    /// Caller-inlined literal-term dictionaries.
+    ///
+    /// Compiled per-request into a shared Aho-Corasick automaton.
+    /// Same rule-count cap as `custom` applies at compile time.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub custom_dictionaries: Vec<CustomDictionary>,
 }
diff --git a/crates/nvisy-schema/src/primitive.rs b/crates/nvisy-schema/src/primitive.rs
index 5c5311dc..b441827b 100644
--- a/crates/nvisy-schema/src/primitive.rs
+++ b/crates/nvisy-schema/src/primitive.rs
@@ -10,6 +10,6 @@
 //! [`context`]: crate::context
 
 pub use elide_core::primitive::{
-    BoundingBox, Color, ConfidenceThreshold, CountryCode, LanguageTag, Languages, Point, Polygon,
-    TimeSpan,
+    BoundingBox, Color, Confidence, ConfidenceThreshold, CountryCode, LanguageTag, Languages,
+    Point, Polygon, TimeSpan,
 };