diff --git a/SW.Bitween.Api/Domain/OperatorAction.cs b/SW.Bitween.Api/Domain/OperatorAction.cs
index 7b2685e8..41c8e1ec 100644
--- a/SW.Bitween.Api/Domain/OperatorAction.cs
+++ b/SW.Bitween.Api/Domain/OperatorAction.cs
@@ -21,6 +21,7 @@ public class OperatorAction
 
     /// <summary>A failed exchange sent, masked, to the AI provider under Settings, AI for an explanation.</summary>
     public const string ExplainFailure = "explain-failure";
+    public const string SuggestRetryPolicy = "suggest-retry-policy";
 
     private OperatorAction()
     {
diff --git a/SW.Bitween.Api/Resources/RetrySuggestions/Suggest.cs b/SW.Bitween.Api/Resources/RetrySuggestions/Suggest.cs
new file mode 100644
index 00000000..3e038dd7
--- /dev/null
+++ b/SW.Bitween.Api/Resources/RetrySuggestions/Suggest.cs
@@ -0,0 +1,169 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.EntityFrameworkCore;
+using SW.Bitween.Domain;
+using SW.Bitween.Model;
+using SW.Bitween.Services.Ai;
+using SW.Bitween.Services.Metrics;
+using SW.PrimitiveTypes;
+
+namespace SW.Bitween.Resources.RetrySuggestions;
+
+public class RetrySuggestionRequest
+{
+    public int SubscriptionId { get; set; }
+
+    /// <summary>How far back to look, 1 to 90 days.</summary>
+    public int Days { get; set; } = 30;
+}
+
+/// <summary>One kind of failure, and what the current and the suggested policy each do with it.</summary>
+public class RetrySuggestionCoverage
+{
+    /// <summary>The error's first line, masked as it was sent.</summary>
+    public string Error { get; set; } = "";
+    public int Count { get; set; }
+    public int Retried { get; set; }
+    public int FixedByRetry { get; set; }
+    public string Now { get; set; } = "";
+    public string Suggested { get; set; } = "";
+}
+
+public class RetrySuggestionResponse
+{
+    public string Name { get; set; } = "";
+    public string Summary { get; set; } = "";
+
+    /// <summary>The groups, ready for <c>POST /api/retrypolicies</c>; nothing is saved until then.</summary>
+    public List<RetryGroup> Groups { get; set; } = new();
+
+    public List<RetrySuggestionCoverage> Coverage { get; set; } = new();
+    public int Failures { get; set; }
+    public int Days { get; set; }
+    public string? Model { get; set; }
+
+    /// <summary>The message that went to the provider, after the fixed <see cref="RetryPolicyPrompt.Instructions"/>.</summary>
+    public string Sent { get; set; } = "";
+}
+
+/// <summary>
+/// Proposes a retry policy for a subscription from its own recent failures.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The provider sees each kind of failure as a masked line with counts and how often a retry fixed
+/// it, and the current policy's rules. Never a document or a response body. The suggestion is then
+/// checked as a saved policy would be and run against the real failures here, so the coverage
+/// shows what changes for each before anyone saves it.
+/// </para>
+/// <para>
+/// It saves nothing: saving the suggestion is creating a policy, so asking needs that right too,
+/// and a question nobody could act on isn't sent. Each one is recorded as an operator action,
+/// since it sends something about the subscription to a third party.
+/// </para>
+/// </remarks>
+public class Suggest(RequestContext requestContext, BitweenDbContext dbContext, AiModels models)
+    : ICommandHandler<RetrySuggestionRequest, RetrySuggestionResponse>
+{
+    public async Task<RetrySuggestionResponse> Handle(RetrySuggestionRequest request)
+    {
+        await requestContext.EnsurePermission(dbContext, Model.Permissions.Subscriptions.View);
+        await requestContext.EnsurePermission(dbContext, Model.Permissions.RetryPolicies.Create);
+        var model = models.Current();
+
+        var subscription = await dbContext.Set<Subscription>().AsNoTracking()
+                               .Include(s => s.RetryPolicy)
+                               .FirstOrDefaultAsync(s => s.Id == request.SubscriptionId)
+                           ?? throw new SWNotFoundException(request.SubscriptionId.ToString());
+        var current = subscription.CustomRetryPolicy?.Groups ?? subscription.RetryPolicy?.Groups;
+        var days = Math.Clamp(request.Days, 1, 90);
+        var since = DateTime.UtcNow.AddDays(-days);
+
+        // The newest failures, by the (SubscriptionId, FinishedOn) index; only the start of each
+        // error, which is where its type and message are. Bad responses are counted apart, so many
+        // of them can't crowd the failures out.
+        var inWindow = dbContext.Set<XchangeResult>().AsNoTracking()
+            .Where(r => r.SubscriptionId == subscription.Id && r.FinishedOn >= since);
+        var errors = await inWindow
+            .Where(r => !r.Success)
+            .OrderByDescending(r => r.FinishedOn)
+            .Take(RetryPolicyPrompt.MaxFailures)
+            .Select(r => new
+            {
+                r.Id, r.FinishedOn,
+                Exception = r.Exception == null ? null : r.Exception.Substring(0, RetryPolicyPrompt.SampleLength),
+            })
+            .ToListAsync();
+        if (errors.Count == 0)
+            throw new SWValidationException("NO_FAILURES",
+                $"This subscription has no failed exchanges in the last {days} days, so there is nothing to learn a policy from.");
+
+        // Whether each one's retry succeeded: the attempt made from it, by the RetryFor index.
+        var ids = errors.Select(e => e.Id).ToList();
+        var retries = await dbContext.Set<Xchange>().AsNoTracking()
+            .Where(x => x.RetryFor != null && ids.Contains(x.RetryFor))
+            .Join(dbContext.Set<XchangeResult>(), x => x.Id, r => r.Id, (x, r) => new { x.RetryFor, Fixed = r.Success && !r.ResponseBad })
+            .ToListAsync();
+        var retriedFrom = retries.GroupBy(r => r.RetryFor!).ToDictionary(g => g.Key, g => g.Any(r => r.Fixed));
+
+        var groups = errors
+            .GroupBy(e => ErrorFingerprint.Of(e.Exception ?? ""))
+            .OrderByDescending(g => g.Count())
+            .Take(RetryPolicyPrompt.MaxKinds)
+            .ToList();
+
+        // Each kind's newest error in full, as the live retry sees it: a matcher may hit deep in the stack.
+        var newestIds = groups.Select(g => g.First().Id).ToList();
+        var full = await dbContext.Set<XchangeResult>().AsNoTracking()
+            .Where(r => newestIds.Contains(r.Id))
+            .Select(r => new { r.Id, r.Exception })
+            .ToDictionaryAsync(r => r.Id, r => r.Exception);
+
+        var kinds = groups
+            .Select(g =>
+            {
+                var newest = g.First();
+                return new FailureKind(full.GetValueOrDefault(newest.Id) ?? newest.Exception ?? "",
+                    RetryPolicyPrompt.Mask(ErrorFingerprint.Sample(newest.Exception ?? "")), g.Count(),
+                    g.Count(e => retriedFrom.ContainsKey(e.Id)), g.Count(e => retriedFrom.TryGetValue(e.Id, out var ok) && ok),
+                    g.Min(e => e.FinishedOn), g.Max(e => e.FinishedOn));
+            })
+            .ToList();
+        var badResponses = await inWindow.CountAsync(r => r.Success && r.ResponseBad);
+
+        var describe = $"Subscription kind: {subscription.Type}; mapper: {subscription.MapperId ?? "none"}; handler: {subscription.HandlerId ?? "none"}";
+        var message = RetryPolicyPrompt.Message(describe, days, errors.Count, badResponses, kinds, current);
+        // Recorded before it goes, so a call that fails or times out after sending is on record too.
+        await dbContext.RecordNowAsync(requestContext, OperatorAction.SuggestRetryPolicy, $"subscription {subscription.Id}",
+            $"Sent to {models.ModelName}: {errors.Count} failures, errors masked.");
+        var suggestion = RetryPolicyPrompt.Parse(
+            await model.Complete(new AiPrompt(RetryPolicyPrompt.Instructions, message, Json: true, MaxTokens: 4000)));
+
+        var coverage = new List<RetrySuggestionCoverage>();
+        foreach (var kind in kinds)
+            coverage.Add(new RetrySuggestionCoverage
+            {
+                Error = kind.Masked,
+                Count = kind.Count,
+                Retried = kind.Retried,
+                FixedByRetry = kind.FixedByRetry,
+                Now = await RetryPolicyPrompt.Outcome(current, kind.Sample),
+                Suggested = await RetryPolicyPrompt.Outcome(suggestion.Groups, kind.Sample),
+            });
+
+        return new RetrySuggestionResponse
+        {
+            Name = suggestion.Name,
+            Summary = suggestion.Summary,
+            Groups = suggestion.Groups,
+            Coverage = coverage,
+            Failures = errors.Count,
+            Days = days,
+            Model = models.ModelName,
+            Sent = message,
+        };
+    }
+}
diff --git a/SW.Bitween.Api/Services/Ai/FailurePrompt.cs b/SW.Bitween.Api/Services/Ai/FailurePrompt.cs
index c1423c92..297a24c7 100644
--- a/SW.Bitween.Api/Services/Ai/FailurePrompt.cs
+++ b/SW.Bitween.Api/Services/Ai/FailurePrompt.cs
@@ -21,7 +21,7 @@ public static class FailurePrompt
         exchanges can be retried by a retry policy, or by hand.
 
         Every value in the documents and the error has been masked before you see it: text is <text>,
-        numbers are <number>, booleans are <true|false>, and long lists show their first entries. Keys,
+        numbers are <number>, booleans are <true|false>, credentials and tokens are <secret>, and long lists show their first entries. Keys,
         structure and the error's wording are real. Never guess at a masked value; reason from structure,
         names, types and the error.
 
diff --git a/SW.Bitween.Api/Services/Ai/Masking.cs b/SW.Bitween.Api/Services/Ai/Masking.cs
index bab6f41e..e3eeb346 100644
--- a/SW.Bitween.Api/Services/Ai/Masking.cs
+++ b/SW.Bitween.Api/Services/Ai/Masking.cs
@@ -30,6 +30,7 @@ public sealed class Masking
 {
     public const string Text = "<text>";
     public const string Number = "<number>";
+    public const string Secret = "<secret>";
     public const string Boolean = "<true|false>";
 
     /// <summary>A long list shows this many entries, then how many more there were.</summary>
@@ -92,6 +93,10 @@ string Words(string text)
         text = Email.Replace(text, "<email>");
         text = Quoted.Replace(text, m => $"{m.Groups["q"].Value}{Text}{m.Groups["q"].Value}");
         text = QueryString.Replace(text, "?<query>");
+        // Credentials a partner's error can echo unquoted: "Bearer eyJ...", "api_key=...", or a bare token.
+        text = Scheme.Replace(text, m => $"{m.Groups["scheme"].Value} {Secret}");
+        text = Labelled.Replace(text, m => $"{m.Groups["label"].Value}{m.Groups["sep"].Value}{Secret}");
+        text = TokenLike.Replace(text, Secret);
         return LongNumber.Replace(text, Number);
     }
 
@@ -182,4 +187,11 @@ static string Cut(string text) =>
     static readonly Regex Quoted = new(@"(?<q>['""])(?!<)[^'""\r\n]{1,200}\k<q>", RegexOptions.Compiled);
     static readonly Regex QueryString = new(@"\?[^\s'""<>]+", RegexOptions.Compiled);
     static readonly Regex LongNumber = new(@"(?<![\w.:])\d{4,}(?![\w])", RegexOptions.Compiled);
+    static readonly Regex Scheme = new(@"\b(?<scheme>bearer|basic)\s+(?!<)[A-Za-z0-9._~+/=-]{8,}", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+    static readonly Regex Labelled = new(
+        @"(?<label>\b(?:password|passwd|pwd|secret|client[_-]?secret|token|access[_-]?token|refresh[_-]?token|api[_-]?key|access[_-]?key|authorization)\b)(?<sep>\s*[:=]\s*)(?!<)(?!(?:bearer|basic)\b)[^\s,;&'""]+",
+        RegexOptions.Compiled | RegexOptions.IgnoreCase);
+    // 20 or more characters mixing letters and digits: keys, tokens, hashes, ids. Exception and
+    // namespace names have no digits, and dots split them anyway.
+    static readonly Regex TokenLike = new(@"(?<![\w+/=-])(?=[A-Za-z0-9_+/=-]*\d)(?=[A-Za-z0-9_+/=-]*[A-Za-z])[A-Za-z0-9_+/=-]{20,}(?![\w+/=-])", RegexOptions.Compiled);
 }
diff --git a/SW.Bitween.Api/Services/Ai/RetryPolicyPrompt.cs b/SW.Bitween.Api/Services/Ai/RetryPolicyPrompt.cs
new file mode 100644
index 00000000..c54b2466
--- /dev/null
+++ b/SW.Bitween.Api/Services/Ai/RetryPolicyPrompt.cs
@@ -0,0 +1,227 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading.Tasks;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using Newtonsoft.Json.Serialization;
+using SW.Bitween.JsonConverters;
+using SW.Bitween.Model;
+using SW.PrimitiveTypes;
+
+namespace SW.Bitween.Services.Ai;
+
+/// <summary>One kind of failure a subscription had: the same first line, give or take its details.</summary>
+/// <param name="Sample">The real error in full - matched against here, never sent.</param>
+/// <param name="Masked">What the model sees of it.</param>
+/// <param name="Retried">How many of these were retried.</param>
+/// <param name="FixedByRetry">How many of those retries succeeded - the mark of a passing glitch.</param>
+public record FailureKind(string Sample, string Masked, int Count, int Retried, int FixedByRetry, DateTime FirstOn, DateTime LastOn);
+
+/// <summary>What the model proposes: a named policy, why, and its groups.</summary>
+public record RetrySuggestion(string Name, string Summary, List<RetryGroup> Groups);
+
+/// <summary>
+/// Proposes a retry policy from a subscription's real failures.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The model sees each kind of failure as one masked line - the wording kept, values, addresses and
+/// quoted text taken out - with how often it happened and how often a retry fixed it. Never a
+/// document or a response body. The current policy's rules go too: they are configuration.
+/// </para>
+/// <para>
+/// What comes back is checked as a saved policy is, then run against the real failures here, so
+/// the person reviewing it sees what each one would do under it before anything is saved.
+/// </para>
+/// </remarks>
+public static class RetryPolicyPrompt
+{
+    /// <summary>How many of the newest failures are looked at.</summary>
+    public const int MaxFailures = 2_000;
+
+    /// <summary>How many kinds of failure are sent, most frequent first.</summary>
+    public const int MaxKinds = 15;
+
+    /// <summary>How much of each error is read to tell its kind: enough for its exception types and message.</summary>
+    public const int SampleLength = 4_000;
+
+    public const string Instructions = """
+        You design retry policies for Bitween, an integration platform. When an exchange fails,
+        its subscription's retry policy decides whether to try it again, how often and how soon.
+
+        A policy is a list of groups, checked in priority order (lowest first); the first group with
+        a matching matcher decides. A failure no group matches is not retried.
+
+        A group, as JSON:
+        {
+          "name": "short name",
+          "priority": 0,
+          "appliesTo": ["Error"],
+          "matchers": [ ... at least one ... ],
+          "action": "Allow" | "Block",
+          "budget": {                         // required when action is Allow; null for Block
+            "maxAttemptsPerError": 3,         // retries of one failing exchange
+            "maxAttemptsTotal": 50,           // retries across all exchanges until the subscription next succeeds; null for no ceiling
+            "delayStrategy": { "type": "exponential", "initialDelayMs": 30000, "multiplier": 2, "maxDelayMs": 600000 }
+                          // or { "type": "fixed", "delayMs": 60000 }
+                          // or { "type": "linear", "initialDelayMs": 30000, "incrementMs": 30000 }
+          },
+          "notes": "one sentence: which failures this is for and why it retries or stops them"
+        }
+        Matchers (any one matching is enough):
+        - { "type": "contains", "value": "text", "caseSensitive": false }
+        - { "type": "regex", "pattern": "a .NET regex", "flags": "i" }
+        - { "type": "exceptionType", "value": "System.Net.Http.HttpRequestException", "includeInner": true }
+        Matchers are checked against the whole error text: exception types, message and stack.
+
+        You get the subscription's kinds of failure from recent weeks, most frequent first, each
+        with a count and how often a retry fixed it, plus its current policy. Each error is masked:
+        values became <text>, <number>, <email>, <query>, <secret>, <url>. Match only on wording that survived
+        masking - never on a <placeholder>, which is not in the real text.
+
+        Guidance:
+        - Retry what passes by itself: timeouts, refused or reset connections, 429, 502, 503, 504,
+          failures that a retry has often fixed.
+        - Don't retry what can't pass unchanged: mapping errors, validation errors, 400, 401, 403,
+          404, malformed configuration such as an invalid URL. Leave them unmatched, or add a Block
+          group when a broader Allow group would otherwise catch them.
+        - Back off: exponential delays, a few attempts per exchange, a total that stops a long
+          outage from hammering the partner.
+        - Keep it small: two to four groups.
+
+        Answer with one JSON object and nothing else:
+        { "name": "policy name", "summary": "two sentences on what it does and why", "groups": [ ... ] }
+        """;
+
+    /// <summary>The message for one subscription.</summary>
+    public static string Message(string subscription, int days, int failures, int badResponses,
+        IReadOnlyList<FailureKind> kinds, IReadOnlyList<RetryGroup>? current)
+    {
+        var message = new StringBuilder();
+        message.AppendLine(subscription);
+        message.AppendLine($"Looked at: the last {days} days, {failures} failures" +
+                           (failures >= MaxFailures ? $" (the newest {MaxFailures})" : "") + ".");
+        if (badResponses > 0) message.AppendLine($"Also {badResponses} bad responses; their bodies are not sent.");
+        message.AppendLine();
+        message.AppendLine("<current_policy>");
+        // The rules only: a group's alert settings name channels and, on old groups, carry handler properties.
+        message.AppendLine(current is { Count: > 0 }
+            ? JsonConvert.SerializeObject(current.Select(g => new { g.Name, g.Priority, g.Enabled, g.AppliesTo, g.Matchers, g.Action, g.Budget }), Settings)
+            : "(none: nothing is retried)");
+        message.AppendLine("</current_policy>");
+        message.AppendLine();
+        message.AppendLine("<failures>");
+        var n = 0;
+        foreach (var kind in kinds)
+        {
+            n++;
+            message.AppendLine($"{n}. {kind.Count} times, {kind.FirstOn:yyyy-MM-dd} to {kind.LastOn:yyyy-MM-dd}. " +
+                               (kind.Retried == 0 ? "Never retried." : $"Retried {kind.Retried} times; the retry succeeded {kind.FixedByRetry} times."));
+            message.AppendLine($"   {kind.Masked}");
+        }
+        if (kinds.Count == 0) message.AppendLine("(none)");
+        message.AppendLine("</failures>");
+        return message.ToString();
+    }
+
+    static readonly Regex Url = new(@"[a-z][a-z0-9+.-]*://[^\s'""<>]+", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    /// <summary>An error's first line as the model may see it: masked, with addresses taken out too.</summary>
+    public static string Mask(string firstLine) => Url.Replace(new Masking().Error(firstLine), "<url>");
+
+    /// <summary>
+    /// The model's answer as a policy that could be saved, or a validation error saying why not.
+    /// Alerts are never taken from it: where a policy's alerts go is a person's choice.
+    /// </summary>
+    public static RetrySuggestion Parse(string answer)
+    {
+        var start = answer.IndexOf('{');
+        var end = answer.LastIndexOf('}');
+        RawSuggestion? raw = null;
+        if (start >= 0 && end > start)
+        {
+            try
+            {
+                raw = JObject.Parse(answer[start..(end + 1)]).ToObject<RawSuggestion>(JsonSerializer.Create(Settings));
+            }
+            catch (Exception e) when (e is JsonException or ArgumentException or InvalidOperationException)
+            {
+            }
+        }
+        if (raw?.Groups is not { Count: > 0 } || raw.Groups.Any(g => g is null))
+            throw new SWValidationException("AI_SUGGESTION", "The AI's answer wasn't a retry policy. Try again.");
+
+        var groups = raw.Groups.Select((g, i) => new RetryGroup
+        {
+            Name = string.IsNullOrWhiteSpace(g.Name) ? $"Group {i + 1}" : g.Name.Trim(),
+            Priority = g.Priority ?? i,
+            AppliesTo = g.AppliesTo?.Where(t => t != XchangeResultType.Success).Distinct().ToList() ?? [],
+            Matchers = g.Matchers?.Where(m => m is not null).ToList() ?? [],
+            Action = g.Action ?? RetryAction.Allow,
+            Budget = g.Action == RetryAction.Block ? null : g.Budget,
+            Notes = g.Notes,
+        }).ToList();
+
+        try
+        {
+            SW.Bitween.Resources.RetryPolicies.RetryGroupValidation.EnsureCanFire(groups);
+        }
+        catch (SWValidationException e)
+        {
+            throw new SWValidationException("AI_SUGGESTION", $"The AI suggested a policy that can't be saved: {e.Message} Try again.");
+        }
+
+        return new RetrySuggestion(
+            string.IsNullOrWhiteSpace(raw.Name) ? "Suggested retry policy" : raw.Name.Trim(),
+            raw.Summary?.Trim() ?? "", groups);
+    }
+
+    /// <summary>What a policy does with one failure: how many times it retries it, by which group, or why it stops.</summary>
+    public static async Task<string> Outcome(IReadOnlyList<RetryGroup>? groups, string content)
+    {
+        if (groups is not { Count: > 0 }) return "Not retried: no retry policy";
+        var evaluator = new RetryPolicyEvaluator(new CustomRetryPolicy { Groups = groups.ToList() }, new InMemoryRetryGroupBudget());
+        var retries = 0;
+        string? by = null;
+        for (var attempt = 0; attempt < 20; attempt++)
+        {
+            var decision = await evaluator.Evaluate(XchangeResultType.Error, content, attempt);
+            if (!decision.ShouldRetry)
+                return retries == 0 ? $"Not retried: {decision.Reason}" : $"Retried up to {retries} times by \"{by}\"";
+            retries++;
+            by = decision.MatchedGroupName;
+        }
+        return $"Retried {retries}+ times by \"{by}\"";
+    }
+
+    /// <summary>The wire's own settings: camelCase, enums as names, matchers and delays by their type.</summary>
+    static readonly JsonSerializerSettings Settings = new()
+    {
+        Converters = { new MatcherJsonConverter(), new DelayStrategyJsonConverter(), new Newtonsoft.Json.Converters.StringEnumConverter() },
+        ContractResolver = new CamelCasePropertyNamesContractResolver(),
+        NullValueHandling = NullValueHandling.Ignore,
+    };
+
+    // Loose on purpose: whatever the model leaves out gets a default or is caught by validation.
+    sealed class RawSuggestion
+    {
+        public string? Name { get; set; }
+        public string? Summary { get; set; }
+        public List<RawGroup>? Groups { get; set; }
+    }
+
+    sealed class RawGroup
+    {
+        public string? Name { get; set; }
+        public int? Priority { get; set; }
+        public List<XchangeResultType>? AppliesTo { get; set; }
+        public List<Matcher>? Matchers { get; set; }
+        public RetryAction? Action { get; set; }
+        public RetryBudget? Budget { get; set; }
+        public string? Notes { get; set; }
+    }
+}
diff --git a/SW.Bitween.HttpTests/RetrySuggestionTests.cs b/SW.Bitween.HttpTests/RetrySuggestionTests.cs
new file mode 100644
index 00000000..b4a1aa44
--- /dev/null
+++ b/SW.Bitween.HttpTests/RetrySuggestionTests.cs
@@ -0,0 +1,129 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Threading.Tasks;
+using Microsoft.EntityFrameworkCore;
+using SW.Bitween.Domain;
+using SW.Bitween.Services.Ai;
+using Xunit;
+
+namespace SW.Bitween.HttpTests;
+
+/// <summary>
+/// Retry suggestions: a subscription's real failures go to the model masked, a policy comes back
+/// that could be saved, tried on those failures, and the request is in the audit trail.
+/// </summary>
+[Collection("Http")]
+public class RetrySuggestionTests(HttpFixture fixture) : IDisposable
+{
+    public void Dispose()
+    {
+        AiModels.ModelOverride = null;
+        using var admin = fixture.AdminAsync().GetAwaiter().GetResult();
+        admin.DeleteAsync("/api/settings/Bitween.Ai.ApiKey").GetAwaiter().GetResult();
+    }
+
+    sealed class FakeModel(string answer) : IAiModel
+    {
+        public List<AiPrompt> Asked { get; } = new();
+
+        public Task<string> Complete(AiPrompt prompt)
+        {
+            Asked.Add(prompt);
+            return Task.FromResult(answer);
+        }
+    }
+
+    /// <summary>A subscription whose exchanges fail in mapping: "maybe" can't become a yes/no value.</summary>
+    async Task<(HttpClient Admin, int SubscriptionId)> FailingSubscriptionAsync(int failures)
+    {
+        var (admin, urlName, _, partnerId, subscriptionId) = await Api.GatewayAsync(fixture);
+        await Api.Json(await admin.PostAsJsonAsync($"/api/subscriptions/{subscriptionId}/savemapper", new
+        {
+            mapperId = "NativeMapper",
+            mapperProperties = new[]
+            {
+                new
+                {
+                    key = "MappingRules",
+                    value = """{ "version": 1, "fields": [ { "target": ["flag"], "from": { "kind": "path", "path": "order.flag" }, "type": "boolean" } ] }""",
+                },
+            },
+        }));
+        var key = await Api.NewKeyAsync(admin);
+        await Api.SetKeysAsync(admin, partnerId, ("default", key));
+        for (var i = 0; i < failures; i++)
+        {
+            using var _ = await Api.CallSyncAsync(fixture, urlName, key, """{ "order": { "flag": "maybe", "owner": "lina@acme.example" } }""");
+        }
+        return (admin, subscriptionId);
+    }
+
+    async Task ConfigureAsync(HttpClient admin)
+    {
+        await Api.Json(await admin.PostAsJsonAsync("/api/settings/Bitween.Ai.ApiKey", new { value = "sk-test-key" }));
+        var live = fixture.App.Services.GetService(typeof(BitweenOptions)) as BitweenOptions;
+        for (var waited = 0; live!.Ai.ApiKey != "sk-test-key"; waited += 50)
+        {
+            Assert.True(waited < 10_000, "the AI key never took effect");
+            await Task.Delay(50);
+        }
+    }
+
+    [Fact]
+    public async Task A_policy_is_suggested_from_masked_failures_tried_on_them_and_audited()
+    {
+        var (admin, subscriptionId) = await FailingSubscriptionAsync(2);
+        await ConfigureAsync(admin);
+        var model = new FakeModel("""
+            { "name": "Mapping stays failed", "summary": "S", "groups": [
+              { "name": "Bad data", "appliesTo": ["Error"], "action": "Block",
+                "matchers": [ { "type": "contains", "value": "boolean" } ] },
+              { "name": "Outages", "appliesTo": ["Error"], "action": "Allow",
+                "matchers": [ { "type": "contains", "value": "timed out" } ],
+                "budget": { "maxAttemptsPerError": 3, "maxAttemptsTotal": 20, "delayStrategy": { "type": "fixed", "delayMs": 60000 } } } ] }
+            """);
+        AiModels.ModelOverride = _ => model;
+
+        var result = await Api.Json(await admin.PostAsJsonAsync("/api/retrysuggestions", new { subscriptionId }));
+
+        Assert.Equal("Mapping stays failed", (string)result["name"]!);
+        Assert.Equal(2, result["groups"]!.AsArray().Count);
+        Assert.Equal(2, (int)result["failures"]!);
+        var row = Assert.Single(result["coverage"]!.AsArray());
+        Assert.Equal(2, (int)row!["count"]!);
+        Assert.Equal("Not retried: no retry policy", (string)row["now"]!);
+        Assert.Equal("Not retried: Group 'Bad data' explicitly blocks this error", (string)row["suggested"]!);
+
+        var sent = Assert.Single(model.Asked).Message;
+        Assert.Equal(sent, (string)result["sent"]!);
+        Assert.DoesNotContain("maybe", sent);
+        Assert.DoesNotContain("lina@acme.example", sent);
+
+        // What came back saves as it is.
+        var saved = await admin.PostAsJsonAsync("/api/retrypolicies", new { name = Api.Unique("Suggested"), groups = result["groups"] });
+        Assert.Equal(HttpStatusCode.OK, saved.StatusCode);
+
+        var audited = await fixture.InDbAsync(db => db.Set<OperatorAction>().AsNoTracking()
+            .AnyAsync(a => a.Action == OperatorAction.SuggestRetryPolicy && a.Target == $"subscription {subscriptionId}"));
+        Assert.True(audited, "the suggestion wasn't recorded");
+    }
+
+    [Fact]
+    public async Task A_subscription_without_failures_has_nothing_to_learn_from()
+    {
+        var (admin, _, _, _, subscriptionId) = await Api.GatewayAsync(fixture);
+        await ConfigureAsync(admin);
+        var model = new FakeModel("{}");
+        AiModels.ModelOverride = _ => model;
+
+        var response = await admin.PostAsJsonAsync("/api/retrysuggestions", new { subscriptionId });
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        Assert.Contains("nothing to learn a policy from", await response.Content.ReadAsStringAsync());
+        Assert.Empty(model.Asked);
+    }
+}
diff --git a/SW.Bitween.UnitTests/Ai/MaskingTests.cs b/SW.Bitween.UnitTests/Ai/MaskingTests.cs
index 89f066ad..127bd700 100644
--- a/SW.Bitween.UnitTests/Ai/MaskingTests.cs
+++ b/SW.Bitween.UnitTests/Ai/MaskingTests.cs
@@ -100,6 +100,19 @@ public void An_error_loses_document_values_quotes_emails_and_long_numbers()
         StringAssert.Contains(masked, "is not allowed");
     }
 
+    [TestMethod]
+    public void An_error_loses_credentials_a_partner_echoed()
+    {
+        var masked = new Masking().Error(
+            "401 Unauthorized: Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEyM30.c2lnbmF0dXJlMTIzNDU2 rejected, api_key=sk_live_51Hx, password: hunter2, key a1b2c3d4e5f6a7b8c9d0e1f2");
+
+        foreach (var leaked in new[] { "eyJhbGciOiJIUzI1NiJ9", "eyJzdWIiOjEyM30", "c2lnbmF0dXJlMTIzNDU2", "sk_live_51Hx", "hunter2", "a1b2c3d4e5f6a7b8c9d0e1f2" })
+            Assert.IsFalse(masked.Contains(leaked), $"'{leaked}' was not masked: {masked}");
+        StringAssert.Contains(masked, "401 Unauthorized: Authorization: Bearer <secret>");
+        StringAssert.Contains(masked, "api_key=<secret>");
+        StringAssert.Contains(masked, "password: <secret>");
+    }
+
     /// <summary>A frame keeps its file and line; the folders above it describe the server, not the failure.</summary>
     [TestMethod]
     public void Stack_frames_keep_their_file_but_not_the_servers_folders()
diff --git a/SW.Bitween.UnitTests/Ai/RetryPolicyPromptTests.cs b/SW.Bitween.UnitTests/Ai/RetryPolicyPromptTests.cs
new file mode 100644
index 00000000..6a53902e
--- /dev/null
+++ b/SW.Bitween.UnitTests/Ai/RetryPolicyPromptTests.cs
@@ -0,0 +1,104 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using SW.Bitween.Model;
+using SW.Bitween.Services.Ai;
+using SW.PrimitiveTypes;
+
+namespace SW.Bitween.UnitTests.Ai;
+
+/// <summary>
+/// Retry suggestions: what the model proposes is a policy that could be saved, it is tried on the
+/// real errors here, and what is sent of them is masked.
+/// </summary>
+[TestClass]
+public class RetryPolicyPromptTests
+{
+    const string Suggestion = """
+        ```json
+        { "name": "Retry outages", "summary": "S",
+          "groups": [
+            { "name": "Connection problems", "appliesTo": ["Error"], "action": "Allow",
+              "matchers": [ { "type": "exceptionType", "value": "System.Net.Http.HttpRequestException" } ],
+              "budget": { "maxAttemptsPerError": 3, "maxAttemptsTotal": 50,
+                          "delayStrategy": { "type": "exponential", "initialDelayMs": 30000, "multiplier": 2, "maxDelayMs": 600000 } },
+              "alertMode": "Send", "alertChannelId": 7, "notes": "Passing outages." },
+            { "name": "Bad URL", "appliesTo": ["Error"], "action": "Block",
+              "matchers": [ { "type": "contains", "value": "Invalid URI" } ],
+              "budget": { "maxAttemptsPerError": 9, "delayStrategy": { "type": "fixed", "delayMs": 1000 } } }
+          ] }
+        ```
+        """;
+
+    [TestMethod]
+    public void A_suggestion_is_a_policy_that_could_be_saved_without_its_alerts()
+    {
+        var suggestion = RetryPolicyPrompt.Parse(Suggestion);
+
+        Assert.AreEqual("Retry outages", suggestion.Name);
+        Assert.AreEqual(2, suggestion.Groups.Count);
+        var outages = suggestion.Groups[0];
+        Assert.AreEqual(0, outages.Priority);
+        Assert.IsInstanceOfType<ExceptionTypeMatcher>(outages.Matchers[0]);
+        Assert.IsInstanceOfType<ExponentialDelayStrategy>(outages.Budget!.DelayStrategy);
+        Assert.AreEqual(RetryAlertMode.Inherit, outages.AlertMode);
+        Assert.IsNull(outages.AlertChannelId);
+        Assert.IsNull(suggestion.Groups[1].Budget, "a blocking group has no budget");
+    }
+
+    [TestMethod]
+    public void A_suggestion_that_couldnt_be_saved_is_refused()
+    {
+        var e = Assert.ThrowsException<SWValidationException>(() => RetryPolicyPrompt.Parse("""
+            { "groups": [ { "name": "No budget", "appliesTo": ["Error"], "action": "Allow",
+                            "matchers": [ { "type": "contains", "value": "timeout" } ] } ] }
+            """));
+        StringAssert.Contains(e.Message, "can't be saved");
+
+        Assert.ThrowsException<SWValidationException>(() => RetryPolicyPrompt.Parse("I would retry timeouts."));
+        Assert.ThrowsException<SWValidationException>(() => RetryPolicyPrompt.Parse("""{ "name": "N", "groups": [null] }"""));
+    }
+
+    [TestMethod]
+    public async Task Each_failure_is_tried_on_the_policy_here()
+    {
+        var groups = RetryPolicyPrompt.Parse(Suggestion).Groups;
+
+        Assert.AreEqual("Retried up to 3 times by \"Connection problems\"", await RetryPolicyPrompt.Outcome(groups,
+            "System.Net.Http.HttpRequestException: Connection refused (skynet.example:443)\n   at Send()"));
+        Assert.AreEqual("Not retried: Group 'Bad URL' explicitly blocks this error", await RetryPolicyPrompt.Outcome(groups,
+            "System.UriFormatException: Invalid URI: The format of the URI could not be determined."));
+        Assert.AreEqual("Not retried: no retry policy", await RetryPolicyPrompt.Outcome(null, "anything"));
+    }
+
+    [TestMethod]
+    public void An_error_line_loses_its_values_and_addresses()
+    {
+        var masked = RetryPolicyPrompt.Mask("Response 503 from https://api.skynet.example/v2/orders for 'Lina Haddad' ref 88213");
+
+        StringAssert.Contains(masked, "Response 503 from <url> for '<text>' ref <number>");
+    }
+
+    [TestMethod]
+    public void The_current_policy_goes_without_its_alert_settings()
+    {
+        var current = new List<RetryGroup>
+        {
+            new()
+            {
+                Name = "Old", AppliesTo = [XchangeResultType.Error], Matchers = [new ContainsMatcher { Value = "timeout" }],
+                Budget = new RetryBudget { MaxAttemptsPerError = 2, DelayStrategy = new FixedDelayStrategy { DelayMs = 1000 } },
+                AlertHandlerId = "legacy", AlertHandlerProperties = new() { ["Password"] = "hunter2" }, AlertChannelId = 4,
+            },
+        };
+
+        var message = RetryPolicyPrompt.Message("Subscription kind: Internal", 30, 12, 0,
+            [new FailureKind("real", "System.TimeoutException: <text>", 12, 10, 9, DateTime.UtcNow, DateTime.UtcNow)], current);
+
+        StringAssert.Contains(message, "\"value\":\"timeout\"");
+        StringAssert.Contains(message, "Retried 10 times; the retry succeeded 9 times.");
+        Assert.IsFalse(message.Contains("hunter2") || message.Contains("legacy") || message.Contains("alertChannelId"), message);
+        Assert.IsFalse(message.Contains("real"), "the real error text is never sent");
+    }
+}
diff --git a/SW.Bitween.Web/ClientApp/src/api/client.ts b/SW.Bitween.Web/ClientApp/src/api/client.ts
index 788c7b22..c83e77a3 100644
--- a/SW.Bitween.Web/ClientApp/src/api/client.ts
+++ b/SW.Bitween.Web/ClientApp/src/api/client.ts
@@ -86,6 +86,7 @@ import type {
   RetryAlertConfig,
   RetryAttempts,
   RetryPolicy,
+  RetrySuggestion,
   RetryPolicyDetail,
   RetryPolicyListRow,
   RetryUsageRow,
@@ -633,6 +634,14 @@ export interface ApiClient {
   }): Promise<Paged<RetryPolicyListRow>>;
   getRetryPolicy(id: number): Promise<RetryPolicyDetail>;
   createRetryPolicy(input: { name: string }): Promise<RetryPolicy>;
+  /**
+   * Asks the AI provider under Settings, AI for a retry policy from a subscription's recent
+   * failures. Only masked error lines, their counts and how often a retry fixed them go, with the
+   * current policy's rules; never documents. Saves nothing.
+   */
+  suggestRetryPolicy(subscriptionId: number, signal?: AbortSignal): Promise<RetrySuggestion>;
+  /** Creates a policy from a suggestion's groups; returns its id. */
+  saveSuggestedRetryPolicy(name: string, groups: RetrySuggestion["groups"]): Promise<number>;
   updateRetryPolicy(
     id: number,
     changes: {
diff --git a/SW.Bitween.Web/ClientApp/src/api/http/retryPolicies.ts b/SW.Bitween.Web/ClientApp/src/api/http/retryPolicies.ts
index 5234d721..61d905b4 100644
--- a/SW.Bitween.Web/ClientApp/src/api/http/retryPolicies.ts
+++ b/SW.Bitween.Web/ClientApp/src/api/http/retryPolicies.ts
@@ -16,6 +16,7 @@ import {
   type Paged,
 } from "../types";
 import { get, post, request } from "./request";
+import type { RetrySuggestion } from "../types";
 import { buildListQuery, SEARCHY_RULE } from "./searchQuery";
 
 interface SearchyResponse<T> {
@@ -267,6 +268,15 @@ export const retryPolicyMethods = {
     return { id, name, groups: [], createdOn: "", alertChannelId: null };
   },
 
+  async suggestRetryPolicy(subscriptionId: number, signal?: AbortSignal): Promise<RetrySuggestion> {
+    return request<RetrySuggestion>("/retrysuggestions", { method: "POST", body: { subscriptionId }, signal });
+  },
+
+  /** Saves a suggestion's groups exactly as the server wrote them, so no field is lost on the way. */
+  async saveSuggestedRetryPolicy(name: string, groups: RetrySuggestion["groups"]): Promise<number> {
+    return post<number>("/retrypolicies", { name, groups });
+  },
+
   async updateRetryPolicy(
     id: number,
     changes: {
diff --git a/SW.Bitween.Web/ClientApp/src/api/types.ts b/SW.Bitween.Web/ClientApp/src/api/types.ts
index ada032db..0a39d6ed 100644
--- a/SW.Bitween.Web/ClientApp/src/api/types.ts
+++ b/SW.Bitween.Web/ClientApp/src/api/types.ts
@@ -2608,3 +2608,28 @@ export interface MirrorBring {
   needsYou: MirrorNote[];
   failed: { section: string; noun: string; key: string; error: string }[];
 }
+
+/** A retry policy the AI proposed from a subscription's failures. Nothing is saved until it's created. */
+export interface RetrySuggestion {
+  name: string;
+  summary: string;
+  /** In the server's own shape (delays in ms), passed back untouched to save them. */
+  groups: {
+    name: string;
+    priority: number;
+    appliesTo: string[];
+    action: "Allow" | "Block";
+    matchers: { type: string; value?: string; pattern?: string; path?: string }[];
+    budget: {
+      maxAttemptsPerError: number;
+      maxAttemptsTotal: number | null;
+      delayStrategy: { type: string; delayMs?: number; initialDelayMs?: number; incrementMs?: number; multiplier?: number; maxDelayMs?: number };
+    } | null;
+    notes?: string | null;
+  }[];
+  coverage: { error: string; count: number; retried: number; fixedByRetry: number; now: string; suggested: string }[];
+  failures: number;
+  days: number;
+  model: string | null;
+  sent: string;
+}
diff --git a/SW.Bitween.Web/ClientApp/src/pages/subscriptions/__tests__/suggestRetryPolicy.test.tsx b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/__tests__/suggestRetryPolicy.test.tsx
new file mode 100644
index 00000000..db7dc647
--- /dev/null
+++ b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/__tests__/suggestRetryPolicy.test.tsx
@@ -0,0 +1,99 @@
+import { screen, waitFor, within } from "@testing-library/react";
+import { http, HttpResponse } from "msw";
+import { describe, expect, it } from "vitest";
+import { apiPath, renderApp } from "../../../__tests__/support/renderApp";
+import { backend, sub } from "./subscriptionBackend";
+
+/**
+ * Suggest a retry policy with AI, from the subscription page. What is sent and how the suggestion
+ * is checked is the C# suite's business (RetryPolicyPromptTests, RetrySuggestionTests); this is the
+ * dialog, saving the suggestion as a policy, and picking it.
+ */
+
+globalThis.ResizeObserver ??= class {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+} as unknown as typeof ResizeObserver;
+
+const GROUPS = [
+  {
+    name: "Outages",
+    priority: 0,
+    appliesTo: ["Error"],
+    action: "Allow",
+    matchers: [{ type: "exceptionType", value: "System.Net.Http.HttpRequestException" }],
+    budget: {
+      maxAttemptsPerError: 3,
+      maxAttemptsTotal: 50,
+      whenExhausted: "Hold",
+      delayStrategy: { type: "exponential", initialDelayMs: 30000, multiplier: 2, maxDelayMs: 600000 },
+    },
+    notes: "Connection failures pass by themselves.",
+  },
+];
+
+describe("suggesting a retry policy", { timeout: 20000 }, () => {
+  it("shows what would change, saves the suggestion as a new policy and picks it", async () => {
+    const created: unknown[] = [];
+    const { handlers, saves } = backend([sub()]);
+    const { user } = renderApp("/subscriptions/10", {
+      config: { aiConfigured: true },
+      handlers: [
+        http.post(apiPath("/retrysuggestions"), async ({ request }) => {
+          expect(await request.json()).toEqual({ subscriptionId: 10 });
+          return HttpResponse.json({
+            name: "Retry outages",
+            summary: "Retries connection failures, stops the rest.",
+            groups: GROUPS,
+            coverage: [
+              {
+                error: "System.Net.Http.HttpRequestException: Connection refused (<url>)",
+                count: 40, retried: 10, fixedByRetry: 9,
+                now: "Not retried: no retry policy",
+                suggested: 'Retried up to 3 times by "Outages"',
+              },
+            ],
+            failures: 40, days: 30, model: "claude-sonnet-5-5", sent: "<failures>...</failures>",
+          });
+        }),
+        http.post(apiPath("/retrypolicies"), async ({ request }) => {
+          created.push(await request.json());
+          return HttpResponse.json(9);
+        }),
+        http.get(apiPath("/retrypolicies"), () =>
+          HttpResponse.json({ result: created.length ? [{ id: 9, name: "Retry outages", groupCount: 1, usedByCount: 0 }] : [], totalCount: created.length }),
+        ),
+        ...handlers,
+      ],
+    });
+
+    await user.click(await screen.findByRole("button", { name: /Suggest with AI/ }));
+    const dialog = await screen.findByRole("dialog", { name: "Suggest a retry policy" });
+    await user.click(within(dialog).getByRole("button", { name: "Suggest" }));
+
+    expect(await within(dialog).findByText("Retries connection failures, stops the rest.")).toBeVisible();
+    expect(within(dialog).getByText(/is a System\.Net\.Http\.HttpRequestException · up to 3 per exchange, 50 in all/)).toBeVisible();
+    expect(within(dialog).getByText("9 of 10")).toBeVisible();
+    expect(within(dialog).getByText('Retried up to 3 times by "Outages"')).toBeVisible();
+
+    await user.click(within(dialog).getByRole("button", { name: "Save as a new policy" }));
+
+    // Saved exactly as the server wrote it: nothing, like the hold, is lost on the way.
+    await waitFor(() => expect(created).toEqual([{ name: "Retry outages", groups: GROUPS }]));
+    await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+    await user.click(screen.getByRole("button", { name: "Save changes" }));
+    await waitFor(() => expect(saves).toHaveLength(1));
+    expect(saves[0].retryPolicyId).toBe(9);
+  });
+
+  it("says where to turn it on until Settings has a provider key", async () => {
+    const { handlers } = backend([sub()]);
+    const { user } = renderApp("/subscriptions/10", { config: { aiConfigured: false }, handlers });
+
+    await user.click(await screen.findByRole("button", { name: /Suggest with AI/ }));
+
+    const dialog = await screen.findByRole("dialog", { name: "Suggest a retry policy" });
+    expect(within(dialog).getByRole("link", { name: "Open Settings, AI in a new tab" })).toHaveAttribute("target", "_blank");
+  });
+});
diff --git a/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/LaneAndRetry.tsx b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/LaneAndRetry.tsx
index 7b7c8a92..5e94034d 100644
--- a/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/LaneAndRetry.tsx
+++ b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/LaneAndRetry.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
 import { Link } from "react-router";
+import { Sparkles } from "lucide-react";
 import { useQuery } from "@tanstack/react-query";
 import { api } from "../../../api";
 import { useSessionCan } from "../../../auth/useSessionCan";
@@ -9,6 +10,7 @@ import { CreateRetryPolicyDialog } from "../../../components/config/RetryPolicyD
 import { keys } from "../../../api/queryKeys";
 import { workGroupQueueName } from "../../../lib/busMessageName";
 import { Fact } from "./Fact";
+import { SuggestRetryPolicy } from "./SuggestRetryPolicy";
 
 /**
  * Which lane a subscription runs in, and what happens when it fails.
@@ -30,6 +32,7 @@ export function LaneAndRetry({
   idPrefix,
   inlineRetryGroups = null,
   inlineReplaced = false,
+  subscriptionId,
 }: {
   workGroupId: number | null;
   retryPolicyId: number | null;
@@ -42,6 +45,8 @@ export function LaneAndRetry({
   canEdit: boolean;
   /** Ids have to be unique per page - the create pages render this beside their own fields. */
   idPrefix: string;
+  /** A saved subscription, whose own failures a retry policy can be suggested from. */
+  subscriptionId?: number;
 }) {
   const canCreateWorkGroup = useSessionCan("workgroups.create");
   const canCreateRetryPolicy = useSessionCan("retry-policies.create");
@@ -53,6 +58,7 @@ export function LaneAndRetry({
   /** undefined = closed, null = creating, number = editing that group. */
   const [groupDialog, setGroupDialog] = useState<number | null | undefined>(undefined);
   const [creatingPolicy, setCreatingPolicy] = useState(false);
+  const [suggesting, setSuggesting] = useState(false);
 
   return (
     <>
@@ -136,6 +142,17 @@ export function LaneAndRetry({
               + New
             </button>
           )}
+          {canCreateRetryPolicy && canEdit && subscriptionId !== undefined && (
+            <button
+              type="button"
+              onClick={() => setSuggesting(true)}
+              title="Propose a retry policy from this subscription's own failures, with AI"
+              className="inline-flex items-center gap-1 text-[12px] font-medium link"
+            >
+              <Sparkles className="size-3" aria-hidden />
+              Suggest with AI
+            </button>
+          )}
         </div>
       </Fact>
       {groupDialog !== undefined && (
@@ -145,6 +162,13 @@ export function LaneAndRetry({
           onSaved={onWorkGroupChange}
         />
       )}
+      {suggesting && subscriptionId !== undefined && (
+        <SuggestRetryPolicy
+          subscriptionId={subscriptionId}
+          onClose={() => setSuggesting(false)}
+          onCreated={onRetryPolicyChange}
+        />
+      )}
       {creatingPolicy && (
         // Selects the new policy rather than navigating to it - the rest of the policy is
         // configured behind "View", and leaving here would abandon the subscription edit.
diff --git a/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/Overview.tsx b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/Overview.tsx
index 55b4a8e4..26cdafc2 100644
--- a/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/Overview.tsx
+++ b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/Overview.tsx
@@ -279,6 +279,7 @@ export function Overview({
           idPrefix="in"
           inlineRetryGroups={s.customRetryGroups ?? null}
           inlineReplaced={draft.retryPolicyId !== s.retryPolicyId}
+          subscriptionId={s.id}
         />
         <CategoryField
           categoryId={draft.categoryId}
diff --git a/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/SuggestRetryPolicy.tsx b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/SuggestRetryPolicy.tsx
new file mode 100644
index 00000000..3767d7a6
--- /dev/null
+++ b/SW.Bitween.Web/ClientApp/src/pages/subscriptions/studio/SuggestRetryPolicy.tsx
@@ -0,0 +1,253 @@
+import { useEffect, useRef, useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { Loader2 } from "lucide-react";
+import { api, getAppConfig } from "../../../api";
+import { keys } from "../../../api/queryKeys";
+import type { RetrySuggestion } from "../../../api/types";
+import { useSessionCan } from "../../../auth/useSessionCan";
+import { Dialog } from "../../../components/ui/overlays";
+import { Button, FormError } from "../../../components/ui/basics";
+
+type Group = RetrySuggestion["groups"][number];
+
+const seconds = (ms?: number) => {
+  const s = Math.round((ms ?? 0) / 1000);
+  return s >= 120 ? `${Math.round(s / 60)} min` : `${s}s`;
+};
+
+function delayLabel(d: NonNullable<Group["budget"]>["delayStrategy"]) {
+  if (d.type === "fixed") return `every ${seconds(d.delayMs)}`;
+  if (d.type === "linear") return `${seconds(d.initialDelayMs)}, then ${seconds(d.incrementMs)} longer each time`;
+  return `${seconds(d.initialDelayMs)}, doubling${d.multiplier && d.multiplier !== 2 ? ` (x${d.multiplier})` : ""} up to ${seconds(d.maxDelayMs)}`;
+}
+
+const matcherLabel = (m: Group["matchers"][number]) =>
+  m.type === "contains"
+    ? `contains "${m.value}"`
+    : m.type === "regex"
+      ? `matches /${m.pattern}/`
+      : m.type === "exceptionType"
+        ? `is a ${m.value}`
+        : `${m.path} ${m.value ?? ""}`.trim();
+
+/**
+ * Suggest a retry policy with AI, from this subscription's own failures. Nothing is saved until
+ * "Save as a new policy", and then the new policy is only picked here: the subscription saves as
+ * it always does.
+ */
+export function SuggestRetryPolicy({
+  subscriptionId,
+  onClose,
+  onCreated,
+}: {
+  subscriptionId: number;
+  onClose: () => void;
+  onCreated: (id: number) => void;
+}) {
+  const config = useQuery({ queryKey: keys.appConfig, queryFn: getAppConfig });
+  const canSetUp = useSessionCan("settings.edit");
+  const queryClient = useQueryClient();
+  const [busy, setBusy] = useState(false);
+  const [elapsed, setElapsed] = useState(0);
+  const [error, setError] = useState<string | null>(null);
+  const [suggestion, setSuggestion] = useState<RetrySuggestion | null>(null);
+  const [name, setName] = useState("");
+  const [showSent, setShowSent] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const controller = useRef<AbortController | null>(null);
+
+  useEffect(() => () => controller.current?.abort(), []);
+  useEffect(() => {
+    if (!busy) return;
+    setElapsed(0);
+    const timer = setInterval(() => setElapsed((s) => s + 1), 1000);
+    return () => clearInterval(timer);
+  }, [busy]);
+
+  async function suggest() {
+    controller.current = new AbortController();
+    setBusy(true);
+    setError(null);
+    try {
+      const res = await api.suggestRetryPolicy(subscriptionId, controller.current.signal);
+      setSuggestion(res);
+      setName(res.name);
+    } catch (e) {
+      if (!controller.current.signal.aborted) setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function save() {
+    if (!suggestion || !name.trim()) return;
+    setSaving(true);
+    setError(null);
+    try {
+      const id = await api.saveSuggestedRetryPolicy(name.trim(), suggestion.groups);
+      // Not waited for: a list that is slow to reload mustn't keep the new policy from being picked.
+      void queryClient.invalidateQueries({ queryKey: keys.retryPolicies.list });
+      onCreated(id);
+      onClose();
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  if (config.data && !config.data.aiConfigured)
+    return (
+      <Dialog title="Suggest a retry policy" onClose={onClose}>
+        <div className="space-y-3 text-sm text-ink-700">
+          <p>AI isn't set up on this Bitween yet: it needs an AI provider and its API key under Settings, AI.</p>
+          {canSetUp ? (
+            <a href="/settings?section=AI" target="_blank" rel="noreferrer" className="font-medium link">
+              Open Settings, AI in a new tab
+            </a>
+          ) : (
+            <p className="text-ink-500">Ask an administrator to set it up.</p>
+          )}
+        </div>
+      </Dialog>
+    );
+
+  return (
+    <Dialog title="Suggest a retry policy" onClose={onClose} wide>
+      {!suggestion ? (
+        <div className="space-y-3 text-sm text-ink-700">
+          <p>
+            Proposes which of this subscription's failures to retry, how often and how soon, from its failures in the
+            last 30 days. Nothing changes until you save the suggestion as a new policy.
+          </p>
+          <p className="text-xs text-ink-500">
+            Sent to the AI provider: each kind of error as one line with every value masked, how often it happened and how
+            often a retry fixed it, and the current policy's rules. Never a document or a response.
+          </p>
+          {error && <FormError>{error}</FormError>}
+          <div className="flex items-center justify-end gap-2">
+            {busy ? (
+              <>
+                <span className="mr-auto inline-flex items-center gap-1.5 text-xs text-ink-500" role="status">
+                  <Loader2 className="size-3.5 animate-spin" aria-hidden />
+                  Suggesting… {elapsed}s · usually 10-30 seconds
+                </span>
+                <Button onClick={() => controller.current?.abort()}>Cancel</Button>
+              </>
+            ) : (
+              <Button variant="primary" onClick={() => void suggest()}>
+                Suggest
+              </Button>
+            )}
+          </div>
+        </div>
+      ) : (
+        <div className="space-y-4 text-sm text-ink-700">
+          {suggestion.summary && <p className="text-ink-900">{suggestion.summary}</p>}
+
+          <section aria-label="Suggested groups" className="space-y-2">
+            {suggestion.groups.map((g, i) => (
+              <div key={i} className="rounded-lg border border-ink-200 px-3 py-2">
+                <div className="flex items-center gap-2">
+                  <span className="font-medium text-ink-900">{g.name}</span>
+                  <span
+                    className={`rounded px-1.5 text-[11px] font-medium ${g.action === "Block" ? "bg-danger-100 text-danger-700" : "bg-ok-100 text-ok-700"}`}
+                    title={g.action === "Block" ? "Failures this group matches are not retried" : "Failures this group matches are retried"}
+                  >
+                    {g.action === "Block" ? "Stops" : "Retries"}
+                  </span>
+                </div>
+                <p className="text-xs text-ink-600">
+                  When the error {g.matchers.map(matcherLabel).join(" or ")}
+                  {g.budget &&
+                    ` · up to ${g.budget.maxAttemptsPerError} per exchange` +
+                      (g.budget.maxAttemptsTotal === null ? "" : `, ${g.budget.maxAttemptsTotal} in all until it next succeeds`) +
+                      ` · waits ${delayLabel(g.budget.delayStrategy)}`}
+                </p>
+                {g.notes && <p className="mt-0.5 text-xs text-ink-500">{g.notes}</p>}
+              </div>
+            ))}
+          </section>
+
+          <section aria-label="What changes">
+            <p className="mb-1 font-medium text-ink-900">
+              What changes, on its {suggestion.failures.toLocaleString()} failures in the last {suggestion.days} days
+            </p>
+            <div className="overflow-x-auto rounded-lg border border-ink-200">
+              <table className="w-full text-left text-xs">
+                <thead className="bg-ink-50 text-ink-500">
+                  <tr>
+                    <th className="px-2 py-1.5 font-medium" title="Each kind of error, masked as it was sent">Error</th>
+                    <th className="px-2 py-1.5 text-right font-medium" title="How many times it happened">Count</th>
+                    <th className="px-2 py-1.5 text-right font-medium" title="Of those retried, how many the retry fixed">
+                      Fixed by retry
+                    </th>
+                    <th className="px-2 py-1.5 font-medium" title="What the policy in use does with it, as if none of its groups' retries were used up yet">Now</th>
+                    <th className="px-2 py-1.5 font-medium" title="What the suggested policy would do, tried on the real error">
+                      Suggested
+                    </th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {suggestion.coverage.map((c, i) => (
+                    <tr key={i} className="border-t border-ink-100 align-top">
+                      <td className="max-w-72 px-2 py-1.5 font-mono break-words text-ink-800">{c.error}</td>
+                      <td className="px-2 py-1.5 text-right tabular-nums">{c.count.toLocaleString()}</td>
+                      <td className="px-2 py-1.5 text-right tabular-nums">
+                        {c.retried === 0 ? "-" : `${c.fixedByRetry} of ${c.retried}`}
+                      </td>
+                      <td className="px-2 py-1.5">{c.now}</td>
+                      <td className="px-2 py-1.5 text-ink-900">{c.suggested}</td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </div>
+          </section>
+
+          <p className="text-xs text-ink-500">
+            {suggestion.model ? `Written by ${suggestion.model}. ` : ""}
+            <button
+              type="button"
+              className="link"
+              aria-expanded={showSent}
+              onClick={() => setShowSent((s) => !s)}
+              title="The message that went to the AI provider, after fixed instructions that are the same on every call"
+            >
+              {showSent ? "Hide what was sent" : "See what was sent"}
+            </button>
+          </p>
+          {showSent && (
+            <pre
+              aria-label="What was sent to the AI provider"
+              className="max-h-64 overflow-auto rounded-md bg-ink-50 p-2 font-mono text-xs whitespace-pre-wrap"
+            >
+              {suggestion.sent}
+            </pre>
+          )}
+
+          {error && <FormError>{error}</FormError>}
+          <div className="flex flex-wrap items-end justify-end gap-2 border-t border-ink-100 pt-3">
+            <label className="mr-auto flex min-w-60 flex-1 flex-col gap-1 text-xs text-ink-600">
+              Policy name
+              <input
+                value={name}
+                onChange={(e) => setName(e.target.value)}
+                className="h-9 rounded-lg border border-ink-200 px-2.5 text-sm text-ink-900 focus:border-ink-400 focus:outline-none"
+              />
+            </label>
+            <Button onClick={() => void suggest()} disabled={busy || saving}>
+              {busy ? `Suggesting… ${elapsed}s` : "Suggest again"}
+            </Button>
+            <Button variant="primary" onClick={() => void save()} disabled={!name.trim() || saving || busy}>
+              {saving ? "Saving…" : "Save as a new policy"}
+            </Button>
+          </div>
+          <p className="text-right text-xs text-ink-500">
+            It's then picked for this subscription; save the subscription to start using it.
+          </p>
+        </div>
+      )}
+    </Dialog>
+  );
+}
diff --git a/docs/admin-ui.md b/docs/admin-ui.md
index b9ec61fe..338ba83d 100644
--- a/docs/admin-ui.md
+++ b/docs/admin-ui.md
@@ -45,7 +45,7 @@ Selecting a stage opens its editor. Adapter stages pick an adapter and fill in i
 
 When a stage uses a database or broker adapter, it also binds the subscription to a data source and picks the statement and operation, the receive mode and batch size, or where to publish. See [Databases](databases.md) and [External brokers](external-brokers.md).
 
-With no stage selected, the overview shows health, next and last run, work group, retry policy, a retry budget banner once a budget is spent, receive attempts or recent runs, recent exchanges, notifications and change history. The **Notifications** card picks channels and when each sends; a new channel can be made from there without losing the page's edits. Header buttons pause or resume, receive or roll up now, create an aggregation of this subscription, and delete it.
+With no stage selected, the overview shows health, next and last run, work group, retry policy, a retry budget banner once a budget is spent, receive attempts or recent runs, recent exchanges, notifications and change history. The **Notifications** card picks channels and when each sends; a new channel can be made from there without losing the page's edits. **Suggest with AI**, beside the retry policy, proposes one from the subscription's own failures ([Suggesting a policy with AI](retries-and-alerts.md#suggesting-a-policy-with-ai)). Header buttons pause or resume, receive or roll up now, create an aggregation of this subscription, and delete it.
 
 Edits stay a draft until saved from the bar at the bottom of the page.
 
diff --git a/docs/api-reference.md b/docs/api-reference.md
index 53bdbb7e..b028f801 100644
--- a/docs/api-reference.md
+++ b/docs/api-reference.md
@@ -297,6 +297,7 @@ See [Data sources](data-sources.md) and [Databases](databases.md).
 | `POST /api/workgroups/{id}/delete` | `workgroups.delete`. Refused while subscriptions use it. |
 | `GET /api/retrypolicies`, `GET /api/retrypolicies/{id}` | `retry-policies.view` |
 | `POST /api/retrypolicies` | `retry-policies.create`. `{ name, groups, alertChannelId }`; see [Retry policies](retries-and-alerts.md#retry-policies). An alert names a notification channel; `alertHandlerId` is refused. |
+| `POST /api/retrysuggestions` | `subscriptions.view` and `retry-policies.create`. Suggest a retry policy with AI from a subscription's failures: `{ subscriptionId, days }` (1-90, default 30), replying with `name`, `summary`, `groups` (ready for `POST /api/retrypolicies`), `coverage`, `model` and `sent`. Saves nothing. See [Suggesting a policy with AI](retries-and-alerts.md#suggesting-a-policy-with-ai). |
 | `POST /api/retrypolicies/{id}` | `retry-policies.edit` |
 | `DELETE /api/retrypolicies/{id}` | `retry-policies.delete` |
 | `POST /api/retrypolicies/test` | `retry-policies.view` |
diff --git a/docs/configuration.md b/docs/configuration.md
index e904cbfa..9550ba6f 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -216,7 +216,7 @@ The **Mail server** section is the one SMTP server every Email notification chan
 
 ### AI
 
-The **AI** section is the provider every AI feature calls; they are [Generate with AI](mapping.md#generate-with-ai) in the mapping editor, [Explain this failure](#explaining-a-failure) on a failed exchange, and [Ask](#asking-your-exchanges) on the Exchanges page. It is read on each call, and AI features stay off until an API key is set.
+The **AI** section is the provider every AI feature calls; they are [Generate with AI](mapping.md#generate-with-ai) in the mapping editor, [Explain this failure](#explaining-a-failure) on a failed exchange, [Ask](#asking-your-exchanges) on the Exchanges page, and [Suggest with AI](retries-and-alerts.md#suggesting-a-policy-with-ai) beside a subscription's retry policy. It is read on each call, and AI features stay off until an API key is set.
 
 - **Provider** is `Anthropic` or `OpenAI`. Any other value, such as a misspelling in configuration, leaves AI features off. `OpenAI` also covers anything that speaks its chat completions API at **API address**: an Azure OpenAI resource (`https://your-resource.openai.azure.com/openai/v1/`), a local Ollama (`http://localhost:11434/v1/`) or a proxy.
 - **Model** empty uses `claude-opus-5-5` with Anthropic. OpenAI needs one named, or the Azure deployment's name.
@@ -235,9 +235,9 @@ Sample documents an AI feature sends go to this provider, with the names - never
 - the retry policy's groups, the attempt's place in its retry chain, why it won't be retried and any scheduled retry, and the first line of up to three earlier attempts' errors;
 - the input, mapped and response documents, with every value replaced by its type: `"name": "Lina"` goes as `"name": "<text>"`. Long lists show their first three entries. A CSV's every row is masked, a header row included, so a file without one can't send its first record as column names. A document that isn't JSON, XML or CSV, or is over 1 MB, isn't sent at all.
 
-Error text is masked too: a document inside it, such as a partner's response body, is masked as a document; every value the exchange's documents hold is taken out wherever it appears; quoted text, numbers of four or more digits, email addresses and URL query strings are replaced; and a stack frame keeps its file name and line but not the server's folders.
+Error text is masked too: a document inside it, such as a partner's response body, is masked as a document; every value the exchange's documents hold is taken out wherever it appears; quoted text, numbers of four or more digits, email addresses, URL query strings and anything that looks like a credential or token are replaced; and a stack frame keeps its file name and line but not the server's folders.
 
-The answer says what happened, the most likely cause and what to change. **See what was sent** shows exactly the masked text that went. Anyone who can view the exchange can ask, and each request is recorded as an `explain-failure` operator action in the audit trail before anything is sent, so a call that fails afterwards is on record too.
+The answer says what happened, the most likely cause and what to change. **See what was sent** shows exactly the masked message that went, after fixed instructions that are the same on every call. Anyone who can view the exchange can ask, and each request is recorded as an `explain-failure` operator action in the audit trail before anything is sent, so a call that fails afterwards is on record too.
 
 #### Asking your exchanges
 
@@ -246,7 +246,7 @@ The answer says what happened, the most likely cause and what to change. **See w
 - the question, the current time and the asker's time zone;
 - the ids and names of partners, subscriptions and information types (up to 2,000 of each), and promoted-property keys.
 
-No exchange, count or property value is sent. Every id and key in the answer is checked against this Bitween before it becomes a filter; anything that doesn't exist is dropped and listed under the answer. **See what was sent** shows exactly what went, and each question is recorded in the audit log as `ask-exchanges` before it is sent. It needs `exchanges.view`, and the filter runs with the asker's rights like any other.
+No exchange, count or property value is sent. Every id and key in the answer is checked against this Bitween before it becomes a filter; anything that doesn't exist is dropped and listed under the answer. **See what was sent** shows exactly the message that went, after fixed instructions that are the same on every call, and each question is recorded in the audit log as `ask-exchanges` before it is sent. It needs `exchanges.view`, and the filter runs with the asker's rights like any other.
 
 The page also has a **Notification channels** section. Channels are records rather than settings: they have their own table, each opens on a page of its own, and the `notifiers` permissions cover them rather than `settings`. See [Notification channels](retries-and-alerts.md#notification-channels).
 
diff --git a/docs/retries-and-alerts.md b/docs/retries-and-alerts.md
index 19be7445..a2caf9bd 100644
--- a/docs/retries-and-alerts.md
+++ b/docs/retries-and-alerts.md
@@ -175,6 +175,18 @@ Deleting a policy is refused while a subscription uses it. Removing a group dele
 
 It returns each simulated attempt with the matched group, whether it would retry, the delay and the reason, and stops at the first refusal. The policy page's test panel runs the unsaved draft.
 
+### Suggesting a policy with AI
+
+**Suggest with AI**, beside the retry policy on a subscription's page, proposes a policy from that subscription's own failures in the last 30 days, using the provider under [Settings, AI](configuration.md#ai). It sends the provider only:
+
+- each kind of error (the newest 2,000 failures, grouped by their first line, the 15 most frequent) as one line with its values masked: quoted text, numbers of four or more digits, email addresses, addresses (`<url>`) and anything that looks like a credential or token (`<secret>`) are replaced;
+- how often each happened, how often it was retried and how often the retry succeeded;
+- the subscription's kind and adapters, and the current policy's groups without their alert settings.
+
+Documents and response bodies are never sent; bad responses are only counted. Failures from before the upgrade that started recording each result's subscription (2026-10-14) aren't seen, so on an upgraded install the first suggestions learn only from failures since. The suggestion is checked as a saved policy would be, alerts are left to you, and it is then run on the real errors on the server: **What changes** shows, for each kind of error, what the current policy does with it, as if none of its groups' retries were used up yet, and what the suggestion would. **See what was sent** shows exactly the message that went; the fixed instructions sent before it are the same on every call and hold nothing of yours.
+
+Nothing changes until **Save as a new policy**, which creates the policy and picks it for the subscription; saving the subscription starts using it. Asking needs `subscriptions.view` and `retry-policies.create`, and is recorded as a `suggest-retry-policy` operator action before anything is sent. `POST /api/retrysuggestions { subscriptionId, days }` is the call behind it.
+
 ## Scheduled retries
 
 An automatic retry waits as a *delayed retry* until its time comes.