Pace provider traffic and identify genuine foreground bank requests

OPERATIONS.txt

@@ -157,12 +157,17 @@ imports and previews, including previews choosing another model, share the AI
 gate. HTTP 429 retries retain the original request and privacy/authentication
 controls. Other HTTP failures are not automatically retried.
 
-Each operation makes at most four attempts. Without a usable Retry-After hint,
-retry delays are 1, 2 and 4 seconds; an exhausted fourth attempt retains an
-8-second cooldown. Retry-After delta-seconds and HTTP dates can extend these
-delays, never shorten them. Automatic waiting totals at most two minutes,
-separate from each network attempt's timeout (bank: at most 30 seconds; AI:
-45 seconds by default). Waiting and queued requests honor context cancellation.
+Every outbound attempt is paced, including successful calls: AI request starts
+are at least 3 seconds apart; bank starts at least 1 second apart. These are
+conservative application defaults, not universal provider quota guarantees.
+On 429, exponential fallback begins at 15 seconds for AI and 30 seconds for
+banking. Consecutive failures escalate across operations, capped at 15 minutes;
+success resets failure escalation but retains learned spacing up to 30 seconds.
+Retry-After seconds and HTTP dates can extend delays, never shorten them.
+Each operation makes at most four attempts and spends at most two minutes in
+automatic retry waits. Normal pacing waits and queueing honor cancellation.
+Network attempt timeouts remain separate (bank: at most 30 seconds; AI:
+45 seconds by default).
 
 Long hints, exhausted attempts, and canceled retries retain the provider's
 cooldown. New calls fail without contacting that provider before its retry
@@ -180,6 +185,29 @@ An unavailable session reports its original safe rate error once, without
 additional unavailable-account errors or a false reconnection requirement.
 Failed-account cursors and the last successful complete sync remain unchanged.
 
+Manual sync, history import and balance HTTP requests forward actual PSU
+metadata to account-data GET requests, consistently across retries/pages.
+Only IP, User-Agent and available browser Accept headers are forwarded; never
+cookies, authorization headers, referrer URLs, or arbitrary supplied Psu-* fields.
+Scheduled sync contexts have no PSU metadata. User metadata is request-local,
+never saved on a shared bank client or copied into classification requests.
+
+With a public origin configured, a loopback reverse proxy must append its
+observed client IP to X-Forwarded-For. Only its rightmost appended address is
+trusted; direct/non-loopback callers cannot override their peer IP. Missing or
+malformed proxy addresses remain unknown, not invented. Tailscale Serve uses
+this deployment arrangement; other proxies must preserve this trust contract.
+
+For a confirmed background ASPSP_RATE_LIMIT_EXCEEDED, defer that account and
+endpoint at least six hours (longer provider hints take precedence), rather
+than replaying every few seconds. This background-only quota does not suppress
+an eligible genuine user request or another account/endpoint. Short generic
+platform limits still use the shared bank controller for both request modes.
+Only the bounded, exact error code is inspected; private provider messages are
+not returned or logged. Quota state is client-local, finite entries expire,
+and restart does not lift the upstream bank's actual quota.
+Source: https://enablebanking.com/docs/faq/
+
 Enable Banking
 --------------
 Register your application and public certificate with Enable Banking. For