diff --git a/CLAUDE.md b/CLAUDE.md
index 53caf4f3..a3ed1f95 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -134,6 +134,6 @@ Full reference: `.env.template` and `config/config.yaml`
 - **Metrics:** `METRICS_ENABLED` (false), `METRICS_ENDPOINT` (/metrics)
 - **Guardrails:** Definitions are persisted in the `guardrail_definitions` store and managed via the admin API/dashboard; `config/config.yaml` entries are validated and upserted into that store at startup (a seed, not the source of truth). `GUARDRAILS_ENABLED` env var gates the feature.
 - **Provider API key rotation:** Any API-key provider accepts several keys: `<PROVIDER>[_SUFFIX]_API_KEY_<n>` env vars (numbered from 2; `_1` is accepted as a synonym for the unsuffixed key) or `providers.<name>.api_keys` in `config.yaml` (merged after `api_key`, de-duplicated, unresolved `${...}` entries dropped; env replaces the whole YAML list). Two or more keys turn on round-robin rotation, drawn per outbound HTTP request — including retries, so a 429'd request retries under the next key. Realtime websocket sessions pick a key per session. Counters are in-memory per instance. The trailing number names a key, not a provider: `OPENAI_API_KEY_2` is key 2 of `openai`, while `OPENAI_REGION_2_API_KEY` is the sole key of provider `openai-region-2`. **Rotation defeats provider prompt caching** (providers scope the cache to the key that filled it); use it to lift per-key rate limits, not to save cost. Keyless (Ollama, vLLM) and non-API-key providers (Vertex, Bedrock) are unaffected.
-- **Provider credentials without env vars:** Every provider below can instead be configured from the admin dashboard's Providers page (or `/admin/provider-credentials` GET/PUT/DELETE), persisted to the `provider_credentials` store — the same declarative-shadows-store precedence as MCP servers: a provider name declared via env vars/`config.yaml` is read-only in the dashboard (`managed: true`), and a store row upsert/delete hot-registers or unregisters the provider into the live registry immediately, no restart. `GOMODEL` boots fine with zero providers configured (empty catalog) so this is a complete alternative to env-var credentials, not just a supplement. API keys (`api_keys`, an ordered rotation list, same semantics as `providers.<name>.api_keys`) and service-account secrets are redacted as `***` on read; an upsert echoing `***` at a position preserves the stored value there (rejected if that position was never set). Disabling a row (`enabled: false`) unregisters it from routing without deleting the stored credentials.
+- **Provider credentials without env vars:** Every provider below can instead be configured from the admin dashboard's Providers page (or `/admin/provider-credentials` GET/PUT/DELETE), persisted to the `provider_credentials` store — the same declarative-shadows-store precedence as MCP servers: a provider name declared via env vars/`config.yaml` is read-only in the dashboard (`managed: true`), and a store row upsert/delete hot-registers or unregisters the provider into the live registry immediately, no restart. `GOMODEL` boots fine with zero providers configured (empty catalog) so this is a complete alternative to env-var credentials, not just a supplement. API keys (`api_keys`, an ordered rotation list, same semantics as `providers.<name>.api_keys`) and service-account secrets are redacted as `***********` on read; an upsert echoing any all-asterisk mask of at least three characters at a position preserves the stored value there (rejected if that position was never set). Disabling a row (`enabled: false`) unregisters it from routing without deleting the stored credentials.
 - **Providers:** `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `ANTHROPIC_DEFAULT_MAX_TOKENS` (optional default `max_tokens` for Anthropic-translated requests that omit it; default 4096), `GEMINI_API_KEY`, `USE_GOOGLE_GEMINI_NATIVE_API` (true by default; false uses Gemini's OpenAI-compatible chat API), `XAI_API_KEY`, `GROQ_API_KEY`, `FIREWORKS_API_KEY`, `FIREWORKS_BASE_URL` (optional Fireworks AI endpoint override; default `https://api.fireworks.ai/inference/v1`), `META_API_KEY`, `META_BASE_URL` (optional Meta Model API endpoint override; default `https://api.meta.ai/v1`; Muse Spark models, e.g. `muse-spark-1.1`), `OPENROUTER_API_KEY`, `OPENROUTER_SITE_URL`/`OPENROUTER_APP_NAME` (optional OpenRouter attribution headers), `ZAI_API_KEY`, `ZAI_BASE_URL` (optional Z.ai endpoint override), `MINIMAX_API_KEY`, `MINIMAX_BASE_URL` (optional MiniMax endpoint override), `XIAOMI_API_KEY`, `XIAOMI_BASE_URL` (optional Xiaomi MiMo endpoint override), `OPENCODE_GO_API_KEY`, `OPENCODE_GO_BASE_URL` (optional OpenCode Go/Zen endpoint override; default `https://opencode.ai/zen/go/v1`), `OPENCODE_GO_MESSAGES_MODELS` (optional comma-separated model IDs routed to the Anthropic-native `/messages` endpoint instead of `/chat/completions`; default `qwen3.7-max`), `BAILIAN_API_KEY`, `BAILIAN_BASE_URL` (optional Bailian base URL for region switching; default `https://dashscope.aliyuncs.com/compatible-mode/v1`), `AZURE_API_KEY`, `AZURE_BASE_URL` (Azure OpenAI deployment base URL), `AZURE_API_VERSION` (optional Azure API version), `ORACLE_API_KEY` (Oracle API key), `ORACLE_BASE_URL` (Oracle OpenAI-compatible base URL), `BEDROCK_BASE_URL` (Bedrock Runtime region or endpoint), `BEDROCK_MANTLE_API_KEY`, `BEDROCK_MANTLE_BASE_URL` (Mantle region or endpoint), `BEDROCK_MANTLE_API_MODE` (`auto`, `openai`, or `standard`), `<PROVIDER>[_SUFFIX]_MODELS` (comma-separated configured model list for any provider type), `OLLAMA_BASE_URL`, `VLLM_BASE_URL`, `VLLM_API_KEY` (optional upstream vLLM bearer token)
 - **Provider model metadata:** `providers.<name>.models` accepts either model IDs (strings) or `{id, metadata}` objects. When `metadata` is supplied (`display_name`, `context_window`, `max_output_tokens`, `modes`, `capabilities`, `pricing`, …) it is merged onto the remote ai-model-list entry during enrichment, with operator values winning per-field. Primary use case: advertising context windows, capabilities, and pricing for local models (Ollama) and other custom endpoints whose IDs are not in the upstream registry.
diff --git a/docs/advanced/configuration.mdx b/docs/advanced/configuration.mdx
index 176d8abd..154f6c0a 100644
--- a/docs/advanced/configuration.mdx
+++ b/docs/advanced/configuration.mdx
@@ -53,6 +53,13 @@ warning at the top of the dashboard, and exposes `DEMO_MODE=on` through the
 allowlisted `/admin/runtime/config` response. Demo mode does not reset storage;
 schedule that separately in the deployment.
 
+Demo mode also does not bypass authentication. A startup log mode of
+`managed_keys` means the configured storage still contains at least one managed
+gateway API key, so requests require a bearer token even when
+`GOMODEL_MASTER_KEY` is empty. Disabled or expired managed keys keep
+authentication enabled as a fail-closed safety measure. Delete every managed
+key to return to unauthenticated mode, or configure a master key for recovery.
+
 #### MCP Gateway
 
 See [MCP Gateway](/features/mcp-gateway) for the full feature guide.
@@ -124,6 +131,12 @@ Storage is shared by audit logging, usage tracking, and future features like IAM
 | `LOGGING_FLUSH_INTERVAL`          | Flush interval in seconds                  | `5`     |
 | `LOGGING_RETENTION_DAYS`          | Auto-delete after N days (0 = forever)     | `30`    |
 
+Realtime dashboard previews and persisted audit logs are separate features.
+With `DASHBOARD_LIVE_LOGS_ENABLED=true` and `LOGGING_ENABLED=false`, requests
+can appear live but are not written to storage and disappear after a page
+refresh. When audit logging is enabled, writes are asynchronous and can take up
+to `LOGGING_FLUSH_INTERVAL` seconds to appear through the stored-log API.
+
 <Warning>
   When `LOGGING_LOG_BODIES` is enabled, request and response bodies are stored
   in full. These may contain sensitive data such as PII or API keys embedded in
diff --git a/internal/admin/dashboard/dashboard_test.go b/internal/admin/dashboard/dashboard_test.go
index e768dae8..be57e202 100644
--- a/internal/admin/dashboard/dashboard_test.go
+++ b/internal/admin/dashboard/dashboard_test.go
@@ -99,6 +99,17 @@ func TestIndex_DemoModeShowsWarning(t *testing.T) {
 	if !strings.Contains(body, "Do not enter sensitive or personal data. Demo data is reset regularly.") {
 		t.Error("expected demo mode data warning in page HTML")
 	}
+	if !strings.Contains(body, `href="https://gomodel.enterpilot.io/?utm_source=gomodel_dashboard&amp;utm_medium=demo_banner&amp;utm_campaign=public_demo" target="_blank" rel="noopener noreferrer">gomodel.enterpilot.io</a>`) {
+		t.Error("expected demo mode website link in page HTML")
+	}
+	for _, unwanted := range []string{
+		`href="https://gomodel.enterpilot.io/docs"`,
+		`href="https://github.com/ENTERPILOT/GoModel"`,
+	} {
+		if strings.Contains(body, unwanted) {
+			t.Errorf("unexpected demo mode link %s in page HTML", unwanted)
+		}
+	}
 }
 
 func TestIndex_StandardModeHidesDemoWarning(t *testing.T) {
diff --git a/internal/admin/dashboard/static/css/dashboard.css b/internal/admin/dashboard/static/css/dashboard.css
index b14137cb..1c04892d 100644
--- a/internal/admin/dashboard/static/css/dashboard.css
+++ b/internal/admin/dashboard/static/css/dashboard.css
@@ -668,10 +668,8 @@ body.dashboard-modal-open {
 }
 
 .demo-mode-banner {
-  position: sticky;
-  top: 16px;
-  z-index: 8;
-  display: flex;
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr) auto;
   align-items: center;
   gap: 12px;
   margin-bottom: 24px;
@@ -690,7 +688,7 @@ body.dashboard-modal-open {
   color: var(--warning);
 }
 
-.demo-mode-banner div {
+.demo-mode-banner-copy {
   display: flex;
   align-items: baseline;
   gap: 8px;
@@ -706,6 +704,39 @@ body.dashboard-modal-open {
   text-transform: uppercase;
 }
 
+.demo-mode-banner-links {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 6px;
+}
+
+.demo-mode-banner-links a {
+  display: inline-flex;
+  align-items: center;
+  min-height: 28px;
+  padding: 4px 8px;
+  border: 1px solid color-mix(in srgb, var(--warning) 42%, var(--border));
+  border-radius: var(--radius);
+  color: var(--text);
+  font-size: 12px;
+  font-weight: 600;
+  line-height: 1;
+  text-decoration: none;
+  white-space: nowrap;
+}
+
+.demo-mode-banner-links a:hover {
+  border-color: var(--warning);
+  background: color-mix(in srgb, var(--warning) 16%, transparent);
+  color: var(--text);
+}
+
+.demo-mode-banner-links a:focus-visible {
+  outline: 2px solid color-mix(in srgb, var(--warning) 42%, transparent);
+  outline-offset: 2px;
+}
+
 .page-header {
   display: flex;
   align-items: center;
@@ -975,6 +1006,29 @@ body.dashboard-modal-open {
   gap: 12px;
 }
 
+.page-with-sticky-date {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  align-items: start;
+  column-gap: 12px;
+}
+
+.page-with-sticky-date > * {
+  grid-column: 1 / -1;
+}
+
+.page-with-sticky-date > .date-range-page-header {
+  grid-column: 1;
+}
+
+.page-with-sticky-date > .sticky-date-range {
+  position: sticky;
+  top: 16px;
+  z-index: 8;
+  grid-column: 2;
+  justify-self: end;
+}
+
 /* Interval Picker */
 .interval-picker {
   display: inline-flex;
@@ -1078,6 +1132,10 @@ body.dashboard-modal-open {
   grid-column: span 2;
 }
 
+.provider-status-overview-card {
+  grid-column: span 1;
+}
+
 .provider-status-flag.is-healthy {
   border-color: color-mix(in srgb, var(--success) 45%, var(--border));
   background: color-mix(in srgb, var(--success) 10%, var(--bg-surface));
@@ -2047,6 +2105,20 @@ td.col-price {
   animation: loading-spin 0.8s linear infinite;
 }
 
+.models-loading-state {
+  position: sticky;
+  top: 16px;
+  z-index: 7;
+  width: fit-content;
+  min-height: 0;
+  margin: 0 auto 16px;
+  padding: 10px 14px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--bg-surface);
+  box-shadow: 0 8px 24px color-mix(in srgb, var(--bg) 70%, transparent);
+}
+
 @keyframes loading-spin {
   to {
     transform: rotate(360deg);
@@ -5413,13 +5485,18 @@ body.conversation-drawer-open {
     padding: 20px;
   }
   .demo-mode-banner {
-    top: 10px;
     align-items: flex-start;
+    grid-template-columns: auto minmax(0, 1fr);
   }
-  .demo-mode-banner div {
+  .demo-mode-banner-copy {
     display: grid;
     gap: 2px;
   }
+  .demo-mode-banner-links {
+    grid-column: 2;
+    justify-content: flex-start;
+    flex-wrap: wrap;
+  }
   .auth-dialog-shell {
     align-items: end;
     padding: 12px;
@@ -5475,6 +5552,25 @@ body.conversation-drawer-open {
     justify-content: space-between;
     flex-wrap: wrap;
   }
+  .page-with-sticky-date {
+    grid-template-columns: minmax(0, 1fr);
+  }
+  .page-with-sticky-date > .date-range-page-header,
+  .page-with-sticky-date > .sticky-date-range {
+    grid-column: 1;
+  }
+  .page-with-sticky-date > .date-range-page-header {
+    margin-bottom: 12px;
+  }
+  .page-with-sticky-date > .sticky-date-range {
+    top: 10px;
+    width: 100%;
+    margin-bottom: 24px;
+  }
+  .sticky-date-range .date-picker-trigger {
+    width: 100%;
+    justify-content: space-between;
+  }
 
   .settings-panel-title-row {
     gap: 8px;
diff --git a/internal/admin/dashboard/static/js/dashboard.js b/internal/admin/dashboard/static/js/dashboard.js
index 9ea38b5b..8d889b99 100644
--- a/internal/admin/dashboard/static/js/dashboard.js
+++ b/internal/admin/dashboard/static/js/dashboard.js
@@ -140,7 +140,9 @@ function dashboard() {
       providers: [],
     },
     models: [],
-    modelsLoading: false,
+    // Start busy so a direct visit to the Models route can paint its loader
+    // before init() starts the first inventory request.
+    modelsLoading: true,
     categories: [],
     activeCategory: "all",
     hasCalendarModule: calendarModuleFactory !== null,
@@ -245,6 +247,16 @@ function dashboard() {
     },
 
     _applyRoute(page, sub) {
+      // Prepare the first bounded Models-page batch before Alpine mounts the
+      // page template. Otherwise navigating from another dashboard page would
+      // synchronously create every model row before a loader can paint.
+      if (
+        page === "models" &&
+        this.page !== "models" &&
+        typeof this.restartModelRendering === "function"
+      ) {
+        this.restartModelRendering();
+      }
       this.page = page;
 
       // Live token throughput is overview-only; tear it down when navigating
@@ -1122,9 +1134,35 @@ function dashboard() {
     },
 
     formatTokensShort(n) {
-      if (n >= 1000000) return (n / 1000000).toFixed(1) + "M";
-      if (n >= 1000) return (n / 1000).toFixed(1) + "K";
-      return String(n);
+      if (n == null || n === "") return "-";
+      const value = Number(n);
+      if (!Number.isFinite(value)) return "-";
+      const absolute = Math.abs(value);
+      const units = [
+        { threshold: 1000000000, suffix: "B" },
+        { threshold: 1000000, suffix: "M" },
+        { threshold: 1000, suffix: "K" },
+      ];
+      for (let index = 0; index < units.length; index += 1) {
+        let unit = units[index];
+        if (absolute >= unit.threshold) {
+          let compact = value / unit.threshold;
+          if (Math.abs(Number(compact.toFixed(1))) >= 1000 && index > 0) {
+            unit = units[index - 1];
+            compact = value / unit.threshold;
+          }
+          return (
+            compact.toFixed(1).replace(/\.0$/, "") + unit.suffix
+          );
+        }
+      }
+      return String(value);
+    },
+
+    tokenCountTitle(label, n) {
+      const value = n == null || n === "" ? NaN : Number(n);
+      const exact = Number.isFinite(value) ? this.formatNumber(value) : "-";
+      return String(label || "Tokens") + ": " + exact;
     },
 
     formatTimestamp(ts) {
diff --git a/internal/admin/dashboard/static/js/modules/dashboard-display.test.cjs b/internal/admin/dashboard/static/js/modules/dashboard-display.test.cjs
index a6feec6a..d1faee37 100644
--- a/internal/admin/dashboard/static/js/modules/dashboard-display.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/dashboard-display.test.cjs
@@ -67,6 +67,20 @@ function loadDashboardApp(overrides = {}) {
     return context.dashboard();
 }
 
+test('Models route starts bounded rendering before Alpine mounts the page', () => {
+    const app = loadDashboardApp();
+    const pagesSeen = [];
+    app.page = 'overview';
+    app.restartModelRendering = function() {
+        pagesSeen.push(this.page);
+    };
+
+    app._applyRoute('models', null);
+
+    assert.deepEqual(pagesSeen, ['overview']);
+    assert.equal(app.page, 'models');
+});
+
 test('qualifiedModelDisplay keeps provider identity for nested provider model IDs', () => {
     const app = loadDashboardApp();
 
@@ -165,6 +179,29 @@ test('formatCost uses data placeholder for missing values', () => {
     assert.equal(app.formatCost('0.25'), '$0.25');
 });
 
+test('formatTokensShort uses K, M, and B suffixes for large token counts', () => {
+    const app = loadDashboardApp();
+
+    assert.equal(app.formatTokensShort(999), '999');
+    assert.equal(app.formatTokensShort(1000), '1K');
+    assert.equal(app.formatTokensShort(1250), '1.3K');
+    assert.equal(app.formatTokensShort(999950), '1M');
+    assert.equal(app.formatTokensShort(56672513), '56.7M');
+    assert.equal(app.formatTokensShort(12072437), '12.1M');
+    assert.equal(app.formatTokensShort(999950000), '1B');
+    assert.equal(app.formatTokensShort(2500000000), '2.5B');
+    assert.equal(app.formatTokensShort(null), '-');
+    assert.equal(app.formatTokensShort('not-a-number'), '-');
+});
+
+test('tokenCountTitle exposes the exact localized count and token type', () => {
+    const app = loadDashboardApp();
+
+    assert.equal(app.tokenCountTitle('Input tokens', 56672513), 'Input tokens: ' + (56672513).toLocaleString());
+    assert.equal(app.tokenCountTitle('Output tokens', 12072437), 'Output tokens: ' + (12072437).toLocaleString());
+    assert.equal(app.tokenCountTitle('Total tokens', null), 'Total tokens: -');
+});
+
 test('system theme media changes rerender all dashboard charts', () => {
     let mediaChangeHandler = null;
     const app = loadDashboardApp({
diff --git a/internal/admin/dashboard/static/js/modules/dashboard-layout.test.cjs b/internal/admin/dashboard/static/js/modules/dashboard-layout.test.cjs
index 3df4d8f8..532222e6 100644
--- a/internal/admin/dashboard/static/js/modules/dashboard-layout.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/dashboard-layout.test.cjs
@@ -94,6 +94,42 @@ test("sidebar and main content share the flex layout without manual content offs
   assert.match(sidebarLogoRule, /color:\s*var\(--accent\)/);
 });
 
+test("demo notice scrolls normally while page date ranges stay sticky", () => {
+  const layout = readFixture("../../../templates/layout.html");
+  const overview = readFixture("../../../templates/page-overview.html");
+  const usage = readFixture("../../../templates/page-usage.html");
+  const audit = readFixture("../../../templates/page-audit-logs.html");
+  const css = readFixture("../../css/dashboard.css");
+
+  assert.match(layout, /<aside class="demo-mode-banner"/);
+  assert.match(
+    layout,
+    /href="https:\/\/gomodel\.enterpilot\.io\/\?utm_source=gomodel_dashboard&amp;utm_medium=demo_banner&amp;utm_campaign=public_demo"[^>]*>gomodel\.enterpilot\.io<\/a>/,
+  );
+  assert.doesNotMatch(layout, /href="https:\/\/gomodel\.enterpilot\.io\/docs"/);
+  assert.doesNotMatch(layout, /href="https:\/\/github\.com\/ENTERPILOT\/GoModel"/);
+  const demoRule = readCSSRule(css, ".demo-mode-banner");
+  assert.doesNotMatch(demoRule, /position:\s*sticky/);
+  assert.doesNotMatch(demoRule, /top:\s*\d/);
+
+  for (const page of [overview, usage, audit]) {
+    assert.match(page, /<div class="page-with-sticky-date">/);
+    assert.match(page, /class="page-header date-range-page-header"/);
+    assert.match(
+      page,
+      /<div class="sticky-date-range">{{template "date-picker" \.}}<\/div>/,
+    );
+  }
+
+  const stickyRule = readCSSRule(
+    css,
+    ".page-with-sticky-date > .sticky-date-range",
+  );
+  assert.match(stickyRule, /position:\s*sticky/);
+  assert.match(stickyRule, /top:\s*16px/);
+  assert.match(stickyRule, /z-index:\s*8/);
+});
+
 test("sidebar theme controls and collapse handle stay keyboard accessible", () => {
   const template = readDashboardShellTemplate();
 
@@ -241,18 +277,18 @@ test("overview page shows provider status summary and per-provider cards keyed b
   assert.doesNotMatch(indexTemplate, /class="provider-status-strip"/);
   assert.match(
     indexTemplate,
-    /class="card provider-status-flag" x-show="providerStatus\.summary\.total > 0"/,
+    /class="card provider-status-flag provider-status-overview-card" x-show="providerStatus\.summary\.total > 0"/,
   );
   assert.match(
     indexTemplate,
-    /class="card card-wide"[\s\S]*<div class="card-label">Tokens<\/div>[\s\S]*class="cache-token-part" title="Input tokens"[\s\S]*summary\.total_input_tokens[\s\S]*class="cache-token-marker">i<\/span>[\s\S]*class="cache-token-part" title="Output tokens"[\s\S]*summary\.total_output_tokens[\s\S]*class="cache-token-marker">o<\/span>[\s\S]*summaryTotalTokens\(\)[\s\S]*<div class="card-label">Total Requests<\/div>/,
+    /class="card card-wide"[\s\S]*<div class="card-label">Tokens<\/div>[\s\S]*tokenCountTitle\('Input tokens',[\s\S]*formatTokensShort\(summary\.total_input_tokens\)[\s\S]*class="cache-token-marker">i<\/span>[\s\S]*tokenCountTitle\('Output tokens',[\s\S]*formatTokensShort\(summary\.total_output_tokens\)[\s\S]*class="cache-token-marker">o<\/span>[\s\S]*tokenCountTitle\('Total tokens',[\s\S]*<div class="card-label">Total Requests<\/div>/,
   );
   assert.doesNotMatch(indexTemplate, /<div class="card-label">Input Tokens<\/div>/);
   assert.doesNotMatch(indexTemplate, /<div class="card-label">Output Tokens<\/div>/);
   assert.doesNotMatch(indexTemplate, /<div class="card-label">Total Tokens<\/div>/);
   assert.match(
     indexTemplate,
-    /class="card card-wide" x-show="cacheAnalyticsEnabled\(\)"[\s\S]*<div class="card-label">Local Cache<\/div>[\s\S]*class="cache-token-part" title="Input tokens"[\s\S]*class="cache-token-marker">i<\/span>[\s\S]*class="cache-token-part" title="Output tokens"[\s\S]*class="cache-token-marker">o<\/span>[\s\S]*cacheOverviewTotalTokens\(\)[\s\S]*class="card provider-status-flag"[\s\S]*<!-- Usage Chart -->/,
+    /class="card card-wide" x-show="cacheAnalyticsEnabled\(\)"[\s\S]*<div class="card-label">Local Cache<\/div>[\s\S]*tokenCountTitle\('Input tokens',[\s\S]*formatTokensShort\(cacheOverview\.summary\.total_input_tokens\)[\s\S]*class="cache-token-marker">i<\/span>[\s\S]*tokenCountTitle\('Output tokens',[\s\S]*formatTokensShort\(cacheOverview\.summary\.total_output_tokens\)[\s\S]*class="cache-token-marker">o<\/span>[\s\S]*tokenCountTitle\('Total tokens',[\s\S]*class="card provider-status-flag provider-status-overview-card"[\s\S]*<!-- Usage Chart -->/,
   );
   assert.doesNotMatch(indexTemplate, /Local Cache Input Tokens/);
   assert.doesNotMatch(indexTemplate, /Local Cache Output Tokens/);
@@ -261,6 +297,7 @@ test("overview page shows provider status summary and per-provider cards keyed b
     /<div class="card-label">Provider Status<\/div>[\s\S]*class="card-value provider-status-value"[\s\S]*providerStatusRatioText\(\)/,
   );
   assert.match(css, /\.card-wide\s*\{\s*grid-column:\s*span 2;/);
+  assert.match(css, /\.provider-status-overview-card\s*\{\s*grid-column:\s*span 1;/);
   assert.match(
     indexTemplate,
     /class="provider-status-card-link"[\s\S]*x-show="providerStatusHasIssues\(\)"[\s\S]*@click="scrollToProviderStatusSection\(\)"/,
@@ -866,6 +903,10 @@ test("audit toolbar uses a full-width search row above the select row with a rig
     indexTemplate,
     /copyId: 'audit-retention-help-copy'[\s\S]*If you want to change the retention period, set LOGGING_RETENTION_DAYS \(env var\) or logging\.retention_days \(config\.yaml\) and restart the gateway\. Default is 30 days; 0 keeps audit logs forever\.[\s\S]*<h2>Audit Logs<\/h2>[\s\S]*<div class="inline-help-title-row" x-show="auditRetentionText\(\)">[\s\S]*<p class="audit-retention-note"><span x-text="auditRetentionPrefix\(\)"><\/span><span class="audit-retention-highlight" x-text="auditRetentionHighlight\(\)"><\/span>\.<\/p>[\s\S]*{{template "inline-help-toggle" \.}}[\s\S]*<p :id="copyId" class="inline-help-copy" x-show="open" x-transition\.opacity\.duration\.200ms x-text="text"><\/p>/,
   );
+  assert.match(
+    indexTemplate,
+    /class="alert alert-warning" x-show="!workflowAuditVisible\(\) && !authError" role="status">\s*Audit logging is off\. Live entries are temporary and disappear after refresh\. Set <code>LOGGING_ENABLED=true<\/code> to persist them\./,
+  );
   const retentionRule = readCSSRule(css, ".audit-retention-note");
   assert.match(retentionRule, /color:\s*var\(--text-muted\)/);
   assert.match(retentionRule, /font-size:\s*13px/);
@@ -1130,11 +1171,11 @@ test("model category tables lazy mount only the active table body", () => {
   );
   assert.match(
     modelsBlock,
-    /class="loading-state" x-show="modelsLoading && !authError" role="status" aria-live="polite"/,
+    /class="loading-state models-loading-state" x-show="modelsBusy\(\) && !authError" role="status" aria-live="polite"/,
   );
   assert.match(
     modelsBlock,
-    /x-text="displayModels\.length > 0 \? 'Refreshing models\.\.\.' : 'Loading models\.\.\.'"/,
+    /class="loading-spinner"[\s\S]*x-text="modelLoadingText\(\)"/,
   );
   assert.match(
     modelsBlock,
@@ -1142,8 +1183,11 @@ test("model category tables lazy mount only the active table body", () => {
   );
   assert.match(
     modelsBlock,
-    /placeholder="Filter by provider, provider\/model, alias, or owner\.\.\." aria-label="Filter models by provider, provider\/model, alias, or owner" x-model="modelFilter" class="filter-input"/,
+    /placeholder="Filter by provider, provider\/model, alias, or owner\.\.\." aria-label="Filter models by provider, provider\/model, alias, or owner" x-model="modelFilter" @input\.debounce\.150ms="restartModelRendering\(\)" class="filter-input"/,
   );
+  const modelLoadingRule = readCSSRule(css, ".models-loading-state");
+  assert.match(modelLoadingRule, /position:\s*sticky/);
+  assert.match(modelLoadingRule, /top:\s*16px/);
   assert.match(
     modelsBlock,
     /class="pagination-btn pagination-btn-primary pagination-btn-with-icon alias-create-btn"[\s\S]*aria-label="New virtual model alias"[\s\S]*title="Alias"[\s\S]*@click="openVirtualModelCreate\(\)"[\s\S]*data-lucide="plus" class="alias-create-icon"[\s\S]*<span>New(?:&nbsp;| )virtual(?:&nbsp;| )model<\/span>/,
diff --git a/internal/admin/dashboard/static/js/modules/providers-config.test.cjs b/internal/admin/dashboard/static/js/modules/providers-config.test.cjs
index a1cead4d..9d6394ec 100644
--- a/internal/admin/dashboard/static/js/modules/providers-config.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/providers-config.test.cjs
@@ -48,7 +48,7 @@ test('fetchProviderCredentialsPage stores the returned list and marks unavailabl
 
 test('fetchProviderCredentialsPage stores rows and lazily loads types once', async () => {
     const rows = [
-        { name: 'my-openai', type: 'openai', api_keys: ['***'], enabled: true, managed: false },
+        { name: 'my-openai', type: 'openai', api_keys: ['***********'], enabled: true, managed: false },
         { name: 'config-anthropic', type: 'anthropic', enabled: true, managed: true }
     ];
     const requests = [];
@@ -137,7 +137,7 @@ test('submitProviderCredentialForm sends a normalized PUT payload on create', as
     assert.equal(module.providerCredentialFormOpen, false);
 });
 
-test('submitProviderCredentialForm preserves untouched API key positions as "***" on edit', async () => {
+test('submitProviderCredentialForm preserves untouched masked API key positions on edit', async () => {
     const requests = [];
     const module = createProvidersConfigModule({
         fetch: async (url, request) => {
@@ -154,7 +154,7 @@ test('submitProviderCredentialForm preserves untouched API key positions as "***
     const existing = {
         name: 'my-openai',
         type: 'openai',
-        api_keys: ['***', '***'],
+        api_keys: ['***********', '***********'],
         base_url: 'https://api.openai.com/v1',
         models: ['gpt-4o'],
         enabled: true,
@@ -163,14 +163,14 @@ test('submitProviderCredentialForm preserves untouched API key positions as "***
     module.providerCredentials = [existing];
     module.openProviderCredentialEdit(existing);
 
-    // Untouched: both rows stay "***". Only a newly added third key is real.
+    // Untouched: both rows stay masked. Only a newly added third key is real.
     module.providerCredentialForm.api_keys.push({ value: 'sk-new-key' });
 
     await module.submitProviderCredentialForm();
 
     assert.equal(requests.length, 1);
     const body = JSON.parse(requests[0].request.body);
-    assert.deepEqual(body.api_keys, ['***', '***', 'sk-new-key']);
+    assert.deepEqual(body.api_keys, ['***********', '***********', 'sk-new-key']);
     assert.equal(body.name, 'my-openai');
 });
 
@@ -297,9 +297,9 @@ test('filteredProviderCredentials matches name, type, and base URL', () => {
 
 test('providerCredentialAuthLabel infers auth mode from populated fields', () => {
     const module = createProvidersConfigModule();
-    assert.equal(module.providerCredentialAuthLabel({ api_keys: ['***'] }), '1 key');
-    assert.equal(module.providerCredentialAuthLabel({ api_keys: ['***', '***'] }), '2 keys');
-    assert.equal(module.providerCredentialAuthLabel({ service_account_json: '***' }), 'service account');
+    assert.equal(module.providerCredentialAuthLabel({ api_keys: ['***********'] }), '1 key');
+    assert.equal(module.providerCredentialAuthLabel({ api_keys: ['***********', '***********'] }), '2 keys');
+    assert.equal(module.providerCredentialAuthLabel({ service_account_json: '***********' }), 'service account');
     assert.equal(module.providerCredentialAuthLabel({ service_account_file: '/etc/gcp.json' }), 'service account');
     assert.equal(module.providerCredentialAuthLabel({ vertex_project: 'my-project' }), 'ADC');
     assert.equal(module.providerCredentialAuthLabel({}), 'keyless');
@@ -320,7 +320,7 @@ test('openProviderCredentialEdit prefills the form from a view row', () => {
     module.openProviderCredentialEdit({
         name: 'my-openai',
         type: 'openai',
-        api_keys: ['***'],
+        api_keys: ['***********'],
         base_url: 'https://api.openai.com/v1',
         models: ['gpt-4o', 'gpt-4o-mini'],
         enabled: false,
@@ -334,7 +334,7 @@ test('openProviderCredentialEdit prefills the form from a view row', () => {
     // Built inside the module's vm realm: compare structurally via JSON
     // rather than assert.deepEqual, which (under node:assert/strict) also
     // checks prototype identity and cross-realm plain objects fail that.
-    assert.equal(JSON.stringify(module.providerCredentialForm.api_keys), JSON.stringify([{ value: '***' }]));
+    assert.equal(JSON.stringify(module.providerCredentialForm.api_keys), JSON.stringify([{ value: '***********' }]));
     assert.equal(module.providerCredentialForm.models, 'gpt-4o, gpt-4o-mini');
     assert.equal(module.providerCredentialForm.enabled, false);
 });
diff --git a/internal/admin/dashboard/static/js/modules/providers.js b/internal/admin/dashboard/static/js/modules/providers.js
index 9718dc59..82818c80 100644
--- a/internal/admin/dashboard/static/js/modules/providers.js
+++ b/internal/admin/dashboard/static/js/modules/providers.js
@@ -246,11 +246,11 @@
                 const summary = this.providerStatus && this.providerStatus.summary ? this.providerStatus.summary : {};
                 const total = Number(summary.total || 0);
                 const healthy = Number(summary.healthy || 0);
-                if (total === 0) return 'No configured providers';
-                if (healthy === total) return 'All configured providers are healthy';
-                if (healthy === 0) return 'No configured providers are healthy';
-                return String(total - healthy) + ' provider' + (total - healthy === 1 ? '' : 's') +
-                    ' need' + (total - healthy === 1 ? 's' : '') + ' attention';
+                if (total === 0) return 'None configured';
+                if (healthy === total) return 'All healthy';
+                if (healthy === 0) return 'None healthy';
+                const attention = total - healthy;
+                return String(attention) + (attention === 1 ? ' needs' : ' need') + ' attention';
             },
 
             scrollToProviderStatusSection() {
diff --git a/internal/admin/dashboard/static/js/modules/providers.test.cjs b/internal/admin/dashboard/static/js/modules/providers.test.cjs
index fbc0be5a..6c743e76 100644
--- a/internal/admin/dashboard/static/js/modules/providers.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/providers.test.cjs
@@ -35,10 +35,20 @@ test('provider status summary and badge helpers map health states to stable clas
     assert.equal(module.providerStatusBadgeClass('unhealthy'), 'is-unhealthy');
     assert.equal(module.providerStatusRatioText(), '1/2');
     assert.equal(module.providerStatusHasIssues(), true);
-    assert.equal(module.providerStatusSummaryText(), '1 provider needs attention');
+    assert.equal(module.providerStatusSummaryText(), '1 needs attention');
 
     module.providerStatus.summary = { total: 2, healthy: 2, degraded: 0, unhealthy: 0, overall_status: 'healthy' };
     assert.equal(module.providerStatusHasIssues(), false);
+    assert.equal(module.providerStatusSummaryText(), 'All healthy');
+
+    module.providerStatus.summary = { total: 2, healthy: 0, degraded: 0, unhealthy: 2, overall_status: 'unhealthy' };
+    assert.equal(module.providerStatusSummaryText(), 'None healthy');
+
+    module.providerStatus.summary = { total: 3, healthy: 1, degraded: 2, unhealthy: 0, overall_status: 'degraded' };
+    assert.equal(module.providerStatusSummaryText(), '2 need attention');
+
+    module.providerStatus.summary = { total: 0, healthy: 0, degraded: 0, unhealthy: 0, overall_status: 'degraded' };
+    assert.equal(module.providerStatusSummaryText(), 'None configured');
 });
 
 test('provider helper methods format configured models and resilience summaries', () => {
diff --git a/internal/admin/dashboard/static/js/modules/virtual-models.js b/internal/admin/dashboard/static/js/modules/virtual-models.js
index 7585315a..37229fcc 100644
--- a/internal/admin/dashboard/static/js/modules/virtual-models.js
+++ b/internal/admin/dashboard/static/js/modules/virtual-models.js
@@ -7,6 +7,11 @@
             aliases: [],
             modelOverrideViews: [],
             displayModels: [],
+            displayModelGroups: [],
+            modelRenderLimit: 0,
+            modelRenderBatchSize: 75,
+            modelsRendering: false,
+            _modelRenderGeneration: 0,
             aliasLoading: false,
             aliasError: '',
             aliasNotice: '',
@@ -40,57 +45,63 @@
             },
 
             buildDisplayModels() {
-                const rows = this.models.map((model) => ({
-                    key: 'model:' + this.qualifiedModelName(model),
-                    display_name: this.qualifiedModelName(model),
-                    secondary_name: '',
-                    provider_name: model.provider_name || '',
-                    provider_type: model.provider_type || '',
-                    model: model.model,
-                    selector: model.selector || '',
-                    is_alias: false,
-                    alias: null,
-                    access: model && model.access ? model.access : null,
-                    kind_badge: '',
-                    masking_alias: null,
-                    has_virtual_model: false,
-                    alias_state_class: '',
-                    alias_state_text: ''
-                }));
-
-                if (!this.virtualModelsAvailable) {
-                    return rows;
-                }
-
                 const redirectsBySource = new Map();
-                for (const alias of this.aliases) {
-                    const aliasName = String(alias && alias.name || '').trim().toLowerCase();
-                    if (!aliasName || alias.enabled === false || !alias.valid) {
-                        continue;
+                if (this.virtualModelsAvailable) {
+                    for (const alias of this.aliases) {
+                        const aliasName = String(alias && alias.name || '').trim().toLowerCase();
+                        if (!aliasName || alias.enabled === false || !alias.valid) {
+                            continue;
+                        }
+                        redirectsBySource.set(aliasName, alias);
                     }
-                    redirectsBySource.set(aliasName, alias);
                 }
 
-                for (const row of rows) {
-                    for (const key of this.modelKeys(row)) {
-                        const redirect = redirectsBySource.get(key);
-                        if (!redirect) continue;
-                        row.masking_alias = redirect;
-                        row.has_virtual_model = true;
-                        break;
-                    }
-                    // A real model row carries a virtual model when an access policy
-                    // override exists for its selector.
-                    if (row.access && row.access.override) {
-                        row.has_virtual_model = true;
+                const concreteModelsByKey = new Map();
+                const rows = this.models.map((model) => {
+                    const displayName = this.qualifiedModelName(model);
+                    let maskingAlias = null;
+                    for (const key of this.modelKeys(model)) {
+                        if (!concreteModelsByKey.has(key)) {
+                            concreteModelsByKey.set(key, model);
+                        }
+                        if (!maskingAlias && redirectsBySource.has(key)) {
+                            maskingAlias = redirectsBySource.get(key);
+                        }
                     }
+                    const access = model && model.access ? model.access : null;
+                    return {
+                        key: 'model:' + displayName,
+                        display_name: displayName,
+                        secondary_name: '',
+                        provider_name: model.provider_name || '',
+                        provider_type: model.provider_type || '',
+                        model: model.model,
+                        selector: model.selector || '',
+                        is_alias: false,
+                        alias: null,
+                        access,
+                        kind_badge: '',
+                        masking_alias: maskingAlias,
+                        has_virtual_model: Boolean(maskingAlias || (access && access.override)),
+                        alias_state_class: '',
+                        alias_state_text: ''
+                    };
+                });
+
+                if (!this.virtualModelsAvailable) {
+                    return rows;
                 }
 
                 for (const alias of this.aliases) {
-                    if (alias && alias.enabled !== false && alias.valid && this.hasConcreteSourceModel(alias.name)) {
+                    const sourceModel = concreteModelsByKey.get(this.normalizedAliasName(alias && alias.name));
+                    if (alias && alias.enabled !== false && alias.valid && sourceModel) {
                         continue;
                     }
-                    const targetModel = this.findConcreteModelForAlias(alias);
+                    let targetModel = null;
+                    for (const key of this.aliasKeys(alias)) {
+                        targetModel = concreteModelsByKey.get(key) || null;
+                        if (targetModel) break;
+                    }
                     if (!targetModel && this.activeCategory && this.activeCategory !== 'all') {
                         continue;
                     }
@@ -108,7 +119,7 @@
                         access: null,
                         kind_badge: 'Virtual Model',
                         masking_alias: null,
-                        source_model_exists: this.hasConcreteSourceModel(alias.name),
+                        source_model_exists: Boolean(sourceModel),
                         has_virtual_model: true,
                         alias_state_class: this.aliasStateClass(alias),
                         alias_state_text: this.aliasStateText(alias)
@@ -125,6 +136,14 @@
 
             syncDisplayModels() {
                 this.displayModels = this.buildDisplayModels();
+                this.displayModelGroups = this.groupDisplayModels(this.displayModels);
+                if (this.page === 'models') {
+                    this.restartModelRendering();
+                } else {
+                    this._modelRenderGeneration += 1;
+                    this.modelRenderLimit = this.displayModels.length;
+                    this.modelsRendering = false;
+                }
             },
 
             get filteredDisplayModels() {
@@ -147,7 +166,62 @@
             },
 
             get filteredDisplayModelGroups() {
-                return this.groupDisplayModels(this.filteredDisplayModels);
+                const filtered = this.filteredDisplayModels;
+                const limit = Math.max(0, Math.min(Number(this.modelRenderLimit || 0), filtered.length));
+                if (!this.modelFilter && limit >= this.displayModels.length) {
+                    return this.displayModelGroups;
+                }
+                return this.groupDisplayModels(filtered.slice(0, limit));
+            },
+
+            modelsBusy() {
+                return Boolean(this.modelsLoading || this.modelsRendering);
+            },
+
+            modelLoadingText() {
+                if (this.modelsLoading) {
+                    return this.displayModels.length > 0 ? 'Refreshing models...' : 'Loading models...';
+                }
+                const total = this.filteredDisplayModels.length;
+                const visible = Math.min(Number(this.modelRenderLimit || 0), total);
+                return 'Rendering models... ' + visible + ' / ' + total;
+            },
+
+            restartModelRendering() {
+                const total = this.filteredDisplayModels.length;
+                const batchSize = Math.max(1, Number(this.modelRenderBatchSize || 75));
+                const generation = Number(this._modelRenderGeneration || 0) + 1;
+                this._modelRenderGeneration = generation;
+                this.modelRenderLimit = Math.min(batchSize, total);
+                this.modelsRendering = this.modelRenderLimit < total;
+                if (this.modelsRendering) {
+                    this.scheduleModelRenderBatch(generation);
+                }
+            },
+
+            scheduleModelRenderBatch(generation) {
+                const scheduleTimeout = typeof global.setTimeout === 'function'
+                    ? global.setTimeout.bind(global)
+                    : (callback) => callback();
+                const afterPaint = (callback) => {
+                    if (typeof global.requestAnimationFrame === 'function') {
+                        global.requestAnimationFrame(() => scheduleTimeout(callback, 0));
+                        return;
+                    }
+                    scheduleTimeout(callback, 0);
+                };
+                afterPaint(() => {
+                    if (generation !== this._modelRenderGeneration || this.page !== 'models') {
+                        return;
+                    }
+                    const total = this.filteredDisplayModels.length;
+                    const batchSize = Math.max(1, Number(this.modelRenderBatchSize || 75));
+                    this.modelRenderLimit = Math.min(total, this.modelRenderLimit + batchSize);
+                    this.modelsRendering = this.modelRenderLimit < total;
+                    if (this.modelsRendering) {
+                        this.scheduleModelRenderBatch(generation);
+                    }
+                });
             },
 
             defaultVirtualModelForm() {
diff --git a/internal/admin/dashboard/static/js/modules/virtual-models.test.cjs b/internal/admin/dashboard/static/js/modules/virtual-models.test.cjs
index 9b38fc20..8af1f0d2 100644
--- a/internal/admin/dashboard/static/js/modules/virtual-models.test.cjs
+++ b/internal/admin/dashboard/static/js/modules/virtual-models.test.cjs
@@ -72,6 +72,125 @@ test('filteredDisplayModels returns stable rows when filter is empty', () => {
     assert.equal(first[0].key, 'model:openai/davinci-002');
 });
 
+test('buildDisplayModels indexes concrete selectors once for alias matching', () => {
+    const module = createAliasesModule();
+    module.models = Array.from({ length: 400 }, (_, index) => ({
+        provider_name: `provider-${index % 4}`,
+        provider_type: 'test',
+        selector: `provider-${index % 4}/model-${index}`,
+        model: {
+            id: `model-${index}`,
+            object: 'model',
+            owned_by: 'test'
+        }
+    }));
+    module.aliases = Array.from({ length: 80 }, (_, index) => ({
+        name: `alias-${index}`,
+        target_model: `provider-0/model-${index * 4}`,
+        enabled: true,
+        valid: true
+    }));
+    module.activeCategory = 'all';
+
+    const modelKeys = module.modelKeys.bind(module);
+    let modelKeyCalls = 0;
+    module.modelKeys = (model) => {
+        modelKeyCalls += 1;
+        return modelKeys(model);
+    };
+
+    const rows = module.buildDisplayModels();
+
+    assert.equal(rows.length, 480);
+    assert.equal(modelKeyCalls, module.models.length);
+});
+
+test('Models page renders large inventories in paint-separated batches', () => {
+    const frames = [];
+    const timers = [];
+    const module = createAliasesModule({
+        window: {
+            requestAnimationFrame(callback) {
+                frames.push(callback);
+            },
+            setTimeout(callback) {
+                timers.push(callback);
+            }
+        }
+    });
+    module.page = 'models';
+    module.modelsLoading = false;
+    module.modelRenderBatchSize = 50;
+    module.modelFilter = '';
+    module.activeCategory = 'all';
+    module.models = Array.from({ length: 130 }, (_, index) => ({
+        provider_name: `provider-${index % 3}`,
+        provider_type: 'test',
+        selector: `provider-${index % 3}/model-${index}`,
+        model: {
+            id: `model-${index}`,
+            object: 'model',
+            owned_by: 'test'
+        }
+    }));
+
+    module.syncDisplayModels();
+
+    assert.equal(module.modelRenderLimit, 50);
+    assert.equal(module.modelsRendering, true);
+    assert.equal(module.modelsBusy(), true);
+    assert.equal(
+        module.filteredDisplayModelGroups.reduce((count, group) => count + group.rows.length, 0),
+        50
+    );
+    assert.equal(module.modelLoadingText(), 'Rendering models... 50 / 130');
+
+    frames.shift()();
+    timers.shift()();
+    assert.equal(module.modelRenderLimit, 100);
+    assert.equal(module.modelsRendering, true);
+
+    frames.shift()();
+    timers.shift()();
+    assert.equal(module.modelRenderLimit, 130);
+    assert.equal(module.modelsRendering, false);
+    assert.equal(module.modelsBusy(), false);
+    assert.strictEqual(module.filteredDisplayModelGroups, module.displayModelGroups);
+});
+
+test('Leaving the Models page stops queued render batches', () => {
+    const frames = [];
+    const timers = [];
+    const module = createAliasesModule({
+        window: {
+            requestAnimationFrame(callback) {
+                frames.push(callback);
+            },
+            setTimeout(callback) {
+                timers.push(callback);
+            }
+        }
+    });
+    module.page = 'models';
+    module.modelsLoading = false;
+    module.modelRenderBatchSize = 50;
+    module.models = Array.from({ length: 130 }, (_, index) => ({
+        provider_name: 'provider',
+        provider_type: 'test',
+        selector: `provider/model-${index}`,
+        model: { id: `model-${index}`, object: 'model', owned_by: 'test' }
+    }));
+
+    module.syncDisplayModels();
+    module.page = 'usage';
+    frames.shift()();
+    timers.shift()();
+
+    assert.equal(module.modelRenderLimit, 50);
+    assert.equal(frames.length, 0);
+    assert.equal(timers.length, 0);
+});
+
 test('qualifiedModelName prefers selector when available', () => {
     const module = createAliasesModule();
     const model = {
diff --git a/internal/admin/dashboard/templates/layout.html b/internal/admin/dashboard/templates/layout.html
index 2f930c8a..a7f1d3ae 100644
--- a/internal/admin/dashboard/templates/layout.html
+++ b/internal/admin/dashboard/templates/layout.html
@@ -80,10 +80,13 @@
             {{if .DemoMode}}
             <aside class="demo-mode-banner" role="alert" aria-label="Demo mode notice">
                 <i data-lucide="triangle-alert" class="demo-mode-banner-icon" aria-hidden="true"></i>
-                <div>
+                <div class="demo-mode-banner-copy">
                     <strong>Public demo</strong>
                     <span>Do not enter sensitive or personal data. Demo data is reset regularly.</span>
                 </div>
+                <nav class="demo-mode-banner-links" aria-label="GoModel website">
+                    <a href="https://gomodel.enterpilot.io/?utm_source=gomodel_dashboard&amp;utm_medium=demo_banner&amp;utm_campaign=public_demo" target="_blank" rel="noopener noreferrer">gomodel.enterpilot.io</a>
+                </nav>
             </aside>
             {{end}}
             {{template "index" .}}
diff --git a/internal/admin/dashboard/templates/page-audit-logs.html b/internal/admin/dashboard/templates/page-audit-logs.html
index 66f882ba..63c9a864 100644
--- a/internal/admin/dashboard/templates/page-audit-logs.html
+++ b/internal/admin/dashboard/templates/page-audit-logs.html
@@ -1,8 +1,8 @@
 {{define "dashboard-page-audit-logs"}}
 <!-- Audit Logs Page -->
 <template x-if="page==='audit-logs'">
-<div>
-    <div class="page-header">
+<div class="page-with-sticky-date">
+    <div class="page-header date-range-page-header">
         <div class="inline-help-section" x-data="{ open: false, copyId: 'audit-retention-help-copy', showLabel: 'Show retention help', hideLabel: 'Hide retention help', text: 'If you want to change the retention period, set LOGGING_RETENTION_DAYS (env var) or logging.retention_days (config.yaml) and restart the gateway. Default is 30 days; 0 keeps audit logs forever.' }">
             <h2>Audit Logs</h2>
             <div class="inline-help-title-row" x-show="auditRetentionText()">
@@ -11,14 +11,16 @@ <h2>Audit Logs</h2>
             </div>
             <p :id="copyId" class="inline-help-copy" x-show="open" x-transition.opacity.duration.200ms x-text="text"></p>
         </div>
-        <div class="page-header-controls">
-            {{template "date-picker" .}}
-        </div>
     </div>
+    <div class="sticky-date-range">{{template "date-picker" .}}</div>
 
     <!-- Auth Error Banner -->
     {{template "auth-banner" .}}
 
+    <div class="alert alert-warning" x-show="!workflowAuditVisible() && !authError" role="status">
+        Audit logging is off. Live entries are temporary and disappear after refresh. Set <code>LOGGING_ENABLED=true</code> to persist them.
+    </div>
+
     <div class="audit-log-section">
         <div class="audit-log-toolbar">
             <div class="audit-filter-row audit-filter-row-search">
diff --git a/internal/admin/dashboard/templates/page-models.html b/internal/admin/dashboard/templates/page-models.html
index b49ed7ae..ceca5b8e 100644
--- a/internal/admin/dashboard/templates/page-models.html
+++ b/internal/admin/dashboard/templates/page-models.html
@@ -34,7 +34,7 @@ <h2>Models</h2>
         <div class="table-toolbar-main">
             <div class="filter-input-wrap">
                 <i data-lucide="search" class="filter-input-icon" aria-hidden="true"></i>
-                <input type="text" placeholder="Filter by provider, provider/model, alias, or owner..." aria-label="Filter models by provider, provider/model, alias, or owner" x-model="modelFilter" class="filter-input">
+                <input type="text" placeholder="Filter by provider, provider/model, alias, or owner..." aria-label="Filter models by provider, provider/model, alias, or owner" x-model="modelFilter" @input.debounce.150ms="restartModelRendering()" class="filter-input">
             </div>
         </div>
         <div class="table-toolbar-actions">
@@ -45,9 +45,9 @@ <h2>Models</h2>
         </div>
     </div>
 
-    <div class="loading-state" x-show="modelsLoading && !authError" role="status" aria-live="polite">
+    <div class="loading-state models-loading-state" x-show="modelsBusy() && !authError" role="status" aria-live="polite">
         <span class="loading-spinner" aria-hidden="true"></span>
-        <span x-text="displayModels.length > 0 ? 'Refreshing models...' : 'Loading models...'"></span>
+        <span x-text="modelLoadingText()">Loading models...</span>
     </div>
 
     <div class="editor-modal-backdrop"
diff --git a/internal/admin/dashboard/templates/page-overview.html b/internal/admin/dashboard/templates/page-overview.html
index 83866643..285ef92e 100644
--- a/internal/admin/dashboard/templates/page-overview.html
+++ b/internal/admin/dashboard/templates/page-overview.html
@@ -1,7 +1,7 @@
 {{define "dashboard-page-overview"}}
 <!-- Overview Page -->
 <template x-if="page==='overview'">
-<div>
+<div class="page-with-sticky-date">
     <!-- Live Token Throughput -->
     <div class="chart-container live-tokens">
         <div class="chart-container-header">
@@ -53,12 +53,10 @@ <h3>Live Token Throughput</h3>
         </div>
     </div>
 
-    <div class="page-header">
+    <div class="page-header date-range-page-header">
         <h2>Usage Overview</h2>
-        <div class="page-header-controls">
-            {{template "date-picker" .}}
-        </div>
     </div>
+    <div class="sticky-date-range">{{template "date-picker" .}}</div>
 
     <!-- Auth Error Banner -->
     {{template "auth-banner" .}}
@@ -68,15 +66,15 @@ <h2>Usage Overview</h2>
         <div class="card card-wide">
             <div class="card-label">Tokens</div>
             <div class="card-value cache-token-value">
-                <span class="cache-token-part" title="Input tokens">
-                    <span x-text="formatNumber(summary.total_input_tokens)">-</span><span class="cache-token-marker">i</span>
+                <span class="cache-token-part" :title="tokenCountTitle('Input tokens', summary.total_input_tokens)">
+                    <span x-text="formatTokensShort(summary.total_input_tokens)">-</span><span class="cache-token-marker">i</span>
                 </span>
                 <span class="cache-token-operator">+</span>
-                <span class="cache-token-part" title="Output tokens">
-                    <span x-text="formatNumber(summary.total_output_tokens)">-</span><span class="cache-token-marker">o</span>
+                <span class="cache-token-part" :title="tokenCountTitle('Output tokens', summary.total_output_tokens)">
+                    <span x-text="formatTokensShort(summary.total_output_tokens)">-</span><span class="cache-token-marker">o</span>
                 </span>
                 <span class="cache-token-operator">=</span>
-                <span x-text="formatNumber(summaryTotalTokens())" title="Total tokens">-</span>
+                <span class="cache-token-part" x-text="formatTokensShort(summaryTotalTokens())" :title="tokenCountTitle('Total tokens', summaryTotalTokens())">-</span>
             </div>
         </div>
         <div class="card">
@@ -94,15 +92,15 @@ <h2>Usage Overview</h2>
         <div class="card card-wide" x-show="cacheAnalyticsEnabled()">
             <div class="card-label">Local Cache</div>
             <div class="card-value cache-token-value">
-                <span class="cache-token-part" title="Input tokens">
-                    <span x-text="formatNumber(cacheOverview.summary.total_input_tokens)">-</span><span class="cache-token-marker">i</span>
+                <span class="cache-token-part" :title="tokenCountTitle('Input tokens', cacheOverview.summary.total_input_tokens)">
+                    <span x-text="formatTokensShort(cacheOverview.summary.total_input_tokens)">-</span><span class="cache-token-marker">i</span>
                 </span>
                 <span class="cache-token-operator">+</span>
-                <span class="cache-token-part" title="Output tokens">
-                    <span x-text="formatNumber(cacheOverview.summary.total_output_tokens)">-</span><span class="cache-token-marker">o</span>
+                <span class="cache-token-part" :title="tokenCountTitle('Output tokens', cacheOverview.summary.total_output_tokens)">
+                    <span x-text="formatTokensShort(cacheOverview.summary.total_output_tokens)">-</span><span class="cache-token-marker">o</span>
                 </span>
                 <span class="cache-token-operator">=</span>
-                <span x-text="formatNumber(cacheOverviewTotalTokens())" title="Total tokens">-</span>
+                <span class="cache-token-part" x-text="formatTokensShort(cacheOverviewTotalTokens())" :title="tokenCountTitle('Total tokens', cacheOverviewTotalTokens())">-</span>
             </div>
         </div>
         <div class="card prompt-cache-card" title="Share of input tokens served from the provider prompt cache, over the selected period">
@@ -112,7 +110,7 @@ <h2>Usage Overview</h2>
                 <span class="prompt-cache-gauge-value" x-text="promptCacheRateText()">-</span>
             </div>
         </div>
-        <div class="card provider-status-flag" x-show="providerStatus.summary.total > 0" :class="providerStatusSummaryClass()">
+        <div class="card provider-status-flag provider-status-overview-card" x-show="providerStatus.summary.total > 0" :class="providerStatusSummaryClass()">
             <div class="card-label">Provider Status</div>
             <div class="card-value provider-status-value" x-text="providerStatusRatioText()">-</div>
             <button type="button"
diff --git a/internal/admin/dashboard/templates/page-providers-config.html b/internal/admin/dashboard/templates/page-providers-config.html
index ad0c3cfd..70f5b37e 100644
--- a/internal/admin/dashboard/templates/page-providers-config.html
+++ b/internal/admin/dashboard/templates/page-providers-config.html
@@ -111,7 +111,7 @@ <h3 x-text="providerCredentialFormMode === 'edit' ? 'Edit Provider' : 'Add Provi
                             <span>Add key</span>
                         </button>
                     </div>
-                    <small class="form-hint">Multiple keys rotate round-robin. Saved values are shown as <code>***</code>; leave <code>***</code> unchanged to keep the stored key. Not every provider type needs a key (e.g. Ollama, or Vertex/Bedrock using ADC).</small>
+                    <small class="form-hint">Multiple keys rotate round-robin. Saved values are shown as <code>***********</code>; leave the asterisks unchanged to keep the stored key. Not every provider type needs a key (e.g. Ollama, or Vertex/Bedrock using ADC).</small>
                 </div>
 
                 <div class="vm-status-row">
@@ -186,13 +186,13 @@ <h3 x-text="providerCredentialFormMode === 'edit' ? 'Edit Provider' : 'Add Provi
                         <div class="form-field">
                             <label class="form-field-label" for="provider-credential-service-account-json">Service Account JSON</label>
                             <textarea id="provider-credential-service-account-json" rows="4" class="mono" placeholder="Paste service account JSON" x-model="providerCredentialForm.service_account_json"></textarea>
-                            <small class="form-hint">Saved values are shown as <code>***</code>; leave <code>***</code> unchanged to keep the stored value, or clear it to remove.</small>
+                            <small class="form-hint">Saved values are shown as <code>***********</code>; leave the asterisks unchanged to keep the stored value, or clear it to remove.</small>
                         </div>
 
                         <div class="form-field">
                             <label class="form-field-label" for="provider-credential-service-account-json-base64">Service Account JSON (base64)</label>
                             <input id="provider-credential-service-account-json-base64" type="text" class="mono" x-model="providerCredentialForm.service_account_json_base64">
-                            <small class="form-hint">Saved values are shown as <code>***</code>; leave <code>***</code> unchanged to keep the stored value.</small>
+                            <small class="form-hint">Saved values are shown as <code>***********</code>; leave the asterisks unchanged to keep the stored value.</small>
                         </div>
 
                         <div class="form-field">
diff --git a/internal/admin/dashboard/templates/page-usage.html b/internal/admin/dashboard/templates/page-usage.html
index 8da68376..134662b6 100644
--- a/internal/admin/dashboard/templates/page-usage.html
+++ b/internal/admin/dashboard/templates/page-usage.html
@@ -1,17 +1,17 @@
 {{define "dashboard-page-usage"}}
 <!-- Usage Page -->
 <template x-if="page==='usage'">
-<div>
-    <div class="page-header">
+<div class="page-with-sticky-date">
+    <div class="page-header date-range-page-header">
         <h2>Usage Analytics</h2>
         <div class="page-header-controls">
             <div class="usage-mode-toggle">
                 <button type="button" class="usage-mode-btn" :class="{active: usageMode==='tokens'}" @click="toggleUsageMode('tokens')">Tokens</button>
                 <button type="button" class="usage-mode-btn" :class="{active: usageMode==='costs'}" @click="toggleUsageMode('costs')">Costs</button>
             </div>
-            {{template "date-picker" .}}
         </div>
     </div>
+    <div class="sticky-date-range">{{template "date-picker" .}}</div>
 
     <!-- Auth Error Banner -->
     {{template "auth-banner" .}}
diff --git a/internal/admin/handler_provider_credentials.go b/internal/admin/handler_provider_credentials.go
index 3dfdfb5c..8511fb31 100644
--- a/internal/admin/handler_provider_credentials.go
+++ b/internal/admin/handler_provider_credentials.go
@@ -27,14 +27,15 @@ type ProviderCredentialsAdmin interface {
 }
 
 // redactedCredentialValue replaces secret values (API keys, service account
-// JSON) in admin views. An upsert that sends the placeholder back keeps the
-// currently stored value, so the dashboard can round-trip a provider
-// definition without ever seeing its secrets again.
-const redactedCredentialValue = "***"
+// JSON) in admin views. An all-asterisk value of at least three characters is
+// accepted on upsert to keep the currently stored value, so older dashboard
+// clients that send "***" remain compatible.
+const redactedCredentialValue = "***********"
 
 // upsertProviderCredentialRequest is the admin upsert contract for one
-// provider credential. "***" in api_keys or the service-account fields
-// preserves the stored value at that position.
+// provider credential. A value containing only three or more asterisks in
+// api_keys or the service-account fields preserves the stored value at that
+// position.
 type upsertProviderCredentialRequest struct {
 	Name                     string   `json:"name"`
 	Type                     string   `json:"type"`
@@ -58,20 +59,20 @@ type upsertProviderCredentialRequest struct {
 // credential: its definition (secrets redacted) plus whether it is read-only
 // (config/env-declared).
 type providerCredentialViewResponse struct {
-	Name                     string    `json:"name"`
-	Type                     string    `json:"type"`
-	APIKeys                  []string  `json:"api_keys,omitempty"`
-	BaseURL                  string    `json:"base_url,omitempty"`
-	APIVersion               string    `json:"api_version,omitempty"`
-	Backend                  string    `json:"backend,omitempty"`
-	AuthType                 string    `json:"auth_type,omitempty"`
-	APIMode                  string    `json:"api_mode,omitempty"`
-	VertexProject            string    `json:"vertex_project,omitempty"`
-	VertexLocation           string    `json:"vertex_location,omitempty"`
-	ServiceAccountFile       string    `json:"service_account_file,omitempty"`
-	ServiceAccountJSON       string    `json:"service_account_json,omitempty"`
-	ServiceAccountJSONBase64 string    `json:"service_account_json_base64,omitempty"`
-	GCPScope                 string    `json:"gcp_scope,omitempty"`
+	Name                     string     `json:"name"`
+	Type                     string     `json:"type"`
+	APIKeys                  []string   `json:"api_keys,omitempty"`
+	BaseURL                  string     `json:"base_url,omitempty"`
+	APIVersion               string     `json:"api_version,omitempty"`
+	Backend                  string     `json:"backend,omitempty"`
+	AuthType                 string     `json:"auth_type,omitempty"`
+	APIMode                  string     `json:"api_mode,omitempty"`
+	VertexProject            string     `json:"vertex_project,omitempty"`
+	VertexLocation           string     `json:"vertex_location,omitempty"`
+	ServiceAccountFile       string     `json:"service_account_file,omitempty"`
+	ServiceAccountJSON       string     `json:"service_account_json,omitempty"`
+	ServiceAccountJSONBase64 string     `json:"service_account_json_base64,omitempty"`
+	GCPScope                 string     `json:"gcp_scope,omitempty"`
 	Models                   []string   `json:"models,omitempty"`
 	Enabled                  bool       `json:"enabled"`
 	Managed                  bool       `json:"managed"`
@@ -192,7 +193,7 @@ func (h *Handler) UpsertProviderCredential(c *echo.Context) error {
 	}
 
 	// Serialize provider-credential mutations: buildProviderCredentialUpsert
-	// reads the current stored row (to resolve "***" placeholders) and then
+	// reads the current stored row (to resolve redacted placeholders) and then
 	// writes it back, so two concurrent edits of the same name could
 	// otherwise interleave and leave the store and registry inconsistent.
 	h.mutationMu.Lock()
@@ -237,8 +238,9 @@ func (h *Handler) DeleteProviderCredential(c *echo.Context) error {
 }
 
 // buildProviderCredentialUpsert maps the request onto a validated
-// ManagedProviderCredential, resolving "***" placeholders against the stored
-// row so the dashboard never has to re-submit real secrets on every edit.
+// ManagedProviderCredential, resolving redacted placeholders against the
+// stored row so the dashboard never has to re-submit real secrets on every
+// edit.
 func (h *Handler) buildProviderCredentialUpsert(ctx context.Context, name string, req upsertProviderCredentialRequest) (providers.ManagedProviderCredential, error) {
 	current, err := h.providerCredentials.Get(ctx, name)
 	if err != nil && !errors.Is(err, providers.ErrCredentialNotFound) {
@@ -303,7 +305,7 @@ func currentField(current *providers.ManagedProviderCredential, get func(provide
 	return get(*current)
 }
 
-// mergeRedactedList resolves "***" placeholders in an ordered secret list
+// mergeRedactedList resolves all-asterisk placeholders in an ordered secret list
 // (API key rotation) positionally against the stored list. A placeholder past
 // the end of the stored list has nothing to preserve and is rejected, the
 // same rule mergeRedactedMCPHeaders applies to headers.
@@ -313,7 +315,7 @@ func mergeRedactedList(incoming, stored []string) ([]string, error) {
 	}
 	merged := make([]string, len(incoming))
 	for i, value := range incoming {
-		if value != redactedCredentialValue {
+		if !isRedactedCredentialValue(value) {
 			merged[i] = value
 			continue
 		}
@@ -325,10 +327,10 @@ func mergeRedactedList(incoming, stored []string) ([]string, error) {
 	return merged, nil
 }
 
-// mergeRedactedValue resolves a single "***" placeholder against the stored
-// value.
+// mergeRedactedValue resolves a single all-asterisk placeholder against the
+// stored value.
 func mergeRedactedValue(incoming, stored string) (string, error) {
-	if incoming != redactedCredentialValue {
+	if !isRedactedCredentialValue(incoming) {
 		return incoming, nil
 	}
 	if stored == "" {
@@ -337,6 +339,14 @@ func mergeRedactedValue(incoming, stored string) (string, error) {
 	return stored, nil
 }
 
+// isRedactedCredentialValue recognizes both the current display mask and
+// legacy masks emitted by older dashboard versions. Requiring at least three
+// asterisks avoids treating a stray single character as an intentional
+// preserve-secret sentinel.
+func isRedactedCredentialValue(value string) bool {
+	return len(value) >= 3 && strings.Trim(value, "*") == ""
+}
+
 // providerCredentialView converts one stored row into the admin response
 // shape, redacting secrets.
 func (h *Handler) providerCredentialView(cred providers.ManagedProviderCredential) providerCredentialViewResponse {
diff --git a/internal/admin/handler_provider_credentials_test.go b/internal/admin/handler_provider_credentials_test.go
index b32eb244..0c5602f2 100644
--- a/internal/admin/handler_provider_credentials_test.go
+++ b/internal/admin/handler_provider_credentials_test.go
@@ -157,7 +157,7 @@ func TestListProviderCredentials_RedactsSecretsAndFlagsManaged(t *testing.T) {
 	if multiKey.Managed {
 		t.Fatal("multi-key.Managed = true, want false (admin-store row)")
 	}
-	if len(multiKey.APIKeys) != 1 || multiKey.APIKeys[0] != redactedCredentialValue {
+	if len(multiKey.APIKeys) != 1 || multiKey.APIKeys[0] != "***********" {
 		t.Fatalf("multi-key.APIKeys = %#v, want one redacted entry", multiKey.APIKeys)
 	}
 
@@ -165,7 +165,7 @@ func TestListProviderCredentials_RedactsSecretsAndFlagsManaged(t *testing.T) {
 	if vertex.Managed {
 		t.Fatal("local-vertex.Managed = true, want false (admin-store row)")
 	}
-	if vertex.ServiceAccountJSON != redactedCredentialValue {
+	if vertex.ServiceAccountJSON != "***********" {
 		t.Fatalf("local-vertex.ServiceAccountJSON = %q, want redacted", vertex.ServiceAccountJSON)
 	}
 }
@@ -305,6 +305,29 @@ func TestUpsertProviderCredential_RedactedKeyPreservesStoredValuePositionally(t
 	}
 }
 
+func TestUpsertProviderCredential_LongerRedactedKeyPreservesStoredValue(t *testing.T) {
+	fake := newProviderCredentialsAdminFake()
+	fake.rows["single"] = providers.ManagedProviderCredential{
+		Name:    "single",
+		Type:    "openai",
+		APIKeys: []string{"sk-secret"},
+		Enabled: true,
+	}
+	h := newProviderCredentialsHandler(fake)
+
+	c, rec := newProviderCredentialContext(http.MethodPut, "/admin/provider-credentials", `{"name":"single","type":"openai","api_keys":["***********"]}`)
+	if err := h.UpsertProviderCredential(c); err != nil {
+		t.Fatalf("UpsertProviderCredential() error = %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 body=%s", rec.Code, rec.Body.String())
+	}
+	stored := fake.rows["single"]
+	if len(stored.APIKeys) != 1 || stored.APIKeys[0] != "sk-secret" {
+		t.Fatalf("stored.APIKeys = %#v, want [sk-secret]", stored.APIKeys)
+	}
+}
+
 func TestUpsertProviderCredential_RedactedKeyBeyondStoredLengthIsRejected(t *testing.T) {
 	fake := newProviderCredentialsAdminFake()
 	fake.rows["single"] = providers.ManagedProviderCredential{
diff --git a/internal/providers/registry.go b/internal/providers/registry.go
index e426ac0c..ecf11b4d 100644
--- a/internal/providers/registry.go
+++ b/internal/providers/registry.go
@@ -286,12 +286,10 @@ func (r *ModelRegistry) RegisterProviderWithNameAndType(provider core.Provider,
 }
 
 // UnregisterProvider removes every provider instance registered under name
-// (normally at most one) so a subsequent Refresh rebuilds the catalog without
-// it. It only drops the registration bookkeeping — model/inventory maps are
-// left for the caller's follow-up Refresh to rebuild wholesale, since
-// applyFetchedInventory already replaces modelsByProvider and r.models from
-// scratch rather than merging into them. Safe to call for a name that was
-// never registered.
+// (normally at most one) and immediately removes its models from the live
+// catalog. Callers may still Refresh afterward to update the remaining
+// providers, but a failed or slow refresh must not leave deleted-provider
+// models visible. Safe to call for a name that was never registered.
 func (r *ModelRegistry) UnregisterProvider(providerName string) {
 	providerName = strings.TrimSpace(providerName)
 	if providerName == "" {
@@ -315,6 +313,8 @@ func (r *ModelRegistry) UnregisterProvider(providerName string) {
 	delete(r.providerRuntime, providerName)
 	delete(r.configMetadataOverrides, providerName)
 	delete(r.configuredProviderModels, providerName)
+	delete(r.modelsByProvider, providerName)
+	r.models = rebuildGlobalModelMap(r.modelsByProvider, r.freshFirstProviderOrderLocked())
 	r.invalidateSortedCaches()
 }
 
diff --git a/internal/providers/registry_init.go b/internal/providers/registry_init.go
index 14aeb4f4..4934f154 100644
--- a/internal/providers/registry_init.go
+++ b/internal/providers/registry_init.go
@@ -61,7 +61,7 @@ func (r *ModelRegistry) initialize(ctx context.Context) error {
 		// outages where /models is unreachable but inference still works.
 		// Individual providers are still marked stale by the per-provider
 		// recheck path as soon as a healthy alternative reappears.
-		r.applyProviderRuntimeUpdates(fetched.runtimeUpdates)
+		r.applyFetchedProviderRuntimeUpdates(&fetched)
 		if fetched.failedProviders == len(providers) {
 			return fmt.Errorf("failed to fetch models from any provider")
 		}
@@ -93,6 +93,7 @@ type fetchedInventory struct {
 	models           map[string]*ModelInfo
 	modelsByProvider map[string]map[string]*ModelInfo
 	runtimeUpdates   map[string]providerRuntimeState
+	sourceProviders  map[string]core.Provider
 	totalModels      int
 	failedProviders  int
 }
@@ -113,6 +114,7 @@ func (r *ModelRegistry) fetchAllProviderModels(
 		models:           make(map[string]*ModelInfo),
 		modelsByProvider: make(map[string]map[string]*ModelInfo),
 		runtimeUpdates:   make(map[string]providerRuntimeState),
+		sourceProviders:  make(map[string]core.Provider),
 	}
 
 	names := make([]string, len(providers))
@@ -160,6 +162,7 @@ func (r *ModelRegistry) fetchAllProviderModels(
 
 	for i, provider := range providers {
 		providerName := names[i]
+		out.sourceProviders[providerName] = provider
 		configuredModels := configuredProviderModels[providerName]
 		resp := results[i].resp
 		configuredReason := results[i].configuredReason
@@ -301,6 +304,7 @@ func (r *ModelRegistry) applyFetchedInventory(
 	metadataStats := r.enrichFetchedProviderModelMaps(providerTypes, fetched.modelsByProvider)
 
 	r.mu.Lock()
+	r.dropUnregisteredFetchedProvidersLocked(&fetched)
 	stale := make(map[string]bool, len(fetched.runtimeUpdates))
 	carriedForward := 0
 	for name := range fetched.runtimeUpdates {
@@ -342,6 +346,34 @@ func (r *ModelRegistry) applyFetchedInventory(
 	slog.Info("model registry initialized", attrs...)
 }
 
+// dropUnregisteredFetchedProvidersLocked prevents an inventory sweep that
+// started before a provider was removed or replaced from publishing that
+// provider instance's stale result afterward. Caller must hold r.mu for writing.
+func (r *ModelRegistry) dropUnregisteredFetchedProvidersLocked(fetched *fetchedInventory) {
+	for name := range fetched.modelsByProvider {
+		if !r.fetchedProviderStillRegisteredLocked(fetched, name) {
+			delete(fetched.modelsByProvider, name)
+		}
+	}
+	for name := range fetched.runtimeUpdates {
+		if !r.fetchedProviderStillRegisteredLocked(fetched, name) {
+			delete(fetched.runtimeUpdates, name)
+		}
+	}
+}
+
+// fetchedProviderStillRegisteredLocked verifies both the configured name and
+// the provider instance. A name-only check is insufficient when dashboard
+// credential edits replace a provider while its old model fetch is in flight.
+func (r *ModelRegistry) fetchedProviderStillRegisteredLocked(fetched *fetchedInventory, providerName string) bool {
+	provider, ok := fetched.sourceProviders[providerName]
+	if !ok || !r.providerRuntime[providerName].registered {
+		return false
+	}
+	currentName, ok := r.providerNames[provider]
+	return ok && currentName == providerName
+}
+
 func (r *ModelRegistry) enrichFetchedProviderModelMaps(
 	providerTypes map[core.Provider]string,
 	modelsByProvider map[string]map[string]*ModelInfo,
@@ -395,15 +427,16 @@ func fetchProviderInventory(
 	return resp, reason, fetchAt, err
 }
 
-func (r *ModelRegistry) applyProviderRuntimeUpdates(updates map[string]providerRuntimeState) {
-	if len(updates) == 0 {
+func (r *ModelRegistry) applyFetchedProviderRuntimeUpdates(fetched *fetchedInventory) {
+	if fetched == nil || len(fetched.runtimeUpdates) == 0 {
 		return
 	}
 
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	r.applyProviderRuntimeUpdatesLocked(updates)
+	r.dropUnregisteredFetchedProvidersLocked(fetched)
+	r.applyProviderRuntimeUpdatesLocked(fetched.runtimeUpdates)
 }
 
 func (r *ModelRegistry) applyProviderRuntimeUpdatesLocked(updates map[string]providerRuntimeState) {
diff --git a/internal/providers/registry_provider_refresh.go b/internal/providers/registry_provider_refresh.go
index 83033680..a179deab 100644
--- a/internal/providers/registry_provider_refresh.go
+++ b/internal/providers/registry_provider_refresh.go
@@ -70,7 +70,7 @@ func (r *ModelRegistry) RefreshProviderModels(ctx context.Context, providerSelec
 
 	if fetched.totalModels == 0 {
 		if fetched.failedProviders == len(providers) {
-			r.applyProviderRuntimeUpdates(fetched.runtimeUpdates)
+			r.applyFetchedProviderRuntimeUpdates(&fetched)
 			r.markFailedRefreshProvidersStale(fetched)
 			return 0, core.NewProviderError(providerSelector, http.StatusServiceUnavailable, "failed to refresh provider models", fetchedProviderRefreshError(fetched))
 		}
@@ -193,6 +193,7 @@ func (r *ModelRegistry) applyFetchedProviderInventory(providerTypes map[core.Pro
 	metadataStats := r.enrichFetchedProviderModelMaps(providerTypes, fetched.modelsByProvider)
 
 	r.mu.Lock()
+	r.dropUnregisteredFetchedProvidersLocked(&fetched)
 	for providerName, providerModels := range fetched.modelsByProvider {
 		r.modelsByProvider[providerName] = providerModels
 		// A refresh that produced inventory is authoritative again.
diff --git a/internal/providers/registry_unregister_test.go b/internal/providers/registry_unregister_test.go
index e4763d4d..dd775661 100644
--- a/internal/providers/registry_unregister_test.go
+++ b/internal/providers/registry_unregister_test.go
@@ -2,13 +2,50 @@ package providers
 
 import (
 	"context"
+	"io"
 	"testing"
 
 	"github.com/enterpilot/gomodel/internal/core"
 )
 
+type blockingRegistryProvider struct {
+	models  *core.ModelsResponse
+	started chan struct{}
+	release chan struct{}
+}
+
+func (p *blockingRegistryProvider) ListModels(ctx context.Context) (*core.ModelsResponse, error) {
+	close(p.started)
+	select {
+	case <-p.release:
+		return p.models, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+func (p *blockingRegistryProvider) ChatCompletion(context.Context, *core.ChatRequest) (*core.ChatResponse, error) {
+	return nil, nil
+}
+
+func (p *blockingRegistryProvider) StreamChatCompletion(context.Context, *core.ChatRequest) (io.ReadCloser, error) {
+	return nil, nil
+}
+
+func (p *blockingRegistryProvider) Responses(context.Context, *core.ResponsesRequest) (*core.ResponsesResponse, error) {
+	return nil, nil
+}
+
+func (p *blockingRegistryProvider) StreamResponses(context.Context, *core.ResponsesRequest) (io.ReadCloser, error) {
+	return nil, nil
+}
+
+func (p *blockingRegistryProvider) Embeddings(context.Context, *core.EmbeddingRequest) (*core.EmbeddingResponse, error) {
+	return nil, nil
+}
+
 func TestModelRegistry_UnregisterProvider(t *testing.T) {
-	t.Run("removes a registered provider and its models after Refresh", func(t *testing.T) {
+	t.Run("removes a registered provider and its models immediately", func(t *testing.T) {
 		registry := NewModelRegistry()
 		keep := &registryMockProvider{
 			name: "keep",
@@ -38,12 +75,8 @@ func TestModelRegistry_UnregisterProvider(t *testing.T) {
 		if got := registry.ProviderCount(); got != 1 {
 			t.Fatalf("ProviderCount() after UnregisterProvider = %d, want 1", got)
 		}
-
-		if err := registry.Refresh(context.Background()); err != nil {
-			t.Fatalf("Refresh() error = %v", err)
-		}
 		if got := registry.ModelCount(); got != 1 {
-			t.Fatalf("ModelCount() after Refresh = %d, want 1", got)
+			t.Fatalf("ModelCount() after UnregisterProvider = %d, want 1", got)
 		}
 		if !registry.Supports("keep/keep-model") {
 			t.Error("Supports(keep/keep-model) = false, want true")
@@ -56,6 +89,115 @@ func TestModelRegistry_UnregisterProvider(t *testing.T) {
 		}
 	})
 
+	t.Run("promotes another provider for an overlapping bare model", func(t *testing.T) {
+		registry := NewModelRegistry()
+		first := &registryMockProvider{
+			name: "first",
+			modelsResponse: &core.ModelsResponse{
+				Object: "list",
+				Data:   []core.Model{{ID: "shared", Object: "model", OwnedBy: "first"}},
+			},
+		}
+		second := &registryMockProvider{
+			name: "second",
+			modelsResponse: &core.ModelsResponse{
+				Object: "list",
+				Data:   []core.Model{{ID: "shared", Object: "model", OwnedBy: "second"}},
+			},
+		}
+		registry.RegisterProviderWithNameAndType(first, "first", "test")
+		registry.RegisterProviderWithNameAndType(second, "second", "test")
+		if err := registry.Initialize(context.Background()); err != nil {
+			t.Fatalf("Initialize() error = %v", err)
+		}
+
+		registry.UnregisterProvider("first")
+
+		if got := registry.GetProvider("shared"); got != second {
+			t.Fatalf("GetProvider(shared) = %T %p, want second provider %p", got, got, second)
+		}
+		if registry.Supports("first/shared") {
+			t.Error("Supports(first/shared) = true, want false")
+		}
+		if !registry.Supports("second/shared") {
+			t.Error("Supports(second/shared) = false, want true")
+		}
+	})
+
+	t.Run("an in-flight refresh cannot restore a removed provider", func(t *testing.T) {
+		registry := NewModelRegistry()
+		drop := &registryMockProvider{name: "drop"}
+		registry.RegisterProviderWithNameAndType(drop, "drop", "test")
+		registry.UnregisterProvider("drop")
+
+		staleModel := &ModelInfo{
+			Model:        core.Model{ID: "stale-model", Object: "model", OwnedBy: "drop"},
+			Provider:     drop,
+			ProviderName: "drop",
+			ProviderType: "test",
+		}
+		registry.applyFetchedInventory(map[core.Provider]string{drop: "test"}, fetchedInventory{
+			models:           map[string]*ModelInfo{"stale-model": staleModel},
+			modelsByProvider: map[string]map[string]*ModelInfo{"drop": {"stale-model": staleModel}},
+			runtimeUpdates:   map[string]providerRuntimeState{"drop": {registered: true}},
+			totalModels:      1,
+		}, 1)
+
+		if got := registry.ModelCount(); got != 0 {
+			t.Fatalf("ModelCount() after stale refresh result = %d, want 0", got)
+		}
+		if registry.Supports("drop/stale-model") {
+			t.Error("Supports(drop/stale-model) = true, want false")
+		}
+	})
+
+	t.Run("an in-flight refresh cannot overwrite a same-name replacement", func(t *testing.T) {
+		registry := NewModelRegistry()
+		oldProvider := &blockingRegistryProvider{
+			models: &core.ModelsResponse{
+				Object: "list",
+				Data:   []core.Model{{ID: "old-model", Object: "model", OwnedBy: "old"}},
+			},
+			started: make(chan struct{}),
+			release: make(chan struct{}),
+		}
+		newProvider := &registryMockProvider{
+			name: "new",
+			modelsResponse: &core.ModelsResponse{
+				Object: "list",
+				Data:   []core.Model{{ID: "new-model", Object: "model", OwnedBy: "new"}},
+			},
+		}
+		registry.RegisterProviderWithNameAndType(oldProvider, "shared", "test")
+
+		refreshDone := make(chan error, 1)
+		go func() {
+			refreshDone <- registry.Initialize(context.Background())
+		}()
+		<-oldProvider.started
+
+		registry.UnregisterProvider("shared")
+		registry.RegisterProviderWithNameAndType(newProvider, "shared", "test")
+		close(oldProvider.release)
+		if err := <-refreshDone; err != nil {
+			t.Fatalf("old Initialize() error = %v", err)
+		}
+
+		if registry.Supports("shared/old-model") {
+			t.Error("Supports(shared/old-model) = true, want false for replaced provider")
+		}
+		if got := registry.GetProvider("old-model"); got != nil {
+			t.Fatalf("GetProvider(old-model) = %T, want nil", got)
+		}
+
+		if err := registry.Initialize(context.Background()); err != nil {
+			t.Fatalf("replacement Initialize() error = %v", err)
+		}
+		if got := registry.GetProvider("shared/new-model"); got != newProvider {
+			t.Fatalf("GetProvider(shared/new-model) = %T, want replacement provider", got)
+		}
+	})
+
 	t.Run("is a no-op for a name that was never registered", func(t *testing.T) {
 		registry := NewModelRegistry()
 		mock := &registryMockProvider{name: "only"}