@@ -39,7 +39,7 @@
 
 from keel import agent
 from keel.commands._products import _history_product, parse_products_option
-from keel.commands.admission import ScreenFn, build_screen_report
+from keel.commands.admission import ScreenFn, ScreenReport, build_screen_report
 from keel.commands.rules import RulesOutcome, RulesRefused, RulesUsageError, add_rule_row
 from keel.config import Config
 from keel.data.repository import Repository
@@ -300,22 +300,28 @@ def select_universe(
     *,
     screen_fn: ScreenFn,
     weights_override: Mapping[str, Decimal] | None = None,
+    screen_report_fn: Callable[[Repository, Config, ScreenFn], ScreenReport] = build_screen_report,
 ) -> Universe:
     """allowlist ∩ admitted ∩ positive weight, minus assets with a non-disabled DCA rule.
 
     Admission comes from `build_screen_report` with the injected `screen_fn`
     (`keel.commands.assets.screen_product` in production) -- the one gate every candidate source
     routes through, never a laxer copy. READ-ONLY: this writes nothing.
+
+    `screen_report_fn` defaults to `build_screen_report` itself, so every caller before #856 is
+    unaffected. `keel/web/api.py`'s `read_dca_plan` is the one caller that passes something else --
+    a lookup into its `ServeConfig`'s `ScreenCache` -- so `/rules?budget=`'s 15s poll does not
+    re-screen the whole allowlist against the database on every reload. `screen_fn` itself is left
+    untouched by that: a cache HIT never even reaches `screen_fn`, and a MISS calls it exactly the
+    way `build_screen_report` always has.
     """
     quote = config.quote_currency
     # #849: the allowlist names assets, so a repeat (`[BTC, ETH, btc]` passes `load_config`) is
     # the SAME asset -- one allocation, one buy, one rule. `dict.fromkeys` keeps first-seen order;
     # nothing is dropped, because a repeat carries no weight of its own.
     allowlist = list(dict.fromkeys(asset.upper() for asset in config.allowlist))
     weights = _weights_by_asset(config.target_weights, "target_weights")
-    admitted = {
-        sp.asset.upper(): sp for sp in build_screen_report(repo, config, screen_fn).screened
-    }
+    admitted = {sp.asset.upper(): sp for sp in screen_report_fn(repo, config, screen_fn).screened}
     existing = existing_dca_rules(repo)
     existing_by_asset = {rule.asset: rule for rule in existing}
 
@@ -801,9 +807,13 @@ def build_dca_plan(
     now_ts: int,
     screen_fn: ScreenFn,
     weights_override: Mapping[str, Decimal] | None = None,
+    screen_report_fn: Callable[[Repository, Config, ScreenFn], ScreenReport] = build_screen_report,
 ) -> DcaPlan:
     """The whole proposal, every figure computed here and nowhere downstream. READ-ONLY.
 
+    `screen_report_fn` is threaded straight through to `select_universe`, unchanged -- see that
+    function's docstring for why it exists (#856's screen cache).
+
     Per buy: `monthly share x cadence_days / (365.25/12)`, rounded DOWN to cents; the monthly
     total is recomputed from that rounded buy and rounded down again; the fee estimate at the
     CONFIGURED `fees.taker_pct` is rounded UP (R5). Blockers (R6, R8) make the plan
@@ -840,7 +850,13 @@ def build_dca_plan(
     `None`) for a test to check directly, and `/api/dca-plan`'s card shows the identical sentence
     because it reads `plan.blockers` verbatim, as it always has.
     """
-    universe = select_universe(repo, config, screen_fn=screen_fn, weights_override=weights_override)
+    universe = select_universe(
+        repo,
+        config,
+        screen_fn=screen_fn,
+        weights_override=weights_override,
+        screen_report_fn=screen_report_fn,
+    )
     cap = monthly_buy_cap(repo, config, venue=venue, now_ts=now_ts)
     cadence = inputs.cadence_days
     spend = _cents_down(inputs.budget_usd * (Decimal("1") - inputs.buffer_pct))
 
@@ -34,8 +34,9 @@
 
 from __future__ import annotations
 
+import threading
 import time
-from collections.abc import Callable, Mapping, Sequence
+from collections.abc import Callable, Hashable, Mapping, Sequence
 from dataclasses import dataclass, field
 from datetime import UTC, datetime
 from pathlib import Path
@@ -783,6 +784,97 @@ def read_rules(cfg: ServeConfig, _query: Query, _state: Any, _now_ts: int) -> di
     return payload.rules_payload(rows)
 
 
+#: How long one deployment's admission screen stays cached (#856). 5 minutes: short enough that
+#: an operator who just fixed a candle gap or attested an asset sees it admitted within one
+#: coffee, long enough that `/rules?budget=`'s 15s poll (`server._REFRESH_SEC`) stops re-running
+#: the whole allowlist's `screen_product` against the database twenty times for every time an
+#: operator actually changes the budget or buffer in the address bar.
+_SCREEN_CACHE_TTL_SECONDS = 300
+
+
+@dataclass(frozen=True)
+class _ScreenCacheEntry:
+    report: Any
+    built_at_ts: int
+
+
+class ScreenCache:
+    """Caches one deployment's admission screen -- `build_screen_report`'s result -- across the
+    repeated `/api/dca-plan` reads `/rules?budget=`'s 15s poll makes (#856).
+
+    **What is cached, and why not the whole plan.** `/api/dca-plan`'s budget and buffer are query
+    parameters an operator can retype at will, and `build_dca_plan` recomputes every buy from
+    them; caching the PLAN would serve one operator's first-typed budget back on their fifth
+    request. The screen (`select_universe`'s admission gate) reads only the allowlist and the
+    database, which the config and the database on disk govern -- not the query string -- so it
+    is the one part of this read that is genuinely the same answer for `TTL_SECONDS`.
+
+    **Keyed on `(config_path, db_path)`, not relied on being one-per-`ServeConfig`.** In
+    production a `ServeConfig` is frozen and built once per `keel serve` process (`server.py`), so
+    a cache living on it is already scoped to one deployment by construction. Keying on the paths
+    anyway is what keeps a `ScreenCache` correct on its own terms -- a test harness, or a future
+    hot-reloaded `ServeConfig`, sharing one `ScreenCache` across two deployments still gets two
+    entries rather than one deployment's screen answering for another's.
+
+    **And on what the screen reads from the config (#873).** `read_dca_plan` re-reads
+    config.yaml on every request, so the same path can name a new allowlist a minute later. The
+    caller's key therefore also carries the screened product ids and the quote currency --
+    exactly the inputs `build_screen_report` takes from the config -- so an asset added at the
+    same path is screened on the next read, never reported "not screened" for a whole TTL.
+
+    **Holds no connection and no repository.** A `ScreenReport` is a frozen dataclass of
+    `MarketFacts`/`ScreenResult` rows -- plain data, read once and never re-touched by this cache.
+    `build()` is a closure the CALLER makes from its OWN per-request repo and connection
+    (`server.py`'s module docstring: each request opens its own SQLite connection); the entry
+    stored here outlives that connection by design and never needs it again.
+
+    **Reads no clock of its own.** `now_ts` is the caller's -- `respond`'s one `time.time()`,
+    already threaded down to every reader (`test_no_reader_reads_the_clock_a_second_time`'s AST
+    scan is the rule this keeps: a second clock read here would let the entry's age and the
+    envelope's `generated_at` describe two different instants).
+
+    **Thread-safe, and the lock is held across a MISS's rebuild -- deliberately.** `KeelServer` is
+    a `ThreadingHTTPServer`: two polls of `/rules` landing at once, both past a stale entry, would
+    otherwise both re-screen the whole allowlist concurrently (a thundering herd) for a page one
+    operator reads alone on a loopback socket. Serialising the rebuild means the second thread's
+    poll waits for the first's screen (a handful of indexed local DB reads, not a network call)
+    and then reads the SAME answer, rather than building a redundant copy of its own. One thread
+    blocked instead of two racing is the right trade for a single-operator dashboard.
+    """
+
+    TTL_SECONDS = _SCREEN_CACHE_TTL_SECONDS
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._entries: dict[tuple[Hashable, ...], _ScreenCacheEntry] = {}
+
+    def get_or_build(
+        self, key: tuple[Hashable, ...], now_ts: int, build: Callable[[], Any]
+    ) -> tuple[Any, int]:
+        """`(report, age_seconds)` for `key` as of `now_ts`.
+
+        A HIT is an entry younger than `TTL_SECONDS`; the boundary is EXCLUSIVE of freshness -- an
+        entry exactly `TTL_SECONDS` old is a MISS, matching `keel/execution/guards.py`'s own
+        `attest_due_ts <= now_ts` (equality already means due, not "an instant of grace left").
+        A MISS calls `build()` while the lock is held (see the class docstring), so `build` must
+        stay a plain, synchronous read -- exactly what `build_screen_report` is.
+
+        The window is symmetric: an entry built `TTL_SECONDS` or more AFTER `now_ts` is a MISS
+        too. A lock-wait legitimately makes the age a second or two negative (read as 0 below),
+        but an entry a whole TTL in this request's future means the wall clock stepped back, and
+        serving it would keep a stale screen up for the step plus the TTL under "0s ago".
+        """
+        with self._lock:
+            entry = self._entries.get(key)
+            if entry is not None and abs(now_ts - entry.built_at_ts) < self.TTL_SECONDS:
+                # A request stamped before a later-stamped one built this entry (it waited on the
+                # lock) reads age 0, never a negative age.
+                return entry.report, max(0, now_ts - entry.built_at_ts)
+            report = build()
+            self._entries[key] = _ScreenCacheEntry(report, now_ts)
+            return report, 0
+
+
 def read_dca_plan(cfg: ServeConfig, query: Query, _state: Any, now_ts: int) -> dict[str, Any]:
     """The DCA proposal card on `/rules`, from THE service the CLI calls
     (`keel.commands.dca_plan.build_dca_plan`). READ-ONLY: it builds a plan and writes nothing;
@@ -797,7 +889,18 @@ def read_dca_plan(cfg: ServeConfig, query: Query, _state: Any, now_ts: int) -> d
     module's one way of saying "declined, and here is why" -- the CLI refuses the same error as a
     clean message rather than a traceback, and a 500 here would read "That report could not be
     built" over a message that already names the fix. The card shows the refusal's detail.
+
+    **#856: the admission screen is cached, nothing else is.** `cfg.screen_cache` (a `ScreenCache`
+    scoped to this `ServeConfig`, i.e. this served deployment) answers `build_screen_report` for
+    up to 5 minutes; on a HIT, `screen_fn` (`screen_product`) is never even called. The cached
+    `ScreenReport` is handed to `build_dca_plan` through its `screen_report_fn` injection point --
+    a fixed callable that ignores the arguments `select_universe` would otherwise pass
+    `build_screen_report` and returns the cached report -- so budget/buffer keep varying per
+    request exactly as before; only the screen itself is stale for up to 5 minutes, and the
+    payload's `screen_age` says so.
     """
+    from keel.commands._products import _default_sim_products
+    from keel.commands.admission import build_screen_report
     from keel.commands.assets import screen_product  # resolved per call: one patch point
     from keel.commands.dca_plan import (
         DcaPlanError,
@@ -821,15 +924,34 @@ def read_dca_plan(cfg: ServeConfig, query: Query, _state: Any, now_ts: int) -> d
     config = load_config(cfg.config_path)
     repo = open_repo(cfg.db_path)
     try:
+        screen_report, screen_age_seconds = cfg.screen_cache.get_or_build(
+            (
+                cfg.config_path,
+                cfg.db_path,
+                config.quote_currency,
+                tuple(_default_sim_products(config)),
+            ),
+            now_ts,
+            lambda: build_screen_report(repo, config, screen_product),
+        )
         plan = build_dca_plan(
-            repo, config, inputs, venue=_bound_venue(cfg), now_ts=now_ts, screen_fn=screen_product
+            repo,
+            config,
+            inputs,
+            venue=_bound_venue(cfg),
+            now_ts=now_ts,
+            screen_fn=screen_product,
+            screen_report_fn=lambda *_a, **_kw: screen_report,
         )
     except DcaPlanError as exc:
         raise ApiRefusal(400, "DCA plan refused", str(exc)) from exc
     finally:
         close_repo(repo)
     return payload.dca_plan_payload(
-        plan, command=apply_command(inputs, config_path=cfg.config_path, db_path=cfg.db_path)
+        plan,
+        command=apply_command(inputs, config_path=cfg.config_path, db_path=cfg.db_path),
+        screen_age_seconds=screen_age_seconds,
+        screen_ttl_seconds=cfg.screen_cache.TTL_SECONDS,
     )
 
 
 
@@ -3711,10 +3711,52 @@ def dca_plan_awaiting_payload(*, command: str) -> dict[str, Any]:
         "existing": [],
         "blockers": [],
         "warnings": [],
+        # #856: nothing was screened for THIS response (no budget was asked for, so
+        # `read_dca_plan` never reached the cache) -- said in words, never a manufactured "0s
+        # ago" that would claim a screen that did not happen, and never `absent()`'s bare "—",
+        # which the card would place as an unlabeled line of its own.
+        "screen_age": _dca_not_screened(),
     }
 
 
-def dca_plan_payload(plan: DcaPlan, *, command: str) -> dict[str, Any]:
+def _dca_not_screened() -> Field:
+    """#856: `screen_age` when no admission screen stands behind the response -- the awaiting
+    card (no budget asked for) or a caller that measured no screen age. A judged field in words,
+    `unknown` like every other figure the awaiting card lacks."""
+    return label(
+        "not_screened",
+        display="Asset screen: not run yet -- it runs once a budget is entered.",
+        state=UNKNOWN,
+    )
+
+
+def _dca_screen_age(age_seconds: int, ttl_seconds: int) -> Field:
+    """#856's staleness note for the cached admission screen behind `/rules?budget=`.
+
+    `ScreenCache` (`keel/web/api.py`) holds one screen for `ttl_seconds` so the page's 15s poll
+    does not re-screen the whole allowlist against the database on every reload; this is the one
+    sentence that tells the operator the trade-off exists. `_human_age` / `_human_remaining`, not
+    fresh formatters, for the same reason `duration()` above uses them: the browser and the CLI
+    must never be able to disagree about how long the same span is. The interval is the TTL the
+    cache applies, handed in by the caller -- never a second copy of it written as prose here.
+    """
+    return label(
+        str(age_seconds),
+        display=(
+            f"Asset screen from {_human_age(age_seconds)}; "
+            f"refreshes every {_human_remaining(ttl_seconds)}."
+        ),
+        state=NEUTRAL,
+    )
+
+
+def dca_plan_payload(
+    plan: DcaPlan,
+    *,
+    command: str,
+    screen_age_seconds: int | None = None,
+    screen_ttl_seconds: int | None = None,
+) -> dict[str, Any]:
     """`keel.commands.dca_plan.DcaPlan`, as JSON. Every figure was computed by the service --
     `weight_pct`, `taker_pct_display`, `buy_count` and the `worst_month_*` fields exist so nothing
     here multiplies or counts (Rules 2 and 6). READ-ONLY: the card carries the CLI command, and
@@ -3786,6 +3828,11 @@ def dca_plan_payload(plan: DcaPlan, *, command: str) -> dict[str, Any]:
         ],
         "blockers": list(plan.blockers),
         "warnings": list(plan.warnings),
+        "screen_age": (
+            _dca_not_screened()
+            if screen_age_seconds is None or screen_ttl_seconds is None
+            else _dca_screen_age(screen_age_seconds, screen_ttl_seconds)
+        ),
     }
 
 
 
@@ -114,6 +114,16 @@ class ServeConfig:
     #: When this run began, for the remote session lifetime (#648). Defaults to the moment the
     #: config is built, which is the moment `keel serve` mints the token it bounds.
     started_at: float = field(default_factory=time.time)
+    #: #856: `/api/dca-plan`'s cached admission screen, scoped to THIS deployment. `ServeConfig`
+    #: is frozen and built once per `keel serve` process (`build_server`), then shared by every
+    #: thread `ThreadingHTTPServer` hands a request to via `BoundKeelHandler.cfg` -- exactly the
+    #: lifetime a 5-minute cache needs, and `default_factory` gives a fresh, empty `ScreenCache`
+    #: to every `ServeConfig` built (so two servers, or two deployments in one test session,
+    #: never share one). `ScreenCache` itself is a plain class in `keel/web/api.py`, not a
+    #: dataclass field with a mutable default -- `field(default_factory=api.ScreenCache)` is what
+    #: keeps a frozen `ServeConfig` correct here: the FIELD is never reassigned, only the cache
+    #: object it names is ever mutated internally, through its own lock.
+    screen_cache: api.ScreenCache = field(default_factory=api.ScreenCache)
 
     @property
     def session_expired_at(self) -> float | None:
 
@@ -3307,6 +3307,12 @@ export function dcaPlanCard(plan, error) {
   const stateLine = el("p");
   stateLine.append(field(plan.state));
   card.append(stateLine);
+  // #856: the admission screen behind this plan is cached for up to 5 minutes, so this figure
+  // can lag a fix (a re-fetched candle, a fresh attestation) by that long -- said here, in the
+  // server's own words, rather than left for the operator to notice on their own.
+  const screenAgeLine = el("p", "note");
+  screenAgeLine.append(field(plan.screen_age));
+  card.append(screenAgeLine);
   card.append(
     dcaPlanFigure("spend / month", plan.summary.spend),
     dcaPlanFigure("budget", plan.summary.budget),