@reproapp/node-sdk 0.0.53 → 0.0.55

package/dist/index.js

@@ -1116,6 +1116,7 @@ let traceMaterializerWorkerDisabled = !TRACE_MATERIALIZE_OFFTHREAD_ENABLED;
 let traceMaterializerTaskSeq = 0;
 let traceMaterializerIdleTimer = null;
 const traceMaterializerExpectedTerminations = new WeakSet();
+const traceMaterializerWorkerPolicies = new WeakMap();
 const traceMaterializerPending = new Map();
 function hasActiveClientRequests() {
     return activeClientRequestCount > 0;
@@ -1332,12 +1333,22 @@ async function materializePendingTraceEventsOffThread(events, payload) {
             timeout,
         });
         try {
+            const previousPolicy = traceMaterializerWorkerPolicies.get(worker);
+            const sendPolicy = !previousPolicy || previousPolicy.policy !== payload.privacy;
+            const policyState = sendPolicy ? { policy: payload.privacy, id: taskId } : previousPolicy;
+            const { policy: _inlinePolicy, ...privacyConfig } = payload.cfg.privacy ?? {};
             const request = {
                 taskId,
                 type: 'materialize-trace-events',
-                payload,
+                payload: {
+                    ...payload,
+                    cfg: { ...payload.cfg, privacy: privacyConfig },
+                    privacy: sendPolicy ? payload.privacy : undefined,
+                    policyId: policyState.id,
+                },
             };
             worker.postMessage(request);
+            traceMaterializerWorkerPolicies.set(worker, policyState);
         }
         catch (err) {
             traceMaterializerPending.delete(taskId);
@@ -7859,7 +7870,7 @@ function scheduleAmqpPublishCapture(params) {
             url: params.path,
             path: params.path,
             status: params.status,
-            durMs: Date.now() - params.t0,
+            durMs: params.durationMs,
             key: params.key,
             headers: {
                 transport: 'amqp',
@@ -7879,7 +7890,7 @@ function scheduleAmqpPublishCapture(params) {
             entries: [{
                     actionId: params.aid ?? null,
                     request: requestPayload,
-                    t: alignedNow(),
+                    t: params.completedAt,
                 }],
         });
         post(params.cfg, params.sid, {
@@ -7941,6 +7952,9 @@ function patchAmqplibPublishMethod(channel, cfg, methodName) {
             if (finished)
                 return;
             finished = true;
+            // Capture queue and privacy processing time are not broker latency.
+            const durationMs = Math.max(0, Date.now() - t0);
+            const completedAt = alignedNow();
             scheduleAmqpPublishCapture({
                 cfg,
                 sid,
@@ -7956,7 +7970,8 @@ function patchAmqplibPublishMethod(channel, cfg, methodName) {
                 content,
                 options: nextOptions,
                 span,
-                t0,
+                durationMs,
+                completedAt,
                 status,
                 error,
                 result,
@@ -8089,6 +8104,8 @@ function wrapAmqplibConsumeHandler(onMessage, cfg, queue) {
             finished = true;
             if (!sid)
                 return;
+            const durationMs = Math.max(0, Date.now() - t0);
+            const completedAt = alignedNow();
             const fields = message?.fields ?? {};
             const messagePayload = buildAmqpMessagePayload(message?.content, properties);
             const body = {
@@ -8118,7 +8135,7 @@ function wrapAmqplibConsumeHandler(onMessage, cfg, queue) {
                     url: `amqp://queue/${queueName}`,
                     path: `amqp://queue/${queueName}`,
                     status: threw ? 500 : 200,
-                    durMs: Date.now() - t0,
+                    durMs: durationMs,
                     key: `AMQP_CONSUME ${queueName}`,
                     headers: normalizeAmqpHeadersForPayload(headers),
                     body: bodyMaterialization.value,
@@ -8129,7 +8146,7 @@ function wrapAmqplibConsumeHandler(onMessage, cfg, queue) {
                     entries: [{
                             actionId: aid ?? null,
                             request: requestPayload,
-                            t: alignedNow(),
+                            t: completedAt,
                         }],
                 });
                 scheduleAmqpTraceFlush(cfg, amqpCtx, aid, consumeRid, rawTraceEvents, maskReq, captureScope);

package/dist/privacy.js

@@ -11,6 +11,7 @@ const EMPTY_RUNTIME_PRIVACY_POLICY = {
     fingerprint: 'empty',
 };
 const runtimePrivacyStatementIndexes = new WeakMap();
+const comparableTokenCache = new Map();
 const RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES = 2048;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_ENTRIES = 1000;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_SERIALIZED_LENGTH = 200000;
@@ -453,6 +454,7 @@ function buildRuntimePrivacyStatementIndex(statements) {
         functionStatements,
         candidateCache: new Map(),
         hasNumericTargetSegments,
+        scoredCandidateCache: new Map(),
     };
 }
 function getRuntimePrivacyStatementIndex(policy) {
@@ -874,6 +876,8 @@ function rememberSerializedRuntimePrivacyProvenance(value, provenance) {
     }
 }
 function lookupSerializedRuntimePrivacyProvenance(value) {
+    if (serializedRuntimePrivacyProvenance.size === 0)
+        return null;
     for (const serialized of runtimePrivacyProvenanceSerializations(value)) {
         const provenance = serializedRuntimePrivacyProvenance.get(hashRuntimePrivacyProvenance(serialized));
         if (provenance) {
@@ -1228,6 +1232,26 @@ async function transformSerializedStructuredStringAsChildrenAsync(policy, surfac
     return JSON.stringify(transformed);
 }
 function matchStatement(policy, surface, value, context, path) {
+    const index = getRuntimePrivacyStatementIndex(policy);
+    // Scores and non-pattern selectors depend on the context/path, not the
+    // observed value. Preserve numeric positions here even for wildcard rules.
+    const key = JSON.stringify([surface, context.trace?.fn, context.routeKey,
+        context.db?.type, context.db?.collection, context.db?.op, path]);
+    let scored = index.scoredCandidateCache.get(key);
+    if (!scored) {
+        scored = scoreStatementCandidates(policy, surface, context, path);
+        if (index.scoredCandidateCache.size >= RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES) {
+            index.scoredCandidateCache.clear();
+        }
+        index.scoredCandidateCache.set(key, scored);
+    }
+    const leaf = path[path.length - 1] ?? '';
+    const joinedPath = normalizeComparablePath(path);
+    const candidates = scored.filter(({ statement }) => statement.scope !== 'PATTERN'
+        || patternMatches(statement.pattern, leaf, joinedPath, value));
+    return selectStatementCandidate(candidates, surface, value, path);
+}
+function scoreStatementCandidates(policy, surface, context, path) {
     let candidates = [];
     for (const statement of candidateStatementsForMatch(policy, surface, context, path)) {
         if (shouldIgnoreBroadContainerRuleOnDescendant(statement, surface, path)) {
@@ -1240,7 +1264,7 @@ function matchStatement(policy, surface, value, context, path) {
         if (targetScore < 0) {
             continue;
         }
-        if (!matchesScope(statement, surface, value, context, path)) {
+        if (statement.scope !== 'PATTERN' && !matchesScope(statement, surface, undefined, context, path)) {
             continue;
         }
         const selectorScore = matchSelectorSpecificity(statement, surface, context, path);
@@ -1254,10 +1278,9 @@ function matchStatement(policy, surface, value, context, path) {
                 statement.priority,
         });
     }
-    if (!candidates.length) {
-        return null;
-    }
-    candidates = candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+    return candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+}
+function selectStatementCandidate(candidates, surface, value, path) {
     if (!candidates.length) {
         return null;
     }
@@ -1632,7 +1655,10 @@ function normalizeComparablePath(path) {
         .join('.');
 }
 function normalizeComparableToken(value) {
-    return value
+    const cached = comparableTokenCache.get(value);
+    if (cached !== undefined)
+        return cached;
+    const normalized = value
         .trim()
         .replace(/\s+/g, '')
         .replace(/\[\*\]/g, '')
@@ -1641,6 +1667,12 @@ function normalizeComparableToken(value) {
         .replace(/^.*->/, '')
         .replace(/\|/g, '')
         .toLowerCase();
+    if (value.length <= 1024) {
+        if (comparableTokenCache.size >= 2048)
+            comparableTokenCache.clear();
+        comparableTokenCache.set(value, normalized);
+    }
+    return normalized;
 }
 function relaxedFieldTargetMatchScore(statement, surface, path) {
     if (!path.length) {
@@ -2379,7 +2411,9 @@ function partiallyMaskUnknownString(value) {
     return normalizePrivacyReplacementSpacing(output);
 }
 function normalizePrivacyReplacementSpacing(value) {
-    if (!value) {
+    // Most captured strings contain no replacement markers. The token regex
+    // backtracks over long ordinary words even though no token can match.
+    if (!value || (!value.includes('[') && !/_tok_/i.test(value))) {
         return value;
     }
     const bracketMarker = String.raw `(?:\[(?:dropped|secret-token|connection-string|auth-token|session-secret|private-key|basic-auth|jwt|credit-card|phone|person|ssn|masked)\])`;

package/dist/trace-materializer-worker.js

@@ -9,13 +9,24 @@ function isTraceMaterializationWorkerRequest(value) {
     const message = value;
     return Number.isFinite(message.taskId) && message.type === 'materialize-trace-events' && !!message.payload;
 }
+let policyId;
+let privacy;
+let queue = Promise.resolve();
 node_worker_threads_1.parentPort?.on('message', (message) => {
     if (!isTraceMaterializationWorkerRequest(message)) {
         return;
     }
-    void (async () => {
+    // FIFO also isolates the materializer's full-value-capture flag across tasks.
+    queue = queue.then(async () => {
         try {
-            const events = await (0, index_1.__materializePendingTraceEventsForWorker)(message.payload);
+            if (message.payload.privacy !== undefined) {
+                policyId = message.payload.policyId;
+                privacy = message.payload.privacy;
+            }
+            else if (policyId === undefined || policyId !== message.payload.policyId) {
+                throw new Error('trace materialization policy reference is unavailable');
+            }
+            const events = await (0, index_1.__materializePendingTraceEventsForWorker)({ ...message.payload, privacy });
             node_worker_threads_1.parentPort?.postMessage({
                 taskId: message.taskId,
                 ok: true,
@@ -29,5 +40,5 @@ node_worker_threads_1.parentPort?.on('message', (message) => {
                 error: err instanceof Error ? err.message : String(err),
             });
         }
-    })();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reproapp/node-sdk",
-  "version": "0.0.53",
+  "version": "0.0.55",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,14 +9,16 @@
     "node": ">=18"
   },
   "scripts": {
+    "test:throughput": "npm run build && node test/trace-worker-policy-reference.test.js && node test/privacy-policy-index.test.js && node test/trace-throughput.testcontainers.test.js",
     "test:latency": "npm run build && node test/privacy-fetch-timeout.test.js && node test/capture-latency.testcontainers.test.js",
     "test:live-capture": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/live-capture-limits.test.js && node test/ingest-throttle-retention.test.js && node test/live-capture-limits.testcontainers.test.js",
     "test:live-brokers": "npm run build && node test/live-broker-limits.testcontainers.test.js",
+    "test:amqp-timing": "npm run build && node test/amqplib-integration.test.js && node test/amqplib-timing.testcontainers.test.js",
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
     "prepublishOnly": "npm run build",
     "test": "npm run build && node test/semantic-serialization.test.js && node test/semantic-serialization-trace.test.js && node test/content-addressed-trace-values.test.js && node test/trace-observation-snapshots.test.js && node test/session-storage-budget.test.js && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/object-id-shapes.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
-    "test:containers": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/background-continuous-traffic.testcontainers.test.js && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
+    "test:containers": "npm run build && node test/trace-worker-policy-reference.test.js && node test/trace-throughput.testcontainers.test.js && node test/twelve-element-capture.testcontainers.test.js && node test/background-continuous-traffic.testcontainers.test.js && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
   },
   "peerDependencies": {
     "express": "^5.1.0",

package/src/index.ts

@@ -445,7 +445,10 @@ type TraceMaterializationWorkerPayload = {
 type TraceMaterializationWorkerRequest = {
     taskId: number;
     type: 'materialize-trace-events';
-    payload: TraceMaterializationWorkerPayload;
+    payload: Omit<TraceMaterializationWorkerPayload, 'privacy'> & {
+        privacy?: NormalizedRuntimePrivacyPolicy | null;
+        policyId: number;
+    };
 };
 
 type TraceMaterializationWorkerResponse =
@@ -1564,6 +1567,10 @@ let traceMaterializerWorkerDisabled = !TRACE_MATERIALIZE_OFFTHREAD_ENABLED;
 let traceMaterializerTaskSeq = 0;
 let traceMaterializerIdleTimer: NodeJS.Timeout | null = null;
 const traceMaterializerExpectedTerminations = new WeakSet<object>();
+const traceMaterializerWorkerPolicies = new WeakMap<object, {
+    policy: NormalizedRuntimePrivacyPolicy | null;
+    id: number;
+}>();
 const traceMaterializerPending = new Map<number, {
     resolve: (events: PendingTraceEventRecord[]) => void;
     reject: (error: Error) => void;
@@ -1771,12 +1778,22 @@ async function materializePendingTraceEventsOffThread(
         });
 
         try {
+            const previousPolicy = traceMaterializerWorkerPolicies.get(worker);
+            const sendPolicy = !previousPolicy || previousPolicy.policy !== payload.privacy;
+            const policyState = sendPolicy ? { policy: payload.privacy, id: taskId } : previousPolicy!;
+            const { policy: _inlinePolicy, ...privacyConfig } = payload.cfg.privacy ?? {};
             const request: TraceMaterializationWorkerRequest = {
                 taskId,
                 type: 'materialize-trace-events',
-                payload,
+                payload: {
+                    ...payload,
+                    cfg: { ...payload.cfg, privacy: privacyConfig },
+                    privacy: sendPolicy ? payload.privacy : undefined,
+                    policyId: policyState.id,
+                },
             };
             worker.postMessage(request);
+            traceMaterializerWorkerPolicies.set(worker, policyState);
         } catch (err) {
             traceMaterializerPending.delete(taskId);
             try { clearTimeout(timeout); } catch {}
@@ -9481,7 +9498,8 @@ function scheduleAmqpPublishCapture(params: {
     content: any;
     options: any;
     span: SpanContext | null;
-    t0: number;
+    durationMs: number;
+    completedAt: number;
     status: number;
     error?: any;
     result?: any;
@@ -9523,7 +9541,7 @@ function scheduleAmqpPublishCapture(params: {
             url: params.path,
             path: params.path,
             status: params.status,
-            durMs: Date.now() - params.t0,
+            durMs: params.durationMs,
             key: params.key,
             headers: {
                 transport: 'amqp',
@@ -9544,7 +9562,7 @@ function scheduleAmqpPublishCapture(params: {
             entries: [{
                 actionId: params.aid ?? null,
                 request: requestPayload,
-                t: alignedNow(),
+                t: params.completedAt,
             }],
         });
         post(params.cfg, params.sid!, {
@@ -9617,6 +9635,9 @@ function patchAmqplibPublishMethod(
         const finish = (status: number, error?: any, result?: any) => {
             if (finished) return;
             finished = true;
+            // Capture queue and privacy processing time are not broker latency.
+            const durationMs = Math.max(0, Date.now() - t0);
+            const completedAt = alignedNow();
             scheduleAmqpPublishCapture({
                 cfg,
                 sid,
@@ -9632,7 +9653,8 @@ function patchAmqplibPublishMethod(
                 content,
                 options: nextOptions,
                 span,
-                t0,
+                durationMs,
+                completedAt,
                 status,
                 error,
                 result,
@@ -9762,6 +9784,8 @@ function wrapAmqplibConsumeHandler(onMessage: any, cfg: AmqplibPatchConfig, queu
             if (finished) return;
             finished = true;
             if (!sid) return;
+            const durationMs = Math.max(0, Date.now() - t0);
+            const completedAt = alignedNow();
             const fields = message?.fields ?? {};
             const messagePayload = buildAmqpMessagePayload(message?.content, properties);
             const body = {
@@ -9797,7 +9821,7 @@ function wrapAmqplibConsumeHandler(onMessage: any, cfg: AmqplibPatchConfig, queu
                     url: `amqp://queue/${queueName}`,
                     path: `amqp://queue/${queueName}`,
                     status: threw ? 500 : 200,
-                    durMs: Date.now() - t0,
+                    durMs: durationMs,
                     key: `AMQP_CONSUME ${queueName}`,
                     headers: normalizeAmqpHeadersForPayload(headers),
                     body: bodyMaterialization.value,
@@ -9809,7 +9833,7 @@ function wrapAmqplibConsumeHandler(onMessage: any, cfg: AmqplibPatchConfig, queu
                     entries: [{
                         actionId: aid ?? null,
                         request: requestPayload,
-                        t: alignedNow(),
+                        t: completedAt,
                     }],
                 });
                 scheduleAmqpTraceFlush(cfg, amqpCtx, aid, consumeRid, rawTraceEvents, maskReq, captureScope);

package/src/privacy.ts

@@ -97,6 +97,7 @@ type RuntimePrivacyStatementIndex = {
     functionStatements: FunctionStatementTrieNode;
     candidateCache: Map<string, NormalizedStatement[]>;
     hasNumericTargetSegments: boolean;
+    scoredCandidateCache: Map<string, Array<{ statement: NormalizedStatement; targetScore: number; score: number }>>;
 };
 
 type TransformFallback = {
@@ -150,6 +151,7 @@ const EMPTY_RUNTIME_PRIVACY_POLICY: NormalizedRuntimePrivacyPolicy = {
 };
 
 const runtimePrivacyStatementIndexes = new WeakMap<object, RuntimePrivacyStatementIndex>();
+const comparableTokenCache = new Map<string, string>();
 const RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES = 2048;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_ENTRIES = 1000;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_SERIALIZED_LENGTH = 200_000;
@@ -685,6 +687,7 @@ function buildRuntimePrivacyStatementIndex(
         functionStatements,
         candidateCache: new Map<string, NormalizedStatement[]>(),
         hasNumericTargetSegments,
+        scoredCandidateCache: new Map(),
     };
 }
 
@@ -1222,6 +1225,7 @@ function rememberSerializedRuntimePrivacyProvenance(value: any, provenance: Runt
 }
 
 function lookupSerializedRuntimePrivacyProvenance(value: any): TransformFallback {
+    if (serializedRuntimePrivacyProvenance.size === 0) return null;
     for (const serialized of runtimePrivacyProvenanceSerializations(value)) {
         const provenance = serializedRuntimePrivacyProvenance.get(hashRuntimePrivacyProvenance(serialized));
         if (provenance) {
@@ -1691,6 +1695,32 @@ function matchStatement(
     context: RuntimePrivacyApplyContext,
     path: string[],
 ): NormalizedStatement | null {
+    const index = getRuntimePrivacyStatementIndex(policy);
+    // Scores and non-pattern selectors depend on the context/path, not the
+    // observed value. Preserve numeric positions here even for wildcard rules.
+    const key = JSON.stringify([surface, context.trace?.fn, context.routeKey,
+        context.db?.type, context.db?.collection, context.db?.op, path]);
+    let scored = index.scoredCandidateCache.get(key);
+    if (!scored) {
+        scored = scoreStatementCandidates(policy, surface, context, path);
+        if (index.scoredCandidateCache.size >= RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES) {
+            index.scoredCandidateCache.clear();
+        }
+        index.scoredCandidateCache.set(key, scored);
+    }
+    const leaf = path[path.length - 1] ?? '';
+    const joinedPath = normalizeComparablePath(path);
+    const candidates = scored.filter(({ statement }) => statement.scope !== 'PATTERN'
+        || patternMatches(statement.pattern, leaf, joinedPath, value));
+    return selectStatementCandidate(candidates, surface, value, path);
+}
+
+function scoreStatementCandidates(
+    policy: NormalizedRuntimePrivacyPolicy,
+    surface: RuntimePrivacySurface,
+    context: RuntimePrivacyApplyContext,
+    path: string[],
+): Array<{ statement: NormalizedStatement; targetScore: number; score: number }> {
     let candidates: Array<{ statement: NormalizedStatement; targetScore: number; score: number }> = [];
     for (const statement of candidateStatementsForMatch(policy, surface, context, path)) {
         if (shouldIgnoreBroadContainerRuleOnDescendant(statement, surface, path)) {
@@ -1703,7 +1733,7 @@ function matchStatement(
         if (targetScore < 0) {
             continue;
         }
-        if (!matchesScope(statement, surface, value, context, path)) {
+        if (statement.scope !== 'PATTERN' && !matchesScope(statement, surface, undefined, context, path)) {
             continue;
         }
         const selectorScore = matchSelectorSpecificity(statement, surface, context, path);
@@ -1718,11 +1748,15 @@ function matchStatement(
                 statement.priority,
         });
     }
-    if (!candidates.length) {
-        return null;
-    }
+    return candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+}
 
-    candidates = candidates.filter(({ statement }) => !isBroadContextKeepExact(statement, surface, path));
+function selectStatementCandidate(
+    candidates: Array<{ statement: NormalizedStatement; targetScore: number; score: number }>,
+    surface: RuntimePrivacySurface,
+    value: any,
+    path: string[],
+): NormalizedStatement | null {
     if (!candidates.length) {
         return null;
     }
@@ -2197,7 +2231,9 @@ function normalizeComparablePath(path: string[]): string {
 }
 
 function normalizeComparableToken(value: string): string {
-    return value
+    const cached = comparableTokenCache.get(value);
+    if (cached !== undefined) return cached;
+    const normalized = value
         .trim()
         .replace(/\s+/g, '')
         .replace(/\[\*\]/g, '')
@@ -2206,6 +2242,11 @@ function normalizeComparableToken(value: string): string {
         .replace(/^.*->/, '')
         .replace(/\|/g, '')
         .toLowerCase();
+    if (value.length <= 1024) {
+        if (comparableTokenCache.size >= 2048) comparableTokenCache.clear();
+        comparableTokenCache.set(value, normalized);
+    }
+    return normalized;
 }
 
 function relaxedFieldTargetMatchScore(
@@ -3082,7 +3123,9 @@ function partiallyMaskUnknownString(value: string): string {
 }
 
 function normalizePrivacyReplacementSpacing(value: string): string {
-    if (!value) {
+    // Most captured strings contain no replacement markers. The token regex
+    // backtracks over long ordinary words even though no token can match.
+    if (!value || (!value.includes('[') && !/_tok_/i.test(value))) {
         return value;
     }
     const bracketMarker = String.raw`(?:\[(?:dropped|secret-token|connection-string|auth-token|session-secret|private-key|basic-auth|jwt|credit-card|phone|person|ssn|masked)\])`;

package/src/trace-materializer-worker.ts

@@ -15,14 +15,24 @@ function isTraceMaterializationWorkerRequest(value: unknown): value is TraceMate
     return Number.isFinite(message.taskId) && message.type === 'materialize-trace-events' && !!message.payload;
 }
 
+let policyId: number | undefined;
+let privacy: any;
+let queue = Promise.resolve();
 parentPort?.on('message', (message: unknown) => {
     if (!isTraceMaterializationWorkerRequest(message)) {
         return;
     }
 
-    void (async () => {
+    // FIFO also isolates the materializer's full-value-capture flag across tasks.
+    queue = queue.then(async () => {
         try {
-            const events = await __materializePendingTraceEventsForWorker(message.payload);
+            if (message.payload.privacy !== undefined) {
+                policyId = message.payload.policyId;
+                privacy = message.payload.privacy;
+            } else if (policyId === undefined || policyId !== message.payload.policyId) {
+                throw new Error('trace materialization policy reference is unavailable');
+            }
+            const events = await __materializePendingTraceEventsForWorker({ ...message.payload, privacy });
             parentPort?.postMessage({
                 taskId: message.taskId,
                 ok: true,
@@ -35,5 +45,5 @@ parentPort?.on('message', (message: unknown) => {
                 error: err instanceof Error ? err.message : String(err),
             });
         }
-    })();
+    });
 });

package/test/amqplib-timing.testcontainers.test.js

@@ -0,0 +1,198 @@
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.TRACE_IDLE_FLUSH_MS = '0';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { once } = require('node:events');
+const { GenericContainer, Wait } = require('testcontainers');
+const amqp = require('amqplib');
+const { __reproTestHooks: hooks } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+const deferred = () => {
+    let resolve;
+    const promise = new Promise(done => { resolve = done; });
+    return { promise, resolve };
+};
+async function within(promise, label) {
+    let timer;
+    try {
+        return await Promise.race([promise, new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`Timed out: ${label}`)), 10000);
+        })]);
+    } finally { clearTimeout(timer); }
+}
+
+async function main() {
+    const events = [], channels = [];
+    let rabbit, connection, release;
+    const sink = http.createServer(async (req, res) => {
+        const buffers = [];
+        for await (const chunk of req) buffers.push(chunk);
+        events.push(...(JSON.parse(Buffer.concat(buffers)).events || []));
+        res.writeHead(202); res.end('{}');
+    });
+    sink.listen(0, '127.0.0.1'); await once(sink, 'listening');
+    try {
+        rabbit = await new GenericContainer('rabbitmq:3.13-alpine')
+            .withEnvironment({ RABBITMQ_DEFAULT_USER: 'repro', RABBITMQ_DEFAULT_PASS: 'test' })
+            .withExposedPorts(5672).withWaitStrategy(Wait.forLogMessage('Server startup complete')).start();
+        connection = await amqp.connect(`amqp://repro:test@${rabbit.getHost()}:${rabbit.getMappedPort(5672)}`);
+        for (const mode of ['live', 'staging']) {
+            const sid = `S_amqp_timing_${mode}`;
+            const cfg = { tenantId: 'TENANT_timing', appId: 'APP_timing', appSecret: 'test',
+                privacy: { captureRaw: true, environment: 'dev' },
+                ingestBase: `http://127.0.0.1:${sink.address().port}`,
+                resolveContext: () => ({ sid, aid: `A_${mode}` }) };
+            const channel = await connection.createConfirmChannel(); channels.push(channel);
+            hooks.patchAmqplibChannelForTest(channel, cfg);
+            const queue = `timing-${mode}`;
+            await channel.assertQueue(queue, { durable: false });
+            const handled = deferred(), acknowledged = deferred(), gate = deferred(), started = deferred();
+            release = gate.resolve;
+            // Hold the real capture queue, not the broker or application callback.
+            hooks.scheduleSdkBackgroundWorkForTest(async () => {
+                started.resolve(); await gate.promise;
+            }, { priority: 'high' });
+            await within(started.promise, 'capture queue blocker');
+            let handlerStart, handlerEnd, publishEnd;
+            const input = { orderId: `order-${mode}`, lines: [{ sku: 'item', quantity: 3 }] };
+            const consumer = await channel.consume(queue, async message => {
+                handlerStart = Date.now();
+                assert.deepEqual(JSON.parse(message.content.toString()), input);
+                assert.equal(message.properties.headers['x-bug-session-id'], sid);
+                assert.equal(message.properties.headers['x-repro-capture-mode'], mode);
+                await sleep(60);
+                channel.ack(message);
+                handlerEnd = Date.now(); handled.resolve();
+            });
+            const publishStart = Date.now();
+            const options = { headers: { 'x-repro-capture-mode': mode }, persistent: false };
+            const result = hooks.runWithRequestContextForTest({ sid, aid: `A_${mode}`, captureScope: { liveCapture: mode === 'live' } },
+                () => channel.sendToQueue(queue, Buffer.from(JSON.stringify(input)), options, error => {
+                    assert.ifError(error); publishEnd = Date.now(); acknowledged.resolve();
+                }));
+            assert.equal(typeof result, 'boolean', 'publish must preserve amqplib backpressure contract');
+            await within(Promise.all([handled.promise, acknowledged.promise]), 'broker confirm and consumer acknowledgement');
+            assert.equal(options.headers['x-bug-session-id'], undefined, 'caller options stay unchanged');
+            assert.equal(events.filter(e => e.session_id === sid && e.event_type === 'backend_request').length, 0);
+            await sleep(450);
+            const releasedAt = Date.now(); gate.resolve(); release = null;
+            const deadline = Date.now() + 10000;
+            let requests;
+            do {
+                await hooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+                requests = events.filter(e => e.session_id === sid && e.event_type === 'backend_request');
+                if (requests.length === 2) break;
+                await sleep(20);
+            } while (Date.now() < deadline);
+            assert.equal(requests.length, 2, 'exactly one publish and one consume, despite sendToQueue delegating to publish');
+            for (const [method, start, end] of [
+                ['AMQP_SEND_TO_QUEUE', publishStart, publishEnd],
+                ['AMQP_CONSUME', handlerStart, handlerEnd],
+            ]) {
+                const event = requests.find(e => e.payload.request.method === method);
+                assert(event, `${mode}: missing ${method}`);
+                const request = event.payload.request;
+                assert(request.durMs <= end - start + 30,
+                    `${mode} ${method}: ${request.durMs}ms includes capture queue time; business took ${end - start}ms`);
+                assert(request.durMs >= end - start - 10, 'duration must still include the async business handler');
+                const timestamp = Date.parse(event.event_ts);
+                assert(timestamp <= end + 30 && timestamp >= start,
+                    `event time must be operation completion, not background delivery: ${timestamp}, ${end}`);
+                assert(timestamp < releasedAt - 400);
+                assert.deepEqual(request.body.value, input, 'timing correction must not lose payload');
+            }
+            await channel.cancel(consumer.consumerTag);
+            console.log(`${mode}: broker confirms and async handler finish before capture drain; timings and payload exact`);
+        }
+        // Exercise failure/return contracts with real delivered envelopes. The
+        // adapter catches deliberate handler failures just as an application would.
+        const sid = 'S_amqp_failures';
+        const cfg = { tenantId: 'TENANT_timing', appId: 'APP_timing', appSecret: 'test',
+            privacy: { captureRaw: true, environment: 'dev' },
+            ingestBase: `http://127.0.0.1:${sink.address().port}`,
+            resolveContext: () => ({ sid, aid: 'A_failures' }) };
+        const raw = await connection.createChannel(); channels.push(raw);
+        await raw.assertQueue('timing-contracts', { durable: false });
+        const gate = deferred(), started = deferred(); release = gate.resolve;
+        hooks.scheduleSdkBackgroundWorkForTest(async () => { started.resolve(); await gate.promise; }, { priority: 'high' });
+        await within(started.promise, 'failure capture queue blocker');
+        const observations = new Map(), completed = deferred();
+        const identity = { result: 'unchanged' }, failure = new Error('application failure');
+        const wrapped = hooks.wrapAmqplibConsumeHandlerForTest(message => {
+            const { scenario } = JSON.parse(message.content.toString());
+            const observation = { start: Date.now(), calls: 1, scenario };
+            observations.set(scenario, observation);
+            const finish = () => {
+                observation.end = Date.now();
+                if (scenario.endsWith('error')) throw failure;
+                return identity;
+            };
+            return scenario.startsWith('async') ? sleep(60).then(finish) : finish();
+        }, cfg, 'timing-contracts');
+        let handled = 0;
+        const consumer = await raw.consume('timing-contracts', message => {
+            const { scenario } = JSON.parse(message.content.toString());
+            const complete = () => { raw.ack(message); if (++handled === 4) completed.resolve(); };
+            try {
+                const value = wrapped(message);
+                if (scenario.startsWith('async')) {
+                    assert.equal(typeof value.then, 'function');
+                    value.then(result => {
+                        assert.strictEqual(result, identity); complete();
+                    }, error => { assert.strictEqual(error, failure); complete(); });
+                } else { assert.strictEqual(value, identity); complete(); }
+            } catch (error) { assert.strictEqual(error, failure); complete(); }
+        });
+        for (const scenario of ['sync-success', 'async-success', 'sync-error', 'async-error']) {
+            raw.sendToQueue('timing-contracts', Buffer.from(JSON.stringify({ scenario })), { headers: {
+                'x-bug-session-id': sid, 'x-bug-action-id': 'A_failures', 'x-repro-capture-mode': 'live',
+            } });
+        }
+        await within(completed.promise, 'handler return and error contracts');
+        const invalid = await connection.createConfirmChannel(); channels.push(invalid);
+        invalid.on('error', () => {});
+        hooks.patchAmqplibChannelForTest(invalid, cfg);
+        const rejected = deferred();
+        const rejectStart = Date.now(); let rejectEnd;
+        invalid.publish('missing-exchange-timing', 'route', Buffer.from('message'), {}, error => {
+            assert(error, 'broker must reject the nonexistent exchange');
+            rejectEnd = Date.now(); rejected.resolve();
+        });
+        await within(rejected.promise, 'broker rejection');
+        await sleep(450); gate.resolve(); release = null;
+        const deadline = Date.now() + 10000;
+        let requests;
+        do {
+            await hooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+            requests = events.filter(e => e.session_id === sid && e.event_type === 'backend_request');
+            if (requests.length === 5) break;
+            await sleep(20);
+        } while (Date.now() < deadline);
+        assert.equal(requests.length, 5, 'no retries/double captures on exceptions or broker channel close');
+        for (const event of requests) {
+            const request = event.payload.request;
+            const observation = request.method === 'AMQP_PUBLISH'
+                ? { start: rejectStart, end: rejectEnd, scenario: 'broker-error' }
+                : observations.get(request.body.value.scenario);
+            assert(observation);
+            assert.equal(request.status, observation.scenario.endsWith('error') ? 500 : 200);
+            assert(request.durMs <= observation.end - observation.start + 30);
+            assert(Date.parse(event.event_ts) <= observation.end + 30);
+        }
+        await raw.cancel(consumer.consumerTag);
+        console.log('sync/async return and error identity preserved; broker rejection and failure timestamps exclude capture drain');
+    } finally {
+        release?.();
+        for (const channel of channels) await channel.close().catch(() => {});
+        if (connection) await connection.close();
+        await hooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+        sink.closeAllConnections(); await new Promise(resolve => sink.close(resolve));
+        if (rabbit) await rabbit.stop();
+    }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/capture-latency.testcontainers.test.js

@@ -25,7 +25,9 @@ async function main() {
     const results = [];
     try {
         mongo = await new GenericContainer('mongo:7').withExposedPorts(27017).withWaitStrategy(Wait.forListeningPorts()).start();
-        for (const variant of ['off', 'live-raw', 'staging-raw', 'live-policy', 'staging-policy', 'live-policy-fallback', 'staging-policy-fallback', 'staging-policy-fault']) {
+        const variants = ['off', 'live-raw', 'staging-raw', 'live-policy', 'staging-policy', 'live-policy-fallback', 'staging-policy-fallback', 'staging-policy-fault']
+            .filter(variant => !process.argv.includes('--raw-only') || !variant.includes('policy'));
+        for (const variant of variants) {
             const mode = variant.split('-')[0];
             child = fork(require.resolve('./fixtures/capture-latency-server'), [], {
                 env: { ...process.env, CAPTURE_TEST_MODE: mode,
@@ -70,6 +72,7 @@ async function main() {
                             const capture = scoped();
                             const manifest = capture.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest;
                             return manifest && ['backend_request', 'db_change'].every(t => capture.some(e => e.event_type === t))
+                                && capture.flatMap(e => e.payload.db || []).length === manifest.expected.dbChange
                                 && capture.filter(e => e.event_type === 'trace_batch').length >= manifest.expected.traceBatch;
                         };
                         while (!complete() && Date.now() < deadline) await sleep(25);

package/test/fixtures/capture-latency-business.js

@@ -1,7 +1,7 @@
 function observeRows(document) { return document; }
 async function loadRows(Model) {
     const document = await Model.findOne({ reference: 'LATENCY' }).lean().exec();
-    for (let i = 0; i < 12; i++) {
+    for (let i = 0; i < Number(process.env.CAPTURE_TEST_OBSERVATIONS || 12); i++) {
         document.phase = i;
         if (observeRows(document) !== document) throw new Error('return identity changed');
     }

package/test/fixtures/capture-latency-server.js

@@ -1,5 +1,5 @@
 const workerThreads = require('node:worker_threads');
-const metrics = { workers: 0, tasks: 0 };
+const metrics = { workers: 0, tasks: 0, policyTransfers: 0 };
 const RealWorker = workerThreads.Worker;
 workerThreads.Worker = class extends RealWorker {
     constructor(...args) {
@@ -10,13 +10,17 @@ workerThreads.Worker = class extends RealWorker {
         if (String(args[0]).includes('trace-materializer-worker')) {
             metrics.workers++;
             const post = this.postMessage.bind(this);
-            this.postMessage = (...messages) => { metrics.tasks++; return post(...messages); };
+            this.postMessage = (...messages) => {
+                metrics.tasks++;
+                if (messages[0]?.payload?.privacy !== undefined) metrics.policyTransfers++;
+                return post(...messages);
+            };
         }
     }
 };
 const http = require('node:http');
 const mode = process.env.CAPTURE_TEST_MODE;
-const { initRepro, reproMongoosePlugin } = require(process.env.CAPTURE_TEST_SDK || '../../dist');
+const { initRepro } = require(process.env.CAPTURE_TEST_SDK || '../../dist');
 async function main() {
     const config = {
         tenantId: 'TENANT_latency', appId: 'APP_latency', appSecret: 'test-only',
@@ -31,7 +35,6 @@ async function main() {
     const express = require('express');
     const connection = await mongoose.createConnection(process.env.CAPTURE_TEST_MONGO).asPromise();
     const schema = new mongoose.Schema({ reference: String, phase: Number, rows: [Object] });
-    if (mode !== 'off') schema.plugin(reproMongoosePlugin, config);
     const Model = connection.model('Latency', schema);
     await Model.create({ reference: 'LATENCY', phase: -1, rows: Array.from({ length: 120 }, (_, id) => ({
         id, status: 'available', internalSecret: `secret-${id}`, description: 'Operational depot description '.repeat(32),

package/test/privacy-policy-index.test.js

@@ -185,6 +185,21 @@ async function main() {
     );
     assert.match(transformedPositionalTrace[4], /^4_tok_[a-f0-9]{12}$/);
 
+    // Cached selector scores must not cache value-dependent PATTERN decisions,
+    // numeric targets, or leak a previous route/function/database context.
+    const contexts = [
+        { trace: { fn: 'CapturedService.loadNames' }, routeKey: 'GET /api/v1/depots/:id/names' },
+        { trace: { fn: 'OtherService.load' }, routeKey: 'POST /other', db: { type: 'mongo', collection: 'other', op: 'insert' } },
+    ];
+    for (let i = 0; i < 8; i++) {
+        const value = { data: [{ notes: i % 2 ? 'ordinary note' : 'secret-value', privateNote: 'private' }] };
+        const context = { appId: 'APP_test', appSecret: 'secret', ...contexts[i % 2] };
+        const warm = await applyRuntimePrivacyPolicyAsync(policy, 'response.body', value, context);
+        const cold = await applyRuntimePrivacyPolicyAsync(structuredClone(policy), 'response.body', value, context);
+        assert.deepEqual(warm, cold);
+        assert.equal(warm.data[0].notes, i % 2 ? 'ordinary note' : '[dropped]');
+        assert.equal(value.data[0].privateNote, 'private');
+    }
     console.log(`privacy policy index OK (${elapsedMs}ms)`);
 }
 

package/test/trace-throughput.testcontainers.test.js

@@ -0,0 +1,110 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { fork } = require('node:child_process');
+const { once } = require('node:events');
+const { performance } = require('node:perf_hooks');
+const { GenericContainer, Wait } = require('testcontainers');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+const policy = { statements: [
+    ...Array.from({ length: 5000 }, (_, i) => ({ sid: `fn-${i}`, when: {
+        scope: 'FUNCTION', selector: `Service${i}.method`, target: 'trace.args|trace.returnValue',
+    }, apply: { action: 'KEEP_EXACT' } })),
+    ...Array.from({ length: 9 }, (_, i) => ({ sid: `pattern-${i}`, when: {
+        scope: 'PATTERN', selector: `pattern-${i}`, pattern: `sensitive-value-${i}`,
+    }, apply: { action: 'DROP' } })),
+    { sid: 'secret', when: { scope: 'FIELD', selector: 'field:internalSecret' }, apply: { action: 'DROP' } },
+] };
+
+async function main() {
+    let events = [], child, mongo;
+    const sink = http.createServer((req, res) => {
+        const chunks = [];
+        req.on('data', chunk => chunks.push(chunk));
+        req.on('end', () => {
+            events.push(...JSON.parse(Buffer.concat(chunks)).events);
+            setTimeout(() => { res.writeHead(202); res.end('{}'); }, 10);
+        });
+    });
+    await new Promise(resolve => sink.listen(0, '127.0.0.1', resolve));
+    try {
+        mongo = await new GenericContainer('mongo:7').withExposedPorts(27017)
+            .withWaitStrategy(Wait.forListeningPorts()).start();
+        for (const mode of ['live', 'staging']) {
+            events = [];
+            child = fork(require.resolve('./fixtures/capture-latency-server'), [], {
+                env: { ...process.env, CAPTURE_TEST_MODE: mode, CAPTURE_TEST_OBSERVATIONS: '128',
+                    CAPTURE_TEST_MONGO: `mongodb://${mongo.getHost()}:${mongo.getMappedPort(27017)}/throughput_${mode}`,
+                    CAPTURE_TEST_SINK: `http://127.0.0.1:${sink.address().port}`, CAPTURE_TEST_POLICY: JSON.stringify(policy),
+                    REPRO_SDK_BACKGROUND_IDLE_DELAY_MS: '0', REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS: '0',
+                    REPRO_SDK_BACKGROUND_MAX_DEFER_MS: '0', TRACE_IDLE_FLUSH_MS: '10', TRACE_LINGER_AFTER_FINISH_MS: '0',
+                }, stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+            });
+            let stderr = '';
+            child.stderr.on('data', chunk => { stderr += chunk; });
+            const ready = await Promise.race([once(child, 'message').then(([v]) => v),
+                once(child, 'exit').then(() => { throw new Error(stderr); })]);
+            const base = `http://127.0.0.1:${ready.port}`;
+            const sessionIds = [0, 1].map(i => `S_throughput_${mode}_${i}`);
+            const started = performance.now();
+            const responses = await Promise.all(sessionIds.map((sid, i) =>
+                fetch(`${base}/names?__repro_sid=${sid}&__repro_aid=A_${i}&__repro_mode=${mode}`).then(r => r.json())));
+            const responseMs = performance.now() - started;
+            for (const response of responses) {
+                assert.equal(response.phase, 127);
+                assert.equal(response.rows.length, 120);
+                assert.equal(response.rows[0].internalSecret, 'secret-0');
+            }
+            const complete = sid => {
+                const scoped = events.filter(e => e.session_id === sid);
+                const manifest = scoped.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest;
+                return manifest && scoped.filter(e => e.event_type === 'trace_batch').length === manifest.expected.traceBatch
+                    && scoped.filter(e => e.event_type === 'backend_request').length === manifest.expected.backendRequest
+                    && scoped.reduce((sum, e) => sum + (Array.isArray(e.payload.db) ? e.payload.db.length : 0), 0) === manifest.expected.dbChange;
+            };
+            let maxHealthMs = 0;
+            while (!sessionIds.every(complete) && performance.now() - started < 60000) {
+                const t = performance.now();
+                await (await fetch(`${base}/health`)).json();
+                maxHealthMs = Math.max(maxHealthMs, performance.now() - t);
+                await sleep(20);
+            }
+            assert(sessionIds.every(complete), `missing evidence: ${JSON.stringify(sessionIds.map(sid => {
+                const scoped = events.filter(e => e.session_id === sid);
+                return { sid, counts: scoped.reduce((out, e) => { out[e.event_type] = (out[e.event_type] || 0) + 1; return out; }, {}),
+                    manifest: scoped.find(e => e.event_type === 'request_capture_manifest')?.payload.requestCaptureManifest };
+            }))} ${stderr.slice(-2000)}`);
+            const completeMs = performance.now() - started;
+            for (const sid of sessionIds) {
+                const scoped = events.filter(e => e.session_id === sid);
+                const manifest = scoped.find(e => e.event_type === 'request_capture_manifest').payload.requestCaptureManifest;
+                assert.equal(manifest.privacy.status, 'applied');
+                assert(!manifest.captureFailures?.length);
+                const values = new Map(scoped.flatMap(e => [...(e.payload.traceValues || []), ...(e.payload.requestValues || []), ...(e.payload.dbValues || [])]).map(v => [v.id, v.value]));
+                const trace = scoped.flatMap(e => e.payload.trace || []);
+                const observations = [...new Map(trace.filter(e => e.fn === 'observeRows' && e.line === 6 && e.type === 'enter')
+                    .map(e => [e.spanId, e])).values()];
+                assert.equal(observations.length, 128);
+                const args = observations.map(e => values.get(e.argsValueCapture?.valueId) ?? e.args);
+                assert.deepEqual(args.map(v => v[0].phase), Array.from({ length: 128 }, (_, i) => i));
+                for (const [document] of args) {
+                    assert.equal(document.rows.length, mode === 'live' ? 101 : 120);
+                    assert.equal(document.rows[0].internalSecret, '[dropped]');
+                }
+                assert(!JSON.stringify(scoped).includes('secret-0'), 'capture leaked a protected value');
+            }
+            const metrics = await (await fetch(`${base}/health`)).json();
+            assert(metrics.tasks > 4);
+            assert(metrics.policyTransfers <= metrics.workers, 'full policy was transferred again for every trace batch');
+            assert(completeMs < 25000, `${mode}: post-response capture backlog took ${completeMs}ms`);
+            assert(maxHealthMs < 500, `${mode}: background capture blocked HTTP for ${maxHealthMs}ms`);
+            console.log(JSON.stringify({ mode, responseMs: Math.round(responseMs), completeMs: Math.round(completeMs), maxHealthMs: Math.round(maxHealthMs), ...metrics }));
+            const exited = once(child, 'exit'); child.send('stop'); await exited; child = null;
+        }
+    } finally {
+        if (child) { const exited = once(child, 'exit'); child.kill(); await exited; }
+        await new Promise(resolve => sink.close(resolve));
+        if (mongo) await mongo.stop();
+    }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/trace-worker-policy-reference.test.js

@@ -0,0 +1,43 @@
+const assert = require('node:assert/strict');
+const { Worker } = require('node:worker_threads');
+const { normalizeRuntimePrivacyPolicy } = require('../dist/privacy');
+
+async function main() {
+    const worker = new Worker(require.resolve('../dist/trace-materializer-worker'));
+    let taskId = 0;
+    const pending = new Map();
+    worker.on('message', message => { pending.get(message.taskId)(message); pending.delete(message.taskId); });
+    const policy = action => normalizeRuntimePrivacyPolicy({ statements: [
+        { sid: action, when: { scope: 'FIELD', selector: 'field:businessNote' }, apply: { action } },
+    ] });
+    const call = (policyId, privacy, tenant = 'T', raw = false) => new Promise(resolve => {
+        const id = ++taskId;
+        pending.set(id, resolve);
+        worker.postMessage({ taskId: id, type: 'materialize-trace-events', payload: {
+            policyId, privacy, fullValueCaptureEnabled: true,
+            cfg: { tenantId: tenant, appId: tenant, appSecret: tenant, privacy: { captureRaw: raw } },
+            maskReq: { key: 'GET /names' }, masking: null, valueNamespace: tenant,
+            events: [{ type: 'enter', fn: 'load', __reproPending: { argsRaw: [{ businessNote: 'operational-value' }] } }],
+        } });
+    });
+    try {
+        const missing = await call(1);
+        assert.equal(missing.ok, false);
+        assert.match(missing.error, /policy reference/);
+        // Queue interleaved policies before any result arrives. Old references must
+        // not accidentally use the new policy or a concurrent task's raw flag.
+        const responses = await Promise.all([
+            call(1, policy('DROP')), call(1), call(2, policy('KEEP_EXACT'), 'Other'),
+            call(2, undefined, 'Other'), call(1), call(3, null, 'Raw', true),
+            call(4, policy('DROP')), call(4),
+        ]);
+        for (const i of [0, 1, 6, 7]) {
+            assert.equal(responses[i].ok, true);
+            assert.equal(responses[i].events[0].args[0].businessNote, '[dropped]');
+        }
+        for (const i of [2, 3, 5]) assert.equal(responses[i].events[0].args[0].businessNote, 'operational-value');
+        assert.equal(responses[4].ok, false, 'stale reference silently used another policy');
+    } finally { await worker.terminate(); }
+    console.log('trace worker policy references, updates, missing refs, and raw/policy isolation OK');
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });