@sema-agent/server 7.141.0 → 7.143.0

package/dist/trace/redact.js

@@ -461,9 +461,11 @@ let urlSegmentRuns = 0;
 let urlSegmentReplays = 0;
 let ssh2ScanBytes = 0;
 let mappedUnits = 0;
+let coverageVisits = 0;
+let rowVisits = 0;
 let readings = 0;
 export function armPoolBudgetForTest() {
-    return { spanCount: poolSpanCount, coveredPositions, headScreenHits, fullYCalls, armCount: poolArmCount, boundaryArmCount: poolBoundaryArmCount, forensicLevels, forensicRuns, forensicSkips, urlSegmentRuns, urlSegmentReplays, ssh2ScanBytes, mappedUnits, readings };
+    return { spanCount: poolSpanCount, coveredPositions, headScreenHits, fullYCalls, armCount: poolArmCount, boundaryArmCount: poolBoundaryArmCount, forensicLevels, forensicRuns, forensicSkips, urlSegmentRuns, urlSegmentReplays, ssh2ScanBytes, mappedUnits, readings, coverageVisits, rowVisits };
 }
 export function resetArmPoolBudgetForTest() {
     poolSpanCount = 0;
@@ -478,6 +480,8 @@ export function resetArmPoolBudgetForTest() {
     ssh2ScanBytes = 0;
     mappedUnits = 0;
     readings = 0;
+    coverageVisits = 0;
+    rowVisits = 0;
 }
 const unitBit = (t, c) => (t[c >>> 5] >>> (c & 31)) & 1;
 let codeUnitDomain;
@@ -707,6 +711,166 @@ function deriveLiteralHead(re) {
         first: unionMembers(per.map((p) => p.first)),
     };
 }
+const repeatLen = (k, len) => (k === 0 ? 0 : k * len);
+function readReachAlternatives(src, from) {
+    const alts = [];
+    let i = from;
+    for (;;) {
+        const one = readReachSequence(src, i);
+        alts.push(one.reading);
+        i = one.next;
+        if (src[i] !== "|")
+            break;
+        i += 1;
+    }
+    return { alts, next: i };
+}
+function readReachSequence(src, from) {
+    const fail = (at, why) => {
+        throw new Error(`redact: decision-reach derivation cannot read ${why} at ${at} in /${src}/`);
+    };
+    let pos = 0;
+    let reach = 0;
+    let beyond = false;
+    let wallReach = 0;
+    const goesBeyond = () => {
+        beyond = true;
+        wallReach = Math.max(wallReach, reach);
+    };
+    let i = from;
+    while (i < src.length) {
+        const c = src[i];
+        if (c === "|" || c === ")")
+            break;
+        let atom;
+        if (c === "(") {
+            const open = /^\((\?:|\?=|\?!|\?<=|\?<!)/.exec(src.slice(i));
+            if (open === null)
+                return fail(i, "a capturing or named group");
+            const mark = open[1];
+            const inner = readReachAlternatives(src, i + 1 + mark.length);
+            if (src[inner.next] !== ")")
+                return fail(i, "an unbalanced group");
+            i = inner.next + 1;
+            atom = {
+                len: Math.max(...inner.alts.map((a) => a.len)),
+                reach: Math.max(...inner.alts.map((a) => a.reach)),
+                beyond: inner.alts.some((a) => a.beyond),
+                wallReach: Math.max(0, ...inner.alts.filter((a) => a.beyond).map((a) => a.wallReach)),
+            };
+            if (mark === "?<=" || mark === "?<!")
+                continue;
+            if (mark === "?=" || mark === "?!") {
+                if (pos === Infinity)
+                    goesBeyond();
+                else {
+                    reach = Math.max(reach, pos + atom.reach);
+                    if (atom.beyond) {
+                        beyond = true;
+                        wallReach = Math.max(wallReach, pos + atom.wallReach);
+                    }
+                }
+                continue;
+            }
+        }
+        else if (c === "[") {
+            let k = i + 1;
+            while (k < src.length && src[k] !== "]")
+                k += src[k] === "\\" ? 2 : 1;
+            if (k >= src.length)
+                return fail(i, "an unterminated character class");
+            atom = { len: 1, reach: 1, beyond: false, wallReach: 0 };
+            i = k + 1;
+        }
+        else if (c === "\\") {
+            const e = src[i + 1];
+            if (e === undefined)
+                return fail(i, "a dangling escape");
+            if (e === "b" || e === "B") {
+                if (pos === Infinity)
+                    goesBeyond();
+                else
+                    reach = Math.max(reach, pos + 1);
+                i += 2;
+                continue;
+            }
+            if (/[1-9k]/.test(e))
+                return fail(i, "a back-reference");
+            const wide = /^\\(?:u[0-9A-Fa-f]{4}|u\{[0-9A-Fa-f]+\}|x[0-9A-Fa-f]{2}|[pP]\{[^}]+\}|c[A-Za-z]|.)/.exec(src.slice(i));
+            atom = { len: 1, reach: 1, beyond: false, wallReach: 0 };
+            i += wide[0].length;
+        }
+        else if (c === "^" || c === "$") {
+            return fail(i, "an anchor");
+        }
+        else if (c === "*" || c === "+" || c === "?" || c === "{") {
+            return fail(i, "a quantifier without an atom");
+        }
+        else {
+            atom = { len: 1, reach: 1, beyond: false, wallReach: 0 };
+            i += 1;
+        }
+        let lo = 1;
+        let hi = 1;
+        const q = src[i];
+        if (q === "*") {
+            lo = 0;
+            hi = Infinity;
+            i += 1;
+        }
+        else if (q === "+") {
+            lo = 1;
+            hi = Infinity;
+            i += 1;
+        }
+        else if (q === "?") {
+            lo = 0;
+            hi = 1;
+            i += 1;
+        }
+        else if (q === "{") {
+            const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
+            if (m === null)
+                return fail(i, "a quantifier");
+            lo = Number(m[1]);
+            hi = m[2] === undefined ? lo : m[3] === "" ? Infinity : Number(m[3]);
+            i += m[0].length;
+        }
+        if (src[i] === "?")
+            return fail(i, "a lazy quantifier");
+        if (pos === Infinity) {
+            if (lo > 0)
+                goesBeyond();
+            continue;
+        }
+        const counted = hi === Infinity ? lo : hi;
+        if (counted > 0) {
+            reach = Math.max(reach, pos + repeatLen(counted - 1, atom.len) + atom.reach);
+            if (atom.beyond) {
+                beyond = true;
+                wallReach = Math.max(wallReach, pos + repeatLen(counted - 1, atom.len) + atom.wallReach);
+            }
+        }
+        pos = hi === Infinity || atom.len === Infinity ? Infinity : pos + repeatLen(hi, atom.len);
+    }
+    return { reading: { len: pos, reach, beyond, wallReach }, next: i };
+}
+function regexDecisionReach(re, lexical) {
+    if (/[uv]/.test(re.flags))
+        throw new Error(`redact: decision-reach derivation does not support the u/v flags on /${re.source}/`);
+    const read = readReachAlternatives(re.source, 0);
+    if (read.next !== re.source.length)
+        throw new Error(`redact: decision-reach derivation stopped at ${read.next} in /${re.source}/`);
+    let reach = 0;
+    for (const alt of read.alts) {
+        if (alt.beyond && !lexical)
+            throw new Error(`redact: arm /${re.source}/ decides beyond an unbounded run but registers no undecided tail`);
+        reach = Math.max(reach, alt.reach, alt.beyond ? alt.wallReach : 0);
+    }
+    if (!Number.isFinite(reach))
+        throw new Error(`redact: decision-reach derivation read no finite reach for /${re.source}/`);
+    return reach;
+}
 function scanResumeAfterHit(start, end, back) {
     return Math.max(start + 1, end - back);
 }
@@ -715,7 +879,7 @@ function collectRegexSpans(a, text, out) {
     g.lastIndex = 0;
     for (let m = g.exec(text); m !== null; m = g.exec(text)) {
         const end = m.index + m[0].length;
-        out.push({ start: m.index, end, repl: a.repl, rank: a.rank, order: a.order });
+        out.push({ start: m.index, end, repl: a.repl, rank: a.rank, order: a.order, anchor: m.index, closeAt: NOT_CLOSED });
         g.lastIndex = scanResumeAfterHit(m.index, end, a.back);
     }
 }
@@ -792,7 +956,7 @@ function collectValueArmSpans(arm, text, out) {
         }
         else
             break;
-        out.push({ start: idx, end, repl, rank, order });
+        out.push({ start: idx, end, repl, rank, order, anchor: idx, closeAt: NOT_CLOSED });
         pos = scanResumeAfterHit(idx, end, back);
     }
 }
@@ -808,7 +972,7 @@ function collectStickySpans(a, text, at, out) {
         if (m === null)
             continue;
         const end = p + m[0].length;
-        out.push({ start: p, end, repl, rank, order });
+        out.push({ start: p, end, repl, rank, order, anchor: p, closeAt: NOT_CLOSED });
         pos = scanResumeAfterHit(p, end, back);
     }
 }
@@ -871,13 +1035,13 @@ function undecidedKeywordStart(text, t) {
     return -1;
 }
 const CREDENTIAL_NAME_ANCHORS = {
-    api_key: "structure-only", apikey: "structure-only", "api-key": "structure-only", key: "structure-only",
-    token: "structure-only", access_token: "structure-only", refresh_token: "structure-only", id_token: "structure-only",
+    api_key: "declarative", apikey: "declarative", "api-key": "declarative", key: "structure-only",
+    token: "structure-only", access_token: "declarative", refresh_token: "declarative", id_token: "declarative",
     auth: "structure-only", authorization: "auth-scheme", "proxy-authorization": "auth-scheme",
     password: "declarative", passwd: "any-form", pwd: "any-form",
-    secret: "declarative", client_secret: "declarative", private_key: "structure-only",
+    secret: "declarative", client_secret: "declarative", private_key: "declarative",
     signature: "structure-only", sig: "structure-only",
-    "x-amz-signature": "structure-only", "x-amz-security-token": "structure-only", "x-amz-credential": "structure-only",
+    "x-amz-signature": "declarative", "x-amz-security-token": "declarative", "x-amz-credential": "declarative",
     sas: "structure-only",
 };
 const CREDENTIAL_NAME_ALT = (() => {
@@ -921,6 +1085,8 @@ const STRUCTURAL_SECRET_PATTERNS = [
     [/:(?<=[A-Za-z][A-Za-z0-9+.-]*:)\/\//g, "$1«redacted»"],
     [new RegExp(buildJsonSecretFieldSource(), "gi"), '$1"«redacted»"'],
 ];
+const PPK_FILE_HEAD = "PuTTY-User-Key-File-";
+const PPK_LINES_FIELD = "Private-Lines: ";
 const PPK_CONTAINER_TOKEN = "«redacted:private-key»";
 const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
 const HEADLESS_PPK_TOKEN = "«redacted:private-key:partial»";
@@ -962,7 +1128,7 @@ function skipPemSeps(scan, s, i, limit) {
     for (;;) {
         if (i >= limit)
             return i;
-        if (opaqueUnitEnd(scan, i) >= 0)
+        if (tokenEnd(scan, i) >= 0)
             return i;
         const c = s.charCodeAt(i);
         if (isSepCode(c)) {
@@ -1006,16 +1172,16 @@ function pemInlineSepLen(s, i, limit) {
     return 0;
 }
 function probePemHeaderToken(scan, s, p, limit) {
-    if (p >= limit || opaqueUnitEnd(scan, p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
+    if (p >= limit || tokenEnd(scan, p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
         return -1;
     p += 1;
     let identLen = 1;
-    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && opaqueUnitEnd(scan, p) < 0 && isIdentCode(s.charCodeAt(p))) {
+    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && tokenEnd(scan, p) < 0 && isIdentCode(s.charCodeAt(p))) {
         p += 1;
         identLen += 1;
     }
     for (;;) {
-        if (p >= limit || opaqueUnitEnd(scan, p) >= 0)
+        if (p >= limit || tokenEnd(scan, p) >= 0)
             return -1;
         const c = s.charCodeAt(p);
         if (c === CH_SPACE || c === CH_TAB) {
@@ -1047,7 +1213,7 @@ function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
     for (;;) {
         if (p >= limit)
             return setPemHdr(scan, start, p, p, true);
-        const unit = opaqueUnitEnd(scan, p);
+        const unit = crossEnd(scan, p);
         if (unit >= 0) {
             p = Math.min(unit, limit);
             continue;
@@ -1077,7 +1243,7 @@ function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
         }
         let q = p;
         for (;;) {
-            if (opaqueUnitEnd(scan, q) >= 0)
+            if (tokenEnd(scan, q) >= 0)
                 break;
             const b = pemLineBreakLen(s, q, limit);
             if (b === 1)
@@ -1104,7 +1270,7 @@ function parsePemBody(scan, s, i, limit) {
     for (;;) {
         const q = skipPemSeps(scan, s, p, limit);
         let r = q;
-        while (r < limit && opaqueUnitEnd(scan, r) < 0 && isBase64Code(s.charCodeAt(r)))
+        while (r < limit && tokenEnd(scan, r) < 0 && isBase64Code(s.charCodeAt(r)))
             r += 1;
         if (r - q < PEM_BODY_RUN_MIN)
             break;
@@ -1113,20 +1279,34 @@ function parsePemBody(scan, s, i, limit) {
     }
     return end;
 }
-function rightmostPemRunEnd(scan, s, from, to) {
+function rightmostPemRunEnd(scan, s, from, to, crossEndsRun) {
     let best = -1;
     let runStart = -1;
     let plainBackslashTill = -1;
     for (let p = from; p <= to; p++) {
         if (p < to) {
-            const unit = opaqueUnitEnd(scan, p);
-            if (unit > 0) {
+            const tok = tokenEnd(scan, p);
+            if (tok > 0) {
                 if (runStart >= 0 && p - runStart >= PEM_BODY_RUN_MIN)
                     best = p;
                 runStart = -1;
-                if (unit > to)
+                if (tok > to)
                     return best;
-                p = unit - 1;
+                p = tok - 1;
+                continue;
+            }
+            const cross = crossEnd(scan, p);
+            if (cross > 0) {
+                if (crossEndsRun) {
+                    if (runStart >= 0 && p - runStart >= PEM_BODY_RUN_MIN)
+                        best = p;
+                    runStart = -1;
+                    if (cross >= to)
+                        return best;
+                }
+                else if (cross >= to)
+                    return runStart >= 0 && to - runStart >= PEM_BODY_RUN_MIN ? to : best;
+                p = cross - 1;
                 continue;
             }
             if (p >= plainBackslashTill && s.charCodeAt(p) === CH_BACKSLASH) {
@@ -1193,7 +1373,7 @@ function findPemFence(scan, text, from) {
         if (!isPemFenceLabel(text, labelFrom, close))
             continue;
         const after = close + PEM_FENCE_CLOSE.length;
-        if (anchorHeld(scan, fence, after))
+        if (lineHeld(scan, fence, after, readingKey(familyCode("pem-armor"), fence)))
             continue;
         return { fence, after };
     }
@@ -1201,131 +1381,112 @@ function findPemFence(scan, text, from) {
 const SSH2_FENCE_OPEN = "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_FENCE_CLOSE = "---- END SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_BODY_MAX = 8192;
-function unitCountWithin(scan, from, to, max, t = scan.table) {
-    if (to - from <= max)
-        return true;
-    noteEvidenceRead(scan, from);
-    noteEvidenceRead(scan, to);
-    const lo = firstCredentialSpanFrom(t, from);
-    let a = lo;
-    let b = t.ends.length;
-    while (a < b) {
-        const mid = (a + b) >>> 1;
-        if (t.ends[mid] <= to)
-            a = mid + 1;
-        else
-            b = mid;
-    }
-    if (a === lo)
-        return false;
-    const saved = unitSavings(t);
-    return to - from - (saved[a] - saved[lo]) <= max;
+function armorCloseAt(scan, text, kind, bodyFrom, max) {
+    const near = firstDelim(scan, text, kind, bodyFrom, false);
+    if (near < 0)
+        return -1;
+    const free = firstDelim(scan, text, kind, bodyFrom, true);
+    const far = free >= 0 ? free : lastNotHiddenDelim(scan, text, kind, near, text.length);
+    if (far > near && blockWithin(scan, text, kind, bodyFrom, far, max))
+        return far;
+    return blockWithin(scan, text, kind, bodyFrom, near, max) ? near : -1;
 }
-const UNIT_SAVINGS = new WeakMap();
-function unitSavings(t) {
-    let saved = UNIT_SAVINGS.get(t);
-    if (saved === undefined) {
-        const n = t.starts.length;
-        saved = new Float64Array(n + 1);
-        for (let k = 0; k < n; k++)
-            saved[k + 1] = saved[k] + (t.ends[k] - t.starts[k] - 1);
-        UNIT_SAVINGS.set(t, saved);
-    }
-    return saved;
+function closeLineEnd(text, kind, close) {
+    return kind === "ssh2-close" ? close + SSH2_FENCE_CLOSE.length : pemFenceLineEnd(text, close + PEM_END_OPEN.length);
 }
-export function unitCountWithinForTest(table, from, to, max) {
-    const t = { starts: Int32Array.from(table, (x) => x[0]), ends: Int32Array.from(table, (x) => x[1]) };
-    return unitCountWithin(buildForensicScan(t, 1), from, to, max);
+function blockWithin(scan, text, kind, bodyFrom, close, max) {
+    const lineEnd = closeLineEnd(text, kind, close);
+    return measureWithin(scan, bodyFrom, lineEnd, max + (lineEnd - close));
 }
 function collectSsh2FenceSpans(scan, text, json, span, isHead) {
-    let cachedFrom = 0;
-    let cachedAt;
-    const nextClose = (from) => {
-        if (cachedAt !== undefined && cachedFrom <= from && (cachedAt < 0 || cachedAt >= from))
-            return cachedAt;
-        let p = text.indexOf(SSH2_FENCE_CLOSE, from);
-        ssh2ScanBytes += (p < 0 ? text.length : p) - from;
-        while (p >= 0 && inOpaqueUnit(scan, p)) {
-            const q = text.indexOf(SSH2_FENCE_CLOSE, p + 1);
-            ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
-            p = q;
-        }
-        cachedFrom = from;
-        cachedAt = p;
-        return p;
-    };
-    let freeFrom = 0;
-    let freeAt;
-    const freeClose = (from) => {
-        if (freeAt !== undefined && freeFrom <= from && (freeAt < 0 || freeAt >= from))
-            return freeAt;
-        let p = text.indexOf(SSH2_FENCE_CLOSE, from);
-        ssh2ScanBytes += (p < 0 ? text.length : p) - from;
-        while (p >= 0 && anchorHeld(scan, p, p + 1)) {
-            const q = text.indexOf(SSH2_FENCE_CLOSE, p + 1);
-            ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
-            p = q;
-        }
-        freeFrom = from;
-        freeAt = p;
-        return p;
-    };
-    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, freeClose);
+    const fam = familyCode("ssh2-armor");
+    const opens = delimPositions(scan, text, "ssh2-open");
+    const closes = delimPositions(scan, text, "ssh2-close");
+    const blockEnds = [];
+    let firstLive = 0;
+    let freshFrom = -1;
+    let freshEnd = -1;
+    for (let oi = 0, ci = 0, rooted = false, prevEnd = -1; ci < closes.length;) {
+        const c = closes[ci];
+        if (oi < opens.length && opens[oi] < c) {
+            rooted = true;
+            prevEnd = -1;
+            oi += 1;
+            continue;
+        }
+        if (rooted && prevEnd >= 0) {
+            scan.self = readingKey(fam, c);
+            while (firstLive < blockEnds.length && uncoveredWithin(scan, blockEnds[firstLive], c + SSH2_FENCE_CLOSE.length) > SSH2_BODY_MAX + SSH2_FENCE_CLOSE.length)
+                firstLive += 1;
+            for (let j = firstLive; j < blockEnds.length; j++) {
+                const from = blockEnds[j];
+                if (from > c)
+                    break;
+                if ((from === freshFrom && blockWithin(scan, text, "ssh2-close", freshEnd, c, SSH2_BODY_MAX - 1)) || blockWithin(scan, text, "ssh2-close", from, c, SSH2_BODY_MAX)) {
+                    span(from, c + SSH2_FENCE_CLOSE.length, c, NOT_CLOSED);
+                    freshFrom = from;
+                    freshEnd = c + SSH2_FENCE_CLOSE.length;
+                    break;
+                }
+            }
+        }
+        prevEnd = c + SSH2_FENCE_CLOSE.length;
+        if (rooted)
+            blockEnds.push(prevEnd);
+        ci += 1;
+    }
     let openFrom = 0;
     let openAt;
     const nextFreeOpen = (from) => {
         if (openAt !== undefined && openFrom <= from && (openAt < 0 || openAt >= from))
             return openAt;
-        let p = text.indexOf(SSH2_FENCE_OPEN, from);
-        ssh2ScanBytes += (p < 0 ? text.length : p) - from;
-        while (p >= 0 && anchorHeld(scan, p, p + SSH2_FENCE_OPEN.length)) {
-            const q = text.indexOf(SSH2_FENCE_OPEN, p + 1);
-            ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
-            p = q;
-        }
+        let k = lowerBound(opens, from);
+        while (k < opens.length && lineHeld(scan, opens[k], opens[k] + SSH2_FENCE_OPEN.length, readingKey(fam, opens[k])))
+            k += 1;
         openFrom = from;
-        openAt = p;
-        return p;
+        openAt = k < opens.length ? opens[k] : -1;
+        return openAt;
     };
-    for (let from = 0;;) {
-        const fence = text.indexOf(SSH2_FENCE_OPEN, from);
-        if (fence < 0)
-            return;
+    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, (from) => firstDelim(scan, text, "ssh2-close", from, true));
+    for (let oi = 0; oi < opens.length;) {
+        const fence = opens[oi];
         const bodyFrom = fence + SSH2_FENCE_OPEN.length;
-        if (anchorHeld(scan, fence, bodyFrom)) {
-            from = fence + 1;
+        if (lineHeld(scan, fence, bodyFrom, readingKey(fam, fence))) {
+            oi += 1;
             continue;
         }
-        if (isHead && unitCountWithin(scan, bodyFrom, text.length, SSH2_BODY_MAX)) {
-            span(fence, text.length, true);
+        scan.self = readingKey(fam, fence);
+        if (isHead && measureWithin(scan, bodyFrom, text.length, SSH2_BODY_MAX)) {
+            span(fence, text.length, fence, NOT_CLOSED, true);
             return;
         }
         let resume = fence + 1;
         if (!isHead) {
             const open = nextFreeOpen(bodyFrom);
             const limit = open < 0 ? text.length : open;
-            const t = truncatedEnd(bodyFrom, limit);
-            const bodyEnd = t < 0 ? -1 : armorBodyEnd(scan, text, json, bodyFrom, limit, false);
-            const end = bodyEnd < 0 ? -1 : Math.max(bodyEnd, t);
-            if (end >= 0 && unitCountWithin(scan, bodyFrom, end, SSH2_BODY_MAX, othersOf(scan))) {
-                span(fence, end);
+            const readEnd = (crossEndsRun) => {
+                const t = truncatedEnd(bodyFrom, limit, crossEndsRun);
+                const bodyEnd = t < 0 ? -1 : armorBodyEnd(scan, text, json, bodyFrom, limit, false, crossEndsRun);
+                return bodyEnd < 0 ? -1 : Math.max(bodyEnd, t);
+            };
+            const far = readEnd(false);
+            const near = far >= 0 && !measureWithin(scan, bodyFrom, far, SSH2_BODY_MAX) ? readEnd(true) : -1;
+            const end = near >= 0 && near < far ? near : far;
+            if (end >= 0 && measureWithin(scan, bodyFrom, end, SSH2_BODY_MAX)) {
+                span(fence, end, fence, NOT_CLOSED);
                 resume = end;
             }
         }
-        const close = nextClose(bodyFrom);
+        const close = armorCloseAt(scan, text, "ssh2-close", bodyFrom, SSH2_BODY_MAX);
         if (close < 0) {
-            if (isHead)
+            if (isHead && firstDelim(scan, text, "ssh2-close", bodyFrom, false) < 0)
                 return;
-            from = resume;
-            continue;
-        }
-        if (!unitCountWithin(scan, bodyFrom, close, SSH2_BODY_MAX)) {
-            from = resume;
+            oi = lowerBound(opens, resume);
             continue;
         }
         const end = close + SSH2_FENCE_CLOSE.length;
-        span(fence, end);
-        from = Math.max(resume, scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length));
+        span(fence, end, fence, close);
+        oi = lowerBound(opens, delimClass(scan, close) === DELIM_FREE ? Math.max(resume, scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length)) : resume);
     }
 }
 const PEM_END_OPEN = "-----END";
@@ -1344,24 +1505,7 @@ function pemFenceLineEnd(text, labelFrom) {
     return isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : PEM_LINE_INVALID;
 }
 function collectPemFenceSpans(scan, text, span, isHead) {
-    let endFrom = -1;
-    let endAt = -1;
-    let endAfter = -1;
-    const visibleEndLine = (b) => {
-        const after = pemFenceLineEnd(text, b + PEM_END_OPEN.length);
-        return after >= 0 && !inOpaqueUnit(scan, b) ? after : -1;
-    };
-    const earliestEndFence = (from) => {
-        if (endFrom >= 0 && from >= endFrom && (endAt < 0 || endAt >= from))
-            return;
-        let b = text.indexOf(PEM_END_OPEN, from);
-        let after = -1;
-        while (b >= 0 && (after = visibleEndLine(b)) < 0)
-            b = text.indexOf(PEM_END_OPEN, b + 1);
-        endFrom = from;
-        endAt = b;
-        endAfter = after;
-    };
+    const fam = familyCode("pem-armor");
     for (let from = 0;;) {
         const fence = text.indexOf(PEM_FENCE_OPEN, from);
         if (fence < 0)
@@ -1371,23 +1515,25 @@ function collectPemFenceSpans(scan, text, span, isHead) {
             from = fence + 1;
             continue;
         }
-        if (anchorHeld(scan, fence, bodyFrom === PEM_LINE_OPEN ? text.length : bodyFrom)) {
+        if (lineHeld(scan, fence, bodyFrom === PEM_LINE_OPEN ? text.length : bodyFrom, readingKey(fam, fence))) {
             from = fence + 1;
             continue;
         }
-        if (bodyFrom !== PEM_LINE_OPEN)
-            earliestEndFence(bodyFrom);
-        if (bodyFrom === PEM_LINE_OPEN || endAt < 0) {
+        scan.self = readingKey(fam, fence);
+        const near = bodyFrom === PEM_LINE_OPEN ? -1 : firstDelim(scan, text, "pem-end", bodyFrom, false);
+        if (near < 0 || (isHead && firstDelim(scan, text, "pem-end", bodyFrom, true) < 0)) {
             if (isHead)
-                span(fence, text.length, true);
+                span(fence, text.length, fence, NOT_CLOSED, true);
             return;
         }
-        if (!unitCountWithin(scan, bodyFrom, endAt, PEM_FENCE_BODY_MAX)) {
+        const endAt = armorCloseAt(scan, text, "pem-end", bodyFrom, PEM_FENCE_BODY_MAX);
+        if (endAt < 0) {
             from = fence + 1;
             continue;
         }
-        span(fence, endAfter);
-        from = scanResumeAfterHit(fence, endAfter, PEM_FENCE_OPEN.length);
+        const endAfter = pemFenceLineEnd(text, endAt + PEM_END_OPEN.length);
+        span(fence, endAfter, fence, endAt);
+        from = delimClass(scan, endAt) === DELIM_FREE ? scanResumeAfterHit(fence, endAfter, PEM_FENCE_OPEN.length) : fence + 1;
     }
 }
 function truncationWindowEnd(text, from, json) {
@@ -1404,13 +1550,13 @@ function truncationWindowEnd(text, from, json) {
     }
     return text.length;
 }
-function armorBodyEnd(scan, text, json, from, limit, allowBare) {
+function armorBodyEnd(scan, text, json, from, limit, allowBare, crossEndsRun) {
     let pos = from;
     let bare = allowBare;
     let hitLimit = false;
     let rightmost = -1;
     while (parsePemHeaderLine(scan, text, pos, limit, bare, json)) {
-        const e = rightmostPemRunEnd(scan, text, scan.hdr.search, scan.hdr.contentEnd);
+        const e = rightmostPemRunEnd(scan, text, scan.hdr.search, scan.hdr.contentEnd, crossEndsRun);
         if (e > rightmost)
             rightmost = e;
         pos = scan.hdr.next;
@@ -1429,7 +1575,7 @@ function armorBodyEnd(scan, text, json, from, limit, allowBare) {
 function createTruncatedBlockEnd(scan, text, json, closeAt) {
     let winFrom = -1;
     let winAt = -1;
-    return (from, limit) => {
+    return (from, limit, crossEndsRun) => {
         if (!(winFrom >= 0 && from >= winFrom && from <= winAt)) {
             winFrom = from;
             winAt = truncationWindowEnd(text, from, json);
@@ -1437,38 +1583,28 @@ function createTruncatedBlockEnd(scan, text, json, closeAt) {
         const close = closeAt(from);
         if (close >= 0 && close < winAt)
             return -1;
-        return rightmostPemRunEnd(scan, text, from, Math.min(limit, winAt));
+        return rightmostPemRunEnd(scan, text, from, Math.min(limit, winAt), crossEndsRun);
     };
 }
 function collectPemFragmentSpans(scan, text, json, span, isHead) {
+    const fam = familyCode("pem-armor");
     let cur = findPemFence(scan, text, 0);
     let inherited = false;
-    let closeFrom = -1;
-    let closeAt = -1;
-    const freeClose = (from) => {
-        if (closeFrom >= 0 && from >= closeFrom && (closeAt < 0 || closeAt >= from))
-            return closeAt;
-        let b = text.indexOf(PEM_END_OPEN, from);
-        while (b >= 0 && (pemFenceLineEnd(text, b + PEM_END_OPEN.length) < 0 || anchorHeld(scan, b, b + 1)))
-            b = text.indexOf(PEM_END_OPEN, b + 1);
-        closeFrom = from;
-        closeAt = b;
-        return b;
-    };
-    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, freeClose);
+    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, (from) => firstDelim(scan, text, "pem-end", from, true));
     while (cur !== undefined) {
         const next = findPemFence(scan, text, cur.after);
         const limit = next === undefined ? text.length : next.fence;
-        const bodyEnd = armorBodyEnd(scan, text, json, cur.after, limit, inherited);
+        scan.self = readingKey(fam, cur.fence);
+        const bodyEnd = armorBodyEnd(scan, text, json, cur.after, limit, inherited, false);
         inherited = scan.hdr.hitLimit;
-        const end = isHead || bodyEnd < 0 ? bodyEnd : Math.max(bodyEnd, truncatedEnd(cur.after, limit));
+        const end = isHead || bodyEnd < 0 ? bodyEnd : Math.max(bodyEnd, truncatedEnd(cur.after, limit, false));
         if (end >= 0)
-            span(cur.fence, end);
+            span(cur.fence, end, cur.fence, NOT_CLOSED);
         cur = next;
     }
 }
 function collectHeadlessPpkSpans(scan, text, span, isHead) {
-    const KEY = "Private-Lines: ";
+    const KEY = PPK_LINES_FIELD;
     const n = text.length;
     const LINE_NONE = -1;
     const LINE_OPEN = -2;
@@ -1476,19 +1612,20 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         if (!isHead)
             return false;
         let k = i;
-        while (k < n && opaqueUnitEnd(scan, k) < 0 && text.charCodeAt(k) === 92)
+        while (k < n && tokenEnd(scan, k) < 0 && text.charCodeAt(k) === 92)
             k += 1;
         return k >= n;
     };
     const isB64 = (c) => (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 43 || c === 47 || c === 61;
-    const b64At = (i) => opaqueUnitEnd(scan, i) < 0 && isB64(text.charCodeAt(i));
-    const skipHs = (i) => { while (i < n && opaqueUnitEnd(scan, i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
+    const b64At = (i) => tokenEnd(scan, i) < 0 && isB64(text.charCodeAt(i));
+    const skipHs = (i) => { while (i < n && tokenEnd(scan, i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
         i += 1; return i; };
+    const lineEndHidden = (i) => i < n && delimClass(scan, i) === DELIM_HIDDEN;
     const skipNewlines = (i) => {
         let q = skipHs(i);
         let seen = false;
         for (;;) {
-            if (opaqueUnitEnd(scan, q) >= 0)
+            if (lineEndHidden(q))
                 break;
             let any = false;
             if (text.charCodeAt(q) === 13) {
@@ -1523,7 +1660,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         return seen ? q : LINE_NONE;
     };
     const escapedNewlineLen = (i) => {
-        if (opaqueUnitEnd(scan, i) >= 0)
+        if (lineEndHidden(i))
             return 0;
         let k = i;
         while (k < n && text.charCodeAt(k) === 92)
@@ -1537,7 +1674,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         const b = skipHs(i);
         if (b >= n || openAt(b))
             return true;
-        if (opaqueUnitEnd(scan, b) >= 0)
+        if (tokenEnd(scan, b) >= 0 || lineEndHidden(b))
             return false;
         const c = text.charCodeAt(b);
         return c === 10 || c === 13 || c === 34 || escapedNewlineLen(b) > 0;
@@ -1547,7 +1684,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         if (q0 < 0)
             return q0;
         let q = q0;
-        const mk = opaqueUnitEnd(scan, q) < 0 ? text.charCodeAt(q) : -1;
+        const mk = tokenEnd(scan, q) < 0 ? text.charCodeAt(q) : -1;
         if (mk === 43 || mk === 45)
             q = skipHs(q + 1);
         let r = q;
@@ -1571,16 +1708,17 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
             break;
         let p = at + KEY.length;
         const d0 = p;
-        while (p < n && opaqueUnitEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
+        while (p < n && tokenEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
             p += 1;
         if (p === d0 && p < n) {
             search = at + KEY.length;
             continue;
         }
-        if (anchorHeld(scan, at, p)) {
+        if (lineHeld(scan, at, p, readingKey(familyCode("putty-ppk"), at))) {
             search = at + KEY.length;
             continue;
         }
+        scan.self = readingKey(familyCode("putty-ppk"), at);
         let end = -1;
         let open = false;
         for (let from = p;;) {
@@ -1598,7 +1736,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
             search = p;
             continue;
         }
-        span(at, end, open);
+        span(at, end, at, NOT_CLOSED, open);
         search = end;
     }
 }
@@ -1735,8 +1873,8 @@ function tokenUnitEnd(text, p) {
     TOKEN_UNIT_Y.lastIndex = p;
     return TOKEN_UNIT_Y.test(text) ? TOKEN_UNIT_Y.lastIndex : -1;
 }
-const NO_CREDENTIAL_SPANS = { starts: new Int32Array(0), ends: new Int32Array(0) };
-function credentialSpans(text) {
+const NO_TOKEN_UNITS = { starts: new Int32Array(0), ends: new Int32Array(0) };
+function tokenUnits(text) {
     const iv = [];
     for (let i = text.indexOf("«"); i >= 0; i = text.indexOf("«", i + 1)) {
         const e = tokenUnitEnd(text, i);
@@ -1746,8 +1884,7 @@ function credentialSpans(text) {
         }
     }
     if (iv.length === 0)
-        return NO_CREDENTIAL_SPANS;
-    iv.sort((a, b) => a[0] - b[0]);
+        return NO_TOKEN_UNITS;
     const starts = new Int32Array(iv.length);
     const ends = new Int32Array(iv.length);
     let k = 0;
@@ -1769,133 +1906,442 @@ function credentialSpans(text) {
     k += 1;
     return { starts: starts.subarray(0, k), ends: ends.subarray(0, k) };
 }
+function familyCode(f) {
+    switch (f) {
+        case "token": return 0;
+        case "pem-armor": return 1;
+        case "ssh2-armor": return 2;
+        case "putty-ppk": return 3;
+        case "url": return 4;
+        case "json-field": return 5;
+        case "anchor": return 6;
+        case "prose": return 7;
+    }
+}
+const FAMILY_SLOTS = 8;
+const TOKEN_FAMILY = familyCode("token");
+const readingKey = (family, anchor) => anchor * FAMILY_SLOTS + family;
+const NOT_CLOSED = -1;
+const NO_SELF = -1;
+const NO_ROWS = { starts: new Int32Array(0), ends: new Int32Array(0), family: new Uint8Array(0), anchor: new Int32Array(0), closeAt: new Int32Array(0) };
+function buildEvidenceRows(text) {
+    const s = [];
+    const e = [];
+    for (let i = text.indexOf("«"); i >= 0; i = text.indexOf("«", i + 1)) {
+        const end = tokenUnitEnd(text, i);
+        if (end > 0) {
+            s.push(i);
+            e.push(end);
+            i = end - 1;
+        }
+    }
+    if (s.length === 0)
+        return NO_ROWS;
+    const n = s.length;
+    const family = new Uint8Array(n).fill(TOKEN_FAMILY);
+    const ends = Int32Array.from(e);
+    return { starts: Int32Array.from(s), ends, family, anchor: Int32Array.from(s), closeAt: ends.map((x) => x - 1) };
+}
+const NO_DIRTY = { starts: new Int32Array(0), ends: new Int32Array(0) };
 let forensicRescanMode = "incremental";
 export function setForensicRescanModeForTest(mode) {
     forensicRescanMode = mode;
 }
-function foldCredentialSpans(prev, spans, from, admit) {
+const FORENSIC_LEVEL_MAX = 32;
+function compareRow(s1, f1, a1, c1, s2, f2, a2, c2) {
+    return s1 - s2 || f1 - f2 || a1 - a2 || (c1 === c2 ? 0 : c1 ? 1 : -1);
+}
+function foldEvidenceRows(prev, spans, from, familyOf) {
     const cap = spans.length - from;
     if (cap === 0)
-        return { next: prev, dirty: NO_CREDENTIAL_SPANS };
-    const Sa = new Int32Array(cap);
-    const Ea = new Int32Array(cap);
-    let m = 0;
-    for (let i = from; i < spans.length; i++) {
-        const sp = spans[i];
-        if (admit !== undefined && !admit(sp))
-            continue;
-        const k = firstCredentialSpanFrom(prev, sp.start + 1) - 1;
-        if (k >= 0 && prev.ends[k] >= sp.end)
-            continue;
-        Sa[m] = sp.start;
-        Ea[m] = sp.end;
-        m += 1;
-    }
-    if (m === 0)
-        return { next: prev, dirty: NO_CREDENTIAL_SPANS };
-    const S = Sa.subarray(0, m).sort();
-    const E = Ea.subarray(0, m).sort();
-    const cs = new Int32Array(m);
-    const ce = new Int32Array(m);
-    let C = 0;
-    for (let i = 0, j = 0, depth = 0, open = 0; i < m || j < m;) {
-        if (i < m && (j >= m || S[i] <= E[j])) {
-            if (depth === 0)
-                open = S[i];
-            depth += 1;
-            i += 1;
+        return { next: prev, dirty: NO_DIRTY };
+    const idx = Array.from({ length: cap }, (_, i) => from + i);
+    const fam = new Uint8Array(spans.length);
+    for (let i = from; i < spans.length; i++)
+        fam[i] = familyOf(spans[i].order);
+    idx.sort((x, y) => {
+        const a = spans[x];
+        const b = spans[y];
+        return compareRow(a.start, fam[x], a.anchor, a.closeAt >= 0, b.start, fam[y], b.anchor, b.closeAt >= 0) || b.end - a.end || b.closeAt - a.closeAt;
+    });
+    const P = prev.starts.length;
+    const total = P + cap;
+    const oS = new Int32Array(total);
+    const oE = new Int32Array(total);
+    const oF = new Uint8Array(total);
+    const oA = new Int32Array(total);
+    const oC = new Int32Array(total);
+    const dS = [];
+    const dE = [];
+    let on = 0;
+    let pi = 0;
+    let ni = 0;
+    const push = (s, e, f, a, c) => {
+        oS[on] = s;
+        oE[on] = e;
+        oF[on] = f;
+        oA[on] = a;
+        oC[on] = c;
+        on += 1;
+    };
+    while (pi < P || ni < cap) {
+        let take;
+        let sp;
+        let nf = 0;
+        if (ni < cap) {
+            sp = spans[idx[ni]];
+            nf = fam[idx[ni]];
         }
+        if (pi >= P)
+            take = "new";
+        else if (sp === undefined)
+            take = "prev";
         else {
-            depth -= 1;
-            if (depth === 0) {
-                cs[C] = open;
-                ce[C] = E[j];
-                C += 1;
+            const c = compareRow(prev.starts[pi], prev.family[pi], prev.anchor[pi], prev.closeAt[pi] >= 0, sp.start, nf, sp.anchor, sp.closeAt >= 0);
+            take = c < 0 ? "prev" : c > 0 ? "new" : "both";
+        }
+        if (take === "prev") {
+            push(prev.starts[pi], prev.ends[pi], prev.family[pi], prev.anchor[pi], prev.closeAt[pi]);
+            pi += 1;
+            continue;
+        }
+        const s = sp.start;
+        let e = sp.end;
+        let c = sp.closeAt;
+        const a = sp.anchor;
+        let nj = ni + 1;
+        while (nj < cap) {
+            const t = spans[idx[nj]];
+            if (compareRow(t.start, fam[idx[nj]], t.anchor, t.closeAt >= 0, s, nf, a, c >= 0) !== 0)
+                break;
+            nj += 1;
+        }
+        ni = nj;
+        if (take === "both") {
+            const pe = prev.ends[pi];
+            const pc = prev.closeAt[pi];
+            pi += 1;
+            if (pe > e || (pe === e && pc >= c)) {
+                push(s, pe, nf, a, pc);
+                continue;
             }
-            j += 1;
+            dS.push(s);
+            dE.push(Math.max(e, pe));
         }
+        else {
+            dS.push(s);
+            dE.push(e);
+        }
+        push(s, e, nf, a, c);
     }
-    const P = prev.starts.length;
-    const oS = new Int32Array(P + C);
-    const oE = new Int32Array(P + C);
-    const dS = new Int32Array(C + P);
-    const dE = new Int32Array(C + P);
-    let on = 0;
-    let dn = 0;
-    let curS = 0;
-    let curE = 0;
-    let sources = 0;
-    let onlyPrev = false;
-    const flush = () => {
-        if (sources === 0)
-            return;
-        oS[on] = curS;
-        oE[on] = curE;
-        on += 1;
-        if (!(sources === 1 && onlyPrev)) {
-            dS[dn] = curS;
-            dE[dn] = curE;
-            dn += 1;
+    if (dS.length === 0)
+        return { next: prev, dirty: NO_DIRTY };
+    const next = { starts: oS.subarray(0, on), ends: oE.subarray(0, on), family: oF.subarray(0, on), anchor: oA.subarray(0, on), closeAt: oC.subarray(0, on) };
+    const ixP = rowIndexOf(prev);
+    const ixN = rowIndexOf(next);
+    for (let a = 0, b = 0; a < P && b < on;) {
+        const c = compareRow(prev.starts[a], prev.family[a], prev.anchor[a], prev.closeAt[a] >= 0, next.starts[b], next.family[b], next.anchor[b], next.closeAt[b] >= 0);
+        if (c > 0) {
+            b += 1;
+            continue;
         }
-    };
-    for (let pi = 0, ci = 0; pi < P || ci < C;) {
-        const takePrev = ci >= C || (pi < P && prev.starts[pi] <= cs[ci]);
-        const s = takePrev ? prev.starts[pi] : cs[ci];
-        const e = takePrev ? prev.ends[pi] : ce[ci];
-        if (takePrev)
-            pi += 1;
-        else
-            ci += 1;
-        if (sources > 0 && s <= curE) {
-            if (e > curE)
-                curE = e;
-            sources += 1;
+        if (c === 0 && ixP.closedFor[a] !== ixN.closedFor[b]) {
+            dS.push(next.starts[b]);
+            dE.push(Math.max(next.closeAt[b], prev.closeAt[a]));
         }
+        a += 1;
+        if (c === 0)
+            b += 1;
+    }
+    return { next, dirty: mergeClosedIntervals(dS, dE) };
+}
+function mergeClosedIntervals(s, e) {
+    const order = Array.from(s.keys()).sort((x, y) => s[x] - s[y]);
+    const os = [];
+    const oe = [];
+    for (const k of order) {
+        const a = s[k];
+        const b = e[k];
+        const last = oe.length - 1;
+        if (last >= 0 && a <= oe[last])
+            oe[last] = Math.max(oe[last], b);
         else {
-            flush();
-            curS = s;
-            curE = e;
-            sources = 1;
-            onlyPrev = takePrev;
+            os.push(a);
+            oe.push(b);
         }
     }
-    flush();
-    return { next: { starts: oS.subarray(0, on), ends: oE.subarray(0, on) }, dirty: { starts: dS.subarray(0, dn), ends: dE.subarray(0, dn) } };
+    return { starts: Int32Array.from(os), ends: Int32Array.from(oe) };
+}
+export function evidenceRowsFoldForTest(prev, add) {
+    const sorted = [...prev].sort((x, y) => compareRow(x[0], x[2], x[3], x[4] >= 0, y[0], y[2], y[3], y[4] >= 0));
+    const table = {
+        starts: Int32Array.from(sorted, (x) => x[0]),
+        ends: Int32Array.from(sorted, (x) => x[1]),
+        family: Uint8Array.from(sorted, (x) => x[2]),
+        anchor: Int32Array.from(sorted, (x) => x[3]),
+        closeAt: Int32Array.from(sorted, (x) => x[4]),
+    };
+    const fams = add.map((x) => x[2]);
+    const spans = add.map(([start, end, , anchor, closeAt], order) => ({ start, end, repl: "", rank: 0, order, anchor, closeAt }));
+    const { next, dirty } = foldEvidenceRows(table, spans, 0, (order) => fams[order]);
+    return {
+        next: Array.from(next.starts, (s, i) => [s, next.ends[i], next.family[i], next.anchor[i], next.closeAt[i]]),
+        dirty: Array.from(dirty.starts, (s, i) => [s, dirty.ends[i]]),
+    };
 }
-export function credentialSpansFoldForTest(prev, add) {
-    const table = (iv) => ({ starts: Int32Array.from(iv, (x) => x[0]), ends: Int32Array.from(iv, (x) => x[1]) });
-    const back = (t) => Array.from(t.starts, (s, i) => [s, t.ends[i]]);
-    const spans = add.map(([start, end]) => ({ start, end, repl: "", rank: 0, order: 0 }));
-    const { next, dirty } = foldCredentialSpans(table(prev), spans, 0);
-    return { next: back(next), dirty: back(dirty) };
+function lowerBound(a, x) {
+    let lo = 0;
+    let hi = a.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (a[mid] < x)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo;
 }
-function firstCredentialSpanFrom(cs, from) {
+function upperBound(a, x) {
     let lo = 0;
-    let hi = cs.starts.length;
+    let hi = a.length;
     while (lo < hi) {
         const mid = (lo + hi) >>> 1;
-        if (cs.starts[mid] < from)
+        if (a[mid] <= x)
             lo = mid + 1;
         else
             hi = mid;
     }
     return lo;
 }
-function credentialSpansCover(scan, from, to) {
-    noteEvidenceRead(scan, from);
-    noteEvidenceRead(scan, to);
-    const cs = scan.table;
-    let k = firstCredentialSpanFrom(cs, from + 1) - 1;
-    if (k < 0)
-        k = 0;
-    return k < cs.starts.length && cs.starts[k] <= from && cs.ends[k] >= to;
+const CLOSED_FOR_ALL = -1;
+const CLOSED_FOR_NONE = -2;
+const ROW_INDEX = new WeakMap();
+function rowIndexOf(t) {
+    const hit = ROW_INDEX.get(t);
+    if (hit !== undefined)
+        return hit;
+    const m = t.starts.length;
+    const e1 = new Int32Array(m);
+    const ek1 = new Float64Array(m);
+    const e2 = new Int32Array(m);
+    const ek2 = new Float64Array(m);
+    const e3 = new Int32Array(m);
+    const c1 = new Int32Array(m);
+    const ck1 = new Float64Array(m);
+    const c2 = new Int32Array(m);
+    let v1 = -1, k1 = -1, v2 = -1, k2 = -1, v3 = -1, w1 = -1, j1 = -1, w2 = -1;
+    const dsL = [];
+    const dK1L = [];
+    const dE1L = [];
+    const dE2L = [];
+    for (let r = 0; r < m; r++) {
+        const key = readingKey(t.family[r], t.anchor[r]);
+        const e = t.ends[r];
+        if (key === k1)
+            v1 = Math.max(v1, e);
+        else if (key === k2) {
+            if (e > v2)
+                v2 = e;
+            if (v2 > v1) {
+                const tv = v1;
+                v1 = v2;
+                v2 = tv;
+                const tk = k1;
+                k1 = k2;
+                k2 = tk;
+            }
+        }
+        else if (e > v1) {
+            v3 = v2;
+            v2 = v1;
+            k2 = k1;
+            v1 = e;
+            k1 = key;
+        }
+        else if (e > v2) {
+            v3 = v2;
+            v2 = e;
+            k2 = key;
+        }
+        else if (e > v3)
+            v3 = e;
+        e1[r] = v1;
+        ek1[r] = k1;
+        e2[r] = v2;
+        ek2[r] = k2;
+        e3[r] = v3;
+        const s = t.starts[r];
+        const d = dsL.length - 1;
+        if (d < 0 || dsL[d] !== s) {
+            dsL.push(s);
+            dK1L.push(key);
+            dE1L.push(e);
+            dE2L.push(-1);
+        }
+        else if (key === dK1L[d])
+            dE1L[d] = Math.max(dE1L[d], e);
+        else if (e > dE1L[d]) {
+            dE2L[d] = dE1L[d];
+            dE1L[d] = e;
+            dK1L[d] = key;
+        }
+        else if (e > dE2L[d])
+            dE2L[d] = e;
+    }
+    const closedFor = new Float64Array(m);
+    const closeForL = new Map();
+    for (let r = 0; r < m; r++) {
+        const c = t.closeAt[r];
+        let f = CLOSED_FOR_NONE;
+        if (c >= 0) {
+            const key = readingKey(t.family[r], t.anchor[r]);
+            const q = upperBound(t.starts, c) - 1;
+            let a, ka, b;
+            if (ek1[q] === key) {
+                a = e2[q];
+                ka = ek2[q];
+                b = e3[q];
+            }
+            else if (ek2[q] === key) {
+                a = e1[q];
+                ka = ek1[q];
+                b = e3[q];
+            }
+            else {
+                a = e1[q];
+                ka = ek1[q];
+                b = e2[q];
+            }
+            f = a <= c ? CLOSED_FOR_ALL : b <= c ? ka : CLOSED_FOR_NONE;
+            if (f === CLOSED_FOR_ALL) {
+                if (key === j1)
+                    w1 = Math.max(w1, c);
+                else if (c > w1) {
+                    w2 = w1;
+                    w1 = c;
+                    j1 = key;
+                }
+                else if (c > w2)
+                    w2 = c;
+            }
+            else if (f !== CLOSED_FOR_NONE) {
+                let bk = closeForL.get(f);
+                if (bk === undefined)
+                    closeForL.set(f, (bk = { s: [], c: [], f: [] }));
+                const last = bk.c.length - 1;
+                const s = t.starts[r];
+                bk.s.push(s);
+                if (last >= 0 && bk.c[last] >= c) {
+                    bk.c.push(bk.c[last]);
+                    bk.f.push(bk.f[last]);
+                }
+                else {
+                    bk.c.push(c);
+                    bk.f.push(s);
+                }
+            }
+        }
+        closedFor[r] = f;
+        c1[r] = w1;
+        ck1[r] = j1;
+        c2[r] = w2;
+    }
+    const closeFor = new Map();
+    for (const [k, b] of closeForL)
+        closeFor.set(k, { starts: Int32Array.from(b.s), maxClose: Int32Array.from(b.c), maxFrom: Int32Array.from(b.f) });
+    const D = dsL.length;
+    const ds = Int32Array.from(dsL);
+    const reach1 = new Int32Array(D);
+    const reach2 = new Int32Array(D);
+    const stS = [];
+    const stR = [];
+    for (let d = D - 1; d >= 0; d--) {
+        let r1 = dE1L[d];
+        let r2 = dE2L[d];
+        for (let q = stS.length - 1; q >= 0 && r2 >= 0 && stS[q] <= r2; q--)
+            r2 = Math.max(r2, stR[q]);
+        while (stS.length > 0 && stS[stS.length - 1] <= r1) {
+            r1 = Math.max(r1, stR[stR.length - 1]);
+            stS.pop();
+            stR.pop();
+        }
+        reach1[d] = r1;
+        reach2[d] = r2;
+        stS.push(ds[d]);
+        stR.push(r1);
+    }
+    const sS = [];
+    const sE = [];
+    for (let r = 0; r < m; r++) {
+        const s = t.starts[r];
+        const e = t.ends[r];
+        const last = sE.length - 1;
+        if (last >= 0 && s <= sE[last])
+            sE[last] = Math.max(sE[last], e);
+        else {
+            sS.push(s);
+            sE.push(e);
+        }
+    }
+    const saved = new Float64Array(sS.length + 1);
+    for (let k = 0; k < sS.length; k++)
+        saved[k + 1] = saved[k] + (sE[k] - sS[k] - 1);
+    const keyStarts = new Map();
+    for (let r = 0; r < m; r++) {
+        const key = readingKey(t.family[r], t.anchor[r]);
+        const at = keyStarts.get(key);
+        if (at === undefined)
+            keyStarts.set(key, [t.starts[r]]);
+        else
+            at.push(t.starts[r]);
+    }
+    const byEndRow = Int32Array.from({ length: m }, (_, r) => r);
+    for (let lo = 0; lo < m;) {
+        let hi = lo + 1;
+        while (hi < m && t.starts[hi] === t.starts[lo])
+            hi += 1;
+        if (hi - lo > 1)
+            byEndRow.subarray(lo, hi).sort((x, y) => t.ends[x] - t.ends[y]);
+        lo = hi;
+    }
+    const byEnd = Int32Array.from(byEndRow, (r) => t.ends[r]);
+    const chainSaved = new Float64Array(D + 1);
+    for (let d = D - 1; d >= 0; d--)
+        chainSaved[d] = Math.max(0, reach1[d] - ds[d] - 1) + chainSaved[upperBound(ds, reach1[d])];
+    const ix = { e1, ek1, e2, closedFor, closeFor, byEndRow, byEnd, chainSaved, bounded: new Map(), c1, ck1, c2, ds, dKey1: Float64Array.from(dK1L), dEnd2: Int32Array.from(dE2L), reach1, reach2, segS: Int32Array.from(sS), segE: Int32Array.from(sE), saved, keyStarts };
+    ROW_INDEX.set(t, ix);
+    return ix;
+}
+function readableMaxEnd(t, ix, x, strict, self) {
+    const r = (strict ? lowerBound(t.starts, x) : upperBound(t.starts, x)) - 1;
+    if (r < 0)
+        return -1;
+    return ix.ek1[r] === self ? ix.e2[r] : ix.e1[r];
+}
+function readableMaxClose(t, ix, x, strict, self) {
+    const r = (strict ? lowerBound(t.starts, x) : upperBound(t.starts, x)) - 1;
+    if (r < 0)
+        return -1;
+    const all = ix.ck1[r] === self ? ix.c2[r] : ix.c1[r];
+    const own = ix.closeFor.get(self);
+    if (own === undefined)
+        return all;
+    const k = (strict ? lowerBound(own.starts, x) : upperBound(own.starts, x)) - 1;
+    return k < 0 ? all : Math.max(all, own.maxClose[k]);
+}
+function reachAt(ix, d, self) {
+    if (ix.dKey1[d] !== self)
+        return ix.reach1[d];
+    return ix.dEnd2[d] < 0 ? -1 : ix.reach2[d];
 }
 const FOOT_NONE = 0x7fffffff;
-function buildForensicScan(table, armCount) {
+function buildForensicScan(tokens, rows, armCount) {
     return {
-        table,
-        others: undefined,
-        cursor: 0,
+        rows,
+        tokens,
+        tokenCursor: 0,
+        self: NO_SELF,
+        rowCursor: 0,
         dirty: undefined,
         footLo: FOOT_NONE,
         footHi: -1,
@@ -1905,15 +2351,14 @@ function buildForensicScan(table, armCount) {
         headsWrite: { a: NO_URL_SEGMENTS, n: 0 },
         paramsRead: { a: NO_URL_SEGMENTS, n: 0 },
         paramsWrite: { a: NO_URL_SEGMENTS, n: 0 },
+        opsRead: { a: NO_URL_SEGMENTS, n: 0, cut: OPS_UNCUT },
+        opsWrite: { a: NO_URL_SEGMENTS, n: 0, cut: OPS_UNCUT },
         hdr: { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false },
+        delimPos: new Map(),
+        delimIx: new Map(),
+        delimIxRows: rows,
     };
 }
-function useEvidenceView(scan, table, dirty, others) {
-    scan.table = table;
-    scan.others = others;
-    scan.cursor = 0;
-    scan.dirty = dirty;
-}
 function noteEvidenceRead(scan, p) {
     if (p < scan.footLo)
         scan.footLo = p;
@@ -1935,55 +2380,416 @@ function footprintClean(dirty, lo, hi) {
     }
     return a >= ends.length || dirty.starts[a] > hi;
 }
-function inOpaqueUnit(scan, p) {
-    noteEvidenceRead(scan, p);
-    const t = scan.table;
+function tokenEnd(scan, p) {
+    const t = scan.tokens;
     const st = t.starts;
     if (st.length === 0)
-        return false;
-    const k = firstCredentialSpanFrom(t, p) - 1;
-    return k >= 0 && st[k] < p && t.ends[k] > p;
+        return -1;
+    let k = scan.tokenCursor;
+    while (k < st.length && st[k] < p)
+        k += 1;
+    while (k > 0 && st[k - 1] >= p)
+        k -= 1;
+    scan.tokenCursor = k;
+    return k < st.length && st[k] === p ? t.ends[k] : -1;
 }
-function othersOf(scan) {
-    const t = scan.others;
-    if (t === undefined)
-        throw new Error("redact: a structural-anchor question was asked by a forensic arm that declares no credential family — it has no other-families evidence to read");
-    return t;
+function crossEndAt(scan, p) {
+    const t = scan.rows;
+    if (t.starts.length === 0)
+        return -1;
+    const ix = rowIndexOf(t);
+    const ds = ix.ds;
+    let k = scan.rowCursor;
+    while (k < ds.length && ds[k] < p)
+        k += 1;
+    while (k > 0 && ds[k - 1] >= p)
+        k -= 1;
+    scan.rowCursor = k;
+    if (k >= ds.length || ds[k] !== p)
+        return -1;
+    const r = reachAt(ix, k, scan.self);
+    return r > p ? r : -1;
 }
-function anchorHeld(scan, p, lineEnd) {
-    const t = othersOf(scan);
+function crossEnd(scan, p) {
+    noteEvidenceRead(scan, p);
+    const r = crossEndAt(scan, p);
+    if (r >= 0)
+        noteEvidenceRead(scan, r);
+    return r;
+}
+const DELIM_FREE = 0;
+const DELIM_AMBIGUOUS = 1;
+const DELIM_HIDDEN = 2;
+function delimClass(scan, c, self = scan.self) {
+    noteEvidenceRead(scan, c);
+    const t = scan.rows;
+    if (t.starts.length === 0)
+        return DELIM_FREE;
+    const ix = rowIndexOf(t);
+    if (readableMaxClose(t, ix, c, false, self) > c)
+        return DELIM_HIDDEN;
+    return readableMaxEnd(t, ix, c, false, self) > c ? DELIM_AMBIGUOUS : DELIM_FREE;
+}
+function lineHeld(scan, p, lineEnd, self) {
     noteEvidenceRead(scan, p);
     noteEvidenceRead(scan, lineEnd - 1);
-    const st = t.starts;
-    if (st.length === 0)
+    const t = scan.rows;
+    if (t.starts.length === 0)
         return false;
-    const k = firstCredentialSpanFrom(t, p) - 1;
-    return k >= 0 && st[k] < p && t.ends[k] >= lineEnd;
+    return readableMaxClose(t, rowIndexOf(t), p, true, self) >= lineEnd;
+}
+function readableReach(t, ix, p, strict, self) {
+    let q = readableMaxEnd(t, ix, p, strict, self);
+    if (q <= p)
+        return p;
+    const ds = ix.ds;
+    for (let k = strict ? lowerBound(ds, p) : upperBound(ds, p); k < ds.length && ds[k] <= q;) {
+        const r = reachAt(ix, k, self);
+        if (r > q)
+            q = r;
+        k = r > ds[k] ? Math.max(k + 1, upperBound(ds, r)) : k + 1;
+    }
+    return q;
 }
-function opaqueUnitEnd(scan, p) {
+function readableCover(scan, p, q) {
     noteEvidenceRead(scan, p);
-    return opaqueUnitEndAt(scan, p);
+    noteEvidenceRead(scan, q);
+    const t = scan.rows;
+    if (t.starts.length === 0)
+        return false;
+    return readableReach(t, rowIndexOf(t), p, false, scan.self) >= q;
+}
+const ROW_ENDS = new WeakMap();
+function rowEndsOf(t) {
+    const hit = ROW_ENDS.get(t);
+    if (hit !== undefined)
+        return hit;
+    const byEnd = Int32Array.from({ length: t.starts.length }, (_, r) => r).sort((x, y) => t.ends[x] - t.ends[y]);
+    const v = { ends: Int32Array.from(byEnd, (r) => t.ends[r]), keys: Float64Array.from(byEnd, (r) => readingKey(t.family[r], t.anchor[r])) };
+    ROW_ENDS.set(t, v);
+    return v;
 }
-function opaqueUnitEndAt(scan, p) {
-    const t = scan.table;
-    const st = t.starts;
-    if (st.length === 0)
+function nameBoundAt(scan, lo, hi) {
+    noteEvidenceRead(scan, lo);
+    noteEvidenceRead(scan, hi);
+    const t = scan.rows;
+    if (t.starts.length === 0)
         return -1;
-    let k = scan.cursor;
-    while (k < st.length && st[k] < p)
-        k += 1;
-    while (k > 0 && st[k - 1] >= p)
-        k -= 1;
-    scan.cursor = k;
-    return k < st.length && st[k] === p ? t.ends[k] : -1;
+    const { ends, keys } = rowEndsOf(t);
+    for (let k = upperBound(ends, hi) - 1; k >= 0 && ends[k] > lo; k--)
+        if (keys[k] !== scan.self)
+            return ends[k];
+    return -1;
+}
+function measureWithin(scan, from, to, max) {
+    if (to - from <= max)
+        return true;
+    noteEvidenceRead(scan, from);
+    noteEvidenceRead(scan, to);
+    const t = scan.rows;
+    if (t.starts.length === 0)
+        return false;
+    const ix = rowIndexOf(t);
+    const self = scan.self;
+    const ds = ix.ds;
+    const g1 = upperBound(ix.segE, to);
+    let saved = 0;
+    for (let k = lowerBound(ds, from); k < ds.length && ds[k] < to;) {
+        const s0 = ds[k];
+        if (s0 - from - saved > max)
+            return false;
+        const g = upperBound(ix.segS, s0) - 1;
+        if (g < g1) {
+            if (ix.segS[g] >= from) {
+                const gEnd = firstOwnSegment(ix, self, g, g1);
+                if (gEnd > g) {
+                    saved += ix.saved[gEnd] - ix.saved[g];
+                    k = upperBound(ds, ix.segE[gEnd - 1]);
+                    continue;
+                }
+            }
+            else if (!ownStartWithin(ix, self, s0, ix.segE[g])) {
+                const kn = upperBound(ds, ix.segE[g]);
+                saved += ix.chainSaved[k] - ix.chainSaved[kn];
+                k = kn;
+                continue;
+            }
+        }
+        saved += boundedSavedFrom(t, ix, k, to, ownStartWithin(ix, self, s0, to) ? self : NO_SELF);
+        break;
+    }
+    return to - from - saved <= max;
+}
+function ownStartWithin(ix, self, a, b) {
+    const own = ix.keyStarts.get(self);
+    if (own === undefined)
+        return false;
+    for (const x of own)
+        if (x >= a && x <= b)
+            return true;
+    return false;
+}
+function boundedSavedFrom(t, ix, k, to, self) {
+    let byReader = ix.bounded.get(to);
+    if (byReader === undefined)
+        ix.bounded.set(to, (byReader = new Map()));
+    let ch = byReader.get(self);
+    if (ch === undefined) {
+        const hi = lowerBound(ix.ds, to);
+        byReader.set(self, (ch = { lo: hi, hi, saved: [], stS: [], stR: [], stV: [] }));
+    }
+    const { stS, stR, stV } = ch;
+    for (let d = ch.lo - 1; d >= k; d--) {
+        const s = ix.ds[d];
+        const x = maxEndWithin(t, ix, s, to, self);
+        let v = stV.length > 0 ? stV[stV.length - 1] : 0;
+        if (x >= 0) {
+            let r = x;
+            while (stS.length > 0 && stS[stS.length - 1] <= r) {
+                r = Math.max(r, stR[stR.length - 1]);
+                stS.pop();
+                stR.pop();
+                stV.pop();
+            }
+            v = Math.max(0, r - s - 1) + (stV.length > 0 ? stV[stV.length - 1] : 0);
+            stS.push(s);
+            stR.push(r);
+            stV.push(v);
+        }
+        ch.saved.push(v);
+        ch.lo = d;
+    }
+    return k >= ch.hi ? 0 : ch.saved[ch.hi - 1 - k];
+}
+function uncoveredWithin(scan, from, to) {
+    noteEvidenceRead(scan, from);
+    noteEvidenceRead(scan, to);
+    const t = scan.rows;
+    if (t.starts.length === 0 || to <= from)
+        return Math.max(0, to - from);
+    const ix = rowIndexOf(t);
+    const lo = upperBound(ix.segE, from);
+    const hi = lowerBound(ix.segS, to);
+    if (lo >= hi)
+        return to - from;
+    let covered = ix.saved[hi] - ix.saved[lo] + (hi - lo);
+    covered -= Math.max(0, from - ix.segS[lo]);
+    covered -= Math.max(0, ix.segE[hi - 1] - to);
+    return to - from - covered;
+}
+function firstOwnSegment(ix, self, g, g1) {
+    const own = ix.keyStarts.get(self);
+    if (own === undefined)
+        return g1;
+    let best = g1;
+    for (const a of own) {
+        const ga = upperBound(ix.segS, a) - 1;
+        if (ga >= g && ga < best)
+            best = ga;
+    }
+    return best;
+}
+function maxEndWithin(t, ix, s, to, self) {
+    const lo = lowerBound(t.starts, s);
+    let a = lo;
+    let b = upperBound(t.starts, s);
+    while (a < b) {
+        const mid = (a + b) >>> 1;
+        if (ix.byEnd[mid] <= to)
+            a = mid + 1;
+        else
+            b = mid;
+    }
+    for (let j = a - 1; j >= lo; j--) {
+        rowVisits += 1;
+        const r = ix.byEndRow[j];
+        if (readingKey(t.family[r], t.anchor[r]) !== self)
+            return ix.byEnd[j];
+    }
+    return -1;
+}
+export function unitCountWithinForTest(table, from, to, max, self) {
+    return unitCountsWithinForTest(table, [[from, to, max, self]])[0];
+}
+export function unitCountsWithinForTest(table, queries) {
+    const keyOf = (x) => (x.length > 2 ? x[2] : x[0]);
+    const sorted = [...table].sort((a, b) => a[0] - b[0] || keyOf(a) - keyOf(b));
+    const rows = {
+        starts: Int32Array.from(sorted, (x) => x[0]),
+        ends: Int32Array.from(sorted, (x) => x[1]),
+        family: new Uint8Array(sorted.length).fill(familyCode("prose")),
+        anchor: Int32Array.from(sorted, keyOf),
+        closeAt: new Int32Array(sorted.length).fill(NOT_CLOSED),
+    };
+    const scan = buildForensicScan(NO_TOKEN_UNITS, rows, 1);
+    return queries.map(([from, to, max, self]) => {
+        scan.self = self === undefined ? NO_SELF : readingKey(familyCode("prose"), self);
+        return measureWithin(scan, from, to, max);
+    });
+}
+function delimPositions(scan, text, kind) {
+    const hit = scan.delimPos.get(kind);
+    if (hit !== undefined)
+        return hit;
+    const out = [];
+    switch (kind) {
+        case "ssh2-open":
+        case "ssh2-close": {
+            const needle = kind === "ssh2-open" ? SSH2_FENCE_OPEN : SSH2_FENCE_CLOSE;
+            for (let p = text.indexOf(needle); p >= 0; p = text.indexOf(needle, p + 1))
+                out.push(p);
+            ssh2ScanBytes += text.length;
+            break;
+        }
+        case "pem-end":
+            for (let b = text.indexOf(PEM_END_OPEN); b >= 0; b = text.indexOf(PEM_END_OPEN, b + 1))
+                if (pemFenceLineEnd(text, b + PEM_END_OPEN.length) >= 0)
+                    out.push(b);
+            break;
+        case "at":
+        case "at-json":
+            for (let p = text.indexOf("@"); p >= 0; p = text.indexOf("@", p + 1)) {
+                if (kind === "at-json") {
+                    let b = 0;
+                    while (p - b - 1 >= 0 && text.charCodeAt(p - b - 1) === CH_BACKSLASH)
+                        b += 1;
+                    if (b % 2 === 1)
+                        continue;
+                }
+                out.push(p);
+            }
+            break;
+    }
+    const pos = Int32Array.from(out);
+    scan.delimPos.set(kind, pos);
+    return pos;
+}
+function delimIndexOf(scan, text, kind) {
+    const t = scan.rows;
+    if (scan.delimIxRows !== t) {
+        scan.delimIx = new Map();
+        scan.delimIxRows = t;
+    }
+    const byKind = scan.delimIx;
+    const hit = byKind.get(kind);
+    if (hit !== undefined)
+        return hit;
+    const pos = delimPositions(scan, text, kind);
+    const n = pos.length;
+    const nextNotHidden = new Int32Array(n + 1);
+    const nextFree = new Int32Array(n + 1);
+    const prevNotHidden = new Int32Array(n);
+    const hid = new Map();
+    const cov = new Map();
+    const hiddenAll = new Uint8Array(n);
+    const coveredAll = new Uint8Array(n);
+    if (t.starts.length > 0) {
+        const ix = rowIndexOf(t);
+        for (let i = 0; i < n; i++) {
+            const c = pos[i];
+            const r = upperBound(t.starts, c) - 1;
+            if (r < 0)
+                continue;
+            if (ix.c1[r] > c) {
+                hiddenAll[i] = 1;
+                if (ix.c2[r] <= c) {
+                    const k = ix.ck1[r];
+                    let b = hid.get(k);
+                    if (b === undefined)
+                        hid.set(k, (b = []));
+                    b.push(i);
+                }
+            }
+            if (ix.e1[r] > c) {
+                coveredAll[i] = 1;
+                if (ix.e2[r] <= c) {
+                    const k = ix.ek1[r];
+                    let b = cov.get(k);
+                    if (b === undefined)
+                        cov.set(k, (b = []));
+                    b.push(i);
+                }
+            }
+        }
+    }
+    nextNotHidden[n] = n;
+    nextFree[n] = n;
+    for (let i = n - 1; i >= 0; i--) {
+        nextNotHidden[i] = hiddenAll[i] === 1 ? nextNotHidden[i + 1] : i;
+        nextFree[i] = coveredAll[i] === 1 ? nextFree[i + 1] : i;
+    }
+    for (let i = 0, last = -1; i < n; i++) {
+        if (hiddenAll[i] !== 1)
+            last = i;
+        prevNotHidden[i] = last;
+    }
+    const freeze = (m) => new Map([...m].map(([k, v]) => [k, Int32Array.from(v)]));
+    const di = { pos, nextNotHidden, nextFree, prevNotHidden, onlyHiddenBy: freeze(hid), onlyCoveredBy: freeze(cov) };
+    byKind.set(kind, di);
+    return di;
+}
+function bucketFirstFrom(b, i, n) {
+    if (b === undefined)
+        return n;
+    const k = lowerBound(b, i);
+    return k < b.length ? b[k] : n;
+}
+function firstDelim(scan, text, kind, from, wantFree) {
+    noteEvidenceRead(scan, from);
+    const di = delimIndexOf(scan, text, kind);
+    const n = di.pos.length;
+    const bucket = (wantFree ? di.onlyCoveredBy : di.onlyHiddenBy).get(scan.self);
+    const firstAt = (i) => (i >= n ? n : Math.min(wantFree ? di.nextFree[i] : di.nextNotHidden[i], bucketFirstFrom(bucket, i, n)));
+    let j = firstAt(lowerBound(di.pos, from));
+    const own = wantFree || scan.rows.starts.length === 0 ? undefined : rowIndexOf(scan.rows).closeFor.get(scan.self);
+    while (own !== undefined && j < n) {
+        const p = di.pos[j];
+        const k = upperBound(own.starts, p) - 1;
+        if (k < 0 || own.maxClose[k] <= p)
+            break;
+        j = firstAt(lowerBound(di.pos, own.maxClose[k]));
+    }
+    const at = j >= n ? -1 : di.pos[j];
+    noteEvidenceRead(scan, at < 0 ? text.length : at);
+    return at;
+}
+function lastNotHiddenDelim(scan, text, kind, a, b) {
+    const di = delimIndexOf(scan, text, kind);
+    const bucket = di.onlyHiddenBy.get(scan.self);
+    const lastAt = (j) => {
+        let best = di.prevNotHidden[j];
+        if (bucket !== undefined) {
+            const k = upperBound(bucket, j) - 1;
+            if (k >= 0 && bucket[k] > best)
+                best = bucket[k];
+        }
+        return best;
+    };
+    const j = lowerBound(di.pos, b) - 1;
+    if (j < 0 || di.pos[j] < a)
+        return -1;
+    let best = lastAt(j);
+    const own = scan.rows.starts.length === 0 ? undefined : rowIndexOf(scan.rows).closeFor.get(scan.self);
+    while (own !== undefined && best >= 0 && di.pos[best] >= a) {
+        const p = di.pos[best];
+        const k = upperBound(own.starts, p) - 1;
+        if (k < 0 || own.maxClose[k] <= p)
+            break;
+        const j2 = lowerBound(di.pos, own.maxFrom[k]) - 1;
+        best = j2 < 0 ? -1 : lastAt(j2);
+    }
+    return best >= 0 && di.pos[best] >= a ? di.pos[best] : -1;
 }
 function scanUrlRun(scan, text, i, kind, json) {
     const n = text.length;
     noteEvidenceRead(scan, i);
     scan.lastAt = -1;
     run: while (i < n) {
-        const unit = opaqueUnitEndAt(scan, i);
+        const unit = crossEndAt(scan, i);
         if (unit >= 0) {
+            const at = lastNotHiddenDelim(scan, text, json ? "at-json" : "at", i, unit);
+            if (at > scan.lastAt)
+                scan.lastAt = at;
             i = unit;
             continue;
         }
@@ -2024,7 +2830,7 @@ function scanUrlRun(scan, text, i, kind, json) {
 }
 function matchUserinfoAt(scan, text, p, json, isHead) {
     const probeEnd = scanUrlRun(scan, text, p, "plain-user", json);
-    const keyId = probeEnd > p && text.charCodeAt(probeEnd) === 58 && credentialSpansCover(scan, p, probeEnd);
+    const keyId = probeEnd > p && text.charCodeAt(probeEnd) === 58 && readableCover(scan, p, probeEnd);
     const runEnd = scanUrlRun(scan, text, p, keyId ? "token-pass" : "plain-pass", json);
     if (isHead && runEnd >= text.length && runEnd > p)
         return runEnd;
@@ -2036,7 +2842,9 @@ function matchUserinfoAt(scan, text, p, json, isHead) {
 const URL_SEG_STRIDE = 4;
 const URL_SEG_MAX_INTS = 3 * 1_048_576;
 const NO_URL_SEGMENTS = new Int32Array(0);
-function growUrlSegments(list) {
+const ANCHOR_SEG_STRIDE = 4;
+const OPS_UNCUT = 0x7fffffff;
+function growSegments(list) {
     const len = list.a.length;
     if (len >= URL_SEG_MAX_INTS)
         return false;
@@ -2047,6 +2855,7 @@ function growUrlSegments(list) {
 }
 function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     const dirty = scan.dirty;
+    const urlFamily = familyCode("url");
     const hr = scan.headsRead;
     const hw = scan.headsWrite;
     const pr = scan.paramsRead;
@@ -2081,14 +2890,17 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
         else {
             scan.footLo = FOOT_NONE;
             scan.footHi = -1;
+            scan.self = readingKey(urlFamily, colon);
             at = matchUserinfoAt(scan, text, start, json, isHead) ?? -1;
             lo = scan.footLo;
             hi = scan.footHi;
             urlSegmentRuns += 1;
-            if (at >= 0 && at !== (known ? ph[pc + 1] : -2))
-                span(start, at, isHead && at >= text.length);
+            if (at >= 0 && at !== (known ? ph[pc + 1] : -2)) {
+                const undecided = isHead && at >= text.length;
+                span(start, at, colon, undecided ? NOT_CLOSED : at, undecided);
+            }
         }
-        if (hw.n + URL_SEG_STRIDE <= hw.a.length || growUrlSegments(hw)) {
+        if (hw.n + URL_SEG_STRIDE <= hw.a.length || growSegments(hw)) {
             const w = hw.a;
             const k = hw.n;
             w[k] = colon;
@@ -2128,14 +2940,15 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
         else {
             scan.footLo = FOOT_NONE;
             scan.footHi = -1;
+            scan.self = readingKey(urlFamily, i);
             valueEnd = scanUrlRun(scan, text, valueStart, "param-value", json);
             lo = scan.footLo;
             hi = scan.footHi;
             urlSegmentRuns += 1;
             if (valueEnd > valueStart && valueEnd !== (known ? pp[qc + 1] : -2))
-                span(valueStart, valueEnd);
+                span(valueStart, valueEnd, i, NOT_CLOSED);
         }
-        if (pw.n + URL_SEG_STRIDE <= pw.a.length || growUrlSegments(pw)) {
+        if (pw.n + URL_SEG_STRIDE <= pw.a.length || growSegments(pw)) {
             const w = pw.a;
             const k = pw.n;
             w[k] = i;
@@ -2267,7 +3080,7 @@ function collectJsonSecretFieldSpans(text, span, isHead) {
                 continue;
             const open = found === STRING_OPEN;
             const end = open ? text.length : found;
-            span(q, end, open, JSON_FIELD_VALUE_REPLS[d]);
+            span(q, end, q, open ? NOT_CLOSED : end - form.length, open, JSON_FIELD_VALUE_REPLS[d]);
             from = scanResumeAfterHit(start, end, JSON_FIELD_BACK);
             next = text.indexOf(JSON_FIELD_ANCHOR, from);
             if (next < 0)
@@ -2349,7 +3162,7 @@ function escapedAt(text, i) {
     anchoredScanUnits += i - 1 - k;
     return ((i - 1 - k) & 1) === 1;
 }
-function anchorHeadAt(text, op, json) {
+function anchorHeadAt(scan, text, op, json) {
     let i = op - 1;
     let spacedLeft = false;
     for (;;) {
@@ -2383,7 +3196,10 @@ function anchorHeadAt(text, op, json) {
     while (j > floor && isIdentCode(text.charCodeAt(j)))
         j -= 1;
     anchoredScanUnits += nameEnd - (j + 1);
-    if (j === floor && j >= 0 && isIdentCode(text.charCodeAt(j)))
+    const bound = j + 1 < nameEnd ? nameBoundAt(scan, Math.max(j, 0), nameEnd) : -1;
+    if (bound > j)
+        j = bound - 1;
+    else if (j === floor && j >= 0 && isIdentCode(text.charCodeAt(j)))
         return undefined;
     let nameStart = j + 1;
     let afterEscape = false;
@@ -2451,50 +3267,96 @@ function quotedValueEnd(text, cs, quote, json, isHead) {
     }
     return isHead ? STRING_OPEN : -1;
 }
-function bareValueEnd(text, s, json, listSep) {
+const NO_MEMO_GROUP = -1;
+function buildBareValueMemo() {
+    return {
+        from: new Int32Array(4),
+        at: new Int32Array(4).fill(-1),
+        netFrom: new Int32Array(4).fill(NO_MEMO_GROUP),
+        net: new Int32Array(16),
+        runFrom: new Int32Array(4).fill(NO_MEMO_GROUP),
+        closers: Array.from({ length: 16 }, () => []),
+    };
+}
+const listSepSlot = (listSep) => (listSep === 0 ? 0 : listSep === CH_AMP ? 1 : listSep === CH_SEMI ? 2 : 3);
+function bareValueEnd(text, s, json, listSep, memo) {
     const n = text.length;
-    let i = s;
-    while (i < n) {
-        const unit = readAnchorUnit(text, i, json);
-        const ch = unitChOf(unit);
-        if (ch === JSON_STRING_END || isRegexSpace(ch))
-            break;
-        if (listSep !== 0 && (ch === listSep || (listSep === CH_AMP && ch === CH_HASH)))
-            break;
-        const next = i + unitLenOf(unit);
-        if (isQuoteUnit(ch)) {
-            if (next >= n)
+    const k = listSepSlot(listSep);
+    let i;
+    if (memo.from[k] <= s && s <= memo.at[k])
+        i = memo.at[k];
+    else {
+        i = s;
+        while (i < n) {
+            const unit = readAnchorUnit(text, i, json);
+            const ch = unitChOf(unit);
+            if (ch === JSON_STRING_END || isRegexSpace(ch))
                 break;
-            if (endsValueUnit(unitChOf(readAnchorUnit(text, next, json))))
+            if (listSep !== 0 && (ch === listSep || (listSep === CH_AMP && ch === CH_HASH)))
                 break;
+            const next = i + unitLenOf(unit);
+            if (isQuoteUnit(ch)) {
+                if (next >= n)
+                    break;
+                if (endsValueUnit(unitChOf(readAnchorUnit(text, next, json))))
+                    break;
+            }
+            i = next;
         }
-        i = next;
+        memo.from[k] = s;
+        memo.at[k] = i;
+        memo.netFrom[k] = NO_MEMO_GROUP;
+        memo.runFrom[k] = NO_MEMO_GROUP;
     }
-    anchoredScanUnits += i - s;
-    const excess = [0, 0, 0, 0];
-    for (let k = s; k < i; k += 1) {
-        const b = bracketOf(text.charCodeAt(k));
-        if (b !== 0)
-            excess[Math.abs(b) - 1] = excess[Math.abs(b) - 1] + (b < 0 ? 1 : -1);
+    const nb = 4 * k;
+    const net = memo.net;
+    const netFrom = memo.netFrom[k];
+    if (netFrom === NO_MEMO_GROUP) {
+        net.fill(0, nb, nb + 4);
+        for (let q = s; q < i; q++) {
+            const b = bracketOf(text.charCodeAt(q));
+            if (b !== 0)
+                net[nb + Math.abs(b) - 1] = net[nb + Math.abs(b) - 1] + (b < 0 ? 1 : -1);
+        }
+        anchoredScanUnits += i - s;
     }
-    let e = i;
-    while (e > s) {
-        const c = text.charCodeAt(e - 1);
-        if (c === CH_DOT || c === CH_COMMA || c === CH_SEMI || c === CH_COLON) {
-            e -= 1;
-            continue;
+    else {
+        for (let q = netFrom; q < s; q++) {
+            const b = bracketOf(text.charCodeAt(q));
+            if (b !== 0)
+                net[nb + Math.abs(b) - 1] = net[nb + Math.abs(b) - 1] - (b < 0 ? 1 : -1);
         }
-        const b = bracketOf(c);
-        if (b < 0 && excess[-b - 1] > 0) {
-            excess[-b - 1] = excess[-b - 1] - 1;
-            e -= 1;
-            continue;
+        anchoredScanUnits += s - netFrom;
+    }
+    memo.netFrom[k] = s;
+    if (memo.runFrom[k] === NO_MEMO_GROUP) {
+        for (let q = 0; q < 4; q++)
+            memo.closers[nb + q].length = 0;
+        const lowest = memo.from[k];
+        let r = i;
+        while (r > lowest) {
+            const c = text.charCodeAt(r - 1);
+            if (c !== CH_DOT && c !== CH_COMMA && c !== CH_SEMI && c !== CH_COLON) {
+                const b = bracketOf(c);
+                if (b >= 0)
+                    break;
+                memo.closers[nb - b - 1].push(r - 1);
+            }
+            r -= 1;
         }
-        break;
+        anchoredScanUnits += i - r;
+        memo.runFrom[k] = r;
+    }
+    let e = Math.max(s, memo.runFrom[k]);
+    for (let q = 0; q < 4; q++) {
+        const at = memo.closers[nb + q];
+        const stop = Math.max(net[nb + q], 0);
+        if (stop < at.length && at[stop] + 1 > e)
+            e = at[stop] + 1;
     }
     return e;
 }
-function literalValueAt(text, s, json, declaredIfBare, listSep, isHead) {
+function literalValueAt(text, s, json, declaredIfBare, listSep, isHead, memo) {
     const n = text.length;
     if (s >= n)
         return undefined;
@@ -2526,7 +3388,7 @@ function literalValueAt(text, s, json, declaredIfBare, listSep, isHead) {
         if (after === CH_LPAREN || after === CH_LBRACKET || (after === CH_DOT && k + 1 < n && isProgramIdentStartCode(text.charCodeAt(k + 1))))
             return undefined;
     }
-    const e = bareValueEnd(text, vs, json, listSep);
+    const e = bareValueEnd(text, vs, json, listSep, memo);
     if (e <= vs)
         return undefined;
     if (e - vs <= ABSENT_OR_BOOLEAN_MAX && ABSENT_OR_BOOLEAN_WORDS.has(text.slice(vs, e).toLowerCase()))
@@ -2595,18 +3457,60 @@ function schemeValueAt(text, s, json) {
         return undefined;
     return { start: vs, end: e, quoted: false };
 }
-function collectAnchoredValueSpans(text, json, span, isHead) {
+function anchoredValueAt(scan, text, op, json, span, isHead, memo) {
+    const head = anchorHeadAt(scan, text, op, json);
+    if (head === undefined)
+        return;
     const n = text.length;
-    let resume = 0;
+    let s = op + 1;
+    let spacedRight = false;
+    while (s < n) {
+        const unit = readAnchorUnit(text, s, json);
+        if (!isInlineSpaceUnit(unitChOf(unit)))
+            break;
+        s += unitLenOf(unit);
+        spacedRight = true;
+    }
+    let v;
+    switch (head.strength) {
+        case "structure-only":
+            return;
+        case "auth-scheme":
+            v = schemeValueAt(text, s, json);
+            break;
+        case "declarative":
+            v = literalValueAt(text, s, json, head.quotedName || (!head.spacedLeft && !spacedRight), head.listSep, isHead, memo);
+            break;
+        case "any-form":
+            v = literalValueAt(text, s, json, true, head.listSep, isHead, memo);
+            break;
+        default: {
+            const unhandled = head.strength;
+            throw new Error(`redact: unhandled free-text anchor strength ${String(unhandled)}`);
+        }
+    }
+    if (v === undefined)
+        return;
+    span(v.start, v.end, op, v.quoted && v.open !== true ? v.end : NOT_CLOSED, v.open === true);
+}
+function collectAnchoredValueSpans(scan, text, json, span, isHead) {
+    const dirty = scan.dirty;
+    const anchorFamily = familyCode("anchor");
+    const rd = scan.opsRead;
+    const wr = scan.opsWrite;
+    wr.n = 0;
+    wr.cut = OPS_UNCUT;
+    const pa = rd.a;
+    const pan = dirty === undefined ? 0 : rd.n;
+    let pc = 0;
+    let armLo = FOOT_NONE;
+    let armHi = -1;
+    const memo = buildBareValueMemo();
     let nextEq = text.indexOf("=");
     let nextColon = text.indexOf(":");
     for (;;) {
-        if (nextEq >= 0 && nextEq < resume)
-            nextEq = text.indexOf("=", resume);
-        if (nextColon >= 0 && nextColon < resume)
-            nextColon = text.indexOf(":", resume);
         if (nextEq < 0 && nextColon < 0)
-            return;
+            break;
         let op;
         if (nextColon < 0 || (nextEq >= 0 && nextEq < nextColon)) {
             op = nextEq;
@@ -2616,41 +3520,51 @@ function collectAnchoredValueSpans(text, json, span, isHead) {
             op = nextColon;
             nextColon = text.indexOf(":", op + 1);
         }
-        const head = anchorHeadAt(text, op, json);
-        if (head === undefined)
+        while (pc < pan && pa[pc] < op)
+            pc += ANCHOR_SEG_STRIDE;
+        const known = pc < pan && pa[pc] === op;
+        if (!known && dirty !== undefined && op < rd.cut)
             continue;
-        let s = op + 1;
-        let spacedRight = false;
-        while (s < n) {
-            const unit = readAnchorUnit(text, s, json);
-            if (!isInlineSpaceUnit(unitChOf(unit)))
-                break;
-            s += unitLenOf(unit);
-            spacedRight = true;
+        scan.self = readingKey(anchorFamily, op);
+        let lo;
+        let hi;
+        let answer;
+        if (known && (answer = nameBoundAt(scan, pa[pc + 1], pa[pc + 2])) === pa[pc + 3]) {
+            lo = pa[pc + 1];
+            hi = pa[pc + 2];
         }
-        let v;
-        switch (head.strength) {
-            case "structure-only":
+        else {
+            scan.footLo = FOOT_NONE;
+            scan.footHi = -1;
+            anchoredValueAt(scan, text, op, json, span, isHead, memo);
+            lo = scan.footLo;
+            hi = scan.footHi;
+            if (lo > hi)
                 continue;
-            case "auth-scheme":
-                v = schemeValueAt(text, s, json);
-                break;
-            case "declarative":
-                v = literalValueAt(text, s, json, head.quotedName || (!head.spacedLeft && !spacedRight), head.listSep, isHead);
-                break;
-            case "any-form":
-                v = literalValueAt(text, s, json, true, head.listSep, isHead);
-                break;
-            default: {
-                const unhandled = head.strength;
-                throw new Error(`redact: unhandled free-text anchor strength ${String(unhandled)}`);
+            answer = nameBoundAt(scan, lo, hi);
+        }
+        if (wr.cut === OPS_UNCUT) {
+            if (wr.n + ANCHOR_SEG_STRIDE <= wr.a.length || growSegments(wr)) {
+                const w = wr.a;
+                const k = wr.n;
+                w[k] = op;
+                w[k + 1] = lo;
+                w[k + 2] = hi;
+                w[k + 3] = answer;
+                wr.n = k + ANCHOR_SEG_STRIDE;
             }
+            else
+                wr.cut = op;
         }
-        if (v === undefined)
-            continue;
-        span(v.start, v.end, v.open === true);
-        resume = v.quoted ? v.start : v.end;
+        if (lo < armLo)
+            armLo = lo;
+        if (hi > armHi)
+            armHi = hi;
     }
+    scan.opsRead = wr;
+    scan.opsWrite = rd;
+    scan.footLo = armLo;
+    scan.footHi = armHi;
 }
 export function structuralScannerForTest(arm) {
     const collect = (scan) => (text) => {
@@ -2662,17 +3576,18 @@ export function structuralScannerForTest(arm) {
         case "json-secret-field":
             return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect(collectJsonSecretFieldSpans) };
         case "pem-fence":
-            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect((text, span, isHead) => collectPemFenceSpans({ ...buildForensicScan(NO_CREDENTIAL_SPANS, 1), others: NO_CREDENTIAL_SPANS }, text, span, isHead)) };
+            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect((text, span, isHead) => collectPemFenceSpans(buildForensicScan(NO_TOKEN_UNITS, NO_ROWS, 1), text, span, isHead)) };
     }
 }
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
 function collectPpkContainerSpans(scan, text, eat, span, isHead) {
-    const HEAD = "PuTTY-User-Key-File-";
+    const fam = familyCode("putty-ppk");
+    const HEAD = PPK_FILE_HEAD;
     const MAC = "Private-MAC: ";
     const HASH = "Private-Hash: ";
-    const LINES = "Private-Lines: ";
+    const LINES = PPK_LINES_FIELD;
     const cache = new Map();
     const find = (needle, from) => {
         const c = cache.get(needle);
@@ -2686,7 +3601,7 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
     };
     const versionEnd = (at) => {
         let p = at + HEAD.length;
-        while (p < text.length && opaqueUnitEnd(scan, p) < 0) {
+        while (p < text.length && tokenEnd(scan, p) < 0) {
             const c = text.charCodeAt(p);
             if (c >= 48 && c <= 57)
                 p += 1;
@@ -2707,14 +3622,14 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
         let p = find(HEAD, from);
         for (; p !== Number.POSITIVE_INFINITY; p = find(HEAD, p + HEAD.length)) {
             const lineEnd = versionedHeadEnd(p);
-            if (lineEnd >= 0 && !anchorHeld(scan, p, lineEnd))
+            if (lineEnd >= 0 && !lineHeld(scan, p, lineEnd, readingKey(fam, p)))
                 break;
         }
         return p;
     };
     const hexRunEnd = (from) => {
         let e = from;
-        while (e < text.length && opaqueUnitEnd(scan, e) < 0) {
+        while (e < text.length && tokenEnd(scan, e) < 0) {
             const c = text.charCodeAt(e);
             if ((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))
                 e += 1;
@@ -2725,7 +3640,9 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
     };
     let at = nextVersionedHead(0);
     while (at !== Number.POSITIVE_INFINITY) {
+        scan.self = readingKey(fam, at);
         let pos = at + HEAD.length + 1;
+        let closeAt = NOT_CLOSED;
         let end = text.length;
         let ateToEnd = !isHead;
         let open = false;
@@ -2752,12 +3669,8 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
             let gapBlank = true;
             if (limit !== Number.POSITIVE_INFINITY) {
                 for (let i = hexEnd; i < limit; i++) {
-                    if (opaqueUnitEnd(scan, i) >= 0) {
-                        gapBlank = false;
-                        break;
-                    }
                     const c = text.charCodeAt(i);
-                    if (c !== 32 && c !== 10 && c !== 13 && c !== 9) {
+                    if ((c !== 32 && c !== 10 && c !== 13 && c !== 9) || delimClass(scan, i) !== DELIM_FREE) {
                         gapBlank = false;
                         break;
                     }
@@ -2767,18 +3680,20 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
             ateToEnd = straggler < limit || !gapBlank;
             end = ateToEnd || undecided ? text.length : hexEnd;
             open = undecided;
+            if (end === hexEnd)
+                closeAt = term;
             break;
         }
         if (ateToEnd && eat !== undefined && eat.from < 0) {
             eat.from = at;
             eat.len = text.length;
         }
-        span(at, end, open);
+        span(at, end, at, closeAt, open);
         at = end >= text.length ? Number.POSITIVE_INFINITY : nextVersionedHead(end);
     }
     const last = isHead ? text.lastIndexOf(HEAD) : -1;
-    if (last >= 0 && isOpenHead(last) && !anchorHeld(scan, last, text.length))
-        span(last, text.length, true);
+    if (last >= 0 && isOpenHead(last) && !lineHeld(scan, last, text.length, readingKey(fam, last)))
+        span(last, text.length, last, NOT_CLOSED, true);
 }
 const armPool = (() => {
     const spanRepl = (token) => {
@@ -2816,67 +3731,68 @@ const armPool = (() => {
                 if (isHead && keywordTail !== undefined) {
                     const at = undecidedKeywordStart(text, keywordTail);
                     if (at >= 0)
-                        out.push({ start: at, end: text.length, repl, rank, order, undecided: true });
+                        out.push({ start: at, end: text.length, repl, rank, order, undecided: true, anchor: at, closeAt: NOT_CLOSED });
                 }
             },
             retry: boundary === undefined ? undefined : (text, at, out) => collectStickySpans(boundary, text, at, out),
             headSrc: boundary === undefined ? undefined : headSrc,
             headFirst: boundary === undefined ? undefined : headFirst,
-            family: undefined,
+            family: "prose",
+            reach: regexDecisionReach(re, LEXICAL_KEYWORD_ARMS.has(re)),
         };
     };
-    const scannerMember = (token, order, arm, rank = ARM_RANK.structural, lexical = false) => {
+    const scannerMember = (token, order, arm, reach, family) => {
         const repl = spanRepl(token);
+        const rank = ARM_RANK.structural;
         return {
             token,
             rank,
             order,
             phase: 1,
-            lexical,
-            collect: (text, json, eat, out, isHead) => arm(text, json, eat, (start, end, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided } : { start, end, repl: r, rank, order }), isHead),
+            lexical: false,
+            collect: (text, json, eat, out, isHead) => arm(text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
-            family: undefined,
+            family,
+            reach,
         };
     };
-    const forensicMember = (token, order, arm, family = undefined, view = "all") => {
-        if (view === "other-families" && family === undefined)
-            throw new Error(`redact: forensic arm ${token} reads the other-families evidence view but declares no credential family`);
+    const forensicMember = (token, order, arm, reach, family, rank = ARM_RANK.structural, lexical = false) => {
         const repl = spanRepl(token);
-        const rank = ARM_RANK.structural;
         return {
             token,
             rank,
             order,
             phase: 2,
-            lexical: false,
-            collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided } : { start, end, repl: r, rank, order }), isHead),
+            lexical,
+            collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
             family,
-            view,
+            repl,
+            reach,
         };
     };
     const structuralScannerMember = (row, order) => {
         if (row === PEM_FENCE_PATTERN)
-            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectPemFenceSpans(scan, text, span, isHead), "pem-armor", "other-families");
+            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectPemFenceSpans(scan, text, span, isHead), PEM_FENCE_OPEN.length, "pem-armor");
         if (row === SSH2_FENCE_PATTERN)
-            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, json, span, isHead), "ssh2-armor");
+            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, json, span, isHead), SSH2_FENCE_OPEN.length, "ssh2-armor");
         if (row === URL_CREDENTIAL_PATTERN)
-            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead));
+            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead), "://".length, "url");
         if (row === JSON_SECRET_FIELD_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead));
+            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_BACK, "json-field");
         throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
     };
     const members = [];
     for (const row of STRUCTURAL_SECRET_PATTERNS)
         members.push(structuralScannerMember(row, members.length));
-    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead), "putty-ppk"));
-    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectPemFragmentSpans(scan, text, json, span, isHead), "pem-armor"));
-    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead), "putty-ppk"));
-    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead) => collectAnchoredValueSpans(text, json, span, isHead), ARM_RANK.keyword, true));
+    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead), PPK_FILE_HEAD.length, "putty-ppk"));
+    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectPemFragmentSpans(scan, text, json, span, isHead), PEM_FENCE_OPEN.length, "pem-armor"));
+    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead), PPK_LINES_FIELD.length, "putty-ppk"));
+    members.push(forensicMember(ANCHORED_VALUE_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectAnchoredValueSpans(scan, text, json, span, isHead), Math.max(BEARER_VALUE_MIN, ABSENT_OR_BOOLEAN_MAX + 1, STRONG_AUTH_SCHEME_MAX + 1), "anchor", ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
@@ -2890,13 +3806,7 @@ const armPool = (() => {
     const retryMembers = members.filter((m) => m.retry !== undefined);
     const phase1 = members.filter((m) => m.phase === 1);
     const phase2 = members.filter((m) => m.phase === 2);
-    const familyOfOrder = members.map((m) => m.family);
-    const viewKeyOf = (m) => {
-        switch (m.view) {
-            case "all": return undefined;
-            case "other-families": return m.family;
-        }
-    };
+    const familyCodeOfOrder = Int32Array.from(members, (m) => familyCode(m.family));
     const laneOf = (scope) => {
         const inScope = (m) => {
             switch (scope) {
@@ -2904,15 +3814,10 @@ const armPool = (() => {
                 case "bounded-unit": return !m.lexical;
             }
         };
-        const lanePhase2 = phase2.filter(inScope);
-        const viewKeys = [...new Set([...lanePhase2.map(viewKeyOf), ...lanePhase2.flatMap((m) => (m.family === undefined ? [] : [m.family]))])];
         return {
             phase1: phase1.filter(inScope),
-            phase2: lanePhase2,
+            phase2: phase2.filter(inScope),
             retry: retryMembers.filter(inScope),
-            viewKeys,
-            viewOf: lanePhase2.map((m) => viewKeys.indexOf(viewKeyOf(m))),
-            othersOf: lanePhase2.map((m) => (m.family === undefined ? -1 : viewKeys.indexOf(m.family))),
         };
     };
     const LANES = {
@@ -2923,21 +3828,39 @@ const armPool = (() => {
     const headFirstUnit = unionMembers(retryMembers.map((m) => m.headFirst)) ?? new Uint32Array(0x10000 >>> 5).fill(0xffffffff);
     poolArmCount = members.length;
     poolBoundaryArmCount = retryMembers.length;
-    return (text, wantCount, json, eat, scope, reach, engineMarked) => {
+    const reaches = members.map((m) => ({ token: m.token, order: m.order, reach: m.reach }));
+    const run = (text, wantCount, json, eat, scope, reach, engineMarked) => {
         readings += 1;
         const isHead = reach !== undefined;
         const lane = LANES[scope];
         const spans = [];
         let tried;
+        const untriedFrom = (nu, p) => {
+            let q = p;
+            while (nu[q] !== 0) {
+                coverageVisits += 1;
+                q += nu[q];
+            }
+            for (let x = p; x !== q;) {
+                const n = x + nu[x];
+                nu[x] = q - x;
+                x = n;
+            }
+            return q;
+        };
         const freshCovered = (from) => {
             const at = [];
-            const seen = (tried ??= new Uint8Array(text.length + 1));
+            const seen = (tried ??= new Int32Array(text.length + 2));
             for (let k = from; k < spans.length; k++) {
                 const s = spans[k];
                 for (let p = s.start; p <= s.end; p++) {
-                    if (seen[p] === 1)
-                        continue;
+                    if (seen[p] !== 0) {
+                        p = untriedFrom(seen, p);
+                        if (p > s.end)
+                            break;
+                    }
                     seen[p] = 1;
+                    coverageVisits += 1;
                     coveredPositions += 1;
                     if (unitBit(headFirstUnit, text.charCodeAt(p)) !== 1)
                         continue;
@@ -2964,26 +3887,23 @@ const armPool = (() => {
             m.collect(text, json, eat, spans, isHead);
         closeCoveragePositions(0);
         if (lane.phase2.length > 0) {
-            const tokens = credentialSpans(text);
-            const scan = buildForensicScan(tokens, lane.phase2.length);
+            const scan = buildForensicScan(tokenUnits(text), buildEvidenceRows(text), lane.phase2.length);
             const reuse = forensicRescanMode === "incremental";
             const foot = scan.armFoot;
-            const views = lane.viewKeys.map((key) => ({ key, table: tokens, dirty: undefined }));
+            let dirty;
             let folded = 0;
             for (let level = 0;; level += 1) {
                 const before = spans.length;
                 for (let j = 0; j < lane.phase2.length; j++) {
-                    const view = views[lane.viewOf[j]];
-                    const oi = lane.othersOf[j];
-                    const others = oi < 0 ? undefined : views[oi];
-                    const dirty = view.dirty;
                     const lo = foot[2 * j];
                     const hi = foot[2 * j + 1];
-                    if (dirty !== undefined && footprintClean(dirty, lo, hi) && (others === undefined || (others.dirty !== undefined && footprintClean(others.dirty, lo, hi)))) {
+                    if (dirty !== undefined && footprintClean(dirty, lo, hi)) {
                         forensicSkips += 1;
                         continue;
                     }
-                    useEvidenceView(scan, view.table, dirty, others?.table);
+                    scan.dirty = dirty;
+                    scan.rowCursor = 0;
+                    scan.self = NO_SELF;
                     scan.footLo = FOOT_NONE;
                     scan.footHi = -1;
                     lane.phase2[j].collect(scan, text, json, level === 0 ? eat : undefined, spans, isHead);
@@ -2993,18 +3913,26 @@ const armPool = (() => {
                 }
                 closeCoveragePositions(before);
                 forensicLevels += 1;
-                let grew = false;
-                for (const view of views) {
-                    const key = view.key;
-                    const grown = foldCredentialSpans(view.table, spans, folded, key === undefined ? undefined : (sp) => familyOfOrder[sp.order] !== key);
-                    if (grown.dirty.starts.length > 0)
-                        grew = true;
-                    view.table = grown.next;
-                    view.dirty = reuse ? grown.dirty : undefined;
-                }
+                const grown = foldEvidenceRows(scan.rows, spans, folded, (o) => familyCodeOfOrder[o]);
                 folded = spans.length;
-                if (!grew)
+                if (grown.dirty.starts.length === 0)
+                    break;
+                if (level + 1 >= FORENSIC_LEVEL_MAX) {
+                    for (let j = 0; j < lane.phase2.length; j++) {
+                        const lo = foot[2 * j];
+                        if (footprintClean(grown.dirty, lo, foot[2 * j + 1]))
+                            continue;
+                        const m = lane.phase2[j];
+                        spans.push({ start: lo, end: text.length, repl: m.repl, rank: m.rank, order: m.order, anchor: lo, closeAt: NOT_CLOSED });
+                        if (eat !== undefined && eat.capFrom < 0) {
+                            eat.capFrom = lo;
+                            eat.capLen = text.length;
+                        }
+                    }
                     break;
+                }
+                scan.rows = grown.next;
+                dirty = reuse ? grown.dirty : undefined;
             }
         }
         poolSpanCount += spans.length;
@@ -3035,6 +3963,7 @@ const armPool = (() => {
         }
         return { hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept: stamped };
     };
+    return Object.assign(run, { reaches, pendingTailUnits: Math.max(...reaches.map((r) => r.reach)) });
 })();
 let onRedaction;
 export function setRedactionObserver(fn) {
@@ -3132,12 +4061,18 @@ function readHexRunValue(s, from, to) {
     return v;
 }
 function shortestReading(text, layout) {
+    const r = readShortest(text, layout);
+    return { visible: r.visible, partial: r.partial };
+}
+function readShortest(text, layout) {
     const raw = collectRawControlCuts(text, invisibleClassesOf(layout));
-    const normalized = normalizeForRedaction(deleteInvisibleCharacters(text, raw, raw.present).text);
+    const rfold = deleteInvisibleCharacters(text, raw, raw.present);
+    const normalized = normalizeForRedaction(rfold.text);
     const open = trailingPartialEscapeStart(normalized);
     const spelled = collectSpelledCuts(normalized);
-    const length = deleteInvisibleCharacters(normalized, spelled, spelled.present).text.length;
-    return open < 0 ? { visible: length, partial: false } : { visible: length - (normalized.length - open), partial: true };
+    const sfold = deleteInvisibleCharacters(normalized, spelled, spelled.present);
+    const layers = [{ fold: sfold }, { input: rfold.text, view: normalized }, { fold: rfold }];
+    return open < 0 ? { visible: sfold.text.length, partial: false, layers } : { visible: sfold.text.length - (normalized.length - open), partial: true, layers };
 }
 export function readingHeadEnd(text, layout, units, from = 0) {
     const rest = text.length - from;
@@ -3161,7 +4096,7 @@ export function readingHeadEnd(text, layout, units, from = 0) {
 }
 function runRedaction(text, observe, json, wantHits, scope, layout, extent) {
     const wantCount = wantHits || (onRedaction !== undefined && observe);
-    const eat = observe ? { from: -1, len: 0 } : undefined;
+    const eat = observe ? { from: -1, len: 0, capFrom: -1, capLen: 0 } : undefined;
     let spans = [];
     let hits = NO_HITS;
     let readsSoFar = 0;
@@ -3202,6 +4137,8 @@ function runRedaction(text, observe, json, wantHits, scope, layout, extent) {
         hits = hitsOfSpans(spans);
     if (eat !== undefined && eat.from >= 0)
         recordFailOpen("server.redact.ppk-eat-to-end", `from=${eat.from} len=${eat.len}`);
+    if (eat !== undefined && eat.capFrom >= 0)
+        recordFailOpen("server.redact.forensic-level-cap", `from=${eat.capFrom} len=${eat.capLen}`);
     if (observe)
         reportHits(hits);
     return { text: applySpans(text, spans).out, hits, spans };
@@ -3251,6 +4188,91 @@ export function redactionSpansForTest(text, opts) {
 export function proposeRedactionSpans(text, scope, layout, extent) {
     return runRedaction(text, true, false, false, scope, layout, extent).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
 }
+export const PENDING_TAIL_UNITS = armPool.pendingTailUnits;
+export function regexDecisionReachForTest(re, lexical) {
+    return regexDecisionReach(re, lexical);
+}
+export function pendingTailReachForTest() {
+    return armPool.reaches;
+}
+function pendingTailStart(text, units) {
+    const r = readShortest(text, "multi-line");
+    return r.visible <= units ? 0 : createViewToOriginal(r.layers).start(r.visible - units);
+}
+function renderRange(text, spans, from, until) {
+    if (from >= until)
+        return "";
+    const parts = [];
+    let at = from;
+    for (const s of spans) {
+        if (s.end <= from)
+            continue;
+        if (s.start >= until)
+            break;
+        if (s.start > at)
+            parts.push(text.slice(at, s.start));
+        parts.push(s.repl);
+        at = Math.max(at, s.end);
+    }
+    if (at < until)
+        parts.push(text.slice(at, until));
+    return parts.join("");
+}
+const STREAM_RESCAN_MIN = 64;
+const streamRescanStep = (n) => Math.max(STREAM_RESCAN_MIN, n >>> 5);
+export function createRedactionStream() {
+    return openRedactionStream(PENDING_TAIL_UNITS);
+}
+export function createRedactionStreamWithTailForTest(units) {
+    return openRedactionStream(units);
+}
+function openRedactionStream(pendingTail) {
+    let buf = "";
+    let released = 0;
+    let deliveredFrom = 0;
+    let sent = "";
+    let scannedAt = 0;
+    return {
+        feed(chunk) {
+            buf += chunk;
+        },
+        takeSettled() {
+            if (buf.length - released <= pendingTail)
+                return "";
+            if (buf.length - scannedAt < streamRescanStep(buf.length))
+                return "";
+            scannedAt = buf.length;
+            const emitEnd = pendingTailStart(buf, pendingTail);
+            if (emitEnd <= released)
+                return "";
+            const spans = runRedaction(buf, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd }).spans;
+            let cut = emitEnd;
+            for (const s of spans)
+                if (s.start < cut && s.end > cut)
+                    cut = s.start;
+            if (cut > 0 && cut < buf.length && (buf.charCodeAt(cut - 1) & 0xfc00) === 0xd800 && (buf.charCodeAt(cut) & 0xfc00) === 0xdc00)
+                cut -= 1;
+            if (cut <= released)
+                return "";
+            const out = renderRange(buf, spans, released, cut);
+            released = cut;
+            sent += out;
+            return out;
+        },
+        flush() {
+            const spans = runRedaction(buf, false, false, false, "free-text", "multi-line", WHOLE_EXTENT).spans;
+            const split = released > deliveredFrom && spans.some((s) => s.start < released && s.end > released);
+            return { rest: renderRange(buf, spans, released, buf.length), diverged: split || renderRange(buf, spans, deliveredFrom, released) !== sent };
+        },
+        skip() {
+            released = deliveredFrom = scannedAt = buf.length;
+            sent = "";
+        },
+        get fed() {
+            return buf;
+        },
+    };
+}
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
     return redactDeepWith(value, redactSecrets);