@sema-agent/server 7.147.0 → 7.149.0

package/dist/trace/redact.js

@@ -29,6 +29,7 @@ export function mapNormalizedToOriginal(text, normalized) {
     return map;
 }
 const SPELLED_FORMAT = 1, SPELLED_CONTROL = 2, RAW_CONTROL = 4, RAW_WHITESPACE = 8;
+const RAW_IGNORABLE = 16, SPELLED_IGNORABLE = 32;
 const INVISIBLE_UNIT_CLASS = (() => {
     const inSet = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
     const table = new Uint8Array(0x10000);
@@ -39,32 +40,72 @@ const INVISIBLE_UNIT_CLASS = (() => {
     }
     return table;
 })();
-const RAW_STRIP_SET_RE = (() => {
-    let body = "";
-    for (let unit = 0; unit < 0x10000; unit++) {
-        if (INVISIBLE_UNIT_CLASS[unit] === 0)
-            continue;
-        let last = unit;
-        while (last + 1 < 0x10000 && INVISIBLE_UNIT_CLASS[last + 1] !== 0)
-            last += 1;
-        const hex = (u) => `\\u${u.toString(16).padStart(4, "0")}`;
-        body += last === unit ? hex(unit) : `${hex(unit)}-${hex(last)}`;
-        unit = last;
-    }
-    return new RegExp(`[${body}]`, "g");
+const READING_IGNORABLE_CLASS = String.raw `\p{Default_Ignorable_Code_Point}\p{Mn}\p{Cc}`;
+const READING_IGNORABLE_RE = new RegExp(`^[${READING_IGNORABLE_CLASS}]$`, "u");
+function isReadingIgnorable(cp) {
+    if (cp < 0 || cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff))
+        return false;
+    return READING_IGNORABLE_RE.test(String.fromCodePoint(cp));
+}
+export function isReadingIgnorableForTest(cp) {
+    return isReadingIgnorable(cp);
+}
+const RAW_UNIT_CLASS = (() => {
+    const table = new Uint8Array(0x10000);
+    for (let unit = 0; unit < table.length; unit++) {
+        const cls = INVISIBLE_UNIT_CLASS[unit];
+        if (cls !== 0)
+            table[unit] = cls === 2 ? RAW_WHITESPACE : RAW_CONTROL;
+    }
+    const units = [];
+    for (let c = 0; c < 0x10000; c++)
+        if (c < 0xd800 || c > 0xdfff)
+            units.push(String.fromCharCode(c));
+    for (const m of units.join("").matchAll(new RegExp(`[${READING_IGNORABLE_CLASS}]`, "gu"))) {
+        const unit = m[0].charCodeAt(0);
+        if (table[unit] === 0)
+            table[unit] = RAW_IGNORABLE;
+    }
+    return table;
 })();
+const ASTRAL_IGNORABLE_MEMO = new Map();
+function astralIgnorableAt(cp) {
+    let hit = ASTRAL_IGNORABLE_MEMO.get(cp);
+    if (hit === undefined) {
+        hit = isReadingIgnorable(cp);
+        if (ASTRAL_IGNORABLE_MEMO.size < 4096)
+            ASTRAL_IGNORABLE_MEMO.set(cp, hit);
+    }
+    return hit;
+}
 function collectRawControlCuts(s, allowed) {
     const cuts = [];
     let present = 0;
-    if ((allowed & (RAW_CONTROL | RAW_WHITESPACE)) === 0)
+    if ((allowed & (RAW_CONTROL | RAW_WHITESPACE | RAW_IGNORABLE)) === 0)
         return { cuts, present };
-    RAW_STRIP_SET_RE.lastIndex = 0;
-    for (let m = RAW_STRIP_SET_RE.exec(s); m !== null; m = RAW_STRIP_SET_RE.exec(s)) {
-        const cls = INVISIBLE_UNIT_CLASS[s.charCodeAt(m.index)] === 2 ? RAW_WHITESPACE : RAW_CONTROL;
-        if ((cls & allowed) === 0)
-            continue;
-        cuts.push(m.index, m.index + 1, cls);
-        present |= cls;
+    const n = s.length;
+    for (let i = 0; i < n; i++) {
+        const unit = s.charCodeAt(i);
+        let cls = RAW_UNIT_CLASS[unit];
+        let len = 1;
+        if (cls === 0) {
+            if ((unit & 0xfc00) !== 0xd800 || i + 1 >= n)
+                continue;
+            const low = s.charCodeAt(i + 1);
+            if ((low & 0xfc00) !== 0xdc00)
+                continue;
+            if (!astralIgnorableAt(((unit - 0xd800) << 10) + (low - 0xdc00) + 0x10000)) {
+                i += 1;
+                continue;
+            }
+            cls = RAW_IGNORABLE;
+            len = 2;
+        }
+        if ((cls & allowed) !== 0) {
+            cuts.push(i, i + len, cls);
+            present |= cls;
+        }
+        i += len - 1;
     }
     return { cuts, present };
 }
@@ -83,7 +124,8 @@ function collectSpelledCuts(s) {
         const cp = readSpelledCodePoint(s, body, read);
         if (cp === ESCAPE_TRUNCATED)
             return { cuts, present, open: i };
-        const cls = cp < 0 ? 0 : isFormatCodePoint(cp) ? SPELLED_FORMAT : cp < 0x10000 && INVISIBLE_UNIT_CLASS[cp] === 1 ? SPELLED_CONTROL : 0;
+        const unitClass = cp >= 0 && cp < 0x10000 ? INVISIBLE_UNIT_CLASS[cp] : 0;
+        const cls = cp < 0 ? 0 : isFormatCodePoint(cp) ? SPELLED_FORMAT : unitClass === 1 ? SPELLED_CONTROL : unitClass === 2 ? 0 : isReadingIgnorable(cp) ? SPELLED_IGNORABLE : 0;
         if (cls !== 0) {
             cuts.push(i, read.end, cls);
             present |= cls;
@@ -465,6 +507,88 @@ let anyValueArm;
 function anyValueArmRe() {
     return (anyValueArm ??= new RegExp(`(?:${VALUE_ARM_BODIES.join("|")})`, "y"));
 }
+const SCAN_UNATTEMPTED = -1;
+class ScanReader {
+    #t;
+    #n;
+    #reg = SCAN_UNATTEMPTED;
+    #hit = false;
+    #open;
+    #unattributed = false;
+    constructor(t) {
+        this.#t = t;
+        this.#n = t.length;
+        this.#open = t.length;
+    }
+    #mark() {
+        this.#hit = true;
+        if (this.#reg === SCAN_UNATTEMPTED) {
+            this.#unattributed = true;
+            this.#open = 0;
+        }
+        else if (this.#reg < this.#open)
+            this.#open = this.#reg;
+    }
+    charCodeAt(i) {
+        if (i < this.#n)
+            return this.#t.charCodeAt(i);
+        this.#mark();
+        return NaN;
+    }
+    atEnd(i) {
+        if (i < this.#n)
+            return false;
+        this.#mark();
+        return true;
+    }
+    readEnd() {
+        this.#mark();
+        return this.#n;
+    }
+    startsWith(lit, at) {
+        if (at + lit.length <= this.#n)
+            return this.#t.startsWith(lit, at);
+        for (let k = 0; at + k < this.#n; k++)
+            if (this.#t.charCodeAt(at + k) !== lit.charCodeAt(k))
+                return false;
+        this.#mark();
+        return false;
+    }
+    slice(a, b) {
+        if (b > this.#n)
+            this.#mark();
+        return this.#t.slice(a, b);
+    }
+    indexOf(lit, from = 0) {
+        return this.#t.indexOf(lit, from);
+    }
+    search(re, from) {
+        re.lastIndex = from;
+        return re.exec(this.#t);
+    }
+    lastIndexOf(lit) {
+        return this.#t.lastIndexOf(lit);
+    }
+    attempt(from) {
+        this.#reg = from;
+        this.#hit = false;
+    }
+    reachedEnd() {
+        return this.#hit;
+    }
+    begin() {
+        this.#reg = SCAN_UNATTEMPTED;
+        this.#hit = false;
+    }
+    get open() {
+        return this.#open;
+    }
+    get unattributed() {
+        return this.#unattributed;
+    }
+}
+const VIEW_END = 0x3fffffff;
+const segmentEnds = (s, i, limit) => i >= limit || s.atEnd(i);
 const ARM_RANK = { structural: 0, keyword: 1, shape: 2, fragment: 3 };
 let poolSpanCount = 0;
 let poolArmCount = 0;
@@ -737,6 +861,112 @@ function deriveLiteralHead(re) {
         first: unionMembers(per.map((p) => p.first)),
     };
 }
+function expandHeadUnits(src, flags) {
+    if (/[iuv]/.test(flags))
+        throw new Error(`redact: head-unit expansion does not support the i/u/v flags (/${src}/${flags})`);
+    const fail = (at, why) => {
+        throw new Error(`redact: head-unit expansion cannot read ${why} at ${at} in /${src}/`);
+    };
+    const LIMIT = 4096;
+    const seqOf = (from) => {
+        let seqs = [[]];
+        let i = from;
+        while (i < src.length && src[i] !== "|" && src[i] !== ")") {
+            let atom;
+            const c = src[i];
+            if (c === "(") {
+                if (!src.startsWith("(?:", i))
+                    return fail(i, "a group other than a non-capturing one");
+                const inner = altsOf(i + 3);
+                if (src[inner.next] !== ")")
+                    return fail(i, "an unbalanced group");
+                atom = inner.seqs;
+                i = inner.next + 1;
+            }
+            else if (c === "[") {
+                let k = i + 1;
+                while (k < src.length && src[k] !== "]")
+                    k += src[k] === "\\" ? 2 : 1;
+                if (k >= src.length)
+                    return fail(i, "an unterminated character class");
+                atom = [[codeUnitMembers(src.slice(i, k + 1))]];
+                i = k + 1;
+            }
+            else if (c === "\\") {
+                const e = src[i + 1];
+                if (e === undefined || !(HEAD_CLASS_ESCAPES.has(e) || HEAD_LITERAL_ESCAPES.has(e)))
+                    return fail(i, "an escape that is not one code unit");
+                atom = [[codeUnitMembers(src.slice(i, i + 2))]];
+                i += 2;
+            }
+            else if (c === "." || c === "^" || c === "$" || c === "*" || c === "+" || c === "?" || c === "{") {
+                return fail(i, JSON.stringify(c));
+            }
+            else {
+                atom = [[codeUnitMembers(c)]];
+                i += 1;
+            }
+            let lo = 1;
+            let hi = 1;
+            if (src[i] === "?") {
+                lo = 0;
+                i += 1;
+            }
+            else if (src[i] === "{") {
+                const m = /^\{(\d+)(?:,(\d+))?\}/.exec(src.slice(i));
+                if (m === null)
+                    return fail(i, "an unbounded quantifier");
+                lo = Number(m[1]);
+                hi = m[2] === undefined ? lo : Number(m[2]);
+                i += m[0].length;
+            }
+            else if (src[i] === "*" || src[i] === "+")
+                return fail(i, "an unbounded quantifier");
+            let reps = [];
+            let power = [[]];
+            for (let k = 0; k <= hi; k++) {
+                if (k >= lo)
+                    reps = reps.concat(power);
+                if (k < hi)
+                    power = power.flatMap((p) => atom.map((a) => [...p, ...a]));
+            }
+            seqs = seqs.flatMap((s) => reps.map((r) => [...s, ...r]));
+            if (seqs.length > LIMIT)
+                return fail(i, "a head with too many spellings");
+        }
+        return { seqs, next: i };
+    };
+    const altsOf = (from) => {
+        const seqs = [];
+        let i = from;
+        for (;;) {
+            const one = seqOf(i);
+            seqs.push(...one.seqs);
+            i = one.next;
+            if (src[i] !== "|")
+                break;
+            i += 1;
+        }
+        return { seqs, next: i };
+    };
+    const all = altsOf(0);
+    if (all.next !== src.length)
+        return fail(all.next, "trailing syntax");
+    if (all.seqs.some((s) => s.length === 0))
+        return fail(0, "an empty head spelling (every position would be feasible)");
+    return all.seqs;
+}
+function headFeasibleAt(seqs, text, p) {
+    const room = text.length - p;
+    outer: for (const seq of seqs) {
+        const m = Math.min(seq.length, room);
+        for (let k = 0; k < m; k++)
+            if (unitBit(seq[k], text.charCodeAt(p + k)) === 0)
+                continue outer;
+        return true;
+    }
+    return false;
+}
 const repeatLen = (k, len) => (k === 0 ? 0 : k * len);
 function readReachAlternatives(src, from) {
     const alts = [];
@@ -921,17 +1151,56 @@ function resolveSpanOverlaps(spans) {
     }
     return kept;
 }
-function applySpans(text, spans) {
-    if (spans.length === 0)
-        return { out: text, count: 0 };
-    const parts = [];
-    let copied = 0;
+const NO_JOINTS = Object.freeze([]);
+const sortedJoints = (joints) => [...new Set(joints)].sort((a, b) => a - b);
+function firstJointAfter(at, start) {
+    let lo = 0;
+    let hi = at.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (at[mid] <= start)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo;
+}
+function jointsCrossedBy(spans, joints) {
+    if (joints.length === 0)
+        return [];
+    const at = sortedJoints(joints);
+    const crossed = new Set();
+    for (const s of spans)
+        for (let i = firstJointAfter(at, s.start); i < at.length && at[i] < s.end; i++)
+            crossed.add(at[i]);
+    return [...crossed].sort((a, b) => a - b);
+}
+function cutAtJoints(spans, joints) {
+    const at = sortedJoints(joints);
+    const out = [];
     for (const s of spans) {
-        parts.push(text.slice(copied, s.start), s.repl);
-        copied = s.end;
+        let start = s.start;
+        for (let i = firstJointAfter(at, s.start); i < at.length && at[i] < s.end; i++) {
+            out.push({ ...s, start, end: at[i] });
+            start = at[i];
+        }
+        out.push(start === s.start ? s : { ...s, start });
     }
-    parts.push(text.slice(copied));
-    return { out: parts.join(""), count: spans.length };
+    return out;
+}
+const poolTie = (a, b) => a.rank - b.rank || a.order - b.order;
+export function mergeRedactionSpans(spans, tie = () => 0, joints = NO_JOINTS) {
+    const order = (joints.length === 0 ? [...spans] : cutAtJoints(spans, joints)).sort((a, b) => a.start - b.start || b.end - a.end || tie(a, b));
+    const committed = joints.length === 0 ? undefined : new Set(joints);
+    const out = [];
+    for (const s of order) {
+        const last = out[out.length - 1];
+        if (last === undefined || s.start > last.end || (s.start === last.end && committed?.has(s.start) === true))
+            out.push(s);
+        else if (s.end > last.end)
+            out[out.length - 1] = { ...last, end: s.end };
+    }
+    return out;
 }
 function collectValueArmSpans(arm, text, out) {
     const { g, y, back, repl, rank, order } = arm;
@@ -1163,7 +1432,7 @@ const SHAPE_SECRET_PATTERNS = [
     [new RegExp(String.raw `xox[baprs]-${atLeast("[A-Za-z0-9-]", 10)}`, "g"), "«redacted:slack-token»"],
     [new RegExp(String.raw `AKIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
     [new RegExp(String.raw `ASIA${atLeast("[0-9A-Z]", 16)}`, "g"), "«redacted:aws-key»"],
-    [new RegExp(String.raw `(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-${atLeast("[A-Za-z0-9_-]", 20)}|(?:sk|rk)_(?:live|test|org)_${atLeast("[A-Za-z0-9]", 24)}|pypi-${atLeast("[A-Za-z0-9_-]", 85)})`, "g"), "«redacted:key»"],
+    [new RegExp(String.raw `(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-${atLeast("[A-Za-z0-9_-]", 20)}|(?:sk|rk)_(?:live|test|org)_${atLeast("[A-Za-z0-9]", 24)}|pypi-${atLeast("[A-Za-z0-9_-]", 85)}|(?<![A-Za-z0-9])(?:npm_${atLeast("[A-Za-z0-9]", 36)}|hf_${atLeast("[A-Za-z0-9]", 34)}|ya29\.${atLeast("[A-Za-z0-9._-]", 30)}))`, "g"), "«redacted:key»"],
     [new RegExp(String.raw `xapp-\d-${atLeast("[A-Za-z0-9-]", 20)}`, "g"), "«redacted:slack-token»"],
     [valueArm("sk-", "[A-Za-z0-9_-]", SK_FULL_ARM_MIN, "self-evident"), "«redacted:key»"],
 ];
@@ -1176,16 +1445,16 @@ const isIdentStartCode = (c) => (c >= CH_A && c <= CH_Z) || (c >= CH_a && c <= C
 const isIdentCode = (c) => isIdentStartCode(c) || (c >= CH_0 && c <= CH_9) || c === CH_UNDERSCORE || c === CH_MINUS;
 function pemEscapeLetterAt(s, i, limit) {
     let j = i;
-    while (j < limit && s.charCodeAt(j) === CH_BACKSLASH)
+    while (!segmentEnds(s, j, limit) && s.charCodeAt(j) === CH_BACKSLASH)
         j += 1;
-    if (j === i || j >= limit)
+    if (j === i || segmentEnds(s, j, limit))
         return -1;
     const n = s.charCodeAt(j);
     return n === CH_r || n === CH_n || n === CH_t ? j : -1;
 }
 function skipPemSeps(scan, s, i, limit) {
     for (;;) {
-        if (i >= limit)
+        if (segmentEnds(s, i, limit))
             return i;
         if (tokenEnd(scan, i) >= 0)
             return i;
@@ -1205,7 +1474,7 @@ function skipPemSeps(scan, s, i, limit) {
     }
 }
 function pemLineBreakLen(s, i, limit) {
-    if (i >= limit)
+    if (segmentEnds(s, i, limit))
         return 0;
     const c = s.charCodeAt(i);
     if (c === CH_CR || c === CH_LF)
@@ -1218,7 +1487,7 @@ function pemLineBreakLen(s, i, limit) {
     return 0;
 }
 function pemInlineSepLen(s, i, limit) {
-    if (i >= limit)
+    if (segmentEnds(s, i, limit))
         return 0;
     const c = s.charCodeAt(i);
     if (c === CH_SPACE || c === CH_TAB)
@@ -1231,16 +1500,20 @@ function pemInlineSepLen(s, i, limit) {
     return 0;
 }
 function probePemHeaderToken(scan, s, p, limit) {
-    if (p >= limit || tokenEnd(scan, p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
+    if (segmentEnds(s, p, limit))
+        return -1;
+    if (tokenEnd(scan, p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
         return -1;
     p += 1;
     let identLen = 1;
-    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && tokenEnd(scan, p) < 0 && isIdentCode(s.charCodeAt(p))) {
+    while (identLen < PEM_HEADER_IDENT_MAX && !segmentEnds(s, p, limit) && tokenEnd(scan, p) < 0 && isIdentCode(s.charCodeAt(p))) {
         p += 1;
         identLen += 1;
     }
     for (;;) {
-        if (p >= limit || tokenEnd(scan, p) >= 0)
+        if (segmentEnds(s, p, limit))
+            return -1;
+        if (tokenEnd(scan, p) >= 0)
             return -1;
         const c = s.charCodeAt(p);
         if (c === CH_SPACE || c === CH_TAB) {
@@ -1261,7 +1534,7 @@ function setPemHdr(scan, search, contentEnd, next, hitLimit, jsonEnd = false) {
 }
 function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
     const start = skipPemSeps(scan, s, i, limit);
-    if (start >= limit)
+    if (segmentEnds(s, start, limit))
         return false;
     const afterToken = probePemHeaderToken(scan, s, start, limit);
     if (afterToken < 0 && !allowBare)
@@ -1270,7 +1543,7 @@ function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
     if (afterToken >= 0 && probePemHeaderToken(scan, s, p, limit) >= 0)
         return setPemHdr(scan, start, p, p, false);
     for (;;) {
-        if (p >= limit)
+        if (segmentEnds(s, p, limit))
             return setPemHdr(scan, start, p, p, true);
         const unit = crossEnd(scan, p);
         if (unit >= 0) {
@@ -1292,9 +1565,9 @@ function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
             return setPemHdr(scan, start, p, p + 1, false);
         if (c === CH_BACKSLASH) {
             let j = p;
-            while (j < limit && s.charCodeAt(j) === CH_BACKSLASH)
+            while (!segmentEnds(s, j, limit) && s.charCodeAt(j) === CH_BACKSLASH)
                 j += 1;
-            const n = j < limit ? s.charCodeAt(j) : -1;
+            const n = segmentEnds(s, j, limit) ? -1 : s.charCodeAt(j);
             if (n !== CH_r && n !== CH_n && n !== CH_t) {
                 p = json && (j - p) % 2 === 0 && n === CH_QUOTE ? j : Math.min(limit, j + 1);
                 continue;
@@ -1316,7 +1589,7 @@ function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
                 break;
             q += u;
         }
-        if (q >= limit)
+        if (segmentEnds(s, q, limit))
             return setPemHdr(scan, start, p, q, true);
         if (probePemHeaderToken(scan, s, q, limit) >= 0)
             return setPemHdr(scan, start, p, q, false);
@@ -1329,7 +1602,7 @@ function parsePemBody(scan, s, i, limit) {
     for (;;) {
         const q = skipPemSeps(scan, s, p, limit);
         let r = q;
-        while (r < limit && tokenEnd(scan, r) < 0 && isBase64Code(s.charCodeAt(r)))
+        while (!segmentEnds(s, r, limit) && tokenEnd(scan, r) < 0 && isBase64Code(s.charCodeAt(r)))
             r += 1;
         if (r - q < PEM_BODY_RUN_MIN)
             break;
@@ -1439,13 +1712,24 @@ function findPemFence(scan, text, from) {
 }
 const SSH2_FENCE_OPEN = "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_FENCE_CLOSE = "---- END SSH2 ENCRYPTED PRIVATE KEY ----";
-const SSH2_BODY_MAX = 8192;
+const ARMOR_BODY_MAX = (() => {
+    const caps = STRUCTURAL_SECRET_PATTERNS.flatMap(([re]) => {
+        const m = /\[\\s\\S\]\{0,(\d+)\}\?/.exec(re.source);
+        return m === null ? [] : [Number(m[1])];
+    });
+    const first = caps[0];
+    if (caps.length !== 2 || first === undefined || caps.some((c) => c !== first)) {
+        throw new Error(`redact: the PEM and SSH2 armor rows of the structural table must each declare one body cap of the same size (read ${JSON.stringify(caps)})`);
+    }
+    return first;
+})();
+export const MAX_RECOGNITION_SPAN = SSH2_FENCE_OPEN.length + ARMOR_BODY_MAX + SSH2_FENCE_CLOSE.length;
 function armorCloseAt(scan, text, kind, bodyFrom, max) {
-    const near = firstDelim(scan, text, kind, bodyFrom, false);
+    const near = firstDelim(scan, kind, bodyFrom, false);
     if (near < 0)
         return -1;
-    const free = firstDelim(scan, text, kind, bodyFrom, true);
-    const far = free >= 0 ? free : lastNotHiddenDelim(scan, text, kind, near, text.length);
+    const free = firstDelim(scan, kind, bodyFrom, true);
+    const far = free >= 0 ? free : lastNotHiddenDelim(scan, kind, near, VIEW_END);
     if (far > near && blockWithin(scan, text, kind, bodyFrom, far, max))
         return far;
     return blockWithin(scan, text, kind, bodyFrom, near, max) ? near : -1;
@@ -1459,8 +1743,8 @@ function blockWithin(scan, text, kind, bodyFrom, close, max) {
 }
 function collectSsh2FenceSpans(scan, text, json, span, isHead) {
     const fam = familyCode("ssh2-armor");
-    const opens = delimPositions(scan, text, "ssh2-open");
-    const closes = delimPositions(scan, text, "ssh2-close");
+    const opens = delimPositions(scan, "ssh2-open");
+    const closes = delimPositions(scan, "ssh2-close");
     const blockEnds = [];
     let firstLive = 0;
     let freshFrom = -1;
@@ -1475,13 +1759,13 @@ function collectSsh2FenceSpans(scan, text, json, span, isHead) {
         }
         if (rooted && prevEnd >= 0) {
             scan.self = readingKey(fam, c);
-            while (firstLive < blockEnds.length && uncoveredWithin(scan, blockEnds[firstLive], c + SSH2_FENCE_CLOSE.length) > SSH2_BODY_MAX + SSH2_FENCE_CLOSE.length)
+            while (firstLive < blockEnds.length && uncoveredWithin(scan, blockEnds[firstLive], c + SSH2_FENCE_CLOSE.length) > ARMOR_BODY_MAX + SSH2_FENCE_CLOSE.length)
                 firstLive += 1;
             for (let j = firstLive; j < blockEnds.length; j++) {
                 const from = blockEnds[j];
                 if (from > c)
                     break;
-                if ((from === freshFrom && blockWithin(scan, text, "ssh2-close", freshEnd, c, SSH2_BODY_MAX - 1)) || blockWithin(scan, text, "ssh2-close", from, c, SSH2_BODY_MAX)) {
+                if ((from === freshFrom && blockWithin(scan, text, "ssh2-close", freshEnd, c, ARMOR_BODY_MAX - 1)) || blockWithin(scan, text, "ssh2-close", from, c, ARMOR_BODY_MAX)) {
                     span(from, c + SSH2_FENCE_CLOSE.length, c, NOT_CLOSED);
                     freshFrom = from;
                     freshEnd = c + SSH2_FENCE_CLOSE.length;
@@ -1506,7 +1790,7 @@ function collectSsh2FenceSpans(scan, text, json, span, isHead) {
         openAt = k < opens.length ? opens[k] : -1;
         return openAt;
     };
-    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, (from) => firstDelim(scan, text, "ssh2-close", from, true));
+    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, (from) => firstDelim(scan, "ssh2-close", from, true));
     for (let oi = 0; oi < opens.length;) {
         const fence = opens[oi];
         const bodyFrom = fence + SSH2_FENCE_OPEN.length;
@@ -1515,30 +1799,31 @@ function collectSsh2FenceSpans(scan, text, json, span, isHead) {
             continue;
         }
         scan.self = readingKey(fam, fence);
-        if (isHead && measureWithin(scan, bodyFrom, text.length, SSH2_BODY_MAX)) {
-            span(fence, text.length, fence, NOT_CLOSED, true);
+        text.attempt(fence);
+        if (isHead && measureWithin(scan, bodyFrom, text.readEnd(), ARMOR_BODY_MAX)) {
+            span(fence, text.readEnd(), fence, NOT_CLOSED, true);
             return;
         }
         let resume = fence + 1;
         if (!isHead) {
             const open = nextFreeOpen(bodyFrom);
-            const limit = open < 0 ? text.length : open;
+            const limit = open < 0 ? VIEW_END : open;
             const readEnd = (crossEndsRun) => {
                 const t = truncatedEnd(bodyFrom, limit, crossEndsRun);
                 const bodyEnd = t < 0 ? -1 : armorBodyEnd(scan, text, json, bodyFrom, limit, false, crossEndsRun);
                 return bodyEnd < 0 ? -1 : Math.max(bodyEnd, t);
             };
             const far = readEnd(false);
-            const near = far >= 0 && !measureWithin(scan, bodyFrom, far, SSH2_BODY_MAX) ? readEnd(true) : -1;
+            const near = far >= 0 && !measureWithin(scan, bodyFrom, far, ARMOR_BODY_MAX) ? readEnd(true) : -1;
             const end = near >= 0 && near < far ? near : far;
-            if (end >= 0 && measureWithin(scan, bodyFrom, end, SSH2_BODY_MAX)) {
+            if (end >= 0 && measureWithin(scan, bodyFrom, end, ARMOR_BODY_MAX)) {
                 span(fence, end, fence, NOT_CLOSED);
                 resume = end;
             }
         }
-        const close = armorCloseAt(scan, text, "ssh2-close", bodyFrom, SSH2_BODY_MAX);
+        const close = armorCloseAt(scan, text, "ssh2-close", bodyFrom, ARMOR_BODY_MAX);
         if (close < 0) {
-            if (isHead && firstDelim(scan, text, "ssh2-close", bodyFrom, false) < 0)
+            if (isHead && firstDelim(scan, "ssh2-close", bodyFrom, false) < 0)
                 return;
             oi = lowerBound(opens, resume);
             continue;
@@ -1549,16 +1834,16 @@ function collectSsh2FenceSpans(scan, text, json, span, isHead) {
     }
 }
 const PEM_END_OPEN = "-----END";
-const PEM_FENCE_BODY_MAX = 8192;
 const PEM_LINE_INVALID = -1;
 const PEM_LINE_OPEN = -2;
 function pemFenceLineEnd(text, labelFrom) {
     const close = text.indexOf(PEM_FENCE_CLOSE, labelFrom);
     if (close < 0) {
-        let to = text.length;
+        const n = text.readEnd();
+        let to = n;
         while (to > labelFrom && text.charCodeAt(to - 1) === 45)
             to -= 1;
-        const stillPossible = text.length - to >= 2 ? isPemFenceLabel(text, labelFrom, to) : !pemLabelDashRuleBroken(text, labelFrom, to);
+        const stillPossible = n - to >= 2 ? isPemFenceLabel(text, labelFrom, to) : !pemLabelDashRuleBroken(text, labelFrom, to);
         return stillPossible ? PEM_LINE_OPEN : PEM_LINE_INVALID;
     }
     return isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : PEM_LINE_INVALID;
@@ -1569,23 +1854,24 @@ function collectPemFenceSpans(scan, text, span, isHead) {
         const fence = text.indexOf(PEM_FENCE_OPEN, from);
         if (fence < 0)
             return;
+        text.attempt(fence);
         const bodyFrom = pemFenceLineEnd(text, fence + PEM_FENCE_OPEN.length);
         if (bodyFrom === PEM_LINE_INVALID) {
             from = fence + 1;
             continue;
         }
-        if (lineHeld(scan, fence, bodyFrom === PEM_LINE_OPEN ? text.length : bodyFrom, readingKey(fam, fence))) {
+        if (lineHeld(scan, fence, bodyFrom === PEM_LINE_OPEN ? text.readEnd() : bodyFrom, readingKey(fam, fence))) {
             from = fence + 1;
             continue;
         }
         scan.self = readingKey(fam, fence);
-        const near = bodyFrom === PEM_LINE_OPEN ? -1 : firstDelim(scan, text, "pem-end", bodyFrom, false);
-        if (near < 0 || (isHead && firstDelim(scan, text, "pem-end", bodyFrom, true) < 0)) {
+        const near = bodyFrom === PEM_LINE_OPEN ? -1 : firstDelim(scan, "pem-end", bodyFrom, false);
+        if (near < 0 || (isHead && firstDelim(scan, "pem-end", bodyFrom, true) < 0)) {
             if (isHead)
-                span(fence, text.length, fence, NOT_CLOSED, true);
+                span(fence, text.readEnd(), fence, NOT_CLOSED, true);
             return;
         }
-        const endAt = armorCloseAt(scan, text, "pem-end", bodyFrom, PEM_FENCE_BODY_MAX);
+        const endAt = armorCloseAt(scan, text, "pem-end", bodyFrom, ARMOR_BODY_MAX);
         if (endAt < 0) {
             from = fence + 1;
             continue;
@@ -1597,8 +1883,8 @@ function collectPemFenceSpans(scan, text, span, isHead) {
 }
 function truncationWindowEnd(text, from, json) {
     if (!json)
-        return text.length;
-    for (let i = from; i < text.length; i++) {
+        return text.readEnd();
+    for (let i = from; !text.atEnd(i); i++) {
         const c = text.charCodeAt(i);
         if (c === CH_BACKSLASH) {
             i += 1;
@@ -1607,7 +1893,7 @@ function truncationWindowEnd(text, from, json) {
         if (c === CH_QUOTE)
             return i;
     }
-    return text.length;
+    return text.readEnd();
 }
 function armorBodyEnd(scan, text, json, from, limit, allowBare, crossEndsRun) {
     let pos = from;
@@ -1649,13 +1935,19 @@ function collectPemFragmentSpans(scan, text, json, span, isHead) {
     const fam = familyCode("pem-armor");
     let cur = findPemFence(scan, text, 0);
     let inherited = false;
-    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, (from) => firstDelim(scan, text, "pem-end", from, true));
+    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, (from) => firstDelim(scan, "pem-end", from, true));
     while (cur !== undefined) {
         const next = findPemFence(scan, text, cur.after);
-        const limit = next === undefined ? text.length : next.fence;
+        const limit = next === undefined ? VIEW_END : next.fence;
         scan.self = readingKey(fam, cur.fence);
+        text.attempt(cur.fence);
         const bodyEnd = armorBodyEnd(scan, text, json, cur.after, limit, inherited, false);
         inherited = scan.hdr.hitLimit;
+        if (isHead && text.reachedEnd()) {
+            span(cur.fence, text.readEnd(), cur.fence, NOT_CLOSED, bodyEnd < 0);
+            cur = next;
+            continue;
+        }
         const end = isHead || bodyEnd < 0 ? bodyEnd : Math.max(bodyEnd, truncatedEnd(cur.after, limit, false));
         if (end >= 0)
             span(cur.fence, end, cur.fence, NOT_CLOSED);
@@ -1664,22 +1956,21 @@ function collectPemFragmentSpans(scan, text, json, span, isHead) {
 }
 function collectHeadlessPpkSpans(scan, text, span, isHead) {
     const KEY = PPK_LINES_FIELD;
-    const n = text.length;
     const LINE_NONE = -1;
     const LINE_OPEN = -2;
     const openAt = (i) => {
         if (!isHead)
             return false;
         let k = i;
-        while (k < n && tokenEnd(scan, k) < 0 && text.charCodeAt(k) === 92)
+        while (!text.atEnd(k) && tokenEnd(scan, k) < 0 && text.charCodeAt(k) === 92)
             k += 1;
-        return k >= n;
+        return text.atEnd(k);
     };
     const isB64 = (c) => (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 43 || c === 47 || c === 61;
     const b64At = (i) => tokenEnd(scan, i) < 0 && isB64(text.charCodeAt(i));
-    const skipHs = (i) => { while (i < n && tokenEnd(scan, i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
+    const skipHs = (i) => { while (!text.atEnd(i) && tokenEnd(scan, i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
         i += 1; return i; };
-    const lineEndHidden = (i) => i < n && delimClass(scan, i) === DELIM_HIDDEN;
+    const lineEndHidden = (i) => !text.atEnd(i) && delimClass(scan, i) === DELIM_HIDDEN;
     const skipNewlines = (i) => {
         let q = skipHs(i);
         let seen = false;
@@ -1722,7 +2013,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         if (lineEndHidden(i))
             return 0;
         let k = i;
-        while (k < n && text.charCodeAt(k) === 92)
+        while (!text.atEnd(k) && text.charCodeAt(k) === 92)
             k += 1;
         if (k === i)
             return 0;
@@ -1731,7 +2022,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
     };
     const atLineEnd = (i) => {
         const b = skipHs(i);
-        if (b >= n || openAt(b))
+        if (text.atEnd(b) || openAt(b))
             return true;
         if (tokenEnd(scan, b) >= 0 || lineEndHidden(b))
             return false;
@@ -1747,13 +2038,13 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         if (mk === 43 || mk === 45)
             q = skipHs(q + 1);
         let r = q;
-        while (r < n && b64At(r))
+        while (!text.atEnd(r) && b64At(r))
             r += 1;
         if (r - q < 4) {
-            if (isHead && r >= n)
+            if (isHead && text.atEnd(r))
                 return LINE_OPEN;
             r = q0;
-            while (r < n && b64At(r))
+            while (!text.atEnd(r) && b64At(r))
                 r += 1;
             if (r - q0 < 4)
                 return LINE_NONE;
@@ -1765,11 +2056,12 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         const at = text.indexOf(KEY, search);
         if (at === -1)
             break;
+        text.attempt(at);
         let p = at + KEY.length;
         const d0 = p;
-        while (p < n && tokenEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
+        while (!text.atEnd(p) && tokenEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
             p += 1;
-        if (p === d0 && p < n) {
+        if (p === d0 && !text.atEnd(p)) {
             search = at + KEY.length;
             continue;
         }
@@ -1784,7 +2076,7 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
             const r = bodyLineAt(from);
             if (r === LINE_NONE)
                 break;
-            end = r === LINE_OPEN ? n : r;
+            end = r === LINE_OPEN ? text.readEnd() : r;
             if (r === LINE_OPEN) {
                 open = true;
                 break;
@@ -1806,7 +2098,7 @@ const FRAGMENT_SECRET_PATTERNS = [
     [valueArm("xox[baprs]-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
     [valueArm("AKIA", "[0-9A-Z]", 6, "needs-left-boundary"), "«redacted:aws-key:partial»"],
     [valueArm("ASIA", "[0-9A-Z]", 8, "needs-left-boundary"), "«redacted:aws-key:partial»"],
-    [valueArm("(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-)", "[A-Za-z0-9_-]", 8, "needs-left-boundary"), "«redacted:key:partial»"],
+    [valueArm("(?:gl(?:pat|dt|rt|rtr|cbt|ptt|oas|ft|imt|agent|wt|soat|ffct)-|(?:sk|rk)_(?:live|test|org)_|pypi-|npm_|hf_|ya29\\.)", "[A-Za-z0-9_-]", 8, "needs-left-boundary"), "«redacted:key:partial»"],
     [valueArm("xapp-\\d-", "[A-Za-z0-9-]", 4, "needs-left-boundary"), "«redacted:slack-token:partial»"],
 ];
 const DISPLAY_SAFE_URL_TOKEN = "«redacted:url»";
@@ -1890,7 +2182,7 @@ const isControlCode = (c) => c < 0x20 || c === 0x7f;
 const TOKEN_UNIT_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
 function credentialParamValueStart(text, p, json) {
     let encoded = false;
-    for (let i = p; i < text.length; i++) {
+    for (let i = p; !text.atEnd(i); i++) {
         const c = text.charCodeAt(i);
         if (c === CH_EQ) {
             if (i === p)
@@ -2374,7 +2666,8 @@ function reachAt(ix, d, self) {
     return ix.dEnd2[d] < 0 ? -1 : ix.reach2[d];
 }
 const FOOT_NONE = 0x7fffffff;
-function buildForensicScan(tokens, rows, armCount) {
+const NO_DELIM_POSITIONS = new Int32Array(0);
+function buildForensicScan(tokens, rows, armCount, positionsOf) {
     return {
         rows,
         tokens,
@@ -2385,6 +2678,7 @@ function buildForensicScan(tokens, rows, armCount) {
         footLo: FOOT_NONE,
         footHi: -1,
         armFoot: new Int32Array(2 * armCount),
+        execs: [],
         lastAt: -1,
         headsRead: { a: NO_URL_SEGMENTS, n: 0 },
         headsWrite: { a: NO_URL_SEGMENTS, n: 0 },
@@ -2394,6 +2688,7 @@ function buildForensicScan(tokens, rows, armCount) {
         opsWrite: { a: NO_URL_SEGMENTS, n: 0, cut: OPS_UNCUT },
         hdr: { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false },
         delimPos: new Map(),
+        positionsOf,
         delimIx: new Map(),
         delimIxRows: rows,
     };
@@ -2404,6 +2699,11 @@ function noteEvidenceRead(scan, p) {
     if (p > scan.footHi)
         scan.footHi = p;
 }
+function noteExecution(scan, lo, hi, from) {
+    if (lo > hi)
+        return;
+    scan.execs.push(lo, hi, from);
+}
 function footprintClean(dirty, lo, hi) {
     if (lo > hi)
         return true;
@@ -2660,16 +2960,21 @@ export function unitCountsWithinForTest(table, queries) {
         anchor: Int32Array.from(sorted, keyOf),
         closeAt: new Int32Array(sorted.length).fill(NOT_CLOSED),
     };
-    const scan = buildForensicScan(NO_TOKEN_UNITS, rows, 1);
+    const scan = buildForensicScan(NO_TOKEN_UNITS, rows, 1, () => NO_DELIM_POSITIONS);
     return queries.map(([from, to, max, self]) => {
         scan.self = self === undefined ? NO_SELF : readingKey(familyCode("prose"), self);
         return measureWithin(scan, from, to, max);
     });
 }
-function delimPositions(scan, text, kind) {
+function delimPositions(scan, kind) {
     const hit = scan.delimPos.get(kind);
     if (hit !== undefined)
         return hit;
+    const pos = scan.positionsOf(kind);
+    scan.delimPos.set(kind, pos);
+    return pos;
+}
+function delimPositionsOf(text, kind) {
     const out = [];
     switch (kind) {
         case "ssh2-open":
@@ -2680,11 +2985,13 @@ function delimPositions(scan, text, kind) {
             ssh2ScanBytes += text.length;
             break;
         }
-        case "pem-end":
+        case "pem-end": {
+            const lines = new ScanReader(text);
             for (let b = text.indexOf(PEM_END_OPEN); b >= 0; b = text.indexOf(PEM_END_OPEN, b + 1))
-                if (pemFenceLineEnd(text, b + PEM_END_OPEN.length) >= 0)
+                if (pemFenceLineEnd(lines, b + PEM_END_OPEN.length) >= 0)
                     out.push(b);
             break;
+        }
         case "at":
         case "at-json":
             for (let p = text.indexOf("@"); p >= 0; p = text.indexOf("@", p + 1)) {
@@ -2699,11 +3006,9 @@ function delimPositions(scan, text, kind) {
             }
             break;
     }
-    const pos = Int32Array.from(out);
-    scan.delimPos.set(kind, pos);
-    return pos;
+    return Int32Array.from(out);
 }
-function delimIndexOf(scan, text, kind) {
+function delimIndexOf(scan, kind) {
     const t = scan.rows;
     if (scan.delimIxRows !== t) {
         scan.delimIx = new Map();
@@ -2713,7 +3018,7 @@ function delimIndexOf(scan, text, kind) {
     const hit = byKind.get(kind);
     if (hit !== undefined)
         return hit;
-    const pos = delimPositions(scan, text, kind);
+    const pos = delimPositions(scan, kind);
     const n = pos.length;
     const nextNotHidden = new Int32Array(n + 1);
     const nextFree = new Int32Array(n + 1);
@@ -2773,9 +3078,9 @@ function bucketFirstFrom(b, i, n) {
     const k = lowerBound(b, i);
     return k < b.length ? b[k] : n;
 }
-function firstDelim(scan, text, kind, from, wantFree) {
+function firstDelim(scan, kind, from, wantFree) {
     noteEvidenceRead(scan, from);
-    const di = delimIndexOf(scan, text, kind);
+    const di = delimIndexOf(scan, kind);
     const n = di.pos.length;
     const bucket = (wantFree ? di.onlyCoveredBy : di.onlyHiddenBy).get(scan.self);
     const firstAt = (i) => (i >= n ? n : Math.min(wantFree ? di.nextFree[i] : di.nextNotHidden[i], bucketFirstFrom(bucket, i, n)));
@@ -2789,11 +3094,11 @@ function firstDelim(scan, text, kind, from, wantFree) {
         j = firstAt(lowerBound(di.pos, own.maxClose[k]));
     }
     const at = j >= n ? -1 : di.pos[j];
-    noteEvidenceRead(scan, at < 0 ? text.length : at);
+    noteEvidenceRead(scan, at < 0 ? VIEW_END : at);
     return at;
 }
-function lastNotHiddenDelim(scan, text, kind, a, b) {
-    const di = delimIndexOf(scan, text, kind);
+function lastNotHiddenDelim(scan, kind, a, b) {
+    const di = delimIndexOf(scan, kind);
     const bucket = di.onlyHiddenBy.get(scan.self);
     const lastAt = (j) => {
         let best = di.prevNotHidden[j];
@@ -2820,13 +3125,12 @@ function lastNotHiddenDelim(scan, text, kind, a, b) {
     return best >= 0 && di.pos[best] >= a ? di.pos[best] : -1;
 }
 function scanUrlRun(scan, text, i, kind, json) {
-    const n = text.length;
     noteEvidenceRead(scan, i);
     scan.lastAt = -1;
-    run: while (i < n) {
+    run: while (!text.atEnd(i)) {
         const unit = crossEndAt(scan, i);
         if (unit >= 0) {
-            const at = lastNotHiddenDelim(scan, text, json ? "at-json" : "at", i, unit);
+            const at = lastNotHiddenDelim(scan, json ? "at-json" : "at", i, unit);
             if (at > scan.lastAt)
                 scan.lastAt = at;
             i = unit;
@@ -2834,7 +3138,7 @@ function scanUrlRun(scan, text, i, kind, json) {
         }
         const c = text.charCodeAt(i);
         if (json && c === 92) {
-            if (i + 1 < n && !isLineTerminator(text.charCodeAt(i + 1))) {
+            if (!text.atEnd(i + 1) && !isLineTerminator(text.charCodeAt(i + 1))) {
                 i += 2;
                 continue;
             }
@@ -2871,7 +3175,7 @@ function matchUserinfoAt(scan, text, p, json, isHead) {
     const probeEnd = scanUrlRun(scan, text, p, "plain-user", json);
     const keyId = probeEnd > p && text.charCodeAt(probeEnd) === 58 && readableCover(scan, p, probeEnd);
     const runEnd = scanUrlRun(scan, text, p, keyId ? "token-pass" : "plain-pass", json);
-    if (isHead && runEnd >= text.length && runEnd > p)
+    if (isHead && runEnd > p && text.atEnd(runEnd))
         return runEnd;
     const at = scan.lastAt;
     if (at <= p)
@@ -2879,6 +3183,7 @@ function matchUserinfoAt(scan, text, p, json, isHead) {
     return at;
 }
 const URL_SEG_STRIDE = 4;
+const URL_PARAM_DELIMS = /[?&#]/g;
 const URL_SEG_MAX_INTS = 3 * 1_048_576;
 const NO_URL_SEGMENTS = new Int32Array(0);
 const ANCHOR_SEG_STRIDE = 4;
@@ -2908,12 +3213,12 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     const phn = dirty === undefined ? 0 : hr.n;
     let pc = 0;
     for (let from = 0;;) {
-        head.lastIndex = from;
-        const m = head.exec(text);
+        const m = text.search(head, from);
         if (m === null)
             break;
         const colon = m.index;
         const start = colon + 3;
+        text.attempt(start);
         while (pc < phn && ph[pc] < colon)
             pc += URL_SEG_STRIDE;
         const known = pc < phn && ph[pc] === colon;
@@ -2934,8 +3239,9 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
             lo = scan.footLo;
             hi = scan.footHi;
             urlSegmentRuns += 1;
+            noteExecution(scan, lo, hi, start);
             if (at >= 0 && at !== (known ? ph[pc + 1] : -2)) {
-                const undecided = isHead && at >= text.length;
+                const undecided = isHead && text.atEnd(at);
                 span(start, at, colon, undecided ? NOT_CLOSED : at, undecided);
             }
         }
@@ -2957,13 +3263,15 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     const pp = pr.a;
     const ppn = dirty === undefined ? 0 : pr.n;
     let qc = 0;
-    for (let i = 0; i < text.length; i++) {
-        const c = text.charCodeAt(i);
-        if (c !== 63 && c !== 38 && c !== 35)
-            continue;
+    let resume = 0;
+    for (let m = text.search(URL_PARAM_DELIMS, 0); m !== null; m = text.search(URL_PARAM_DELIMS, resume)) {
+        const i = m.index;
+        resume = i + 1;
+        text.attempt(i + 1);
         const valueStart = credentialParamValueStart(text, i + 1, json);
         if (valueStart < 0)
             continue;
+        text.attempt(valueStart);
         while (qc < ppn && pp[qc] < i)
             qc += URL_SEG_STRIDE;
         const known = qc < ppn && pp[qc] === i;
@@ -2984,6 +3292,7 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
             lo = scan.footLo;
             hi = scan.footHi;
             urlSegmentRuns += 1;
+            noteExecution(scan, lo, hi, valueStart);
             if (valueEnd > valueStart && valueEnd !== (known ? pp[qc + 1] : -2))
                 span(valueStart, valueEnd, i, NOT_CLOSED);
         }
@@ -3000,7 +3309,7 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
             armLo = lo;
         if (hi > armHi)
             armHi = hi;
-        i = valueEnd - 1;
+        resume = valueEnd;
     }
     scan.headsRead = hw;
     scan.headsWrite = hr;
@@ -3013,10 +3322,9 @@ const JSON_FIELD_ANCHOR = '"';
 const JSON_FIELD_HEAD_MAX = Math.max(...JSON_FIELD_QUOTE_FORMS.map((f) => f.length));
 function jsonSecretFieldValueQuoteAt(text, p, depth) {
     const form = JSON_FIELD_QUOTE_FORMS[depth];
-    const n = text.length;
     const nameFrom = p + form.length;
     let i = nameFrom;
-    for (; i < n; i++) {
+    for (; !text.atEnd(i); i++) {
         const c = text.charCodeAt(i);
         if (!isJsonFieldNameCode(c))
             break;
@@ -3024,12 +3332,12 @@ function jsonSecretFieldValueQuoteAt(text, p, depth) {
     if (i === nameFrom || !text.startsWith(form, i) || credentialNameAnchor(text.slice(nameFrom, i)) === undefined)
         return -1;
     i += form.length;
-    while (i < n && isRegexSpace(text.charCodeAt(i)))
+    while (!text.atEnd(i) && isRegexSpace(text.charCodeAt(i)))
         i += 1;
     if (text.charCodeAt(i) !== CH_COLON)
         return -1;
     i += 1;
-    while (i < n && isRegexSpace(text.charCodeAt(i)))
+    while (!text.atEnd(i) && isRegexSpace(text.charCodeAt(i)))
         i += 1;
     return text.startsWith(form, i) ? i : -1;
 }
@@ -3044,7 +3352,7 @@ const packUnit8 = (kind, next) => next * 8 + kind;
 const unit8Kind = (u) => (u % 8);
 const unit8Next = (u) => (u - (u % 8)) / 8;
 function escapedUnitAt(text, i, depth) {
-    if (i >= text.length)
+    if (text.atEnd(i))
         return packUnit8(U_END, i);
     if (depth === 0) {
         const c = text.charCodeAt(i);
@@ -3111,12 +3419,13 @@ function collectJsonSecretFieldSpans(text, span, isHead) {
             const start = p - (form.length - 1);
             if (start < p - run)
                 continue;
+            text.attempt(start);
             const q = jsonSecretFieldValueQuoteAt(text, start, d);
             const found = q < 0 ? -1 : jsonStringEndAt(text, q + form.length, d, isHead);
             if (found === -1)
                 continue;
             const open = found === STRING_OPEN;
-            const end = open ? text.length : found;
+            const end = open ? text.readEnd() : found;
             span(q, end, q, open ? NOT_CLOSED : end - form.length, open, JSON_FIELD_VALUE_REPLS[d]);
             from = scanResumeAfterHit(start, end, end - q);
             next = text.indexOf(JSON_FIELD_ANCHOR, from);
@@ -3171,7 +3480,7 @@ function readTextUnit(text, i, json) {
         return packUnit(c, 1);
     if (c === CH_QUOTE)
         return packUnit(JSON_STRING_END, 1);
-    if (c !== CH_BACKSLASH || i + 1 >= text.length)
+    if (c !== CH_BACKSLASH || text.atEnd(i + 1))
         return packUnit(c, 1);
     switch (text.charCodeAt(i + 1)) {
         case CH_n: return packUnit(CH_LF, 2);
@@ -3281,9 +3590,8 @@ function anchorHeadAt(scan, text, op, json) {
     return { strength, quotedName: quote !== 0, spacedLeft, listSep, runStart };
 }
 function quotedValueEnd(text, cs, quote, json, isHead) {
-    const n = text.length;
     let i = cs;
-    while (i < n) {
+    while (!text.atEnd(i)) {
         const unit = readAnchorUnit(text, i, json);
         const ch = unitChOf(unit);
         if (ch === quote)
@@ -3292,7 +3600,7 @@ function quotedValueEnd(text, cs, quote, json, isHead) {
             return -1;
         i += unitLenOf(unit);
         if (ch === CH_BACKSLASH && quote !== JSON_STRING_END) {
-            if (i >= n)
+            if (text.atEnd(i))
                 break;
             const escaped = readAnchorUnit(text, i, json);
             if (unitChOf(escaped) === JSON_STRING_END)
@@ -3307,6 +3615,7 @@ function buildBareValueMemo() {
     return {
         from: new Int32Array(4),
         at: new Int32Array(4).fill(-1),
+        end: new Uint8Array(4),
         netFrom: new Int32Array(4).fill(NO_MEMO_GROUP),
         net: new Int32Array(16),
         runFrom: new Int32Array(4).fill(NO_MEMO_GROUP),
@@ -3315,14 +3624,17 @@ function buildBareValueMemo() {
 }
 const listSepSlot = (listSep) => (listSep === 0 ? 0 : listSep === CH_AMP ? 1 : listSep === CH_SEMI ? 2 : 3);
 function bareValueEnd(text, s, json, listSep, memo) {
-    const n = text.length;
     const k = listSepSlot(listSep);
     let i;
-    if (memo.from[k] <= s && s <= memo.at[k])
+    if (memo.from[k] <= s && s <= memo.at[k]) {
         i = memo.at[k];
+        if (memo.end[k] === 1)
+            text.readEnd();
+    }
     else {
         i = s;
-        while (i < n) {
+        let reachedEnd = false;
+        while (!(reachedEnd = text.atEnd(i))) {
             const unit = readAnchorUnit(text, i, json);
             const ch = unitChOf(unit);
             if (ch === JSON_STRING_END || isRegexSpace(ch))
@@ -3331,7 +3643,7 @@ function bareValueEnd(text, s, json, listSep, memo) {
                 break;
             const next = i + unitLenOf(unit);
             if (isQuoteUnit(ch)) {
-                if (next >= n)
+                if ((reachedEnd = text.atEnd(next)))
                     break;
                 if (endsValueUnit(unitChOf(readAnchorUnit(text, next, json))))
                     break;
@@ -3340,6 +3652,7 @@ function bareValueEnd(text, s, json, listSep, memo) {
         }
         memo.from[k] = s;
         memo.at[k] = i;
+        memo.end[k] = reachedEnd ? 1 : 0;
         memo.netFrom[k] = NO_MEMO_GROUP;
         memo.runFrom[k] = NO_MEMO_GROUP;
     }
@@ -3392,21 +3705,20 @@ function bareValueEnd(text, s, json, listSep, memo) {
     return e;
 }
 function literalValueAt(text, s, json, bare, listSep, isHead, memo) {
-    const n = text.length;
-    if (s >= n)
+    if (text.atEnd(s))
         return undefined;
     const firstUnit = readAnchorUnit(text, s, json);
     const first = unitChOf(firstUnit);
     let vs = s;
     if (isQuoteUnit(first) || first === JSON_STRING_END) {
         vs = s + unitLenOf(firstUnit);
-        if (vs >= n)
+        if (text.atEnd(vs))
             return undefined;
         if (!isAsciiAlnumCode(unitChOf(readAnchorUnit(text, vs, json))))
             return undefined;
         const close = quotedValueEnd(text, vs, first, json, isHead);
         if (close === STRING_OPEN)
-            return { start: vs, end: n, quoted: true, open: true };
+            return { start: vs, end: text.readEnd(), quoted: true, open: true };
         if (close >= 0)
             return { start: vs, end: close, quoted: true };
     }
@@ -3429,11 +3741,11 @@ function literalValueAt(text, s, json, bare, listSep, isHead, memo) {
     }
     if (isProgramIdentStartCode(text.charCodeAt(vs))) {
         let k = vs;
-        while (k < n && isProgramIdentCode(text.charCodeAt(k)))
+        while (!text.atEnd(k) && isProgramIdentCode(text.charCodeAt(k)))
             k += 1;
         anchoredScanUnits += k - vs;
         const after = text.charCodeAt(k);
-        if (after === CH_LPAREN || after === CH_LBRACKET || (after === CH_DOT && k + 1 < n && isProgramIdentStartCode(text.charCodeAt(k + 1))))
+        if (after === CH_LPAREN || after === CH_LBRACKET || (after === CH_DOT && !text.atEnd(k + 1) && isProgramIdentStartCode(text.charCodeAt(k + 1))))
             return undefined;
     }
     const e = bareValueEnd(text, vs, json, listSep, memo);
@@ -3452,7 +3764,7 @@ function literalValueAt(text, s, json, bare, listSep, isHead, memo) {
             case "goes-on":
                 return undefined;
             case "undecided":
-                return { start: vs, end: text.length, quoted: false, open: true };
+                return { start: vs, end: text.readEnd(), quoted: false, open: true };
             default: {
                 const unhandled = rest;
                 throw new Error(`redact: unhandled line-key rest ${String(unhandled)}`);
@@ -3462,9 +3774,8 @@ function literalValueAt(text, s, json, bare, listSep, isHead, memo) {
     return { start: vs, end: e, quoted: false };
 }
 function lineKeyRestAt(text, e, json, isHead) {
-    const n = text.length;
     let i = e;
-    while (i < n) {
+    while (!text.atEnd(i)) {
         const unit = readAnchorUnit(text, i, json);
         const ch = unitChOf(unit);
         if (isInlineSpaceUnit(ch) || (ch >= 0 && INVISIBLE_UNIT_CLASS[ch] === 1)) {
@@ -3526,9 +3837,8 @@ function declarativeBareAt(text, head, spacedRight, json) {
     return spacedRight && lineHeadBefore(text, head.runStart, json) ? "line-key" : "never";
 }
 function schemeValueAt(text, s, json) {
-    const n = text.length;
     let i = s;
-    if (i >= n)
+    if (text.atEnd(i))
         return undefined;
     const opening = readAnchorUnit(text, i, json);
     if (isQuoteUnit(unitChOf(opening)) || unitChOf(opening) === JSON_STRING_END)
@@ -3540,14 +3850,14 @@ function schemeValueAt(text, s, json) {
         anchoredScanUnits += REDACTION_MARK.length;
     }
     else {
-        while (i < n && i - w <= STRONG_AUTH_SCHEME_MAX && (isIdentStartCode(text.charCodeAt(i))))
+        while (!text.atEnd(i) && i - w <= STRONG_AUTH_SCHEME_MAX && (isIdentStartCode(text.charCodeAt(i))))
             i += 1;
         anchoredScanUnits += i - w;
         if (i - w > STRONG_AUTH_SCHEME_MAX || !STRONG_AUTH_SCHEMES.has(text.slice(w, i).toLowerCase()))
             return undefined;
     }
     let separated = false;
-    while (i < n) {
+    while (!text.atEnd(i)) {
         const unit = readAnchorUnit(text, i, json);
         const ch = unitChOf(unit);
         if (!isInlineSpaceUnit(ch) && !isSchemeDelimiterCode(ch))
@@ -3560,30 +3870,30 @@ function schemeValueAt(text, s, json) {
     const vs = i;
     if (engineMarked) {
         let k = i;
-        while (k < n && isToken68Code(text.charCodeAt(k)))
+        while (!text.atEnd(k) && isToken68Code(text.charCodeAt(k)))
             k += 1;
-        while (k < n && text.charCodeAt(k) === CH_EQ)
+        while (!text.atEnd(k) && text.charCodeAt(k) === CH_EQ)
             k += 1;
         if (k - vs >= BEARER_VALUE_MIN) {
             anchoredScanUnits += k - vs;
             return { start: vs, end: k, quoted: false };
         }
     }
-    if (i >= n || !isAsciiAlnumCode(text.charCodeAt(i)))
+    if (text.atEnd(i) || !isAsciiAlnumCode(text.charCodeAt(i)))
         return undefined;
-    while (i < n && isToken68Code(text.charCodeAt(i)))
+    while (!text.atEnd(i) && isToken68Code(text.charCodeAt(i)))
         i += 1;
-    while (i < n && text.charCodeAt(i) === CH_EQ)
+    while (!text.atEnd(i) && text.charCodeAt(i) === CH_EQ)
         i += 1;
     anchoredScanUnits += i - vs;
     const e = i;
-    while (i < n) {
+    while (!text.atEnd(i)) {
         const unit = readAnchorUnit(text, i, json);
         if (!isInlineSpaceUnit(unitChOf(unit)))
             break;
         i += unitLenOf(unit);
     }
-    if (i < n && !endsHeaderValueUnit(unitChOf(readAnchorUnit(text, i, json))))
+    if (!text.atEnd(i) && !endsHeaderValueUnit(unitChOf(readAnchorUnit(text, i, json))))
         return undefined;
     return { start: vs, end: e, quoted: false };
 }
@@ -3591,10 +3901,9 @@ function anchoredValueAt(scan, text, op, json, span, isHead, memo) {
     const head = anchorHeadAt(scan, text, op, json);
     if (head === undefined)
         return;
-    const n = text.length;
     let s = op + 1;
     let spacedRight = false;
-    while (s < n) {
+    while (!text.atEnd(s)) {
         const unit = readAnchorUnit(text, s, json);
         if (!isInlineSpaceUnit(unitChOf(unit)))
             break;
@@ -3661,6 +3970,7 @@ function collectAnchoredValueSpans(scan, text, json, span, isHead) {
         if (!known && dirty !== undefined && op < rd.cut)
             continue;
         scan.self = readingKey(anchorFamily, op);
+        text.attempt(op + 1);
         let lo;
         let hi;
         let answer;
@@ -3676,6 +3986,7 @@ function collectAnchoredValueSpans(scan, text, json, span, isHead) {
             hi = scan.footHi;
             if (lo > hi)
                 continue;
+            noteExecution(scan, lo, hi, op + 1);
             answer = nameBoundAt(scan, lo, hi);
         }
         if (wr.cut === OPS_UNCUT) {
@@ -3730,10 +4041,9 @@ export function resetDiagnosticScanUnitsForTest() {
     diagnosticScanUnits = 0;
 }
 function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
-    const n = text.length;
     const readRun = (from, isValue) => {
         let i = from;
-        while (i < n) {
+        while (!text.atEnd(i)) {
             const unit = readTextUnit(text, i, json);
             diagnosticScanUnits += 1;
             if (!isValue(unitChOf(unit)))
@@ -3782,6 +4092,7 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
         }
         if (nameStart < 0)
             continue;
+        text.attempt(nameStart);
         let s;
         let end;
         if (inValue) {
@@ -3790,14 +4101,14 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
         }
         else {
             s = skipBlank(op + 1);
-            if (s < n) {
+            if (!text.atEnd(s)) {
                 const unit = readTextUnit(text, s, json);
                 if (unitChOf(unit) === CH_QUOTE)
                     s += unitLenOf(unit);
             }
-            if (s >= n) {
+            if (text.atEnd(s)) {
                 if (isHead)
-                    span(nameStart, n, op, NOT_CLOSED, true);
+                    span(nameStart, text.readEnd(), op, NOT_CLOSED, true);
                 continue;
             }
             end = readRun(s, isDiagnosticValueUnit);
@@ -3805,11 +4116,11 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
         }
         if (end > s && nameTier === "auth-scheme" && readRun(s, isAsciiLetterCode) === end) {
             const k = skipBlank(end);
-            if (k > end && k >= n && isHead) {
-                span(nameStart, n, op, NOT_CLOSED, true);
+            if (k > end && isHead && text.atEnd(k)) {
+                span(nameStart, text.readEnd(), op, NOT_CLOSED, true);
                 continue;
             }
-            if (k > end && k < n) {
+            if (k > end && !text.atEnd(k)) {
                 const credEnd = readRun(k, isDiagnosticSchemeValueUnit);
                 if (credEnd > k)
                     end = credEnd;
@@ -3821,10 +4132,10 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
         }
     }
     let schemeEnd = 0;
-    DIAGNOSTIC_SCHEME_RE.lastIndex = 0;
-    for (let m = DIAGNOSTIC_SCHEME_RE.exec(text); m !== null; m = DIAGNOSTIC_SCHEME_RE.exec(text)) {
+    for (let m = text.search(DIAGNOSTIC_SCHEME_RE, 0); m !== null; m = text.search(DIAGNOSTIC_SCHEME_RE, m.index + m[0].length)) {
         const at = m.index;
         const q = at + m[0].length;
+        text.attempt(at);
         if (q < schemeEnd)
             continue;
         if (at > 0 && isRegexWordCode(text.charCodeAt(at - 1)) && deletedAt(at) === "none")
@@ -3832,9 +4143,9 @@ function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
         const k = skipBlank(q);
         if (k === q && deletedAt(q) !== "blank")
             continue;
-        if (k >= n) {
+        if (text.atEnd(k)) {
             if (isHead)
-                span(at, n, at, NOT_CLOSED, true);
+                span(at, text.readEnd(), at, NOT_CLOSED, true);
             continue;
         }
         const end = readRun(k, isDiagnosticSchemeValueUnit);
@@ -3852,12 +4163,14 @@ export function structuralScannerForTest(arm) {
     };
     switch (arm) {
         case "json-secret-field":
-            return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect(collectJsonSecretFieldSpans) };
+            return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect((text, span, isHead) => collectJsonSecretFieldSpans(new ScanReader(text), span, isHead)) };
         case "pem-fence":
-            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect((text, span, isHead) => collectPemFenceSpans(buildForensicScan(NO_TOKEN_UNITS, NO_ROWS, 1), text, span, isHead)) };
+            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect((text, span, isHead) => collectPemFenceSpans(buildForensicScan(NO_TOKEN_UNITS, NO_ROWS, 1, (kind) => delimPositionsOf(text, kind)), new ScanReader(text), span, isHead)) };
     }
 }
 let ppkScanBytes = 0;
+const TO_END = -1;
+const EACH_HEAD = -1;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
 function collectPpkContainerSpans(scan, text, eat, span, isHead) {
@@ -3872,14 +4185,14 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
         if (c !== undefined && c >= from)
             return c;
         const p = text.indexOf(needle, from);
-        ppkScanBytes += (p === -1 ? text.length : p) - from;
+        ppkScanBytes += p === -1 ? 0 : p - from;
         const v = p === -1 ? Number.POSITIVE_INFINITY : p;
         cache.set(needle, v);
         return v;
     };
     const versionEnd = (at) => {
         let p = at + HEAD.length;
-        while (p < text.length && tokenEnd(scan, p) < 0) {
+        while (!text.atEnd(p) && tokenEnd(scan, p) < 0) {
             const c = text.charCodeAt(p);
             if (c >= 48 && c <= 57)
                 p += 1;
@@ -3894,11 +4207,12 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
     };
     const isOpenHead = (at) => {
         const p = versionEnd(at);
-        return p >= text.length || (p === text.length - 1 && p > at + HEAD.length && text.charCodeAt(p) === 58);
+        return text.atEnd(p) || (text.atEnd(p + 1) && p > at + HEAD.length && text.charCodeAt(p) === 58);
     };
-    const nextVersionedHead = (from) => {
+    const nextVersionedHead = (from, attemptAt) => {
         let p = find(HEAD, from);
         for (; p !== Number.POSITIVE_INFINITY; p = find(HEAD, p + HEAD.length)) {
+            text.attempt(attemptAt === EACH_HEAD ? p : attemptAt);
             const lineEnd = versionedHeadEnd(p);
             if (lineEnd >= 0 && !lineHeld(scan, p, lineEnd, readingKey(fam, p)))
                 break;
@@ -3907,7 +4221,7 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
     };
     const hexRunEnd = (from) => {
         let e = from;
-        while (e < text.length && tokenEnd(scan, e) < 0) {
+        while (!text.atEnd(e) && tokenEnd(scan, e) < 0) {
             const c = text.charCodeAt(e);
             if ((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))
                 e += 1;
@@ -3916,12 +4230,13 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
         }
         return e;
     };
-    let at = nextVersionedHead(0);
+    let at = nextVersionedHead(0, EACH_HEAD);
     while (at !== Number.POSITIVE_INFINITY) {
         scan.self = readingKey(fam, at);
+        text.attempt(at);
         let pos = at + HEAD.length + 1;
         let closeAt = NOT_CLOSED;
-        let end = text.length;
+        let end = TO_END;
         let ateToEnd = !isHead;
         let open = false;
         for (;;) {
@@ -3942,7 +4257,7 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
                 pos = hexStart;
                 continue;
             }
-            const limit = nextVersionedHead(hexEnd);
+            const limit = nextVersionedHead(hexEnd, at);
             const straggler = Math.min(find(LINES, hexEnd), find(MAC, hexEnd), find(HASH, hexEnd));
             let gapBlank = true;
             if (limit !== Number.POSITIVE_INFINITY) {
@@ -3956,7 +4271,7 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
             }
             const undecided = isHead && limit === Number.POSITIVE_INFINITY;
             ateToEnd = straggler < limit || !gapBlank;
-            end = ateToEnd || undecided ? text.length : hexEnd;
+            end = ateToEnd || undecided ? TO_END : hexEnd;
             open = undecided;
             if (end === hexEnd)
                 closeAt = term;
@@ -3964,14 +4279,24 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
         }
         if (ateToEnd && eat !== undefined && eat.from < 0) {
             eat.from = at;
-            eat.len = text.length;
+            eat.len = text.readEnd();
         }
-        span(at, end, at, closeAt, open);
-        at = end >= text.length ? Number.POSITIVE_INFINITY : nextVersionedHead(end);
+        span(at, end === TO_END ? text.readEnd() : end, at, closeAt, open);
+        at = end === TO_END ? Number.POSITIVE_INFINITY : nextVersionedHead(end, EACH_HEAD);
     }
     const last = isHead ? text.lastIndexOf(HEAD) : -1;
-    if (last >= 0 && isOpenHead(last) && !lineHeld(scan, last, text.length, readingKey(fam, last)))
-        span(last, text.length, last, NOT_CLOSED, true);
+    if (last >= 0)
+        text.attempt(last);
+    if (last >= 0 && isOpenHead(last) && !lineHeld(scan, last, text.readEnd(), readingKey(fam, last)))
+        span(last, text.readEnd(), last, NOT_CLOSED, true);
+}
+function anchoredHeadOf(prior) {
+    switch (prior.kind) {
+        case "anchored":
+            return { kind: "anchors", anchors: prior.anchors };
+        case "bounded":
+            throw new Error("redact: a bounded arm declares no anchor literal to read its head from");
+    }
 }
 const NO_GAP = (_unit) => false;
 const armPool = (() => {
@@ -3981,6 +4306,9 @@ const armPool = (() => {
             throw new Error(`redact: arm-pool replacement ${JSON.stringify(token)} may only use a leading $1 (the run kept outside the span)`);
         return body;
     };
+    const headUnderivable = (re) => {
+        throw new Error(`redact: regex arm /${re.source}/ has no derivable head — the live frontier cannot tell where an attempt that reads past the end of the text starts`);
+    };
     const regexMember = ([re, token], rank, order) => {
         if (token.startsWith("$1"))
             throw new Error(`redact: regex arm /${re.source}/ cannot carry an outside-span $1 prefix — that form belongs to the structural scanners`);
@@ -4003,7 +4331,7 @@ const armPool = (() => {
             phase: 1,
             lexical: LEXICAL_KEYWORD_ARMS.has(re),
             diagnosticOnly: false,
-            collect: (text, _json, _eat, out, isHead) => {
+            collect: (text, _view, _json, _eat, out, isHead) => {
                 if (boundary === undefined)
                     collectRegexSpans(arm, text, out);
                 else
@@ -4020,9 +4348,10 @@ const armPool = (() => {
             family: "prose",
             reach: regexDecisionReach(re, LEXICAL_KEYWORD_ARMS.has(re)),
             prior: { kind: "bounded", gap: keywordTail === undefined ? NO_GAP : (c) => keywordTail.isSeparator(String.fromCharCode(c)) },
+            head: { kind: "units", seqs: keywordTail !== undefined ? keywordTail.forms.map((f) => [...f].map((ch) => codeUnitMembers(ch))) : d.src !== undefined ? expandHeadUnits(d.src, re.flags) : headUnderivable(re) },
         };
     };
-    const scannerMember = (token, order, arm, reach, family, prior, rank = ARM_RANK.structural, lexical = false, diagnosticOnly = false) => {
+    const scannerMember = (token, order, arm, reach, family, prior, head, rank = ARM_RANK.structural, lexical = false, diagnosticOnly = false) => {
         const repl = spanRepl(token);
         return {
             token,
@@ -4031,16 +4360,17 @@ const armPool = (() => {
             phase: 1,
             lexical,
             diagnosticOnly,
-            collect: (text, json, eat, out, isHead, deletedAt) => arm(text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead, deletedAt),
+            collect: (_text, view, json, eat, out, isHead, deletedAt) => arm(view, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead, deletedAt),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
             family,
             reach,
             prior,
+            head,
         };
     };
-    const forensicMember = (token, order, arm, reach, family, prior, rank = ARM_RANK.structural, lexical = false) => {
+    const forensicMember = (token, order, arm, reach, family, grain, prior, head, rank = ARM_RANK.structural, lexical = false) => {
         const repl = spanRepl(token);
         return {
             token,
@@ -4049,41 +4379,47 @@ const armPool = (() => {
             phase: 2,
             lexical,
             diagnosticOnly: false,
-            collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead),
+            collect: (scan, view, json, eat, out, isHead) => arm(scan, view, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
             family,
             repl,
+            grain,
             reach,
             prior,
+            head,
         };
     };
+    const PEM_ARMOR_PRIOR = { kind: "anchored", anchors: [PEM_FENCE_OPEN, PEM_END_OPEN] };
+    const SSH2_ARMOR_PRIOR = { kind: "anchored", anchors: [SSH2_FENCE_OPEN, SSH2_FENCE_CLOSE] };
+    const PPK_CONTAINER_PRIOR = { kind: "anchored", anchors: [PPK_FILE_HEAD] };
+    const HEADLESS_PPK_PRIOR = { kind: "anchored", anchors: [PPK_LINES_FIELD] };
     const structuralScannerMember = (row, order) => {
         if (row === PEM_FENCE_PATTERN)
-            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectPemFenceSpans(scan, text, span, isHead), PEM_FENCE_OPEN.length, "pem-armor", { kind: "anchored", anchors: [PEM_FENCE_OPEN, PEM_END_OPEN] });
+            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectPemFenceSpans(scan, text, span, isHead), PEM_FENCE_OPEN.length, "pem-armor", "arm", PEM_ARMOR_PRIOR, anchoredHeadOf(PEM_ARMOR_PRIOR));
         if (row === SSH2_FENCE_PATTERN)
-            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, json, span, isHead), SSH2_FENCE_OPEN.length, "ssh2-armor", { kind: "anchored", anchors: [SSH2_FENCE_OPEN, SSH2_FENCE_CLOSE] });
+            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, json, span, isHead), SSH2_FENCE_OPEN.length, "ssh2-armor", "arm", SSH2_ARMOR_PRIOR, anchoredHeadOf(SSH2_ARMOR_PRIOR));
         if (row === URL_CREDENTIAL_PATTERN)
-            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead), "://".length, "url", { kind: "bounded", gap: NO_GAP });
+            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead), "://".length, "url", "segment", { kind: "bounded", gap: NO_GAP }, { kind: "anchors", anchors: ["://"] });
         if (row === JSON_SECRET_FIELD_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_HEAD_MAX, "json-field", { kind: "bounded", gap: isRegexSpace });
+            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_HEAD_MAX, "json-field", { kind: "bounded", gap: isRegexSpace }, { kind: "anchors", anchors: [JSON_FIELD_ANCHOR] });
         throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
     };
     const members = [];
     for (const row of STRUCTURAL_SECRET_PATTERNS)
         members.push(structuralScannerMember(row, members.length));
-    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead), PPK_FILE_HEAD.length, "putty-ppk", { kind: "anchored", anchors: [PPK_FILE_HEAD] }));
-    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectPemFragmentSpans(scan, text, json, span, isHead), PEM_FENCE_OPEN.length, "pem-armor", { kind: "anchored", anchors: [PEM_FENCE_OPEN, PEM_END_OPEN] }));
-    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead), PPK_LINES_FIELD.length, "putty-ppk", { kind: "anchored", anchors: [PPK_LINES_FIELD] }));
-    members.push(forensicMember(ANCHORED_VALUE_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectAnchoredValueSpans(scan, text, json, span, isHead), Math.max(BEARER_VALUE_MIN, BARE_WORD_MAX + 1, STRONG_AUTH_SCHEME_MAX + 1), "anchor", { kind: "bounded", gap: (c) => isInlineSpaceUnit(c) || isSchemeDelimiterCode(c) }, ARM_RANK.keyword, true));
+    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead), PPK_FILE_HEAD.length, "putty-ppk", "arm", PPK_CONTAINER_PRIOR, anchoredHeadOf(PPK_CONTAINER_PRIOR)));
+    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectPemFragmentSpans(scan, text, json, span, isHead), PEM_FENCE_OPEN.length, "pem-armor", "arm", PEM_ARMOR_PRIOR, anchoredHeadOf(PEM_ARMOR_PRIOR)));
+    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead), PPK_LINES_FIELD.length, "putty-ppk", "arm", HEADLESS_PPK_PRIOR, anchoredHeadOf(HEADLESS_PPK_PRIOR)));
+    members.push(forensicMember(ANCHORED_VALUE_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectAnchoredValueSpans(scan, text, json, span, isHead), Math.max(BEARER_VALUE_MIN, BARE_WORD_MAX + 1, STRONG_AUTH_SCHEME_MAX + 1), "anchor", "segment", { kind: "bounded", gap: (c) => isInlineSpaceUnit(c) || isSchemeDelimiterCode(c) }, { kind: "anchors", anchors: ["=", ":"] }, ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.shape, members.length));
     for (const row of FRAGMENT_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.fragment, members.length));
-    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead, deletedAt) => collectDiagnosticValueSpans(text, json, span, isHead, deletedAt), Math.max(CREDENTIAL_NAME_MAX, STRONG_AUTH_SCHEME_MAX) + 2, "prose", { kind: "bounded", gap: isRegexSpace }, ARM_RANK.keyword, true, true));
+    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead, deletedAt) => collectDiagnosticValueSpans(text, json, span, isHead, deletedAt), Math.max(CREDENTIAL_NAME_MAX, STRONG_AUTH_SCHEME_MAX) + 2, "prose", { kind: "bounded", gap: isRegexSpace }, { kind: "anchors", anchors: ["=", ":"] }, ARM_RANK.keyword, true, true));
     for (const [re] of KEYWORD_SECRET_PATTERNS) {
         if (!LEXICAL_KEYWORD_ARMS.has(re))
             throw new Error(`redact: keyword arm /${re.source}/ is not registered as lexical — build it with keywordArm() so the bounded-unit scope can exclude it`);
@@ -4116,11 +4452,51 @@ const armPool = (() => {
     poolArmCount = members.length;
     poolBoundaryArmCount = retryMembers.length;
     const reaches = members.map((m) => ({ token: m.token, order: m.order, reach: m.reach }));
+    const viewOpenOf = (text, lane, spans, scanned) => {
+        const n = text.length;
+        let open = scanned;
+        const visit = (m) => {
+            const h = m.head;
+            switch (h.kind) {
+                case "units":
+                    for (let p = Math.max(0, n - m.reach); p < open; p++) {
+                        if (headFeasibleAt(h.seqs, text, p)) {
+                            open = p;
+                            break;
+                        }
+                    }
+                    return;
+                case "anchors":
+                    for (const a of h.anchors) {
+                        for (let k = Math.min(a.length - 1, n); k > 0 && n - k < open; k--) {
+                            if (text.endsWith(a.slice(0, k))) {
+                                open = n - k;
+                                break;
+                            }
+                        }
+                    }
+                    return;
+                default: {
+                    const unhandled = h;
+                    throw new Error(`redact: unhandled head reading ${String(unhandled)}`);
+                }
+            }
+        };
+        for (const m of lane.phase1)
+            visit(m);
+        for (const m of lane.phase2)
+            visit(m);
+        for (const sp of spans)
+            if (sp.end >= n && sp.start < open && members[sp.order].head.kind === "units")
+                open = sp.start;
+        return open;
+    };
     const run = (text, wantCount, json, eat, scope, reach, engineMarked, deletedAt) => {
         readings += 1;
         const isHead = reach !== undefined;
         const lane = LANES[scope];
         const spans = [];
+        const view = new ScanReader(text);
         let tried;
         const untriedFrom = (nu, p) => {
             let q = p;
@@ -4170,11 +4546,14 @@ const armPool = (() => {
                 at = freshCovered(before);
             }
         };
-        for (const m of lane.phase1)
-            m.collect(text, json, eat, spans, isHead, deletedAt);
+        for (const m of lane.phase1) {
+            view.begin();
+            m.collect(text, view, json, eat, spans, isHead, deletedAt);
+        }
         closeCoveragePositions(0);
+        let evidence;
         if (lane.phase2.length > 0) {
-            const scan = buildForensicScan(tokenUnits(text), buildEvidenceRows(text), lane.phase2.length);
+            const scan = buildForensicScan(tokenUnits(text), buildEvidenceRows(text), lane.phase2.length, (kind) => delimPositionsOf(text, kind));
             const reuse = forensicRescanMode === "incremental";
             const foot = scan.armFoot;
             let dirty;
@@ -4193,15 +4572,29 @@ const armPool = (() => {
                     scan.self = NO_SELF;
                     scan.footLo = FOOT_NONE;
                     scan.footHi = -1;
-                    lane.phase2[j].collect(scan, text, json, level === 0 ? eat : undefined, spans, isHead);
+                    const arm = lane.phase2[j];
+                    view.begin();
+                    arm.collect(scan, view, json, level === 0 ? eat : undefined, spans, isHead);
                     foot[2 * j] = scan.footLo;
                     foot[2 * j + 1] = scan.footHi;
                     forensicRuns += 1;
+                    switch (arm.grain) {
+                        case "arm":
+                            noteExecution(scan, scan.footLo, scan.footHi, scan.footLo);
+                            break;
+                        case "segment":
+                            break;
+                        default: {
+                            const unhandled = arm.grain;
+                            throw new Error(`redact: unhandled evidence grain ${String(unhandled)}`);
+                        }
+                    }
                 }
                 closeCoveragePositions(before);
                 forensicLevels += 1;
                 const grown = foldEvidenceRows(scan.rows, spans, folded, (o) => familyCodeOfOrder[o]);
                 folded = spans.length;
+                evidence = { execs: scan.execs, rows: grown.next };
                 if (grown.dirty.starts.length === 0)
                     break;
                 if (level + 1 >= FORENSIC_LEVEL_MAX) {
@@ -4224,9 +4617,12 @@ const armPool = (() => {
         }
         poolSpanCount += spans.length;
         const survives = (sp) => !engineMarked(sp.start, sp.end, sp.repl) && (sp.undecided !== true || reach === undefined || reach(sp.start));
-        const kept = resolveSpanOverlaps(spans.filter(survives));
+        const cover = spans.filter(survives);
+        const kept = resolveSpanOverlaps(cover);
+        const open = isHead ? viewOpenOf(text, lane, spans, view.open) : text.length;
+        const unattributed = view.unattributed;
         if (!wantCount || kept.length === 0)
-            return { hits: NO_HITS, kept };
+            return { hits: NO_HITS, kept, cover, evidence, open, unattributed };
         const tokenOf = (sp) => members[sp.order].token;
         const strong = spans.filter((sp) => armOfToken(tokenOf(sp)) === "full" && survives(sp)).sort((a, b) => a.start - b.start);
         const byArmedToken = new Map();
@@ -4248,9 +4644,9 @@ const armPool = (() => {
                 cur.count += 1;
             stamped.push({ ...sp, hit: { token, arm } });
         }
-        return { hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept: stamped };
+        return { hits: [...byArmedToken.values()].map(({ token, arm, count }) => ({ label: labelOfToken(token), count, arm })), kept: stamped, cover, evidence, open, unattributed };
     };
-    return Object.assign(run, { reaches, pendingTailUnits: Math.max(...reaches.map((r) => r.reach)), priors: members.map((m) => m.prior) });
+    return Object.assign(run, { reaches, maxDecisionReach: Math.max(...reaches.map((r) => r.reach)), priors: members.map((m) => m.prior) });
 })();
 let onRedaction;
 export function setRedactionObserver(fn) {
@@ -4274,9 +4670,9 @@ export const WHOLE_EXTENT = { kind: "whole" };
 function invisibleClassesOf(layout) {
     switch (layout) {
         case "multi-line":
-            return SPELLED_FORMAT | SPELLED_CONTROL | RAW_CONTROL;
+            return SPELLED_FORMAT | SPELLED_CONTROL | RAW_CONTROL | RAW_IGNORABLE;
         case "single-line":
-            return SPELLED_FORMAT | SPELLED_CONTROL | RAW_CONTROL | RAW_WHITESPACE;
+            return SPELLED_FORMAT | SPELLED_CONTROL | RAW_CONTROL | RAW_WHITESPACE | RAW_IGNORABLE;
         default: {
             const unhandled = layout;
             throw new Error(`redact: unhandled layout ${String(unhandled)}`);
@@ -4317,14 +4713,19 @@ export function readingHeadEnd(text, layout, units, from = 0) {
     }
     return text.length;
 }
-function runRedaction(text, observe, json, wantHits, scope, layout, extent, observeFrom = 0) {
+function runRedaction(text, observe, json, wantHits, scope, layout, extent, observeFrom = 0, joints = NO_JOINTS) {
     scannedUnits += text.length;
     const wantCount = wantHits || (onRedaction !== undefined && observe);
     const eat = observe ? { from: -1, len: 0, capFrom: -1, capLen: 0 } : undefined;
     let spans = [];
+    const cover = [];
     let hits = NO_HITS;
     let readsSoFar = 0;
     let unioned = false;
+    const evidence = [];
+    let lattice = text.length;
+    let viewOpen = text.length;
+    let unattributed = false;
     const read = (layers, view) => {
         const toOriginal = createViewToOriginal(layers);
         const reach = extent.kind === "head" ? (viewStart) => toOriginal.start(viewStart) < extent.emitEnd : undefined;
@@ -4343,7 +4744,17 @@ function runRedaction(text, observe, json, wantHits, scope, layout, extent, obse
         };
         const r = applyRules(view, wantCount, json, eat, scope, reach, engineMarked, deletedAt);
         forgetEscapedSeparatorTails();
+        if (r.evidence !== undefined && (r.evidence.execs.length > 0 || r.evidence.rows.starts.length > 0)) {
+            const viewLength = view.length;
+            evidence.push({ execs: r.evidence.execs, rows: r.evidence.rows, at: (v) => (v >= viewLength ? text.length : toOriginal.start(v)) });
+        }
+        if (r.open < view.length)
+            viewOpen = Math.min(viewOpen, toOriginal.start(r.open));
+        if (r.unattributed)
+            unattributed = true;
         readsSoFar += 1;
+        for (const sp of toOriginal.spans(r.cover))
+            cover.push(sp);
         if (readsSoFar === 1) {
             spans = toOriginal.spans(r.kept);
             hits = r.hits;
@@ -4360,6 +4771,7 @@ function runRedaction(text, observe, json, wantHits, scope, layout, extent, obse
         const rfold = deleteInvisibleCharacters(text, raw, rmask);
         const normalized = normalizeForRedaction(rfold.text);
         const spelled = collectSpelledCuts(normalized);
+        lattice = Math.min(lattice, latticeOpenOf(text.length, rfold, normalized, spelled.open));
         for (let smask = 0;; smask = (smask - spelled.present) & spelled.present) {
             const sfold = deleteInvisibleCharacters(normalized, spelled, smask);
             read([{ fold: sfold }, { input: rfold.text, view: normalized }, { fold: rfold }], sfold.text);
@@ -4375,9 +4787,21 @@ function runRedaction(text, observe, json, wantHits, scope, layout, extent, obse
         recordFailOpen("server.redact.ppk-eat-to-end", `from=${eat.from} len=${eat.len}`);
     if (eat !== undefined && eat.capFrom >= 0)
         recordFailOpen("server.redact.forensic-level-cap", `from=${eat.capFrom} len=${eat.capLen}`);
+    if (observe && unattributed)
+        recordFailOpen("server.redact.scan-view-unattributed", `len=${text.length}`);
     if (observe)
         reportHits(observeFrom === 0 ? hits : hitsOfSpans(spans.filter((sp) => sp.end > observeFrom)));
-    return { text: applySpans(text, spans).out, hits, spans };
+    const groups = mergeRedactionSpans(cover, poolTie, joints);
+    return { text: renderRedactionSpans(text, groups, 0, text.length), hits, spans: groups, claims: spans, crossed: jointsCrossedBy(spans, joints), evidence, lattice, view: viewOpen };
+}
+function latticeOpenOf(n, rfold, normalized, open) {
+    let at = n;
+    if (open >= 0)
+        at = createViewToOriginal([{ input: rfold.text, view: normalized }, { fold: rfold }]).start(open);
+    const last = rfold.text.length - 1;
+    if (last >= 0 && (rfold.text.charCodeAt(last) & 0xfc00) === 0xd800)
+        at = Math.min(at, createViewToOriginal([{ fold: rfold }]).start(last));
+    return at;
 }
 function hitsOfSpans(spans) {
     const by = new Map();
@@ -4415,8 +4839,12 @@ export function redactSecrets(text, opts) {
     if (before === "")
         return runRedaction(text, opts?.observe ?? true, opts?.json === true, false, "free-text", "multi-line", WHOLE_EXTENT).text;
     const whole = before + text;
-    const r = runRedaction(whole, opts?.observe ?? true, opts?.json === true, false, "free-text", "multi-line", WHOLE_EXTENT, before.length);
-    return renderRange(whole, r.spans, before.length, whole.length);
+    const r = runRedaction(whole, opts?.observe ?? true, opts?.json === true, false, "free-text", "multi-line", WHOLE_EXTENT, before.length, [before.length]);
+    return renderRedactionSpans(whole, r.spans, before.length, whole.length);
+}
+export function isCredentialShapedUnit(unit) {
+    const r = runRedaction(unit, false, false, true, "bounded-unit", "multi-line", WHOLE_EXTENT);
+    return r.claims.some((claim) => claim.start === 0 && claim.hit?.arm === "full");
 }
 export function redactSecretsWithArms(text, opts) {
     const r = runRedaction(text, opts?.observe ?? true, opts?.json === true, true, "free-text", "multi-line", WHOLE_EXTENT);
@@ -4426,21 +4854,136 @@ export function redactionSpansForTest(text, opts) {
     const r = runRedaction(text, false, opts?.json === true, false, opts?.scope ?? "free-text", "multi-line", WHOLE_EXTENT);
     return { text: r.text, spans: r.spans.map((sp) => ({ start: sp.start, end: sp.end })) };
 }
-export function proposeRedactionSpans(text, scope, layout, extent) {
-    return runRedaction(text, true, false, false, scope, layout, extent).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
+export function proposeRedactionSpans(text, scope, layout, extent, json) {
+    return runRedaction(text, true, json, false, scope, layout, extent).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
 }
-export const PENDING_TAIL_UNITS = armPool.pendingTailUnits;
+export const MAX_DECISION_REACH = armPool.maxDecisionReach;
 export function regexDecisionReachForTest(re, lexical) {
     return regexDecisionReach(re, lexical);
 }
-export function pendingTailReachForTest() {
+export function decisionReachForTest() {
     return armPool.reaches;
 }
-function pendingTailStart(text, units) {
-    const r = readShortest(text, "multi-line");
-    return r.visible <= units ? 0 : createViewToOriginal(r.layers).start(r.visible - units);
+const FRONTIER_TERMS = {
+    view: (m) => m.view,
+    lattice: (m) => m.lattice,
+    token: (m) => m.token,
+    evidence: (m, f) => m.evidence(f),
+    coverage: (m) => m.n,
+};
+const READ_PORTS = Object.keys(FRONTIER_TERMS);
+function settledFrontier(m) {
+    let f = m.n;
+    for (;;) {
+        let next = f;
+        for (const k of READ_PORTS)
+            next = Math.min(next, FRONTIER_TERMS[k](m, next));
+        if (next >= f)
+            return f;
+        f = next;
+    }
+}
+function tokenTailOpen(text) {
+    const n = text.length;
+    const p = text.lastIndexOf("«");
+    if (p < 0)
+        return n;
+    const e = tokenUnitEnd(text, p);
+    if (e < 0)
+        return n - p < TOKEN_UNIT_REACH && text.indexOf("»", p) < 0 ? p : n;
+    if (e !== n)
+        return n;
+    let start = p;
+    while (start > 0) {
+        const q = text.lastIndexOf("«", start - 1);
+        if (q < 0 || tokenUnitEnd(text, q) < start)
+            break;
+        start = q;
+    }
+    return start;
+}
+const TOKEN_UNIT_REACH = regexDecisionReach(TOKEN_UNIT_Y, false);
+function createEvidenceFrontier(readings) {
+    const prepared = readings.filter((r) => r.execs.length > 0).map((r) => {
+        const E = r.execs.length / 3;
+        const order = Array.from({ length: E }, (_, i) => i);
+        const hi = Float64Array.from(order, (i) => r.at(r.execs[3 * i + 1]));
+        const from = Float64Array.from(order, (i) => r.at(r.execs[3 * i + 2]));
+        order.sort((x, y) => hi[y] - hi[x]);
+        const t = r.rows;
+        const iv = [];
+        for (let k = 0; k < t.starts.length; k++) {
+            const s = r.at(t.starts[k]);
+            const c = t.closeAt[k];
+            const d = Math.max(r.at(t.ends[k] - 1) + 1, c >= 0 ? r.at(c) + 1 : 0);
+            if (d - s >= 2)
+                iv.push([s, d]);
+        }
+        iv.sort((a, b) => a[0] - b[0]);
+        const segS = [];
+        const segE = [];
+        for (const [s, d] of iv) {
+            const last = segE.length - 1;
+            if (last >= 0 && s < segE[last])
+                segE[last] = Math.max(segE[last], d);
+            else {
+                segS.push(s);
+                segE.push(d);
+            }
+        }
+        const horizon = (f) => {
+            let a = 0;
+            let b = segS.length;
+            while (a < b) {
+                const mid = (a + b) >>> 1;
+                if (segS[mid] < f)
+                    a = mid + 1;
+                else
+                    b = mid;
+            }
+            return a > 0 && f < segE[a - 1] ? segS[a - 1] : f;
+        };
+        return { order, hi, from, horizon };
+    });
+    if (prepared.length === 0)
+        return (f) => f;
+    return (f) => {
+        let out = f;
+        for (const p of prepared) {
+            let cur = f;
+            let least = Infinity;
+            for (let k = 0;;) {
+                const fev = p.horizon(cur);
+                while (k < p.order.length && p.hi[p.order[k]] >= fev)
+                    least = Math.min(least, p.from[p.order[k++]]);
+                if (least >= cur)
+                    break;
+                cur = least;
+            }
+            out = Math.min(out, cur);
+        }
+        return out;
+    };
+}
+export function evidenceFrontierForTest(execs, rows, f) {
+    const t = {
+        starts: Int32Array.from(rows, (r) => r[0]),
+        ends: Int32Array.from(rows, (r) => r[1]),
+        family: new Uint8Array(rows.length),
+        anchor: Int32Array.from(rows, (r) => r[0]),
+        closeAt: Int32Array.from(rows, (r) => r[2]),
+    };
+    return createEvidenceFrontier([{ execs: execs.flat(), rows: t, at: (v) => v }])(f);
 }
-function renderRange(text, spans, from, until) {
+export function forensicExecutionsForTest(text) {
+    const out = [];
+    for (const r of runRedaction(text, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: text.length }).evidence) {
+        for (let k = 0; k < r.execs.length; k += 3)
+            out.push([r.at(r.execs[k]), r.at(r.execs[k + 1]), r.at(r.execs[k + 2])]);
+    }
+    return out;
+}
+export function renderRedactionSpans(text, spans, from, until) {
     if (from >= until)
         return "";
     const parts = [];
@@ -4459,9 +5002,11 @@ function renderRange(text, spans, from, until) {
         parts.push(text.slice(at, until));
     return parts.join("");
 }
-const STREAM_RESCAN_MIN = 64;
-const streamRescanStep = (n) => Math.max(STREAM_RESCAN_MIN, n >>> 5);
+const streamRescanStep = (n) => Math.max(1, n >>> 5);
 const STREAM_WINDOW_HORIZON = 2;
+if (STREAM_WINDOW_HORIZON * MAX_DECISION_REACH > MAX_RECOGNITION_SPAN) {
+    throw new Error(`redact: the horizon of the scan window (${STREAM_WINDOW_HORIZON} × ${MAX_DECISION_REACH} units) exceeds the longest recognition span (${MAX_RECOGNITION_SPAN}) — the exit seat's margin would be shorter than what a decision reads`);
+}
 const STREAM_WINDOW_MIN = 2048;
 function deriveStreamWindowAlphabets(priors) {
     const blank = new Uint8Array(0x10000);
@@ -4481,7 +5026,7 @@ function deriveStreamWindowAlphabets(priors) {
                         throw new Error("redact: an anchored arm declares an empty anchor literal");
                     for (let i = 0; i < anchor.length; i++) {
                         const c = anchor.charCodeAt(i);
-                        if (INVISIBLE_UNIT_CLASS[c] !== 0 || FORMAT_CODEPOINT_TABLE[c] === 1 || (c & 0xf800) === 0xd800 || c === CH_BACKSLASH) {
+                        if (INVISIBLE_UNIT_CLASS[c] !== 0 || FORMAT_CODEPOINT_TABLE[c] === 1 || isReadingIgnorable(c) || (c & 0xf800) === 0xd800 || c === CH_BACKSLASH) {
                             throw new Error(`redact: anchor literal ${JSON.stringify(anchor)} holds a unit some reading deletes or reads as an escape (index ${i}) — its presence is not monotone under deletion, so the stream window's delimiter check on the most-deleted reading would be incomplete`);
                         }
                     }
@@ -4545,15 +5090,70 @@ function windowAdvancePoint(text, units, alphabets = STREAM_WINDOW_ALPHABETS) {
     return at <= 0 ? 0 : text.lastIndexOf("\n", at - 1) + 1;
 }
 function windowIndependentAt(text, q) {
-    const full = runRedaction(text, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: text.length }).spans;
+    return windowVerdictAt(text, q) === "independent";
+}
+function windowVerdictAt(text, q) {
+    const fullRun = runRedaction(text, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: text.length });
+    const full = fullRun.spans;
     if (full.some((s) => s.start < q && s.end > q))
-        return false;
+        return "span-straddles";
+    if (fullRun.evidence.some((r) => footprintStraddles(r, q)))
+        return "footprint-straddles";
+    if (fullRun.evidence.some((r) => rowStraddles(r, q)))
+        return "row-straddles";
     const after = full.filter((s) => s.start >= q);
     const tail = text.slice(q);
-    const alone = runRedaction(tail, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: tail.length }).spans;
+    const aloneRun = runRedaction(tail, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: tail.length });
+    const alone = aloneRun.spans;
     if (after.length !== alone.length)
+        return "spans-differ";
+    if (!after.every((a, i) => a.start - q === alone[i].start && a.end - q === alone[i].end && a.repl === alone[i].repl))
+        return "spans-differ";
+    if (!sameRowSet(rowKeysFrom(fullRun.evidence, q), rowKeysFrom(aloneRun.evidence, 0)))
+        return "rows-differ";
+    return fullRun.view < q ? "view-straddles" : "independent";
+}
+export function windowVerdictAtForTest(text, q) {
+    return windowVerdictAt(text, q);
+}
+function footprintStraddles(r, q) {
+    for (let k = 0; k < r.execs.length; k += 3)
+        if (r.at(r.execs[k]) < q && r.at(r.execs[k + 1]) >= q)
+            return true;
+    return false;
+}
+function rowStraddles(r, q) {
+    const t = r.rows;
+    for (let k = 0; k < t.starts.length; k++) {
+        if (r.at(t.starts[k]) >= q)
+            continue;
+        const c = t.closeAt[k];
+        if (Math.max(r.at(t.ends[k] - 1) + 1, c >= 0 ? r.at(c) + 1 : 0) > q)
+            return true;
+    }
+    return false;
+}
+function rowKeysFrom(readings, q) {
+    const keys = new Set();
+    for (const r of readings) {
+        const t = r.rows;
+        for (let k = 0; k < t.starts.length; k++) {
+            const s = r.at(t.starts[k]);
+            if (s < q)
+                continue;
+            const c = t.closeAt[k];
+            keys.add(`${s - q},${r.at(t.ends[k] - 1) + 1 - q},${t.family[k]},${r.at(t.anchor[k]) - q},${c >= 0 ? r.at(c) - q : -1}`);
+        }
+    }
+    return keys;
+}
+function sameRowSet(a, b) {
+    if (a.size !== b.size)
         return false;
-    return after.every((a, i) => a.start - q === alone[i].start && a.end - q === alone[i].end && a.repl === alone[i].repl);
+    for (const k of a)
+        if (!b.has(k))
+            return false;
+    return true;
 }
 export function windowAdvancePointForTest(text, units, extra = []) {
     return windowAdvancePoint(text, units, extra.length === 0 ? STREAM_WINDOW_ALPHABETS : deriveStreamWindowAlphabets([...armPool.priors, ...extra]));
@@ -4562,18 +5162,53 @@ export function windowIndependentAtForTest(text, q) {
     return windowIndependentAt(text, q);
 }
 export function createRedactionStream() {
-    return openRedactionStream(PENDING_TAIL_UNITS);
+    return openRedactionStream();
 }
 export function createRedactionStreamWithoutWindowForTest() {
-    return openRedactionStream(PENDING_TAIL_UNITS, false);
+    return openRedactionStream(false);
 }
 export function createRedactionStreamWithCertifierForTest(certify) {
-    return openRedactionStream(PENDING_TAIL_UNITS, true, certify);
-}
-export function createRedactionStreamWithTailForTest(units) {
-    return openRedactionStream(units);
-}
-function openRedactionStream(pendingTail, windowed = true, certify = windowIndependentAt) {
+    return openRedactionStream(true, certify);
+}
+export function createRedactionStreamWithFrontierForTest(adjust) {
+    return openRedactionStream(true, windowIndependentAt, adjust);
+}
+function settledCut(win, joints = NO_JOINTS) {
+    const n = win.length;
+    let rounds = 1;
+    let r = runRedaction(win, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: n }, 0, joints);
+    const lattice = r.lattice;
+    const token = tokenTailOpen(win);
+    let scanned = n;
+    for (let tail = Math.min(lattice, token), back = 1; tail < scanned; back *= 2) {
+        scanned = Math.max(0, Math.min(tail, scanned - back));
+        const head = win.slice(0, scanned);
+        r = runRedaction(head, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd: scanned }, 0, joints);
+        rounds += 1;
+        tail = Math.min(r.lattice, tokenTailOpen(head));
+    }
+    const spans = r.spans;
+    const inputs = { n, view: r.view, lattice, token, evidence: createEvidenceFrontier(r.evidence) };
+    const frontier = settledFrontier(inputs);
+    let cut = frontier;
+    for (const s of spans)
+        if (s.start < cut && (s.end >= cut || s.end >= scanned))
+            cut = s.start;
+    return { cut, spans, inputs, frontier, rounds };
+}
+export function settledCutsForTest(text) {
+    const s = settledCut(text);
+    const terms = Object.fromEntries(READ_PORTS.map((k) => [k, FRONTIER_TERMS[k](s.inputs, s.frontier)]));
+    return { cut: s.cut, settled: renderRedactionSpans(text, s.spans, 0, s.cut), frontier: s.frontier, terms, rounds: s.rounds };
+}
+export function createScanViewForTest(text) {
+    const r = new ScanReader(text);
+    return { view: r, open: () => r.open, unattributed: () => r.unattributed };
+}
+export function expandHeadUnitsForTest(src, flags = "g") {
+    return expandHeadUnits(src, flags).length;
+}
+function openRedactionStream(windowed = true, certify = windowIndependentAt, adjust = 0) {
     let past = [];
     let total = 0;
     let win = "";
@@ -4584,6 +5219,8 @@ function openRedactionStream(pendingTail, windowed = true, certify = windowIndep
     let sent = "";
     let scannedAt = 0;
     let evaluatedAt = -1;
+    const commits = [];
+    const jointsInWindow = () => (commits.length === 0 ? NO_JOINTS : commits.filter((c) => c > base).map((c) => c - base));
     let retryAt = 0;
     const whole = () => (past.length === 0 ? win : past.join("") + win);
     const advanceWindow = () => {
@@ -4592,7 +5229,7 @@ function openRedactionStream(pendingTail, windowed = true, certify = windowIndep
         evaluatedAt = total;
         retryAt = win.length + (win.length >> 1);
         windowEvaluations += 1;
-        const q = windowAdvancePoint(win, STREAM_WINDOW_HORIZON * pendingTail);
+        const q = windowAdvancePoint(win, STREAM_WINDOW_HORIZON * MAX_DECISION_REACH);
         if (q < 0) {
             retryAt = 0;
             return;
@@ -4615,25 +5252,18 @@ function openRedactionStream(pendingTail, windowed = true, certify = windowIndep
             total += chunk.length;
         },
         takeSettled() {
-            if (total - released <= pendingTail)
-                return "";
-            if (total - scannedAt < streamRescanStep(total))
+            if (released === total || total - scannedAt < streamRescanStep(total))
                 return "";
             scannedAt = total;
-            const emitEnd = pendingTailStart(win, pendingTail);
             const from = released - base;
-            if (emitEnd <= from)
-                return "";
-            const spans = runRedaction(win, false, false, false, "free-text", "multi-line", { kind: "head", emitEnd }).spans;
-            let cut = emitEnd;
-            for (const s of spans)
-                if (s.start < cut && s.end > cut)
-                    cut = s.start;
+            const settled = settledCut(win, jointsInWindow());
+            const spans = settled.spans;
+            let cut = Math.min(win.length, settled.cut + adjust);
             if (cut > 0 && cut < win.length && (win.charCodeAt(cut - 1) & 0xfc00) === 0xd800 && (win.charCodeAt(cut) & 0xfc00) === 0xdc00)
                 cut -= 1;
             if (cut <= from)
                 return "";
-            const out = renderRange(win, spans, from, cut);
+            const out = renderRedactionSpans(win, spans, from, cut);
             released = base + cut;
             sent += out;
             return out;
@@ -4641,9 +5271,10 @@ function openRedactionStream(pendingTail, windowed = true, certify = windowIndep
         takeAll() {
             if (released === total)
                 return "";
-            const spans = runRedaction(win, false, false, false, "free-text", "multi-line", WHOLE_EXTENT).spans;
-            const out = renderRange(win, spans, released - base, win.length);
+            const spans = runRedaction(win, false, false, false, "free-text", "multi-line", WHOLE_EXTENT, 0, jointsInWindow()).spans;
+            const out = renderRedactionSpans(win, spans, released - base, win.length);
             released = scannedAt = total;
+            commits.push(total);
             sent += out;
             return out;
         },
@@ -4651,12 +5282,13 @@ function openRedactionStream(pendingTail, windowed = true, certify = windowIndep
             if (deliveredFrom === total)
                 return { rest: "", diverged: false };
             const buf = whole();
-            const spans = runRedaction(buf, false, false, false, "free-text", "multi-line", WHOLE_EXTENT).spans;
-            const split = released > deliveredFrom && spans.some((s) => s.start < released && s.end > released);
-            return { rest: renderRange(buf, spans, released, buf.length), diverged: split || renderRange(buf, spans, deliveredFrom, released) !== sent };
+            const { spans, crossed } = runRedaction(buf, false, false, false, "free-text", "multi-line", WHOLE_EXTENT, 0, commits);
+            const split = released > deliveredFrom && (spans.some((s) => s.start < released && s.end > released) || crossed.some((j) => j > deliveredFrom));
+            return { rest: renderRedactionSpans(buf, spans, released, buf.length), diverged: split || renderRedactionSpans(buf, spans, deliveredFrom, released) !== sent };
         },
         skip() {
             released = deliveredFrom = scannedAt = total;
+            commits.push(total);
             sent = "";
         },
         endBlock() {
@@ -4824,10 +5456,6 @@ function shapeLawCredentialInQueryOrFragment(canonical) {
     }
     return false;
 }
-let displaySafeFailClosedWarned = false;
-export function resetDisplaySafeFailClosedWarnForTest() {
-    displaySafeFailClosedWarned = false;
-}
 export function buildDisplaySafeUrl(raw, positionalLaw = displayUrlOf) {
     return buildDisplaySafeUrlChecked(raw, positionalLaw).text;
 }
@@ -4863,10 +5491,6 @@ export function buildDisplaySafeRefusal(text, sourceUrls) {
 const REFUSAL_WITHHELD_TEXT = "[route refusal text withheld: it quotes a configured URL that carries a credential, and the upstream wording cannot be re-redacted safely once the URL has been rewritten for display. " +
     "The machine-readable verdict is on the pairing field beside this one; fix the configuration so the credential is not in the URL.]";
 function noteDisplaySafeFailClosed(level) {
-    if (displaySafeFailClosedWarned)
-        return;
-    displaySafeFailClosedWarned = true;
-    process.emitWarning(`display-safe URL composition fell back to fail-closed (${level}): a part of the configured URL was judged to carry a credential that the composition cannot redact at byte granularity, so that whole part is withheld. ` +
-        `The product is safe, but this deployment has an input hitting the composition seam — report it upstream. No original bytes are logged.`, "SemaRedactionFailClosed");
+    recordFailOpen("server.redact.display-safe-fail-closed", `level=${level}`);
 }
 //# sourceMappingURL=redact.js.map