@volter/supercode-teams 0.3.156 → 0.3.157

package/README.md

@@ -58,6 +58,14 @@ mail history and individual records can still be large. The
 [allocation evidence](../../docs/evidence/mail-transcript-stream-2026-10-08.md) names
 the source boundary and the remaining runtime qualification.
 
+The connector's redaction memo keeps serialized redacted JSON, with at most
+200,000 entries and 32 MiB of accounted string payload (two bytes per code unit,
+including keys and digests). An entry over 1 MiB is not retained. Oldest entries
+are evicted to fit; cache misses still go through the redaction worker. These are
+memo bounds, not total connector memory limits. The
+[source investigation](../../docs/evidence/connector-redaction-memo-2026-10-08.md)
+does not attribute the observed process peak or claim a measured runtime improvement.
+
 `supercode teams rpc mail.statistics` reads local storage counts and import/retention receipts. It is refused remotely
 and through the app door. Writer groups count stored envelope copies, not call attempts or quotas; database page
 counts exclude physical WAL size. Successful imports record their actual source reads, bytes, batch sizes and time.

package/connector/index.mjs

@@ -103,14 +103,30 @@ export function foldConnectorState(stateDir){
 }
 // What leaves for the server is redacted (@volter/teams/redact), and every digest this connector keeps or sends (what it
 // observed, a baseline, the carried prefix) is of that form: a digest of the local text named a prefix the server never
-// held, every carry was refused, and each session holding a secret went whole on every pass. A message is redacted once
-// per process, in the connector's redaction worker: by its digest, nothing kept for one without a secret (most), its
-// redacted form for one with. Each loaded message's digest (of the form sent) is taken once and read where needed.
-const REDACTED_MEMO=200000;
+// held, every carry was refused, and each session holding a secret went whole on every pass. A message is redacted
+// in the connector's redaction worker, with a bounded digest memo: no body for one without a secret (most), serialized
+// redacted JSON for one with. Evicted or oversized values are redacted again. Each loaded message's digest (of the form
+// sent) is taken once and read where needed. The byte budget counts two bytes per retained string code unit, including
+// keys and digests; the entry bound separately limits Map/record overhead. Neither is a total-process heap bound.
+const REDACTED_MEMO=200000,REDACTED_MEMO_BYTES=32*1024*1024,REDACTED_MEMO_ENTRY_BYTES=1024*1024;
 const redactions=new Map();
+let redactionBytes=0;
 const sentDigests=new WeakMap();
 const digestOf=message=>{let digest=sentDigests.get(message);if(digest===undefined){digest=hash(canonicalJson(message.value));sentDigests.set(message,digest);}return digest;};
-const remember=(digest,redacted)=>{if(redactions.size>=REDACTED_MEMO)redactions.clear();redactions.set(digest,redacted);};
+function remember(digest,redacted){
+  // Remove the earlier unchanged placeholder even if this redacted body is too large to cache: leaving it would
+  // make a later hit reuse the original, unredacted message.
+  const previous=redactions.get(digest);
+  if(previous){redactionBytes-=previous.bytes;redactions.delete(digest);}
+  const kept=redacted?{text:JSON.stringify(redacted.value),digest:redacted.digest}:null;
+  const bytes=2*(digest.length+(kept?.digest.length??0)+(kept?.text.length??0));
+  if(bytes>REDACTED_MEMO_ENTRY_BYTES)return;
+  while(redactions.size>=REDACTED_MEMO||redactionBytes+bytes>REDACTED_MEMO_BYTES){
+    const oldest=redactions.keys().next().value;
+    redactionBytes-=redactions.get(oldest).bytes;redactions.delete(oldest);
+  }
+  redactions.set(digest,{kept,bytes});redactionBytes+=bytes;
+}
 // A capture part is one request, and the server refuses a body over 8 MiB (volter-teams request-json.mjs): a part
 // holds at most PART_MESSAGES messages (the contract's bound) and PART_BYTES of them, so a run of large tool results
 // splits across parts instead of failing the whole session. A single message larger than that goes alone.
@@ -881,7 +897,7 @@ export class TeamsConnector {
     const out=new Array(raw.length),missing=[];
     raw.forEach((message,index)=>{
       const text=canonicalJson(message.value),digest=hash(text);
-      if(redactions.has(digest)){const kept=redactions.get(digest);out[index]=kept?{...message,value:kept.value}:message;sentDigests.set(out[index],kept?kept.digest:digest);return;}
+      if(redactions.has(digest)){const {kept}=redactions.get(digest);out[index]=kept?{...message,value:JSON.parse(kept.text)}:message;sentDigests.set(out[index],kept?kept.digest:digest);return;}
       if(held?.has(digest)){remember(digest,null);out[index]=message;sentDigests.set(message,digest);return;}
       missing.push([index,digest,text]);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.156",
+  "version": "0.3.157",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",