claude-mem-lite 6.19.0 → 6.19.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "6.19.0",
+      "version": "6.19.2",
       "source": "./",
       "homepage": "https://github.com/sdsrss/claude-mem-lite",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.0",
+  "version": "6.19.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/hook-optimize.mjs

@@ -32,6 +32,7 @@ import { normalizeScope, SCOPE_PROMPT_LEGEND, insertObservationRow } from './lib
 import { liveObsFilterSql } from './lib/inject-search-core.mjs';
 import { resolveRuntimeDir } from './lib/resolve-data-dir.mjs';
 import { MEMORY_INPUT_GUARD } from './lib/memory-input-guard.mjs';
+import { MANUAL_SESSION_ID_PREFIX, writerSessionId } from './lib/provenance.mjs';
 
 import { DAY_MS } from './lib/time-constants.mjs';
 // P1-14: same resolver as hook-shared.mjs — this was the second module that had never
@@ -582,12 +583,34 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
       // text over it, wide wrote back the pre-edit narrative it read before the call
       // (tests/verify-reenrich-race.test.mjs). It also stops two overlapping runs rewriting a
       // row twice.
+      //
+      // Narrow replaces title and narrative with model text, so an explicit save it rewrites (one
+      // whose save-time enrich failed) moves to the re-enrich writer's id, as a cluster-merge
+      // keeper does (D#146, D#138). Wide keeps the stored title and narrative (it fills the lesson
+      // and the side fields), so the row stays an explicit save. The writer's session row is
+      // best-effort.
+      let rewriteSessionId = null;
+      if (!isWide) {
+        const cur = db.prepare('SELECT memory_session_id FROM observations WHERE id = ?').get(cand.id);
+        if (cur?.memory_session_id?.startsWith(MANUAL_SESSION_ID_PREFIX)) {
+          const enrichSessionId = writerSessionId('enrich-', cand.project);
+          try {
+            db.prepare(
+              `INSERT OR IGNORE INTO sdk_sessions (content_session_id, memory_session_id, project, started_at, started_at_epoch, status)
+               VALUES (?, ?, ?, ?, ?, 'active')`,
+            ).run(enrichSessionId, enrichSessionId, cand.project, new Date().toISOString(), Date.now());
+            rewriteSessionId = enrichSessionId;
+          } catch (e) {
+            debugCatch(e, 'reenrich writer session');
+          }
+        }
+      }
       const res = db
         .prepare(
           `
         UPDATE observations SET type=?, title=?, narrative=?, concepts=?, facts=?,
           text=?, importance=?, lesson_learned=?, search_aliases=?, minhash_sig=?, optimized_at=?,
-          scope=COALESCE(?, scope)
+          scope=COALESCE(?, scope), memory_session_id = COALESCE(?, memory_session_id)
         WHERE id = ? AND ${liveObsFilterSql('')} AND optimized_at IS NULL
       `,
         )
@@ -607,6 +630,7 @@ scope: ${SCOPE_PROMPT_LEGEND}`;
           // scope, or emits an off-enum value, must never blank an existing label —
           // and THIS update stamps optimized_at, so the loss would be permanent.
           normalizeScope(parsed.scope),
+          rewriteSessionId,
           cand.id,
         );
       if (res.changes === 0) {
@@ -1108,7 +1132,7 @@ export function findMergeCandidates(db, maxClusters = 5, { project } = {}) {
     -- keeper.search_aliases when it rebuilt the keeper's TF-IDF vector. Phase-2 removed that
     -- rebuild, so the column had no reader left and went with it. Do NOT re-add it on the
     -- strength of R10 P3-7 -- that finding is moot, not pending. executeMergeCluster reads
-    -- keeper.{id,importance,narrative,concepts,facts} and o.{id,title,type,narrative,
+    -- keeper.{id,project,importance,narrative,concepts,facts} and o.{id,title,type,narrative,
     -- importance,access_count,lesson_learned}, and nothing else off these rows.
     SELECT id, title, narrative, project, type, access_count, importance, created_at_epoch, minhash_sig, lesson_learned, concepts, facts
     FROM observations
@@ -1311,10 +1335,33 @@ Return ONLY valid JSON:
          SELECT ${snapColList}, ? FROM observations WHERE id = ?`,
       ).run(keeper.id, keeper.id);
 
+      // The keeper now holds model text. Search reads authorship from memory_session_id, so an
+      // explicit save's `manual-` id would mark it as one (D#138); it moves to the compression
+      // writer's id. A machine-written keeper keeps its id, and so does the snapshot above, which
+      // is the original save. writerSessionId keeps the id out of the uuid shape sdk_sessions
+      // refuses (D#147); the row stays best-effort, so no refusal can fail the merge (v6.19.1
+      // pre-tag F5a).
+      let rewriteSessionId = null;
+      const keeperSession = db
+        .prepare('SELECT memory_session_id FROM observations WHERE id = ?')
+        .get(keeper.id);
+      if (keeperSession?.memory_session_id?.startsWith(MANUAL_SESSION_ID_PREFIX)) {
+        const compressSessionId = writerSessionId('compress-', keeper.project);
+        try {
+          db.prepare(
+            `INSERT OR IGNORE INTO sdk_sessions (content_session_id, memory_session_id, project, started_at, started_at_epoch, status)
+             VALUES (?, ?, ?, ?, ?, 'active')`,
+          ).run(compressSessionId, compressSessionId, keeper.project, new Date().toISOString(), Date.now());
+          rewriteSessionId = compressSessionId;
+        } catch (e) {
+          debugCatch(e, 'cluster-merge writer session');
+        }
+      }
       db.prepare(
         `
         UPDATE observations SET title=?, narrative=?, concepts=?, facts=?, text=?,
-          importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?
+          importance=?, lesson_learned=?, minhash_sig=?, optimized_at=?,
+          memory_session_id = COALESCE(?, memory_session_id)
         WHERE id = ?
       `,
       ).run(
@@ -1327,6 +1374,7 @@ Return ONLY valid JSON:
         safe.lesson_learned,
         minhashSig,
         Date.now(),
+        rewriteSessionId,
         keeper.id,
       );
 
@@ -1555,7 +1603,7 @@ export async function executeSmartCompressCluster(db, observations, project) {
       ) {
         return null;
       }
-      const sessionId = `compress-${project}`;
+      const sessionId = writerSessionId('compress-', project);
       const now = new Date();
       db.prepare(
         `INSERT OR IGNORE INTO sdk_sessions

package/lib/activity.mjs

@@ -7,6 +7,7 @@
 import { sanitizeFtsQuery } from '../utils.mjs';
 import { scrubRecord, scrubFilePaths } from './scrub-record.mjs';
 import { saveObservation } from './save-observation.mjs';
+import { writerSessionId } from './provenance.mjs';
 // Pure title-only builder: this query runs on the EVENTS table, which has no
 // lesson_learned column — the lesson-escape variant would be a SQL error here.
 import { buildNotLowSignalSql } from './low-signal-patterns.mjs';
@@ -199,6 +200,8 @@ export function promoteInsightEvents(
       // manual-save contract) so it lands in the high-weight FTS field.
       lesson_learned: ev.body.slice(0, 500),
       now: new Date(ev.created_at_epoch),
+      // Event bodies are machine-written (episode summaries), so the row is not an explicit save.
+      sessionId: writerSessionId('promote-', ev.project),
     });
     mark.run(Date.now(), ev.id);
     return r;

package/lib/compress-core.mjs

@@ -17,6 +17,7 @@
 
 import { isoWeekKey, COMPRESSED_AUTO } from '../utils.mjs';
 import { scrubRecord } from './scrub-record.mjs';
+import { writerSessionId } from './provenance.mjs';
 
 /**
  * Low-value compression candidates: importance<=1, never accessed, older than
@@ -88,7 +89,7 @@ export function compressGroup(db, proj, obs) {
   const dominantType = Object.entries(types).sort((a, b) => b[1] - a[1])[0][0];
   const title = `Weekly summary: ${obs.length} ${dominantType} observations`;
   const narrative = obs.map((o) => `- ${o.title || '(untitled)'}`).join('\n');
-  const sessionId = `compress-${proj}`;
+  const sessionId = writerSessionId('compress-', proj);
 
   const sortedEpochs = obs.map((o) => o.created_at_epoch).sort((a, b) => a - b);
   const medianEpoch = sortedEpochs[Math.floor(sortedEpochs.length / 2)];

package/lib/deferred-work.mjs

@@ -86,6 +86,30 @@ export function listOpenWithOrdinal(db, project, limit = 10) {
     .all(project, limit);
 }
 
+/**
+ * One open row's ordinal, numbered as listOpenWithOrdinal numbers it; null when the row is not
+ * open. `defer add` / `mem_defer` read it from a 50-row page before, so an item added past 50
+ * open printed `(item ?)` (D#123).
+ * @param {Database} db
+ * @param {string} project
+ * @param {number} id
+ * @returns {number|null}
+ */
+export function openOrdinalOf(db, project, id) {
+  const row = db
+    .prepare(
+      `
+    SELECT ordinal FROM (
+      SELECT id, ROW_NUMBER() OVER (ORDER BY priority DESC, created_at_epoch ASC, id ASC) AS ordinal
+      FROM deferred_work
+      WHERE project = ? AND status = 'open'
+    ) WHERE id = ?
+  `,
+    )
+    .get(project, id);
+  return row ? row.ordinal : null;
+}
+
 /**
  * How many open rows `defer list` / `mem_defer_list` left off their page, as a line to
  * print — '' when the page held them all. Without it a page one short of the open set

package/lib/lesson-bridge.mjs

@@ -26,7 +26,8 @@ export function buildBridgePrompt(lesson, hunk) {
 
 // { ok:true, check } when the bridge produced a usable, applicable check;
 // { ok:false } on N/A / empty / error / timeout. NEVER throws — the caller
-// falls back to the baseline ACK_DIRECTIVE on { ok:false }.
+// falls back to the arm's plain directive on { ok:false } (VERDICT_DIRECTIVE since 6.17.0,
+// scripts/pre-tool-recall.js ACTIVE_DIRECTIVE).
 export async function bridgeLesson({ lesson, hunk, timeoutMs = 2500, _callLLM = callLLM }) {
   try {
     const raw = await _callLLM(buildBridgePrompt(lesson, hunk), timeoutMs);

package/lib/provenance.mjs

@@ -1,6 +1,7 @@
 // Which writer produced an observation, read back from its memory_session_id. saveObservation
 // writes every explicit save under MANUAL_SESSION_ID_PREFIX. The hook capture (`hook-`),
-// transcript import (`import-`), compression summaries (`compress-`) and rows imported from
+// transcript import (`import-`), compression summaries and cluster-merge keepers (`compress-`),
+// rows narrow re-enrich rewrote (`enrich-`), promoted events (`promote-`) and rows imported from
 // older stores (a bare session uuid) are machine-written.
 //
 // Search and get mark the machine-written side, because explicit saves are the large majority
@@ -9,6 +10,20 @@
 
 export const MANUAL_SESSION_ID_PREFIX = 'manual-';
 
+// sdk_sessions refuses a row whose two ids are equal and 36 characters long with dashes where a
+// uuid has them (schema.mjs, sdk_sessions_id_mix_check_ai). A writer row uses `<prefix><project>`
+// for both, which has that shape for one project length and dash layout (27 characters under
+// `compress-`, 29 under `manual-`), and the refusal failed every write in such a project (D#147).
+// That id gets one more character; every other id is unchanged. Counted in code points, as
+// SQLite's length() and LIKE's `_` count them.
+const UUID_SHAPED_RE = /^[\s\S]{8}-[\s\S]{4}-[\s\S]{4}-[\s\S]{4}-[\s\S]{12}$/u;
+
+/** The session id a non-hook writer (`manual-`, `compress-`, `enrich-`, `promote-`) stores for a project. */
+export function writerSessionId(prefix, project) {
+  const id = `${prefix}${project}`;
+  return UUID_SHAPED_RE.test(id) ? `${id}~` : id;
+}
+
 const AUTO_MARK = '🤖';
 const AUTO_TEXT = 'auto-written, not an explicit save';
 

package/lib/save-observation.mjs

@@ -22,7 +22,7 @@ import { liveObsFilterSql } from './inject-search-core.mjs';
 // Imported, not injected: `allowStatuses` below is the POLICY this function exists to hold,
 // and a caller free to pass its own resolver could reinstate the one-way gate D#195 closed.
 import { resolveDeferredIds, closeDeferredItems } from './deferred-work.mjs';
-import { MANUAL_SESSION_ID_PREFIX } from './provenance.mjs';
+import { MANUAL_SESSION_ID_PREFIX, writerSessionId } from './provenance.mjs';
 
 const DEDUP_WINDOW_MS = 5 * 60 * 1000;
 const DEDUP_RECENT_LIMIT = 50;
@@ -144,6 +144,7 @@ export function formatSupersedeSkipped(skipped) {
  * @param {string|null} [params.lesson_learned]   Caller validates ≤500 chars.
  * @param {boolean} [params.force=false]          Skip the near-duplicate window (below).
  * @param {Date}   [params.now]                   Override for tests.
+ * @param {string} [params.sessionId]             Writer id; default `manual-<project>` (an explicit save).
  * Both result shapes carry `supersededIds` (observations actually tombstoned) and
  * `supersedeSkipped` (requested but NOT tombstoned, each with a `reason`:
  * `malformed-id` | `no-such-observation` | `no-such-event` | `other-project` |
@@ -198,7 +199,9 @@ export function saveObservation(db, params) {
   const safeTitle = scrubSecrets(rawTitle);
   const safeLesson = rawLesson ? scrubSecrets(rawLesson) : null;
 
-  const sessionId = `${MANUAL_SESSION_ID_PREFIX}${project}`;
+  // An explicit save by default; a caller storing machine-written text names its own writer
+  // (lib/provenance.mjs reads authorship from this id).
+  const sessionId = params.sessionId || writerSessionId(MANUAL_SESSION_ID_PREFIX, project);
 
   // Ensure session exists (FK constraint). INSERT OR IGNORE makes this safe
   // under concurrent calls.

package/mem-cli.mjs

@@ -163,6 +163,7 @@ import { aggregateMetrics, readMetrics } from './lib/metrics.mjs';
 import {
   insertDeferred,
   listOpenWithOrdinal,
+  openOrdinalOf,
   dropDeferred,
   formatDropReasonHint,
   resolveDeferredIds,
@@ -1448,9 +1449,8 @@ function cmdDeferAdd(db, args) {
     return;
   }
   // Compute the freshly-inserted row's ordinal for an immediately-actionable
-  // response ("ok, deferred this as item N"). Mirrors server.mjs:980.
-  const open = listOpenWithOrdinal(db, project, 50);
-  const ord = open.find((o) => o.id === r.id)?.ordinal ?? '?';
+  // response ("ok, deferred this as item N"), as mem_defer does.
+  const ord = openOrdinalOf(db, project, r.id) ?? '?';
   out(`[mem] Deferred as D#${r.id} (item ${ord}) in project "${project}".`);
 }
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.0",
+  "version": "6.19.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-mem-lite",
-      "version": "6.19.0",
+      "version": "6.19.2",
       "os": [
         "darwin",
         "linux",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "6.19.0",
+  "version": "6.19.2",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. FTS5 BM25 keyword search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/secret-scrub.mjs

@@ -184,32 +184,35 @@ export const SECRET_PATTERNS = [
   [/\b(?:xox[bpasr]|xapp|xoxe)-[a-zA-Z0-9-]{10,}\b/g, '***'],
   // Slack incoming-webhook URL — the path after /services/ is the shared secret.
   [/(https:\/\/hooks\.slack\.com\/services\/)[A-Za-z0-9/]+/g, '$1***'],
-  // JWT tokens (eyJ...eyJ...). A JWT begins its own token, so the start is `(?<![\w-])`, not
-  // `\b`: `-` is a base64url character, and `\b` let every `-eyJ` inside one dotless run be a
-  // fresh start that rescans the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
-  // (D#130). A `-eyJ` start is the middle of a run, never a JWT's first character.
-  // A JWT glued by a hyphen to up to 40 characters of hyphenated words (`my-sess-eyJ…`,
-  // `X-Auth-Token-eyJ…`) is a start too. `\b` allowed any length; past 40 characters it is missed. The lookbehind needs a token
-  // boundary within those 41 characters, so a hyphen run has at most ~10 starts, not one per
-  // `-eyJ` (v6.19.0 pre-tag reviews P3-2, delta P3-1).
+  // JWT tokens (eyJ...eyJ...), from any `eyJ`: one glued to a prefix (`my-sess-eyJ…`,
+  // `session-<uuid>-eyJ…`, `tok_eyJ…`) is still a JWT. Every `eyJ` of one dotless run used to be a
+  // fresh start that rescanned the run to its end — quadratic, 9.6 s on 200k chars of `eyJ-`
+  // (D#130) — and v6.19.0's bounded lookbehind that fixed it missed a prefix over 40 characters
+  // (round-3 review P3-2). Here a failed start consumes its run instead (`|eyJ[\w-]*`, returned
+  // unchanged), so the scan resumes after it. Nothing is lost: the first segment cannot contain a
+  // `.`, so every later `eyJ` of the same run reaches the same run end and fails the same way.
   [
-    /(?:(?<![\w-])|(?<=(?:^|[^\w-])[\w-]{1,40}-))eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b/g,
-    '***',
+    /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+\b|eyJ[a-zA-Z0-9_-]*/g,
+    (m) => (m.includes('.') ? '***' : m),
   ],
   // PEM private key blocks. `[A-Z0-9 ]*` covers every armor label — RSA/EC/DSA/
   // OPENSSH plus ENCRYPTED and PGP (… PRIVATE KEY BLOCK) — that the fixed
   // alternation missed; the block delimiters make FP impossible.
   // The body stops at the next `-----BEGIN ` (D#130): with `[\s\S]*?` every header with no END
   // scanned to the end of the text, on each of scrubSecrets' passes — quadratic, 8.3 s on 500k
-  // chars. A block whose END is missing ends where the next private-key BEGIN starts, so a cut-off
-  // key's body is scrubbed too (v6.19.0 pre-tag review P2-1: requiring the END there stored that
-  // body); any other BEGIN (a certificate) does not end it, so a bare header in prose does not
-  // erase the text up to one (delta review P3-2). A header with no END and no later key header
-  // is left as it was in v6.18.0.
+  // chars. A block whose END is missing is left to the next pattern. Nor does it cross a mark this
+  // scrubber wrote: on a later pass, a BEGIN that a scrubbed key used to block reached a far END
+  // and erased the prose between (v6.19.2 pre-tag defect review F5).
   [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY)[\s\S])*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|(?=-----BEGIN [A-Z0-9 ]*PRIVATE KEY))/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN [A-Z0-9 ]*PRIVATE KEY|\*\*\*PEM_KEY\*\*\*)[\s\S])*?-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g,
     '***PEM_KEY***',
   ],
+  // A cut-off key (`head id_rsa`, a tool output cut mid-key) and a headerless key tail (`tail
+  // key.pem`). These are line scanners, not patterns (D#145): three rounds of review each found a
+  // line shape the regex versions misread, and each fix to one shape erased prose in another.
+  // See scrubCutOffKeys and scrubKeyTails below for the line rules.
+  [{ [Symbol.replace]: (text) => scrubCutOffKeys(text) }, null],
+  [{ [Symbol.replace]: (text) => scrubKeyTails(text) }, null],
   // Long hex strings in credential assignments (e.g. SECRET_KEY=abc123def456...).
   // `hash` deliberately excluded: `hash: <40hex>` / `hash=<md5>` are git SHAs and
   // checksums (real, preserved data in this hash-heavy repo), not credentials.
@@ -333,6 +336,463 @@ export const SECRET_PATTERNS = [
   // bare-token pattern here: don't — anchor it to a provider prefix instead.
 ];
 
+// ─── Cut-off private keys (D#145) ──────────────────────────────────────────
+// A key's text reaches the scrubber in many line shapes: plain LF/CRLF/CR lines, JSON-escaped
+// breaks (`\n` as two characters, or `\\n` when serialised twice), lines carrying a prefix (the
+// Read tool's `     2\t` or `2→`, grep's `id_rsa:`, a `> ` quote, a diff `-`), and lines inside a
+// quoted string. The scanners read the text as lines of ONE shape per key, decided at the key:
+//   - the break after the BEGIN line (or before the END line) says whether breaks are real or
+//     escaped, and at which depth; in real-break text a backslash is never a break, so a Windows
+//     path in a `Comment:` value no longer ends the header (v6.19.1 round-3 P3-E);
+//   - the text before the BEGIN (or END) on its line is the line prefix, and every other line
+//     loses a prefix of the same shape (digits may differ, `:` and `-` swap for grep context)
+//     before it is judged;
+//   - lines end at breaks only. A header value that runs on into the next JSON fields is still
+//     one header line, so it erases nothing without a base64 line under it (round-3 P3-C).
+// A body line is WHOLE base64: 16+ characters, or 1-15 for the last line. So a word under a key
+// body keeps its text (round-3 P3-A: `Don't` lost `Don`), as does a path or an identifier that
+// starts the next line (P3-B), and a body needs one long line, so a header followed by words is
+// not a key (F3). A string's closing quote, a backtick or a closing tag after the line is not part
+// of it. A line whose base64 run is followed by something else is a cut or annotated key line
+// when the run is 40+ characters or a truncation mark or delimiter follows it (`…`, `...`,
+// `[truncated]`, `<`): its base64 goes and the rest stays (delta review P3-2; v6.19.2 pre-tag
+// defect review F4). A shorter run followed by words starts a line of prose.
+
+const KEY_BEGIN_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g;
+const KEY_END_RE = /-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g;
+const KEY_END_LINE_RE = /^-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/;
+const B64_LONG_RE = /^[A-Za-z0-9+/=]{16,}$/;
+const B64_SHORT_RE = /^[A-Za-z0-9+/=]{1,15}$/;
+// Space-separated chunks, allowed only on the BEGIN line itself (a key pasted onto one line).
+const B64_CHUNKS_RE = /^[A-Za-z0-9+/=]+(?:[ \t]+[A-Za-z0-9+/=]+)*$/;
+const B64_RUN_RE = /^[A-Za-z0-9+/=]{16,}/;
+// What may follow a key line that was cut or annotated: a truncation mark or a delimiter. A quote
+// ends the string a key sits in (`…', 'rc': 0}`, `…","stderr":…`): the scanners do not track which
+// quote opened a string, since no character before a quote tells an opening quote from prose
+// (`Here's`, `Run 'head id_rsa'`, `b'…'`; v6.19.2 pre-tag reviews, delta F1 and round-3 F1/F2).
+// Two escapes deep a string ends at `\"` (round-4 F2). Five dashes are the next key's marker glued
+// to a cut line (`for i in …; do head -c 80 k; done`).
+const CUT_MARK_RE = /^(?: ?…| ?\.\.\.| ?\[| ?<|[`"']|\\+["']|-----)/;
+const PGP_CRC_RE = /^=[A-Za-z0-9+/]{4}$/;
+// How a key's base64 starts: a DER SEQUENCE (PKCS#1, PKCS#8, SEC1) or OpenSSH's `openssh-key-v1`;
+// under a PGP header, a secret-key packet in the old or new format (`lQ…`, `xc…`/`xV…`).
+const KEY_MAGIC_RE = /^(?:MII|MIG|MC4C|MHcC|b3BlbnNzaC1rZXktdjE)/;
+const PGP_MAGIC_RE = /^(?:lQ|x[cV])/;
+// RFC 1421 / RFC 4880 armor headers, before the body. Named, not any `Word:`: a `Note:` line is
+// prose, and taking it for a header made the lone base64 line under it a key.
+// RFC 1421's full set and tool-written `X-` headers count too (v6.19.2 pre-tag delta review F4:
+// `Content-Domain` or `X-Custom` before the body stored the whole key).
+const ARMOR_HEADER_RE =
+  /^(?:Proc-Type|DEK-Info|Content-Domain|Originator-ID-(?:Asymmetric|Symmetric)|Originator-Certificate|Issuer-Certificate|MIC-Info|Key-Info|Recipient-ID-(?:Asymmetric|Symmetric)|CRL|Version|Comment|Hash|Charset|MessageID|X-[A-Za-z0-9-]+)[ \t]*:/i;
+const MAX_ARMOR_HEADERS = 16;
+// A JS/Python string split across source lines: `…\n" +` then `"…` on the next line. Not a comma:
+// `'…\n',` then `'…'` is the next element of a list, and its first word is not the key's last line.
+// One whitespace quantifier on each side of the `+`: `[ \t]*\+?[ \t]*` split a run between two
+// and was quadratic when no break followed (v6.19.2 pre-tag defect review F1: 16-19 s at 200k).
+const CONCAT_AFTER_RE = /["'](?:[ \t]*\+)?[ \t]*(?:\r\n|\n|\r)[ \t]*["']/y;
+const CONCAT_BEFORE_RE = /(?:\\r)?\\n["'](?:[ \t]*\+)?[ \t]*(?:\r\n|\n|\r)[ \t]*["']$/;
+const PEM_MARK = '***PEM_KEY***';
+// After an END that ends its line: a closing quote or punctuation, then a break or the text end.
+// Closing tags may be nested (`END</code></pre>`; round-4 F3), and a string's closing quote, escaped
+// or not, ends the line whatever follows it: `…END-----","stderr":""` is `tail -n 2` in a tool
+// result (round-5 F3).
+const CLEAN_AFTER_END_RE = /(?:[ \t`,;)\]}]|<\/[A-Za-z][\w:.-]{0,40}>)*(?:\r|\n|\\+[nr]|\\*["']|$)/y;
+
+const BLANK = 0;
+const LONG = 1;
+const SHORT = 2;
+const END = 3;
+const ARMOR = 4;
+const CUT = 5;
+const OTHER = 6;
+
+function backslashesBefore(text, i, floor) {
+  let j = i;
+  while (j > floor && text[j - 1] === '\\') j--;
+  return i - j;
+}
+
+// Break depth `u`: 0 = real breaks only, 1 = `\n`, 2 = `\\n`, … A run of r backslashes then `n`
+// is a break at depth u when r % 2u === u (the backslashes before it are escaped backslashes).
+const isEscBreak = (r, u) => u > 0 && r % (2 * u) === u;
+// An unescaped quote at depth u ends the string: r % 2u < u.
+const isStringEnd = (r, u) => u > 0 && r % (2 * u) < u;
+
+/** The line starting at s: its end, and where the next line starts (-1 at the end of the text). */
+function nextLine(text, s, u) {
+  const n = text.length;
+  let i = s;
+  while (i < n) {
+    const ch = text[i];
+    if (ch === '\n') return { end: i, next: i + 1 };
+    if (ch === '\r') return { end: i, next: text[i + 1] === '\n' ? i + 2 : i + 1 };
+    if (u > 0 && ch === '\\') {
+      let j = i;
+      while (j < n && text[j] === '\\') j++;
+      const r = j - i;
+      const c = text[j];
+      if ((c === 'n' || c === 'r') && isEscBreak(r, u)) {
+        let next = j + 1;
+        if (c === 'r' && text.startsWith('\\'.repeat(u) + 'n', next)) next += u + 1;
+        if (u === 1) {
+          CONCAT_AFTER_RE.lastIndex = next;
+          const m = CONCAT_AFTER_RE.exec(text);
+          if (m) next += m[0].length;
+        }
+        return { end: j - u, next };
+      }
+      i = j + 1;
+      continue;
+    }
+    i++;
+  }
+  return { end: n, next: -1 };
+}
+
+/** The line that ends at the break before `ls`, or null when `ls` starts the text or string. */
+function prevLine(text, ls, u, floor) {
+  if (ls - 1 < floor) return null;
+  const c = text[ls - 1];
+  let bs = -1;
+  if (c === '\n') bs = ls - 2 >= floor && text[ls - 2] === '\r' ? ls - 2 : ls - 1;
+  else if (c === '\r') bs = ls - 1;
+  else if ((c === 'n' || c === 'r') && isEscBreak(backslashesBefore(text, ls - 1, floor), u)) {
+    bs = ls - 1 - u;
+    const r2 = bs - 1 >= floor && text[bs - 1] === 'r' ? backslashesBefore(text, bs - 1, floor) : 0;
+    if (c === 'n' && isEscBreak(r2, u)) bs -= u + 1;
+  } else if (u === 1 && (c === '"' || c === "'")) {
+    const m = CONCAT_BEFORE_RE.exec(text.slice(Math.max(floor, ls - 64), ls));
+    if (m) bs = ls - m[0].length;
+  }
+  if (bs === -1) return null;
+  let i = bs - 1;
+  while (i >= floor) {
+    const ch = text[i];
+    if (ch === '\n' || ch === '\r') break;
+    if (u > 0 && (ch === 'n' || ch === 'r') && isEscBreak(backslashesBefore(text, i, floor), u)) break;
+    if (u > 0 && (ch === '"' || ch === "'") && isStringEnd(backslashesBefore(text, i, floor), u)) break;
+    i--;
+  }
+  return { start: i + 1, end: bs };
+}
+
+/** A regex for the line prefix `prefix` has, with digits free and grep's `:`/`-` interchangeable. */
+function prefixShape(prefix) {
+  const body = prefix.replace(/^[ \t]+/, '');
+  if (!body || body.length > 256) return null;
+  if (body === '-' || body === '+') return /^[ \t]*[-+ ]/;
+  const src = body
+    .replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')
+    .replace(/\d+/g, '\\d+')
+    .replace(/[:-]/g, '[:-]');
+  return new RegExp(`^[ \\t]*${src}`);
+}
+
+/** The judged part of line [s, e): no prefix of the key's shape, no padding, no string quotes. */
+function lineCore(text, s, e, shape) {
+  let line = text.slice(s, e);
+  let off = s;
+  if (shape) {
+    const m = shape.exec(line);
+    if (m) {
+      line = line.slice(m[0].length);
+      off += m[0].length;
+    }
+  }
+  let a = 0;
+  let b = line.length;
+  while (a < b && (line[a] === ' ' || line[a] === '\t')) a++;
+  while (b > a && (line[b - 1] === ' ' || line[b - 1] === '\t')) b--;
+  if (a < b && (line[a] === '"' || line[a] === "'" || line[a] === '`')) a++;
+  // A closing quote or backtick with what may follow it (`",`, `" +`, `')`), or a closing tag
+  // (`</key>`), and escaped breaks before it. Read from the end: an unanchored
+  // `(?:\\+[rn])*["']…$` retried every start in a backslash run.
+  let q = b;
+  while (q > a && /[ \t+,;)\]}]/.test(line[q - 1])) q--;
+  const tag = q > a && line[q - 1] === '>' ? /<\/[A-Za-z][\w:.-]{0,40}>$/.exec(line.slice(a, q)) : null;
+  if (tag) b = q - tag[0].length;
+  else if (q > a && (line[q - 1] === '"' || line[q - 1] === "'" || line[q - 1] === '`')) {
+    q--;
+    for (;;) {
+      if (q - 1 <= a || (line[q - 1] !== 'n' && line[q - 1] !== 'r')) break;
+      let k = q - 1;
+      while (k > a && line[k - 1] === '\\') k--;
+      if (k === q - 1) break;
+      q = k;
+    }
+    b = q;
+  }
+  return { core: line.slice(a, b), start: off + a, end: off + b };
+}
+
+function classify(core) {
+  if (core === '') return BLANK;
+  if (B64_LONG_RE.test(core)) return LONG;
+  if (B64_SHORT_RE.test(core)) return SHORT;
+  if (KEY_END_LINE_RE.test(core)) return END;
+  if (ARMOR_HEADER_RE.test(core)) return ARMOR;
+  if (cutRun(core)) return CUT;
+  return OTHER;
+}
+
+/**
+ * The base64 run a cut or annotated key line starts with, or null: 16+ characters followed by a
+ * truncation mark or a delimiter (`…`, `...`, `[truncated]`, `<`, a backtick), or 40+ followed by
+ * anything (`<64> see above`). A shorter run followed by text is an identifier or a path starting
+ * a line of prose (`exportedArmoredPrivateKey = …`, round-3 P3-B), which stays.
+ */
+function cutRun(core) {
+  const m = B64_RUN_RE.exec(core);
+  if (!m) return null;
+  return m[0].length >= 40 || CUT_MARK_RE.test(core.slice(m[0].length)) ? m[0] : null;
+}
+
+/**
+ * Where the key that starts with the BEGIN at [b, be) ends, or -1 when no key material follows it.
+ * Header lines and blank lines may come first; then 16+-character base64 lines (blank lines only
+ * between them), one shorter last line (and a PGP `=XXXX` checksum after it), and the END if it
+ * is there. One base64 line alone is a key only when it is 40+ characters, starts the way a key
+ * encoding starts (DER `MII…`, OpenSSH `b3BlbnNzaC1rZXktdjE…`) or follows armor headers: a path
+ * or an identifier of 16-39 characters under a header is prose (delta review P3-5). A complete
+ * block never gets here; the block pattern above takes it first.
+ */
+function cutOffKeyEnd(text, b, be) {
+  // The rest of the BEGIN line: nothing, or base64 chunks, then a break that sets the depth.
+  let i = be;
+  while (i < text.length && /[A-Za-z0-9+/= \t]/.test(text[i])) i++;
+  const rest = text.slice(be, i).trim();
+  let u;
+  let next;
+  if (i >= text.length) return -1;
+  if (text[i] === '\n' || text[i] === '\r') {
+    u = 0;
+    next = text[i] === '\r' && text[i + 1] === '\n' ? i + 2 : i + 1;
+  } else if (text[i] === '\\') {
+    let j = i;
+    while (j < text.length && text[j] === '\\') j++;
+    const r = j - i;
+    if (text[j] !== 'n' && text[j] !== 'r') return -1;
+    u = r & -r;
+    if (r !== u) return -1; // a literal backslash on the BEGIN line: not a key line
+    ({ next } = nextLine(text, i, u));
+  } else return -1;
+  let longs = 0;
+  let longest = 0;
+  let first = '';
+  let end = -1;
+  if (rest) {
+    // A key pasted onto its BEGIN line: every chunk but the last is a full 16+ line. Words there
+    // are prose, even one of 16+ letters (v6.19.2 pre-tag defect review F9). A loop, not a spread:
+    // Math.max(...chunks) overflowed the stack past ~125k chunks (F2).
+    if (!B64_CHUNKS_RE.test(rest)) return -1;
+    const chunks = rest.split(/[ \t]+/);
+    for (let k = 0; k < chunks.length; k++) {
+      if (k < chunks.length - 1 && chunks[k].length < 16) return -1;
+      if (chunks[k].length > longest) longest = chunks[k].length;
+    }
+    if (longest < 16) return -1;
+    longs = 1;
+    first = chunks[0];
+    end = be + text.slice(be, i).trimEnd().length;
+  }
+  // The BEGIN line's prefix.
+  let ls = b;
+  while (ls > 0) {
+    const ch = text[ls - 1];
+    if (ch === '\n' || ch === '\r') break;
+    if (u > 0 && (ch === 'n' || ch === 'r') && isEscBreak(backslashesBefore(text, ls - 1, 0), u)) break;
+    if (u > 0 && (ch === '"' || ch === "'") && isStringEnd(backslashesBefore(text, ls - 1, 0), u)) break;
+    ls--;
+  }
+  // A 16+ base64 run glued to the BEGIN is the previous key's cut line, not a line prefix: taken
+  // for one, it stripped this key's identical body line and one copy of a repeated cut key went
+  // per pass (v6.19.2 pre-tag round-5 review F2).
+  let run = 0;
+  while (run < 16 && b - run > ls && /[A-Za-z0-9+/=]/.test(text[b - run - 1])) run++;
+  const shape = run >= 16 ? null : prefixShape(text.slice(ls, b));
+
+  let armors = 0;
+  let shorts = 0;
+  let pendingBlank = false;
+  while (next !== -1) {
+    const line = nextLine(text, next, u);
+    const { core, start, end: coreEnd } = lineCore(text, next, line.end, shape);
+    const kind = classify(core);
+    next = line.next;
+    if (kind === END) {
+      if (longs > 0) end = start + KEY_END_LINE_RE.exec(core)[0].length;
+      break;
+    }
+    if (kind === BLANK) {
+      if (shorts > 0) break;
+      pendingBlank = true;
+      continue;
+    }
+    if (longs === 0) {
+      if (kind === ARMOR && ++armors <= MAX_ARMOR_HEADERS) continue;
+      if (kind !== LONG && kind !== CUT) break;
+    }
+    if (kind === LONG && shorts === 0) {
+      if (longs++ === 0) first = core;
+      longest = Math.max(longest, core.length);
+      end = coreEnd;
+      pendingBlank = false;
+      continue;
+    }
+    // A cut line ends the key whatever came before it, blank lines included: a PGP or encrypted
+    // key has one before its body, and `head` of it in a JSON string ends in a cut line (round-4
+    // F1: checked after the blank-line stop, it was never read and the whole key was stored).
+    if (kind === CUT && shorts === 0) {
+      const run = cutRun(core);
+      if (longs++ === 0) first = run;
+      longest = Math.max(longest, run.length);
+      end = start + run.length;
+      break;
+    }
+    if (pendingBlank) break;
+    if (kind === SHORT && (shorts === 0 || (shorts === 1 && PGP_CRC_RE.test(core)))) {
+      shorts++;
+      end = coreEnd;
+      continue;
+    }
+    break;
+  }
+  if (longs === 0) return -1;
+  const magic = KEY_MAGIC_RE.test(first) || (text.slice(b, be).includes('PGP') && PGP_MAGIC_RE.test(first));
+  return longs >= 2 || armors > 0 || longest >= 40 || magic ? end : -1;
+}
+
+function scrubCutOffKeys(text) {
+  if (!text.includes('PRIVATE KEY')) return text;
+  KEY_BEGIN_RE.lastIndex = 0;
+  let out = '';
+  let last = 0;
+  let m;
+  while ((m = KEY_BEGIN_RE.exec(text))) {
+    const end = cutOffKeyEnd(text, m.index, m.index + m[0].length);
+    if (end === -1) continue;
+    out += text.slice(last, m.index) + PEM_MARK;
+    last = end;
+    KEY_BEGIN_RE.lastIndex = end;
+  }
+  return last === 0 ? text : out + text.slice(last);
+}
+
+/**
+ * The span [start, end) of the key tail that ends with the END at [e, ee), or null: whole base64
+ * lines of 16+ characters directly above it, with one shorter line before the END, or two when the
+ * one before the END is a PGP `=XXXX` checksum (delta review P2; two short words above an END are
+ * prose, round-3 P3-D). The span takes the END too, unless words precede the END on its line (a
+ * sentence naming it): then the lines above go and the sentence stays (F7). `floor` is the end of
+ * the previous END, so no line is read twice.
+ */
+function keyTailSpan(text, e, ee, floor) {
+  let ls = e;
+  let u = 0;
+  while (ls > floor) {
+    const ch = text[ls - 1];
+    if (ch === '\n' || ch === '\r') break;
+    if (ch === 'n' || ch === 'r') {
+      const r = backslashesBefore(text, ls - 1, floor);
+      if (r > 0) {
+        u = r & -r;
+        break;
+      }
+    }
+    ls--;
+  }
+  let longs = 0;
+  let shorts = 0;
+  let crc = false;
+  let top = -1;
+  let topCore = '';
+  let longest = 0;
+  let bottom = -1;
+  const take = (core, start, end) => {
+    if (!accept(core, start)) return false;
+    if (bottom === -1) bottom = end;
+    return true;
+  };
+  const accept = (core, start) => {
+    const kind = classify(core);
+    if (kind === LONG) {
+      longs++;
+      top = start;
+      topCore = core;
+      if (core.length > longest) longest = core.length;
+      return true;
+    }
+    if (longs > 0 || kind !== SHORT) return false;
+    if (shorts === 0) {
+      shorts = 1;
+      crc = PGP_CRC_RE.test(core);
+      return true;
+    }
+    if (shorts === 1 && crc) {
+      shorts = 2;
+      return true;
+    }
+    return false;
+  };
+  // The END line's own prefix: a line prefix, the key's last base64 run glued to the END, or words.
+  // Words with spaces are a line prefix when the line above starts the same way (`web-1  | `, a
+  // syslog stamp, `> > `; v6.19.2 pre-tag delta review F2), and a sentence naming the END if not.
+  const prefix = text.slice(ls, e);
+  const trimmed = prefix.trim();
+  let shape = null;
+  let sentence = false;
+  let prefixed = false;
+  if (/^[ \t]*[A-Za-z0-9+/=]+$/.test(prefix)) {
+    const at = ls + prefix.indexOf(trimmed);
+    if (!take(trimmed, at, at + trimmed.length)) return null;
+  } else {
+    shape = prefixShape(prefix);
+    const above = shape && prevLine(text, ls, u, floor);
+    prefixed = Boolean(above && shape.test(text.slice(above.start, above.end)));
+    if (/\S\s+\S/.test(trimmed) && !prefixed) {
+      sentence = true;
+      shape = null;
+    }
+  }
+  // An END alone on its line (after nothing but a line prefix, before nothing but a quote,
+  // punctuation or a closing tag) is evidence enough for one line over it that has a digit, a `+`
+  // or `=` padding: `tail -n 2` of a key whose last line is 16-39 characters (delta F3). A 16+
+  // run of random base64 almost always has one; a camelCase identifier or a path has none
+  // (round-3 F3). An END in a sentence or in inline code followed by words is not alone.
+  CLEAN_AFTER_END_RE.lastIndex = ee;
+  const clean = !sentence && (trimmed === '' || prefixed) && CLEAN_AFTER_END_RE.test(text);
+  let cur = ls;
+  for (let line; (line = prevLine(text, cur, u, floor)); cur = line.start) {
+    const { core, start, end } = lineCore(text, line.start, line.end, shape);
+    if (!take(core, start, end)) break;
+  }
+  // Otherwise the same evidence a cut-off key needs: one base64 line alone is a key tail only when
+  // it is 40+ characters, starts like a key encoding or sits over a PGP checksum; an identifier of
+  // 16-39 characters over an END named in prose is not (F7).
+  if (longs === 0) return null;
+  const b64ish = /[0-9+]|=$/.test(topCore);
+  if (!(longs >= 2 || longest >= 40 || crc || (clean && b64ish) || KEY_MAGIC_RE.test(topCore))) return null;
+  return [top, sentence ? bottom : ee];
+}
+
+function scrubKeyTails(text) {
+  if (!text.includes('PRIVATE KEY')) return text;
+  KEY_END_RE.lastIndex = 0;
+  let out = '';
+  let last = 0;
+  let floor = 0;
+  let m;
+  while ((m = KEY_END_RE.exec(text))) {
+    const span = keyTailSpan(text, m.index, m.index + m[0].length, Math.max(floor, last));
+    if (span) {
+      out += text.slice(last, span[0]) + PEM_MARK;
+      last = span[1];
+    }
+    floor = m.index + m[0].length;
+  }
+  return last === 0 ? text : out + text.slice(last);
+}
+
 /**
  * Scrub known secret patterns (API keys, tokens, credentials) from text.
  * Also strips user-marked `<private>...</private>` blocks first, so every

package/server.mjs

@@ -125,6 +125,7 @@ import { AUTO_MERGE_THRESHOLD } from './lib/dedup-constants.mjs';
 import {
   insertDeferred,
   listOpenWithOrdinal,
+  openOrdinalOf,
   dropDeferred,
   formatDropReasonHint,
   resolveDeferredIds,
@@ -1221,8 +1222,7 @@ server.registerTool(
     });
     // Compute the ordinal for the freshly-inserted row so the response is
     // immediately actionable ("ok, I deferred this as item 1").
-    const open = listOpenWithOrdinal(db, project, 50);
-    const ord = open.find((o) => o.id === r.id)?.ordinal ?? null;
+    const ord = openOrdinalOf(db, project, r.id);
     return {
       content: [
         {

package/utils.mjs

@@ -289,13 +289,34 @@ const DESC_SCRUB_WINDOW = 4096;
 // before the first remaining `<private>` or private-key BEGIN, so no field shows a span whose end
 // is out of view. Before v6.19.0 an unclosed opener in the window (a Grep line
 // `notes.md:3:<private>bank pin 4412`) was shown as written (v6.19.0 pre-tag reviews P3-1, r3 P2-1).
-// The PEM half is case-sensitive, like the scrubber's PEM pattern.
-const PRIVATE_OPENER_RE = /<[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----BEGIN [A-Z0-9 ]*PRIVATE KEY/;
-function scrubTruncate(str, max) {
+// A `</private>` or private-key END that comes first is a span whose START is out of view (a
+// nested span, `tail key.pem`), so everything before it may be its inside: the field shows nothing
+// (round-3 P3-1). The PEM half is case-sensitive, like the scrubber's PEM pattern.
+const PRIVATE_MARK_RE = /<\/?[Pp][Rr][Ii][Vv][Aa][Tt][Ee]>|-----(?:BEGIN|END) [A-Z0-9 ]*PRIVATE KEY/;
+// A window edge that cuts a token leaves a fragment shorter than its pattern needs (`ghp_` and 12
+// of its 36 characters), and whitespace collapsing can bring it into view: the cut token is
+// dropped (defect review P3-6, round-3 P3-4/P3-6). A head window with no whitespace keeps it: its
+// start is intact and it is the only part shown. A tail window with no whitespace is all one cut token.
+const isWs = (c) => c === ' ' || c === '\n' || c === '\t' || c === '\r' || /\s/.test(c);
+function dropCutTokenAtEnd(win, next) {
+  if (next === undefined || isWs(next)) return win;
+  let i = win.length;
+  while (i > 0 && !isWs(win[i - 1])) i--;
+  return i > 0 ? win.slice(0, i) : win;
+}
+function dropCutTokenAtStart(win, prev) {
+  if (prev === undefined || isWs(prev)) return win;
+  let i = 0;
+  while (i < win.length && !isWs(win[i])) i++;
+  return win.slice(i);
+}
+function scrubTruncate(str, max, window = DESC_SCRUB_WINDOW) {
   if (typeof str !== 'string' || str === '') return truncate(str, max);
-  let win = stripPrivate(str).slice(0, DESC_SCRUB_WINDOW);
-  const at = win.search(PRIVATE_OPENER_RE);
-  if (at >= 0) win = win.slice(0, at);
+  const stripped = stripPrivate(str);
+  let win = stripped.slice(0, window);
+  const mark = PRIVATE_MARK_RE.exec(win);
+  if (mark) win = mark[0][1] === '/' || mark[0].startsWith('-----END') ? '' : win.slice(0, mark.index);
+  else win = dropCutTokenAtEnd(win, stripped[window]);
   // The window edge can split a surrogate pair; truncate only guards a cut it makes itself.
   if (/[\uD800-\uDBFF]$/.test(win)) win = win.slice(0, -1);
   return truncate(_scrubSecrets(win), max);
@@ -314,6 +335,17 @@ function scrubTruncate(str, max) {
 // key with no END more than 4096 characters back).
 const PRIVATE_TAG_HINT_RE = /<\/?private>/i;
 const HEAD_ONLY_MAX = 60;
+// The tail window is scrubbed with TAIL_CONTEXT characters before it, which are then dropped: a
+// label cut by the window's edge (`pass|word: <value>`) is seen whole, so its value is not left
+// unlabelled at the window's start, where whitespace collapsing can bring it into view (v6.19.1
+// pre-tag review F1). A replacement inside the context moves the cut by its length change; the
+// token the cut lands in is dropped either way.
+const TAIL_CONTEXT = 256;
+function scrubTailWindow(str, window) {
+  const scrubbed = _scrubSecrets(str.slice(-(window + TAIL_CONTEXT)));
+  return dropCutTokenAtStart(scrubbed.slice(TAIL_CONTEXT), scrubbed[TAIL_CONTEXT - 1]);
+}
+const oneSpace = (s) => s.replace(/\s+/g, ' ');
 // The early return needs the WHOLE output inside the head window: a long output whose first
 // 4096 characters collapse to a few (whitespace) still has a tail to show (v6.19.0 pre-tag
 // claims review F2).
@@ -321,11 +353,20 @@ function scrubTruncateEnds(str, max) {
   if (typeof str === 'string' && (str.includes('PRIVATE KEY') || PRIVATE_TAG_HINT_RE.test(str))) {
     return scrubTruncate(str, HEAD_ONLY_MAX);
   }
-  const flat = scrubTruncate(str, DESC_SCRUB_WINDOW);
-  const whole = typeof str !== 'string' || str.length <= DESC_SCRUB_WINDOW;
+  // Up to two windows long, one window covers the whole output: two overlapping windows showed
+  // the same text twice (delta review P3-4).
+  const window =
+    typeof str === 'string' && str.length <= 2 * DESC_SCRUB_WINDOW
+      ? 2 * DESC_SCRUB_WINDOW
+      : DESC_SCRUB_WINDOW;
+  // Whitespace runs are one space: a blank-line run no longer spends the budget (or, before the
+  // one-window rule, hid behind the window edge).
+  const flat = oneSpace(scrubTruncate(str, window, window));
+  const whole = typeof str !== 'string' || str.length <= window;
   if (whole && flat.length <= max) return flat;
   const tailLen = Math.floor(max / 2) - 1;
-  const tailSrc = whole ? flat : normalizeInline(_scrubSecrets(str.slice(-DESC_SCRUB_WINDOW)));
+  const tailSrc = whole ? flat : oneSpace(normalizeInline(scrubTailWindow(str, window)));
+  if (tailSrc === '') return truncate(flat, max);
   // Drop a lone low surrogate the tail's cut may start on.
   const tail = tailSrc.slice(-tailLen).replace(/^[\uDC00-\uDFFF]/, '');
   // A head short enough to escape truncate's own "…" still gets one before the tail.