Egress: a name's single words count only capitalised, in capitals or spread out

[askalf]

Found by the first real report-only traffic: the Unscathed Desk's turns for a test inquiry were marked would-refuse. A replay with the site's real inquiry layout reproduces it for a visitor named "Test User". The visitor's own message, "this is a test of the contact form", tripped the egress check on the lowercase word "test".

Cause

A declared name's single words are read alone at egress, word-bounded with any separators, to catch a spread-out name ("Z o r a"). That reading matched every lowercase occurrence of the word too. Detection only replaces the capitalised word, so an ordinary lowercase "test", "user" or "grant" stayed in the body and egress called it the name. A one-word name was also a separator-blind folded needle, so "grant" was found inside "fragrant".

Change

• Separate list. Name-token forms move to their own list, spreadRes.
• When a match counts. A match counts only when the occurrence is spread out, meaning a separator sits between its letters, or when it starts with a capital ("Test", "TEST"). The check runs on a normalised copy of the text that keeps case.
• Order. This reading runs after the pattern and folded readings, so a full name still reports as pattern.
• One-word names. A one-word name is no longer a folded needle.
• Unchanged. Full names in any case, initial-and-surname forms, emails, phones, IDs, handles, addresses and dates are read as before.

Tests

New regressions:

• Test User: "this is a test … as a new user" is not a hit, while "Test", "TEST", "t e s t" and "u.s.e.r" are.
• Grant: "grant access … fragrant grants … vagrant" is not a hit, while "Grant" and "g r a n t" are.
• The desk's context turn: for a "Test User" visitor it is verified once redacted.

Five earlier tests relied on a lowercase word counting as the name. Each now uses a declared literal or the capitalised word, so it still tests what it meant to: that the field is read.

• Suite: npm test is all green: 262/210/18/5/156/117/94.
• Fuzz: the subject fuzz passes at 1,000 runs per property.

[sprayberry-redline]

Verdict: request changes. The egress matcher separates case-sensitive name-token handling as intended, but the release note was added inside the changelog's existing HTML comment and will not appear in the published changelog.

1. Blocking: CHANGELOG.md:12

• Egress: a declared name's single words are no longer found in ordinary lowercase text. A word read alone counts only when it is capitalised, in capitals or spread out ("Test", "TEST", "t e s t"), so a visitor named Test User or Grant does not turn "this is a test" or "grant access" into a refusal. A one-word name is no longer a separator-blind needle either ("fragrant" held "grant"). Full names, email addresses, phone numbers and the other forms are read as before.

This entry is between the opening <!-- and closing --> of the release-convention comment. Consequently it is hidden from rendered changelog readers and release notes produced from this file do not document the behavior change.

Suggested fix:

Move the Fixed section and this entry below `## [Unreleased]`, outside the HTML comment.

rule:none

[sprayberry-redline]

Verdict: approve. The egress matcher now separates standalone name tokens from folded needles and accepts those tokens only when capitalized or separated, while retaining the existing full-name and identifier checks. The regression coverage exercises lowercase ordinary text, capitalized and separated tokens, one-token names, and the reported redaction path.