Replay suite for known subjects, and the gaps it found

[askalf]

A replay suite for known subjects, and the four gaps it found on its first runs.

The suite: _test_replay.mjs, in npm test

• People: invented, hard on purpose: ordinary-word names (Grant, Test User, Chase Hope), one-word names, hyphens, apostrophes, accents, and every common phone spelling.
• Request shapes, five of them:
  • a chat turn;
  • an agent tool loop with a form submission in a JSON tool result, and a draft tool whose earlier call carries real values;
  • MCP-named tools;
  • Chat Completions tool calls;
  • Responses function calls.
• What every combination must do:
  1. Leak nothing: once redacted, the egress check finds no declared identifier.
  2. Not refuse ordinary text: a message that uses a name's plain words only as ordinary lowercase words passes.
  3. Round-trip: a reply that uses the placeholders gets the real values back, in its text and in an allowed tool's arguments, while a tool the restore policy does not name keeps the placeholders.
• Size: 17 fixed people × 5 shapes × 7 messages, which is 595 combinations, plus generated people through every shape as fast-check properties. CORDON_FUZZ_RUNS deepens them; they pass at 1,000.

What it found (fixed here)

• A name right after a JSON escape was not redacted. A tool result's JSON text writes \nGrant, and the n glued to the name, which defeated the word boundary. subjectSpans now reads \n, \", \\ and the other JSON escapes as separators of the same length, so offsets still point into the original text.
• A one-word name in capitals ("GRANT") was not redacted. The capitalised form is case-sensitive. An all-caps form is added.
• A username-style join matched inside other words. The joins are marisolvance, mvance and vancem. Detection's contiguous form was unbounded, so "advancement" got a redacted "vancem". It is now letter-bounded, so digits may follow ("mvance77") but letters may not.
• The initial joins were read across words at egress. The egress check read them as separator-blind needles, so "the stone might" (stonemight) refused a person named Mia Stone. Initial joins are now read letter-bounded, with any separators between their letters. The full first-and-last joins stay separator-blind needles too.

Tests

• New regressions in _test_subject.mjs: capitals; JSON escapes; "the stone might" not read; "stonem77" still read; "advancement" untouched.
• npm test: all green (262/215/18/5/replay 5/156/117/94).

[sprayberry-redline]

Verdict: approve. The replay suite exercises redaction, egress checking, and restoration across the supported request shapes, while the subject matcher changes cover escaped JSON boundaries, uppercase single-token names, and bounded handle forms. The focused regressions cover the newly fixed matching cases.