[Naoray]

What & why

Protect customer, employee, and person record IDs after explicit labels, including quoted and serialized values, mixed tool output, and later session turns. Typed repeat seeds retain provenance and exact restore.

Field-owned values must have an ID shape. Leading symbols, bounded groups, dash connectors, separated numeric wrappers, and padded base64 remain covered. Reference rejection requires an _id or Id boundary; uppercase ID prefixes remain private. Type rejection uses finite spellings, and a hyphenated ID can precede a parenthetical prose suffix. Hash-led values distinguish Unicode numeric IDs and longer non-hex identifiers from colours, counting characters rather than bytes.

The shared markup index requires strict, bounded tag grammar plus evidence from standard HTML/SVG/MathML names, custom elements, or PascalCase components. Closing/self-closing tags, recognized HTML/framework attributes, and constrained standalone HTML fragments establish context. Unquoted values accept URL/query/style punctuation. SQL-keyword attribute lookalikes, including paired lookalikes, and malformed tags cannot hide IDs or repeats. Existing unquoted ID attributes remain raw; quoted attributes and proven data scalars retain ownership.

SQL grouping stops before keywords in either case within SQL context; grouped prose IDs retain their complete values. SQL parameters, including quoted/qualified table carriers, and small variables in spaced code assignments cannot seed the sweep. SELECT context requires a statement anchor and FROM; schema context requires a column list and ends at its matching close. Complete ALTER ADD COLUMN carriers retain context across tool-output prefixes.

Every sweep source follows both strict JSON and lexical key/number/literal gates. Labelled containers own only explicit record values. Daemon v2 accounts for repeat provenance and matcher allocations before publication; provenance changes invalidate earlier inventory decisions.

Validation

Candidate: c441706d3463eee55174686a68c84eb8a844a272. Every new commit is signed and has a DCO trailer.

• Focused sweep: 60 tests pass. Five rule-boundary generators cover 1,270 primary/repeat cases. All 328 original carrier rows remain exact-unchanged. The former semicolon-attribute negative is retained as an unchanged-output case; an actually invalid nested-angle attribute supplies the owned counterweight.
• Named Anvil fast passes with assessment.passing_and_current=true at this candidate.
• Final workspace verification, the 103-mutant catalog, the original 35,214-case replay plus 176 carriers, and all 220 review probes are being refreshed at this candidate. These are pending, and earlier-head observations do not certify it.
• The original 34,560 structure cases, 4,900 covered-value cases, and 359,152 legacy comparisons retain their expectations. The committed review-probe fixture and FULL CI-input inventory make the new inputs reviewable and repeatable.

Benchmark evidence

Certification is pending for candidate c441706d3463eee55174686a68c84eb8a844a272. No benchmark capture was started in this correction. Fresh full-corpus shipped-policy base/candidate observations under both v2 and v1 scored-label contracts and the mechanism comparison remain required before merge. Earlier benchmark observations do not certify this candidate.

Axes and limits

The digit floor narrows recall for quoted alphabetic application keys to preserve code/schema structure. Exact type spellings and actual identifier references remain ambiguous application values; their exclusions trade recall for structure preservation. Padded base64 retains existing digit-free IDs. Tokenized values restore byte-exactly, and caches belong to one input.

Direct unquoted HTML IDs remain raw pending safe token emission. Direct numeric JSON IDs retain the existing bare-token behavior, which may make cleaned JSON invalid until restore. Container/header mapping, YAML numeric repeat ambiguity, prose dash counts, and the previously uncovered Markdown/table forms remain follow-ups. Benchmark certification and a further review remain required before merge.

[Naoray]

Closing as superseded. Review rounds showed that lexical value-shape rules cannot tell record IDs from code, markup and JSON syntax reliably. Labelled record IDs will instead land as a series of small PRs built on typed field provenance:

• Add typed protection outcomes and field provenance types #893: typed protection outcomes and field-provenance types (no behaviour change)
• Test structured-field record IDs through proxy tool calls #892: capture tests that reproduce structured-field context loss in the proxy, MCP, CLI and daemon
• Next: audit columns for outcomes, field paths threaded from the proxy and MCP, a structured-input benchmark layer, then a field-label recognizer for customer, employee and record IDs

The label vocabulary and the review probe fixture from this branch will be reused there. The branch stays in place.