[randomparity]

Live-test FAIL output could persist session credentials in console output and result JSON even when upstream exception handling redacted a different representation. The shared failure writer now collects credentials from named session headers, Cookie fields and RequestHeaders/XML forms, removes those sources, and redacts their exact echoes across the same failure object.

Bounded traversal, learned-value limits and matching/source-scan budgets use a complete failure-data marker when processing cannot finish safely. Ordinary diagnostic text and the outer result envelope remain available. Tests exercise direct FAIL records and CallFailure handling through both console and persisted JSON, including raw and once-decoded source identities, malformed/truncated fields and deterministic limit exhaustion.

Scope remains the shared writer, its tests, the specification and ADR 0345. Exception retention is owned by #1884; historical-document sanitization and PASS-row redesign remain outside this change. No live HMC calls were made.

Validation: just verify passed in 1,340.97 seconds, including the complete test suite with configured coverage, MCP smoke, wheel/sdist validation and CLI checks; pinned uv run --no-sync prek run --all-files passed all 14 hooks in 111.53 seconds. Focused runner verification passed 811 tests in 125.78 seconds; controlled faults established that the new boundary checks fail when their protections are removed. All 14 normal commit hooks passed at the final commit. Hosted amd64 Python 3.11–3.14 CI passed: all 30 applicable checks succeeded; the schedule-only support-drift check was skipped. CI run.

The latest whole-branch review approved with one medium note and no blockers. The required note and its verified composition regression were then fixed; the subsequent static security confirmation approved the final candidate with zero findings. Five scope audits completed. Review accounting retains 11 cumulative rounds under one charter, including prior exhausted allowances and explicit operator continuations; the latest allowance used 1/3. The original security initial scan and its one confirmation are complete. Simplification was a no-op.

Hook-history disclosure: an early design-only commit bypassed its commit hook by mistake. A compensating pinned all-files run passed at those design bytes; every later commit used normal configured hooks. This grants no future bypass.

Provenance: campaign 152593d7a535-fdfc969e-824d-4d69-a9ae-3ce95496903a, source #1896, same attempt 1 and frozen scope. The implementation is larger than the original 220–300-line estimate: 996 changed production/test lines. Complete design 300/fixed S100=3.00x NOTE; the denominator and approved scope were not expanded.

Closes #1896

Review exit payloads

• Original branch budget stop: truncated Cookie EOF source context could leave credential echoes. Fixed before the first operator continuation; no remaining finding.
• First continuation budget stop: an unmatched XML opening delimiter could hide a subsequent named source. Fixed before the next operator continuation; no remaining finding.
• Second continuation budget stop: list-valued named fields lost source context. Fixed before the latest operator continuation; no remaining finding.
• Latest review approved with one medium note about repeated effective entity decoding. The note and the verified encoded-header composition regression were corrected afterward. The final static security confirmation approved that candidate with zero findings; this correction is not represented as another whole-branch review pass.
• Deferrals, follow-up candidates, rejected findings and outstanding notes: none. Historical exhausted budgets remain recorded; the current allowance used one of three passes and stopped on approval.

[randomparity]

verdict: approve
exit: none
findings: 1
iterations: 1
security: approve
delivered-head-sha: a0ce942

Forge whole-branch review

forge review: not required (Cast single coupled shared-writer unit)

Review exit payloads

• Original branch budget stop: truncated Cookie EOF source context could leave credential echoes. Fixed before the first operator continuation; no remaining finding.
• First continuation budget stop: an unmatched XML opening delimiter could hide a subsequent named source. Fixed before the next operator continuation; no remaining finding.
• Second continuation budget stop: list-valued named fields lost source context. Fixed before the latest operator continuation; no remaining finding.
• Latest review approved with one medium note about repeated effective entity decoding. The note and the verified encoded-header composition regression were corrected afterward. The final static security confirmation approved that candidate with zero findings; this correction is not represented as another whole-branch review pass.
• Deferrals, follow-up candidates, rejected findings and outstanding notes: none. Historical exhausted budgets remain recorded; the current allowance used one of three passes and stopped on approval.