Description
The Wave 6 pre-close confidentiality review found that malformed API response formatting resumes after a rewritten quoted URL candidate. If that candidate closing quote is also the next credential URL opener, the second value is skipped and can reach APICallError and shipped poll diagnostics.
Acceptance Criteria
- #1 JSON-like URL scanning reconsiders overlapping quote positions even after replacing an earlier candidate
- #2 Two overlapping credential URL candidates are both redacted from malformed APICallError output
- #3 Focused redaction tests and the repository gate pass
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
- Add the independent reviewer overlapping-URL reproducer and observe the second credential survive.
- Resynchronise over shared quote boundaries after replacement without copying replaced bytes twice.
- Run focused race tests, CodeRabbit review, the repository gate, then commit and push.
Implementation Notes
Observed the overlapping-URL regression fail before the fix. Complete rewritten JSON-string tokens now leave the source closing quote available as a possible overlapping opener; the focused race-enabled truncation suite passes.
Validation at implementation commit 3bb2bdd9: the focused race-enabled redaction suites and final just check passed; the final CodeRabbit two-file source slice completed with findings=0. The independent reviewer found the last overlapping-quote bypass, its object/array/comma reproducers failed before the fix and passed after it; the requested final independent retry was platform-blocked and is not counted as a clean pass.
Final Summary
Closed the malformed API-response credential-redaction bypass described by this task in implementation commit 3bb2bdd9. Focused race tests, the repository gate, and a completed zero-finding CodeRabbit source review passed.