Module redact 

Store-wide credential redaction retrofit.

wm ingest --redact redacts at ingest time, but content written before that flag existed (or by other write paths) can carry credential-shaped spans. A ledger entry makes the source file “unchanged”, so a re-ingest cannot re-scrub it: the stored rows themselves must be rewritten.

This pass mirrors crate::reindex::repair_content: matching rows are rewritten under the SAME id (content + recomputed content_hash) through MemoryStore::put, chained into the revision history as a content change, and delete-then-add reindexed. apply = false reports without writing.

The caller must hold the writer lock (no writable serve on the store); a fresh wm backup before applying is the operator’s responsibility.

Structs

GalaxyRedactStats

Per-galaxy redaction outcome.

RedactReport

Aggregate redaction outcome.

Functions

redact_store_content

Redact credential-shaped spans across galaxies.