Expand description
Store-wide credential redaction retrofit.
wm ingest --redact redacts at ingest time, but content written before
that flag existed (or by other write paths) can carry credential-shaped
spans. A ledger entry makes the source file “unchanged”, so a re-ingest
cannot re-scrub it: the stored rows themselves must be rewritten.
This pass mirrors crate::reindex::repair_content: matching rows are
rewritten under the SAME id (content + recomputed content_hash) through
MemoryStore::put, chained into the revision history as a content change,
and delete-then-add reindexed. apply = false reports without writing.
The caller must hold the writer lock (no writable serve on the store);
a fresh wm backup before applying is the operator’s responsibility.
Note (2026-09-21 reviewer finding): rewrites scrub the live records in every lane — galaxy rows and the episodic raw records that mirror explicit memories. LMDB is copy-on-write, so a freed page can retain pre-rewrite bytes until the allocator reuses it; reads and search never consult freed pages, so nothing is retrievable once this pass reports clean. For byte-level absence on disk, back the store up and restore into a fresh store.
Structs§
- Galaxy
Redact Stats - Per-galaxy redaction outcome.
- Redact
Report - Aggregate redaction outcome.
Functions§
- redact_
store_ content - Redact credential-shaped spans across
galaxies.