ideate writes caller free text into a committed tier with no scanner call — the fifth committed-tier writer the store-before-commit sweep missed. internal/core/ideate/record.go renders the verdict payload and writes it with fsutil.CreateExclusiveIn into .abcd/development/research/, and nothing in internal/core/ideate imports the scanner, so a secret or an identity pasted into the verdict text lands in the durable record in clear while capture, memory, history and intent all route their text through sc.ScanText plus scanner.Redact first. Evidence: internal/core/ideate/record.go (the CreateExclusiveIn call and render), and the absence of any scanner reference in the package. The fix is to route the rendered record through the same shared redactor before the exclusive create, with the stage-two residual check the other stores apply.

ideate writes caller free text into a committed tier with no scanner call — the fifth committed-tier writer the store-before-commit sweep missed. internal/core/ideate/record.go renders the verdict payload and writes it with fsutil.CreateExclusiveIn into .abcd/development/research/, and nothing in internal/core/ideate imports the scanner, so a secret or an identity pasted into the verdict text lands in the durable record in clear while capture, memory, history and intent all route their text through sc.ScanText plus scanner.Redact first. Evidence: internal/core/ideate/record.go (the CreateExclusiveIn call and render), and the absence of any scanner reference in the package. The fix is to route the rendered record through the same shared redactor before the exclusive create, with the stage-two residual check the other stores apply.

Grounds

• pursued: the tier decides the stance — a writer into .abcd/development/ takes intent's fail-closed posture, and redacting the fields before the renderer rather than the rendered document keeps the escaping authoritative; it would show wrong if a legitimate verdict were refused by the stage-two residual on core-owned bytes the field pass cannot reach, which would mean the slug, not the prose, is the thing that must be rewritten