Harden output cache and debug state integration

internal/framework/pipeline/debug.go

@@ -491,10 +491,19 @@ func debugSourceChunkEnvelope(chunk source.Chunk) debugSourceChunk {
 }
 
 func cloneSourceUnitsForDebug(units []source.SourceUnit) []source.SourceUnit {
-	cloned, err := cloneSourceUnits(units)
-	if err != nil {
+	if len(units) == 0 {
 		return nil
 	}
+	cloned := make([]source.SourceUnit, len(units))
+	for i, unit := range units {
+		cloned[i] = source.SourceUnit{
+			ID:       unit.ID,
+			Kind:     unit.Kind,
+			Text:     string(redactSecretBytes([]byte(unit.Text))),
+			Ref:      unit.Ref,
+			Metadata: redactSensitiveMap(unit.Metadata),
+		}
+	}
 	return cloned
 }
 

internal/framework/pipeline/debug_test.go

@@ -2,6 +2,7 @@ package pipeline
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 
 	"gitea.maximumdirect.net/eric/notarius/internal/core/source"
@@ -29,6 +30,35 @@ func TestDebugSourceDocumentPreservesUnitReferences(t *testing.T) {
 	}
 }
 
+func TestDebugSourceUnitsRedactSecrets(t *testing.T) {
+	units := []source.SourceUnit{{
+		ID:       1,
+		Kind:     "paragraph",
+		Text:     "application text Bearer secretvalue sk-secretvalue",
+		Ref:      source.SourceRef{SourceID: "source-1", StartUnitID: 1, EndUnitID: 1},
+		Metadata: map[string]any{"api_key": "sk-secretvalue"},
+	}}
+
+	got := cloneSourceUnitsForDebug(units)
+	if len(got) != 1 {
+		t.Fatalf("debug unit count = %d, want 1", len(got))
+	}
+	if !strings.Contains(got[0].Text, "application text") {
+		t.Fatalf("debug unit text = %q, want application content retained", got[0].Text)
+	}
+	for _, forbidden := range []string{"secretvalue", "sk-secretvalue"} {
+		if strings.Contains(got[0].Text, forbidden) {
+			t.Fatalf("debug unit text contains %q: %q", forbidden, got[0].Text)
+		}
+	}
+	if got, want := got[0].Metadata["api_key"], "[REDACTED]"; got != want {
+		t.Fatalf("debug unit metadata api_key = %#v, want %q", got, want)
+	}
+	if units[0].Text != "application text Bearer secretvalue sk-secretvalue" {
+		t.Fatalf("source unit text was mutated: %q", units[0].Text)
+	}
+}
+
 func TestDebugSourceChunkPreservesReference(t *testing.T) {
 	doc := validSourceDocument()
 	chunk := source.Chunk{