fix(service-datasource): carry a withheld value forward only where the read path still withholds it

restoreRedactedConfig re-redacts the merged config and keeps only the
grafts whose landing path is still withheld, repeating until nothing more
drops (the /meta carry-forward's loop). An untouched Save skips the second
walk: the merged config is the stored one.

Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/services/service-datasource/src/__tests__/datasource-contractless-credentials.test.ts

@@ -261,6 +261,60 @@ describe('a withheld array value is carried only onto the element it came from',
   });
 });
 
+describe('a value is carried forward only where the read path would still withhold it', () => {
+  // A pair's `value` is credential material only while a label names a
+  // credential, so an edit to the LABEL changes whether the value beside it is
+  // withheld. The pair sits under a plain (non-credential) record key, so the
+  // array identity rule does not apply and only the re-judgment can decide.
+  const STORED = {
+    host: 'wh.internal',
+    proxyHeader: { name: 'Authorization', value: 'Bearer px-1' },
+    probeHeader: { key: 'X-Api-Key', value: 'pk-2' },
+  };
+  const SERVED = { host: 'wh.internal', proxyHeader: { name: 'Authorization' }, probeHeader: { key: 'X-Api-Key' } };
+  const restore = (patch: Record<string, unknown>) => restoreRedactedConfig(DRIVER, patch, STORED) as Record<string, unknown>;
+
+  it('control: an untouched Save carries both values forward', () => {
+    expect(restore(structuredClone(SERVED))).toEqual(STORED);
+  });
+
+  it('a label renamed to a non-credential name: the value is dropped, not served', () => {
+    const out = restore({ ...structuredClone(SERVED), proxyHeader: { name: 'X-Trace' } });
+    expect(out.proxyHeader).toEqual({ name: 'X-Trace' });
+    expect(out.probeHeader).toEqual(STORED.probeHeader);
+    expect(JSON.stringify(out)).not.toContain('px-1');
+  });
+
+  it('a label deleted: the value is dropped, not served', () => {
+    const out = restore({ ...structuredClone(SERVED), proxyHeader: {} });
+    expect(out.proxyHeader).toEqual({});
+    expect(JSON.stringify(out)).not.toContain('px-1');
+  });
+
+  it('a `key:` label renamed: the value is dropped, not served', () => {
+    const out = restore({ ...structuredClone(SERVED), probeHeader: { key: 'Accept' } });
+    expect(out.probeHeader).toEqual({ key: 'Accept' });
+    expect(out.proxyHeader).toEqual(STORED.proxyHeader);
+    expect(JSON.stringify(out)).not.toContain('pk-2');
+  });
+
+  it('a label renamed to ANOTHER credential name still carries the value (it stays withheld)', () => {
+    const out = restore({ ...structuredClone(SERVED), proxyHeader: { name: 'Proxy-Authorization' } });
+    expect(out.proxyHeader).toEqual({ name: 'Proxy-Authorization', value: 'Bearer px-1' });
+  });
+
+  it('whatever survives the restore is withheld again on the next read', async () => {
+    const { service } = makeService([{ name: 'w', driver: DRIVER, origin: 'runtime', config: structuredClone(STORED) }]);
+    const read = await service.getDatasource('w');
+    const config = structuredClone(read!.config) as Record<string, unknown>;
+    config.proxyHeader = { name: 'X-Trace' };
+    config.probeHeader = {};
+    await service.updateDatasource('w', { config });
+    const again = await service.getDatasource('w');
+    expect(JSON.stringify(again)).not.toMatch(/px-1|pk-2/);
+  });
+});
+
 describe('planCredentialMigration names a contractless row\'s credentials as residue', () => {
   it('refuses with a remedy instead of reporting nothing-to-migrate', () => {
     const plan = planCredentialMigration({

packages/services/service-datasource/src/datasource-config-redaction.ts

@@ -97,6 +97,17 @@ export {
  * raw-headers list's value) is carried only when the patch's array equals the
  * served array.
  *
+ * ## Only where the read path would still withhold it
+ *
+ * Whether a position is withheld can depend on its siblings: the `value` of a
+ * `{ name, value }` pair is credential material only while a label names a
+ * credential. A value carried forward beside an EDITED sibling (the label
+ * renamed, deleted, or moved to another label key) could therefore land where
+ * the read path would serve it. So the grafted config is redacted again, and a
+ * graft survives only when the redaction still withholds its landing path —
+ * repeated until nothing more drops. A dropped graft leaves the patch as the
+ * author sent it there.
+ *
  * What this does NOT do is let a patch set a refused key: `assertValidConfig`
  * still runs on the merged record, so a caller that types `password` into the
  * config gets #8078's refusal exactly as it would without this function.
@@ -110,20 +121,48 @@ export function restoreRedactedConfig(
   if (!stored || typeof stored !== 'object') return patch;
 
   const served = redactDatasourceConfig(driver, stored);
-  let out: Record<string, unknown> = patch;
-
+  const grafts: Array<{ landing: string[]; value: unknown }> = [];
   for (const path of served.redactedPaths) {
     const storedLeaf = valueAt(stored, path);
     if (storedLeaf === undefined) continue;
     const landing = landingPath(served.config, patch, path);
-    if (!landing) continue;
-    if (out === patch) out = { ...patch };
-    graftAt(out, landing, storedLeaf);
+    if (landing) grafts.push({ landing, value: storedLeaf });
   }
+  if (grafts.length === 0) return patch;
+
+  const graftAll = (kept: readonly { landing: string[]; value: unknown }[]): Record<string, unknown> => {
+    const out: Record<string, unknown> = { ...patch };
+    for (const graft of kept) graftAt(out, graft.landing, graft.value);
+    return out;
+  };
 
-  return out;
+  // An untouched Save — the patch IS the served projection — grafts every
+  // withheld value back onto exactly what it was withheld from, so the merged
+  // config is the stored one and the read path withholds the same positions:
+  // no second walk is owed.
+  if (grafts.length === served.redactedPaths.length && sameValue(patch, served.config)) return graftAll(grafts);
+
+  // Otherwise keep only what the read path would STILL withhold where it
+  // lands. The judgment of a position can depend on its siblings — a pair's
+  // `value` is a credential only while a label names one — so a value carried
+  // under an edited sibling may land where the read path would serve it.
+  // Each pass re-grafts the survivors onto the untouched patch and drops every
+  // graft the merged config's redaction no longer withholds AT its landing
+  // path; the set only shrinks, so this settles within one pass per graft.
+  // Same loop as the `/meta` carry-forward's (#20590).
+  let kept = grafts;
+  for (;;) {
+    const out = graftAll(kept);
+    const withheld = new Set(redactDatasourceConfig(driver, out).redactedPaths.map(pathKey));
+    const next = kept.filter((graft) => withheld.has(pathKey(graft.landing)));
+    if (next.length === kept.length) return next.length === 0 ? patch : out;
+    kept = next;
+  }
 }
 
+/** A path as one comparable string (segments may hold any character, so JSON, not a join). */
+const pathKey = (path: readonly string[]): string => JSON.stringify(path);
+
 /** An array position, as the redactor spells it in a path (its decimal index). */
 const isIndex = (segment: string): boolean => /^(0|[1-9][0-9]*)$/.test(segment);