#1651 Ripple redaction rewrites HTTP status-code runs as phone numbers, silently corrupting evidence

Summary

swamp issue ripple's automatic redaction rewrites runs of three-digit numbers as [REDACTED-PHONE], which silently corrupts the most common shape of evidence in an engineering issue: a sequence of HTTP status codes.

Reproduction

Posting a ripple on lab #1230 containing a before/after rate-limiting result:

HOPS=0 (default, today):  404 404 404 404 404 404 404 404
HOPS=1:                   404 404 404 404 404 429 429 429

The CLI reported Redacted 4 phone numbers, 1 IP address and posted:

HOPS=0 (default, today):  [REDACTED-PHONE] [REDACTED-PHONE] 404 404
HOPS=1:                   [REDACTED-PHONE] [REDACTED-PHONE] 429 429

Impact

This is worse than a cosmetic mangle, for three reasons.

1. It destroys the meaning while looking deliberate. The whole point of that block was the contrast between the two rows. The redacted version still reads as a plausible result table, so a reader has no signal that anything was removed — and both rows now end in the same two tokens, which inverts the conclusion.
2. It is not recoverable from the issue. The original text is gone; only the CLI's transient stdout held it. If the author does not read that output carefully, they never learn it happened.
3. It hits the highest-value content. Status-code runs, latency series, row counts, and byte sizes are exactly what a performance or security issue is made of, and any run of 3+ three-digit numbers separated by spaces is at risk.

A private pod address in a documentation example (10.244.1.5) was also redacted to [IP-1]. That one is defensible in isolation, but combined with the above it means measurement output generally cannot be pasted into a ripple as-is.

Suggested direction

Make the phone-number matcher require an actual phone shape rather than "three-digit groups separated by whitespace" — a leading +, parentheses, or hyphen/dot separators, and a total digit count in the 7–15 range. A bare run of space-separated three-digit numbers has no phone-number structure and should not match.

Failing that, at minimum:

• Don't redact inside fenced code blocks. That is where measurement output lives, and it is the least likely place for a real phone number.
• Make the change visible where it lands: the posted ripple could carry a footer noting that N redactions were applied, so a reader knows the content was altered rather than trusting a mangled table.

--no-redact exists and works (it is what the correction ripple used), but it only helps someone who already noticed the damage.

Environment

swamp CLI 20260206.200442.0-sha., posting to swamp-club.com. Found while rippling the #1230 proxy-trust work.