Class QuarantineWriter

  • All Implemented Interfaces:

    
    public final class QuarantineWriter
    
                        

    Failed-row quarantine with redaction (HEL-236 scenario 6). Rejected rows are written under <prefix>/<runId>/ so audit evidence stays traceable to the run that produced it, and the columns the caller declares sensitive are REDACTED before any byte leaves the process: the stored value is sha256:<16 hex> — a stable fingerprint (equal values match across rows, supporting investigation) that cannot be reversed to the value.

    Security invariants: keys carry only runId + counters (never row data), the summary object carries counts + the caller's reason string (never values), and redaction is applied per WRITE — there is no unredacted code path.