v0.10.14 - three pipelines, three wins

Open Second Brain v0.10.14 - three small wins across indexer, redactor, digest

Three independent surface improvements ship together: the indexer now skips reading unchanged files via a stat-cache fastpath, the event-log redactor catches PEM private-key blocks and JWT-shaped tokens before they reach the search index, and brain_digest surfaces a connection-health metric so the operator sees whether the vault grows as a network of ideas or an organized graveyard. Each change touches a separate pipeline and is independently testable; the bundle is a release shape, not a coupling.

What ships

• Indexer fastpath in src/core/search/indexer.ts and src/core/search/store.ts. The indexer compares mtime and size against the stored DocumentSummary and skips the read + SHA256 step when both match. On a hash-match-but-stat-drift case it calls the new Store.touchDocument(relPath, mtime, size) to re-arm the fastpath for the next run.
• Broader secret redaction in src/core/event-log.ts. A state-machine pass replaces multi-line -----BEGIN ... PRIVATE KEY----- blocks (RSA, EC, DSA, OpenSSH, PGP, encrypted variants) with [REDACTED PRIVATE KEY]. A conservative JWT-shaped pass matches three base64url segments at least four characters each and replaces them with ***REDACTED_JWT_<last-4>, with no false-positive on semver-style versions like 1.2.3. Both passes compose with the existing SECRET_ASSIGNMENT_RE for KEY=VALUE.
• Connection-health metric in src/core/brain/digest.ts. The new DigestJsonConnectionHealth reports total_nodes, linked_nodes, orphan_nodes, mean_backlinks, median_backlinks, and link_density. It reuses the existing backlink index across preferences and retired entries, so the digest gains a vault-level health surface without an extra walk.

Process wins

• Indexing latency on large vaults drops because most files do not change between runs - mtime + size compare is several orders of magnitude cheaper than a full content hash.
• Pasted private keys and raw JWTs no longer leak into event logs or the search index. The two new passes are orthogonal to the existing KEY=VALUE rule, so coverage adds up rather than competing.
• Vault structural health is now visible in the same place as the rest of the digest. The metric calls out orphan ratio and mean backlink count, so a growing pile of disconnected notes shows up in the regular brief instead of hiding in the file tree.

Notes

• Bundle of three independent atomic features under one version. The CHANGELOG entry [0.10.14] has Added and Changed sub-sections; the commit history on main shows the implementation and the version bump as separate commits.
• All previously passing tests stay green (1875 / 0 fail, 4979 expects). Six new tests cover PEM block redaction (RSA, EC), standalone JWT masking, version-number false-positive guard, combined redaction order, and the fastpath touch-on-hash-match path.