M-1: redact()'s Content-Disposition cut computed its index against a
lowercased copy but sliced the original string — some Unicode characters
change length under toLowerCase(), which could let a fragment of
"Content-Disposition" survive the cut. Now uses a case-insensitive regex
matched directly against the original string.
T3.5: errorText() could itself throw on a pathological thrown value (a
null-prototype object with no toString/valueOf/Symbol.toPrimitive),
defeating transcribe()'s "never throws" guarantee in an already-caught
branch. Now wrapped defensively with a generic fallback message.
Also corrects two stale descriptions in design.md (classify/redact
signatures, and the post-promise rejection handling) so the archived
design document matches the shipped code.
Refs #5
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKHeGuAYh4W1jNdjMConZa
