fix: filter out partial name substitutions from reveal pairs

The smart engine records individual name parts ("Ademo"→"John",
"Demo"→"Smith") AND the combined form ("Ademo Demo"→"John Smith")
in sessionSubstitutions. The catch-all in buildRevealPairs was
adding all of them, causing partial replacements that corrupted
the DOM and made the cache oscillate between 4 and 0 pairs.

Fix: skip session entries whose key is a substring of a longer
entry (e.g. "ademo" is part of "ademo demo"). Only the combined
form gets added as a reveal pair.

Also: remove debug logging, improve cache with size tracking.

https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT

src/content/content.js

@@ -1444,11 +1444,18 @@
     // Catch-all: add any session substitution not already covered above.
     // This picks up combined names ("Ademo Demo" → "John Smith"),
     // auto-detected PII, and auto-redacted secrets.
+    // Skip entries that are substrings of a longer entry (e.g. "Ademo"
+    // is part of "Ademo Demo") to prevent partial replacements.
+    const allKeys = [...sessionSubstitutions.keys()];
     for (const [key, entry] of sessionSubstitutions) {
-      if (!added.has(key)) {
-        pairs.push({ from: entry.replaced, to: entry.original });
-        added.add(key);
-      }
+      if (added.has(key)) continue;
+      // Skip if this entry's replaced value is a substring of a longer one
+      const isPartOfLonger = allKeys.some(k =>
+        k !== key && k.includes(key) && sessionSubstitutions.has(k)
+      );
+      if (isPartOfLonger) continue;
+      pairs.push({ from: entry.replaced, to: entry.original });
+      added.add(key);
     }
 
     pairs.sort((a, b) => b.from.length - a.from.length);
@@ -1458,6 +1465,7 @@
   // Cache — invalidate when identity/mappings change or new substitutions happen
   // Settings-only updates (e.g. reveal toggle) do NOT invalidate
   let _revealPairsCache = null;
+  let _lastSessionSubsSize = 0;
   window.addEventListener('message', (event) => {
     if (event.data?.type === 'ss:config-updated') {
       if (event.data.mappings || event.data.identity) _revealPairsCache = null;
@@ -1466,7 +1474,12 @@
   });
 
   function getRevealPairs() {
-    if (!_revealPairsCache) _revealPairsCache = buildRevealPairs();
+    // Rebuild if cache cleared OR if new substitutions were added
+    const currentSize = sessionSubstitutions.size;
+    if (!_revealPairsCache || currentSize !== _lastSessionSubsSize) {
+      _revealPairsCache = buildRevealPairs();
+      _lastSessionSubsSize = currentSize;
+    }
     return _revealPairsCache;
   }
 
@@ -1627,8 +1640,6 @@
 
   // Reveal ALL text on the page + apply highlights
   function revealAllResponses() {
-    const pairs = getRevealPairs();
-    console.log('[Silent Send] revealAllResponses — pairs:', pairs.length, pairs.map(p => `"${p.from}" → "${p.to}"`));
     revealInElement(document.body);
     highlightMatches(document.body);
   }

src/options/options.html

@@ -629,7 +629,7 @@
     </section>
 
     <footer>
-      <p>Silent Send v0.9.15</p>
+      <p>Silent Send v0.9.16</p>
       <p style="font-size:11px;color:#9ca3af;margin-top:6px;max-width:600px">
         Silent Send is a convenience tool, not a security guarantee. Third-party sites may change how they send data at any time, which can cause missed substitutions without warning. You are responsible for verifying your data before sending. See the <a href="https://github.com/outis1one/silent-send/blob/main/LICENSE" target="_blank" style="color:#6b7280">LICENSE</a> for full terms.
       </p>