test(provenance): restore two tests that the length floor had hollowed out

Greptile caught the byte-limit test: lengthening the catalog fixture without the
`recordResolved` value beside it left them mismatched, so the registry latched and
`projectResolvedSecretModelJsonContent` returned `{ safe: false }` at its
completeness guard — before any alias projection. The test passed while covering
nothing it is named for. It now records the same literal it catalogs, sizes the
limit between the raw bytes and the projected bytes, and asserts both directions
so a limit applied to the wrong side fails it.

Auditing every changed test for the same shape — a `recordResolved` value that
does not match its own catalog entry — found one more, pre-dating this branch: the
legacy-memory test drew its teeth from substituting the one-character secret `x`
inside `Box`, which the floor no longer substitutes, so it too had become vacuous.
Its fixture is now a full-length secret that appears in the message, which is what
makes "not projected" meaningful.

The three remaining mismatches are deliberate: those tests are about a resolution
that fails to verify.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/handlers/agent/memory.test.ts

@@ -465,11 +465,11 @@ describe('Memory', () => {
 
     it('does not project unrelated active secrets into legacy memory', async () => {
       const registry = new ResolvedSecretTraceRegistry([
-        { name: 'TOKEN', plaintext: 'x', encryptedValue: 'ciphertext' },
+        { name: 'TOKEN', plaintext: 'unrelated-secret', encryptedValue: 'ciphertext' },
       ])
-      registry.recordResolved('TOKEN', 'x')
+      expect(registry.recordResolved('TOKEN', 'unrelated-secret')).toBe(true)
       vi.spyOn(memoryService as any, 'fetchMemory').mockResolvedValueOnce({
-        messages: [{ role: 'assistant', content: 'Box' }],
+        messages: [{ role: 'assistant', content: 'Box unrelated-secret' }],
         provenance: { status: 'exact', entries: [] },
       })
 
@@ -478,7 +478,7 @@ describe('Memory', () => {
         inputs
       )
 
-      expect(messages).toEqual([{ role: 'assistant', content: 'Box' }])
+      expect(messages).toEqual([{ role: 'assistant', content: 'Box unrelated-secret' }])
     })
 
     it('does not activate provenance from a message dropped by the selected window', async () => {

apps/sim/executor/utils/resolved-secret-content-projection.test.ts

@@ -411,11 +411,22 @@ describe('projectResolvedSecretModelJsonContent', () => {
 
   it('enforces the byte limit after secret aliases are projected', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'X', plaintext: 'xxxxxxxx', encryptedValue: 'ciphertext' },
+      { name: 'X_LONGER_NAME', plaintext: 'xxxxxxxx', encryptedValue: 'ciphertext' },
     ])
-    registry.recordResolved('X', 'x')
-
-    expect(projectResolvedSecretModelJsonContent({ a: 'x' }, registry, 9)).toEqual({ safe: false })
+    expect(registry.recordResolved('X_LONGER_NAME', 'xxxxxxxx')).toBe(true)
+
+    /**
+     * `{"a":"xxxxxxxx"}` is 16 bytes and fits; projecting it to
+     * `{"a":"{{X_LONGER_NAME}}"}` takes it to 25. The limit has to be applied to the projected
+     * bytes, so the first call must fail and the second must not.
+     */
+    expect(projectResolvedSecretModelJsonContent({ a: 'xxxxxxxx' }, registry, 16)).toEqual({
+      safe: false,
+    })
+    expect(projectResolvedSecretModelJsonContent({ a: 'xxxxxxxx' }, registry, 25)).toEqual({
+      safe: true,
+      value: { a: '{{X_LONGER_NAME}}' },
+    })
   })
 })