Docs-Sync #469: redactor fast-path row names a pass count and line anchors the restructure changed #476

PR: #469 — merged 2026-10-03

Affected doc surface: docs/performance-improvements.md (the fast-path row in the optimisation table, around line 1106).

• docs/performance-improvements.md — the redactor fast-path row describes "16 compiled Regex-Pässe" and anchors line numbers that the restructure moved. The row reads: "Fast-Path: vor den 16 compiled Regex-Pässen ein IndexOf-Probe gegen die Trigger-Substring-Liste", linking OutputRedactor.cs:98-105. That was accurate against the old Regex[] DefaultPatterns. After this PR the array is object[] DefaultPasses with 16 entries of which 14 are Regex and two are PemBlocks (hand-paired BEGIN/END marker regexes, introduced to replace the quadratic lazy-body PEM pattern) — so "16 compiled Regex-Pässe" no longer describes the structure, and the keyword probe itself moved to DefaultTriggerKeywords near line 340 with its use around line 364. The linked range L98-L105 now points into the middle of the pass array (the AWS/GitHub token patterns), not at the fast path. Not auto-applied — it needs a call on what this file is. docs/performance-improvements.md reads as a dated log of measured optimisation iterations, with each row anchored to the line numbers that were current when it was written; rewriting those figures and anchors would restate history rather than correct a live claim, and the same question applies to every other line-anchored row in the file (the fix is either "re-anchor this one row", "re-anchor the file", or "the file is a historical log and stays as written"). The structural claim it makes — that an ordinal IndexOf probe short-circuits ahead of the pass array — is still true either way. The substantive behaviour change from this PR (built-in passes no longer carry a wall-clock regex timeout, operator patterns under Logging:Redaction:Patterns still do and still fail open) is already documented: the PR updated docs/security-findings.md § M-4 itself, and the user-facing doc surfaces (CLAUDE.md, content/{de,en}/configuration/logging.md, content/{de,en}/security/overview.md) only claim redaction is "always active", which remains correct and is now strictly more so.

Automated docs-drift finding from the daily documentation-sync run — needs triage.

Generated by Claude Code