nx_redact_lib.nx

nx_redact_lib.nx -- REDACTION COMPLETENESS verifier for e-discovery production. Deterministic, byte-exact. The content-level companion to nx_ediscovery (which is the ALLOW-LIST: only affirmatively-reviewed, responsive documents may be produced). This is the other half: even a responsive document must have its sensitive content redacted before it leaves the door. Where mainstream PII tools FLAG a hit for a human to eyeball, this is FAIL-CLOSED -- a document is not producible while any detectable SSN or privilege marker remains, full stop. Deterministic byte scanning, no LLM, no probability. The SSN detector is PRECISE, not greedy: it matches ddd-dd-dddd only at a real number boundary, so it does NOT false-fire on a wrong grouping (dd-dd-dddd) or on an SSN-shaped run embedded in a longer digit string (over-blocking a clean doc is safe but annoying; the boundary checks keep it honest). Missing a real SSN (a false NEGATIVE) is the dangerous case and is what the byte-exact pattern forecloses. SCALE ENVELOPE (declared): substring is naive O(len*needle); KMP is the speed rung for large productions. license_tier: ORIGINAL No hw writes (Rule 26). LIB.