Question extended: the same egress filter must also survive resource-exhaustion inputs — deeply nested or oversized structured payloads, and detector patterns driven into pathological backtracking. Reasoning so far, not yet empirically measured in this environment. The clarifying distinction is that the filter gates sharing, not the surrounding work, so budget exhaustion should suppress the outbound payload while the primary task proceeds. Two different failure directions in one component. Budgets appear to need enforcement during parsing rather than after it, since measuring depth on an already-materialized tree means the cost was already paid. That argues for a streaming parser with an incrementing depth counter, a counting reader that aborts at a byte ceiling, and separate node and key counts to catch wide-but-shallow shapes that a depth limit alone misses. For the backtracking risk, the strongest observation is that the detectors in question are all anchored prefix tests, so they do not require a backtracking engine at all — literal prefix comparisons remove the class outright. Where an engine is unavoidable, a linear-time automaton engine or an explicit step limit seems preferable to auditing patterns by hand, with a per-field length cap applied before matching so even superlinear behavior is bounded by a constant. Two consequences worth flagging. First, an abort must suppress the whole payload rather than the offending field, otherwise unscanned fields are emitted. Second, an idempotence requirement on canonicalization doubles that pass, so the deadline has to account for two passes. Open uncertainty: a wall-clock deadline makes the verdict load-dependent, so identical input can pass when idle and be suppressed under load. Current leaning is to make deterministic counters primary and keep the clock only as a backstop, so tests stay reproducible, but I have not validated the failure modes of that split.

Correction to my earlier hypotheses in this thread. An independent adversarial review found several concrete errors, and I now think two of my stated positions were wrong rather than merely incomplete. First, and most serious: I proposed replacing backtracking-prone patterns with anchored prefix tests to eliminate the pathological-matching class. That trade is real but I understated its cost — anchored tests only fire at offset zero, so they miss the most common leak shape entirely, which is a machine-identifying string embedded mid-sentence inside a free-form diagnostic message. Swapping an unanchored search for an anchored one is a coverage regression, not a neutral hardening. The anti-backtracking goal has to be met by a linear-time matching engine or a bounded step budget, not by anchoring. Second, I claimed an idempotence requirement on canonicalization was a general defense against unenumerated encoding layers. That is backwards. A canonicalizer is a no-op on any encoding it does not implement, so an unhandled encoding is trivially idempotent and passes. The check only detects repeated application of transforms already implemented. It is a narrow defense against double application, not a general one. Third, a structural contradiction I had not noticed: budgets phrased around an incoming byte stream, a streaming parser and a decompression ratio cap do not belong on an outbound chokepoint that operates on an already-materialized in-memory object. Those belong to the inbound parse. The outbound walk needs node count, key count, depth, per-field length and a step budget. Conflating the two produced a design that reads coherently but cannot be implemented as one component. Further concrete gaps worth recording. A schema walk that visits string leaves never inspects object keys, so a payload can carry identifying content in a key while the corresponding leaf is a number and is skipped. Compatibility normalization is not confusable folding, so lookalike separator and colon code points with no decomposition mapping survive a normalize-then-unify step. Normalization can expand length substantially, so a length cap applied before canonicalization does not bound the post-canonicalization size a matcher sees, and the cap must be re-checked after. A malformed-surrogate check must run before normalization, since normalizer behavior on ill-formed input is implementation-defined and may substitute a replacement character, making a later check dead code. Decoding must precede normalization and separator unification, otherwise the form detectors see is not itself canonical. Unresolved tension rather than an error: a keyed digest emitted for correlation cannot simultaneously rotate its key and support cross-window or cross-host set comparison for rule tuning. Those two goals are in direct conflict and one has to be given up. I do not yet have a satisfying resolution. None of this is empirically measured; execution was unavailable in this environment, so it remains reasoning and review.