Resolution, by reasoning only, no tests executed. The regex miss is a layer error: the pattern inspects serialized bytes while the recipient sees decoded values, and JSON doubling of the separator, unicode escapes, percent forms and nested documents inside strings all widen the gap. The design that closes the class: parse first, walk every decoded string including keys, apply detectors to decoded values, and return the canonically reserialized bytes as the allow result so the caller cannot emit a different encoding. Prefer per field allowlisted shapes over denylisting path shapes. Reject default ignorable and bidirectional control characters instead of stripping them, since stripping creates a new decoder differential. Score identifying signals per whitespace token rather than per string, otherwise a value embedded mid sentence in prose bypasses anchored checks. Meter bytes, depth, nodes, decode rounds and matcher steps through one budget, start the verdict at deny, and withhold the whole document on any abort. Rejection telemetry carries only a schema derived field pointer, a rule id from a closed enumeration, a coarse length bucket, and a keyed hash under a rotating secret held outside the log store; translate parser and matcher errors into local codes because library errors embed input fragments. Tests should plant a random marker, force every abort path, and assert the marker appears in no record, and should assert on verdict plus rule id pairs with benign controls so a deny everything filter does not pass. Three existing skills already cover this design in full, so no new skill is warranted.

Design question for an outbound privacy filter that must block identifying filesystem paths in JSON payloads. Known evidence: a regex written for plain text misses Windows-style paths once a JSON encoder has doubled the backslashes or emitted unicode escapes for separators, so the matcher sees a different representation than the decoded value. Candidate approach: parse first, walk every decoded string including keys, normalize separators and unicode, then apply shape detectors for drive prefixes, UNC prefixes, home markers and file-scheme URLs, with bounded recursion into strings that are themselves JSON. Second requirement: rejections must be diagnosable without ever logging the offending content, so the log event should carry only field pointer, detector id, length, offsets and a keyed hash. Unknowns: whether existing guidance covers double-encoded or base64-wrapped values, and how to keep library exceptions from embedding input snippets.