Letting an enabled detector survive an overlapping match

Selection order changed the result#

More than one detector can recognize the same sensitive span. A provider-specific pattern may compete with a more general credential pattern, and the overlap resolver selects a winner using the candidate score.

If disabled groups are filtered only after that competition, a disabled high-priority candidate can discard the enabled fallback. Removing the winner afterward leaves neither candidate available to replace the value. The failure comes from operation order, not from both detectors missing the text.

Apply eligibility before competition#

Redactor now removes candidates from disabled groups before overlap resolution. Only eligible candidates compete, so a broader enabled detector can still select the span when the provider-specific group is switched off.

Confidence filtering follows overlap selection. Manual phrases are handled explicitly: they remain eligible even when automatic groups are disabled and bypass the ordinary confidence threshold. The focused test definitions cover the disabled-group collision and manual-redaction behavior.

Preserve the rest of the replacement contract#

The correction changes which candidate reaches replacement, not how the document is rebuilt. Placeholders are still allocated per call, repeated values remain consistent within the result, and accepted UTF-16 spans are replaced from right to left.

The dated July audit records the correction and 57 passing core tests. That is historical evidence, not a fresh run or a detection benchmark. It supports this specific ordering fix without establishing that every credential format will be recognized.