"""Redaction engine — VENDORED from the CRM repo for behavioral parity.

`scrub.py` and `test_scrub_leak.py` in this directory are byte-for-byte copies of
the CRM's reference implementation, kept verbatim so re-syncing is a trivial `cp`
and a diff. Do NOT edit scrub.py here — change it in the CRM repo, re-vendor, and
re-run the leak test. The Spark Control *gateway* (server-held pseudonym map, TTL,
map_handle, local-Qwen NER backstop, the /scrub + /rehydrate HTTP contract) is
built AROUND this engine in app/redaction_gateway.py — the engine's detection
logic is never reimplemented.

Parity source: CRM backend/redaction/scrub.py
  sha256: 412c5fdf7006275a98fa427457293a43256165e97eebaee878c310c68cea054b
  (re-vendored after the upstream hardening pass: currency-only amounts with a
   word-boundary suffix, SWIFT/letter-prefixed-account Tier-1, NFKC+zero-width
   normalization, single-pass rehydrate, and the dictionary deleted_at fix.)
Acceptance: backend/redaction/test_scrub_leak.py — must pass against this copy.
"""