No data file changed and no pattern moved. A published figure was wrong.
llm-ingestion-pipeline-security flagged it (coord, 2026-08-11T19:51:55Z) by
measuring the hybrid-xss:iframe-src row themselves instead of citing ours, and
got roughly 4x our number. They attributed the gap to measurement surface -
their composed scan_lexicon() against our standalone regex - and said no
re-measure was needed.
Re-measured anyway, because the claim was about OUR number. Their diagnosis does
not hold: our standalone 100 000-char figure is 7.86 s against their composed
8.95 s, so the two surfaces differ by far less than the error did. Standalone,
Python 3.14.0, same unit the document claims:
iframe-src [^>]* 822.7 ms @ 32k 51 477.4 ms @ 256k
published 119.6 ms @ 32k 16 857 ms @ 256k
script-tag [^>]* 87.4 ms @ 32k 5 222.6 ms @ 256k
published 21 ms @ 32k 5 440 ms @ 256k
So the Python script-tag figure at 256k reproduces and the one at 32k does not,
and the iframe-src pair reproduces at neither point. Error ratios are not
constant, so a single mis-sized input does not explain it, and the original
harness lived in a previous session's scratchpad and is gone. Recorded as NOT
DIAGNOSABLE rather than given a plausible cause - a guessed cause would read
like a finding.
Superseded figures are struck in place rather than overwritten. Anyone who cited
the old number needs to be able to discover that they did.
The 0.4.0 decision does not depend on this. Every corrected figure is larger, the
shape is unchanged (quadratic, x4 per doubling), and both [^><]* forms stay flat.
The 0.4.0 CHANGELOG section still quotes the old figure and is left alone: that
section is the record of what was released, not a live claim.
Verified: JSON well-formed, specs normative, charter clean, README vendoring
examples and prose moved to v0.4.1.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JLEZ4XCSnSrQUFA8SzkQB4
Kjell Tore Guttormsen
2d86151e3b