perf(test): normalize report secrets once per redaction

scripts/fba-core-regression-test-env.test.mjs

@@ -124,6 +124,17 @@ test('preflight failure creates summary but no HTTP fixture; existing run or act
   await assert.rejects(runFbaCore({...config(),runId:'next',outputDir:'reports/next'},{env:env(),outputRoot,readers:readers()}))
   assert.equal(readFileSync(lock,'utf8'),'occupied')
 })
+test('redaction scans the secret input once for the complete report tree',()=>{
+  let reads=0
+  const values=Array.from({length:80},()=> 'synthetic-private-value')
+  const secrets=new Proxy(values,{get(target,key,receiver){if(/^\d+$/.test(String(key)))reads++;return Reflect.get(target,key,receiver)}})
+  const report={steps:Array.from({length:40},()=>({message:'prefix synthetic-private-value suffix',nested:{token:'hidden',public:'kept'}}))}
+  const result=redactEvidence(report,secrets)
+  assert.ok(result.steps.every(row=>row.message==='prefix [REDACTED] suffix'&&row.nested.token==='[REDACTED]'&&row.nested.public==='kept'))
+  assert.equal(reads,values.length,'normalization must not repeat for every evidence string')
+  assert.equal(report.steps[0].message,'prefix synthetic-private-value suffix','input report is not modified')
+})
+
 test('reports redact dynamically created account secrets and environment/token values',()=>{
   const value=redactEvidence({password:'x',pdaToken:'y',message:'failure private-secret',nested:{gateway:'url',value:'safe'}},['private-secret'])
   assert.equal(value.password,'[REDACTED]');assert.equal(value.pdaToken,'[REDACTED]')