Notes/Performance

Don't scan the whole database to classify PII

2026-03-18

A full table read to “find PII” will sit on a lock, blow a timeout, or both. TrustOS discovery decrypts connector credentials, plans chunks, samples values, then writes findings. Transient errors retry and then pause so an operator can resume. That is slower than a spinner that claims 100%, and it is the only version that can finish on a live store. Dry-run and simulated inventories are labelled. They must not show up as verification. If the UI treats a mock connector like a completed erasure, the certificate is fiction. The expensive work is classified inventory and evidence packs, not a single SELECT * with a regex.