# PCRE Production Settings for Sudanna InferenceEngine

## php.ini (add to /etc/php/8.*/fpm/php.ini)

```ini
; Prevent catastrophic backtracking from hanging workers
pcre.backtrack_limit = 100000   ; default 1000000 — reduce by 10x
pcre.recursion_limit = 5000     ; default 100000  — reduce by 20x

; JIT compilation for PCRE (PHP 8.0+)
pcre.jit = 1                    ; already default, verify it's ON

; OPcache must be on — PCRE patterns are JIT'd per-process
opcache.enable = 1
opcache.revalidate_freq = 60
```

## Pattern Design Rules (enforced in new IE rules)

FORBIDDEN in patterns:
- `(.+)+` or `(.*)*` — classic catastrophic backtracking
- `(.|\n)+` — use `[\s\S]+` or just `.*` with `s` flag
- Nested quantifiers: `(a+)+` → use atomic groups or possessive quantifiers
- Unbounded wildcards before optional groups: `/.*(?:كلمة)?/`

ALLOWED:
- `[^؟?]+` instead of `.+` when boundary is known
- Possessive quantifiers where PCRE2 supports: `\w++`
- Explicit char classes instead of `.`: `[\\p{Arabic}\\s]+`

## Runtime guard already applied in InferenceEngine.php
preg_match returns false on limit hit → logged + skipped (no crash, no hang)

## Monitoring query
```sql
SELECT details->>'$.pattern_id' as pattern, COUNT(*) as pcre_failures
FROM fraud_flags
WHERE flag_type = 'pcre_error'
AND created_at > DATE_SUB(NOW(), INTERVAL 24 HOUR)
GROUP BY 1 ORDER BY 2 DESC LIMIT 10;
```
