@@ -53,8 +53,17 @@ class LogRedaction:
     # each would each proceed inside their own - the exact interleaving it exists to prevent. A
     # class attribute is therefore shared by every instance, which is sound because all it guards
     # is the atomicity of one instance's "read sentinel, build, store"; making that atomic
-    # process-wide is strictly stronger than making it per-instance, and it is only ever held for
-    # the duration of a rebuild, which happens on a config change rather than per log line.
+    # process-wide is strictly stronger than making it per-instance.
+    #
+    # It is acquired on every _log_secret_pattern() call, so on every log line, and held across
+    # the fingerprint check - a handful of identity and len() reads - on the warm path; only a
+    # rebuild holds it for longer, and rebuilds happen on a config change. Sharing it does mean a
+    # rebuild on one instance briefly blocks log() on every other instance of the class, which
+    # the single-engine production case never notices but a test process holding several engines
+    # could (#5171 review). Nothing reached under the lock logs - collect_log_secret_values() and
+    # compile_log_secret_pattern() are pure helpers in utils.py - so there is no re-entrant path
+    # back into log() to deadlock a non-reentrant Lock, which is what makes sharing it safe
+    # rather than merely cheap.
     _log_secret_pattern_lock = threading.Lock()
 
     def _invalidate_log_secret_pattern(self):
@@ -78,6 +87,17 @@ def _log_secret_fingerprint(self):
         web.py's batch editor does via clear()/update() and web_chat.py does by assigning a new
         block.
 
+        The mappings themselves are held here, not their id(): a stored id() is only an integer,
+        so once the mapping it was taken from is freed CPython is free to hand that same address
+        to the next allocation, and a rebind to a same-length dict landing there would produce a
+        fingerprint equal to the stored one - skipping the rebuild and leaving a just-configured
+        credential unredacted until the next explicit invalidation (#5171 review). Holding the
+        objects means an address recorded in a live fingerprint cannot be recycled while it is
+        still recorded, at the cost of keeping a superseded args/secrets mapping reachable until
+        the next rebuild. They are compared by _log_secret_fingerprint_matches() rather than ==,
+        because == on two dicts is an O(number of values) comparison that would also report two
+        distinct-but-equal mappings as unchanged - identity is the question being asked.
+
         An in-place edit of an existing key that keeps the size the same is NOT caught here, so
         the explicit _invalidate_log_secret_pattern() call sites remain load-bearing. This is a
         safety net under them, not a replacement: with it, a missed or mis-ordered call site
@@ -88,7 +108,20 @@ def _log_secret_fingerprint(self):
         """
         args = getattr(self, "args", None)
         secrets = getattr(self, "secrets", None)
-        return (id(args), len(args) if isinstance(args, dict) else -1, id(secrets), len(secrets) if isinstance(secrets, dict) else -1)
+        return (args, len(args) if isinstance(args, dict) else -1, secrets, len(secrets) if isinstance(secrets, dict) else -1)
+
+    @staticmethod
+    def _log_secret_fingerprint_matches(left, right):
+        """
+        Whether two fingerprints from _log_secret_fingerprint() describe the same args/secrets.
+
+        The mapping halves are compared with `is` and only their sizes with ==, so a rebind to an
+        equal-but-distinct mapping counts as a change (a rebuild) rather than a match. `right` is
+        None before the first build, which never matches a real fingerprint.
+        """
+        if left is None or right is None:
+            return left is right
+        return left[0] is right[0] and left[1] == right[1] and left[2] is right[2] and left[3] == right[3]
 
     def _log_secret_pattern(self):
         """
@@ -111,7 +144,7 @@ def _log_secret_pattern(self):
         """
         with self._log_secret_pattern_lock:
             fingerprint = self._log_secret_fingerprint()
-            if self._log_secret_pattern_cache is self._LOG_SECRET_PATTERN_UNSET or fingerprint != self._log_secret_pattern_fingerprint:
+            if self._log_secret_pattern_cache is self._LOG_SECRET_PATTERN_UNSET or not self._log_secret_fingerprint_matches(fingerprint, self._log_secret_pattern_fingerprint):
                 args = getattr(self, "args", None)
                 redact_strings = args.get("redact_strings") if args else None
                 redact_strings_labelled = args.get("redact_strings_labelled") if args else None
 
@@ -902,6 +902,13 @@ def __init__(self):
     except AttributeError as error:
         print("ERROR: redaction needed state that only Hass.__init__ establishes: {}".format(error))
         failed = True
+    except Exception as error:
+        # Not just AttributeError: log() has other ways to fail on an engine that skipped
+        # Hass.__init__ (a TypeError from an unexpected mixin-state shape, predbat_log_count()),
+        # and letting one escape would abort the whole suite run instead of reporting a failed
+        # test like every other case here (#5171 review).
+        print("ERROR: logging on an engine that skipped Hass.__init__ raised {}: {}".format(type(error).__name__, error))
+        failed = True
     else:
         content = engine.logfile.getvalue()
         if "OVERLAY-SECRET-VALUE-5169" in content:
@@ -948,6 +955,129 @@ def __init__(self, args):
     return failed
 
 
+def test_log_secret_pattern_cache_is_reused():
+    """A second _log_secret_pattern() call must return the cached pattern without rebuilding it.
+
+    The rest of this suite asserts the cold path (a build happens), the invalidation call sites and
+    the fingerprint safety net, but nothing counted rebuilds - so a regression that recomputed the
+    value set and recompiled the regex on every log line, which is the one thing the cache exists
+    to avoid on log()'s hot path, would have passed the whole suite silently (#5171 review).
+    """
+    print("**** Testing the log redaction pattern is cached across calls ****")
+    failed = False
+
+    # Patched in log_secrets.py's namespace, where _log_secret_pattern() looks the name up, for the
+    # same reason as test_log_secret_pattern_build_is_not_racy().
+    import log_secrets as log_secrets_module
+    from log_secrets import LogRedaction
+
+    class CountingRedactor(LogRedaction):
+        """A mixin-only object, so a shared engine's own logging cannot disturb the build count."""
+
+        def __init__(self, args):
+            """Hold the args the redaction pattern is built from."""
+            self.args = args
+
+    saved_collect = log_secrets_module.collect_log_secret_values
+    builds = []
+
+    def counting_collect(*args, **kwargs):
+        """Count each rebuild on the way through to the real collector."""
+        builds.append(1)
+        return saved_collect(*args, **kwargs)
+
+    try:
+        log_secrets_module.collect_log_secret_values = counting_collect
+        redactor = CountingRedactor({"api_key": "CACHE-REUSE-SECRET-5171"})
+
+        first = redactor._log_secret_pattern()
+        if len(builds) != 1:
+            print("ERROR: the first call made {} builds, expected exactly 1".format(len(builds)))
+            failed = True
+
+        stored_fingerprint = redactor._log_secret_pattern_fingerprint
+        second = redactor._log_secret_pattern()
+        if len(builds) != 1:
+            print("ERROR: a second call rebuilt the pattern instead of returning the cached one - {} builds".format(len(builds)))
+            failed = True
+        if second is not first:
+            print("ERROR: a second call returned a different pattern object from the one it cached")
+            failed = True
+        if redactor._log_secret_pattern_fingerprint is not stored_fingerprint:
+            print("ERROR: a cache hit replaced the stored fingerprint, so it did not take the cached path")
+            failed = True
+
+        # A cache that can never be rebuilt would satisfy everything above just as well as a
+        # correct one, so confirm the counter still moves when it is supposed to.
+        redactor._invalidate_log_secret_pattern()
+        redactor._log_secret_pattern()
+        if len(builds) != 2:
+            print("ERROR: the pattern was not rebuilt after an invalidation - {} builds".format(len(builds)))
+            failed = True
+    finally:
+        log_secrets_module.collect_log_secret_values = saved_collect
+
+    if not failed:
+        print("**** test_log_secret_pattern_cache_is_reused PASSED ****")
+    return failed
+
+
+def test_log_secret_fingerprint_is_not_fooled_by_address_reuse():
+    """Rebinding args to a mapping that could land on the freed one's address must still rebuild.
+
+    The fingerprint is the safety net under the explicit invalidation call sites, so a false
+    "unchanged" verdict there is a leak rather than mere staleness: the rebuild is skipped and a
+    just-configured credential stays in plaintext until something else invalidates the cache.
+    Recording id(args) permitted exactly that - the id is only an integer, so CPython may hand the
+    freed mapping's address to the next allocation and a same-length replacement landing there
+    compares equal (#5171 review). The fingerprint holds the mappings themselves, which is what
+    keeps an address it recorded from being recycled while it is still recorded.
+    """
+    print("**** Testing the redaction fingerprint is not fooled by a recycled mapping address ****")
+    failed = False
+
+    import gc
+    from utils import redact_log_line
+    from log_secrets import LogRedaction
+
+    class BareRedactor(LogRedaction):
+        """An object carrying args and the redaction mixin, and nothing else."""
+
+        def __init__(self, args):
+            """Hold the args the redaction pattern is built from."""
+            self.args = args
+
+    redactor = BareRedactor({"api_key": "FIRST-ADDRESS-SECRET-5171"})
+    if "FIRST-ADDRESS-SECRET-5171" in redact_log_line("Info: using FIRST-ADDRESS-SECRET-5171", redactor._log_secret_pattern()):
+        print("ERROR: the first pattern did not redact the args it was built from")
+        failed = True
+
+    # Rebind args and keep hold of the superseded mapping only through this local, so what the
+    # stored fingerprint retains is the question. Asserted by referrer rather than by trying to
+    # provoke a real address collision: whether CPython actually hands the freed address to the
+    # next allocation depends on the allocator's pool state, so a probe that allocates same-shaped
+    # dicts and looks for the old address passes with or without the fix and proves nothing. The
+    # property that rules the collision out is that the recorded address still belongs to a live
+    # object, which is exactly "the fingerprint refers to the mapping".
+    superseded_args = redactor.args
+    redactor.args = {"api_key": "SECOND-ADDRESS-SECRET-5171"}
+    gc.collect()
+
+    stored_fingerprint = redactor._log_secret_pattern_fingerprint
+    if not any(referrer is stored_fingerprint for referrer in gc.get_referrers(superseded_args)):
+        print("ERROR: the stored fingerprint does not refer to the mapping it describes, so that mapping can be freed and its address handed to a same-length replacement - which would compare as unchanged and skip the rebuild")
+        failed = True
+
+    second_line = redact_log_line("Info: using SECOND-ADDRESS-SECRET-5171", redactor._log_secret_pattern())
+    if "SECOND-ADDRESS-SECRET-5171" in second_line or "<api_key>" not in second_line:
+        print("ERROR: rebinding args to a same-length mapping did not rebuild the pattern: {}".format(second_line))
+        failed = True
+
+    if not failed:
+        print("**** test_log_secret_fingerprint_is_not_fooled_by_address_reuse PASSED ****")
+    return failed
+
+
 def test_resolve_arg_re_masks_secret_arg_matches(my_predbat):
     """
     resolve_arg_re() logs the entity id it matched before auto_config()'s caller has invalidated
@@ -1004,6 +1134,8 @@ def run_secrets_tests(my_predbat=None):
     failed |= test_log_redaction_survives_a_missed_invalidation(my_predbat)
     failed |= test_auto_config_invalidates_log_secret_cache(my_predbat)
     failed |= test_log_redaction_mixin_needs_no_init()
+    failed |= test_log_secret_pattern_cache_is_reused()
+    failed |= test_log_secret_fingerprint_is_not_fooled_by_address_reuse()
     failed |= test_log_secret_pattern_build_is_not_racy(my_predbat)
     failed |= test_resolve_arg_re_masks_secret_arg_matches(my_predbat)
     return failed