Reuse parsed sensitivity paths

internal/engine/secret.go

@@ -83,6 +83,20 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 }
 
 func addSecretPath(paths map[string]Path, pointer string) {
+	if existing, found := paths[pointer]; found && existing.valid() {
+		// Accumulator keys already match their paths' canonical spelling. History
+		// can install typed segments, which still need the parsed replacement.
+		parsed := true
+		for _, segment := range existing.segments {
+			if segment.kind != pathSegmentParsed {
+				parsed = false
+				break
+			}
+		}
+		if parsed {
+			return
+		}
+	}
 	if path, err := ParsePath(pointer); err == nil {
 		paths[pointer] = path
 	}