Masking PII in production logs for a small language model is not optional. It is survival. Every request to your API, every streamed output, every debug trace could carry personally identifiable information: full names, addresses, phone numbers, government IDs, or chat history. If your logs hold it, you own the