Diagnostic projection policy for analysis sessions whose results are private.

A session over private records may not forward evaluator-produced message text: that text can quote a captured record, and a host may route diagnostics somewhere the result itself never goes. It may still tell the operator what went wrong, because the fault often describes nothing but the operator's own submitted source — or, for a narrower class, nothing private that this evaluation itself captured.

Two admission rules apply, both rebuild-or-bound, never raw forward of untrusted evaluator prose outside their footing:

1. Source-derived structured detail (today :unbound_var). A message is rebuilt only when every name appears verbatim in the submitted source. Every other byte is a literal in this module.

2. Allowlisted compile/analyze kinds with no capability activity. Several of these kinds (:invalid_arity, :invalid_form, :unknown_tool, :private_tool_unauthorized) also have runtime constructors. Admission therefore requires details.capability_activity? == false — measured for this evaluation — and a byte/UTF-8 bound at this boundary. The allowlist names which kinds may be considered; the activity flag is the load-bearing gate. Messages are a function of the submitted source, prelude surface, and installed tool names, not of values read from private records.

details is evaluator output and is treated as untrusted: it selects among fixed shapes, it never carries provenance. Anything outside those rules collapses to redacted_message/0.