ADR-0012's producer-side projection: the transform that replaces values in a closed set of value positions with the reserved {"$redacted": true} sentinel while leaving every identity, counter, ordering, and structural field untouched.

project/2 is applied to a %StatifierUI.Trace.Message{} on the StatifierUI.Trace.Subscriber path, after StatifierUI.Trace.Normalizer has built the message and before it is buffered or fanned out to any listener. That placement is the record's central decision and the reason this is not a filter in StatifierUI.Trace.Json or in a consumer: every shipped consumer reads structs and never passes through the encoder, so a redaction placed at the encoder would be visible only to the golden tests.

The practical test the placement is chosen to pass: a projected stream may be buffered, rendered, encoded, written to disk, shipped to a log aggregator, or replayed months later without any of those having held a datamodel value.

Redaction replaces; it never omits

A redacted position carries %{"$redacted" => true}. It is never dropped, never nil, never %{}, and never %{"$undefined" => true}. Key absence, JSON null, and $undefined already mean specific things in this format, and every one of them is a claim about what the run did; $redacted is the format's only encoding for "a value was here and this stream is not carrying it," which is a claim about the stream rather than about the run.

The corollary that governs every clause below: a position is replaced only where it is already present. Nine of the sixteen key paths this module touches are conditionally absent, and writing a sentinel into one that was absent would assert something the run never did - an eventless round becoming evented (trace.transitions_selected's event), a first write acquiring a prior value (effect.datamodel_change's prior_value), or a host that supplied no fixtures acquiring a bundle (session.start's fixtures). replace_present/3 is the only way a value is written here.

The two allowlist shapes

Within projected mode the default is deny. A profile may allow specific values back, and the allowlist has two parts because the format's value positions divide cleanly in two.

Located positions - the datamodel - are allowlisted by path prefix, written as arrays of segments in the same encoding effect.datamodel_change's location_path already uses. The same prefixes apply to session.datamodel, whose keys are the first segment of every path.

Unlocated positions - payloads, which have no path - are allowlisted by naming the position, from the closed set positions/0 returns. Naming a position allows it wholesale, at every message that carries it. There is deliberately no per-key allowlist inside a payload: an event payload has no stable schema the way a datamodel location does.

Prefix matching, and the shallower-write rule

Three cases, and the third is the operator ruling of 2026-08-29 recorded on ADR-0012 (the accepted text settled only the first two):

• An allowed prefix matches the write's leading segments (the prefix is no longer than the write's path): the whole value is allowed through.
• No allowed prefix relates to the path at all: the whole value is redacted.
• An allowed prefix is longer than the write's path and extends it - the write is shallower than the prefix, so the written value contains both the allowed leaf and its withheld siblings. The projection descends into the value and redacts selectively, so the allowed leaf passes and every sibling is redacted. Allowing the whole write would leak a sibling the profile withheld; denying it would withhold a leaf the profile allowed.

Descent applies identically to session.datamodel's snapshot values. Where a value cannot be descended into because it is a scalar rather than a map or a list, the allowed leaf is unreachable and the value is redacted whole

• the safe direction.

What is never projected

Every identity, counter, and structural field: type, session, seq, macrostep, microstep, round, otel (a trace id and a span id are random identifiers carrying no chart vocabulary and nothing derived from a datamodel value - ADR-0013), state indexes, t_index, c_index, d_index, invokeid, send_id, state_index, invoke_index, every session.start table and every location object in them, configurations, exit and entry sequences, kind and type discriminators, owner and origin objects, event names, label on effect.log, src and invoke_type on effect.invoke, target and send_type on the send family, location_path and location_source on effect.datamodel_change, session.halted's reason (a closed three-value set), and effect.done's configuration.

location_path's integer segments are resolved index expressions, so a projected stream still reveals which array index a write landed on. ADR-0012 records that as an accepted residual: a consumer that cannot see the path cannot fold the write at all.

An event's error object (StatifierUI.Trace.Diagnostic.object/4) adds four more never-projected fields: kind, span, location, and location_kind. Only error.expression is chart text and is redacted with session.start's source under allow_source: false - it is not a new entry in positions/0, since the existing allow_source knob already governs chart text.

Not anonymization, not access control

Structure leaks. Which branch a run took, how many rounds a macrostep needed, which transition fired on which event - these imply things about the values that produced them. The guarantee is narrow and worth stating in those terms: no datamodel value crosses the producer boundary. Choosing the profile correctly per tenant is the host's job, and this format cannot check it.