redact-counterparty-payloads-completely

Use a structural recursion like stripKeyInPlace that walks arrays and objects and deletes the key at every depth, since a flat delete payload[path] only strips top-level keys. The provided stripInternalInPlace.ts mirrors the existing coarsenGeoInPlace geo-redaction pattern.

redactEvent deletes only top-level payload keys, but gl_map lives inside lines[] array elements, so a flat entry like ["gl_map"] is a no-op. You need both a top-level entry for division and a nested walk for gl_map.

Yes. Any authed route a counterparty role can reach must branch its response by session lens, returning a re-mapped shape like portalPricedResponse that keeps only gate results and never internal economics such as floors or versions.

Build a maximal payload per counterparty/public kind planting each internal field top-level and inside every array, run redactEvent with scope party, and assert the serialized payload contains none of the internal field names. Call redactEvent directly so empty party_refs cannot make the test vacuous.

Kinds whose default visibility is internal, such as credit.checked, split.computed, or agent.acted, never leave the tenant lens, so redaction is moot for them. The completeness matrix only covers kinds resolving to counterparty or public.