L03-13j — Decide the redaction surface (decision gate) #241

Outcome

A recorded decision on whether and how redaction ships in Quick, with the contract it needs.

Parent and boundary

Parent: #231. Owner: LoopEditor. This issue owns one bounded slice of Quick Workspace; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Grounding

• docs/product-surface.json marks redact-plugin OPEN with target loop-fix; its follow_up_issue 66 is a legacy number that now opens L08-06.
• PdfTool has a redact command; docs/BUG_HUNT_2026-08-04.md finding L09 — Intake module gate #10 covers its incremental-save detector.

Acceptance

• An ADR records ship / CLI-only / stop-shipping, with the value case and the risk of incomplete redaction.
• If it ships, the ADR names the governed operation, the verification that removed content is gone from the bytes, and the follow-up implementation issue.
• docs/product-surface.json disposition and follow_up_issue are updated to match.

Required proof

The merged ADR and the updated product-surface row. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap · Gap review of docs/loop-shell-actions.json against Quick command handlers, 2026-10-06.