[P0] Add a safe redacted diagnostic bundle and storage-risk gate

[deucebucket]

Problem

DeckDoc reports can contain usernames, paths, process/game names, network identifiers, device identifiers, and private journal text. Storage failures also require a stop-write boundary before normal collection makes the situation worse.

Shipped baseline — v3.4.0 / #28

All normal full-report, continuous-probe, remediation, and Rescue output now passes through a shared public-safe filter before DeckDoc writes it to persistent storage. There is no intentionally raw DeckDoc variant. The filter and minimized modules cover common credentials/tokens, email, user paths, hostname, URL/query data, IPv4/IPv6, MAC, UUID, Steam/account IDs, and exact 32-character identifiers. Adversarial fixtures enforce the current contract.

This intentionally supersedes the original raw/private-bundle proposal: DeckDoc should not create a more dangerous raw artifact merely because it is labeled local.

Remaining scope

Create a deterministic share-bundle pipeline that checks destination/storage risk before collection, records the evidence-access ledger, verifies archive contents, and requires a user review step.

Acceptance criteria

• Gate normal write-heavy collection on new media/I/O errors, forced read-only state, disappearing device, critical SMART, or dangerously low destination space.
• Never remount read-write, repair, format, trim, stress, or continue repeated writes after the gate trips.
• Filter common user/home paths, hostnames, SSID/BSSID/MAC/IP, serial-like fields, tokens, URLs/query data, and account identifiers before standard DeckDoc disk writes.
• Preserve required timestamps and subsystem relationships while adding a normalized access ledger and safe within-case correlation identifiers.
• Produce private archive permissions, checksum, contents list, redaction summary, access ledger, and an explicit “review before sharing” step.
• Do not retain an intentionally raw DeckDoc bundle; generate public-safe evidence from the start.
• Extend adversarial fixtures to Unicode paths, multiline journals, archives, symlinks, malformed upstream records, and low disk space.
• Never upload automatically.

Decision boundary

“Filtered before write” greatly reduces exposure but is not a mathematical guarantee. Upstream formats change, so every shareable report still requires review.

Source

docs/wiki/Collecting-and-Sharing-Evidence.md, docs/wiki/Storage-and-MicroSD-Problems.md, the research deep dive, and merged PR #28.