docs(adr): design 0016's four deferrals — array summarization, raw redaction, enhanced result object (0017-0019, Proposed)

[rejifald]

A design pass — ADRs only, no implementation — for the four items ADR 0016 deferred in its Future work / Out of scope. All three land as Status: Proposed.

What's here

Four deferred items → three ADRs (one merge):

ADR	Item(s)	Builds on
0017 — Array drift summarization in classifyDiff	Item 3	refines 0015 (merged, #331)
0018 — Opt-in redact option for .inspect()'s raw	Item 2	refines 0016 (#334)
0019 — Enhanced result object (.report()/RunReport) + source discriminator	Items 4 + 1	extends 0016 (#334)

The one merge: the source discriminator (item 1) folds into 0019. ADR 0016 guessed source belonged on the enhanced object; 0019 reverses that — source explains why raw is null, and raw lives on Inspection, so source lands on Inspection itself (it's free; the engine already knows the branch). The heavier diagnostics go on a separate RunReport<T> extends Inspection<T>.

Decisions, in brief

• 0017 — 0015's existing change|path dedup already collapses homogeneous array drift, but with a silent correctness gap: first-wins drops heterogeneous problems at the same [] path. Decision: group-then-summarize; homogeneity = identical detail string; homogeneous → "all N elements: …" + sample index; heterogeneous → one finding per distinct variant. One new optional DriftFinding.sample. diff.ts stays index-precise.
• 0018 — Per-call InspectOptions.redact, default off, reusing the existing secret-key denylist (isSecretKey, renamed from isSecretQueryKey) + a new redactSecretsDeep. Name-based only, scoped as a safe-sharing convenience, not a leak guarantee — which is exactly why it stays opt-in. No engine change.
• 0019 — source on Inspection; RunReport via .report() carrying attempts, timing, redacted config, cache. The plumbing audit is the heart: everything except per-attempt latency is derivable from the existing event spine, so v1 needs no new engine events. config echo is the redacted __config, never __rawConfig.

Numbering

Numbered 0017–0019 to dodge 0013/0014 (#328) and 0016 (#334), both in flight. Each carries the renumber-at-PR-time note, as 0015/0016 did.

Verification

Pre-commit hook clean: Prettier unchanged, full workspace typecheck passed (docs are Markdown only — no code touched).

🤖 Generated with Claude Code

[rejifald]

Superseding this in favour of three stacked implementation PRs that each carry their ADR flipped to Accepted (per the decision to land docs alongside code): 0017 (array drift summarization), 0018 (.inspect() raw redaction), 0019 (enhanced result object + source). Closing.