fix(acceptance): keep safe fleet metadata clear of sensitive report fields

scripts/admin-test-env-modules/fleet-handover-acceptance-contract.test.mjs

@@ -210,7 +210,8 @@ test('missing persistence and failed pre-send checkpoints cannot send HTTP', asy
     assert.ok(blocked)
     assert.ok(!f.calls.some(row => row.method === blocked.method && row.path === blocked.path))
     if (target === 'multipart') {
-      assert.match(blocked.file.sha256, /^[a-f0-9]{64}$/); assert.ok(blocked.file.bytes > 0)
+      assert.match(blocked.file.sha256, /^[a-f0-9]{64}$/); assert.ok(blocked.file.sizeBytes > 0)
+      assert.equal(Object.hasOwn(blocked.file, 'bytes'), false)
       assert.equal(blocked.file.content, undefined)
     }
   }

scripts/admin-test-env-modules/fleet-handover-acceptance.mjs

@@ -38,7 +38,7 @@ function io(context, module, proof) {
   }
   async function request(method, path, body, label, { token, conflict, file } = {}) {
     const entry = { method, path, label, actor: token ? 'PDA' : 'PLATFORM', body: clone(body), status: 'SENDING' }
-    if (file) entry.file = { name: file.name, type: file.type, sha256: createHash('sha256').update(file.content).digest('hex'), bytes: file.content.length }
+    if (file) entry.file = { name: file.name, type: file.type, sha256: createHash('sha256').update(file.content).digest('hex'), sizeBytes: file.content.length }
     proof.requests.push(entry)
     // A failed write must stop before HTTP. Keep the durable SENDING record if the process dies in flight.
     await checkpoint(proof)

scripts/admin-test-env-modules/fleet-return-redispatch-acceptance-contract.test.mjs

@@ -117,6 +117,9 @@ test('fresh return/redispatch chain proves A pending, B complete, then A complet
   assert.equal(result.afterRedispatch.departed.shippedPackages, 2)
   assert.ok(!JSON.stringify(f.checkpoints).includes('private-pda-token'))
   assert.ok(f.checkpoints.some(row => row.requests.at(-1)?.status === 'SENDING' && row.requests.at(-1)?.file?.sha256))
+  const uploads = f.trip.returnRedispatch.requests.filter(row => row.file)
+  assert.ok(uploads.length > 0)
+  assert.ok(uploads.every(row => Number.isSafeInteger(row.file.sizeBytes) && row.file.sizeBytes > 0 && !Object.hasOwn(row.file, 'bytes')))
 })
 
 for (const missing of [false, true]) test(`unapproved or missing pre-signature gate cannot sign or close new trip; missing=${missing}`, async () => {

scripts/admin-test-env-modules/fleet-return-redispatch-acceptance.mjs

@@ -51,7 +51,7 @@ export async function verifyFleetReturnRedispatch(context, module, trip, input,
   io.assert = (...args) => { context.assert(...args); if (!args[3]) throw Error(args[1]) }
   async function invoke(method, path, body, token, file, options) {
     const entry = { method, path, body: copy(body), actor: token ? 'PDA' : 'PLATFORM', status: 'SENDING' }
-    if (file) entry.file = { name: file.name, type: file.type, bytes: file.content.byteLength, sha256: createHash('sha256').update(file.content).digest('hex') }
+    if (file) entry.file = { name: file.name, type: file.type, sizeBytes: file.content.byteLength, sha256: createHash('sha256').update(file.content).digest('hex') }
     proof.requests.push(entry); await context.checkpoint()
     try {
       const response = file ? await context.requestMultipart(method, path, file) : await context.request(method, path, body, token, options)