Harden audit durability and diagnostic redaction

Persist fallback audit targets before use and fail upload starts or active-batch additions closed when the plan cannot be recorded. Keep lifecycle audits out of session and debug logs, expose diagnostics through opaque metadata, localize audit failures, and redact paths plus complete credential values without corrupting benign text.

lib/diagnostics-collectors.js

@@ -79,10 +79,10 @@ function createCollectors(deps) {
         readableNames.add(path.basename(fp));
         try {
           const st = fs.statSync(fp);
-          variants.push({ backup, sizeBytes: st.size, mtime: st.mtime.toISOString() });
+          variants.push({ id: backup === 0 ? name : `${name}:${backup}`, backup, fileName: path.basename(fp), sizeBytes: st.size, mtime: st.mtime.toISOString() });
         } catch {}
       }
-      files.push({ name, path: base, readable: true, present: variants.length > 0, variants });
+      files.push({ id: name, name, fileName: path.basename(base), readable: true, present: variants.length > 0, variants });
     }
     let siblings = [];
     try {
@@ -95,16 +95,16 @@ function createCollectors(deps) {
         return { name: f, readable: false, sizeBytes: size, mtime };
       });
     } catch {}
-    return { dir, files, otherLogs: siblings };
+    return { files, otherLogs: siblings };
   }
 
   function readLog(args) {
     const a = args || {};
     const name = a.name;
     const p = _resolveLogPath(name, a.backup);
-    if (!p) return { ok: false, error: `unknown or non-readable log: ${name}` };
+    if (!p) return { ok: false, error: 'unknown or non-readable log identifier' };
     const tailKb = Math.min(Math.max(Number(a.tailKb) || 256, 1), 1024);
-    const raw = support.collectFile(p, name, tailKb * 1024);
+    const raw = support.collectFile(p, name, tailKb * 1024, { includePath: false });
     let content = support.redactLogText(raw, _secrets());
     let matchedLines;
     if (a.grep && typeof a.grep === 'string' && a.grep.length <= 200) {
@@ -120,7 +120,7 @@ function createCollectors(deps) {
     }
     let sizeBytes = null;
     try { sizeBytes = fs.statSync(p).size; } catch {}
-    return { name, path: p, sizeBytes, returnedBytes: Buffer.byteLength(content), tailKb, matchedLines, content };
+    return { id: name, name, fileName: path.basename(p), sizeBytes, returnedBytes: Buffer.byteLength(content), tailKb, matchedLines, content };
   }
 
   function getAppEvents(args) {