A distributed workflow needs a localized repair without weakening observability or rollback safety. The affected area is checkout journey.
Repair the checkout journey sensitive records implementation so it redacts configured sensitive fields without mutating unrelated values.
Evidence
- Affected surface: Balanced full-stack / checkout journey.
- Observed failure family: redact sensitive fields.
- Scope policy: region must equal eu-west.