Joseph Doherty
47c0b646a9
GatewayLogRedactor.RedactCommandValue had no production caller. Its only one was GatewayLogRedactorAdapter on the abandoned feat/adopt-zb-telemetry-serilog branch; when that work was re-implemented on main as GatewayLogRedactorSeam the identity half was carried over and the command-value half was not. Four unit tests kept the policy green, so it read as wired while masking nothing. No live leak today — no log statement currently emits a CommandValue property — but the next one to do so would have written credential-bearing MXAccess payloads (AuthenticateUser, WriteSecured, WriteSecured2) to every sink in the clear, with passing tests suggesting otherwise. Ports the missing half onto the seam: a non-null CommandValue is masked via the existing policy, gated on CommandMethod. Value logging stays off — the seam exposes no opt-in — so ordinary values are masked too, matching RedactCommandValue's default. A null value stays null rather than becoming the placeholder, and the property is never invented when absent. Five tests added, three of which were red first on the leak itself (operator01:hunter2 reaching the assertion unmasked). The other two pin the null and absent guards. Identity redaction is untouched. Full NonWindows suite: 785 pass, 45 pre-existing macOS NamedPipe-harness failures unchanged from baseline (verified by stashing this change). Build 0 warnings.