FL-1110 refactor: move PII redaction boundary to the consumer (D-33 amended) (!13) · Merge requests · SDKs / POS

Dmitry Popov requested to merge FL-1110 into main Jun 10, 2026

sdk/pos faithfully carries POS data; the consumer (ETL) decides when to strip PII.

pos.Reservation: +PhoneNumber (guest phone, PII) for consumer-side FL matching; +Redacted() clears it. Reservation is no longer auto-redacted on the read path.
sevenrooms mapEntity: carries PhoneNumber; builds RawPayload from a REDACTED copy so the audit blob stays PII-free (scalar fields). processEntities no longer calls redact().
tests: PIISurfaceIsOnlyPhoneNumber (only PhoneNumber allowed), CarriesPhone_RawPayloadRedacted.
README: PII boundary section rewritten (consumer-owned), API/data-flow/tests updated.

FL-1110 refactor: move PII redaction boundary to the consumer (D-33 amended)