Optional ReadonlypersonalUser-entered or identifying fields the SDK names on its wire — a
device's display name, an account holder's name, a postal address —
in any casing. Blanked exactly like a credential wherever they ride
(request and response bodies, headers, params, URL queries, the
thrown HttpError snapshot). The core knows no wire's field names,
so this tier is EMPTY unless the SDK fills it, and the credential
tier never depends on it: an SDK passing none redacts exactly what
it did before.
The second vocabulary tier createRedaction accepts, declared APART from the credential keys because it answers a different rule: a credential must never reach a log because it opens an account; a personal-data field must never reach one because the user typed it, and a diagnostic report pasted into a public issue reproduces it.