Redact credentials throughout publication recovery displays

recovery_test.go

@@ -5,11 +5,25 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	releasekit "go.maximumdirect.net/releasekit"
 )
 
+func TestRecoveryFacadeRedactsSelectedPathAndRetainsRawCause(t *testing.T) {
+	path := "https://audit-user:audit-secret@example.invalid/attempt.json"
+	_, err := releasekit.LoadPublicationEvidence(path)
+	var recovery *releasekit.PublicationRecoveryError
+	var pathErr *os.PathError
+	if !errors.As(err, &recovery) || recovery.RecordPath != path || !errors.As(err, &pathErr) || pathErr.Path != path {
+		t.Fatalf("raw diagnostic context lost: %v", err)
+	}
+	if strings.Contains(err.Error(), "audit-secret") || strings.Contains(err.Error(), "audit-user") {
+		t.Fatalf("credentials in displayed error: %v", err)
+	}
+}
+
 func TestRecoveryFacadeLoadsPartialEvidenceAndPreservesCause(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "attempt.json")
 	if err := os.WriteFile(path, []byte(`{"format_version":1,"evidence":{}}`), 0600); err != nil {