Development record

ultra-v0.6.8 C3: the literal HOME backstop in internal/core/memory/redact.go (and its twin in internal/core/history/history.go) is strings.ReplaceAll(text, home, "~") with no path-boundary anchor, so with HOME=/root a page body naming /rootfs/etc/hosts or 'the /root-cause' is silently rewritten to ~fs/etc/hosts and 'the ~-cause' before it is committed; any short home ([redacted-path] inside [redacted-path]/...) corrupts the same way. The strings.Contains(redacted, home) fail-closed check that follows ReplaceAll can never be true, so the 'home path survived redaction' refusal is dead code. Fix once in the shared home (C7): anchor the replacement on a path boundary and make the survivor check boundary-aware so it can actually fire.