The drain's history-walk notice (internal/surface/cli/intent_drain.go, runOwedDrain) prints site.LoadHistory's error to stderr through termsafe.Sanitize alone, bypassing scrubPaths, so git's quoted stderr, which can name an absolute path inside the repository (a corrupt loose object is reported with the file it is stored in), reaches the terminal unredacted: the one print in the drain front door no redactor touches. Found by review3-drain as a nit.

The drain's history-walk notice (internal/surface/cli/intent_drain.go, runOwedDrain) prints site.LoadHistory's error to stderr through termsafe.Sanitize alone, bypassing scrubPaths, so git's quoted stderr, which can name an absolute path inside the repository (a corrupt loose object is reported with the file it is stored in), reaches the terminal unredacted: the one print in the drain front door no redactor touches. Found by review3-drain as a nit.

Grounds

• pursued: a failed history walk whose git stderr names an absolute repository path prints it relative; a notice carrying the absolute path would show it wrong