Hide credentials in checkout preparation errors

docs/cli.md

@@ -244,6 +244,7 @@ the selected Git remote (default `origin`), requires its peeled commit to match
 the required full `--commit` object ID, checks out that commit detached, then
 verifies the tag, HEAD, and clean worktree. With `--prepared`, it performs those
 checks read-only against the existing checkout and does not fetch or check out.
+Preparation diagnostics mask userinfo in HTTP(S) remote URLs.
 In either mode, it loads the profile from the verified source. `--expected-module`
 optionally checks that the profile selects the module chosen by a launcher;
 module selection itself remains profile-owned. The command compares the selected

docs/roadmap/remediation.md

@@ -109,9 +109,16 @@ public publication regression using a local hook from another caller directory.
 
 ## R03. Checkout preparation reintroduces credentials after Git redaction
 
-**Priority:** P2. **Status:** Pending. This is an A04 integration gap in the
+**Priority:** P2. **Status:** Complete. This addressed an A04 integration gap in the
 existing preparation workflow, separate from R01's URL-span parsing defect.
 
+**Completion:** Fetch-failure errors render the remote with `DisplayURL`, while
+the fetch retains its original URL and wrapped Git cause. Public preparation
+and CLI regressions failed before the fix and now pass with local HTTP servers;
+the public test also verifies authentication with the configured credentials.
+The remaining owned Git URL renderers were reviewed, and the CLI guide describes
+the implemented diagnostic behavior. Combined verification below passed.
+
 **Relevant code:** `PrepareTaggedCheckout` in
 [internal/git/prepare.go](../../internal/git/prepare.go), lines 18–20; the public
 [preparation facade](../../preparation.go); and error presentation in
@@ -205,3 +212,20 @@ using the earlier Git environment behavior passed. Both audits left production
 code and existing tests unchanged. The full-suite, static, and compiled
 API/dependency results above record the audit baseline; completion notes record
 verification of the subsequent repairs.
+
+## Completed remediation verification
+
+All three findings are complete. Each fix includes regressions that reproduced
+the defect before the production change, and each unit has its own commit with
+the corresponding completion marker.
+
+On Linux/amd64 with Go 1.26.8, combined verification passed with
+`GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off`, the prepared build cache, and
+`TMPDIR=/var/tmp` for test fixtures:
+
+- `go test ./...`
+- `go test -race ./...`
+- `go run ./internal/apicheck`
+
+Changed Go files passed formatting inspection. Local links and fragments in
+this document and the CLI guide resolved, and the diff passed whitespace checks.