docs(diag): say that a unix group name is deliberately kept, and pin it

docs/usage/cli.md

@@ -501,6 +501,15 @@ were replaced:
   imported is redacted too, because a `.conf` or `.ovpn` is named after the VPN
   it configures.
 
+Two things are deliberately **kept**, because redacting them would replace the
+answer rather than an identity. The **unix group** in `control.group` is a
+property of the machine, not of you or your provider — the default is `admin` —
+and the control check exists to tell you which group to join, which
+"you are not in the `profile-1` group" cannot do. And the **paths of dezhban's
+own files**: the control check names the socket it probed, so a path reading as
+`…/host-N` would be a diagnosis with its subject removed. A socket you renamed
+yourself is redacted, because that name is yours.
+
 The README's legend reports counts and the tokens they cover — a range
 ("23 distinct IP addresses → ip-1 … ip-23") when a kind's tokens run
 consecutively, and a list ("2 distinct profile names → profile-1, profile-3")

internal/redact/json_test.go

@@ -589,3 +589,34 @@ func TestANameSpelledLikeAnExistingTokenKeepsItsSpelling(t *testing.T) {
 		t.Errorf("legend = %v, want the single profile and no interface kind", legend)
 	}
 }
+
+// A unix group is a property of the machine, not of the person or the provider:
+// the macOS default is `admin`, and the control check exists to tell you which
+// group to join — which "you are not in the profile-1 group" cannot do. Kept
+// deliberately, in both entries that carry it, and pinned here because the
+// question has been raised once and closed (#69): a bundle that hides the
+// diagnosis has thrown away the answer and hidden no identity.
+//
+// Keeping it in only ONE of the two would be worse than either choice: the same
+// value would read as a token in one entry and a name in the other.
+func TestAUnixGroupNameIsKeptInEveryEntryThatCarriesIt(t *testing.T) {
+	r := New(true)
+	const group = "vpnadmins"
+
+	cfg := r.JSON(`{"control":{"enabled":true,"group":"` + group + `"}}`)
+	if !strings.Contains(cfg, group) {
+		t.Errorf("config.json redacted the group: %q", cfg)
+	}
+
+	doc := r.JSON(`{"checks":[{"name":"control","summary":"reachable (/var/db/dezhban/control.sock, group \"` + group + `\") — routine ops need no password."}]}`)
+	if !strings.Contains(doc, group) {
+		t.Errorf("doctor.json redacted the group: %q", doc)
+	}
+	// And the socket path beside it, for the same reason.
+	if !strings.Contains(doc, "/var/db/dezhban/control.sock") {
+		t.Errorf("doctor.json redacted the socket path: %q", doc)
+	}
+	if legend := r.Legend(); len(legend) != 0 {
+		t.Errorf("legend = %v, want nothing minted for a group name or a path", legend)
+	}
+}