diff --git a/src/signals/focus-manifest.ts b/src/signals/focus-manifest.ts
index 1638f365f4..a3a97b264e 100644
--- a/src/signals/focus-manifest.ts
+++ b/src/signals/focus-manifest.ts
@@ -289,10 +289,11 @@ const EMPTY_MANIFEST: FocusManifest = {
  * text must not leak reward, wallet/key, ranking, or local filesystem path material.
  */
 export function isFocusManifestPublicSafe(text: string): boolean {
-  // Local filesystem path alternatives mirror the canonical PUBLIC_UNSAFE_PATTERN in redaction.ts: include
-  // `/root/` (container/CI home) and accept the forward-slash Windows form (`C:/Users/`), not only the
-  // backslash one — otherwise a `/root/...` or `C:/Users/...` path leaks through this public-safe guard.
-  return !/\b(reward\w*|score\w*|wallets?|hotkeys?|coldkeys?|seed[-\s]?phrases?|mnemonics?|private[-\s]?keys?|farming|payouts?|rankings?|raw[-\s]?trust(?:[-\s]?scores?)?|trust[-\s]?scores?|private[-\s]?reviewability|reviewability(?:[-\s]?internals?)?|private[-\s]?scoreability|scoreability|public[-\s]?score[-\s]?(?:estimate|prediction|claim)s?|estimated[-\s]?scores?|score[-\s]?(?:estimate|prediction|preview)s?)\b|\/Users\/|\/home\/|\/root\/|\/tmp\/|[A-Z]:[\\/]Users[\\/]/i.test(text);
+  // Local filesystem path alternatives mirror the canonical PUBLIC_UNSAFE_PATTERN in redaction.ts: the full
+  // set is `/Users/`, `/home/`, `/root/` (container/CI home), `/var/` (logs, temp, CI workspaces), `/tmp/`,
+  // and the Windows `[A-Z]:[\/]Users[\/]` form (both slash directions). Any omission leaks that path prefix
+  // through this public-safe guard.
+  return !/\b(reward\w*|score\w*|wallets?|hotkeys?|coldkeys?|seed[-\s]?phrases?|mnemonics?|private[-\s]?keys?|farming|payouts?|rankings?|raw[-\s]?trust(?:[-\s]?scores?)?|trust[-\s]?scores?|private[-\s]?reviewability|reviewability(?:[-\s]?internals?)?|private[-\s]?scoreability|scoreability|public[-\s]?score[-\s]?(?:estimate|prediction|claim)s?|estimated[-\s]?scores?|score[-\s]?(?:estimate|prediction|preview)s?)\b|\/Users\/|\/home\/|\/root\/|\/var\/|\/tmp\/|[A-Z]:[\\/]Users[\\/]/i.test(text);
 }
 
 function emptyManifest(source: FocusManifestSource, warnings: string[] = []): FocusManifest {
diff --git a/test/unit/focus-manifest.test.ts b/test/unit/focus-manifest.test.ts
index f13c37225a..add859dac6 100644
--- a/test/unit/focus-manifest.test.ts
+++ b/test/unit/focus-manifest.test.ts
@@ -718,6 +718,7 @@ describe("public-safe invariant", () => {
     expect(isFocusManifestPublicSafe("see /Users/me/repo/src")).toBe(false);
     expect(isFocusManifestPublicSafe("see /home/dev/repo/src")).toBe(false);
     expect(isFocusManifestPublicSafe("see /root/repo/src")).toBe(false);
+    expect(isFocusManifestPublicSafe("see /var/log/build.log")).toBe(false);
     expect(isFocusManifestPublicSafe("see /tmp/build/out")).toBe(false);
     // Windows, both backslash and forward-slash forms.
     expect(isFocusManifestPublicSafe("see C:\\Users\\me\\repo")).toBe(false);