Document findings.

Skill drills that exercise this task

• CSCD240-E1-B-Q49 Delete the in-memory command history for the current shell.
• CSCD240-E1-C-Q50 IR runbook: capture terminal session output of every IR command. Name the command and why it matters for chain of custody.