- Basic credentials and values saved with `secret: true` are redacted however
short, as declared secrets are; page values keep the 8-character floor
- a literal Basic password other than empty is refused, since Evidence
records literals as written
- `save_response` takes only a request the step starts, so an earlier
autosave cannot answer it, matches its path as the browser spells it, and
stops watching requests when the step ends
- saving reads are bounded: a request step streams its answer up to
4,000,000 characters; a UI step refuses a larger received size unread
- goto placeholders fill the destination URL before structured query values
join it
- reading a composed string stops at the reading cap before comparing or
allocating more
- a slug's `&` spelling follows every create the plan accepted and every held
entity; direct slug rules and composed strings take it from held entities
when the create slugs none, and a slug rule they contradict is not learned
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
