1@README.md
2
3- `Forward` never writes the real key into a fixture: only the headers in
4  `KEPT` are recorded. A header added there must not be able to carry a
5  credential.
6- `Replay` answers a miss with a non-retryable 400, never a retryable status:
7  a retrying client would turn one miss into several.