docs: describe redaction as masking every query value

Author: lesnik512

docs/middleware.md

@@ -13,7 +13,7 @@ Middleware is for behavior that applies to every call through a client. Other ca
 - Side effects that don't need httpware's exceptions or chain order, including on post-redirect hops: use `event_hooks` on an `httpx2` client you build yourself and pass as `httpx2_client=`. Middleware and phase decorators run in the httpware chain, see httpware exceptions, and compose with `AsyncRetry` and `AsyncBulkhead`. `event_hooks` run a layer below, on every transport attempt. That is also why `httpware` refuses `event_hooks=` as a client option: an `httpx2.HTTPStatusError` raised in a hook (say, by `raise_for_status()`) reaches the chain as a plain `TransportError` instead of a `StatusError`, so `AsyncRetry` never retries it and the circuit breaker never counts it.
 - URL or header validation: `httpx2` already does it.
 - Creating HTTP spans for tracing: install `opentelemetry-instrumentation-httpx`, which already traces every transport call. See [Observability](observability.md).
-- Redaction: httpware redacts URLs before they reach logs, telemetry, and error messages. It strips `user:pass@` userinfo and masks the values of sensitive query and fragment parameters ([Errors](errors.md#excresponse-access-pattern) lists them). It does not touch headers or bodies, so if your middleware logs those, redact them yourself, for example with a `logging.Filter`.
+- Redaction: httpware redacts URLs before they reach logs, telemetry, and error messages. It strips `user:pass@` userinfo and replaces every query and fragment parameter value with `REDACTED`, keeping the keys ([Errors](errors.md#excresponse-access-pattern) has an example). It does not touch headers or bodies, so if your middleware logs those, redact them yourself, for example with a `logging.Filter`.
 
 ## Writing your own
 

src/httpware/_internal/observability.py

@@ -26,7 +26,7 @@ def _emit_event(
 
     The ``url`` attribute, when present, is run through
     ``redaction.redact_url`` here — at the single emission boundary — so a
-    request URL's userinfo and known-sensitive query/fragment secrets never
+    request URL's userinfo and query/fragment parameter values never
     reach a log record or span event, regardless of how a caller built the
     attributes dict.