The redaction a pause carries to the resumed run — NAMES only, never a value
(the checkpoint stays real): the keys marked secret for the rest of the run
(a per-call setValue(key, value, true), a key the policy redacted whole, a
subflow mapper's taint) and the fields a mapper handed to a new key. Resume
seeds the resumed run's rule with them, so a copy made before the pause is
still masked after it.
The redaction a pause carries to the resumed run — NAMES only, never a value (the checkpoint stays real): the keys marked secret for the rest of the run (a per-call
setValue(key, value, true), a key the policy redacted whole, a subflow mapper's taint) and the fields a mapper handed to a new key. Resume seeds the resumed run's rule with them, so a copy made before the pause is still masked after it.