Refuse a credential in a log entry and take a full 256 KiB value with its expect header (ADR 0297 review)

A log keeps what it is given for good, so the state guard against secrets
applies to it too; the stream holds 260 KiB a message so the headers an
append carries never push a 256 KiB value over.

node-tools/internal/runtime/log_test.go

@@ -313,6 +313,24 @@ func TestWhatALogCannotHoldIsRefusedWithTheReason(t *testing.T) {
 	if info := infoOf(t, b); info["entries"] != 0 {
 		t.Fatalf("a refused append wrote: %v", info)
 	}
-	// The largest value allowed is taken.
-	appendOf(t, b, `{"log":"changes","key":"1","value":"`+strings.Repeat("x", 256*1024-2)+`"}`)
+	// The largest value allowed is taken, also with the header an expect carries.
+	largest := `"` + strings.Repeat("x", 256*1024-2) + `"`
+	appendOf(t, b, `{"log":"changes","key":"1","value":`+largest+`,"expect":0}`)
+	appendOf(t, b, `{"log":"changes","key":"2","value":`+largest+`}`)
+}
+
+// A value naming a credential anywhere in it is refused, as mesh/state.put refuses one (novox/hq ADR
+// 0201 §13): a log keeps what it is given for good. A value that only counts tokens is taken.
+func TestALogRefusesAValueNamingACredential(t *testing.T) {
+	b, _, _ := logBuses(t, 1<<20)
+	for _, value := range []string{`{"op":"set","api_key":"s"}`, `{"op":"note","with":{"headers":{"Authorization":"Bearer s"}}}`} {
+		_, err := logAsk(b, "append", `{"log":"changes","key":"1","value":`+value+`}`)
+		if err == nil || !strings.Contains(err.Error(), "names a credential") {
+			t.Errorf("append of %s: %v", value, err)
+		}
+	}
+	if info := infoOf(t, b); info["entries"] != 0 {
+		t.Fatalf("a refused append wrote: %v", info)
+	}
+	appendOf(t, b, `{"log":"changes","key":"1","value":{"op":"note","maxTokens":4096}}`)
 }