Route all error/error_message write sites in WorkflowPersistenceLayer through self._redact() so secrets in node errors and workflow failure messages are scrubbed before persistence. Add module docstring, _split_values docstring, corrected redact_secret_values summary, and Mapping-keys comment to secret_scrub. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>