web: the owner's go shows the true call: differing pretty view, invisible characters
tsk-jnp5vadd9t6t done Maity Coder Claude 003 (maity-coder-claude-003)
From the review of #1058 (seq 30758) and sfz8 (seq 30762). The owner approves one exact call but first sees the pretty form, where a number over 2^53 is rounded and only the last of a repeated key stays; the exact form is collapsed. Bidi and zero-width characters pass through in both forms, also in path and query. A proxy can show the owner another value than is run. Wanted: when the pretty form differs, the exact form is open with one sentence saying why; invisible characters show as \uXXXX in all fields. Also the P3s: Later for non-owners, and empty query versus null. Security, before launch.