[jwrosewell]

Problem

The Usage Sharing Element differs from the rule the cloud service follows in two places.

1. Query and form values. By default only the query string and HTTP form parameters whose names start 51D_ are shared (lines 70 to 72), and share all query string parameters defaults to false (line 402).
2. Cookies when all Evidence is shared. The rule that leaves out cookies not starting 51D_ applies only "Unless all Evidence is shared" (lines 65 to 68), so turning on share all Evidence shares every cookie a site sets, its session cookie included (lines 89 and 90 and 309 to 311).

James Rosewell decided the rule for every package on 14 November 2026, in these words.

Usage sharing defaults: the cloud rule is every language package's default. Every package shares every query and form value by default, and Share all Evidence no longer shares cookies other than 51D_ ones (the raw Cookie header never). The specification changes to say so.

What changed

All in pipeline-specification/pipeline-elements/usage-sharing-element.md.

1. Shared Evidence. A new paragraph after the keys that are never shared says the filter MUST return false for a cookie. key whose field does not start 51D_, whatever the configuration and even when all Evidence is shared. The cookie. line leaves the list that applies only when all Evidence is not shared.
2. Query and form values. The query. line in that list now applies only when share all query string parameters is off, and a new sentence says that option is on by default, so every query string and HTTP form parameter is shared unless a user turns it off.
3. The session cookie MUST NOT be shared unless its name starts 51D_, as no other cookie is. It used to be shared whenever all Evidence was.
4. Session tracking. Sharing all Evidence no longer shares the session cookie, so the paragraph that opened "Unless all Evidence is shared, the session cookie is not compared" now opens "By default the session cookie is not compared". The sentence saying track session has no effect when all Evidence is shared, which was true only while sharing all Evidence shared every cookie, is replaced by one saying track session works the same either way.
5. Configuration options. Share all query string parameters defaults to true. Included query string parameters says it has an effect only when that option is off, and share all Evidence says the keys it never shares include every cookie whose name does not start 51D_.

The raw Cookie header (header.cookie) was already never shared and stays so. No option is removed or renamed, so a user who wants only the 51D_ query values and their own list turns share all query string parameters off.

What each language changes

Every language's Usage Sharing Element changes in its own draft, with tests, linking this one.

1. Share all query string parameters defaults to true.
2. With share all Evidence on, a cookie whose name does not start 51D_ is still not shared, the session cookie included.

Merging with #146

#146 also changes the session tracking paragraph, at other lines. A trial merge of #146's head 79c84b0 into this branch merged with no conflict, so the two can merge in either order.

What remains

The documentation's usage sharing page describes these defaults. It follows in documentation#316 once this merges.

Build

The specifications have no build. The checks on the head, b6fae7f, are green, being utm-link-lint and Only rc into main.