Function redact_url 

pub fn redact_url(raw: &str) -> String

Canonical strict redaction of a raw URL string for diagnostic surfaces (ADR-0051, bd rc-eh49): authority windows are enumerated over maximal runs of / and \ characters — a pure-slash run of two or more characters opens a window, a backslash-bearing run opens one only behind an RFC 3986 scheme prefix ([a-zA-Z][a-zA-Z0-9+.-]*:) ending immediately before the run (a single \ additionally needs a scheme of two-plus characters, or a one-character scheme whose candidate window content is credential-shaped) — and each window ends at the next /, ?, or #. A window containing @ carries userinfo, and the bytes from window start through the LAST @ are masked in place as ***@ (over-masking is safe, under-masking is not). Every window is scanned, so credentials cannot hide in a later window behind a benign first one. Everything from the earliest ? or # is dropped; the sentinels compose: each distinct introducer character (? and/or #) that occurs anywhere in the URL appends its matching ?[redacted] / #[redacted] sentinel in first-occurrence order — queries and fragments routinely carry tokens. The result is capped at 256 bytes on a UTF-8 char boundary. There is no URL parser here, so in-place windowed masking is the strictest feasible handling. This is the string layer; crate::endpoint_uri::EndpointUri::to_redacted_string redacts the catalog-driven authored-URI surface instead.