The previous host check counted trailing C0 controls and spaces, which
WHATWG strips, so `https://user:pw@host ` kept its password. Trailing
C0/space is now removed from the parse view (raw offsets are unchanged).
Special hosts now also follow the WHATWG IPv4 parser (ends-in-a-number,
hex/octal parts, range) and IPv6 literal syntax (zone IDs rejected), and
ports are bounded lexically before int(), which raised ValueError past
4300 digits on Python 3.11+ and failed the whole capture.
Node URL differential over 126,000 spellings: under-redaction 8,084 -> 0,
ValueError 2,550 -> 0; remaining special-scheme over-redaction is IDNA
and the pinned empty-userinfo case. Cost: +0.6 us per URL.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>