ef4996a01e
redact()'s final fallthrough still used the unbounded [^@]* class #638 removed from the verdict-line masker, so a diff line with a URL that has no userinfo plus a later @ elsewhere had its text between them silently deleted. Share one bounded implementation, mask_url_userinfo(), between redact() and mask_verdict_userinfo() so the bound lives in one place.