classify_reqwest formatted the raw reqwest error, whose Display embeds the request URL with its hmac= token; the string is logged on every retry and in the player's CMAF-failed warning. It now uses the URL-free helper the legacy stream path already had, moved to qbz-qobuz::net_diag so both paths share it. The log redaction layer additionally scrubs hmac=, Signature=, Policy= and Key-Pair-Id= values. cc