#1647 fix(media): redact diagnostics and simplify portable download routes

Media diagnostics exposed keys and signed URLs, and download URL concatenation put a second ? inside existing queries. This change redacts Debug output and retry logs, resolves encoded URI references without changing signed query bytes or fragments, and rejects references that change the selected HTTPS origin. The existing token parameter is preserved.

MediaRoute now contains only ordered hosts. Download requests no longer copy session auth; upload auth and download host refresh/failover remain in place. The existing platform markers allow browser-local Rc/RefCell adapters while retaining native Send futures.

Migration

• Replace MediaRoute::authenticated(hosts, auth) and unauthenticated(hosts) with MediaRoute::new(hosts); remove without_auth() and accesses to auth. From<&MediaConn> and default_hosts() remain available.
• Downloadable: MaybeSendSync; download writers require DownloadWriter + MaybeSend + 'static. Native Send/Sync behavior remains unchanged.
• CDN direct paths must be URI-encoded. Raw whitespace, Unicode, malformed escapes, userinfo, invalid ports and ambiguous authorities are rejected. Root-relative, relative, same-origin absolute and network-path references are covered by tests. Static URLs retain their separate verbatim path.
• External api/download.mdx migration is owned by the documentation lane.

Implementation and dependency review

The runtime uses fluent-uri 0.4.1 with default-features = false, features = ["alloc"] for parsing, resolution and building. url remains only as a differential test oracle. The consumer lock removes all 21 URL/IDNA/ICU packages introduced by the first implementation and adds four packages: fluent-uri 0.4.1, borrow-or-share 0.2.4, ref-cast 1.0.27 and ref-cast-impl 1.0.27. The core's production dependency tree contains no URL/IDNA/ICU stack.

Official crates.io package metadata declares MSRV 1.68/MIT for fluent-uri, 1.65/MIT-0 for borrow-or-share, and 1.71/MIT OR Apache-2.0 for ref-cast and its proc-macro. Upstream has parsing/resolution tests and differential fuzzing; its latest commit was 2026-05-20 when checked. Upstream, documented features.

Evidence

Covers report F03, F06, F11 and F16. Verified all 516 original JS files, 77,347,149 bytes, against whatspec 1a441f0329c941fcdb238490a6c604550d8a9939, schema 4.3.0, WA Web 2.3000.1045368834. Archive SHA-256: 2edd4b3f8dae50b503e0b15920adc774e2680cdb542396d57608bb0374196ee1. AST extraction found one definition each in bundle ffe69f61924eb23c1d65cb89a152e4ce35ee404bd52a7edcced9c037b236f490: FormatDownloadUrl bytes 829936–831951, MmsDownload 831953–837357, MmsClient 837359–844848. The download chain passes hosts and media references without connection auth. This is static evidence for that Web snapshot, not a server acceptance claim.

Original bundle archive

Validation

Reconciled merged PRs #1644 and #1645 from main 02456d45 without conflicts. Current head is 8df9e62f; the media/download contracts are unchanged. After the full CI run completed, main advanced to 9ef62ef4 with the test-only allocator changes in #1646. A temporary local merge was conflict-free; all 132 media/download tests and all seven allocator controls passed on that composition. The temporary merge was then removed, leaving the published head and clean working tree unchanged. Full CI and size results below apply to 8df9e62f against 02456d45; the additional integration check covers 9ef62ef4 locally.

On this head, 132 focused library tests, four isolated consumer download tests and all 53 consumer doctests passed, including both negative Send/Sync probes. The WASM Rc/RefCell consumer check passed with two pre-existing unused-qualification warnings. All current-head CI jobs are now terminal. Build & Test, all-features build/Clippy/tests, all 11 per-crate feature matrices, default Clippy, MSRV, native/MSRV independent consumers, WASM, all three Miri jobs, E2E, Cargo Deny, generated artifacts, Rustdoc, format, autofix, rederive and the native size gate passed. E2E ran 168 tests successfully with 11 skipped; the final all-shareable-features test stage ran 3,120 successfully with six skipped. Greptile passed with no unresolved threads. Cubic skipped its AI review because the last commit is a merge commit (the preceding non-merge review was quota-limited); it is not counted as an independent completed review.

The same download_probe source was rebuilt on base 02456d45 and head 8df9e62f using the pinned nightly, wasm32-unknown-unknown, release profile, and core,js features. It retains the public URL-preparation function without network activity:

WASM probe metric	Base	PR	Delta
Non-custom sections, bytes	49,012	76,053	+27,041
Code section, bytes	37,167	58,257	+21,090
Data section, bytes	7,242	13,150	+5,908
Complete artifact, bytes	72,801	102,458	+29,657

This measures the linked download-preparation path, not a complete application or an ESP32 firmware image. The official native size gate passed on 8df9e62f against validated base 02456d45: -42.62 KiB stripped and -50.19 KiB .text. No size override or workflow change has been made.

The verified MIT-0 allowance is restricted to borrow-or-share =0.2.4 through cargo-deny's package-specific license exception. The official crate archive SHA-256 matches Cargo.lock: dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c; the packaged LICENSE SHA-256 is 010492e490b92ec85db01daad2a290ea5959f29314a1c4ff25e7a172e223abf9. Its LICENSE says MIT No Attribution and agrees with the packaged SPDX metadata. No global license permission, advisory suppression or other check was changed. Cargo Deny passed locally on 6c459b6c and remotely on current head 8df9e62f.

No code changes, conflicts, failing correctness gates or open review threads remain. The informational semver failure and neutral performance observations below remain visible. This PR is ready for review following the user's acceptance of the disclosed WASM size increase and unresolved simulation caveats; no merge was performed.

The informational semver job already fails on base 8f711a9 (job 111535094975). On current head 8df9e62f, job 111564085818 confirmed this PR's intentional removals of MediaRoute's auth field and three auth methods, and flagged MaybeSendSync as a new supertrait. These changes are separately documented, not attributed to the pre-existing failures.

All four CodSpeed execution jobs passed, but the performance analysis is neutral with two simulation regressions in bench_session_with_self[false/true] (-8.22%/-8.21%). Exact base/head comparison. The environment warning does not apply to those simulation results. CodSpeed's detailed metrics show identical instruction cost for each pair; memory-access cost changes from 1,111.11 ns to 1,222.22 ns and cache cost from 66.67 ns to 63.89 ns. The flamegraphs localize the difference to existing Option::as_ref and fixed-array equality operations. libsignal source, benchmark source and its normalized dependency tree are unchanged. This is consistent with a simulated cache/layout effect, but no matching current-head walltime result establishes causality. The report is retained as an unresolved informational performance observation; no benchmark was acknowledged, hidden or altered.