fetchURL echoed the whole raw URL (path, query, userinfo) in the ErrUnsupportedSource message, so a rejected source carrying a signed query leaked it into logs and tickets. Route the URL exit through trace.HostOf and fall back to a placeholder instead of the raw string. Test pins origin-only output and goes red if the fix is reverted.