The ingest verb hands item body text to capture.IngestReading after redaction only, and capture's yamlScalar refuses runes below 0x20 and nothing above, so a model-authored bidi override, C1 control or zero-width rune lands verbatim in a committed markdown reading record. This diff is what makes that writer reachable, and it makes it reachable exclusively from model output, so a Trojan-Source-style reversed span can reach a record a reviewer reads in a terminal. internal/termsafe carries a lossless encoder for exactly this boundary.

The ingest verb hands item body text to capture.IngestReading after redaction only, and capture's yamlScalar refuses runes below 0x20 and nothing above, so a model-authored bidi override, C1 control or zero-width rune lands verbatim in a committed markdown reading record. This diff is what makes that writer reachable, and it makes it reachable exclusively from model output, so a Trojan-Source-style reversed span can reach a record a reviewer reads in a terminal. internal/termsafe carries a lossless encoder for exactly this boundary.

Grounds

• pursued: the finding is closed by a test that fails without the change; a later review or mutation run finding the same shape again would show this wrong