The reconstruction artefact's anti-forgery fencing covers block content but not block metadata, so the forgery class it was built to close is still open. A tool call's name, a tool result's identifier and a turn's model name are formatted directly into the document outside any fence, with no guard on their contents: the only helper applied to them substitutes a dash for the empty string. A transcript carrying a line break inside any of those fields therefore emits lines of the document itself, and the lines it can emit include an agent section heading, a turn heading and a join marker, which are exactly the shapes the earlier fix set out to make unforgeable. The regression test plants its payload only in a text block, so nothing exercises the metadata path and the gap passed unnoticed. The consequence falls on the reader the artefact is written for: the guide it carries tells that reader everything inside a fence is something somebody said and everything outside one is the document, and that is not the rule the renderer implements. The fix is to sanitise every scalar interpolated outside a fence rather than to fence more, since these are single-line labels, and to extend the regression test to each of them. Until then the document states a guarantee it does not hold, which is worse than stating none.

The reconstruction artefact's anti-forgery fencing covers block content but not block metadata, so the forgery class it was built to close is still open. A tool call's name, a tool result's identifier and a turn's model name are formatted directly into the document outside any fence, with no guard on their contents: the only helper applied to them substitutes a dash for the empty string. A transcript carrying a line break inside any of those fields therefore emits lines of the document itself, and the lines it can emit include an agent section heading, a turn heading and a join marker, which are exactly the shapes the earlier fix set out to make unforgeable. The regression test plants its payload only in a text block, so nothing exercises the metadata path and the gap passed unnoticed. The consequence falls on the reader the artefact is written for: the guide it carries tells that reader everything inside a fence is something somebody said and everything outside one is the document, and that is not the rule the renderer implements. The fix is to sanitise every scalar interpolated outside a fence rather than to fence more, since these are single-line labels, and to extend the regression test to each of them. Until then the document states a guarantee it does not hold, which is worse than stating none.

Grounds

• pursued: we expect containment to be the whole answer here, because these are single-line labels whose only power is to leave their line, so stripping the line break removes the forgery and escaping the backtick and pipe removes the quieter falsehoods of escaping a code span and shifting a table's cells; it is shown wrong if a value can forge a line by some route that is not a line break, or if the cleaner's own rewrites make a label misrepresent what the session actually contained