Render operator notes without terminal control interpretation

Valid audit data still needs a display decision

An operator reviews a denied AI action. The application’s trusted audit record says denied, while a bounded model observation explains why review was needed. The record is structurally valid. A convenience viewer then decodes the observation and writes it directly to an operator terminal. That last handoff introduces a different consumer from the stored JSON document.

This original worksheet selects one supported xterm-style review surface, one fixed trusted renderer and an independently known terminal state. It does not select a shell tool, terminal multiplexer or command runner. The existing audit-envelope, field-minimization and record-framing rules remain in force. This proposal concerns only how an already admitted observation is presented.

Read terminal behavior without sending a sequence

The actual XTerm Control Sequences reference identifies Patch 411, updated 23 August 2026. It distinguishes control bytes and graphic characters, documents CSI cursor movement and display erasure, and describes OSC window-title changes. Many features are optional or configurable; this is not evidence about every emulator or an installed terminal.

The reference also describes modal processing: after a control sequence starts, bytes that otherwise resemble graphic characters can be processed as sequence parameters. Consequently, the proposed positive requires independently established parser state and complete writer ownership. Merely labeling an output string printable is insufficient when that context is unknown.

Those are documented repertoire and state distinctions, not a claim that any hostile text was displayed or that a particular terminal permits arbitrary program execution. No control sequence, payload or terminal operation was created for this article.

Separate trusted interface output from the note

Invent event E-A, trusted decision denied and observation reference N-A. Its ordinary useful content is “Recipient needs review.” These are paper labels and harmless prose, not an actual logging record or terminal fixture. The application owns the event reference, decision label and layout. N-A must never choose those fields, a terminal title, output options or a formatting template.

For this selected renderer policy, untrusted data may contribute only a bounded single-line visible representation using ordinary ASCII graphic characters and spaces. Values outside that repertoire must become an independently reviewed visible notation or be omitted with a trusted notice. Untrusted carriage returns, line breaks, tabs, escape and other control bytes do not pass through as raw output. Trusted layout owns its own separators.

This is a proposed byte contract, not an implemented encoding function. It must specify how notation stays distinguishable from original literal text and how input and complete output bounds are enforced. It promises neither universal Unicode support nor a general-purpose terminal sanitizer.

Do not decode an admitted visible notation into raw controls later. Account for every transformation between the observation field and the actual terminal write, including error rendering. A path that handles the normal note safely but echoes the original on failure is outside this policy.

Use a complete output-provenance sheet

The ordinary positive preserves N-A’s readable explanation next to the separately trusted denial. It becomes eligible only when every actual row is independently supported. The renderer, output encoding, final bytes, terminal state, settings, writer inventory, interleaving prevention and current access rights are all unimplemented or unknown here; any missing prerequisite blocks that positive.

A second process, diagnostic handler or partially written output can invalidate the assumed context. This sheet supplies no terminal reset, recovery procedure, locking service or cross-writer coordination mechanism. Do not treat a fresh-looking prompt or a quiet screen as evidence that those prerequisites hold.

Review eight inert display cards

These conditions describe review decisions without constructing escape strings. They establish no executed sanitizer result, terminal setting or actual attack.

Keep other surfaces and evidence separate

A narrow terminal renderer does not make the explanation accurate, remove sensitive content or turn it into an approval. The structured audit record remains the authority boundary. Browser HTML, spreadsheet importers, saved views and other terminals each need their own consumer contract.

Keep future verification evidence to permitted case identifiers, renderer revisions, supported terminal scope and actual output-boundary results. Do not copy raw customer notes into diagnostics to illustrate the problem. No claim is made about clipboard operations, shell execution, secure erasure, terminal cleanup or all possible emulator behavior.

No terminal, control bytes, parser, renderer, encoding fixture, log event, shell, browser, API/model or runtime experiment was constructed or executed. Ordinary editorial files are separate. Boundary is prelaunch and does not ship this terminal viewer. Its synthetic policy, export and approval-status checks establish different behavior.