Markdown → HTML, rendered through MDEx (comrak), on two paths that share one pipeline: to_html/1 for untrusted input (agent or user output) and to_trusted_html/1 for an authored manual. Both return a binary of HTML; a Phoenix caller wraps it in Phoenix.HTML.raw/1. The untrusted path closes two holes that a plain markdown-to-HTML call leaves open (Fountain #323):

1. Raw HTML — an agent emitting <img src=x onerror=...> as its own paragraph must not become live markup.
2. Markdown link/image syntax accepts any URL scheme — [x](javascript:...) must not render as a live link.

to_html/1 walks the parsed document before rendering: every raw-HTML node (block and inline) is replaced by a text node carrying its source, so the renderer escapes it and the HTML displays as text rather than executing. Links and images are dropped unless their URL scheme is on the allowlist — http/https/mailto for links, http/https for images, relative URLs for both — and a dropped link or image is unwrapped to its text/alt so the content still reads. The untrusted path additionally renders with comrak's unsafe: false + escape: true, so even a raw-HTML node the walk missed would be escaped rather than emitted.

Scheme checks run on a normalized copy of the URL: character references decoded and the whitespace/control characters browsers ignore stripped, so javascript: or java\tscript: cannot smuggle a scheme past the check. Normalization is deliberately generous — over-decoding can only make the filter stricter.