The assembled harness's small view-map -> plain-text-lines bridge.

Every harness Component in Raxol.UI.Components.Harness.* (Block, BlockBody, Composer, and everything BodyProvider mounts) renders a plain view map (Raxol.View.Components-shaped: %{type: :column, children: [...]} / %{type: :text, content:, style:}) meant for the normal Preparer -> LayoutEngine -> UIRenderer pipeline. The append-path / footer-viewport substrate (InlineAuthority/FlatAuthority) bypasses that pipeline entirely -- it is a byte-level, pinned-region writer whose seal/2, repaint/2, and keyframe/2 all take already-flattened iodata(), one binary per row (InlineAuthority's own moduledoc: "callers hand the paint authority already width-truncated text").

This module is the bridge the assembled harness owns: flatten a view map into an ordered list of one-line-per-leaf-text-node strings, truncated to a display-width budget (Raxol.UI.TextMeasure, never String.length -- CJK undercounts), optionally wrapped in minimal SGR (24-bit truecolor :fg, :dim) for the styled/inline path.

Why truncate BEFORE styling

lines/3's pipeline is: flatten -> truncate to width (plain content only) -> THEN wrap in SGR. Reversing that order would count escape bytes as display columns (TextMeasure has no ANSI awareness), silently truncating either mid-escape-sequence or too early. Truncating the plain string first and adding SGR as a pure string-wrap afterward keeps the width budget exact regardless of styling.

Modes

• :plain -- FlatAuthority's destination (pipe/CI/screen-reader): zero escape bytes, ever (mirrors FlatAuthority's own "zero escape bytes, full stop" contract) -- content only.
• :styled -- InlineAuthority's destination: content wrapped in a minimal SGR run (24-bit :fg, :dim) when the source view node carries a :style map with those keys, \e[0m reset at the end of any styled line. A style-free node (no :fg/:dim) round-trips byte-identical to plain -- neutral by default, matching every harness Component's own "absent prominence = zero change" contract.

This module is the trust boundary: sanitize content here, not downstream

Every string this module flattens can originate from an untrusted source -- a fixture's tool-call output, an LLM's streamed response, a bracketed paste landing in the Composer buffer (Composer's own moduledoc: pasted content is inserted verbatim, "no matter how many lines the paste contains"). Neither InlineAuthority nor FlatAuthority re-validates the iodata() rows a caller hands them -- both take already-flattened content ON TRUST, one binary per row. So this module, the ONE seam every harness Component's content passes through before reaching either authority, is where two hostile-content properties get enforced, once, for both paint substrates:

1. Embedded \n splits into multiple collected lines. A :text node whose content contains a literal newline (a multi-line tool result, a pasted multi-line composer buffer, Composer's own queued-steer banner built from raw composer text) would otherwise collect as ONE list entry containing an embedded newline -- InlineAuthority.repaint/2's "one binary per row" row-accounting assumes every list entry maps to exactly one physical terminal row, so a single entry that actually PRINTS as two rows (the terminal itself breaks on the embedded \n) desyncs that count silently: every row after the split one is now off-by-one against whatever InlineAuthority believes it painted. Splitting on \n here (before truncation, so each resulting line gets its own width budget) is CORRECT, not lossy -- it turns one row-accounting bug into the same content rendered as the multiple rows it actually is.
2. ESC and C0 control bytes (except \t) are stripped from content. An embedded ESC in a :text node's content -- unlike the styling this module adds itself around a truncated line -- is an INJECTION: it would ride through untouched and reach the terminal inside what InlineAuthority/FlatAuthority both assume is inert text, capable of anything from a stray color change to a full screen clear. The same byte-wise strip FlatAuthority.scrub/1 uses is used here (see that module's own comment: multi-byte UTF-8 lead (0xC2-0xF4) and continuation (0x80-0xBF) bytes are both >= 0x20, so byte-wise stripping never splits a valid codepoint) -- the C0 byte is removed and the rest of a hostile sequence's bytes are left as a visible, garbled fragment, same honest failure mode FlatAuthority documents: a reader sees something was stripped rather than an invisible, silently-swallowed injection.

This is complementary to, not a substitute for, FlatAuthority's own scrub (a module-enforced flat scrub). Two independent layers, two independent jobs: FlatAuthority.append_sealed/2 holds the FLAT-TIER guarantee ("this authority never emits a cursor-moving byte, regardless of what any caller passes in" -- a property that has to live in the authority itself, since a caller bypassing this bridge entirely must still get it). This module's sanitize fixes the INLINE-TIER row-accounting bug (1) that FlatAuthority's scrub has no reason to know or care about (flat mode has no row-accounting to desync -- it is append-only), and belt-and- braces re-applies the same ESC/C0 strip (2) at the one seam BOTH tiers' content flows through, before either authority ever sees it. Neither layer alone is the full guarantee; removing either one reopens exactly the hole the other was never responsible for closing.