diff --git a/gigaevo/database/redis_program_storage.py b/gigaevo/database/redis_program_storage.py
index 68694a94..78cae2c9 100644
--- a/gigaevo/database/redis_program_storage.py
+++ b/gigaevo/database/redis_program_storage.py
@@ -25,6 +25,7 @@
 from gigaevo.programs.program_state import ProgramState, validate_transition
 from gigaevo.utils.json import dumps as _dumps
 from gigaevo.utils.json import loads as _loads
+from gigaevo.utils.text_sanitize import sanitize_for_log
 from gigaevo.utils.trackers.base import LogWriter
 
 T = TypeVar("T")
@@ -109,7 +110,11 @@ def _safe_deserialize(
         try:
             return Program.from_dict(_loads(raw), exclude=exclude)
         except Exception as e:
-            logger.warning("[RedisProgramStorage] Corrupt data in {}: {}", ctx, e)
+            logger.warning(
+                "[RedisProgramStorage] Corrupt data in {}: {}",
+                ctx,
+                sanitize_for_log(str(e)),
+            )
             return None
 
     async def _mget_by_keys(
diff --git a/gigaevo/database/state_manager.py b/gigaevo/database/state_manager.py
index b8ee2fd1..3ebdf945 100644
--- a/gigaevo/database/state_manager.py
+++ b/gigaevo/database/state_manager.py
@@ -7,6 +7,7 @@
 from gigaevo.programs.core_types import ProgramStageResult, StageState
 from gigaevo.programs.program import Program
 from gigaevo.programs.program_state import ProgramState, validate_transition
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 # States after which the DagRunner never accesses the program again.
 # Evict per-program locks for these states to prevent unbounded memory growth.
@@ -100,7 +101,7 @@ async def set_program_state(
                 logger.error(
                     "[ProgramStateManager] Invalid state transition for {}: {}",
                     program.short_id,
-                    e,
+                    sanitize_for_log(str(e)),
                 )
                 raise
 
diff --git a/gigaevo/evolution/bus/transport.py b/gigaevo/evolution/bus/transport.py
index 786cb172..960746d2 100644
--- a/gigaevo/evolution/bus/transport.py
+++ b/gigaevo/evolution/bus/transport.py
@@ -8,12 +8,14 @@
 
 from abc import ABC, abstractmethod
 import json
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, cast
 
 from loguru import logger
 from pydantic import BaseModel
 import redis.asyncio as aioredis
 
+from gigaevo.utils.text_sanitize import deep_sanitize_for_json
+
 if TYPE_CHECKING:
     from gigaevo.evolution.bus.topology import Topology
 
@@ -28,10 +30,19 @@ class MigrantEnvelope(BaseModel):
     generation: int
 
     def to_stream_fields(self) -> dict[str, str]:
+        # Belt-and-suspenders: program_data carries LLM-generated code plus
+        # stage errors whose origins span Python / Triton / CUDA C++ /
+        # CUTLASS / Mojo / Pallas / CuTe. Any one of those toolchains can
+        # emit text that contains a lone UTF-16 surrogate; json.dumps then
+        # raises UnicodeEncodeError and the migration write aborts. Scrub
+        # surrogates at the boundary.
+        safe_program_data = cast(
+            dict[str, Any], deep_sanitize_for_json(self.program_data)
+        )
         return {
             "source_run_id": self.source_run_id,
             "program_id": self.program_id,
-            "program_data": json.dumps(self.program_data),
+            "program_data": json.dumps(safe_program_data),
             "published_at": str(self.published_at),
             "generation": str(self.generation),
         }
diff --git a/gigaevo/evolution/mutation/mutation_operator.py b/gigaevo/evolution/mutation/mutation_operator.py
index 42a119c7..b0109dd7 100644
--- a/gigaevo/evolution/mutation/mutation_operator.py
+++ b/gigaevo/evolution/mutation/mutation_operator.py
@@ -17,6 +17,7 @@
 from gigaevo.problems.context import ProblemContext
 from gigaevo.programs.metrics.formatter import MetricsFormatter
 from gigaevo.programs.program import Program
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 if TYPE_CHECKING:
     from gigaevo.database.program_storage import ProgramStorage
@@ -95,7 +96,7 @@ def _canonicalize_code(code: str) -> str:
             logger.warning(
                 "[LLMMutationOperator] Failed to canonicalize code due to syntax error: {}. "
                 "Returning original code.",
-                e,
+                sanitize_for_log(str(e)),
             )
             return code
 
@@ -156,7 +157,10 @@ async def mutate_single(
             if structured_output:
                 mutation_metadata[MutationSpec.META_OUTPUT] = structured_output
                 archetype = result.get("archetype", "unknown")
-                logger.debug("[LLMMutationOperator] Mutation archetype: {}", archetype)
+                logger.debug(
+                    "[LLMMutationOperator] Mutation archetype: {}",
+                    sanitize_for_log(str(archetype)),
+                )
             if result.get("changes"):
                 logger.debug(
                     "[LLMMutationOperator] Mutation returned {} tracked change(s)",
diff --git a/gigaevo/llm/agents/insights.py b/gigaevo/llm/agents/insights.py
index 96565050..299fbac6 100644
--- a/gigaevo/llm/agents/insights.py
+++ b/gigaevo/llm/agents/insights.py
@@ -8,12 +8,13 @@
 
 from langchain_core.messages import AIMessage, BaseMessage, HumanMessage, SystemMessage
 from langchain_openai import ChatOpenAI
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 
 from gigaevo.llm.agents.base import LangGraphAgent
 from gigaevo.llm.models import MultiModelRouter
 from gigaevo.programs.metrics.formatter import MetricsFormatter
 from gigaevo.programs.program import OPTIMIZATION_STAGES, Program
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 
 class ProgramInsight(BaseModel):
@@ -24,6 +25,11 @@ class ProgramInsight(BaseModel):
     tag: str = Field(description="Tag for the insight")
     severity: str = Field(description="Severity of the insight")
 
+    @field_validator("type", "insight", "tag", "severity", mode="after")
+    @classmethod
+    def _scrub_text(cls, value: str) -> str:
+        return sanitize_for_log(value)
+
 
 class ProgramInsights(BaseModel):
     """Collection of program insights."""
diff --git a/gigaevo/llm/agents/lineage.py b/gigaevo/llm/agents/lineage.py
index c3ae277c..f2e76cd6 100644
--- a/gigaevo/llm/agents/lineage.py
+++ b/gigaevo/llm/agents/lineage.py
@@ -9,12 +9,13 @@
 
 from langchain_core.messages import AIMessage, BaseMessage, HumanMessage, SystemMessage
 from langchain_openai import ChatOpenAI
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 from gigaevo.llm.agents.base import LangGraphAgent
 from gigaevo.llm.models import MultiModelRouter
 from gigaevo.programs.metrics.formatter import MetricsFormatter
 from gigaevo.programs.program import OPTIMIZATION_STAGES, Program
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 
 class TransitionInsight(BaseModel):
@@ -27,6 +28,11 @@ class TransitionInsight(BaseModel):
         description="Specific explanation with evidence (≤30 words)"
     )
 
+    @field_validator("strategy", "description", mode="after")
+    @classmethod
+    def _scrub_text(cls, value: str) -> str:
+        return sanitize_for_log(value)
+
 
 class TransitionInsights(BaseModel):
     """Collection of transition insights."""
diff --git a/gigaevo/llm/agents/memory_selector.py b/gigaevo/llm/agents/memory_selector.py
index 1592d43e..298f6c3a 100644
--- a/gigaevo/llm/agents/memory_selector.py
+++ b/gigaevo/llm/agents/memory_selector.py
@@ -14,6 +14,7 @@
 
 from gigaevo.evolution.mutation.constants import MUTATION_CONTEXT_METADATA_KEY
 from gigaevo.programs.program import Program
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 try:
     from gigaevo.memory.runtime_config import (
@@ -71,7 +72,7 @@ def _resolve_memory_backend_class(use_api: bool) -> type[Any]:
 
     def _create_memory_backend(self) -> Any | None:
         if _RUNTIME_IMPORT_ERROR is not None:
-            message = (
+            message = sanitize_for_log(
                 "gigaevo.memory is unavailable"
                 f"{': ' + str(_RUNTIME_IMPORT_ERROR) if _RUNTIME_IMPORT_ERROR else ''}"
             )
@@ -210,17 +211,19 @@ def _create_memory_backend(self) -> Any | None:
             logger.info(
                 "[MemorySelectorAgent] Using memory backend "
                 "(class={}, use_api={}, namespace={}, channel={}, checkpoint={})",
-                type(memory).__module__,
+                sanitize_for_log(type(memory).__module__),
                 use_api,
-                namespace,
-                channel,
-                memory_dir,
+                sanitize_for_log(str(namespace)),
+                sanitize_for_log(str(channel)),
+                sanitize_for_log(str(memory_dir)),
             )
             return memory
         except Exception as exc:
-            self._backend_error = str(exc)
+            safe_exc = sanitize_for_log(str(exc))
+            self._backend_error = safe_exc
             logger.warning(
-                "[MemorySelectorAgent] Failed to initialize red memory backend: {}", exc
+                "[MemorySelectorAgent] Failed to initialize red memory backend: {}",
+                safe_exc,
             )
             return None
 
@@ -259,7 +262,7 @@ async def select(
         if self.memory is None:
             logger.warning(
                 "[MemorySelectorAgent] Memory backend unavailable: {}",
-                self._backend_error or "unknown error",
+                sanitize_for_log(self._backend_error or "unknown error"),
             )
             return MemorySelection(cards=[], card_ids=[])
 
@@ -280,7 +283,10 @@ async def select(
                     self._search_with_ids, query
                 )
         except Exception as exc:
-            logger.warning("[MemorySelectorAgent] Red memory search failed: {}", exc)
+            logger.warning(
+                "[MemorySelectorAgent] Red memory search failed: {}",
+                sanitize_for_log(str(exc)),
+            )
             return MemorySelection(cards=[], card_ids=[])
 
         cards = self._parse_search_result(result_text, max_cards=max_cards)
@@ -295,7 +301,7 @@ async def select(
             logger.debug(
                 "[MemorySelectorAgent] Selected {} memory idea(s) via red agent (ids={})",
                 len(cards),
-                card_ids,
+                [sanitize_for_log(cid) for cid in card_ids],
             )
         else:
             logger.debug(
@@ -358,7 +364,7 @@ def _search_with_ids(self, query: str) -> tuple[str, list[str]]:
             except Exception as exc:
                 logger.warning(
                     "[MemorySelectorAgent] Direct GAM research failed, falling back to plain search: {}",
-                    exc,
+                    sanitize_for_log(str(exc)),
                 )
 
         assert self.memory is not None  # caller checks self.memory before calling
diff --git a/gigaevo/llm/agents/mutation.py b/gigaevo/llm/agents/mutation.py
index 8a8ee40f..371011a4 100644
--- a/gigaevo/llm/agents/mutation.py
+++ b/gigaevo/llm/agents/mutation.py
@@ -8,7 +8,7 @@
 from langchain_core.messages import BaseMessage, HumanMessage, SystemMessage
 from langchain_openai import ChatOpenAI
 from loguru import logger
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 
 from gigaevo.evolution.mutation.base import MutationSpec
 from gigaevo.evolution.mutation.constants import (
@@ -18,6 +18,7 @@
 from gigaevo.llm.agents.base import LangGraphAgent
 from gigaevo.llm.models import MultiModelRouter, get_selected_model
 from gigaevo.programs.program import Program
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 if TYPE_CHECKING:
     from gigaevo.programs.metrics.context import MetricsContext
@@ -42,6 +43,14 @@ class MutationChange(BaseModel):
         )
     )
 
+    @field_validator("description", "explanation", mode="after")
+    @classmethod
+    def _scrub_text(cls, value: str) -> str:
+        # LLM-generated free-form text; sanitize so downstream log sinks,
+        # JSON encoders, and asyncpg TEXT columns never see ANSI escape
+        # sequences, BIDI overrides, lone UTF-16 surrogates, or NUL bytes.
+        return sanitize_for_log(value)
+
 
 class MutationStructuredOutput(BaseModel):
     """Structured output from the mutation LLM.
@@ -76,6 +85,20 @@ class MutationStructuredOutput(BaseModel):
         )
     )
 
+    @field_validator("archetype", "justification", "code", mode="after")
+    @classmethod
+    def _scrub_text(cls, value: str) -> str:
+        # ``code`` is sanitized too — Python source has no legitimate use
+        # for ANSI/BIDI/C0-other-than-TAB-LF or NUL, and an LLM injecting
+        # one would otherwise break ast.parse() error formatting, log
+        # rendering, and asyncpg storage.
+        return sanitize_for_log(value)
+
+    @field_validator("insights_used", mode="after")
+    @classmethod
+    def _scrub_insights(cls, value: list[str]) -> list[str]:
+        return [sanitize_for_log(v) for v in value]
+
 
 # Re-export from canonical location for backward compatibility
 MUTATION_OUTPUT_METADATA_KEY = MutationSpec.META_OUTPUT
@@ -202,7 +225,9 @@ def _dump_prompt_to_file(
                 f.write(user)
                 f.write("\n")
         except Exception as exc:
-            logger.debug(f"[MutationAgent] prompt dump failed: {exc}")
+            logger.debug(
+                "[MutationAgent] prompt dump failed: {}", sanitize_for_log(str(exc))
+            )
 
     async def arun(self, input: list[Program], mutation_mode: str) -> dict:
         """Execute mutation agent.
@@ -258,8 +283,9 @@ async def acall_llm(self, state: MutationState) -> MutationState:
             )
 
         except Exception as e:
-            logger.error(f"[MutationAgent] Structured LLM call failed: {e}")
-            state["error"] = str(e)
+            safe_msg = sanitize_for_log(str(e))
+            logger.error("[MutationAgent] Structured LLM call failed: {}", safe_msg)
+            state["error"] = safe_msg
             state["llm_response"] = None
 
         return state
@@ -387,8 +413,10 @@ def parse_response(self, state: MutationState) -> MutationState:
         model_used = state.get("metadata", {}).get("model_used")
 
         if structured_output is None:
-            error_msg = state.get("error", "No structured output received")
-            logger.error(f"[MutationAgent] No structured output: {error_msg}")
+            error_msg = sanitize_for_log(
+                state.get("error", "No structured output received")
+            )
+            logger.error("[MutationAgent] No structured output: {}", error_msg)
             state["parsed_output"] = {
                 "code": "",
                 "structured_output": None,
@@ -450,14 +478,17 @@ def parse_response(self, state: MutationState) -> MutationState:
             )
 
         except Exception as e:
-            logger.error(f"[MutationAgent] Failed to parse structured response: {e}")
-            state["error"] = str(e)
+            safe_msg = sanitize_for_log(str(e))
+            logger.error(
+                "[MutationAgent] Failed to parse structured response: {}", safe_msg
+            )
+            state["error"] = safe_msg
             state["parsed_output"] = {
                 "code": "",
                 "structured_output": (
                     structured_output.model_dump() if structured_output else None
                 ),
-                "error": str(e),
+                "error": safe_msg,
                 "model_used": model_used,
             }
 
diff --git a/gigaevo/llm/bandit.py b/gigaevo/llm/bandit.py
index b63fe5c0..446aeb65 100644
--- a/gigaevo/llm/bandit.py
+++ b/gigaevo/llm/bandit.py
@@ -19,6 +19,7 @@
 import numpy as np
 
 from gigaevo.llm.models import MultiModelRouter, _StructuredOutputRouter
+from gigaevo.utils.text_sanitize import sanitize_for_log
 from gigaevo.utils.trackers.base import LogWriter
 
 if TYPE_CHECKING:
@@ -296,7 +297,7 @@ def on_mutation_outcome(
             self._bandit.update_reward(model_name, normalized)
             logger.debug(
                 "[BanditModelRouter] Reward for {} ({}): raw=0.0 norm={:.4f}",
-                model_name,
+                sanitize_for_log(str(model_name)),
                 outcome.value,
                 normalized,
             )
@@ -326,7 +327,7 @@ def on_mutation_outcome(
         self._bandit.update_reward(model_name, normalized)
         logger.debug(
             "[BanditModelRouter] Reward for {} ({}): raw={:.4f} norm={:.4f}",
-            model_name,
+            sanitize_for_log(str(model_name)),
             outcome.value,
             raw,
             normalized,
diff --git a/gigaevo/llm/models.py b/gigaevo/llm/models.py
index 7a810372..0f977797 100644
--- a/gigaevo/llm/models.py
+++ b/gigaevo/llm/models.py
@@ -6,6 +6,7 @@
 import os
 import random
 from typing import TYPE_CHECKING, Any, cast
+from urllib.parse import urlparse, urlunparse
 
 from langchain_core.language_models import LanguageModelInput
 from langchain_core.messages import BaseMessage
@@ -15,6 +16,7 @@
 from loguru import logger
 
 from gigaevo.llm.token_tracking import TokenTracker
+from gigaevo.utils.text_sanitize import clean_identifier, sanitize_for_log
 from gigaevo.utils.trackers.base import LogWriter
 
 if TYPE_CHECKING:
@@ -24,6 +26,37 @@
 _selected_model_var: ContextVar[str | None] = ContextVar("selected_model", default=None)
 
 
+def _redact_url(url: str) -> str:
+    """Strip userinfo (user:password@) from a URL before logging. Other
+    URL components are preserved verbatim. Returns the input unchanged
+    on parse failure."""
+    try:
+        parsed = urlparse(url)
+    except Exception:
+        return url
+    if not parsed.hostname:
+        return url
+    netloc = parsed.hostname
+    if parsed.port is not None:
+        netloc = f"{netloc}:{parsed.port}"
+    return urlunparse(parsed._replace(netloc=netloc))
+
+
+def _safe_model_name(raw: object) -> str:
+    """Validate a model name read off a ChatOpenAI instance. Strips control
+    characters and ANSI; logs a one-shot WARNING if the cleaning changes
+    the input so operators notice a misconfigured identifier."""
+    raw_str = str(raw) if raw is not None else ""
+    cleaned = clean_identifier(raw_str, max_len=128)
+    if cleaned != raw_str:
+        logger.warning(
+            "[MultiModelRouter] model_name sanitized: {!r} -> {!r}",
+            sanitize_for_log(raw_str),
+            cleaned,
+        )
+    return cleaned
+
+
 def get_selected_model() -> str | None:
     """Return the last selected model name for the current async context."""
     return _selected_model_var.get()
@@ -95,7 +128,12 @@ def __init__(
             raise ValueError("All probabilities must be positive")
 
         self.models = models
-        self.model_names = [m.model_name for m in models]
+        # ChatOpenAI.model_name comes from operator config / env interpolation
+        # / occasionally LLM-generated overrides; control characters there
+        # would propagate into every loguru ``{}`` substitution in this
+        # module and into langfuse trace identifiers. Validate once at
+        # construction.
+        self.model_names = [_safe_model_name(m.model_name) for m in models]
         self.probabilities = [p / sum(probabilities) for p in probabilities]
         self._task_model_map: dict[int, str] = {}
         self._name = name
@@ -116,12 +154,15 @@ def __init__(
             model_desc,
         )
         # Log base URLs for debugging server connectivity
-        for m in models:
+        for m, safe_name in zip(models, self.model_names):
             # ChatOpenAI exposes base_url as a property (langchain 0.1+)
             base_url = getattr(m, "base_url", None)
             if base_url:
                 logger.info(
-                    "[MultiModelRouter:{}] Model {} at {}", name, m.model_name, base_url
+                    "[MultiModelRouter:{}] Model {} at {}",
+                    name,
+                    safe_name,
+                    _redact_url(sanitize_for_log(str(base_url))),
                 )
 
         self._verify_models()
@@ -139,38 +180,45 @@ def _verify_models(self) -> None:
             if not base_url or base_url in checked:
                 continue
             checked.add(base_url)
+            # Redacted view of base_url is what enters log messages. The raw
+            # value still drives the HTTP GET below — operators need that
+            # for connectivity debugging, but it must never reach loguru.
+            safe_base_url = _redact_url(sanitize_for_log(str(base_url)))
             try:
                 url = f"{base_url}/models"
                 req = urllib.request.Request(url, method="GET")
                 with urllib.request.urlopen(req, timeout=10) as resp:  # noqa: S310
                     data = _json.loads(resp.read())
-                available = [d["id"] for d in data.get("data", [])]
-                for m in self.models:
+                # Server-returned model ids are LLM-provider-controlled text;
+                # treat them as untrusted before logging or comparing.
+                available_raw = [d["id"] for d in data.get("data", [])]
+                available = [sanitize_for_log(str(x)) for x in available_raw]
+                for m, safe_name in zip(self.models, self.model_names):
                     m_url = getattr(m, "base_url", None) or getattr(
                         m, "openai_api_base", None
                     )
                     if m_url == base_url:
-                        if m.model_name in available:
+                        if m.model_name in available_raw:
                             logger.info(
                                 "[MultiModelRouter:{}] Model {} verified on {}",
                                 self._name,
-                                m.model_name,
-                                base_url,
+                                safe_name,
+                                safe_base_url,
                             )
                         else:
                             logger.warning(
                                 "[MultiModelRouter:{}] Model {} NOT FOUND on {}. Available: {}",
                                 self._name,
-                                m.model_name,
-                                base_url,
+                                safe_name,
+                                safe_base_url,
                                 available,
                             )
             except Exception as exc:
                 logger.warning(
                     "[MultiModelRouter:{}] Cannot verify models at {}: {}",
                     self._name,
-                    base_url,
-                    exc,
+                    safe_base_url,
+                    sanitize_for_log(str(exc)),
                 )
 
     @staticmethod
diff --git a/gigaevo/llm/token_tracking.py b/gigaevo/llm/token_tracking.py
index 2e912852..98015ad0 100644
--- a/gigaevo/llm/token_tracking.py
+++ b/gigaevo/llm/token_tracking.py
@@ -2,8 +2,9 @@
 from typing import Annotated, Any
 
 from loguru import logger
-from pydantic import BaseModel, Field, SkipValidation
+from pydantic import BaseModel, Field, SkipValidation, ValidationError
 
+from gigaevo.utils.text_sanitize import clean_identifier, sanitize_for_log
 from gigaevo.utils.trackers.base import LogWriter
 
 
@@ -60,16 +61,39 @@ class TokenTracker(BaseModel):
     )
 
     def track(self, response: Any, model_name: str) -> None:
-        """Track token usage from LLM response. Thread-safe."""
+        """Track token usage from LLM response. Thread-safe.
+
+        ``model_name`` is cleaned through ``clean_identifier`` because it
+        flows into metric path components (``self._write_metrics`` joins it
+        with slashes and colons replaced) and into loguru ``{}`` slots. The
+        ``TokenUsage.from_response`` call is wrapped against ``ValidationError``
+        — a hostile provider returning ``"prompt_tokens": "lots"`` would
+        otherwise abort the whole ``ainvoke`` boundary.
+        """
         if self.writer is None:
             return
 
-        usage = TokenUsage.from_response(response)
+        safe_model_name = clean_identifier(str(model_name), max_len=128) or "unknown"
+        try:
+            usage = TokenUsage.from_response(response)
+        except (ValidationError, TypeError, ValueError) as exc:
+            logger.debug(
+                "[TokenTracker:{}] Token usage extraction failed for {}: {}",
+                self.name,
+                safe_model_name,
+                sanitize_for_log(str(exc)),
+            )
+            return
         if usage is None:
             logger.debug(
-                "[TokenTracker:{}] No token usage for {}", self.name, model_name
+                "[TokenTracker:{}] No token usage for {}",
+                self.name,
+                safe_model_name,
             )
             return
+        # Shadow original variable so the rest of the function uses the
+        # cleaned name everywhere (cumulative dict key, _write_metrics path).
+        model_name = safe_model_name
 
         with self.lock:
             if model_name not in self.cumulative:
diff --git a/gigaevo/programs/core_types.py b/gigaevo/programs/core_types.py
index 417d2b3f..4d411012 100644
--- a/gigaevo/programs/core_types.py
+++ b/gigaevo/programs/core_types.py
@@ -7,9 +7,10 @@
 from typing import Any
 
 import cloudpickle
-from pydantic import BaseModel, Field, field_serializer
+from pydantic import BaseModel, Field, field_serializer, field_validator
 
 from gigaevo.programs.utils import pickle_b64_deserialize, pickle_b64_serialize
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 
 class StageIO(BaseModel):
@@ -39,6 +40,21 @@ class StageError(BaseModel):
     stage: str | None = Field(default=None, description="Stage class name, if known")
     traceback: str | None = Field(default=None, description="Formatted traceback")
 
+    @field_validator("type", "message", mode="after")
+    @classmethod
+    def _scrub_text(cls, value: str) -> str:
+        # LLM-generated code triggers compiler errors whose stderr (from
+        # nvcc / clang / ptxas / Triton / Mojo / Pallas / CUTLASS) may carry
+        # ANSI colorization, BIDI overrides, lone surrogates, NUL bytes.
+        # Sanitize at construction so every downstream (loguru, orjson,
+        # Redis storage, re-injection back into LLM prompts) sees safe text.
+        return sanitize_for_log(value)
+
+    @field_validator("traceback", mode="after")
+    @classmethod
+    def _scrub_traceback(cls, value: str | None) -> str | None:
+        return None if value is None else sanitize_for_log(value)
+
     @classmethod
     def from_exception(
         cls,
diff --git a/gigaevo/programs/dag/dag.py b/gigaevo/programs/dag/dag.py
index b0f85cd4..7a230318 100644
--- a/gigaevo/programs/dag/dag.py
+++ b/gigaevo/programs/dag/dag.py
@@ -21,6 +21,7 @@
 )
 from gigaevo.programs.program import Program
 from gigaevo.programs.stages.base import Stage
+from gigaevo.utils.text_sanitize import sanitize_for_log
 from gigaevo.utils.trackers.base import LogWriter
 
 DEFAULT_STALL_GRACE_SECONDS = 120.0
@@ -409,11 +410,17 @@ async def _process_finished_task(
             result = cast(ProgramStageResult, outcome)
 
         if result.status == StageState.FAILED and result.error is not None:
+            # ``StageError`` field_validators already sanitize ``type``,
+            # ``message``, and ``traceback`` at construction, so
+            # ``pretty()`` returns text whose interpolated leaves are
+            # safe. The outer literal in ``pretty()`` is hardcoded.
+            # Defensive wrap guards against future fields being added to
+            # the format string without a corresponding validator.
             logger.exception(
                 "[DAG][{}] Stage '{}' FAILED with exception.\n### ERROR SUMMARY ###:\n{}",
                 pid,
                 stage_name,
-                result.error.pretty(include_traceback=True),
+                sanitize_for_log(result.error.pretty(include_traceback=True)),
             )
 
         await self._persist_stage_result(program, stage_name, result)
diff --git a/gigaevo/programs/stages/optimization/optuna/stage.py b/gigaevo/programs/stages/optimization/optuna/stage.py
index b8218632..2c7fcd8e 100644
--- a/gigaevo/programs/stages/optimization/optuna/stage.py
+++ b/gigaevo/programs/stages/optimization/optuna/stage.py
@@ -12,6 +12,7 @@
 import asyncio
 import math
 from pathlib import Path
+import re
 import time
 from typing import Any, cast
 import warnings
@@ -63,9 +64,71 @@
     run_exec_runner,
 )
 from gigaevo.programs.stages.stage_registry import StageRegistry
+from gigaevo.utils.text_sanitize import clean_identifier, sanitize_for_log
+
+# Conservative cap on Optuna parameter names. Long enough to admit
+# any reasonable snake_case identifier the LLM proposes; short enough
+# that a hostile payload of megabytes of garbage cannot bloat the
+# trial dict / optuna storage key. Matches typical SQL identifier
+# limits and leaves headroom for compound names like
+# "block_size_x_inner_loop_unroll".
+_MAX_PARAM_NAME_LEN: int = 64
 
 _DEADLINE_GRACE_S: int = 10  # post-eval margin before hard stage timeout
 
+_OPTUNA_PARAM_REF_RE = re.compile(
+    rf"(?P<prefix>{re.escape(_OPTUNA_PARAMS_NAME)}\s*\[\s*)"
+    r"(?P<literal>'(?P<single>(?:\\.|[^'\\])*)'|\"(?P<double>(?:\\.|[^\"\\])*)\")"
+    r"(?P<suffix>\s*\])"
+)
+
+
+def _dedupe_param_name(base_name: str, used_names: set[str]) -> str:
+    """Return a unique Optuna parameter name within the configured length cap."""
+
+    if base_name not in used_names:
+        return base_name
+
+    counter = 1
+    while True:
+        suffix = f"_{counter}"
+        prefix_len = max(1, _MAX_PARAM_NAME_LEN - len(suffix))
+        candidate = f"{base_name[:prefix_len]}{suffix}"
+        if candidate not in used_names:
+            return candidate
+        counter += 1
+
+
+def _string_literal_key(match: re.Match[str]) -> str | None:
+    """Decode the string key from an ``_optuna_params[...]`` regex match."""
+
+    literal = match.group("literal")
+    try:
+        value = ast.literal_eval(literal)
+    except (SyntaxError, ValueError):
+        value = match.group("single")
+        if value is None:
+            value = match.group("double")
+    return value if isinstance(value, str) else None
+
+
+def _rewrite_optuna_param_refs(snippet: str, name_map: dict[str, str]) -> str:
+    """Rewrite string-literal ``_optuna_params`` keys after name sanitization."""
+
+    if not name_map:
+        return snippet
+
+    def replace(match: re.Match[str]) -> str:
+        old_key = _string_literal_key(match)
+        if old_key is None:
+            return match.group(0)
+        new_key = name_map.get(old_key)
+        if new_key is None or new_key == old_key:
+            return match.group(0)
+        return f"{match.group('prefix')}{new_key!r}{match.group('suffix')}"
+
+    return _OPTUNA_PARAM_REF_RE.sub(replace, snippet)
+
 
 @StageRegistry.register(
     description="LLM-guided hyperparameter optimization using Optuna"
@@ -206,6 +269,38 @@ def _apply_modifications(
         ValueError
             If line ranges are invalid or if the resulting code has syntax errors.
         """
+        # LLM-derived parameter names flow into ``trial.suggest_*`` calls,
+        # which embed the name in Optuna's internal storage key and in
+        # log records. A name like ``"\x00../"`` or ``"abc‮"`` would
+        # otherwise corrupt the trial dict and any downstream sink.
+        # Clean the identifier at the boundary; if the LLM hands us a
+        # name with no surviving characters, fall back to a stable
+        # positional id so optimization can still proceed.
+        name_map: dict[str, str] = {}
+        assigned_by_original: dict[str, str] = {}
+        used_names: set[str] = set()
+        for idx, p in enumerate(search_space.parameters):
+            original_name = p.name
+            if original_name in assigned_by_original:
+                cleaned = assigned_by_original[original_name]
+            else:
+                cleaned = clean_identifier(original_name, max_len=_MAX_PARAM_NAME_LEN)
+                if not cleaned:
+                    cleaned = f"param_{idx}"
+                cleaned = _dedupe_param_name(cleaned, used_names)
+                assigned_by_original[original_name] = cleaned
+                used_names.add(cleaned)
+
+            if cleaned != original_name:
+                name_map[original_name] = cleaned
+            if cleaned != p.name:
+                logger.debug(
+                    "[Optuna] ParamSpec name sanitized: {!r} -> {!r}",
+                    sanitize_for_log(p.name),
+                    cleaned,
+                )
+                p.name = cleaned
+
         lines = original_code.splitlines()
         num_lines = len(lines)
         mods = sorted(search_space.modifications, key=lambda x: x.start_line)
@@ -230,7 +325,8 @@ def _apply_modifications(
         for mod in reversed(mods):
             start_idx = mod.start_line - 1
             end_idx = mod.end_line
-            replacement_lines = mod.parameterized_snippet.splitlines()
+            snippet = _rewrite_optuna_param_refs(mod.parameterized_snippet, name_map)
+            replacement_lines = snippet.splitlines()
             # Defensive: strip any "N | " prefix if the LLM copied the numbered format
             replacement_lines = strip_line_number_prefix(replacement_lines)
             # Re-indent to match the original block so we never get "unexpected indent"
@@ -251,14 +347,22 @@ def _apply_modifications(
         try:
             ast.parse(code)
         except SyntaxError as e:
-            logger.error(
-                "[Optuna] Parameterized code has syntax error: {}\nCode snippet around error:\n{}",
-                e,
+            # ``e.msg`` and the surrounding code lines originate from
+            # LLM output and may carry ANSI / BIDI / control bytes;
+            # sanitize each interpolation independently.
+            snippet = (
                 "\n".join(code.splitlines()[max(0, e.lineno - 5) : e.lineno + 5])
                 if e.lineno
-                else "Unknown location",
+                else "Unknown location"
             )
-            raise ValueError(f"Parameterized code syntax error: {e}")
+            logger.error(
+                "[Optuna] Parameterized code has syntax error: {}\nCode snippet around error:\n{}",
+                sanitize_for_log(str(e)),
+                sanitize_for_log(snippet),
+            )
+            raise ValueError(
+                f"Parameterized code syntax error: {sanitize_for_log(str(e))}"
+            ) from e
 
         return code
 
@@ -492,8 +596,16 @@ async def _evaluate_single(
         except TimeoutError:
             return None, None, "Timeout"
         except ExecRunnerError as exc:
+            # Sanitize compiler-stderr-derived text before it flows into
+            # StageError.message / loguru sinks downstream. The returned
+            # error string ends up in failure_reasons and ultimately in
+            # log lines aggregated for the LLM.
             last_line = (exc.stderr or "").strip().rsplit("\n", 1)[-1]
-            return None, None, f"{exc} | {last_line}"
+            return (
+                None,
+                None,
+                f"{sanitize_for_log(str(exc))} | {sanitize_for_log(last_line)}",
+            )
 
     async def _run_optuna(
         self,
@@ -1152,7 +1264,11 @@ async def compute(self, program: Program) -> OptunaOptimizationOutput:
             n,
             [p.name for p in param_specs],
         )
-        logger.debug("[Optuna][{}] LLM reasoning: {}", pid, search_space.reasoning)
+        logger.debug(
+            "[Optuna][{}] LLM reasoning: {}",
+            pid,
+            sanitize_for_log(search_space.reasoning),
+        )
 
         # 3. Run Optuna
         (
diff --git a/gigaevo/programs/stages/optimization/utils.py b/gigaevo/programs/stages/optimization/utils.py
index e58f209b..f0b1f33b 100644
--- a/gigaevo/programs/stages/optimization/utils.py
+++ b/gigaevo/programs/stages/optimization/utils.py
@@ -25,6 +25,7 @@
     ExecRunnerError,
     run_exec_runner,
 )
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 # ---------------------------------------------------------------------------
 # Shared numeric / AST helpers
@@ -244,14 +245,25 @@ async def evaluate_single(
             return result, None
 
         msg = f"Unexpected result type: {type(result).__name__} (expected dict with key '{score_key}')"
-        logger.warning("[{}] {}", log_tag, msg)
+        logger.warning("[{}] {}", log_tag, sanitize_for_log(msg))
         return None, msg
 
     except TimeoutError:
         logger.trace("[{}] single evaluation timed out", log_tag)
         return None, "Timeout"
     except ExecRunnerError as exc:
+        # exc.stderr may carry ANSI / NUL / BIDI from heterogeneous
+        # compiler stacks; the str(exc) message is sanitized too because
+        # ExecRunnerError stores arbitrary text.
         last_line = (exc.stderr or "").strip().rsplit("\n", 1)[-1]
-        logger.trace("[{}] eval failed: {} | {}", log_tag, exc, last_line)
-        # Return the actual error message so the caller can log it if critical
-        return None, f"{exc} | {last_line}"
+        safe_exc = sanitize_for_log(str(exc))
+        safe_last = sanitize_for_log(last_line)
+        logger.trace(
+            "[{}] eval failed: {} | {}",
+            log_tag,
+            safe_exc,
+            safe_last,
+        )
+        # Return the sanitized error message so callers can log / store
+        # it without re-introducing terminal control bytes.
+        return None, f"{safe_exc} | {safe_last}"
diff --git a/gigaevo/programs/stages/python_executors/execution.py b/gigaevo/programs/stages/python_executors/execution.py
index d4a28acc..3f1a1c8f 100644
--- a/gigaevo/programs/stages/python_executors/execution.py
+++ b/gigaevo/programs/stages/python_executors/execution.py
@@ -22,6 +22,7 @@
 )
 from gigaevo.programs.stages.stage_registry import StageRegistry
 from gigaevo.programs.utils import dedent_code
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 T = TypeVar("T")
 
@@ -133,12 +134,17 @@ async def compute(self, program: Program) -> ProgramStageResult | Box[Any]:
                     else "Process ran out of memory"
                 )
 
+            # Subprocess stderr may contain ANSI / NUL / BIDI / lone
+            # surrogates from heterogeneous compiler toolchains (nvcc,
+            # ptxas, Triton, Mojo). Sanitize the log interpolation; the
+            # StageError construction below is already covered by
+            # field_validators on type/message/traceback.
             logger.warning(
                 "[{}] {} FAILED for {}: {}",
                 stage_name,
                 error_type,
                 program.id[:8],
-                error_msg[:200],
+                sanitize_for_log(error_msg[:200]),
             )
             return ProgramStageResult.failure(
                 error=StageError(
@@ -153,7 +159,7 @@ async def compute(self, program: Program) -> ProgramStageResult | Box[Any]:
                 "[{}] Exception for {}: {}",
                 stage_name,
                 program.id[:8],
-                str(e)[:200],
+                sanitize_for_log(str(e)[:200]),
             )
             return ProgramStageResult.failure(
                 error=StageError.from_exception(e, stage=stage_name)
diff --git a/gigaevo/programs/stages/validation.py b/gigaevo/programs/stages/validation.py
index f32f83e9..26bcd4d9 100644
--- a/gigaevo/programs/stages/validation.py
+++ b/gigaevo/programs/stages/validation.py
@@ -12,6 +12,7 @@
 from gigaevo.programs.program import Program
 from gigaevo.programs.stages.base import Stage
 from gigaevo.programs.stages.stage_registry import StageRegistry
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 
 class CodeValidationOutput(StageIO):
@@ -73,9 +74,18 @@ async def compute(self, program: Program) -> StageIO:
         try:
             compile(code, "<string>", "exec")
         except SyntaxError as e:
+            # ``e.msg`` and ``e.text`` come from the parser operating on
+            # LLM output, which can embed control bytes that would slip
+            # into the re-raised exception's args and from there into
+            # every downstream log / serialization path. Sanitize before
+            # interpolation; the StageError validators below would catch
+            # the final log line, but the exception text itself is
+            # consumed elsewhere (e.g. ``__cause__`` chains in tests).
             code_line = (e.text or "").strip() or "<source unavailable>"
             raise SyntaxError(
-                f"SyntaxError at line {e.lineno}, offset {e.offset}: {e.msg}. Line: `{code_line}`"
+                f"SyntaxError at line {e.lineno}, offset {e.offset}: "
+                f"{sanitize_for_log(e.msg or '')}. "
+                f"Line: `{sanitize_for_log(code_line)}`"
             ) from e
 
         if self.safe_mode:
diff --git a/gigaevo/prompts/coevolution/stages.py b/gigaevo/prompts/coevolution/stages.py
index 88b6fc98..08fcc65c 100644
--- a/gigaevo/prompts/coevolution/stages.py
+++ b/gigaevo/prompts/coevolution/stages.py
@@ -21,6 +21,7 @@
 from gigaevo.programs.stages.insights_lineage import LineageAnalysesOutput, LineageStage
 from gigaevo.programs.stages.stage_registry import StageRegistry
 from gigaevo.prompts.coevolution.stats import PromptStatsProvider, prompt_text_to_id
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 
 class PromptExecutionOutput(StageIO):
@@ -58,15 +59,19 @@ async def compute(self, program: Program) -> PromptExecutionOutput:  # type: ign
             raise ValueError(
                 "Prompt program must contain 'def entrypoint()'. "
                 "Got non-Python content (possibly JSON template). "
-                f"Code starts with: {code[:80]!r}"
+                f"Code starts with: {sanitize_for_log(code[:80])!r}"
             )
         namespace: dict[str, Any] = {}
         try:
             exec(compile(code, "<prompt_program>", "exec"), namespace)  # noqa: S102
         except SyntaxError as exc:
-            raise ValueError(f"Prompt program has syntax error: {exc}") from exc
+            raise ValueError(
+                f"Prompt program has syntax error: {sanitize_for_log(str(exc))}"
+            ) from exc
         except Exception as exc:
-            raise ValueError(f"Prompt program failed to compile/exec: {exc}") from exc
+            raise ValueError(
+                f"Prompt program failed to compile/exec: {sanitize_for_log(str(exc))}"
+            ) from exc
 
         entrypoint_fn = namespace.get("entrypoint")
         if not callable(entrypoint_fn):
@@ -75,7 +80,9 @@ async def compute(self, program: Program) -> PromptExecutionOutput:  # type: ign
         try:
             result = entrypoint_fn()
         except Exception as exc:
-            raise ValueError(f"entrypoint() raised an exception: {exc}") from exc
+            raise ValueError(
+                f"entrypoint() raised an exception: {sanitize_for_log(str(exc))}"
+            ) from exc
 
         if isinstance(result, str):
             if not result.strip():
@@ -100,6 +107,16 @@ async def compute(self, program: Program) -> PromptExecutionOutput:  # type: ign
                 f"entrypoint() must return str or dict, got {type(result).__name__}"
             )
 
+        system_text = sanitize_for_log(system_text)
+        if not system_text.strip():
+            raise ValueError("entrypoint() returned empty string after sanitization")
+        if user_text is not None:
+            user_text = sanitize_for_log(user_text)
+            if not user_text.strip():
+                raise ValueError(
+                    "dict entrypoint() 'user' key became empty after sanitization"
+                )
+
         prompt_id = prompt_text_to_id(system_text, user_text=user_text)
         logger.debug(
             f"[PromptExecutionStage] Executed entrypoint(): "
diff --git a/gigaevo/prompts/coevolution/stats.py b/gigaevo/prompts/coevolution/stats.py
index 6ae1738c..70db5b97 100644
--- a/gigaevo/prompts/coevolution/stats.py
+++ b/gigaevo/prompts/coevolution/stats.py
@@ -14,6 +14,8 @@
 from loguru import logger
 from redis import asyncio as aioredis
 
+from gigaevo.utils.text_sanitize import sanitize_for_log
+
 
 @dataclass
 class PromptMutationStats:
@@ -131,8 +133,11 @@ async def get_stats(self, prompt_id: str) -> PromptMutationStats:
                         ) + float(v)
             except Exception as exc:
                 logger.warning(
-                    f"[RedisPromptStatsProvider] Error reading stats from "
-                    f"db={db} for {prompt_id}: {exc}"
+                    "[RedisPromptStatsProvider] Error reading stats from "
+                    "db={} for {}: {}",
+                    db,
+                    sanitize_for_log(str(prompt_id)),
+                    sanitize_for_log(str(exc)),
                 )
 
         if total_trials < self._min_trials:
@@ -178,7 +183,9 @@ def prompt_text_to_id(prompt_text: str, user_text: str | None = None) -> str:
     Returns:
         16-char hex string (sha256[:16])
     """
+    prompt_text = sanitize_for_log(prompt_text)
     blob = prompt_text
     if user_text is not None:
+        user_text = sanitize_for_log(user_text)
         blob = prompt_text + "\x00" + user_text
     return hashlib.sha256(blob.encode()).hexdigest()[:16]
diff --git a/gigaevo/prompts/fetcher.py b/gigaevo/prompts/fetcher.py
index eadcf9a1..dd6c67b4 100644
--- a/gigaevo/prompts/fetcher.py
+++ b/gigaevo/prompts/fetcher.py
@@ -18,6 +18,7 @@
 
 from gigaevo.prompts import load_prompt
 from gigaevo.prompts.coevolution.stats import prompt_text_to_id
+from gigaevo.utils.text_sanitize import sanitize_for_log
 
 if TYPE_CHECKING:
     from gigaevo.database.program_storage import ProgramStorage
@@ -292,7 +293,9 @@ def _refresh_candidates(self) -> list[tuple[str, float, str]] | None:
                         candidates.append((pid, fitness, code))
                 except Exception as exc:
                     logger.debug(
-                        f"[GigaEvoArchivePromptFetcher] Error parsing program {pid}: {exc}"
+                        "[GigaEvoArchivePromptFetcher] Error parsing program {}: {}",
+                        sanitize_for_log(str(pid)),
+                        sanitize_for_log(str(exc)),
                     )
                     continue
 
@@ -301,7 +304,9 @@ def _refresh_candidates(self) -> list[tuple[str, float, str]] | None:
         except Exception as exc:
             self._fetch_errors += 1
             logger.warning(
-                f"[GigaEvoArchivePromptFetcher] Archive read error (#{self._fetch_errors}): {exc}"
+                "[GigaEvoArchivePromptFetcher] Archive read error (#{}): {}",
+                self._fetch_errors,
+                sanitize_for_log(str(exc)),
             )
             return None
 
@@ -327,16 +332,26 @@ def _sample_prompt(self) -> _PromptPack | None:
         if pack is None:
             return None
 
-        user_preview = repr(pack.user[:300]) if pack.user else "None"
+        user_preview = (
+            repr(sanitize_for_log(pack.user[:300])) if pack.user else "None"
+        )
+        system_preview = repr(sanitize_for_log(pack.system[:300]))
         logger.info(
-            f"[GigaEvoArchivePromptFetcher] Sampled: {chosen_pid[:8]} "
-            f"fitness={chosen_fitness:.4f} prompt_id={pack.prompt_id} "
-            f"has_user={pack.user is not None} "
-            f"(from {len(candidates)} candidates)\n"
-            f"  SYSTEM[:{min(300, len(pack.system))}]: "
-            f"{pack.system[:300]!r}\n"
-            f"  USER[:{min(300, len(pack.user)) if pack.user else 0}]: "
-            f"{user_preview}"
+            "[GigaEvoArchivePromptFetcher] Sampled: {} "
+            "fitness={:.4f} prompt_id={} "
+            "has_user={} "
+            "(from {} candidates)\n"
+            "  SYSTEM[:{}]: {}\n"
+            "  USER[:{}]: {}",
+            sanitize_for_log(str(chosen_pid[:8])),
+            chosen_fitness,
+            sanitize_for_log(str(pack.prompt_id)),
+            pack.user is not None,
+            len(candidates),
+            min(300, len(pack.system)),
+            system_preview,
+            min(300, len(pack.user)) if pack.user else 0,
+            user_preview,
         )
         return pack
 
@@ -365,13 +380,14 @@ def _execute_entrypoint(self, code: str) -> _PromptPack | None:
                 return None
             result = entrypoint_fn()
             if isinstance(result, str):
-                if not result.strip():
+                system = sanitize_for_log(result)
+                if not system.strip():
                     logger.warning(
                         "[GigaEvoArchivePromptFetcher] entrypoint() returned empty string"
                     )
                     return None
-                pid = prompt_text_to_id(result)
-                return _PromptPack(system=result, user=None, prompt_id=pid)
+                pid = prompt_text_to_id(system)
+                return _PromptPack(system=system, user=None, prompt_id=pid)
             elif isinstance(result, dict):
                 system = result.get("system", "")
                 if not isinstance(system, str) or not system.strip():
@@ -379,23 +395,38 @@ def _execute_entrypoint(self, code: str) -> _PromptPack | None:
                         "[GigaEvoArchivePromptFetcher] dict entrypoint() missing valid 'system' key"
                     )
                     return None
+                system = sanitize_for_log(system)
+                if not system.strip():
+                    logger.warning(
+                        "[GigaEvoArchivePromptFetcher] dict entrypoint() system became empty after sanitization"
+                    )
+                    return None
                 user = result.get("user")
                 if user is not None and (not isinstance(user, str) or not user.strip()):
                     logger.warning(
                         "[GigaEvoArchivePromptFetcher] dict entrypoint() has invalid 'user' key — ignoring"
                     )
                     user = None
+                if user is not None:
+                    user = sanitize_for_log(user)
+                    if not user.strip():
+                        logger.warning(
+                            "[GigaEvoArchivePromptFetcher] dict entrypoint() user became empty after sanitization"
+                        )
+                        user = None
                 pid = prompt_text_to_id(system, user_text=user)
                 return _PromptPack(system=system, user=user, prompt_id=pid)
             else:
                 logger.warning(
-                    f"[GigaEvoArchivePromptFetcher] entrypoint() returned {type(result)}, "
-                    f"expected str or dict"
+                    "[GigaEvoArchivePromptFetcher] entrypoint() returned {}, "
+                    "expected str or dict",
+                    type(result),
                 )
                 return None
         except Exception as exc:
             logger.warning(
-                f"[GigaEvoArchivePromptFetcher] entrypoint() execution error: {exc}"
+                "[GigaEvoArchivePromptFetcher] entrypoint() execution error: {}",
+                sanitize_for_log(str(exc)),
             )
             return None
 
@@ -552,12 +583,18 @@ def record_outcome(
 
             self._redis_main_sync.set(stats_key, _json.dumps(stats))
             logger.debug(
-                f"[GigaEvoArchivePromptFetcher] Stats updated for {prompt_id}: "
-                f"trials={stats['trials']} successes={stats['successes']} "
-                f"child_fitness={child_fitness:.4f}"
+                "[GigaEvoArchivePromptFetcher] Stats updated for {}: "
+                "trials={} successes={} child_fitness={:.4f}",
+                sanitize_for_log(str(prompt_id)),
+                stats["trials"],
+                stats["successes"],
+                child_fitness,
             )
         except Exception as exc:
-            logger.warning(f"[GigaEvoArchivePromptFetcher] Stats write error: {exc}")
+            logger.warning(
+                "[GigaEvoArchivePromptFetcher] Stats write error: {}",
+                sanitize_for_log(str(exc)),
+            )
 
     def get_stats(self) -> dict[str, Any]:
         return {
diff --git a/gigaevo/runner/dag_runner.py b/gigaevo/runner/dag_runner.py
index cd8f570f..f8aabdfb 100644
--- a/gigaevo/runner/dag_runner.py
+++ b/gigaevo/runner/dag_runner.py
@@ -20,6 +20,7 @@
 from gigaevo.programs.program_state import ProgramState
 from gigaevo.runner.dag_blueprint import DAGBlueprint
 from gigaevo.utils.metrics_collector import start_metrics_collector
+from gigaevo.utils.text_sanitize import sanitize_for_log
 from gigaevo.utils.trackers.base import LogWriter
 
 
@@ -290,10 +291,14 @@ async def _maintain(self) -> None:
                 self._metrics.record_timeout()
                 logger.error("[DagScheduler] program {} timed out", info.program_id[:8])
             except Exception as e:
+                # Exception ``__str__`` from downstream subprocess /
+                # compiler stacks may carry ANSI / control bytes; wrap
+                # before loguru interpolation to keep log records inert
+                # for parsers and terminal renderers.
                 logger.error(
                     "[DagScheduler] discard after timeout failed for {}: {}",
                     info.program_id[:8],
-                    e,
+                    sanitize_for_log(str(e)),
                 )
 
         for info in finished:
@@ -308,7 +313,9 @@ async def _maintain(self) -> None:
             except Exception as e:
                 self._metrics.increment_dag_errors()
                 logger.error(
-                    "[DagScheduler] program {} failed: {}", info.program_id[:8], e
+                    "[DagScheduler] program {} failed: {}",
+                    info.program_id[:8],
+                    sanitize_for_log(str(e)),
                 )
             finally:
                 del info
@@ -340,7 +347,10 @@ async def _launch(self) -> None:
                 self._storage.get_ids_by_status(ProgramState.RUNNING.value),
             )
         except Exception as e:
-            logger.error("[DagScheduler] fetch-by-status failed: {}", e)
+            logger.error(
+                "[DagScheduler] fetch-by-status failed: {}",
+                sanitize_for_log(str(e)),
+            )
             return
 
         # Phase 2: handle orphaned RUNNING programs (fetch full data only for these)
@@ -362,10 +372,13 @@ async def _launch(self) -> None:
                         logger.error(
                             "[DagScheduler] orphan discard failed for {}: {}",
                             p.short_id,
-                            se,
+                            sanitize_for_log(str(se)),
                         )
             except Exception as e:
-                logger.error("[DagScheduler] orphan fetch failed: {}", e)
+                logger.error(
+                    "[DagScheduler] orphan fetch failed: {}",
+                    sanitize_for_log(str(e)),
+                )
 
         # Phase 3: launch fresh programs up to capacity (fetch only what we need)
         # Prefetch: create up to max_concurrent_dags * prefetch_factor tasks.
@@ -385,7 +398,10 @@ async def _launch(self) -> None:
         try:
             fresh = await self._storage.mget(to_launch_ids)
         except Exception as e:
-            logger.error("[DagScheduler] mget for launch failed: {}", e)
+            logger.error(
+                "[DagScheduler] mget for launch failed: {}",
+                sanitize_for_log(str(e)),
+            )
             return
 
         launched: list[Program] = []
@@ -406,9 +422,14 @@ async def _launch(self) -> None:
                 import traceback
 
                 logger.error(
-                    "[DagScheduler] DAG build failed for {}: {}", program.short_id, e
+                    "[DagScheduler] DAG build failed for {}: {}",
+                    program.short_id,
+                    sanitize_for_log(str(e)),
+                )
+                logger.error(
+                    "[DagScheduler] Traceback:\n{}",
+                    sanitize_for_log(traceback.format_exc()),
                 )
-                logger.error("[DagScheduler] Traceback:\n{}", traceback.format_exc())
                 self._metrics.record_build_failure()
                 try:
                     await self._state_manager.set_program_state(
@@ -418,7 +439,7 @@ async def _launch(self) -> None:
                     logger.error(
                         "[DagScheduler] state update failed for {}: {}",
                         program.short_id,
-                        se,
+                        sanitize_for_log(str(se)),
                     )
                     self._metrics.record_state_update_failure()
                 continue
@@ -447,7 +468,10 @@ async def _run_one(prog: Program = program, dag_inst: DAG = dag) -> None:
                 self._metrics.dag_runs_started += count
                 logger.info("[DagScheduler] launched {} programs", count)
             except Exception as e:
-                logger.error("[DagScheduler] batch mark-started failed: {}", e)
+                logger.error(
+                    "[DagScheduler] batch mark-started failed: {}",
+                    sanitize_for_log(str(e)),
+                )
                 # Cancel tasks whose state transition failed
                 for pid in launched_ids:
                     info = self._active.pop(pid, None)
@@ -461,8 +485,13 @@ async def _execute_dag(self, dag: DAG, program: Program) -> None:
             await dag.run(program)
         except Exception as exc:
             ok = False
+            # ``exc`` may originate from Triton / CUDA / Mojo / nvcc
+            # subprocess stderr propagated as an exception message;
+            # sanitize before loguru emits the record.
             logger.error(
-                "[DagScheduler] DAG run failed for {}: {}", program.short_id, exc
+                "[DagScheduler] DAG run failed for {}: {}",
+                program.short_id,
+                sanitize_for_log(str(exc)),
             )
         finally:
             # Eagerly release references to allow GC of heavy objects.
@@ -497,7 +526,7 @@ async def _execute_dag(self, dag: DAG, program: Program) -> None:
                 logger.error(
                     "[DagScheduler] state update failed for {}: {}",
                     program.short_id,
-                    se,
+                    sanitize_for_log(str(se)),
                 )
 
     async def _flush_done_queue(self) -> None:
@@ -519,7 +548,7 @@ async def _flush_done_queue(self) -> None:
             logger.error(
                 "[DagScheduler] batch RUNNING→DONE failed for {} programs: {}",
                 len(batch),
-                e,
+                sanitize_for_log(str(e)),
             )
 
     async def _cancel_task(self, info: TaskInfo) -> None:
diff --git a/gigaevo/utils/json.py b/gigaevo/utils/json.py
index cb771d60..3ad0d2ae 100644
--- a/gigaevo/utils/json.py
+++ b/gigaevo/utils/json.py
@@ -4,6 +4,8 @@
 import types
 from typing import Any
 
+from gigaevo.utils.text_sanitize import deep_sanitize_for_json
+
 __all__ = ["dumps", "loads", "json"]
 
 json: types.ModuleType
@@ -12,8 +14,15 @@
     import orjson as _orjson
 
     def dumps(obj: Any) -> str:
-        """Serialize *obj* to a ``str`` using orjson (bytes -> str)."""
-        return _orjson.dumps(obj).decode()
+        """Serialize *obj* to a ``str`` using orjson (bytes -> str).
+
+        Walks ``obj`` first to replace lone UTF-16 surrogates with U+FFFD.
+        orjson (and stdlib ``json``) raise ``UnicodeEncodeError`` on lone
+        surrogates; LLM-derived text frequently carries them on the path
+        from Triton / CUDA / CUTLASS / Mojo error formatters. The walk is
+        a no-op for clean structures.
+        """
+        return _orjson.dumps(deep_sanitize_for_json(obj)).decode()
 
     def loads(data: str | bytes | bytearray) -> Any:
         """Deserialize *data* using orjson."""
@@ -24,8 +33,11 @@ def loads(data: str | bytes | bytearray) -> Any:
 except ModuleNotFoundError:  # pragma: no cover -- dev/test envs without orjson
 
     def dumps(obj: Any) -> str:  # type: ignore[misc]  # redefinition for fallback branch
-        """Serialize *obj* to a ``str`` using the stdlib *json* module."""
-        return _stdlib_json.dumps(obj)
+        """Serialize *obj* to a ``str`` using the stdlib *json* module.
+
+        See the orjson branch for the surrogate-scrub rationale.
+        """
+        return _stdlib_json.dumps(deep_sanitize_for_json(obj))
 
     def loads(data: str | bytes | bytearray) -> Any:  # type: ignore[misc]  # redefinition for fallback branch
         """Deserialize *data* using the stdlib *json* module."""
diff --git a/gigaevo/utils/text_sanitize.py b/gigaevo/utils/text_sanitize.py
new file mode 100644
index 00000000..c67d107b
--- /dev/null
+++ b/gigaevo/utils/text_sanitize.py
@@ -0,0 +1,198 @@
+"""Pure text sanitization for LLM-derived strings.
+
+Three increasingly strict modes that compose freely. Most callers want
+``sanitize_for_log``; the other two are minimal helpers for cases where
+the destination only rejects a narrower set of bytes.
+
+All functions are pure ``str -> str``, idempotent, and preserve printable
+Unicode (CJK, Greek letters, math symbols, emoji, directional arrows).
+Lone UTF-16 surrogates always collapse to U+FFFD.
+
+The threat surface this module guards covers compiler error text from
+heterogeneous LLM targets (Python tracebacks, Triton MLIR diagnostics,
+nvcc / ptxas / CUTLASS template explosions with embedded ANSI from gcc /
+clang colorization, Mojo error formatter output with Unicode arrows,
+Pallas / JAX jaxpr traces with ASCII art, CuTe layout errors with
+``Layout<Shape<...>,Stride<...>>`` template syntax). Each toolchain emits
+its own conventions; the sanitizers reject what would break log files,
+JSON encoders, or Postgres TEXT columns, and preserve everything else.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Final
+
+# ============================================================================
+# Compiled patterns (private)
+# ============================================================================
+
+
+# ANSI escape sequences. Covers CSI (the common ``\x1b[...m`` colorization
+# from gcc / clang / nvcc), OSC (xterm title-setting and similar), DCS / SOS
+# / PM / APC string sequences, and single-character Fe escapes. Reference:
+# ECMA-48 + xterm Ctrl Sequences.
+_ANSI_RE: Final[re.Pattern[str]] = re.compile(
+    r"\x1b\[[0-?]*[ -/]*[@-~]"  # CSI: ESC [ params intermediates final
+    r"|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)"  # OSC: ESC ] ... BEL or ST
+    r"|\x1b[PX^_][^\x1b]*\x1b\\"  # DCS / SOS / PM / APC: ESC X ... ST
+    r"|\x1b[@-Z\\-_]"  # Fe single-char: ESC <C1 byte>
+)
+
+# C0 controls (0x00-0x1F + 0x7F DEL) except TAB (0x09) and LF (0x0A). CR
+# (0x0D) is included so log-line forgery via "\r\nFAKE LINE" is defused
+# while real multi-line tracebacks (which use LF only) pass through.
+_C0_RE: Final[re.Pattern[str]] = re.compile(r"[\x00-\x08\x0b-\x1f\x7f]")
+
+# C1 controls (0x80-0x9F). Rare in modern output but legal in Python str and
+# capable of confusing terminal parsers.
+_C1_RE: Final[re.Pattern[str]] = re.compile(r"[\x80-\x9f]")
+
+# Unicode BIDI overrides and isolates (U+202A..U+202E plus U+2066..U+2069).
+# Invisible characters used to spoof text directionality; have no place in
+# machine-readable log records.
+_BIDI_RE: Final[re.Pattern[str]] = re.compile(r"[‪-‮⁦-⁩]")
+
+# UTF-16 surrogate code points (U+D800-U+DFFF). Python ``str`` is sequence-of-
+# code-points, not UTF-16, so a "high then low" pair is NOT decoded as one
+# astral character; both halves remain independent code points that the
+# UTF-8 encoder refuses (``surrogates not allowed``). Match every surrogate
+# unconditionally and replace with U+FFFD. Real astral characters in Python
+# ``str`` are single code points above U+FFFF, never surrogate pairs.
+_LONE_SURROGATE_RE: Final[re.Pattern[str]] = re.compile(r"[\ud800-\udfff]")
+
+# Identifier strip pattern. Anything outside the conservative charset is
+# removed. Slash and colon are permitted because model names sometimes
+# carry path-like or provider-prefix forms (``openai:gpt-4o-mini``,
+# ``/local/path/to/model.gguf``); ``@`` is permitted because some configs
+# route via ``model@host:port`` against local vllm / sglang / tgi servers.
+_IDENTIFIER_STRIP_RE: Final[re.Pattern[str]] = re.compile(r"[^A-Za-z0-9._:/+@\-]")
+
+
+def _escape_control(match: re.Match[str]) -> str:
+    return f"\\x{ord(match.group()):02x}"
+
+
+# ============================================================================
+# Public API
+# ============================================================================
+
+
+def sanitize_for_log(text: str) -> str:
+    """Make ``text`` safe for log sinks, JSON encoders, and Postgres TEXT.
+
+    Strips ANSI escape sequences (no terminal control on log readers), strips
+    BIDI overrides (no directional spoofing in log records), escapes C0 and
+    C1 control characters except TAB and LF (visible but inert; for example
+    ``\\x07`` BEL becomes the four-character literal ``\\x07``, and
+    ``\\x0d`` CR is escaped so single-line log records cannot be forged via
+    carriage-return overwriting), and replaces lone UTF-16 surrogates with
+    U+FFFD. Result is valid UTF-8, safe for ``json.dumps`` /
+    ``model_dump_json``, and safe for ``asyncpg`` TEXT columns.
+
+    LF (``\\n``) is preserved so legitimate multi-line tracebacks survive.
+    A consequence is that a hostile string containing ``"\\n[FORGED]"``
+    will produce a second line in plain-text log sinks. Reasonable log
+    parsers should recognize that authentic entries begin with a timestamp
+    prefix and treat untimestamped continuations accordingly. Callers that
+    cannot accept this residual risk (for example, plain-text sinks read
+    by line-naive consumers) should pipeline through a stricter step that
+    escapes ``\\n`` as well.
+    """
+    text = _ANSI_RE.sub("", text)
+    text = _BIDI_RE.sub("", text)
+    text = _C0_RE.sub(_escape_control, text)
+    text = _C1_RE.sub(_escape_control, text)
+    text = _LONE_SURROGATE_RE.sub("�", text)
+    return text
+
+
+def sanitize_for_json(text: str) -> str:
+    """Minimum-viable fix for JSON encoders. Replaces lone UTF-16 surrogates
+    with U+FFFD so ``json.dumps`` and ``pydantic.model_dump_json`` succeed.
+    Preserves every other byte verbatim — control characters, ANSI escape
+    sequences, BIDI overrides all pass through. Compose with
+    ``sanitize_for_log`` when the destination also forbids those.
+    """
+    return _LONE_SURROGATE_RE.sub("�", text)
+
+
+def sanitize_for_dbtext(text: str) -> str:
+    """Make ``text`` safe for Postgres TEXT columns through asyncpg.
+
+    Handles two failure modes asyncpg surfaces on LLM-derived text. First,
+    the driver rejects literal NUL bytes outright (``A string literal cannot
+    contain NUL (0x00) characters``) — NUL is replaced with U+FFFD. Second,
+    asyncpg UTF-8 encodes string values before sending them on the wire,
+    and Python's UTF-8 encoder refuses lone UTF-16 surrogates; those are
+    also replaced with U+FFFD. ANSI escape sequences and other control
+    bytes pass through verbatim because Postgres TEXT accepts them; compose
+    with ``sanitize_for_log`` when the column is also displayed to humans
+    or consumed by log readers.
+    """
+    text = text.replace("\x00", "�")
+    text = _LONE_SURROGATE_RE.sub("�", text)
+    return text
+
+
+def deep_sanitize_for_json(value: object) -> object:
+    """Walk a JSON-shaped structure and apply ``sanitize_for_json`` to every
+    string leaf. Lists / tuples / dicts are rebuilt recursively; primitive
+    non-string values (``int`` / ``float`` / ``bool`` / ``None``) pass
+    through unchanged.
+
+    Use at the boundary where an arbitrary container of LLM-derived text
+    will be handed to ``json.dumps`` / ``orjson.dumps`` / pydantic
+    ``model_dump_json``. A single lone surrogate buried anywhere in the
+    structure would otherwise raise ``UnicodeEncodeError`` from inside the
+    serializer and abort the write. This is the cheap belt that stops
+    those aborts without rewriting every producer.
+
+    Returns ``object`` rather than a tight type because the input shape is
+    arbitrary JSON. Callers narrow at the call site via ``cast`` or by
+    knowing the input shape; the function preserves the outermost
+    container type (``dict`` stays ``dict``, ``list`` stays ``list``,
+    ``tuple`` stays ``tuple``).
+    """
+    if isinstance(value, str):
+        return sanitize_for_json(value)
+    if isinstance(value, dict):
+        return {
+            deep_sanitize_for_json(k): deep_sanitize_for_json(v)
+            for k, v in value.items()
+        }
+    if isinstance(value, list):
+        return [deep_sanitize_for_json(v) for v in value]
+    if isinstance(value, tuple):
+        return tuple(deep_sanitize_for_json(v) for v in value)
+    return value
+
+
+def clean_identifier(text: str, *, max_len: int | None = None) -> str:
+    """Strip every character outside the conservative identifier charset
+    ``[A-Za-z0-9._:/+@-]`` and optionally truncate to ``max_len`` characters.
+
+    Returns an empty string if nothing in ``text`` survives. Callers decide
+    whether to reject, fall back to a default, or warn. Intended for places
+    where a string must be a stable, displayable, file-system-safe
+    identifier (model names, cache keys, log tags).
+
+    Raises ``ValueError`` if ``max_len`` is negative; the slice ``[:negative]``
+    would silently drop trailing characters without warning, which is almost
+    never what the caller meant.
+    """
+    if max_len is not None and max_len < 0:
+        raise ValueError(f"max_len must be non-negative, got {max_len}")
+    cleaned = _IDENTIFIER_STRIP_RE.sub("", text)
+    if max_len is not None and len(cleaned) > max_len:
+        cleaned = cleaned[:max_len]
+    return cleaned
+
+
+__all__ = (
+    "clean_identifier",
+    "deep_sanitize_for_json",
+    "sanitize_for_dbtext",
+    "sanitize_for_json",
+    "sanitize_for_log",
+)
diff --git a/gigaevo/utils/trackers/backends/redis.py b/gigaevo/utils/trackers/backends/redis.py
index f5ed5bd9..04056558 100644
--- a/gigaevo/utils/trackers/backends/redis.py
+++ b/gigaevo/utils/trackers/backends/redis.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import json
 import threading
 import time
@@ -8,6 +9,12 @@
 from loguru import logger
 import redis
 
+from gigaevo.utils.text_sanitize import (
+    clean_identifier,
+    deep_sanitize_for_json,
+    sanitize_for_dbtext,
+    sanitize_for_log,
+)
 from gigaevo.utils.trackers.configs import RedisMetricsConfig
 from gigaevo.utils.trackers.core import LoggerBackend
 
@@ -31,10 +38,21 @@ def __init__(self, cfg: RedisMetricsConfig):
     def _k_latest(self) -> str:
         return f"{self.cfg.key_prefix}:latest"
 
+    def _field_tag(self, tag: str) -> str:
+        """Return the stable Redis hash/list field for a metric tag."""
+
+        safe_tag = clean_identifier(tag, max_len=128)
+        if safe_tag:
+            return safe_tag
+
+        digest = hashlib.sha256(sanitize_for_log(tag).encode()).hexdigest()[:12]
+        return f"metric_{digest}"
+
     def _k_history(self, tag: str) -> str:
-        # Sanitize tag for Redis key
-        safe_tag = tag.replace("/", ":").replace(" ", "_")
-        return f"{self.cfg.key_prefix}:history:{safe_tag}"
+        # Sanitize tag for Redis key: strict identifier charset only.
+        # Defends against ANSI / BIDI / control bytes in LLM-derived tags
+        # that the previous ad-hoc replace() missed.
+        return f"{self.cfg.key_prefix}:history:{self._field_tag(tag)}"
 
     def _k_meta(self) -> str:
         return f"{self.cfg.key_prefix}:meta"
@@ -82,10 +100,13 @@ def write_hist(self, tag: str, values: Any, step: int, wall_time: float) -> None
             self._buffer.append(entry)
 
     def write_text(self, tag: str, text: str, step: int, wall_time: float) -> None:
+        # Sanitize the text payload at the boundary so LLM-derived strings
+        # with NUL bytes or lone surrogates do not poison the latest-hash
+        # value or the JSON history entry.
         entry = {
             "kind": "text",
             "tag": tag,
-            "value": text,
+            "value": sanitize_for_dbtext(text),
             "step": step,
             "wall_time": wall_time,
         }
@@ -105,7 +126,12 @@ def flush(self) -> None:
             pipe = self._client.pipeline(transaction=False)
 
             for entry in buf:
-                tag = entry["tag"]
+                # Sanitize the tag at the Redis boundary. The wire encoder
+                # rejects lone UTF-16 surrogates and is also unhappy with
+                # NUL inside a field name on some clients; clean_identifier
+                # gives a stable, displayable field name regardless of what
+                # an LLM-derived tag carried.
+                tag = self._field_tag(str(entry["tag"]))
                 step = entry["step"]
                 wall_time = entry["wall_time"]
                 kind = entry["kind"]
@@ -119,7 +145,10 @@ def flush(self) -> None:
 
                 # Store history if enabled
                 if self.cfg.store_history:
-                    history_entry = json.dumps(
+                    # deep_sanitize_for_json defuses lone surrogates buried
+                    # in histogram value lists or text strings before they
+                    # reach json.dumps, which would otherwise raise.
+                    payload = deep_sanitize_for_json(
                         {
                             "s": step,
                             "t": wall_time,
@@ -127,6 +156,7 @@ def flush(self) -> None:
                             "k": kind,
                         }
                     )
+                    history_entry = json.dumps(payload)
                     history_key = self._k_history(tag)
                     pipe.rpush(history_key, history_entry)
                     # Trim to max size (FIFO)
@@ -137,7 +167,9 @@ def flush(self) -> None:
             pipe.execute()
 
         except Exception as e:
-            logger.warning("[RedisMetricsBackend] Flush failed: {}", e)
+            logger.warning(
+                "[RedisMetricsBackend] Flush failed: {}", sanitize_for_log(str(e))
+            )
 
     def clear_series(self, tag: str) -> None:
         """Delete the history list for *tag* so it can be rewritten."""
@@ -148,7 +180,9 @@ def clear_series(self, tag: str) -> None:
             self._client.delete(history_key)
         except Exception as e:
             logger.warning(
-                "[RedisMetricsBackend] clear_series failed for {}: {}", tag, e
+                "[RedisMetricsBackend] clear_series failed for {}: {}",
+                sanitize_for_log(tag),
+                sanitize_for_log(str(e)),
             )
 
     # --------------------- Query Methods ---------------------
@@ -160,15 +194,18 @@ def get_latest(self, tag: str | None = None) -> dict[str, Any]:
             return {}
         try:
             if tag:
-                val = client.hget(self._k_latest(), tag)
+                field = self._field_tag(tag)
+                val = client.hget(self._k_latest(), field)
                 if val is None:
                     return {}
-                return {tag: float(str(val))}
+                return {field: self._parse_value(str(val))}
             else:
                 data = client.hgetall(self._k_latest())
                 return {k: self._parse_value(str(v)) for k, v in data.items()}
         except Exception as e:
-            logger.warning("[RedisMetricsBackend] get_latest failed: {}", e)
+            logger.warning(
+                "[RedisMetricsBackend] get_latest failed: {}", sanitize_for_log(str(e))
+            )
             return {}
 
     def get_history(
@@ -182,7 +219,9 @@ def get_history(
             entries = client.lrange(self._k_history(tag), start, end)
             return [json.loads(str(e)) for e in entries]
         except Exception as e:
-            logger.warning("[RedisMetricsBackend] get_history failed: {}", e)
+            logger.warning(
+                "[RedisMetricsBackend] get_history failed: {}", sanitize_for_log(str(e))
+            )
             return []
 
     def list_metrics(self) -> list[str]:
@@ -193,7 +232,9 @@ def list_metrics(self) -> list[str]:
         try:
             return [str(k) for k in client.hkeys(self._k_latest())]
         except Exception as e:
-            logger.warning("[RedisMetricsBackend] list_metrics failed: {}", e)
+            logger.warning(
+                "[RedisMetricsBackend] list_metrics failed: {}", sanitize_for_log(str(e))
+            )
             return []
 
     @staticmethod
diff --git a/tests/dag/test_sanitize_integration.py b/tests/dag/test_sanitize_integration.py
new file mode 100644
index 00000000..c1415701
--- /dev/null
+++ b/tests/dag/test_sanitize_integration.py
@@ -0,0 +1,117 @@
+"""Hostile-input integration tests for the sanitizer wiring in
+``gigaevo/programs/dag/dag.py`` and ``gigaevo/runner/dag_runner.py``.
+
+We exercise the exact log lines wrapped with ``sanitize_for_log`` by
+constructing exceptions whose ``__str__`` carries ANSI / NUL / BIDI and
+asserting the captured loguru output contains no raw control bytes.
+"""
+
+from __future__ import annotations
+
+import re
+
+from loguru import logger
+
+from gigaevo.programs.core_types import StageError
+
+# Patterns the sanitizer must strip.
+_ANSI_RE = re.compile(r"\x1b\[")
+_BIDI_RE = re.compile(r"[‪-‮⁦-⁩]")
+_C0_RAW_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+
+
+def _capture():
+    """Attach a list-sink to loguru. Returns (list, sink_id)."""
+    captured: list[str] = []
+    sink_id = logger.add(captured.append, format="{message}", level="TRACE")
+    return captured, sink_id
+
+
+def _assert_clean(captured: list[str]) -> None:
+    joined = "\n".join(captured)
+    assert not _ANSI_RE.search(joined), f"ANSI escape leaked: {joined!r}"
+    assert not _BIDI_RE.search(joined), f"BIDI override leaked: {joined!r}"
+    assert not _C0_RAW_RE.search(joined), f"Raw C0 control leaked: {joined!r}"
+
+
+class TestDagRunnerErrorLogSanitization:
+    """The ``DagRunner`` interpolates the ``__str__`` of caught
+    exceptions into ``logger.error`` lines. After the sanitizer wiring,
+    a hostile exception message must arrive at the sink in escaped form.
+    """
+
+    def test_sanitize_for_log_module_is_wired(self):
+        """Smoke test: the dag_runner module imports the sanitizer."""
+        from gigaevo.runner import dag_runner
+
+        assert hasattr(dag_runner, "sanitize_for_log")
+
+    def test_hostile_exception_string_is_escaped(self):
+        """Simulate the wrapped log call directly. This is the exact
+        idiom every error path in dag_runner.py now uses."""
+        from gigaevo.runner.dag_runner import sanitize_for_log
+
+        captured, sink_id = _capture()
+        try:
+            exc = RuntimeError("\x1b[31mCUDA OOM\x1b[0m\nat \x00addr ‮swap")
+            logger.error(
+                "[DagScheduler] program {} failed: {}",
+                "deadbeef",
+                sanitize_for_log(str(exc)),
+            )
+            _assert_clean(captured)
+            # The visible text "CUDA OOM" must survive — sanitizer
+            # preserves printable content.
+            assert "CUDA OOM" in "\n".join(captured)
+        finally:
+            logger.remove(sink_id)
+
+    def test_traceback_format_exc_is_escaped(self):
+        """``traceback.format_exc()`` from a thrown hostile exception
+        is also wrapped by the new logging path."""
+        from gigaevo.runner.dag_runner import sanitize_for_log
+
+        captured, sink_id = _capture()
+        try:
+            try:
+                raise ValueError("\x1b[31mbad\x1b[0m\x00")
+            except ValueError:
+                import traceback as tb
+
+                logger.error(
+                    "[DagScheduler] Traceback:\n{}",
+                    sanitize_for_log(tb.format_exc()),
+                )
+            _assert_clean(captured)
+        finally:
+            logger.remove(sink_id)
+
+
+class TestDagStageErrorPretty:
+    """``DAG._process_finished_task`` now wraps ``error.pretty()``.
+    Verify the StageError model + the wrap together yield clean text
+    on hostile input."""
+
+    def test_stage_error_pretty_is_safe(self):
+        # StageError validators scrub ``type`` / ``message`` /
+        # ``traceback`` at construction. ``stage`` is supplied
+        # internally (canonical class names — no LLM influence), so it
+        # is not scrubbed. The dag-side ``sanitize_for_log`` wrap is
+        # the defensive belt for the whole ``pretty()`` string.
+        from gigaevo.utils.text_sanitize import sanitize_for_log
+
+        err = StageError(
+            type="\x1b[31mError\x1b[0m",
+            message="\x00invalid\x1b[0m",
+            stage="HostileStage",
+            traceback="line1\n\x1b[31mline2\x1b[0m\n‮line3",
+        )
+        rendered = sanitize_for_log(err.pretty(include_traceback=True))
+        assert "\x1b[" not in rendered
+        assert "\x00" not in rendered
+        assert "‮" not in rendered
+
+    def test_dag_module_imports_sanitizer(self):
+        from gigaevo.programs.dag import dag as dag_mod
+
+        assert hasattr(dag_mod, "sanitize_for_log")
diff --git a/tests/llm/test_insights_scoring_agents.py b/tests/llm/test_insights_scoring_agents.py
index 38600d4d..de0b19e1 100644
--- a/tests/llm/test_insights_scoring_agents.py
+++ b/tests/llm/test_insights_scoring_agents.py
@@ -359,3 +359,69 @@ def test_non_program_score_raises(self):
         }
         with pytest.raises(ValueError, match="Expected ProgramScore"):
             agent.parse_response(state)
+
+
+# ---------------------------------------------------------------------------
+# ProgramInsight field validators — schema-layer sanitization
+# ---------------------------------------------------------------------------
+
+
+class TestProgramInsightFieldSanitization:
+    """ProgramInsight str fields receive LLM output verbatim and must scrub
+    ANSI / BIDI overrides / lone surrogates / control bytes before the value
+    flows into reports, JSON dumps, Postgres TEXT columns, or re-injection
+    back into LLM prompts as part of a multi-agent loop."""
+
+    def test_clean_input_passes_through(self):
+        insight = ProgramInsight(
+            type="performance",
+            insight="The inner loop dominates wall time on N>1000.",
+            tag="hotspot",
+            severity="medium",
+        )
+        assert insight.type == "performance"
+        assert insight.insight == "The inner loop dominates wall time on N>1000."
+        assert insight.tag == "hotspot"
+        assert insight.severity == "medium"
+
+    def test_ansi_escape_in_insight_field_stripped(self):
+        insight = ProgramInsight(
+            type="perf",
+            insight="\x1b[31mred\x1b[0m: cache miss on hot path",
+            tag="cache",
+            severity="high",
+        )
+        assert "\x1b" not in insight.insight
+        assert "red: cache miss on hot path" in insight.insight
+
+    def test_lone_surrogate_replaced_in_type(self):
+        insight = ProgramInsight(
+            type="perf\ud83d",
+            insight="ok",
+            tag="t",
+            severity="low",
+        )
+        assert "\ud83d" not in insight.type
+        # Result must be UTF-8 encodable and JSON-serializable.
+        insight.type.encode("utf-8")
+        insight.model_dump_json()
+
+    def test_cr_in_severity_does_not_forge_log_line(self):
+        insight = ProgramInsight(
+            type="t",
+            insight="ok",
+            tag="t",
+            severity="high\r\n[FAKE LINE]",
+        )
+        assert "\r" not in insight.severity
+
+    def test_unicode_arrows_and_math_symbols_preserved(self):
+        # Mojo and Pallas error formatters carry these legitimately; the
+        # validator must not strip printable Unicode the operator wants to see.
+        insight = ProgramInsight(
+            type="formal",
+            insight="∀x ∈ ℝ → ℂ holds after the rewrite",
+            tag="t",
+            severity="low",
+        )
+        assert insight.insight == "∀x ∈ ℝ → ℂ holds after the rewrite"
diff --git a/tests/llm/test_lineage_agent.py b/tests/llm/test_lineage_agent.py
index e811930f..4cae487b 100644
--- a/tests/llm/test_lineage_agent.py
+++ b/tests/llm/test_lineage_agent.py
@@ -616,3 +616,58 @@ async def _capture(state):
         assert captured_state["child"] is child
         assert captured_state["metadata"]["parent_id"] == parent.id
         assert captured_state["metadata"]["child_id"] == child.id
+
+
+# ---------------------------------------------------------------------------
+# TransitionInsight field validators — schema-layer sanitization
+# ---------------------------------------------------------------------------
+
+
+class TestTransitionInsightFieldSanitization:
+    """TransitionInsight str fields receive LLM output verbatim and must scrub
+    ANSI / BIDI overrides / lone surrogates / control bytes before the value
+    flows into reports, JSON dumps, Postgres TEXT columns, or re-injection
+    back into LLM prompts."""
+
+    def test_clean_input_passes_through(self):
+        ti = TransitionInsight(
+            strategy="imitation",
+            description="Parent's loop tiling improved cache locality 1.8x.",
+        )
+        assert ti.strategy == "imitation"
+        assert ti.description == "Parent's loop tiling improved cache locality 1.8x."
+
+    def test_ansi_escape_in_description_stripped(self):
+        ti = TransitionInsight(
+            strategy="avoidance",
+            description="\x1b[31mreverted\x1b[0m fused-mul-add — slower on this GPU",
+        )
+        assert "\x1b" not in ti.description
+        assert "reverted" in ti.description
+
+    def test_lone_surrogate_replaced_in_strategy(self):
+        ti = TransitionInsight(
+            strategy="exploration\ud83d",
+            description="ok",
+        )
+        assert "\ud83d" not in ti.strategy
+        ti.strategy.encode("utf-8")
+        ti.model_dump_json()
+
+    def test_cr_in_description_does_not_forge_log_line(self):
+        ti = TransitionInsight(
+            strategy="generalization",
+            description="moved threshold higher\r\n[FAKE LINE]",
+        )
+        assert "\r" not in ti.description
+
+    def test_unicode_arrows_preserved(self):
+        # Mojo / Pallas error formatters carry U+2192; CUTLASS-style template
+        # syntax in descriptions must survive verbatim.
+        ti = TransitionInsight(
+            strategy="imitation",
+            description="Shape<_32,_128> → Shape<_64,_64> halves register pressure",
+        )
+        assert ti.description == (
+            "Shape<_32,_128> → Shape<_64,_64> halves register pressure"
+        )
diff --git a/tests/llm/test_sanitize_wiring.py b/tests/llm/test_sanitize_wiring.py
new file mode 100644
index 00000000..1c000934
--- /dev/null
+++ b/tests/llm/test_sanitize_wiring.py
@@ -0,0 +1,464 @@
+"""Integration tests that prove the sanitizer is wired into LLM call sites.
+
+Each test drives a hostile string (ANSI escape, NUL, lone surrogate, BIDI
+override, CR carriage-return) through the production call site and asserts
+the destination — a real loguru sink, a JSON dump, or pydantic field state —
+never sees the raw hostile bytes.
+
+The tests intentionally use the production logging path (``loguru.logger``
+with a captured ``StringIO`` sink) so that a regression that silently drops
+a ``sanitize_for_log`` wrap surfaces as a hostile byte reappearing in the
+captured output. They are organized one class per modified file under
+``gigaevo/llm/``.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock
+
+from loguru import logger
+import pytest
+
+from gigaevo.llm.agents.mutation import (
+    MutationAgent,
+    MutationChange,
+    MutationState,
+    MutationStructuredOutput,
+)
+from gigaevo.llm.bandit import BanditModelRouter, MutationOutcome
+from gigaevo.llm.models import MultiModelRouter, _redact_url
+from gigaevo.llm.token_tracking import TokenTracker
+from gigaevo.programs.program import Program
+from tests.conftest import NullWriter
+
+
+# ---------------------------------------------------------------------------
+# Shared hostile-input fixtures (kept consistent with tests/utils/...)
+# ---------------------------------------------------------------------------
+
+LONE_HIGH = "\ud83d"
+HOSTILE = (
+    "\x1b[31merr\x1b[0m"  # ANSI red
+    "\x00NUL"  # NUL
+    "\rCR"  # CR forgery
+    "\x07BEL"  # bell
+    f"{LONE_HIGH}LS"  # lone surrogate
+    "‮RLO"  # RLO BIDI override
+)
+
+
+@pytest.fixture
+def loguru_sink():
+    """Add a string-buffer loguru sink, yield it, tear down."""
+    buf = io.StringIO()
+    sink_id = logger.add(buf, format="{message}", level="DEBUG")
+    yield buf
+    logger.remove(sink_id)
+
+
+def _assert_no_raw_hostile(captured: str) -> None:
+    assert "\x1b" not in captured, "raw ANSI ESC survived"
+    assert "\x00" not in captured, "raw NUL survived"
+    assert "\x07" not in captured, "raw BEL survived"
+    assert LONE_HIGH not in captured, "lone surrogate survived"
+    assert "‮" not in captured, "BIDI RLO survived"
+    # Captured string must encode cleanly as UTF-8 (loguru already wrote it).
+    captured.encode("utf-8")
+
+
+def _mock_model(name: str) -> MagicMock:
+    m = MagicMock()
+    m.model_name = name
+    m.with_structured_output = MagicMock(return_value=MagicMock())
+    return m
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/llm/models.py — MultiModelRouter init + _verify_models
+# ---------------------------------------------------------------------------
+
+
+class TestModelRouterLogSanitization:
+    """Init banner and _verify_models warnings must never emit hostile bytes."""
+
+    def test_init_log_with_hostile_model_name(
+        self, loguru_sink, monkeypatch
+    ) -> None:
+        # Hostile bytes in model_name should be stripped by _safe_model_name
+        # before reaching the init INFO line. Patch _verify_models out — this
+        # test is about the init banner, not the server probe; the real probe
+        # would otherwise spend ~10s timing out against the fake host.
+        monkeypatch.setattr(
+            MultiModelRouter, "_verify_models", lambda self: None
+        )
+        models = [_mock_model(f"gpt-4{HOSTILE}"), _mock_model("gpt-3.5-turbo")]
+        # base_url must be present so the second loop also fires; we use one
+        # that contains userinfo, exercising _redact_url alongside sanitizing.
+        models[0].base_url = "http://user:pwd@host:8000/v1"
+        models[1].base_url = "http://host:8000/v1"
+        MultiModelRouter(models, [0.5, 0.5], writer=NullWriter(), name="san")
+        captured = loguru_sink.getvalue()
+        _assert_no_raw_hostile(captured)
+        # Cleaned form survives — sanity-check the prefix is recognizable.
+        assert "[MultiModelRouter:san]" in captured
+        # Userinfo from base_url must be redacted in the log.
+        assert "user:pwd" not in captured
+        assert "pwd@" not in captured
+
+    def test_verify_models_failure_log_sanitized(
+        self, loguru_sink, monkeypatch
+    ) -> None:
+        """When the server probe raises, the exception message is sanitized."""
+        import urllib.request
+
+        def boom(*_a, **_kw):
+            raise OSError(f"connect failed: {HOSTILE}")
+
+        monkeypatch.setattr(urllib.request, "urlopen", boom)
+        models = [_mock_model("gpt-4")]
+        models[0].base_url = "http://host:8000/v1"
+        MultiModelRouter(models, [1.0], writer=NullWriter(), name="probe")
+        captured = loguru_sink.getvalue()
+        assert "Cannot verify models" in captured
+        _assert_no_raw_hostile(captured)
+
+    def test_verify_models_not_found_log_sanitized(
+        self, loguru_sink, monkeypatch
+    ) -> None:
+        """Server-returned model ids with hostile bytes are sanitized in WARN."""
+        import urllib.request
+
+        class FakeResp:
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *exc):
+                return False
+
+            def read(self):
+                # The server claims to host a different model than the
+                # configured one, with hostile bytes in its id.
+                return json.dumps(
+                    {"data": [{"id": f"other-model{HOSTILE}"}]}
+                ).encode("utf-8")
+
+        def fake_urlopen(*_a, **_kw):
+            return FakeResp()
+
+        monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+        models = [_mock_model("gpt-4")]
+        models[0].base_url = "http://host:8000/v1"
+        MultiModelRouter(models, [1.0], writer=NullWriter(), name="probe2")
+        captured = loguru_sink.getvalue()
+        assert "NOT FOUND" in captured
+        _assert_no_raw_hostile(captured)
+
+
+class TestRedactUrl:
+    """Strip userinfo, keep everything else."""
+
+    def test_userinfo_stripped(self) -> None:
+        assert _redact_url("http://u:p@h:8000/x") == "http://h:8000/x"
+
+    def test_no_userinfo_preserved(self) -> None:
+        assert _redact_url("http://h:8000/v1") == "http://h:8000/v1"
+
+    def test_parse_failure_returns_input(self) -> None:
+        # http://[ is an unparseable URL on stricter parsers — at minimum
+        # the helper must not raise and must yield a str.
+        result = _redact_url("not a url at all")
+        assert isinstance(result, str)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/llm/agents/mutation.py — structured-output validators + log calls
+# ---------------------------------------------------------------------------
+
+
+class TestMutationStructuredOutputValidators:
+    """Field validators must scrub LLM-supplied text on construction."""
+
+    def test_hostile_archetype_scrubbed_at_validation(self) -> None:
+        out = MutationStructuredOutput(
+            archetype=f"clever{HOSTILE}archetype",
+            justification=f"because{HOSTILE}",
+            insights_used=[f"insight{HOSTILE}1", "clean"],
+            changes=[
+                MutationChange(
+                    description=f"swap loop{HOSTILE}",
+                    explanation=f"why{HOSTILE}",
+                )
+            ],
+            code=f"def f():\n    return 1{HOSTILE}",
+        )
+        # No raw hostile bytes survive in any string field.
+        assert "\x1b" not in out.archetype
+        assert "\x00" not in out.archetype
+        assert LONE_HIGH not in out.archetype
+        assert "\x00" not in out.justification
+        assert all("\x00" not in s for s in out.insights_used)
+        assert "\x1b" not in out.changes[0].description
+        assert "\x07" not in out.changes[0].explanation
+        # The code field is also scrubbed (ANSI/BIDI/C0-non-LF have no
+        # legitimate place in Python source). LF must still survive.
+        assert "\x00" not in out.code
+        assert "\n" in out.code  # legitimate newline preserved
+
+    def test_model_dump_json_succeeds_after_validation(self) -> None:
+        """Lone surrogate inside any field would otherwise abort orjson; the
+        validator pre-scrubs so JSON serialization is total."""
+        out = MutationStructuredOutput(
+            archetype=f"a{LONE_HIGH}",
+            justification="j",
+            insights_used=[f"i{LONE_HIGH}"],
+            changes=[],
+            code=f"x = 1{LONE_HIGH}",
+        )
+        blob = out.model_dump_json()
+        # Round-trip parse must succeed — no encoder failure.
+        json.loads(blob)
+
+
+class TestMutationAgentLogSanitization:
+    """Direct logger calls inside MutationAgent must scrub LLM-derived text."""
+
+    def _make_agent(self) -> MutationAgent:
+        mock_llm = MagicMock()
+        mock_llm.with_structured_output = MagicMock(return_value=MagicMock())
+        return MutationAgent(
+            llm=mock_llm,
+            system_prompt="sys",
+            user_prompt_template="Mutate {count}:\n{parent_blocks}",
+            mutation_mode="rewrite",
+        )
+
+    async def test_acall_llm_failure_log_sanitized(self, loguru_sink) -> None:
+        agent = self._make_agent()
+        agent.structured_llm = MagicMock()
+        agent.structured_llm.ainvoke = AsyncMock(
+            side_effect=RuntimeError(f"oops {HOSTILE}")
+        )
+        state: MutationState = {
+            "input": [],
+            "mutation_mode": "rewrite",
+            "messages": [],
+            "llm_response": None,
+            "final_code": "",
+            "mutation_label": "",
+        }
+        await agent.acall_llm(state)
+        captured = loguru_sink.getvalue()
+        assert "Structured LLM call failed" in captured
+        _assert_no_raw_hostile(captured)
+        # State["error"] must also be scrubbed so callers can stash it.
+        assert "\x00" not in state.get("error", "")
+
+    def test_parse_response_no_output_log_sanitized(self, loguru_sink) -> None:
+        agent = self._make_agent()
+        state: MutationState = {
+            "input": [],
+            "mutation_mode": "rewrite",
+            "messages": [],
+            "llm_response": None,
+            "final_code": "",
+            "mutation_label": "",
+            "error": f"upstream said: {HOSTILE}",
+        }
+        agent.parse_response(state)
+        captured = loguru_sink.getvalue()
+        assert "No structured output" in captured
+        _assert_no_raw_hostile(captured)
+
+    def test_parse_response_failure_stores_sanitized_error(
+        self, loguru_sink, monkeypatch
+    ) -> None:
+        agent = self._make_agent()
+        structured_output = MutationStructuredOutput(
+            archetype="Rewrite",
+            justification="test",
+            insights_used=[],
+            changes=[],
+            code="def run_code():\n    return 1\n",
+        )
+
+        def boom(_code: str) -> str:
+            raise RuntimeError(f"parse failed: {HOSTILE}")
+
+        monkeypatch.setattr(agent, "_extract_code_block", boom)
+        state: MutationState = {
+            "input": [],
+            "mutation_mode": "rewrite",
+            "messages": [],
+            "llm_response": None,
+            "structured_output": structured_output,
+            "final_code": "",
+            "mutation_label": "",
+        }
+
+        agent.parse_response(state)
+
+        captured = loguru_sink.getvalue()
+        assert "Failed to parse structured response" in captured
+        _assert_no_raw_hostile(captured)
+        parsed = state["parsed_output"]
+        _assert_no_raw_hostile(parsed["error"])
+        assert state["error"] == parsed["error"]
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/llm/token_tracking.py — track() error path
+# ---------------------------------------------------------------------------
+
+
+class TestTokenTrackerWiring:
+    def test_validation_error_caught_and_logged_sanitized(
+        self, loguru_sink
+    ) -> None:
+        """A provider returning garbage token-usage types must not raise out
+        of TokenTracker.track; the failure is logged with sanitized text."""
+        tracker = TokenTracker(name="t", writer=NullWriter())
+
+        class BadResponse:
+            @property
+            def response_metadata(self):
+                # ``prompt_tokens`` is a string — pydantic coerces it, but if
+                # we use a clearly non-coercible value we exercise the
+                # try/except path.
+                return {"token_usage": {"prompt_tokens": object()}}
+
+        # Should not raise even though TokenUsage.from_response will hit
+        # validation/type errors.
+        tracker.track(BadResponse(), model_name=f"model{HOSTILE}")
+        captured = loguru_sink.getvalue()
+        _assert_no_raw_hostile(captured)
+
+    def test_model_name_cleaned_in_no_usage_branch(self, loguru_sink) -> None:
+        """When response carries no usage, the debug log must show a cleaned
+        model name (control chars in ``model_name`` would otherwise reach
+        loguru via the ``{}`` slot)."""
+        tracker = TokenTracker(name="t", writer=NullWriter())
+
+        class EmptyResponse:
+            response_metadata: dict = {}
+
+        tracker.track(EmptyResponse(), model_name=f"model{HOSTILE}")
+        captured = loguru_sink.getvalue()
+        assert "No token usage" in captured
+        _assert_no_raw_hostile(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/llm/agents/memory_selector.py — backend init + search log paths
+# ---------------------------------------------------------------------------
+
+
+class TestMemorySelectorLogSanitization:
+    """The memory selector logs over backend errors; those strings are
+    backend-supplied and must be scrubbed before reaching loguru."""
+
+    async def test_search_unavailable_log_sanitized(self, loguru_sink) -> None:
+        """When ``self.memory`` is None, ``select()`` logs the cached backend
+        error verbatim — that path must run the value through sanitize."""
+        from gigaevo.llm.agents.memory_selector import (
+            MemorySelection,
+            MemorySelectorAgent,
+        )
+
+        agent = MemorySelectorAgent.__new__(MemorySelectorAgent)
+        agent.memory = None
+        agent._backend_error = f"backend died: {HOSTILE}"
+        import asyncio as _aio
+
+        agent._search_lock = _aio.Lock()
+
+        result = await agent.select(
+            input=[],
+            mutation_mode="rewrite",
+            task_description="t",
+            metrics_description="m",
+            memory_text="",
+            max_cards=1,
+        )
+        assert isinstance(result, MemorySelection)
+        assert result.cards == []
+        captured = loguru_sink.getvalue()
+        assert "Memory backend unavailable" in captured
+        _assert_no_raw_hostile(captured)
+
+    async def test_search_failure_log_sanitized(self, loguru_sink) -> None:
+        """When the underlying GAM search raises with hostile bytes in the
+        exception message, the WARN line must show the scrubbed form."""
+        from gigaevo.llm.agents.memory_selector import (
+            MemorySelection,
+            MemorySelectorAgent,
+        )
+
+        agent = MemorySelectorAgent.__new__(MemorySelectorAgent)
+
+        # Memory backend that raises from research and from search.
+        class BadMem:
+            research_agent = None
+
+            def search(self, query: str) -> str:
+                raise RuntimeError(f"search exploded {HOSTILE}")
+
+        agent.memory = BadMem()
+        agent._backend_error = None
+        import asyncio as _aio
+
+        agent._search_lock = _aio.Lock()
+
+        result = await agent.select(
+            input=[],
+            mutation_mode="rewrite",
+            task_description="t",
+            metrics_description="m",
+            memory_text="",
+            max_cards=1,
+        )
+        assert isinstance(result, MemorySelection)
+        assert result.cards == []
+        captured = loguru_sink.getvalue()
+        assert "Red memory search failed" in captured
+        _assert_no_raw_hostile(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/llm/bandit.py — on_mutation_outcome debug log
+# ---------------------------------------------------------------------------
+
+
+class TestBanditRouterLogSanitization:
+    def _make_router(self) -> BanditModelRouter:
+        models = [_mock_model("m1"), _mock_model("m2")]
+        return BanditModelRouter(
+            models,
+            [0.5, 0.5],
+            writer=NullWriter(),
+            name="bandit",
+            fitness_key="fitness",
+            higher_is_better=True,
+        )
+
+    def test_outcome_log_with_hostile_model_metadata(self, loguru_sink) -> None:
+        """``program.get_metadata("mutation_model")`` could carry hostile text
+        if any upstream stashes it raw; the bandit log must sanitize."""
+        router = self._make_router()
+        # Patch the bandit update so its KeyError on the hostile key (a
+        # separate pre-existing concern queued as follow-up) does not mask
+        # the wiring assertion we care about here.
+        router._bandit.update_reward = lambda *a, **kw: None  # type: ignore[method-assign]
+        program = Program(code="x = 1")
+        program.metadata["mutation_model"] = f"m1{HOSTILE}"
+        # No parent metrics → REJECTED_ACCEPTOR path that logs raw=0.0 line.
+        router.on_mutation_outcome(
+            program,
+            parents=[],
+            outcome=MutationOutcome.REJECTED_ACCEPTOR,
+        )
+        captured = loguru_sink.getvalue()
+        assert "Reward for" in captured
+        _assert_no_raw_hostile(captured)
diff --git a/tests/prompts/test_coevolution_pipeline.py b/tests/prompts/test_coevolution_pipeline.py
index 0b7ab926..56bb4b76 100644
--- a/tests/prompts/test_coevolution_pipeline.py
+++ b/tests/prompts/test_coevolution_pipeline.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import asyncio
+import hashlib
 import json
 from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock, patch
@@ -434,6 +435,12 @@ def capture_set(key, value):
 
 
 class TestPromptTextToIdUserText:
+    def test_clean_system_only_hash_matches_previous_sha256(self):
+        """Clean prompt text keeps the historical sha256[:16] ID."""
+        expected = hashlib.sha256("system".encode()).hexdigest()[:16]
+
+        assert prompt_text_to_id("system") == expected
+
     def test_same_system_different_user_different_ids(self):
         """M4: Two prompts with same system but different user get different IDs."""
         id1 = prompt_text_to_id("system", user_text="user1")
@@ -452,6 +459,13 @@ def test_user_text_changes_id(self):
         id_with_user = prompt_text_to_id("system", user_text="user")
         assert id_system_only != id_with_user
 
+    def test_lone_surrogate_prompt_text_is_sanitized_before_hashing(self):
+        """LLM-returned prompt text with a surrogate must not crash ID generation."""
+        expected_blob = "system�\x00user�"
+        expected = hashlib.sha256(expected_blob.encode()).hexdigest()[:16]
+
+        assert prompt_text_to_id("system\ud83d", user_text="user\udc00") == expected
+
 
 # ===================================================================
 # Amendment #11: PromptInsightsStage / PromptLineageStage
diff --git a/tests/prompts/test_coevolution_stages.py b/tests/prompts/test_coevolution_stages.py
index 55a71dab..d27c968c 100644
--- a/tests/prompts/test_coevolution_stages.py
+++ b/tests/prompts/test_coevolution_stages.py
@@ -12,7 +12,11 @@
     PromptExecutionStage,
     PromptFitnessStage,
 )
-from gigaevo.prompts.coevolution.stats import PromptMutationStats, PromptStatsProvider
+from gigaevo.prompts.coevolution.stats import (
+    PromptMutationStats,
+    PromptStatsProvider,
+    prompt_text_to_id,
+)
 
 # ---------------------------------------------------------------------------
 # Fixtures
@@ -87,6 +91,32 @@ async def test_execute_valid_program(self, simple_prompt_program: Program):
         )
         assert len(result.prompt_id) == 16  # SHA256[:16]
 
+    @pytest.mark.asyncio
+    async def test_execute_sanitizes_returned_prompt_text(self):
+        """compute() sanitizes prompt text before returning and hashing it."""
+        code = (
+            "def entrypoint() -> dict:\n"
+            "    return {\n"
+            "        'system': 'system\\ud83d\\x00\\x1b[31mred\\x1b[0m',\n"
+            "        'user': 'user\\udc00\\r\\u202e',\n"
+            "    }\n"
+        )
+        stage = PromptExecutionStage(timeout=30.0)
+        stage.attach_inputs({})
+
+        result = await stage.compute(Program(code=code))
+
+        assert result.prompt_text == "system�\\x00red"
+        assert result.user_text == "user�\\x0d"
+        assert result.prompt_id == prompt_text_to_id(
+            result.prompt_text, user_text=result.user_text
+        )
+        assert "\ud83d" not in result.prompt_text
+        assert "\x1b" not in result.prompt_text
+        assert "\x00" not in result.prompt_text
+        assert "\udc00" not in result.user_text
+        assert "‮" not in result.user_text
+
     @pytest.mark.asyncio
     async def test_execute_no_entrypoint(self, broken_prompt_program: Program):
         """compute() raises when program has no entrypoint()."""
diff --git a/tests/prompts/test_fetcher.py b/tests/prompts/test_fetcher.py
index a2823926..86d326b1 100644
--- a/tests/prompts/test_fetcher.py
+++ b/tests/prompts/test_fetcher.py
@@ -232,6 +232,35 @@ def test_execute_entrypoint_str_return(self, tmp_prompts_dir: Path):
 
         assert pack.prompt_id == prompt_text_to_id("Hello system.")
 
+    def test_execute_entrypoint_sanitizes_prompt_pack(self, tmp_prompts_dir: Path):
+        """_execute_entrypoint() sanitizes returned system/user prompt text."""
+        fetcher = GigaEvoArchivePromptFetcher(
+            prompt_redis_db=6,
+            main_redis_prefix="prefix",
+            fallback_prompts_dir=tmp_prompts_dir,
+        )
+        code = (
+            "def entrypoint() -> dict:\n"
+            "    return {\n"
+            "        'system': 'System\\ud83d\\x00\\x1b[31mred\\x1b[0m',\n"
+            "        'user': 'User\\udc00\\r\\u202e',\n"
+            "    }\n"
+        )
+
+        from gigaevo.prompts.coevolution.stats import prompt_text_to_id
+
+        pack = fetcher._execute_entrypoint(code)
+
+        assert pack is not None
+        assert pack.system == "System�\\x00red"
+        assert pack.user == "User�\\x0d"
+        assert pack.prompt_id == prompt_text_to_id(pack.system, user_text=pack.user)
+        assert "\ud83d" not in pack.system
+        assert "\x1b" not in pack.system
+        assert "\x00" not in pack.system
+        assert "\udc00" not in pack.user
+        assert "‮" not in pack.user
+
     def test_execute_entrypoint_dict_return_with_user(self, tmp_prompts_dir: Path):
         """_execute_entrypoint() handles dict-returning entrypoint with user key."""
         fetcher = GigaEvoArchivePromptFetcher(
diff --git a/tests/stages/test_sanitize_integration.py b/tests/stages/test_sanitize_integration.py
new file mode 100644
index 00000000..bd4f9b31
--- /dev/null
+++ b/tests/stages/test_sanitize_integration.py
@@ -0,0 +1,365 @@
+"""Hostile-input integration tests for the sanitizer wiring in
+``gigaevo/programs/stages/`` and ``gigaevo/programs/dag/``.
+
+Each test feeds ANSI escape sequences, NUL bytes, BIDI overrides, or
+lone UTF-16 surrogates into one of the call sites surgically wired with
+``sanitize_for_log`` / ``clean_identifier`` and asserts that the
+relevant downstream surface (loguru sink contents, optuna trial keys,
+SyntaxError args) is free of the offending bytes — without disturbing
+the surrounding logic.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+import re
+
+from loguru import logger
+import pytest
+
+from gigaevo.programs.core_types import StageError
+from gigaevo.programs.program import Program
+from gigaevo.programs.program_state import ProgramState
+from gigaevo.programs.stages.optimization.optuna.models import (
+    CodeModification,
+    OptunaSearchSpace,
+    ParamSpec,
+)
+from gigaevo.programs.stages.optimization.optuna.stage import OptunaOptimizationStage
+from gigaevo.programs.stages.optimization.utils import evaluate_single
+from gigaevo.programs.stages.python_executors.execution import PythonCodeExecutor
+from gigaevo.programs.stages.python_executors.wrapper import ExecRunnerError
+from gigaevo.programs.stages.validation import ValidateCodeStage
+
+# Byte patterns we never want to see on log sinks or as optuna trial keys.
+_ANSI_RE = re.compile(r"\x1b\[")
+_BIDI_RE = re.compile(r"[‪-‮⁦-⁩]")
+_C0_RAW_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+
+
+def _attach_sink() -> list[str]:
+    """Add a memory loguru sink for the duration of a single test.
+
+    Returns the underlying list that captures every emitted log message;
+    each test removes the sink at the end via ``logger.remove``.
+    """
+    messages: list[str] = []
+    sink_id = logger.add(messages.append, format="{message}", level="TRACE")
+    # Stash the sink id on the list so the caller can remove it.
+    messages.append(f"__sink_id__={sink_id}")
+    return messages
+
+
+def _detach_sink(messages: list[str]) -> None:
+    for entry in messages:
+        if isinstance(entry, str) and entry.startswith("__sink_id__="):
+            sink_id = int(entry.split("=", 1)[1])
+            logger.remove(sink_id)
+            return
+
+
+def _assert_sink_clean(messages: list[str]) -> None:
+    for line in messages:
+        if line.startswith("__sink_id__="):
+            continue
+        assert not _ANSI_RE.search(line), f"ANSI escape leaked into log: {line!r}"
+        assert not _BIDI_RE.search(line), f"BIDI override leaked into log: {line!r}"
+        assert not _C0_RAW_RE.search(line), f"Raw C0 control leaked into log: {line!r}"
+
+
+# ---------------------------------------------------------------------------
+# validation.py — SyntaxError text scrubbing
+# ---------------------------------------------------------------------------
+
+
+class TestValidationSyntaxErrorSanitized:
+    """``ValidateCodeStage`` interpolates ``e.msg`` / ``e.text`` into a
+    re-raised ``SyntaxError``. With a hostile compiler message that
+    text would propagate verbatim into every downstream consumer."""
+
+    async def test_syntax_error_message_strips_ansi(self):
+        # Inject a raw \x1b sequence into the code as a comment so the
+        # parser quotes it back in e.text.
+        code = "def foo(\x1b[31m  # bad\n"
+        stage = ValidateCodeStage(timeout=30.0)
+        prog = Program(code=code, state=ProgramState.RUNNING)
+        with pytest.raises(SyntaxError) as ei:
+            await stage.compute(prog)
+        rendered = str(ei.value)
+        assert "\x1b[" not in rendered
+        assert "\x1b" not in rendered or "\\x1b" in rendered
+
+    async def test_syntax_error_message_escapes_nul(self):
+        code = "def bar(\x00\n"
+        stage = ValidateCodeStage(timeout=30.0)
+        prog = Program(code=code, state=ProgramState.RUNNING)
+        with pytest.raises(SyntaxError) as ei:
+            await stage.compute(prog)
+        rendered = str(ei.value)
+        assert "\x00" not in rendered
+
+
+# ---------------------------------------------------------------------------
+# optuna/stage.py — ParamSpec.name as an Optuna trial key
+# ---------------------------------------------------------------------------
+
+
+class TestOptunaParamNameCleaning:
+    """``OptunaOptimizationStage._apply_modifications`` must scrub
+    ``ParamSpec.name`` before the name is handed to ``trial.suggest_*``
+    where it becomes an optuna storage key."""
+
+    @staticmethod
+    def _make_stage(tmp_path: Path) -> OptunaOptimizationStage:
+        # Minimal validator file so __init__ succeeds.
+        validator = tmp_path / "validator.py"
+        validator.write_text(
+            "def validate(_):\n    return {'score': 0.0}\n",
+            encoding="utf-8",
+        )
+        return OptunaOptimizationStage(
+            llm=None,  # type: ignore[arg-type]  # not used here
+            validator_path=validator,
+            score_key="score",
+            timeout=30.0,
+        )
+
+    def test_clean_paramspec_name_and_reference_stay_unchanged(self, tmp_path: Path):
+        stage = self._make_stage(tmp_path)
+        param = ParamSpec(
+            name="learning_rate",
+            initial_value=0.1,
+            param_type="float",
+            low=0.01,
+            high=1.0,
+            reason="clean",
+        )
+        mod = CodeModification(
+            start_line=1,
+            end_line=1,
+            parameterized_snippet="x = _optuna_params['learning_rate']",
+        )
+        ss = OptunaSearchSpace(
+            parameters=[param],
+            modifications=[mod],
+            reasoning="clean",
+        )
+
+        code = stage._apply_modifications("x = 1\n", ss)
+
+        assert param.name == "learning_rate"
+        assert code == "x = _optuna_params['learning_rate']\n"
+
+    def test_nul_in_paramspec_name_cleaned(self, tmp_path: Path):
+        stage = self._make_stage(tmp_path)
+        param = ParamSpec(
+            name="\x00../etc/passwd",
+            initial_value=1.0,
+            param_type="float",
+            low=0.0,
+            high=10.0,
+            reason="hostile",
+        )
+        mod = CodeModification(
+            start_line=1,
+            end_line=1,
+            parameterized_snippet="x = _optuna_params['\x00../etc/passwd']",
+        )
+        ss = OptunaSearchSpace(
+            parameters=[param],
+            modifications=[mod],
+            reasoning="hostile",
+        )
+
+        code = stage._apply_modifications("x = 1\n", ss)
+
+        assert "\x00" not in param.name
+        assert ".." in param.name or "etc" in param.name  # printable survived
+        # And the name is now safe for use as an optuna key (no control bytes).
+        assert _C0_RAW_RE.search(param.name) is None
+        assert code == "x = _optuna_params['../etc/passwd']\n"
+        namespace = {"_optuna_params": {param.name: 3.0}}
+        exec(code, namespace)  # noqa: S102
+        assert namespace["x"] == 3.0
+
+    def test_ansi_in_paramspec_name_cleaned(self, tmp_path: Path):
+        stage = self._make_stage(tmp_path)
+        param = ParamSpec(
+            name="\x1b[31mred_param\x1b[0m",
+            initial_value=1,
+            param_type="int",
+            low=0,
+            high=10,
+            reason="hostile",
+        )
+        ss = OptunaSearchSpace(
+            parameters=[param],
+            modifications=[
+                CodeModification(
+                    start_line=1, end_line=1, parameterized_snippet="x = 1"
+                )
+            ],
+            reasoning="hostile",
+        )
+        stage._apply_modifications("x = 1\n", ss)
+        assert "\x1b" not in param.name
+        assert "red_param" in param.name
+
+    def test_only_bad_chars_falls_back_to_positional(self, tmp_path: Path):
+        stage = self._make_stage(tmp_path)
+        # Every character outside the identifier charset.
+        param = ParamSpec(
+            name="\x00\x1b‮",
+            initial_value=1.0,
+            param_type="float",
+            low=0.0,
+            high=1.0,
+            reason="hostile",
+        )
+        ss = OptunaSearchSpace(
+            parameters=[param],
+            modifications=[
+                CodeModification(
+                    start_line=1, end_line=1, parameterized_snippet="x = 1"
+                )
+            ],
+            reasoning="hostile",
+        )
+        stage._apply_modifications("x = 1\n", ss)
+        assert param.name == "param_0"
+
+    def test_sanitized_param_name_rewrites_double_quoted_reference(
+        self, tmp_path: Path
+    ):
+        stage = self._make_stage(tmp_path)
+        param = ParamSpec(
+            name="batch size\r",
+            initial_value=16,
+            param_type="int",
+            low=1,
+            high=64,
+            reason="hostile",
+        )
+        ss = OptunaSearchSpace(
+            parameters=[param],
+            modifications=[
+                CodeModification(
+                    start_line=1,
+                    end_line=1,
+                    parameterized_snippet='x = _optuna_params["batch size\\r"]',
+                )
+            ],
+            reasoning="hostile",
+        )
+
+        code = stage._apply_modifications("x = 16\n", ss)
+
+        assert param.name == "batchsize"
+        assert code == "x = _optuna_params['batchsize']\n"
+        namespace = {"_optuna_params": {"batchsize": 32}}
+        exec(code, namespace)  # noqa: S102
+        assert namespace["x"] == 32
+
+
+# ---------------------------------------------------------------------------
+# execution.py — subprocess stderr through the warning log
+# ---------------------------------------------------------------------------
+
+
+class _HostilePythonCodeExecutor(PythonCodeExecutor):
+    """Bypass the subprocess pool entirely; raise a precomposed
+    ``ExecRunnerError`` so we can drive the ``except`` branch
+    deterministically without spinning a real worker."""
+
+    def __init__(self, hostile_stderr: str, **kwargs):
+        super().__init__(**kwargs)
+        self._hostile_stderr = hostile_stderr
+
+    async def compute(self, program):  # noqa: D401 — override
+        # Re-run the parent implementation but force the error path.
+        # Easiest: call the parent's exception block directly by invoking
+        # the same logger pattern via the parent's compute, but inject the
+        # error. We mimic the structure manually for stability.
+        raise ExecRunnerError(
+            returncode=1,
+            stderr=self._hostile_stderr,
+            stdout_bytes=b"",
+        )
+
+
+class TestExecutionWarningLogSanitized:
+    async def test_hostile_stderr_does_not_leak_to_loguru(self):
+        # Build a real PythonCodeExecutor with a stub that raises
+        # ExecRunnerError on the inner await — exercises the exact
+        # logger.warning line we wrapped.
+        hostile = "\x1b[31mCUDA error\x1b[0m: \x00 invalid value ‮malicious"
+        stage = PythonCodeExecutor(timeout=30.0)
+
+        async def _fake_runner(**_kw):
+            raise ExecRunnerError(
+                returncode=1, stderr=hostile, stdout_bytes=b""
+            )
+
+        # Monkey-patch the bound name imported inside execution.py.
+        from gigaevo.programs.stages.python_executors import execution as exec_mod
+
+        original = exec_mod.run_exec_runner
+        exec_mod.run_exec_runner = _fake_runner  # type: ignore[assignment]
+        messages = _attach_sink()
+        try:
+            prog = Program(code="def run_code(): return 1", state=ProgramState.RUNNING)
+            result = await stage.compute(prog)
+            # The stage should return a FAILED result, not raise.
+            assert hasattr(result, "status")
+            _assert_sink_clean(messages)
+        finally:
+            _detach_sink(messages)
+            exec_mod.run_exec_runner = original  # type: ignore[assignment]
+
+    async def test_stage_error_traceback_scrubbed_by_validator(self):
+        # The StageError validator must convert any control bytes in
+        # the constructed StageError.traceback into escaped form.
+        hostile = "Traceback:\n\x1b[31mline\x1b[0m\nFinal\x00"
+        err = StageError(type="X", message="m", traceback=hostile)
+        assert "\x1b[" not in (err.traceback or "")
+        assert "\x00" not in (err.traceback or "")
+
+
+# ---------------------------------------------------------------------------
+# optimization/utils.py — evaluate_single ExecRunnerError path
+# ---------------------------------------------------------------------------
+
+
+class TestEvaluateSingleSanitization:
+    async def test_exec_runner_error_returned_message_is_sanitized(
+        self, monkeypatch
+    ):
+        hostile_stderr = "\x1b[31mcompile error\x1b[0m\nlast: \x00bad"
+
+        async def _fake_runner(**_kw):
+            raise ExecRunnerError(
+                returncode=1, stderr=hostile_stderr, stdout_bytes=b""
+            )
+
+        from gigaevo.programs.stages.optimization import utils as utils_mod
+
+        monkeypatch.setattr(utils_mod, "run_exec_runner", _fake_runner)
+        messages = _attach_sink()
+        try:
+            scores, err = await evaluate_single(
+                eval_code="def _opt(): return 1",
+                eval_fn_name="_opt",
+                context=None,
+                score_key="score",
+                python_path=[],
+                timeout=5,
+                max_memory_mb=None,
+                log_tag="Unit",
+            )
+            assert scores is None
+            assert err is not None
+            assert "\x1b" not in err
+            assert "\x00" not in err
+            _assert_sink_clean(messages)
+        finally:
+            _detach_sink(messages)
diff --git a/tests/utils/test_text_sanitize.py b/tests/utils/test_text_sanitize.py
new file mode 100644
index 00000000..56f0f9d5
--- /dev/null
+++ b/tests/utils/test_text_sanitize.py
@@ -0,0 +1,533 @@
+"""Tests for gigaevo/utils/text_sanitize.py.
+
+Coverage axes:
+  * sanitize_for_log: ANSI families, C0, C1, BIDI, lone surrogates,
+    composition, idempotence, identity on safe input.
+  * sanitize_for_json: minimal lone-surrogate replacement, identity on
+    everything else.
+  * sanitize_for_dbtext: NUL replacement, identity on everything else.
+  * clean_identifier: charset strip, max_len, empty input.
+  * multi-language preservation: Greek (Mojo identifiers), Unicode arrows
+    (Mojo / Pallas formatters), math symbols, CJK, emoji, box-drawing,
+    CUTLASS-style template syntax.
+  * composability and idempotence guarantees.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from gigaevo.utils.text_sanitize import (
+    clean_identifier,
+    deep_sanitize_for_json,
+    sanitize_for_dbtext,
+    sanitize_for_json,
+    sanitize_for_log,
+)
+
+# ---------------------------------------------------------------------------
+# sanitize_for_log — ANSI escape sequences
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForLogAnsi:
+    @pytest.mark.parametrize(
+        "src,expected",
+        [
+            ("\x1b[2J\x1b[H", ""),  # clear screen + home
+            ("\x1b[31mred\x1b[0m text", "red text"),  # SGR colorization
+            ("\x1b[1m\x1b[31merror\x1b[0m", "error"),  # bold red
+            ("plain", "plain"),  # identity
+            ("\x1b[?25h", ""),  # private mode (cursor show)
+            ("\x1b]0;window title\x07after", "after"),  # OSC + BEL terminator
+            ("\x1b]2;title\x1b\\after", "after"),  # OSC + ST terminator
+            ("\x1b[1;31;42mtext\x1b[0m", "text"),  # multi-param CSI
+        ],
+    )
+    def test_csi_and_osc_stripped(self, src: str, expected: str) -> None:
+        assert sanitize_for_log(src) == expected
+
+    def test_single_char_fe_escape_stripped(self) -> None:
+        # ESC followed by a single Fe byte (e.g. ESC M reverse-index).
+        assert sanitize_for_log("a\x1bMb") == "ab"
+
+    def test_compiler_style_error_block(self) -> None:
+        # Mimics a gcc / clang / nvcc colorized error line.
+        src = "\x1b[1m\x1b[31merror:\x1b[0m\x1b[1m undefined reference\x1b[0m"
+        assert sanitize_for_log(src) == "error: undefined reference"
+
+    def test_dcs_sequence_stripped(self) -> None:
+        # DCS (Device Control String): ESC P ... ST. Used by e.g. terminal
+        # sixel image transfer; rare but legal in stderr.
+        assert sanitize_for_log("a\x1bPpayload\x1b\\b") == "ab"
+
+    def test_apc_sequence_stripped(self) -> None:
+        # APC (Application Program Command): ESC _ ... ST.
+        assert sanitize_for_log("a\x1b_data\x1b\\b") == "ab"
+
+    def test_csi_with_intermediate_byte_stripped(self) -> None:
+        # CSI with intermediate byte: ESC [ params SP final. ``\x1b[1 q``
+        # is a cursor-shape control with space as intermediate.
+        assert sanitize_for_log("a\x1b[1 qb") == "ab"
+
+    def test_consecutive_ansi_sequences_all_stripped(self) -> None:
+        src = "\x1b[31m\x1b[1m\x1b[4mtext\x1b[0m\x1b[0m\x1b[0m"
+        assert sanitize_for_log(src) == "text"
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_log — C0 and C1 controls
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForLogControlChars:
+    def test_nul_escaped(self) -> None:
+        assert sanitize_for_log("a\x00b") == "a\\x00b"
+
+    def test_bel_escaped(self) -> None:
+        assert sanitize_for_log("a\x07b") == "a\\x07b"
+
+    def test_backspace_escaped(self) -> None:
+        assert sanitize_for_log("a\x08b") == "a\\x08b"
+
+    def test_cr_escaped_so_no_line_forgery(self) -> None:
+        # The critical case: a forged log entry attempt becomes inert.
+        assert sanitize_for_log("real\r\nFORGED") == "real\\x0d\nFORGED"
+
+    def test_tab_preserved(self) -> None:
+        assert sanitize_for_log("a\tb") == "a\tb"
+
+    def test_lf_preserved(self) -> None:
+        # Real multi-line tracebacks must survive.
+        assert sanitize_for_log("line1\nline2") == "line1\nline2"
+
+    def test_del_escaped(self) -> None:
+        assert sanitize_for_log("a\x7fb") == "a\\x7fb"
+
+    @pytest.mark.parametrize("byte", [0x80, 0x9F, 0x85])
+    def test_c1_controls_escaped(self, byte: int) -> None:
+        src = f"a{chr(byte)}b"
+        assert sanitize_for_log(src) == f"a\\x{byte:02x}b"
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_log — BIDI overrides
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForLogBidi:
+    @pytest.mark.parametrize(
+        "codepoint",
+        [
+            0x202A,  # LRE
+            0x202B,  # RLE
+            0x202C,  # PDF
+            0x202D,  # LRO
+            0x202E,  # RLO
+            0x2066,  # LRI
+            0x2067,  # RLI
+            0x2068,  # FSI
+            0x2069,  # PDI
+        ],
+    )
+    def test_each_bidi_override_stripped(self, codepoint: int) -> None:
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == "ab"
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_log — lone surrogates
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForLogSurrogates:
+    def test_lone_high_surrogate_replaced(self) -> None:
+        assert sanitize_for_log("a\ud83dz") == "a�z"
+
+    def test_lone_low_surrogate_replaced(self) -> None:
+        assert sanitize_for_log("a\udc00z") == "a�z"
+
+    def test_multiple_lone_surrogates_replaced(self) -> None:
+        assert sanitize_for_log("\ud800𐀀\ud801") == "�𐀀�"
+
+    def test_valid_surrogate_pair_preserved(self) -> None:
+        # A paired high+low surrogate represents a single code point above the
+        # BMP. Python str doesn't typically use this form, but if constructed
+        # by hand it must be preserved as a valid pair.
+        src = "a😀z"  # paired -> U+1F600 emoji
+        assert sanitize_for_log(src) == src
+
+    def test_real_astral_emoji_preserved(self) -> None:
+        # The natural single-code-point form must of course pass through.
+        assert sanitize_for_log("a😀z") == "a😀z"
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_log — multi-language preservation
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForLogPreservation:
+    def test_greek_letters_preserved(self) -> None:
+        # Mojo permits Greek identifiers; classifier and logs must preserve.
+        assert sanitize_for_log("αβγ_kernel") == "αβγ_kernel"
+
+    def test_unicode_arrows_preserved(self) -> None:
+        # Mojo / Pallas error formatters use U+2192 / U+21D2 to highlight
+        # source positions.
+        assert sanitize_for_log("a → b ⇒ c") == "a → b ⇒ c"
+
+    def test_math_symbols_preserved(self) -> None:
+        assert sanitize_for_log("∀x ∈ ℝ → ℂ") == "∀x ∈ ℝ → ℂ"
+
+    def test_cjk_preserved(self) -> None:
+        assert sanitize_for_log("配置错误") == "配置错误"
+
+    def test_emoji_preserved(self) -> None:
+        assert sanitize_for_log("done ✅ 🎉") == "done ✅ 🎉"
+
+    def test_box_drawing_preserved(self) -> None:
+        # clang / rustc carets use box-drawing for source-position pointers.
+        assert sanitize_for_log("│  ╰─ here") == "│  ╰─ here"
+
+    def test_cutlass_template_syntax_preserved(self) -> None:
+        # CUTLASS / CuTe error messages routinely contain dense template
+        # syntax that must survive verbatim.
+        src = "Layout<Shape<_32,_128>,Stride<_128,_1>>"
+        assert sanitize_for_log(src) == src
+
+    def test_compile_error_block_with_mixed_content(self) -> None:
+        # Realistic: ANSI from compiler colorization wrapping a source line
+        # that itself contains template syntax, Greek identifier, arrow.
+        src = "\x1b[31merror\x1b[0m: cannot convert α → β in Layout<Shape<_32>>"
+        assert (
+            sanitize_for_log(src) == "error: cannot convert α → β in Layout<Shape<_32>>"
+        )
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_log — invariants
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForLogInvariants:
+    def test_identity_on_safe_input(self) -> None:
+        safe = "Plain ASCII with\ttabs and\nnewlines."
+        assert sanitize_for_log(safe) == safe
+
+    def test_idempotence_on_safe_input(self) -> None:
+        safe = "plain text"
+        assert sanitize_for_log(sanitize_for_log(safe)) == safe
+
+    def test_idempotence_on_hostile_input(self) -> None:
+        hostile = "a\x1b[2J\x07‮b\ud83dc\x00"
+        once = sanitize_for_log(hostile)
+        twice = sanitize_for_log(once)
+        assert twice == once
+
+    def test_empty_input(self) -> None:
+        assert sanitize_for_log("") == ""
+
+    def test_only_controls_collapses(self) -> None:
+        # All-controls input becomes a string of escape forms (still safe).
+        result = sanitize_for_log("\x00\x01\x02\x03")
+        assert result == "\\x00\\x01\\x02\\x03"
+
+    def test_output_is_utf8_encodable(self) -> None:
+        # After sanitization the result must round-trip through UTF-8.
+        hostile = "a\ud83d\x00\x1b[2J‮b"
+        cleaned = sanitize_for_log(hostile)
+        cleaned.encode("utf-8")  # must not raise
+
+    def test_output_is_json_encodable(self) -> None:
+        import json
+
+        hostile = "a\ud83d\x00\x1b[2J‮b"
+        json.dumps(sanitize_for_log(hostile))  # must not raise
+
+    def test_output_contains_no_escape_byte(self) -> None:
+        # Byte-level invariant: no raw \x1b ever survives sanitize_for_log.
+        # Catches regex regressions that JSON / UTF-8 checks would not.
+        hostile = "\x1b[2J\x1bM\x1b]title\x07\x1b_apc\x1b\\plain"
+        assert "\x1b" not in sanitize_for_log(hostile)
+
+    def test_output_contains_no_lone_surrogate(self) -> None:
+        hostile = "a\ud800b\udc00c\ud83d"
+        cleaned = sanitize_for_log(hostile)
+        for ch in cleaned:
+            cp = ord(ch)
+            assert not (0xD800 <= cp <= 0xDFFF), (
+                f"surrogate U+{cp:04X} survived"
+            )
+
+    def test_output_contains_no_raw_c0_except_tab_lf(self) -> None:
+        hostile = "".join(chr(c) for c in range(0x20)) + "\x7f"
+        cleaned = sanitize_for_log(hostile)
+        for ch in cleaned:
+            cp = ord(ch)
+            assert cp in (0x09, 0x0A) or cp >= 0x20, (
+                f"raw C0 char U+{cp:04X} survived"
+            )
+        # And no 0x7F either.
+        assert "\x7f" not in cleaned
+
+    def test_output_contains_no_bidi_overrides(self) -> None:
+        hostile = "a‪b‫c‬d‭e‮f⁦g⁧h⁨i⁩"
+        cleaned = sanitize_for_log(hostile)
+        for ch in cleaned:
+            cp = ord(ch)
+            assert not (0x202A <= cp <= 0x202E), f"BIDI U+{cp:04X} survived"
+            assert not (0x2066 <= cp <= 0x2069), f"BIDI U+{cp:04X} survived"
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_json
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForJson:
+    def test_lone_surrogate_replaced(self) -> None:
+        assert sanitize_for_json("a\ud83dz") == "a�z"
+
+    def test_paired_surrogates_preserved(self) -> None:
+        assert sanitize_for_json("a😀z") == "a😀z"
+
+    def test_ansi_passes_through(self) -> None:
+        # JSON encoder handles ANSI fine; this function does not strip it.
+        assert sanitize_for_json("\x1b[2Jhello") == "\x1b[2Jhello"
+
+    def test_controls_pass_through(self) -> None:
+        # NUL / BEL / CR survive — sanitize_for_dbtext or _log are stricter.
+        assert sanitize_for_json("a\x00\x07\rb") == "a\x00\x07\rb"
+
+    def test_bidi_passes_through(self) -> None:
+        assert sanitize_for_json("a‮b") == "a‮b"
+
+    def test_idempotence(self) -> None:
+        hostile = "a\ud83dz"
+        assert sanitize_for_json(sanitize_for_json(hostile)) == sanitize_for_json(
+            hostile
+        )
+
+    def test_json_encodes_after_sanitize(self) -> None:
+        import json
+
+        hostile = "msg with \ud83d lone"
+        json.dumps(sanitize_for_json(hostile))  # must not raise
+
+    def test_identity_on_safe_input(self) -> None:
+        safe = "completely normal text 😀 αβγ"
+        assert sanitize_for_json(safe) == safe
+
+
+# ---------------------------------------------------------------------------
+# sanitize_for_dbtext
+# ---------------------------------------------------------------------------
+
+
+class TestSanitizeForDbtext:
+    def test_nul_replaced(self) -> None:
+        assert sanitize_for_dbtext("a\x00b") == "a�b"
+
+    def test_multiple_nul_replaced(self) -> None:
+        assert sanitize_for_dbtext("\x00\x00x\x00") == "��x�"
+
+    def test_no_nul_identity(self) -> None:
+        assert sanitize_for_dbtext("plain") == "plain"
+
+    def test_ansi_passes_through(self) -> None:
+        # The dbtext variant is intentionally minimal; ANSI passes.
+        assert sanitize_for_dbtext("\x1b[2Jhello") == "\x1b[2Jhello"
+
+    def test_other_controls_pass_through(self) -> None:
+        assert sanitize_for_dbtext("a\x07\r\nb") == "a\x07\r\nb"
+
+    def test_unicode_preserved(self) -> None:
+        assert sanitize_for_dbtext("a😀b") == "a😀b"
+
+    def test_idempotence(self) -> None:
+        src = "a\x00b\x00c"
+        assert sanitize_for_dbtext(sanitize_for_dbtext(src)) == sanitize_for_dbtext(src)
+
+    def test_lone_surrogate_replaced(self) -> None:
+        # asyncpg UTF-8 encodes; lone surrogates fail there even after NUL
+        # handling. dbtext variant must cover both.
+        assert sanitize_for_dbtext("a\ud83dz") == "a�z"
+
+    def test_combined_nul_and_surrogate(self) -> None:
+        assert sanitize_for_dbtext("a\x00b\ud83dc") == "a�b�c"
+
+    def test_paired_surrogates_preserved(self) -> None:
+        # Valid emoji must not be mangled by the surrogate fix.
+        assert sanitize_for_dbtext("a😀b") == "a😀b"
+
+    def test_output_is_utf8_encodable(self) -> None:
+        # The whole point: after dbtext, the result encodes cleanly.
+        hostile = "a\x00\ud83db\udc00c"
+        sanitize_for_dbtext(hostile).encode("utf-8")  # must not raise
+
+
+# ---------------------------------------------------------------------------
+# Composability
+# ---------------------------------------------------------------------------
+
+
+class TestComposability:
+    def test_dbtext_then_log_handles_everything(self) -> None:
+        # Pipelined: first replace NUL, then strip ANSI / BIDI / controls /
+        # surrogates. End result is safe for log, JSON, and DB.
+        src = "a\x00\x1b[2J‮\ud83db\r"
+        intermediate = sanitize_for_dbtext(src)
+        final = sanitize_for_log(intermediate)
+        assert "\x00" not in final
+        assert "\x1b" not in final
+        assert "‮" not in final
+        assert "\r" not in final
+        # Validate output safety.
+        final.encode("utf-8")
+        import json
+
+        json.dumps(final)
+
+    def test_log_alone_covers_db_safety(self) -> None:
+        # sanitize_for_log strips C0 (incl NUL) — the escaped \\x00 string
+        # is safe for Postgres TEXT.
+        result = sanitize_for_log("a\x00b")
+        assert "\x00" not in result
+
+
+# ---------------------------------------------------------------------------
+# clean_identifier
+# ---------------------------------------------------------------------------
+
+
+class TestCleanIdentifier:
+    @pytest.mark.parametrize(
+        "src,expected",
+        [
+            ("gpt-4o-mini", "gpt-4o-mini"),
+            ("claude-3-5-sonnet-20241022", "claude-3-5-sonnet-20241022"),
+            ("meta-llama/Llama-3.1-70B-Instruct", "meta-llama/Llama-3.1-70B-Instruct"),
+            ("openai:gpt-4o", "openai:gpt-4o"),
+            ("model@my-host:8080", "model@my-host:8080"),
+            ("model_v2+experimental", "model_v2+experimental"),
+            ("/local/path/to/model.gguf", "/local/path/to/model.gguf"),
+        ],
+    )
+    def test_safe_identifiers_pass_through(self, src: str, expected: str) -> None:
+        assert clean_identifier(src) == expected
+
+    @pytest.mark.parametrize(
+        "src,expected",
+        [
+            ("gpt\x00admin", "gptadmin"),  # NUL
+            ("real\nFAKE", "realFAKE"),  # LF
+            ("a‮b", "ab"),  # RLO
+            # ANSI: clean_identifier strips byte-by-byte, so the digits and
+            # letters inside the escape survive. Callers wanting ANSI removed
+            # as a unit must pipeline sanitize_for_log first.
+            ("model\x1b[2J", "model2J"),
+            ("model with spaces", "modelwithspaces"),  # spaces
+            ("model<template>", "modeltemplate"),  # angle brackets
+            ("αβγ-model", "-model"),  # Greek stripped (ASCII-only policy)
+            ("привет", ""),  # Cyrillic stripped, empty result is legal
+        ],
+    )
+    def test_hostile_chars_stripped(self, src: str, expected: str) -> None:
+        assert clean_identifier(src) == expected
+
+    def test_max_len_truncates(self) -> None:
+        assert clean_identifier("abcdefghij", max_len=4) == "abcd"
+
+    def test_max_len_after_strip(self) -> None:
+        # Strip first, then truncate the result.
+        assert clean_identifier("a\x00b\x00c\x00d\x00e", max_len=3) == "abc"
+
+    def test_max_len_none_no_truncation(self) -> None:
+        long = "a" * 1000
+        assert clean_identifier(long) == long
+
+    def test_empty_input(self) -> None:
+        assert clean_identifier("") == ""
+
+    def test_all_stripped_returns_empty(self) -> None:
+        # Pure-controls plus pure-spaces plus pure-BIDI: nothing in the
+        # identifier charset, returns empty.
+        assert clean_identifier("\x00\x07\x1b\x7f ‮") == ""
+
+    def test_idempotence(self) -> None:
+        src = "model\x00 with\nstuff"
+        assert clean_identifier(clean_identifier(src)) == clean_identifier(src)
+
+    def test_negative_max_len_raises(self) -> None:
+        # Regression: Python slice ``[:-1]`` would silently drop a trailing
+        # char; reject explicitly so the caller notices the mistake.
+        with pytest.raises(ValueError, match="max_len"):
+            clean_identifier("abcde", max_len=-1)
+
+    def test_zero_max_len_yields_empty(self) -> None:
+        assert clean_identifier("abcde", max_len=0) == ""
+
+
+# ---------------------------------------------------------------------------
+# deep_sanitize_for_json
+# ---------------------------------------------------------------------------
+
+
+class TestDeepSanitizeForJson:
+    def test_string_leaf(self) -> None:
+        assert deep_sanitize_for_json("a\ud83dz") == "a�z"
+
+    def test_dict_string_value(self) -> None:
+        result = deep_sanitize_for_json({"k": "a\ud83dz"})
+        assert result == {"k": "a�z"}
+
+    def test_dict_string_key(self) -> None:
+        # Even keys can be hostile if they originate from LLM output.
+        result = deep_sanitize_for_json({"a\ud83d": "v"})
+        assert result == {"a�": "v"}
+
+    def test_nested_structure(self) -> None:
+        data = {
+            "outer": {
+                "list": ["a\ud83d", "b", {"deep": "c\ud83d"}],
+                "scalar": 42,
+            },
+            "name": "ok",
+        }
+        result = deep_sanitize_for_json(data)
+        import json
+
+        json.dumps(result)  # must not raise
+        assert isinstance(result, dict)
+        assert result["outer"]["list"][0] == "a�"
+        assert result["outer"]["list"][2]["deep"] == "c�"
+        assert result["outer"]["scalar"] == 42
+
+    def test_preserves_container_type(self) -> None:
+        # tuples stay tuples (orjson distinguishes; stdlib json doesn't,
+        # but downstream callers may care).
+        result = deep_sanitize_for_json(("a", "b"))
+        assert isinstance(result, tuple)
+
+    def test_primitives_pass_through(self) -> None:
+        assert deep_sanitize_for_json(42) == 42
+        assert deep_sanitize_for_json(3.14) == 3.14
+        assert deep_sanitize_for_json(True) is True
+        assert deep_sanitize_for_json(None) is None
+
+    def test_safe_input_round_trips(self) -> None:
+        # A clean structure must be byte-identical after sanitize.
+        data = {"x": [1, 2, "ok"], "y": "αβγ"}
+        assert deep_sanitize_for_json(data) == data
+
+    def test_empty_containers(self) -> None:
+        assert deep_sanitize_for_json({}) == {}
+        assert deep_sanitize_for_json([]) == []
+        assert deep_sanitize_for_json(()) == ()
+
+    def test_idempotence(self) -> None:
+        data = {"a": "x\ud83d", "b": ["y\ud83d", "z"]}
+        once = deep_sanitize_for_json(data)
+        twice = deep_sanitize_for_json(once)
+        assert once == twice
diff --git a/tests/utils/test_text_sanitize_consumers.py b/tests/utils/test_text_sanitize_consumers.py
new file mode 100644
index 00000000..3520742b
--- /dev/null
+++ b/tests/utils/test_text_sanitize_consumers.py
@@ -0,0 +1,987 @@
+"""Downstream-consumer fixture tests for ``gigaevo.utils.text_sanitize``.
+
+The unit tests in ``test_text_sanitize.py`` assert per-pattern strip /
+preserve / escape behavior. This file asserts the next layer of contract:
+that real-world hostile LLM error text, after passing through the
+appropriate sanitizer, is accepted by every downstream surface the
+project actually uses --- and that the *un*-sanitized form would fail.
+
+Consumers exercised:
+
+* ``json.dumps`` with both ``ensure_ascii`` settings, including the
+  often-overlooked post-encode ``str.encode('utf-8')`` step that is
+  where lone surrogates actually break.
+* ``pydantic.BaseModel.model_dump_json`` on a small frozen model.
+* ``pydantic.TypeAdapter(str).dump_python`` and ``dump_json``.
+* ``text.encode('utf-8')`` --- the asyncpg / file-write path.
+* ``loguru`` file-sink with a timestamp format, including line-forgery
+  attempts.
+* ``subprocess.run`` argv (NUL is rejected by the kernel's ``exec``).
+* ``redis.asyncio`` / ``fakeredis`` with key and value containing
+  protocol bytes (``\\r\\n``).
+* ``sqlite3`` TEXT column round-trip (NUL handling differs from
+  Postgres --- see notes inline).
+* ``csv.writer`` round-trip after sanitization.
+* Path-traversal residual risk in ``clean_identifier`` output.
+* HTML / Markdown / SQL-LIKE / URL passthrough (documented non-goals).
+* Composability, idempotence under iteration, JSON round-trip identity.
+* Realistic provider-error string: ANSI from nvcc, CUTLASS template
+  syntax, embedded NUL, Greek-letter Mojo identifier.
+* Performance sanity (1 MB hostile input under 1 second per sanitizer).
+
+Every test that exercises an "un-sanitized output would break" path uses
+``pytest.raises`` to pin the exact failure mode; a regression that makes
+that failure silently disappear (for instance, a future stdlib release
+that starts silently replacing lone surrogates) would correctly fail
+this test and prompt review rather than a silent semantic change.
+"""
+
+from __future__ import annotations
+
+import csv
+import io
+import json
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import time
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from gigaevo.utils.text_sanitize import (
+    clean_identifier,
+    sanitize_for_dbtext,
+    sanitize_for_json,
+    sanitize_for_log,
+)
+
+# ---------------------------------------------------------------------------
+# Shared hostile fixtures
+# ---------------------------------------------------------------------------
+
+# An astral lone high surrogate that breaks UTF-8 encoders and pydantic
+# JSON serialization. Used in many tests.
+LONE_HIGH = "\ud83d"
+LONE_LOW = "\udc00"
+
+# A minimal but realistic Triton MLIR diagnostic body, with ANSI from gcc
+# colorization, embedded NUL (driver buffer artifact), CR (terminal width
+# trick), C0 bytes, a BIDI override, and a lone surrogate.
+HOSTILE_COMPILER_ERROR = (
+    "\x1b[1m\x1b[31merror:\x1b[0m cannot convert value of type 'Layout<Shape<_32,_128>>'"
+    "\n  at "
+    "\x1b[33m/tmp/kernel.mlir:42:13\x1b[0m"
+    " in template instantiation"
+    "\nstack:\x00offset=0x1234"
+    "\rtail-overwrite"
+    f"\x07{LONE_HIGH} (lone surrogate)"
+    "\n‮ direction-spoofed continuation"  # RLO
+)
+
+# A realistic OpenAI-2.x-style ``BadRequestError.message`` body simulating
+# a remote tool-use call that returned an embedded compiler trace.
+HOSTILE_PROVIDER_ERROR = (
+    "tool 'compile_kernel' failed with:\n"
+    "\x1b[1;31mnvcc fatal\x1b[0m   : Unsupported gpu architecture 'compute_120'\n"
+    "  while expanding "
+    "\x1b[36mcutlass::gemm::device::Gemm<cutlass::half_t, "
+    "cutlass::layout::RowMajor, cutlass::half_t, cutlass::layout::ColumnMajor, "
+    "float, cutlass::arch::OpClassTensorOp, cutlass::arch::Sm120>\x1b[0m\n"
+    "  identifier: αβγ_residual_kernel\x00\n"
+    "  return code: 1\r\n"
+)
+
+
+@pytest.fixture
+def lone_surrogate_text() -> str:
+    """A string Python permits but UTF-8 / JSON encoders reject."""
+    return f"prefix{LONE_HIGH}suffix"
+
+
+@pytest.fixture
+def nul_text() -> str:
+    return "before\x00after"
+
+
+@pytest.fixture
+def crlf_forgery_text() -> str:
+    """Single CR-only forgery attempt (no LF)."""
+    return "real-entry\rFAKE-overwrite"
+
+
+# ---------------------------------------------------------------------------
+# json.dumps --- ensure_ascii=True (default)
+# ---------------------------------------------------------------------------
+
+
+class TestJsonDumpsAscii:
+    """``json.dumps`` with default ``ensure_ascii=True``.
+
+    Important nuance: stdlib ``json.dumps(..., ensure_ascii=True)`` does
+    NOT raise on lone surrogates --- it escapes them as ``\\uXXXX``
+    literals. The actual breakage occurs only when the resulting str is
+    UTF-8 encoded (which is what file / socket writers do).
+    """
+
+    def test_lone_surrogate_unsanitized_serializes_but_unencodable(
+        self, lone_surrogate_text: str
+    ) -> None:
+        # The serializer itself succeeds...
+        serialized = json.dumps(lone_surrogate_text)
+        assert "\\ud83d" in serialized
+        # ...but the result is unsendable: a lone ``\\uXXXX`` decodes back
+        # to a lone surrogate on json.loads, which then refuses UTF-8.
+        loaded = json.loads(serialized)
+        with pytest.raises(UnicodeEncodeError):
+            loaded.encode("utf-8")
+
+    def test_lone_surrogate_sanitized_round_trips(
+        self, lone_surrogate_text: str
+    ) -> None:
+        cleaned = sanitize_for_json(lone_surrogate_text)
+        serialized = json.dumps(cleaned)
+        loaded = json.loads(serialized)
+        # Encoding must succeed end-to-end.
+        loaded.encode("utf-8")
+        assert "�" in loaded
+
+    def test_nul_passes_through_json_ascii_escape(self, nul_text: str) -> None:
+        # NUL is permitted in JSON strings (escapes to ``\\x00``). Round-
+        # trip must preserve byte exactly. The sanitizer does NOT need to
+        # touch NUL for the JSON destination.
+        serialized = json.dumps(nul_text)
+        assert "\\u0000" in serialized
+        assert json.loads(serialized) == nul_text
+
+
+# ---------------------------------------------------------------------------
+# json.dumps --- ensure_ascii=False
+# ---------------------------------------------------------------------------
+
+
+class TestJsonDumpsNonAscii:
+    """``ensure_ascii=False`` keeps multibyte text verbatim.
+
+    NUL becomes the two-char literal ``\\u0000`` (safe to write). Lone
+    surrogates remain as raw lone surrogates in the resulting Python str
+    --- this is where UTF-8 encoding raises.
+    """
+
+    def test_lone_surrogate_unsanitized_encode_raises(
+        self, lone_surrogate_text: str
+    ) -> None:
+        # json.dumps does NOT raise; it returns a str containing the lone
+        # surrogate. The encoder rejects it.
+        serialized = json.dumps(lone_surrogate_text, ensure_ascii=False)
+        assert LONE_HIGH in serialized
+        with pytest.raises(UnicodeEncodeError):
+            serialized.encode("utf-8")
+
+    def test_lone_surrogate_sanitized_encodes_cleanly(
+        self, lone_surrogate_text: str
+    ) -> None:
+        cleaned = sanitize_for_json(lone_surrogate_text)
+        json.dumps(cleaned, ensure_ascii=False).encode("utf-8")
+
+    def test_nul_passes_through_safely(self, nul_text: str) -> None:
+        # NUL becomes the literal 6-char escape ``\\u0000`` even with
+        # ensure_ascii=False --- it is the one C0 byte JSON refuses raw.
+        serialized = json.dumps(nul_text, ensure_ascii=False)
+        assert "\\u0000" in serialized
+        serialized.encode("utf-8")  # writable
+
+    def test_compiler_error_with_log_sanitizer_then_json(self) -> None:
+        cleaned = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        serialized = json.dumps(cleaned, ensure_ascii=False)
+        # End-to-end byte path must succeed.
+        encoded = serialized.encode("utf-8")
+        # ANSI bytes never reach the encoder.
+        assert b"\x1b" not in encoded
+        # Legitimate technical content survives.
+        assert "Layout<Shape<_32,_128>>" in cleaned
+
+
+# ---------------------------------------------------------------------------
+# pydantic.BaseModel.model_dump_json
+# ---------------------------------------------------------------------------
+
+
+class TestPydanticBaseModel:
+    """The most common production path: a pydantic v2 model with a single
+    str field, serialized via ``model_dump_json``. Pydantic raises a
+    ``PydanticSerializationError`` wrapping the underlying
+    ``UnicodeEncodeError`` for lone surrogates.
+    """
+
+    def _model_cls(self) -> Any:
+        from pydantic import BaseModel, ConfigDict
+
+        class ErrMsg(BaseModel):
+            model_config = ConfigDict(frozen=True)
+            payload: str
+
+        return ErrMsg
+
+    def test_unsanitized_lone_surrogate_dump_raises(
+        self, lone_surrogate_text: str
+    ) -> None:
+        from pydantic import ValidationError  # noqa: F401  (sanity import)
+        from pydantic_core import PydanticSerializationError
+
+        Model = self._model_cls()
+        # Construction is fine --- the surrogate is a legal Python str char.
+        m = Model(payload=lone_surrogate_text)
+        with pytest.raises(PydanticSerializationError):
+            m.model_dump_json()
+
+    def test_sanitized_lone_surrogate_dump_ok(
+        self, lone_surrogate_text: str
+    ) -> None:
+        Model = self._model_cls()
+        m = Model(payload=sanitize_for_json(lone_surrogate_text))
+        data = m.model_dump_json()
+        assert json.loads(data)["payload"].endswith("suffix")
+
+    def test_dump_json_round_trip_through_loads(self) -> None:
+        Model = self._model_cls()
+        cleaned = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        m = Model(payload=cleaned)
+        revived = Model.model_validate_json(m.model_dump_json())
+        assert revived.payload == cleaned
+
+    def test_nul_safe_through_pydantic(self, nul_text: str) -> None:
+        # NUL travels through pydantic JSON serialization as ``\\x00``.
+        # No sanitizer required for this single-byte case, BUT downstream
+        # consumers like Postgres still reject NUL, so the project policy
+        # is to sanitize at construction time. Verify both paths.
+        Model = self._model_cls()
+        Model(payload=nul_text).model_dump_json()
+        Model(payload=sanitize_for_dbtext(nul_text)).model_dump_json()
+
+
+# ---------------------------------------------------------------------------
+# pydantic.TypeAdapter
+# ---------------------------------------------------------------------------
+
+
+class TestPydanticTypeAdapter:
+    def test_dump_python_unsanitized_passes_str_through(
+        self, lone_surrogate_text: str
+    ) -> None:
+        # dump_python returns the str unchanged --- pydantic does not
+        # validate-encode for the Python target. This is correct stdlib
+        # behavior but means the breakage only surfaces at dump_json /
+        # network time.
+        from pydantic import TypeAdapter
+
+        ta = TypeAdapter(str)
+        assert ta.dump_python(lone_surrogate_text) == lone_surrogate_text
+
+    def test_dump_json_unsanitized_raises(self, lone_surrogate_text: str) -> None:
+        from pydantic import TypeAdapter
+        from pydantic_core import PydanticSerializationError
+
+        ta = TypeAdapter(str)
+        with pytest.raises(PydanticSerializationError):
+            ta.dump_json(lone_surrogate_text)
+
+    def test_dump_json_sanitized_ok(self, lone_surrogate_text: str) -> None:
+        from pydantic import TypeAdapter
+
+        ta = TypeAdapter(str)
+        ta.dump_json(sanitize_for_json(lone_surrogate_text))
+
+    def test_dump_python_sanitized_drops_surrogate(
+        self, lone_surrogate_text: str
+    ) -> None:
+        from pydantic import TypeAdapter
+
+        ta = TypeAdapter(str)
+        cleaned = sanitize_for_json(lone_surrogate_text)
+        assert LONE_HIGH not in ta.dump_python(cleaned)
+
+
+# ---------------------------------------------------------------------------
+# text.encode('utf-8') --- the asyncpg / file write path
+# ---------------------------------------------------------------------------
+
+
+class TestUtf8Encode:
+    """asyncpg always UTF-8-encodes string values before sending them on
+    the wire. The same Python encoder is what file writers (``open(path,
+    'w').write(s)`` if the locale is UTF-8) use. Lone surrogates are the
+    failure mode that ``sanitize_for_json`` / ``_log`` / ``_dbtext`` all
+    fix; NUL is rejected by asyncpg at a higher layer (string-literal
+    pre-check) and so is fixed by ``_dbtext`` and ``_log`` specifically.
+    """
+
+    def test_lone_surrogate_unsanitized_raises(
+        self, lone_surrogate_text: str
+    ) -> None:
+        with pytest.raises(UnicodeEncodeError):
+            lone_surrogate_text.encode("utf-8")
+
+    def test_lone_surrogate_after_log_ok(self, lone_surrogate_text: str) -> None:
+        sanitize_for_log(lone_surrogate_text).encode("utf-8")
+
+    def test_lone_surrogate_after_json_ok(self, lone_surrogate_text: str) -> None:
+        sanitize_for_json(lone_surrogate_text).encode("utf-8")
+
+    def test_lone_surrogate_after_dbtext_ok(self, lone_surrogate_text: str) -> None:
+        sanitize_for_dbtext(lone_surrogate_text).encode("utf-8")
+
+    def test_nul_after_log_no_raw_nul(self, nul_text: str) -> None:
+        # ``sanitize_for_log`` escapes NUL to the literal ``\\x00``,
+        # which is safe to UTF-8-encode but no longer contains the actual
+        # NUL byte. This is what makes the output safe for line-oriented
+        # log sinks AND for Postgres TEXT columns simultaneously.
+        cleaned = sanitize_for_log(nul_text)
+        encoded = cleaned.encode("utf-8")
+        assert b"\x00" not in encoded
+
+    def test_compiler_error_after_log_encodes(self) -> None:
+        sanitize_for_log(HOSTILE_COMPILER_ERROR).encode("utf-8")
+
+    def test_compiler_error_after_dbtext_encodes(self) -> None:
+        sanitize_for_dbtext(HOSTILE_COMPILER_ERROR).encode("utf-8")
+
+
+# ---------------------------------------------------------------------------
+# loguru file sink with line-forgery
+# ---------------------------------------------------------------------------
+
+
+class TestLoguruFileSink:
+    """Loguru produces one record per ``logger.info`` call, but its file
+    sink writes the formatted message verbatim --- so an LF inside the
+    message produces a physical second line. The sanitizer documents
+    this as a residual risk (``\\n`` is preserved so genuine tracebacks
+    survive); a forged-line attempt that includes a fake timestamp can
+    masquerade as a separate entry. CR-only forgeries are fully defused
+    because ``\\r`` is escaped to ``\\x0d``.
+    """
+
+    def _setup_sink(self, fmt: str = "{time:YYYY-MM-DD HH:mm:ss} {level} {message}"):
+        from loguru import logger
+
+        logger.remove()
+        tf = tempfile.NamedTemporaryFile(
+            mode="w", delete=False, suffix=".log", encoding="utf-8"
+        )
+        tf.close()
+        sink_path = Path(tf.name)
+        sink_id = logger.add(sink_path, format=fmt, level="INFO")
+        return logger, sink_path, sink_id
+
+    def _teardown(self, logger: Any, sink_path: Path, sink_id: int) -> None:
+        logger.remove(sink_id)
+        if sink_path.exists():
+            sink_path.unlink()
+
+    def test_unsanitized_lf_forgery_produces_extra_line(self) -> None:
+        # Documented residual risk: a hostile string with ``\n`` plus a
+        # plausible timestamp prefix shows up in the sink as if it were
+        # a real log entry. The mitigation is a higher-level invariant:
+        # genuine entries always begin with the configured timestamp
+        # prefix that the application's formatter emits, which the
+        # forged line cannot match exactly without server-side knowledge.
+        logger, path, sid = self._setup_sink()
+        try:
+            cleaned = sanitize_for_log("legit\n2026-01-01 00:00:00 INFO FORGED")
+            logger.info(cleaned)
+            content = path.read_text(encoding="utf-8")
+        finally:
+            self._teardown(logger, path, sid)
+        # We document the residual risk by asserting it: two lines, one
+        # of which looks like a forged entry.
+        lines = content.rstrip("\n").splitlines()
+        assert len(lines) == 2, "LF in message produces physical second line"
+        # Useful diagnostic: the second line is the forgery.
+        assert "FORGED" in lines[1]
+
+    def test_cr_only_forgery_is_defused(self, crlf_forgery_text: str) -> None:
+        logger, path, sid = self._setup_sink()
+        try:
+            cleaned = sanitize_for_log(crlf_forgery_text)
+            logger.info(cleaned)
+            content = path.read_text(encoding="utf-8")
+        finally:
+            self._teardown(logger, path, sid)
+        # CR was escaped, so the single logger.info call still produces
+        # one and only one physical line in the file.
+        lines = content.rstrip("\n").splitlines()
+        assert len(lines) == 1
+        assert "\\x0d" in lines[0]
+        assert "FAKE-overwrite" in lines[0]  # visible but inert
+
+    def test_ansi_alone_does_not_forge(self) -> None:
+        logger, path, sid = self._setup_sink()
+        try:
+            cleaned = sanitize_for_log("a\x1b[31mb\x1b[0mc")
+            logger.info(cleaned)
+            content = path.read_text(encoding="utf-8")
+        finally:
+            self._teardown(logger, path, sid)
+        lines = content.rstrip("\n").splitlines()
+        assert len(lines) == 1
+        # ANSI bytes do not reach the sink.
+        assert "\x1b" not in content
+        assert "abc" in lines[0]
+
+    def test_lone_surrogate_in_message_does_not_crash_sink(
+        self, lone_surrogate_text: str
+    ) -> None:
+        logger, path, sid = self._setup_sink()
+        try:
+            logger.info(sanitize_for_log(lone_surrogate_text))
+            content = path.read_text(encoding="utf-8")
+        finally:
+            self._teardown(logger, path, sid)
+        assert "prefix" in content and "suffix" in content
+        assert LONE_HIGH not in content  # replaced with U+FFFD
+
+    def test_unsanitized_lone_surrogate_would_break_sink(
+        self, lone_surrogate_text: str
+    ) -> None:
+        # Loguru queues writes; we trigger the failure path by directly
+        # exercising the file write the sink would otherwise perform.
+        # This is the equivalent of "what happens when the sink flushes".
+        with pytest.raises(UnicodeEncodeError):
+            (lone_surrogate_text + "\n").encode("utf-8")
+
+
+# ---------------------------------------------------------------------------
+# subprocess argv
+# ---------------------------------------------------------------------------
+
+
+class TestSubprocessArgv:
+    """The kernel's ``execve`` accepts argv via a NUL-terminated C array,
+    so Python pre-validates: any argv element containing NUL raises
+    ``ValueError`` before fork. ``clean_identifier`` is the right
+    sanitizer for argv because it produces strict-ASCII output with no
+    control bytes whatsoever.
+    """
+
+    def test_unsanitized_nul_in_argv_rejected(self) -> None:
+        with pytest.raises(ValueError, match="null"):
+            subprocess.run(
+                [sys.executable, "-c", "pass", "model\x00admin"],
+                capture_output=True,
+                check=False,
+                timeout=10,
+            )
+
+    def test_clean_identifier_output_is_exec_safe(self) -> None:
+        ident = clean_identifier("model\x00admin\nworker\x07")
+        # Result is the conservative identifier charset only.
+        assert "\x00" not in ident
+        assert "\n" not in ident
+        assert "\x07" not in ident
+        r = subprocess.run(
+            [sys.executable, "-c", "import sys; print(sys.argv[1])", ident],
+            capture_output=True,
+            check=True,
+            timeout=10,
+            text=True,
+        )
+        assert r.stdout.strip() == ident
+
+    def test_subprocess_stdin_accepts_nul_bytes(self) -> None:
+        # Pipes accept NUL --- the kernel rejection is argv-specific.
+        # This guards against a future "over-sanitize stdin" mistake.
+        r = subprocess.run(
+            [sys.executable, "-c", "import sys; sys.stdout.buffer.write(sys.stdin.buffer.read())"],
+            input=b"a\x00b",
+            capture_output=True,
+            check=True,
+            timeout=10,
+        )
+        assert r.stdout == b"a\x00b"
+
+
+# ---------------------------------------------------------------------------
+# Redis RESP protocol
+# ---------------------------------------------------------------------------
+
+
+class TestRedisProtocol:
+    """RESP delimits frames with ``\\r\\n`` and length-prefixes bulk
+    strings, so modern clients are not vulnerable to in-band injection.
+    We use fakeredis as a behavioral oracle to confirm that keys and
+    values containing CRLF round-trip cleanly --- the sanitizer is not
+    required here, but applying it to keys avoids weird debug output.
+    """
+
+    def test_crlf_in_key_round_trips(self) -> None:
+        import fakeredis
+
+        r = fakeredis.FakeRedis()
+        try:
+            r.set("a\r\nFLUSHDB", b"value")
+            assert r.get("a\r\nFLUSHDB") == b"value"
+        finally:
+            r.close()
+
+    def test_crlf_in_value_round_trips(self) -> None:
+        import fakeredis
+
+        r = fakeredis.FakeRedis()
+        try:
+            forged = b"val\r\n*1\r\n$8\r\nFLUSHALL\r\n"
+            r.set("k", forged)
+            assert r.get("k") == forged
+        finally:
+            r.close()
+
+    def test_sanitized_key_works(self) -> None:
+        import fakeredis
+
+        r = fakeredis.FakeRedis()
+        try:
+            key = clean_identifier("user:42@host\r\nproblem")
+            r.set(key, b"v")
+            assert r.get(key) == b"v"
+        finally:
+            r.close()
+
+
+# ---------------------------------------------------------------------------
+# SQLite TEXT column round-trip
+# ---------------------------------------------------------------------------
+
+
+class TestSqliteTextColumn:
+    """SQLite's TEXT affinity stores arbitrary bytes including NUL ---
+    unlike Postgres' TEXT, which rejects NUL at the wire layer. This is
+    a place where the dbtext sanitizer's NUL-replacement policy is
+    motivated by the *Postgres* contract, not SQLite's. We still verify
+    that sanitized output round-trips cleanly through SQLite.
+    """
+
+    @pytest.fixture
+    def conn(self) -> sqlite3.Connection:
+        c = sqlite3.connect(":memory:")
+        c.execute("CREATE TABLE t (v TEXT NOT NULL)")
+        yield c
+        c.close()
+
+    def test_sqlite_does_not_truncate_at_nul(
+        self, conn: sqlite3.Connection, nul_text: str
+    ) -> None:
+        # Documented behavior: SQLite stores NUL byte intact. This is
+        # different from Postgres TEXT and is the reason sanitize_for_dbtext
+        # is needed only on the Postgres path. We pin the behavior so a
+        # future SQLite Python binding change does not silently affect
+        # callers who relied on round-trip.
+        conn.execute("INSERT INTO t VALUES (?)", (nul_text,))
+        (got,) = conn.execute("SELECT v FROM t").fetchone()
+        assert got == nul_text  # full string preserved
+
+    def test_dbtext_sanitized_round_trips(self, conn: sqlite3.Connection) -> None:
+        cleaned = sanitize_for_dbtext(f"a\x00b{LONE_HIGH}c")
+        conn.execute("INSERT INTO t VALUES (?)", (cleaned,))
+        (got,) = conn.execute("SELECT v FROM t").fetchone()
+        assert got == cleaned
+        # And the round-tripped value is still UTF-8-encodable for the
+        # consumer that will eventually read this row.
+        got.encode("utf-8")
+
+    def test_log_sanitized_round_trips(self, conn: sqlite3.Connection) -> None:
+        cleaned = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        conn.execute("INSERT INTO t VALUES (?)", (cleaned,))
+        (got,) = conn.execute("SELECT v FROM t").fetchone()
+        assert got == cleaned
+
+    def test_unsanitized_lone_surrogate_breaks_text_factory(
+        self, conn: sqlite3.Connection
+    ) -> None:
+        # If the connection text_factory is the default ``str``, the C
+        # layer stores the lone-surrogate-bearing str by encoding it as
+        # UTF-8 internally; this raises at insert time, not at fetch.
+        # We assert the failure path so a regression of the dbtext
+        # sanitizer's surrogate handling is caught here.
+        with pytest.raises((UnicodeEncodeError, sqlite3.ProgrammingError)):
+            conn.execute("INSERT INTO t VALUES (?)", (f"x{LONE_HIGH}y",))
+
+
+# ---------------------------------------------------------------------------
+# CSV writer round-trip
+# ---------------------------------------------------------------------------
+
+
+class TestCsvWriter:
+    def test_hostile_row_round_trips_after_log_sanitize(self) -> None:
+        cleaned = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        out = io.StringIO()
+        csv.writer(out).writerow(["id-1", cleaned, "tail"])
+        # Read back; csv.reader correctly handles embedded newlines from
+        # quoted fields. ANSI is already stripped, so quote rules apply
+        # cleanly.
+        rows = list(csv.reader(io.StringIO(out.getvalue())))
+        assert len(rows) == 1
+        assert rows[0][0] == "id-1"
+        assert rows[0][1] == cleaned
+        assert rows[0][2] == "tail"
+
+    def test_unsanitized_lone_surrogate_breaks_utf8_write(
+        self, lone_surrogate_text: str
+    ) -> None:
+        out = io.StringIO()
+        csv.writer(out).writerow([lone_surrogate_text])
+        with pytest.raises(UnicodeEncodeError):
+            out.getvalue().encode("utf-8")
+
+    def test_sanitized_writes_to_real_file(self, tmp_path: Path) -> None:
+        cleaned = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        target = tmp_path / "out.csv"
+        with target.open("w", encoding="utf-8", newline="") as fh:
+            csv.writer(fh).writerow(["k", cleaned])
+        # File write must not raise.
+        assert target.read_text(encoding="utf-8").count("\n") >= 1
+
+    def test_commas_and_quotes_in_message_handled(self) -> None:
+        msg = sanitize_for_log('value with, comma and "quote" inside')
+        out = io.StringIO()
+        csv.writer(out).writerow([msg])
+        rows = list(csv.reader(io.StringIO(out.getvalue())))
+        assert rows[0][0] == msg
+
+
+# ---------------------------------------------------------------------------
+# clean_identifier path-traversal residual risk
+# ---------------------------------------------------------------------------
+
+
+class TestCleanIdentifierPathTraversal:
+    """``clean_identifier`` keeps ``/`` because the project genuinely
+    uses path-style model identifiers (``meta-llama/Llama-3.1-70B``).
+    A side-effect is that ``..`` and trailing slashes also survive, so
+    callers that pipe the result to filesystem APIs MUST normalize /
+    confine before joining. These tests pin the residual risk.
+    """
+
+    def test_dot_dot_survives(self) -> None:
+        assert ".." in clean_identifier("../../etc/passwd")
+
+    def test_full_path_traversal_string_survives(self) -> None:
+        assert clean_identifier("../../etc/passwd") == "../../etc/passwd"
+
+    def test_slash_survives(self) -> None:
+        assert "/" in clean_identifier("a/b/c")
+
+    def test_null_byte_stripped_from_path(self) -> None:
+        assert "\x00" not in clean_identifier("foo\x00../bar")
+
+    def test_filesystem_join_is_callers_problem(self, tmp_path: Path) -> None:
+        # Demonstrate the trap: if a caller blindly does
+        # ``tmp_path / clean_identifier(user_input)`` the resolved path
+        # can escape ``tmp_path``. Callers must use Path.resolve() +
+        # is_relative_to() or similar.
+        evil = clean_identifier("../../etc/passwd")
+        joined = (tmp_path / evil).resolve()
+        # The resolved path is OUTSIDE tmp_path --- this is the failure
+        # mode callers must guard against. We assert it to document.
+        assert not str(joined).startswith(str(tmp_path.resolve()))
+
+
+# ---------------------------------------------------------------------------
+# Pass-through hazards (documented non-goals)
+# ---------------------------------------------------------------------------
+
+
+class TestPassThroughHazards:
+    """The sanitizers deliberately do NOT escape HTML / Markdown / SQL
+    LIKE wildcards / URL-unsafe characters. These tests pin the policy.
+    """
+
+    def test_html_special_chars_pass_through_log(self) -> None:
+        src = "<script>alert(1)</script> & &amp;"
+        assert sanitize_for_log(src) == src
+
+    def test_html_consumer_must_escape_itself(self) -> None:
+        import html
+
+        cleaned = sanitize_for_log("<script>alert(1)</script>")
+        # The HTML consumer adds its own layer.
+        assert "&lt;" in html.escape(cleaned)
+
+    def test_markdown_special_chars_pass_through_log(self) -> None:
+        src = "`backtick` *italic* **bold** [link](url)"
+        assert sanitize_for_log(src) == src
+
+    def test_sql_like_wildcards_survive_clean_identifier(self) -> None:
+        # ``%`` and ``_`` --- ``_`` is in the identifier charset, ``%``
+        # is not. Both are non-issues at this layer; SQL LIKE callers
+        # must escape themselves.
+        assert "_" in clean_identifier("a_b")
+        assert "%" not in clean_identifier("a%b")
+
+    def test_url_unsafe_chars_largely_absent_from_clean_identifier(self) -> None:
+        # Side benefit of the conservative charset: ``?``, ``#``, ``&``
+        # are absent. ``/``, ``:``, ``@``, ``.`` survive (legitimate in
+        # path / scheme / userinfo positions).
+        ident = clean_identifier("a?b#c&d/e:f@g.h")
+        for unsafe in "?#&":
+            assert unsafe not in ident
+
+
+# ---------------------------------------------------------------------------
+# Composability
+# ---------------------------------------------------------------------------
+
+
+class TestComposability:
+    """Order of application matters for output bytes (an earlier escape
+    can hide a NUL behind ``\\x00``) but never for safety: regardless of
+    order, the final output is safe for every consumer."""
+
+    SRC = f"a\x00b{LONE_HIGH}c\x1b[2Jd"
+
+    def test_log_then_dbtext_safe(self) -> None:
+        out = sanitize_for_dbtext(sanitize_for_log(self.SRC))
+        out.encode("utf-8")
+        json.dumps(out)
+
+    def test_dbtext_then_log_safe(self) -> None:
+        out = sanitize_for_log(sanitize_for_dbtext(self.SRC))
+        out.encode("utf-8")
+        json.dumps(out)
+
+    def test_orders_differ_in_form_but_both_safe(self) -> None:
+        a = sanitize_for_log(sanitize_for_dbtext(self.SRC))
+        b = sanitize_for_dbtext(sanitize_for_log(self.SRC))
+        # Inner-dbtext converts NUL to U+FFFD, so outer-log sees no NUL
+        # to escape: ``\\x00`` literal is absent in (a).
+        assert "\\x00" not in a
+        # Outer-dbtext sees ``\\x00`` (literal backslash-x-zero-zero) and
+        # leaves it alone --- no real NUL to replace.
+        assert "\\x00" in b
+        # Both are safe at every downstream target.
+        for v in (a, b):
+            v.encode("utf-8")
+            json.dumps(v)
+
+
+# ---------------------------------------------------------------------------
+# Idempotence under iteration
+# ---------------------------------------------------------------------------
+
+
+class TestIdempotenceStress:
+    def test_log_idempotent_100_times(self) -> None:
+        once = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        v = once
+        for _ in range(100):
+            v = sanitize_for_log(v)
+        assert v == once
+
+    def test_dbtext_idempotent_100_times(self) -> None:
+        once = sanitize_for_dbtext(HOSTILE_COMPILER_ERROR)
+        v = once
+        for _ in range(100):
+            v = sanitize_for_dbtext(v)
+        assert v == once
+
+    def test_json_idempotent_100_times(self) -> None:
+        once = sanitize_for_json(HOSTILE_COMPILER_ERROR)
+        v = once
+        for _ in range(100):
+            v = sanitize_for_json(v)
+        assert v == once
+
+    def test_identifier_idempotent_100_times(self) -> None:
+        once = clean_identifier("model\x00 with\n stuff αβγ")
+        v = once
+        for _ in range(100):
+            v = clean_identifier(v)
+        assert v == once
+
+
+# ---------------------------------------------------------------------------
+# JSON round-trip identity from second pass onwards
+# ---------------------------------------------------------------------------
+
+
+class TestJsonRoundTripIdentity:
+    def test_sanitize_dump_load_sanitize_is_identity(self) -> None:
+        once = sanitize_for_json(HOSTILE_COMPILER_ERROR)
+        revived = json.loads(json.dumps(once))
+        twice = sanitize_for_json(revived)
+        assert twice == once
+
+    def test_log_sanitize_dump_load_log_sanitize_is_identity(self) -> None:
+        once = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        revived = json.loads(json.dumps(once))
+        twice = sanitize_for_log(revived)
+        assert twice == once
+
+    def test_pydantic_round_trip_identity(self) -> None:
+        from pydantic import BaseModel
+
+        class M(BaseModel):
+            payload: str
+
+        once = sanitize_for_log(HOSTILE_COMPILER_ERROR)
+        m1 = M(payload=once)
+        m2 = M.model_validate_json(m1.model_dump_json())
+        assert m2.payload == once
+
+
+# ---------------------------------------------------------------------------
+# Realistic provider-error fixture
+# ---------------------------------------------------------------------------
+
+
+class TestRealisticProviderError:
+    def test_provider_error_through_log_then_json(self) -> None:
+        cleaned = sanitize_for_log(HOSTILE_PROVIDER_ERROR)
+        # JSON serialization must succeed end-to-end.
+        json.dumps(cleaned).encode("utf-8")
+        # ANSI bytes do not survive.
+        assert "\x1b" not in cleaned
+        # NUL is escaped to literal.
+        assert "\x00" not in cleaned
+        # Greek identifier survives (Mojo-style identifier preservation).
+        assert "αβγ_residual_kernel" in cleaned
+        # CUTLASS template syntax survives.
+        assert "cutlass::gemm::device::Gemm" in cleaned
+        # The compiler diagnostic text itself survives.
+        assert "Unsupported gpu architecture" in cleaned
+
+    def test_provider_error_through_dbtext_then_log(self) -> None:
+        # Composition order used in production: dbtext first (for the
+        # DB write), log on the way to display.
+        once = sanitize_for_dbtext(HOSTILE_PROVIDER_ERROR)
+        once.encode("utf-8")
+        twice = sanitize_for_log(once)
+        twice.encode("utf-8")
+        # CR was preserved by dbtext, escaped by log.
+        assert "\r" not in twice
+        assert "\\x0d" in twice
+
+    def test_provider_error_into_pydantic(self) -> None:
+        from pydantic import BaseModel
+
+        class ProviderErr(BaseModel):
+            message: str
+
+        m = ProviderErr(message=sanitize_for_log(HOSTILE_PROVIDER_ERROR))
+        # Full pydantic JSON serialization path must succeed.
+        revived = ProviderErr.model_validate_json(m.model_dump_json())
+        assert "αβγ_residual_kernel" in revived.message
+
+    def test_provider_error_clean_identifier_extraction(self) -> None:
+        # A common project pattern: extract a model name from a free-form
+        # provider error. clean_identifier on a slice must survive even
+        # if the slice contains hostile bytes.
+        slice_ = HOSTILE_PROVIDER_ERROR.split("identifier: ", 1)[1].split("\n")[0]
+        ident = clean_identifier(slice_)
+        # ASCII-only, no controls, no NUL.
+        assert ident.isascii()
+        assert "\x00" not in ident
+
+
+# ---------------------------------------------------------------------------
+# Performance sanity --- 1 MB input under 1 second
+# ---------------------------------------------------------------------------
+
+
+class TestPerformanceSanity:
+    """Pure regex throughput sanity. The sanitizers are linear in input
+    length; 1 MB through any of them should complete well under 1 s on
+    typical CI hardware. A regression that introduced quadratic
+    behavior (for instance, repeated full-string passes inside a loop)
+    would fail this guard."""
+
+    @pytest.fixture(scope="class")
+    def one_mb_hostile(self) -> str:
+        # Repeat a 1 KiB hostile block 1024 times. Includes ANSI, NUL,
+        # BIDI, surrogate, C1, CR.
+        chunk = (
+            "\x1b[31mErr\x1b[0m \x00 ‮ \ud83d \x9b \r tail "
+            + ("padding " * 100)
+        )[:1024]
+        return chunk * 1024  # ~1 MiB
+
+    def test_sanitize_for_log_under_one_second(self, one_mb_hostile: str) -> None:
+        t0 = time.perf_counter()
+        sanitize_for_log(one_mb_hostile)
+        elapsed = time.perf_counter() - t0
+        assert elapsed < 1.0, f"sanitize_for_log too slow: {elapsed:.3f}s"
+
+    def test_sanitize_for_json_under_one_second(self, one_mb_hostile: str) -> None:
+        t0 = time.perf_counter()
+        sanitize_for_json(one_mb_hostile)
+        elapsed = time.perf_counter() - t0
+        assert elapsed < 1.0, f"sanitize_for_json too slow: {elapsed:.3f}s"
+
+    def test_sanitize_for_dbtext_under_one_second(self, one_mb_hostile: str) -> None:
+        t0 = time.perf_counter()
+        sanitize_for_dbtext(one_mb_hostile)
+        elapsed = time.perf_counter() - t0
+        assert elapsed < 1.0, f"sanitize_for_dbtext too slow: {elapsed:.3f}s"
+
+    def test_clean_identifier_under_one_second(self, one_mb_hostile: str) -> None:
+        t0 = time.perf_counter()
+        clean_identifier(one_mb_hostile)
+        elapsed = time.perf_counter() - t0
+        assert elapsed < 1.0, f"clean_identifier too slow: {elapsed:.3f}s"
+
+
+# ---------------------------------------------------------------------------
+# Final invariant: every sanitizer's output is byte-encodable
+# ---------------------------------------------------------------------------
+
+
+class TestUniversalEncodability:
+    """The single most important contract: regardless of input, every
+    sanitizer's primary output (the function that targets a specific
+    destination) must produce a string that destination accepts.
+    """
+
+    INPUTS = [
+        "",
+        "plain ASCII",
+        "αβγ Greek",
+        "配置错误",
+        "a\x00b",
+        f"a{LONE_HIGH}b",
+        f"a{LONE_LOW}b",
+        "a\x1b[2Jb",
+        "a‮b",
+        HOSTILE_COMPILER_ERROR,
+        HOSTILE_PROVIDER_ERROR,
+        # Maximum-entropy mix.
+        "".join(chr(i) for i in range(0, 0x80)),
+    ]
+
+    @pytest.mark.parametrize("src", INPUTS)
+    def test_log_output_utf8_encodable(self, src: str) -> None:
+        sanitize_for_log(src).encode("utf-8")
+
+    @pytest.mark.parametrize("src", INPUTS)
+    def test_json_output_json_dumpable_and_loadable(self, src: str) -> None:
+        cleaned = sanitize_for_json(src)
+        # ensure_ascii=False is the strict path; default also works but
+        # the strict path is what surfaces lone-surrogate bugs.
+        encoded = json.dumps(cleaned, ensure_ascii=False).encode("utf-8")
+        assert json.loads(encoded.decode("utf-8")) == cleaned
+
+    @pytest.mark.parametrize("src", INPUTS)
+    def test_dbtext_output_utf8_encodable_and_nul_free(self, src: str) -> None:
+        cleaned = sanitize_for_dbtext(src)
+        assert "\x00" not in cleaned
+        cleaned.encode("utf-8")
+
+    @pytest.mark.parametrize("src", INPUTS)
+    def test_identifier_output_ascii_and_no_controls(self, src: str) -> None:
+        ident = clean_identifier(src)
+        # Strict ASCII subset only.
+        assert ident.isascii()
+        # No control bytes.
+        for ch in ident:
+            assert ch.isprintable() or ch == ""
diff --git a/tests/utils/test_text_sanitize_regex.py b/tests/utils/test_text_sanitize_regex.py
new file mode 100644
index 00000000..0b55c047
--- /dev/null
+++ b/tests/utils/test_text_sanitize_regex.py
@@ -0,0 +1,768 @@
+"""Adversarial regex-level tests for gigaevo/utils/text_sanitize.py.
+
+The base test file (``test_text_sanitize.py``) covers normal-case behavior.
+This file targets the ANSI / surrogate / BIDI / C0 / C1 regexes themselves:
+ambiguity between alternatives, malformed sequences, intermediate / private
+bytes, missing terminators, surrogate adjacency, DoS resistance, and known
+gaps (direct C1 introducers, bare ESC + Fp/Fs sequences).
+
+Every test documents the observed behavior so that future regex tightening
+can be detected as a behavior change.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+
+import pytest
+
+from gigaevo.utils.text_sanitize import (
+    sanitize_for_dbtext,
+    sanitize_for_json,
+    sanitize_for_log,
+)
+
+# Visible U+FFFD as a constant so test bodies stay readable.
+REPL = "�"
+
+
+# ---------------------------------------------------------------------------
+# Malformed CSI: truncated / missing-final / invalid char in params
+# ---------------------------------------------------------------------------
+
+
+class TestMalformedCsi:
+    """A CSI introducer that does not complete a valid sequence must NOT
+    silently swallow following bytes. The current pattern requires a final
+    byte in 0x40-0x7E; if absent, the ESC drops through to the C0 escape
+    pass and surfaces as ``\\x1b`` followed by the literal residue.
+    """
+
+    def test_truncated_csi_bare_introducer(self) -> None:
+        # ``ESC [`` with no params and no final: ESC escaped, ``[`` literal.
+        assert sanitize_for_log("\x1b[") == "\\x1b["
+
+    def test_truncated_csi_with_params_no_final(self) -> None:
+        # ``ESC [ 3 1`` looks like the start of a colour sequence but stops
+        # before the final SGR byte. Whole prefix must surface literally.
+        assert sanitize_for_log("\x1b[31") == "\\x1b[31"
+
+    def test_invalid_char_in_csi_params(self) -> None:
+        # ``X`` (0x58) is outside the params 0x30-0x3F and intermediate
+        # 0x20-0x2F ranges but inside the final 0x40-0x7E range. So the CSI
+        # regex matches ``\x1b[1X`` with final ``X``, leaving ``m`` behind.
+        # This is technically a malformed SGR but the regex absorbs it.
+        assert sanitize_for_log("\x1b[1Xm") == "m"
+
+    def test_partial_csi_does_cascade_when_joined_at_runtime(self) -> None:
+        # Python string concatenation is a compile/runtime operation: by
+        # the time the sanitizer sees its input, ``\x1b[`` + ``31m`` IS
+        # the single string ``\x1b[31m`` — a valid CSI. There is no way
+        # for the sanitizer to know the two halves arrived separately.
+        # This test exists to fix the boundary in test author's mind:
+        # all bypass attempts must be SINGLE-STRING constructions.
+        assert sanitize_for_log("\x1b[" + "31m") == ""
+
+    def test_partial_csi_with_non_final_terminator_does_not_cascade(self) -> None:
+        # A genuinely truncated CSI: the next byte after the param is
+        # space (0x20), which IS a valid intermediate byte. Pattern then
+        # needs a final byte 0x40-0x7E. ``\n`` (0x0A) is not in that
+        # range. So the CSI alt fails. Fe-single fails. ESC escapes,
+        # bracket and digits survive, LF survives.
+        assert sanitize_for_log("\x1b[31 \n") == "\\x1b[31 \n"
+
+
+# ---------------------------------------------------------------------------
+# CSI with intermediate bytes (real vendor sequences)
+# ---------------------------------------------------------------------------
+
+
+class TestCsiIntermediateBytes:
+    @pytest.mark.parametrize(
+        "sequence,name",
+        [
+            ("\x1b[1 q", "DECSCUSR cursor shape (space intermediate)"),
+            ("\x1b[2 q", "DECSCUSR steady block"),
+            ("\x1b[0$~", "DECSEL ($ intermediate, ~ final)"),
+            ("\x1b[1\"q", "DECSCA select character protection"),
+            ("\x1b[!p", "DECSTR soft terminal reset (! intermediate)"),
+        ],
+    )
+    def test_intermediate_byte_csi_stripped(
+        self, sequence: str, name: str
+    ) -> None:
+        assert sanitize_for_log(f"a{sequence}b") == "ab", name
+
+    def test_multiple_intermediate_bytes(self) -> None:
+        # Pattern allows ``[ -/]*`` — zero or more intermediates.
+        assert sanitize_for_log("a\x1b[1 !\"#~b") == "ab"
+
+
+# ---------------------------------------------------------------------------
+# Private-parameter CSI (DEC private modes)
+# ---------------------------------------------------------------------------
+
+
+class TestPrivateParamCsi:
+    @pytest.mark.parametrize(
+        "sequence,name",
+        [
+            ("\x1b[?25h", "DECTCEM show cursor"),
+            ("\x1b[?25l", "DECTCEM hide cursor"),
+            ("\x1b[?2004h", "bracketed paste on"),
+            ("\x1b[?2004l", "bracketed paste off"),
+            ("\x1b[?1049h", "alternate screen buffer on"),
+            ("\x1b[?1049l", "alternate screen buffer off"),
+            ("\x1b[?1000;1006h", "mouse tracking with SGR"),
+            ("\x1b[>4;2m", "modifyOtherKeys (> private prefix)"),
+            ("\x1b[<3;10;20M", "SGR mouse report (< private prefix)"),
+            ("\x1b[=1c", "send device attributes (= prefix)"),
+        ],
+    )
+    def test_private_param_csi_stripped(self, sequence: str, name: str) -> None:
+        # ``?``, ``<``, ``=``, ``>`` are all 0x3C-0x3F, inside the params
+        # range 0x30-0x3F, so the regex picks them up.
+        assert sanitize_for_log(f"x{sequence}y") == "xy", name
+
+
+# ---------------------------------------------------------------------------
+# OSC variants
+# ---------------------------------------------------------------------------
+
+
+class TestOscVariants:
+    @pytest.mark.parametrize(
+        "sequence,description",
+        [
+            ("\x1b]0;window title\x07", "xterm window+icon title (BEL term)"),
+            ("\x1b]1;icon\x07", "xterm icon name (BEL term)"),
+            ("\x1b]2;just title\x1b\\", "xterm window title (ST term)"),
+            ("\x1b]4;1;rgb:ff/00/00\x07", "set ANSI palette"),
+            ("\x1b]52;c;SGVsbG8=\x07", "OSC 52 clipboard write (security)"),
+            ("\x1b]52;c;?\x07", "OSC 52 clipboard read query"),
+            ("\x1b]133;A\x07", "FinalTerm OSC 133 prompt mark A"),
+            ("\x1b]133;B\x07", "FinalTerm prompt mark B"),
+            ("\x1b]133;C\x07", "FinalTerm command start"),
+            ("\x1b]133;D;0\x07", "FinalTerm command end"),
+            ("\x1b]7;file://host/path\x07", "iTerm2 current directory"),
+            # OSC 8 hyperlink wraps visible text; this parametrization sets
+            # the OSC to empty payload + empty payload so both vanish with
+            # nothing between them. The visible-text variant is covered
+            # explicitly below.
+            ("\x1b]8;;\x07\x1b]8;;\x07", "OSC 8 hyperlink (no visible text)"),
+            ("\x1b]10;rgb:ff/ff/ff\x1b\\", "set foreground"),
+            ("\x1b]11;#000000\x07", "set background"),
+        ],
+    )
+    def test_osc_payload_fully_consumed(
+        self, sequence: str, description: str
+    ) -> None:
+        # The body must vanish, including security-sensitive payloads like
+        # OSC 52 clipboard writes. Any leakage of the payload would be a
+        # serious bug (an attacker could exfiltrate via clipboard).
+        assert sanitize_for_log(f"pre{sequence}post") == "prepost", description
+
+    def test_osc8_hyperlink_with_visible_text_preserves_text(self) -> None:
+        # A real OSC 8 hyperlink: ESC]8;;URL BEL  visible-text  ESC]8;; BEL.
+        # The two OSC sequences strip; the visible link text between them
+        # is preserved (this is desirable — the human-readable label of a
+        # hyperlink should survive).
+        src = "pre\x1b]8;;https://example.com\x07link\x1b]8;;\x07post"
+        assert sanitize_for_log(src) == "prelinkpost"
+
+    def test_osc_with_embedded_surrogate_pair_in_body(self) -> None:
+        # The OSC body regex is ``[^\x07\x1b]*`` — agnostic to Unicode
+        # content. A valid emoji inside the body should still vanish with
+        # the OSC.
+        assert sanitize_for_log("a\x1b]title=😀\x07b") == "ab"
+
+    def test_osc_no_terminator_caught_by_fe_fallback(self) -> None:
+        # ``\x1b]forever`` with no BEL / ST. The OSC alternative cannot
+        # match (no terminator). The Fe-single alternative ``\x1b[@-Z\\-_]``
+        # DOES match ``\x1b]`` because ``]`` is 0x5D inside the ``\\-_``
+        # subrange (0x5C-0x5F). The body becomes literal text.
+        # DOCUMENTED BEHAVIOR: payload leaks through as plain text, but no
+        # regex hang. Acceptable: payload is no longer interpretable as OSC
+        # without its introducer.
+        assert sanitize_for_log("\x1b]forever") == "forever"
+
+    def test_osc_with_embedded_esc_breaks_into_two_matches(self) -> None:
+        # ``\x1b]title\x1bP\x1b\\`` — the OSC body forbids ESC, so the OSC
+        # alternative fails. Pattern matching at first ESC: Fe-single
+        # matches ``\x1b]`` (the ``]`` byte). Pattern advances to second
+        # ESC, where DCS matches ``\x1bP\x1b\\`` (empty payload). Result:
+        # both ESCs and the bracket vanish, but the literal ``title``
+        # between them surfaces as visible text.
+        # DOCUMENTED BEHAVIOR: payload of a malformed OSC with embedded
+        # ESC leaks; this is a real (but minor) confusion gap.
+        assert sanitize_for_log("\x1b]title\x1bP\x1b\\rest") == "titlerest"
+
+
+# ---------------------------------------------------------------------------
+# DCS / SOS / PM / APC string sequences
+# ---------------------------------------------------------------------------
+
+
+class TestStringSequences:
+    @pytest.mark.parametrize(
+        "introducer,name",
+        [
+            ("P", "DCS"),
+            ("X", "SOS"),
+            ("^", "PM"),
+            ("_", "APC"),
+        ],
+    )
+    def test_each_introducer_stripped(self, introducer: str, name: str) -> None:
+        src = f"a\x1b{introducer}payload\x1b\\b"
+        assert sanitize_for_log(src) == "ab", name
+
+    def test_dcs_with_nul_in_body(self) -> None:
+        # The DCS body regex is ``[^\x1b]*`` — explicitly permits NUL
+        # bytes. The whole DCS including the NUL inside vanishes.
+        assert sanitize_for_log("a\x1bP1;0|head\x00tail\x1b\\b") == "ab"
+
+    def test_dcs_with_c0_controls_in_body(self) -> None:
+        # Body permits any non-ESC byte. The body itself is consumed by
+        # the regex so the inner C0 controls never reach the C0 pass.
+        assert sanitize_for_log("a\x1bP\x01\x02\x03\x1b\\b") == "ab"
+
+    def test_apc_inside_dcs_body_breaks_dcs(self) -> None:
+        # ``\x1bP outer \x1b_ inner \x1b\\ remainder``. The DCS body
+        # regex stops at the inner ESC, so the DCS alternative fails at
+        # the outer position. Fe-single then matches ``\x1bP`` (P is
+        # 0x50, in 0x40-0x5F Fe range), advances. ``outer`` surfaces.
+        # Then APC ``\x1b_inner\x1b\\`` matches. ``remainder`` surfaces.
+        # DOCUMENTED BEHAVIOR: outer DCS payload leaks as plain text.
+        assert (
+            sanitize_for_log("\x1bPouter\x1b_inner\x1b\\remainder")
+            == "outerremainder"
+        )
+
+    def test_dcs_inside_apc(self) -> None:
+        # Symmetric case: APC body forbids ESC so DCS nested inside
+        # similarly fragments the match.
+        assert (
+            sanitize_for_log("\x1b_outer\x1bPinner\x1b\\remainder")
+            == "outerremainder"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Direct C1 introducers (no preceding ESC)
+# ---------------------------------------------------------------------------
+
+
+class TestDirectC1Introducers:
+    """U+0080-U+009F are the C1 control range. U+009B is a single-byte
+    CSI introducer equivalent to ``ESC [``, and U+009D is OSC. Python str
+    can hold these bytes. The current ANSI regex requires a literal ESC
+    prefix and therefore does NOT recognise direct C1 introducers as
+    starting a sequence — they fall through to the C1 escape pass and
+    surface as ``\\x9b`` / ``\\x9d`` literals followed by their payloads.
+
+    DOCUMENTED GAP: any terminal that interprets C1 introducers would
+    still see the payload as a control sequence. Mitigation in practice
+    is that almost no producer emits raw C1; modern locales transmit
+    ``ESC [`` instead. Severity LOW.
+    """
+
+    def test_direct_csi_introducer_u009b_not_swallowed(self) -> None:
+        # ``\x9b31mred`` is conceptually equivalent to ``\x1b[31mred`` on
+        # a terminal that supports 8-bit C1. The regex does not strip it.
+        # The C1 pass escapes ``\x9b`` to ``\\x9b``, and ``31mred``
+        # survives literally.
+        assert sanitize_for_log("\x9b31mred") == "\\x9b31mred"
+
+    def test_direct_osc_introducer_u009d_not_swallowed(self) -> None:
+        # ``\x9d0;title\x07`` would be an OSC on an 8-bit terminal.
+        # Currently: ``\x9d`` escaped, ``0;title`` survives, ``\x07`` BEL
+        # escaped.
+        assert sanitize_for_log("\x9d0;title\x07after") == "\\x9d0;title\\x07after"
+
+    def test_direct_dcs_u0090_not_swallowed(self) -> None:
+        # U+0090 is the 8-bit DCS introducer.
+        assert (
+            sanitize_for_log("\x90payload\x9c") == "\\x90payload\\x9c"
+        )  # \x9c is ST
+
+    @pytest.mark.parametrize(
+        "byte",
+        [0x80, 0x84, 0x88, 0x8D, 0x90, 0x9B, 0x9C, 0x9D, 0x9E, 0x9F],
+    )
+    def test_all_c1_bytes_escaped_not_swallowed(self, byte: int) -> None:
+        src = f"x{chr(byte)}y"
+        assert sanitize_for_log(src) == f"x\\x{byte:02x}y"
+
+
+# ---------------------------------------------------------------------------
+# Bare ESC + Fp / Fs bytes (gaps in Fe-only single-char pattern)
+# ---------------------------------------------------------------------------
+
+
+class TestEscFpFsGaps:
+    """The Fe single-char pattern matches only ESC + a byte in 0x40-0x5F
+    (with ``[`` and ``]``/``P``/``X``/``^``/``_`` partially carved out by
+    longer patterns earlier in the alternation, leaving the rest). It
+    does NOT cover Fp bytes (0x30-0x3F: ``\\x1b7`` DECSC, ``\\x1b8`` DECRC,
+    ``\\x1b=`` DECKPAM, ``\\x1b>`` DECKPNM) or Fs bytes (0x60-0x7E:
+    ``\\x1bc`` RIS, ``\\x1bn`` LS2, ``\\x1b~`` LS1R).
+
+    DOCUMENTED GAP: bare ESC drops to the C0 pass which escapes ESC to
+    ``\\x1b`` but leaves the second character intact. The resulting
+    string is no longer a control sequence — a terminal that reprints
+    it would just show ``\\x1b7``. Severity LOW: visual noise, not
+    exploitable.
+    """
+
+    @pytest.mark.parametrize(
+        "code,name",
+        [
+            (0x37, "DECSC save cursor (ESC 7)"),
+            (0x38, "DECRC restore cursor (ESC 8)"),
+            (0x3D, "DECKPAM keypad application (ESC =)"),
+            (0x3E, "DECKPNM keypad normal (ESC >)"),
+        ],
+    )
+    def test_esc_fp_byte_not_stripped(self, code: int, name: str) -> None:
+        src = f"a\x1b{chr(code)}b"
+        # ESC escaped, second byte survives.
+        assert sanitize_for_log(src) == f"a\\x1b{chr(code)}b", name
+
+    @pytest.mark.parametrize(
+        "code,name",
+        [
+            (0x63, "RIS full reset (ESC c)"),
+            (0x6E, "LS2 locking shift G2 (ESC n)"),
+            (0x6F, "LS3 locking shift G3 (ESC o)"),
+            (0x7C, "LS3R (ESC |)"),
+            (0x7D, "LS2R (ESC })"),
+            (0x7E, "LS1R (ESC ~)"),
+        ],
+    )
+    def test_esc_fs_byte_not_stripped(self, code: int, name: str) -> None:
+        src = f"a\x1b{chr(code)}b"
+        assert sanitize_for_log(src) == f"a\\x1b{chr(code)}b", name
+
+
+# ---------------------------------------------------------------------------
+# Multiple ESCs and ambiguity between alternatives
+# ---------------------------------------------------------------------------
+
+
+class TestMultipleAndAmbiguous:
+    def test_two_adjacent_esc_then_csi(self) -> None:
+        # ``\x1b\x1b\x1b[2J``. At pos 0: no alternative matches (next byte
+        # is ESC, in none of the byte classes the alternatives expect at
+        # pos+1). Fe-single requires 0x40-0x5F; ESC (0x1B) is not. So pos
+        # 0 ESC is left alone and escaped by C0 pass. Same for pos 1.
+        # Pos 2 starts a clean CSI which strips fully. Result: two
+        # escaped ESC literals followed by nothing.
+        assert sanitize_for_log("\x1b\x1b\x1b[2J") == "\\x1b\\x1b"
+
+    def test_esc_then_bracket_then_text_then_csi(self) -> None:
+        # ``\x1b[ ESC [ 0 m``. The first match attempt at pos 0: CSI
+        # requires final byte in 0x40-0x7E. Looking forward: ``[`` then
+        # ``\x1b`` (0x1B, NOT in final range), so first CSI attempt
+        # extends greedily through params/intermediates and fails. CSI
+        # falls through. OSC fails (introducer mismatch). DCS family
+        # fails. Fe-single requires ESC + [@-Z\\-_]; ``[`` IS 0x5B in
+        # 0x40-0x5F, but the carved-out ``[`` should still match Fe-single
+        # because the character class ``[@-Z\\-_]`` includes 0x5B.
+        # Wait: re-check pattern ``\x1b[@-Z\\-_]``. Range @-Z is 0x40-0x5A.
+        # ``[`` is 0x5B which is OUTSIDE @-Z. The next subrange ``\\-_``
+        # is 0x5C-0x5F. So 0x5B is NOT matched. Therefore Fe-single fails
+        # at pos 0 too. ESC at pos 0 escaped. ``[`` literal. CSI starts at
+        # pos 2 and consumes ``\x1b[0m``. Result: ``\\x1b[``.
+        assert sanitize_for_log("\x1b[\x1b[0m") == "\\x1b["
+
+    def test_csi_inside_what_looks_like_an_osc(self) -> None:
+        # ``\x1b]title\x1b[31mred\x07``. OSC body cannot have ESC. The
+        # OSC alternative fails. Fe-single matches ``\x1b]``. ``title``
+        # surfaces. CSI matches ``\x1b[31m``. ``red`` surfaces. BEL is C0
+        # and escapes to ``\\x07``.
+        assert (
+            sanitize_for_log("\x1b]title\x1b[31mred\x07")
+            == "titlered\\x07"
+        )
+
+    def test_greedy_csi_does_not_eat_past_first_valid_final(self) -> None:
+        # ``\x1b[1m\x1b[2m``: each CSI matches as a unit, second one
+        # starts fresh. No greedy across.
+        assert sanitize_for_log("\x1b[1m\x1b[2m") == ""
+
+
+# ---------------------------------------------------------------------------
+# Lone surrogate boundaries
+# ---------------------------------------------------------------------------
+
+
+class TestLoneSurrogateBoundaries:
+    def test_lone_high_at_start(self) -> None:
+        assert sanitize_for_log("\ud800rest") == f"{REPL}rest"
+
+    def test_lone_high_at_end(self) -> None:
+        assert sanitize_for_log("rest\ud800") == f"rest{REPL}"
+
+    def test_lone_high_only_char(self) -> None:
+        assert sanitize_for_log("\ud800") == REPL
+
+    def test_lone_low_at_start(self) -> None:
+        assert sanitize_for_log("\udc00rest") == f"{REPL}rest"
+
+    def test_lone_low_at_end(self) -> None:
+        assert sanitize_for_log("rest\udc00") == f"rest{REPL}"
+
+    def test_lone_low_only_char(self) -> None:
+        assert sanitize_for_log("\udc00") == REPL
+
+    def test_two_adjacent_high(self) -> None:
+        # ``\ud800\ud801``: first high is NOT followed by low -> lone.
+        # Second high also not followed by low -> lone. Both replaced.
+        assert sanitize_for_log("\ud800\ud801") == REPL + REPL
+
+    def test_two_adjacent_low(self) -> None:
+        # ``\udc00\udc01``: first low NOT preceded by high (lookbehind).
+        # Second low IS preceded by low — and low is not in [\ud800-\udbff]
+        # so lookbehind fails; second low also lone. Both replaced.
+        assert sanitize_for_log("\udc00\udc01") == REPL + REPL
+
+    def test_high_low_high_middle_pair_valid(self) -> None:
+        # ``\ud800 \ud83d \udc00 \ud801``:
+        #   pos 0 high: lookahead sees \ud83d (high), NOT in low range -> lone.
+        #   pos 1 high (\ud83d): lookahead sees \udc00 (low) -> valid pair.
+        #   pos 2 low: lookbehind sees \ud83d (high) -> valid pair.
+        #   pos 3 high: lookahead sees end -> lone.
+        # Result: REPL + valid-pair-as-emoji + REPL.
+        src = "\ud800🐀\ud801"
+        # 🐀 is U+1F400 RAT.
+        assert sanitize_for_log(src) == f"{REPL}\U0001f400{REPL}"
+
+    def test_high_high_low_first_high_lone(self) -> None:
+        # ``\ud800 \ud83d \udc00``:
+        #   pos 0 high: lookahead sees \ud83d (high, NOT low) -> lone.
+        #   pos 1 high: lookahead sees \udc00 (low) -> valid pair, skip.
+        #   pos 3: nothing.
+        src = "\ud800🐀"
+        assert sanitize_for_log(src) == f"{REPL}\U0001f400"
+
+    def test_low_high_inverted_pair(self) -> None:
+        # ``\udc00\ud800``: looks like inverted pair. Both are lone.
+        #   pos 0 low: lookbehind sees nothing -> lone.
+        #   pos 1 high: lookahead sees end -> lone.
+        # Both replaced.
+        src = "\udc00\ud800"
+        assert sanitize_for_log(src) == REPL + REPL
+
+    def test_consecutive_lone_surrogates_high_low_must_both_replace(self) -> None:
+        # Regression guard. Two separate lone surrogates constructed via
+        # chr(). Critically, this is NOT the astral codepoint U+10000: it is
+        # two distinct str codepoints U+D800 and U+DC00 stored side by side.
+        # The previous lookahead/lookbehind regex mistook them for a valid
+        # UTF-16 pair and let them through, breaking UTF-8 encoding. The
+        # current implementation strips every surrogate unconditionally.
+        src = chr(0xD800) + chr(0xDC00)
+        out = sanitize_for_log(src)
+        # Whatever we accept as "fixed", the output MUST be UTF-8 encodable.
+        out.encode("utf-8")
+        # And it must not contain raw surrogates.
+        for ch in out:
+            cp = ord(ch)
+            assert not (0xD800 <= cp <= 0xDFFF), (
+                f"raw surrogate U+{cp:04X} survived"
+            )
+
+    def test_lone_high_then_valid_pair(self) -> None:
+        # ``\ud800 then valid 😀``:
+        #   pos 0 lone high (next is high).
+        #   pos 1 high with low after -> pair.
+        src = "\ud800😀"
+        assert sanitize_for_log(src) == f"{REPL}\U0001f600"
+
+    def test_valid_pair_then_lone_low(self) -> None:
+        src = "😀\udc01"
+        assert sanitize_for_log(src) == f"\U0001f600{REPL}"
+
+
+# ---------------------------------------------------------------------------
+# ANSI interleaved with multi-byte / ZWJ sequences
+# ---------------------------------------------------------------------------
+
+
+class TestAnsiInterleavedWithUnicode:
+    def test_ansi_inside_zwj_family_reassembled(self) -> None:
+        # ZWJ emoji family with ANSI colour codes interleaved. After ANSI
+        # strip, the ZWJ sequence must be intact (man + ZWJ + woman + ZWJ
+        # + girl + ZWJ + boy).
+        src = "👨\x1b[31m‍👩\x1b[0m‍👧‍👦"
+        expected = "👨‍👩‍👧‍👦"
+        assert sanitize_for_log(src) == expected
+
+    def test_ansi_between_cjk_chars(self) -> None:
+        # The ANSI bytes are not UTF-8 continuation bytes, but the regex
+        # operates on Python str (already decoded). Still worth verifying.
+        assert sanitize_for_log("你\x1b[2J好") == "你好"
+
+    def test_ansi_between_combining_characters(self) -> None:
+        # ``e`` + combining acute (U+0301). ANSI between base and combiner
+        # must not break the combine.
+        src = "e\x1b[31ḿ"
+        assert sanitize_for_log(src) == "é"
+
+    def test_ansi_inside_skin_tone_modifier_sequence(self) -> None:
+        # ``👋`` (waving hand) + U+1F3FB (light skin tone modifier).
+        # ANSI between base emoji and modifier.
+        src = "👋\x1b[1m\U0001f3fb"
+        assert sanitize_for_log(src) == "👋\U0001f3fb"
+
+
+# ---------------------------------------------------------------------------
+# Performance: linear time on adversarial input
+# ---------------------------------------------------------------------------
+
+
+class TestPerformance:
+    def test_one_megabyte_ansi_strips_under_one_second(self) -> None:
+        # 100 000 copies of ``\x1b[31m\x1b[0m`` ≈ 800 KB. Must complete
+        # well under 1 s even on a slow CI runner; observed ≈10 ms on a
+        # modern desktop. Budget is generous to avoid flakes.
+        payload = "\x1b[31m\x1b[0m" * 100_000
+        t0 = time.perf_counter()
+        out = sanitize_for_log(payload)
+        dt = time.perf_counter() - t0
+        assert out == ""
+        assert dt < 1.0, f"sanitizer took {dt:.3f}s on 1 MB ANSI input"
+
+    def test_long_unterminated_osc_no_backtracking_hang(self) -> None:
+        # A megabyte of OSC body with no terminator. The OSC alternative
+        # cannot complete; Fe-single fires on ``\x1b]`` and the body
+        # passes through as plain text. Important: this must finish in
+        # linear time despite the unterminated body.
+        payload = "\x1b]" + "a" * 1_000_000
+        t0 = time.perf_counter()
+        out = sanitize_for_log(payload)
+        dt = time.perf_counter() - t0
+        assert out == "a" * 1_000_000
+        assert dt < 1.0, f"OSC fallback took {dt:.3f}s"
+
+    def test_alternating_partial_csi_no_pathological_backtrack(self) -> None:
+        # Many almost-CSI fragments that all fail at the final byte. Each
+        # falls back to C0-escape independently — should remain linear.
+        payload = "\x1b[31" * 10_000  # 40 000 chars
+        t0 = time.perf_counter()
+        out = sanitize_for_log(payload)
+        dt = time.perf_counter() - t0
+        assert "\x1b" not in out  # all ESCs escaped
+        assert dt < 1.0, f"partial-CSI flood took {dt:.3f}s"
+
+
+# ---------------------------------------------------------------------------
+# CSI final-byte exhaustive coverage
+# ---------------------------------------------------------------------------
+
+
+# All bytes in 0x40-0x7E that are legal CSI finals. The pattern accepts the
+# whole range without carve-out, so every one of these must terminate the
+# CSI cleanly.
+_CSI_FINAL_BYTES = [chr(c) for c in range(0x40, 0x7F)]
+
+
+class TestCsiFinalByteExhaustive:
+    @pytest.mark.parametrize("final", _CSI_FINAL_BYTES)
+    def test_every_final_byte_terminates_csi(self, final: str) -> None:
+        src = f"pre\x1b[1{final}post"
+        assert sanitize_for_log(src) == "prepost", (
+            f"CSI with final 0x{ord(final):02x} ({final!r}) not stripped"
+        )
+
+    @pytest.mark.parametrize("final", _CSI_FINAL_BYTES)
+    def test_every_final_byte_empty_params(self, final: str) -> None:
+        # No params at all — also valid CSI.
+        src = f"pre\x1b[{final}post"
+        assert sanitize_for_log(src) == "prepost", (
+            f"empty-param CSI with final {final!r} not stripped"
+        )
+
+    def test_empty_csi_reset(self) -> None:
+        # ``\x1b[m`` is SGR reset with no params, common in compiler output.
+        assert sanitize_for_log("\x1b[m") == ""
+
+    def test_many_param_csi(self) -> None:
+        # 15-param SGR. Must strip in full.
+        params = ";".join(str(i) for i in range(1, 16))
+        assert sanitize_for_log(f"\x1b[{params}m") == ""
+
+
+# ---------------------------------------------------------------------------
+# BIDI position coverage
+# ---------------------------------------------------------------------------
+
+
+class TestBidiPositions:
+    @pytest.mark.parametrize(
+        "codepoint",
+        [0x202A, 0x202B, 0x202C, 0x202D, 0x202E, 0x2066, 0x2067, 0x2068, 0x2069],
+    )
+    @pytest.mark.parametrize(
+        "position",
+        ["start", "middle", "end", "only"],
+    )
+    def test_bidi_at_position(self, codepoint: int, position: str) -> None:
+        ch = chr(codepoint)
+        if position == "start":
+            src, expected = ch + "rest", "rest"
+        elif position == "middle":
+            src, expected = "pre" + ch + "post", "prepost"
+        elif position == "end":
+            src, expected = "rest" + ch, "rest"
+        else:
+            src, expected = ch, ""
+        assert sanitize_for_log(src) == expected
+
+
+# ---------------------------------------------------------------------------
+# Mixed C0 / C1 / ANSI / surrogate / BIDI in one string
+# ---------------------------------------------------------------------------
+
+
+class TestMixedClasses:
+    def test_one_of_each_in_order(self) -> None:
+        # ANSI strip first, then BIDI, then C0 escape, then C1 escape,
+        # then lone surrogate replace. Order matters: BIDI runs before
+        # C0/C1 escape, so the BIDI char is gone before being seen as a
+        # non-control codepoint. ANSI runs first so its inner bytes never
+        # reach later passes.
+        src = "a\x1b[31m‮b\x00c\x9dd\ud800e"
+        # \x1b[31m -> gone
+        # ‮ BIDI RLO -> gone
+        # \x00 NUL -> \x00 escaped
+        # \x9d C1 -> \x9d escaped
+        # \ud800 lone high -> REPL
+        expected = "ab\\x00c\\x9dd" + REPL + "e"
+        assert sanitize_for_log(src) == expected
+
+    def test_ansi_wrapping_c0_does_not_leak(self) -> None:
+        # ANSI body contains a C0 control. The CSI regex matches the
+        # whole ANSI sequence atomically, so the inner C0 vanishes with
+        # it — it does NOT reach the C0 pass.
+        # ``\x1b[?\x081h`` — but \x08 is in C0, will it stop the CSI?
+        # Params class is [0-?] (0x30-0x3F). \x08 is below that range.
+        # So CSI greedy match stops: regex matches ``\x1b[?`` then needs
+        # final byte but \x08 is below 0x40. Match fails at this
+        # position. Fall back to Fe-single: ``\x1b[`` — ``[`` is 0x5B,
+        # NOT in [@-Z\\-_]. Fail. ESC escapes. ``[?`` survives. \x08
+        # escapes. ``1h`` survives.
+        assert sanitize_for_log("\x1b[?\x081h") == "\\x1b[?\\x081h"
+
+
+# ---------------------------------------------------------------------------
+# Replacement char and literal escape form idempotence
+# ---------------------------------------------------------------------------
+
+
+class TestIdempotenceArtifacts:
+    def test_existing_replacement_char_passes_through(self) -> None:
+        # Idempotence requires that an input already containing U+FFFD
+        # survives untouched. If the regex were to re-match U+FFFD as a
+        # surrogate, sanitize would not be idempotent.
+        assert sanitize_for_log(f"a{REPL}b") == f"a{REPL}b"
+
+    def test_multiple_replacement_chars_pass_through(self) -> None:
+        assert sanitize_for_log(REPL * 10) == REPL * 10
+
+    def test_literal_backslash_x1b_string_passes_through(self) -> None:
+        # The four-character literal ``\\x1b`` (backslash, x, 1, b) is
+        # NOT a real ESC byte. It must survive unchanged.
+        assert sanitize_for_log("error: \\x1b decoded") == "error: \\x1b decoded"
+
+    def test_full_idempotence_on_complex_hostile(self) -> None:
+        # Sanitizing twice yields the same string as sanitizing once.
+        hostile = (
+            "\x1b[31m" "head"
+            "\x00mid\r"
+            "‮tail"
+            "\ud800"
+            "\x9b"
+            "\x1b]0;t\x07"
+        )
+        once = sanitize_for_log(hostile)
+        twice = sanitize_for_log(once)
+        assert once == twice
+
+    def test_idempotence_random_axes(self) -> None:
+        # A broader hostile: every class represented twice over.
+        hostile = (
+            "α"  # Greek (preserve)
+            "\x1b[1;31m" "X" "\x1b[0m"  # ANSI
+            "‭" "Y" "‬"  # BIDI
+            "\x01\x02"  # C0
+            "\x80\x9f"  # C1
+            "😀"  # valid pair
+            "\ud800"  # lone high
+            "\udc00"  # lone low
+            "你好"  # CJK
+            "🇺🇸"  # regional indicator pair (two astral chars)
+        )
+        once = sanitize_for_log(hostile)
+        twice = sanitize_for_log(once)
+        thrice = sanitize_for_log(twice)
+        assert once == twice == thrice
+
+
+# ---------------------------------------------------------------------------
+# Cross-function: composition still safe under adversarial input
+# ---------------------------------------------------------------------------
+
+
+class TestCompositionSafety:
+    def test_log_output_is_json_safe_under_adversarial_input(self) -> None:
+        # Every adversarial axis at once. NOTE: lone surrogates are
+        # placed with non-surrogate neighbours to avoid triggering the
+        # documented ``𐀀`` lookaround-confusion bug (covered
+        # separately as xfail). Once that bug is fixed, ``hostile`` can
+        # be tightened to include adjacent lone surrogates.
+        hostile = (
+            "\x1b[31m"
+            "\x1b]52;c;EXFIL\x07"
+            "\x1bPdcs\x1b\\"
+            "\x9b31m"
+            "\x1b7"
+            "\x00\x07\r"
+            "‮"
+            "\ud800X"  # lone high, then ASCII (no false pair)
+            "Y\udc00"  # ASCII, then lone low (no false pair)
+            "\ud83dZ"  # lone high, then ASCII
+            "text"
+        )
+        out = sanitize_for_log(hostile)
+        # Must encode to UTF-8.
+        out.encode("utf-8")
+        # Must serialise as JSON.
+        json.dumps(out)
+        # No raw ESC byte must survive sanitize_for_log.
+        assert "\x1b" not in out
+        # No raw C0 except TAB / LF.
+        for ch in out:
+            cp = ord(ch)
+            assert cp in (0x09, 0x0A) or cp >= 0x20
+        # No lone surrogate.
+        for ch in out:
+            cp = ord(ch)
+            assert not 0xD800 <= cp <= 0xDFFF
+        # No BIDI override.
+        for ch in out:
+            cp = ord(ch)
+            assert not (0x202A <= cp <= 0x202E or 0x2066 <= cp <= 0x2069)
+
+    def test_dbtext_then_log_idempotent(self) -> None:
+        hostile = "a\x00\x1b[2J\ud800b"
+        once = sanitize_for_log(sanitize_for_dbtext(hostile))
+        twice = sanitize_for_log(sanitize_for_dbtext(once))
+        assert once == twice
+
+    def test_json_then_log_idempotent(self) -> None:
+        hostile = "a\x1b[2J\ud800\x00b"
+        once = sanitize_for_log(sanitize_for_json(hostile))
+        twice = sanitize_for_log(sanitize_for_json(once))
+        assert once == twice
diff --git a/tests/utils/test_text_sanitize_unicode.py b/tests/utils/test_text_sanitize_unicode.py
new file mode 100644
index 00000000..2546e48d
--- /dev/null
+++ b/tests/utils/test_text_sanitize_unicode.py
@@ -0,0 +1,1019 @@
+"""Unicode-layer fixture tests for gigaevo/utils/text_sanitize.py.
+
+These tests complement test_text_sanitize.py by exercising Unicode-domain
+concerns the original suite does not cover: confusables / homoglyphs,
+normalization-form invariance, zero-width characters, weak BIDI marks
+(distinct from the strong overrides already stripped), variation selectors,
+tag characters, line / paragraph separators, BOM placement, soft hyphen,
+Zalgo combining stacks, full CJK script families, RTL scripts, emoji ZWJ
+sequences (family / rainbow flag), Fitzpatrick skin-tone modifiers,
+regional-indicator country flags, math alphanumerics above the BMP, and
+half-/full-width and non-Latin digit forms.
+
+Every fixture is built as a positive case (something the sanitizer must
+preserve verbatim) or a negative case (something it must strip or escape).
+Each test carries a comment explaining why the input is interesting and
+what property it asserts.
+"""
+
+from __future__ import annotations
+
+import json
+import unicodedata
+
+import pytest
+
+from gigaevo.utils.text_sanitize import (
+    clean_identifier,
+    sanitize_for_dbtext,
+    sanitize_for_json,
+    sanitize_for_log,
+)
+
+# ---------------------------------------------------------------------------
+# Confusables and homoglyphs
+# ---------------------------------------------------------------------------
+
+
+class TestConfusables:
+    """Latin / Cyrillic / Greek letters that render identically.
+
+    The threat: an operator reading a log sees ``openai`` but the string
+    actually contains Cyrillic letters that route to a different host or
+    poison a cache key. Two distinct contracts:
+
+    * sanitize_for_log preserves all three so the operator at least has the
+      raw bytes available for inspection / forensic comparison.
+    * clean_identifier strips non-ASCII so cache keys / log tags collapse to
+      a single canonical form (which, paradoxically, also reveals the
+      attack because the spoofed identifier shrinks dramatically).
+    """
+
+    # Latin A U+0041, Cyrillic А U+0410, Greek capital Α U+0391 all render
+    # visually identical in most fonts. Positive case for sanitize_for_log.
+    @pytest.mark.parametrize(
+        "codepoint,name",
+        [
+            (0x0041, "Latin A"),
+            (0x0410, "Cyrillic A"),
+            (0x0391, "Greek Alpha"),
+        ],
+    )
+    def test_log_preserves_each_confusable(self, codepoint: int, name: str) -> None:
+        src = f"prefix_{chr(codepoint)}_suffix"
+        assert sanitize_for_log(src) == src, name
+
+    def test_log_preserves_all_three_side_by_side(self) -> None:
+        # The trio together: operator can compare byte-for-byte.
+        src = "AАΑ"
+        assert sanitize_for_log(src) == src
+
+    def test_identifier_collapses_cyrillic_to_empty(self) -> None:
+        # Pure Cyrillic identifier is not safe — drops to nothing.
+        assert clean_identifier("опенаи") == ""
+
+    def test_identifier_strips_only_non_ascii_from_mixed(self) -> None:
+        # Spoofed ``openai``: o and a are Cyrillic (U+043E, U+0430), the
+        # rest are Latin. Only Latin chars survive, yielding a string that
+        # is visibly shorter than the input — that asymmetry is the tell.
+        spoof = "оpenаi"  # о p e n а i
+        assert clean_identifier(spoof) == "peni"
+        assert len(clean_identifier(spoof)) < len(spoof)
+
+    def test_identifier_strips_greek_alpha(self) -> None:
+        # Greek capital Α masquerading as Latin A inside a model name.
+        # The single Greek char is removed, leaving a single dash between
+        # ``model`` and ``lpha`` — visible shortening reveals the spoof.
+        assert clean_identifier("model-Αlpha-v2") == "model-lpha-v2"
+
+
+# ---------------------------------------------------------------------------
+# Unicode normalization: NFC vs NFD
+# ---------------------------------------------------------------------------
+
+
+class TestNormalizationInvariance:
+    """The sanitizer must not normalize either way.
+
+    Two strings that render identically but live in different normalization
+    forms (precomposed NFC vs decomposed NFD) carry different byte sequences.
+    A sanitizer that silently normalized would corrupt round-tripping into
+    systems that hash on bytes (asyncpg LISTEN/NOTIFY, content-addressed
+    caches, signature verification).
+    """
+
+    @pytest.mark.parametrize(
+        "nfc,nfd",
+        [
+            ("é", "é"),  # é (acute)
+            ("è", "è"),  # è (grave)
+            ("ñ", "ñ"),  # ñ (tilde)
+            ("ä", "ä"),  # ä (diaeresis)
+            ("Å", "Å"),  # Å (ring above)
+            ("ẛ", "ẛ"),  # ẛ (long s with dot)
+        ],
+    )
+    def test_nfc_and_nfd_both_round_trip(self, nfc: str, nfd: str) -> None:
+        # Sanity: the two forms really do normalize to each other.
+        assert unicodedata.normalize("NFC", nfd) == nfc
+        # Both forms must survive verbatim — no implicit normalization.
+        assert sanitize_for_log(nfc) == nfc
+        assert sanitize_for_log(nfd) == nfd
+        # And neither becomes the other.
+        assert sanitize_for_log(nfd) != nfc
+        assert sanitize_for_log(nfc) != nfd
+
+    def test_nfd_preserves_combining_count(self) -> None:
+        # NFD string: ``e`` + combining acute. Length must not change.
+        src = "é"
+        out = sanitize_for_log(src)
+        assert len(out) == 2 and out[1] == "́"
+
+
+# ---------------------------------------------------------------------------
+# Zero-width characters
+# ---------------------------------------------------------------------------
+
+
+class TestZeroWidth:
+    """ZWSP, ZWNJ, ZWJ, WJ all carry semantic weight.
+
+    * ZWJ (U+200D) joins emoji into family / profession sequences.
+    * ZWNJ (U+200C) inhibits ligatures (essential in Persian / Indic).
+    * ZWSP (U+200B) marks word boundaries in scripts with no spaces.
+    * WJ  (U+2060) is a no-break joiner used in line-break control.
+
+    None are in the BIDI override / isolate ranges and must survive.
+    Negative case: would a zero-width injection inside a clean_identifier
+    survive? No — those characters are not in the ASCII charset, so the
+    identifier path strips them.
+    """
+
+    @pytest.mark.parametrize(
+        "codepoint,name",
+        [
+            (0x200B, "ZWSP"),
+            (0x200C, "ZWNJ"),
+            (0x200D, "ZWJ"),
+            (0x2060, "WJ"),
+        ],
+    )
+    def test_log_preserves_zero_width(self, codepoint: int, name: str) -> None:
+        # Positive: zero-width chars survive sanitize_for_log untouched.
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src, name
+
+    @pytest.mark.parametrize(
+        "codepoint",
+        [0x200B, 0x200C, 0x200D, 0x2060],
+    )
+    def test_identifier_strips_zero_width(self, codepoint: int) -> None:
+        # Negative: zero-width chars must not survive into identifiers, or
+        # cache keys would collapse / collide invisibly.
+        src = f"model{chr(codepoint)}name"
+        assert clean_identifier(src) == "modelname"
+
+
+# ---------------------------------------------------------------------------
+# Weak BIDI marks (NOT the strong overrides already stripped)
+# ---------------------------------------------------------------------------
+
+
+class TestWeakBidiMarks:
+    """LRM / RLM / ALM are weak hints, not directionality overrides.
+
+    Unicode classifies these as Bidi_Class=L / R / AL respectively (weak),
+    distinct from the strong overrides U+202A-U+202E and isolates
+    U+2066-U+2069 (which the sanitizer correctly strips). The strip regex
+    is ``[U+202A-U+202E][U+2066-U+2069]`` — narrow on purpose. Weak marks
+    are legitimate for mixed-direction text rendering inside Arabic /
+    Hebrew strings. Asserting the current behavior so a future regex
+    widening would have to deliberately break this test.
+    """
+
+    @pytest.mark.parametrize(
+        "codepoint,name",
+        [
+            (0x200E, "LRM"),  # Left-to-right mark
+            (0x200F, "RLM"),  # Right-to-left mark
+            (0x061C, "ALM"),  # Arabic letter mark
+        ],
+    )
+    def test_weak_bidi_preserved(self, codepoint: int, name: str) -> None:
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src, name
+
+
+# ---------------------------------------------------------------------------
+# BIDI strip pattern boundary checks
+# ---------------------------------------------------------------------------
+
+
+class TestBidiStripBoundaries:
+    """Ensure the strip pattern is exact and not over-broad.
+
+    The pattern catches U+202A-U+202E and U+2066-U+2069 only. Adjacent
+    characters (U+2029 PS, U+202F NNBSP, U+2065 reserved, U+206A deprecated
+    formatter) must pass through. A regression that widened the class
+    would break legitimate RTL rendering and CJK numbering.
+    """
+
+    @pytest.mark.parametrize(
+        "codepoint,name",
+        [
+            (0x2029, "PARAGRAPH SEPARATOR (just below LRE)"),
+            (0x202F, "NARROW NO-BREAK SPACE (just above RLO)"),
+            (0x2065, "reserved, just below LRI"),
+            (0x206A, "INHIBIT SYMMETRIC SWAPPING (deprecated, just above PDI)"),
+            (0x206F, "NOMINAL DIGIT SHAPES (deprecated)"),
+        ],
+    )
+    def test_neighbors_of_bidi_range_preserved(
+        self, codepoint: int, name: str
+    ) -> None:
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src, name
+
+
+# ---------------------------------------------------------------------------
+# Variation selectors
+# ---------------------------------------------------------------------------
+
+
+class TestVariationSelectors:
+    """VS1-VS16 (U+FE00-U+FE0F) and VS17-VS256 (U+E0100-U+E01EF).
+
+    VS16 (U+FE0F) is the emoji-presentation selector: ``❤️`` is U+2764
+    HEAVY BLACK HEART followed by U+FE0F. Stripping VS16 silently changes
+    rendering from emoji to a black-and-white dingbat. The other VS code
+    points carry semantic meaning in CJK ideographic variant selectors.
+    """
+
+    @pytest.mark.parametrize("codepoint", [0xFE00, 0xFE07, 0xFE0E, 0xFE0F])
+    def test_vs1_to_vs16_preserved(self, codepoint: int) -> None:
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src
+
+    @pytest.mark.parametrize("codepoint", [0xE0100, 0xE0150, 0xE01EF])
+    def test_supplementary_vs_preserved(self, codepoint: int) -> None:
+        # VS17-VS256 above the BMP — CJK ideographic variation.
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src
+
+    def test_heart_emoji_with_vs16_preserved(self) -> None:
+        # The canonical example: ``❤️`` = U+2764 + U+FE0F.
+        heart = "❤️"
+        assert sanitize_for_log(heart) == heart
+        assert len(sanitize_for_log(heart)) == 2
+
+    def test_vs15_text_presentation_preserved(self) -> None:
+        # VS15 (U+FE0E) forces *text* (mono) presentation. Equally semantic.
+        text_heart = "❤︎"
+        assert sanitize_for_log(text_heart) == text_heart
+
+
+# ---------------------------------------------------------------------------
+# Tag characters U+E0000-U+E007F
+# ---------------------------------------------------------------------------
+
+
+class TestTagCharacters:
+    """Tag characters are invisible ASCII shadows used in some
+    Trojan-Source-style steganography attacks. The current sanitizer does
+    NOT strip them; this is documented behavior — they are valid for
+    locale subtags inside emoji sequences (Welsh / English / Scottish
+    flag variants). Tests assert preservation explicitly so any future
+    decision to strip them shows up as a deliberate test change.
+    """
+
+    @pytest.mark.parametrize(
+        "codepoint",
+        [0xE0000, 0xE0020, 0xE0041, 0xE007F],  # tag space, tag 'A', cancel tag
+    )
+    def test_tag_char_preserved(self, codepoint: int) -> None:
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src
+
+    def test_invisible_tag_payload_survives(self) -> None:
+        # An invisible-payload variant of Trojan Source: the visible bytes
+        # look innocent, but tag chars carry a hidden ASCII shadow.
+        # Sanitizer does not strip tag chars — operator sees clean visible
+        # output, but downstream byte-level checks (hash, length) reveal it.
+        visible = "// looks safe"
+        hidden = "".join(chr(0xE0000 + 0x20 + i) for i in range(5))  # tag "...."
+        payload = visible + hidden
+        assert sanitize_for_log(payload) == payload
+        # Crucially, the length differs from what an operator would expect.
+        assert len(sanitize_for_log(payload)) == len(visible) + 5
+
+
+# ---------------------------------------------------------------------------
+# Line / paragraph separators U+2028 / U+2029
+# ---------------------------------------------------------------------------
+
+
+class TestLineParaSeparators:
+    """U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR.
+
+    These are real Unicode line terminators. Critically, JavaScript treats
+    them as line terminators *inside string literals* (per ECMAScript), so
+    a sanitized log message containing U+2028 that ends up inlined into a
+    ``<script>`` tag breaks JS parsing — historically a JSON-in-script-tag
+    injection vector. Python's ``json.dumps(..., ensure_ascii=False)``
+    does NOT escape these; ``ensure_ascii=True`` (default) does.
+
+    Current sanitizer behavior: passes them through. Documented here so
+    callers shipping JSON to ``<script>`` know to pipeline an extra escape
+    or to keep ``ensure_ascii=True``.
+    """
+
+    @pytest.mark.parametrize("codepoint", [0x2028, 0x2029])
+    def test_separator_preserved_in_log(self, codepoint: int) -> None:
+        src = f"a{chr(codepoint)}b"
+        assert sanitize_for_log(src) == src
+
+    def test_json_default_escapes_u2028(self) -> None:
+        # Document the safe default: json.dumps WITHOUT ensure_ascii=False
+        # escapes U+2028, which is what you want when emitting into <script>.
+        out = json.dumps("a
b")
+        assert "\\u2028" in out
+
+    def test_json_ensure_ascii_false_lets_u2028_through(self) -> None:
+        # The dangerous mode: U+2028 survives as a literal byte sequence.
+        # Callers using ensure_ascii=False on sanitized text and inlining
+        # into <script> must additionally escape U+2028 / U+2029.
+        out = json.dumps("a
b", ensure_ascii=False)
+        assert "
" in out
+
+
+# ---------------------------------------------------------------------------
+# BOM (U+FEFF) at various positions
+# ---------------------------------------------------------------------------
+
+
+class TestBOM:
+    """U+FEFF zero-width no-break space, used as a Byte Order Mark.
+
+    Legitimate at the start of a file as encoding signal. Suspicious in
+    the middle of a string (no functional purpose; sometimes used to make
+    text comparisons silently fail). Current sanitizer preserves it
+    everywhere — neither helping nor hurting. Tests pin the behavior.
+    """
+
+    @pytest.mark.parametrize(
+        "src,desc",
+        [
+            ("hello", "BOM at start (file-signature use)"),
+            ("hello", "BOM in middle (suspicious)"),
+            ("hello", "BOM at end"),
+            ("", "BOM only"),
+            ("", "multiple BOMs"),
+        ],
+    )
+    def test_bom_preserved_through_log(self, src: str, desc: str) -> None:
+        assert sanitize_for_log(src) == src, desc
+
+    @pytest.mark.parametrize(
+        "src",
+        ["hello", "hello", "hello"],
+    )
+    def test_bom_preserved_through_json(self, src: str) -> None:
+        assert sanitize_for_json(src) == src
+
+    @pytest.mark.parametrize(
+        "src",
+        ["hello", "hello", "hello"],
+    )
+    def test_bom_preserved_through_dbtext(self, src: str) -> None:
+        assert sanitize_for_dbtext(src) == src
+
+    def test_bom_stripped_from_identifier(self) -> None:
+        # Negative: U+FEFF is not in the ASCII charset, identifier path
+        # drops it. Prevents invisible cache-key collisions.
+        assert clean_identifier("model-v1") == "model-v1"
+
+
+# ---------------------------------------------------------------------------
+# Soft hyphen U+00AD
+# ---------------------------------------------------------------------------
+
+
+class TestSoftHyphen:
+    """U+00AD SOFT HYPHEN: invisible line-break hint.
+
+    Legitimate in word-processor exports and certain CMS systems. Falls
+    outside the C0 / C1 range so the sanitizer correctly preserves it.
+    """
+
+    def test_soft_hyphen_preserved_in_log(self) -> None:
+        src = "long­word"
+        assert sanitize_for_log(src) == src
+
+    def test_soft_hyphen_stripped_from_identifier(self) -> None:
+        # Negative: a soft hyphen inside a model name could mask collisions.
+        assert clean_identifier("gpt­4") == "gpt4"
+
+
+# ---------------------------------------------------------------------------
+# Zalgo: stacked combining diacritics
+# ---------------------------------------------------------------------------
+
+
+class TestZalgoCombining:
+    """Pathological but legitimate: base character + many combining marks.
+
+    Combining diacritics live in U+0300-U+036F (and several extension
+    blocks). None overlap C0/C1/BIDI/surrogate ranges, so they must
+    pass through. A 50-mark stack tests both the regex and any naive
+    string-length assumption downstream.
+    """
+
+    def test_fifty_combining_marks_preserved(self) -> None:
+        # Build ``A`` plus 50 combining accents cycling through U+0300-U+0331.
+        base = "A"
+        marks = "".join(chr(0x0300 + i % 50) for i in range(50))
+        src = base + marks
+        assert sanitize_for_log(src) == src
+        assert len(sanitize_for_log(src)) == 51
+
+    def test_combining_only_string_preserved(self) -> None:
+        # Combining marks with no base — odd but legitimate (will render
+        # against a dotted circle). Must not be stripped.
+        src = "".join(chr(0x0300 + i) for i in range(10))
+        assert sanitize_for_log(src) == src
+
+    def test_zalgo_through_dbtext(self) -> None:
+        src = "A" + "".join(chr(0x0300 + i % 30) for i in range(30))
+        assert sanitize_for_dbtext(src) == src
+
+
+# ---------------------------------------------------------------------------
+# CJK script families
+# ---------------------------------------------------------------------------
+
+
+class TestCJKFamilies:
+    """All major CJK scripts must round-trip. LLM error output sometimes
+    embeds Chinese / Japanese / Korean string literals from training data.
+    """
+
+    @pytest.mark.parametrize(
+        "src,script",
+        [
+            ("汉字", "Han (Simplified)"),  # 汉字
+            ("漢字", "Han (Traditional)"),  # 漢字
+            ("ひらがな", "Hiragana"),  # ひらがな
+            ("カタカナ", "Katakana"),  # カタカナ
+            ("한글", "Hangul"),  # 한글
+            ("ㄅㄆㄇ", "Bopomofo"),  # ㄅㄆㄇ
+            ("んン", "Hiragana + Katakana N"),
+        ],
+    )
+    def test_cjk_round_trip(self, src: str, script: str) -> None:
+        assert sanitize_for_log(src) == src, script
+        assert sanitize_for_json(src) == src, script
+        assert sanitize_for_dbtext(src) == src, script
+
+    def test_mixed_cjk_with_ascii_error_text(self) -> None:
+        # Realistic: a Python traceback whose UserError message is CJK.
+        src = "ValueError: 设置错误 in line 42"
+        assert sanitize_for_log(src) == src
+
+
+# ---------------------------------------------------------------------------
+# Right-to-left scripts
+# ---------------------------------------------------------------------------
+
+
+class TestRTLScripts:
+    """RTL strings must round-trip with no BIDI strip mangling.
+
+    Important: the strip pattern catches U+202A-U+202E + U+2066-U+2069
+    only. Arabic, Hebrew, Syriac letter ranges are far below this; the
+    regex character class won't match them. This is the test that would
+    fail loudly if the regex ever widened.
+    """
+
+    @pytest.mark.parametrize(
+        "src,script",
+        [
+            ("مرحبا", "Arabic (مرحبا)"),
+            ("שלום", "Hebrew (שלום)"),
+            ("ܫܠܡܐ", "Syriac (ܫܠܡܐ)"),
+            ("تجربة", "Arabic word (تجربة)"),
+            ("בראשית", "Hebrew word (בראשית)"),
+        ],
+    )
+    def test_rtl_preserved_through_log(self, src: str, script: str) -> None:
+        assert sanitize_for_log(src) == src, script
+
+    def test_rtl_with_legitimate_weak_bidi_mark(self) -> None:
+        # Arabic text with embedded LRM (legitimate for numeric isolation
+        # in mixed-direction phrases). Must survive intact.
+        src = "عدد ‎42‎ جديد"
+        assert sanitize_for_log(src) == src
+
+    def test_rtl_with_strong_override_strips_only_override(self) -> None:
+        # The override is removed; the Arabic letters are preserved.
+        src = "مرحبا‮ attack"
+        out = sanitize_for_log(src)
+        assert "‮" not in out
+        assert "مرحبا" in out
+
+
+# ---------------------------------------------------------------------------
+# Emoji ZWJ sequences and modifiers
+# ---------------------------------------------------------------------------
+
+
+class TestEmojiSequences:
+    """Emoji are not just single code points. Family emoji uses ZWJ to
+    glue heads / women / girls / boys; rainbow flag is white-flag + VS16
+    + ZWJ + rainbow. Any over-broad strip (zero-width or VS16) silently
+    breaks rendering. Tests ensure round-trip.
+    """
+
+    @pytest.mark.parametrize(
+        "src,desc",
+        [
+            ("\U0001f468‍\U0001f469‍\U0001f467‍\U0001f466", "family"),
+            ("\U0001f3f3️‍\U0001f308", "rainbow flag"),
+            ("\U0001f9d1‍\U0001f4bb", "technologist"),
+            ("\U0001f469‍\U0001f527", "woman mechanic"),
+            ("\U0001f441️‍\U0001f5e8️", "eye in speech bubble"),
+        ],
+    )
+    def test_zwj_sequence_round_trip(self, src: str, desc: str) -> None:
+        assert sanitize_for_log(src) == src, desc
+        assert sanitize_for_json(src) == src, desc
+        assert sanitize_for_dbtext(src) == src, desc
+
+    @pytest.mark.parametrize(
+        "src,desc",
+        [
+            ("\U0001f44b\U0001f3fb", "waving hand light"),  # Fitzpatrick 1-2
+            ("\U0001f44b\U0001f3fc", "waving hand medium-light"),  # 3
+            ("\U0001f44b\U0001f3fd", "waving hand medium"),  # 4
+            ("\U0001f44b\U0001f3fe", "waving hand medium-dark"),  # 5
+            ("\U0001f44b\U0001f3ff", "waving hand dark"),  # 6
+        ],
+    )
+    def test_skin_tone_modifiers_preserved(self, src: str, desc: str) -> None:
+        # Fitzpatrick modifiers U+1F3FB-U+1F3FF must survive intact.
+        assert sanitize_for_log(src) == src, desc
+
+    @pytest.mark.parametrize(
+        "src,desc",
+        [
+            ("\U0001f1fa\U0001f1f8", "US flag"),
+            ("\U0001f1ef\U0001f1f5", "JP flag"),
+            ("\U0001f1e9\U0001f1ea", "DE flag"),
+            ("\U0001f1f7\U0001f1fa", "RU flag"),
+        ],
+    )
+    def test_regional_indicator_flags_preserved(self, src: str, desc: str) -> None:
+        # Country flags are pairs of regional indicators U+1F1E6-U+1F1FF.
+        # No control / BIDI / surrogate range overlap; must survive.
+        assert sanitize_for_log(src) == src, desc
+
+    def test_emoji_with_vs16_survives_json_round_trip(self) -> None:
+        # Real-world end-to-end: emoji string with VS16 + ZWJ + skin tone
+        # passes through sanitize_for_log and then json.dumps cleanly.
+        src = (
+            "Status: \U0001f3f3️‍\U0001f308 active for "
+            "\U0001f469\U0001f3fd"
+        )
+        sanitized = sanitize_for_log(src)
+        assert sanitized == src
+        # Must JSON-encode (default ensure_ascii=True is fine; the bytes
+        # become \uXXXX escapes but decode back to the original string).
+        decoded = json.loads(json.dumps(sanitized))
+        assert decoded == src
+
+
+# ---------------------------------------------------------------------------
+# Mathematical alphanumerics (above the BMP)
+# ---------------------------------------------------------------------------
+
+
+class TestMathAlphanumerics:
+    """Math italic / bold / script / fraktur letters live in U+1D400-U+1D7FF.
+
+    These are single supplementary-plane code points (not surrogate pairs
+    in Python str). They are sometimes used to spoof identifiers in
+    technical writing. Sanitize_for_log preserves them; clean_identifier
+    strips them.
+    """
+
+    @pytest.mark.parametrize(
+        "codepoint,desc",
+        [
+            (0x1D400, "MATH BOLD CAPITAL A"),
+            (0x1D434, "MATH ITALIC CAPITAL A"),
+            (0x1D49C, "MATH SCRIPT CAPITAL A"),
+            (0x1D504, "MATH FRAKTUR CAPITAL A"),
+            (0x1D538, "MATH DOUBLE-STRUCK CAPITAL A"),
+            (0x1D7CE, "MATH BOLD DIGIT ZERO"),
+        ],
+    )
+    def test_math_alphanumeric_preserved_in_log(
+        self, codepoint: int, desc: str
+    ) -> None:
+        src = f"prefix_{chr(codepoint)}_suffix"
+        assert sanitize_for_log(src) == src, desc
+
+    def test_math_alphanumerics_string_round_trip(self) -> None:
+        # 𝐀𝐁𝐂 — three bold math caps, plus emoji to confirm BMP/non-BMP mix.
+        src = "\U0001d400\U0001d401\U0001d402 vs ABC"
+        assert sanitize_for_log(src) == src
+
+    def test_math_alphanumerics_stripped_from_identifier(self) -> None:
+        # Negative: clean_identifier accepts ASCII only, so math-A is gone.
+        assert clean_identifier("model\U0001d400-v2") == "model-v2"
+
+
+# ---------------------------------------------------------------------------
+# Halfwidth / fullwidth forms
+# ---------------------------------------------------------------------------
+
+
+class TestHalfFullwidth:
+    """U+FF21 FULLWIDTH LATIN CAPITAL A renders like A but is a distinct
+    code point used in East Asian typography. Preserved in log, stripped
+    from identifier.
+    """
+
+    @pytest.mark.parametrize(
+        "src",
+        [
+            "ＡＢＣ",  # ＡＢＣ
+            "０１２",  # ０１２
+            "ｈｅｌｌｏ",  # ｈｅｌｌｏ
+        ],
+    )
+    def test_fullwidth_preserved_in_log(self, src: str) -> None:
+        assert sanitize_for_log(src) == src
+
+    @pytest.mark.parametrize(
+        "src",
+        ["ＡＢＣ", "０１２"],
+    )
+    def test_fullwidth_stripped_from_identifier(self, src: str) -> None:
+        # Fullwidth digits / letters are not ASCII; identifier collapses.
+        assert clean_identifier(src) == ""
+
+    def test_halfwidth_katakana_preserved(self) -> None:
+        # U+FF66-U+FF9F: halfwidth katakana, used in legacy JP encoding.
+        src = "ｶﾀｶﾅ"  # ｶﾀｶﾅ
+        assert sanitize_for_log(src) == src
+
+
+# ---------------------------------------------------------------------------
+# Non-Latin digit forms
+# ---------------------------------------------------------------------------
+
+
+class TestNonLatinDigits:
+    """The identifier regex accepts ASCII [0-9] only. Arabic-Indic,
+    Devanagari, fullwidth, and Eastern Arabic digits are all distinct
+    code points and must be stripped from identifiers (preventing
+    visually-identical but byte-distinct cache keys).
+    """
+
+    @pytest.mark.parametrize(
+        "src,script",
+        [
+            ("٠١٢", "Arabic-Indic 012"),  # ٠١٢
+            ("۰۱۲", "Extended Arabic-Indic 012"),  # ۰۱۲
+            ("०१२", "Devanagari 012"),  # ०१२
+            ("০১২", "Bengali 012"),  # ০১২
+            ("๐๑๒", "Thai 012"),  # ๐๑๒
+            ("０１２", "Fullwidth 012"),  # ０１２
+        ],
+    )
+    def test_log_preserves_non_latin_digits(self, src: str, script: str) -> None:
+        # Operator-facing log keeps them — useful for diagnosing locale bugs.
+        assert sanitize_for_log(src) == src, script
+
+    @pytest.mark.parametrize(
+        "src",
+        [
+            "٠١٢",
+            "۰۱۲",
+            "०१२",
+            "০১২",
+            "๐๑๒",
+            "０１２",
+        ],
+    )
+    def test_identifier_strips_non_latin_digits(self, src: str) -> None:
+        # Identifier path is ASCII-only — every non-Latin digit form
+        # collapses to empty string.
+        assert clean_identifier(src) == ""
+
+    def test_mixed_ascii_and_non_latin_digits(self) -> None:
+        # ASCII digits survive, others stripped.
+        src = "v1٠١v2"  # v1٠١v2
+        assert clean_identifier(src) == "v1v2"
+
+
+# ---------------------------------------------------------------------------
+# Adversarial composite inputs
+# ---------------------------------------------------------------------------
+
+
+class TestAdversarialComposites:
+    """End-to-end attack-style strings exercising several axes at once."""
+
+    def test_trojan_source_style_payload(self) -> None:
+        # Visible-looking comment with bidi override flipping direction and
+        # tag chars carrying invisible payload. sanitize_for_log strips
+        # the override (BIDI); tag chars survive (documented behavior).
+        # The visible bytes change from spoofed reversed-order to a
+        # straight read, which is exactly what an operator wants.
+        visible = "// safe"
+        override = "‮"
+        reversed_text = " moc.live"  # would render as "evil.com " under RLO
+        tags = "".join(chr(0xE0000 + 0x20 + i) for i in range(3))
+        payload = visible + override + reversed_text + tags
+        out = sanitize_for_log(payload)
+        # Override gone:
+        assert "‮" not in out
+        # Tag chars survive (documented):
+        for cp in (0xE0020, 0xE0021, 0xE0022):
+            assert chr(cp) in out
+        # Visible parts both still there:
+        assert visible in out
+        assert reversed_text in out
+
+    def test_thousand_char_base_with_hundred_zwjs(self) -> None:
+        # A 1000-char base interleaved with 100 ZWJ characters. ZWJ is not
+        # in any strip set, so the entire string must round-trip exactly.
+        base = "x" * 1000
+        # Insert ZWJ every 10 characters.
+        parts = []
+        for i in range(0, 1000, 10):
+            parts.append(base[i : i + 10])
+        joined = "‍".join(parts)
+        assert joined.count("‍") == 99  # 100 segments => 99 joins
+        # Boost to 100 ZWJs by prepending one:
+        src = "‍" + joined
+        assert src.count("‍") == 100
+        out = sanitize_for_log(src)
+        assert out == src
+        # ZWJ count preserved exactly.
+        assert out.count("‍") == 100
+
+    def test_emoji_string_json_round_trip_after_sanitize(self) -> None:
+        # Real-world: a status message with rich emoji passes sanitize_for_log
+        # and survives json.dumps + json.loads byte-identically.
+        src = (
+            "Job \U0001f3f3️‍\U0001f308 done by "
+            "\U0001f9d1\U0001f3fd‍\U0001f4bb in 1.23s"
+        )
+        sanitized = sanitize_for_log(src)
+        assert sanitized == src
+        assert json.loads(json.dumps(sanitized)) == src
+
+    def test_kitchen_sink_unicode_passthrough(self) -> None:
+        # Greek + CJK + RTL Arabic + emoji ZWJ + math alphanumeric +
+        # combining + zero-width + BOM. Every byte must survive sanitize_for_log.
+        src = (
+            "αβγ "  # Greek with leading BOM
+            "汉字 "  # CJK
+            "مرحبا "  # Arabic
+            "\U0001f468‍\U0001f4bb "  # man technologist (ZWJ)
+            "\U0001d400\U0001d401 "  # math bold
+            "é "  # NFD é
+            "x​y"  # ZWSP-joined
+        )
+        assert sanitize_for_log(src) == src
+
+    def test_lone_surrogate_inside_otherwise_clean_emoji_string(self) -> None:
+        # Mixed: valid emoji + a lone surrogate must replace only the lone
+        # one, leaving the valid emoji untouched.
+        src = "\U0001f600\ud83d\U0001f601"  # 😀 + lone high + 😁
+        out = sanitize_for_log(src)
+        assert "\U0001f600" in out and "\U0001f601" in out
+        assert "\ud83d" not in out  # lone replaced with U+FFFD
+        assert "�" in out
+
+
+# ---------------------------------------------------------------------------
+# Cross-mode consistency for Unicode-rich strings
+# ---------------------------------------------------------------------------
+
+
+class TestCrossModeUnicodeConsistency:
+    """A string containing only legitimate Unicode (no controls, no BIDI
+    overrides, no lone surrogates, no NUL) must come out byte-identical
+    from every sanitizer. Catches any over-strip regression.
+    """
+
+    @pytest.mark.parametrize(
+        "src",
+        [
+            "αβγ",  # Greek
+            "汉字ひらがな한글",  # CJK families
+            "\U0001f468‍\U0001f469‍\U0001f467‍\U0001f466",  # family
+            "❤️",  # heart + VS16
+            "\U0001f3f3️‍\U0001f308",  # rainbow flag
+            "مرحبا",  # Arabic
+            "שלום",  # Hebrew
+            "",  # BOM only
+            "long­word",  # soft hyphen
+            "é",  # NFD é
+            "\U0001d400\U0001d401\U0001d402",  # math alphanumerics
+            "A" + "́" * 20,  # combining stack
+            "‎42‏",  # weak BIDI marks
+            "٠١٢",  # Arabic-Indic digits
+            "ＡＢＣ",  # fullwidth Latin
+            "​‌‍⁠",  # zero-width set
+        ],
+    )
+    def test_safe_unicode_unchanged_in_all_modes(self, src: str) -> None:
+        assert sanitize_for_log(src) == src
+        assert sanitize_for_json(src) == src
+        assert sanitize_for_dbtext(src) == src
+
+    @pytest.mark.parametrize(
+        "src",
+        [
+            "αβγ",
+            "❤️",
+            "long­word",
+            "é",
+            "‎42‏",
+        ],
+    )
+    def test_idempotent_on_safe_unicode(self, src: str) -> None:
+        # Doubling sanitize_for_log on safe Unicode is identity twice over.
+        once = sanitize_for_log(src)
+        twice = sanitize_for_log(once)
+        assert once == src and twice == src
+
+
+# ---------------------------------------------------------------------------
+# JSON / JSONL grammar safety
+# ---------------------------------------------------------------------------
+
+
+class TestJsonGrammarSafety:
+    """Hostile log values that try to forge JSON / JSONL structure.
+
+    The sanitizers do NOT escape JSON metacharacters (``{`` ``}`` ``[``
+    ``]`` ``"`` ``\\`` ``,`` ``:``). That is correct: escaping is the
+    JSON encoder's job. The contract this class verifies:
+
+    1. Raw JSON grammar bytes pass through unchanged.
+    2. After ``json.dumps`` wraps the sanitized value, structural
+       injection attempts (``}{`` to fake a JSONL boundary, embedded
+       ``"`` to break out of a string) become inert because they live
+       inside a quoted JSON string with ``"`` and ``\\`` properly
+       escaped.
+    3. LF survives ``sanitize_for_log`` (multi-line tracebacks), but
+       ``json.dumps`` escapes LF as the two-byte sequence ``\\n`` on the
+       wire, so a forged JSONL record (``\\n{"forged":1}\\n``) cannot
+       break NDJSON line splitting once the value is encoded properly.
+    """
+
+    @pytest.mark.parametrize(
+        "ch",
+        ["{", "}", "[", "]", '"', "\\", ",", ":"],
+    )
+    def test_json_metachar_preserved_in_log(self, ch: str) -> None:
+        # Sanitize_for_log must not eat or escape JSON metacharacters —
+        # otherwise legitimate JSON / Python repr / template syntax in
+        # error messages would be corrupted.
+        src = f"prefix{ch}suffix"
+        assert sanitize_for_log(src) == src
+
+    @pytest.mark.parametrize(
+        "ch",
+        ["{", "}", "[", "]", '"', "\\", ",", ":"],
+    )
+    def test_json_metachar_preserved_in_json_mode(self, ch: str) -> None:
+        # The JSON-mode sanitizer is even more permissive: only lone
+        # surrogates are replaced.
+        src = f"prefix{ch}suffix"
+        assert sanitize_for_json(src) == src
+
+    @pytest.mark.parametrize(
+        "ch",
+        ["{", "}", "[", "]", '"', "\\", ",", ":"],
+    )
+    def test_json_metachar_preserved_in_dbtext(self, ch: str) -> None:
+        src = f"prefix{ch}suffix"
+        assert sanitize_for_dbtext(src) == src
+
+    def test_brace_pair_round_trips_through_json_dumps(self) -> None:
+        # The classic attack-shaped input: ``}{`` literally inside a
+        # value. After sanitize_for_log it is unchanged; after json.dumps
+        # it is wrapped in quotes; after json.loads it round-trips
+        # byte-for-byte. The attempted forgery never reaches the wire.
+        hostile = 'real }{ "forged":"value" }{ '
+        sanitized = sanitize_for_log(hostile)
+        assert sanitized == hostile  # nothing stripped
+        encoded = json.dumps({"msg": sanitized})
+        decoded = json.loads(encoded)
+        assert decoded == {"msg": hostile}
+        # Exactly one top-level key — no extra object created by forgery.
+        assert list(decoded.keys()) == ["msg"]
+
+    def test_embedded_quote_cannot_break_out(self) -> None:
+        # Quote injection: ``"})({"`` would be catastrophic if not
+        # escaped. sanitize_for_log leaves quotes alone; json.dumps
+        # escapes them inside the string value. The full wire string
+        # contains a single top-level object.
+        hostile = '"})({"k":"v"}'
+        sanitized = sanitize_for_log(hostile)
+        wire = json.dumps({"payload": sanitized})
+        loaded = json.loads(wire)
+        assert set(loaded.keys()) == {"payload"}
+        assert loaded["payload"] == hostile
+
+    def test_backslash_escape_cannot_create_invalid_escape(self) -> None:
+        # The six literal characters ``\\u202e`` typed into a log value
+        # must not be confused with the actual U+202E code point. The
+        # BIDI strip targets only the real code point; literal text
+        # passes through. json.dumps then escapes the backslash itself.
+        hostile = "msg: \\u202e attack"
+        sanitized = sanitize_for_log(hostile)
+        assert sanitized == hostile
+        wire = json.dumps(sanitized)
+        # In the wire, the single backslash must appear as two (escaped).
+        assert "\\\\u202e" in wire
+        assert json.loads(wire) == hostile
+
+    def test_jsonl_line_split_is_safe_after_dumps(self) -> None:
+        # A JSONL writer splits records on ``\\n``. An attacker injecting
+        # raw LF + JSON object into a value should NOT inject a second
+        # JSONL record. sanitize_for_log preserves LF (legit traceback
+        # behaviour), but json.dumps escapes LF as the two-byte sequence
+        # ``\\n`` on the wire — so the splitter still sees one record.
+        hostile = 'real\n{"forged":"record"}\n'
+        sanitized = sanitize_for_log(hostile)
+        assert sanitized == hostile  # LF preserved by design
+        wire = json.dumps({"line": sanitized})
+        # No literal LF byte ever reaches the wire.
+        assert wire.count("\n") == 0
+        assert wire.splitlines() == [wire]
+        assert json.loads(wire) == {"line": hostile}
+
+    def test_jsonl_writer_full_pipeline(self) -> None:
+        # Three hostile records — each containing brace-injection,
+        # quote-injection, or LF-injection patterns — get JSONL-encoded
+        # and split back into exactly three records.
+        records = [
+            {"msg": sanitize_for_log('attack }{ {"x":1} ')},
+            {"msg": sanitize_for_log('quotes "inside" value')},
+            {"msg": sanitize_for_log("multi\nline\nvalue")},
+        ]
+        wire = "\n".join(json.dumps(r) for r in records)
+        lines = wire.split("\n")
+        assert len(lines) == 3
+        for line, original in zip(lines, records):
+            assert json.loads(line) == original
+
+    def test_sanitize_does_not_escape_quote_or_backslash(self) -> None:
+        # Sharp contract: pre-escaping these bytes would cause double-
+        # escaping once json.dumps runs (``"`` would become ``\\\\"``).
+        src = 'a"b\\c'
+        assert sanitize_for_log(src) == src
+        assert sanitize_for_json(src) == src
+        assert sanitize_for_dbtext(src) == src
+
+    def test_json_round_trip_for_unicode_rich_hostile_payload(self) -> None:
+        # All-axes payload: braces + quotes + LF + emoji ZWJ + RTL +
+        # combining stack. Round-trips through sanitize_for_log + json.
+        src = (
+            'log }{ "user":"\U0001f468‍\U0001f4bb" '
+            "مرحبا\n"
+            "next-line é \\ end"
+        )
+        sanitized = sanitize_for_log(src)
+        wire = json.dumps({"e": sanitized})
+        assert json.loads(wire) == {"e": src}
+        # Exactly one JSONL line on the wire.
+        assert wire.count("\n") == 0
+
+    def test_cr_escape_form_keeps_jsonl_single_line(self) -> None:
+        # The sanitizer turns CR into the literal six-byte sequence
+        # ``\\x0d``. That sequence contains no LF and no JSON metachar
+        # with semantic effect — so the JSONL splitter sees one record,
+        # and the wire visibly carries the escape form.
+        hostile = "real\rINJECTED"
+        sanitized = sanitize_for_log(hostile)
+        assert sanitized == "real\\x0dINJECTED"
+        wire = json.dumps({"v": sanitized})
+        assert "real\\\\x0dINJECTED" in wire
+        assert wire.count("\n") == 0
+
+    def test_only_braces_string(self) -> None:
+        # Degenerate edge case: a value that is *nothing but* JSON
+        # metacharacters. Must survive sanitize_for_log untouched and
+        # round-trip cleanly when wrapped.
+        src = '{{}}[],":\\'
+        assert sanitize_for_log(src) == src
+        wire = json.dumps({"v": sanitize_for_log(src)})
+        assert json.loads(wire) == {"v": src}
diff --git a/tests/utils/test_text_sanitize_wiring.py b/tests/utils/test_text_sanitize_wiring.py
new file mode 100644
index 00000000..e832db27
--- /dev/null
+++ b/tests/utils/test_text_sanitize_wiring.py
@@ -0,0 +1,507 @@
+"""Integration tests proving the sanitizer is wired into call sites.
+
+Each test feeds a hostile string (ANSI escape, NUL, lone surrogate, BIDI
+override, CR carriage-return) through a real call site, captures the
+resulting log line or stored value via loguru/fakeredis, and asserts that
+the destination saw a sanitized form rather than the raw hostile bytes.
+
+The tests deliberately use the production logging path (loguru sink) and
+production fakeredis (already a dev dep) so that a regression which silently
+removes a ``sanitize_for_log`` wrap will surface as a hostile byte
+re-appearing in the captured output.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+import tempfile
+from pathlib import Path
+from typing import Any
+
+import fakeredis
+from loguru import logger
+import pytest
+
+
+# Shared hostile fixtures
+LONE_HIGH = "\ud83d"
+HOSTILE = (
+    "\x1b[31merr\x1b[0m"  # ANSI red
+    "\x00NUL"  # NUL
+    "\rCR"  # CR forgery
+    "\x07BEL"  # bell
+    f"{LONE_HIGH}LS"  # lone surrogate
+    "‮RLO"  # RLO BIDI override
+)
+# A variant without a lone surrogate, for paths that flow through pydantic
+# string fields whose validators reject lone surrogates upstream of our
+# sanitizer wrapping (e.g. ``Program.code``).
+HOSTILE_NO_SURROGATE = (
+    "\x1b[31merr\x1b[0m"  # ANSI red
+    "\x00NUL"  # NUL
+    "\rCR"  # CR forgery
+    "\x07BEL"  # bell
+    "‮RLO"  # RLO BIDI override
+)
+
+
+def _assert_no_raw_hostile_non_surrogate(captured: str) -> None:
+    """Variant for paths where the lone-surrogate has already been filtered
+    upstream by a pydantic validator before reaching the sanitizer.
+    """
+    assert "\x1b" not in captured, "raw ANSI ESC survived"
+    assert "\x00" not in captured, "raw NUL survived"
+    assert "\x07" not in captured, "raw BEL survived"
+    assert "‮" not in captured, "BIDI RLO survived"
+    captured.encode("utf-8")
+
+
+@pytest.fixture
+def loguru_sink():
+    """Add a string-buffer loguru sink, yield (buffer, sink_id), tear down."""
+    buf = io.StringIO()
+    sink_id = logger.add(buf, format="{message}", level="DEBUG")
+    yield buf
+    logger.remove(sink_id)
+
+
+def _assert_sanitized(captured: str) -> None:
+    """Assert no raw hostile bytes survived; sanitized escapes are OK."""
+    assert "\x1b" not in captured, "raw ANSI ESC survived"
+    assert "\x00" not in captured, "raw NUL survived"
+    assert "\x07" not in captured, "raw BEL survived"
+    assert LONE_HIGH not in captured, "lone surrogate survived"
+    assert "‮" not in captured, "BIDI RLO survived"
+    # Captured string must encode cleanly as UTF-8 (the loguru sink path).
+    captured.encode("utf-8")
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/database/redis_program_storage.py
+# ---------------------------------------------------------------------------
+
+
+class TestRedisProgramStorageCorruptDataLog:
+    def test_corrupt_data_log_sanitized(self, loguru_sink) -> None:
+        from gigaevo.database.redis_program_storage import RedisProgramStorage
+
+        # Trigger _safe_deserialize with a corrupt JSON blob whose error
+        # message includes hostile bytes. We construct an exception by
+        # raising one with a hostile message, which from_dict will surface.
+        bad_blob = '{"id": "x", "code": "' + HOSTILE + '"}'
+        # The exception message produced by Program.from_dict will mention
+        # missing fields; the JSON value itself isn't echoed back, so we
+        # also exercise the path where the error str contains hostile bytes.
+        # Simplest: monkeypatch Program.from_dict to raise with hostile msg.
+        from gigaevo.programs import program as program_mod
+
+        original = program_mod.Program.from_dict
+
+        def boom(_data: Any, *, exclude: Any = None) -> None:  # noqa: ANN401
+            raise ValueError(f"parse failed: {HOSTILE}")
+
+        program_mod.Program.from_dict = staticmethod(boom)  # type: ignore[assignment]
+        try:
+            result = RedisProgramStorage._safe_deserialize(bad_blob, ctx="test")
+        finally:
+            program_mod.Program.from_dict = original  # type: ignore[assignment]
+
+        assert result is None
+        captured = loguru_sink.getvalue()
+        assert "[RedisProgramStorage] Corrupt data in test:" in captured
+        _assert_sanitized(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/database/state_manager.py
+# ---------------------------------------------------------------------------
+
+
+class TestStateManagerInvalidTransitionLog:
+    async def test_invalid_state_transition_log_sanitized(
+        self, state_manager, make_program, loguru_sink, monkeypatch
+    ) -> None:
+        from gigaevo.programs import program_state as ps_mod
+
+        prog = make_program()
+        await state_manager.storage.add(prog)
+
+        def boom(_old: Any, _new: Any) -> None:  # noqa: ANN401
+            raise ValueError(f"bad transition: {HOSTILE}")
+
+        monkeypatch.setattr(ps_mod, "validate_transition", boom)
+        # Re-import inside state_manager too (it imports by name).
+        from gigaevo.database import state_manager as sm_mod
+
+        monkeypatch.setattr(sm_mod, "validate_transition", boom)
+
+        with pytest.raises(ValueError):
+            await state_manager.set_program_state(prog, ps_mod.ProgramState.DONE)
+
+        captured = loguru_sink.getvalue()
+        assert "Invalid state transition for" in captured
+        _assert_sanitized(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/evolution/mutation/mutation_operator.py
+# ---------------------------------------------------------------------------
+
+
+class TestMutationOperatorCanonicalizeLog:
+    def test_syntax_error_log_sanitized(self, loguru_sink, monkeypatch) -> None:
+        from gigaevo.evolution.mutation import mutation_operator as mop
+
+        # Force ast.parse to raise a SyntaxError whose msg has hostile bytes.
+        def boom(_src: str) -> None:
+            raise SyntaxError(f"bad syntax: {HOSTILE}")
+
+        monkeypatch.setattr(mop.ast, "parse", boom)
+        out = mop.LLMMutationOperator._canonicalize_code("x = 1")
+        # Falls back to original code on failure.
+        assert out == "x = 1"
+        captured = loguru_sink.getvalue()
+        assert "Failed to canonicalize code" in captured
+        _assert_sanitized(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/prompts/coevolution/stages.py
+# ---------------------------------------------------------------------------
+
+
+class TestPromptExecutionStageErrorMessages:
+    """The ValueError messages produced by PromptExecutionStage carry the
+    LLM-derived code snippet or exception text. The sanitizer is applied
+    before f-string interpolation so the exception args themselves are
+    UTF-8-encodable and do not break downstream loguru / asyncpg writers
+    that surface ``str(exc)``.
+    """
+
+    async def test_non_python_content_error_sanitized(self) -> None:
+        from gigaevo.prompts.coevolution.stages import PromptExecutionStage
+
+        stage = PromptExecutionStage()
+        # No "def entrypoint" so the first branch fires. Use a hostile
+        # string that does NOT include a lone UTF-16 surrogate — those are
+        # already rejected by Program.code's pydantic validator upstream,
+        # so this is the realistic threat surface for stages.py.
+        bad_code = HOSTILE_NO_SURROGATE + "garbage content here that exceeds 80 chars" * 3
+        from gigaevo.programs.program import Program
+
+        prog = Program(code=bad_code)
+        with pytest.raises(ValueError) as ei:
+            await stage.compute(prog)
+        msg = str(ei.value)
+        _assert_no_raw_hostile_non_surrogate(msg)
+        # The marker phrase survives.
+        assert "Code starts with" in msg
+
+    async def test_syntax_error_message_sanitized(self, monkeypatch) -> None:
+        from gigaevo.prompts.coevolution import stages as st
+
+        stage = st.PromptExecutionStage()
+        # Genuinely malformed Python whose SyntaxError str() will not
+        # already contain hostile bytes; we then monkeypatch the
+        # ``compile`` builtin in the module's globals so the str(exc) we
+        # interpolate carries the hostile payload.
+        code = "def entrypoint():\n    pass\n"
+        from gigaevo.programs.program import Program
+
+        prog = Program(code=code)
+
+        # Patch the builtin module's compile via stages.__builtins__.
+        import builtins
+
+        original = builtins.compile
+
+        def boom_compile(*_a: Any, **_k: Any) -> None:  # noqa: ANN401
+            raise SyntaxError(f"bad: {HOSTILE_NO_SURROGATE}")
+
+        monkeypatch.setattr(builtins, "compile", boom_compile)
+        try:
+            with pytest.raises(ValueError) as ei:
+                await stage.compute(prog)
+            _assert_no_raw_hostile_non_surrogate(str(ei.value))
+        finally:
+            monkeypatch.setattr(builtins, "compile", original)
+
+    async def test_entrypoint_exception_message_sanitized(self) -> None:
+        from gigaevo.prompts.coevolution.stages import PromptExecutionStage
+        from gigaevo.programs.program import Program
+
+        # entrypoint() raises with hostile bytes in the exception message.
+        # No lone surrogate because Program.code's validator rejects it.
+        code = (
+            "def entrypoint():\n"
+            f"    raise RuntimeError({HOSTILE_NO_SURROGATE!r})\n"
+        )
+        prog = Program(code=code)
+        stage = PromptExecutionStage()
+        with pytest.raises(ValueError) as ei:
+            await stage.compute(prog)
+        _assert_no_raw_hostile_non_surrogate(str(ei.value))
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/prompts/coevolution/stats.py
+# ---------------------------------------------------------------------------
+
+
+class TestRedisPromptStatsProviderErrorLog:
+    async def test_redis_error_log_sanitized(self, loguru_sink, monkeypatch) -> None:
+        from gigaevo.prompts.coevolution import stats as st
+
+        provider = st.RedisPromptStatsProvider(
+            host="localhost", port=6379, db=0, prefix="test"
+        )
+
+        # Make the Redis client GET raise with hostile error text.
+        class BoomRedis:
+            async def get(self, _key: str) -> None:
+                raise RuntimeError(f"redis error: {HOSTILE}")
+
+        monkeypatch.setattr(provider, "_get_redis", lambda _db: BoomRedis())
+
+        # Prompt ID with hostile bytes too (rare but possible in tests).
+        result = await provider.get_stats(prompt_id=f"pid-{HOSTILE}")
+        # No data found -> default zero stats.
+        assert result.trials == 0
+        captured = loguru_sink.getvalue()
+        assert "Error reading stats from" in captured
+        _assert_sanitized(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/prompts/fetcher.py
+# ---------------------------------------------------------------------------
+
+
+class TestGigaEvoArchivePromptFetcherLogs:
+    def _make_fetcher(self, tmp_path: Path) -> Any:
+        from gigaevo.prompts.fetcher import GigaEvoArchivePromptFetcher
+
+        return GigaEvoArchivePromptFetcher(
+            prompt_redis_db=0,
+            main_redis_prefix="main",
+            main_redis_db=None,
+            fallback_prompts_dir=tmp_path,
+        )
+
+    def test_archive_read_error_log_sanitized(
+        self, tmp_path: Path, loguru_sink, monkeypatch
+    ) -> None:
+        fetcher = self._make_fetcher(tmp_path)
+
+        class BoomRedis:
+            def hvals(self, _k: str) -> None:
+                raise RuntimeError(f"hvals failed: {HOSTILE}")
+
+        monkeypatch.setattr(fetcher, "_get_sync_redis", lambda: BoomRedis())
+        result = fetcher._refresh_candidates()
+        assert result is None
+        captured = loguru_sink.getvalue()
+        assert "Archive read error" in captured
+        _assert_sanitized(captured)
+
+    def test_entrypoint_execution_error_log_sanitized(
+        self, tmp_path: Path, loguru_sink
+    ) -> None:
+        fetcher = self._make_fetcher(tmp_path)
+        # Code whose entrypoint() raises with hostile message.
+        code = f"def entrypoint():\n    raise RuntimeError({HOSTILE!r})\n"
+        out = fetcher._execute_entrypoint(code)
+        assert out is None
+        captured = loguru_sink.getvalue()
+        assert "entrypoint() execution error" in captured
+        _assert_sanitized(captured)
+
+    def test_sampled_prompt_preview_sanitized(
+        self, tmp_path: Path, loguru_sink
+    ) -> None:
+        fetcher = self._make_fetcher(tmp_path)
+        # Inject candidates list directly so _sample_prompt fires the
+        # preview log line containing system[:300] from the LLM code output.
+        # The system text must be UTF-8-encodable so exec() can run the
+        # Python source; no lone surrogates here, but ANSI/BIDI/NUL all
+        # exercise the sanitizer.
+        hostile_prompt = HOSTILE_NO_SURROGATE + " legitimate prompt body content"
+        code = (
+            "def entrypoint():\n"
+            f"    return {hostile_prompt!r}\n"
+        )
+        fetcher._cached_candidates = [("pid-abc12345", 0.7, code)]
+        pack = fetcher._sample_prompt()
+        assert pack is not None
+        captured = loguru_sink.getvalue()
+        assert "Sampled:" in captured
+        _assert_no_raw_hostile_non_surrogate(captured)
+
+    def test_parse_program_error_log_sanitized(
+        self, tmp_path: Path, loguru_sink, monkeypatch
+    ) -> None:
+        fetcher = self._make_fetcher(tmp_path)
+
+        class FakeRedis:
+            def hvals(self, _k: str) -> list[str]:
+                return [f"prog-{HOSTILE}"]
+
+            def get(self, _k: str) -> str:
+                # Not valid JSON -> triggers the inner except branch.
+                return f"not-json {HOSTILE}"
+
+        monkeypatch.setattr(fetcher, "_get_sync_redis", lambda: FakeRedis())
+        out = fetcher._refresh_candidates()
+        # No valid candidates produced; return is None.
+        assert out is None
+        captured = loguru_sink.getvalue()
+        assert "Error parsing program" in captured
+        _assert_sanitized(captured)
+
+
+# ---------------------------------------------------------------------------
+# gigaevo/utils/trackers/backends/redis.py
+# ---------------------------------------------------------------------------
+
+
+class TestRedisMetricsBackendSanitization:
+    def _make_backend(self) -> Any:
+        from gigaevo.utils.trackers.backends.redis import RedisMetricsBackend
+        from gigaevo.utils.trackers.configs import RedisMetricsConfig
+
+        cfg = RedisMetricsConfig(
+            redis_url="redis://localhost:6379/0",
+            key_prefix="test_metrics",
+            store_history=True,
+        )
+        backend = RedisMetricsBackend(cfg)
+        # Substitute a fakeredis client so flush can actually run.
+        backend._client = fakeredis.FakeRedis(decode_responses=True)
+        return backend
+
+    def test_clean_scalar_tag_round_trips_latest_and_history(self) -> None:
+        backend = self._make_backend()
+
+        backend.write_scalar("loss/train", 0.25, step=3, wall_time=1.5)
+        backend.flush()
+
+        assert backend.get_latest("loss/train") == {"loss/train": 0.25}
+        assert backend.list_metrics() == ["loss/train"]
+        assert backend.get_history("loss/train") == [
+            {"s": 3, "t": 1.5, "v": 0.25, "k": "scalar"}
+        ]
+
+    def test_hostile_scalar_tag_round_trips_via_sanitized_field(self) -> None:
+        backend = self._make_backend()
+        tag = f"loss {HOSTILE}/train"
+        safe_tag = backend._field_tag(tag)
+
+        backend.write_scalar(tag, 0.5, step=4, wall_time=2.0)
+        backend.flush()
+
+        assert backend.get_latest(tag) == {safe_tag: 0.5}
+        assert backend.list_metrics() == [safe_tag]
+        assert backend.get_history(tag) == [
+            {"s": 4, "t": 2.0, "v": 0.5, "k": "scalar"}
+        ]
+        _assert_sanitized(safe_tag)
+
+    def test_history_key_strips_hostile_bytes_from_tag(self) -> None:
+        backend = self._make_backend()
+        # Tag with ANSI/BIDI/NUL/CR — clean_identifier strips them all.
+        tag = f"loss/train {HOSTILE} step"
+        key = backend._k_history(tag)
+        # The conservative charset survives; everything hostile is gone.
+        for hostile_ch in ("\x1b", "\x00", "\x07", "\r", LONE_HIGH, "‮"):
+            assert hostile_ch not in key
+        # Prefix is intact.
+        assert key.startswith("test_metrics:history:")
+
+    def test_history_key_caps_length(self) -> None:
+        backend = self._make_backend()
+        long_tag = "x" * 500
+        key = backend._k_history(long_tag)
+        # 128-char cap from clean_identifier plus the static prefix.
+        # "test_metrics:history:" + 128 chars = 149.
+        assert len(key) <= len("test_metrics:history:") + 128
+
+    def test_write_text_sanitizes_value_for_dbtext(self) -> None:
+        backend = self._make_backend()
+        # Hostile payload: NUL + lone surrogate. sanitize_for_dbtext drops
+        # both, replacing each with U+FFFD; the buffered entry's value
+        # must already be free of those bytes.
+        backend.write_text("tag1", f"text{HOSTILE}", step=1, wall_time=0.0)
+        stored = backend._buffer[0]["value"]
+        assert "\x00" not in stored
+        assert LONE_HIGH not in stored
+        # The original NUL/lone-surrogate become U+FFFD.
+        assert "�" in stored
+
+    def test_flush_writes_hostile_history_without_raising(self) -> None:
+        backend = self._make_backend()
+        # Histogram entry containing a list with a lone surrogate.
+        backend.write_hist(
+            f"loss{HOSTILE}/train",
+            ["value-with-" + HOSTILE, 1.0, 2.0],
+            step=1,
+            wall_time=0.0,
+        )
+        backend.write_text(f"text{HOSTILE}", "payload " + HOSTILE, step=1, wall_time=0.0)
+        # flush() invokes json.dumps via deep_sanitize_for_json -> must not
+        # raise UnicodeEncodeError. The previous implementation would have.
+        backend.flush()
+        # Confirm something was actually written to fakeredis.
+        history_keys = backend._client.keys("test_metrics:history:*")
+        assert len(history_keys) >= 2
+
+    def test_flush_history_payload_is_json_loadable_and_utf8(self) -> None:
+        backend = self._make_backend()
+        backend.write_text("tag2", f"payload {HOSTILE}", step=5, wall_time=10.0)
+        backend.flush()
+        # Pull back the history entry and confirm it is a clean JSON record.
+        keys = backend._client.keys("test_metrics:history:*")
+        assert keys
+        raw = backend._client.lrange(keys[0], 0, -1)
+        assert raw
+        for entry in raw:
+            # Already-decoded by decode_responses=True.
+            entry.encode("utf-8")  # safe round-trip
+            data = json.loads(entry)
+            assert data["s"] == 5
+            # The stored value never contains the raw hostile bytes.
+            v = data["v"]
+            if isinstance(v, str):
+                assert "\x00" not in v
+                assert LONE_HIGH not in v
+
+
+# ---------------------------------------------------------------------------
+# End-to-end: every sanitized log line through a real loguru file sink
+# remains UTF-8 encodable.
+# ---------------------------------------------------------------------------
+
+
+class TestEndToEndLoguruFileSinkUtf8():
+    def test_real_file_sink_accepts_all_sanitized_messages(self) -> None:
+        tf = tempfile.NamedTemporaryFile(
+            mode="w", delete=False, suffix=".log", encoding="utf-8"
+        )
+        tf.close()
+        path = Path(tf.name)
+        sink_id = logger.add(path, format="{message}", level="DEBUG")
+        try:
+            from gigaevo.utils.text_sanitize import sanitize_for_log
+
+            # Emit each hostile variant through the sink; loguru would
+            # raise on a lone surrogate without the sanitizer.
+            for src in (HOSTILE, HOSTILE * 3, "\x00" * 10, LONE_HIGH * 5):
+                logger.info(sanitize_for_log(src))
+            content = path.read_text(encoding="utf-8")
+            assert "\x1b" not in content
+            assert "\x00" not in content
+            assert LONE_HIGH not in content
+        finally:
+            logger.remove(sink_id)
+            if path.exists():
+                path.unlink()