nova-fuse keeps every event on one line, whatever the box contains

nova-fuse keeps every event on one line, whatever the box contains. The fuse box is world-readable and hand-editable by design, so on a shared machine its reasons, stamps and surface names are authored by whoever can write the file, and until now they reached the documented one-line grammar untouched. A newline in a reason forged a second event line beneath a real one, a FUSE OK under a FUSE FAIL, and an ESC sequence reached an operator's terminal intact. A --box path or a surface argument could do the same from the command line, including through the flag package's own error text.

What ships.

• fuse.OneLine: every piece of free text that reaches an event, refusal or note line, from the box or from an argument, is rendered with control characters and the Unicode line and paragraph separators escaped as \xNN or \uNNNN. Printable text, including non-ASCII, passes through. The flag package no longer writes to the stream; its errors are printed by the tool, escaped.
• fuse.Fold: this tool's own writes fold control characters in reasons and surface names to spaces. Fold-equivalent spellings are one surface in both directions: check refuses on any spelling, lift quarantine removes every spelling and announces each. A reason made only of non-whitespace control characters is kept as its visible escapes, never refused, because a fuse you cannot blow is not a fuse.
• check is deterministic when two stored keys fold together: stored keys are matched in sorted order.
• SPEC.md states the guarantee, its exact escape set, what passes through (format characters, including the bidi controls), that the escape is not injective, that path echoes its argument unescaped and must never be scanned for grammar, and the four exit codes that moved.
• Two source-level tests over the package classify every printed argument and refuse any writer that would bypass the escape, in every file of the package; behavioral tests per verb pin the forgeries, each seen red first.

Four revisions, each read cold on two models told to argue for rejection. Round one found nine refusal lines still printing raw; round two found the flag package writing to stderr outside the fence; round three split, one reader passing and one holding out for the spec to tell the truth about the lift direction of the fold; round four passed.

Take what fits, item by item; nothing here can weaken a floor.