diff --git a/Cargo.lock b/Cargo.lock
index b701c13..6bd3feb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -993,6 +993,7 @@ dependencies = [
  "serde_json",
  "tokio",
  "tokio-tungstenite 0.30.0",
+ "unicode-width",
  "ureq",
 ]
 
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index 7a5ac89..30deef9 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -52,6 +52,10 @@ pkarr = { version = "8.0.0", default-features = false, features = ["dht"] }
 # against it. See docs/plans/interactive-terminal-ui-plan-2026-09-10.md.
 ratatui = "0.30.2"
 crossterm = "0.29.0"
+# Display width of a name a peer chose, so eliding it counts a CJK character as
+# the two columns it takes. Pure Rust, and already in the tree through ratatui,
+# so this adds no crate to the build.
+unicode-width = "0.2"
 
 [dev-dependencies]
 api = { path = ".." }
diff --git a/cli/src/client.rs b/cli/src/client.rs
index 199dc3f..20ab4ac 100644
--- a/cli/src/client.rs
+++ b/cli/src/client.rs
@@ -98,7 +98,8 @@ pub fn create_session(origin: &str, ciphertext_size: u64) -> Result<String, Clie
                 .and_then(|body| body.message)
                 .unwrap_or_else(|| format!("the relay rejected the request with status {status}"));
 
-            Err(ClientError::Server(message))
+            // The relay is untrusted, and this is printed as it arrives.
+            Err(ClientError::Server(crate::display::peer_message(&message)))
         }
         Err(error) => Err(ClientError::Transport(format!(
             "could not reach {origin}: {error}"
diff --git a/cli/src/display.rs b/cli/src/display.rs
new file mode 100644
index 0000000..6e065b5
--- /dev/null
+++ b/cli/src/display.rs
@@ -0,0 +1,262 @@
+//! Putting text somebody else chose on this terminal.
+//!
+//! A filename is chosen by the sender, an error message by the peer or the
+//! relay, and none of them is trusted. Printed as-is, a name can carry escape
+//! sequences that move the cursor, clear the line, retitle the window, or plant
+//! a hyperlink. It can also carry bidirectional controls that make `exe.pdf`
+//! read as `fdp.exe`. That matters most exactly where Drop asks a person to
+//! decide something about the name they are looking at, and it matters already
+//! for the "Receiving" line, which is printed before any decision exists.
+//!
+//! Everything here replaces rather than removes. A `\u{FFFD}` where a control
+//! character was tells the reader the name was odd; silently deleting it would
+//! show them a cleaner name than the one that exists.
+//!
+//! Legitimate names in any script pass through unchanged: only control and
+//! formatting characters are touched, never letters, marks or emoji.
+
+use unicode_width::{UnicodeWidthChar, UnicodeWidthStr};
+
+/// What stands in for anything that should not reach a terminal.
+const REPLACEMENT: char = '\u{FFFD}';
+
+/// Columns a name may take before its middle is elided.
+///
+/// Wide enough for ordinary names, narrow enough that a hostile one cannot push
+/// a question onto a line of its own and off the screen.
+pub const NAME_COLUMNS: usize = 80;
+
+/// Columns kept from the end of an elided name, so the extension — the part
+/// that says what kind of file this is — always survives.
+const TAIL_COLUMNS: usize = 24;
+
+/// Columns a message from a peer or a relay may take.
+const MESSAGE_COLUMNS: usize = 200;
+
+/// Characters that are not controls but still change how a terminal lays text
+/// out: bidirectional overrides, embeddings, isolates and marks; line and
+/// paragraph separators; and invisible characters that let two different names
+/// look identical.
+///
+/// Zero-width joiner and non-joiner (U+200D, U+200C) are deliberately absent.
+/// Emoji sequences and several scripts need them, and they cannot reorder or
+/// hide text.
+fn is_layout_control(character: char) -> bool {
+    matches!(
+        character,
+        '\u{061C}'              // arabic letter mark
+        | '\u{200B}'            // zero width space
+        | '\u{200E}' | '\u{200F}' // left-to-right and right-to-left marks
+        | '\u{2028}' | '\u{2029}' // line and paragraph separators
+        | '\u{202A}'..='\u{202E}' // embeddings and overrides
+        | '\u{2060}'            // word joiner
+        | '\u{2066}'..='\u{2069}' // isolates
+        | '\u{FEFF}'            // byte order mark
+    )
+}
+
+/// Makes untrusted text safe to print, without shortening it.
+///
+/// Control characters (C0, DEL, C1, which includes the bytes that start every
+/// escape sequence) and layout controls become `\u{FFFD}`. Runs of whitespace
+/// collapse to one space, so padding cannot push the end of a name out of
+/// sight.
+pub fn for_terminal(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    let mut in_whitespace = false;
+
+    for character in text.chars() {
+        if character.is_control() || is_layout_control(character) {
+            out.push(REPLACEMENT);
+            in_whitespace = false;
+        } else if character.is_whitespace() {
+            if !in_whitespace {
+                out.push(' ');
+            }
+            in_whitespace = true;
+        } else {
+            out.push(character);
+            in_whitespace = false;
+        }
+    }
+
+    out
+}
+
+/// A name a peer chose, ready to print on one line.
+///
+/// Sanitised by [`for_terminal`], then elided in the middle if it is wider than
+/// [`NAME_COLUMNS`]. The middle rather than the end, because the end holds the
+/// extension and the extension is what says whether this is a document or a
+/// program.
+pub fn name(text: &str) -> String {
+    elide_middle(&for_terminal(text), NAME_COLUMNS)
+}
+
+/// A message a peer or a relay sent, ready to print after `error: `.
+///
+/// Neither is trusted, so this is sanitised too, and capped so a hostile one
+/// cannot fill the screen.
+pub fn peer_message(text: &str) -> String {
+    elide_middle(&for_terminal(text), MESSAGE_COLUMNS)
+}
+
+/// Shortens `text` to at most `columns` display columns by replacing its middle
+/// with an ellipsis, measuring wide characters as two columns.
+fn elide_middle(text: &str, columns: usize) -> String {
+    if text.width() <= columns {
+        return text.to_string();
+    }
+
+    let tail_budget = TAIL_COLUMNS.min(columns / 2);
+    // One column for the ellipsis itself.
+    let head_budget = columns - tail_budget - 1;
+
+    let mut head = String::new();
+    let mut used = 0;
+    for character in text.chars() {
+        let width = character.width().unwrap_or(0);
+        if used + width > head_budget {
+            break;
+        }
+        head.push(character);
+        used += width;
+    }
+
+    let mut tail: Vec<char> = Vec::new();
+    let mut used = 0;
+    for character in text.chars().rev() {
+        let width = character.width().unwrap_or(0);
+        if used + width > tail_budget {
+            break;
+        }
+        tail.push(character);
+        used += width;
+    }
+    tail.reverse();
+
+    format!("{head}\u{2026}{}", tail.into_iter().collect::<String>())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{NAME_COLUMNS, for_terminal, name, peer_message};
+    use unicode_width::UnicodeWidthStr;
+
+    #[test]
+    fn a_csi_sequence_cannot_reach_the_terminal() {
+        // Clear the line, move up, and print something else.
+        let hostile = "report.pdf\x1b[2K\x1b[1Ainvoice.pdf";
+        let shown = for_terminal(hostile);
+
+        assert!(!shown.contains('\x1b'), "escape survived: {shown:?}");
+        assert!(
+            shown.contains('\u{FFFD}'),
+            "the tampering should be visible"
+        );
+        assert!(shown.contains("report.pdf") && shown.contains("invoice.pdf"));
+    }
+
+    #[test]
+    fn an_osc_hyperlink_and_a_window_title_are_neutralised() {
+        let hyperlink = "\x1b]8;;https://example.invalid\x07click.txt\x1b]8;;\x07";
+        let title = "\x1b]0;owned\x07name.txt";
+
+        for hostile in [hyperlink, title] {
+            let shown = for_terminal(hostile);
+            assert!(
+                !shown.contains('\x1b') && !shown.contains('\x07'),
+                "{shown:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn c1_controls_are_replaced_too() {
+        // U+009B is a single-character CSI on terminals that honour C1.
+        let shown = for_terminal("a\u{009B}2Kb");
+        assert_eq!(shown, "a\u{FFFD}2Kb");
+    }
+
+    #[test]
+    fn newlines_and_tabs_cannot_break_a_line() {
+        let shown = for_terminal("first\nsecond\rthird\tfourth");
+        assert!(!shown.contains(['\n', '\r', '\t']), "{shown:?}");
+    }
+
+    #[test]
+    fn every_bidirectional_control_is_replaced() {
+        let controls = [
+            '\u{061C}', '\u{200E}', '\u{200F}', '\u{202A}', '\u{202B}', '\u{202C}', '\u{202D}',
+            '\u{202E}', '\u{2066}', '\u{2067}', '\u{2068}', '\u{2069}',
+        ];
+
+        for control in controls {
+            let shown = for_terminal(&format!("invoice{control}fdp.exe"));
+            assert!(
+                !shown.contains(control),
+                "U+{:04X} survived: {shown:?}",
+                control as u32
+            );
+        }
+    }
+
+    #[test]
+    fn the_classic_right_to_left_override_shows_its_real_extension() {
+        // Rendered naively this reads "invoice_exe.pdf".
+        let shown = name("invoice_\u{202E}fdp.exe");
+        assert!(shown.ends_with("fdp.exe"), "{shown:?}");
+    }
+
+    #[test]
+    fn whitespace_padding_collapses() {
+        let shown = for_terminal("report.pdf                                        .exe");
+        assert_eq!(shown, "report.pdf .exe");
+    }
+
+    #[test]
+    fn a_long_name_keeps_its_extension() {
+        let long = format!("{}.exe", "a".repeat(300));
+        let shown = name(&long);
+
+        assert!(shown.width() <= NAME_COLUMNS, "{} columns", shown.width());
+        assert!(shown.ends_with(".exe"), "{shown:?}");
+        assert!(shown.contains('\u{2026}'));
+    }
+
+    #[test]
+    fn wide_characters_count_as_two_columns() {
+        let long = format!("{}.txt", "東".repeat(100));
+        let shown = name(&long);
+
+        assert!(shown.width() <= NAME_COLUMNS, "{} columns", shown.width());
+        assert!(shown.ends_with(".txt"));
+    }
+
+    #[test]
+    fn honest_names_in_any_script_are_untouched() {
+        for honest in [
+            "Łódź 東京 🎉.txt",
+            "résumé-final (2).pdf",
+            "مرحبا.docx",
+            "👩‍👩‍👧 family.jpg", // zero-width joiners inside the emoji
+            "10:30 standup.md",
+        ] {
+            assert_eq!(name(honest), honest);
+        }
+    }
+
+    #[test]
+    fn a_short_name_is_not_elided() {
+        assert_eq!(name("report.pdf"), "report.pdf");
+    }
+
+    #[test]
+    fn a_peer_message_is_sanitised_and_capped() {
+        let hostile = format!("\x1b[2J{}", "x".repeat(10_000));
+        let shown = peer_message(&hostile);
+
+        assert!(!shown.contains('\x1b'));
+        assert!(shown.width() <= 200);
+    }
+}
diff --git a/cli/src/lib.rs b/cli/src/lib.rs
index ffbddd2..536fa9e 100644
--- a/cli/src/lib.rs
+++ b/cli/src/lib.rs
@@ -9,6 +9,7 @@ pub mod direct;
 // the browser client can compile it to WebAssembly. Keeping the name `crypto`
 // means every call site below reads the same as before the split.
 pub use drop_crypto as crypto;
+pub mod display;
 pub mod payload;
 pub mod progress;
 pub mod recv;
diff --git a/cli/src/recv.rs b/cli/src/recv.rs
index 7933db5..91309ab 100644
--- a/cli/src/recv.rs
+++ b/cli/src/recv.rs
@@ -10,7 +10,7 @@ use std::{
 use serde_json::json;
 
 use crate::{
-    client, crypto, direct,
+    client, crypto, direct, display,
     payload::{GZIP_MIME, TAR_GZIP_MIME, TAR_MIME},
     progress::Progress,
     transport::{Frame, Transport, relay},
@@ -179,6 +179,14 @@ pub async fn run(code: &str, options: ReceiveOptions) -> Result<(), Box<dyn Erro
     receive_transfer(&mut transport, &code, &options).await
 }
 
+/// The message in an `error` frame, made safe to print.
+///
+/// A peer on the direct path, or the relay on the other one, wrote it, and
+/// neither is trusted to put bytes on this terminal.
+fn peer_error(payload: &serde_json::Value, otherwise: &str) -> String {
+    display::peer_message(payload["message"].as_str().unwrap_or(otherwise))
+}
+
 fn missing_record() -> Box<dyn Error + Send + Sync> {
     "nobody has published a peer-to-peer address for this code".into()
 }
@@ -279,9 +287,11 @@ pub(crate) async fn receive_transfer<T: Transport>(
 
     let mut opener = crypto::Opener::new(&keys, size);
 
+    // The sender chose this name. It reaches the terminal only through
+    // `display`, because an escape sequence in it would otherwise run here.
     eprintln!(
         "Receiving {} ({})",
-        filename,
+        display::name(&filename),
         crate::progress::format_bytes(size)
     );
 
@@ -364,11 +374,7 @@ pub(crate) async fn receive_transfer<T: Transport>(
                     return Ok(());
                 }
                 Some("error") => {
-                    return Err(payload["message"]
-                        .as_str()
-                        .unwrap_or("the relay reported an error")
-                        .to_string()
-                        .into());
+                    return Err(peer_error(&payload, "the relay reported an error").into());
                 }
                 _ => {}
             },
@@ -418,11 +424,7 @@ async fn exchange_keys<T: Transport>(
                 }
             }
             Some("error") => {
-                return Err(payload["message"]
-                    .as_str()
-                    .unwrap_or("the relay reported an error")
-                    .to_string()
-                    .into());
+                return Err(peer_error(&payload, "the relay reported an error").into());
             }
             _ => {}
         }
@@ -470,11 +472,7 @@ async fn wait_for_meta<T: Transport>(
                 }
             }
             Some("error") => {
-                return Err(payload["message"]
-                    .as_str()
-                    .unwrap_or("the relay reported an error")
-                    .to_string()
-                    .into());
+                return Err(peer_error(&payload, "the relay reported an error").into());
             }
             _ => {}
         }
@@ -525,10 +523,13 @@ fn open_target(
     if path != requested {
         eprintln!(
             "{} already exists; saving as {} instead",
-            safe_name,
-            path.file_name()
-                .unwrap_or(path.as_os_str())
-                .to_string_lossy()
+            display::name(&safe_name),
+            display::name(
+                &path
+                    .file_name()
+                    .unwrap_or(path.as_os_str())
+                    .to_string_lossy()
+            )
         );
     }
 
@@ -654,19 +655,21 @@ fn report(target: &Target, received: u64) {
         Target::File { path, .. } => {
             eprintln!(
                 "Saved {} ({}).",
-                path.display(),
+                display::for_terminal(&path.display().to_string()),
                 crate::progress::format_bytes(received)
             );
         }
         Target::Archive { root, extractor } => {
             for warning in extractor.warnings() {
-                eprintln!("warning: {warning}");
+                // Warnings quote entry names from the archive, which the
+                // sender chose.
+                eprintln!("warning: {}", display::for_terminal(warning));
             }
 
             eprintln!(
                 "Extracted {} files into {}.",
                 extractor.files_written(),
-                root.display()
+                display::for_terminal(&root.display().to_string())
             );
         }
     }
diff --git a/cli/src/send.rs b/cli/src/send.rs
index 3f75906..439e40e 100644
--- a/cli/src/send.rs
+++ b/cli/src/send.rs
@@ -140,14 +140,16 @@ pub async fn run(
     let payload = Payload::prepare(path, options.compress)?;
 
     for warning in &payload.warnings {
-        eprintln!("warning: {warning}");
+        // Names from the tree being sent. They are local, but a hostile name
+        // can already be sitting on a shared disk.
+        eprintln!("warning: {}", crate::display::for_terminal(warning));
     }
 
     if payload.size == 0 {
         return Err("there is nothing to send: the payload is empty".into());
     }
 
-    eprintln!("Sending {}", payload.summary);
+    eprintln!("Sending {}", crate::display::for_terminal(&payload.summary));
     eprintln!("Size    {}", crate::progress::format_bytes(payload.size));
 
     // The relay bounds and accounts for what actually crosses it, which is
@@ -742,11 +744,16 @@ async fn await_completion<T: Transport>(
     Err("the transfer connection closed before the receiver confirmed the file".into())
 }
 
+/// The message in an `error` frame, made safe to print.
+///
+/// The relay wrote it, or on the direct path the receiver did. Neither is
+/// trusted to put bytes on this terminal.
 fn relay_error(payload: &Value) -> String {
-    payload["message"]
-        .as_str()
-        .unwrap_or("the relay reported an error")
-        .to_string()
+    crate::display::peer_message(
+        payload["message"]
+            .as_str()
+            .unwrap_or("the relay reported an error"),
+    )
 }
 
 #[cfg(test)]
diff --git a/cli/src/transport/relay.rs b/cli/src/transport/relay.rs
index ddc2d7a..995acf5 100644
--- a/cli/src/transport/relay.rs
+++ b/cli/src/transport/relay.rs
@@ -80,12 +80,12 @@ fn while_waiting(payload: &Value) -> WhileWaiting {
         Some("status") if payload["status"].as_str() == Some("receiver_connected") => {
             WhileWaiting::PeerArrived
         }
-        Some("error") => WhileWaiting::Refused(
+        // The relay is untrusted, and this reaches the terminal verbatim.
+        Some("error") => WhileWaiting::Refused(crate::display::peer_message(
             payload["message"]
                 .as_str()
-                .unwrap_or("the relay reported an error")
-                .to_string(),
-        ),
+                .unwrap_or("the relay reported an error"),
+        )),
         _ => WhileWaiting::KeepWaiting,
     }
 }
diff --git a/cli/src/ui/app.rs b/cli/src/ui/app.rs
index cb7343a..0318011 100644
--- a/cli/src/ui/app.rs
+++ b/cli/src/ui/app.rs
@@ -347,7 +347,10 @@ fn browse(screen: &mut Screen, start: PathBuf, picking: Picking) -> Outcome<Path
 
             body.push(row(
                 selected == index + 1,
-                format!("{}{detail}", entry.name),
+                // A local name, but not necessarily a benign one: a file
+                // extracted from somebody's archive can carry an escape
+                // sequence, and ratatui prints a cell's text as it is given.
+                format!("{}{detail}", crate::display::name(&entry.name)),
             ));
         }
 
diff --git a/cli/tests/transfer.rs b/cli/tests/transfer.rs
index b6cd155..929dbc8 100644
--- a/cli/tests/transfer.rs
+++ b/cli/tests/transfer.rs
@@ -915,3 +915,96 @@ async fn the_carrier_line_stays_out_of_an_ordinary_transfer() {
         "the sender stopped saying which path it took:\n{sent}"
     );
 }
+
+/// A name the sender chose cannot run on the receiver's terminal.
+///
+/// The name carries a clear-line-and-move-up sequence and a right-to-left
+/// override. Before `display` existed, the receiver's "Receiving" line printed
+/// both verbatim, before the receiver had agreed to anything.
+///
+/// Through the real binary and a pipe, because a pipe is what makes the
+/// assertion meaningful: the progress line only writes escape sequences when
+/// stderr is a terminal, so any escape found here came from the name.
+///
+/// Unix only. Windows refuses control characters in file names, so there is
+/// no way to create the fixture there, and a Windows sender cannot produce
+/// this name either.
+#[cfg(unix)]
+#[tokio::test]
+async fn a_hostile_file_name_cannot_write_escape_sequences_to_the_receiver() {
+    let origin = spawn_relay().await;
+    let base = scratch("hostile-name");
+    let hostile_name = "report\x1b[2K\x1b[1A\u{202E}fdp.exe";
+    let source = base.join(hostile_name);
+    let destination = base.join("received");
+    fs::create_dir_all(&destination).expect("destination directory");
+    write_file(&source, b"not what the name says");
+
+    let mut sender = tokio::process::Command::new(env!("CARGO_BIN_EXE_drop"))
+        .arg("send")
+        .arg(&source)
+        .args(["--server", &origin, "--transport", "relay"])
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .expect("spawn the sender");
+
+    let mut announced = BufReader::new(sender.stdout.take().expect("the sender's stdout")).lines();
+    let code = tokio::time::timeout(Duration::from_secs(30), announced.next_line())
+        .await
+        .expect("the sender announced a code in time")
+        .expect("reading the sender's stdout")
+        .expect("the sender announced a code at all");
+
+    let receiver = tokio::process::Command::new(env!("CARGO_BIN_EXE_drop"))
+        .args(["recv", &code, "--server", &origin, "--transport", "relay"])
+        .arg("--out")
+        .arg(&destination)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .expect("spawn the receiver")
+        .wait_with_output();
+
+    let receiver = tokio::time::timeout(Duration::from_secs(60), receiver)
+        .await
+        .expect("the receiver finished in time")
+        .expect("the receiver ran");
+    let sender = tokio::time::timeout(Duration::from_secs(60), sender.wait_with_output())
+        .await
+        .expect("the sender finished in time")
+        .expect("the sender ran");
+
+    let sent = String::from_utf8_lossy(&sender.stderr);
+    let received = String::from_utf8_lossy(&receiver.stderr);
+
+    assert!(sender.status.success(), "the sender failed:\n{sent}");
+    assert!(
+        receiver.status.success(),
+        "the receiver failed:\n{received}"
+    );
+
+    for (who, output) in [("receiver", &received), ("sender", &sent)] {
+        assert!(
+            !output.contains('\x1b'),
+            "an escape sequence from the name reached the {who}'s terminal:\n{output:?}"
+        );
+        assert!(
+            !output.contains('\u{202E}'),
+            "a right-to-left override from the name reached the {who}'s terminal:\n{output:?}"
+        );
+    }
+
+    assert!(
+        received.contains("fdp.exe"),
+        "the name should still be shown, only neutralised:\n{received}"
+    );
+
+    // The file itself keeps the name the sender gave it. Displaying a name
+    // safely is not the same as renaming a file, and this test is about the
+    // first.
+    assert_eq!(
+        fs::read(destination.join(hostile_name)).expect("the received file"),
+        b"not what the name says"
+    );
+}
diff --git a/docs/implementation-checklist.md b/docs/implementation-checklist.md
index 4547ad5..5fa4517 100644
--- a/docs/implementation-checklist.md
+++ b/docs/implementation-checklist.md
@@ -503,7 +503,7 @@ manual checklist recorded.
 ## 11. Receiver consent, cancel, and live status
 
 Plan: [`receiver-consent-and-status-plan-2026-09-14.md`](plans/receiver-consent-and-status-plan-2026-09-14.md)
-Status: **proposed**
+Status: **active** — phase 1 done
 
 The receiver sees name, type, size and where it will be saved, and accepts
 before a byte is written. Either side can cancel and the other is told in words.
@@ -513,9 +513,11 @@ receive, finish.
 - [ ] Phase 0 — decisions entry; consent before bytes, `--yes` required without
       a terminal (user decision 2026-09-14), reasons as enumerations, version 2,
       exit codes.
-- [ ] Phase 1 — display sanitisation, alone. **Live bug**: a received filename
-      reaches `eprintln!` unfiltered today, so an escape sequence in it can
-      redraw the terminal.
+- [x] Phase 1 — display sanitisation, alone. **Live bug**, fixed 2026-09-14: a
+      received filename reached `eprintln!` unfiltered, so an escape sequence
+      in it could redraw the terminal. Also covered: error messages from a peer
+      or the relay, archive warnings, and the file browser. Pinned end to end
+      through the binary, with a negative control.
 - [ ] Phase 2 — protocol and relay: `meta_ok` on both carriers, `accept`,
       `decline`, receiver `cancel`, `finishing`; the relay refuses chunks
       before `accept` and stops counting declines and cancels as failures;
diff --git a/docs/plans/receiver-consent-and-status-plan-2026-09-14.md b/docs/plans/receiver-consent-and-status-plan-2026-09-14.md
index d312ffe..2700a5b 100644
--- a/docs/plans/receiver-consent-and-status-plan-2026-09-14.md
+++ b/docs/plans/receiver-consent-and-status-plan-2026-09-14.md
@@ -1,6 +1,6 @@
 # Receiver consent, cancel, and live status plan
 
-Status: **proposed**
+Status: **active** — phase 1 done 2026-09-14
 Created: **2026-09-14**
 Last updated: **2026-09-14**
 
@@ -334,16 +334,32 @@ concrete type.
 It fixes a live bug independent of consent: an escape sequence in a received
 filename reaches the terminal today.
 
-- [ ] `sanitize_for_display` in a new `cli/src/display.rs`, with unit tests:
-      CSI sequence, OSC 8 hyperlink, C1 control, each bidirectional control,
-      collapsed whitespace padding, middle ellipsis keeping the extension, and a
-      legitimate non-ASCII name (`Łódź 東京 🎉.txt`) passing through unchanged.
-- [ ] Applied to every peer-chosen string that reaches a terminal:
-      `recv.rs:282-286`, `recv.rs:526-532`, extractor warnings printed at
-      `recv.rs:662-664`, and the sender's printing of paths it scanned (its own
-      files, but a hostile filename can already exist on a shared disk).
-- [ ] `type_label(name)` and `is_program(name)`, tested against the padding
-      trick above.
+- [x] `cli/src/display.rs`: `for_terminal`, `name` and `peer_message`, with
+      unit tests covering a CSI sequence, an OSC 8 hyperlink, an OSC window
+      title, a C1 control, newlines and tabs, each bidirectional control, the
+      right-to-left-override extension trick, collapsed whitespace padding, a
+      middle ellipsis that keeps the extension, wide characters counted as two
+      columns, and honest names (`Łódź 東京 🎉.txt`, Arabic, an emoji ZWJ
+      sequence, `10:30 standup.md`) passing through unchanged.
+- [x] Applied at every site where someone else's text reaches a terminal:
+      - the receiver's `Receiving` line, collision note, `Saved` path, archive
+        warnings and extraction line
+      - every `error` frame's message, in `recv.rs`, `send.rs` and
+        `transport/relay.rs`
+      - the relay's HTTP error body in `client.rs`
+      - the sender's own `Sending` summary and warnings
+      - the interface's file browser rows
+- [x] End to end through the real binary: a file named with a clear-line
+      sequence and a right-to-left override crosses a real relay, and neither
+      side's stderr contains `ESC` or `U+202E`. **Negative control:** with the
+      `Receiving` line reverted to printing the name verbatim, the test fails
+      with "an escape sequence from the name reached the receiver's terminal".
+- Moved to phase 3, where the preview first needs them: `type_label(name)` and
+  `is_program(name)`. Adding them here would be code with no caller.
+
+Done 2026-09-14 on `fix/sanitize-peer-text`. 193 tests, up from 180: 12 unit
+tests and one end-to-end. `unicode-width` becomes a direct dependency, and it
+was already in the tree through ratatui.
 
 ### Phase 2 — protocol and relay
 
diff --git a/docs/security.md b/docs/security.md
index 559b31f..d84fd5a 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -155,6 +155,18 @@ overrides. Any surface that renders it — especially a confirmation prompt, whe
 misleading the reader is the whole payoff — must render it inert first. The web
 client escapes by default; a terminal does not.
 
+The CLI does this in `cli/src/display.rs`. Every name a peer chose, every
+archive warning that quotes one, and every error message a peer or the relay
+sent passes through it before reaching the terminal. The relay is untrusted, so
+its messages count as peer text too. Control characters, including the bytes
+that begin every escape sequence, and bidirectional and invisible formatting
+characters are **replaced** with `U+FFFD`, not removed, so a doctored name looks
+doctored. Whitespace runs collapse, so padding cannot push an extension out of
+sight. Long names are shortened in the middle, keeping the extension. Only
+display changes: a received file keeps the name its bytes arrived with, subject
+to the path rules above. Until 2026-09-14 the receiver printed the sender's
+filename verbatim in its `Receiving` line.
+
 ## Resource bounds
 
 Every bound exists to stop one peer consuming the relay: