A name write is one name, refused with its reason otherwise; a log record is one line of UTF-8

A name took a second line, DEL, a C1 control or bytes that are not UTF-8,
which then went into /index and /log as they were and split or garbled a
reader's lines. `name` strips one trailing newline and refuses the rest,
saying which (`bad character in file name: not UTF-8`); and the log turns
DEL and C1 into spaces, as it did control characters, and escapes bytes
that are not UTF-8 as `\xNN`.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 10 insertions, 5 deletions

diff --git a/docs/fs.md b/docs/fs.md
index df1b128c..9adef635 100644
--- a/docs/fs.md
+++ b/docs/fs.md
@@ -507,10 +507,13 @@ writing it renames the buffer; a relative name resolves against the pane's
 directory. A name alone is no edit: the pane's `dirty` stays what its text made it
 (a renamed clean file is still 0, and nothing asks about it at Exit,
 Restore or Del, which ask only about text edited), and `Save` writes it
-under the new name all the same. The write is the name and its newline, nothing trimmed: a blank
-inside a name is taken (`two words.zig`), but one at either end, or a
-control character, is refused, `bad character in file name` (EINVAL), as
-acme refuses a blank (xfid.c:650), rather than quietly cut off. `body` appends on write and replaces on truncating open. A
+under the new name all the same. A write is one name: one trailing newline
+is its end and nothing else is trimmed. A blank inside a name is taken
+(`two words.zig`); refused, EINVAL, in acme's words (xfid.c:650) and why,
+are a blank at either end (not quietly cut off), `bad character in file
+name: a blank at its end`, a second line, `...: a newline (a name is one
+line)`, a control byte, DEL or a C1 control (U+0080-U+009F), `...: a
+control character`, and bytes that are not UTF-8, `...: not UTF-8`. `body` appends on write and replaces on truncating open. A
 terminal's `body` is its history as plain text, frozen per open, in logical
 lines: a row the terminal wrapped is joined back to the row before it (the
 wrap is ghostty's, as `pty/run`'s output unwraps), and the last line ends
@@ -786,7 +789,9 @@ acme's `errors` only takes text, and one record stream is simpler to watch
 than a file per pane. A `msg` said while a
 pane is being made can precede that pane's `new`; panes present at boot are
 recorded before anything else.
-Control characters in a record become spaces, so a record is one line.
+Control characters, DEL and C1 controls (U+0080-U+009F) in a record become
+spaces, and a byte that is not UTF-8 is written `\xNN`, so a record is one
+line of UTF-8.
 (An `event` record is not: acme's `<origin><action><q0> <q1> <flag> <n>
 <text>\n`, whose text may hold newlines. The origin is `E` (a 9P write to body or tag), `F` (other
 files, the editor's own lines), `K` (the keyboard) or `M` (the mouse); the