Markdown

Markdown as a reader sees it.

People and agents write to each other in markdown, so a transcript that shows **bold** shows characters nobody meant to write. Reading it is the job of this one place, on the JVM: the browser is handed prose that is already markup, which is what keeps a markdown parser out of the bundle and makes a server-rendered page and an element-rendered page the same page.

Everything the transcript wrote is escaped. Markdown's own syntax is the only thing that becomes markup, and two of its outcomes are refused:

• a destination whose scheme would run code, or would name anything but a web page or an address to write to. The sanitizer reads the scheme where one is written and empties the destination it refuses; an empty destination still draws an anchor that reads as a link and opens the page it sits on, so what was written is shown as its words and no anchor is drawn at all. A destination that writes no scheme at all — /matters/x, //host/x — names no other kind of thing, and is left as it was written
• an image, which would fetch bytes from somewhere else into the host's document. The card's rule is that an artifact is a reference and a media type, never bytes, so a markdown image is rendered as the reference it is.