Research: prompt-injection defences for persisted memory; the M5a check refuses all default-ignorable code points

The research feeds M5b's sanitizer. One finding is a bug in the M5a
draft: category Cf misses variation selectors, the combining grapheme
joiner, and the Hangul and Braille fillers.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/specs/2026-09-24-m5a-local-memory.md

@@ -211,8 +211,12 @@ the file fails safely: every `old` must match an entry of the file as it is now,
 if it contains:
 
 1. a control character other than newline and tab (C0, DEL, C1);
-2. an invisible or direction-changing character (Unicode general category `Cf`: zero-width
-   spaces and joiners, bidirectional controls, and the like);
+2. an invisible or direction-changing character: any code point with the Unicode property
+   `Default_Ignorable_Code_Point` (zero-width spaces and joiners, bidirectional controls,
+   variation selectors, tag characters U+E0000 to U+E007F, and the like), and U+034F, U+115F,
+   U+3164, U+2800, U+2028 and U+2029, which are invisible without being in that property or in
+   category `Cf` (`docs/research/2026-09-24-prompt-injection-memory.md`, section 2). The table
+   is fixed in the code, from Unicode 16 data;
 3. chat-template markup: `<|` or `|>`, or `<think`, `</think`, `<tool_call`, `</tool_call`;
 4. one of these phrases, ignoring case and runs of spaces: `ignore previous instructions`,
    `ignore all previous`, `disregard previous instructions`, `disregard all previous`,