fix: systematic byte fidelity for config strings and RV7 gaps

Resolves the 9 gap groups in docs/rewrite/notes/review-rv7-codex.md and
audits every string-typed config field against its consumers
(field -> consumers -> decode status table in final-Z9.md):
- Windows EnvMap keys use a port of Zig's nls.zig uppercase table
  (upcaseW); Windows locale init follows Zig's chain (setlocale +
  _putenv_s); malformed WTF-8 now fails process launch conversions like
  Zig instead of substituting U+FFFD; kitty file paths convert WTF-8.
- bash --rcfile/--init-file, configured TERM and inherited GTK LANG
  keep their original bytes.
- C API clipboard completion and ghostty_surface_binding_action take
  bytes; complete_clipboard_request is byte-typed through the core.
- text:/csi:/esc: bindings, enquiry-response, input = path:, embedded
  initial_input, search needles, titles, link regexes, clipboard
  codepoint map, command palette text and GTK font/namespace values
  decode the escape encoding before use.

Remaining by design: D-Bus a{ss} values and +new-window arguments are
UTF-8 by D-Bus type. C API key/preedit text follows separately.

Test Plan:
- cargo test --workspace
- just check-macos (both), just check-windows, just check-wasm

crates/ghostty-core/src/surface/binding.rs

@@ -713,30 +713,35 @@ impl Surface {
                 // We need to send the CSI/ESC sequence as a single write
                 // request. If you split it across two then the shell can
                 // interpret it as two literals.
-                let full = if matches!(action, Action::Csi(_)) {
-                    format!("\x1b[{data}")
+                let mut full: Vec<u8> = if matches!(action, Action::Csi(_)) {
+                    b"\x1b[".to_vec()
                 } else {
-                    format!("\x1b{data}")
+                    b"\x1b".to_vec()
                 };
+                // The payload is a config string in the reversible OS-byte
+                // encoding: the pty gets the original bytes.
+                full.extend(ghostty_os::osbytes::config_str_to_bytes(data));
                 // Zig formats into a fixed 128 byte buffer (`NoSpaceLeft`).
                 if full.len() > 128 {
                     return Err("csi/esc binding sequence too long (max 128 bytes)".into());
                 }
-                self.queue_io(IoMessage::write_req(full.as_bytes()));
+                self.queue_io(IoMessage::write_req(full.as_slice()));
 
                 // CSI/ESC triggers a scroll.
                 self.scroll_to_bottom(&mut self.lock_terminal());
             }
 
             Action::Text(data) => {
-                let text = match ghostty_config::string::parse(data) {
+                // Decoded bytes: escapes produce UTF-8, everything else is
+                // copied byte for byte (Zig `config/string.zig`).
+                let text = match ghostty_config::string::parse_bytes(data) {
                     Ok(t) => t,
                     Err(err) => {
                         log::warn!("error parsing text binding text={data} err={err:?}");
                         return Ok(true);
                     }
                 };
-                self.queue_io(IoMessage::write_req(text.as_bytes()));
+                self.queue_io(IoMessage::write_req(text.as_slice()));
 
                 // Text triggers a scroll.
                 self.scroll_to_bottom(&mut self.lock_terminal());
@@ -817,7 +822,11 @@ impl Surface {
                     }
                 } else if let Some(s) = self.search.borrow().as_ref() {
                     s.handle
-                        .send(SearchMessage::ChangeNeedle(text.as_bytes().to_vec()));
+                        // The payload is a config string in the reversible
+                        // encoding: search for the original bytes.
+                        .send(SearchMessage::ChangeNeedle(
+                            ghostty_os::osbytes::config_str_to_bytes(text),
+                        ));
                     s.handle.wakeup();
                 }
             }
@@ -925,11 +934,15 @@ impl Surface {
             }
 
             Action::SetSurfaceTitle(v) => {
-                return Ok(self.perform(RtAction::SetTitle(SetTitle { title: v.clone() })));
+                return Ok(self.perform(RtAction::SetTitle(SetTitle {
+                    title: ghostty_os::osbytes::config_str_to_text(v),
+                })));
             }
 
             Action::SetTabTitle(v) => {
-                return Ok(self.perform(RtAction::SetTabTitle(SetTitle { title: v.clone() })));
+                return Ok(self.perform(RtAction::SetTabTitle(SetTitle {
+                    title: ghostty_os::osbytes::config_str_to_text(v),
+                })));
             }
 
             Action::ClearScreen => {

crates/ghostty-core/src/surface/clipboard.rs

@@ -88,8 +88,9 @@ impl Surface {
 
         // The options we'll use for all formatting. We'll just override the
         // emit format.
-        let codepoint_map: Vec<formatter::CodepointMap> =
-            cfg.clipboard_codepoint_map.map.list.clone();
+        // Replacement strings are config strings (reversible byte encoding);
+        // the formatter produces text, so decode them to UTF-8 text first.
+        let codepoint_map = decode_codepoint_map(&cfg.clipboard_codepoint_map.map.list);
         let opts = formatter::Options {
             emit: Format::Plain, // We'll override this below
             unwrap: true,
@@ -195,20 +196,20 @@ impl Surface {
     pub fn complete_clipboard_request(
         &self,
         req: ClipboardRequest,
-        data: &str,
+        data: &[u8],
         confirmed: bool,
     ) -> Result<(), ClipboardError> {
         match req {
-            ClipboardRequest::Paste => self.complete_clipboard_paste(data.as_bytes(), confirmed),
+            ClipboardRequest::Paste => self.complete_clipboard_paste(data, confirmed),
 
             ClipboardRequest::Osc52Read(clipboard) => {
-                self.complete_clipboard_read_osc52(data.as_bytes(), clipboard, confirmed)
+                self.complete_clipboard_read_osc52(data, clipboard, confirmed)
             }
 
             ClipboardRequest::Osc52Write(clipboard) => {
                 self.rt_surface.set_clipboard(
                     clipboard,
-                    &[("text/plain".to_owned(), data.as_bytes().to_vec())],
+                    &[("text/plain".to_owned(), data.to_vec())],
                     !confirmed,
                 );
                 Ok(())
@@ -407,3 +408,40 @@ impl Surface {
         self.complete_clipboard_paste(text, true)
     }
 }
+
+/// The clipboard codepoint map with string replacements decoded from the
+/// config encoding (a literal `U+FDD0` is restored; bytes that are not
+/// UTF-8 can't be represented in the formatter's text output).
+fn decode_codepoint_map(list: &[formatter::CodepointMap]) -> Vec<formatter::CodepointMap> {
+    list.iter()
+        .map(|e| formatter::CodepointMap {
+            range: e.range,
+            replacement: match &e.replacement {
+                formatter::Replacement::String(s) => {
+                    formatter::Replacement::String(ghostty_os::osbytes::config_str_to_text(s))
+                }
+                r @ formatter::Replacement::Codepoint(_) => r.clone(),
+            },
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod decode_map_tests {
+    use super::*;
+
+    #[test]
+    fn string_replacements_are_decoded() {
+        let enc = ghostty_os::osbytes::valid_str_to_config_string("a\u{fdd0}");
+        assert_ne!(enc, "a\u{fdd0}");
+        let list = [formatter::CodepointMap {
+            range: [1, 2],
+            replacement: formatter::Replacement::String(enc),
+        }];
+        let out = decode_codepoint_map(&list);
+        assert_eq!(
+            out[0].replacement,
+            formatter::Replacement::String("a\u{fdd0}".to_owned())
+        );
+    }
+}

crates/ghostty-core/src/surface/config.rs

@@ -55,7 +55,7 @@ impl DerivedConfig {
         let mut links = Vec::with_capacity(config.link.links.len());
         for link in &config.link.links {
             links.push(Link {
-                regex: Regex::new(&link.regex)?,
+                regex: Regex::new(&ghostty_os::osbytes::config_str_to_text(&link.regex))?,
                 action: link.action,
                 highlight: link.highlight,
             });

crates/ghostty-core/src/surface/mod.rs

@@ -459,7 +459,10 @@ impl Surface {
             // don't leak GHOSTTY_LOG to any subprocesses
             env.remove("GHOSTTY_LOG");
 
-            let mut ecfg = exec::Config::new(env, config.term.clone());
+            let mut ecfg = exec::Config::new(
+                env,
+                ghostty_os::osbytes::EncodedOs::from_encoded(config.term.clone()),
+            );
             ecfg.command = command.clone();
             ecfg.env_override = config.env.clone();
             ecfg.shell_integration = config.shell_integration;
@@ -604,7 +607,7 @@ impl Surface {
             rt_app.perform_action(
                 Target::Surface(id),
                 RtAction::SetTitle(SetTitle {
-                    title: title.clone(),
+                    title: ghostty_os::osbytes::config_str_to_text(title),
                 }),
             );
         } else if config.xdg_terminal_exec
@@ -617,7 +620,7 @@ impl Surface {
             rt_app.perform_action(
                 Target::Surface(id),
                 RtAction::SetTitle(SetTitle {
-                    title: cmd.string(),
+                    title: ghostty_os::osbytes::config_str_to_text(&cmd.string()),
                 }),
             );
         } else if let Some(cmd) = &command {
@@ -633,7 +636,7 @@ impl Surface {
                 rt_app.perform_action(
                     Target::Surface(id),
                     RtAction::SetTitle(SetTitle {
-                        title: first.clone(),
+                        title: ghostty_os::osbytes::config_str_to_text(first),
                     }),
                 );
             }
@@ -1303,7 +1306,7 @@ impl Surface {
         // configured title.
         if let Some(title) = &config.title {
             self.perform(RtAction::SetTitle(SetTitle {
-                title: title.clone(),
+                title: ghostty_os::osbytes::config_str_to_text(title),
             }));
         }
 
@@ -2062,7 +2065,7 @@ impl CoreSurface for Surface {
     fn complete_clipboard_request(
         &self,
         req: ClipboardRequest,
-        data: &str,
+        data: &[u8],
         confirmed: bool,
     ) -> Result<(), ClipboardError> {
         Surface::complete_clipboard_request(self, req, data, confirmed)

crates/ghostty-core/tests/common/mod.rs

@@ -326,7 +326,10 @@ impl Harness {
                 .get(&cb_key(clipboard))
                 .cloned()
                 .unwrap_or_default();
-            match self.surface.complete_clipboard_request(req, &text, false) {
+            match self
+                .surface
+                .complete_clipboard_request(req, text.as_bytes(), false)
+            {
                 Ok(()) => {}
                 Err(ClipboardError::UnsafePaste | ClipboardError::UnauthorizedPaste) => {
                     self.rt

crates/ghostty-core/tests/e2e_bindings.rs

@@ -111,7 +111,7 @@ fn unbracketed_paste_converts_newlines_and_requires_confirmation_when_unsafe() {
     // Confirm it.
     let c = h.rt.confirmations.borrow()[0].clone();
     h.surface
-        .complete_clipboard_request(c.request, &c.text, true)
+        .complete_clipboard_request(c.request, c.text.as_bytes(), true)
         .unwrap();
     h.expect_input(b"rm -rf x\rls");
 }
@@ -367,6 +367,31 @@ fn text_csi_esc_and_ignore_bindings() {
     h.expect_input(b"hi!\x1b[1;5H\x1bx");
 }
 
+#[test]
+fn config_loaded_text_csi_esc_write_decoded_bytes() {
+    use ghostty_os::osbytes::EncodedOs;
+
+    let h = harness!(Harness::recorder("", &[]));
+    let enc = |raw: &[u8]| EncodedOs::from_bytes(raw).into_encoded();
+    // Byte FF and a literal U+FDD0 must reach the pty unchanged, not as
+    // the reversible escape encoding.
+    for (kind, raw, want) in [
+        ("text", &b"a\xffb"[..], b"a\xffb".to_vec()),
+        (
+            "text",
+            "\u{fdd0}".as_bytes(),
+            "\u{fdd0}".as_bytes().to_vec(),
+        ),
+        ("csi", &b"\xff"[..], b"\x1b[\xff".to_vec()),
+        ("esc", "\u{fdd0}".as_bytes(), b"\x1b\xef\xb7\x90".to_vec()),
+    ] {
+        h.mark();
+        let a = ghostty_input::binding::Action::parse(&format!("{kind}:{}", enc(raw))).unwrap();
+        assert!(h.surface.perform_binding_action(&a).unwrap());
+        h.expect_input(&want);
+    }
+}
+
 #[test]
 fn csi_binding_longer_than_the_zig_buffer_is_rejected() {
     let h = harness!(Harness::recorder("", &[]));

crates/ghostty-core/tests/e2e_term.rs

@@ -162,7 +162,7 @@ fn osc52_write_ask_requires_confirmation_and_deny_ignores() {
     // The user confirms: the apprt calls complete_clipboard_request.
     let c = h.rt.confirmations.borrow()[0].clone();
     h.surface
-        .complete_clipboard_request(c.request, &c.text, true)
+        .complete_clipboard_request(c.request, c.text.as_bytes(), true)
         .unwrap();
     assert_eq!(h.rt.writes.borrow().len(), 2);
 
@@ -208,7 +208,7 @@ fn osc52_read_requires_confirmation_by_default() {
     assert_eq!(h.recorded(), Vec::<u8>::new());
     let c = h.rt.confirmations.borrow()[0].clone();
     h.surface
-        .complete_clipboard_request(c.request, &c.text, true)
+        .complete_clipboard_request(c.request, c.text.as_bytes(), true)
         .unwrap();
     // base64("secret") = c2VjcmV0
     h.expect_input(b"\x1b]52;c;c2VjcmV0\x1b\\");