Harden 'modelfuzz scan' against a hostile endpoint, and fix a false INCONCLUSIVE

[higagan]

Found by a full-library audit. Both confirmed by re-execution.

1. Endpoint-controlled text is rendered raw to the terminal

cli.py echoes the target's reply and the mutated payload to the terminal at three sites (~:412, :432, :453; :432 is not even _truncated). _truncate is " ".join(text.split()), which strips \n\r\t but leaves every ESC byte intact.

The target under test is the untrusted party by construction — _ATTACKER_SYSTEM explicitly asks it to produce deceptive output.

Rendering a captured pty stream through a terminal emulator: with the scan genuinely finding 3/3 vulnerable, the final screen displayed

0/3 seed strategies broke through. No vulnerabilities found within budget.

The DECSTBM scroll-region trick is not SGR, so the RESET the code appends does not undo it. Redirected to a file, three forged plain-text lines byte-identical to the real summary still precede the true one.

A security scanner that can be made to report "clean" by the thing it is scanning is the one failure mode it cannot have.

Fix: strip C0/C1 control characters inside _truncate, and route the :432 echo through it. Consider a size cap on the rendered reply.

2. INCONCLUSIVE is reported when only the attacker endpoint failed

cli.py:~448 increments errors without incrementing attempts, so the errors == attempts test at :~486 fires with zero probe errors. Three genuine SAFE verdicts and the remediation guidance are suppressed, and the user is told to check an endpoint that is working.

Provably conservative — a real vulnerability can never be masked this way — but it is misleading. Fix: a separate attacker_errors counter.