Function render_credential_issue 

pub fn render_credential_issue(r: &CredentialIssueRecord) -> String

One credential handed to a component. Printed the moment it resolves and never folded into a rollup: an operator scanning a run for “what got out” must find one line per issue, not a count.

key is guest-authored (design §5.5 — the descriptor is untrusted input), and so is the stored kind, so both go through escape_audit_field; a newline in either would otherwise forge a second audit line.