The individual protected-content segments (one per system message, the latest user
message, each diff header/hunk line, …) that must each survive byte-for-byte after any
transform. Kept as separate segments (rather than one flattened blob) so safety.rs can
check each one independently — concatenated messages are rarely contiguous in the
original document, so a single substring check across the whole blob would be meaningless.