Thanks @pwilliams that sounds great.
Ultimately I think it would be great to get a defined set of good and bad characters into the spec so everyone knows what the rules are and validation can be standardised. UTF-8 Unicode is a very broad target with multiple ways of doing essentially the same thing in places. It’d be good to constrain that problem space.
It’d be great to see what you come up with.