diff --git a/.gitignore b/.gitignore
index faab1cb..cb85322 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,8 @@ docs/glpi_api_contract.json
 # Coverage data: rewritten by every test run (and by the venv .pth hook).
 .coverage
 .coverage.*
+
+# One-shot live-instance probe scripts. They are standalone investigations
+# (a main() run by hand against preprod), not collected tests -- the findings
+# get written up in CHANGELOG.md, the scripts stay local.
+integration_tests/probe_*.py
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6f1c90..b1dc065 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,361 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 0.5.0 — 2026-09-08
+
+### Fixed
+
+- **Deeply nested HTML raised `RecursionError` while a model was being
+  validated.** `markdownify` walks the parsed document recursively and
+  spends about two CPython frames per nesting level, so roughly 494 levels
+  exhausted the default 1000-frame limit — measured, and the same 494 for
+  `<div>`, `<p>`, `<blockquote>` and `<table><tr><td>`, 495 for
+  `<ul><li>`, which is what identifies the cost as per-level. An
+  unclosed tag counts too: `html.parser` does not auto-close `<p>` or
+  `<li>`, so `"<p>" * 5000` really is 5000 levels.
+
+  Because the converter was wired as a Pydantic `BeforeValidator`, the
+  failure landed inside `model_validate` — that is, inside `get_ticket` —
+  as a bare builtin from a library whose whole error surface is supposed
+  to derive from `GlpiError`.
+
+  `from_transport` now *attempts* the conversion and answers the
+  `RecursionError` by stripping the document to its text instead.
+  **It degrades, it never truncates, and it does not raise for depth**:
+  every character of prose the converting path would have produced also
+  appears in the degraded rendering.
+
+  Attempting it rather than predicting it is the whole design, and it
+  replaced a fixed `MAX_HTML_DEPTH = 200` bound that was wrong in both
+  directions. Too low, because the budget is not 1000 frames but whatever
+  is left of the stack when the conversion starts, and that belongs to
+  the caller — so the bound had to assume the worst and flattened every
+  body between 200 and the real cliff of about 494. Measured, a
+  300-level and a 400-level body now come back as **Markdown with their
+  links, emphasis and lists intact** where they used to come back as
+  plain text, with no error to notice and no way to ask for better. And
+  too fragile, because predicting the depth meant reproducing the
+  parser's idea of the tree: three rounds of adversarial review found
+  seven ways for that estimate to land *under* the real depth, each of
+  which sent a document to `markdownify` and into the very
+  `RecursionError` the bound existed to prevent.
+
+  Trying the conversion cannot be wrong about whether the conversion
+  fits. `MAX_HTML_DEPTH` and the scan behind it are gone; the constant
+  was introduced in this same unreleased cycle and never shipped.
+
+  Two consequences worth knowing. The outcome now depends on the caller's
+  remaining stack, so the same body can convert from one call site and
+  degrade from a deeper one — nothing is lost either way, but a caller
+  comparing two renderings of one body should know which knob moved it.
+  And a body too deep to convert now pays the failed attempt before it
+  degrades: measured, 2.0x to 2.6x the old cost at 600 and 5000 levels.
+  Ordinary bodies got *faster*, at 0.87x to 0.90x, because the scan they
+  used to pay for on every read is gone.
+
+  A document `html.parser` refuses outright — `<![FOO[`, an unknown
+  marked-section keyword, which `bs4` re-raises as
+  `ParserRejectedMarkup` — takes the same degraded path, where it used
+  to raise and give the caller none of their text.
+
+  Both halves were fuzzed against the real parser over 15000 documents,
+  with zero under-counts, zero over-counts and zero text losses. Getting
+  there took several rules that are not the obvious ones:
+
+  - A closing tag pops by name or is ignored — `bs4` pops nothing when no
+    element of that name is open, so `"<div></p>" * 600` really is 600
+    deep where a naive counter says 1.
+  - An attribute value may contain `<` and `>`, so
+    `'<div title="</div>">' * 600` also measured 0 against a real 600
+    until the scan learned to skip quoted values.
+  - A quote opens a value only as the first character after the `=`,
+    which is the parser's own rule, so `<p title=don't>` carries the
+    value `don't`. Reading that apostrophe as a quote printed the opening
+    tag verbatim at the reader — and an apostrophe needs no malice to
+    reach a French ticket body.
+  - `tagfind_tolerant` runs a tag *name* to whitespace, `/` or `>`, so
+    `<style=>` is an element named `style=` and never enters raw-text
+    mode; a self-closed `<script/>` does not either, because
+    `parse_starttag` enters it only on the branch that is not
+    self-closing. Reading either as raw text swallowed the rest of the
+    document: `"<style=>" + "<div>" * 600` measured 1 level against a
+    real 601 and raised.
+  - A declaration is text on neither path only when it is closed. A
+    `<!weird` left unterminated at end of input is flushed as character
+    data when the parser closes, so dropping it lost the tail of a body.
+  - An unclosed tag counts, a childless node still occupies a level, and
+    a bogus comment swallows the tags inside it.
+  - The degraded path had to be measured against the converting path
+    construct by construct rather than reasoned about. Three answers came
+    back the opposite way round: a `<script>`/`<style>` body is *kept*
+    (`markdownify`'s `strip=` removes an element's markup and still walks
+    its children), so is a `CDATA` body, and so is the inside of any
+    `<!`/`<?` construct the parser could not resolve.
+
+  What the degraded rendering does not reproduce, none of it prose: link
+  targets and image alt text, fenced-block and `<pre>` indentation,
+  `&nbsp;`-padded alignment, and a processing instruction's `<?`/`>`
+  delimiters, which survive as literal text.
+
+  Character references are resolved by the parser's rule rather than by
+  `html.unescape`, which implements HTML5's longest-known-*prefix* rule
+  and would rewrite a pasted URL: `?a=1&copyright=2` becomes
+  `?a=1©right=2` under `unescape` and is left alone by the parser. A
+  semicolon-less reference resolves only when its whole name is known.
+
+  The ceiling is 200 rather than 494 because the budget is not 1000
+  frames, it is whatever is left of the stack when conversion starts, and
+  that belongs to the caller. The package's own contribution is small,
+  and since conversion moved to the attribute it no longer depends on how
+  the record was fetched: measured, 5 frames below the caller when
+  `.content` is read — the same 5 whether the model came from
+  `model_validate` or from `client.get_ticket` — and 9 on the write path,
+  where the renderer runs inside `model_dump`. What is not small is an
+  application reading `.content` from inside a request handler or a
+  recursive walk. Converting a 200-level document peaks at a measured 412
+  frames, so it stays safe until the caller's own stack passes about
+  588 — and no document a human wrote nests 200 elements deep.
+
+  **`sys.setrecursionlimit` was considered and rejected.** It is
+  process-global state belonging to the application, not to a library the
+  application imported; and past what the C stack can hold it converts a
+  catchable `RecursionError` into a hard interpreter crash — on Windows,
+  an access violation with no traceback. It moves the cliff and makes
+  falling off it worse. The prohibition is asserted by
+  `testing/tests/test_raise_site_audit.py` rather than left as a comment
+  for the next person to weigh up again.
+
+- **Where a tag *ends* was read with start-tag rules, twice.** Both were
+  unbounded depth under-counts, which is the one direction the ceiling
+  exists to prevent, and both also deleted prose from the degraded path at
+  any depth.
+
+  `parse_endtag` falls back to `rawdata.find(">")`, so an end tag skips
+  nothing — CPython's own comment concedes the case: "this is not 100%
+  correct, since we might have things like `</tag attr=">">`". Reading one
+  with attribute rules made `'</x a="><div>">' * 600` measure **0**
+  against a real 600.
+
+  `locatestarttagend_tolerant` reaches a quoted value only through an
+  attribute *name*, and a name may itself begin with `=`. So in
+  `<div ="<p><p>">` the parser reads the name `="<p` and ends the tag at
+  the first `>`, where treating any `=` before a quote as a value
+  indicator swallowed the rest: `'<div ="' + "<p>" * 600` measured **1**
+  against a real 600.
+
+  The attribute pattern is now a sequence of attributes rather than a run
+  of permitted characters, and end tags have their own branch. The
+  attribute name carries the parser's own "starts after a quote,
+  whitespace or `/`" rule, which is load-bearing twice over: without it
+  `<div ="` reads as a value, *and* the pattern backtracks
+  catastrophically — a 400-byte `'<div a="' * 50` did not finish.
+
+- **A body of nothing but `<div a="` cost O(n²).** 32 KB took 6.6 s. `re`
+  restarts at every `<` where `html.parser` buffers an incomplete tag and
+  never looks back. No `>` anywhere means no element anywhere, so that is
+  now answered in constant time. The pattern's remaining non-linear
+  shapes turned out to be exponential rather than quadratic, and are gone
+  with the pattern itself — see the entry below.
+
+- **The markup scan imitated `html.parser` instead of using it, and was
+  wrong in five unbounded ways at once.** A third adversarial round found
+  that the pattern reproducing the parser's dispatch disagreed with the
+  parser on: a comment closing on `--\s*>` rather than only `-->`; `</
+  script>` ending raw text; `<![IGNORE[` opening a marked section; `</ div
+  foo>` being a bogus comment rather than an end tag; and `<a href=/>` —
+  an ordinary root-relative link — leaving the element *open*, because the
+  unquoted value swallows the `/`. Each made a document measure one level
+  deep where the real tree was hundreds, so `'<a href=/>' * 494` cleared
+  the ceiling and raised. Two further findings were cost: a run of
+  whitespace inside a failing tag made the attribute pattern backtrack as
+  `(a+)*`, and a 39-byte body took 20.8 s.
+
+  The pattern is gone. Depth, void-tag canonicalisation and the degraded
+  rendering now come from one pass of an `html.parser` subclass — the same
+  parser `bs4` uses, so this cannot be wrong about the parser and is not a
+  new dependency or a new risk. Every pathology `html.parser` has was
+  already in the pipeline: measured on the shapes that made the pattern
+  backtrack, the `markdownify` call costs what the scan costs, to within a
+  few per cent.
+
+  Three consequences beyond the five defects:
+
+  - **A derailed scan silently reinstated the `<br>` data loss fixed
+    below**, because the void-tag workaround read the same pattern.
+    Measured, `"<p>one<br>two</p><script>x</ script><p>three<br
+    />TAIL</p>"` lost `TAIL` outright, and `<img>` and `<hr>` lost their
+    tails the same way.
+  - **A document the parser rejects now degrades instead of raising.**
+    `<![FOO[` makes `_markupbase` raise `AssertionError` on the
+    interpreters where that keyword is unknown — 3.10 through 3.12.11 as
+    measured, no longer 3.12.14 — and `bs4` re-raises it as
+    `ParserRejectedMarkup`. Where it happens, the caller used to get a
+    `GlpiContentError` and none of their text, and now gets their words.
+
+  Note that `html.parser`'s reading of a *malformed* construct is not
+  stable across CPython patch releases: the same three builds disagree
+  about an unterminated `<script>`, a comment with no `-->` and an end
+  tag carrying a quoted `>`. The scan tracks the parser rather than a
+  snapshot of it, so the depth decision stays correct on every version,
+  but the exact text a broken construct contributes to a degraded body is
+  the interpreter's. Well-formed content is unaffected.
+  - **A processing instruction no longer leaves `<?` and `>` in the
+    degraded text.** The converting path prints the body alone, so this
+    does too.
+
+  Cost, end to end and on identical output: 0.77x to 1.52x of the previous
+  implementation on realistic bodies. The exponential shapes are flat: 39
+  bytes of the whitespace bomb went from 20.8 s to 0.12 ms, and 20 KB of
+  it costs 0.67 ms. The depth scan those defects were found in has since
+  been removed altogether — see the entry above — but the same parser now
+  backs the void-tag rewrite and the degraded renderer, which inherited
+  every one of the misreadings and the backtracking too.
+
+  The one shape where `html.parser` is worse than linear is a document
+  carrying no `>` at all, where `close()` advances a character at a time
+  and rescans the tail: 32 KB costs it 13 s. That is answered in constant
+  time by the guard already present for the pattern's own O(n²) on the
+  same input, and is unreachable from `from_transport`, which needs a `>`
+  to find an element at all.
+
+  Re-fuzzed against a ground-truth walk of the tree `bs4` really builds,
+  over an alphabet carrying every construct all three rounds raised —
+  including the four whose absence is why the previous 10.5M-document
+  corpus could not have found these: `-- >`, `</ script>`, `<![IGNORE[`
+  and runs of whitespace and quotes inside a tag. **470000 documents, 0
+  depth under-counts, 0 prose losses, 0 crashes**, plus 60000 hostile
+  documents through `from_transport` with nothing but `GlpiError`
+  escaping.
+
+- **`GlpiContentError` did not survive the write path.** Outbound
+  conversion runs in a `PlainSerializer`, and pydantic-core catches
+  everything a serializer raises and re-raises `PydanticSerializationError`
+  — a `ValueError`, not a `GlpiError`, with `__cause__` and `__context__`
+  both `None`. So on every `create_*`/`update_*` carrying a body,
+  `except GlpiError` did not fire and the underlying fault was
+  unrecoverable. The fault is now stashed as it is raised and restored
+  around `model_dump`, with its own `__cause__` intact; a serialisation
+  failure that is *not* content becomes `GlpiValidationError` rather than
+  being mislabelled.
+
+- **One field spelled two ways shadowed itself in `model_dump`.** Pydantic
+  consumes the first alias and `extra="allow"` files the rest as model
+  extras — and an extra named after a field is emitted *instead of* that
+  field, so the attribute reported one body and the object's own dump
+  reported the other. The redundant spelling is now dropped before
+  Pydantic resolves anything, and `content_html` is the first choice, so a
+  dump carrying both round-trips back to the raw body.
+
+  Worth knowing about the read models: `model_copy(update={"content": ...})`
+  — the 0.4.x spelling — updates **nothing**, because `content` is now a
+  `cached_property`. A caller redacting a body that way gets an object
+  whose `.content` still holds the original. Rewrite `content_html`, or
+  rebuild through `model_validate`.
+
+- **A body that used both spellings of `<br>` lost everything after the
+  second one.** `<p>line1<br>line2</p><p>para2<br />line4</p>` converted
+  to `line1  \nline2\n\npara2` — `line4` silently gone, no error, on the
+  ordinary conversion path.
+
+  The cause is in `beautifulsoup4` (measured on 4.14.3), not in
+  `markdownify`. Its `html.parser` builder auto-closes a bare `<br>` and
+  records the name in `already_closed_empty_element` so a later `</br>`
+  can be ignored as redundant; when no `</br>` arrives the entry just
+  stays. The next `<br />` reaches the builder as `handle_startendtag`,
+  opens a real element and closes it itself — and that close finds the
+  stale entry, treats the element as already closed, and leaves it open,
+  so every following sibling becomes a child of the `<br>`.
+  `markdownify`'s `convert_br` ignores an element's children, and the
+  text is gone. `get_text` walks children, which is why the tree looks
+  intact.
+
+  Note the paragraph in the example: the two spellings need not be near
+  each other, since a name once recorded poisons the rest of the
+  document. `<img>` and `<hr>` are the other two converters that discard
+  children and lost text the same way.
+
+  `from_transport` now writes self-closing void tags bare before
+  converting, which removes the `handle_startendtag` path where the
+  asymmetry lives. Both spellings already built the same node, so nothing
+  else moves: measured over 4000 fuzzed documents of each spelling alone,
+  not one output changed, and over 4000 mixing them, 102 recovered text
+  and none lost any. Only names in the void set are touched, and only in
+  real tag position — a `<div/>`, a `<br />` inside an attribute value, a
+  comment or a `<script>` body are all left alone.
+
+- **`GlpiModel` now recognises validation aliases when it captures unknown
+  keys.** `_capture_unknown_fields` runs before Pydantic resolves aliases
+  and compared incoming keys against field *names* only, so an aliased key
+  was diverted into `extra_payload` before its field could see it — HTTP
+  200, no warning, and the value silently `None`. Latent until this
+  release, which introduces the package's first alias.
+
+### Added
+
+- **`GlpiContentError`** — a new `GlpiError` leaf for a rich-text body
+  that could not be converted, in either direction, with the underlying
+  fault attached as `__cause__`. Exported from the package root and
+  documented in the API reference.
+
+  Content conversion previously sat outside the taxonomy altogether: a
+  parser fault escaped `except GlpiError` and reached the caller as a bare
+  builtin. The depth ceiling above means no ordinary input gets here, so
+  this is the backstop — including for the outbound direction, where
+  `markdown` has its own cliff at around 500 levels of list indentation.
+
+  Unlike `GlpiStatusError`, `GlpiValidationError` and `GlpiProtocolError`
+  it does **not** inherit `ValueError`. Those three carry it for
+  compatibility with releases that raised bare `ValueError` at the same
+  sites; there was never a `ValueError` at a conversion site, and a parser
+  exhausting the stack is not a value the caller got wrong. Same reasoning
+  as `GlpiTransportError`.
+
+- **`content_html` on the read models**, holding the wire value verbatim:
+  `GetTicket`, `GetFollowup`, `GetTicketTask`, `GetSolution`,
+  `GetKBArticleRevision`, and `GetKBArticle` (which also gains
+  `description_html`).
+
+### Changed (breaking)
+
+- **Read models convert to Markdown on first access instead of during
+  validation.** `content` is now a `functools.cached_property` over
+  `content_html`:
+
+  ```python
+  ticket = client.get_ticket(42)
+  ticket.content_html   # '<p>Printer is <strong>offline</strong></p>'
+  ticket.content        # 'Printer is **offline**'  (converted here, once)
+  ```
+
+  **Callers that read `.content` need no change.** The field carries the
+  validation alias `content`, so a GLPI payload and a hand-written
+  `GetTicket(content=...)` both still populate it, and `.content` still
+  returns Markdown. What changes is *when*.
+
+  Two things follow. A caller who wants only `id` and `date_mod` no longer
+  pays HTML-to-Markdown on every record of every page. And a body that
+  cannot be converted no longer takes its page-mates with it:
+  `TransportMixin._resource_list` builds every item of a page in one
+  comprehension, so one unconvertible record used to make the whole page
+  unreadable — the failure is now scoped to the record whose body is
+  actually read.
+
+  Write models (`Post*`, `Patch*`) are deliberately unchanged: they keep
+  the plain `content` field and convert eagerly, so a caller's own
+  Markdown is still checked where it was supplied, and there is no list
+  path on a write model to make lazy.
+
+  What does break: `content` is no longer in `GetTicket.model_fields`, and
+  `GetTicket(...).model_dump()` emits `content_html` holding HTML where it
+  used to emit `content` holding Markdown (`by_alias=True` gives a dump
+  keyed the way GLPI keys it).
+
+  One sharp edge comes with the cache. Assigning to `content_html` after
+  `.content` has been read leaves the stale Markdown in place, and so does
+  `model_copy(update={"content_html": ...})` — and neither equality,
+  `repr` nor any `model_dump` reveals it. Treat a read model as immutable
+  once validated, or rebuild it through `model_validate`.
+
 ## 0.4.3 — 2026-08-13
 
 ### Changed (breaking)
diff --git a/README.md b/README.md
index 188d330..d4a2d41 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,11 @@ The goal is to let GLPI integrations work with domain objects instead of raw
 JSON payloads. The package exposes Pydantic models for tickets, users,
 followups, documents, locations, and related records, while converting GLPI
 HTML content into Markdown for Python-side workflows and rendering Markdown
-back to HTML for outgoing payloads.
+back to HTML for outgoing payloads. On a response model that conversion is
+lazy — `.content` converts on first read and caches, so listing records
+costs nothing per body — and it degrades to plain text rather than failing
+on pathologically nested HTML. See
+[Rich-text content](https://glpi-python-client.readthedocs.io/en/latest/user_guide.html#content-conversion).
 
 It currently focuses on ticket-centric workflows and exposes two high-level
 clients built on top of the GLPI v2 REST API:
diff --git a/docs/api_reference.rst b/docs/api_reference.rst
index 61ab4af..0c62a1b 100644
--- a/docs/api_reference.rst
+++ b/docs/api_reference.rst
@@ -27,11 +27,13 @@ from it, so neither wraps the other and the two cannot drift apart.
 Exceptions
 ----------
 
-Exceptions raised for a bad argument, an unexpected HTTP status, or an
-unusable response body derive from :class:`GlpiError`.
-:class:`GlpiStatusError`, :class:`GlpiValidationError` and
-:class:`GlpiProtocolError` also inherit :class:`ValueError` for backwards
-compatibility with releases that raised bare ``ValueError``.
+Exceptions raised for a bad argument, an unexpected HTTP status, an
+unusable response body, or content that cannot be converted derive from
+:class:`GlpiError`. :class:`GlpiStatusError`, :class:`GlpiValidationError`
+and :class:`GlpiProtocolError` also inherit :class:`ValueError` for
+backwards compatibility with releases that raised bare ``ValueError``;
+:class:`GlpiContentError` and :class:`GlpiTransportError` do not, because
+nothing was passed in wrongly in either case.
 
 Network-level faults (connection failures, DNS errors, timeouts) are
 raised as :class:`GlpiTransportError`, or its :class:`GlpiTimeoutError`
@@ -80,6 +82,55 @@ guide for the full picture, including which methods raise which type.
    :members:
    :show-inheritance:
 
+.. autoexception:: GlpiContentError
+   :members:
+   :show-inheritance:
+
+Rich-text content
+-----------------
+
+GLPI exchanges ticket, followup, task, solution and knowledge-base bodies
+as HTML. The package's surface is Markdown in both directions, but the two
+directions work differently, and the difference is visible.
+
+A **write** model (``Post*``, ``Patch*``) takes Markdown in ``content`` and
+renders it to HTML when the request is built. Nothing to think about.
+
+A **read** model (``Get*``) keeps two views of the same body:
+
+``content_html``
+   what GLPI sent, verbatim. Also accepts the wire spelling ``content`` on
+   construction.
+
+``content``
+   the same body as Markdown, converted on the first read and cached.
+   :class:`GetKBArticle` has ``description`` / ``description_html`` as
+   well.
+
+Reading ``.content`` is what a caller wants and what earlier releases
+returned, so no read-side code needs changing. What changed is *when* the
+conversion happens, which buys two things: listing records costs nothing
+per body, and a body that cannot be converted no longer stops the rest of
+its page being read.
+
+Very deeply nested HTML is the case worth knowing about.
+``markdownify`` walks the document recursively and runs out of stack at
+around 494 levels of nesting. The converter does not try to predict
+that: it attempts the conversion and, if the walk does not fit, strips
+tags instead. It degrades, it never truncates, and it does not raise:
+every character the normal rendering would have produced still appears.
+What is lost is structure rather than words — link targets and image alt
+text, code fencing and ``<pre>`` indentation, ``&nbsp;`` alignment.
+Because the budget is the stack left when the conversion starts, the
+same body can convert from one call site and degrade from a deeper one.
+Anything else that goes wrong in either direction raises
+:class:`GlpiContentError`.
+
+Because the conversion is cached on first read, a read model should be
+treated as immutable afterwards: assigning to ``content_html``, or
+``model_copy(update={"content_html": ...})``, leaves the cached Markdown
+in place. Rebuild through ``model_validate`` if you need to change it.
+
 Aggregated Models
 -----------------
 
diff --git a/docs/development.md b/docs/development.md
index c4346c6..c8e5cfe 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -82,7 +82,18 @@ python -m pytest
 - `glpi_python_client.models` contains typed request and response
   models.
 - `glpi_python_client.content` handles HTML/Markdown conversion for
-  ticket descriptions, followups, tasks, and solutions.
+  ticket descriptions, followups, tasks, solutions, knowledge-base
+  articles (`content` and `description`) and article revisions. It is
+  wired into the models by `models/api_schema/_content.py`, eagerly on
+  the write models and through a cached property on the read ones.
+  Inbound HTML too deep for `markdownify` to walk is tag-stripped
+  rather than parsed. The depth is not predicted: the conversion is
+  attempted and the `RecursionError` answered, because the budget is the
+  caller's remaining stack and no bound computed in advance can know it.
+  The module docstring carries the derivation and the rejected
+  alternatives (`sys.setrecursionlimit`, and a thread with a larger
+  stack, which needs the same global). The prohibition is enforced by
+  `testing/tests/test_raise_site_audit.py`, not just written down.
 - `glpi_python_client.testing` exposes `make_client` and
   `make_async_client` factories that produce in-memory clients with no
   real HTTP plumbing for downstream test suites, plus the shared
diff --git a/docs/user_guide.rst b/docs/user_guide.rst
index dd918b0..9fb1b13 100644
--- a/docs/user_guide.rst
+++ b/docs/user_guide.rst
@@ -586,7 +586,11 @@ Knowledge base
 The knowledge base mixins map to ``/Knowledgebase``. Articles and
 categories expose the ``search_ / get_ / create_ / update_ / delete_``
 shape; comments are nested under an article; revisions are read-only.
-Article ``content`` and ``description`` accept and return Markdown. An
+Article ``content`` and ``description`` accept and return Markdown; on
+:class:`~glpi_python_client.GetKBArticle` they are properties over
+``content_html`` and ``description_html``, converted on first read -- see
+:ref:`content-conversion`, which matters here because searching the
+knowledge base returns whole article bodies. An
 article's ``categories`` association is read-only in the v2 GLPI contract,
 so the client sets it through a legacy fallback — see
 `Assigning categories`_.
@@ -1429,9 +1433,9 @@ Example output::
 -----------------
 
 Exceptions the client raises for a bad argument, an unexpected HTTP
-status, or an unusable response body derive from
-:class:`~glpi_python_client.GlpiError`, so one handler covers that part
-of the library surface:
+status, an unusable response body, or content it cannot convert derive
+from :class:`~glpi_python_client.GlpiError`, so one handler covers that
+part of the library surface:
 
 .. code-block:: python
 
@@ -1474,15 +1478,17 @@ The hierarchy lets you narrow as far as you need:
 .. code-block:: text
 
    GlpiError
-   ├── GlpiTransportError      reserved for the httpx transport swap;
-   │   └── GlpiTimeoutError    not raised yet -- see the note above
+   ├── GlpiTransportError      the request never produced a response
+   │   └── GlpiTimeoutError    GLPI was too slow
    ├── GlpiStatusError         GLPI answered with an unexpected status
    │   ├── GlpiAuthError       401 / 403
    │   ├── GlpiNotFoundError   404
    │   └── GlpiServerError     5xx (retried up to 3 attempts before it
    │                           reaches you)
    ├── GlpiValidationError     the client rejected your argument
-   └── GlpiProtocolError       GLPI answered 2xx with an unusable body
+   ├── GlpiProtocolError       GLPI answered 2xx with an unusable body
+   └── GlpiContentError        a rich-text body could not be converted
+                               between HTML and Markdown
 
 :class:`~glpi_python_client.GlpiStatusError` carries the diagnostics you
 usually want:
@@ -1505,6 +1511,73 @@ usually want:
    :class:`~glpi_python_client.GlpiProtocolError` also inherit
    :class:`ValueError`. Code written against earlier releases, which
    raised bare ``ValueError``, keeps working unchanged.
+   :class:`~glpi_python_client.GlpiContentError` and
+   :class:`~glpi_python_client.GlpiTransportError` do not inherit it:
+   there was never a bare ``ValueError`` at either kind of site, and
+   neither is a value the caller got wrong.
+
+.. _content-conversion:
+
+Rich-text content: Markdown in, Markdown out
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Ticket, followup, task, solution and knowledge-base bodies travel to GLPI
+as HTML. You work in Markdown in both directions and the package handles
+the translation, but the two directions are not symmetric and the
+difference shows up in the field names.
+
+Writing is the simple half: give ``content`` Markdown and it is rendered
+to HTML when the request is built.
+
+Reading gives you two views of the same body:
+
+.. code-block:: python
+
+   ticket = client.get_ticket(42)
+
+   ticket.content_html  # '<p>The printer is <strong>offline</strong>.</p>'
+   ticket.content       # 'The printer is **offline**.'
+
+``.content`` is what you want and what earlier releases gave you, so
+read-side code needs no change. What changed is *when* the conversion
+runs: on the first read of ``.content``, cached afterwards, rather than
+while the model is being built. Two things follow.
+
+Listing records is cheap. ``client.search_tickets()`` used to convert
+every body on the page whether or not you looked at one; now a search
+that only reads ``id`` and ``date_mod`` converts nothing at all.
+
+A body that cannot be converted no longer takes its page down with it.
+The whole page is built in one pass, so a single unconvertible record used
+to make its page-mates unreadable too. The failure is now scoped to the
+record whose body you actually read.
+
+.. note::
+
+   Deeply nested HTML is the case worth knowing about. The HTML-to-Markdown
+   converter walks the document recursively and exhausts the interpreter's
+   stack at around 494 levels of nesting. ``.content`` does not try to
+   predict that -- it attempts the conversion and, when the walk does not
+   fit, strips the tags instead. **It degrades, it never truncates, and it
+   does not raise**: every character the normal rendering would have
+   produced still appears, so a body never says less because of how deeply
+   it happened to nest. What you lose is structure,
+   not words — link targets and image alt text, code-block fencing and
+   ``<pre>`` indentation, and ``&nbsp;``-padded alignment. Anything else
+   that goes wrong raises
+   :class:`~glpi_python_client.GlpiContentError`.
+
+   Because the result is cached on first read, treat a read model as
+   immutable afterwards. Assigning to ``content_html`` -- or
+   ``model_copy(update={"content_html": ...})`` -- leaves the cached
+   Markdown in place, and nothing in ``repr``, ``==`` or ``model_dump``
+   will tell you. Rebuild through ``model_validate`` instead.
+
+Two smaller consequences, if you are upgrading from 0.4.x: ``content`` is
+no longer in ``GetTicket.model_fields``, and ``GetTicket(...).model_dump()``
+emits ``content_html`` holding HTML where it used to emit ``content``
+holding Markdown. Pass ``by_alias=True`` for a dump keyed the way GLPI
+keys it.
 
 Retry behaviour
 ~~~~~~~~~~~~~~~
@@ -1533,4 +1606,4 @@ most 2 POST requests.
 
 Search methods are deliberately tolerant: ``search_tickets`` and its
 siblings return an empty list rather than raising when GLPI rejects the
-query. Methods that fetch or mutate one specific record always raise.
\ No newline at end of file
+query. Methods that fetch or mutate one specific record always raise.
diff --git a/glpi_python_client/__init__.py b/glpi_python_client/__init__.py
index 13e3eb8..508acad 100644
--- a/glpi_python_client/__init__.py
+++ b/glpi_python_client/__init__.py
@@ -20,6 +20,7 @@
 from glpi_python_client._async.clients import AsyncGlpiClient
 from glpi_python_client._errors import (
     GlpiAuthError,
+    GlpiContentError,
     GlpiError,
     GlpiNotFoundError,
     GlpiProtocolError,
@@ -109,7 +110,7 @@
     date_window,
 )
 
-__version__ = "0.4.3"
+__version__ = "0.5.0"
 
 __all__ = [
     "AsyncGlpiClient",
@@ -145,6 +146,7 @@
     "GetUser",
     "GlpiAuthError",
     "GlpiClient",
+    "GlpiContentError",
     "GlpiEnum",
     "GlpiError",
     "GlpiGlobalValidation",
diff --git a/glpi_python_client/_async/clients/commons/_payloads.py b/glpi_python_client/_async/clients/commons/_payloads.py
index 69e1232..f1792b4 100644
--- a/glpi_python_client/_async/clients/commons/_payloads.py
+++ b/glpi_python_client/_async/clients/commons/_payloads.py
@@ -14,6 +14,7 @@
     SERVER_TIMEZONE_CONTEXT_KEY,
     GlpiModel,
 )
+from glpi_python_client.models.api_schema._content import restoring_content_faults
 
 ModelT = TypeVar("ModelT", bound=GlpiModel)
 
@@ -54,12 +55,13 @@ def model_to_payload(
         if server_timezone is not None
         else None
     )
-    body = model.model_dump(
-        mode="json",
-        exclude_none=True,
-        exclude={"extra_payload"},
-        context=context,
-    )
+    with restoring_content_faults():
+        body = model.model_dump(
+            mode="json",
+            exclude_none=True,
+            exclude={"extra_payload"},
+            context=context,
+        )
     if model.extra_payload:
         body.update(model.extra_payload)
     return body
diff --git a/glpi_python_client/_errors.py b/glpi_python_client/_errors.py
index 20e41b6..b4ae3f4 100644
--- a/glpi_python_client/_errors.py
+++ b/glpi_python_client/_errors.py
@@ -1,10 +1,10 @@
 """Public exception hierarchy raised by :mod:`glpi_python_client`.
 
 Every exception the client raises for a bad argument, an unexpected HTTP
-status, an unusable response body, or a network-level fault deliberately
-derives from :class:`GlpiError`, so callers can catch the library's failure
-surface with a single ``except`` clause and never need to import the
-underlying HTTP library.
+status, an unusable response body, a network-level fault, or content it
+cannot convert deliberately derives from :class:`GlpiError`, so callers can
+catch the library's failure surface with a single ``except`` clause and
+never need to import the underlying HTTP library.
 
 Two deliberate exceptions to that rule remain:
 
@@ -17,6 +17,8 @@
 :class:`GlpiStatusError`, :class:`GlpiValidationError` and
 :class:`GlpiProtocolError` also inherit :class:`ValueError` so code written
 against earlier releases — which raised bare ``ValueError`` — keeps working.
+:class:`GlpiContentError` and :class:`GlpiTransportError` do not, for the
+reason given on each: nothing was passed in wrongly.
 """
 
 from __future__ import annotations
@@ -137,6 +139,35 @@ class GlpiProtocolError(GlpiError, ValueError):
     """
 
 
+class GlpiContentError(GlpiError):
+    """A rich-text content value could not be converted.
+
+    Raised when :class:`~glpi_python_client.content.GlpiContentConverter`
+    cannot translate a value between GLPI's HTML transport format and the
+    package's canonical Markdown — in either direction. The underlying
+    fault is always attached as ``__cause__``.
+
+    This exists so that no failure of the content layer escapes the
+    package's taxonomy. The conversion runs third-party parsers
+    (``markdownify`` inbound, ``markdown`` outbound), and a parser fault
+    used to reach the caller as a bare builtin — most visibly a
+    ``RecursionError``, which ``except GlpiError`` does not catch and which
+    a caller reading a ticket has no reason to expect from
+    ``get_ticket``. Deeply nested HTML is caught and answered with the
+    body's text instead of raising at all (see
+    :meth:`glpi_python_client.content.conversion.GlpiContentConverter.from_transport`);
+    this is the backstop for everything else.
+
+    Unlike :class:`GlpiStatusError`, :class:`GlpiValidationError` and
+    :class:`GlpiProtocolError` this does **not** inherit ``ValueError``.
+    Those three do so for back-compatibility with releases that raised
+    bare ``ValueError`` at the same sites; there was never a
+    ``ValueError`` here to be compatible with, and a parser exhausting the
+    interpreter's stack is not a value the caller got wrong. The reasoning
+    matches :class:`GlpiTransportError`.
+    """
+
+
 def status_error_class(status_code: int) -> type[GlpiStatusError]:
     """Return the most specific status-error class for one status code.
 
@@ -164,6 +195,7 @@ def status_error_class(status_code: int) -> type[GlpiStatusError]:
 
 __all__ = [
     "GlpiAuthError",
+    "GlpiContentError",
     "GlpiError",
     "GlpiNotFoundError",
     "GlpiProtocolError",
diff --git a/glpi_python_client/_sync/clients/commons/_payloads.py b/glpi_python_client/_sync/clients/commons/_payloads.py
index 69e1232..f1792b4 100644
--- a/glpi_python_client/_sync/clients/commons/_payloads.py
+++ b/glpi_python_client/_sync/clients/commons/_payloads.py
@@ -14,6 +14,7 @@
     SERVER_TIMEZONE_CONTEXT_KEY,
     GlpiModel,
 )
+from glpi_python_client.models.api_schema._content import restoring_content_faults
 
 ModelT = TypeVar("ModelT", bound=GlpiModel)
 
@@ -54,12 +55,13 @@ def model_to_payload(
         if server_timezone is not None
         else None
     )
-    body = model.model_dump(
-        mode="json",
-        exclude_none=True,
-        exclude={"extra_payload"},
-        context=context,
-    )
+    with restoring_content_faults():
+        body = model.model_dump(
+            mode="json",
+            exclude_none=True,
+            exclude={"extra_payload"},
+            context=context,
+        )
     if model.extra_payload:
         body.update(model.extra_payload)
     return body
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index bacfeb4..55a6a37 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -1,16 +1,60 @@
 """Content conversion helpers for GLPI payloads.
 
-This module translates between GLPI's HTML transport format and the package's
-canonical Markdown representation used by the rich content models.
+This module translates between GLPI's HTML transport format and the
+package's canonical Markdown representation used by the rich content
+models.
+
+Neither *parse* recurses -- ``html.parser`` is an iterative scanner --
+but ``markdownify`` walks the finished tree recursively, at about two
+CPython frames per nesting level, so inbound conversion has a nesting
+ceiling. Measured from a shallow stack against the default 1000-frame
+limit, the deepest document that converts is 494 levels: the same 494
+for ``<div>``, ``<p>``, ``<blockquote>`` and ``<table><tr><td>``, and
+495 for ``<ul><li>``, which is what identifies the cost as per-level.
+
+**The ceiling is discovered rather than predicted.** Inbound conversion
+is attempted, and a ``RecursionError`` is caught and answered by
+stripping the document to its text instead -- see
+:meth:`GlpiContentConverter.from_transport`. Estimating the depth up
+front and degrading past a fixed bound was the previous design, and it
+was wrong in both directions: it degraded bodies that would have
+converted, because the bound had to assume the worst about the caller's
+remaining stack, and three rounds of review found seven ways for the
+estimate to come in *under* the real tree, each of which put a document
+through ``markdownify`` and into the ``RecursionError`` the bound
+existed to prevent. Trying the conversion cannot be wrong about whether
+the conversion fits.
+
+Anything else that goes wrong in either direction surfaces as
+:class:`~glpi_python_client.GlpiContentError`, so no parser fault
+escapes the package's exception taxonomy.
+
+**``sys.setrecursionlimit`` is deliberately not called, here or anywhere
+in the package.** It is process-global state that belongs to the
+application, not to a library an application imported; and raising the
+limit past what the C stack can hold turns a catchable
+``RecursionError`` into a hard interpreter crash -- on Windows, an
+access violation with no traceback. It moves the cliff and makes falling
+off it worse. Degrading the one body that does not fit is the answer
+that does not. Running the walk in a thread with a larger stack was
+considered and rejected for the same reason: the recursion limit is a
+counter rather than a measurement of the stack, so a deeper thread still
+needs the global limit raised to use it.
 """
 
 from __future__ import annotations
 
 import re
+from html import unescape
+from html.entities import html5 as _HTML5_REFERENCES
+from html.parser import HTMLParser
 
+from bs4 import ParserRejectedMarkup
 from markdown import markdown as markdown_to_html
 from markdownify import markdownify as html_to_markdown
 
+from glpi_python_client._errors import GlpiContentError
+
 #: Element names that make a ``<...>`` sequence markup rather than text.
 #:
 #: The HTML5 element set, which is what the parser behind ``markdownify``
@@ -55,6 +99,93 @@
 #: place.
 _CANDIDATE_TAG = re.compile(r"</?([a-zA-Z][a-zA-Z0-9]*)\b[^<>]*>")
 
+#: Elements that cannot contain anything, so nothing nests below them.
+#:
+#: ``html.parser`` -- the parser ``markdownify`` builds its tree with --
+#: closes these itself, so ``<br>`` a thousand times over is a thousand
+#: siblings, not a thousand levels. Measured: ``"<br>" * 5000`` parses one
+#: level deep and converts fine, while ``"<div>" * 5000`` parses 5000 deep
+#: and raises.
+#:
+#: The HTML5 void set, plus the ten legacy names ``bs4``'s HTML-parser tree
+#: builder also treats as empty. **The invariant is that this stays a
+#: subset of what the parser treats as empty**, and the direction matters:
+#: a name missing from here is counted as nesting when it does not, which
+#: costs an unnecessary degradation, while a name wrongly *in* here hides
+#: real nesting, which is a ``RecursionError``. Listing the legacy names
+#: only makes the count exact on old markup. Copied rather than imported --
+#: it lives in ``bs4.builder`` as
+#: ``HTMLTreeBuilder.DEFAULT_EMPTY_ELEMENT_TAGS``, which ``bs4``'s own
+#: documentation marks ``:meta private:`` -- and the subset invariant is
+#: asserted against a real parse in the unit tests, so a future ``bs4``
+#: cannot quietly break it. The two sets currently hold the same 24 names.
+_VOID_ELEMENTS = frozenset(
+    """
+    area base basefont bgsound br col command embed frame hr image img
+    input isindex keygen link menuitem meta nextid param source spacer
+    track wbr
+    """.split()
+)
+
+#: Elements whose boundary becomes a line break when tags are stripped.
+#:
+#: Used only by :func:`_strip_tags`. Removing a block element outright runs
+#: its neighbours together -- ``<p>a</p><p>b</p>`` becomes ``ab`` -- while
+#: putting a separator at *every* tag breaks words apart, turning
+#: ``<b>off</b>line`` into ``off line``. Splitting on the block/inline line
+#: keeps both readable. An unrecognised name counts as inline, matching how
+#: the normal path treats it: markup dropped, body kept in place.
+_BLOCK_ELEMENTS = frozenset(
+    """
+    address article aside blockquote br col dd details dialog div dl dt
+    fieldset figcaption figure footer form h1 h2 h3 h4 h5 h6 header hgroup
+    hr li main menu nav ol p pre search section summary table tbody td
+    tfoot th thead tr ul
+    """.split()
+)
+
+
+#: One character reference, with or without its terminating semicolon.
+#:
+#: Resolved by :func:`_resolve_references` rather than by ``html.unescape``
+#: over the whole string. ``unescape`` implements the HTML5 rule of
+#: consuming the longest *known* name it can find, so a semicolon-less
+#: reference that is a prefix of a longer unknown word gets split --
+#: measured, ``http://x/?a=1&copyright=2`` becomes
+#: ``http://x/?a=1©right=2``, and a URL pasted into a ticket is exactly
+#: where ``&copyright=`` and ``&notanentity=`` occur. The parser behind the
+#: converting path leaves those whole, so this does too.
+_CHARACTER_REFERENCE = re.compile(
+    r"&(?:\#[0-9]+;?|\#[xX][0-9a-fA-F]+;?|[A-Za-z][A-Za-z0-9]*;?)"
+)
+
+
+#: The ``/`` of a self-closing tag, with any space around it.
+_VOID_SELF_CLOSE = re.compile(r"\s*/\s*>$")
+
+
+def _resolve_references(text: str) -> str:
+    """Resolve character references the way the real parser would.
+
+    A numeric reference always resolves. A named one resolves only when
+    the whole name is known, which is the difference from
+    ``html.unescape``: that consumes the longest known *prefix*, so
+    ``&copyright=2`` loses its ``&copy`` and leaves ``right=2`` behind.
+    See :data:`_CHARACTER_REFERENCE`.
+
+    Where the two rules differ this one keeps the reference literal, which
+    is the safe direction for :func:`_strip_tags`, whose promise is that no
+    text goes missing.
+    """
+
+    def resolve(match: re.Match[str]) -> str:
+        token = match.group(0)
+        if token[1] == "#":
+            return unescape(token)
+        return unescape(token) if token[1:] in _HTML5_REFERENCES else token
+
+    return _CHARACTER_REFERENCE.sub(resolve, text)
+
 
 def _looks_like_html(content: str) -> bool:
     """Return whether ``content`` carries at least one real HTML element.
@@ -74,6 +205,385 @@ def _looks_like_html(content: str) -> bool:
     )
 
 
+class _ParserScan(HTMLParser):
+    """Walk a document with the parser that will convert it, not one like it.
+
+    Both remaining questions this module asks about raw HTML -- which
+    self-closing void tags to rewrite, and what the text is when the tree
+    will not fit the stack -- are questions about ``html.parser``'s
+    dispatch. This subclass asks ``html.parser`` instead of describing
+    it.
+
+    It replaces a regular expression that reproduced that dispatch by
+    imitation, and the imitation kept being wrong in ways that showed up
+    only after they shipped. A comment closes on ``--\\s*>``
+    and not only on ``-->``, ``</ script>`` ends raw text, ``<![IGNORE[``
+    opens a marked section, ``</ div foo>`` is a bogus comment rather than
+    an end tag, and ``<a href=/>`` leaves an element *open* because the
+    unquoted value swallows the ``/``. Two more were cost rather than
+    correctness: a run of whitespace inside a failing tag made the
+    attribute pattern backtrack as ``(a+)*``, and a 39-byte body took
+    20.8 seconds.
+
+    Those seven were found as depth under-counts, back when this module
+    predicted the nesting depth instead of attempting the conversion.
+    Predicting it is gone, but the pattern's other two readers were wrong
+    the same way and are still here: a derailed scan meant
+    :func:`_canonicalise_void_elements` never saw the ``<br />`` it
+    exists to rewrite, so
+    ``"<p>one<br>two</p><script>x</ script><p>three<br />TAIL</p>"`` lost
+    ``TAIL`` outright, and :func:`_strip_tags` inherited both the
+    misreadings and the backtracking.
+
+    Reading the parser's own event stream cannot be wrong about the
+    parser, so none of those remain judgement calls. It is also not a new
+    dependency nor a new risk: ``markdownify`` builds its tree with
+    ``bs4``, and ``bs4`` builds it with this same ``html.parser``, so
+    every pathology the parser has was already in the pipeline. Measured
+    on the shapes that made the pattern backtrack, the ``markdownify``
+    call costs what this scan costs, to within a few per cent.
+
+    ``convert_charrefs`` is ``False`` because that is what ``bs4`` passes
+    (in ``bs4.builder._htmlparser``), and the difference shows: with it
+    on, ``html.unescape`` consumes the longest *known* name, so
+    ``&copyright=2`` in a pasted URL loses its ``&copy``. Off, each
+    reference arrives as its own event and :func:`_resolve_references`
+    applies the whole-name rule the converting path applies.
+
+    ``collect_text`` separates the two callers: the void rewrite needs
+    only the spans, and accumulating the pieces of a 150 KB body for it
+    would be waste.
+
+    Parameters
+    ----------
+    content : str
+        The document to walk. Kept so spans can be sliced back out of it:
+        the parser reports what it found and where, and the source is the
+        only place the exact original spelling still exists.
+    collect_text : bool, optional
+        Whether to accumulate :attr:`pieces` for :func:`_strip_tags`.
+    """
+
+    def __init__(self, content: str, *, collect_text: bool = False) -> None:
+        super().__init__(convert_charrefs=False)
+        self._content = content
+        self._collect_text = collect_text
+        offsets = [0]
+        for line in content.splitlines(keepends=True):
+            offsets.append(offsets[-1] + len(line))
+        self._line_offsets = offsets
+        #: Source spans of ``<void ... />`` tags, for
+        #: :func:`_canonicalise_void_elements`.
+        self.void_spans: list[tuple[int, int]] = []
+        #: The document's text, in order, when ``collect_text`` is set.
+        self.pieces: list[str] = []
+        #: Set when ``html.parser`` gave up on the document.
+        self.rejected = False
+
+    def _at(self) -> int:
+        """Return the absolute offset of the construct being handled.
+
+        ``goahead`` calls ``updatepos`` up to the start of each construct
+        before dispatching it, so ``getpos`` addresses the construct
+        itself. It reports a line and a column, and every span sliced
+        here needs an index, which is what the line table built in
+        ``__init__`` converts between.
+        """
+
+        lineno, offset = self.getpos()
+        return self._line_offsets[lineno - 1] + offset
+
+    def _text(self, piece: str) -> None:
+        if self._collect_text:
+            self.pieces.append(piece)
+
+    def _boundary(self, tag: str) -> None:
+        """Record a block element's edge as a line break.
+
+        See :data:`_BLOCK_ELEMENTS` for why the block/inline line is the
+        one that matters here.
+        """
+
+        if self._collect_text and tag in _BLOCK_ELEMENTS:
+            self.pieces.append("\n")
+
+    def handle_starttag(self, tag: str, attrs: object) -> None:
+        self._boundary(tag)
+
+    def handle_startendtag(self, tag: str, attrs: object) -> None:
+        """Count a ``<foo/>`` as a leaf, and note a void one to rewrite.
+
+        This is the event :func:`_canonicalise_void_elements` needs, and
+        the one a pattern cannot identify reliably. ``html.parser``
+        reaches it only when the stripped remainder of the tag is exactly
+        ``/>``, so ``<br />`` arrives here while ``<br  /  >`` is an
+        ordinary start tag. Deciding it on the event means the workaround
+        fires on exactly the tags that trigger the ``bs4`` defect, and on
+        no others.
+        """
+
+        if tag in _VOID_ELEMENTS:
+            token = self.get_starttag_text()
+            start = self._at()
+            if token is not None and self._content.startswith(token, start):
+                self.void_spans.append((start, start + len(token)))
+        self._boundary(tag)
+
+    def handle_endtag(self, tag: str) -> None:
+        self._boundary(tag)
+
+    def handle_data(self, data: str) -> None:
+        """Keep character data, a raw-text element's body included.
+
+        A ``<script>`` or ``<style>`` body arrives here because the parser
+        is in CDATA mode, and it is kept for the reason recorded in
+        :func:`_strip_tags`: ``markdownify``'s ``strip=`` removes an
+        element's markup and still walks its children, so the body
+        reaches the converted output as text.
+        """
+
+        self._text(data)
+
+    def handle_entityref(self, name: str) -> None:
+        self._text(self._reference_at())
+
+    def handle_charref(self, name: str) -> None:
+        self._text(self._reference_at())
+
+    def _reference_at(self) -> str:
+        """Return a character reference exactly as it was written.
+
+        The event carries the name but not whether a semicolon closed it,
+        and that is what decides whether the reference resolves -- so the
+        source is re-read rather than the token rebuilt from the name.
+        See :data:`_CHARACTER_REFERENCE`.
+        """
+
+        match = _CHARACTER_REFERENCE.match(self._content, self._at())
+        return match.group(0) if match is not None else ""
+
+    def handle_pi(self, data: str) -> None:
+        """Keep a processing instruction's body, which the converter prints.
+
+        Measured, not assumed, and the delimiters are the detail that
+        matters: ``bs4`` files the instruction as a string node, so
+        ``<p>a</p><?php SECRET ?><p>b</p>`` converts to
+        ``"a\\n\\nphp SECRET ?\\n\\nb"`` -- the body, without its ``<?``
+        and ``>``. Keeping the body alone therefore matches the
+        converting path exactly, where keeping the whole construct used
+        to leave punctuation in an output that promises none.
+        """
+
+        self._text(data)
+
+    def keep_remainder(self) -> None:
+        """Hand back the text of the region the parser stopped on.
+
+        Called only when it raised, so that the degraded path still
+        carries every word after the construct it could not read.
+        """
+
+        self._text(self._content[self._at() :])
+
+    def unknown_decl(self, data: str) -> None:
+        """Keep the body of a ``CDATA`` section or a marked section.
+
+        Counter-intuitive, and measured rather than assumed: ``bs4`` files
+        both as a string node, and ``markdownify`` prints a string node
+        that is neither a comment nor a doctype. So ``<![IGNORE[x]]>``
+        contributes ``IGNORE[x`` to the converted output, and dropping it
+        here would make the same document say less on the degraded path
+        than on the converting one.
+        """
+
+        self._text(data[6:] if data.startswith("CDATA[") else data)
+
+
+def _scan(content: str, *, collect_text: bool = False) -> _ParserScan:
+    """Run one :class:`_ParserScan` over ``content`` and hand it back.
+
+    The parser gives up on two constructs -- an unknown marked-section
+    keyword such as ``<![FOO[``, and a ``[`` where a declaration cannot
+    hold one -- by raising ``AssertionError`` from ``_markupbase``. That
+    is not a case to guess around, because ``bs4`` catches the same
+    ``AssertionError`` and re-raises it as ``ParserRejectedMarkup``: a
+    document that stops this scan is a document ``markdownify`` cannot
+    convert either. So the partial scan is kept and the remainder of the
+    source is handed to :attr:`_ParserScan.pieces` as text, which is what
+    lets :meth:`GlpiContentConverter.from_transport` answer that
+    rejection with the body's words instead of an exception.
+
+    Parameters
+    ----------
+    content : str
+        The document to walk.
+    collect_text : bool, optional
+        Whether the scan should accumulate the document's text.
+
+    Returns
+    -------
+    _ParserScan
+        The finished scan, whether or not the parser ran out of document.
+    """
+
+    scan = _ParserScan(content, collect_text=collect_text)
+    try:
+        scan.feed(content)
+        scan.close()
+    except AssertionError:
+        scan.rejected = True
+        scan.keep_remainder()
+    return scan
+
+
+def _strip_tags(content: str) -> str:
+    """Reduce HTML to its text without building a tree, keeping every word.
+
+    The fallback for a document ``markdownify`` could not walk -- deeper
+    than the caller's remaining stack, or refused by the parser outright.
+    One pass of :class:`_ParserScan`, then whitespace tidying. No tree,
+    no recursion and no ceiling of its own, which is what qualifies it as
+    the fallback: it answers for input of any shape and any depth, so
+    there is always something to give the caller.
+
+    It **degrades and never truncates.** The property, stated as
+    something checkable: after collapsing whitespace, every character the
+    converting path would have produced also appears here, in order. A
+    superset, not an equality -- so no body says less because of the path
+    it took, which is the only guarantee worth making about a fallback.
+
+    Establishing that meant measuring what the converting path really
+    keeps, construct by construct, rather than assuming. Three answers
+    were counter-intuitive and each was a silent deletion here before it
+    was checked: a ``<script>``/``<style>`` body is *kept*, because
+    ``markdownify``'s ``strip=`` removes an element's markup and still
+    walks its children; so is a ``CDATA`` body; and so is the inside of
+    any ``<!``/``<?`` construct the parser could not resolve, which it
+    hands back as character data.
+
+    What it does **not** reproduce, none of which loses a character of
+    prose:
+
+    * Markup that only the converter can express: a link becomes its text
+      without the target, an image contributes nothing, and a fenced
+      block loses its fence -- so ``<pre>`` indentation is normalised
+      away with the rest. A pasted log comes back as its own lines of
+      text, not as a code block.
+    * Whitespace is normalised harder. Runs of spaces collapse, and
+      ``&nbsp;`` counts as whitespace, so ``&nbsp;``-padded column
+      alignment does not survive.
+    * Character references are resolved even inside a region the parser
+      handed back as raw data, so a broken comment's ``&amp;`` comes back
+      as ``&``. In the other direction, a handful of semicolon-less
+      references stay literal here that the converter resolves -- see
+      :func:`_resolve_references`, which errs that way on purpose.
+    * Whitespace falls differently at a markup boundary, in both
+      directions: the converter joins ``a<b>c`` as ``a**c**`` where this
+      joins it as ``ac``, and this breaks a line at a block edge the
+      converter runs together. Which is why the property is about the
+      order of the characters of prose and not about where the spaces
+      land.
+
+    Parameters
+    ----------
+    content : str
+        Raw HTML.
+
+    Returns
+    -------
+    str
+        The document's text, block boundaries preserved as line breaks
+        and character references resolved.
+    """
+
+    if ">" not in content:
+        # No ``>`` means no markup to skip, so the whole document is the
+        # text the parser would flush on ``close()``. Answering it here
+        # also keeps the scan away from the one shape that costs
+        # ``html.parser`` more than linear time: with no ``>`` to finish a
+        # tag, ``close()`` advances one character at a time and rescans
+        # the tail, and 32 KB of an unfinished tag takes 13 seconds.
+        text = _resolve_references(content)
+    else:
+        text = _resolve_references("".join(_scan(content, collect_text=True).pieces))
+    text = re.sub(r"[^\S\n]*\n[^\S\n]*", "\n", text)
+    text = re.sub(r"[^\S\n]{2,}", " ", text)
+    text = re.sub(r"\n{3,}", "\n\n", text)
+    return text.strip()
+
+
+def _canonicalise_void_elements(content: str) -> str:
+    """Rewrite ``<br />`` as ``<br>``, so the text after it is not lost.
+
+    A workaround for a ``beautifulsoup4`` defect (measured on 4.14.3),
+    reachable from ordinary editor output and silent when it fires.
+
+    ``bs4``'s ``html.parser`` builder auto-closes a bare ``<br>`` and
+    records the name in ``already_closed_empty_element``, a list keyed by
+    name alone, so a later ``</br>`` can be ignored as redundant. If no
+    ``</br>`` ever arrives the entry simply stays there. The next
+    ``<br />`` -- which reaches the builder as ``handle_startendtag`` --
+    opens a real element and then closes it itself, and *that* close
+    finds the stale entry, treats the element as already closed, and
+    leaves it open. Every following sibling becomes a child of the
+    ``<br>``.
+
+    ``get_text`` still walks those children, which is why the tree looks
+    intact, but ``markdownify``'s ``convert_br`` ignores an element's
+    children and returns a line break. The text is gone:
+
+    ``"<p>line1<br>line2</p><p>para2<br />line4</p>"`` converted to
+    ``"line1  \\nline2\\n\\npara2"`` -- and note the two spellings are in
+    different paragraphs, because a name once recorded poisons the rest
+    of the document. ``<img>`` and ``<hr>`` lose text the same way; they
+    are the other two converters that discard children. One bare ``<br>``
+    anywhere before one ``<br />`` is the whole precondition, and GLPI
+    bodies are edited by more than one client.
+
+    Rewriting to the bare spelling removes the ``handle_startendtag``
+    path for void elements, which is where the asymmetry lives; both
+    spellings already build the same node, so nothing else about the
+    output moves. Only the names in :data:`_VOID_ELEMENTS` are touched,
+    and only where the parser really reports ``handle_startendtag``: a
+    self-closed ``<div/>`` is left alone, and cannot be affected anyway,
+    since only a void name is ever recorded.
+
+    Which tags those are is the parser's answer rather than this
+    module's, and that is not cosmetic. Deciding it by pattern meant
+    inheriting every way the pattern could be derailed, and a derailed
+    scan reinstates the very defect this works around: measured,
+    ``"<p>one<br>two</p><script>x</ script><p>three<br />TAIL</p>"``
+    lost ``TAIL`` outright, because ``</ script>`` ends raw text for the
+    parser but not for the pattern, so the ``<br />`` after it was never
+    seen and never rewritten. ``<img>`` and ``<hr>`` lost their tails the
+    same way.
+
+    Parameters
+    ----------
+    content : str
+        Raw HTML.
+
+    Returns
+    -------
+    str
+        The same HTML with self-closing void tags written bare.
+    """
+
+    if "/>" not in content:
+        return content
+    spans = _scan(content).void_spans
+    if not spans:
+        return content
+    pieces: list[str] = []
+    cursor = 0
+    for start, end in spans:
+        pieces.append(content[cursor:start])
+        pieces.append(_VOID_SELF_CLOSE.sub(">", content[start:end]))
+        cursor = end
+    pieces.append(content[cursor:])
+    return "".join(pieces)
+
+
 class GlpiContentConverter:
     """Convert content between GLPI HTML payloads and canonical Markdown.
 
@@ -93,6 +603,56 @@ def from_transport(value: object) -> str:
         is also wired as the inbound validator for caller-authored content:
         text sent down the HTML path loses whatever the parser does not
         recognise, and Markdown sent down it comes back escaped.
+
+        There are therefore three outcomes, not two. Real HTML that fits
+        the stack is converted. Real HTML that does not is stripped to its
+        text instead: ``markdownify`` recurses about two frames per
+        nesting level, so the conversion is *attempted* and its
+        ``RecursionError`` answered, rather than the depth predicted and a
+        bound applied. The caller gets a readable body either way;
+        **this method degrades, it does not truncate, and it does not
+        raise for depth.**
+
+        Attempting it is what makes the answer exact. The budget is not
+        1000 frames, it is whatever is left of the stack when the
+        conversion starts, and that belongs to the caller -- an
+        application reading ``.content`` from inside a request handler, a
+        template render or a recursive walk has less of it than a script
+        does. No bound computed in advance can know that number, so the
+        previous design guessed low, 200 against a measured cliff of 494,
+        and flattened bodies that would have converted. It also had to
+        estimate the depth of the tree, and three rounds of review found
+        seven ways for that estimate to come in *under* the real one --
+        each of which sent a document to ``markdownify`` and into the
+        ``RecursionError`` the bound existed to prevent.
+
+        One consequence is the price of that exactness and worth naming:
+        the outcome now depends on the caller's remaining stack, so the
+        same body can convert from one call site and degrade from a
+        deeper one. Nothing is lost either way -- the degraded rendering
+        keeps every character of prose -- but a caller comparing two
+        renderings of one body should know which knob moved it.
+
+        Self-closing void tags are written bare before conversion, which
+        works around a ``beautifulsoup4`` defect that silently dropped
+        everything after the second spelling of ``<br>`` in a body that
+        used both -- see :func:`_canonicalise_void_elements`.
+
+        A document ``html.parser`` refuses outright takes the degraded
+        path as well, rather than the exception it used to. ``<![FOO[``
+        is the reachable case: an unknown marked-section keyword, which
+        ``_markupbase`` raises ``AssertionError`` for and ``bs4``
+        re-raises as ``ParserRejectedMarkup``. A caller who can read
+        their text is better off than one holding an error, and there is
+        nothing else to be done with such a body, so it is stripped too.
+
+        Raises
+        ------
+        GlpiContentError
+            The parser failed for some reason other than depth. The original
+            exception is attached as ``__cause__``. Nothing is expected to
+            reach this -- it is here so a parser fault cannot escape
+            ``except GlpiError`` the way a bare ``RecursionError`` used to.
         """
 
         content = str(value or "")
@@ -100,15 +660,35 @@ def from_transport(value: object) -> str:
             return ""
         if not _looks_like_html(content):
             return content.strip()
-
-        markdown = html_to_markdown(
-            content,
-            heading_style="ATX",
-            bullets="-",
-            strip=["script", "style"],
-            escape_underscores=False,
-            escape_asterisks=False,
-        )
+        try:
+            markdown = html_to_markdown(
+                _canonicalise_void_elements(content),
+                heading_style="ATX",
+                bullets="-",
+                strip=["script", "style"],
+                escape_underscores=False,
+                escape_asterisks=False,
+            )
+        except (RecursionError, ParserRejectedMarkup):
+            # The tree is deeper than the stack left, or the parser will
+            # not build it at all. Both are answered with the text.
+            try:
+                return _strip_tags(content)
+            except RecursionError as exc:
+                # Reachable only from a caller already within a few frames
+                # of the limit, where stripping cannot run either. Named
+                # rather than allowed to escape as a bare builtin, which is
+                # what this taxonomy exists for.
+                raise GlpiContentError(
+                    "Could not convert GLPI HTML content to Markdown: the "
+                    "caller's stack left too little room even to strip its "
+                    "tags."
+                ) from exc
+        except Exception as exc:
+            raise GlpiContentError(
+                "Could not convert GLPI HTML content to Markdown "
+                f"({type(exc).__name__}: {exc})."
+            ) from exc
         return str(markdown).strip()
 
     @staticmethod
@@ -117,14 +697,33 @@ def to_transport(value: object) -> str:
 
         Empty Markdown stays empty, while non-empty content is rendered through
         the configured Markdown extensions used by the package.
+
+        There is no depth ceiling on this direction and no degraded path.
+        Inbound content is whatever GLPI happens to hold, so it has to be
+        survivable; outbound content is what the caller just wrote, so a
+        failure is worth reporting rather than papering over. ``markdown``
+        recurses on nested constructs too -- measured, a list indented 495
+        levels raises -- so the failure is caught and named.
+
+        Raises
+        ------
+        GlpiContentError
+            The Markdown could not be rendered. The original exception is
+            attached as ``__cause__``.
         """
 
         markdown = str(value or "")
         if not markdown.strip():
             return ""
-        html = markdown_to_html(
-            markdown,
-            extensions=_MARKDOWN_EXTENSIONS,
-            output_format="html5",
-        )
+        try:
+            html = markdown_to_html(
+                markdown,
+                extensions=_MARKDOWN_EXTENSIONS,
+                output_format="html5",
+            )
+        except Exception as exc:
+            raise GlpiContentError(
+                "Could not render Markdown content as GLPI HTML "
+                f"({type(exc).__name__}: {exc})."
+            ) from exc
         return str(html).strip()
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index e708c95..b061b33 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -1,8 +1,128 @@
 from __future__ import annotations
 
+import re
+from html.parser import HTMLParser
+
 import pytest
+from bs4 import BeautifulSoup
+
+from glpi_python_client import GlpiContentError, GlpiError
+from glpi_python_client.content import conversion
+from glpi_python_client.content.conversion import (
+    GlpiContentConverter,
+    _strip_tags,
+)
+
+#: Everything that is not a letter or a digit.
+_NOT_PROSE = re.compile(r"[^0-9A-Za-z]+")
+
+#: A Markdown link or image destination.
+#:
+#: The converting path renders a target that the fallback documents as
+#: dropped -- "a link becomes its text without the target, an image
+#: contributes nothing" -- so a URL inside ``]( )`` is not prose either,
+#: and comparing it would assert a difference the module declares.
+_DESTINATION = re.compile(r"\]\([^)]*\)")
+
+#: A link, and the target only the *converting* path renders.
+#:
+#: There is no depth number to ask any more -- the converter attempts the
+#: walk and answers the ``RecursionError`` -- so a test that needs to know
+#: which path ran has to read the output. A link is the cheapest tell:
+#: ``markdownify`` writes ``[probe](u)`` and :func:`_strip_tags` writes
+#: ``probe``.
+PROBE_LINK = '<a href="u">probe</a>'
+PROBE_TARGET = "](u)"
+
+
+def _prose(text: str) -> str:
+    """Reduce a rendering to its letters and digits, in order.
+
+    Whitespace falls differently at a markup boundary on the two paths --
+    the converter joins ``a<b>c`` as ``a**c**`` where the degraded path
+    joins it as ``ac``, and the degraded path breaks a line at a block
+    edge the converter runs together -- and the converter adds
+    punctuation of its own: table pipes, fence backticks, list bullets,
+    link and image brackets. None of that is prose, and none of it is
+    what the fallback promises to reproduce.
+    """
 
-from glpi_python_client.content.conversion import GlpiContentConverter
+    return _NOT_PROSE.sub("", _DESTINATION.sub("]", text))
+
+
+def _is_subsequence(needle: str, haystack: str) -> bool:
+    remaining = iter(haystack)
+    return all(character in remaining for character in needle)
+
+
+def _parser_rejects(html: str) -> bool:
+    """Return whether ``html.parser`` gives up on this document.
+
+    ``_markupbase`` raises ``AssertionError`` for an unknown
+    marked-section keyword, and which keywords count has changed across
+    CPython patch releases -- so whether a given document is rejected is
+    a question to ask the running interpreter rather than to assume.
+    """
+
+    parser = HTMLParser(convert_charrefs=False)
+    try:
+        parser.feed(html)
+        parser.close()
+    except AssertionError:
+        return True
+    return False
+
+
+def assert_the_degraded_path_says_no_less(shallow: str) -> None:
+    """Assert the module's one promise about the fallback, on this parser.
+
+    ``html.parser``'s reading of a *malformed* construct is not stable
+    across CPython patch releases. Measured on the same three documents,
+    3.12.3, 3.12.11 and 3.12.14 disagree about an unterminated
+    ``<script>``, about a comment with no ``-->``, and about an end tag
+    carrying a quoted ``>``: each build emits a different set of events.
+    Writing down the literal output of one of them made this suite assert
+    that interpreter's quirks rather than the module's contract, and it
+    duly went red on a patch bump while the module itself was fine.
+
+    So the expectation is computed from the converting path rather than
+    written down. Both paths read the same parser, so they move together,
+    and the promise was never equality anyway -- it is inclusion: **a
+    body must not say less because of the path it took.**
+    """
+
+    # The padding is closed *before* the construct rather than wrapped
+    # around it. Wrapping changes what the construct means: an
+    # unterminated ``<!weird`` runs to the next ``>``, which inside a
+    # wrapper is the ``>`` of a ``</div>``, so the same text is a bogus
+    # comment there and character data at end of input. The point of the
+    # padding is only to be deeper than the converter can walk.
+    #
+    # The probe link is how the test knows which path ran, now that there
+    # is no depth number to consult: only the converting path renders a
+    # target, so its absence is the degradation.
+    # Both renderings are taken from the *same* document, and the
+    # fallback is called directly rather than provoked with a body deep
+    # enough to exhaust the stack. Provoking it costs a 600-level tree
+    # and a walk that runs until it raises, which under coverage
+    # instrumentation took this suite from 69 seconds to 333; and it
+    # tests the routing, which one test can do once, rather than the
+    # property, which is what every shape here is for.
+    #
+    # The probe link carries the document onto the HTML path. Without it
+    # a fragment whose only tag name is not an element -- ``<scripty>`` --
+    # is plain text rather than markup, and the two sides would not be
+    # renderings of the same thing.
+    document = PROBE_LINK + shallow
+    converted = GlpiContentConverter.from_transport(document)
+    degraded = _strip_tags(document)
+
+    assert PROBE_TARGET in converted, "the body must reach the converting path"
+
+    assert _is_subsequence(_prose(converted), _prose(degraded)), (
+        f"the degraded path said less than the converting one\n"
+        f"  converted: {converted!r}\n  degraded:  {degraded!r}"
+    )
 
 
 def test_content_converter_uses_markdown_in_python_and_html_for_glpi() -> None:
@@ -108,3 +228,870 @@ def test_incoming_text_is_not_backslash_escaped(html: str, expected: str) -> Non
     """
 
     assert GlpiContentConverter.from_transport(html) == expected
+
+
+# ---------------------------------------------------------------------------
+# Nesting depth
+# ---------------------------------------------------------------------------
+#
+# ``markdownify`` walks the parsed tree recursively, so a deeply nested body
+# used to exhaust the interpreter's stack -- and because the converter was
+# wired as a Pydantic ``BeforeValidator``, the ``RecursionError`` surfaced
+# from inside ``model_validate``, i.e. from inside ``get_ticket``. These
+# tests pin the three things that fixed it: the depth is measured without
+# recursing, the ceiling is enforced, and past it the body degrades to text
+# rather than raising or being cut short.
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div>" * 500 + "text" + "</div>" * 500, id="balanced"),
+        pytest.param("<p>" * 5000 + "text", id="unclosed"),
+        pytest.param("<ul><li>" * 500 + "text" + "</li></ul>" * 500, id="lists"),
+        pytest.param("<foo>" * 5000 + "<p>text</p>", id="unknown-elements"),
+        pytest.param(
+            "<table><tr><td>" * 400 + "text" + "</td></tr></table>" * 400,
+            id="tables",
+        ),
+        pytest.param("<div>" * 100_000 + "text", id="absurd"),
+    ],
+)
+def test_deep_html_degrades_instead_of_raising(html: str) -> None:
+    """Past the ceiling the caller gets a usable body, not an exception.
+
+    494 levels was enough to exhaust the default 1000-frame limit from a
+    shallow stack. Every shape here is past it, including the unclosed and
+    unknown-element ones -- both of which the parser nests just as deeply
+    as the balanced case.
+    """
+
+    assert GlpiContentConverter.from_transport(html) == "text"
+
+
+def test_the_degraded_path_keeps_every_word() -> None:
+    """It degrades; it does not truncate.
+
+    A body too deep to convert is still the only copy of what someone
+    wrote, so the fallback's contract is that all of the text comes back.
+    """
+
+    lines = [f"line {index}" for index in range(400)]
+    html = "".join(f"<div><p>{line}</p>" for line in lines) + "</div>" * 400
+
+    stripped = GlpiContentConverter.from_transport(html)
+
+    assert all(line in stripped for line in lines)
+    assert "<" not in stripped
+
+
+def test_the_degraded_path_resolves_entities_and_block_boundaries() -> None:
+    """Blocks become line breaks, inline tags vanish, references resolve.
+
+    Dropping every tag outright would run ``<p>a</p><p>b</p>`` together as
+    ``ab``; separating at every tag would break ``<b>off</b>line`` into two
+    words. Only the block boundary gets a separator.
+    """
+
+    html = "<div>" * 600 + "<b>off</b>line &amp; <p>next</p>" + "</div>" * 600
+
+    assert GlpiContentConverter.from_transport(html) == "offline &\nnext"
+
+
+@pytest.mark.parametrize(
+    ("construct", "kept"),
+    [
+        pytest.param("<!-- SECRET -->", False, id="resolved-comment"),
+        pytest.param("<!DOCTYPE SECRET>", False, id="doctype"),
+        pytest.param("<!SECRET>", False, id="bogus-declaration"),
+        pytest.param("<script>SECRET</script>", True, id="script-body"),
+        pytest.param("<style>SECRET</style>", True, id="style-body"),
+        pytest.param("<![CDATA[SECRET]]>", True, id="marked-section"),
+        pytest.param("<![CDATA[SECRET>", True, id="unterminated-marked-section"),
+        pytest.param("<?php SECRET ?>", True, id="processing-instruction"),
+    ],
+)
+def test_the_degraded_path_keeps_exactly_what_the_converter_keeps(
+    construct: str, kept: bool
+) -> None:
+    """Parity, construct by construct, and not one of these was a guess.
+
+    Each expectation here was read off the converting path rather than
+    reasoned about, and three came back the opposite way round from the
+    obvious answer -- a ``<script>`` body is *kept*, because
+    ``markdownify``'s ``strip=`` removes an element's markup and still
+    walks its children; so is a ``CDATA`` body; and so is the inside of
+    any construct the parser could not resolve. Each of those was a silent
+    deletion in the degraded path until it was measured.
+
+    The bar is that a body must not say less because of the path it took,
+    so a divergence here is a bug even when the dropped text is
+    JavaScript.
+    """
+
+    shallow = f"<p>a</p>{construct}<p>b</p>"
+    deep = "<div>" * 600 + shallow + "</div>" * 600
+
+    converted = GlpiContentConverter.from_transport(shallow)
+    degraded = GlpiContentConverter.from_transport(deep)
+
+    # ``kept`` records what was measured, and is asserted only where the
+    # running parser still agrees with the measurement -- the reading of a
+    # malformed construct moves between CPython patch releases, and it is
+    # the parity below, not the snapshot, that this module promises.
+    if ("SECRET" in converted) is kept:
+        assert ("SECRET" in degraded) is kept
+    assert not ("SECRET" in converted and "SECRET" not in degraded)
+
+
+def test_an_unterminated_raw_text_element_reads_the_same_on_both_paths() -> None:
+    """Whether an unclosed ``<script>`` body survives is the parser's call.
+
+    It made this test its own snapshot: 3.12.3 discards the body on
+    ``close()`` and 3.12.14 flushes it as character data, so the literal
+    that was correct on one was wrong on the other. What has to hold on
+    either is that the two paths agree.
+    """
+
+    assert_the_degraded_path_says_no_less("<p>keep</p><script>SECRET")
+    assert "keep" in GlpiContentConverter.from_transport("<p>keep</p><script>SECRET")
+
+
+@pytest.mark.parametrize("depth", [1, 100, 200, 250, 300])
+def test_a_document_the_stack_can_hold_is_converted_in_full(depth: int) -> None:
+    """Everything that fits must convert, and structure has to survive.
+
+    This is what attempting the conversion bought. The previous design
+    predicted the depth and degraded past a fixed 200, which flattened
+    every body between 200 and the real cliff of about 494 -- ordinary
+    quoted mail threads among them -- to text, with no error to notice
+    and no way for a caller to ask for better. The 300 and 400 cases here
+    are the ones that used to come back as prose.
+    """
+
+    html = "<div>" * depth + "<strong>offline</strong>" + "</div>" * depth
+
+    assert GlpiContentConverter.from_transport(html) == "**offline**"
+
+
+def test_void_elements_do_not_spend_the_depth_budget() -> None:
+    """5000 ``<br>`` is one level, so this must take the converting path.
+
+    The surviving ``**`` proves it: the degraded path strips markup, so
+    emphasis would be gone if the void tags had been counted.
+    """
+
+    html = "<p>" + "<br>" * 5000 + "<strong>offline</strong></p>"
+
+    assert "**offline**" in GlpiContentConverter.from_transport(html)
+
+
+# ---------------------------------------------------------------------------
+# Failure taxonomy
+# ---------------------------------------------------------------------------
+
+
+def test_a_parser_fault_surfaces_as_a_glpi_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """No parser fault escapes ``except GlpiError``.
+
+    Nothing ordinary reaches this, so the fault is injected. It matters
+    anyway: a caller who wrote ``except GlpiError`` around ``get_ticket``
+    would otherwise watch a bare parser exception sail straight through
+    it.
+
+    A ``RecursionError`` is deliberately *not* the fault used here. It is
+    no longer a failure at all -- it is how the converter learns that the
+    document does not fit, and it is answered with the body's text; see
+    the test below.
+    """
+
+    def _boom(*args: object, **kwargs: object) -> str:
+        raise ValueError("the parser fell over")
+
+    monkeypatch.setattr(conversion, "html_to_markdown", _boom)
+
+    with pytest.raises(GlpiContentError) as caught:
+        GlpiContentConverter.from_transport("<p>offline</p>")
+
+    assert isinstance(caught.value, GlpiError)
+    assert isinstance(caught.value.__cause__, ValueError)
+
+
+def test_a_recursion_error_degrades_rather_than_raising(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Running out of stack is answered, not reported.
+
+    Injected rather than provoked, because the depth needed to provoke it
+    depends on the stack the test runner has already spent -- which is the
+    very reason the depth is no longer predicted. What is pinned is the
+    contract: the caller gets their words, not an exception.
+    """
+
+    def _boom(*args: object, **kwargs: object) -> str:
+        raise RecursionError("maximum recursion depth exceeded")
+
+    monkeypatch.setattr(conversion, "html_to_markdown", _boom)
+
+    assert (
+        GlpiContentConverter.from_transport("<p>Le serveur ne repond plus.</p>")
+        == "Le serveur ne repond plus."
+    )
+
+
+def test_an_outbound_render_fault_surfaces_as_a_glpi_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The outbound direction is wrapped too; ``markdown`` recurses as well."""
+
+    def _boom(*args: object, **kwargs: object) -> str:
+        raise RecursionError("maximum recursion depth exceeded")
+
+    monkeypatch.setattr(conversion, "markdown_to_html", _boom)
+
+    with pytest.raises(GlpiContentError) as caught:
+        GlpiContentConverter.to_transport("offline")
+
+    assert isinstance(caught.value, GlpiError)
+    assert isinstance(caught.value.__cause__, RecursionError)
+
+
+def test_deeply_nested_markdown_does_not_raise_a_bare_recursion_error() -> None:
+    """The real outbound cliff, unmocked.
+
+    ``markdown`` breaks between 495 and 500 levels of list indentation
+    (measured). Unlike the inbound direction this is not degraded --
+    outbound content is what the caller just wrote, so a failure is worth
+    reporting -- but it has to be reported as a library error.
+    """
+
+    markdown = "\n".join("  " * level + "- x" for level in range(500))
+
+    with pytest.raises(GlpiContentError):
+        GlpiContentConverter.to_transport(markdown)
+
+
+# ---------------------------------------------------------------------------
+# The scan against the tree the parser really builds
+# ---------------------------------------------------------------------------
+#
+# The three cases below are the ones a plain open/close counter gets wrong,
+# and the first is not a corner case: a stray ``</p>`` or ``</span>`` is
+# what a Word or Outlook paste leaves in a GLPI body. Each was measured
+# under-counting -- the one direction that turns into a crash -- before the
+# scan learned to pop by name.
+
+
+def _parser_depth(html: str) -> int:
+    """Return the deepest element ``html.parser`` actually builds.
+
+    The ground truth the scan is checked against, walked iteratively so
+    that measuring a pathological document does not hit the very limit
+    under test.
+    """
+
+    soup = BeautifulSoup(html, "html.parser")
+    deepest = 0
+    pending = [(child, 1) for child in soup.children if getattr(child, "name", None)]
+    while pending:
+        node, depth = pending.pop()
+        deepest = max(deepest, depth)
+        pending.extend(
+            (child, depth + 1)
+            for child in node.children
+            if getattr(child, "name", None)
+        )
+    return deepest
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div></p>" * 600 + "kept", id="stray-close-p"),
+        pytest.param("<div></span>" * 800 + "kept", id="stray-close-span"),
+        pytest.param("<li></tr>" * 700 + "kept", id="stray-close-tr"),
+    ],
+)
+def test_a_stray_closing_tag_does_not_hide_real_nesting(html: str) -> None:
+    """The regression test for the under-count that reached ``markdownify``.
+
+    A closing tag with no matching open element pops nothing in ``bs4``, so
+    these documents nest as deeply as their opening tags say. Counting the
+    close as a level down measured them at 1, they went to the recursive
+    converter, and it raised.
+    """
+
+    assert GlpiContentConverter.from_transport(html) == "kept"
+
+
+def test_the_degraded_path_keeps_a_cdata_body() -> None:
+    """A ``CDATA`` section's body is text, and text is what survives.
+
+    The declaration pattern that strips ``<!DOCTYPE ...>`` reaches the
+    first ``>``, and a ``CDATA`` section has none until its end, so it used
+    to take the body with it -- a silent deletion in the one path whose
+    whole promise is that nothing is deleted.
+    """
+
+    html = "<div>" * 600 + "<p>a<![CDATA[secret words]]>b</p>" + "</div>" * 600
+
+    assert GlpiContentConverter.from_transport(html) == "asecret wordsb"
+
+
+def test_the_degraded_path_keeps_the_text_of_a_broken_comment() -> None:
+    """Parity with the normal path, even where the parser gave up.
+
+    ``html.parser`` cannot resolve a comment with no ``-->``, so it hands
+    the region back as character data -- meaning ``markdownify`` would have
+    kept it. The degraded path is only trustworthy if which path a body
+    took never changes what it says, so it keeps it too.
+    """
+
+    assert_the_degraded_path_says_no_less("<p>keep</p><!--oops but keep this")
+
+
+def test_the_degraded_path_drops_a_comment_the_parser_understood() -> None:
+    """A resolved comment is text on neither path, so it goes.
+
+    The mirror of the test above, and the reason the two cannot share one
+    rule: telling them apart is the whole job of the ``-->``.
+    """
+
+    html = "<div>" * 600 + "<p>keep</p><!-- drop this -->" + "</div>" * 600
+
+    assert GlpiContentConverter.from_transport(html) == "keep"
+
+
+def test_no_name_in_the_void_set_actually_nests() -> None:
+    """The one direction of the void set that would be a crash.
+
+    A name listed as void that the parser really nests hides real depth,
+    and the document then reaches the recursive converter. The set is a
+    hand-copy of a private ``bs4`` table, so the invariant is asserted
+    against a real parse rather than against that table: for every name
+    claimed void, 300 of them must build one level, not 300.
+    """
+
+    understated = [
+        name
+        for name in sorted(conversion._VOID_ELEMENTS)
+        if _parser_depth(f"<{name}>" * 300 + "x") > 1
+    ]
+
+    assert understated == []
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param('<div title="</div>">x</div>', id="close-tag-in-attribute"),
+        pytest.param('<div title="<div>">x</div>', id="open-tag-in-attribute"),
+        pytest.param('<div title="a>b">x</div>', id="gt-in-attribute"),
+        pytest.param("<div data-x='a>b'><p>x</p></div>", id="single-quoted"),
+        pytest.param('<p title=">">one</p><p>two</p>', id="attribute-is-just-gt"),
+        pytest.param('<div title="</div>">' * 5 + "x", id="nested-and-quoted"),
+    ],
+)
+def test_a_tag_inside_a_quoted_attribute_is_not_read_as_markup(html: str) -> None:
+    """An attribute value may legally contain ``<`` and ``>``.
+
+    Reading a quoted ``</div>`` as a real close tag lost the text after
+    it, and used to under-count the nesting without bound as well, back
+    when the nesting was predicted. What has to hold either way is that
+    the shape costs the body nothing: it converts, and if it is too deep
+    to convert it still says the same thing.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+def test_a_quoted_close_tag_at_depth_still_degrades() -> None:
+    """The same shape scaled past the ceiling: degrades, does not raise."""
+
+    html = '<div title="</div>">' * 600 + "keep"
+
+    assert GlpiContentConverter.from_transport(html) == "keep"
+
+
+@pytest.mark.parametrize(
+    ("raw", "expected"),
+    [
+        # A URL in a ticket body is exactly where a semicolon-less
+        # reference that is a prefix of a longer word shows up.
+        ("http://x/?a=1&copyright=2", "http://x/?a=1&copyright=2"),
+        ("http://x/?a=1&notanentity=2", "http://x/?a=1&notanentity=2"),
+        # Terminated references still resolve, named and numeric.
+        ("a &amp; b &lt; c", "a & b < c"),
+        ("&#65;&#x42;", "AB"),
+        # ... and so does a semicolon-less reference whose whole name is
+        # known, because that is what the parser does.
+        ("&copy 2026", "\u00a9 2026"),
+        ("a&b", "a&b"),
+    ],
+)
+def test_the_degraded_path_resolves_references_like_the_parser(
+    raw: str, expected: str
+) -> None:
+    """``html.unescape`` alone corrupts URLs; the parser's rule does not.
+
+    ``unescape`` implements HTML5's longest-known-*prefix* rule, so
+    ``&copyright=2`` comes back as ``(c)right=2`` -- a query parameter
+    silently rewritten. The parser behind the converting path resolves a
+    semicolon-less reference only when the entire name is known, so it
+    leaves that URL alone, and the degraded path has to agree or a body
+    changes meaning according to how deeply it nests.
+    """
+
+    html = "<div>" * 600 + f"<p>{raw}</p>" + "</div>" * 600
+
+    assert GlpiContentConverter.from_transport(html) == expected
+
+
+@pytest.mark.parametrize(
+    "prefix",
+    [
+        pytest.param("<style=>", id="malformed-style-name"),
+        pytest.param("<script=>", id="malformed-script-name"),
+        pytest.param("<script/>", id="self-closed-script"),
+        pytest.param("<style />", id="self-closed-style"),
+        pytest.param("<p title=don't>", id="apostrophe-in-bare-value"),
+        pytest.param("<p alt=P<0.05>", id="lt-in-bare-value"),
+    ],
+)
+def test_a_malformed_tag_does_not_swallow_the_body_after_it(prefix: str) -> None:
+    """One malformed tag must not take the rest of the document with it.
+
+    Read as raw text, ``"<style=>"`` and ``"<script/>"`` swallowed
+    everything after them. That showed up first as an unbounded depth
+    under-count -- ``"<style=>" + "<div>" * 600`` measured **1** level
+    against a real 601 and reached ``markdownify`` -- but the deletion was
+    always the real damage, and it is what this pins now that the depth is
+    no longer predicted.
+    """
+
+    html = prefix + "<div>" * 600 + "the printer is offline"
+
+    assert GlpiContentConverter.from_transport(html) == "the printer is offline"
+
+
+def test_the_degraded_path_does_not_emit_a_tag_it_could_not_read() -> None:
+    """A tag the scan mis-read used to be printed at the reader.
+
+    Measured: the body below degraded to ``"<p title=don't>Le serveur ne
+    repond plus."`` -- the opening tag verbatim in text a person reads,
+    from a path whose whole promise is text. An apostrophe is ordinary in
+    French, so this needs no malice to reach a ticket.
+    """
+
+    html = "<div>" * 600 + "<p title=don't>Le serveur ne repond plus.</p>"
+
+    degraded = GlpiContentConverter.from_transport(html)
+
+    assert degraded == "Le serveur ne repond plus."
+    assert "<" not in degraded
+
+
+def test_an_unterminated_declaration_at_end_of_input_is_kept() -> None:
+    """``close()`` flushes an incomplete declaration as text, so this does.
+
+    A declaration is text on neither path only when it is *closed*: a
+    ``"<!weird"`` that never completes is flushed as character data when
+    the parser closes, and the converting path prints it. Dropping it lost
+    the tail of the body.
+    """
+
+    assert_the_degraded_path_says_no_less("<p>keep this</p><!weird")
+    assert "keep this" in GlpiContentConverter.from_transport("<p>keep this</p><!weird")
+
+
+@pytest.mark.parametrize(
+    ("html", "expected"),
+    [
+        pytest.param(
+            "<p>one<br>two<br />three</p>",
+            "one  \ntwo  \nthree",
+            id="br-both-spellings",
+        ),
+        pytest.param(
+            "<p>Bonjour,<br>Le serveur ne repond plus.<br />Merci de regarder.</p>",
+            "Bonjour,  \nLe serveur ne repond plus.  \nMerci de regarder.",
+            id="realistic-body",
+        ),
+        pytest.param(
+            "<p>line1<br>line2</p><p>para2<br />line4</p>",
+            "line1  \nline2\n\npara2  \nline4",
+            id="across-paragraphs",
+        ),
+        pytest.param(
+            "<p>a<br>b<br />c<br>d<br />e</p>",
+            "a  \nb  \nc  \nd  \ne",
+            id="alternating",
+        ),
+        pytest.param(
+            "<p>one<img>two<img />three</p>",
+            "one![]()two![]()three",
+            id="img",
+        ),
+        pytest.param(
+            "<p>one<hr>two<hr />three</p>",
+            "one\n\n---\n\ntwo\n\n---\n\nthree",
+            id="hr",
+        ),
+    ],
+)
+def test_a_body_using_both_spellings_of_a_void_tag_keeps_its_text(
+    html: str, expected: str
+) -> None:
+    """Text after the second spelling of ``<br>`` used to be dropped.
+
+    A ``beautifulsoup4`` defect, silent when it fires and reachable from
+    ordinary editor output: a bare ``<br>`` leaves its name in
+    ``already_closed_empty_element`` for a ``</br>`` that never comes, and
+    the next ``<br />`` closes itself against that stale entry and stays
+    open. Every later sibling becomes its child, and ``convert_br``
+    discards an element's children.
+
+    Note the paragraph case: the two spellings need not be near each
+    other, because a name once recorded poisons the rest of the document.
+    ``<img>`` and ``<hr>`` are the other two converters that drop
+    children, so they lose text the same way.
+    """
+
+    assert GlpiContentConverter.from_transport(html) == expected
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div/>x", id="self-closed-non-void"),
+        pytest.param("<custom />x", id="self-closed-unknown"),
+        pytest.param("<p>a<br>b</p>", id="already-bare"),
+        pytest.param("<p>2 /> 3</p>", id="slash-gt-in-text"),
+        pytest.param('<div title="<br />">x</div>', id="in-an-attribute"),
+        pytest.param("<script>var s = '<br />';</script>x", id="in-a-script-body"),
+        pytest.param("<!-- <br /> -->x", id="in-a-comment"),
+        pytest.param("<p>a<br  /  >b</p>", id="slash-not-abutting-gt"),
+    ],
+)
+def test_the_void_rewrite_leaves_everything_else_alone(html: str) -> None:
+    """The rewrite is confined to void tags in real tag position.
+
+    ``<div/>`` is left as it is -- rewriting it would change what the
+    document means, and it cannot be affected anyway, since only a void
+    name is ever recorded as already closed. The last case is the one
+    worth pinning: ``<br  /  >`` reaches the parser as an ordinary start
+    tag, because its ``/`` does not abut the ``>``, so it never takes the
+    path that loses text and needs no rewriting.
+    """
+
+    assert conversion._canonicalise_void_elements(html) == html
+
+
+def test_the_void_rewrite_changes_nothing_for_one_spelling_alone() -> None:
+    """A body that picks a spelling and keeps it converts exactly as before.
+
+    The rewrite exists to remove an asymmetry between two spellings of the
+    same node, so it must be invisible to every body that does not mix
+    them. Measured over 4000 fuzzed documents of each spelling: not one
+    output moved.
+    """
+
+    bare = "<p>a<br>b<img><hr>c</p>"
+    slashed = "<p>a<br />b<img /><hr />c</p>"
+
+    assert GlpiContentConverter.from_transport(bare) == "a  \nb![]()\n\n---\n\nc"
+    assert GlpiContentConverter.from_transport(slashed) == "a  \nb![]()\n\n---\n\nc"
+
+
+def test_both_paths_agree_on_a_body_using_both_spellings() -> None:
+    """The degraded path already kept this text; now the converting one does.
+
+    This body was the one place where the fallback said *more* than the
+    conversion it stands in for, which is the wrong way round for a
+    fallback and was how the defect was noticed at all.
+    """
+
+    shallow = "<p>one<br>two<br />three</p>"
+    deep = "<div>" * 600 + shallow + "</div>" * 600
+
+    converted = GlpiContentConverter.from_transport(shallow)
+    degraded = GlpiContentConverter.from_transport(deep)
+
+    for word in ("one", "two", "three"):
+        assert word in converted
+        assert word in degraded
+
+
+@pytest.mark.parametrize(
+    "fragment",
+    [
+        pytest.param('</x a="><div>">', id="end-tag-with-a-quoted-attribute"),
+        pytest.param('<div ="<p>', id="name-less-equals-quote"),
+        pytest.param('<p title="><span>">', id="quoted-gt-then-tag"),
+    ],
+)
+def test_a_misread_tag_end_does_not_swallow_the_body_after_it(fragment: str) -> None:
+    """Scaled past the cliff: degrades quietly, and keeps its words.
+
+    Reading an end tag with start-tag rules consumed everything up to the
+    next quote, which deleted prose at any depth and under-counted the
+    nesting 1:1 with the repetition back when the nesting was predicted.
+    """
+
+    html = fragment * 600 + "the printer is offline"
+
+    assert "the printer is offline" in GlpiContentConverter.from_transport(html)
+
+
+def test_a_misread_tag_end_does_not_delete_prose() -> None:
+    """The other half of the same defect, and it needs no depth at all.
+
+    Reading an end tag with attribute rules consumed everything between
+    the opening quote and its partner, so a degraded body said less than
+    the converting one -- the divergence the parity test forbids.
+    """
+
+    body = '<p>Bonjour</p title="> Le serveur ne repond plus. SECRET ">fin'
+
+    assert_the_degraded_path_says_no_less(body)
+    assert "Bonjour" in GlpiContentConverter.from_transport(body)
+
+
+def test_a_document_with_no_closing_bracket_is_answered_without_scanning() -> None:
+    """No ``>`` means no element, and saying so keeps a bad shape cheap.
+
+    ``html.parser`` cannot finish a tag that never closes, so ``close()``
+    flushes it one character at a time and rescans the tail at each step:
+    measured, 32 KB of ``'<div a="'`` costs it 13 seconds. Both readers
+    answer that shape directly instead. The text still survives, because
+    the parser flushes an unfinished tag as data when it closes.
+    """
+
+    html = '<div a="' * 4000
+
+    assert GlpiContentConverter.from_transport(html).startswith('<div a="')
+    assert "the printer" in GlpiContentConverter.from_transport(html + "the printer")
+    assert _strip_tags(html).startswith('<div a="')
+
+
+def test_a_document_the_parser_rejects_degrades_instead_of_raising() -> None:
+    """An unknown marked-section keyword stops the parser, not the body.
+
+    ``_markupbase.parse_marked_section`` raises ``AssertionError`` for a
+    keyword it does not know, and ``bs4`` catches that same
+    ``AssertionError`` and re-raises it as ``ParserRejectedMarkup``. So a
+    document carrying ``<![FOO[`` is one the converting path cannot
+    convert either, and the old behaviour was to let it try and fail:
+    the caller got a :class:`GlpiContentError` and none of their text.
+
+    Reporting a depth past the ceiling instead sends it down the degraded
+    path, where it yields its words. Degrading beats raising when the
+    alternative is a body nobody can read.
+    """
+
+    html = "<p>Le serveur ne repond plus. SECRET</p><![FOO[x]]>"
+
+    assert "SECRET" in GlpiContentConverter.from_transport(html)
+    if _parser_rejects(html):
+        # The converting path cannot run at all, so the answer is the text.
+        assert GlpiContentConverter.from_transport(html) == _strip_tags(html)
+
+
+def test_the_text_after_a_construct_the_parser_rejects_is_still_kept() -> None:
+    """The give-up point is not the end of the body.
+
+    The scan stops where the parser stopped, so everything past that
+    construct would go missing unless it is handed back explicitly --
+    and a body is far more likely to carry the marked section in the
+    middle than at the end.
+    """
+
+    html = "<p>avant</p><![FOO[x]]><p>apres SECRET</p>"
+
+    assert "avant" in _strip_tags(html)
+    assert "SECRET" in _strip_tags(html)
+    assert "SECRET" in GlpiContentConverter.from_transport(html)
+    assert "avant" in GlpiContentConverter.from_transport(html)
+
+
+def test_stripping_a_document_with_no_closing_bracket_keeps_all_of_it() -> None:
+    """The degraded path needs the same guard the depth scan needs.
+
+    ``html.parser`` cannot complete a tag that never closes, so
+    ``close()`` flushes it one character at a time and rescans the tail
+    at each step: measured, 32 KB of ``'<div a="'`` costs it 13 seconds.
+    The whole document is that unfinished tag's text, which is the answer
+    the guard returns directly.
+    """
+
+    html = '<div a="' * 4000 + "le serveur ne repond plus"
+
+    assert _strip_tags(html).endswith("le serveur ne repond plus")
+    assert _strip_tags(html).startswith('<div a="')
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        # The repetition counts here are deliberately modest. They were
+        # large when this corpus guarded a depth *prediction*, where the
+        # error grew with the repetition; the shapes are what matter now,
+        # and each document has to be one the converting path can still
+        # walk on every supported interpreter for the comparison to mean
+        # anything.
+        pytest.param("<div></p>" * 60 + "kept", id="stray-close-p"),
+        pytest.param("<div></span>" * 60 + "kept", id="stray-close-span"),
+        pytest.param("<p></b>" * 60 + "kept", id="stray-close-b"),
+        pytest.param("<b><i>x</b></i>", id="interleaved"),
+        pytest.param("<div>" * 100 + "<br>" + "</div>" * 100, id="void-leaf"),
+        pytest.param("<div>" * 100 + "<img/>" + "</div>" * 100, id="self-closed-leaf"),
+        pytest.param("<br>" * 5000, id="void-only"),
+        pytest.param("<div><b>x</b></br></div>", id="close-of-a-void"),
+        pytest.param("<p>The printer is <strong>offline</strong>.</p>", id="realistic"),
+        pytest.param("<div><!-- <div><div> --><p>x</p></div>", id="tags-in-a-comment"),
+        pytest.param(
+            "<div><script>var s='<div><div>'</script>x</div>", id="tags-in-js"
+        ),
+        pytest.param("<table><tr><td>" * 30 + "x", id="tables"),
+        pytest.param("<blockquote>" * 100 + "x", id="blockquotes"),
+        pytest.param("<p>a</p>" * 100, id="siblings"),
+    ],
+)
+def test_both_paths_agree_about_what_is_markup(html: str) -> None:
+    """The two renderings of one body must not disagree about its markup.
+
+    This corpus was built against a flat scan that predicted the nesting
+    depth, and it caught the scan reading markup differently from the
+    parser -- a stray close popping an element the parser keeps, a void
+    element counted as a parent, a tag inside a comment or a script body
+    counted at all. The prediction is gone; the corpus is not, because
+    the same disagreements would now show up as the fallback deleting or
+    inventing text relative to the converting path.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        # A comment with no ``-->`` is a *bogus comment*: the parser gives up
+        # at the first ``>``, so the ``</custom>`` inside it is text and the
+        # ``<br>`` lands inside ``<custom>``. Read that ``</custom>`` as a
+        # real close and the count comes back one level short -- which is
+        # how a document that needed degrading reached the converter.
+        pytest.param("<custom><!--oops</custom><br>", id="bogus-comment-eats-a-close"),
+        # ... and recovery ends at that ``>``. It does not swallow the rest
+        # of the document, so these really are two levels.
+        pytest.param("<!--oops><div><div>", id="bogus-comment-ends-at-its-close"),
+        # A processing instruction ends at the first ``>`` too, and here
+        # that lands inside what looks like a comment -- so the second
+        # ``<div>`` is a real element. Stripping comments globally before
+        # scanning gets this wrong in both directions at once.
+        pytest.param("<?php x<!-- <div><div> -->", id="pi-overlapping-a-comment"),
+        pytest.param("<div><!-- <div><div> --></div>", id="terminated-comment"),
+        pytest.param("<!DOCTYPE html><div><p>x</p></div>", id="doctype"),
+        pytest.param("<div><![CDATA[a<div>b]]><p>x</p></div>", id="marked-section"),
+        pytest.param("<div><script>a<div><div></script><p>x</p></div>", id="raw-text"),
+        pytest.param("<div><script>a<div>", id="unclosed-raw-text"),
+    ],
+)
+def test_every_markup_construct_is_read_the_way_the_parser_reads_it(html: str) -> None:
+    """Construct by construct, and the order they are tried in matters.
+
+    The parser reads left to right and these constructs overlap: in
+    ``<?php x<!-- <div><div> -->`` the processing instruction ends at the
+    first ``>``, which lands inside what looks like a comment, so the
+    ``<div>`` after it is a real element. Handling any of them out of
+    order gets that document wrong in both directions at once.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<p title=don't>x</p>", id="apostrophe-in-bare-value"),
+        pytest.param('<p title=say"hi>x</p>', id="quote-in-bare-value"),
+        pytest.param("<p alt=P<0.05>x</p>", id="lt-in-bare-value"),
+        pytest.param("<p title=Etape 1>x</p>", id="space-in-bare-value"),
+        pytest.param("<style=>x", id="malformed-style-name"),
+        pytest.param("<script=>x", id="malformed-script-name"),
+        pytest.param("<div=x>y", id="malformed-name"),
+        pytest.param('<div"a">y', id="quote-in-name"),
+        pytest.param("<scripty>x</scripty>", id="raw-name-is-a-prefix"),
+        pytest.param("<script/>x", id="self-closed-script"),
+        pytest.param("<style />x", id="self-closed-style"),
+        pytest.param('<li y=">mot<script data-x="</div>">tail', id="lt-after-value"),
+        pytest.param("<div a=1 <p>text", id="tag-inside-a-tag"),
+        pytest.param("<div class=a<b>text", id="lt-in-unquoted-value"),
+    ],
+)
+def test_a_malformed_tag_is_read_the_way_the_parser_reads_it(html: str) -> None:
+    """Malformed markup is where every rule taken from the spec was wrong.
+
+    Each shape here was read one way by the HTML5 grammar and another by
+    ``tagfind_tolerant`` and ``locatestarttagend_tolerant``, which are
+    what ``markdownify`` actually builds its tree with. The module reads
+    the parser's events now, so the corpus is a guard against a future
+    change reintroducing a rule from the wrong place.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+@pytest.mark.parametrize(
+    ("html", "reason"),
+    [
+        pytest.param(
+            '</x a="><div>">',
+            "an end tag skips nothing, so the <div> after it is real",
+            id="end-tag-with-a-quoted-attribute",
+        ),
+        pytest.param(
+            '<div ="<p><p>">',
+            "a name-less = starts an attribute NAME, not a quoted value",
+            id="name-less-equals-quote",
+        ),
+        pytest.param(
+            '<div a ="x>y">',
+            "whitespace before = still leaves a quoted value",
+            id="space-before-equals",
+        ),
+        pytest.param(
+            "</ p>x",
+            "the strict end-tag pattern allows space after </",
+            id="space-in-end-tag",
+        ),
+        pytest.param("</p/>x", "a trailing slash on an end tag", id="slash-in-end-tag"),
+        pytest.param(
+            '<li y=">mot<script data-x="</div>">tail',
+            "< inside a tag",
+            id="lt-after-a-value",
+        ),
+    ],
+)
+def test_a_tag_end_is_read_the_way_the_parser_reads_it(html: str, reason: str) -> None:
+    """``parse_endtag`` falls back to ``rawdata.find(">")`` and skips nothing.
+
+    CPython's own comment concedes the consequence -- "this is not 100%
+    correct, since we might have things like ``</tag attr=">">``" -- so
+    an end tag read with attribute rules consumes prose the parser keeps.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+def test_the_fallback_does_not_itself_recurse() -> None:
+    """Stripping 100k levels must not need 100k frames.
+
+    The fallback exists because the converting path ran out of stack, so
+    it cannot want a stack of its own. ``html.parser`` is an iterative
+    scanner and this walks its events into a list, which is what makes it
+    an answer for input of any depth rather than a second thing to guard.
+    """
+
+    assert _strip_tags("<div>" * 100_000 + "le serveur") == "le serveur"
diff --git a/glpi_python_client/models/__init__.py b/glpi_python_client/models/__init__.py
index b0af301..afd90d8 100644
--- a/glpi_python_client/models/__init__.py
+++ b/glpi_python_client/models/__init__.py
@@ -3,9 +3,10 @@
 The models are organised in two layers:
 
 * :mod:`glpi_python_client.models.api_schema` -- raw Pydantic shapes that
-  mirror ``docs/glpi_api_contract.json`` one for one. One model per HTTP
-  verb is exposed under the ``Get<Name>``, ``Post<Name>``, ``Patch<Name>``
-  and ``Delete<Name>`` naming convention. Use these models from new client
+  mirror ``docs/glpi_api_contract.json`` one for one, apart from the
+  rich-text slots documented there. One model per HTTP verb is exposed
+  under the ``Get<Name>``, ``Post<Name>``, ``Patch<Name>`` and
+  ``Delete<Name>`` naming convention. Use these models from new client
   mixins.
 * :mod:`glpi_python_client.models.custom_schema` -- aggregated views, such
   as :class:`GlpiTicketContext`, that group several API objects into one
diff --git a/glpi_python_client/models/_base.py b/glpi_python_client/models/_base.py
index d534a1f..8980cc6 100644
--- a/glpi_python_client/models/_base.py
+++ b/glpi_python_client/models/_base.py
@@ -20,6 +20,8 @@
 from typing import Any
 
 from pydantic import (
+    AliasChoices,
+    AliasPath,
     BaseModel,
     ConfigDict,
     Field,
@@ -38,6 +40,115 @@
 #: :meth:`GlpiModel._localise_naive_datetimes`.
 SERVER_TIMEZONE_CONTEXT_KEY = "server_timezone"
 
+#: Per-class cache of the payload keys that map onto a declared field.
+#:
+#: One entry per :class:`GlpiModel` subclass ever validated, computed once.
+#: Worth caching rather than recomputing: it is read once per record, so on
+#: a page of search results it is read once per row per model.
+_PAYLOAD_KEYS: dict[type[BaseModel], frozenset[str]] = {}
+
+
+def _payload_keys(model_class: type[BaseModel]) -> frozenset[str]:
+    """Return every payload key that maps onto a declared field.
+
+    Field *names* are not the whole answer, because a field may be fed by a
+    validation alias instead -- the read models take the wire's ``content``
+    into a field called ``content_html``. Comparing incoming keys against
+    names alone put that ``content`` in ``extra_payload`` before Pydantic
+    could resolve the alias, so the body silently arrived as ``None``.
+
+    All three alias shapes are covered. ``alias=`` and ``validation_alias=``
+    are both valid spellings of the same thing, an
+    :class:`~pydantic.AliasChoices` holds a list of either strings or
+    :class:`~pydantic.AliasPath` objects, and only the *first* segment of an
+    ``AliasPath`` is a key of the incoming mapping -- the rest index into
+    the value.
+
+    Parameters
+    ----------
+    model_class : type of pydantic.BaseModel
+        The concrete model class whose payload keys are wanted.
+
+    Returns
+    -------
+    frozenset of str
+        Field names plus every key any of their aliases can consume.
+    """
+
+    cached = _PAYLOAD_KEYS.get(model_class)
+    if cached is not None:
+        return cached
+
+    keys = set(model_class.model_fields)
+    pending: list[str | AliasPath | AliasChoices] = []
+    for field in model_class.model_fields.values():
+        if field.validation_alias is not None:
+            pending.append(field.validation_alias)
+        if field.alias is not None:
+            pending.append(field.alias)
+    while pending:
+        candidate = pending.pop()
+        if isinstance(candidate, str):
+            keys.add(candidate)
+        elif isinstance(candidate, AliasChoices):
+            pending.extend(candidate.choices)
+        else:
+            head = candidate.path[0]
+            if isinstance(head, str):
+                keys.add(head)
+
+    resolved = frozenset(keys)
+    _PAYLOAD_KEYS[model_class] = resolved
+    return resolved
+
+
+#: Cache for :func:`_alias_groups`, keyed the same way as
+#: :data:`_PAYLOAD_KEYS`.
+_ALIAS_GROUPS: dict[type[BaseModel], tuple[tuple[str, ...], ...]] = {}
+
+
+def _alias_groups(model_class: type[BaseModel]) -> tuple[tuple[str, ...], ...]:
+    """Return the payload keys of every field that accepts more than one.
+
+    Each group is one field's accepted spellings **in the order Pydantic
+    tries them**, which for ``AliasChoices`` is the order they were
+    declared. Fields accepting a single key are left out, since there is
+    nothing to choose between.
+
+    Only plain string choices are listed. An ``AliasPath`` addresses a
+    position inside a nested structure rather than a key that could
+    duplicate another, so it is not a member of any group.
+
+    Parameters
+    ----------
+    model_class : type[BaseModel]
+        The concrete model being validated.
+
+    Returns
+    -------
+    tuple of tuple of str
+        One tuple per multi-spelling field, most-preferred spelling first.
+    """
+
+    cached = _ALIAS_GROUPS.get(model_class)
+    if cached is not None:
+        return cached
+    groups: list[tuple[str, ...]] = []
+    for field in model_class.model_fields.values():
+        keys: list[str] = []
+        alias = field.validation_alias
+        if isinstance(alias, AliasChoices):
+            keys.extend(choice for choice in alias.choices if isinstance(choice, str))
+        elif isinstance(alias, str):
+            keys.append(alias)
+        if field.alias is not None and field.alias not in keys:
+            keys.append(field.alias)
+        if len(keys) > 1:
+            groups.append(tuple(keys))
+    resolved = tuple(groups)
+    _ALIAS_GROUPS[model_class] = resolved
+    return resolved
+
 
 class GlpiModel(BaseModel):
     """Base class for field-validated GLPI data models.
@@ -55,16 +166,34 @@ class GlpiModel(BaseModel):
     def _capture_unknown_fields(cls, data: Any) -> Any:
         """Funnel unknown payload keys into ``extra_payload``.
 
-        The validator only runs when ``data`` is a mapping. Keys that are
-        not declared as fields on the concrete subclass (and are not the
-        ``extra_payload`` meta field itself) are removed from the incoming
-        mapping and merged into the ``extra_payload`` mapping. Any keys the
-        caller already placed in ``extra_payload`` win on conflicts.
+        The validator only runs when ``data`` is a mapping. Keys that no
+        declared field on the concrete subclass can consume (and that are
+        not the ``extra_payload`` meta field itself) are removed from the
+        incoming mapping and merged into the ``extra_payload`` mapping. Any
+        keys the caller already placed in ``extra_payload`` win on
+        conflicts.
+
+        "Can consume" means field names *and* validation aliases -- see
+        :func:`_payload_keys`. This validator runs before Pydantic resolves
+        aliases, so a key it removes is a key the alias never gets to see.
+
+        A payload that spells one field two ways keeps only the spelling
+        Pydantic would have used, per :func:`_alias_groups`. The redundant
+        one is dropped rather than kept, because keeping it was worse than
+        it sounds: Pydantic consumes the winning alias, and ``extra="allow"``
+        then files the loser as a model extra, which ``model_dump`` emits
+        *over* the field it duplicates. Measured on ``GetTicket`` given both
+        ``content`` and ``content_html``, the attribute reported one body
+        and the object's own dump reported the other.
         """
 
         if not isinstance(data, dict):
             return data
-        known = set(cls.model_fields.keys())
+        known = _payload_keys(cls)
+        for group in _alias_groups(cls):
+            present = [key for key in group if key in data]
+            for redundant in present[1:]:
+                del data[redundant]
         existing_extras = data.get("extra_payload")
         captured: dict[str, Any] = {}
         for key in list(data.keys()):
diff --git a/glpi_python_client/models/api_schema/__init__.py b/glpi_python_client/models/api_schema/__init__.py
index 4d7a04b..e9a4116 100644
--- a/glpi_python_client/models/api_schema/__init__.py
+++ b/glpi_python_client/models/api_schema/__init__.py
@@ -13,4 +13,11 @@
 ``docs/glpi_api_contract.json`` are honoured. Mandatory and optional behaviour
 is left to GLPI: every field is declared optional in Python because the
 contract does not advertise ``required`` arrays.
+
+One deliberate departure from the contract's field names: a rich-text slot
+on a ``Get`` model is stored under ``<name>_html`` -- ``content_html``,
+``description_html`` -- because the model holds the wire value and exposes
+the converted Markdown under the contract's own name as a property. The
+contract spelling is still accepted on the way in, as a validation alias.
+See :mod:`glpi_python_client.models.api_schema._content`.
 """
diff --git a/glpi_python_client/models/api_schema/_content.py b/glpi_python_client/models/api_schema/_content.py
index 61ea729..13fd521 100644
--- a/glpi_python_client/models/api_schema/_content.py
+++ b/glpi_python_client/models/api_schema/_content.py
@@ -2,20 +2,48 @@
 
 GLPI exchanges rich-text fields (ticket ``content``, followup ``content``,
 task ``content``, solution ``content``, ...) over the wire as HTML
-(``format: html`` in the OpenAPI contract), but the public package surface
-is intentionally Markdown-only: callers should never need to author or read
-HTML. The annotated type defined here wires
-:class:`glpi_python_client.content.conversion.GlpiContentConverter` into
-Pydantic so the conversion happens transparently on every model boundary:
-
-* On validation (incoming HTML payloads from GLPI) the value is normalised
-  to canonical Markdown before being assigned to the field, so attribute
-  access always returns Markdown.
+(``format: html`` in the OpenAPI contract), while the public package
+surface is Markdown: a caller never has to author HTML, and reading
+``.content`` on any model gives Markdown back. The annotated types here
+wire :class:`glpi_python_client.content.conversion.GlpiContentConverter`
+into Pydantic to make that so, and they are deliberately not symmetric.
+
+**Write models** (``Post*``, ``Patch*``) use :data:`GlpiMarkdownContent`,
+which converts eagerly:
+
+* On validation the caller's Markdown is normalised, so it is checked at
+  the point the caller supplied it rather than somewhere later.
 * On serialisation (outgoing request bodies built via
   :func:`glpi_python_client._sync.clients.commons._payloads.model_to_payload`)
   the Markdown value is rendered back to HTML so GLPI receives the format
   it expects.
 
+**Read models** (``Get*``) use :data:`GlpiRawContent` or
+:data:`GlpiRawDescription` on a field named ``content_html`` /
+``description_html``, which holds exactly what GLPI sent and converts
+nothing. Each read model pairs that field with a ``cached_property`` --
+``content``, ``description`` -- that converts on first access and caches
+the result, over :func:`markdown_view`.
+
+The asymmetry is the point. Conversion used to run inside the Pydantic
+validator, which cost two things a caller could not opt out of:
+
+* **A list read converted every body.** Someone who wanted only ``id``
+  and ``date_mod`` still paid HTML-to-Markdown on every record of every
+  page.
+* **A failure took its page-mates with it.**
+  ``TransportMixin._resource_list`` builds every item of a page in one
+  comprehension, so one unconvertible body made the whole page
+  unreadable. Conversion now happens at the attribute, so whatever can go
+  wrong is scoped to the attribute.
+
+The field keeps ``content`` as a validation alias, so a GLPI payload and a
+hand-written ``GetTicket(content=...)`` both still populate it -- which is
+why :class:`glpi_python_client.models._base.GlpiModel` has to know about
+aliases when it captures unknown keys: that validator runs *before*
+Pydantic resolves them, and would otherwise divert the wire's ``content``
+into ``extra_payload``.
+
 Plain-text content is preserved verbatim on the inbound path and rendered
 as HTML paragraphs on the outbound path, matching the converter's default
 behaviour. "Plain text" means text carrying no recognised HTML element:
@@ -29,23 +57,55 @@
 so caller-authored Markdown passes through it before the serializer renders
 it. That is why the plain-text path has to stay verbatim -- routing Markdown
 through the HTML normaliser escapes it, and GLPI receives literal asterisks.
+
+One sharp edge comes with the read side, from ``functools.cached_property``:
+assigning to ``content_html`` after ``content`` has been read leaves the
+cached Markdown in place, and so does
+``model_copy(update={"content_html": ...})``. Neither equality, ``repr``
+nor any ``model_dump`` shows it. Treat a read model as immutable once
+validated; if something really must rewrite the raw value, drop the cache
+with ``obj.__dict__.pop("content", None)`` or rebuild the model through
+``model_validate``.
+
+``model_copy(update={"content": ...})`` -- the 0.4.x spelling, when
+``content`` was still a field -- is worse and worth naming outright: it
+updates **nothing**. ``content`` resolves to the class-level
+``cached_property``, so the attribute keeps the body it already had, while
+``extra="allow"`` files the value as a model extra that ``model_dump``
+then emits beside the real one. A caller redacting a body that way gets an
+object whose ``.content`` still holds the original text. Nothing warns,
+because from Pydantic's side nothing is wrong. Re-validating such a dump
+does at least keep the real body, since ``content_html`` is the first
+choice in the alias list and
+:func:`glpi_python_client.models._base._alias_groups` drops the loser
+before it can shadow the field -- but the copy itself is not a redaction.
+Rewrite the raw field, or rebuild through ``model_validate``.
 """
 
 from __future__ import annotations
 
+from collections.abc import Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
 from typing import Annotated
 
-from pydantic import BeforeValidator, PlainSerializer
+from pydantic import AliasChoices, BeforeValidator, Field, PlainSerializer
+from pydantic_core import PydanticSerializationError
 
+from glpi_python_client._errors import GlpiContentError, GlpiValidationError
 from glpi_python_client.content.conversion import GlpiContentConverter
 
 
 def _from_transport(value: object) -> str | None:
-    """Normalise an inbound GLPI content value into canonical Markdown.
+    """Normalise a content value supplied to a write model into Markdown.
 
     Pydantic invokes this before validation, so the field type stays ``str``
     while the caller-visible value is always Markdown. ``None`` is preserved
     unchanged so optional content fields keep their tri-state semantics.
+
+    Only write models still normalise on validation; a read model stores
+    what GLPI sent and converts at the attribute instead, through
+    :func:`markdown_view`.
     """
 
     if value is None:
@@ -53,17 +113,120 @@ def _from_transport(value: object) -> str | None:
     return GlpiContentConverter.from_transport(value)
 
 
+def markdown_view(raw: str | None) -> str | None:
+    """Convert one stored raw transport value into Markdown.
+
+    The body of every ``content`` / ``description`` ``cached_property`` on
+    the read models. It is a plain function rather than a method so the
+    seven properties share one implementation while each keeps its own
+    docstring and its own cache slot.
+
+    ``None`` passes through, so a field GLPI never sent reads back as
+    ``None`` rather than as an empty string.
+
+    Parameters
+    ----------
+    raw : str or None
+        The raw transport value as stored, normally HTML.
+
+    Returns
+    -------
+    str or None
+        Canonical Markdown, or ``None``.
+
+    Raises
+    ------
+    GlpiContentError
+        The value could not be converted. Content too deeply nested
+        for the converter to walk is degraded to text instead of
+        raising, so this is a backstop rather than an expected outcome
+        -- but note that it surfaces from the attribute read, not from
+        ``model_validate``, which is the deliberate difference from the
+        write-model path.
+    """
+
+    if raw is None:
+        return None
+    return GlpiContentConverter.from_transport(raw)
+
+
+#: The last content fault raised inside a serializer, for
+#: :func:`restoring_content_faults` to hand back.
+#:
+#: A ``ContextVar`` rather than a module global so two concurrent writes
+#: cannot read each other's fault; it is set immediately before the raise
+#: and cleared on the way into every dump.
+_LAST_CONTENT_FAULT: ContextVar[GlpiContentError | None] = ContextVar(
+    "glpi_last_content_fault", default=None
+)
+
+
 def _to_transport(value: str | None) -> str | None:
     """Render an outbound Markdown content value as the HTML GLPI expects.
 
     ``None`` is preserved so ``model_dump(exclude_none=True)`` continues to
     drop unset fields from request bodies. Empty Markdown is rendered as an
     empty string to stay consistent with the inbound converter behaviour.
+
+    A failure is recorded in :data:`_LAST_CONTENT_FAULT` before it is
+    raised, because raising it is not enough on its own: see
+    :func:`restoring_content_faults`.
     """
 
     if value is None:
         return None
-    return GlpiContentConverter.to_transport(value)
+    try:
+        return GlpiContentConverter.to_transport(value)
+    except GlpiContentError as exc:
+        _LAST_CONTENT_FAULT.set(exc)
+        raise
+
+
+@contextmanager
+def restoring_content_faults() -> Iterator[None]:
+    """Put a content fault raised inside ``model_dump`` back in the taxonomy.
+
+    Outbound conversion runs in a ``PlainSerializer``, and pydantic-core
+    catches everything a serializer function raises and re-raises its own
+    ``PydanticSerializationError``. The type is lost -- that class derives
+    from ``ValueError``, not from :class:`GlpiError`, so ``except
+    GlpiError`` does not fire -- and so is the chain: ``__cause__`` and
+    ``__context__`` both arrive as ``None``, leaving only the message text
+    embedded in a foreign exception.
+
+    Both halves of the package's error contract break there, on every write
+    that carries a body, which is every ``create_*`` and ``update_*`` with
+    ``content``. So the fault is stashed on the way out and re-raised here,
+    with its own traceback and its own ``__cause__`` -- the
+    ``RecursionError``, or whatever else the renderer hit -- intact. The
+    pydantic exception becomes its ``__context__``, which is where a
+    reader would look for the serializer detail anyway.
+
+    A ``PydanticSerializationError`` with no stashed fault is something
+    else entirely -- an unserialisable field, not a content problem -- so
+    it is wrapped as :class:`GlpiValidationError` rather than mislabelled.
+
+    Yields
+    ------
+    None
+        The block runs with content faults restored on the way out.
+    """
+
+    _LAST_CONTENT_FAULT.set(None)
+    try:
+        yield
+    except PydanticSerializationError as exc:
+        fault = _LAST_CONTENT_FAULT.get()
+        if fault is not None:
+            _LAST_CONTENT_FAULT.set(None)
+            # Rebuilt rather than re-raised so the raise-site audit can see
+            # the type. The chain is what matters and it survives: the
+            # original fault's own cause is carried across, and the
+            # pydantic wrapper becomes the context.
+            raise GlpiContentError(str(fault)) from fault.__cause__
+        raise GlpiValidationError(
+            f"Could not serialise the request body ({exc})."
+        ) from exc
 
 
 GlpiMarkdownContent = Annotated[
@@ -73,11 +236,57 @@ def _to_transport(value: str | None) -> str | None:
 ]
 """Annotated ``str | None`` that round-trips Markdown through GLPI's HTML wire format.
 
-Use this annotation on every model field that maps to a GLPI ``format: html``
-content slot (ticket descriptions, followup bodies, task bodies, solution
-bodies). The conversion is invisible to package users: the field accepts
-Markdown on construction, exposes Markdown on attribute access, and emits
-HTML on serialisation.
+Use this annotation on a **write** model field that maps to a GLPI
+``format: html`` content slot (ticket descriptions, followup bodies, task
+bodies, solution bodies). The conversion is invisible to package users: the
+field accepts Markdown on construction, exposes Markdown on attribute
+access, and emits HTML on serialisation.
+
+A read model wants :data:`GlpiRawContent` instead, and a
+``cached_property`` beside it. See the module docstring for why the two
+directions differ.
 """
 
-__all__ = ["GlpiMarkdownContent"]
+GlpiRawContent = Annotated[
+    str | None,
+    Field(
+        validation_alias=AliasChoices("content_html", "content"),
+        serialization_alias="content",
+    ),
+]
+"""Annotated ``str | None`` holding one raw GLPI ``content`` value, unconverted.
+
+Use this on a **read** model field named ``content_html``, paired with a
+``content`` ``cached_property`` over :func:`markdown_view`. Nothing is
+converted on validation, so building a page of records costs nothing per
+body and no body can spoil another.
+
+The validation alias accepts both spellings, so a GLPI payload
+(``content``) and a hand-written ``GetTicket(content_html=...)`` both
+populate the field. The name must be listed in the alias alongside the
+wire key: a bare ``validation_alias="content"`` would silently divert
+by-name construction into ``extra_payload`` rather than raising, because
+the base model allows extra keys.
+"""
+
+GlpiRawDescription = Annotated[
+    str | None,
+    Field(
+        validation_alias=AliasChoices("description_html", "description"),
+        serialization_alias="description",
+    ),
+]
+""":data:`GlpiRawContent` for the second content slot on a knowledge-base article.
+
+``KBArticle`` carries both ``content`` and ``description`` as
+``format: html``, and an alias names one wire key, so the two need
+separate annotations.
+"""
+
+__all__ = [
+    "GlpiMarkdownContent",
+    "GlpiRawContent",
+    "GlpiRawDescription",
+    "markdown_view",
+    "restoring_content_faults",
+]
diff --git a/glpi_python_client/models/api_schema/assistance/_ticket.py b/glpi_python_client/models/api_schema/assistance/_ticket.py
index b38a38b..40c85fe 100644
--- a/glpi_python_client/models/api_schema/assistance/_ticket.py
+++ b/glpi_python_client/models/api_schema/assistance/_ticket.py
@@ -9,21 +9,30 @@
 ``internal_resolution_date``, ``internal_take_into_account_date``) are
 excluded from the request models.
 
-Ticket ``content`` is exchanged with GLPI as HTML (``format: html``). The
-schema models the raw transport string; HTML/Markdown conversion belongs
-to the client layer.
+Ticket ``content`` is exchanged with GLPI as HTML (``format: html``).
+:class:`PostTicket` and :class:`PatchTicket` accept Markdown and render it
+on serialisation; :class:`GetTicket` stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import (
     IdNameCompletenameRef,
     IdNameRef,
 )
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import (
     GlpiGlobalValidation,
     GlpiPriority,
@@ -70,10 +79,10 @@ class GetTicket(GlpiModel):
         Native GLPI identifier (``readOnly``).
     name : str | None, optional
         Title of the ticket.
-    content : GlpiMarkdownContent
-        Body of the ticket exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the ticket exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     user_recipient : IdNameRef | None, optional
         Reference to the user designated as the ticket recipient (no
         contract description).
@@ -183,7 +192,7 @@ class GetTicket(GlpiModel):
 
     id: int | None = None
     name: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     user_recipient: IdNameRef | None = None
     user_editor: IdNameRef | None = None
     is_deleted: bool | None = None
@@ -225,6 +234,18 @@ class GetTicket(GlpiModel):
     entity: IdNameCompletenameRef | None = None
     team: list[_TicketTeamMember] | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The ticket body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        listing tickets costs nothing per body and a body that cannot be
+        converted affects only this record. ``content_html`` holds the HTML
+        exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostTicket(GlpiModel):
     """Request body for ``POST /Assistance/Ticket``.
diff --git a/glpi_python_client/models/api_schema/assistance/timeline/_followup.py b/glpi_python_client/models/api_schema/assistance/timeline/_followup.py
index bddf3bb..a2f347a 100644
--- a/glpi_python_client/models/api_schema/assistance/timeline/_followup.py
+++ b/glpi_python_client/models/api_schema/assistance/timeline/_followup.py
@@ -5,17 +5,26 @@
 ``components.schemas.Followup`` from the GLPI OpenAPI contract.
 
 Read-only contract fields (``id``) are excluded from request models.
-``content`` is exchanged as HTML; HTML/Markdown conversion is left to the
-client transport layer.
+``content`` is exchanged as HTML. The write models accept Markdown and
+render it on serialisation; the read model stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import GlpiTimelinePosition
 
 
@@ -34,10 +43,10 @@ class GetFollowup(GlpiModel):
         GLPI item type the followup belongs to, typically ``"Ticket"``.
     items_id : int | None, optional
         Identifier of the parent GLPI item.
-    content : GlpiMarkdownContent
-        Body of the followup exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the followup exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     is_private : bool | None, optional
         Whether the followup is visible only to technicians.
     user : IdNameRef | None, optional
@@ -69,7 +78,7 @@ class GetFollowup(GlpiModel):
     id: int | None = None
     itemtype: str | None = None
     items_id: int | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     is_private: bool | None = None
     user: IdNameRef | None = None
     user_editor: IdNameRef | None = None
@@ -81,6 +90,18 @@ class GetFollowup(GlpiModel):
     source_item_id: int | None = None
     source_of_item_id: int | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The followup body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        reading a ticket's timeline costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostFollowup(GlpiModel):
     """Request body for ``POST`` on ticket timeline followup endpoints.
diff --git a/glpi_python_client/models/api_schema/assistance/timeline/_solution.py b/glpi_python_client/models/api_schema/assistance/timeline/_solution.py
index a5a106c..f5eefc6 100644
--- a/glpi_python_client/models/api_schema/assistance/timeline/_solution.py
+++ b/glpi_python_client/models/api_schema/assistance/timeline/_solution.py
@@ -5,17 +5,26 @@
 ``components.schemas.Solution`` from the GLPI OpenAPI contract.
 
 Read-only contract fields (``id``) are excluded from request models.
-``content`` is exchanged as HTML; HTML/Markdown conversion is left to the
-client transport layer.
+``content`` is exchanged as HTML. The write models accept Markdown and
+render it on serialisation; the read model stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import GlpiSolutionStatus
 
 
@@ -35,10 +44,10 @@ class GetSolution(GlpiModel):
         Identifier of the parent GLPI item.
     type : IdNameRef | None, optional
         Reference to the solution type.
-    content : GlpiMarkdownContent
-        Body of the solution exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the solution exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     user : IdNameRef | None, optional
         Reference to the author of the solution.
     user_editor : IdNameRef | None, optional
@@ -66,7 +75,7 @@ class GetSolution(GlpiModel):
     itemtype: str | None = None
     items_id: int | None = None
     type: IdNameRef | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     user: IdNameRef | None = None
     user_editor: IdNameRef | None = None
     approver: IdNameRef | None = None
@@ -76,6 +85,18 @@ class GetSolution(GlpiModel):
     date_mod: datetime | None = None
     date_approval: datetime | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The solution body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        reading a ticket's timeline costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostSolution(GlpiModel):
     """Request body for ``POST`` on ticket timeline solution endpoints.
diff --git a/glpi_python_client/models/api_schema/assistance/timeline/_task.py b/glpi_python_client/models/api_schema/assistance/timeline/_task.py
index 20c395f..60b39fb 100644
--- a/glpi_python_client/models/api_schema/assistance/timeline/_task.py
+++ b/glpi_python_client/models/api_schema/assistance/timeline/_task.py
@@ -5,17 +5,26 @@
 OpenAPI contract.
 
 Read-only contract fields (``id``, ``uuid``) are excluded from request
-models. ``content`` is exchanged as HTML; HTML/Markdown conversion is left
-to the client transport layer.
+models. ``content`` is exchanged as HTML. The write models accept Markdown
+and render it on serialisation; the read model stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import (
     GlpiTaskState,
     GlpiTimelinePosition,
@@ -37,10 +46,10 @@ class GetTicketTask(GlpiModel):
         Server-generated universally unique identifier matching the
         pattern ``/^[0-9a-f]{8}-...-4...-[89ab]...-...$/i``
         (``readOnly``).
-    content : GlpiMarkdownContent
-        Body of the task exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the task exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     is_private : bool | None, optional
         Whether the task is visible only to technicians.
     user : IdNameRef | None, optional
@@ -86,7 +95,7 @@ class GetTicketTask(GlpiModel):
 
     id: int | None = None
     uuid: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     is_private: bool | None = None
     user: IdNameRef | None = None
     user_editor: IdNameRef | None = None
@@ -105,6 +114,18 @@ class GetTicketTask(GlpiModel):
     source_item_id: int | None = None
     source_of_item_id: int | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The task body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        reading a ticket's timeline costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostTicketTask(GlpiModel):
     """Request body for ``POST`` on ticket timeline task endpoints.
diff --git a/glpi_python_client/models/api_schema/knowledgebase/_article.py b/glpi_python_client/models/api_schema/knowledgebase/_article.py
index cd5da3b..7caf533 100644
--- a/glpi_python_client/models/api_schema/knowledgebase/_article.py
+++ b/glpi_python_client/models/api_schema/knowledgebase/_article.py
@@ -1,8 +1,15 @@
 """GLPI ``KBArticle`` schemas for the ``/Knowledgebase/Article`` endpoints.
 
 The field layout mirrors ``components.schemas.KBArticle`` from the GLPI
-OpenAPI contract (2.3.0). ``content`` and ``description`` are exchanged as
-HTML (``format: html``) and use the transparent Markdown annotation.
+OpenAPI contract (2.3.0). ``content`` and ``description`` are both
+exchanged as HTML (``format: html``). :class:`PostKBArticle` and
+:class:`PatchKBArticle` accept Markdown and render it on serialisation;
+:class:`GetKBArticle` stores the wire values in ``content_html`` and
+``description_html`` and exposes Markdown through the ``content`` and
+``description`` properties, converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
+
 Server-managed fields (``id``, ``views``, ``revisions``, ``translations``)
 are excluded from the request models; revisions and translations are
 managed through the dedicated revision endpoints.
@@ -11,10 +18,16 @@
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    GlpiRawDescription,
+    markdown_view,
+)
 
 
 class _KBArticleRevisionRef(GlpiModel):
@@ -37,13 +50,20 @@ class _KBArticleTranslationRef(GlpiModel):
 class GetKBArticle(GlpiModel):
     """Response shape returned by ``GET /Knowledgebase/Article`` endpoints.
 
-    Mirrors ``components.schemas.KBArticle``. ``content`` and
-    ``description`` round-trip Markdown through GLPI's HTML wire format.
+    Mirrors ``components.schemas.KBArticle``. ``content_html`` and
+    ``description_html`` hold the HTML exactly as GLPI sent it, and both
+    accept their wire spellings (``content``, ``description``) as well; the
+    :attr:`content` and :attr:`description` properties convert to Markdown
+    on first read.
+
+    An article body is the largest content GLPI serves, and searching the
+    knowledge base returns whole articles, so this is the model where
+    converting only what is read matters most.
     """
 
     id: int | None = None
     name: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     categories: list[IdNameRef] | None = None
     is_faq: bool | None = None
     entity: IdNameRef | None = None
@@ -51,7 +71,7 @@ class GetKBArticle(GlpiModel):
     user: IdNameRef | None = None
     views: int | None = None
     show_in_service_catalog: bool | None = None
-    description: GlpiMarkdownContent = None
+    description_html: GlpiRawDescription = None
     illustration: str | None = None
     is_pinned: bool | None = None
     date_creation: datetime | None = None
@@ -61,6 +81,28 @@ class GetKBArticle(GlpiModel):
     revisions: list[_KBArticleRevisionRef] | None = None
     translations: list[_KBArticleTranslationRef] | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The article body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        searching the knowledge base costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
+    @cached_property
+    def description(self) -> str | None:
+        """The article summary as Markdown, or ``None`` if GLPI sent none.
+
+        The short counterpart to :attr:`content`, converted from
+        ``description_html`` on the first read and cached the same way.
+        """
+
+        return markdown_view(self.description_html)
+
 
 class PostKBArticle(GlpiModel):
     """Request body for ``POST /Knowledgebase/Article``.
diff --git a/glpi_python_client/models/api_schema/knowledgebase/_revision.py b/glpi_python_client/models/api_schema/knowledgebase/_revision.py
index 123b377..61d3678 100644
--- a/glpi_python_client/models/api_schema/knowledgebase/_revision.py
+++ b/glpi_python_client/models/api_schema/knowledgebase/_revision.py
@@ -3,33 +3,56 @@
 The endpoints live under
 ``/Knowledgebase/Article/{article_id}/Revision`` (and the language-scoped
 variant). Revisions are read-only, so this module exposes only a ``Get``
-model. ``content`` is exchanged as HTML (``format: html``) and round-trips
-Markdown on the model boundary.
+model. ``content`` is exchanged as HTML (``format: html``): the wire value
+is stored in ``content_html`` and the ``content`` property converts it to
+Markdown on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiRawContent,
+    markdown_view,
+)
 
 
 class GetKBArticleRevision(GlpiModel):
     """Response shape returned by ``GET`` on KB revision endpoints.
 
-    Mirrors ``components.schemas.KBArticleRevision``.
+    Mirrors ``components.schemas.KBArticleRevision``. ``content_html``
+    holds the HTML exactly as GLPI sent it and also accepts the wire
+    spelling ``content``; the :attr:`content` property converts it to
+    Markdown on first read.
+
+    Revision history is the clearest case for that: listing an article's
+    revisions returns every past body, and a caller comparing dates or
+    revision numbers reads none of them.
     """
 
     id: int | None = None
     kbarticle: IdNameRef | None = None
     revision: int | None = None
     name: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     language: str | None = None
     user: IdNameRef | None = None
     date: datetime | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The revision's body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached.
+        ``content_html`` holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 __all__ = ["GetKBArticleRevision"]
diff --git a/glpi_python_client/models/api_schema/tests/__init__.py b/glpi_python_client/models/api_schema/tests/__init__.py
new file mode 100644
index 0000000..7cdb581
--- /dev/null
+++ b/glpi_python_client/models/api_schema/tests/__init__.py
@@ -0,0 +1 @@
+"""Unit tests for the shared API-schema helpers."""
diff --git a/glpi_python_client/models/api_schema/tests/test_content.py b/glpi_python_client/models/api_schema/tests/test_content.py
new file mode 100644
index 0000000..00cc8c1
--- /dev/null
+++ b/glpi_python_client/models/api_schema/tests/test_content.py
@@ -0,0 +1,159 @@
+"""Unit tests for :mod:`glpi_python_client.models.api_schema._content`.
+
+The annotated types and the ``markdown_view`` helper had no unit tests of
+their own -- their behaviour was covered incidentally by the model suites,
+which left the ``None`` paths on both directions executed by nothing at
+all. Those paths are what keeps ``exclude_none`` working, so they are the
+ones worth pinning explicitly.
+
+The wider read/write contract lives in
+``glpi_python_client/testing/tests/test_content_roundtrip.py``; this module
+is only the helpers.
+"""
+
+from __future__ import annotations
+
+import pytest
+from pydantic_core import PydanticSerializationError
+
+from glpi_python_client import GlpiContentError, GlpiError, GlpiValidationError
+from glpi_python_client._sync._testing import TransportRecorder, make_client
+from glpi_python_client._sync.clients.commons._payloads import model_to_payload
+from glpi_python_client.models.api_schema._content import (
+    _from_transport,
+    _to_transport,
+    markdown_view,
+    restoring_content_faults,
+)
+from glpi_python_client.models.api_schema.assistance import GetTicket, PostTicket
+
+
+def test_markdown_view_passes_none_through() -> None:
+    """A slot GLPI never sent reads back as ``None``, not as ``""``.
+
+    The distinction matters on the way back out: an empty string is a
+    caller asking to clear the body, and ``None`` is a caller not
+    mentioning it.
+    """
+
+    assert markdown_view(None) is None
+
+
+def test_markdown_view_converts_a_raw_value() -> None:
+    """The body of every read model's content property, in one line."""
+
+    assert markdown_view("<p>The printer is <strong>offline</strong>.</p>") == (
+        "The printer is **offline**."
+    )
+
+
+def test_the_inbound_validator_passes_none_through() -> None:
+    """An explicit ``content=None`` on a write model stays ``None``.
+
+    Reached only by naming the field, since an unset field never runs the
+    validator -- which is why nothing exercised it before.
+    """
+
+    assert _from_transport(None) is None
+    assert PostTicket(content=None).content is None
+
+
+def test_the_outbound_serialiser_passes_none_through() -> None:
+    """``None`` has to survive serialisation for ``exclude_none`` to work.
+
+    ``model_to_payload`` dumps with ``exclude_none=True``, so a rendered
+    empty string here would put an empty body in the request instead of
+    leaving the field out.
+    """
+
+    assert _to_transport(None) is None
+    assert "content" not in model_to_payload(PostTicket(content=None))
+
+
+def test_a_read_model_reads_none_when_glpi_sent_no_body() -> None:
+    """The read side of the same tri-state, through the real model."""
+
+    ticket = GetTicket.model_validate({"id": 1})
+
+    assert ticket.content_html is None
+    assert ticket.content is None
+
+
+def test_a_content_fault_on_the_write_path_stays_in_the_taxonomy() -> None:
+    """pydantic-core destroys a serializer's exception; this puts it back.
+
+    Outbound conversion runs in a ``PlainSerializer``, and everything it
+    raises comes back out as ``PydanticSerializationError`` -- a
+    ``ValueError``, not a :class:`GlpiError`, with ``__cause__`` and
+    ``__context__`` both ``None``. Every ``create_*``/``update_*`` carrying
+    a body was affected, so ``except GlpiError`` did not fire on the one
+    path the package's error contract is most explicit about.
+    """
+
+    deep_markdown = "".join(" " * (4 * level) + "- x\n" for level in range(600))
+    client = make_client()
+    TransportRecorder().install(client)
+
+    with pytest.raises(GlpiContentError) as caught:
+        client.create_ticket(PostTicket(name="round trip", content=deep_markdown))
+
+    assert isinstance(caught.value, GlpiError)
+    assert not isinstance(caught.value, ValueError)
+    # the original fault, which pydantic-core had discarded
+    assert isinstance(caught.value.__cause__, RecursionError)
+    # and the serializer wrapper, kept where a reader would look for it
+    assert isinstance(caught.value.__context__, PydanticSerializationError)
+
+
+def test_a_serialisation_fault_that_is_not_content_is_not_mislabelled() -> None:
+    """Only a stashed content fault becomes a ``GlpiContentError``.
+
+    An unserialisable field is a different problem, and reporting it as a
+    content conversion failure would send a reader looking in the wrong
+    place. It also proves the stash cannot go stale: this block records no
+    fault of its own.
+    """
+
+    with pytest.raises(GlpiValidationError):
+        with restoring_content_faults():
+            raise PydanticSerializationError("unserialisable field")
+
+
+def test_one_field_spelled_twice_keeps_the_spelling_pydantic_uses() -> None:
+    """A duplicate spelling used to shadow the field in ``model_dump``.
+
+    ``extra="allow"`` filed the alias Pydantic did not consume as a model
+    extra, and ``model_dump`` emitted it *over* the real field: the
+    attribute reported one body and the object's own dump reported the
+    other. ``content_html`` is the first choice, so a dump that carries
+    both -- which is what ``model_copy(update={"content": ...})`` produces
+    -- round-trips back to the raw body rather than to the phantom.
+    """
+
+    both = GetTicket.model_validate(
+        {
+            "id": 1,
+            "content": "<p>from content</p>",
+            "content_html": "<p>from content_html</p>",
+        }
+    )
+
+    assert both.content_html == "<p>from content_html</p>"
+    assert both.model_extra == {}
+    assert both.extra_payload == {}
+    assert both.model_dump()["content_html"] == "<p>from content_html</p>"
+
+
+def test_a_glpi_payload_still_populates_the_raw_field() -> None:
+    """The alias order changed, so pin what GLPI actually sends.
+
+    GLPI sends ``content``; only a round-tripped dump carries
+    ``content_html``. Preferring the raw spelling must not stop the wire
+    spelling working, or every read breaks.
+    """
+
+    ticket = GetTicket.model_validate({"id": 2, "content": "<p>offline</p>"})
+
+    assert ticket.content_html == "<p>offline</p>"
+    assert ticket.content == "offline"
+    assert ticket.extra_payload == {}
diff --git a/glpi_python_client/models/custom_schema/_ticket_context.py b/glpi_python_client/models/custom_schema/_ticket_context.py
index 07d9d1e..d645f4f 100644
--- a/glpi_python_client/models/custom_schema/_ticket_context.py
+++ b/glpi_python_client/models/custom_schema/_ticket_context.py
@@ -238,6 +238,17 @@ def to_markdown(
             Markdown transcript suitable for direct display or for
             forwarding into a downstream Markdown renderer. The string
             never ends with trailing whitespace.
+
+        Raises
+        ------
+        GlpiContentError
+            One of the bodies could not be converted from GLPI's HTML.
+            This is where the read models' HTML-to-Markdown conversion
+            actually happens -- they hold the wire value and convert on
+            first read, and this method is normally the first reader.
+            Content too deeply nested for the converter to walk is
+            degraded to plain text rather than raising, so this is a
+            backstop rather than an expected outcome.
         """
 
         opts = options if options is not None else TicketMarkdownOptions()
diff --git a/glpi_python_client/models/tests/test_base.py b/glpi_python_client/models/tests/test_base.py
index bdb6188..8e0fbe1 100644
--- a/glpi_python_client/models/tests/test_base.py
+++ b/glpi_python_client/models/tests/test_base.py
@@ -8,8 +8,12 @@
 from __future__ import annotations
 
 from datetime import datetime, timedelta, timezone
+from typing import Annotated
 
-from glpi_python_client.models._base import GlpiModel
+import pytest
+from pydantic import AliasChoices, AliasPath, Field, ValidationError
+
+from glpi_python_client.models._base import GlpiModel, _alias_groups
 
 _PARIS_SUMMER = timezone(timedelta(hours=2))
 _PARIS_WINTER = timezone(timedelta(hours=1))
@@ -181,3 +185,171 @@ def test_the_serialisation_timezone_reaches_a_nested_model() -> None:
     dumped = nested.model_dump(mode="json", context={"server_timezone": _PARIS_WINTER})
 
     assert dumped["inner"]["date"] == "2024-01-01T13:00:00"
+
+
+# ---------------------------------------------------------------------------
+# Alias-aware capture of unknown keys
+# ---------------------------------------------------------------------------
+#
+# ``_capture_unknown_fields`` runs before Pydantic resolves aliases, so a key
+# it removes is a key the alias never gets to see. That made the read models'
+# ``content`` -> ``content_html`` rename fail in the worst possible way:
+# HTTP 200, no warning, no error, and every ticket body reading back as
+# ``None`` with the HTML sitting in ``extra_payload``. These tests pin both
+# halves -- an aliased key must reach its field, and a genuinely unknown key
+# must still be captured.
+
+
+class _Aliased(GlpiModel):
+    """Model whose field is fed by a validation alias, like the read models."""
+
+    id: int | None = None
+    body_html: Annotated[
+        str | None,
+        Field(validation_alias=AliasChoices("body", "body_html")),
+    ] = None
+
+
+class _PathAliased(GlpiModel):
+    """Model fed through an ``AliasPath``, where only segment 0 is a key."""
+
+    inner: Annotated[
+        str | None, Field(validation_alias=AliasPath("wrapper", "value"))
+    ] = None
+
+
+def test_an_aliased_payload_key_reaches_its_field() -> None:
+    """The wire spelling populates the field instead of ``extra_payload``."""
+
+    parsed = _Aliased.model_validate({"id": 1, "body": "<p>hello</p>"})
+
+    assert parsed.body_html == "<p>hello</p>"
+    assert parsed.extra_payload == {}
+
+
+def test_the_field_name_spelling_also_reaches_the_field() -> None:
+    """Listing the field's own name in ``AliasChoices`` is what allows this.
+
+    A bare ``validation_alias="body"`` would not raise on by-name
+    construction -- the base model allows extra keys, so the value would go
+    quietly to ``extra_payload`` and the field would stay ``None``.
+    """
+
+    parsed = _Aliased.model_validate({"body_html": "<p>hello</p>"})
+
+    assert parsed.body_html == "<p>hello</p>"
+    assert parsed.extra_payload == {}
+
+
+def test_a_genuinely_unknown_key_is_still_captured() -> None:
+    """Widening the known set must not stop the escape hatch working.
+
+    The other direction of the same fix: if ``known`` became "any key at
+    all", the ``extra_payload`` contract would silently stop collecting the
+    helper fields GLPI adds outside the contract.
+    """
+
+    parsed = _Aliased.model_validate({"body": "<p>x</p>", "href": "/Ticket/1"})
+
+    assert parsed.body_html == "<p>x</p>"
+    assert parsed.extra_payload == {"href": "/Ticket/1"}
+
+
+def test_only_the_first_segment_of_an_alias_path_is_a_payload_key() -> None:
+    """``AliasPath("wrapper", "value")`` consumes ``wrapper``, not ``value``.
+
+    The remaining segments index into the value, so treating them as keys
+    would exempt names that really are unknown.
+    """
+
+    parsed = _PathAliased.model_validate({"wrapper": {"value": "deep"}, "junk": 1})
+
+    assert parsed.inner == "deep"
+    assert parsed.extra_payload == {"junk": 1}
+
+
+class _PlainAliased(GlpiModel):
+    """Model using the ``alias=`` spelling rather than ``validation_alias=``."""
+
+    value: Annotated[str | None, Field(alias="wire_value")] = None
+
+
+def test_the_plain_alias_spelling_is_also_recognised() -> None:
+    """``alias=`` is a validation spelling too, so it has to be collected.
+
+    Pydantic mirrors ``alias=`` into ``validation_alias`` today, which makes
+    reading both belt and braces -- but the belt is one line and the braces
+    are an undocumented implementation detail of another library.
+    """
+
+    parsed = _PlainAliased.model_validate({"wire_value": "x", "junk": 1})
+
+    assert parsed.value == "x"
+    assert parsed.extra_payload == {"junk": 1}
+
+
+def test_a_non_mapping_payload_is_passed_through_untouched() -> None:
+    """The capture validator only has work to do on a mapping.
+
+    Anything else is handed straight to Pydantic, which produces the real
+    error. Capturing keys from a list would mean inventing them.
+    """
+
+    with pytest.raises(ValidationError):
+        _Stamped.model_validate([1, 2, 3])
+
+
+def test_a_field_spelled_twice_drops_the_spelling_pydantic_ignores() -> None:
+    """Only one spelling of one field may survive validation.
+
+    Pydantic consumes the first alias it finds and leaves the rest to
+    ``extra="allow"``, which files them as model extras -- and a model
+    extra named after a field is emitted by ``model_dump`` *instead of*
+    that field. So the redundant spelling is removed here, before Pydantic
+    resolves anything.
+    """
+
+    class Twice(GlpiModel):
+        body: Annotated[
+            str | None,
+            Field(validation_alias=AliasChoices("body_raw", "body")),
+        ] = None
+
+    both = Twice.model_validate({"body_raw": "raw wins", "body": "legacy"})
+
+    assert both.body == "raw wins"
+    assert both.model_extra == {}
+    assert both.extra_payload == {}
+    assert both.model_dump()["body"] == "raw wins"
+
+
+def test_either_spelling_alone_still_populates_the_field() -> None:
+    """Dropping a duplicate must not turn into dropping the only value."""
+
+    class Twice(GlpiModel):
+        body: Annotated[
+            str | None,
+            Field(validation_alias=AliasChoices("body_raw", "body")),
+        ] = None
+
+    assert Twice.model_validate({"body_raw": "x"}).body == "x"
+    assert Twice.model_validate({"body": "y"}).body == "y"
+
+
+def test_alias_groups_lists_only_fields_with_a_choice() -> None:
+    """A field with one spelling has nothing to choose, so it is left out.
+
+    An ``AliasPath`` is left out too: it addresses a position inside a
+    nested structure rather than a key that could duplicate another.
+    """
+
+    class Mixed(GlpiModel):
+        one: Annotated[str | None, Field(validation_alias="only")] = None
+        two: Annotated[
+            str | None, Field(validation_alias=AliasChoices("a", "b", "c"))
+        ] = None
+        three: Annotated[
+            str | None, Field(validation_alias=AliasPath("nested", "deep"))
+        ] = None
+
+    assert _alias_groups(Mixed) == (("a", "b", "c"),)
diff --git a/glpi_python_client/testing/tests/test_content_roundtrip.py b/glpi_python_client/testing/tests/test_content_roundtrip.py
index 817aeb0..5f685b1 100644
--- a/glpi_python_client/testing/tests/test_content_roundtrip.py
+++ b/glpi_python_client/testing/tests/test_content_roundtrip.py
@@ -9,9 +9,14 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterator
+from functools import cached_property
+
 import pytest
 
 from glpi_python_client._sync.clients.commons._payloads import model_to_payload
+from glpi_python_client.content import conversion
+from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema.assistance import (
     GetTicket,
     PatchTicket,
@@ -25,6 +30,30 @@
     PostSolution,
     PostTicketTask,
 )
+from glpi_python_client.models.api_schema.knowledgebase import (
+    GetKBArticle,
+    GetKBArticleRevision,
+)
+
+
+def _count_conversions(monkeypatch: pytest.MonkeyPatch) -> list[str]:
+    """Record every call to the inbound converter, and return the log.
+
+    A list rather than a counter so an assertion can show what was
+    converted, not only how often.
+    """
+
+    seen: list[str] = []
+    real = conversion.GlpiContentConverter.from_transport
+
+    def _record(value: object) -> str:
+        seen.append(str(value))
+        return real(value)
+
+    monkeypatch.setattr(
+        conversion.GlpiContentConverter, "from_transport", staticmethod(_record)
+    )
+    return seen
 
 
 @pytest.mark.parametrize(
@@ -187,3 +216,234 @@ def test_round_trip_corpus(markdown: str) -> None:
     incoming = GetTicket.model_validate({"name": "Round trip", **outgoing})
 
     assert incoming.content == markdown
+
+
+# ---------------------------------------------------------------------------
+# Lazy conversion on the read models
+# ---------------------------------------------------------------------------
+#
+# Conversion used to run inside the Pydantic validator, which meant a caller
+# who wanted only ``id`` and ``date_mod`` paid HTML-to-Markdown on every
+# record of every page, and one unconvertible body took its page-mates down
+# with it -- ``_resource_list`` builds a page in a single comprehension. The
+# tests here pin the three consequences of moving it to the attribute: the
+# raw value is available, nothing converts until something is read, and a
+# failure is confined to the record whose body was read.
+
+#: Every read model with a content slot, and the fields on each.
+#:
+#: Named explicitly so each case reads as itself, with the *completeness* of
+#: the list asserted separately by
+#: :func:`test_every_read_model_with_a_raw_slot_is_covered_here`. The list
+#: on its own cannot give that guarantee -- a read model nobody adds to it
+#: is a model these cases never mention, which is silence, not a failure --
+#: and it claimed to for a while.
+READ_CONTENT_MODELS = [
+    pytest.param(GetTicket, ["content"], id="GetTicket"),
+    pytest.param(GetFollowup, ["content"], id="GetFollowup"),
+    pytest.param(GetSolution, ["content"], id="GetSolution"),
+    pytest.param(GetTicketTask, ["content"], id="GetTicketTask"),
+    pytest.param(GetKBArticle, ["content", "description"], id="GetKBArticle"),
+    pytest.param(GetKBArticleRevision, ["content"], id="GetKBArticleRevision"),
+]
+
+
+@pytest.mark.parametrize(("model_cls", "slots"), READ_CONTENT_MODELS)
+def test_read_models_keep_the_raw_wire_value(model_cls: type, slots: list[str]) -> None:
+    """``<slot>_html`` holds exactly what GLPI sent, unconverted."""
+
+    html = "<p>The printer is <strong>offline</strong>.</p>"
+
+    instance = model_cls.model_validate({slot: html for slot in slots})
+
+    for slot in slots:
+        assert getattr(instance, f"{slot}_html") == html
+        assert getattr(instance, slot) == "The printer is **offline**."
+
+
+@pytest.mark.parametrize(("model_cls", "slots"), READ_CONTENT_MODELS)
+def test_no_read_model_still_declares_the_slot_as_a_field(
+    model_cls: type, slots: list[str]
+) -> None:
+    """A leftover field declaration would shadow the property, silently.
+
+    Pydantic keeps a field of that name if one is declared anywhere in the
+    MRO, puts the validated value straight into ``__dict__``, and the
+    non-data ``cached_property`` descriptor never runs -- no error, no
+    warning, and ``.content`` hands back raw HTML. Deleting the old line is
+    half the change, so it is asserted rather than assumed.
+    """
+
+    for slot in slots:
+        assert slot not in model_cls.model_fields
+        assert f"{slot}_html" in model_cls.model_fields
+        assert isinstance(model_cls.__dict__.get(slot), cached_property)
+
+
+def test_building_a_page_of_records_converts_nothing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Validation is free; the cost moves to whoever reads a body.
+
+    This is the reason for the whole change. A search returning a hundred
+    tickets used to run HTML-to-Markdown a hundred times whether or not the
+    caller looked at a single body.
+    """
+
+    calls = _count_conversions(monkeypatch)
+    payload = {"id": 1, "content": "<p>The printer is <strong>offline</strong>.</p>"}
+
+    page = [GetTicket.model_validate(payload) for _ in range(100)]
+
+    assert calls == []
+    assert page[7].content == "The printer is **offline**."
+    assert len(calls) == 1
+
+
+def test_a_body_is_converted_once_however_often_it_is_read(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """``cached_property``, so repeated reads are free.
+
+    Worth pinning: without the cache, moving conversion to the attribute
+    would make the common read-it-twice case slower than the eager version
+    it replaced.
+    """
+
+    calls = _count_conversions(monkeypatch)
+    ticket = GetTicket.model_validate({"content": "<p>a <em>b</em></p>"})
+
+    first, second, third = ticket.content, ticket.content, ticket.content
+
+    assert first == second == third == "a *b*"
+    assert len(calls) == 1
+
+
+def test_one_unconvertible_body_leaves_its_page_mates_readable(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A failure is scoped to the record whose body was actually read.
+
+    ``TransportMixin._resource_list`` validates a whole page in one
+    comprehension, so a converter that raised on any single record used to
+    abort the page and take every other body with it -- including the
+    records the caller wanted. Now the two other tickets read fine and the
+    bad one raises only when touched.
+    """
+
+    def _selective(value: object) -> str:
+        if "poison" in str(value):
+            raise RecursionError("maximum recursion depth exceeded")
+        return "converted"
+
+    monkeypatch.setattr(
+        conversion.GlpiContentConverter, "from_transport", staticmethod(_selective)
+    )
+
+    page = [
+        GetTicket.model_validate({"id": 1, "content": "<p>fine</p>"}),
+        GetTicket.model_validate({"id": 2, "content": "<p>poison</p>"}),
+        GetTicket.model_validate({"id": 3, "content": "<p>fine too</p>"}),
+    ]
+
+    assert [ticket.id for ticket in page] == [1, 2, 3]
+    assert page[0].content == "converted"
+    assert page[2].content == "converted"
+    with pytest.raises(RecursionError):
+        _ = page[1].content
+
+
+def test_a_body_too_deep_to_convert_no_longer_breaks_get_ticket() -> None:
+    """The end-to-end regression test for the bug behind all of this.
+
+    Around 494 levels of nesting exhausted the interpreter's stack inside
+    ``markdownify``. With the conversion in a ``BeforeValidator`` that
+    ``RecursionError`` came out of ``model_validate`` -- so out of
+    ``get_ticket``, from a library whose whole error surface is supposed to
+    derive from ``GlpiError``. Two changes had to land for this to pass:
+    the depth ceiling that degrades instead of recursing, and the move off
+    the validator so nothing converts before it is asked for.
+    """
+
+    deep = "<div>" * 600 + "the printer is offline" + "</div>" * 600
+
+    ticket = GetTicket.model_validate({"id": 42, "content": deep})
+
+    assert ticket.id == 42
+    assert ticket.content == "the printer is offline"
+
+
+def test_reading_content_off_a_write_model_still_works() -> None:
+    """Write models keep converting eagerly, and keep the field name.
+
+    The asymmetry is deliberate -- a caller's own Markdown is worth
+    checking where it was supplied, and there is no list path on a write
+    model to make lazy -- but ``.content`` has to read back the same way on
+    both, or the read-modify-write flow breaks.
+    """
+
+    ticket = PostTicket(content="The printer is **offline**.")
+
+    assert ticket.content == "The printer is **offline**."
+    assert "content" in PostTicket.model_fields
+    assert not hasattr(ticket, "content_html")
+
+
+def _model_subclasses() -> list[type]:
+    """Return every ``GlpiModel`` subclass the api_schema package defines."""
+
+    def walk(cls: type) -> Iterator[type]:
+        for sub in cls.__subclasses__():
+            yield sub
+            yield from walk(sub)
+
+    return sorted(set(walk(GlpiModel)), key=lambda cls: cls.__name__)
+
+
+def test_every_read_model_with_a_raw_slot_is_covered_here() -> None:
+    """Discovery, so a seventh read model cannot arrive uncovered.
+
+    ``READ_CONTENT_MODELS`` is hand-written, and a hand-written list cannot
+    notice a model that is missing from it. This walks the class tree
+    instead: every ``Get*`` model carrying a ``<slot>_html`` field must
+    appear above, with that slot named.
+    """
+
+    listed = {param.values[0]: set(param.values[1]) for param in READ_CONTENT_MODELS}
+    for model_cls in _model_subclasses():
+        if not model_cls.__name__.startswith("Get"):
+            continue
+        raw = {
+            name[: -len("_html")]
+            for name in model_cls.model_fields
+            if name.endswith("_html")
+        }
+        if not raw:
+            continue
+        assert model_cls in listed, (
+            f"{model_cls.__name__} has raw slots {sorted(raw)} and is not in "
+            "READ_CONTENT_MODELS"
+        )
+        assert listed[model_cls] == raw, (
+            f"{model_cls.__name__} declares {sorted(raw)} but the list says "
+            f"{sorted(listed[model_cls])}"
+        )
+
+
+def test_no_read_model_anywhere_declares_a_converted_slot_as_a_field() -> None:
+    """The shadowing guard, applied to every read model rather than six.
+
+    A field named ``content`` or ``description`` on a ``Get*`` model would
+    shadow the ``cached_property`` silently and hand back raw HTML, and the
+    six-model version of this check could not see a seventh.
+    """
+
+    for model_cls in _model_subclasses():
+        if not model_cls.__name__.startswith("Get"):
+            continue
+        for slot in ("content", "description"):
+            if f"{slot}_html" not in model_cls.model_fields:
+                continue
+            assert slot not in model_cls.model_fields, (
+                f"{model_cls.__name__}.{slot} is a field and shadows its property"
+            )
diff --git a/glpi_python_client/testing/tests/test_raise_site_audit.py b/glpi_python_client/testing/tests/test_raise_site_audit.py
index 40a32de..6f9e96f 100644
--- a/glpi_python_client/testing/tests/test_raise_site_audit.py
+++ b/glpi_python_client/testing/tests/test_raise_site_audit.py
@@ -1,12 +1,19 @@
 """Audit every raise statement in library code against the error contract.
 
 This is a structural guard, not a behavioural one. It exists because the
-0.4.0 error migration is a mechanical sweep across raise sites in
-non-test library code -- as of this writing 24 ``GlpiValidationError``,
-9 ``GlpiProtocolError``, 4 ``RuntimeError``, 2 ``TypeError``,
-1 ``GlpiServerError``, plus 2 ``status_error_class(...)`` dispatch sites
-(42 total) -- and a missed one is invisible: a bare ValueError still
-passes every existing ``pytest.raises(ValueError)`` test.
+0.4.0 error migration was a mechanical sweep across every raise site in
+non-test library code, and a missed one is invisible: a bare
+``ValueError`` still passes every existing ``pytest.raises(ValueError)``
+test. The same goes for a raise site added later, which is what makes this
+worth keeping rather than a one-off checklist.
+
+(There used to be a per-class tally of the raise sites here. It was prose
+asserted by nothing and it rotted -- by 0.5.0 it was out by a third. The
+allow-list below is the part that has to be right, and the suite enforces
+it.)
+
+The module also guards one thing the library must *never* call. See
+:func:`test_the_library_never_touches_the_recursion_limit`.
 
 The RuntimeError and TypeError sites are deliberately exempt. Converting
 them to GlpiValidationError -- which inherits ValueError, not TypeError --
@@ -25,6 +32,7 @@
 _ALLOWED = {
     "GlpiValidationError",
     "GlpiProtocolError",
+    "GlpiContentError",
     "GlpiServerError",
     "GlpiStatusError",
     "error_class",  # status_error_class(...) dispatch result
@@ -136,3 +144,47 @@ def test_every_raise_site_uses_an_allowed_exception() -> None:
 
     offenders = [site for site in _raise_sites() if site[2] not in _ALLOWED]
     assert offenders == [], f"unexpected raise sites: {offenders}"
+
+
+def test_the_library_never_touches_the_recursion_limit() -> None:
+    """``sys.setrecursionlimit`` is a rejected option, not an unused one.
+
+    The content converter has a recursion ceiling -- ``markdownify``
+    recurses about twice per level of HTML nesting -- and raising the
+    interpreter's limit is the obvious-looking way to move it. It is the
+    wrong way twice over, so the prohibition is asserted rather than left
+    as a comment for the next person to weigh up again:
+
+    * The limit is process-global state belonging to the application, not
+      to a library the application imported. Writing it changes the
+      behaviour of code that never asked.
+    * Past what the C stack can actually hold, it converts a catchable
+      ``RecursionError`` into a hard interpreter crash -- on Windows, an
+      access violation with no traceback. It moves the cliff and makes
+      falling off it worse.
+
+    Answering the ``RecursionError`` instead of preventing it is what
+    :meth:`glpi_python_client.content.conversion.GlpiContentConverter.from_transport`
+    does -- it attempts the conversion and degrades the body to its text
+    if the walk does not fit -- and the backstop for anything else is
+    :class:`glpi_python_client.GlpiContentError`.
+
+    Matched on the AST rather than the text, so that the module docstrings
+    which explain the prohibition do not trip the guard that enforces it.
+    """
+
+    offenders: list[tuple[str, int]] = []
+    for path in _library_modules():
+        tree = ast.parse(path.read_text(encoding="utf-8"))
+        for node in ast.walk(tree):
+            named = (
+                isinstance(node, ast.Attribute) and node.attr == "setrecursionlimit"
+            ) or (isinstance(node, ast.Name) and node.id == "setrecursionlimit")
+            if named:
+                offenders.append(
+                    (path.relative_to(_PACKAGE_ROOT).as_posix(), node.lineno)
+                )
+    assert offenders == [], (
+        "the library must not write the interpreter's recursion limit; "
+        f"bound the input instead. Sites: {offenders}"
+    )
diff --git a/glpi_python_client/tests/test_errors.py b/glpi_python_client/tests/test_errors.py
index 8b5d699..cfdb737 100644
--- a/glpi_python_client/tests/test_errors.py
+++ b/glpi_python_client/tests/test_errors.py
@@ -9,6 +9,7 @@
 
 from glpi_python_client import (
     GlpiAuthError,
+    GlpiContentError,
     GlpiError,
     GlpiNotFoundError,
     GlpiProtocolError,
@@ -33,6 +34,7 @@ def test_every_public_error_derives_from_glpi_error() -> None:
         GlpiServerError,
         GlpiValidationError,
         GlpiProtocolError,
+        GlpiContentError,
     ):
         assert issubclass(cls, GlpiError)
 
@@ -49,6 +51,19 @@ def test_transport_errors_are_not_value_errors() -> None:
     assert not issubclass(GlpiTransportError, ValueError)
 
 
+def test_content_errors_are_not_value_errors() -> None:
+    """A parser exhausting the stack is not a value the caller got wrong.
+
+    The three ``ValueError`` inheritors below carry that base only for
+    back-compatibility with releases that raised bare ``ValueError`` at the
+    same sites. There was never a ``ValueError`` at a conversion site, so
+    inheriting one here would widen the contract for no one's benefit --
+    the same reasoning as :class:`GlpiTransportError`.
+    """
+
+    assert not issubclass(GlpiContentError, ValueError)
+
+
 @pytest.mark.parametrize(
     "cls", [GlpiStatusError, GlpiValidationError, GlpiProtocolError]
 )
diff --git a/integration_tests/probe_wire_format.py b/integration_tests/probe_wire_format.py
deleted file mode 100644
index 401a972..0000000
--- a/integration_tests/probe_wire_format.py
+++ /dev/null
@@ -1,332 +0,0 @@
-"""Record what GLPI 11 actually puts on the wire, for two open decisions.
-
-Run this against preprod and paste the output into issues #31 and #35. It
-answers two questions the repository cannot answer from inside, and both
-decide whether a proposed change is worth building at all:
-
-**#31 -- do datetimes arrive naive?** The proposal to attach a server
-timezone assumes GLPI omits the UTC offset. Nothing here records a real v2
-response, and the project's own fixtures disagree: the knowledge base tests
-use ``+00:00`` (which already parses aware) while the timeline, management
-and administration tests use a bare ``2024-01-02T03:04:05``. If the live
-server sends an offset, #31 can be closed unbuilt.
-
-**#35 -- what does a POST return?** ``_resource_create`` parses the whole
-body and keeps one integer. If the body already carries the full record,
-the fix is to stop discarding it, not to add a second request behind a
-``create_*_and_fetch`` helper.
-
-**#22 follow-up -- does GLPI honour an offset on write?** The fix for #22
-changed outbound serialisation to Pydantic's JSON mode, so an aware
-``datetime`` now goes out as ``...+02:00`` or ``...Z``. Accepting it and
-honouring it are different questions, and only the second is dangerous to
-get wrong: a truncated offset moves the moment silently, with a 200.
-
-This is a **read-mostly** probe. It creates exactly one ticket -- reused by
-both write probes -- and deletes it again in a ``finally``. Nothing else is
-written.
-
-Usage
------
-    python integration_tests/probe_wire_format.py
-
-Credentials load the same way the integration suite loads them: from
-``secrets/`` files, falling back to ``GLPI_*`` environment variables.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-import socket
-import sys
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-_REPO_ROOT = Path(__file__).resolve().parents[1]
-_SECRETS_DIR = _REPO_ROOT / "secrets"
-
-#: Wire values that look like a timestamp, offset-bearing or not.
-_TIMESTAMP = re.compile(r"^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}")
-
-
-def _read_value(secret_name: str, env_name: str) -> str | None:
-    """Return the secret file's contents, or the environment fallback."""
-
-    path = _SECRETS_DIR / secret_name
-    if path.exists():
-        value = path.read_text(encoding="utf-8").strip()
-        if value:
-            return value
-    env_value = os.environ.get(env_name)
-    return env_value.strip() if env_value else None
-
-
-def _load() -> dict[str, str]:
-    """Resolve the live configuration or exit with what is missing."""
-
-    wanted = {
-        "api_url": ("glpi_api_url", "GLPI_API_URL"),
-        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
-        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
-        "username": ("glpi_username", "GLPI_USERNAME"),
-        "password": ("glpi_password", "GLPI_PASSWORD"),
-    }
-    config: dict[str, str] = {}
-    missing: list[str] = []
-    for key, (secret, env) in wanted.items():
-        value = _read_value(secret, env)
-        if value is None:
-            missing.append(secret)
-        else:
-            config[key] = value
-    if missing:
-        sys.exit("missing credentials: " + ", ".join(missing))
-    return config
-
-
-def _check_reachable(api_url: str) -> None:
-    """Exit with a diagnosis when the API host does not resolve.
-
-    The GLPI instance lives on an internal ``.local`` name, so running this
-    off the corporate VPN fails during DNS with a forty-line httpx traceback
-    ending in ``getaddrinfo failed`` -- which looks like a bug in the probe
-    rather than a missing network. Checking first turns that into one line.
-    """
-
-    host = urlparse(api_url).hostname
-    if not host:
-        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
-    try:
-        socket.getaddrinfo(host, None)
-    except socket.gaierror:
-        try:
-            socket.getaddrinfo("github.com", None)
-        except socket.gaierror:
-            sys.exit(f"cannot resolve {host} -- and public DNS is down too.")
-        sys.exit(
-            f"cannot resolve {host}.\n"
-            "Public DNS works, so this is name resolution for the internal "
-            "domain: connect to the corporate VPN and run this again.\n"
-            "(The integration suite cannot reach the instance either while "
-            "this fails.)"
-        )
-
-
-def _token(client: httpx.Client, config: dict[str, str]) -> str:
-    """Obtain an access token with the password grant."""
-
-    response = client.post(
-        f"{config['api_url'].rstrip('/')}/token",
-        data={
-            "grant_type": "password",
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-            "username": config["username"],
-            "password": config["password"],
-            "scope": "api",
-        },
-        timeout=30,
-    )
-    response.raise_for_status()
-    return str(response.json()["access_token"])
-
-
-def _walk_timestamps(payload: Any, prefix: str = "") -> list[tuple[str, str]]:
-    """Return every ``(path, value)`` in ``payload`` that looks like a timestamp."""
-
-    found: list[tuple[str, str]] = []
-    if isinstance(payload, dict):
-        for key, value in payload.items():
-            found.extend(_walk_timestamps(value, f"{prefix}.{key}" if prefix else key))
-    elif isinstance(payload, list):
-        for index, value in enumerate(payload[:2]):
-            found.extend(_walk_timestamps(value, f"{prefix}[{index}]"))
-    elif isinstance(payload, str) and _TIMESTAMP.match(payload):
-        found.append((prefix, payload))
-    return found
-
-
-def _report_timestamps(label: str, payload: Any) -> None:
-    """Print every timestamp in one payload and whether it carries an offset."""
-
-    stamps = _walk_timestamps(payload)
-    if not stamps:
-        print(f"  {label}: no timestamp-shaped values found")
-        return
-    for path, value in stamps:
-        aware = bool(re.search(r"(Z|[+-]\d{2}:?\d{2})$", value))
-        verdict = "AWARE (carries an offset)" if aware else "NAIVE (no offset)"
-        print(f"  {label}.{path} = {value!r}  -> {verdict}")
-
-
-#: The three ways this package can now render one moment onto the wire.
-#:
-#: These are not hypothetical spellings -- they are the literal bytes
-#: ``model_to_payload`` produces for a ``PatchTicket(date=...)`` built with a
-#: UTC ``tzinfo``, a ``Europe/Paris`` one, and none at all. Pydantic's JSON
-#: mode writes UTC as ``Z`` and every other zone as a numeric offset.
-#:
-#: ``12:30Z`` is the discriminating case, because it is ``14:30`` in Paris:
-#: a server that honours the offset stores a different wall clock than one
-#: that ignores it, and one read-back separates them. The ``+02:00`` case
-#: cannot discriminate -- it names the same wall clock either way -- but it
-#: does answer whether an offset-bearing string is accepted at all.
-_WRITE_CASES = (
-    ("naive   (control)", "2026-08-01T12:30:00"),
-    ("UTC     (Z form) ", "2026-08-01T12:30:00Z"),
-    ("Paris   (+02:00) ", "2026-08-01T12:30:00+02:00"),
-    ("Tokyo   (+09:00) ", "2026-08-01T12:30:00+09:00"),
-    ("LA      (-08:00) ", "2026-08-01T12:30:00-08:00"),
-    ("Kiritim (+14:00) ", "2026-08-01T12:30:00+14:00"),
-    ("nonsense(+99:99) ", "2026-08-01T12:30:00+99:99"),
-)
-
-
-def _probe_write_offsets(
-    client: httpx.Client,
-    base: str,
-    read_headers: dict[str, str],
-    write_headers: dict[str, str],
-    ticket_id: int,
-) -> None:
-    """Write each spelling of one moment and report what GLPI stored.
-
-    Issue #22 changed outbound serialisation to Pydantic's JSON mode, so an
-    aware ``datetime`` now leaves as ``...+02:00`` or ``...Z`` where it
-    previously left as a live object that ``json.dumps`` refused. That fixed
-    the crash but moved the question rather than answering it: nothing here
-    had ever recorded whether GLPI *accepts* an offset, nor -- the part that
-    matters more -- whether it *honours* one.
-
-    A rejection is loud and harmless. Silent truncation is neither: writing
-    ``12:30Z`` and having 12:30 stored as Paris local time moves the moment
-    two hours with a 200 and no complaint.
-    """
-
-    for label, wire in _WRITE_CASES:
-        patch = client.request(
-            "PATCH",
-            f"{base}/Assistance/Ticket/{ticket_id}",
-            headers=write_headers,
-            json={"date": wire},
-        )
-        if patch.status_code >= 400:
-            print(f"  {label} {wire!r}")
-            print(f"      PATCH -> HTTP {patch.status_code} REJECTED")
-            print(f"      body  -> {patch.text[:200]!r}")
-            continue
-        read = client.get(f"{base}/Assistance/Ticket/{ticket_id}", headers=read_headers)
-        stored = read.json().get("date") if read.status_code < 400 else None
-        print(f"  {label} {wire!r}")
-        print(f"      PATCH -> HTTP {patch.status_code}   read back -> {stored!r}")
-
-
-def main() -> None:
-    """Run every probe and print a report to paste into the issues."""
-
-    config = _load()
-    base = config["api_url"].rstrip("/")
-    _check_reachable(base)
-
-    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
-        token = _token(client, config)
-        # A GET must NOT advertise a JSON content type. GLPI sees the header,
-        # tries to parse the (absent) body, and answers 400 "Contenu du JSON
-        # invalide" -- an error about the request body on a request that has
-        # none. The library avoids this with its `include_content_type` flag,
-        # which is False for GET; the two header sets here mirror that.
-        read_headers = {"Authorization": f"Bearer {token}"}
-        write_headers = {
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-        }
-
-        print("=" * 72)
-        print("PROBE 1 (issue #31) -- datetime wire format")
-        print("=" * 72)
-        for label, path in (
-            ("Ticket", "/Assistance/Ticket?limit=1"),
-            ("User", "/Administration/User?limit=1"),
-            ("KBArticle", "/Knowledgebase/Article?limit=1"),
-        ):
-            response = client.get(f"{base}{path}", headers=read_headers)
-            if response.status_code >= 400:
-                print(f"  {label}: HTTP {response.status_code} -- skipped")
-                continue
-            _report_timestamps(label, response.json())
-
-        print()
-        print("=" * 72)
-        print("PROBE 2 (issue #35) -- what a create returns")
-        print("=" * 72)
-        created_id: int | None = None
-        try:
-            response = client.post(
-                f"{base}/Assistance/Ticket",
-                headers=write_headers,
-                json={
-                    "name": "py_glpi wire-format probe (safe to delete)",
-                    "content": "<p>Automated probe. Deleted immediately.</p>",
-                },
-            )
-            print(f"  status      : {response.status_code}")
-            print(f"  Location    : {response.headers.get('Location', '<absent>')}")
-            print(f"  body bytes  : {len(response.content)}")
-            try:
-                body = response.json()
-            except ValueError:
-                print(f"  body        : <not JSON> {response.text[:200]!r}")
-            else:
-                keys = sorted(body) if isinstance(body, dict) else "<not an object>"
-                print(f"  body keys   : {keys}")
-                print("  body        :")
-                print(json.dumps(body, indent=4, ensure_ascii=False)[:2000])
-                if isinstance(body, dict):
-                    created_id = body.get("id")
-                    print()
-                    print(
-                        "  VERDICT: "
-                        + (
-                            "id only -- a fetch is genuinely needed (#35)"
-                            if set(body) <= {"id", "href"}
-                            else f"{len(body)} fields returned -- the client is "
-                            "DISCARDING a fuller record; fix that instead of "
-                            "adding create_*_and_fetch (#35)"
-                        )
-                    )
-            if created_id:
-                print()
-                print("=" * 72)
-                print("PROBE 3 (#22 follow-up) -- does GLPI honour an offset on write?")
-                print("=" * 72)
-                _probe_write_offsets(
-                    client, base, read_headers, write_headers, created_id
-                )
-        finally:
-            if created_id:
-                # `client.delete(...)` rejects `json=` -- httpx exposes a body
-                # only on `request()`, because DELETE-with-a-body is unusual.
-                # GLPI needs one for `force`, so this must not be "simplified"
-                # back to the convenience method; the library's own
-                # `_delete_request` goes through `session.request` for the
-                # same reason.
-                cleanup = client.request(
-                    "DELETE",
-                    f"{base}/Assistance/Ticket/{created_id}",
-                    headers=write_headers,
-                    json={"force": True},
-                )
-                print()
-                print(f"  cleanup: deleted {created_id} -> {cleanup.status_code}")
-            else:
-                print()
-                print("  cleanup: nothing to delete (no id parsed from the response)")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/integration_tests/test_integration.py b/integration_tests/test_integration.py
index 9b5ac9b..d8df5d5 100644
--- a/integration_tests/test_integration.py
+++ b/integration_tests/test_integration.py
@@ -287,6 +287,10 @@ def test_from_env(
     monkeypatch.setenv("GLPI_USERNAME", live_config.username)
     monkeypatch.setenv("GLPI_PASSWORD", live_config.password)
     monkeypatch.setenv("GLPI_VERIFY_SSL", str(live_config.verify_ssl).lower())
+    # from_env requires it: GLPI does not advertise its own timezone, and
+    # the client refuses to guess one. Missing here, this test failed
+    # before it reached the network.
+    monkeypatch.setenv("GLPI_SERVER_TIMEZONE", live_config.server_timezone)
 
     glpi_client = GlpiClient.from_env()
     try:
diff --git a/pyproject.toml b/pyproject.toml
index 66835b9..b43c7a3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,7 +35,7 @@ exclude = [
 
 [project]
 name = "glpi-python-client"
-version = "0.4.3"
+version = "0.5.0"
 description = "A typed Python client for GLPI ITSM APIs."
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/skills/glpi-client-setup/SKILL.md b/skills/glpi-client-setup/SKILL.md
index aef3468..0e2598f 100644
--- a/skills/glpi-client-setup/SKILL.md
+++ b/skills/glpi-client-setup/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to a GLPI v2 API, and valid GLPI credentials."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Client Setup
@@ -197,9 +197,18 @@ with GlpiClient.from_env(
   raise `GlpiAuthError` (401/403), `GlpiNotFoundError` (404),
   `GlpiServerError` (persistent 5xx),
   `GlpiTransportError`/`GlpiTimeoutError` (network fault) or
-  `GlpiProtocolError` (unusable 2xx body). Do not catch `requests`
-  exceptions — `requests` is not a dependency — and do not catch
-  `tenacity.RetryError`; the retry decorators re-raise the real error.
+  `GlpiProtocolError` (unusable 2xx body). Reading a rich-text body that
+  cannot be converted raises `GlpiContentError` — note that this comes
+  from the attribute read (`ticket.content`), not from the call that
+  fetched the record, because response models convert on first read. Do
+  not catch `requests` exceptions — `requests` is not a dependency — and
+  do not catch `tenacity.RetryError`; the retry decorators re-raise the
+  real error.
+- `GlpiContentError` and `GlpiTransportError` are the two leaves that do
+  **not** also inherit `ValueError`; `GlpiStatusError`,
+  `GlpiValidationError` and `GlpiProtocolError` do, for compatibility
+  with releases that raised bare `ValueError`. So `except ValueError:`
+  catches most of the hierarchy but not all of it — catch `GlpiError`.
 - A small set of raise sites is deliberately **outside** that hierarchy,
   so `except GlpiError:` will not catch them. Plain `RuntimeError`:
   using a closed client; a v1-backed call on a client built without
diff --git a/skills/glpi-document-workflow/SKILL.md b/skills/glpi-document-workflow/SKILL.md
index bb93d36..4fe0272 100644
--- a/skills/glpi-document-workflow/SKILL.md
+++ b/skills/glpi-document-workflow/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and v1 credentials configured on the client for binary uploads."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Document Workflow
diff --git a/skills/glpi-knowledge-base/SKILL.md b/skills/glpi-knowledge-base/SKILL.md
index 43bd1dc..146d747 100644
--- a/skills/glpi-knowledge-base/SKILL.md
+++ b/skills/glpi-knowledge-base/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and — for category writes only — a legacy v1 session (v1_base_url + v1_user_token)."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Knowledge Base
@@ -164,6 +164,8 @@ await client.delete_kb_article(42, force=True)
 - `language` has two different mechanics in this family. On `search_kb_articles`/`search_kb_categories` it is a **query parameter**. On `list_kb_article_revisions`/`get_kb_article_revision` it is a **path segment** between the id and `Revision` (`Knowledgebase/Article/5/fr_FR/Revision`). `get_kb_article`, the comment helpers and every write helper take no `language` at all; they inherit the client-level value, sent as `Accept-Language` (default `en_GB`).
 - KB write models use `IdNameRef` for every foreign key -- `categories[]`, `entity`, `user`, `parent` -- not `IdRef`. Passing `IdRef(id=4)` raises a pydantic `ValidationError`. (`GetKBArticleComment.parent` is the one KB field genuinely typed `IdRef`, and it is read-only.)
 - Article `content`/`description` and revision `content` are Markdown on the Python side and HTML on the wire; the conversion is automatic, so never author HTML. Comment `comment` is a plain `str` with no conversion at all -- the inconsistency is real, not an omission here.
+- On the **read** models the conversion is lazy. `GetKBArticle` stores `content_html`/`description_html` (the server's HTML verbatim, also accepting the wire spellings `content`/`description` on construction) and exposes `content`/`description` as cached properties that convert on first read; `GetKBArticleRevision` is the same with `content_html`. Reading `.content` is unchanged, but `search_kb_articles` and `list_kb_article_revisions` now convert nothing until a body is read -- which matters most here, because article search returns whole bodies and revision history returns every past one. Write models (`PostKBArticle`/`PatchKBArticle`) still convert eagerly and keep the plain `content`/`description` field names.
+- HTML too deeply nested for the converter to walk is **stripped to text instead of converted** -- every character the normal rendering would have produced, none of the Markdown structure, and no exception. The conversion is attempted rather than the depth predicted, so the limit is whatever stack is left at the call site (about 494 levels from a shallow one). Any other conversion failure raises `GlpiContentError`, from the `.content` read rather than from the search call.
 - `force` on `delete_kb_article`, `delete_kb_category` and `delete_kb_article_comment` is keyword-only and is serialised into the JSON request **body** via the matching `Delete*` model, not sent as a query parameter. `force=True` deletes permanently; omitting it or passing `False` moves the record to the GLPI trash.
 - Revisions are read-only: there is no create/update/delete helper and no Post/Patch/Delete revision model. A revision appears as a side effect of updating an article. `get_kb_article_revision(article_id, revision)` takes the revision **number** (`GetKBArticleRevision.revision`), not the row `id` -- the two differ on the model.
 - `GetKBArticle.revisions` and `.translations` hold two *different* private ref classes (leading underscore, not exported from the package root). Read their attributes; never import them. The two field sets are not interchangeable: a `revisions` entry has `.id`, `.revision`, `.language`, `.date`, while a `translations` entry has `.id`, `.language`, `.name`. `revisions[0].name` raises `AttributeError` -- the models allow unknown keys from the server, but that does not synthesise an attribute that was never sent.
diff --git a/skills/glpi-plugin-fields/SKILL.md b/skills/glpi-plugin-fields/SKILL.md
index f3bdcdb..e979583 100644
--- a/skills/glpi-plugin-fields/SKILL.md
+++ b/skills/glpi-plugin-fields/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, the GLPI Fields plugin installed server-side, and a legacy v1 session (v1_base_url + v1_user_token) — every method in this family goes over the v1 API."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Plugin Fields
@@ -191,7 +191,7 @@ async def upsert_plugin_field_row(
 - A container that has never had a value saved for that ticket is **silently absent** from the `get_ticket_custom_fields` result -- you do not get `{"container": {}}`. Use `result.get(name, {})`, never `result[name]`. An empty overall dict is **ambiguous**: `get_ticket_custom_fields` builds its result by skipping every container with no persisted row, so `{}` comes back both when the instance declares no Ticket containers at all and when it declares several but this ticket has saved nothing in any of them. The return value cannot tell you which -- call `list_plugin_fields_containers(itemtype="Ticket")` if you need to know.
 - Both discovery listings fetch **one fixed page, `range=0-999`**, with no pagination and no server-side filtering. The `itemtype` and `container_id` narrowing happens client-side *after* that cap, so an instance with more than 1000 containers or field declarations silently loses the tail -- possibly including the container you are looking for.
 - Neither listing filters on `is_active`, so **disabled containers and disabled or read-only fields come back from discovery looking exactly like live ones**. `set_ticket_custom_fields` accepts a field whose `is_readonly` is `True`, because its guard only checks that the name is declared. Check `container.is_active`, `field.is_active` and `field.is_readonly` yourself.
-- Values are transmitted **verbatim -- there is no HTML/Markdown conversion on this path**, unlike ticket and KB article content. A `richtext` field takes raw HTML (`"<p>test</p>"`). Convert yourself if you want Markdown: `GlpiContentConverter` is not exported from the package root, import it from `glpi_python_client.content`.
+- Values are transmitted **verbatim -- there is no HTML/Markdown conversion on this path**, unlike ticket and KB article content. A `richtext` field takes raw HTML (`"<p>test</p>"`). Convert yourself if you want Markdown: `GlpiContentConverter` is not exported from the package root, import it from `glpi_python_client.content`. Calling it directly puts you on the same two rules the models get: HTML too deeply nested for the converter to walk comes back **tag-stripped rather than converted** (every character the normal rendering would have produced, none of the structure, no exception), and any other failure raises `GlpiContentError`.
 - The two convenience helpers are **Ticket-only** -- the itemtype is hardcoded. There is no `get_item_custom_fields` and no `set_item_custom_fields`. For Computer, Problem, Change and the rest, drive the generic row helpers.
 - Parameter-passing style is inconsistent across the family, and only one half of it is a rule. `list_item_plugin_field_rows(itemtype, items_id, container_name)` declares ordinary `POSITIONAL_OR_KEYWORD` parameters, so both `("Ticket", 1234, "extrainfo")` and `(itemtype="Ticket", items_id=1234, container_name="extrainfo")` are legal -- the examples above pass them positionally by choice, not by requirement. `create_item_plugin_field_row` and `update_item_plugin_field_row` are genuinely **keyword-only** (`*` in the signature): calling either writer positionally is a `TypeError`.
 - Error taxonomy on the write path: an unknown container name or an unknown field name raises `GlpiValidationError`; a container the server returned without an `id`, or a create whose v1 reply carries no numeric row id, raises `GlpiProtocolError`. Both inherit `ValueError`. A missing v1 session raises a plain `RuntimeError`, and a non-success v1 status raises `GlpiStatusError` (with `.status_code`, `.url` and `.response_text`).
diff --git a/skills/glpi-reporting-and-context/SKILL.md b/skills/glpi-reporting-and-context/SKILL.md
index 6a1055c..427d595 100644
--- a/skills/glpi-reporting-and-context/SKILL.md
+++ b/skills/glpi-reporting-and-context/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials allowed to read tickets, tasks, users, entities, and timeline records."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Reporting And Context
@@ -25,7 +25,7 @@ Returned identifiers are raw GLPI numeric values; resolve them with the appropri
 ## Procedure
 
 1. Create a client (`GlpiClient` or `AsyncGlpiClient`) with the correct entity/profile scope.
-2. For one ticket, call `await client.get_ticket_context(ticket_id)` and read `bundle.ticket`, `bundle.tasks`, `bundle.followups`, `bundle.solutions`, and `bundle.documents`. To render the whole bundle as one Markdown transcript (ticket title, subtitle metadata, description, chronologically sorted timeline, linked documents), call `bundle.to_markdown()`. Pass a `TicketMarkdownOptions` to drop sections or metadata, e.g. `bundle.to_markdown(TicketMarkdownOptions(include_documents=False, show_dates=False))`; all 17 flags default to `True`, so a bare `to_markdown()` emits everything. Both `GlpiTicketContext` and `TicketMarkdownOptions` are exported from `glpi_python_client`.
+2. For one ticket, call `await client.get_ticket_context(ticket_id)` and read `bundle.ticket`, `bundle.tasks`, `bundle.followups`, `bundle.solutions`, and `bundle.documents`. To render the whole bundle as one Markdown transcript (ticket title, subtitle metadata, description, chronologically sorted timeline, linked documents), call `bundle.to_markdown()`. Pass a `TicketMarkdownOptions` to drop sections or metadata, e.g. `bundle.to_markdown(TicketMarkdownOptions(include_documents=False, show_dates=False))`; all 17 flags default to `True`, so a bare `to_markdown()` emits everything. Both `GlpiTicketContext` and `TicketMarkdownOptions` are exported from `glpi_python_client`. Note that `to_markdown()` is where the bodies are actually converted from GLPI's HTML — the read models convert on first read — so it is the call that pays for that and the call a `GlpiContentError` would surface from, not `get_ticket_context`.
 3. For ticket counts, call `await client.get_ticket_statistics(start_date=..., end_date=..., default_days=..., entity_id=..., entity_name=..., extra_filter=...)`. All keyword arguments are optional; the default window is the last 30 days ending today.
 4. For task duration totals on a known ticket list, call `await client.get_task_statistics(ticket_ids)`. For an end-to-end "duration over a window with filters" report, call `await client.get_task_durations(...)` instead; it gathers the ticket IDs internally.
 5. For a per-user activity report, call `await client.get_user_activity(username=..., start_date=..., end_date=...)`. Supply at least one of `user_id`, `username`, `realname`, `firstname`.
diff --git a/skills/glpi-team-members/SKILL.md b/skills/glpi-team-members/SKILL.md
index bfcc1db..7f1a070 100644
--- a/skills/glpi-team-members/SKILL.md
+++ b/skills/glpi-team-members/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials allowed to manage ticket teams."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Team Members
diff --git a/skills/glpi-ticket-timeline/SKILL.md b/skills/glpi-ticket-timeline/SKILL.md
index bb59cf1..7e70892 100644
--- a/skills/glpi-ticket-timeline/SKILL.md
+++ b/skills/glpi-ticket-timeline/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, and network access to the GLPI v2 API."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Ticket Timeline
@@ -119,6 +119,7 @@ await client.update_ticket_timeline_document(
 - The live GLPI v2 server returns each timeline list entry wrapped in `{"type": ..., "item": {...}}` even though the OpenAPI contract documents a flat array. The client unwraps that envelope transparently for the four `list_*` helpers; you receive plain `Get<Entity>` instances. For the document family that entity is `GetDocument` -- the full `/Management/Document` record with `filename`, `mime`, `filepath`, `sha1sum` -- and not `GetTimelineDocument`, which is exported from the package root but is never returned by any client method. `get_ticket_timeline_document` returns `GetDocument` for the same reason. The other three are `list_ticket_followups` -> `GetFollowup`, `list_ticket_tasks` -> `GetTicketTask`, `list_ticket_solutions` -> `GetSolution`.
 - `create_*` methods return new identifiers as plain `int`. `update_*` and `delete_*`/`unlink_*` return `None`.
 - Three enums carry this family's value vocabularies, all exported from `glpi_python_client` and all subclasses of `GlpiEnum` (itself an `IntEnum`, so a member serialises as its number and compares equal to one): `GlpiTaskState` on `PostTicketTask.state`/`PatchTicketTask.state` (`INFORMATION = 0`, `TODO = 1`, `DONE = 2` -- note `INFORMATION` is `0`, so `if task.state:` is false for it; test against `None`), `GlpiSolutionStatus` on `PostSolution.status`/`PatchSolution.status` (`NONE = 1`, `WAITING = 2`, `ACCEPTED = 3`, `REFUSED = 4`), and `GlpiTimelinePosition` on `timeline_position` (`INVALID = -1`, `NONE = 0`, `LEFT = 1`, `RIGHT = 2`, `LEFT_BIG = 3`, `RIGHT_BIG = 4`), which the followup, task and document models carry -- the solution models do not have the field at all.
-- Timeline `content` fields are Markdown on the Python side, not HTML. `PostFollowup`/`PostTicketTask`/`PostSolution` render Markdown to GLPI's HTML on serialisation, and `GetFollowup`/`GetTicketTask`/`GetSolution` convert the server's HTML back to Markdown on validation -- so `record.content` is always Markdown (`GetFollowup(content="<p>Hello <strong>world</strong></p>").content == "Hello **world**"`). Authoring raw HTML is not an error but is round-tripped through the Markdown converter and can be reshaped; write Markdown.
+- Timeline `content` fields are Markdown on the Python side, not HTML. `PostFollowup`/`PostTicketTask`/`PostSolution` render Markdown to GLPI's HTML on serialisation. On `GetFollowup`/`GetTicketTask`/`GetSolution` the field is `content_html` -- the server's HTML verbatim -- and `content` is a cached property that converts it on **first read**, not on validation (`GetFollowup(content="<p>Hello <strong>world</strong></p>").content == "Hello **world**"` still holds; the wire spelling `content` is accepted as a validation alias). So `record.content` is always Markdown, but `list_ticket_followups` converts nothing until you read a body, and a body that cannot be converted no longer breaks the whole list. Authoring raw HTML on a write model is not an error but is round-tripped through the Markdown converter and can be reshaped; write Markdown.
+- HTML too deeply nested to walk is **stripped to text instead of converted**: `markdownify` recurses per level and dies around 494 from a shallow stack. The conversion is attempted rather than the depth predicted, so the real limit is whatever stack is left at the call site. Every character the normal rendering would have produced still appears, but structure does not: link targets, image alt text and code fencing are gone. Nothing raises. Any other conversion failure raises `GlpiContentError` -- from the `.content` read, not from the `list_*` call. Note that `GlpiTicketContext.to_markdown()` is usually the first thing to read every body, so it is where such an error surfaces.
 - Extra server fields (e.g. plugin keys) flow into `record.extra_payload` rather than raising.
 - `delete_ticket_*` and `unlink_ticket_timeline_document` accept a keyword-only `force` parameter; pass `force=True` to permanently delete.
\ No newline at end of file
diff --git a/skills/glpi-ticket-workflow/SKILL.md b/skills/glpi-ticket-workflow/SKILL.md
index fa1b317..bb986b5 100644
--- a/skills/glpi-ticket-workflow/SKILL.md
+++ b/skills/glpi-ticket-workflow/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials accepted by GlpiClient."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Ticket Workflow
@@ -30,7 +30,7 @@ Search open tickets:
 tickets = await client.search_tickets("is_deleted==false;status==1", limit=20)  # v2 search returns trashed tickets unless `is_deleted` is pinned
 ```
 
-Create a ticket. Content fields accept Markdown and are converted to GLPI's HTML transport format transparently:
+Create a ticket. Content fields accept Markdown and are converted to GLPI's HTML transport format transparently (reading is the mirror image but lazy — see the `content_html` note below):
 
 ```python
 from glpi_python_client import PostTicket
@@ -73,6 +73,8 @@ ticket = PostTicket(
 - `search_tickets` accepts a raw RSQL filter string; pagination is via the keyword-only `limit` and `start` (it also takes `sort` and `fields`). To walk a whole result set use the batch iterator `iter_search_tickets(rsql_filter, batch_size=50, sort=..., fields=...)`, which advances `start` itself and yields one `list[GetTicket]` page per step, stopping when a page comes back shorter than `batch_size` — `async for batch in client.iter_search_tickets(...)` on `AsyncGlpiClient`, `for batch in client.iter_search_tickets(...)` on `GlpiClient`.
 - **`search_tickets` and every other `search_*` raise `GlpiStatusError` on a 4xx.** This changed: they used to check the response status only when the caller passed a `failure_message`, which none of the seven `search_*` helpers does, so a GLPI error body was coerced to `[]` and a malformed RSQL filter, a 403, a missing route and a genuinely empty result set were indistinguishable. `_resource_list` now checks the status on every call, so **an empty list means the server said the result set is empty**. The iterators inherit that: a 4xx raises instead of making the first page short and ending the walk silently. Note the *other* fail-open path is unchanged and still bites -- GLPI v2 ignores a filter field it does not recognise and answers 200 with the whole unfiltered table, so a filter that returns rows is still not proof it was applied.
 - `create_ticket` returns the new ticket ID. `update_ticket` and `delete_ticket` return `None`.
+- **`GetTicket` has no `content` field; it has `content_html` and a `content` property.** `content_html` holds the server's HTML verbatim (and accepts the wire spelling `content` on construction); `content` is a cached property that converts it to Markdown on **first read**, not on validation. Reading `ticket.content` is unchanged and still gives Markdown, so read-side code needs no edit — but `search_tickets` now converts nothing until a body is read, and a body that cannot be converted no longer breaks the rest of the page. Two things do change if you were relying on them: `"content" not in GetTicket.model_fields`, and `GetTicket(...).model_dump()` emits `content_html` with HTML where it used to emit `content` with Markdown (`by_alias=True` gives you the GLPI key). `PostTicket`/`PatchTicket` are untouched: plain `content` field, converted eagerly.
+- HTML too deeply nested to walk is **stripped to text rather than converted** — `markdownify` recurses about twice per nesting level and dies around 494 from a shallow stack. The converter attempts the conversion and answers the `RecursionError` rather than predicting the depth, so the real limit is whatever stack is left at the call site, and the same body can convert from one and degrade from a deeper one. It degrades rather than truncating — every character the normal rendering would have produced still appears — but structure does not survive: link targets, image alt text, code fencing and `<pre>` indentation are gone. Anything else that goes wrong converting a body raises `GlpiContentError`, from the attribute read rather than from `get_ticket`. Treat a fetched ticket as immutable afterwards: the conversion is cached, so assigning to `content_html` (or `model_copy(update={"content_html": ...})`) leaves stale Markdown on `.content` with nothing in `repr`, `==` or `model_dump` to show it.
 - The GLPI server is the authoritative validator. Extra keys returned by the server flow into `ticket.extra_payload` rather than raising. Caller-provided `extra_payload` keys win on conflicts.
 - **`status` is writable, on `PatchTicket` only.** `client.update_ticket(tid, PatchTicket(status=GlpiTicketStatus.PENDING))` moves the ticket. This corrects an earlier claim in this skill that the field was read-only: GLPI's own contract publishes `Ticket.status.id` as `readOnly: true`, and that is simply wrong — a live GLPI 11 instance honours the `PATCH`. The same contract omits the `Major` level from `priority`, so treat it as a hint, not an authority. Two things it does *not* cover: `POST` **ignores** `status` (201, then the ticket reads back as `New`), which is why the field is declared on `PatchTicket` and not on `PostTicket`; and `status_id` is silently dropped, so use `status`. Posting a solution still moves the ticket to `SOLVED` on its own and remains the better call when there is a resolution to record — a bare status change leaves no trace of why.
 - **Key on `status.id`, never on `status.name`.** The id set is hardcoded in GLPI's core — there is no `TicketStatus` itemtype (the v1 API answers 400 for it, while `ITILCategory` and `RequestType` return instance rows), and `listSearchOptions` reports `status` as `{"table": "glpi_tickets", "datatype": "specific"}`, i.e. a column of the tickets table rather than a foreign key into a configurable one. An administrator cannot add or rename a status. The **labels** are another matter: they are translations, so the same id reads back as `"Nouveau"` on a French instance and `"New"` on an English one. The ids `7`, `8`, `9`, `11`–`14` exist but belong to the sibling ITIL types, and they are literal integers in GLPI's source: `CommonITILObject` declares `INCOMING = 1` through `OBSERVED = 8` plus `APPROVAL = 10`, and `Change` adds `EVALUATION = 9`, `TEST = 11`, `QUALIFICATION = 12`, `REFUSED = 13`, `CANCELED = 14`. Each type's `getAllStatusArray()` is a hardcoded PHP array mapping those constants to *translated* labels — no database, no config table. The set is therefore coupled to the GLPI *version*, not to the instance.
diff --git a/skills/glpi-user-location-provisioning/SKILL.md b/skills/glpi-user-location-provisioning/SKILL.md
index 742de53..caab841 100644
--- a/skills/glpi-user-location-provisioning/SKILL.md
+++ b/skills/glpi-user-location-provisioning/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials allowed to read or write users, locations, and entities."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI User, Location, And Entity Provisioning