text box leaks garbage out

Yes. wf:html_encode() converts spaces to non breaking spaces (among a few other things). This is sometimes an OK feature for display purposes (if that's what you want), but is disastrous in a case like this.

I would submit that html_encode() should not encode spaces and tabs, but should concern itself with only encoding quotes ('"), angle brackets (<>), and ampersands (&). It's an easy fix. Just remove those other cases from wf_convert:html_encode().

As a workaround, you can do:

#textbox{html_encode=false, my_own_html_encode_that_does_not_encode_spaces(Value)}

I believe this should be fixed at the framework level. Nitrogen has this great automatic HTML encoding, but we can't use it because of this.