it appears I've answered my own question with AI
Here is exactly why osTicket makes the &# combination disappear:
The "Under the Hood" Explanation
The Meaning of &#: In web development, the &# sequence isn't just two random characters—it is the universal starting code for an HTML numeric character reference (an HTML entity). For example, ' creates an apostrophe ('), and © creates the copyright symbol (©).
osTicket's Security Filter: osTicket allows users to submit rich text (bolding, lists, images) in tickets. To prevent hackers from injecting malicious scripts (a type of attack called Cross-Site Scripting, or XSS), osTicket runs all ticket text through a strict HTML purification library called htmLawed (specifically triggered in their class.format.php file).
The "Malformed Entity" Trigger: When you type &# next to each other, the htmLawed sanitizer immediately thinks, "Ah, the user is trying to write an HTML entity here." It then looks for the numbers and the closing semicolon (😉 that are supposed to follow it.
The Disappearance: Because you just typed &# with no numbers or semicolon after it, the sanitizer flags it as a malformed or broken HTML entity. Security sanitizers are designed to be extremely paranoid. Instead of guessing what you meant, the safest thing for the sanitizer to do is completely strip the broken code out of the database so it doesn't accidentally break the page layout or create a security vulnerability.
How to Get Around It
Because this happens at the core sanitization level before the ticket is saved to the database, you have to trick the editor into not seeing it as an HTML entity.
Add a space: As you've noticed, typing & # breaks the sequence, so the sanitizer just sees standard text.
Use the code block: If you are pasting code or technical instructions, wrapping the text in a code block (using the </> button in the osTicket formatting bar) sometimes tells the system to escape the characters properly.
Manually escape the ampersand: In some modes, if you type &#, the system will render the ampersand safely without triggering the entity check.
