kerfmaster pin list · The interface — recorded intent (build later)
recordStates what the code does today. Auditable against the code — this is the only type that can go stale.
Content last changed 2026-09-01 — computed from the item itself, not typed.
Aristide 2026-09-01 (“go with your lean”, on the systems-test findings): a name is pure text, everywhere. The systems test proved a job named <i>pierce probe</i> rendered its markup RAW on customer.html, packet.html, the board build page and the Jobs home (innerHTML) — stored HTML injection via a customer-controlled filename.
server._esc escapes at the render boundary; _pname/_cust_par wrap the customer's own part name in span.pname so the vocabulary census can exempt EXACTLY those occurrences (scoped exemption — never a global string strip). Escaped: part name, material, machine, onum_source, findings/anomaly text on customer sheet, floor packet, board page, nest packet, nest board page. Sentence DATA stays raw plain text (packet.json unchanged) — escaping happens only at render, per data-in-JSON/generator-separate. The nest part-map CSV quotes a part name carrying comma/quote/newline so columns never shift.
app.js's existing esc() now also covers the Jobs-home card name, the intake file/units rows, every blocked-stage “engine said” render and the findings messages (engine strings can embed typed values).
test_customer.py controls 20–26 (escape on all four pages, scoped census, anchor-in-name is text, real anchor still refuses) + live: hostile-name job delivered — board build 181 carries zero raw tags, Jobs home shows the name as literal text; verify_customer.js 16 live checks pass comparing verbatim quotes at text level. Defect caught in the build: the CSV variable shadowed run_delivernest's pn postnest document — renamed, caught by the live verify before commit.