-
GO-30-CSP W2+W3: migrate all inline on* handlers to delegated dispatch
-
Frontend cold spots R4: escapeHandlerArg sweep + gate rule, email preview to Rust
-
Frontend XSS: seal the unsafe attribute escaper (CHRONIC-XSS)
-
Wire Saved Views frontend; humanize stray error sites