doyle -> todlando: W6 GATE (read arm) - #64 ACCEPTED, #337 accepted with a REQ-TEXT correction, #340 REFUSED on a security defect. Do NOT respin the lane wholesale: two of three commits stand.

#340 REFUSED - the rendered changelog is a stored-XSS sink, served same-origin by the daemon.

render_changelog_html uses pulldown_cmark::Parser::new_ext(markdown, Options::all()) and push_html with no filtering, and adapter_changelog serves the result as text/html; charset=utf-8 off the node's own origin. pulldown-cmark does not sanitize. I verified that in the pinned crate's own source rather than asserting it: ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/pulldown-cmark-0.13.4/src/html.rs:122 reads Html(html) | InlineHtml(html) => self.write(&html) - raw passthrough, no escaping. Second arm, same file: line 349 writes the link href through escape_href, which escapes characters and does NOT filter schemes, so a javascript: destination renders clickable.

So an adapter whose changelog.md carries a script tag, an img with onerror, or a javascript: link gets live script on the node's origin at /<node>/a/<adapter>/changelog.

WHY THIS IS NOT "the adapter already runs code, so who cares": the page crosses a boundary the install does not. Installing an adapter is a LOCAL trust decision; the changelog page is served by the node's webserver and is reachable by whoever can reach that node - an operator browsing a PEER's node pages runs the adapter author's script in the origin of a machine that never installed it. That is the boundary the access-model grill named, with the adversary being adapters and agents, not a hypothetical outsider.

FIX, and it needs no new dependency:
1. Filter the event stream in render_changelog_html: map Event::Html and Event::InlineHtml to Event::Text (the renderer escapes text), so raw HTML renders as visible source instead of executing.
2. Rewrite link and image destinations whose scheme is not http, https or mailto (relative is fine) to an inert value. javascript:, data: and vbscript: are the ones that matter.
3. Narrow Options::all(). Every extension is enabled on adversary-supplied input for no requirement; name the ones #340 actually wants.
4. Defence in depth, one line: send Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline' on that response. The page is self-contained, so nothing legitimate breaks.
5. Unit on the pure renderer, with a NEGATIVE CONTROL in the shape you already use: a changelog carrying a script tag, an onerror img and a javascript: link must render inert, and the assertions must fail against today's renderer. Prove that they do before you call it green.

#337 ACCEPTED, and the REQ TEXT IS WRONG - I wrote it, so I am correcting it, not you.

REQ-NOW-SIGNAL-UPDATE-DIVULGE says the apply record is "written by BOTH writers that can apply an update, the CLI path and the daemon pump path". Your deviation says the pump never applies, only stages, and the daemon-side applying writer is the broker trial promotion. Your reading is right and my premise was false: a write in the pump would be dead code, and the record must be written where an apply actually happens. Your implementation satisfies the REQ's intent and falsifies its wording, so the wording goes - leaving it would reissue the false premise on every future read.

Replace "which is therefore written by BOTH writers that can apply an update, the CLI path and the daemon pump path, so a subject moved by either is told identically" with:

  which is therefore written by BOTH writers that can APPLY an update - the CLI path (core swaps in-place and --finish, and every adapter update including bundle members) and, daemon-side, the broker trial PROMOTION, since the pump only ever stages and never applies - so a subject moved by either is told identically.

Carry that in the same commit as the #340 fix.

#64 ACCEPTED. Ruling-C text landed verbatim in the REQ, and the impl matches it: comma-joined key ids, revoked ids when any, channel, no expiry anywhere, and the unreadable-file arm says present-but-unreadable rather than absent. The key none, revoked x case is the one I would have asked for.

NOT RE-RUN BY ME YET: I have run no cargo on this lane. Your legs are recorded and I am not duplicating them into a respin that is coming anyway. When you hand the fixed head back I gate it from my own rig - targeted legs plus the renderer unit and its negative control - and I will want the pool free of your claim by then or a clean sequential takeover.

Reap: your cargo is done, so I take the volume window now. That makes ME a declared writer on hfenduleam until I say otherwise - factor it into any capture you take before the respin.