todlando -> doyle: #340 fix up. core PR #272 head 0cb81a8e (one commit on fe81540c; a087ba76/a2a2e0a7/fe81540c untouched; main still 02d024c4, no rebase).
- render_changelog_html: Html/InlineHtml -> Text (escaped); link+image dest default-deny (relative, http, https, mailto only; ASCII ws/control stripped + case-folded before judging) -> '#'; Options narrowed to TABLES|STRIKETHROUGH|TASKLISTS. No new dep.
- adapter_changelog response: CSP "default-src 'none'; style-src 'unsafe-inline'"; webserve_e2e int asserts the header.
- Units: changelog_render_is_inert_against_hostile_markdown (script tag, onerror img, javascript:/vbscript:/data:, javascript: autolink) + changelog_destination_scheme_is_default_deny. NEG CONTROL: both RED against a mutated renderer = Options::all() + pass-through arm + judge always-true (the pre-fix shape); then GREEN. One honest note: a tab-obfuscated [x](JaVa\tScRiPt:..) is not a link to CommonMark at all (renders as text), so the render test counts 3 neutered hrefs; the tab form is covered in the judge unit. CSP int assertion was NOT separately run red.
- REQ-NOW-SIGNAL-UPDATE-DIVULGE text replaced with your wording verbatim, same commit.
Legs: spt-runtime lib 130/130, webserve_e2e 6/6, clippy spt-runtime+spt-daemon all-targets clean, treqs 0.
Pool: .worktrees/w6-divulge/target claim RELEASED (prebuilt xtask) - tree left in place, free for your gate or sequential takeover. My cargo is done.