`CHANGES2.md`

20 lines

## Round 2 Applied

- `dashboard.js:17` — changed `escapeHtml` to preserve numeric `0`, and added `formatMoney()` — fixes rereview concern that `String(s || "")` collapses zero values.
- `dashboard.js:62` — escaped stored `r.price.mid` before card `innerHTML` insertion — fixes rereview missed call-site `dashboard.js:59`.
- `browse.js:7` — changed `escapeHtml` to preserve numeric `0`, and added `formatMoney()` — fixes rereview concern that `String(s || "")` collapses zero values.
- `browse.js:66` — escaped stored `r.price.mid` before browse card `innerHTML` insertion — fixes rereview missed call-site `browse.js:63`.
- `rental.js:35` — changed `escapeHtml` to preserve numeric `0`, and added `formatMoney()` — fixes rereview concern/new issue around numeric display.
- `rental.js:142` — escaped stored `price.mid` in trailer outro pricing — fixes rereview missed call-site `rental.js:139`.
- `rental.js:424` — passed escaped `address.city` into dynamic guide heading templates while preserving intended `<br>` markup — fixes rereview missed call-site `rental.js:422`.
- `rental.js:459` — passed escaped `address.city` into dynamic history heading templates while preserving intended `<br>` markup — fixes rereview missed call-site `rental.js:459`.
- `rental.js:622` — escaped stored `price.mid`, `price.low`, `price.high`, and `baseline.base` in the price card — fixes rereview missed call-site `rental.js:619`.
- `signup.js:147` — added HTML/attribute escaping helpers for signup dynamic HTML — supports the rereview signup and autocomplete findings.
- `signup.js:240` — escaped submitted/geocoded signup status fields before `setStatus(...innerHTML...)` — fixes rereview missed call-site `signup.js:226`.
- `signup.js:328` — escaped Nominatim autocomplete `data-val`, line 1, and line 2 fields before `innerHTML` insertion — fixes rereview missed call-site `signup.js:312`.

## Still Deferred

- No database schema, migrations, infrastructure, package, public copy/CSS, or real-secret changes were touched.
- Broader XSS cleanup outside the specific rereview P0/BROKEN/concern list remains for Steve if desired.