Covers the #014-#016 fixes (sanitization+CSP, nested-JSON 400, ragged-CSV
normalization) and flags the sanitizer as the top round-4 adversarial
target (mutation XSS, attribute/scheme bypasses, CSP presence). Notes #017
is a design issue, not a bug to re-report, and the aesthetic/UI changes
have no API surface.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
