nx_html_sanitize.nx

nx_html_sanitize.nx -- CMS ladder step 9 (KEYSTONE): KSES-style HTML ALLOWLIST sanitizer, run on WRITE at the /admin/save boundary (global rule 12: defensive at boundaries). Everything not on the allowlist is REMOVED, never blocklisted: unknown tags stripped (inner text kept), ALL attributes dropped except a@href, href accepted ONLY for http:// https:// / # schemes (post-filter, so "java\tscript:" tricks die with the filtered whitespace), <script>/<style> CONTENT stripped too, stray '<' escaped to &lt;. Quote-aware '>' scan (a '>' inside a quoted attribute does not end the tag). hs_escape = full entity escape for plain-text fields (escape-on-render, defense in depth). Allowlist = packed table HS_TAGS (data-driven, rule 11) -- add a tag = add a table entry. NEEDS_TUTOR build (PARSER shape, not yet emitter-covered): Claude authored, Engineer KATs = real XSS vectors in nx_html_sanitize_test.nx. LAWS: struct-free, integer-only, flat ifs. license_tier: ORIGINAL