[muse-sweep][Task] XSS uncited-sink triage: 22 innerHTML hits outside cited lines

[mattmre]

Task (R1-XSS + R2-XSS, censused live). dashboard/index.html (1225 lines): 26 innerHTML hits, zero outerHTML/document.write/.html(. Cited (interpolation, tracked): :516-517 (P2-02), :537-541 (P2-03), :855-858 (P1-11), :951/:954 sweep-table family. Uncited to triage (22): :522,532,547,578,619,650,668,696,714,738,761,775,793,817,891,911,951,954,1090,1091,1133,1138,1141 - R1 notes these read as static-literal or = '' clears; tail cluster :1090-1141 needs eyes. R1-FE adds candidate :1166 log-only catch (loadBeirResults leaves board stale) - confirm.
Fix: read each, file only attacker-influenced interpolations; record the rest as cleared with reason.
Source: Muse EGV R1+R2 panels 2026-09-02.

[mattmre]

Triage update (operator live read 2026-09-02, dashboard/index.html): tail cluster :1090,1091,1133,1138,1141 CLEARED - all are innerHTML = '' clears, static literals, or textContent-built DOM (BEIR heatmap/detail tables). No new interpolation sink. Remaining open: :1166 log-only catch (loadBeirResults console.error-only, stale prior render persists - Low, same class as P1-08/09) + val.toFixed on possibly-undefined values feeding that catch. Recommend: clear :1166 with explicit board-error state, then close this task.