fix(drawer): three regressions from PR #338 — client-side sanitizer crash + HTP card bypassed sanitizer + STORIES header still first-person

[mitwilli-create]

Summary

Three regressions from PR #338 discovered via live Chrome MCP audit on 2026-05-30 (same session, drawer-quality follow-up).

The 3 fixes

1. Client-side sanitizer crash (CRITICAL — broke entire COMP INTELLIGENCE section)

_renderHMIntel runs in BROWSER context (emitted as inline <script>). PR #338 wired d = sanitizeObjectStrings(d) inside it, but sanitizeObjectStrings is a Node-side import at the top of build-dashboard.mjs — server-side only. At runtime the browser threw Error: sanitizeObjectStrings is not defined, replacing the COMP INTELLIGENCE section with that error string.

Fix: removed the client-side call. Server-side sanitization on the richSummary build pass (from PR #338) stays active and is extended to renderHowToPosition (see fix 2).

2. HTP card bypassed sanitizer (load-bearing for "Nivel detectado:" removal)

The posCard at line 3586 renders via renderHowToPosition(positioning) — a separate BUILD-TIME path. It was NOT covered by PR #338's _renderHMIntel or richSummary sanitization wiring. Result: 26 occurrences of "Nivel detectado:" Spanish residue still in served HTML.

Fix: wrap positioning with sanitizeDrawerText() before passing to renderHowToPosition.

3. STORIES card first-person header (bug 8 from original audit, missed in PR #338)

"Stories to use in your application" → "Stories Mitchell can use in his application" (both occurrences at lines 3737 + 3757).

Verification (curl on served HTML at https://dashboard.careers-ops.com/)

$ grep -c "Nivel detectado" /tmp/served.html
0   (was 26)

$ grep -c "Stories Mitchell can use" /tmp/served.html
299 (was 0)

$ grep -c "Stories to use in your application" /tmp/served.html
0   (was 57)

$ grep -c "d = sanitizeObjectStrings(d)" /tmp/served.html
0   (the broken client-side call)

$ grep -c "sanitizeObjectStrings is not defined" /tmp/served.html
0   (no more runtime error)

Chrome MCP visual verification: WorkOS Applied AI Engineer drawer renders fully — HOW TO POSITION section now reads "Detected level: Mid-to-senior IC..." instead of "Nivel detectado:". STORIES card label reads "Stories Mitchell can use in his application". COMP INTELLIGENCE renders the comp table (no more JS error breaking the section).

Why this wasn't caught pre-#338

• The _renderHMIntel Node import works at BUILD time (the import resolves) so build-dashboard.mjs runs clean — the failure only manifests at BROWSER runtime
• The grep-based fallback verification on PR feat(drawer): content-quality sweep — Spanish stripper + voice fix + overclaim scrubber + generic-template removal #338 didn't include a "click into drawer" step because the worktree's HTML wasn't served live
• The HTP card render path is a separate code path that wasn't in PR feat(drawer): content-quality sweep — Spanish stripper + voice fix + overclaim scrubber + generic-template removal #338's diff scope

Lesson for the follow-up retroactive sweep spec: any client-side renderer that calls a sanitizer needs the sanitizer rules INLINED into the browser bundle. Cross-context imports don't work across the build-time / runtime boundary.

Test plan

• node --check scripts/build-dashboard.mjs (clean)
• node scripts/build-dashboard.mjs (clean build; 8 inline <script> blocks parse)
• Live Chrome MCP visual verification on https://dashboard.careers-ops.com/ — WorkOS drawer renders all sections without JS errors
• Grep verification of all 3 fix targets in served HTML

🤖 Generated with Claude Code

[github-actions]

⚠️ Critical file overlap detected

This PR modifies files that are also modified by one or more other open PRs.
Merging in the wrong order can produce structural merge conflicts.

⚠️  CRITICAL FILE OVERLAP DETECTED
============================================================

PR #343 shares critical files with 1 other open PR(s).
These files need to be merged in sequence to avoid structural conflicts.

  PR #319 "fix(dashboard): consistent 'Deep Refresh' capitalization across 10 user-visible labels"
    Branch: fix/dashboard-deep-refresh-button-rename-2026-05-29
    Overlap: scripts/build-dashboard.mjs

Options:
  1. Merge the other PR first, then rebase this branch onto main
  2. Coordinate with the other PR author to split responsibility
  3. If your changes are independent sections, proceed — but rebase after the other PR merges

See AGENTS.md § Bug class: pr-conflict-mirage-from-parallel-shipping

This is a warning, not a block. CI still passes. Merge order matters — coordinate before merging.

See AGENTS.md § Bug class: pr-conflict-mirage-from-parallel-shipping for the triage + recovery playbook.