[ogorzalka]

The harness (SEC-04) reported 114 {!! !!} outputs in 64 views. Each one is now one of:

• Escaped where WooCommerce's own templates escape it (60): wp_kses_post() for prices, messages, titles and sentences built with sprintf(); esc_html() for labels, dates and the billing email; esc_attr() around the $_POST / $_REQUEST values of the login and tracking forms (same result as before, the call moved to the outside). The store notice (get_option('woocommerce_demo_store_notice')), which printed an admin-typed field as it was, goes through wp_kses_post() like WooCommerce does.
• A safer Blade structure (5): aria-current and readonly use @if instead of printing a string; the calculated_shipping class and the comment id use {{ }}.
• Kept raw, with a nosemgrep that says why (49): the theme's own SVG icons, and the markup WooCommerce builds and escapes itself (product images, buttons, remove links, tab callbacks, the_content), where wp_kses_post() would strip attributes.

observed: security is dropped from the harness workflow: the gate blocks again. The views still compile and parse as PHP (checked against the previous version of each file); the Semgrep rule of harness v0.1.13 reports nothing.