Checkpoint web parity through Chromium input tasks

docs/status/M13-01D.md

@@ -0,0 +1,36 @@
+# M13-01D Status
+
+status: done  
+task: UI direct-eval bypass gate  
+updated: 2026-08-18 America/New_York  
+enablingTask: false  
+parityStateChange: false
+
+## Scope
+
+The production app, Workers, and protocol TypeScript sources contain no direct `eval(` or
+`new Function(` bypass. The scan covers 176 non-vendor `.ts/.tsx` files and records the only
+declared scripting policy entry points: `gateScriptExecution`, `gateServerScriptJob`, and
+`parseScriptSourceInventory`. Execution remains `DENY`; this static gate does not claim a sandbox.
+
+## Evidence
+
+- `node tools/web/check-script-ui-bypass.mjs` passed:
+  `script-ui-bypass-ok scanned=176 violations=0 policyEntrypoints=3 report=8e234e128b90036548ab709b86b063de404250da2c5c0a6e25e28969b5cd5c73 next=M13-01E`.
+- `git diff --check` passed. Vendor-generated Emscripten/Three.js sources are outside the scan;
+  no application or protocol source is allowed to introduce a direct eval constructor.
+
+## Artifact Hashes
+
+- checker: `f34cb64891c2b22bc3da353f6b864ba3e558d3c286cf716bcb778d9a542cb3d9`
+- report: `6b050092088508ebd5d769d95a2e66f0cd4020c97f3407724a19b9707f51f6dd`
+- manifest: `6b28688b3ebcce5629bcfc437d4ca903d0b1e053b32a796690ee4e021726c75b`
+
+## Next Task
+
+`M13-01E`: preserve Text data and unknown script sources through save/reopen.
+
+## Rollback
+
+Remove the checker, report, manifest, and this status entry. Restore M13-01C as the queue tail and
+move the machine queue back to M13-01D. No parity ledger rollback is required.