{% extends "base.html" %}
{% block title %}{{ label }} — {{ slug }}{% endblock %}
{% block content %}
<p><a href="/sessions/{{ slug }}">← {{ slug }}</a></p>
<h1>{{ label }}</h1>
<div class="toolbar">
  <a class="btn small ghost" href="/sessions/{{ slug }}/artifacts/{{ artifact_type }}?download=1">Download</a>
</div>
{# `safe` on content this app produced, which is the standard `templating.py` states — and here it
   is load-bearing rather than convenient, so it is worth saying exactly what is being claimed. The
   string is not the artifact: it is `render/html.py`'s output, in which every tag is a literal that
   module wrote and every run of document text went through `html.escape` first. Autoescape has to
   be off or those tags would be shown instead of applied, which is the whole point of #235; the
   escaping therefore happens in the renderer, before Jinja sees anything.
   `test_hostile_markup_in_a_saved_artifact_is_shown_not_executed` drives this exact path with a
   tampered file on disk, and `tests/test_render_html.py` owns the per-construct proof. #}
<article class="artifact">{{ document | safe }}</article>
{% endblock %}