Health messages go straight from each arr's API into innerHTML and quote things nobody here controls — indexer names from Prowlarr, import-list names, release titles. The page used no escaping at all. _sz() was also binary while labelling its output TB, so /tv read 86.9 TB here and 95.6 TB on every other tab; it has one caller and that caller is disk capacity, so it now matches the rest.