The page interpolated media titles, partner hostnames read over the mesh, and docker folder names straight into innerHTML — its own header claimed otherwise, and the helpers that would have fixed it were defined in a page it never loads. Container WebUI values now get a scheme check before they reach window.open().