render.gno

 1package nsdata
 2
 3// The real human-facing view moved OUT of this realm into `nsview`
 4// (2026-08-21), after an adversarial review found three separate
 5// defects in the old Render() — unescaped profile-field injection into
 6// the markdown, an O(domains × names) home page any user could inflate
 7// into a permanent DoS, and links that 404'd — none of which could ever
 8// be fixed, because this realm is deployed once and never replaced.
 9//
10// The lesson generalised: "it's only display code, it has no
11// authorization surface" was the wrong test for what belongs in an
12// immutable realm. The right test is whether a bug in it would be
13// permanent. Display code changes far more often than storage schemas
14// do, so it belongs in something swappable.
15//
16// What remains here is deliberately a fixed string: no user-authored
17// data, no iteration over state, nothing that can be wrong later.
18func Render(path string) string {
19	return "# Meme Name Service — data realm\n\n" +
20		"This realm stores records only: name and domain ownership, " +
21		"configuration, and the NFT state.\n\n" +
22		"The human-facing view lives in the `nsview` realm; writes go " +
23		"through `nslogic`.\n"
24}