Deferred from PR #484's review fixes, where it was analyzed and documented in code: no pairwise substitution ORDER protects both test-plan-controlled strings at the template seam — with the current order, [[CURRENT_DEVICE]] remains reachable from a crafted destination name (it inserts a label; the other order would insert controls, which is worse). Closing the class means single-pass substitution across the whole HTML seam rather than sequential replaces. Pre-existing before #484; no known exploit path beyond placeholder-text insertion; PlaceholderOrderTests pins the current behavior. Refs #484, #439.