Replace character-allowlist regex with an element-token grammar validator.
Strip control characters first, then extract the maximal leading run of
valid element tokens ([A-Z][a-z]?\d*) and group separators (()[]·.).
Fixes: 'C10H12\ninjection' now returns 'C10H12' (was 'C10H12injection').
New: fully invalid inputs (e.g. '<script>alert(1)</script>') return ''.
Keep: parenthesised formulas (e.g. 'C2H5(OH)') pass unchanged.
Unit tests expanded from 4 to 7 formula cases covering all five DoD
requirements plus whitespace-only edge case.
PHP not installable in sandbox; all 7 test inputs hand-traced
against the regex and confirmed correct via Python simulation.
Agent-Session: peptide-schema-backfill v0.6.0 formula-validator
Consolidates the `peptide` CPT under PR Core ownership, dropping the `pr_peptide` slug-collision that was 404ing all 89 peptide detail pages.
- POST_TYPE: pr_peptide -> peptide
- TAX_CATEGORY: pr_peptide_category -> peptide_category
- TAX_FAMILY + pr_peptide_family taxonomy removed
- Defensive post_type_exists/taxonomy_exists guards on both registrations
- Args harmonized as superset of PSA + prior PR Core (adds thumbnail support)
- Activation hook + init:999 version-change flush handler
- Uninstall scoped to _pr_core_authored flag (PSA-authored posts survive)
- Plugin version 0.1.1 -> 0.2.0, CHANGELOG in same commit
- ARCHITECTURE.md + CONVENTIONS.md updated with CPT ownership rule
QA gate verdict: PASS (qa-reviews/peptide-repo-core/2026-04-22-874f93b.md)
Sibling release: peptiderepo/peptide-search-ai#15 (PSA v4.5.0)
Known follow-up: manage_peptide_content capability is not granted to any role as of v0.2.0. No current UI/theme reads or writes PR Core-defined meta keys, so no regression. Follow-up thread to decide role assignment.
