The spec prescribed replaceAll's string form and the plan hard-coded it, so the $-substitution defect originated in the design documents rather than in execution. Both now specify the function replacer. Also replaces the spec's frame-reporting idea with the document.hasFocus() gate that shipped; frame provenance was only ever needed for auto-submit, which Appendix B rejects.