Sourced, demonstrable essays on shipping UI from your backend — without an interpreter. Every piece traces to running code, a primary source, or a test you can read.
If your UI is generated from strings at runtime, a no-unsafe-eval Content-Security-Policy turns it off. Why code-from-strings and a strict CSP are structurally at odds — with a running demo and the test that proves it.
Since March 2025, PCI DSS 4.0 §6.4.3 and §11.6.1 require every payment-page script to be inventoried, justified, and tamper-monitored. Why a dynamic, eval-driven UI is squarely in scope — and how a versioned, no-eval contract gets you out of it.
The first version of a home-grown server-driven UI is a weekend. Then the Configuration Complexity Clock starts: your JSON grows conditions until it’s a worse programming language. What you actually signed up for — and the rule that avoids it.