Zero callers anywhere in the app — confirmed via grep for "OutputHelper::" across the whole codebase. Every view actually calls htmlspecialchars() directly instead, which a prior audit confirmed is done consistently, so escaping was never actually at risk. This was just a misleading, unused class that README.md's file reference implied was part of the app's active XSS-prevention story. Removed the file and its README Project Structure entry. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X