@bongos/core 1.19.697 → 1.19.699

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.697",
-  "core_contract": "1.19.697",
-  "source_commit": "bfb9b4492d0f0057725db35914055204f148c032",
+  "core_version": "1.19.699",
+  "core_contract": "1.19.699",
+  "source_commit": "c2fc577575ff838fa4b7c6ef9b487a61834508da",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T02:32:59.182Z",
+  "built_at": "2026-09-13T03:11:31.535Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2627,
-  "tree_sha256": "aecd13ccb73fd1082fe45b3aa23bab026afc2c358c584c4e188cb8caafcc1199",
+  "tree_sha256": "6784a09f48fd3badc907d3157a51dfd66a765084f015b78924eb7229bcb7c757",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8862b2feb53917b00597c8a2a32d75fedbbe24cdb78c12998209f9de39395c15"
+      "sha256": "83f3755afa52e27b8dc1c9cacc65fd57eb20ca11463f1408bb7298279bbf3994"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4267,7 +4267,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "7bc7c746f2518cb465773a205c8e9fe7efc30852c857001255be92ad8e340bca"
+      "sha256": "7271dc2c3eab6c8ed274dc90f855ec813eef4e401180a300e31de31dce30aa6c"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -7772,12 +7772,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b8fa92bf72071648e7a68331fcd48c316d5f42b4dd22ac58de8c69fa91cdbefb"
+      "sha256": "7235324939dc1acfb616300365334ebf96e054f83b8083b15cd2f99eeb5a6d71"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c2dd79228c1d4d99779ed0526734e6f75a68e40026db6665e800862b95cccc5"
+      "sha256": "c650680172226a9259dbb3da9cfc459a3c94f3fa5578be520c27d2b71d0a71d9"
     },
     {
       "path": "public-docs/index.html",
@@ -8072,7 +8072,7 @@
     {
       "path": "scripts/gds/context-pack.js",
       "mode": "0000644",
-      "sha256": "caa5dd1628b00569a5593964f1831641ac12c9a85b8ec132964a1baf67c77350"
+      "sha256": "7863284f9d81a9cf77a5d01cff82d119207637090f9ef14012c8689625e93a49"
     },
     {
       "path": "scripts/gds/control-manifest.js",
@@ -9512,7 +9512,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "5c99fec0061221143be5e22bb51ca690aec883d9eaf094bd25007d3e21b5f96c"
+      "sha256": "61b13299ffdd7f036d5bc3d364135bd8ca4d3470223001b8ff6cc45d858d6107"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9542,7 +9542,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aceceda426abd1aa9dd04fdfc69a225e7b33a91b790a823cf10d206698f24c1e"
+      "sha256": "f6283921aa6c4af4de772e638a58ad28111bb8e6664a4bb67e15bc86ad1083f3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9922,7 +9922,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "911a764f72976298daa17855acb836d0ada3215b480961ae8607e1fc3634f882"
+      "sha256": "85b0f479d16d53eea0442cab9ea8aa2dd09d95926765b47a142c609af22f6927"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -10232,7 +10232,7 @@
     {
       "path": "tests/context_pack.mjs",
       "mode": "0000644",
-      "sha256": "09f956c01f169ab7384204a5d43deefa3e57a7d57924072dfa8215f0942c2513"
+      "sha256": "159661396a274740d9164dce8532b54e283ead733301c841078334033784d04f"
     },
     {
       "path": "tests/control_manifest.mjs",
@@ -10327,7 +10327,7 @@
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",
-      "sha256": "b88f7ab55948f0bfbf0e6982cc96465ff2c34d76b143f40b86f933c323b8ff1d"
+      "sha256": "20994467d64d35647433c320265e360a520391bff974b1a39a918ef66ad7f172"
     },
     {
       "path": "tests/cutover_codemod.mjs",

package/docs/module-api-changelog.md

@@ -1853,5 +1853,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.695 with no explicit bump. run 34733145358. (task 1002620)
   1.19.697 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.696 with no explicit bump. run 34733301156. (task 1002620)
+  1.19.698 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.697 with no explicit bump. run 34733917938. (task 1002620)
+  1.19.699 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.698 with no explicit bump. run 34734848584. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/box-access.js

@@ -178,6 +178,24 @@ const BASE_SPARSE_PATHS = [
   // config/government.json) is host content the box's own builder authors — no
   // credentials live here (ADR 0022); those are in /etc and the box env.
   'config',
+  // modules/lifecycle — task 1003085. BASE's whole charter is "enough to run the
+  // /builder-* CLI", and the CLI does not run without this module:
+  // scripts/gds/context-pack.js reads the task enums from
+  // modules/lifecycle/task-classifier, and context-pack is on the /builder-start
+  // AND /builder-claim paths. On a task-scoped box with NO active claim nothing
+  // put lifecycle in scope, so both commands died at import with MODULE_NOT_FOUND
+  // — and neither could be used to fix it, because a CLAIM is what fetches the
+  // module. The only way out was POST /claims by hand.
+  //
+  // This is the structural half; context-pack.js also degrades now if the module
+  // is absent for any OTHER reason. Both, deliberately: the degrade keeps the CLI
+  // alive against a future module gap, and this line is what makes the pack
+  // actually COMPLETE on every box rather than quietly reduced.
+  //
+  // Same posture as the entries above — core-domain work-tracking code, which is
+  // methodology and not product runtime, so it belongs in BASE by the same reading
+  // that put scripts/ and src/bongos/ here. No secrets; a cone-mode directory.
+  'modules/lifecycle',
 ];
 
 // sparsePathsForScopeKeys — PURE. Given the module KEYS a builder's active claims

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.697",
+  "version": "1.19.699",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.697",
+      "version": "1.19.699",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.697",
+  "version": "1.19.699",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/context-pack.js

@@ -30,11 +30,30 @@ const path = require('node:path');
 // The live validators. task-classifier is a pure module (no DB, no network),
 // so importing it from a CLI is safe — same precedent as next-number.js reading
 // the repo tree directly. This is the "not hand-maintained" guarantee.
-const {
-  VALID_KINDS,
-  VALID_DISCIPLINES,
-  TASK_FIELD_BOUNDS,
-} = require('../../modules/lifecycle/task-classifier');
+//
+// OPTIONAL, because the file may not be ON DISK (task 1003085). A task-scoped box
+// (ADR 0148) materializes modules/<key> only for the modules the CLAIM puts in
+// scope, so on a box with NO active claim modules/lifecycle is absent and this
+// require threw MODULE_NOT_FOUND at import time. That killed /builder-start AND
+// /builder-claim — the exact two commands needed to escape the state, since the
+// claim is what would fetch the module. A deadlock, escapable only by calling
+// POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
+// block a claim") was already the right rule; this require was the line that did
+// not keep it.
+//
+// Degrade by OMITTING the enums, NEVER by hard-coding a copy. A local list of
+// kinds is precisely the drift the "generated from the live validators" design
+// exists to prevent, and it would be WORSE than absence: absence costs the
+// planner one /docs lookup, while a stale list reads as authoritative and is
+// discovered only when POST /tasks rejects it — the guess-and-retry turn this
+// whole pack was built to save.
+let classifier = null;
+try {
+  // eslint-disable-next-line global-require
+  classifier = require('../../modules/lifecycle/task-classifier');
+} catch (_) {
+  // Not materialized on this box. apiContract() reports it honestly below.
+}
 
 // Single source of truth for the API prefix (src/bongos/api-prefix.js) so the URL
 // rename (Part B) flips one constant and this pack follows. Importing a pure src
@@ -46,17 +65,31 @@ const { API_PREFIX } = require('../../src/bongos/api-prefix');
 // The API contract a planner needs to file/claim without guessing. 'unclassified'
 // is dropped from both enums: it's the classifier's fallback bucket, never a
 // value a human should pick.
+//
+// The SHAPE is the same either way — empty arrays and null bounds, never missing
+// keys — because every consumer here and in start.js reads these fields
+// positionally. Returning a short object instead would move the crash from the
+// require to the formatter and fix nothing. `enums_available` is what the
+// formatters branch on, so "we don't know" is said once, in words, rather than
+// rendered as an empty list that looks like "there are none".
 function apiContract() {
-  const kinds = [...VALID_KINDS].filter((k) => k !== 'unclassified');
-  const disciplines = [...VALID_DISCIPLINES].filter((d) => d !== 'unclassified');
-  return {
+  const base = {
     api_prefix: API_PREFIX,
     docs_url: '/docs',
     openapi_url: '/docs/openapi.json',
-    task_kinds: kinds,
-    disciplines,
-    priority: TASK_FIELD_BOUNDS.priority,
-    manual_degree: TASK_FIELD_BOUNDS.manual_degree,
+    enums_available: Boolean(classifier),
+    task_kinds: [],
+    disciplines: [],
+    priority: null,
+    manual_degree: null,
+  };
+  if (!classifier) return base;
+  return {
+    ...base,
+    task_kinds: [...classifier.VALID_KINDS].filter((k) => k !== 'unclassified'),
+    disciplines: [...classifier.VALID_DISCIPLINES].filter((d) => d !== 'unclassified'),
+    priority: classifier.TASK_FIELD_BOUNDS.priority,
+    manual_degree: classifier.TASK_FIELD_BOUNDS.manual_degree,
   };
 }
 
@@ -212,13 +245,20 @@ function formatContextPack(pack) {
   lines.push(`  Held claims:    ${formatClaims(claims)}`);
   lines.push(`  API prefix:     ${api.api_prefix}   (e.g. POST ${api.api_prefix}/tasks, GET ${api.api_prefix}/me)`);
   lines.push(`  API reference:  ${api.docs_url} (rendered) · ${api.openapi_url} (OpenAPI 3.1)`);
-  lines.push(`  Task kinds:     ${api.task_kinds.join(', ')}`);
-  lines.push(`  Disciplines:    ${api.disciplines.join(', ')}`);
-  const conv = api.priority.convention;
-  lines.push(
-    `  Numeric fields: priority int ${api.priority.min}–${api.priority.max} ` +
-    `(use ${conv.label}) · manual_degree int ${api.manual_degree.min}–${api.manual_degree.max}`
-  );
+  if (api.enums_available) {
+    lines.push(`  Task kinds:     ${api.task_kinds.join(', ')}`);
+    lines.push(`  Disciplines:    ${api.disciplines.join(', ')}`);
+    const conv = api.priority.convention;
+    lines.push(
+      `  Numeric fields: priority int ${api.priority.min}–${api.priority.max} ` +
+      `(use ${conv.label}) · manual_degree int ${api.manual_degree.min}–${api.manual_degree.max}`
+    );
+  } else {
+    // Say WHY and WHERE to look. The one thing this line must not do is imply the
+    // enums are empty — a planner who reads "kinds:" with nothing after it will
+    // invent one.
+    lines.push(`  Task kinds:     unavailable here — modules/lifecycle is not on this box; see ${api.docs_url}`);
+  }
   lines.push(`  OS:             ${formatOs(os)}`);
   return lines.join('\n');
 }
@@ -230,7 +270,9 @@ function formatContextPack(pack) {
 // noise beyond the shared compass.
 function formatContextPackCompact(pack) {
   const { worktree, api } = pack;
-  const kinds = api.task_kinds.slice(0, 4).join(', ') + (api.task_kinds.length > 4 ? ', …' : '');
+  const kinds = api.enums_available
+    ? api.task_kinds.slice(0, 4).join(', ') + (api.task_kinds.length > 4 ? ', …' : '')
+    : `see ${api.docs_url}`;
   return [
     `🧭 Worktree: ${worktree.root}  (edit + git here, not the main checkout)`,
     `   API ${api.api_prefix} · kinds: ${kinds} · full pack on /builder-claim`,

package/src/bongos/serve-internal.js

@@ -107,25 +107,66 @@ function themeMarkup(theme) {
   if (!theme) return '';
   const decls = [];
   for (const [key, cssVar] of Object.entries(COLOR_VARS)) {
-    const v = theme.colors?.[key];
+    const v = cssSafe(theme.colors?.[key]);
     if (v) decls.push(`${cssVar}:${v};`);
   }
-  if (theme.fonts?.display) decls.push(`--font-display:${theme.fonts.display};`);
-  if (theme.fonts?.body) decls.push(`--font-body:${theme.fonts.body};`);
+  const display = cssSafe(theme.fonts?.display);
+  if (display) decls.push(`--font-display:${display};`);
+  const body = cssSafe(theme.fonts?.body);
+  if (body) decls.push(`--font-body:${body};`);
   let out = '';
   for (const href of theme.fonts?.links || []) {
-    out += `<link rel="stylesheet" href="${href}">`;
+    out += `<link rel="stylesheet" href="${esc(href)}">`;
   }
   // `backdrop` paints the page background (e.g. the Cloud Bongos sunrise gradient,
   // ADR 0064 / R74) over the flat var(--bg); omitted packs (OTB) keep --bg.
   const css = [];
   if (decls.length) css.push(`:root{${decls.join('')}}`);
-  if (theme.backdrop) css.push(`body{background:${theme.backdrop};}`);
+  const backdrop = cssSafe(theme.backdrop);
+  if (backdrop) css.push(`body{background:${backdrop};}`);
   if (css.length) out += `<style>${css.join('')}</style>`;
-  if (theme.favicon) out += `<link rel="icon" href="${theme.favicon}">`;
+  // esc() is lossless in an attribute: the HTML parser decodes the entities back
+  // before anything reads the URL, so the neutral pack's inline `data:image/svg+xml,
+  // <svg …>` favicon resolves to exactly the same bytes it does today.
+  if (theme.favicon) out += `<link rel="icon" href="${esc(theme.favicon)}">`;
   return out;
 }
 
+// A pack-supplied value on its way into <style> TEXT. esc() is the wrong tool
+// here and would corrupt the output: CSS is not entity-decoded, so a font stack
+// like `"Cinzel", serif` would reach the browser as `&quot;Cinzel&quot;, serif`
+// and simply not parse. There is no encoding that both survives CSS and
+// neutralizes markup, so this fails closed instead. The only way out of a <style>
+// element is a literal `</style`, every route to it begins with `<`, and no
+// colour, font stack, or backdrop has a legitimate use for one — so a value
+// carrying `<` is dropped whole rather than emitted half-escaped. Dropping one
+// declaration loses that pack's colour and falls back to style.css's default;
+// emitting it loses the page.
+function cssSafe(v) {
+  const s = String(v == null ? '' : v);
+  return s.includes('<') ? '' : s;
+}
+
+// Serialize a pack value for injection INSIDE a <script> element. JSON.stringify
+// alone is not enough: its output is valid JSON, but the browser reads a script
+// body as raw text FIRST, so a `</script>` anywhere in the pack ends the element
+// early and everything after it lands in the document as markup (the latent
+// self-XSS from an operator-authored pack — idea 348, Hacker dispatch on task
+// 1374). Escaping `<` alone closes it: `</script`, `<script`, and `<!--` all need
+// one. `>` and `&` need no escaping here precisely because a classic script body
+// is NOT entity-decoded — there is nothing for them to start. U+2028/U+2029 are
+// escaped as well: legal in string literals since ES2019, so not a break-out on
+// any browser we serve, but free to escape and still fatal to an older parser.
+// `\u003c` is the same character to the JS parser and never one to the HTML
+// parser, so the value the page actually reads is unchanged. Same fix, same
+// reasoning as modules/provisioning/routes/callback-page.js.
+function jsonForScript(value) {
+  return JSON.stringify(value)
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
 // Inject the client-safe branding pack into a served HTML document (R56 task 1195
 // + R57 task 1196, ADR 0062 §3):
 //   * `window.__BRANDING__` — a synchronous global so every hall/status script
@@ -145,7 +186,7 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
   // UI sections for off modules synchronously (no fetch, no race). R60 wires the
   // actual section-hiding; this exposes the data.
   const stamped = applyBrandTokens(html, brand);
-  const tag = `${clientBundleScriptTag()}<script>window.__BRANDING__=${JSON.stringify(brand)};window.__MODULES__=${JSON.stringify(mods)};</script>${themeMarkup(brand.theme)}`;
+  const tag = `${clientBundleScriptTag()}<script>window.__BRANDING__=${jsonForScript(brand)};window.__MODULES__=${jsonForScript(mods)};</script>${themeMarkup(brand.theme)}`;
   return stamped.includes('</head>') ? stamped.replace('</head>', `${tag}</head>`) : tag + stamped;
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.697'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.699'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -196,7 +196,12 @@ console.log('\nBASE_SPARSE_PATHS — the non-product base a task-scoped box laye
 t('BASE carries the methodology + tooling, NOT the product/game', () => {
   // clients/ is load-bearing: cli-lib.js hard-imports clients/bongos-client, so a
   // cone without it has a fully dead builder CLI on the box (task 1002745).
-  for (const p of ['.devcontainer', '.claude', 'scripts', 'src/bongos', 'docs', 'infra', 'tests', 'clients']) {
+  // modules/lifecycle is load-bearing for the same reason (task 1003085):
+  // scripts/gds/context-pack.js reads the task enums from its task-classifier,
+  // and context-pack sits on BOTH /builder-start and /builder-claim. A box with
+  // no active claim put nothing in scope, so both commands died at import — and
+  // neither could fix it, because a CLAIM is what fetches the module.
+  for (const p of ['.devcontainer', '.claude', 'scripts', 'src/bongos', 'docs', 'infra', 'tests', 'clients', 'modules/lifecycle']) {
     assert.ok(BASE.includes(p), `BASE must include ${p}`);
   }
   for (const p of ['src/world', 'src/rooms', 'public', 'art', 'modules/status-ui']) {

package/tests/context_pack.mjs

@@ -339,5 +339,85 @@ t('formatContextPackCompact: two lines, worktree + prefix, no undefined', () =>
   assert.ok(!/undefined/.test(out));
 });
 
+// ---- the task-scoped box with no claim (task 1003085) ----------------------
+//
+// A box scoped to a claim materializes modules/<key> only for the modules that
+// claim put in scope (ADR 0148). With NO active claim, modules/lifecycle is not
+// on disk — and this file's hard `require` of task-classifier threw
+// MODULE_NOT_FOUND at IMPORT time, which killed /builder-start and
+// /builder-claim: the two commands needed to escape the state, because a claim
+// is what fetches the module. The live escape was POST /claims by curl.
+//
+// This reproduces the condition for real rather than asserting on source text:
+// a temp tree holding context-pack.js and the one other thing it imports, with
+// NO modules/ directory at all. A regression re-introducing a bare top-level
+// require fails here at `require(...)`, before any assertion runs.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const url = require('node:url');
+
+function boxWithoutLifecycle() {
+  const here = path.dirname(url.fileURLToPath(import.meta.url));
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ctxpack-nolifecycle-'));
+  fs.mkdirSync(path.join(root, 'scripts', 'gds'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'src', 'bongos'), { recursive: true });
+  fs.copyFileSync(path.join(here, '..', 'scripts', 'gds', 'context-pack.js'),
+    path.join(root, 'scripts', 'gds', 'context-pack.js'));
+  // The ONLY other import. Deliberately copied rather than stubbed: if
+  // context-pack grows a second hard dependency, this test fails and that new
+  // coupling has to be looked at — which is the point.
+  fs.copyFileSync(path.join(here, '..', 'src', 'bongos', 'api-prefix.js'),
+    path.join(root, 'src', 'bongos', 'api-prefix.js'));
+  // No modules/ — that IS the box condition.
+  assert.ok(!fs.existsSync(path.join(root, 'modules')), 'the fixture must not carry modules/');
+  return { root, mod: require(path.join(root, 'scripts', 'gds', 'context-pack.js')) };
+}
+
+t('a box with no modules/lifecycle can still LOAD the pack (the deadlock)', () => {
+  const { mod } = boxWithoutLifecycle();
+  const api = mod.apiContract();
+  assert.equal(api.enums_available, false, 'it must say so, not pretend');
+  assert.equal(api.api_prefix, '/api/bongos', 'everything not behind the module still works');
+  // Shape preserved, so every positional consumer survives.
+  assert.deepEqual(api.task_kinds, []);
+  assert.deepEqual(api.disciplines, []);
+  assert.equal(api.priority, null);
+  assert.equal(api.manual_degree, null);
+});
+
+t('both formatters render on that box instead of throwing', () => {
+  const { mod } = boxWithoutLifecycle();
+  const pack = mod.buildContextPack({
+    activeClaims: [], cwd: '/fallback', platform: 'linux',
+    runGit: () => '/work/tree\n', runWhich: () => '',
+  });
+  // The crash this moves is subtle: omitting the keys instead of emptying them
+  // would just relocate the failure from the require to `api.priority.convention`
+  // here — still a dead CLI, one stack frame later.
+  const full = mod.formatContextPack(pack);
+  assert.ok(!/undefined/.test(full), 'no undefined leaks into the pack');
+  assert.match(full, /unavailable here/, 'it names the gap');
+  assert.match(full, /\/docs/, 'and says where the real answer is');
+  assert.doesNotMatch(full, /Task kinds: {5}$/m, 'never an EMPTY kinds line — that reads as "there are none"');
+  const compact = mod.formatContextPackCompact(pack);
+  assert.equal(compact.split('\n').length, 2);
+  assert.ok(!/undefined/.test(compact));
+});
+
+t('with the module present the enums are still the LIVE ones, not a local copy', () => {
+  // The guard on the fix: degrading must not have introduced a hand-maintained
+  // fallback list. This is the original design promise, re-pinned against the
+  // new code path.
+  const api = apiContract();
+  assert.equal(api.enums_available, true);
+  const live = require('../modules/lifecycle/task-classifier');
+  assert.deepEqual(api.task_kinds, [...live.VALID_KINDS].filter((k) => k !== 'unclassified'));
+  assert.deepEqual(api.disciplines, [...live.VALID_DISCIPLINES].filter((d) => d !== 'unclassified'));
+  const src = fs.readFileSync(new URL('../scripts/gds/context-pack.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /'(bug|feature|chore|cleanup|verify)'\s*,\s*'/,
+    'a literal kind list in this file is the drift the generated design exists to prevent');
+});
+
 console.log(`\ncontext_pack: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/currency_label.mjs

@@ -121,6 +121,89 @@ test('injectBrandingGlobal degrades safely when there is no </head>', () => {
   assert.ok(out.includes('<div>no head</div>'));
 });
 
+// --- task 1001434 (idea 348): everything the pack contributes is escaped for the
+// context it lands in. The pack is operator-authored, so this is not a defence
+// against a hostile visitor — it is a defence against one stray character in a
+// config file silently turning every served page's <head> into markup.
+
+// A pack string carrying `</script>` is the whole bug: the browser finds the end
+// of the script element by scanning raw text, before any JS parsing happens.
+const HOSTILE = {
+  identity: { productName: '</script><img src=x onerror=alert(1)>', worldName: 'w' },
+  copy: { tagline: 'a < b && c > d' },
+};
+
+function brandingJson(out) {
+  const m = /window\.__BRANDING__=(.*?);window\.__MODULES__=/s.exec(out);
+  assert.ok(m, 'the injected branding assignment must be findable');
+  return m[1];
+}
+
+test('1001434: a `</script>` in the pack cannot close the injected script element', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding(HOSTILE), {});
+  assert.ok(/<script>window\.__BRANDING__=(.*?)<\/script>/s.exec(out), 'the injected block is well-formed');
+  // Two closers are correct and expected: the client-bundle <script src=…></script>
+  // that leads the tag, and our own terminator. A third would BE the bug — the
+  // pack's `</script>` ending the element early. Unfixed, this counts 3.
+  assert.equal(out.split('</script>').length - 1, 2, 'no early close');
+  assert.ok(!out.includes('<img src=x'), 'the payload never reaches the document as a tag');
+});
+
+test('1001434: every `<` in the injected JSON is \\u003c, and the VALUE is unchanged', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding(HOSTILE), {});
+  const json = brandingJson(out);
+  assert.ok(!json.includes('<'), 'no raw < survives into the script body');
+  assert.ok(json.includes('\\u003c'), 'it is escaped, not stripped');
+  // Escaping must be lossless: < is the same character to the JSON parser,
+  // so the page reads exactly what the operator configured.
+  const parsed = JSON.parse(json);
+  assert.equal(parsed.identity.productName, '</script><img src=x onerror=alert(1)>');
+  assert.equal(parsed.copy.tagline, 'a < b && c > d', '> and & are left alone — a script body is not entity-decoded');
+});
+
+test('1001434: __MODULES__ is escaped too — it rides the same script tag', () => {
+  const out = injectBrandingGlobal('<head></head>', clientBranding({}), { enabled: { '</script>': true } });
+  assert.equal(out.split('</script>').length - 1, 2, 'the bundle tag and our terminator, and nothing else');
+  const m = /window\.__MODULES__=(.*?);<\/script>/s.exec(out);
+  assert.ok(m && !m[1].includes('<'));
+  assert.deepEqual(JSON.parse(m[1]), { enabled: { '</script>': true } });
+});
+
+test('1001434: a theme value carrying `<` is DROPPED rather than breaking out of <style>', () => {
+  const m = themeMarkup({
+    colors: { bg: '#fff', ink: '</style><script>alert(1)</script>' },
+    backdrop: '</style>x',
+    fonts: { display: '"Cinzel", serif' },
+  });
+  assert.ok(!m.includes('<script>'), 'no escape from the style element');
+  assert.equal(m.split('</style>').length - 1, 1, 'exactly one style terminator — our own');
+  assert.ok(m.includes('--bg:#fff;'), 'the clean declarations still ship');
+  assert.ok(!m.includes('--ink:'), 'the poisoned one is dropped whole, not half-escaped');
+  assert.ok(!m.includes('body{background:'), 'a poisoned backdrop is dropped too');
+  // CSS is not entity-decoded, so esc() here would be a bug of its own: the font
+  // stack has to keep its real quotes.
+  assert.ok(m.includes('--font-display:"Cinzel", serif;'), 'quotes in a font stack survive intact');
+});
+
+test('1001434: a pack cannot break out of the favicon or font-link href attribute', () => {
+  const m = themeMarkup({ favicon: 'x"><script>alert(1)</script>', fonts: { links: ['y"><script>alert(2)</script>'] } });
+  assert.ok(!m.includes('<script>'), 'neither href can escape its attribute');
+  assert.ok(m.includes('&quot;'), 'the quote is entity-escaped, which the parser undoes on read');
+});
+
+test('1001434: escaping the favicon is lossless — the neutral inline-SVG data URI still resolves', () => {
+  const favicon = "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'><circle r='8'/></svg>";
+  const m = themeMarkup({ favicon });
+  const href = /<link rel="icon" href="([^"]*)">/.exec(m);
+  assert.ok(href, 'the attribute is still well-formed');
+  // Decode the way an HTML parser does; the operator's bytes must come back.
+  const decoded = href[1]
+    .replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
+  assert.equal(decoded, favicon, 'the browser reads exactly the URI the pack configured');
+});
+
 // --- BV1.R75: module hall-widget script injection (ADR 0062 §4) ---
 
 const HALL = '<body><script src="/builders/builders.js?v=2026-06-27-r75" defer></script></body>';