@bongos/core 1.21.181 → 1.22.1

package/tests/github_install_nudge.mjs

@@ -22,6 +22,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -159,12 +160,14 @@ test('GET /provisioning/instances and /provisioning/instances/:id carry github_i
 function grab(head) {
   const at = HUB.indexOf(`\n  ${head}`);
   assert.ok(at >= 0, `${head} must exist`);
+  const line = HUB.slice(at, HUB.indexOf('\n', at + 1));
+  if (/\}\s*$/.test(line)) return line; // a one-line declaration (esc, task 1004876)
   const end = HUB.indexOf('\n  }', at + 1);
   const close = HUB.slice(end, end + 5) === '\n  };' ? end + 5 : end + 4;
   return HUB.slice(at, close);
 }
 function page() {
-  const ctx = { STATE_GROUP: { active: 'live', error: 'attention', torn_down: 'gone' } };
+  const ctx = { window: { OTB: realOTB() }, STATE_GROUP: { active: 'live', error: 'attention', torn_down: 'gone' } };
   vm.createContext(ctx);
   vm.runInContext(['function esc(', 'function ghInstallRow(', 'function groupFor('].map(grab).join('\n'), ctx);
   return ctx;

package/tests/goal_map_page.mjs

@@ -431,9 +431,9 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<main id="hall-main" class="sky-stage">/, 'the sky is drawn in the stage, the skip link\'s target');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
   // criterion-uat-ui.js (task 1004402): the rings' UAT state words, shared with the goal page.
-  assert.deepEqual(scripts(html).filter((s) => !['shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
+  assert.deepEqual(scripts(html).filter((s) => !['dom-utils.js', 'shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
   // Both doors load the shell (tasks 1004327, 1004430); the SKY's files are the same.
-  const skyScripts = (h) => scripts(h).filter((s) => !['shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0]));
+  const skyScripts = (h) => scripts(h).filter((s) => !['dom-utils.js', 'shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0]));
   assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');
   assert.equal(html.match(/thinking\.css\?v=([^"]+)/)[1], thinking.match(/thinking\.css\?v=([^"]+)/)[1]);
   assert.match(read('thinking.css'), /body\[data-page\] \.sky-stage \{/, 'the sheet dresses the one stage both doors draw in inside the hall');

package/tests/government_protected_surfaces.mjs

@@ -26,9 +26,23 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GOV = path.join(ROOT, 'modules', 'government');
 
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
-const registry = require(path.join(GOV, 'protected-surfaces.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 
+// The registry exactly as the live kernel matcher loads it — the one loader the
+// enforcers (pre-push hook, grader pre-pass, main audit, goal-scope check) use.
+// Task 1004890 deleted modules/government/protected-surfaces.js, a wrapper over
+// this same matcher that nothing but this test ever required; FLOOR and
+// SYSTEM_PERMISSIONS are derived here the way it derived them.
+const registry = {
+  SURFACES: ppc.PROTECTED_SURFACES,
+  PROTECTED_GLOBS: ppc.PROTECTED_GLOBS,
+  FLOOR: catalog.RANK_ORDER[Math.min(...ppc.PROTECTED_SURFACES.map((s) => catalog.RANK_ORDER.indexOf(s.floor)))],
+  SYSTEM_PERMISSIONS: [...new Set(ppc.PROTECTED_SURFACES.map((s) => s.permission))].sort(),
+  surfaceFor: (file) => ppc.surfaceFor(file),
+  floorFor: (file) => ppc.floorFor(file),
+  isProtected: (file) => ppc.surfaceFor(file) !== null,
+};
+
 // The verbatim PROTECTED_GLOBS array as it stood immediately before R101.
 const EXPECTED_GLOBS_BEFORE_R101 = [
   'src/bongos/auth.js',
@@ -979,91 +993,6 @@ test('every entry maps to a permission the catalog defines as system:true', () =
   assert.deepEqual(registry.SYSTEM_PERMISSIONS, ['path.protected.modify']);
 });
 
-// Feed a BAD registry through the real loader in a cold subprocess and assert the
-// module refuses to load. The pattern is the sibling probe below ("a missing
-// registry fails CLOSED"): patch fs.readFileSync for the registry path only, then
-// require the module under test and let its load-time throw be the result.
-//
-// WHY A SUBPROCESS AND NOT AN IN-PROCESS ASSERTION (task 1003196, finding 9). The
-// version of this test before that task read the catalog and checked that a
-// grantable key exists and an unknown key returns null — both true regardless of
-// whether the guard exists. Demonstrated: deleting the whole validation loop from
-// modules/government/protected-surfaces.js left the entire suite green. The guard
-// is load-time, so only a fresh module load can exercise it, and the registry is
-// read from disk, so only a patched read can make it bad.
-//
-// This matters because the sibling test above ("every entry maps to a permission
-// the catalog defines as system:true") only checks the COMMITTED file. The
-// load-time throw is what protects an out-of-band registry write — the Government
-// tab editing an instance file at runtime — and nothing was watching it.
-function loadWithRegistry(registryJson) {
-  execFileSync(process.execPath, ['-e',
-    "const fs=require('node:fs');const real=fs.readFileSync;" +
-    'const fake=' + JSON.stringify(JSON.stringify(registryJson)) + ';' +
-    "fs.readFileSync=(p,...r)=>(String(p).includes('protected-surfaces.json') ? fake : real(p,...r));" +
-    "require('./modules/government/protected-surfaces.js');",
-  ], { cwd: ROOT, stdio: 'pipe' });
-}
-
-test('a surface mapped to a GRANTABLE permission fails loud at load', () => {
-  // A grantable (system:false) key is the dangerous case ADR 0151 §4 names: a
-  // custom rank could be handed the very power the substrate reserves.
-  const grantable = catalog.grantableKeys()[0];
-  assert.ok(grantable, 'the catalog must define at least one grantable key for this probe');
-  assert.equal(catalog.isSystem(grantable), false, 'fixture sanity: the probe key must be grantable');
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'metic',
-      permission: grantable,
-      surfaces: [{ glob: 'src/probe/grantable-surface.js' }],
-    }),
-    /which is not system:true/,
-    'a surface mapping to a grantable permission must refuse to load',
-  );
-});
-
-test('a surface mapped to an UNKNOWN permission fails loud at load', () => {
-  assert.equal(catalog.byKey('not.a.real.permission'), null, 'fixture sanity: the key must be unknown');
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'metic',
-      permission: 'not.a.real.permission',
-      surfaces: [{ glob: 'src/probe/unknown-surface.js' }],
-    }),
-    /which the permission catalog does not define/,
-    'a surface mapping to a permission the catalog never defines must refuse to load',
-  );
-});
-
-test('the probe itself is honest — a GOOD registry loads clean through the same path', () => {
-  // Without this, both assertions above would pass if the subprocess threw for an
-  // unrelated reason (a bad patch, a missing cwd, a syntax error in the -e script).
-  assert.doesNotThrow(() => loadWithRegistry({
-    floor: 'metic',
-    permission: registry.SYSTEM_PERMISSIONS[0],
-    surfaces: [{ glob: 'src/probe/good-surface.js' }],
-  }), 'a well-formed registry must still load — otherwise the probes above prove nothing');
-});
-
-test('an unknown FLOOR is refused before the catalog check ever sees it', () => {
-  // The validation loop's third branch (`!catalog.RANK_ORDER.includes(s.floor)`) is
-  // a DRIFT guard, not dead code, and this test records why it cannot be provoked
-  // through the registry: the kernel loader keeps its own local RANK_TIER map
-  // (permission-path-check.js) and rejects an unknown floor first. The government
-  // branch only becomes reachable if those two rank lists ever disagree — which is
-  // exactly the drift it exists to catch, and is not craftable from JSON alone.
-  assert.throws(
-    () => loadWithRegistry({
-      floor: 'emperor',
-      permission: registry.SYSTEM_PERMISSIONS[0],
-      surfaces: [{ glob: 'src/probe/bad-floor.js' }],
-    }),
-    /unknown floor/,
-  );
-  assert.deepEqual(catalog.RANK_ORDER, ['xenos', 'thetes', 'metic', 'archon'],
-    'if this list and the kernel RANK_TIER drift, the government floor branch wakes up');
-});
-
 // ---------- synchronous, no DB, no server ----------
 
 test('the registry loads synchronously from the repo with no DB and no server', () => {
@@ -1080,12 +1009,6 @@ test('the registry loads synchronously from the repo with no DB and no server',
 test('the registry data file carries no DB/network dependency', () => {
   const json = fs.readFileSync(path.join(GOV, 'protected-surfaces.json'), 'utf8');
   assert.doesNotThrow(() => JSON.parse(json), 'the canonical form must be plain parseable data');
-  const code = fs.readFileSync(path.join(GOV, 'protected-surfaces.js'), 'utf8')
-    .split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
-  for (const banned of ['./db', 'pool', 'fetch(', 'await ']) {
-    assert.ok(!code.includes(banned),
-      `protected-surfaces.js must not introduce "${banned}" — the substrate reads this with no DB and no server (ADR 0151 §4)`);
-  }
 });
 
 // ---------- policy owns / substrate enforces ----------
@@ -1095,10 +1018,6 @@ test('the kernel does not require the governance module (ADR 0083 one-way rule)'
   const requires = [...kernel.matchAll(/require\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1]);
   assert.deepEqual(requires.filter((r) => r.includes('modules/')), [],
     'core must never require a module — it reads the registry as data');
-  // …and the flow runs the legal way: governance reaches the matcher through the doorway.
-  const gov = fs.readFileSync(path.join(GOV, 'protected-surfaces.js'), 'utf8');
-  assert.ok(/require\(\s*['"]\.\.\/\.\.\/src\/module-api['"]\s*\)/.test(gov),
-    'governance must reach the kernel matcher through the published doorway');
 });
 
 test('the hardcoded protected list is gone from the kernel — one source, no drift', () => {

package/tests/hall_approval_queue.mjs

@@ -18,7 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { makeRunner, makeEl, walk, settle } from './helpers.mjs';
+import { makeRunner, makeEl, walk, settle, realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -105,7 +105,7 @@ function bootPanel({ answers = {}, writes = null, mode = 'light' } = {}) {
       return val.__status ? { ok: false, status: val.__status, data: val.data } : { ok: true, status: 200, data: val };
     },
   };
-  const win = { matchMedia: () => ({ matches: false }), __BRANDING__: { identity: { productName: 'Cloud Bongos', worldName: 'the studio' } } };
+  const win = { OTB: realOTB(), matchMedia: () => ({ matches: false }), __BRANDING__: { identity: { productName: 'Cloud Bongos', worldName: 'the studio' } } };
   const ctx = vm.createContext({ window: win, document: documentObj, console, setTimeout, clearTimeout, encodeURIComponent });
   win.window = win;
   vm.runInContext(read('brand-holes.js'), ctx, { filename: 'brand-holes.js' });

package/tests/hall_city.mjs

@@ -288,7 +288,7 @@ test('the city sits in the hall chrome, behind the shell\'s full-screen switch',
   // task 1004685 (the living city): gov-living.js, the model under the drawing, and
   // gov-feeds.js, its one reader per page (shared with the shell's tally), load before it
   // task 1004702: the card answers its first ask in place, so the deck's card and sender (and the desk rows under them) load before the page
-  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'hall-kit', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-deck', 'city-decide', 'city-switchboard', 'city'], 'the shell first, as on every hall page');
+  assert.deepEqual(scripts, ['dom-utils', 'shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'hall-kit', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-deck', 'city-decide', 'city-switchboard', 'city'], 'the shell first, as on every hall page');
   const css = read('city.css').replace(/\/\*[\s\S]*?\*\//g, '');
   assert.match(css, /\.city-main \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
   assert.match(css, /html\[data-fullscreen="on"\] \.city-main \{ top: 0; left: 0; \}/);

package/tests/hall_fullscreen.mjs

@@ -18,6 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -104,6 +105,7 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
   };
   let resizes = 0;
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     // `meId` answers /me once with that builder; otherwise the read never settles.
     BongosClient: { createClient: () => ({ request: () => (meId == null ? new Promise(() => {})

package/tests/hall_gov_real_site.mjs

@@ -31,6 +31,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -300,6 +301,7 @@ function baseWindow(hash = '') {
   const store = new Map();
   const ls = { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, String(v)), removeItem: (k) => store.delete(k) };
   return {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     innerWidth: 1440, innerHeight: 900, location: { hash, href: '', search: '', pathname: '/' },
     localStorage: ls, sessionStorage: ls,
     matchMedia: () => ({ matches: true, addEventListener() {} }), addEventListener() {}, removeEventListener() {},

package/tests/hall_kit_charts.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -299,7 +300,7 @@ function runPage(file, extraWindow = {}) {
     { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
   const sandbox = {
     window: {
-      OTB: { escapeHtml: esc, $: () => null, fmtNum: (n) => String(n ?? 0), fmtDate: (s) => String(s ?? '') },
+      OTB: { ...realOTB(), escapeHtml: esc, $: () => null, fmtNum: (n) => String(n ?? 0), fmtDate: (s) => String(s ?? '') },
       __BRANDING__: { currency: { label: 'drachmae' } },
       ...extraWindow,
     },

package/tests/hall_my_agents.mjs

@@ -26,6 +26,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -378,7 +379,7 @@ function bootCraft({ session = {} } = {}) {
     getElementById: () => null, querySelector: () => null, querySelectorAll: () => [],
     createElement: () => el(), addEventListener() {}, removeEventListener() {}, dispatchEvent() { return true; },
   };
-  const window = { location: { search: '' }, matchMedia: () => ({ matches: false }), sessionStorage: mk(session), localStorage: mk({}) };
+  const window = { OTB: realOTB(), location: { search: '' }, matchMedia: () => ({ matches: false }), sessionStorage: mk(session), localStorage: mk({}) };
   const sandbox = { window, document, console, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -441,7 +442,7 @@ test('PAGE: in the hall family, with no prototype key', () => {
   const sheets = [...html.matchAll(/href="\/builders\/([a-z-]+\.css)/g)].map((m) => m[1]);
   assert.deepEqual(sheets, ['style.css', 'oversight.css', 'my-agents.css'], 'rides the oversight archetype, linked before its own sheet');
   const scripts = [...html.matchAll(/src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts.slice(0, 3), ['shell-trail', 'craft-mode', 'shell']);
+  assert.deepEqual(scripts.slice(0, 4), ['dom-utils', 'shell-trail', 'craft-mode', 'shell']); // dom-utils first: the shell escapes through it (task 1004876)
   for (const s of ['gov-living', 'gov-positions', 'my-agents']) assert.ok(scripts.includes(s), `loads ${s}.js`);
   assert.doesNotMatch(html, /ma-key|data-proto|Prototype data/, 'nothing on the page is prototype data, so there is no key');
   assert.doesNotMatch(read('my-agents.js'), /governor-overlay/, 'and it reads no overlay');

package/tests/hall_nav.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -136,6 +137,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings', search = '
   };
 
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     // Index pages never reach probeMe (builders.js owns /me there); a non-index
     // boot would, so hand back a never-settling promise rather than fake auth —

package/tests/hall_palette.mjs

@@ -18,7 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { hallSource } from './helpers.mjs';
+import { hallSource, realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -79,7 +79,7 @@ function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work',
     addEventListener() {},
     activeElement: null,
   };
-  const windowObj = { location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
+  const windowObj = { OTB: realOTB(), location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
   const sandbox = {
     window: windowObj, document: documentObj, navigator: { platform: 'Win32', userAgent: 'test' },
     console, setTimeout, clearTimeout, Promise, JSON, Number, String, Array, Object,

package/tests/hall_reading_world.mjs

@@ -59,6 +59,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -429,7 +430,7 @@ test('roadmap\'s two sub-24px controls clear the floor, on both axes', () => {
 // md-reader.js is a browser IIFE that only touches `window` and `location`, so
 // a two-property sandbox is the whole DOM it needs.
 function loadReader() {
-  const sandbox = { window: {}, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/primer' } };
+  const sandbox = { window: { OTB: realOTB() }, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/primer' } };
   vm.createContext(sandbox);
   vm.runInContext(mdReaderJs, sandbox, { filename: 'md-reader.js' });
   return sandbox.window.OTBMdReader;
@@ -644,6 +645,7 @@ async function bootRoadmap({ progress, versions } = {}) {
     },
   };
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     BongosClient: { createClient: () => client },
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     localStorage: { getItem: () => null, setItem() {}, removeItem() {} },

package/tests/hall_reference_world.mjs

@@ -41,6 +41,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -67,7 +68,7 @@ const rule = (css, selector) => {
 
 // md-reader.js is a browser IIFE that only touches `window` and `location`.
 function loadReader() {
-  const sandbox = { window: {}, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/drachmae' } };
+  const sandbox = { window: { OTB: realOTB() }, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/drachmae' } };
   vm.createContext(sandbox);
   vm.runInContext(mdReaderJs, sandbox, { filename: 'md-reader.js' });
   return sandbox.window.OTBMdReader;

package/tests/hall_signout.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
@@ -66,6 +67,7 @@ function driveClick({ page = 'settings', href } = {}) {
   };
 
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => api },
     matchMedia: () => ({ matches: false, addEventListener() {} }),

package/tests/hall_street.mjs

@@ -487,7 +487,7 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
+  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['dom-utils', 'shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 

package/tests/hall_studio_world.mjs

@@ -17,6 +17,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -271,7 +272,7 @@ async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags =
   const handlers = [];
   const window = {
     BongosClient: { createClient: () => ({ request }) },
-    OTB: {
+    OTB: { ...realOTB(),
       // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
       // the same reason categoryChip is: an undefined helper throws mid-render.
       roleAxisLabel: () => 'Role',
@@ -574,6 +575,7 @@ function bootShell() {
   };
   const location = { hostname: 'builders.cloudbongos.com', origin: 'https://builders.cloudbongos.com', pathname: '/studio', hash: '', assign() {}, replace() {} };
   const window = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
     matchMedia: () => ({ matches: false, addEventListener() {} }),

package/tests/hall_tweak_editor.mjs

@@ -19,7 +19,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { makeRunner, makeEl, parseInto, walk, settle } from './helpers.mjs';
+import { makeRunner, makeEl, parseInto, walk, settle, realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -133,6 +133,7 @@ function bootEditor({ search = '?page=landing:index', answers = {}, stored = {}
     },
   };
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: { identity: { productName: 'Cloud Bongos' } }, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
     location: { host: 'builders.cloudbongos.com', hostname: 'builders.cloudbongos.com', protocol: 'https:', origin: 'https://builders.cloudbongos.com', href: 'https://builders.cloudbongos.com/builders/tweak-editor', search, pathname: '/builders/tweak-editor', assign: (u) => { out.navigated = u; } },

package/tests/helpers.mjs

@@ -79,6 +79,20 @@ import { Readable } from 'node:stream';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
+// realOTB — the REAL window.OTB from modules/hall-ui/public/dom-utils.js, built in
+// its own sandbox (task 1004876). Hall scripts escape user text through
+// window.OTB.escapeHtml at call time, so a test that loads one of them without the
+// page's dom-utils.js hands it this: `window.OTB = realOTB()` (or spread
+// `escapeHtml: realOTB().escapeHtml` into a partial stub). The real one, never a
+// re-typed escaper, so a test cannot pass against a weaker copy.
+export const DOM_UTILS_JS = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'dom-utils.js'), 'utf8');
+export function realOTB() {
+  const ctx = { window: {}, document: { querySelector: () => null, createElement: () => ({}) } };
+  vm.createContext(ctx);
+  vm.runInContext(DOM_UTILS_JS, ctx, { filename: 'dom-utils.js' });
+  return ctx.window.OTB;
+}
+
 export const SKIP_MARKER = 'HOST-TOPOLOGY-SKIP';
 
 function emitSkip(missing, note) {
@@ -617,7 +631,7 @@ export function bootProfilePage({ signedIn = true, trail = [], roles = ['ideator
       roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
       roleIsUnset: (d) => !d || d === 'unclassified',
       ROLE_UNSET: 'unclassified',
-      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      escapeHtml: realOTB().escapeHtml, // the real one (task 1004876)
       $: (sel) => documentObj.querySelector(sel),
       fmtNum: (n) => String(n ?? 0),
       fmtDate: (iso) => String(iso ?? '').slice(0, 10),
@@ -729,7 +743,7 @@ export function bootIdeaPage({ idea = null, status = 200, template = null, viewe
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
     OTB: {
-      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      escapeHtml: realOTB().escapeHtml, // the real one (task 1004876)
       $: (sel) => documentObj.querySelector(sel),
       fmtDate: (iso) => String(iso ?? '').slice(0, 10),
       toast() {},
@@ -931,6 +945,7 @@ export function bootSkyPage({
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
+    OTB: realOTB(), // the page loads dom-utils.js first; sky-data.js escapes through it (task 1004876)
     innerWidth, innerHeight, devicePixelRatio: 1,
     matchMedia: () => ({ matches: reduce }),
     localStorage: { getItem: (k) => (k in store ? store[k] : null), setItem: (k, v) => { store[k] = String(v); } },