@bongos/core 1.21.182 → 1.22.1

package/modules/hall-ui/public/approval-queue.js

@@ -32,9 +32,9 @@
   // chip (brand-holes.js, task 1004381). Escaped text when it is not loaded.
   const H = window.OTBBrandHoles || null;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-  }
+  // The shared escaper, window.OTB (dom-utils.js, task 1004876). Browser-only: this
+  // file reads window at the top of its IIFE, so it never loads under plain Node.
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   function errWords(data, fallback) {
     const e = data && data.error;

package/modules/hall-ui/public/atlas.html

@@ -89,9 +89,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/atlas.js

@@ -290,7 +290,7 @@
     if (conns.length) html += '<div class="ab-prow">Connects to</div><div class="ab-chips">' + conns.map(function (cc) { return '<button type="button" class="fact-chip ab-jump" data-node="' + esc(cc.id) + '">' + esc(cc.label) + '</button>'; }).join('') + '</div>';
     return html;
   }
-  function esc(s) { return String(s).replace(/[&<>"]/g, function (c) { return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]; }); }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   function openPopup(n, g) {
     selected = n.id; lightNode(n.id);

package/modules/hall-ui/public/blockers.html

@@ -51,14 +51,13 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE blockers.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
+<!-- the branding pack's currency label, loaded BEFORE blockers.js. -->
 <script src="/builders/brand-apply.js"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- task-detail.js still owns the #/blocker/N deep-link overlay every row's

package/modules/hall-ui/public/board-room.html

@@ -58,12 +58,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-board"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- task 1003761: the vocabulary this page and /government both speak. Must load
      BEFORE board-room.js, which destructures window.OTBBoardLib at IIFE entry. -->

package/modules/hall-ui/public/brand-holes.js

@@ -26,9 +26,9 @@
 
   const HOLE_RE = /\{\{([A-Za-z][A-Za-z0-9_]*)\}\}/g;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   function splitHoles(text) {
     const s = String(text == null ? '' : text);

package/modules/hall-ui/public/city.html

@@ -105,9 +105,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/collab.html

@@ -148,11 +148,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>
 <script src="/builders/collab.js?v=2026-09-24-archive"></script>
 </body>

package/modules/hall-ui/public/commands.html

@@ -51,12 +51,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/commands-lib.js"></script>
 <script src="/builders/commands.js"></script>

package/modules/hall-ui/public/commands.js

@@ -14,8 +14,7 @@
   'use strict';
 
   const lib = window.OTBCommandsLib;
-  const esc = (window.OTBKit && window.OTBKit.esc) || ((s) => String(s == null ? '' : s)
-    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;'));
+  const esc = (s) => window.OTB.escapeHtml(s);
 
   async function getJson(url) {
     const r = await fetch(url, { credentials: 'same-origin' });

package/modules/hall-ui/public/copy-desk.html

@@ -177,11 +177,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/copy-desk.js?v=2026-09-01-redesign"></script>
 </body>

package/modules/hall-ui/public/core-move-notice.js

@@ -18,11 +18,7 @@
   'use strict';
 
   var SEEN_KEY = 'bongos.coreMove.seen';
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   /** Draw the notice under the top bar. `opts.api` is shell.js's client; `opts.href` Settings. */
   function render(moved, opts) {

package/modules/hall-ui/public/craft-mode.js

@@ -509,11 +509,7 @@
   // localStorage: the mode to keep when "Ask me again next session" is unticked.
   var KEEP_KEY = 'hall-craft-keep';
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function icon(id, cls) {
     return '<svg class="' + cls + '" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + ICONS[id] + '</svg>';
   }

package/modules/hall-ui/public/criterion-uat-ui.js

@@ -43,9 +43,9 @@
   const MAX_BYTES = 100 * 1024 * 1024;
   const TYPES = ['video/mp4', 'video/webm'];
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   // The state a row reads as. A server older than the UAT rule sends no
   // uat_state; then satisfied/open is the whole truth and no UAT control shows.

package/modules/hall-ui/public/deploy.html

@@ -76,11 +76,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- the shared ask card the move is drawn with (task 1004829) -->
 <script src="/builders/hall-ask.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -94,9 +94,10 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/dom-utils.js

@@ -1,7 +1,12 @@
 // public-builders/dom-utils.js — shared frontend toolkit for the builders' hall
 // (GDS-V4 C4 / task 1088). Loaded as the FIRST hall <script> on each page so the
 // per-page IIFEs can pull these from one place instead of redefining them.
-// Attaches a single global, `window.OTB`.
+// Attaches a single global, `window.OTB` (and is its module.exports under Node).
+//
+// escapeHtml here is THE browser HTML escaper (task 1004876): every hall script
+// — and the landing's projects page — escapes user text through it, and the
+// fitness check scripts/bongos/escape-helper-guard.js fails on a third copy and
+// on any hall page that does not load this file first, without defer.
 //
 // NOT a consumer: modules/status-ui/public/ (the off-box status mirror) stays
 // self-contained by design — do not wire this there. Network helpers
@@ -19,11 +24,11 @@
 (() => {
   'use strict';
 
-  // HTML-escape for text interpolated into innerHTML. (8 byte-equivalent copies.)
+  // HTML-escape for text interpolated into innerHTML: & < > " ' ; null/undefined → ''.
+  // The server twin is src/html-escape.js; tests/html_escape.mjs holds them equal.
+  const ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
   function escapeHtml(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
+    return String(s ?? '').replace(/[&<>"']/g, (c) => ESCAPES[c]);
   }
 
   // querySelector shorthand. (7 copies; pair.js's single-arg form is a subset.)
@@ -460,7 +465,7 @@
     } catch (err) { return null; }
   }
 
-  window.OTB = {
+  const OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn, disciplines,
     // task 1003936 — ONE word for the role axis, all six surfaces
     roleAxisLabel, roleLabel, roleWord, roleOptions, roleIsUnset, ROLE_UNSET,
@@ -472,4 +477,8 @@
     categoryChip, // task 1003276 — shared by the Goals page, the Tasks board and the task page
     hubOrigin, // task 1003485 — the hub account page's origin, for Settings and the profile nudge
   };
+  if (typeof window !== 'undefined') window.OTB = OTB;
+  // Node: the hall libs that also load under require() (hall-kit.js, task-lib.js, …)
+  // escape through this same function there (task 1004876).
+  if (typeof module !== 'undefined' && module.exports) module.exports = OTB;
 })();

package/modules/hall-ui/public/drachmae.html

@@ -94,9 +94,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet-costs.js

@@ -20,8 +20,9 @@
     'co-tenant': 'Shared server (retired)',
   };
 
-  const ESC = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
-  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ESC[c]);
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  const esc = (s) => (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s);
   const isPriced = (v) => typeof v === 'number' && Number.isFinite(v);
   const quiet = (text) => `<span class="ledger__est">${text}</span>`;
 

package/modules/hall-ui/public/fleet.html

@@ -55,11 +55,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/fleet-costs.js"></script>
 <script src="/builders/fleet.js"></script>

package/modules/hall-ui/public/founding-mark.js

@@ -18,12 +18,7 @@
     charter: 'charter', legalize: 'legalize', legislation: 'legislation',
   };
 
-  function esc(s) {
-    if (window.OTB && typeof window.OTB.escapeHtml === 'function') return window.OTB.escapeHtml(s);
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   // One request per page, shared by every surface on it. Any failure (signed out, the
   // onboarding module off, a network blip) is an empty list: no marks, today's page.

package/modules/hall-ui/public/gate.html

@@ -62,12 +62,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/gate.js?v=2026-10-25-autobongos"></script>
 </body>

package/modules/hall-ui/public/goal-map.html

@@ -137,9 +137,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/goals.html

@@ -234,12 +234,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <!-- shared component kit (window.OTBKit) — pager, filter bar, tabs, empty/skeleton (task 2166). -->

package/modules/hall-ui/public/government.html

@@ -132,12 +132,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- task 1003761: the vocabulary this page and /board-room both speak. Must load
      BEFORE government.js, which destructures window.OTBBoardLib at IIFE entry. -->

package/modules/hall-ui/public/hall-ask.js

@@ -16,9 +16,9 @@
 // Every string is escaped here; `saidHtml` is the one pre-built slot, for a
 // caller whose facts are already escaped markup (blockerFacts).
 (function () {
-  const esc = (s) => String(s == null ? '' : s)
-    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  const esc = (s) => (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s);
   const attrsOf = (a) => Object.keys(a || {})
     .filter((k) => a[k] != null && a[k] !== false)
     .map((k) => ` ${k}="${esc(a[k])}"`).join('');

package/modules/hall-ui/public/hall-kit.js

@@ -27,11 +27,9 @@
   'use strict';
 
   // HTML-escape for text interpolated into innerHTML.
-  function esc(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
   const $id = (id) => document.getElementById(id);
 
   // ---- pager ----------------------------------------------------------------

package/modules/hall-ui/public/hall-visual.js

@@ -27,11 +27,9 @@
   'use strict';
 
   // HTML-escape for text interpolated into innerHTML.
-  function esc(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   // Same-origin, SERVER-MINTED paths only. The URL arrives from our own API, but
   // it lands in an href and a src, so it is matched literally against the shape

package/modules/hall-ui/public/idea.html

@@ -50,11 +50,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref
      written inside an idea's own prose keeps resolving from this page. -->
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail2" defer></script>

package/modules/hall-ui/public/ideas.html

@@ -225,11 +225,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -106,7 +106,7 @@
      / ADR 0069 — no client lib to load (EventSource is built into the browser). -->
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so every consuming
      IIFE below can pull escapeHtml/$/fmtNum/... from one place. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
 <!-- R56 (task 1195): apply the instance currency label from window.__BRANDING__
      to [data-currency-label]/[data-currency-tmpl] markup + expose OTBBranding.
@@ -119,7 +119,7 @@
 <script src="/builders/welcome-boot.js?v=2026-10-23-city1" defer></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3" defer></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos" defer></script>
+<script src="/builders/shell.js?v=2026-10-25-escape" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/lightbulb.js

@@ -20,11 +20,7 @@
 
   var sheet = null, returnFocus = null, saveTimer = null, busy = false;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function plural(n, one, many) { return n + ' ' + (n === 1 ? one : many); }
   function day(iso) {
     var d = iso ? new Date(iso) : null;

package/modules/hall-ui/public/md-reader.js

@@ -21,14 +21,7 @@
 (function () {
   'use strict';
 
-  function escapeHtml(s) {
-    return String(s)
-      .replace(/&/g, '&')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#39;');
-  }
+  function escapeHtml(s) { return window.OTB.escapeHtml(s); }
 
   // Stable slug for heading anchors — lowercase, strip punctuation, dash-join.
   // Matches the primer's slugify so in-doc anchor links behave identically.

package/modules/hall-ui/public/modules.html

@@ -125,12 +125,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-apply.js"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/md-reader.js"></script>

package/modules/hall-ui/public/my-agents.html

@@ -59,12 +59,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/gov-living.js?v=2026-10-10-real1"></script>
 <script src="/builders/gov-positions.js?v=2026-10-09-positions1"></script>
 <script src="/builders/my-agents.js?v=2026-10-17-tidy"></script>

package/modules/hall-ui/public/my-agents.js

@@ -310,7 +310,9 @@
   const API = '/api/bongos';
   const api = root.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
   const $ = (id) => document.getElementById(id);
-  const esc = (s) => str(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  const esc = (s) => (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s);
   const toast = (msg) => { if (root.OTB && root.OTB.toast) root.OTB.toast(msg); };
   const brand = root.__BRANDING__ || {};
   const PROJECT = (brand.identity && (brand.identity.productName || brand.identity.worldName)) || 'The project';

package/modules/hall-ui/public/page-notes.js

@@ -21,11 +21,7 @@
 
   var sheet = null, returnFocus = null, state = null, saveTimer = null, pollTimer = null, docked = false;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   // Where the panel is open. The hall needs no setting; the public site's
   // Artist review button (task 1004499, artist-review.js) calls
   // configure({ surface: 'site', hall: <the hall's origin> }) before it opens.