@bongos/core 1.21.182 → 1.22.1

package/tests/github_install_nudge.mjs

@@ -22,6 +22,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -159,12 +160,14 @@ test('GET /provisioning/instances and /provisioning/instances/:id carry github_i
 function grab(head) {
   const at = HUB.indexOf(`\n  ${head}`);
   assert.ok(at >= 0, `${head} must exist`);
+  const line = HUB.slice(at, HUB.indexOf('\n', at + 1));
+  if (/\}\s*$/.test(line)) return line; // a one-line declaration (esc, task 1004876)
   const end = HUB.indexOf('\n  }', at + 1);
   const close = HUB.slice(end, end + 5) === '\n  };' ? end + 5 : end + 4;
   return HUB.slice(at, close);
 }
 function page() {
-  const ctx = { STATE_GROUP: { active: 'live', error: 'attention', torn_down: 'gone' } };
+  const ctx = { window: { OTB: realOTB() }, STATE_GROUP: { active: 'live', error: 'attention', torn_down: 'gone' } };
   vm.createContext(ctx);
   vm.runInContext(['function esc(', 'function ghInstallRow(', 'function groupFor('].map(grab).join('\n'), ctx);
   return ctx;

package/tests/goal_map_page.mjs

@@ -431,9 +431,9 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<main id="hall-main" class="sky-stage">/, 'the sky is drawn in the stage, the skip link\'s target');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
   // criterion-uat-ui.js (task 1004402): the rings' UAT state words, shared with the goal page.
-  assert.deepEqual(scripts(html).filter((s) => !['shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
+  assert.deepEqual(scripts(html).filter((s) => !['dom-utils.js', 'shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
   // Both doors load the shell (tasks 1004327, 1004430); the SKY's files are the same.
-  const skyScripts = (h) => scripts(h).filter((s) => !['shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0]));
+  const skyScripts = (h) => scripts(h).filter((s) => !['dom-utils.js', 'shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0]));
   assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');
   assert.equal(html.match(/thinking\.css\?v=([^"]+)/)[1], thinking.match(/thinking\.css\?v=([^"]+)/)[1]);
   assert.match(read('thinking.css'), /body\[data-page\] \.sky-stage \{/, 'the sheet dresses the one stage both doors draw in inside the hall');

package/tests/hall_approval_queue.mjs

@@ -18,7 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { makeRunner, makeEl, walk, settle } from './helpers.mjs';
+import { makeRunner, makeEl, walk, settle, realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -105,7 +105,7 @@ function bootPanel({ answers = {}, writes = null, mode = 'light' } = {}) {
       return val.__status ? { ok: false, status: val.__status, data: val.data } : { ok: true, status: 200, data: val };
     },
   };
-  const win = { matchMedia: () => ({ matches: false }), __BRANDING__: { identity: { productName: 'Cloud Bongos', worldName: 'the studio' } } };
+  const win = { OTB: realOTB(), matchMedia: () => ({ matches: false }), __BRANDING__: { identity: { productName: 'Cloud Bongos', worldName: 'the studio' } } };
   const ctx = vm.createContext({ window: win, document: documentObj, console, setTimeout, clearTimeout, encodeURIComponent });
   win.window = win;
   vm.runInContext(read('brand-holes.js'), ctx, { filename: 'brand-holes.js' });

package/tests/hall_city.mjs

@@ -288,7 +288,7 @@ test('the city sits in the hall chrome, behind the shell\'s full-screen switch',
   // task 1004685 (the living city): gov-living.js, the model under the drawing, and
   // gov-feeds.js, its one reader per page (shared with the shell's tally), load before it
   // task 1004702: the card answers its first ask in place, so the deck's card and sender (and the desk rows under them) load before the page
-  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'hall-kit', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-deck', 'city-decide', 'city-switchboard', 'city'], 'the shell first, as on every hall page');
+  assert.deepEqual(scripts, ['dom-utils', 'shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'hall-kit', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-deck', 'city-decide', 'city-switchboard', 'city'], 'the shell first, as on every hall page');
   const css = read('city.css').replace(/\/\*[\s\S]*?\*\//g, '');
   assert.match(css, /\.city-main \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
   assert.match(css, /html\[data-fullscreen="on"\] \.city-main \{ top: 0; left: 0; \}/);

package/tests/hall_fullscreen.mjs

@@ -18,6 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -104,6 +105,7 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
   };
   let resizes = 0;
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     // `meId` answers /me once with that builder; otherwise the read never settles.
     BongosClient: { createClient: () => ({ request: () => (meId == null ? new Promise(() => {})

package/tests/hall_gov_real_site.mjs

@@ -31,6 +31,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -300,6 +301,7 @@ function baseWindow(hash = '') {
   const store = new Map();
   const ls = { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, String(v)), removeItem: (k) => store.delete(k) };
   return {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     innerWidth: 1440, innerHeight: 900, location: { hash, href: '', search: '', pathname: '/' },
     localStorage: ls, sessionStorage: ls,
     matchMedia: () => ({ matches: true, addEventListener() {} }), addEventListener() {}, removeEventListener() {},

package/tests/hall_kit_charts.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -299,7 +300,7 @@ function runPage(file, extraWindow = {}) {
     { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
   const sandbox = {
     window: {
-      OTB: { escapeHtml: esc, $: () => null, fmtNum: (n) => String(n ?? 0), fmtDate: (s) => String(s ?? '') },
+      OTB: { ...realOTB(), escapeHtml: esc, $: () => null, fmtNum: (n) => String(n ?? 0), fmtDate: (s) => String(s ?? '') },
       __BRANDING__: { currency: { label: 'drachmae' } },
       ...extraWindow,
     },

package/tests/hall_my_agents.mjs

@@ -26,6 +26,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -378,7 +379,7 @@ function bootCraft({ session = {} } = {}) {
     getElementById: () => null, querySelector: () => null, querySelectorAll: () => [],
     createElement: () => el(), addEventListener() {}, removeEventListener() {}, dispatchEvent() { return true; },
   };
-  const window = { location: { search: '' }, matchMedia: () => ({ matches: false }), sessionStorage: mk(session), localStorage: mk({}) };
+  const window = { OTB: realOTB(), location: { search: '' }, matchMedia: () => ({ matches: false }), sessionStorage: mk(session), localStorage: mk({}) };
   const sandbox = { window, document, console, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
@@ -441,7 +442,7 @@ test('PAGE: in the hall family, with no prototype key', () => {
   const sheets = [...html.matchAll(/href="\/builders\/([a-z-]+\.css)/g)].map((m) => m[1]);
   assert.deepEqual(sheets, ['style.css', 'oversight.css', 'my-agents.css'], 'rides the oversight archetype, linked before its own sheet');
   const scripts = [...html.matchAll(/src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts.slice(0, 3), ['shell-trail', 'craft-mode', 'shell']);
+  assert.deepEqual(scripts.slice(0, 4), ['dom-utils', 'shell-trail', 'craft-mode', 'shell']); // dom-utils first: the shell escapes through it (task 1004876)
   for (const s of ['gov-living', 'gov-positions', 'my-agents']) assert.ok(scripts.includes(s), `loads ${s}.js`);
   assert.doesNotMatch(html, /ma-key|data-proto|Prototype data/, 'nothing on the page is prototype data, so there is no key');
   assert.doesNotMatch(read('my-agents.js'), /governor-overlay/, 'and it reads no overlay');

package/tests/hall_nav.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -136,6 +137,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings', search = '
   };
 
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     // Index pages never reach probeMe (builders.js owns /me there); a non-index
     // boot would, so hand back a never-settling promise rather than fake auth —

package/tests/hall_palette.mjs

@@ -18,7 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { hallSource } from './helpers.mjs';
+import { hallSource, realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -79,7 +79,7 @@ function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work',
     addEventListener() {},
     activeElement: null,
   };
-  const windowObj = { location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
+  const windowObj = { OTB: realOTB(), location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
   const sandbox = {
     window: windowObj, document: documentObj, navigator: { platform: 'Win32', userAgent: 'test' },
     console, setTimeout, clearTimeout, Promise, JSON, Number, String, Array, Object,

package/tests/hall_reading_world.mjs

@@ -59,6 +59,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -429,7 +430,7 @@ test('roadmap\'s two sub-24px controls clear the floor, on both axes', () => {
 // md-reader.js is a browser IIFE that only touches `window` and `location`, so
 // a two-property sandbox is the whole DOM it needs.
 function loadReader() {
-  const sandbox = { window: {}, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/primer' } };
+  const sandbox = { window: { OTB: realOTB() }, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/primer' } };
   vm.createContext(sandbox);
   vm.runInContext(mdReaderJs, sandbox, { filename: 'md-reader.js' });
   return sandbox.window.OTBMdReader;
@@ -644,6 +645,7 @@ async function bootRoadmap({ progress, versions } = {}) {
     },
   };
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     BongosClient: { createClient: () => client },
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     localStorage: { getItem: () => null, setItem() {}, removeItem() {} },

package/tests/hall_reference_world.mjs

@@ -41,6 +41,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
@@ -67,7 +68,7 @@ const rule = (css, selector) => {
 
 // md-reader.js is a browser IIFE that only touches `window` and `location`.
 function loadReader() {
-  const sandbox = { window: {}, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/drachmae' } };
+  const sandbox = { window: { OTB: realOTB() }, location: { hostname: 'builders.example.com', href: 'https://builders.example.com/drachmae' } };
   vm.createContext(sandbox);
   vm.runInContext(mdReaderJs, sandbox, { filename: 'md-reader.js' });
   return sandbox.window.OTBMdReader;

package/tests/hall_signout.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
@@ -66,6 +67,7 @@ function driveClick({ page = 'settings', href } = {}) {
   };
 
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => api },
     matchMedia: () => ({ matches: false, addEventListener() {} }),

package/tests/hall_street.mjs

@@ -487,7 +487,7 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
+  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['dom-utils', 'shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 

package/tests/hall_studio_world.mjs

@@ -17,6 +17,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -271,7 +272,7 @@ async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags =
   const handlers = [];
   const window = {
     BongosClient: { createClient: () => ({ request }) },
-    OTB: {
+    OTB: { ...realOTB(),
       // task 1003936 — the role axis vocabulary (dom-utils OTB.role*). PRESENT for
       // the same reason categoryChip is: an undefined helper throws mid-render.
       roleAxisLabel: () => 'Role',
@@ -574,6 +575,7 @@ function bootShell() {
   };
   const location = { hostname: 'builders.cloudbongos.com', origin: 'https://builders.cloudbongos.com', pathname: '/studio', hash: '', assign() {}, replace() {} };
   const window = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
     matchMedia: () => ({ matches: false, addEventListener() {} }),

package/tests/hall_tweak_editor.mjs

@@ -19,7 +19,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
-import { makeRunner, makeEl, parseInto, walk, settle } from './helpers.mjs';
+import { makeRunner, makeEl, parseInto, walk, settle, realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -133,6 +133,7 @@ function bootEditor({ search = '?page=landing:index', answers = {}, stored = {}
     },
   };
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     __BRANDING__: { identity: { productName: 'Cloud Bongos' } }, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
     location: { host: 'builders.cloudbongos.com', hostname: 'builders.cloudbongos.com', protocol: 'https:', origin: 'https://builders.cloudbongos.com', href: 'https://builders.cloudbongos.com/builders/tweak-editor', search, pathname: '/builders/tweak-editor', assign: (u) => { out.navigated = u; } },

package/tests/helpers.mjs

@@ -79,6 +79,20 @@ import { Readable } from 'node:stream';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
+// realOTB — the REAL window.OTB from modules/hall-ui/public/dom-utils.js, built in
+// its own sandbox (task 1004876). Hall scripts escape user text through
+// window.OTB.escapeHtml at call time, so a test that loads one of them without the
+// page's dom-utils.js hands it this: `window.OTB = realOTB()` (or spread
+// `escapeHtml: realOTB().escapeHtml` into a partial stub). The real one, never a
+// re-typed escaper, so a test cannot pass against a weaker copy.
+export const DOM_UTILS_JS = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'dom-utils.js'), 'utf8');
+export function realOTB() {
+  const ctx = { window: {}, document: { querySelector: () => null, createElement: () => ({}) } };
+  vm.createContext(ctx);
+  vm.runInContext(DOM_UTILS_JS, ctx, { filename: 'dom-utils.js' });
+  return ctx.window.OTB;
+}
+
 export const SKIP_MARKER = 'HOST-TOPOLOGY-SKIP';
 
 function emitSkip(missing, note) {
@@ -617,7 +631,7 @@ export function bootProfilePage({ signedIn = true, trail = [], roles = ['ideator
       roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
       roleIsUnset: (d) => !d || d === 'unclassified',
       ROLE_UNSET: 'unclassified',
-      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      escapeHtml: realOTB().escapeHtml, // the real one (task 1004876)
       $: (sel) => documentObj.querySelector(sel),
       fmtNum: (n) => String(n ?? 0),
       fmtDate: (iso) => String(iso ?? '').slice(0, 10),
@@ -729,7 +743,7 @@ export function bootIdeaPage({ idea = null, status = 200, template = null, viewe
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
     OTB: {
-      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      escapeHtml: realOTB().escapeHtml, // the real one (task 1004876)
       $: (sel) => documentObj.querySelector(sel),
       fmtDate: (iso) => String(iso ?? '').slice(0, 10),
       toast() {},
@@ -931,6 +945,7 @@ export function bootSkyPage({
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
+    OTB: realOTB(), // the page loads dom-utils.js first; sky-data.js escapes through it (task 1004876)
     innerWidth, innerHeight, devicePixelRatio: 1,
     matchMedia: () => ({ matches: reduce }),
     localStorage: { getItem: (k) => (k in store ? store[k] : null), setItem: (k, v) => { store[k] = String(v); } },

package/tests/html_escape.mjs

@@ -0,0 +1,149 @@
+// tests/html_escape.mjs — the ONE HTML escaper per side (task 1004876, goal 1000135).
+//
+// The escaper is what keeps a builder's own words (a task title, an idea) from
+// becoming live markup on another builder's screen. ~45 private copies were
+// collapsed onto two: window.OTB.escapeHtml (modules/hall-ui/public/dom-utils.js)
+// in the browser and escapeHtml (src/html-escape.js, re-exported by the module
+// doorway) on the server. These tests pin:
+//   1. both shared escapers escape all five characters, map null/undefined to '',
+//      and agree with each other on every input;
+//   2. the module doorway hands modules the very same function;
+//   3. pages that used to carry a private copy now render user text through the
+//      shared one (a title with <, & and a quote stays text);
+//   4. the fitness check goes red on a third definition, and on a hall page that
+//      loads dom-utils.js after (or deferred behind) the scripts that need it.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules', 'hall-ui', 'public');
+
+const { escapeHtml: serverEscape } = require('../src/html-escape.js');
+const guard = require('../scripts/bongos/escape-helper-guard.js');
+
+// Load the real dom-utils.js into a sandbox and hand back its window.OTB.
+function browserOTB() {
+  const sandbox = { window: {}, document: { querySelector: () => null } };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(PUB, 'dom-utils.js'), 'utf8'), sandbox, { filename: 'dom-utils.js' });
+  return sandbox.window.OTB;
+}
+
+const HOSTILE = `<img src=x onerror="alert('x')"> & "quoted" 'single' a&amp;b`;
+const CASES = [HOSTILE, '', 'plain', 0, 42, -1.5, true, false, null, undefined, '&lt;', '<<>>', "it's", '"'];
+
+test('server escaper escapes all five HTML characters', () => {
+  assert.equal(serverEscape(`<a href="x" title='y'>&</a>`),
+    '&lt;a href=&quot;x&quot; title=&#39;y&#39;&gt;&amp;&lt;/a&gt;');
+});
+
+test('server escaper: null/undefined render as empty text, numbers and booleans as their string', () => {
+  assert.equal(serverEscape(null), '');
+  assert.equal(serverEscape(undefined), '');
+  assert.equal(serverEscape(0), '0');
+  assert.equal(serverEscape(42), '42');
+  assert.equal(serverEscape(false), 'false');
+});
+
+test('server escaper escapes an ampersand first, so an existing entity is shown literally', () => {
+  assert.equal(serverEscape('&lt;'), '&amp;lt;');
+});
+
+test('browser and server escapers agree on every input', () => {
+  const OTB = browserOTB();
+  for (const c of CASES) assert.equal(OTB.escapeHtml(c), serverEscape(c), `input ${JSON.stringify(c)}`);
+});
+
+test('the module doorway exports the shared server escaper', () => {
+  const api = require('../src/module-api.js');
+  assert.equal(api.escapeHtml, serverEscape);
+});
+
+test('a hall helper that dropped its private copy renders user text through window.OTB', () => {
+  // hall-kit.js used to carry its own esc() (exported as OTBKit.esc); it must now delegate, at call time.
+  const sandbox = { window: {}, document: { querySelector: () => null } };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(PUB, 'dom-utils.js'), 'utf8'), sandbox);
+  vm.runInContext(fs.readFileSync(path.join(PUB, 'hall-kit.js'), 'utf8'), sandbox);
+  const lib = sandbox.window.OTBKit;
+  assert.ok(lib && typeof lib.esc === 'function', 'hall-kit exposes esc');
+  assert.equal(lib.esc('Fix <b> & "q" \'s\''), 'Fix &lt;b&gt; &amp; &quot;q&quot; &#39;s&#39;');
+  assert.equal(lib.esc(null), '');
+});
+
+test('fitness: a third escape table anywhere in the code is a hard fail', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'esc-guard-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'src'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'modules', 'x', 'public'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'modules', 'x', 'tests'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'src', 'html-escape.js'), "const T = { '<': '&lt;' };\n");
+    fs.writeFileSync(path.join(tmp, 'modules', 'x', 'tests', 't.mjs'), "const T = { '<': '&lt;' };\n");
+    let r = guard.checkOneHtmlEscaper({ root: tmp });
+    assert.equal(r.ok, true, r.violations.join('\n'));
+    // A renamed copy is still caught: the detector reads the table, not the name.
+    fs.writeFileSync(path.join(tmp, 'modules', 'x', 'public', 'page.js'),
+      "const hesc = (s) => String(s).replace(/</g, '&lt;');\n");
+    r = guard.checkOneHtmlEscaper({ root: tmp });
+    assert.equal(r.ok, false);
+    assert.equal(r.hardFail, true);
+    assert.match(r.violations[0], /modules\/x\/public\/page\.js:1/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('fitness: a delegate to the shared escaper is not a copy', () => {
+  assert.deepEqual(guard.findEscapeTables('function esc(s) { return window.OTB.escapeHtml(s); }'), []);
+  assert.deepEqual(guard.findEscapeTables("s.replace(/&lt;/g, '<')"), [], 'a DECODER is not an escaper');
+  assert.deepEqual(guard.findEscapeTables("x\n{ '<': \"&lt;\" }"), [2]);
+});
+
+test('fitness: a local escaper name that does not delegate is a hard fail (the old primer fallback)', () => {
+  const browser = { browser: true };
+  assert.deepEqual(guard.findFakeDelegates("  const escapeHtml = (MD && MD.escapeHtml) || ((s) => String(s));", browser), [],
+    'names the shared one — but the line-level rule cannot see the fallback, so primer.js no longer has one');
+  assert.deepEqual(guard.findFakeDelegates('  const escapeHtml = (s) => String(s);', browser), [1]);
+  assert.deepEqual(guard.findFakeDelegates('  function esc(s) { return s; }', browser), [1]);
+  assert.deepEqual(guard.findFakeDelegates('  function esc(s) { return window.OTB.escapeHtml(s); }', browser), []);
+  assert.deepEqual(guard.findFakeDelegates('  var esc = kit.esc;', browser), []);
+  // server: `esc` is also a regex/markdown escaper name there, so only the HTML names are held
+  assert.deepEqual(guard.findFakeDelegates("const esc = (k) => k.replace(/[.*]/g, '\\\\$&');"), []);
+  assert.deepEqual(guard.findFakeDelegates('const hesc = (s) => String(s);'), [1]);
+  assert.deepEqual(guard.findFakeDelegates("const { escapeHtml: hesc } = require('../../src/html-escape');"), []);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'esc-guard-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'modules', 'x', 'public'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'modules', 'x', 'public', 'p.js'), 'const esc = (s) => String(s);\n');
+    const r = guard.checkOneHtmlEscaper({ root: tmp });
+    assert.equal(r.ok, false);
+    assert.match(r.violations[0], /p\.js:1 — defines a local HTML escaper name/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('fitness: the guard is registered in fitness.js CHECKS, so CI runs it', () => {
+  const fitness = require('../scripts/bongos/fitness.js');
+  const checks = fitness.CHECKS || fitness.checks;
+  assert.ok(Array.isArray(checks), 'fitness.js exports its CHECKS list');
+  assert.ok(checks.includes(guard.checkOneHtmlEscaper), 'checkOneHtmlEscaper is one of the fitness checks');
+});
+
+test('fitness: a hall page must load dom-utils.js first and synchronously', () => {
+  const ok = '<script src="/builders/dom-utils.js?v=1"></script><script src="/builders/shell.js"></script>';
+  assert.equal(guard.hallPageOrderProblem(ok), null);
+  assert.equal(guard.hallPageOrderProblem('<p>no scripts</p>'), null);
+  assert.match(guard.hallPageOrderProblem('<script src="/builders/shell.js"></script><script src="/builders/dom-utils.js"></script>'), /before/);
+  assert.match(guard.hallPageOrderProblem('<script src="/builders/dom-utils.js" defer></script><script src="/builders/shell.js"></script>'), /defer/);
+  assert.match(guard.hallPageOrderProblem('<script src="/builders/shell.js"></script>'), /never/);
+});
+
+test('fitness: the real tree holds exactly the two shared escapers', () => {
+  const r = guard.checkOneHtmlEscaper();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+});

package/tests/lightbulb.mjs

@@ -17,6 +17,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -265,6 +266,7 @@ function boot({ storage = {}, throwing = false, respond } = {}) {
     ? { ok: true, status: 200, json: { ideas: [{ id: '5', title: '<b>Bold</b> idea', author_name: 'Bo', captured_at: '2026-10-01T00:00:00Z' }] } }
     : { ok: true, status: 201, json: { ideas: [{ id: '801', title: 'Sort drafts' }, { id: '802', title: 'Name writers' }], split_by: 'ai' } }));
   const win = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     location: { pathname: '/studio' },
     localStorage: store,
     fetch: (url, opts) => {

package/tests/module_api.mjs

@@ -20,6 +20,7 @@ const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 // `withTx` was added; no enabled module at its pinned coreVersion lost a capability.
 const PUBLISHED_SURFACE = [
   'CORE_VERSION',
+  'escapeHtml', // task 1004876: THE server-side HTML escaper (1.22.0) — modules render user text through it, never a private copy
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'requireActAlone', // added by task 1004657 (ADR 0363 D5): a building's own page asks its decision-rules row before one builder acts alone. On the doorway because eight buildings' pages live in six modules and core, and each must refuse the same way People does

package/tests/module_store_howto.mjs

@@ -16,6 +16,7 @@ import os from 'node:os';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -173,7 +174,7 @@ test('a delisted module\'s how-to still reads for people who hold it, and only f
 // ---- the page: the author's markdown is untrusted input ----
 
 function loadReader() {
-  const ctx = { window: {}, location: { href: 'https://builders.example.com/builders/modules', hostname: 'builders.example.com' }, URL };
+  const ctx = { window: { OTB: realOTB() }, location: { href: 'https://builders.example.com/builders/modules', hostname: 'builders.example.com' }, URL };
   vm.createContext(ctx);
   vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/md-reader.js'), 'utf8'), ctx);
   return ctx.window.OTBMdReader;

package/tests/nav_permission_atoms.mjs

@@ -93,7 +93,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // says a held core version was tried and rolled back; task 1004731: the one-time
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852).
-const SHELL_SHA = '670b2f71085c13b6';
+const SHELL_SHA = 'cea38eeab6b234cc';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/npm_release_where.mjs

@@ -18,7 +18,7 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
-import { npmTarball, npmPackument, fakeHttpsGet } from './helpers.mjs';
+import { npmTarball, npmPackument, fakeHttpsGet, realOTB } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -193,6 +193,7 @@ function bootWidget(answer, { shown = null } = {}) {
   const listeners = {};
   const asked = [];
   const windowObj = {
+    OTB: realOTB(), // the page loads dom-utils.js first (task 1004876)
     OTBTaskShown: shown,
     BongosClient: { createClient: () => ({ request: async (m, url) => { asked.push(url); return answer(url); } }) },
   };

package/tests/page_notes_panel.mjs

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -59,7 +60,7 @@ function boot({ session = {}, search = '' } = {}) {
   };
   const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
   const opened = [];
-  const window = { localStorage: mk({}), sessionStorage: mk(session), matchMedia: () => ({ matches: false }), location: { search } };
+  const window = { OTB: realOTB(), localStorage: mk({}), sessionStorage: mk(session), matchMedia: () => ({ matches: false }), location: { search } };
   // "Loading" page-notes.js: record the tag, then define the API it would define.
   head.onAppend = (tag) => {
     loaded.push(tag.src);
@@ -115,7 +116,7 @@ test('a ?note= link opens that doc on arrival, in any mode', async () => {
 
 // ---------- the reader ----------
 function reader() {
-  const window = { location: { pathname: '/studio' } };
+  const window = { OTB: realOTB(), location: { pathname: '/studio' } };
   const document = { body: { dataset: { page: 'studio', pageTitle: 'Studio' } }, title: 'Studio — hall' };
   const sandbox = { window, document };
   vm.createContext(sandbox);
@@ -206,7 +207,7 @@ function dockedPanel({ reviewing = null, opened = false } = {}) {
     experiences: () => [{ id: 'ideating', label: 'Ideator experience', short: 'Ideating' }, { id: 'building', label: 'Building experience', short: 'Building' }],
     iconHtml: () => '<svg></svg>',
   };
-  const window = { location: { pathname: '/studio' }, OTBCraftMode: craft };
+  const window = { OTB: realOTB(), location: { pathname: '/studio' }, OTBCraftMode: craft };
   const sandbox = { window, document, fetch, setTimeout, clearTimeout, Promise };
   vm.createContext(sandbox);
   vm.runInContext(NOTES, sandbox, { filename: 'page-notes.js' });

package/tests/paintbrush.mjs

@@ -17,6 +17,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -157,7 +158,7 @@ function boot({ round = null, draft = null, claim = { status: 200, body: { ok: t
     return respond(404, {});
   };
   const winListeners = {};
-  const window = { location: { pathname: '/roadmap' }, addEventListener: (t, fn) => { (winListeners[t] ||= []).push(fn); }, removeEventListener: (t, fn) => { winListeners[t] = (winListeners[t] || []).filter((f) => f !== fn); } };
+  const window = { OTB: realOTB(), location: { pathname: '/roadmap' }, addEventListener: (t, fn) => { (winListeners[t] ||= []).push(fn); }, removeEventListener: (t, fn) => { winListeners[t] = (winListeners[t] || []).filter((f) => f !== fn); } };
   const sandbox = { window, document, fetch, Promise, setTimeout, clearTimeout, JSON, Math, String, Array, Object };
   window.window = window;
   vm.createContext(sandbox);