@bongos/core 1.21.182 → 1.22.2

package/modules/agents/lib/answer-hold.js

@@ -88,4 +88,4 @@ function createAnswerHold({ maxHeld = MAX_HELD, ttlMs = TTL_MS, now = () => Date
   };
 }
 
-module.exports = { createAnswerHold, MAX_HELD, TTL_MS };
+module.exports = { createAnswerHold, TTL_MS };

package/modules/agents/lib/fire-budget.js

@@ -106,4 +106,4 @@ function createFireBudget({
   };
 }
 
-module.exports = { createFireBudget, DEFAULT_LIMIT, DEFAULT_WINDOW_MS, MAX_TRACKED_BUILDERS };
+module.exports = { createFireBudget, DEFAULT_LIMIT, MAX_TRACKED_BUILDERS };

package/modules/autonomy/cadence.js

@@ -342,7 +342,7 @@ function shouldJumpWait(before, after) {
 }
 
 module.exports = {
-  CLASSES, COUNTS_AS_FAILURE, SYSTEMIC_MARKERS, DEFAULTS, START,
-  looksSystemic, classifyEvent, nextCadence, signalFingerprint, shouldJumpWait,
-  workerNeverRan, WORKER_RAN_FLOOR_S,
+  CLASSES, COUNTS_AS_FAILURE, DEFAULTS, START,
+  classifyEvent, nextCadence, signalFingerprint, shouldJumpWait,
+  workerNeverRan,
 };

package/modules/autonomy/config-idle.js

@@ -188,5 +188,5 @@ function createNotifier({ post = null, channel = 'ship_news' } = {}) {
 
 module.exports = {
   GRACE_S, LONG_GRACE_S, CONFIG_IDLE,
-  configIdleCode, trackIdle, idleEvent, markBeat, parseIdleEvent, pendingCode, noticeDecision, noticeText, createNotifier,
+  configIdleCode, trackIdle, idleEvent, markBeat, parseIdleEvent, pendingCode, noticeText, createNotifier,
 };

package/modules/autonomy/fence.js

@@ -361,4 +361,4 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
   return { go: true, code: null, reason: null };
 }
 
-module.exports = { REFUSALS, HOST_ACCESS_PATTERNS, HOST_ACCESS_MIN_SIGNALS, normaliseFence, prioritise, allowedGoals, effectiveFence, decideRun, decideTask, needsHostAccess };
+module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, effectiveFence, decideRun, decideTask, needsHostAccess };

package/modules/autonomy/gauge.js

@@ -301,6 +301,6 @@ function decideCapacity({ gauge, now, config = {} } = {}) {
 }
 
 module.exports = {
-  decideCapacity, readGauge, reserveFor, weeklyPace, whenPaceAllows, localHour,
-  cfg, DEFAULT_CONFIG, WEEK_SECONDS, DEFAULT_STALE_AFTER_S,
+  decideCapacity, readGauge, reserveFor, weeklyPace, whenPaceAllows,
+  cfg, DEFAULT_CONFIG, DEFAULT_STALE_AFTER_S,
 };

package/modules/autonomy/governor-docket.js

@@ -288,5 +288,4 @@ module.exports = {
   runningFloor,
   spendingLimitFloor,
   reportsFloor,
-  fenceHistory,
 };

package/modules/autonomy/server-schedule.js

@@ -34,4 +34,4 @@ function periodMs(routine) {
   return CADENCE_MS[row.cadence];
 }
 
-module.exports = { SERVER_ROUTINES, CADENCE_MS, periodMs, DAY_MS, WEEK_MS };
+module.exports = { SERVER_ROUTINES, periodMs, DAY_MS, WEEK_MS };

package/modules/builder-settings/builder-needs.js

@@ -385,9 +385,7 @@ module.exports = {
   computeNeeds,
   // exported for tests / direct reuse
   artKeyNeed,
-  helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed, mingleIntroductionsNeed, stuckPageTweakNeeds,
-  foundingGraceActive,
+  helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed, mingleIntroductionsNeed,
   FOUNDING_GRACE_DAYS,
-  SETTINGS_PATH,
   NEED_PRIORITY,
 };

package/modules/builder-settings/event-sound-prefs.js

@@ -169,7 +169,6 @@ module.exports = {
   EVENT_DEFAULT,
   KNOWN_EVENT_IDS,
   KNOWN_VARIANT_IDS,
-  EVENT_VARIANTS,
   resolveVariant,
   resolveWav,
   listEffective,

package/modules/builder-settings/law-locks.js

@@ -194,7 +194,6 @@ function locksFor(route, locks) {
 
 module.exports = {
   settingSpec,
-  locksOf,
   lockedPrefs,
   checkPatch,
   describe,

package/modules/builder-settings/model-alloc-prefs.js

@@ -133,14 +133,9 @@ module.exports = {
   RESERVED_KEY,
   ALLOWED_TIERS,
   SLOTS,
-  SLOT_KEYS,
-  isValidTier,
-  codeDefaults,
   storedOverride,
-  instanceDefault,
   effectiveAllocation,
   contractFor,
-  slotCatalog,
   describeForApi,
   validatePatch,
   applyPatch,

package/modules/builder-settings/profile-nudge-prefs.js

@@ -115,7 +115,6 @@ function applyPatch(existing, patch) {
 module.exports = {
   RESERVED_KEY,
   DEFAULT_DISMISSED,
-  overrideDismissed,
   nudgeDismissed,
   missingProfileFields,
   shouldNudge,

package/modules/builder-settings/render-prefs.js

@@ -328,7 +328,6 @@ module.exports = {
   DEFAULT_ENABLED,
   LEVELS,
   // the ladder
-  isLevel,
   levelRank,
   showsCard,
   showsWidget,

package/modules/builder-settings/skill-prefs.js

@@ -187,8 +187,6 @@ module.exports = {
   ALLOWED_MODELS,
   KNOWN_SKILLS,
   SKILL_DEFAULTS,
-  isAllowedModel,
-  isKnownSkill,
   getForBuilder,
   listEffective,
   validatePatch,

package/modules/builder-settings/sound-prefs.js

@@ -165,14 +165,11 @@ module.exports = {
   KNOWN_SOUNDS,
   SOUND_META,
   SOUND_DEFAULTS,
-  VOLUME_KEY,
-  VOLUME_DEFAULT,
   isKnownSound,
   getForBuilder,
   listEffective,
   effectiveMap,
   getVolume,
-  clampVolume,
   validatePatch,
   applyPatch,
 };

package/modules/builder-settings/wandering-prefs.js

@@ -302,12 +302,10 @@ function applyPatch(existing, patch) {
 module.exports = {
   LEVELS,
   LEVEL_META,
-  LEVEL_CONTRACT,
   RANK_WANDERING,
   rankWandering,
   RANK_DEFAULT,
   RANK_MAX,
-  TOP_LEVEL,
   RESERVED_KEY,
   isLevelInt,
   levelKey,

package/modules/copy-desk/artist-stats.js

@@ -67,4 +67,4 @@ async function readArtistPages(builderId, { limit = 10, offset = 0 } = {}) {
   return { rows: all.slice(offset, offset + limit), total: all.length, inventory_known: !!inv.ok };
 }
 
-module.exports = { tallyCreditRows, readArtistStats, readArtistPages, TALLY_ROW_CAP };
+module.exports = { tallyCreditRows, readArtistStats, readArtistPages };

package/modules/copy-desk/flags.js

@@ -326,7 +326,7 @@ async function resolvePageAsks({ pageId, taskId, resolvedBy, shippedAt }) {
 }
 
 module.exports = {
-  SCOPES, FLAG_SCOPES, PAGE_SCOPE, STATUSES, KINDS, CLOSING_STATUSES, MIN_REASON_CHARS, MAX_REASON_CHARS, MAX_NOTE_CHARS,
+  SCOPES, FLAG_SCOPES, STATUSES, KINDS, CLOSING_STATUSES, MIN_REASON_CHARS, MAX_REASON_CHARS, MAX_NOTE_CHARS,
   tidy, normalizeFlagPayload, normalizeResolution, normalizePageAsk,
   insertFlag, listFlags, getFlag, closeFlag,
   findOpenPageAsk, countPageAskers, pageAskSummary, resolvePageAsks,

package/modules/copy-desk/guarded-lines.js

@@ -86,4 +86,4 @@ function checkList(readings, list = loadList()) {
 // Test seam: a fixture list for the route-level tests; null goes back to the file.
 function _setList(list) { cached = list; }
 
-module.exports = { _setList, LIST_PATH, loadList, guardsFor, guardForLine, guardWarnings, checkList, missingPhrases };
+module.exports = { _setList, loadList, guardForLine, guardWarnings, checkList };

package/modules/copy-desk/page-status.js

@@ -943,19 +943,14 @@ module.exports = {
   composeEditor,
   TALLY_REASON_PREFIX,
   NEXT_ALTERNATIVES,
-  NEXT_TIERS,
   composeNext,
-  SURFACE_ORDER,
-  SURFACE_LABELS,
   STATUS,
   indexRounds,
   countsFor,
   driftFor,
   roundState,
-  changelogFor,
   composePages,
   textLinesOf,
-  WORST_PAGES,
   composePage,
   lastRoundShippedAt,
   composeTally,

package/modules/copy-desk/proposals.js

@@ -273,11 +273,9 @@ function resolveTargetVersion(versions) {
 }
 
 module.exports = {
-  PROPOSAL_SCHEMA,
   resolveTargetVersion,
   FENCE,
   PLACEHOLDER,
-  MIN_WHY_CHARS,
   MAX_WHY_CHARS,
   MAX_TEXT_CHARS,
   tidy,

package/modules/copy-desk/registry.js

@@ -310,7 +310,7 @@ function composeQueue({ registry, index, flags, allFlags }) {
 }
 
 module.exports = {
-  REGISTRY_REL, REGISTRY_ABS, GENERATOR_CMD,
+  REGISTRY_REL,
   loadRegistry, _resetCache,
   indexRegistry, hasSurface, occurrencesOf, snapshotFor, searchEntries,
   annotateFlag, duplicateCandidates, composeQueue,

package/modules/copy-desk/stuck-tweaks.js

@@ -76,4 +76,4 @@ async function runDigest({ nowMs = Date.now(), state, post, readStuckImpl = read
   return { posted: !!(r && r.posted), reason: r && r.reason, text };
 }
 
-module.exports = { DIGEST_CHANNEL, DIGEST_HOUR_UTC, CACHE_MS, readStuck, readStuckCached, readStuckFor, digestDue, runDigest, _resetCache };
+module.exports = { CACHE_MS, readStuckCached, readStuckFor, runDigest, _resetCache };

package/modules/economy/credits-by-craft.js

@@ -199,10 +199,8 @@ module.exports = {
   creditsByCraft,
   foldCraftRows,
   apportion,
-  craftOfDiscipline,
   craftForPreference,
   earnedCrafts,
   CRAFTS,
-  DISCIPLINE_CRAFT,
   CREDITS_BY_CRAFT_SQL,
 };

package/modules/economy/streak.js

@@ -316,10 +316,7 @@ module.exports = {
   computeStreak,
   wouldExtendStreak,
   streakPreviewsForTasks,
-  previewFromStreak,
   // Exported for testing
   qualifyingShipDays,
-  todayInBuilderTz,
-  ymdToOrdinal,
   computeRunsFromShipDays,
 };

package/modules/government/asks-db.js

@@ -87,4 +87,4 @@ async function unclearFor(matterIds) {
   return out;
 }
 
-module.exports = { saveAsk, asksFor, flagUnclear, unclearFor, MAX_READ };
+module.exports = { saveAsk, asksFor, flagUnclear, unclearFor };

package/modules/government/asks.js

@@ -256,7 +256,6 @@ module.exports = {
   CAPS,
   BUILDINGS,
   SEAT,
-  MATTER_ID,
   ASK_REQUIRED_MESSAGE,
   checkAsk,
   refusalLine,

package/modules/government/decision-board.js

@@ -607,7 +607,6 @@ module.exports = {
   validateMatterAction,
   matterActFor,
   MATTER_ACTIONS,
-  MATTER_ACT_POINT,
   openMatter,
   checkActAlone,
   leadsView,

package/modules/government/docket.js

@@ -913,23 +913,17 @@ module.exports = {
   EXPECTED_SOURCES,
   COMING_SOURCES,
   COMING_FLOORS,
-  SOURCE_TIMEOUT_MS,
-  normalizeFloor,
-  normalizeHistory,
   normalizeActs,
   normalizeDeskRow,
   loadGovernment,
-  SETTLED_WINDOW_MS,
   normalizeMatter,
   gateAllows,
-  compareMatters,
   homeLine,
   boardMatter,
   fairnessReading,
   registeredContributions,
   buildDocket,
   docketFor,
-  attachAsks,
   findMatter,
   findMatterFor,
   loadSeats,

package/modules/government/leads.js

@@ -161,7 +161,6 @@ function leadsView(rows, archons, { includePast = false, rights = null, structur
 module.exports = {
   CHARTER_MAX,
   DEFAULT_CHARTERS,
-  LEAD_ACTS,
   isLeadAct,
   charterLine,
   answerFor,

package/modules/government/positions.js

@@ -104,4 +104,4 @@ async function readPositions(builderId, reads) {
   }
 }
 
-module.exports = { positionsOf, readPositions, titleOf, KINDS, KIND_ORDER };
+module.exports = { positionsOf, readPositions, titleOf, KINDS };

package/modules/government/recommendations.js

@@ -222,11 +222,8 @@ function recommendationsFor({ type, headcount } = {}) {
 
 module.exports = {
   PROJECT_TYPES,
-  SIZE_BANDS,
   JOB_GRANTS,
-  JOB_NAMES,
   JOB_CAN,
-  normalizeType,
   sizeBandFor,
   recommendedCharter,
   recommendedRankSet,

package/modules/government/routing.js

@@ -151,4 +151,4 @@ function passRefusal(matter, viewerId, toSeat, ctx, now = Date.now()) {
   return null;
 }
 
-module.exports = { seatOf, seatLabel, resolveSeat, routeMatter, routeAll, passRefusal, BUILDING_NAMES };
+module.exports = { seatOf, resolveSeat, routeMatter, routeAll, passRefusal, BUILDING_NAMES };

package/modules/government/treasury-db.js

@@ -163,4 +163,4 @@ async function openBorrowRows() {
   return rows.map((r) => ({ row: r, ask: stored.get(treasury.matterId(r.id)) || null }));
 }
 
-module.exports = { readSpend, listPots, listOpenGoals, listBorrows, getBorrow, readCap, readTreasury, setPot, goalById, fileBorrows, answerBorrow, openBorrowRows };
+module.exports = { getBorrow, readTreasury, setPot, goalById, fileBorrows, answerBorrow, openBorrowRows };

package/modules/government/treasury.js

@@ -235,7 +235,7 @@ function borrowMatter(borrow, { title, canAnswer = false } = {}) {
 }
 
 module.exports = {
-  MATTER_SOURCE, SEAT, ROUND_USD, MAX_BUDGET_USD, ANSWERS, ACT_KEY,
-  monthKey, prevMonth, monthGone, parseBudget, capView, borrowAmount, needsBorrow,
+  MATTER_SOURCE, SEAT, MAX_BUDGET_USD, ANSWERS,
+  monthKey, prevMonth, parseBudget, borrowAmount, needsBorrow,
   buildTreasury, borrowView, matterId, goalName, borrowAsk, answerOf, borrowMatter,
 };

package/modules/grading/grade-engine.js

@@ -256,7 +256,6 @@ function replayRecorded({ signals, workType } = {}) {
 
 module.exports = {
   PIPELINE_STAGES,
-  WORK_TYPE_PORT_PREFIX,
   applyDeterministicGate,
   listWorkTypes,
   registerWorkType,

package/modules/hall-ui/public/approval-queue.js

@@ -32,9 +32,9 @@
   // chip (brand-holes.js, task 1004381). Escaped text when it is not loaded.
   const H = window.OTBBrandHoles || null;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-  }
+  // The shared escaper, window.OTB (dom-utils.js, task 1004876). Browser-only: this
+  // file reads window at the top of its IIFE, so it never loads under plain Node.
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   function errWords(data, fallback) {
     const e = data && data.error;

package/modules/hall-ui/public/atlas.html

@@ -89,9 +89,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/atlas.js

@@ -290,7 +290,7 @@
     if (conns.length) html += '<div class="ab-prow">Connects to</div><div class="ab-chips">' + conns.map(function (cc) { return '<button type="button" class="fact-chip ab-jump" data-node="' + esc(cc.id) + '">' + esc(cc.label) + '</button>'; }).join('') + '</div>';
     return html;
   }
-  function esc(s) { return String(s).replace(/[&<>"]/g, function (c) { return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]; }); }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   function openPopup(n, g) {
     selected = n.id; lightNode(n.id);

package/modules/hall-ui/public/blockers.html

@@ -51,14 +51,13 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE blockers.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
+<!-- the branding pack's currency label, loaded BEFORE blockers.js. -->
 <script src="/builders/brand-apply.js"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- task-detail.js still owns the #/blocker/N deep-link overlay every row's

package/modules/hall-ui/public/board-room.html

@@ -58,12 +58,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-board"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- task 1003761: the vocabulary this page and /government both speak. Must load
      BEFORE board-room.js, which destructures window.OTBBoardLib at IIFE entry. -->

package/modules/hall-ui/public/brand-holes.js

@@ -26,9 +26,9 @@
 
   const HOLE_RE = /\{\{([A-Za-z][A-Za-z0-9_]*)\}\}/g;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   function splitHoles(text) {
     const s = String(text == null ? '' : text);

package/modules/hall-ui/public/city.html

@@ -105,9 +105,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/collab.html

@@ -148,11 +148,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>
 <script src="/builders/collab.js?v=2026-09-24-archive"></script>
 </body>

package/modules/hall-ui/public/commands.html

@@ -51,12 +51,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/commands-lib.js"></script>
 <script src="/builders/commands.js"></script>

package/modules/hall-ui/public/commands.js

@@ -14,8 +14,7 @@
   'use strict';
 
   const lib = window.OTBCommandsLib;
-  const esc = (window.OTBKit && window.OTBKit.esc) || ((s) => String(s == null ? '' : s)
-    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;'));
+  const esc = (s) => window.OTB.escapeHtml(s);
 
   async function getJson(url) {
     const r = await fetch(url, { credentials: 'same-origin' });

package/modules/hall-ui/public/copy-desk.html

@@ -177,11 +177,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/copy-desk.js?v=2026-09-01-redesign"></script>
 </body>

package/modules/hall-ui/public/core-move-notice.js

@@ -18,11 +18,7 @@
   'use strict';
 
   var SEEN_KEY = 'bongos.coreMove.seen';
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   /** Draw the notice under the top bar. `opts.api` is shell.js's client; `opts.href` Settings. */
   function render(moved, opts) {

package/modules/hall-ui/public/craft-mode.js

@@ -509,11 +509,7 @@
   // localStorage: the mode to keep when "Ask me again next session" is unticked.
   var KEEP_KEY = 'hall-craft-keep';
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function icon(id, cls) {
     return '<svg class="' + cls + '" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + ICONS[id] + '</svg>';
   }

package/modules/hall-ui/public/criterion-uat-ui.js

@@ -43,9 +43,9 @@
   const MAX_BYTES = 100 * 1024 * 1024;
   const TYPES = ['video/mp4', 'video/webm'];
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   // The state a row reads as. A server older than the UAT rule sends no
   // uat_state; then satisfied/open is the whole truth and no UAT control shows.

package/modules/hall-ui/public/deploy.html

@@ -76,11 +76,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- the shared ask card the move is drawn with (task 1004829) -->
 <script src="/builders/hall-ask.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -94,9 +94,10 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>