@bongos/core 1.21.182 → 1.22.2

package/modules/hall-ui/public/dom-utils.js

@@ -1,7 +1,12 @@
 // public-builders/dom-utils.js — shared frontend toolkit for the builders' hall
 // (GDS-V4 C4 / task 1088). Loaded as the FIRST hall <script> on each page so the
 // per-page IIFEs can pull these from one place instead of redefining them.
-// Attaches a single global, `window.OTB`.
+// Attaches a single global, `window.OTB` (and is its module.exports under Node).
+//
+// escapeHtml here is THE browser HTML escaper (task 1004876): every hall script
+// — and the landing's projects page — escapes user text through it, and the
+// fitness check scripts/bongos/escape-helper-guard.js fails on a third copy and
+// on any hall page that does not load this file first, without defer.
 //
 // NOT a consumer: modules/status-ui/public/ (the off-box status mirror) stays
 // self-contained by design — do not wire this there. Network helpers
@@ -19,11 +24,11 @@
 (() => {
   'use strict';
 
-  // HTML-escape for text interpolated into innerHTML. (8 byte-equivalent copies.)
+  // HTML-escape for text interpolated into innerHTML: & < > " ' ; null/undefined → ''.
+  // The server twin is src/html-escape.js; tests/html_escape.mjs holds them equal.
+  const ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
   function escapeHtml(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
+    return String(s ?? '').replace(/[&<>"']/g, (c) => ESCAPES[c]);
   }
 
   // querySelector shorthand. (7 copies; pair.js's single-arg form is a subset.)
@@ -460,7 +465,7 @@
     } catch (err) { return null; }
   }
 
-  window.OTB = {
+  const OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn, disciplines,
     // task 1003936 — ONE word for the role axis, all six surfaces
     roleAxisLabel, roleLabel, roleWord, roleOptions, roleIsUnset, ROLE_UNSET,
@@ -472,4 +477,8 @@
     categoryChip, // task 1003276 — shared by the Goals page, the Tasks board and the task page
     hubOrigin, // task 1003485 — the hub account page's origin, for Settings and the profile nudge
   };
+  if (typeof window !== 'undefined') window.OTB = OTB;
+  // Node: the hall libs that also load under require() (hall-kit.js, task-lib.js, …)
+  // escape through this same function there (task 1004876).
+  if (typeof module !== 'undefined' && module.exports) module.exports = OTB;
 })();

package/modules/hall-ui/public/drachmae.html

@@ -94,9 +94,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet-costs.js

@@ -20,8 +20,9 @@
     'co-tenant': 'Shared server (retired)',
   };
 
-  const ESC = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
-  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ESC[c]);
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  const esc = (s) => (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s);
   const isPriced = (v) => typeof v === 'number' && Number.isFinite(v);
   const quiet = (text) => `<span class="ledger__est">${text}</span>`;
 

package/modules/hall-ui/public/fleet.html

@@ -55,11 +55,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/fleet-costs.js"></script>
 <script src="/builders/fleet.js"></script>

package/modules/hall-ui/public/founding-mark.js

@@ -18,12 +18,7 @@
     charter: 'charter', legalize: 'legalize', legislation: 'legislation',
   };
 
-  function esc(s) {
-    if (window.OTB && typeof window.OTB.escapeHtml === 'function') return window.OTB.escapeHtml(s);
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   // One request per page, shared by every surface on it. Any failure (signed out, the
   // onboarding module off, a network blip) is an empty list: no marks, today's page.

package/modules/hall-ui/public/gate.html

@@ -62,12 +62,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/gate.js?v=2026-10-25-autobongos"></script>
 </body>

package/modules/hall-ui/public/goal-map.html

@@ -137,9 +137,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/goals.html

@@ -234,12 +234,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <!-- shared component kit (window.OTBKit) — pager, filter bar, tabs, empty/skeleton (task 2166). -->

package/modules/hall-ui/public/government.html

@@ -132,12 +132,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- task 1003761: the vocabulary this page and /board-room both speak. Must load
      BEFORE government.js, which destructures window.OTBBoardLib at IIFE entry. -->

package/modules/hall-ui/public/hall-ask.js

@@ -16,9 +16,9 @@
 // Every string is escaped here; `saidHtml` is the one pre-built slot, for a
 // caller whose facts are already escaped markup (blockerFacts).
 (function () {
-  const esc = (s) => String(s == null ? '' : s)
-    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  const esc = (s) => (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s);
   const attrsOf = (a) => Object.keys(a || {})
     .filter((k) => a[k] != null && a[k] !== false)
     .map((k) => ` ${k}="${esc(a[k])}"`).join('');

package/modules/hall-ui/public/hall-kit.js

@@ -27,11 +27,9 @@
   'use strict';
 
   // HTML-escape for text interpolated into innerHTML.
-  function esc(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
   const $id = (id) => document.getElementById(id);
 
   // ---- pager ----------------------------------------------------------------

package/modules/hall-ui/public/hall-visual.js

@@ -27,11 +27,9 @@
   'use strict';
 
   // HTML-escape for text interpolated into innerHTML.
-  function esc(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   // Same-origin, SERVER-MINTED paths only. The URL arrives from our own API, but
   // it lands in an href and a src, so it is matched literally against the shape

package/modules/hall-ui/public/idea.html

@@ -50,11 +50,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref
      written inside an idea's own prose keeps resolving from this page. -->
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail2" defer></script>

package/modules/hall-ui/public/ideas.html

@@ -225,11 +225,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -106,7 +106,7 @@
      / ADR 0069 — no client lib to load (EventSource is built into the browser). -->
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so every consuming
      IIFE below can pull escapeHtml/$/fmtNum/... from one place. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
 <!-- R56 (task 1195): apply the instance currency label from window.__BRANDING__
      to [data-currency-label]/[data-currency-tmpl] markup + expose OTBBranding.
@@ -119,7 +119,7 @@
 <script src="/builders/welcome-boot.js?v=2026-10-23-city1" defer></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3" defer></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos" defer></script>
+<script src="/builders/shell.js?v=2026-10-25-escape" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/lightbulb.js

@@ -20,11 +20,7 @@
 
   var sheet = null, returnFocus = null, saveTimer = null, busy = false;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function plural(n, one, many) { return n + ' ' + (n === 1 ? one : many); }
   function day(iso) {
     var d = iso ? new Date(iso) : null;

package/modules/hall-ui/public/md-reader.js

@@ -21,14 +21,7 @@
 (function () {
   'use strict';
 
-  function escapeHtml(s) {
-    return String(s)
-      .replace(/&/g, '&')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#39;');
-  }
+  function escapeHtml(s) { return window.OTB.escapeHtml(s); }
 
   // Stable slug for heading anchors — lowercase, strip punctuation, dash-join.
   // Matches the primer's slugify so in-doc anchor links behave identically.

package/modules/hall-ui/public/modules.html

@@ -125,12 +125,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-apply.js"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/md-reader.js"></script>

package/modules/hall-ui/public/my-agents.html

@@ -59,12 +59,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/gov-living.js?v=2026-10-10-real1"></script>
 <script src="/builders/gov-positions.js?v=2026-10-09-positions1"></script>
 <script src="/builders/my-agents.js?v=2026-10-17-tidy"></script>

package/modules/hall-ui/public/my-agents.js

@@ -310,7 +310,9 @@
   const API = '/api/bongos';
   const api = root.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
   const $ = (id) => document.getElementById(id);
-  const esc = (s) => str(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  const esc = (s) => (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s);
   const toast = (msg) => { if (root.OTB && root.OTB.toast) root.OTB.toast(msg); };
   const brand = root.__BRANDING__ || {};
   const PROJECT = (brand.identity && (brand.identity.productName || brand.identity.worldName)) || 'The project';

package/modules/hall-ui/public/page-notes.js

@@ -21,11 +21,7 @@
 
   var sheet = null, returnFocus = null, state = null, saveTimer = null, pollTimer = null, docked = false;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   // Where the panel is open. The hall needs no setting; the public site's
   // Artist review button (task 1004499, artist-review.js) calls
   // configure({ surface: 'site', hall: <the hall's origin> }) before it opens.

package/modules/hall-ui/public/paintbrush.js

@@ -43,11 +43,7 @@
 
   var bar = null, st = null;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function tidy(s) { return String(s == null ? '' : s).replace(/\s+/g, ' ').trim(); }
   function plural(n, one, many) { return n + ' ' + (n === 1 ? one : many); }
   function clip(s, n) { s = tidy(s); return s.length > n ? s.slice(0, n - 1) + '…' : s; }

package/modules/hall-ui/public/palette.js

@@ -105,11 +105,7 @@
   var searchAbort = null; // the in-flight request's AbortController, if the runtime has one
   var searchCache = {};   // query (trimmed+lowercased) -> raw hits[], this OPEN only
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function visible(id) {
     var el = document.getElementById(id);
     return !!(el && !el.hidden);

package/modules/hall-ui/public/primer.html

@@ -110,9 +110,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/primer.js

@@ -55,7 +55,7 @@
   function $(sel) { return document.querySelector(sel); }
 
   const MD = window.OTBMdReader;
-  const escapeHtml = (MD && MD.escapeHtml) || ((s) => String(s));
+  const escapeHtml = (s) => window.OTB.escapeHtml(s); // task 1004876: the old fallback escaped nothing
 
   // The shared resolver, plus the one rewrite that is the primer's alone: the
   // economy doc has an in-hall reader page (task 1472), so a link to it stays in

package/modules/hall-ui/public/profile-crafts.js

@@ -33,11 +33,9 @@
 (function () {
   'use strict';
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
   function objects() {
     return (typeof window !== 'undefined' && window.OTBIdeaObjects) || null;
   }

package/modules/hall-ui/public/profile.html

@@ -205,13 +205,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>

package/modules/hall-ui/public/project-settings.html

@@ -69,12 +69,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/project-settings.js?v=2026-10-08-ship-mode"></script>
 </body>

package/modules/hall-ui/public/ranks.html

@@ -71,13 +71,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/founding-mark.js?v=2026-09-30-founding"></script>
 <script src="/builders/ranks.js?v=2026-09-30-founding"></script>
 </body>

package/modules/hall-ui/public/roadmap.html

@@ -41,12 +41,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- The chart kit and the timeline's series builders (task 1003447). Both MUST
      precede roadmap.js: the page reads window.OTBKit / window.OTBRoadmapTimeline
      at render time, so loading either after would be a blank section in

package/modules/hall-ui/public/roster.html

@@ -53,14 +53,13 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE roster.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
+<!-- the branding pack's currency label, loaded BEFORE roster.js. -->
 <script src="/builders/brand-apply.js"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/founding-mark.js?v=2026-09-30-founding"></script>

package/modules/hall-ui/public/sessions.html

@@ -109,13 +109,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
 <!-- The shared component kit — the pager contract this page now uses instead of
      its own (task 1003279-sibling follow-up of 1003281). Must load BEFORE

package/modules/hall-ui/public/settings.html

@@ -470,13 +470,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- shared component kit (window.OTBKit) — section rail (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
 <!-- shared record overlay (#/idea|blocker/N) — every hall page carries it; this

package/modules/hall-ui/public/shell.js

@@ -64,11 +64,7 @@
   // builders.js owns these hashes (deep-link overlay) — never route them.
   var DEEPLINK_RE = /^#\/(task|idea|blocker)\/(\d+)$/;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function moduleOn(name) {
     var m = window.__MODULES__;
     if (!m || !m.enabled || !(name in m.enabled)) return true;

package/modules/hall-ui/public/sky-data.js

@@ -87,7 +87,7 @@
   }
   // esc — the prototype builds HTML strings, and every title, criterion and
   // goal name passes through here first, so a title never becomes markup.
-  function esc(s) { return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])); }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function fmtDate(iso) { if (!iso) return '—'; const d = new Date(iso); return d.toLocaleDateString('en-GB', { day: '2-digit', month: 'short' }).toLowerCase(); }
   function fmtDay(t) { return new Date(t).toLocaleDateString('en-GB', { day: '2-digit', month: 'short', year: 'numeric' }).toLowerCase(); }
   function ageDays(iso) { return iso ? (NOW - new Date(iso).getTime()) / 86400000 : 0; }

package/modules/hall-ui/public/street.html

@@ -228,9 +228,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/studio.html

@@ -188,11 +188,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure
      (task 1003829), which the older reviews still show. -->
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1"></script>