@bongos/core 1.21.182 → 1.22.2

package/modules/hall-ui/public/task-detail.js

@@ -75,12 +75,7 @@
   // dom-utils.js already publishes escapeHtml on window.OTB (this file uses
   // OTB.toast the same way) — a local copy would be its 9th byte-identical twin.
   // The fallback keeps the file's self-contained contract if OTB hasn't loaded.
-  function esc(s) {
-    if (window.OTB && window.OTB.escapeHtml) return window.OTB.escapeHtml(s);
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   async function fetchRef(kind, id) {
     if (kind === 'blocker') {

package/modules/hall-ui/public/task-lib.js

@@ -23,14 +23,9 @@
 (() => {
   'use strict';
 
-  // Local HTML-escape — deliberately NOT window.OTB.escapeHtml, so this file
-  // keeps hall-kit's dependency-free property (same reasoning, same duplication
-  // of ~4 lines being cheaper than a load-order constraint).
-  function esc(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   // Sort key for a "P3"-style priority string. Unparseable/absent sorts last.
   function priorityRank(p) {

package/modules/hall-ui/public/task.html

@@ -55,13 +55,12 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N deep-link overlay
      (and the #/task/N → /task/N redirect, task 751); load it here too so those
      links still resolve from this page. -->

package/modules/hall-ui/public/thinking.html

@@ -138,9 +138,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -142,11 +142,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>
 <script src="/builders/tweak-editor-lib.js?v=2026-09-29-tw27"></script>
 <script src="/builders/tweak-editor.js?v=2026-09-29-tw27-aqfix"></script>

package/modules/hall-ui/public/vote-control.js

@@ -30,7 +30,7 @@
     insufficient_rank: 'Voting opens at Metic rank.',
   };
 
-  const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const esc = (s) => window.OTB.escapeHtml(s);
   const netText = (n) => { const v = Number(n) || 0; return v > 0 ? `+${v}` : `${v}`; };
   const validId = (id) => { const n = Number(id); return Number.isInteger(n) && n > 0 ? n : null; };
 

package/modules/hall-ui/public/watch.html

@@ -163,13 +163,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- shared component kit (window.OTBKit) — tabs, ledger, pager (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>

package/modules/hall-ui/public/welcome-boot.js

@@ -139,11 +139,9 @@
   }
 
   // ---------- the overlay ----------
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
   function craft() { return window.OTBCraftMode || null; }
   function reducedMotion() {
     return !!(window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches);

package/modules/hall-ui/public/work.html

@@ -171,13 +171,12 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <!-- shared component kit (window.OTBKit) — tabs, pager, filter bar (task 2166). -->

package/modules/ideas/completeness.js

@@ -112,4 +112,4 @@ function weakestSectionPayload(fieldValues, { templateKey = DEFAULT_TEMPLATE_KEY
   };
 }
 
-module.exports = { completenessScore, scoreFieldValues, substanceOf, weakestField, weakestSectionPayload };
+module.exports = { completenessScore, scoreFieldValues, weakestField, weakestSectionPayload };

package/modules/ideas/descent.js

@@ -275,7 +275,6 @@ async function syncDescentForTask(taskId, { client = null } = {}) {
 
 module.exports = {
   DESCENT_MAX_DEPTH,
-  DESCENT_RELATIONS,
   linkTaskDescent,
   ancestorsOfTask,
   descendantsOfTask,

package/modules/ideas/governor-docket.js

@@ -221,10 +221,8 @@ function contributeIdeasToDocket() {
 module.exports = {
   contributeIdeasToDocket,
   blockerDocketMatter,
-  blockerOptions,
   ratifyDeskRows,
   rulesReading,
   rulesFloor,
   rulesHistory,
-  countRoutedThisMonth,
 };

package/modules/ideas/idea-state.js

@@ -247,7 +247,6 @@ module.exports = {
   IDEA_STATES,
   IDEA_STATE_VALUES,
   IDEA_POSITIONS,
-  AWAITING_NOD_STATUS,
   taskFactsFromIdeaRow,
   resolveIdeaState,
   attachStateToTrail,

package/modules/ideas/ideator-stats.js

@@ -146,4 +146,4 @@ async function readIdeatorStats(builderId, deps = {}) {
   return summarizeIdeatorTrail(ideas, { ideatorCredits, ratifiedIds, truncated: sky && sky.truncated, total: sky && sky.total });
 }
 
-module.exports = { readIdeatorStats, summarizeIdeatorTrail, PUBLIC_VIEWER_RANK };
+module.exports = { readIdeatorStats, summarizeIdeatorTrail };

package/modules/ideas/votes.js

@@ -90,4 +90,4 @@ async function readIdeaVotes(pool, { voterId, ids }) {
   return out;
 }
 
-module.exports = { castIdeaVote, readIdeaVotes, ideaVoteTally };
+module.exports = { castIdeaVote, readIdeaVotes };

package/modules/lifecycle/autopickup-files.js

@@ -130,10 +130,7 @@ function refusalMessage(r) {
 }
 
 module.exports = {
-  SHIP_WRITES,
-  pageIdFromRef,
   pageFiles,
-  decideFiles,
   readRound,
   autoPickupFileRefusal,
   refusalMessage,

package/modules/lifecycle/conflict-resolve.js

@@ -551,5 +551,4 @@ module.exports = {
   unmergedPaths,
   hasConflictMarkers,
   GENERATOR_SCRIPTS,
-  MARKER_GREP_RE,
 };

package/modules/lifecycle/criterion-uat-db.js

@@ -271,10 +271,6 @@ async function setBackendOnly({ criterionId, builderId, backendOnly, authorize }
 
 module.exports = {
   DEPLOY_PORT,
-  linkedTasks,
-  summarizeLinked,
-  currentSignoff,
-  isBackendOnly,
   readLive,
   signOff,
   recordOverride,

package/modules/lifecycle/dead-deps.js

@@ -340,6 +340,6 @@ function findProseGatedTasks(tasks, statusById) {
 module.exports = {
   DEAD_DEP_STATUSES, LIVE_STATUSES,
   absorbedInto, depRefusalRow, splitDeadDeps, deadDepHint, findStrandedTasks,
-  proseGatedIds, findProseGatedTasks, idCandidates, GATE_PHRASE_RE, GATE_WINDOW, OTHER_ENTITY_RE,
-  LIVENESS_BEFORE_RE, LIVENESS_AFTER_RE, IMPORT_ID_OFFSETS,
+  proseGatedIds, findProseGatedTasks, idCandidates,
+  IMPORT_ID_OFFSETS,
 };

package/modules/lifecycle/est-advisory.js

@@ -186,4 +186,4 @@ async function buildEstAdvisory({ db, task } = {}) {
   }
 }
 
-module.exports = { adviseEstimate, pickRatio, buildEstAdvisory, calibrationSummary, resetCalibrationCache, CALIBRATION_TTL_MS, MIN_MATERIAL_DELTA, SCALE_OK_RATIO, MIN_KIND_SAMPLES, MIN_OVERALL_SAMPLES };
+module.exports = { adviseEstimate, pickRatio, buildEstAdvisory, calibrationSummary, resetCalibrationCache, CALIBRATION_TTL_MS, MIN_MATERIAL_DELTA, SCALE_OK_RATIO };

package/modules/lifecycle/goal-category.js

@@ -379,16 +379,13 @@ function goalCategoryHandler({ db, authorizeGoalManagement, validateOrRespond, p
 }
 
 module.exports = {
-  CATEGORY_COLS,
   slugify,
   isValidSlug,
   listCategories,
   countGoalsByCategory,
   getCategory,
   adviseCategory,
-  createCategory,
   updateCategory,
-  setGoalCategory,
   decorateGoalCategory,
   categoryIndex,
   categoriesListHandler,

package/modules/lifecycle/goal-spec-task.js

@@ -126,4 +126,4 @@ async function createGoalWithSpec({ db, withTx, goalFields, withSpecTask = false
   return { goal, specTask };
 }
 
-module.exports = { SPEC_SOURCE, specSourceRef, specTaskFields, openSpecTaskId, gateOnSpecTask, ensureSpecTask, createGoalWithSpec };
+module.exports = { SPEC_SOURCE, specSourceRef, specTaskFields, gateOnSpecTask, ensureSpecTask, createGoalWithSpec };

package/modules/lifecycle/governor-docket.js

@@ -463,7 +463,6 @@ module.exports = {
   overrideMatter,
   removalMatter,
   uatMatter,
-  uatActs,
   joinRequestMatter,
   flowReading,
   promisesReading,

package/modules/lifecycle/kickoff-seed.js

@@ -130,4 +130,4 @@ async function genesisStageTasks(deps = {}) {
   return out;
 }
 
-module.exports = { seedKickoffIfEmpty, specFromBranding, FIRST_VERSION_SQL, seedGenesisStages, genesisStageTasks, GENESIS_SOURCE };
+module.exports = { seedKickoffIfEmpty, specFromBranding, FIRST_VERSION_SQL, seedGenesisStages, genesisStageTasks };

package/modules/lifecycle/mingle.js

@@ -345,9 +345,9 @@ async function decidePair(pairId, builderId, decision, deps = {}) {
 }
 
 module.exports = {
-  MINGLE_ENABLED_KEY, MAX_ROWS, MATCHING, matchingModel,
+  MAX_ROWS, MATCHING, matchingModel,
   parseEnabled, projectEnabled, setProjectEnabled,
-  optInState, setOptIn, mingleStateFor,
-  eligibleBuilders, isCrossCraft, planPairs, pairKey, openPairKeys,
+  setOptIn, mingleStateFor,
+  eligibleBuilders, isCrossCraft, planPairs, openPairKeys,
   runMingleRound, openPairsFor, countOpenPairsFor, decidePair,
 };

package/modules/lifecycle/page-tweak-claim.js

@@ -181,4 +181,4 @@ async function webClaimPageTweak({ pageId, builderId, versionId = null, round },
   }
 }
 
-module.exports = { webClaimPageTweak, lockKey, roundNumber };
+module.exports = { webClaimPageTweak, lockKey };

package/modules/lifecycle/rebase-gate.js

@@ -75,4 +75,4 @@ function rebaseRefusalTasks(split) {
   ];
 }
 
-module.exports = { REBASE_GATE_LIMIT, WAITING_REASONS, waitsOn, splitRebaseGate, rebaseRefusalTasks };
+module.exports = { REBASE_GATE_LIMIT, waitsOn, splitRebaseGate, rebaseRefusalTasks };

package/modules/lifecycle/removal-derivation.js

@@ -326,7 +326,6 @@ module.exports = {
   removalCandidatesForTask,
   listCommitsForPath,
   deletedPathsFrom,
-  groupByTask,
   attributeDeletions,
   deriveRemovalsForShip,
 };

package/modules/lifecycle/routes/abandon-handler.js

@@ -148,4 +148,4 @@ function makeAbandonHandler(deps) {
   };
 }
 
-module.exports = { makeAbandonHandler, requiredAtoms, floorsFor };
+module.exports = { makeAbandonHandler };

package/modules/lifecycle/routes/version-route-authz.js

@@ -222,5 +222,4 @@ module.exports = {
   authorizeVersionBuild,
   planVersionClose,
   rollForwardNeedsPlanningVersion,
-  VERSION_CLOSE_VERBS,
 };

package/modules/lifecycle/ship-card.js

@@ -587,10 +587,7 @@ function renderMonospaceCard(model) {
 }
 
 // ---- HTML renderer (the in-feed branded card) ------------------------------
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) =>
-    ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-}
+function esc(s) { return require('../../src/module-api').escapeHtml(s); } // the one server escaper (task 1004876)
 function factHtml(f) {
   let inner = esc(f.value);
   if (f.mono) inner = `<span class="cc-mono">${inner}</span>`;
@@ -867,7 +864,7 @@ module.exports = {
   // untrusted-title rule is pinned by a test rather than trusted by eye.
   sanitizeOneLine, MAX_CONFIRM_LINE,
   // exported for unit tests:
-  fmtTokens, fmtUsd, fmtInt, fmtMins, nextActionFor, esc, wrap, changedText,
+  fmtTokens, fmtUsd, fmtInt, fmtMins, esc, wrap,
   // task 1003150 — the session-boundary nudge, pure so every branch is pinned.
   handoffAdvice, HEAVY_SESSION_CACHED_TOKENS,
   PIPELINE, FORMS, trailSteps,

package/modules/lifecycle/ship-preflight.js

@@ -323,7 +323,6 @@ module.exports = {
   untrackedLeftBehind,
   untrackedWarningLines,
   cleanupMacFinderDupRefs,
-  gitDirFor,
   findMainWorktree,
   findPrimaryWorktree,
   closeoutPlan,

package/modules/lifecycle/sky.js

@@ -301,4 +301,4 @@ function skyHandler({ read = sky, log = console, cache = skyCache() } = {}) {
   };
 }
 
-module.exports = { sky, skyRows, shapeSky, foldCriteria, normalizeBorn, skyCache, skyHandler, SKY_CACHE_TTL_MS };
+module.exports = { sky, skyRows, shapeSky, foldCriteria, normalizeBorn, skyCache, skyHandler };

package/modules/lifecycle/task-classifier.js

@@ -551,7 +551,6 @@ module.exports = {
   VALID_KINDS,
   VALID_DISCIPLINES,
   WRITABLE_DISCIPLINES,
-  DISCIPLINE_CONFIDENCE_FLOOR,
   resolveWriteDiscipline,
   VOTABLE_TASK_STATUSES,
   TASK_FIELD_BOUNDS,

package/modules/lifecycle/task-visuals.js

@@ -390,8 +390,6 @@ module.exports = {
   screenImage,
   readImageFile,
   normalizeAlt,
-  urlForName,
-  SERVE_PREFIX,
   isPubliclyViewable,
   persistImageBuffer,
   deleteStored,

package/modules/lifecycle/version-close.js

@@ -101,7 +101,6 @@ async function getCloseSuggestionsForBuildingVersions() {
 }
 
 module.exports = {
-  PERCENT_GATE,
   suggestClose,
   getCloseSuggestionsForBuildingVersions,
 };

package/modules/memory/memory.js

@@ -568,5 +568,4 @@ module.exports = {
   assertBfgPath,
   isReservedNamespacePath,
   BFG_NAMESPACE_PREFIX,
-  BFG_KINDS,
 };

package/modules/memory/search-chunker.js

@@ -275,4 +275,4 @@ function chunkMarkdown({ path, content, maxTokens = DEFAULT_MAX_TOKENS, targetTo
   return { path: path || null, title, frontmatter: frontmatter || null, chunks };
 }
 
-module.exports = { chunkMarkdown, parseFrontMatter, estTokens, fileLabel, stripPrivate, sanitizeForText, PG_INVALID_TEXT_RE, DEFAULT_TARGET_TOKENS, DEFAULT_MAX_TOKENS };
+module.exports = { chunkMarkdown, parseFrontMatter, estTokens, stripPrivate, sanitizeForText };

package/modules/memory/search.js

@@ -581,8 +581,5 @@ module.exports = {
   RANK_LADDER,
   DEFAULT_LIMIT,
   MAX_LIMIT,
-  RRF_K,
   TRGM_THRESHOLD,
-  USEFULNESS_WEIGHT,
-  USEFULNESS_SCALE,
 };

package/modules/npm-release/preview/divert.js

@@ -102,4 +102,4 @@ function createDivert({ supervisor, forward, requireBuilder, requirePermission }
   };
 }
 
-module.exports = { createDivert, cookieVersion, clearCookie, setCookie, AUTH_PATH, PREVIEW_PATH };
+module.exports = { createDivert, cookieVersion, clearCookie, setCookie, AUTH_PATH };

package/modules/npm-release/preview/proxy.js

@@ -29,9 +29,8 @@ function withoutPreviewCookie(cookieHeader) {
     .join('; ');
 }
 
-function escapeHtml(s) {
-  return String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
-}
+// The one server escaper, through the doorway (task 1004876); this copy used to skip '.
+const { escapeHtml } = require('../../../src/module-api');
 
 /** The banner markup: which version this is, which one the hall runs, and the way out. */
 function bannerHtml({ viewing, running, exitHref }) {

package/modules/npm-release/preview/runtime.js

@@ -114,4 +114,4 @@ function createRuntime({ liveDb, log, env = process.env, instanceRoot = null } =
   return supervisor;
 }
 
-module.exports = { createRuntime, runCommand, probeHealth };
+module.exports = { createRuntime, probeHealth };

package/modules/npm-release/public/task-widget.js

@@ -16,7 +16,7 @@
   'use strict';
 
   const API = '/api/bongos';
-  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const esc = (s) => window.OTB.escapeHtml(s); // the hall's shared escaper (dom-utils.js, task 1004876)
   const client = window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
   const DONE = ['completed', 'confirmed', 'shipped'];
 

package/modules/onboarding/founding-builders.js

@@ -124,4 +124,4 @@ async function foundingBuildersFor(deps = {}) {
   }
 }
 
-module.exports = { stageAt, shapeFoundingBuilders, foundingBuildersFor, MAX_MARKS };
+module.exports = { stageAt, shapeFoundingBuilders, foundingBuildersFor };

package/modules/onboarding/founding-mode.js

@@ -204,6 +204,6 @@ async function setFoundingMode({ active, stage } = {}, builderId = null, deps =
 
 module.exports = {
   STAGES, WAKES, WAKES_WHEN_ALIVE, KEYS, stageAtKey,
-  parseActive, asleepRooms, dayOf, shapeFoundingMode, waitingOnFromGovernment,
+  dayOf, shapeFoundingMode, waitingOnFromGovernment,
   foundingModeFor, setFoundingMode,
 };

package/modules/onboarding/howto-guide.js

@@ -262,4 +262,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { MOMENTS, STEPS, MOMENT_IDS, stepById, stepsForMoment, nextUnread, formatStep, formatGuide };
+module.exports = { MOMENTS, STEPS, MOMENT_IDS, stepById, stepsForMoment, nextUnread, formatGuide };

package/modules/onboarding/howto-state.js

@@ -105,4 +105,4 @@ async function reset(builderId, { steps, all = false } = {}, deps = {}) {
   return { ok: true, state: await readState(builderId, deps) };
 }
 
-module.exports = { HOWS, checkSteps, shapeState, readState, markRead, reset };
+module.exports = { shapeState, readState, markRead, reset };

package/modules/onboarding/onboarding-state.js

@@ -495,12 +495,8 @@ module.exports = {
   GRADUATED,
   ALL_STAGES,
   PRE_AUTH_STEP,
-  SHIP_GRADUATION_TARGET,
-  STAGE_LABELS,
   STAGE_HINTS,
-  DISPLAY_STEPS,
   DISPLAY_LABELS,
-  DISPLAY_HINTS,
   isKnownStage,
   nextStage,
   hasCleared,

package/modules/onboarding/onboarding.js

@@ -489,20 +489,14 @@ function buildIdeaPayload({ sessionMeta = {}, analysis, signals = {} }) {
 
 module.exports = {
   ONBOARDING_FRICTION_TAG,
-  ONBOARDING_FRICTION_KIND,
   // parsing
   parseTranscript,
-  stripMachineNoise,
   // signals
   detectFrictionSignals,
-  LONG_RESPONSE_CHARS,
-  SIMILARITY_THRESHOLD,
   // subagent
   buildAnalysisPrompt,
-  compactTranscript,
   extractJson,
   validateAnalysis,
-  VALID_MOMENT_KINDS,
   // payload
   buildIdeaPayload,
 };

package/modules/page-notes/notes.js

@@ -236,7 +236,6 @@ module.exports = {
   wholeDocIdea,
   noteLink,
   SITE_SURFACE,
-  STUDIO_PATH,
   isSiteNote,
   siteListItem,
   ideaBody,

package/modules/platform-identity/community-leaderboard.js

@@ -231,5 +231,4 @@ module.exports = {
   MAX_LIMIT,
   MAX_OFFSET,
   MAX_DISCIPLINE_CHARS,
-  TOTALS_TTL_MS,
 };

package/modules/platform-identity/hub-keys.js

@@ -157,8 +157,6 @@ function mintHubApplicationVouch({ clientId, githubId, githubLogin, handle }, op
 }
 
 module.exports = {
-  ASSERTION_TTL_MS,
-  ISSUER,
   LOGOUT_PURPOSE,
   generateHubKeypair,
   loadHubSigningKey,

package/modules/platform-identity/instance-feedback.js

@@ -229,7 +229,6 @@ module.exports = {
   sha256Hex,
   projectOrigin,
   isHostedBy,
-  verifyDirectReport,
   fileDirectReport,
   FEEDBACK_KINDS,
   MESSAGE_MAX,

package/modules/platform-identity/read-rate-limit.js

@@ -65,4 +65,4 @@ function createReadRateLimit({ scope, limit, windowMs = 60 * 1000, maxTrackedIps
   return limiter;
 }
 
-module.exports = { createReadRateLimit, MAX_TRACKED_IPS };
+module.exports = { createReadRateLimit };

package/modules/platform-identity/routes/sso.js

@@ -118,9 +118,7 @@ function reportAsOf(req) {
 // The /sso/authorize failures are pre-redirect (bad client / bad redirect_uri), so
 // we must render our OWN page rather than bounce to an unvalidated URI.
 function errorPage(detail) {
-  const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
-  ));
+  const esc = api.escapeHtml; // the one server escaper (task 1004876)
   return `<!doctype html><html lang="en"><head><meta charset="utf-8">`
     + `<meta name="viewport" content="width=device-width, initial-scale=1">`
     + `<title>Sign-in handoff failed</title></head><body>`

package/modules/platform-identity/visibility-pull.js

@@ -59,14 +59,6 @@ const { pool: defaultPool } = require('../../src/module-api');
 const { ORB_BY_STATE } = require('./projects-feed');
 const projectStats = require('./project-stats');
 
-// The manifest route every Cloud Bongos instance already serves, unauthenticated and
-// CORS-open (ADR 0114's discovery surface; `src/bongos/routes/instance.js`). Nothing is
-// added to it by this task — ADR 0252 §2.3: the field already ships in every core, so
-// there is no wire change on anyone else's upgrade schedule. The API router is
-// dual-mounted at `/api/bongos` (canonical) and at the permanent legacy alias ADR 0252
-// happened to write, so either prefix reaches it; the fetch uses the canonical one.
-const MANIFEST_ROUTE = '/api/bongos/instance';
-
 // Rows the PULL may write: the ones the ADR 0246 control-plane bridge has never claimed.
 // `IS DISTINCT FROM` rather than `<> `, deliberately — a NULL source is the unclaimed
 // state and plain inequality would drop exactly those rows on a NULL comparison.
@@ -190,7 +182,6 @@ async function sweepVisibilityOnce({ pool = defaultPool, limit = 200, fetchVisib
 }
 
 module.exports = {
-  MANIFEST_ROUTE,
   PULLABLE_SQL,
   visibilityFromManifest,
   pullDecision,

package/modules/provisioning/app-status.js

@@ -93,4 +93,4 @@ function retryAnswers(h) {
   return r;
 }
 
-module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE, SERVICE_ID_RE };
+module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE };