@bongos/core 1.21.182 → 1.22.2

package/modules/provisioning/catalog-bridge.js

@@ -161,7 +161,6 @@ async function healInstanceCatalog(db, row) {
 }
 
 module.exports = {
-  CATALOG_HIDDEN_STATES,
   catalogEntryForInstance,
   // the disconnect runner leg forgets exactly what a publish wrote (task 1003249)
   catalogOriginForInstance, ownerGithubIdForInstance,

package/modules/provisioning/core-upgrade.js

@@ -551,5 +551,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, lastCoreMove, lastMoveSuperseded, parseRepoNote, UPGRADE_SHAPES, VERSION_RE, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/credential-preflight.js

@@ -167,4 +167,4 @@ async function adoptCredentialFault({ builderId, onboardMode, targetRef }, deps)
   return null;
 }
 
-module.exports = { adoptCredentialFault, parseTargetRef, readOwnerRepoToken, fetchRepoVisibility };
+module.exports = { adoptCredentialFault, parseTargetRef };

package/modules/provisioning/demo.js

@@ -171,6 +171,6 @@ async function sweepDemos(db, { enqueueTeardown, recordEvent, now = new Date() }
 }
 
 module.exports = {
-  DEMO_LIMITS, DEMO_OFFLINE_DAYS, DEMO_WARN_DAYS, DEMO_DETAIL, DEMO_SETTINGS, OUTCOMES,
-  parseDemo, fitCheck, withDemoDetail, demoRecord, demoView, startDemo, startDemoProject, settleDemo, sweepDemos,
+  DEMO_LIMITS, DEMO_SETTINGS, OUTCOMES,
+  parseDemo, fitCheck, withDemoDetail, demoRecord, demoView, startDemoProject, settleDemo, sweepDemos,
 };

package/modules/provisioning/look.js

@@ -165,5 +165,5 @@ module.exports = {
   upsertLogo, deleteLogo, readLogo,
   LIBRARY_LOOKS, LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV,
   lookChoice, lookAdjustAccent, lookAccentOf, logoUrlOf,
-  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, sniffLogo, logoFileName, LOGO_FILE,
+  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, logoFileName, LOGO_FILE,
 };

package/modules/provisioning/routes/callback-page.js

@@ -20,12 +20,8 @@
 
 const api = require('../../../src/module-api');
 
-// Minimal HTML escaper for the callback landing page (no template engine here).
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
-  ));
-}
+// The one server escaper, through the doorway (task 1004876).
+function esc(s) { return api.escapeHtml(s); }
 
 // The way back to the project (task 1004650): the hub's return route, keyed on the attempt's
 // one-time state. The SERVER resolves that state to the project it was minted for and lands
@@ -194,4 +190,4 @@ function callbackPage({ ok, title, body, state, domain, next }) {
 </body></html>`;
 }
 
-module.exports = { esc, callbackPage, returnHref, RETURN_PATH };
+module.exports = { esc, callbackPage, returnHref };

package/modules/public-landing/public/projects.html

@@ -2173,6 +2173,7 @@ summary{min-height:24px;padding:3px 0;}
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
 
+<script src="/modules/hall-ui/public/dom-utils.js"></script>
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this
    script; baked markup above is the standalone fallback. */
@@ -2199,11 +2200,8 @@ summary{min-height:24px;padding:3px 0;}
 
   function $(id) { return document.getElementById(id); }
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  /* the hall's shared escaper (dom-utils.js, loaded just above; task 1004876) */
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   /* ── the app's setup on Render (task 1004353) ──
      GET /provisioning/instances/:id/render is the one source, on both the wizard's done

package/modules/raise/raise.js

@@ -55,7 +55,7 @@ function isEditableKey(key) {
   return !!m && Number(m[1]) >= 1 && Number(m[1]) <= (DEFAULT_SETTINGS.founders || []).length;
 }
 
-const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+const { escapeHtml: esc } = require('../../src/module-api'); // the one server escaper (task 1004876)
 const usd = (n) => '$' + Math.round(n).toLocaleString('en-US');
 const TBA = '<span class="tba">TBA</span>';
 
@@ -170,5 +170,5 @@ module.exports = {
   TOKENS, SETTING_KEYS, MAX_BLOCK, EDIT_MIN_RANK, TBA,
   defaultCopy, defaultSettings, ndaBody, ndaVersion, isEditableKey,
   esc, usd, kindOf, normalizeBlock, renderInline, renderBlock, renderContext, fill, cleanSetting,
-  hashPassword, passwordOk, validLinkedin, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
+  hashPassword, passwordOk, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
 };

package/modules/render-deploy/deploys.js

@@ -197,7 +197,7 @@ async function saveApp(pool, { ownerId, serviceId, serviceName, builderId }) {
 }
 
 module.exports = {
-  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE, HISTORY_LIMIT,
+  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE,
   statusWords, taskIdsIn, previewOf, costOf, shapeHistory, readHistory, getApp, saveApp,
   ROLLBACK_STATUSES,
 };

package/modules/security/artifact-scan/aggregate.js

@@ -33,7 +33,6 @@ const TIER_CLAMP = Object.freeze({
 // A lens that did not finish cleanly contributes caution, never silence: an
 // errored/timed-out/budget-exhausted lens means its surface went UNREVIEWED.
 const LENS_OK = 'ok';
-const LENS_PROBLEM_STATUSES = Object.freeze(['error', 'timeout', 'budget_exhausted']);
 
 const rank = (v) => VERDICT_RANK[v] ?? VERDICT_RANK.dangerous; // unknown → worst
 const maxVerdict = (a, b) => (rank(a) >= rank(b) ? a : b);
@@ -123,11 +122,8 @@ function reduceVerdict({ floorReport = {}, lenses = [], tier = 'low', declaredDe
 
 module.exports = {
   VERDICTS,
-  TIER_CLAMP,
   LENS_OK,
-  LENS_PROBLEM_STATUSES,
   panelOutcome,
-  lensHealth,
   coverageCap,
   reduceVerdict,
 };

package/modules/security/artifact-scan/detectors/capabilities.js

@@ -50,4 +50,4 @@ function inventory(corpus) {
 
 // Constants exported as the white-box surface: the reducer/report stages and
 // tests read them to stay in lockstep with what the inventory actually covers.
-module.exports = { inventory, CAPABILITY_PATTERNS, SCRIPT_EXTENSIONS };
+module.exports = { inventory };

package/modules/security/artifact-scan/detectors/config-obfuscation.js

@@ -38,4 +38,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, isJsonConfig };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/credentials.js

@@ -114,4 +114,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, perFileHits, CREDENTIAL_PATTERNS };
+module.exports = { detect, perFileHits };

package/modules/security/artifact-scan/detectors/dependencies.js

@@ -112,4 +112,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, specSeverity, DEP_SECTIONS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/injection.js

@@ -115,4 +115,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, OVERRIDE_PHRASES, SCANNER_PHRASES, codepointClasses };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/network.js

@@ -64,4 +64,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, perFileHits, NETWORK_PATTERNS };
+module.exports = { detect, perFileHits };

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -78,4 +78,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, AUTO_RUN_SCRIPTS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/permissions.js

@@ -88,4 +88,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, BYPASS_MARKERS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/shared.js

@@ -202,14 +202,11 @@ function escapedConfigKeyCount(text) {
 }
 
 module.exports = {
-  EXCERPT_MAX_CHARS,
   SEVERITIES,
-  SENSITIVE_BASENAMES,
   isSensitivePath,
   basename,
   finding,
   excerpt,
-  sanitizeDetail,
   lineAt,
   parseJsonStrict,
   rawKeyCounts,

package/modules/security/artifact-scan/floor.js

@@ -359,12 +359,9 @@ async function runFloor({ pristineDir, quarantineRoot, entries, sha = null, cont
 
 module.exports = {
   FLOOR_VERSION,
-  REPORT_BASENAME,
   VERDICT_RANK,
   DETECTORS,
   buildCorpus,
-  computeFloorVerdict,
-  countBySeverity,
   coOccurrence,
   coverageFindings,
   dedupeFindings,

package/modules/security/artifact-scan/mirror.js

@@ -155,4 +155,4 @@ async function buildMirror({ pristineDir, mirrorDir, quarantineRoot, entries, ca
   return { mirrored, stubs, unreviewedBytes, fenceDelim, indexPath };
 }
 
-module.exports = { buildMirror, MIRROR_CAPS, INDEX_BASENAME };
+module.exports = { buildMirror, MIRROR_CAPS };

package/modules/security/artifact-scan/quarantine.js

@@ -254,7 +254,6 @@ function createQuarantine({ tmpRoot = os.tmpdir(), forbiddenRoots } = {}) {
 module.exports = {
   canonical,
   isInsideLexical,
-  canonicalUncached,
   clearCanonicalCache,
   CAPS,
   REPO_ROOT,

package/modules/security/artifact-scan/rebuild-spec.js

@@ -112,8 +112,6 @@ function assembleRebuildSpec({
 }
 
 module.exports = {
-  SPEC_LIMITS,
-  GROUND_RULES,
   isDocPath,
   selectDocFiles,
   assembleRebuildSpec,

package/modules/security/artifact-scan/report.js

@@ -152,4 +152,4 @@ function assembleReport({
   return out.join('\n');
 }
 
-module.exports = { assembleReport, findingLine };
+module.exports = { assembleReport };

package/modules/security/artifact-scan/sanitize.js

@@ -313,8 +313,6 @@ async function buildSanitizedCopy({ pristineDir, quarantineRoot, entries, remova
 }
 
 module.exports = {
-  SANITIZED_DIRNAME,
-  DIFF_BASENAME,
   hasMaliceIndicator,
   planSanitize,
   buildSanitizedCopy,

package/modules/security/secret-scrub.js

@@ -255,15 +255,11 @@ function scrubSecrets(text, extraSecrets = [], opts = undefined) {
 module.exports = {
   REDACTED,
   SECRET_PATTERNS,
-  SECRET_ASSIGNMENT_RE,
   shannonEntropy,
-  charClasses,
   looksHighEntropySecret,
-  ENTROPY_CANDIDATE_RE,
   redactHighEntropy,
   ENV_SECRET_KEY_RE,
   ENV_SECRET_PREFIX_RE,
-  ENV_BENIGN_KEY_RE,
   collectEnvSecrets,
   scrubSecrets,
 };

package/modules/security/security.js

@@ -283,8 +283,6 @@ async function linkVulnerabilityReportFix(id, fixTaskId) {
 module.exports = {
   SEVERITIES,
   VULN_STATUSES,
-  DEFAULT_BOUNTY,
-  SEVERITY_BLURB,
   envName,
   bountyTable,
   bountyTableDetailed,

package/modules/sessions/accessibility.js

@@ -356,7 +356,6 @@ module.exports = {
   scoreAccessibility,
   // Exported so the tests can pin the contracts (waivers, leniency, each
   // detector) without reconstructing a whole digest for every case.
-  resolveProfile,
   waiversFor,
   leniencyFor,
   assistantProse,
@@ -366,7 +365,6 @@ module.exports = {
   bandFor,
   SIGNAL_SPEC,
   JARGON_TERMS,
-  UI_BACKED_SUBJECTS,
   LOW_CONFIDENCE_CHARS,
   PROFILE_DEFAULTS,
   PROFILE_VALUES,

package/modules/sessions/bfg.js

@@ -346,12 +346,8 @@ module.exports = {
   buildAdoptionSuggestion,
   // 6C.2 correction builder
   buildCorrection,
-  TRANSFERABLE_TYPES,
-  PII_PATTERNS,
   // exported for tests + reuse
   parseFrontmatter,
-  stripFrontmatter,
   clamp01,
   QUALITY_WEIGHTS,
-  ALLOWED_MEMORY_TYPES,
 };

package/modules/sessions/upload-health.js

@@ -187,11 +187,8 @@ function uploadHealthVerdict(rows, opts = {}) {
 module.exports = {
   DEFAULT_WINDOW_HOURS,
   DEFAULT_LOOKBACK_DAYS,
-  DEFAULT_MIN_SHIPS,
-  DEFAULT_MAX_UNCOVERED_SHARE,
   clampLookbackDays,
   clampWindowHours,
   clampSampleLimit,
-  normalizeBuilderRows,
   uploadHealthVerdict,
 };

package/modules/specialities/db.js

@@ -278,5 +278,5 @@ module.exports = {
   createSpeciality, getSpeciality, listVisibleTo, updateSpeciality,
   addDocument, listDocuments, deleteDocument,
   linkLearning, countTraining,
-  adopt, abandon, deactivateCraft, activeForCraft, listAdoptions, setEnabledSkills,
+  adopt, abandon, activeForCraft, listAdoptions, setEnabledSkills,
 };

package/modules/specialities/specialities.js

@@ -303,4 +303,4 @@ function offeredTo(specialities, viewer, adoptions = []) {
   });
 }
 
-module.exports = { VISIBILITIES, LIMITS, SKILL_NAME_RE, slugify, validateDraft, skillListErrors, enabledSkillsErrors, canAdopt, describeForApi, offeredTo };
+module.exports = { VISIBILITIES, LIMITS, SKILL_NAME_RE, slugify, validateDraft, enabledSkillsErrors, canAdopt, describeForApi, offeredTo };

package/modules/ui-design/kit/lib.js

@@ -524,9 +524,9 @@ function packColors(pack) {
 }
 
 module.exports = {
-  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS, EXPECT_KEYS,
+  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS,
   argOf, hasFlag, listArg, pageName, normalizePageArg, resolveSurfaceDir, sidecarPath, readJson,
-  validateActions, runActions, validateExpect, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
+  runActions, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
   validateStatesFile, validateProbesFile, NoBrowserError, launchBrowser, attachCollectors, withMode,
   freePort, startStub, parseColor, composite, luminance, contrastRatio, instancePack, packColors,
   listStyles, resolveStyle, styleBrandingFile,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.182",
+  "version": "1.22.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.182",
+      "version": "1.22.2",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.182",
+  "version": "1.22.2",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10331,18 +10331,6 @@
     {
       "id": "1004889",
       "text": "An automatic security check on search results works again, and it now really catches a private note leaking to the wrong person instead of passing by luck."
-    },
-    {
-      "id": "1004886",
-      "text": "Core releases can no longer be labelled as containing code that never actually went out."
-    },
-    {
-      "id": "1004859",
-      "text": "The Gate page is now called Autobongos. It keeps the runner controls and drops the list of held pull requests, which was always empty because the check it waited on never ran. Old links to /gate still work. The two permissions"
-    },
-    {
-      "id": "1004863",
-      "text": "Eight database tests that had quietly stopped working are repaired and now run on every change, including the one that proves an idea's author is never paid twice and the one that proves search never shows someone a page above"
     }
   ],
   "1.21.179": [
@@ -10368,5 +10356,31 @@
       "id": "1004890",
       "text": "Removed a leftover permission-list checker that nothing in the product used; the real protections and their tests are unchanged."
     }
+  ],
+  "1.22.0": [
+    {
+      "id": "1004886",
+      "text": "Core releases can no longer be labelled as containing code that never actually went out."
+    },
+    {
+      "id": "1004859",
+      "text": "The Gate page is now called Autobongos. It keeps the runner controls and drops the list of held pull requests, which was always empty because the check it waited on never ran. Old links to /gate still work. The two permissions"
+    },
+    {
+      "id": "1004863",
+      "text": "Eight database tests that had quietly stopped working are repaired and now run on every change, including the one that proves an idea's author is never paid twice and the one that proves search never shows someone a page above"
+    }
+  ],
+  "1.22.1": [
+    {
+      "id": "1004876",
+      "text": "Builder-written text now goes through one safety filter in the browser and one on the server instead of 42 hand-made copies, six of which let a stray quote through — and a check stops a new copy from creeping back."
+    }
+  ],
+  "1.22.2": [
+    {
+      "id": "1004891",
+      "text": "Cleaned up 220 internal code hooks nothing else used, cutting the project's dead-code count from 439 to 213."
+    }
   ]
 }

package/scripts/bongos/escape-helper-guard.js

@@ -0,0 +1,147 @@
+// scripts/bongos/escape-helper-guard.js — fitness check: ONE HTML escaper per side
+// (task 1004876, goal 1000135).
+//
+// WHY. The HTML escaper is what keeps a builder's own text (a task title, an idea,
+// a goal name) from turning into live markup on someone else's screen. The
+// 2026-10-25 audit found ~45 private copies of it, and six of them escaped fewer
+// characters than the rest (no single quote) or printed "null" for a missing
+// value — each one a place a cross-site-scripting hole could hide. They were
+// collapsed onto exactly two definitions:
+//
+//   browser  modules/hall-ui/public/dom-utils.js  → window.OTB.escapeHtml
+//   server   src/html-escape.js                    → escapeHtml (modules reach it
+//                                                   through src/module-api.js)
+//
+// This check keeps it that way. It does not look for a NAME (a copy called
+// `hesc` or `sesc` hid from a name search) — it looks for the escape TABLE
+// itself: a quoted < string literal is what every hand-rolled escaper has
+// to contain, and nothing else in the code needs one. A file that contains one
+// outside the allow-list below is a new private escaper: delete it and call the
+// shared one (a thin `function esc(s) { return window.OTB.escapeHtml(s); }`
+// delegate is fine — it holds no table).
+//
+// A delegate must really delegate, though. primer.js used to fall back to
+// `(s) => String(s)` — an "escaper" with no table that escaped nothing — so a
+// local HTML-escaper NAME (esc / escapeHtml / escAttr / escHtml / hesc / sesc)
+// must point at a shared escaper on the line that defines it. In browser code
+// (modules/*/public/) every such name is checked; on the server `esc` alone is
+// exempt, because scripts there use it for regex and markdown escaping too.
+//
+// Second half: a hall page must load dom-utils.js as its FIRST hall script and
+// without `defer`/`async`, because shell.js, palette.js and craft-mode.js run
+// while the page parses and now escape through window.OTB.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { REPO_ROOT } = require('./fitness-lib.js');
+
+// The two shared escapers, plus the one file whose escaper is NOT an HTML one.
+const ALLOWED = new Map([
+  ['modules/hall-ui/public/dom-utils.js', 'the shared BROWSER escaper (window.OTB.escapeHtml)'],
+  ['src/html-escape.js', 'the shared SERVER escaper (module-api escapeHtml)'],
+  ['modules/copy-desk/docx.js', 'an XML escaper for .docx files (', drops control characters) — a different contract'],
+]);
+
+// Where code lives. Tests, docs and vendored bundles are out of scope: a test may
+// carry its own decoder/encoder to CHECK the shared one against.
+const SCAN_ROOTS = ['src', 'scripts', 'modules', 'server.js', 'bin'];
+const SCAN_EXT = /\.(c|m)?js$|\.html$/;
+const SKIP_DIR = new Set(['node_modules', '.git', 'tests', 'fixtures']);
+
+// A quoted < literal — the entity standing alone as a string in any quote style.
+const ESCAPE_TABLE_RE = /(['"`])<\1/;
+
+function walk(abs, out) {
+  let st;
+  try { st = fs.statSync(abs); } catch { return out; }
+  if (st.isFile()) { if (SCAN_EXT.test(abs)) out.push(abs); return out; }
+  for (const ent of fs.readdirSync(abs, { withFileTypes: true })) {
+    if (SKIP_DIR.has(ent.name)) continue;
+    walk(path.join(abs, ent.name), out);
+  }
+  return out;
+}
+
+// findEscapeTables(text) → 1-based line numbers holding a hand-rolled escape table.
+function findEscapeTables(text) {
+  const lines = String(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) if (ESCAPE_TABLE_RE.test(lines[i])) hits.push(i + 1);
+  return hits;
+}
+
+// findFakeDelegates(text, { browser }) → 1-based lines that define a local HTML
+// escaper name WITHOUT pointing it at a shared escaper (window.OTB.escapeHtml, a
+// kit/reader alias of it, api.escapeHtml, or src/html-escape.js).
+const BROWSER_NAMES = /(?:function\s+|(?:const|let|var)\s+)(esc|escapeHtml|escAttr|escHtml|hesc|sesc)\s*(?:\(|=)/;
+const SERVER_NAMES = /(?:function\s+|(?:const|let|var)\s+)(escapeHtml|escAttr|escHtml|hesc|sesc)\s*(?:\(|=)/;
+const POINTS_AT_SHARED = /\.escapeHtml\b|\.esc\b|\bescapeHtml;|require\([^)]*html-escape/;
+function findFakeDelegates(text, { browser = false } = {}) {
+  const lines = String(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(browser ? BROWSER_NAMES : SERVER_NAMES);
+    if (!m) continue;
+    if (!POINTS_AT_SHARED.test(lines[i].slice(m.index + m[0].length))) hits.push(i + 1);
+  }
+  return hits;
+}
+
+// hallPageOrderProblem(html) → null when the page is fine, else a sentence saying
+// why. A page loading no /builders/ script at all has nothing to order.
+function hallPageOrderProblem(html) {
+  const tags = [...String(html).matchAll(/<script\b[^>]*\bsrc=["']([^"']+)["'][^>]*>/g)]
+    .map((m) => ({ tag: m[0], src: m[1].split('?')[0] }))
+    .filter((t) => t.src.startsWith('/builders/'));
+  if (!tags.length) return null;
+  const at = tags.findIndex((t) => t.src === '/builders/dom-utils.js');
+  if (at < 0) return 'loads hall scripts but never /builders/dom-utils.js (window.OTB.escapeHtml would be undefined)';
+  if (at > 0) return `loads ${tags[0].src} before /builders/dom-utils.js — dom-utils must be the first hall script`;
+  if (/\b(defer|async)\b/.test(tags[at].tag)) return 'loads /builders/dom-utils.js with defer/async — scripts that run while the page parses would find no window.OTB';
+  if (tags.filter((t) => t.src === '/builders/dom-utils.js').length > 1) return 'loads /builders/dom-utils.js twice';
+  return null;
+}
+
+function checkOneHtmlEscaper({ root = REPO_ROOT } = {}) {
+  const violations = [];
+  let scanned = 0;
+  for (const r of SCAN_ROOTS) {
+    for (const abs of walk(path.join(root, r), [])) {
+      scanned++;
+      const relPath = path.relative(root, abs).split(path.sep).join('/');
+      if (ALLOWED.has(relPath)) continue;
+      const text = fs.readFileSync(abs, 'utf8');
+      const hits = findEscapeTables(text);
+      if (hits.length) {
+        violations.push(`${relPath}:${hits[0]} — a private HTML escaper (a quoted &lt; literal: an escape table). Use the shared one: `
+          + 'window.OTB.escapeHtml in the browser, escapeHtml from src/html-escape.js (or api.escapeHtml in a module) on the server.');
+      }
+      const fakes = findFakeDelegates(text, { browser: /^modules\/[^/]+\/public\//.test(relPath) });
+      if (fakes.length) {
+        violations.push(`${relPath}:${fakes[0]} — defines a local HTML escaper name that does not point at a shared escaper `
+          + '(a fallback like `(s) => String(s)` escapes nothing). Delegate to window.OTB.escapeHtml / api.escapeHtml / src/html-escape.js.');
+      }
+    }
+  }
+  const hallDir = path.join(root, 'modules', 'hall-ui', 'public');
+  let pages = 0;
+  for (const abs of walk(hallDir, []).filter((f) => f.endsWith('.html'))) {
+    pages++;
+    const problem = hallPageOrderProblem(fs.readFileSync(abs, 'utf8'));
+    if (problem) violations.push(`${path.relative(root, abs).split(path.sep).join('/')} — ${problem}`);
+  }
+  return {
+    name: 'one HTML escaper per side (task 1004876)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} code files hold no private escape table (allowed: ${[...ALLOWED.keys()].join(', ')}); `
+      + `${pages} hall pages load dom-utils.js first.`,
+  };
+}
+
+module.exports = { checkOneHtmlEscaper, findEscapeTables, findFakeDelegates, hallPageOrderProblem, ALLOWED };

package/scripts/bongos/fitness.js

@@ -523,7 +523,7 @@ const KERNEL_FILES = [
   'src/module-api.js',                    // the published doorway
   'src/modules.js',                       // the registry/resolver facade
   'src/module-seams.js',                  // the seam registry (ports/events/contributions)
-  'src/role-responsibilities.js',         // the owner's written role statements (task 1003732) — modules.js reads it; imports nothing
+  'src/role-responsibilities.js', 'src/html-escape.js', // owner's role statements (task 1003732) + THE server HTML escaper (task 1004876) — both import nothing
   'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
   'src/module-loader/manifest-schema.js', // the manifest validator
   'src/module-loader/semver.js',          // coreVersion compatibility
@@ -1371,6 +1371,7 @@ const CHECKS = [
   // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
   // and the check gets its own line back.
   require('./version-literal-guard.js').checkNoVersionLiterals,
+  require('./escape-helper-guard.js').checkOneHtmlEscaper, // task 1004876: ONE HTML escaper per side (dom-utils.js / src/html-escape.js), and hall pages load dom-utils first
   require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
@@ -1436,7 +1437,7 @@ module.exports = {
   scanForRawNul,
   checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
   checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, checkPrelaunchVocabulary, PRELAUNCH_SURFACE, // 19c task 1003120, 19d task 1003152
-  runAll,
+  runAll, CHECKS, // CHECKS: so a test can prove a check is registered, not just written (task 1004876)
   resolvesToHostGame,
   checkCoreHostBoundary,
   checkClaudeMdBudget,

package/scripts/bongos/key-card.js

@@ -112,10 +112,7 @@ function renderMonospaceKeyCard(model) {
 }
 
 // ---- HTML renderer (the in-feed branded card) ---------------------------
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) =>
-    ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-}
+const { escapeHtml: esc } = require('../../src/html-escape'); // the one server escaper (task 1004876)
 function renderKeyCardHtml(model) {
   const m = model;
   const bg = 'var(--color-background-warning)';