[A10] Small correctness sweep for Beta admission

[SisyphusZheng]

A10.12

[A10] Small correctness sweep for Beta admission

Problem

Low-cost, high-certainty correctness defects that directly affect Beta admission, re-verified at baseline 2936bf0a:

1. M4 duplicated VOID_TAGS — CONFIRMED. Six independent production definitions: element/src/sanitize.ts:152, element/src/internal/compiled/program.ts:385, element/src/internal/compiled/server/shared.ts:44, element/src/internal/compiled/runtime.ts:1103, adapter-vite/src/internal/compiler/semantic-core/compile.ts:142, adapter-vite/src/internal/compiler/semantic-core/program.ts:376 (+3 test copies). One canonical definition; the rest import it.
2. M8 dev/start request callback containment — CONFIRMED. packages/adapter-vite/src/cli/start.ts:164-174: createServer(async (req,res) => …) with no try/catch; dispatchRequest rethrows non-URIError failures (static-serve.ts:167-170) → unhandled rejection in a node:http callback. The generated serve.mjs twin already contains the fix pattern (.catch → 500, ssg-helpers.ts:501-509).
3. M13 file URL construction — CONFIRMED. packages/adapter-vite/src/cli/build-ssg.ts:454-456 builds file:// URLs by string concatenation with no percent-encoding (spaces/#/?/non-ASCII break); correct pathToFileURL usage already exists at internal/static-serve.ts:184 and elsewhere.
4. M3 hard-coded when comparison — latent, record + converge. Number(value) > part.test.value triplicated at runtime.ts:370-371, claim/index.ts:355, server/index.ts:340. Today the operator space is closed to 'greater-than' by both validators (program.ts:602, semantic-core program.ts:593), so it cannot diverge — converge the triplication to one shared predicate while touching claim in A10.3, or document why not.
5. L1 escapeAttr drift — CONFIRMED (serializer pair). runtime.ts:1123 escapes only & and " while server/index.ts:108 escapes & " < > ' — two serializers that must emit byte-identical DSD with different attribute escapes and no documented contract. (The sanitize.ts:193 twin is intentional and documented — do not consolidate that pair.)
6. Pre-upgrade capture cleanup if still applicable → tracked in A10.5; do not duplicate here.
7. Any manually-stale current-version file bypassing truth checks → verify tools/project-constants.ts, packages/create/src/version.ts, www/app/data/version.ts are all covered by check-version-anchors/check-docs-truth.

Acceptance

Each item either fixed with observable evidence or explicitly deferred with the reason recorded in umbrella #1155. Not a general cleanup sprint.

Scope / non-goals

No stylistic refactors; no large-file splits; no new abstractions.

Risk

Low; item 5 changes serialized output bytes — verify SSR/claim parity tests stay green (they assert byte-level DSD equality where relevant).

Semantic owner: per-item canonical module (HTML escaping contract, static-serve, CLI build). Part of umbrella #1155. Internal Alpha.10 — no publish, no tag.