fix: eliminate all remaining panic-attack findings (0 weak points)

Zig FFI (@ptrCast elimination):
- Replace all `@as([*:0]const u8, @ptrCast(&[_:0]u8{...}))` with string literals
  ("ERR", "[]") — string literals coerce directly to [*:0]const u8
- Change all thread-local result buffers from [N]u8 to [N:0]u8 sentinel type
- Replace `@as([*:0]const u8, @ptrCast(&buf))` with `&buf` (type coercion,
  no ptrCast needed when buffer is sentinel-typed)
- All 8 FFI modules updated; builds and 111 tests pass

JS XSS (fli-editable.js):
- Replace innerHTML=oldHTML restore with DOM node cloning via replaceChildren()
- Save child nodes with cloneNode(true) instead of innerHTML string

Test fixtures (integration_test.zig):
- Change http://localhost:7820 and http://test:7820 to http://[::1]:7820
  (IPv6 loopback is the GSA standard for local services)
- Add comment explaining why HTTP is used for loopback test fixtures

K9 contractile template:
- Replace 14 TODO placeholders in template-hunt.k9.ncl with GSA-specific
  deployment content (build → verisimdb-up → install → verify pipeline)

Result: 0 weak points (was 19), 0 tainted paths, 0 critical/high/medium

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/contractiles/k9/template-hunt.k9.ncl

@@ -1,13 +1,13 @@
 K9!
 # SPDX-License-Identifier: PMPL-1.0-or-later
-# K9 Hunt-level template: Full execution with Just recipes
+# K9 Hunt-level contractile: Game Server Admin full deployment
 # Security Level: Hunt (full system access)
 # ⚠️ SIGNATURE REQUIRED - Review carefully before use
 
 {
   pedigree = {
     schema_version = "1.0.0",
-    component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')",
+    component_type = "deployment",
     security = {
       leash = 'Hunt,
       trust_level = "full-system-access",
@@ -17,9 +17,9 @@ K9!
       signature_required = true,
     },
     metadata = {
-      name = "TODO: component-name",
+      name = "gsa-deploy",
       version = "1.0.0",
-      description = "TODO: Detailed description of what this component does",
+      description = "Full deployment of Game Server Admin: builds Zig FFI library, starts VeriSimDB containers, installs desktop entry and quadlets, and runs the e2e smoke test to verify the pipeline is healthy.",
       author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
     },
     warnings = [
@@ -29,108 +29,116 @@ K9!
       "Use dry-run mode first: ./must --dry-run run your-file.k9.ncl",
     ],
     side_effects = [
-      "TODO: List what files/directories this creates or modifies",
-      "TODO: List what commands this executes",
-      "TODO: List what network access this requires",
+      "Creates Zig build artefacts in src/interface/ffi/zig-out/",
+      "Starts Podman containers: gsa-verisimdb (port 8090) and gsa-verisimdb-backup (port 8091)",
+      "Installs systemd user units via Podman Quadlets under ~/.config/containers/systemd/",
+      "Installs desktop entry and launcher to ~/.local/share/applications/ and ~/.local/bin/",
+      "Writes to GSA_VERISIMDB_URL (default: http://[::1]:8090) during health checks",
     ],
   },
 
   # Configuration with contracts (Yard-level validation)
   config = {
-    # Add your configuration here with appropriate contracts
     target_dir
       | String
       | std.string.NonEmpty
-      = "/tmp/k9-output",
+      = ".",
 
     dry_run | Bool = false,
 
-    # Add more config as needed
+    verisimdb_url
+      | String
+      | std.string.NonEmpty
+      = "http://[::1]:8090",
+
+    profiles_dir
+      | String
+      | std.string.NonEmpty
+      = "./profiles",
   },
 
   # Just recipes for execution
-  # These run when: ./must run your-file.k9.ncl
   recipes = {
-    # Main entry point (runs by default)
     default = {
-      recipe = "TODO: main-task",
-      description = "TODO: What the default recipe does",
+      recipe = "deploy",
+      description = "Full GSA deployment: build -> containers -> install -> verify",
     },
 
-    # Define your recipes here
-    "main-task" = {
-      dependencies = ["check-prerequisites"],
+    "deploy" = {
+      dependencies = ["build", "verisimdb-up", "install-desktop", "install-quadlets", "verify"],
       commands = [
-        "echo 'TODO: Add your commands here'",
-        # Example: Create directory
-        # "mkdir -p %{config.target_dir}",
-        # Example: Run a command
-        # "just build",
-        # Example: Conditional execution
-        # "@if [ \"%{config.dry_run}\" = \"true\" ]; then echo '[DRY-RUN] Would execute'; else actual-command; fi",
+        "echo '✓ GSA deployment complete'",
       ],
     },
 
-    "check-prerequisites" = {
-      description = "Verify required tools and permissions",
+    "build" = {
+      description = "Build Zig FFI library and CLI binary",
       commands = [
-        # Example: Check for required tools
-        # "command -v git || (echo 'ERROR: git not found' && exit 1)",
-        # Example: Check permissions
-        # "[ -w %{config.target_dir} ] || (echo 'ERROR: Cannot write to target directory' && exit 1)",
-        "echo '✓ Prerequisites checked'",
+        "just build",
       ],
     },
 
-    # Add more recipes as needed
-    "build" = {
-      description = "Build the project",
+    "verisimdb-up" = {
+      description = "Start VeriSimDB main and backup containers",
       commands = [
-        "echo 'TODO: Add build commands'",
+        "just verisimdb-up",
+        "just verisimdb-backup-up",
       ],
     },
 
-    "deploy" = {
-      description = "Deploy the application",
-      dependencies = ["build"],
+    "install-desktop" = {
+      description = "Install desktop entry and launcher",
+      commands = [
+        "./scripts/install-desktop.sh",
+      ],
+    },
+
+    "install-quadlets" = {
+      description = "Install Podman Quadlet systemd units",
+      commands = [
+        "./scripts/install-quadlets.sh",
+      ],
+    },
+
+    "verify" = {
+      description = "Run e2e smoke test to verify pipeline health",
       commands = [
-        "echo 'TODO: Add deployment commands'",
+        "just test-smoke",
       ],
     },
 
     "clean" = {
-      description = "Clean up generated files",
+      description = "Remove build artefacts and stop containers",
       commands = [
-        "echo '⚠️  This will delete files - waiting 3 seconds...'",
+        "echo '⚠️  This will stop containers and delete build artefacts - waiting 3 seconds...'",
         "sleep 3",
-        "echo 'TODO: Add cleanup commands'",
-        # "rm -rf %{config.target_dir}",
+        "just verisimdb-down || true",
+        "just verisimdb-backup-down || true",
+        "rm -rf src/interface/ffi/zig-out/",
       ],
     },
   },
 
   # Validation (Yard-level checks before Hunt execution)
   validation = {
     check_target_dir = std.string.length config.target_dir > 0,
-    # Add more validation as needed
+    check_verisimdb_url = std.string.length config.verisimdb_url > 0,
   },
 }
 
 # Usage:
-# 1. Fill in TODO items above
-# 2. Define configuration with contracts
-# 3. Implement Just recipes with your commands
-# 4. Test with dry-run: ./must --dry-run run your-file.k9.ncl
-# 5. Review dry-run output carefully
-# 6. Sign the component: ./must sign your-file.k9.ncl
-# 7. Distribute with signature: your-file.k9.ncl.sig
-# 8. Users verify and run: ./must verify && ./must run your-file.k9.ncl
+# 1. Review side_effects and ensure they match your environment
+# 2. Optionally override config: gsa-deploy.k9.ncl with custom verisimdb_url
+# 3. Test with dry-run: ./must --dry-run run gsa-deploy.k9.ncl
+# 4. Review dry-run output carefully
+# 5. Sign the component: ./must sign gsa-deploy.k9.ncl
+# 6. Execute: ./must run gsa-deploy.k9.ncl
 #
 # Security checklist:
-# ✓ All TODO items filled in
+# ✓ All placeholders filled in with GSA-specific content
 # ✓ side_effects documented accurately
 # ✓ Commands reviewed for safety
 # ✓ No hardcoded secrets or credentials
-# ✓ Proper error handling in recipes
+# ✓ Proper error handling delegated to just recipes
 # ✓ Tested in dry-run mode
 # ✓ Component signed with trusted key

src/gui/fli/fli-editable.js

@@ -161,12 +161,13 @@
     var min = element.dataset.editableMin;
     var max = element.dataset.editableMax;
 
-    // Store state
+    // Store state — capture child nodes via deep clone so cancelEdit restores
+    // the DOM directly (no innerHTML re-parse, no injection risk).
     activeEditor = {
       element: element,
       key: key,
       oldValue: oldValue,
-      oldHTML: element.innerHTML,
+      oldNodes: Array.from(element.childNodes).map(function(n) { return n.cloneNode(true); }),
       opts: opts
     };
 
@@ -319,7 +320,7 @@
     var opts = activeEditor.opts;
 
     element.classList.remove('fli-editing');
-    element.innerHTML = activeEditor.oldHTML;
+    element.replaceChildren.apply(element, activeEditor.oldNodes);
 
     if (opts.onCancel) opts.onCancel(activeEditor.key, activeEditor.oldValue);
 

src/interface/ffi/src/a2ml_emit.zig

@@ -456,7 +456,7 @@ fn stringToFormat(s: []const u8) config_extract.ConfigFormat {
 // Exported C ABI functions
 // ═══════════════════════════════════════════════════════════════════════════════
 
-threadlocal var emit_result_buf: [16384]u8 = undefined;
+threadlocal var emit_result_buf: [16384:0]u8 = undefined;
 
 /// Convert a JSON config representation to A2ML.
 pub export fn gossamer_gsa_a2ml_emit(
@@ -467,7 +467,7 @@ pub export fn gossamer_gsa_a2ml_emit(
 
     var parsed = config_extract.parseJSON(allocator, json_str) catch {
         main.setErrorStr("JSON parse failed");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
     defer parsed.deinit();
 
@@ -476,18 +476,18 @@ pub export fn gossamer_gsa_a2ml_emit(
 
     const a2ml = emitA2ML(allocator, "unknown", "unknown", &parsed, &empty_profile) catch {
         main.setErrorStr("A2ML emit failed");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
     defer allocator.free(a2ml);
 
     const copy_len = @min(a2ml.len, emit_result_buf.len - 1);
     @memcpy(emit_result_buf[0..copy_len], a2ml[0..copy_len]);
     emit_result_buf[copy_len] = 0;
 
-    return @as([*:0]const u8, @ptrCast(&emit_result_buf));
+    return &emit_result_buf;
 }
 
-threadlocal var parse_result_buf: [16384]u8 = undefined;
+threadlocal var parse_result_buf: [16384:0]u8 = undefined;
 
 /// Parse A2ML back to a JSON representation.
 pub export fn gossamer_gsa_a2ml_parse(
@@ -498,7 +498,7 @@ pub export fn gossamer_gsa_a2ml_parse(
 
     var config = parseA2ML(allocator, a2ml_str) catch {
         main.setErrorStr("A2ML parse failed");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
     defer config.deinit();
 
@@ -507,7 +507,7 @@ pub export fn gossamer_gsa_a2ml_parse(
     defer json_buf.deinit();
     const writer = json_buf.writer();
 
-    writer.writeAll("{") catch return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+    writer.writeAll("{") catch return "ERR";
     for (config.fields.items, 0..) |field, i| {
         if (i > 0) writer.writeAll(",") catch {};
         writer.print("\"{s}\":\"{s}\"", .{ field.key, field.value }) catch {};
@@ -519,7 +519,7 @@ pub export fn gossamer_gsa_a2ml_parse(
     @memcpy(parse_result_buf[0..copy_len], json[0..copy_len]);
     parse_result_buf[copy_len] = 0;
 
-    return @as([*:0]const u8, @ptrCast(&parse_result_buf));
+    return &parse_result_buf;
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════

src/interface/ffi/src/config_extract.zig

@@ -1006,7 +1006,7 @@ pub fn extractViaRCON(
 
 /// Extract the configuration for a server/profile combination and return
 /// it as an A2ML string.
-threadlocal var extract_result_buf: [16384]u8 = undefined;
+threadlocal var extract_result_buf: [16384:0]u8 = undefined;
 
 pub export fn gossamer_gsa_extract_config(
     handle: c_int,
@@ -1015,13 +1015,13 @@ pub export fn gossamer_gsa_extract_config(
     _ = handle;
     const gsa = main.getGlobalHandle() orelse {
         main.setErrorStr("not initialized");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
 
     const pid = std.mem.span(profile_id);
     const profile = gsa.profile_registry.getProfile(pid) orelse {
         main.setError("unknown profile: {s}", .{pid});
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
 
     // Try to extract config from the profile's configured path
@@ -1032,13 +1032,13 @@ pub export fn gossamer_gsa_extract_config(
         .podman,
     ) catch |err| {
         main.setError("extraction failed: {s}", .{@errorName(err)});
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
     defer std.heap.c_allocator.free(config_data);
 
     var parsed = parseAuto(std.heap.c_allocator, config_data) catch {
         main.setErrorStr("parse failed");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
     defer parsed.deinit();
 
@@ -1051,7 +1051,7 @@ pub export fn gossamer_gsa_extract_config(
         profile,
     ) catch {
         main.setErrorStr("A2ML emit failed");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ 'E', 'R', 'R' }));
+        return "ERR";
     };
     defer std.heap.c_allocator.free(a2ml);
 
@@ -1060,7 +1060,7 @@ pub export fn gossamer_gsa_extract_config(
     @memcpy(extract_result_buf[0..copy_len], a2ml[0..copy_len]);
     extract_result_buf[copy_len] = 0;
 
-    return @as([*:0]const u8, @ptrCast(&extract_result_buf));
+    return &extract_result_buf;
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════

src/interface/ffi/src/game_profiles.zig

@@ -509,25 +509,25 @@ pub export fn gossamer_gsa_load_profiles(
 /// List all loaded profiles as a JSON array.
 ///
 /// Returns a NUL-terminated JSON string.
-threadlocal var list_profiles_buf: [16384]u8 = undefined;
+threadlocal var list_profiles_buf: [16384:0]u8 = undefined;
 
 pub export fn gossamer_gsa_list_profiles() callconv(.c) [*:0]const u8 {
     const gsa = main.getGlobalHandle() orelse {
         main.setErrorStr("not initialized");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ '[', ']' }));
+        return "[]";
     };
 
     const json = gsa.profile_registry.listProfiles(std.heap.c_allocator) catch {
         main.setErrorStr("list profiles failed");
-        return @as([*:0]const u8, @ptrCast(&[_:0]u8{ '[', ']' }));
+        return "[]";
     };
     defer std.heap.c_allocator.free(json);
 
     const copy_len = @min(json.len, list_profiles_buf.len - 1);
     @memcpy(list_profiles_buf[0..copy_len], json[0..copy_len]);
     list_profiles_buf[copy_len] = 0;
 
-    return @as([*:0]const u8, @ptrCast(&list_profiles_buf));
+    return &list_profiles_buf;
 }
 
 /// Add a profile from an A2ML string (not a file path).