Constrain OSGi imports to actual adapter API requirements and freeze bundle identities

[jmanico]

Reviewed 2026-09-25 (America/Los_Angeles) against main at bd249f5. Execution order and cross-issue ownership: #169. Batch 03.

This scope replaces the dated implementation prescriptions in the original report and earlier comments; linked historical evidence remains useful but must be rechecked before implementation.

Updated finding

The original [1.4,2) core range is stale: #151 added JSON tags that call Encode.forJson, introduced in 1.5 development. Unversioned adapter imports can resolve against older core bundles and fail when a tag executes. #162 already checks Bundle-SymbolicName and package names, but not the required import version ranges. #168 adds XML 1.1 tags and shares this packaging review.

• Derive each adapter's minimum core package version from every API it actually calls. JSP/Jakarta now require the 1.5 API; do not hardcode the old [1.4,2) range. Decide the ESAPI adapter range from its own calls and security-support policy.
• Choose bnd dependency visibility or explicit imports without embedding dependency classes, exporting unintended packages, introducing java.* imports, or silently raising supported container floors.
• Validate Servlet/JSP package ranges against supported exports; widening Jakarta Pages 3 to 4 requires actual compatibility evidence, not a guessed upper bound.
• Freeze published BSNs explicitly: org.owasp.encoder, org.owasp.encoder.jsp, org.owasp.encoder.jakarta-jsp, org.owasp.encoder.esapi. Preserve existing JPMS and automatic module identities.
• Extend the existing packaged-consumer guards and Felix R6/newer fixtures: accept supported wiring; reject a core missing required APIs; invoke the newer tags to prove linkage. Preserve intentionally wrapped ESAPI-fixture limitations in documentation.
• Add the BSN column to Rewrite the README and context guide, incorporating #114 and current 1.5 contracts #128's compatibility table. State that real ESAPI OSGi consumers need appropriately wrapped dependencies; the test wrapper is not an upstream OSGi guarantee.

This issue exclusively owns BSN declarations/table data previously duplicated in #123. Complete this packaging decision before final #103 reproducibility baselines and before treating #131/#168 as releasable.