body - `var = || [];`, * `window..push(…)`, `const = …`. There is no escaping fix * available for that position, because escaping is exactly what a bare * identifier must not have, so this pattern IS the control and it has to * encode the grammar the sink parses rather than merely constrain the * value. `-` is the character that makes the difference: it is a perfectly * ordinary thing to type into a settings field and JavaScript reads it as * the subtraction operator, so a name containing one turns the whole *