@bongos/core 1.19.1042 → 1.19.1044

package/docs/file-map.md

@@ -137,7 +137,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
+│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -2571,5 +2571,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         1.19.0 precedent, riding the next CI patch as joinabilityMode did.
   1.19.1042 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1041 with no explicit bump. run 36254852933. (task 1002620)
+  1.19.1043 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1042 with no explicit bump. run 36258640780. (task 1002620)
+  1.19.1044 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1043 with no explicit bump. run 36260641494. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -98,7 +98,10 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
     "pollers":     ["box-lifecycle"], //   background pollers (start/stop lifecycle)
     "disciplines": ["artist"],        //   builder disciplines this module adds
     "skills":      ["otb-tile-generate"], // slash-command skills it ships
-    "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__
+    "uiSections":  ["boxes"],         //   hall/status UI sections gated by window.__MODULES__. Ship public/hall-widget.js
+                                      //   and it is injected into the hall index; ship public/task-widget.js and it
+                                      //   is injected into a task's page before task.js, to fill #task-contrib on
+                                      //   `otb:task-shown` (task 1004301). The page itself names no module.
     "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces: a Host PREFIX (BV1.R84)…
                                                             // …or { "apexRoot": true, "dir": "public" } for the
                                                             // apex root (ADR 0218). One or the other, never both.

package/migrations/core_256_blocker_unlink_releases_task.sql

@@ -0,0 +1,84 @@
+-- core_256_blocker_unlink_releases_task.sql — unlinking a blocker from a task
+-- must release that task when it was the last thing holding it (task 1003518).
+--
+-- THE GAP. `POST /blockers/:id/link` parks a 'ready' task in 'blocked' so the
+-- resolve trigger (009, tightened by core_223) has something to promote. Nothing
+-- removed a link. Post-core_223 a task is released only when its LAST open
+-- blocker resolves, so a wrong link — wrong task id, a duplicate filed by two
+-- people, a blocker later understood to be irrelevant — was permanent. The only
+-- escape was to resolve a blocker that was never real, putting a falsehood in
+-- the blocker ledger to clear a bookkeeping artifact. core_223's own header
+-- names this: "there is no unlink route to detach one first."
+--
+-- WHY A TRIGGER AND NOT THE ROUTE. tests/blocker_resolve_guard.mjs pins that
+-- modules/ideas/blockers.js never writes `tasks.status = 'ready'` itself: "if it
+-- ever started UPDATE-ing tasks.status, this guard would be bypassable and the
+-- fix would need to live in two places." An unlink that promoted in JS would be
+-- exactly that second place — a hand-copy of the predicate below, free to drift
+-- from it. Putting the release here keeps ONE definition of "this task has
+-- nothing open against it any more", and has a second payoff: the direct
+-- `DELETE FROM task_blockers` that was the only workaround before this task now
+-- does the right thing too, instead of silently leaving the task stranded.
+--
+-- NO `b.id <> …` EXCLUSION, AND THAT IS THE DIFFERENCE FROM core_223. That
+-- migration runs in a BEFORE UPDATE trigger, where the blocker being resolved
+-- still reads 'open' in the table and would count itself as an open blocker —
+-- so without the exclusion nothing would ever promote. This is an AFTER DELETE
+-- trigger: the link row is already gone when the body runs, so the NOT EXISTS
+-- already sees exactly the blockers that remain. Adding the exclusion here would
+-- be cargo-cult; omitting it is deliberate.
+--
+-- Deliberately NOT gating on dependencies, for core_223's reason: the
+-- dep-promotion triggers (163) only ever flip 'backlog' -> 'ready', never
+-- 'blocked' -> 'ready', so a task this left in 'blocked' for unshipped deps
+-- would have no release path at all. The claim path re-checks DEPS_NOT_SHIPPED
+-- as its second line of defence. Blocker-clearing and dep-clearing stay separate.
+--
+-- ONLY 'blocked' IS REWRITTEN. A task that was never parked (link arrived while
+-- it was active/backlog/shipped — see LINK_BLOCKABLE_STATUSES) is left exactly
+-- as it is, so an unlink can never launder a task past the metic+archon promote
+-- gate.
+--
+-- Legacy markdown-anchor links (a task_blockers row with blocker_ref and no
+-- blocker_id) are out of scope, the same scope core_223 and 176 draw: the JOIN
+-- below only sees structured links, so a legacy row neither blocks nor releases.
+--
+-- CASCADE SAFETY. task_blockers.task_id and .blocker_id are both ON DELETE
+-- CASCADE. Nothing in the repo hard-deletes a task (abandon is terminal) or a
+-- blocker (resolve is), so in practice this fires only on a real unlink. If a
+-- blocker ever were deleted outright, releasing the tasks it held is the correct
+-- reading — the thing that was blocking them no longer exists.
+--
+-- Idempotent: CREATE OR REPLACE for the function, DROP IF EXISTS + CREATE for
+-- the trigger (a trigger has no CREATE OR REPLACE before PG 14, and this must
+-- apply cleanly on a re-run).
+
+BEGIN;
+
+CREATE OR REPLACE FUNCTION trg_release_task_on_blocker_unlink()
+RETURNS TRIGGER AS $$
+BEGIN
+  UPDATE tasks
+     SET status = 'ready', updated_at = now()
+   WHERE id = OLD.task_id
+     AND status = 'blocked'
+     -- … and nothing open is left against this task (core_223's predicate,
+     -- minus the self-exclusion an AFTER DELETE trigger does not need).
+     AND NOT EXISTS (
+       SELECT 1
+         FROM task_blockers tb
+         JOIN blockers b ON b.id = tb.blocker_id
+        WHERE tb.task_id = OLD.task_id
+          AND b.status = 'open'
+     );
+  RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS release_task_on_blocker_unlink ON task_blockers;
+CREATE TRIGGER release_task_on_blocker_unlink
+  AFTER DELETE ON task_blockers
+  FOR EACH ROW
+  EXECUTE FUNCTION trg_release_task_on_blocker_unlink();
+
+COMMIT;

package/modules/hall-ui/public/style.css

@@ -3151,6 +3151,10 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   min-width: 0;
   max-width: 100%;
 }
+/* The 24px floor (task 1004301 found it failing): at 13px the base field's padding left a
+   number input 21px tall beside a select that clears it — the task page's "Wait for task"
+   box. Sized to sit level with its select. */
+.td-field input { min-height: 26px; box-sizing: border-box; }
 .td-form .td-actions, .td-form-hint, .td-form .td-action-note { grid-column: 1 / -1; }
 .td-form .td-actions { margin: 4px 0 0; }
 .td-form-hint { font-size: 12.5px; color: var(--ink-soft); margin: 0; }

package/modules/hall-ui/public/task.css

@@ -139,3 +139,9 @@
   .tk-axis:nth-child(3) { border-left: 0; padding-left: 0; }
   .tk-lrow { grid-template-columns: 1fr; gap: 6px; }
 }
+
+/* The module slot under the rail (task 1004301): a module's task-widget.js may write one
+   line of its own here (the npm-release module says which version carries the task).
+   Empty unless a module fills it, and then it takes no room at all. */
+.tk-contrib { margin: var(--sp-md) 0 0; }
+.tk-contrib:empty { display: none; }

package/modules/hall-ui/public/task.html

@@ -69,6 +69,6 @@
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/md-reader.js" defer></script>
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1" defer></script>
-<script src="/builders/task.js?v=2026-07-03-taskpage1" defer></script>
+<script src="/builders/task.js?v=2026-09-26-taskwhere" defer></script>
 </body>
 </html>

package/modules/hall-ui/public/task.js

@@ -634,6 +634,11 @@
       ['Priority', t.priority == null ? null : 'P' + t.priority],
     ]));
     parts.push(lifecycleRail(t, creditVal));
+    // A slot a MODULE may fill (task 1004301): the module's public/task-widget.js is
+    // injected just before this script and writes into it on `otb:task-shown` below. The
+    // page itself names no module and draws nothing here — with none enabled it stays
+    // empty, and `:empty` in task.css collapses it.
+    parts.push('<div class="tk-contrib" id="task-contrib" aria-live="polite"></div>');
 
     // Claim history (task 751). The most recent holder leads; since task 1003437
     // the read also carries the FULL claim ledger (?include=claims), so a task
@@ -806,6 +811,7 @@
 
     const body = $('#task-body');
     if (body) body.innerHTML = parts.join('');
+    announceShown(t);
 
     const copyBtn = $('#copy-prompt-btn');
     if (copyBtn) {
@@ -958,6 +964,17 @@
   // The two honest failures. Both keep the <h1> — the empty and error renders are
   // renders like any other, and a page whose only heading lives on the happy path
   // has none in the states a reader is most likely to hit.
+  // Tell any module widget which task is on screen (task 1004301). Fired after EVERY
+  // render, because render() rebuilds #task-body wholesale and the slot a widget filled a
+  // moment ago is gone. The last task shown is also left on window.OTBTaskShown for a
+  // widget that loads after the first announcement. Only the id and the status travel:
+  // a widget that needs more asks its own module's route, which applies its own gate.
+  function announceShown(t) {
+    const detail = { id: String(t.id), status: t.status || null };
+    window.OTBTaskShown = detail;
+    if (typeof CustomEvent === 'function') document.dispatchEvent(new CustomEvent('otb:task-shown', { detail }));
+  }
+
   function renderNotFound(id) {
     const body = $('#task-body');
     if (body) body.innerHTML = `

package/modules/hall-ui/records/record-family.md

@@ -11,3 +11,5 @@
 **The task record's grade panel, session log and claim ledger (task 1003437).** Two net-new regions the owner approved at the composition round (direction doc §6 decision 4) sit between Shipped and Actions on `task.html`. Four rules carry them: all three ride the ONE task read as opt-in siblings — `GET /tasks/:id?include=last_claim,grade,session_logs,claims`; the two new reads (`getTaskSessionLogs`, `getTaskClaims` in `modules/lifecycle/db-claim-reads.js`) are keyed by `task_id`, newest first, **rank never returned**; absent → **NOTHING** (the ship-visual precedent), except a grade row whose panel was `unavailable`, which is data and says so in one line; and verdicts and outcomes wear the fixed verification vocabulary through `.rec-pill--ok/warn/danger`, **never the accent**. Pinned in `tests/hall_record_world.mjs` (page) and `tests/task_detail_includes.mjs` (route + reads).
 
 **The way into and out of a task record (task 1003468, ADR 0229).** Since 1759/1869 a to-do card's BODY toggles selection so a builder can bulk-claim — which is why the owner could not open a card, the only door being a 26px ⤢ glyph nobody found. Now **the title is the door**: `.task__link` on both surfaces that render the card (`work.js`, `goals-render.js`), bought up to the 24px floor with the `.scroll__lede a` recipe; both click handlers let it through; the glyph is gone. **The link carries where it was opened from** — `OTBTaskDetail.href(id)` appends `?from=<path+query+hash>` (a query param so the origin survives a reload and keeps a goal's `#/goal/N`, which a referrer drops) — and `task.js` resolves the exit once (`?from=` → same-origin referrer → the work board), points the crumb **before** the fetch so the way back exists in every state, and refuses anything that is not a path on this host. **Never write a bare `/task/N` link from a list again — call `OTBTaskDetail.href(id)`.** Pinned by §10 of `tests/hall_record_world.mjs` and §7 of `tests/hall_board_world.mjs`.
+
+**The task page carries a module slot (task 1004301).** Under the lifecycle rail sits `#task-contrib`, empty and collapsed (`.tk-contrib:empty`) unless a module fills it, and `task.js` announces every render as `otb:task-shown` with `{ id, status }` (also left on `window.OTBTaskShown` for a late widget). The page names no module: the server injects each enabled module's `public/task-widget.js` just before `task.js` (the loader's uiSections seam, `hallWidgetScripts({ file: 'task-widget.js' })`), so both run deferred in order and the listener exists before the first announcement. Render rebuilds `#task-body` wholesale, which is why the announcement is per render, not per load. The first filler is npm-release's line — "In 1.19.1036 · running here · not released to other projects yet", or "Done, but not merged" for a stranded ship. Tests: `tests/hall_record_world.mjs` (slot + announcement), `tests/npm_release_where.mjs` (the widget and the seam).

package/modules/ideas/blockers.js

@@ -147,6 +147,65 @@ async function linkBlockerToTask({ blockerId, taskId }) {
   }
 }
 
+// Unlink a blocker from a task — the missing inverse of linkBlockerToTask
+// (task 1003518). Linking is one-way and Metic+, so before this a wrong link
+// (wrong task id, a duplicate filed by two people, a blocker later understood
+// to be irrelevant) could only be undone by a direct DELETE on task_blockers.
+//
+// LIKE resolveBlocker, THIS ONLY OBSERVES. The release lives in a DB trigger
+// (core_256), for the reason tests/blocker_resolve_guard.mjs states about the
+// resolve path: a promotion written here would be a second copy of core_223's
+// predicate, free to drift from it. One DELETE, then a read-back of what the
+// trigger did — the same shape resolveBlocker uses for `promoted_tasks`.
+//
+// The three statements share a transaction so `released` cannot be a lie told
+// by a concurrent writer between the delete and the read-back.
+//
+// `poolOverride` is injected by tests only, and is named so it cannot shadow the
+// module-level `pool` this file closes over.
+async function unlinkBlockerFromTask({ blockerId, taskId }, { pool: poolOverride = pool } = {}) {
+  const client = await poolOverride.connect();
+  try {
+    await client.query('BEGIN');
+    // Status BEFORE, so `released` means "this unlink moved it", not merely
+    // "it is ready now" — a task linked while it was never blockable would
+    // otherwise report a release that never happened (the task-1002559 lesson:
+    // a write that reports success without saying what changed hides a dead
+    // loop). FOR UPDATE so the row cannot move under the read-back below.
+    const { rows: before } = await client.query(
+      `SELECT status FROM tasks WHERE id = $1 FOR UPDATE`,
+      [taskId]
+    );
+    const { rows: removed } = await client.query(
+      `DELETE FROM task_blockers
+        WHERE task_id = $1 AND blocker_id = $2
+        RETURNING task_id`,
+      [taskId, blockerId]
+    );
+    // Answer honestly when nothing was there: a missing link is a refusal, not
+    // a silent success a caller would read as "detached".
+    if (removed.length === 0) {
+      await client.query('ROLLBACK');
+      const e = new Error('no such blocker link on that task');
+      e.code = 'LINK_NOT_FOUND';
+      throw e;
+    }
+    const { rows: after } = await client.query(
+      `SELECT status FROM tasks WHERE id = $1`,
+      [taskId]
+    );
+    await client.query('COMMIT');
+    const was = before[0] && before[0].status;
+    const now = after[0] && after[0].status;
+    return { unlinked: true, released: was === 'blocked' && now === 'ready' };
+  } catch (err) {
+    if (err.code !== 'LINK_NOT_FOUND') await client.query('ROLLBACK');
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
 module.exports = {
   listOpenBlockers,
   countOpenBlockers,
@@ -154,6 +213,7 @@ module.exports = {
   createBlocker,
   resolveBlocker,
   linkBlockerToTask,
+  unlinkBlockerFromTask,
   blocksOnLink,
   LINK_BLOCKABLE_STATUSES,
 };

package/modules/ideas/routes/blockers.js

@@ -145,5 +145,46 @@ module.exports = function buildBlockersRouter() {
     }
   });
 
+  // Unlink a blocker from a task — the inverse of /link (task 1003518). Both ids
+  // sit in the PATH, matching DELETE /tasks/:id/dependencies/:depId, the closest
+  // existing shape: an edge between two rows, removed by naming both.
+  //
+  // Post-core_223 a task is released only when its LAST open blocker resolves,
+  // so a wrong link is permanent: the only way out was to resolve a blocker that
+  // was never real, putting a falsehood in the blocker ledger to clear a
+  // bookkeeping artifact. This is the honest way out.
+  //
+  // Promotion is the TRIGGER's job here exactly as it is on /resolve: core_256
+  // fires AFTER DELETE on task_blockers and re-uses core_223's predicate, so
+  // "nothing open is left against this task" has one definition, not two.
+  // blockers.unlinkBlockerFromTask only deletes and reads back what happened.
+  //
+  // `released` says whether the task actually moved, never a bare {ok:true}
+  // (task 1002559 — a write that reports success without saying what changed is
+  // how a dead loop hides).
+  // Metic+ (#360 / ADR 0018) — same blocker-review grant as link and resolve.
+  // rank: metic+archon — unlink a blocker from a task; same blocker-review grant as link.
+  router.delete('/blockers/:id/link/:taskId', api.requireBuilder, api.requirePermission('blocker.review'), async (req, res) => {
+    // Both ids strict positive integers (`positiveInt`), via the shared parseId
+    // rather than a hand-rolled check: a `7.5` would otherwise pass a bare
+    // isFinite and then simply miss on the DELETE, answering "not linked" for
+    // what is really a malformed id. The sibling link/resolve routes predate
+    // that option; this one has no reason to be looser than it can be.
+    const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
+    if (id === null) return;
+    const taskId = parseId(req, res, { param: 'taskId', code: 'bad_task_id', positiveInt: true });
+    if (taskId === null) return;
+    try {
+      const { released } = await blockers.unlinkBlockerFromTask({ blockerId: id, taskId });
+      res.json({ ok: true, unlinked: true, released });
+    } catch (err) {
+      if (err.code === 'LINK_NOT_FOUND') {
+        return res.fail('link_not_found', { status: 404, message: 'that blocker is not linked to that task' });
+      }
+      console.error('[gds] DELETE /blockers/:id/link/:taskId', err);
+      res.fail('unlink_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/npm-release/module.json

@@ -1,7 +1,7 @@
 {
   "key": "npm-release",
   "title": "npm release",
-  "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
+  "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622) — and the same line on a task's own page (task 1004301). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
   "coreVersion": "^1.19.0",
   "default": false,
   "author": "Cloud Bongos",
@@ -12,7 +12,13 @@
     "status": "core-maintained"
   },
   "contributes": {
-    "routes": ["work"]
+    "routes": [
+      "work",
+      "task-where"
+    ],
+    "uiSections": [
+      "task-where"
+    ]
   },
   "provides": [],
   "consumes": []

package/modules/npm-release/public/task-widget.js

@@ -0,0 +1,79 @@
+// modules/npm-release/public/task-widget.js — the line a task's own page shows about where
+// its code is (task 1004301): "In 1.19.1036 · running here · not released yet", or that a
+// task marked done never reached main — which is how a stranded ship becomes visible to the
+// person who shipped it.
+//
+// HOW IT GETS THERE. The core's task page names no module. It renders an empty slot
+// (#task-contrib) and announces each render as `otb:task-shown`; the server injects this file
+// just before task.js because the module declares a uiSection and ships task-widget.js
+// (src/module-loader/loader.js hallWidgetScripts, file: 'task-widget.js'). Module off: this
+// file is never injected, its asset 404s, and the slot stays empty.
+//
+// THE PAGE KNOWS NOTHING (deploy.js's rule, kept). The stage and version are the server's
+// reading; a partial reading says so; any failure draws no line rather than a wrong one.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const client = window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const DONE = ['completed', 'confirmed', 'shipped'];
+
+  // One reading per task per page load: the page re-renders on every action, and each
+  // render re-announces, but where the code is does not change between clicks. Bounded —
+  // a page shows one task, and the overlay can walk to a few more; nothing needs more than
+  // the last handful.
+  const cache = new Map();
+  const CACHE_MAX = 8;
+
+  // The line for each stage, in the deploy page's own words (its stage names), shortened to
+  // read as one sentence under a task's lifecycle rail.
+  const REST = {
+    unversioned: () => 'Merged, waiting for the next published version.',
+    not_live: (w) => `published, not running here yet${w.offered ? ' · already offered to other projects' : ''}.`,
+    live_unreleased: () => 'running here · not released to other projects yet.',
+    released: (w) => `${w.live ? 'running here · ' : ''}released to other projects.`,
+    // Said with the reason a builder would recognise, the way "Done, but not merged" is: this
+    // is most often work that changed no code, and only sometimes a merge that lost its name.
+    no_version: () => 'Shipped, though no published version lists it — usually a change that needed no code, like a scope edit or a check, and now and then a merge whose note did not name this task.',
+  };
+
+  function lineHtml(w) {
+    if (w.stage === 'not_merged') {
+      return '<p class="rec-meta nr-where nr-where--stranded"><b>Done, but not merged.</b> The ledger marks this task done, and its code is not on main yet — a ship that has not landed.</p>';
+    }
+    const rest = REST[w.stage];
+    if (!rest) return '';
+    const lead = w.version ? `In <b>${esc(w.version)}</b> · ` : '';
+    const partial = w.partial ? ' (a partial reading: the registry or the release notes could not be read)' : '';
+    return `<p class="rec-meta nr-where">${lead}${esc(rest(w) + partial)}</p>`;
+  }
+
+  async function reading(id) {
+    if (cache.has(id)) return cache.get(id);
+    const p = (async () => {
+      if (!client) return null;
+      const res = await client.request('GET', `${API}/npm-release/task/${encodeURIComponent(id)}`);
+      return res && res.status === 200 && res.data ? res.data : null;
+    })().catch(() => null);
+    cache.set(id, p);
+    while (cache.size > CACHE_MAX) cache.delete(cache.keys().next().value);
+    return p;
+  }
+
+  async function show(detail) {
+    if (!detail || !/^\d{1,12}$/.test(String(detail.id || ''))) return;
+    if (!DONE.includes(detail.status)) return;           // nothing to place until it is done
+    const w = await reading(String(detail.id));
+    // The page may have re-rendered while the read was in flight: write into the slot that
+    // exists NOW, and only for the task it is still showing.
+    const slot = document.getElementById('task-contrib');
+    const shown = window.OTBTaskShown;
+    if (!slot || !w || (shown && String(shown.id) !== String(detail.id))) return;
+    slot.innerHTML = lineHtml(w);
+  }
+
+  document.addEventListener('otb:task-shown', (e) => { show(e && e.detail); });
+  if (window.OTBTaskShown) show(window.OTBTaskShown);
+})();

package/modules/npm-release/routes/task-where.js

@@ -0,0 +1,48 @@
+'use strict';
+
+// modules/npm-release/routes/task-where.js — GET /npm-release/task/:id, the one line a
+// task's own page shows about where its code is (task 1004301): which version carries it,
+// whether this hall runs that version, whether it is released — or that a task marked done
+// never reached main. See readTaskWhere in ../work.js for the reading.
+//
+// ANY SIGNED-IN BUILDER, NOT THE DEPLOY PAGE'S ATOM. Every builder can open a task page, so
+// the question the task asked was what this line may show them. It shows nothing that is
+// not already public: the version naming the task is in the package's own release notes on
+// npm, the core this hall runs is what the public GET /version reports, and "released" is
+// the registry's `latest` label. The deploy page stays on `core.pin.move` for what it adds
+// beyond that — the ledger of upgrades, the door. requireBuilder rather than nothing, like
+// the task page's own read, so the line is never a signed-out probe.
+//
+// READ-ONLY.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { readTaskWhere } = require('../work');
+
+const log = api.logger('npm-release');
+
+module.exports = function buildNpmReleaseTaskWhereRouter({ read = readTaskWhere } = {}) {
+  const router = express.Router();
+
+  router.get(
+    '/npm-release/task/:id',
+    api.requireBuilder,
+    async (req, res) => {
+      const id = String((req.params && req.params.id) || '');
+      if (!/^\d{1,12}$/.test(id)) {
+        res.status(400).json({ error: { code: 'bad_task_id', message: 'A task id is a number.' } });
+        return;
+      }
+      try {
+        const where = await read({ pool: api.pool, id });
+        if (!where) { res.status(404).json({ error: { code: 'task_not_found', message: `No task ${id}.` } }); return; }
+        res.json(where);
+      } catch (e) {
+        log.error(`npm-release task-where read failed: ${e && e.message}`);
+        res.status(500).json({ error: { code: 'task_where_failed', message: 'Could not read where this task\'s code is right now.' } });
+      }
+    },
+  );
+
+  return router;
+};

package/modules/npm-release/work.js

@@ -57,9 +57,16 @@ function configuredPackage(env = process.env) {
   return v || CORE_PACKAGE;
 }
 
+// READ ONCE PER PROCESS. The file ships inside the installed package, so it cannot change
+// while this process runs — an upgrade replaces the package AND restarts the server. The
+// deploy page's reading reached it rarely; a task's own page (task 1004301) reaches it on
+// every view by every builder, and a synchronous disk read has no business on that path.
+let installedNotesMemo;
 function readInstalledNotes() {
-  try { return JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
-  catch { return null; }
+  if (installedNotesMemo !== undefined) return installedNotesMemo;
+  try { installedNotesMemo = JSON.parse(fs.readFileSync(INSTALLED_NOTES, 'utf8')); }
+  catch { installedNotesMemo = null; }
+  return installedNotesMemo;
 }
 
 function boundText(text) {
@@ -194,12 +201,9 @@ function clampInt(v, dflt, max) {
  * `now`, `store` and `installedNotes` are the seams tests drive; `live` defaults to this
  * process's own core version when the package is the core.
  */
-async function readWork({
-  pool, pkg = configuredPackage(), live, days, before, limit,
-  installedNotes = readInstalledNotes, get, now, store,
-} = {}) {
-  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
-  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+// What versions exist and what each carried — the half of the reading both the deploy page
+// and a task's own page need (task 1004301 split it out of readWork unchanged).
+async function readVersions({ pkg, live, installedNotes, get, now, store }) {
   const running = live !== undefined ? live : (pkg === CORE_PACKAGE ? api.CORE_VERSION : null);
   const liveVersion = VERSION_RE.test(String(running || '')) ? running : null;
 
@@ -225,6 +229,17 @@ async function readWork({
   const coversTo = versions.length ? versions[versions.length - 1].version : null;
   const published = registry.ok ? registry.published : {};
   const released = registry.ok ? registry.latest : null;
+  return { liveVersion, registry, versions, source, notesError, coversTo, published, released };
+}
+
+async function readWork({
+  pool, pkg = configuredPackage(), live, days, before, limit,
+  installedNotes = readInstalledNotes, get, now, store,
+} = {}) {
+  const windowDays = clampInt(days, DEFAULT_DAYS, MAX_DAYS);
+  const pageLimit = clampInt(limit, DEFAULT_LIMIT, MAX_LIMIT);
+  const { liveVersion, registry, versions, source, notesError, coversTo, published, released } =
+    await readVersions({ pkg, live, installedNotes, get, now, store });
 
   const tasks = await recentTasks(pool, windowDays);
   const stages = placeTasks({ tasks, versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
@@ -255,4 +270,50 @@ async function readWork({
   };
 }
 
-module.exports = { readWork };
+/**
+ * Where ONE task's code is (task 1004301) — the line its own page shows: the same
+ * placement the deploy page's list makes, for one task and without the 14-day window.
+ *
+ * Returns null for an id that is not a task. For a task not yet declared done, `stage` is
+ * null: there is no code to place. Otherwise `stage` is one of the deploy page's six, with
+ * the version that carries it when there is one.
+ *
+ * WHAT IT DISCLOSES, because every builder can open a task page: the version that names the
+ * task (the package's own release notes, published on npm), whether that version is the one
+ * this hall runs (GET /version already says which core runs), and whether it is released
+ * (the registry's `latest` label). Nothing here is not already public, which is why its
+ * route asks only for a signed-in builder — unlike the deploy page, whose ledger view and
+ * upgrade door are the owner's.
+ */
+async function readTaskWhere({ pool, id, pkg = configuredPackage(), live, installedNotes = readInstalledNotes, get, now, store } = {}) {
+  const taskId = String(id == null ? '' : id);
+  if (!/^\d{1,12}$/.test(taskId)) return null;
+  const { rows } = await pool.query(
+    `SELECT id, status, value_summary, COALESCE(shipped_at, updated_at) AS at FROM tasks WHERE id = $1::bigint`,
+    [taskId],
+  );
+  if (!rows.length) return null;
+  const r = rows[0];
+  const task = { id: String(r.id), status: r.status, summary: r.value_summary || null, at: r.at instanceof Date ? r.at.toISOString() : r.at };
+  const base = { task_id: task.id, package: pkg, status: task.status };
+  if (!['completed', 'confirmed', 'shipped'].includes(task.status)) return { ...base, stage: null };
+
+  const { liveVersion, registry, versions, notesError, coversTo, published, released } =
+    await readVersions({ pkg, live, installedNotes, get, now, store });
+  const stages = placeTasks({ tasks: [task], versions, live: liveVersion, released, coveredAt: coversTo ? published[coversTo] || null : null });
+  const stage = Object.keys(stages).find((k) => stages[k].length) || null;
+  const row = stage ? stages[stage][0] : {};
+  return {
+    ...base,
+    stage,
+    version: row.version || null,
+    offered: !!row.offered,
+    live: liveVersion,
+    released,
+    // A partial reading is said, not hidden: without the notes a shipped task reads as "in no
+    // version", which would be a claim the page cannot back.
+    partial: !registry.ok || !!notesError,
+  };
+}
+
+module.exports = { readWork, readTaskWhere };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1042",
+  "version": "1.19.1044",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1042",
+      "version": "1.19.1044",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1042",
+  "version": "1.19.1044",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",