@bongos/core 1.19.1042 → 1.19.1044

package/release-notes.json

@@ -7553,5 +7553,17 @@
       "id": "1001433",
       "text": "The nightly security check of the main code line no longer trusts the name typed on each change, which anyone can fake. It now checks that every change to a sensitive file carries the server's own sign-off from a senior builde"
     }
+  ],
+  "1.19.1043": [
+    {
+      "id": "1004301",
+      "text": "A task's own page now says where its code is — which version carries it, whether it is running on Bongos, whether it is released — and says plainly when a task marked done never actually landed."
+    }
+  ],
+  "1.19.1044": [
+    {
+      "id": "1003518",
+      "text": "A blocker that was linked to the wrong task — a duplicate, or a mistake — can now be unlinked, and the task goes back to being claimable if nothing else was holding it. Before this the only way out was to mark the blocker reso"
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:299',
+    at: 'src/module-loader/loader.js:309',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/seam-wiring-guard.js

@@ -95,11 +95,13 @@ const SEAM_CONSUMERS = {
     artifact: (dir, entry) => path.join(dir, 'rooms', `${entry}.js`),
   },
   uiSections: {
-    // Per-MODULE, not per-entry: hallWidgetScripts looks for one hall-widget.js
-    // however many sections the module names.
+    // Per-MODULE, not per-entry: hallWidgetScripts looks for one widget file per page
+    // however many sections the module names — hall-widget.js for the index, and since
+    // task 1004301 task-widget.js for a task's page. Either one wires the declaration.
     consumer: 'src/module-loader/loader.js hallWidgetScripts',
     kind: 'file',
     artifact: (dir) => path.join(dir, 'public', 'hall-widget.js'),
+    alternates: (dir) => [path.join(dir, 'public', 'task-widget.js')],
   },
   skills: {
     // moduleSkillSources resolves a declared name against the module's OWN tree or

package/scripts/hall-preview/server.js

@@ -77,7 +77,8 @@ let express;
 try { express = require(path.join(ROOT, 'node_modules', 'express')); }
 catch (_) { express = require('express'); }
 const { buildStampedHtml } = require(path.join(ROOT, 'src', 'asset-version.js'));
-const { injectBrandingGlobal, mountInternalSurfaces } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
+const { injectBrandingGlobal, mountInternalSurfaces, injectModuleHallWidgets } = require(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'));
+const { hallWidgetScripts } = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
 const { clientModules } = require(path.join(ROOT, 'src', 'modules.js'));
 const { overrideKey, resolveLiveIdentity } = require('./live-identity');
 
@@ -128,6 +129,9 @@ const FIXTURE_FALLBACKS = [
   // without it /deploy?project=… only ever rendered its "could not read" state, which
   // is the trap this directory's README calls out by name.
   [/^provisioning\/instances\/\d+\/core-upgrade$/, 'provisioning__instances__core-upgrade'],
+  // the npm-release module's line on a task's page (task 1004301): one reading serves any
+  // id, as the core-upgrade preview above does — the page shows one task.
+  [/^npm-release\/task\/\d+$/, 'npm-release__task'],
 ];
 
 // A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request
@@ -283,6 +287,15 @@ for (const key of MODULES_OFF) {
 for (const key of MODULES_ON) {
   (mods.enabled = mods.enabled || {})[key] = true;
 }
+// Module page widgets, injected at boot exactly as serve-internal.js does for prod: the
+// hall index's hall-widget.js and a task page's task-widget.js (task 1004301), for the
+// modules THIS harness runs with. Without it a module's line on a page could never be
+// previewed — the page would only ever render its empty slot.
+{
+  const isOn = (k) => !!(mods.enabled && mods.enabled[k]);
+  if (stamped['index.html']) stamped['index.html'] = injectModuleHallWidgets(stamped['index.html'], hallWidgetScripts({ isEnabled: isOn }));
+  if (stamped['task.html']) stamped['task.html'] = injectModuleHallWidgets(stamped['task.html'], hallWidgetScripts({ isEnabled: isOn, file: 'task-widget.js' }), 'task');
+}
 
 function sendPage(res, name) {
   const html = stamped[name];

package/src/bongos/serve-internal.js

@@ -443,14 +443,17 @@ function clientBundleScriptTag() {
 // module's widget is never injected (it vanishes); contributeHallWidget is the second
 // gate (it no-ops a widget whose module is off). `scripts` is the loader projection
 // [{ key, src }]; default reads the live enabled set. Pure + exported for the test.
-function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled })) {
+function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled }), consumer = 'builders') {
   if (!Array.isArray(scripts) || scripts.length === 0) return html;
   const tags = scripts
     .map((s) => `<script src="${s.src}" defer></script>`)
     .join('');
-  // Anchor on builders.js's <script> regardless of its ?v= stamp so the module
-  // widgets always land immediately before the consumer that mounts them.
-  const anchor = html.match(/<script src="\/builders\/builders\.js[^"]*"[^>]*><\/script>/);
+  // Anchor on the consuming page script's <script> (builders.js on the index, task.js on
+  // a task's page — task 1004301) regardless of its ?v= stamp, so the module widgets
+  // always land immediately before the consumer: both are `defer`, so they run in
+  // document order, and a widget's listener exists before the page first announces.
+  const name = /^[a-z-]+$/.test(consumer) ? consumer : 'builders';
+  const anchor = html.match(new RegExp(`<script src="\\/builders\\/${name}\\.js[^"]*"[^>]*><\\/script>`));
   if (anchor) return html.replace(anchor[0], tags + anchor[0]);
   return html.includes('</body>') ? html.replace('</body>', `${tags}</body>`) : html + tags;
 }
@@ -1070,6 +1073,17 @@ function mountInternalSurfaces(app) {
   if (buildersHtml['index.html']) {
     buildersHtml['index.html'] = injectModuleHallWidgets(buildersHtml['index.html']);
   }
+  // task 1004301: the same seam for a task's own page. A module that ships
+  // public/task-widget.js is loaded just before task.js, and fills the slot task.js
+  // renders and announces (`otb:task-shown`). The page names no module; with none
+  // enabled, nothing is injected and the slot stays empty.
+  if (buildersHtml['task.html']) {
+    buildersHtml['task.html'] = injectModuleHallWidgets(
+      buildersHtml['task.html'],
+      hallWidgetScripts({ isEnabled: isModuleEnabled, file: 'task-widget.js' }),
+      'task',
+    );
+  }
 
   // Serve enabled modules' browser assets at /modules/<key>/public/* — the URL the
   // loader's hallWidgetScripts projection points at. Mounted BEFORE the /builders

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1042'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1044'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/loader.js

@@ -213,15 +213,25 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
 // never injected), and contributeHallWidget itself no-ops a stale widget whose module
 // is off. No-op (empty list) until a module ships a hall widget — same SAFE-BY-
 // CONSTRUCTION posture as every other seam here. Returns [{ key, src }].
-function hallWidgetScripts({ isEnabled } = {}, opts) {
+//
+// ONE SEAM, ONE FILE PER PAGE (task 1004301). `file` names which page's widget is being
+// asked for: hall-widget.js for the hall index (the default, and the only caller until
+// then), task-widget.js for a task's own page. Same declaration (uiSections), same
+// enabled-only asset mount, same "a disabled module simply is not there" — so a module
+// adds a line to the task page without the page's own code ever naming it. The name is
+// matched against PAGE_WIDGET_FILES rather than trusted, so no caller can turn this into
+// a way to serve an arbitrary file.
+const PAGE_WIDGET_FILES = Object.freeze(['hall-widget.js', 'task-widget.js']);
+function hallWidgetScripts({ isEnabled, file = 'hall-widget.js' } = {}, opts) {
+  if (!PAGE_WIDGET_FILES.includes(file)) return [];
   const out = [];
   for (const { key, dir, manifest } of discovered(opts).loaded) {
     if (typeof isEnabled === 'function' && !isEnabled(key)) continue;
     const sections = (manifest.contributes && manifest.contributes.uiSections) || [];
     if (sections.length === 0) continue;
-    const scriptPath = path.join(dir, 'public', 'hall-widget.js');
+    const scriptPath = path.join(dir, 'public', file);
     if (!fs.existsSync(scriptPath)) continue; // declarative-only uiSections (e.g. status-page section)
-    out.push({ key, src: `/modules/${key}/public/hall-widget.js` });
+    out.push({ key, src: `/modules/${key}/public/${file}` });
   }
   return out;
 }

package/tests/blocker_unlink.mjs

@@ -0,0 +1,251 @@
+// tests/blocker_unlink.mjs
+//
+// Task 1003518 — a blocker can be UNLINKED from a task. Linking is one-way and
+// Metic+, and post-core_223 a task is released only when its LAST open blocker
+// resolves, so a wrong link (wrong task id, a duplicate filed twice, a blocker
+// later understood to be irrelevant) was permanent: the only escape was to
+// resolve a blocker that was never real, putting a falsehood in the ledger.
+//
+// TWO HALVES, mirroring tests/blocker_resolve_guard.mjs:
+//   1. the JS is an OBSERVER — it deletes and reads back, it never promotes;
+//   2. the promotion itself is core_256's trigger, pinned as SQL TEXT so a
+//      later edit cannot quietly drop the guard or "simplify" it into a bug.
+//
+// The JS half is behavioural, not shape assertions. The module-level `pool` is
+// replaced through require.cache BEFORE blockers.js loads, so the default
+// (zero-injection) path is the one under test — the shape a `deps.pool || pool`
+// shadowing bug would break while a harness that always injects stayed green.
+//
+// Run:  node tests/blocker_unlink.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const require = createRequire(import.meta.url);
+const { test, summary } = makeRunner();
+
+// -- the fake pool, installed as the module's OWN pool ----------------------
+
+let current = null;   // the pool the stubbed module-api hands out this test
+let releases = 0;     // how many times client.release() was called
+
+const apiPath = require.resolve('../src/module-api.js');
+require.cache[apiPath] = {
+  id: apiPath,
+  filename: apiPath,
+  loaded: true,
+  exports: { pool: { connect: (...a) => current.connect(...a) } },
+};
+
+const blockers = require('../modules/ideas/blockers.js');
+
+// before/after: the task's status either side of the DELETE (the trigger is what
+// changes it in production, so the fake simply reports what it would have done).
+// deleted: rows the DELETE returns (0 = there was no such link).
+// failOn: a substring; the first matching statement throws.
+function scenario({ before = 'blocked', after = 'ready', deleted = 1, failOn = null } = {}) {
+  let seenDelete = false;
+  const pool = makeSqlAwareClient((sql) => {
+    if (failOn && sql.includes(failOn)) throw new Error('boom');
+    if (/^DELETE FROM task_blockers/.test(sql)) {
+      seenDelete = true;
+      return { rows: Array.from({ length: deleted }, () => ({ task_id: 7 })) };
+    }
+    if (/^SELECT status FROM tasks/.test(sql)) {
+      return { rows: [{ status: seenDelete ? after : before }] };
+    }
+    return { rows: [] };
+  });
+  const realRelease = pool._client.release.bind(pool._client);
+  pool._client.release = () => { releases += 1; realRelease(); };
+  current = pool;
+  releases = 0;
+  return pool;
+}
+
+const sqlOf = (pool) => pool.queries.map((q) => String(q.sql).replace(/\s+/g, ' ').trim());
+const unlink = (opts) => blockers.unlinkBlockerFromTask({ blockerId: 93, taskId: 7 }, opts);
+
+// == 1. the JS observes =====================================================
+
+await test('the link row is deleted, keyed on BOTH ids', async () => {
+  const pool = scenario();
+  await unlink();
+  const del = pool.queries.find((q) => /DELETE FROM task_blockers/.test(q.sql));
+  assert.ok(del, 'no DELETE was issued');
+  // Order matters: the SQL is (task_id, blocker_id), so a swap deletes a
+  // different edge — or silently none.
+  assert.deepEqual(del.params, [7, 93]);
+});
+
+await test('the JS never promotes — that is core_256s job', async () => {
+  // The same assertion blocker_resolve_guard.mjs makes about the resolve path,
+  // restated for unlink so the next person to "just fix it here" trips a test.
+  const src = read('modules', 'ideas', 'blockers.js');
+  assert.doesNotMatch(src, /UPDATE\s+tasks[\s\S]{0,200}?status\s*=\s*'ready'/);
+});
+
+await test('the whole unlink is one transaction', async () => {
+  const pool = scenario();
+  await unlink();
+  const s = sqlOf(pool);
+  assert.equal(s[0], 'BEGIN');
+  assert.equal(s[s.length - 1], 'COMMIT');
+});
+
+await test('the before-status is read FOR UPDATE so the read-back cannot be raced', async () => {
+  const pool = scenario();
+  await unlink();
+  const s = sqlOf(pool);
+  const first = s.find((q) => q.startsWith('SELECT status FROM tasks'));
+  assert.match(first, /FOR UPDATE/);
+  // …and it is read BEFORE the delete, or "did this unlink move it?" is unanswerable.
+  assert.ok(s.indexOf(first) < s.findIndex((q) => q.startsWith('DELETE FROM task_blockers')));
+});
+
+await test('released:true when the task went blocked -> ready', async () => {
+  scenario({ before: 'blocked', after: 'ready' });
+  assert.deepEqual(await unlink(), { unlinked: true, released: true });
+});
+
+await test('released:false while another blocker is still open', async () => {
+  // The trigger's NOT EXISTS fails, so the task stays blocked. The unlink still
+  // happened — but saying released:true here is the task-1002559 lie.
+  scenario({ before: 'blocked', after: 'blocked' });
+  assert.deepEqual(await unlink(), { unlinked: true, released: false });
+});
+
+await test('released:false when the task was never blocked in the first place', async () => {
+  // A link can land on a task that LINK_BLOCKABLE_STATUSES never parks (active,
+  // backlog, shipped). Reporting "released" for one of those would claim a
+  // promotion that never happened — and would be exactly what a naive
+  // "is it ready now?" read-back returns.
+  scenario({ before: 'active', after: 'active' });
+  assert.deepEqual(await unlink(), { unlinked: true, released: false });
+});
+
+await test('released:false for a task that was ALREADY ready before the unlink', async () => {
+  // THE DISCRIMINATING CASE. A legacy blocker_ref link, or one that landed while
+  // the task was not blockable, leaves a 'ready' task carrying a link. Removing
+  // it changes nothing — but a naive "is it ready NOW?" read-back reports a
+  // release that never happened. Only comparing against the BEFORE status can
+  // tell the two apart, which is why that status is read at all.
+  scenario({ before: 'ready', after: 'ready' });
+  assert.deepEqual(await unlink(), { unlinked: true, released: false });
+});
+
+await test('a link that is not there refuses with LINK_NOT_FOUND and rolls back', async () => {
+  const pool = scenario({ deleted: 0 });
+  await assert.rejects(() => unlink(), (e) => e.code === 'LINK_NOT_FOUND');
+  const s = sqlOf(pool);
+  assert.ok(s.includes('ROLLBACK'), 'must roll back');
+  assert.ok(!s.includes('COMMIT'), 'must not commit');
+});
+
+await test('an unexpected failure rolls back exactly once', async () => {
+  const pool = scenario({ failOn: 'DELETE FROM task_blockers' });
+  await assert.rejects(() => unlink());
+  const s = sqlOf(pool);
+  assert.equal(s.filter((q) => q === 'ROLLBACK').length, 1);
+  assert.ok(!s.includes('COMMIT'));
+});
+
+await test('the client is returned to the pool on EVERY path', async () => {
+  scenario();
+  await unlink();
+  assert.equal(releases, 1, 'success path');
+
+  scenario({ deleted: 0 });
+  await assert.rejects(() => unlink());
+  assert.equal(releases, 1, 'refusal path');
+
+  scenario({ failOn: 'DELETE FROM task_blockers' });
+  await assert.rejects(() => unlink());
+  assert.equal(releases, 1, 'error path');
+});
+
+await test('an injected pool overrides the module-level one', async () => {
+  scenario({ before: 'active', after: 'active' });   // module-level: would say false
+  let sawDelete = false;
+  const other = makeSqlAwareClient((sql) => {
+    if (/^DELETE FROM task_blockers/.test(sql)) { sawDelete = true; return { rows: [{ task_id: 7 }] }; }
+    if (/^SELECT status FROM tasks/.test(sql)) return { rows: [{ status: sawDelete ? 'ready' : 'blocked' }] };
+    return { rows: [] };
+  });
+  assert.equal((await unlink({ pool: other })).released, true, 'the injected pool must be the one used');
+  assert.equal(current.queries.length, 0, 'the module-level pool saw none');
+});
+
+// == 2. core_256 — the trigger that actually releases =======================
+
+const MIG = 'core_256_blocker_unlink_releases_task.sql';
+const mig = read('migrations', MIG);
+const migN = mig.replace(/\s+/g, ' ');
+// Comments carry the rationale; strip them when asserting on the executable
+// body, so a claim in prose can never stand in for the real SQL.
+const body = mig.replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+await test('256 installs an AFTER DELETE row trigger on task_blockers', () => {
+  assert.match(body, /CREATE OR REPLACE FUNCTION trg_release_task_on_blocker_unlink\(\)/);
+  assert.match(body, /AFTER DELETE ON task_blockers/);
+  assert.match(body, /FOR EACH ROW/);
+});
+
+await test('the release targets ONLY a blocked task', () => {
+  assert.match(body, /UPDATE tasks SET status = 'ready'/);
+  assert.match(body, /WHERE id = OLD\.task_id/);
+  // Without this, an unlink would launder any task straight to 'ready' — past
+  // the metic+archon promote gate.
+  assert.match(body, /AND status = 'blocked'/);
+});
+
+await test("core_223's NOT EXISTS over the task's remaining open blockers is carried", () => {
+  assert.match(body, /AND NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id/);
+  assert.match(body, /WHERE tb\.task_id = OLD\.task_id/);
+  assert.match(body, /AND b\.status = 'open'/);
+});
+
+await test("and deliberately has NO `b.id <> …` exclusion — AFTER DELETE, the row is gone", () => {
+  // core_223 needs that clause because it runs BEFORE UPDATE, where the blocker
+  // being resolved still reads 'open' and would count itself, stalling forever.
+  // Here the link row is already deleted when the body runs, so the NOT EXISTS
+  // sees only what remains. Copying the clause across would be cargo-cult.
+  assert.doesNotMatch(body, /b\.id <>/);
+});
+
+await test('256 does NOT also gate on dependencies — that would strand the task', () => {
+  // The dep-promotion triggers (163) only flip backlog -> ready, so a task held
+  // in 'blocked' for unshipped deps would have no release path at all.
+  assert.doesNotMatch(body, /task_is_fully_unblocked/);
+});
+
+await test('256 is transactional and re-appliable', () => {
+  assert.match(migN, /BEGIN;.*COMMIT;/);
+  // A trigger has no CREATE OR REPLACE before PG 14, so the drop is what makes
+  // a re-run clean rather than a duplicate-object error.
+  assert.match(body, /DROP TRIGGER IF EXISTS release_task_on_blocker_unlink ON task_blockers/);
+  assert.doesNotMatch(body, /DROP FUNCTION/i);
+});
+
+await test('256 is the ONLY definition of the unlink-release function', () => {
+  const defs = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /FUNCTION trg_release_task_on_blocker_unlink/.test(read('migrations', f)))
+    .sort();
+  // migrate.sh applies in filename order, so a second, lower-numbered
+  // definition landing later would silently reinstate whatever it said.
+  assert.deepEqual(defs, [MIG]);
+});
+
+await test('unlinkBlockerFromTask is exported', () => {
+  assert.equal(typeof blockers.unlinkBlockerFromTask, 'function');
+});
+
+summary();

package/tests/hall_record_world.mjs

@@ -305,6 +305,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
   const requests = [];
   const writes = [];
   const toasts = [];
+  const dispatched = [];   // task 1004301: what the page announced (otb:task-shown)
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, disabled: false, _html: '',
@@ -326,6 +327,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     querySelectorAll() { return []; },
     createElement() { return makeEl(); },
     addEventListener(type, fn) { if (type === 'DOMContentLoaded') onReady = fn; },
+    dispatchEvent(e) { dispatched.push(e); return true; },
   };
   const client = {
     request: async (method, p, opts) => {
@@ -393,7 +395,8 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     confirm: () => true,
     navigator: { clipboard: { writeText: async () => {} } },
   };
-  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams };
+  class CustomEvent { constructor(type, init) { this.type = type; this.detail = init && init.detail; } }
+  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams, CustomEvent };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   if (withReader) vm.runInContext(MD_SRC, sandbox, { filename: 'md-reader.js' });
@@ -407,6 +410,8 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     requests,
     writes,
     toasts,
+    dispatched,
+    win: windowObj,
   };
 }
 
@@ -1052,3 +1057,20 @@ test("a move-to-goal refusal (403) surfaces the server's own sentence, verbatim"
     `the server's own sentence must reach the toast, not a generic fallback — got: ${r.toasts.join(' | ')}`);
   assert.equal(task.goal_id, 1000071, 'a refused PATCH must not move the task locally');
 });
+
+// task 1004301 — a slot a MODULE may fill, and the announcement that tells it which task.
+// The page names no module: it draws an empty #task-contrib under the lifecycle rail and
+// announces each render, and a module's task-widget.js does the rest.
+test('the task page renders an empty module slot and announces every render', async () => {
+  const r = renderTask({ ...BASE_TASK });
+  r.boot();
+  for (let i = 0; i < 5; i++) await settle();
+  const html = r.html();
+  assert.match(html, /<div class="tk-contrib" id="task-contrib" aria-live="polite"><\/div>/, 'an empty slot');
+  assert.ok(html.indexOf('id="task-contrib"') > html.indexOf('class="tk-rail"'), 'under the lifecycle rail');
+  const shown = r.dispatched.filter((e) => e.type === 'otb:task-shown');
+  assert.equal(shown.length, 1);
+  assert.deepEqual({ ...shown[0].detail }, { id: '1003305', status: 'shipped' }, 'only the id and the status travel');
+  assert.deepEqual({ ...r.win.OTBTaskShown }, { id: '1003305', status: 'shipped' }, 'left on window for a widget that loads late');
+  assert.doesNotMatch(read('task.js'), /npm-release/, 'the core page names no module');
+});

package/tests/module_loader.mjs

@@ -330,6 +330,33 @@ test('hallWidgetScripts: a module with no uiSections is never listed', () => {
   loader._reset();
 });
 
+// task 1004301 — the same seam, one file per page: task-widget.js for a task's own page.
+test('hallWidgetScripts: file task-widget.js lists the modules that ship one, and only those', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { uiSections: ['a'] } }), files: { 'public/task-widget.js': '// task line' } },
+    beta: { manifest: validManifest('beta', { contributes: { uiSections: ['b'] } }), files: { 'public/hall-widget.js': '// index only' } },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  assert.deepEqual(loader.hallWidgetScripts({ isEnabled: () => true, file: 'task-widget.js' }, opts),
+    [{ key: 'alpha', src: '/modules/alpha/public/task-widget.js' }]);
+  assert.deepEqual(loader.hallWidgetScripts({ isEnabled: () => true }, opts),
+    [{ key: 'beta', src: '/modules/beta/public/hall-widget.js' }], 'the default is still the index widget');
+  assert.deepEqual(loader.hallWidgetScripts({ isEnabled: (k) => k !== 'alpha', file: 'task-widget.js' }, opts), [], 'disabled: never listed');
+  loader._reset();
+});
+
+test('hallWidgetScripts: a file name outside the page allowlist lists nothing — it is not a file server', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { uiSections: ['a'] } }), files: { 'public/secrets.js': '//', 'public/task-widget.js': '//' } },
+  });
+  for (const file of ['secrets.js', '../module.json', 'public/task-widget.js', 'TASK-WIDGET.JS']) {
+    assert.deepEqual(loader.hallWidgetScripts({ isEnabled: () => true, file }, { roots: [root], core: '1.0.0' }), [], file);
+  }
+  loader._reset();
+});
+
 // --- moduleWebSurfaces: an enabled module's host-routed static surface resolves,
 //     a disabled one vanishes (BV1.R84 / task 1635, ADR 0093 §1 / 02-module-map §6) ---