@bongos/core 1.19.540 → 1.19.541

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.540",
-  "core_contract": "1.19.540",
-  "source_commit": "5fc647cb0f3cec892a9ecf58528bbd0158250e44",
+  "core_version": "1.19.541",
+  "core_contract": "1.19.541",
+  "source_commit": "0f2805ada935b696e72031342663a4193c5c802d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T16:31:49.656Z",
+  "built_at": "2026-09-04T16:58:05.057Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 441,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1999,
+    "functional_verbatim": 2000,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2464,
-  "tree_sha256": "36d8ec4b4166ff3dedaed13accf062736759569e3ef0dbaf8655662c4b896a9b",
+  "file_count": 2465,
+  "tree_sha256": "281153bdf107ee76f439badeb13dc3cbd70393ce4b70d52084e542a9581684f8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -27,7 +27,7 @@
     {
       "path": ".claude/skills/blocker-solve/SKILL.md",
       "mode": "0000644",
-      "sha256": "f9a8cc82815777f88d8732cdf7d72a3076af4f4081943696de20bae12defb814"
+      "sha256": "90de8b32fb4dac69d6e5c781d78489c36c40f00c4b07f062c0650cff08052203"
     },
     {
       "path": ".claude/skills/builder-backup/SKILL.md",
@@ -2647,7 +2647,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8e3f784b21310cbe1b35bbbed75b512d9a1818810cf90eb303cc60008ae68253"
+      "sha256": "263a5d16f7cd22a3b6a193a4cff05994a8fcf7a0522b561ba802392c3328b4f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5237,7 +5237,7 @@
     {
       "path": "modules/ideas/blockers.js",
       "mode": "0000644",
-      "sha256": "73349f0209190305a61e2f4d771fa466c12be4f9034b4134b60a9e4a560e1c5a"
+      "sha256": "d3feb342ef22f8a3952c249c7d09a2fa1c9d01ac45f4306f4084e2572df5c203"
     },
     {
       "path": "modules/ideas/completeness.js",
@@ -7407,12 +7407,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2b42ac2bcb878baf1aa06fafc797c6f9b778eb989f46f1e1d53b46cf35b2124c"
+      "sha256": "d1edde947ae28592c6bb37d8a935cc2c2c9c9ca45c9064c1579c8128d313e5ae"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a461dae944c1fc1c49b88250e96d2b6a4eaff4b60a12e96b730f15b8b43bef2d"
+      "sha256": "1f416b6226afeec3bb285d65c4d2bede292e7ad63c04a5701c54d7c59324c634"
     },
     {
       "path": "public-docs/index.html",
@@ -9097,7 +9097,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e1b39ba5609d7066607c7a1d90ebbef58237deab27cbe74d1cacef7e55a76a33"
+      "sha256": "c9da65f8915d9cc8bb519797fb741a9644421066fbb97b29bb1d270fa874c1b4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9404,6 +9404,11 @@
       "mode": "0000644",
       "sha256": "445231e7fea9163e83ec0a76fce981415ed141760e34b165016a8039bba4da51"
     },
+    {
+      "path": "tests/blocker_detail_hydration.mjs",
+      "mode": "0000644",
+      "sha256": "fac81eb7827820e9e9ad03d4024d8fd9372f6a346a6931ac0a77692805ae2d5c"
+    },
     {
       "path": "tests/blocker_link.mjs",
       "mode": "0000644",

package/.claude/skills/blocker-solve/SKILL.md

@@ -41,7 +41,7 @@ Read the blocker fully, then enrich it:
 node scripts/gds/api.js GET /api/gds/blockers/<id>
 ```
 
-Fields: `title`, `body_md` (often already contains a numbered "Steps (owner): …" plan — lean on it), `source`, `source_ref`, `status`, plus `blocking_task_ids` from the list view (`GET /api/gds/blockers`). These linked tasks are exactly what will auto-promote when you resolve.
+Fields: `title`, `body_md` (often already contains a numbered "Steps (owner): …" plan — lean on it), `source`, `source_ref`, `status`, plus `blocking_task_ids` (task 1002459 — the detail route now hydrates the same array the list view returns). These linked tasks are exactly what will auto-promote when you resolve.
 
 - Read any linked task's notes (`GET /api/gds/tasks/<task-id>`) — the source task usually explains what "done" means.
 - Pull project knowledge so you're not re-deriving: `node scripts/gds/recall.js "<the blocker's topic>"` (add `--kind doc` for ADRs/recipes). This surfaces the ADR, recipe, or past session that already documents how to do this thing.

package/docs/module-api-changelog.md

@@ -1529,5 +1529,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.538 with no explicit bump. run 33892948885. (task 1002620)
   1.19.540 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.539 with no explicit bump. run 33895602533. (task 1002620)
+  1.19.541 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.540 with no explicit bump. run 33897974683. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/blockers.js

@@ -9,15 +9,20 @@
 
 const { pool } = require('../../src/module-api');
 
+// Shared by listOpenBlockers + getBlocker so the two reads can never drift
+// (task 1002459 — getBlocker used to omit this column entirely, so a
+// link-then-verify against the detail route read as a false negative).
+const BLOCKING_TASK_IDS_SQL = `COALESCE(
+              (SELECT array_agg(tb.task_id ORDER BY tb.task_id)
+                 FROM task_blockers tb WHERE tb.blocker_id = b.id),
+              ARRAY[]::bigint[]
+            ) AS blocking_task_ids`;
+
 async function listOpenBlockers() {
   const { rows } = await pool.query(
     `SELECT b.id, b.title, b.body_md, b.status, b.created_at,
             b.source, b.source_ref,
-            COALESCE(
-              (SELECT array_agg(tb.task_id ORDER BY tb.task_id)
-                 FROM task_blockers tb WHERE tb.blocker_id = b.id),
-              ARRAY[]::bigint[]
-            ) AS blocking_task_ids
+            ${BLOCKING_TASK_IDS_SQL}
        FROM blockers b
       WHERE b.status = 'open'
       ORDER BY b.id`
@@ -27,9 +32,10 @@ async function listOpenBlockers() {
 
 async function getBlocker(id) {
   const { rows } = await pool.query(
-    `SELECT id, title, body_md, status, created_at, resolved_at, resolved_by, resolution_note,
-            source, source_ref
-       FROM blockers WHERE id = $1`,
+    `SELECT b.id, b.title, b.body_md, b.status, b.created_at, b.resolved_at, b.resolved_by,
+            b.resolution_note, b.source, b.source_ref,
+            ${BLOCKING_TASK_IDS_SQL}
+       FROM blockers b WHERE b.id = $1`,
     [id]
   );
   return rows[0] || null;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.540",
+  "version": "1.19.541",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.540",
+      "version": "1.19.541",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.540",
+  "version": "1.19.541",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.540'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.541'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/blocker_detail_hydration.mjs

@@ -0,0 +1,128 @@
+// tests/blocker_detail_hydration.mjs
+//
+// task 1002459 — GET /blockers/:id was missing `blocking_task_ids`, the array
+// the list route (GET /blockers) already returns for the same row. A caller
+// doing the natural link-then-verify (link a task, then re-fetch the blocker
+// by id to confirm) read that as a false negative — the ids were never gone,
+// `getBlocker`'s SELECT just never asked for them.
+//
+// The fix hoists the array_agg fragment into one shared constant
+// (BLOCKING_TASK_IDS_SQL) so `listOpenBlockers` and `getBlocker` cannot drift
+// apart again the way they did here. This test pins that: both queries must
+// carry the identical fragment, and the detail route's SELECT must not add a
+// status filter the list route has (task_blockers rows persist after resolve,
+// so a resolved blocker's field reads as "tasks it WAS blocking" — a
+// deliberate widening, not a bug, per the task's decision note).
+//
+// DB-free: `modules/ideas/blockers.js` destructures `pool` off the doorway at
+// require time, so patching `pool.query` on that same object — BEFORE
+// requiring blockers.js — intercepts every query. No live Postgres needed.
+//
+// Run:  node tests/blocker_detail_hydration.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const api = require('../src/module-api.js');
+
+let queries = [];
+
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql: String(sql), params });
+  if (/FROM blockers b\s+WHERE b\.status = 'open'/.test(sql)) {
+    return {
+      rows: [
+        { id: '1000085', title: 'the open one', body_md: '', status: 'open',
+          created_at: new Date(), source: 'manual', source_ref: null,
+          blocking_task_ids: ['1001838', '1001839'] },
+      ],
+    };
+  }
+  if (/FROM blockers b WHERE b\.id = \$1/.test(sql)) {
+    const id = String(params[0]);
+    if (id === '1000085') {
+      return {
+        rows: [
+          { id: '1000085', title: 'the open one', body_md: '', status: 'open',
+            created_at: new Date(), resolved_at: null, resolved_by: null,
+            resolution_note: null, source: 'manual', source_ref: null,
+            blocking_task_ids: ['1001838', '1001839'] },
+        ],
+      };
+    }
+    if (id === '1000099') {
+      // A resolved blocker: task_blockers rows persist, so the field still
+      // reports the tasks it WAS blocking (see comment above).
+      return {
+        rows: [
+          { id: '1000099', title: 'the resolved one', body_md: '', status: 'resolved',
+            created_at: new Date(), resolved_at: new Date(), resolved_by: '41',
+            resolution_note: 'done', source: 'manual', source_ref: null,
+            blocking_task_ids: ['1002000'] },
+        ],
+      };
+    }
+    return { rows: [] };
+  }
+  throw new Error(`unexpected query: ${sql}`);
+};
+
+const blockers = require('../modules/ideas/blockers.js');
+
+let passed = 0;
+let failed = 0;
+
+async function test(name, fn) {
+  queries = [];
+  try {
+    await fn();
+    passed += 1;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed += 1;
+    console.log(`  FAIL  ${name}\n      ${err.message}`);
+  }
+}
+
+function blockingTaskIdsFragment(sql) {
+  const match = sql.match(/COALESCE\(\s*\(SELECT array_agg\(tb\.task_id[\s\S]*?blocking_task_ids/);
+  assert.ok(match, `query does not carry a blocking_task_ids projection:\n${sql}`);
+  return match[0].replace(/\s+/g, ' ').trim();
+}
+
+await test('listOpenBlockers and getBlocker project blocking_task_ids from the identical fragment', async () => {
+  await blockers.listOpenBlockers();
+  const listSql = queries[queries.length - 1].sql;
+
+  queries = [];
+  await blockers.getBlocker(1000085);
+  const detailSql = queries[queries.length - 1].sql;
+
+  assert.equal(blockingTaskIdsFragment(detailSql), blockingTaskIdsFragment(listSql));
+});
+
+await test('getBlocker returns blocking_task_ids on the row — the gap this task closes', async () => {
+  const row = await blockers.getBlocker(1000085);
+  assert.deepEqual(row.blocking_task_ids, ['1001838', '1001839']);
+});
+
+await test('getBlocker does not restrict by status — the list route is open-only, the detail route is not', async () => {
+  const detailSql = (await (async () => { await blockers.getBlocker(1000085); return queries[queries.length - 1].sql; })());
+  assert.ok(!/WHERE b\.status = 'open'/.test(detailSql), 'detail query must not gain the list route\'s open-only filter');
+});
+
+await test('a resolved blocker still reports the tasks it WAS blocking (task_blockers rows persist)', async () => {
+  const row = await blockers.getBlocker(1000099);
+  assert.equal(row.status, 'resolved');
+  assert.deepEqual(row.blocking_task_ids, ['1002000']);
+});
+
+await test('getBlocker still returns null for an id with no row', async () => {
+  const row = await blockers.getBlocker(999999);
+  assert.equal(row, null);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);