@bongos/core 1.19.827 → 1.19.829

package/modules/hall-ui/public/blockers-lib.js

@@ -0,0 +1,110 @@
+// blockers-lib.js — the ONE blocker-row renderer (task 1003455, goal 1000089).
+//
+// GET /blockers (modules/ideas/routes/blockers.js) had zero consumers — not the
+// hall, not status-ui — and the only blocker a builder could ever see was
+// GET /blockers/:id, reachable only by typing #/blocker/N into the address bar.
+// Owner decision 2026-08-30: BOTH surfaces, from ONE code path — the open-blocker
+// queue gets a real page (modules/hall-ui/public/blockers.js), and open blockers
+// also become line items in the existing Needs-attention inbox
+// (modules/hall-ui/public/goal-inbox.js), because hall-ui/CLAUDE.md's placement
+// rule says an action awaiting a human is an inbox line, never a new Home card.
+//
+// This file is the shared middle: the goals-lib.js / goalRenderFacts precedent —
+// ONE facts source that both callers render from their own DOM shape, so the two
+// surfaces cannot drift apart the way ~10 hand-rolled pagers did before the kit.
+// The two callers do not share a visual family (the inbox nests inside
+// .ginbox__item, the page's rows are the oversight family's .ov-row), so — unlike
+// goalRenderFacts, whose two callers share one family and one fixed class — the
+// class names are the caller's own, passed in `opts`; only the FACTS (title, the
+// filed date, the note, which tasks it blocks) are shared.
+//
+// Pure: no window.OTB, no DOM, no fetch — Node-require-safe like goals-lib.js /
+// hall-kit.js, so a test can run the real arithmetic instead of agreeing with a
+// copy of it.
+(function (root, factory) {
+  var mod = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = mod;
+  else root.OTBBlockersLib = mod;
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+
+  function fmtDate(iso) {
+    if (!iso) return '';
+    var d = new Date(iso);
+    if (isNaN(d.getTime())) return '';
+    return d.toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' });
+  }
+
+  // A blocker's body_md is the owner's own words, quoted the way goal-inbox.js's
+  // invitation/join rows already quote a note (the SAME convention, not a new
+  // one). It can run to a paragraph, and the row is a summary, so it is clipped —
+  // CSS line-clamp handles visual overflow on both surfaces, this just keeps one
+  // enormous blocker from making the row's own text node absurd.
+  function noteHtml(bodyMd, noteClass) {
+    var t = String(bodyMd || '').trim();
+    if (!t) return '';
+    var clipped = t.length > 240 ? t.slice(0, 239).replace(/\s+$/, '') + '…' : t;
+    return '<p class="' + esc(noteClass) + '">“' + esc(clipped) + '”</p>';
+  }
+
+  // `taskHref(id)` is the caller's own link builder (window.OTBTaskDetail.href on
+  // a live page) — kept OUT of this pure module the way hall-kit.js stays
+  // date-agnostic: the lib never learns what a task URL looks like.
+  function blockingLine(b, taskHref) {
+    var ids = Array.isArray(b.blocking_task_ids) ? b.blocking_task_ids : [];
+    if (!ids.length) return 'Blocking nothing yet';
+    var links = ids.map(function (id) {
+      var label = '#' + id;
+      return taskHref ? '<a href="' + esc(taskHref(id)) + '">' + esc(label) + '</a>' : esc(label);
+    }).join(', ');
+    var noun = ids.length === 1 ? 'task' : 'tasks';
+    return 'Blocking ' + ids.length + ' ' + noun + ': ' + links;
+  }
+
+  // blockerFacts(b, opts) — the shared render. `opts`:
+  //   titleClass  (default 'ov-row__title')
+  //   noteClass   (default 'ov-row__sub')
+  //   whenClass   (default 'ov-row__when')
+  //   blockerHref(id)  — the title's own link (both surfaces point at the SAME
+  //                      #/blocker/N overlay task-detail.js already renders —
+  //                      the "reachable only by typing the URL" bug this task
+  //                      fixes is exactly that overlay having no door INTO it).
+  //   taskHref(id)     — see blockingLine above.
+  // Returns { titleHtml, noteHtml, factsHtml } — fragments, not a wrapped row;
+  // each caller nests them in its OWN <li> (goal-inbox.js's .ginbox__item,
+  // blockers.js's .ov-row), the goalRenderFacts idiom.
+  function blockerFacts(b, opts) {
+    opts = opts || {};
+    var titleClass = opts.titleClass || 'ov-row__title';
+    var noteClass = opts.noteClass || 'ov-row__sub';
+    var whenClass = opts.whenClass || 'ov-row__when';
+    var blockerHref = opts.blockerHref || null;
+    var taskHref = opts.taskHref || null;
+
+    var titleText = esc(b.title || ('Blocker #' + b.id));
+    var titleHtml = blockerHref
+      ? '<a class="' + esc(titleClass) + '" href="' + esc(blockerHref(b.id)) + '">' + titleText + '</a>'
+      : '<span class="' + esc(titleClass) + '">' + titleText + '</span>';
+
+    // ONE fact line, `·`-joined — the watch.js convention (its box/report rows
+    // join multiple facts into a single .ov-row__when span the same way) rather
+    // than several sibling spans, which need a flex-gapped parent to space
+    // themselves and the attention-inbox context (.ginbox__sub) is not one.
+    var facts = 'Filed ' + esc(fmtDate(b.created_at)) + ' · ' + blockingLine(b, taskHref);
+    var factsHtml = '<span class="' + esc(whenClass) + '">' + facts + '</span>';
+
+    return {
+      titleHtml: titleHtml,
+      noteHtml: noteHtml(b.body_md, noteClass),
+      factsHtml: factsHtml,
+    };
+  }
+
+  return { esc: esc, fmtDate: fmtDate, blockingLine: blockingLine, blockerFacts: blockerFacts };
+}));

package/modules/hall-ui/public/blockers.html

@@ -0,0 +1,65 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Blockers — {{worldName}}</title>
+  <meta name="description" content="What is stuck on the owner right now: open blockers and the work they hold up.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <!-- task 1003455: the row shape (title + facts) is the oversight family's,
+       the same archetype collab/copy-desk/watch/gate already ride. -->
+  <link rel="stylesheet" href="/builders/oversight.css">
+</head>
+<body data-page="blockers" data-page-title="Blockers">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Blockers</h1>
+        <p class="page-head__sub" id="blockers-sub">Things stuck on the owner — a credential, a purchase, a product call only they can make. Resolving one un-sticks every task waiting on it automatically.</p>
+      </div>
+
+      <main id="hall-main">
+        <!-- task 1003455 (goal 1000089): the queue GET /blockers had no page for
+             — the only door in used to be typing #/blocker/N into the address
+             bar. This is the read half; filing/resolving/linking is task 1003456. -->
+        <section class="scroll" id="blockers-scroll" aria-labelledby="blockers-h">
+          <h2 id="blockers-h" class="scroll__h">Open blockers<span class="count-pill" id="blockers-count" hidden></span></h2>
+          <div id="blockers-body">
+            <p class="profile__placeholder">Loading…</p>
+          </div>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
+     chrome exists before the page script runs. -->
+<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
+<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
+     branding pack's currency label, loaded BEFORE blockers.js. -->
+<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
+<script src="/builders/brand-apply.js"></script>
+<script src="/builders/hall-kit.js"></script>
+<!-- task-detail.js still owns the #/blocker/N deep-link overlay every row's
+     title opens into — this page needs its link-builder (OTBTaskDetail.href)
+     for the "blocking N tasks" facts line, but not the overlay's own render. -->
+<script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
+<script src="/builders/blockers-lib.js"></script>
+<script src="/builders/blockers.js"></script>
+</body>
+</html>

package/modules/hall-ui/public/blockers.js

@@ -0,0 +1,88 @@
+// blockers.js — the Blockers page: the full open-blocker queue (task 1003455,
+// goal 1000089).
+//
+// GET /blockers (modules/ideas/routes/blockers.js) is PUBLIC and had ZERO hall
+// consumers before this task — the only blocker a builder could ever see was the
+// #/blocker/N overlay task-detail.js already renders, reachable only by typing
+// the id into the address bar. Owner decision 2026-08-30: BOTH surfaces, from
+// ONE code path — this page is the full queue (a long list has nowhere else to
+// live), and goal-inbox.js's attention-inbox slice is the capped summary. Both
+// render from blockers-lib.js's blockerFacts(), so the two cannot drift apart
+// the way ~10 hand-rolled pagers did before the kit (hall-ui/CLAUDE.md).
+//
+// Read-only: filing, resolving and linking a blocker to a task are task 1003456.
+// Deliberately UNGATED (tests/hall_page_gate_map.mjs) — its one data source is
+// public, the roster/drachmae precedent: a page must not be gated tighter than
+// the API it fronts.
+(function () {
+  'use strict';
+  var kit = window.OTBKit;
+  var lib = window.OTBBlockersLib;
+  var API = '/api/bongos';
+  var body = document.getElementById('blockers-body');
+  var countPill = document.getElementById('blockers-count');
+  var sub = document.getElementById('blockers-sub');
+
+  var taskHref = function (id) {
+    return window.OTBTaskDetail ? window.OTBTaskDetail.href(id) : ('/task/' + encodeURIComponent(id));
+  };
+  var blockerHref = function (id) { return '#/blocker/' + encodeURIComponent(id); };
+
+  var all = [];
+
+  function rowHtml(b) {
+    var facts = lib.blockerFacts(b, {
+      titleClass: 'ov-row__title',
+      noteClass: 'ov-row__sub',
+      whenClass: 'ov-row__when',
+      blockerHref: blockerHref,
+      taskHref: taskHref,
+    });
+    return '<li class="ov-row" data-id="' + lib.esc(String(b.id)) + '">'
+      + '<div class="ov-row__main">'
+      + facts.titleHtml
+      + facts.noteHtml
+      + '<div class="ov-row__facts">' + facts.factsHtml + '</div>'
+      + '</div>'
+      + '</li>';
+  }
+
+  var pager = kit.makePager('blockers', 'hall-blockers-per-page', { defaultPerPage: 25 });
+  var listEl = null;
+
+  function rerender() {
+    var slice = kit.paginate(all, pager);
+    listEl.innerHTML = slice.length
+      ? slice.map(rowHtml).join('')
+      : kit.emptyStateHtml('Nothing is stuck on the owner right now.');
+  }
+
+  function mountBlockers(rows) {
+    all = Array.isArray(rows) ? rows : [];
+    if (countPill) { countPill.textContent = String(all.length); countPill.hidden = all.length === 0; }
+    if (sub) {
+      sub.textContent = all.length
+        ? (all.length === 1 ? 'One thing' : all.length + ' things') + ' stuck on the owner — a credential, a '
+          + 'purchase, a product call only they can make. Resolving one un-sticks every task waiting on it automatically.'
+        : 'Nothing is stuck on the owner right now.';
+    }
+    body.innerHTML = '<ul class="ov-rows" id="blockers-list"></ul>' + kit.pagerBarHtml(pager.prefix, { label: 'blockers' });
+    listEl = document.getElementById('blockers-list');
+    kit.wirePager(pager, rerender);
+    rerender();
+  }
+
+  function notice(msg) {
+    body.innerHTML = '';
+    body.className = 'note';
+    body.textContent = msg;
+  }
+
+  fetch(API + '/blockers?limit=200', { headers: { Accept: 'application/json' } })
+    .then(function (r) {
+      if (!r.ok) throw new Error('http ' + r.status);
+      return r.json();
+    })
+    .then(function (data) { mountBlockers(data && data.blockers); })
+    .catch(function () { notice('Couldn’t load the blocker queue right now.'); });
+}());

package/modules/hall-ui/public/goal-inbox.js

@@ -384,6 +384,73 @@
       });
   }
 
+  // ---- open blockers (task 1003455, goal 1000089) ---------------------------
+  //
+  // GET /blockers is public and had ZERO hall consumers — the only blocker a
+  // builder could ever see was the #/blocker/N overlay task-detail.js already
+  // renders, reachable only by typing the id into the address bar. This slice
+  // + the /blockers page (blockers.js) are ONE code path: both render from
+  // blockers-lib.js's blockerFacts(), loaded before this file (index.html).
+  const MAX_BLOCKER_ROWS = 5;
+
+  function blockerRowHtml(b) {
+    const lib = window.OTBBlockersLib;
+    const facts = lib.blockerFacts(b, {
+      titleClass: 'ginbox__goal',
+      noteClass: 'ginbox__note',
+      whenClass: 'ginbox__sub',
+      // The SAME overlay task-detail.js has rendered since task 1003066's
+      // predecessor — this slice is what gives it its first door in.
+      blockerHref: (id) => `#/blocker/${encodeURIComponent(id)}`,
+      taskHref: (id) => (window.OTBTaskDetail ? window.OTBTaskDetail.href(id) : `/task/${encodeURIComponent(id)}`),
+    });
+    return `<li class="ginbox__item">
+        <div class="ginbox__body">
+          ${facts.titleHtml}
+          ${facts.factsHtml}
+          ${facts.noteHtml}
+        </div>
+      </li>`;
+  }
+
+  function renderBlockers(data) {
+    const box = host && host.querySelector('#attention-blockers');
+    if (!box) return;
+    const rows = (data && Array.isArray(data.blockers)) ? data.blockers : [];
+    if (!rows.length) {
+      box.innerHTML = '';
+      window.OTBAttention?.refresh();
+      return;
+    }
+    const total = (data && data.page && Number.isFinite(data.page.total)) ? data.page.total : rows.length;
+    const more = total > rows.length
+      ? `<p class="ginbox__pending">…${total - rows.length} more — <a href="/blockers">open the queue</a>.</p>`
+      : '';
+    box.innerHTML = '<h3 class="ginbox__sec-h">Stuck on the owner '
+      + `<span class="count-pill">${total}</span></h3>`
+      + `<ul class="ginbox">${rows.map(blockerRowHtml).join('')}</ul>${more}`;
+    window.OTBAttention?.refresh();
+  }
+
+  // task 1003448's "Home bounded reads" rule: ask the server for exactly the
+  // rows the card will show (limit=MAX_BLOCKER_ROWS) and read `page.total` back,
+  // rather than fetching every open blocker and slicing it client-side — the
+  // Next-up / triage-card bug this file's own CLAUDE.md names as the shape to
+  // avoid.
+  function loadBlockers() {
+    return getJSON(`${API}/blockers?limit=${MAX_BLOCKER_ROWS}`)
+      .then((data) => renderBlockers(data))
+      .catch((err) => {
+        const box = host && host.querySelector('#attention-blockers');
+        if (box) box.innerHTML = '';
+        window.OTBAttention?.refresh();
+        if (err.code !== 'auth-needed' && err.code !== 'not-found') {
+          console.warn('[hall] blockers feed unavailable — the "Stuck on the owner" section is empty '
+            + 'because the request failed, NOT because nothing is open:', err);
+        }
+      });
+  }
+
   // task 2169: this widget IS the "Needs your attention" card — ONE capped
   // summary hosting every actionable item class: goal invitations +
   // join-requests (this file) and ideas awaiting triage (builders.js renders
@@ -417,6 +484,12 @@
       // triage. Its rows carry the shared .ginbox__item class, so refresh()
       // counts them with no change to the selector below.
       '<div id="attention-nod"></div>' +
+      // task 1003455 (goal 1000089): open blockers — things stuck on the owner
+      // (modules/ideas/blockers.js). AFTER nod, BEFORE rot: like every slice
+      // above it, a blocker is genuinely waiting on a human, but unlike them it
+      // is project-wide rather than addressed to this viewer, so it sits with
+      // rot's standing-question tail rather than the personal asks at the top.
+      '<div id="attention-blockers"></div>' +
       // task 1003279 (goal 1000072): work going quiet — a goal or task untouched
       // past the project's rot timer, with the owner's four verbs on it. LAST in
       // the card on purpose: every slice above is somebody waiting on YOU right
@@ -426,6 +499,7 @@
     host.addEventListener('click', onClick);
     load();
     loadNodQueue();
+    loadBlockers();
     loadRot();
     // task 1002802 (P06): the profile slice lives in its own file (builders.js is
     // over the size budget); this card owns its div, so it boots it here.

package/modules/hall-ui/public/index.html

@@ -121,6 +121,10 @@
 <script src="/builders/hall-widgets.js?v=2026-06-27-r75" defer></script>
 <!-- BV1.R78 (task 1694): the Goals widget registers into the same registry. -->
 <script src="/builders/goals.js?v=2026-07-01-goals" defer></script>
+<!-- task 1003455: the shared blocker-row renderer (window.OTBBlockersLib), read by
+     both goal-inbox.js's attention-inbox slice below and the /blockers page.
+     Loaded BEFORE goal-inbox.js, which calls it while rendering. -->
+<script src="/builders/blockers-lib.js" defer></script>
 <!-- ADR 0112 (task 1954): the home-page goal-membership inbox — invitations to
      accept + join-requests to approve. Self-registers; hidden when empty. -->
 <script src="/builders/goal-inbox.js?v=2026-07-10-goal-inbox" defer></script>

package/modules/hall-ui/public/shell.js

@@ -165,6 +165,15 @@
       // active-nav detection (#nav-work), the 'work' gate case, and the server
       // page-gate all keep working — only the visible label and order change.
       { id: 'work', label: 'Tasks', icon: 'work', href: '/work', gate: 'signed' },
+      // task 1003455 (goal 1000089): the open-blocker queue — what's stuck on the
+      // owner. Lives with the project's own state (Roadmap/Goals/Tasks), not You
+      // or Community, because its subject is the project, not a person. Its one
+      // data source (GET /blockers) is deliberately public, like Roadmap's — but
+      // the NAV FLAG stays 'signed' on the roster/drachmae precedent: an ungated
+      // page can still gate cosmetically wider in the sidebar than the API it
+      // fronts, showing the link to signed-in builders while a stranger who
+      // already has the URL can still open it.
+      { id: 'blockers', label: 'Blockers', icon: 'admin', href: '/blockers', gate: 'signed' },
       // task 1003744 (goal 1000111): the Board Room lives HERE, in the project's
       // own group, and gates on the atom its page gates on.
       //

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.827",
+  "version": "1.19.829",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.827",
+      "version": "1.19.829",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.827",
+  "version": "1.19.829",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -191,6 +191,24 @@ const KNOWN_FAILING = new Set([
   'served_paths_shipped',
 ]);
 
+// Task 1003845: on Windows + Node 24 a suite that hard-exits after serving HTTP can
+// print a clean verdict and THEN abort natively (the cliExit class in
+// scripts/gds/CLAUDE.md), exiting 127 or 0xC0000409 depending on timing. Counted as
+// FAILED, these swap in and out of a Windows baseline, so a new failure can hide
+// behind a vanished one. Recognised by signature plus the suite's own verdict —
+// never by a list of names, which docs/recipes/windows-builders.md shows goes stale
+// in hours. Only the `N passed, M failed` summary counts as a verdict: node:test
+// suites set exitCode rather than hard-exiting, so they do not hit this.
+const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
+
+function isCleanTeardownAbort(stdout, stderr) {
+  if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
+  // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
+  if (/^\s*FAIL\b/m.test(stdout)) return false;
+  const lastLine = stdout.trim().split('\n').pop();
+  return /\b[1-9]\d* passed, 0 failed\s*$/.test(lastLine);
+}
+
 // Discover modules/<key>/tests/*.mjs. Pure-ish (reads disk; `isEnabled` is
 // injected so this is unit-testable with zero real modules/ or DB config —
 // mirrors the injected-dependency pattern the module loader itself uses).
@@ -266,6 +284,7 @@ function main() {
   const total = files.length + moduleTests.length;
 
   const failures = [];
+  const teardownAborts = [];
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
@@ -283,8 +302,13 @@ function main() {
       console.log(`  ok    ${displayName}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
-      console.log(`  FAIL  ${displayName} (${why})`);
       const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
+      if (!err.killed && isCleanTeardownAbort(stdoutText, err.stderr ? err.stderr.toString() : '')) {
+        console.log(`  ok    ${displayName} (clean verdict, then libuv teardown abort, ${why})`);
+        teardownAborts.push(displayName);
+        return;
+      }
+      console.log(`  FAIL  ${displayName} (${why})`);
       // The actual failures first: the file's own FAIL lines, then its stdout
       // tail (the last failure's assertion detail + summary), both bounded.
       const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
@@ -323,6 +347,9 @@ function main() {
 
   const label = integrationMode ? 'run-unit-tests --integration' : 'run-unit-tests';
   console.log('');
+  if (teardownAborts.length) {
+    console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
+  }
   if (failures.length === 0) {
     console.log(`${label}: all ${total} passed.`);
     process.exit(0);
@@ -333,4 +360,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { discoverModuleTests };
+module.exports = { discoverModuleTests, isCleanTeardownAbort };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.827'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.829'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/blockers_hall.mjs

@@ -0,0 +1,107 @@
+// tests/blockers_hall.mjs — task 1003455 (goal 1000089): "Blockers become
+// visible: the queue page and the attention slice, from one code path."
+//
+// GET /blockers had zero hall consumers before this task. Done-when: the queue
+// renders on a real page from GET /blockers, the attention inbox shows open
+// blockers as line items, BOTH read the same renderer (blockers-lib.js, pinned
+// separately in tests/blockers_lib.mjs), and the page's list is paged through
+// OTBKit rather than hand-rolled. This file pins the WIRING — that both
+// consumers actually call the shared lib and the real API, and that the page
+// uses the kit's pager rather than reimplementing slicing.
+//
+// Source-regex style, matching tests/rot_inbox.mjs's checks on the same file —
+// pure text assertions over the real client source, no DOM/vm harness needed for
+// what this pins (presence + call shape, not runtime behaviour).
+//
+// Run:  node tests/blockers_hall.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = join(ROOT, 'modules/hall-ui/public');
+const GOAL_INBOX_SRC = readFileSync(join(HALL, 'goal-inbox.js'), 'utf8');
+const BLOCKERS_JS_SRC = readFileSync(join(HALL, 'blockers.js'), 'utf8');
+const BLOCKERS_HTML_SRC = readFileSync(join(HALL, 'blockers.html'), 'utf8');
+const INDEX_HTML_SRC = readFileSync(join(HALL, 'index.html'), 'utf8');
+
+// ---- the attention-inbox slice (goal-inbox.js) -----------------------------
+
+test('goal-inbox.js carries a blockers slice div in the SAME needs-attention card', () => {
+  assert.match(GOAL_INBOX_SRC, /<div id="attention-blockers"><\/div>/,
+    'a second Home card would violate the placement rule (hall-ui/CLAUDE.md): an action awaiting a human is an inbox line, never a new card');
+});
+
+test('goal-inbox.js reads the real GET /blockers route, not a stand-in', () => {
+  assert.match(GOAL_INBOX_SRC, /getJSON\(`\$\{API\}\/blockers/);
+});
+
+test('goal-inbox.js asks the server for a BOUNDED read and reports the total, not fetch-all-then-slice', () => {
+  // The "Home bounded reads" rule this module's own CLAUDE.md names: a capped
+  // Home card must ask for exactly what it shows and get a total back, never
+  // download the whole feed and .slice() it client-side.
+  assert.match(GOAL_INBOX_SRC, /\/blockers\?limit=\$\{MAX_BLOCKER_ROWS\}/);
+  assert.match(GOAL_INBOX_SRC, /data\.page\.total/);
+});
+
+test('goal-inbox.js renders blocker rows through the SHARED lib, not a re-implementation', () => {
+  assert.match(GOAL_INBOX_SRC, /window\.OTBBlockersLib/);
+  assert.match(GOAL_INBOX_SRC, /lib\.blockerFacts\(/);
+});
+
+test('the blocker row carries .ginbox__item, so the card\'s count-pill and visibility include it', () => {
+  assert.match(GOAL_INBOX_SRC, /function blockerRowHtml[\s\S]*?class="ginbox__item"/);
+});
+
+test('the mount() boot sequence actually calls loadBlockers()', () => {
+  assert.match(GOAL_INBOX_SRC, /loadNodQueue\(\);\s*\n\s*loadBlockers\(\);\s*\n\s*loadRot\(\);/);
+});
+
+// ---- the full queue page (blockers.html + blockers.js) ---------------------
+
+test('blockers.js reads the real GET /blockers route, not a stand-in', () => {
+  assert.match(BLOCKERS_JS_SRC, /API \+ '\/blockers/);
+});
+
+test('blockers.js renders rows through the SAME shared lib the attention slice uses', () => {
+  assert.match(BLOCKERS_JS_SRC, /window\.OTBBlockersLib/);
+  assert.match(BLOCKERS_JS_SRC, /lib\.blockerFacts\(/);
+});
+
+test('blockers.js pages through OTBKit — makePager/paginate/wirePager/pagerBarHtml — not by hand', () => {
+  assert.match(BLOCKERS_JS_SRC, /kit\.makePager\(/);
+  assert.match(BLOCKERS_JS_SRC, /kit\.paginate\(/);
+  assert.match(BLOCKERS_JS_SRC, /kit\.wirePager\(/);
+  assert.match(BLOCKERS_JS_SRC, /kit\.pagerBarHtml\(/);
+  // The negative half: no hand-rolled slice math (start/end arithmetic) sitting
+  // beside the kit call, which is what "paged through OTBKit rather than
+  // hand-rolled" would otherwise silently tolerate.
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /\.slice\(\s*\(?\s*pager\.page/);
+});
+
+test('blockers.html loads blockers-lib.js BEFORE blockers.js', () => {
+  const libAt = BLOCKERS_HTML_SRC.indexOf('src="/builders/blockers-lib.js"');
+  const pageAt = BLOCKERS_HTML_SRC.indexOf('src="/builders/blockers.js"');
+  assert.ok(libAt > -1 && pageAt > -1, 'both scripts must be present');
+  assert.ok(libAt < pageAt, 'blockers.js calls window.OTBBlockersLib at load time');
+});
+
+test('index.html loads blockers-lib.js BEFORE goal-inbox.js', () => {
+  // The literal <script src> attribute, not a bare filename mention — a
+  // surrounding comment is free to name either file in either order (and does:
+  // profile-nudge.js's own comment mentions "goal-inbox.js" ahead of the real
+  // goal-inbox.js <script> tag), so only the src strings say what actually loads
+  // first.
+  const libAt = INDEX_HTML_SRC.indexOf('src="/builders/blockers-lib.js"');
+  const inboxAt = INDEX_HTML_SRC.indexOf('src="/builders/goal-inbox.js');
+  assert.ok(libAt > -1 && inboxAt > -1, 'both scripts must be present');
+  assert.ok(libAt < inboxAt);
+});
+
+test('every title link opens the SAME #/blocker/N overlay task-detail.js already renders', () => {
+  assert.match(GOAL_INBOX_SRC, /`#\/blocker\/\$\{encodeURIComponent\(id\)\}`/);
+  assert.match(BLOCKERS_JS_SRC, /'#\/blocker\/' \+ encodeURIComponent\(id\)/);
+});