@bongos/core 1.19.863 → 1.19.865

package/tests/blockers_page_ui.mjs

@@ -0,0 +1,325 @@
+// tests/blockers_page_ui.mjs — the /blockers queue page, EXECUTED (task
+// 1003456, following tests/task_detail_ui.mjs's precedent).
+//
+// A ship-time grade on this task found two real bugs in blockers.js that a
+// source-regex test (tests/blockers_hall.mjs) could not have caught, because
+// both are about ORDER and STATE rather than presence:
+//   - a boot race: GET /me and GET /blockers fire together, and the row
+//     renderer reads the reviewer flag at RENDER time — if the queue rendered
+//     before the rank arrived, a Metic/Archon saw no Resolve/Link buttons
+//     until an unrelated re-render happened.
+//   - a CSS-family misuse (.ov-row--lead on a row with no lead column) that a
+//     regex cannot see is wrong without knowing what the class means.
+// task_detail_ui.mjs's own header says it best: "browser code fails when a
+// human clicks, and only a harness that clicks can see that." This is that
+// harness for the sibling surface.
+//
+// Real hall-kit.js runs INSIDE the vm (it touches document/window at call
+// time, so it must share the sandbox's stubs) — blockers-lib.js is pure and is
+// require()'d directly, the same as tests/blockers_lib.mjs already trusts it.
+//
+// Run:  node tests/blockers_page_ui.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner, makeEl, walk } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const HALL_KIT_SRC = fs.readFileSync(path.join(HALL, 'hall-kit.js'), 'utf8');
+const BLOCKERS_JS_SRC = fs.readFileSync(path.join(HALL, 'blockers.js'), 'utf8');
+
+const require = createRequire(import.meta.url);
+const OTBBlockersLib = require(path.join(HALL, 'blockers-lib.js'));
+
+const { test, summary } = makeRunner();
+
+const tick = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+async function settle(extraMs = 0) {
+  if (extraMs) await tick(extraMs);
+  for (let i = 0; i < 30; i++) await tick(0);
+}
+
+const DEFAULT_ROWS = [
+  { id: 12, title: 'Need the owner’s AWS card on file', body_md: '', status: 'open', created_at: '2026-09-10T00:00:00.000Z', blocking_task_ids: [] },
+];
+
+function ok(data) { return { status: 200, ok: true, data }; }
+function fail(status, code, message) { return { status, ok: false, data: { error: { code, message } } }; }
+
+async function boot(opts = {}) {
+  const {
+    rank = 'archon',
+    rows = DEFAULT_ROWS,
+    meDelayMs = 0,
+    meFails = false,
+    blockersDelayMs = 0,
+    fileResponse = null,     // null → default success; or a fail(...) envelope
+    linkResponse = null,
+    resolveResponse = null,
+  } = opts;
+
+  const requests = [];
+  const toasts = [];
+  const navigations = [];
+  const winListeners = {};
+
+  const api = {
+    async request(method, p, init) {
+      const body = (init && init.body) || {};
+      const url = p.replace('/api/bongos', '');
+      if (method === 'GET' && url === '/me') {
+        if (meDelayMs) await tick(meDelayMs);
+        requests.push({ method, path: p, body });
+        if (meFails) return fail(401, 'auth_needed', 'sign in');
+        return ok({ builder: { id: 1, rank } });
+      }
+      requests.push({ method, path: p, body });
+      if (method === 'POST' && url === '/blockers') {
+        return fileResponse || ok({ blocker: { id: 900, title: body.title, body_md: body.body_md, status: 'open', created_at: '2026-09-17T00:00:00.000Z', blocking_task_ids: [] } });
+      }
+      if (method === 'POST' && /^\/blockers\/\d+\/link$/.test(url)) {
+        return linkResponse || ok({ ok: true, blocked: true });
+      }
+      if (method === 'POST' && /^\/blockers\/\d+\/resolve$/.test(url)) {
+        return resolveResponse || ok({ blocker: { id: Number(url.split('/')[2]), status: 'resolved' } });
+      }
+      return ok({});
+    },
+  };
+
+  const locationObj = { hostname: 'builders.example.test', pathname: '/blockers', assign(u) { navigations.push(['assign', u]); } };
+  // ONE root holding the page's known containers as PERSISTENT children —
+  // getElementById WALKS it (the task-detail.js harness's own pattern), so an
+  // id introduced later by `container.innerHTML = '...'` (the file form, a
+  // row's inline resolve/link form) is found the same way a real querySelector
+  // would find it, rather than handing back a phantom detached element.
+  const root = makeEl('div');
+  function registerRoot(id) { const el = makeEl('div', { id }); root.appendChild(el); return el; }
+  registerRoot('blockers-body');
+  registerRoot('blockers-count');
+  registerRoot('blockers-sub');
+  registerRoot('blockers-file-area');
+  const documentObj = {
+    getElementById(id) { return walk(root, (el) => (el.id === id ? el : null)); },
+  };
+  const windowObj = {
+    OTB: { toast: (m) => toasts.push(m) },
+    OTBBlockersLib,
+    OTBTaskDetail: { href: (id) => '/task/' + id },
+    BongosClient: { createClient: () => api },
+    location: locationObj,
+    localStorage: { getItem: () => null, setItem() {} },
+    addEventListener(type, fn) { (winListeners[type] = winListeners[type] || []).push(fn); },
+    dispatchEvent(ev) { (winListeners[ev.type] || []).forEach((fn) => fn(ev)); return true; },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: locationObj,
+    console, setTimeout, clearTimeout, Promise, Date, Math, JSON, Error,
+    Number, String, Object, Array, Boolean, Set, Map, RegExp, encodeURIComponent,
+  };
+  sandbox.globalThis = sandbox;
+  // fetch() is blockers.js's OWN call for GET /blockers — separate from the
+  // BongosClient api used for writes and /me, exactly as the real file does.
+  sandbox.fetch = async (url) => {
+    if (blockersDelayMs) await tick(blockersDelayMs);
+    requests.push({ method: 'GET', path: url });
+    return { ok: true, json: async () => ({ blockers: rows, page: { limit: 200, offset: 0, total: rows.length } }) };
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(HALL_KIT_SRC, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(BLOCKERS_JS_SRC, sandbox, { filename: 'blockers.js' });
+  await settle();
+
+  const body = () => documentObj.getElementById('blockers-body');
+  const fileArea = () => documentObj.getElementById('blockers-file-area');
+  const rowsOf = () => body().querySelectorAll('.ov-row');
+  const requestsTo = (method, re) => requests.filter((r) => r.method === method && re.test(r.path));
+
+  // The FILE form's open/cancel buttons and its own submit carry a DIRECT
+  // listener (wireFileForm addEventListener's each element itself). The
+  // per-row Resolve/Link open/cancel/submit are DELEGATED on #blockers-body
+  // (module-scope body.addEventListener) — makeEl's fire() does not bubble,
+  // so a delegated handler must be fired ON THE DELEGATE with the real
+  // target, exactly as a browser's own event dispatch would deliver it.
+  async function submitDirect(form) {
+    let prevented = false;
+    form.fire('submit', { preventDefault() { prevented = true; }, target: form });
+    await settle();
+    assert.equal(prevented, true, 'the submit handler did not execute');
+  }
+  async function submitDelegated(form) {
+    let prevented = false;
+    body().fire('submit', { preventDefault() { prevented = true; }, target: form });
+    await settle();
+    assert.equal(prevented, true, 'the delegated submit handler did not execute');
+  }
+  function clickDelegated(el) { body().fire('click', { target: el }); }
+
+  return {
+    requests, requestsTo, toasts, navigations, settle,
+    body, fileArea, rowsOf,
+    fileOpenBtn: () => fileArea().querySelector('#blockers-file-open'),
+    fileForm: () => fileArea().querySelector('#blockers-file-form'),
+    submit: submitDirect,
+    submitRow: submitDelegated,
+    click: (el) => { el.fire('click', { target: el }); },
+    clickRow: clickDelegated,
+    dispatchWindowEvent: (type) => windowObj.dispatchEvent({ type }),
+  };
+}
+
+// ===========================================================================
+// The boot race (the FIRST bug the grade found)
+// ===========================================================================
+
+await test('BUG REGRESSION: GET /blockers resolving BEFORE GET /me still ends with Resolve/Link offered to a reviewer', async () => {
+  const h = await boot({ rank: 'archon', blockersDelayMs: 0, meDelayMs: 15 });
+  const row = h.rowsOf()[0];
+  assert.ok(row, 'the row rendered');
+  assert.ok(row.querySelector('[data-resolve-open]'), 'once the viewer resolves, the row must re-render with the reviewer controls — this is exactly the boot race the grade found');
+});
+
+await test('the reverse order (viewer known first) already worked, and still does', async () => {
+  const h = await boot({ rank: 'archon', blockersDelayMs: 15, meDelayMs: 0 });
+  const row = h.rowsOf()[0];
+  assert.ok(row.querySelector('[data-resolve-open]'));
+});
+
+await test('a non-reviewer sees the row with no Resolve/Link controls at all', async () => {
+  const h = await boot({ rank: 'xenos' });
+  const row = h.rowsOf()[0];
+  assert.equal(row.querySelector('[data-resolve-open]'), null);
+  assert.equal(row.querySelector('[data-link-open]'), null);
+});
+
+await test('a signed-out visitor (GET /me fails) sees the queue with no reviewer controls, not an error', async () => {
+  const h = await boot({ meFails: true });
+  const row = h.rowsOf()[0];
+  assert.equal(row.querySelector('[data-resolve-open]'), null);
+  assert.ok(h.fileOpenBtn(), 'the File button still renders — filing needs only a sign-in the write itself will demand');
+});
+
+// ===========================================================================
+// Filing — any signed-in builder, and the file+link one-action flow
+// ===========================================================================
+
+await test('filing alone (no task #) posts once and toasts the filed id', async () => {
+  const h = await boot({ rank: 'xenos' });
+  h.click(h.fileOpenBtn());
+  const form = h.fileForm();
+  form.querySelector('#bf-title').value = 'Need a decision';
+  await h.submit(form);
+  const posts = h.requestsTo('POST', /\/blockers$/);
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].body.title, 'Need a decision');
+  assert.ok(h.toasts.some((t) => /Blocker #900 filed\.$/.test(t)));
+  assert.equal(h.requestsTo('POST', /\/link$/).length, 0, 'no task # given — no link attempted');
+});
+
+await test('filing WITH a task # does both in the one submit, and toasts success', async () => {
+  const h = await boot({ rank: 'xenos' });
+  h.click(h.fileOpenBtn());
+  const form = h.fileForm();
+  form.querySelector('#bf-title').value = 'Need a decision';
+  form.querySelector('#bf-task-id').value = '5001';
+  await h.submit(form);
+  const linkPosts = h.requestsTo('POST', /\/blockers\/900\/link$/);
+  assert.equal(linkPosts.length, 1);
+  assert.equal(linkPosts[0].body.task_id, 5001);
+  assert.ok(h.toasts.some((t) => /filed and linked to task #5001\./.test(t)));
+});
+
+await test('a non-reviewer filer who names a task the link 403s on still gets an HONEST message — filing is not a silent no-op', async () => {
+  const h = await boot({ rank: 'xenos', linkResponse: fail(403, 'permission_forbidden', 'nope') });
+  h.click(h.fileOpenBtn());
+  const form = h.fileForm();
+  form.querySelector('#bf-title').value = 'Need a decision';
+  form.querySelector('#bf-task-id').value = '5001';
+  await h.submit(form);
+  assert.ok(h.toasts.some((t) => t === 'Blocker #900 filed. You need Metic+ access to do that.'),
+    `expected the honest fallback, got: ${JSON.stringify(h.toasts)}`);
+});
+
+await test('a deduped (skipped) file with a task # typed says the link was NOT attempted', async () => {
+  const h = await boot({ fileResponse: ok({ skipped: true, reason: 'duplicate_source_ref' }) });
+  h.click(h.fileOpenBtn());
+  const form = h.fileForm();
+  form.querySelector('#bf-title').value = 'Need a decision';
+  form.querySelector('#bf-task-id').value = '5001';
+  await h.submit(form);
+  assert.equal(h.requestsTo('POST', /\/link$/).length, 0, 'no blocker id came back — nothing to link');
+  assert.ok(h.toasts.some((t) => /already filed\. It was NOT linked to task #5001/.test(t)),
+    `expected the honest skip+link message, got: ${JSON.stringify(h.toasts)}`);
+});
+
+await test('an empty title is refused in the browser before a doomed request', async () => {
+  const h = await boot();
+  h.click(h.fileOpenBtn());
+  const form = h.fileForm();
+  await h.submit(form);
+  assert.equal(h.requestsTo('POST', /\/blockers$/).length, 0);
+  assert.equal(form.querySelector('#bf-err').textContent, 'A title is required.');
+});
+
+// ===========================================================================
+// Resolve / Link — reviewer-only, cosmetic mirror of blocker.review
+// ===========================================================================
+
+await test('a reviewer resolving a row posts to the real route, toasts, and reloads the queue', async () => {
+  const h = await boot({ rank: 'metic' });
+  h.clickRow(h.rowsOf()[0].querySelector('[data-resolve-open]'));
+  await h.settle();
+  // The click's own rerender() replaced the row's markup — re-query from the
+  // (stable) delegate rather than the now-detached `row` reference.
+  const form = h.body().querySelector('[data-resolve-form]');
+  assert.ok(form, 'the resolve form opened');
+  form.note.value = 'raised the budget';
+  await h.submitRow(form);
+  const posts = h.requestsTo('POST', /\/blockers\/12\/resolve$/);
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].body.resolution_note, 'raised the budget');
+  assert.ok(h.toasts.some((t) => t === 'Blocker #12 resolved.'));
+  // reload() re-fetches — a second GET /blockers beyond the initial boot fetch.
+  assert.ok(h.requestsTo('GET', /\/blockers\?limit=200$/).length >= 2, 'the queue reloads after a mutation');
+});
+
+await test('a reviewer linking a row posts task_id as a NUMBER', async () => {
+  const h = await boot({ rank: 'metic' });
+  h.clickRow(h.rowsOf()[0].querySelector('[data-link-open]'));
+  await h.settle();
+  const form = h.body().querySelector('[data-link-form]');
+  form.taskId.value = '777';
+  await h.submitRow(form);
+  const posts = h.requestsTo('POST', /\/blockers\/12\/link$/);
+  assert.equal(posts.length, 1);
+  assert.strictEqual(posts[0].body.task_id, 777, 'a string field value must be coerced to Number, not sent as text');
+});
+
+await test('a 403 on resolve renders HONEST copy and leaves the form open — never a silent no-op', async () => {
+  const h = await boot({ rank: 'metic', resolveResponse: fail(403, 'permission_forbidden', 'nope') });
+  h.clickRow(h.rowsOf()[0].querySelector('[data-resolve-open]'));
+  await h.settle();
+  const form = h.body().querySelector('[data-resolve-form]');
+  await h.submitRow(form);
+  assert.equal(form.querySelector('[data-err]').textContent, 'You need Metic+ access to do that.');
+});
+
+await test('resolving through the shared #/blocker/N overlay (otb:blocker-resolved) reloads this page\'s queue too', async () => {
+  const h = await boot({ rank: 'metic' });
+  const before = h.requestsTo('GET', /\/blockers\?limit=200$/).length;
+  // Simulate task-detail.js's blockerPanel firing the event on THIS window —
+  // the SAME event the overlay dispatches when a builder resolves a blocker
+  // from the deep-link card opened on top of this page.
+  h.dispatchWindowEvent('otb:blocker-resolved');
+  await h.settle();
+  const after = h.requestsTo('GET', /\/blockers\?limit=200$/).length;
+  assert.equal(after, before + 1, 'the queue re-fetched exactly once in response to the event');
+});
+
+summary();

package/tests/docs_scrubber_damage.mjs

@@ -0,0 +1,111 @@
+// tests/docs_scrubber_damage.mjs — the secret-scrubber ate real prose in
+// docs/recipes/managed-settings-remote-control.md (task 1004027, part 4 of the
+// damage family after 1004021 / 1004022).
+//
+// Two distinct repairs, and the SECOND is the trap. A scrubber pass replaced
+// two pieces of ordinary content with the literal `<redacted>`:
+//   - an in-page anchor target, so the link went nowhere;
+//   - an `infra/*.sh` script name, so the doc pointed at no script at all.
+// But four OTHER `<redacted>` occurrences in the same file are DELIBERATE — they
+// stand in for real secrets (a tunnel credential, two tokens, a trust seed).
+// A global sweep "fixes" the two and destroys the four, and nothing in the repo
+// would notice, because the anchor lint only ever looks at link targets.
+//
+// So this file pins BOTH halves: the anchor and the script path resolve, AND the
+// placeholder count stays at exactly four. The second assertion is the one that
+// makes a future sweep fail loudly instead of quietly.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { parseFile } = require(path.join(ROOT, 'scripts', 'gds', 'docs-entropy.js'));
+
+const REL = 'docs/recipes/managed-settings-remote-control.md';
+const ABS = path.join(ROOT, REL);
+const raw = () => fs.readFileSync(ABS, 'utf8');
+
+// The doc is only worth asserting against while it exists at this path.
+test('the recipe under repair is still tracked at its documented path', () => {
+  assert.ok(fs.existsSync(ABS), `${REL} is missing — move this test with it`);
+});
+
+test('every in-page anchor in the recipe resolves to a heading it actually has', () => {
+  // The damaged link read `[named-tunnel automation](#<redacted>)`. Resolve
+  // through the SAME parser docs-entropy.js uses, so the slug this asserts is
+  // the slug the lint computes — a test with its own slug rule would let the
+  // doc pass here and still red the ratchet.
+  const { headings, links } = parseFile(ABS);
+  const slugs = new Set(headings.map((h) => h.slug));
+  const inPage = links.filter((l) => l.href.startsWith('#'));
+
+  assert.ok(inPage.length > 0, 'fixture sanity: the recipe does link to its own sections');
+  const broken = inPage.filter((l) => !slugs.has(l.href.slice(1)));
+  assert.deepEqual(
+    broken.map((l) => `${l.line}: ${l.href}`), [],
+    'an in-page anchor points at no heading in this file — this is what doc_broken_anchors counts',
+  );
+});
+
+test('the key-sync cron names a script the cloud-init renderer actually installs', () => {
+  // The damaged line read `infra/<redacted>.sh`. The authority for the real name
+  // is not prose anywhere: it is the renderer that bakes the script into the
+  // cloud-init, so assert the doc against THAT rather than against a literal.
+  const line = raw().split(/\r?\n/).find((l) => l.includes('GET /box/authorized-keys'))
+    ?? raw().split(/\r?\n/).find((l) => l.includes('keeps `authorized_keys` in sync'));
+  assert.ok(line, 'fixture sanity: the recipe still describes the authorized_keys sync cron');
+
+  const named = [...raw().matchAll(/`infra\/([a-z0-9-]+\.sh)`/g)].map((m) => m[1]);
+  assert.ok(
+    named.includes('box-authorized-keys-fetch.sh'),
+    `the recipe names no authorized-keys script; found ${JSON.stringify(named)}`,
+  );
+
+  // Scoped to the repaired name on purpose. Other `infra/*.sh` the recipe cites
+  // (box-connect.sh) are builder-side scripts absent from this checkout for an
+  // unrelated, pre-existing reason (idea 1000895) — asserting over all of them
+  // would red this test on a gap it is not about.
+  const renderer = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'box-infra.js'), 'utf8');
+  assert.ok(
+    renderer.includes('box-authorized-keys-fetch.sh'),
+    'box-infra.js no longer bakes box-authorized-keys-fetch.sh into the cloud-init — '
+    + 'the recipe now names a script nothing installs, so fix the doc to match the renderer',
+  );
+});
+
+test('the four deliberate <redacted> secret placeholders survive — a global sweep must fail here', () => {
+  // This is the anti-fix assertion. Each of these stands in for a real secret and
+  // is correct as written; "repairing" them is the damage, not the cure.
+  const lines = raw().split(/\r?\n/);
+  const placeholders = lines
+    .map((text, i) => ({ line: i + 1, text }))
+    .filter((l) => l.text.includes('<redacted>'));
+
+  assert.equal(
+    placeholders.length, 4,
+    'expected exactly the four secret placeholders, got:\n'
+    + placeholders.map((p) => `  ${p.line}: ${p.text.trim().slice(0, 110)}`).join('\n'),
+  );
+
+  // Named by CONTEXT, not by line number, so ordinary edits above them don't red this.
+  const contexts = ['"credential"', 'BOX_TUNNEL_TOKEN', 'BOX_SOURCE_FULL_TOKEN', '/root/.claude.json'];
+  for (const ctx of contexts) {
+    assert.ok(
+      placeholders.some((p) => p.text.includes(ctx)),
+      `the deliberate placeholder for ${ctx} is gone — a <redacted> sweep took a real secret stand-in with it`,
+    );
+  }
+
+  // And no placeholder may sit in a link target or a path again: those two shapes
+  // are exactly what the scrubber damaged.
+  for (const p of placeholders) {
+    assert.ok(
+      !/\(#<redacted>\)/.test(p.text) && !/infra\/<redacted>/.test(p.text),
+      `line ${p.line} carries scrubber damage, not a secret placeholder: ${p.text.trim().slice(0, 110)}`,
+    );
+  }
+});

package/tests/helpers.mjs

@@ -281,6 +281,10 @@ export function makeEl(tagName, attrs = {}) {
     attrs,
     children: [],
     parentNode: null,
+    // parentElement — every parent this stub ever creates IS an element (no
+    // text-node parents tracked separately), so it is always the same value
+    // as parentNode; a getter keeps the two from drifting if that changes.
+    get parentElement() { return this.parentNode; },
     className: attrs.class || '',
     id: attrs.id || '',
     name: attrs.name,
@@ -325,6 +329,10 @@ export function makeEl(tagName, attrs = {}) {
       walk(this, (c) => { if (matches(c, sel)) out.push(c); return null; });
       return out;
     },
+    // HTMLSelectElement.options — real <select> elements have it; hall-kit.js's
+    // wirePager() reads `.length` off it before deciding whether to (re)build
+    // the per-page choices.
+    get options() { return this.tagName === 'select' ? this.querySelectorAll('option') : undefined; },
     closest(sel) {
       let node = this;
       while (node) { if (matches(node, sel)) return node; node = node.parentNode; }
@@ -340,6 +348,11 @@ export function makeEl(tagName, attrs = {}) {
     },
     addEventListener(type, fn) { (this.listeners[type] = this.listeners[type] || []).push(fn); },
     focus() {},
+    // HTMLFormElement.reset() — real forms have it, most elements do not, but a
+    // universal no-op is harmless (nothing currently reads a cleared value back)
+    // and lets a page script that calls form.reset() run without a stub-specific
+    // workaround in every test that exercises one.
+    reset() {},
     fire(type, event) { (this.listeners[type] || []).forEach((fn) => fn(event)); },
   };
   for (const [k, v] of Object.entries(attrs)) {

package/tests/task_detail_ui.mjs

@@ -73,6 +73,18 @@ const DEFAULT_SUGGESTIONS = {
   BV1: [{ id: 1000058, title: 'Consumer path', score: 4, matched_terms: ['overlay'] }],
   BV2: [{ id: 1000062, title: 'Idea surfaces', score: 6, matched_terms: ['promote', 'merge'] }],
 };
+// task 1003456: the blocker resolve panel rides the SAME overlay, so it rides
+// the same executing harness — a source-regex test cannot catch the exact
+// class of bug this file's own header names (a ReferenceError inside a submit
+// handler that passes review and 500s at click time).
+const DEFAULT_BLOCKER = {
+  id: 5000042,
+  status: 'open',
+  title: 'Need the owner’s AWS card on file',
+  body_md: 'Raise the S3 budget or approve a spend.',
+  created_at: '2026-09-01T00:00:00.000Z',
+  blocking_task_ids: [],
+};
 
 const escapeHtml = (s) => String(s == null ? '' : s).replace(/[&<>"']/g,
   (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
@@ -89,7 +101,9 @@ function fail(status, code, message) {
 
 async function boot(opts = {}) {
   const {
+    kind = 'idea',
     idea = DEFAULT_IDEA,
+    blocker = DEFAULT_BLOCKER,
     rank = 'metic',
     versions = DEFAULT_VERSIONS,
     suggestions = DEFAULT_SUGGESTIONS,
@@ -98,8 +112,10 @@ async function boot(opts = {}) {
     createdTask = { id: 1003600, title: 'Cover the overlay handlers' },
     createFails = null,
     patchFails = null,
+    resolveFails = null,
     mergeTargets = { 1000900: { id: 1000900, title: 'The canonical idea' } },
   } = opts;
+  const ref = kind === 'blocker' ? blocker : idea;
 
   const requests = [];
   const toasts = [];
@@ -130,6 +146,15 @@ async function boot(opts = {}) {
       }
       if (method === 'POST' && route === '/tasks') return createFails || ok({ task: { ...createdTask, title: body.title } });
       if (method === 'PATCH' && route.startsWith('/inbox/')) return patchFails || ok({ idea: { ...idea, status: body.status } });
+      // task 1003456 — the blocker overlay panel rides the same stub.
+      if (method === 'GET' && route.startsWith('/blockers/')) {
+        const id = Number(route.slice('/blockers/'.length));
+        if (id === Number(blocker.id)) return ok({ blocker });
+        return { status: 404, ok: false, data: null };
+      }
+      if (method === 'POST' && /^\/blockers\/\d+\/resolve$/.test(route)) {
+        return resolveFails || ok({ blocker: { ...blocker, status: 'resolved', resolution_note: body.resolution_note } });
+      }
       return ok({});
     },
   };
@@ -138,7 +163,7 @@ async function boot(opts = {}) {
     hostname: 'builders.example.test',
     pathname: '/builders',
     search: '',
-    hash: `#/idea/${idea.id}`,
+    hash: `#/${kind}/${ref.id}`,
     href: '',
     assign(u) { navigations.push(['assign', u]); },
     replace(u) { navigations.push(['replace', u]); },
@@ -246,6 +271,59 @@ await test('a closed idea offers no triage panel', async () => {
   assert.equal(h.panel(), null, 'a settled idea has nothing left to decide');
 });
 
+// ===========================================================================
+// task 1003456 — the blocker resolve panel, on the SAME overlay
+// ===========================================================================
+
+await test('an open blocker offers a Metic the Resolve panel', async () => {
+  const h = await boot({ kind: 'blocker' });
+  assert.ok(h.overlay(), 'a #deeplink-card overlay is mounted');
+  const p = h.panel();
+  assert.ok(p, 'an open blocker carries the resolve panel');
+  const verbs = p.querySelectorAll('[data-go]').map((b) => b.dataset.go);
+  assert.deepEqual(verbs, ['resolve'], 'one verdict — resolve — not the idea three');
+});
+
+await test('a Xenos gets the blocker card but no resolve panel (the server gate is mirrored, not trusted)', async () => {
+  const h = await boot({ kind: 'blocker', rank: 'xenos' });
+  assert.ok(h.overlay(), 'the record is still readable');
+  assert.equal(h.panel(), null, 'the action is not offered below Metic');
+});
+
+await test('a resolved blocker offers no resolve panel, and says what closed it', async () => {
+  const h = await boot({ kind: 'blocker', blocker: { ...DEFAULT_BLOCKER, status: 'resolved', resolution_note: 'raised the budget' } });
+  assert.equal(h.panel(), null, 'a settled blocker has nothing left to decide');
+  const note = h.overlay().querySelectorAll('.deeplink-card__note').map((n) => n.textContent).join(' | ');
+  assert.match(note, /Resolved: raised the budget/);
+});
+
+await test('resolving posts to the real route, toasts, dispatches otb:blocker-resolved, and closes the overlay', async () => {
+  const h = await boot({ kind: 'blocker' });
+  await h.clickGo('resolve');
+  const form = h.panel().querySelector('[data-form="resolve"]');
+  form.note.value = 'raised the budget';
+  await h.submitForm('resolve');
+  const posts = h.requestsTo('POST', /\/blockers\/5000042\/resolve$/);
+  assert.equal(posts.length, 1, 'exactly one resolve POST');
+  assert.equal(posts[0].body.resolution_note, 'raised the budget');
+  assert.ok(h.toasts.some((t) => /Blocker #5000042 resolved\./.test(t)));
+  assert.equal(h.events.length, 1, 'the otb:blocker-resolved event fired');
+  assert.equal(h.events[0].type, 'otb:blocker-resolved');
+  assert.equal(h.events[0].detail.id, 5000042);
+  assert.equal(h.overlay(), null, 'the overlay closes on a settled verdict, the idea-panel precedent');
+});
+
+await test('a 403 on resolve renders HONEST copy and leaves the form open — never a silent no-op', async () => {
+  const h = await boot({
+    kind: 'blocker',
+    resolveFails: { status: 403, ok: false, data: { error: { code: 'permission_forbidden', message: 'nope' } } },
+  });
+  await h.clickGo('resolve');
+  await h.submitForm('resolve');
+  assert.equal(h.errText(), 'You need Metic+ access to resolve blockers.');
+  assert.ok(h.overlay(), 'the overlay stays open so the builder can see why it failed');
+});
+
 // ===========================================================================
 // Promote — the form the version and goal pickers live on
 // ===========================================================================