Ro'yxat va kartochka — GET /orders, GET /orders/{id}

finalize-ep-10 yangiladi

Yangilandi: commit_sha, pr_url

team-lead-pm statusni o'zgartirdi Ishlanyapti → Bajarildi

team-lead-pm statusni o'zgartirdi Bloklangan → Ishlanyapti

team-lead-pm izoh qoldirdi

Drift topilmasi bu bargdan yangi EP-10-T02-S05 bargiga ko'chirildi (3 ta /orders/me* endpoint — bu bargning scope'iga kirmaydi: S04 faqat GET /orders va GET /orders/{id}). S04 o'z qabul mezonlari bo'yicha bajarilgan, done ga qaytarildi.

finalize-ep-10 statusni o'zgartirdi Ishlanyapti → Bloklangan

Kontrakt drift (A toifa, bloklovchi) — epic yakunlashda topildi (2026-09-03, finalize-EP-10). Muzlatilgan kontrakt openapi/v1/orders.yaml da 4 ta /orders/me* endpoint bor, kodda faqat 1 tasi bor: - GET /api/v1/orders/me -> KODDA YO'Q (mijoz: 'Buyurtmalarim') - GET /api/v1/orders/me/deliveries -> KODDA YO'Q (haydovchi: 'Reys') - GET /api/v1/orders/me/picking -> KODDA YO'Q (hodim: 'Yig'ish navbati') - GET /api/v1/orders/me/catalog -> bor (OrderSelfController) Dalil: scripts/openapi-diff.sh v1/orders (ilova HEAD=a054e3c dan qurilgan, :18080) -> exit=1, policy 'blocking': paths.deleted x3. Kodda mapping ham, test ham yo'q (OrderSelfController da faqat @GetMapping("/catalog")). Ta'siri: erpbom-mobile (customer_order_api.dart, driver_delivery_api.dart, picking) va erpbom-web (order-self-service.api.ts) shu 3 endpointga klient yozgan — merge bo'lsa mijoz/haydovchi/yig'uvchi ekranlari 404 beradi. Backlog bo'shligi: bu 3 endpoint uchun EP-10 da alohida backend barg YO'Q (T02-S04 faqat GET /orders + GET /orders/{id} + /me/catalog ni qamragan). Yangi barg kerak. Qoida bo'yicha kontrakt emas, kod tuzatiladi (finalize agent kod yozmaydi). Shu sabab 3 repo ham PUSH QILINMADI, PR ochilmadi; branchlar lokalda turibdi.

finalize-ep-10 statusni o'zgartirdi Bajarildi → Ishlanyapti

qa-ep-10-t02-s04 statusni o'zgartirdi Review → Bajarildi

qa-ep-10-t02-s04 izoh qoldirdi

QA 2-yurish (dfb1730) — QABUL QILINDI (done). MUTATSIYA (izolyatsiyalangan worktree /tmp/qa2-EP-10-T02-S04, javap bilan tasdiqlangan) — 4/4 O LDI: - #4 OrderUpdatePoster.java:258 maska chetlab o tildi -> QIZIL (19 dan 1 yiqildi: customerAudienceSeesManyQtyReserved...:474, expected many but was exact). javap: OrderUpdatePoster da QtyMaskingService.mask chaqiruvi 0 ta (mutant haqiqatan kuchga kirgan). 1-yurish Topilma 1 YOPILDI. - #2 QtyMaskingService.java:42 dan ! olib tashlandi -> QIZIL (3 test yiqildi: :474, :439, :520). javap: ifne 19 (asli ifeq) — inversiya bytecode da tasdiqlangan. - #6 ProductVariantService.java:279 tartib ASC ga qotirildi -> QIZIL (3 sort testi yiqildi: name/code/unit_price desc). javap: resolveCatalogOrderBy da toUpperCase 0 ta. Sort testlari tautologik EMAS — element KETMA-KETLIGI assert qilinadi, asc va desc farqli natija beradi. 1-yurish Topilma 2 YOPILDI. - #7 whitelist chetlab o tildi (getOrDefault(field, v.name)) -> QIZIL (sortWithDisallowedFieldReturnsValidationError:444, expected 400 but was 200). javap: Map.getOrDefault mavjud. FIXTURE XILMA-XILLIGI — YETARLI: maska testlarida qty != qty_reserved HAR DOIM ((50,45) (60,47.5) (50,30) (60,47.5); List da (50,12.5) (50,30) (50,30.5) (300,250) (10,0)) — maydon almashinuvi mutanti qoplangan (chegara testida qty=50, reserved=30: almashinuv many beradi -> qizil). Chegara qamrovi: 0 / 12.5 / 30 (aynan) / 30.5 / 45 / 47.5 / 250 — 30 ning ikkala tomoni ham bor. doesNotContain(47.5000) da vosi HAQIQIY: fixture da qty=60.0000, unit_price=2000.00, line_amount=total=120000.00 — 47.5000 faqat qty_reserved da uchraydi, ya ni na vakuum-yashil, na doim-qizil. TEST SONI (aniqlik): grep @Test 20/25 bergan edi — bu YOLG ON, @Testcontainers (68/61-qatorlar) substring sifatida sanalgan. Surefire haqiqiy soni: Update 19 (16->19, +3), Catalog 24 (19->24, +5), List 14 (o zgarmagan), Create 11 (o zgarmagan). Jami +8 yangi test, bironta test zaiflashmagan/o chirilmagan. TEST: rm -rf target/surefire-reports + flock, bloklovchi. Yakuniy yurish tiklangan daraxtda: Update 19/19, Catalog 24/24 = 43/43 YASHIL, exit 0. javap: mask chaqiruvi tiklangan (1 ta). REGRESSIYA: git diff 697b176..dfb1730 -- src/main/ BO SH (faqat 2 test fayli, +190 qator). git diff b441b81..HEAD -- openapi/ BO SH. AC3674 (403) va AC3676 (lines_ready/lines_total/fully_reserved, 3.9999 vs 4.0000 precision chegarasi) OrderListControllerTest da qamrab olingan, maskadan mustaqil. TOZALIK: worktree o chirildi (git worktree list da qoldiq yo q), grep -rn MUTANT ikkala daraxtda BO SH, .orig qoldiq yo q, asosiy daraxt git status toza, HEAD=dfb1730, branch=feat/EP-10-erpbom-backend.

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Tayyorlik ko'rsatkichi F5 bo'yicha rezervdan hisoblanadi (07 sikllaridan emas) — 3 qatordan 2 tasi band bo'lganda 2/3 (AC4)

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz javobida qoldiq 30 dan katta bo'lsa aniq son qaytmaydi

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz o'zganing buyurtmasini GET qila olmaydi (403)

coder-ep-10-t02-s04 yangiladi

Yangilandi: commit_sha

coder-ep-10-t02-s04 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-10-t02-s04 statusni o'zgartirdi Tayyor → Ishlanyapti

Agent ishni boshladi

coder-ep-10-t02-s04 ishga oldi

coder-ep-10-t02-s04 fayllarni qayd etdi

2 ta fayl qayd etildi

system statusni o'zgartirdi Ishlanyapti → Tayyor

Avtomatik bo'shatildi: 60 daqiqa signal yo'q

system bo'shatdi

Avtomatik bo'shatildi: 60 daqiqa signal yo'q

qa-ep-10-t02-s04 statusni o'zgartirdi Review → Ishlanyapti

qa-ep-10-t02-s04 izoh qoldirdi

QA 697b176 — 3 mezon (3674/3675/3676) TASDIQLANDI, lekin ikkita test bo'shligi bilan QAYTARILDI. O'TDI: kontrakt daxlsiz (git diff b441b81..HEAD -- openapi/ BO'SH). Maska UCHALA order endpoint + katalogda: OrderService.java:338 (POST), :717 (GET detail, principal.audience() :391/:404 orqali), OrderUpdatePoster.java:258 (PUT), OrderService.java:444 (katalog) — hech qayerda audience QOTIRILMAGAN, hammasi AuthenticatedUser.audience(). fully_reserved/lines_ready/lines_total maskadan ta'sirlanmagan (xom line.fullyReserved()). 4 ta 409 kodi qayta ishlatilgan, yangi kod to'qilmagan; raw ombor -> ORDER_WAREHOUSE_TYPE_INVALID. OrderSelfController da @RequirePermission YO'Q (import ham yo'q; 32-qatordagi javadoc — ma'lum yolg'on ijobiy), aud!=customer -> 403. available=0 ro'yxatda qoladi, arxiv variant chiqarilgan. Presigned — FileDownloadService qayta ishlatilgan, 7-chi TTL konstantasi qo'shilmagan, TTL=5 daq. Cross-modul (StockService/ProductVariantService) o'zgarishlari faqat QO'SHIMCHA, @Transactional(readOnly=true) bilan. TESTLAR YASHIL: 60 test / 0 failure (Catalog 19, Create 11, List 14, Update 16). Test soni kamaymagan (Update 16->17, List 11->15 @Test), mavjud assert'lar KUCHAYGAN (qty_reserved string -> {level,qty}). MUTATSIYA (izolyatsiyalangan worktree, javap bilan tasdiqlangan): M1 <=0 -> <0 O'LDI (Catalog+List, 30.0000 chegarasi). M2 !equals -> equals O'LDI (Catalog 2 + List 2 + Update 1). M3 many'da null -> qty O'LDI (Catalog 2 + List 1); Create'da tirik — u yerda qty_reserved DOIM 0 (OrderService.java:308), shoxobcha erishib bo'lmas, defekt emas. M5 qty_on_hand-qty_reserved -> qty_on_hand O'LDI (Catalog). === QAYTARISH SABABI (2 ta) === 1) MUTANT TIRIK QOLDI — PUT maskasi mijoz kanalida sinalmagan. Fayl: src/main/java/uz/erpbom/orders/service/OrderUpdatePoster.java:258 Mutant: qtyMaskingService.mask(...) o'rniga new MaskedQty("exact", ctx.line().getQtyReserved()) qo'yildi (javap: OrderUpdatePoster da QtyMaskingService.mask chaqiruvi 0 ta) -> OrderUpdateControllerTest 16/16 YASHIL qoldi. Sabab: OrderUpdateControllerTest da PUT javobining maskasi FAQAT ichki audience uchun sinaladi (internalUserSeesExactQtyReservedAboveThresholdOnUpdate, :~420) — aud=customer bilan bironta PUT testi yo'q. Erishib bo'lmas emas: RequirePermissionAspect.java:50 faqat permissionEvaluator.can() ni tekshiradi, audience gate YO'Q — order.update rule'i berilgan, aud=customer tokenli user PUT qila oladi. Kerak: OrderUpdateControllerTest ga bitta test — user'ga order.update grant qilinadi, token audience="customer", qty_reserved>30 (mas. 45.0000) bo'lgan qator PUT qilinadi; kutilgan qty_reserved.level=="many", qty==null va javob MATNIDA "45.0000" satri UMUMAN yo'q. 2) SORT QAMROVI NOL — kontraktda aniq yozilgan xatti-harakat umuman sinalmagan. Fayl: src/main/java/uz/erpbom/products/service/ProductVariantService.java:~270 (resolveCatalogOrderBy) — kod TO'G'RI (ruxsat: variant_name/variant_code/unit_price, default v.name ASC, aks holda ValidationException("sort") = 400, OrderService.resolveSort:769 naqshi bilan izchil). Lekin: OrderCatalogControllerTest.java da "sort" so'zi 0 marta uchraydi — na 400 (mas. sort=created_at,desc), na 3 ta ruxsat etilgan maydon, na yo'nalishsiz qiymat (sort=variant_name) sinalgan. happyPath... faqat DEFAULT tartibni bilvosita tekshiradi. Kerak: OrderCatalogControllerTest ga (a) sort=unit_price,desc va sort=variant_code,asc tartibini tasdiqlovchi test; (b) sort=created_at,desc -> 400 VALIDATION_ERROR (fields da "sort") testi. ESLATMA (defekt EMAS, xabar uchun): katalog SQL da p.active tekshirilmaydi (ProductCatalogQueryRepository.java:~130 — v.active/v.deleted_at/p.deleted_at bor). Bu create'dagi requireSellableActive (faqat variant.active) bilan IZCHIL, shu sabab qaytarish sababi emas.

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Tayyorlik ko'rsatkichi F5 bo'yicha rezervdan hisoblanadi (07 sikllaridan emas) — 3 qatordan 2 tasi band bo'lganda 2/3 (AC4)

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz javobida qoldiq 30 dan katta bo'lsa aniq son qaytmaydi

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz o'zganing buyurtmasini GET qila olmaydi (403)

coder-ep-10-t02-s04 yangiladi

Yangilandi: commit_sha

coder-ep-10-t02-s04 statusni o'zgartirdi Ishlanyapti → Review

coder-ep-10-t02-s04 izoh qoldirdi

2026-08-29 kontrakt o'zgarishi (b441b81) bo'yicha bajarildi: qty_reserved -> MaskedQty (uch endpoint), GET /orders/me/catalog yangi endpoint qo'shildi (OrderSelfController + OrderService.listCatalog, ProductVariantService#searchCatalog/ProductCatalogQueryRepository, StockService#getAvailableQty). Maska yagona QtyMaskingService orqali. 60/60 test yashil (OrderCreate/Update/List/CatalogControllerTest). openapi/ o'zgarmadi. Diqqat: GET /orders/me/catalog EP-10-T02-S04 board itemida alohida AC sifatida yozilmagan edi (faqat AC3675 bor edi) - kontrakt commit matni (b441b81) buni shu bargga bog'lagani sababli shu yerda amalga oshirildi; agar lead boshqacha joylashtirishni istasa (mas. alohida barg), fayllar mustaqil ko'chirilishi mumkin.

coder-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz javobida qoldiq 30 dan katta bo'lsa aniq son qaytmaydi

coder-ep-10-t02-s04 fayllarni qayd etdi

19 ta fayl qayd etildi

coder-ep-10-t02-s04 statusni o'zgartirdi Tayyor → Ishlanyapti

Agent ishni boshladi

coder-ep-10-t02-s04 ishga oldi

team-lead-pm statusni o'zgartirdi Bloklangan → Tayyor

Blok yechildi: biznes qarori olindi (2026-08-29) — qoldiq maskasi SERVER tomonida, mijoz katalogi 06_orders kontraktida. Kontrakt b441b81 bilan yangilandi: GET /api/v1/orders/me/catalog + MaskedQty {level: exact|many, qty} (>30 da qty=null, aniq son mijozga umuman yuborilmaydi); qty_reserved ham maskaga o'tkazildi. CAPTURE #38.

qa-ep-10-t02-s04 izoh qoldirdi

QA natijasi (commit fdf471a, izolyatsiyalangan worktree /tmp/qa-s04, HOLAT O'ZGARTIRILMADI — barg `blocked` bo'lib qoladi, AC3675 tegilmadi). VERDIKT: AC3674 ✓ · AC3676 ✓ (ikkalasi ham mutatsiya bilan tasdiqlandi). TEST: OrderListControllerTest — 10 test, 0 failure, 0 error (surefire XML). AC3674 (mijoz egaligi, 403): · OrderService.java:362-380 getForRequester — findOrThrow AVVAL (begona id → 404), so'ng order.view rule, so'ng aud=customer EGALIK, oxirida fail-closed 403. Kontrakt getOrder (orders.yaml 541-568) aynan 403 FORBIDDEN talab qiladi (AC13) — mos, 404-bilan-yashirish emas. · 🔴 RO'YXAT SIZISHI — ALOHIDA TEKSHIRILDI (probe test yozildi, yurgizildi, o'chirildi): aud=customer token bilan (1) GET /orders → 403, (2) GET /orders?customer_id=<o'zining> → 403, (3) GET /orders?customer_id=<O'ZGANING> → 403. Ya'ni customer_id query paramini o'zi berib ro'yxat filtrini chetlab o'tish MUMKIN EMAS — list @RequirePermission("order.view") bilan butunlay yopiq (OrderController.java:57), RequirePermissionAspect da audience istisnosi yo'q. SIZISH TOPILMADI. · Eslatma (defekt EMAS, scope): mijozning O'Z ro'yxati kontraktda alohida endpoint — /api/v1/orders/me `listMyOrders` (orders.yaml 408-450), bu bargda emas va hali yozilmagan. AC3676 (F5 = rezervdan): · Kartochka: OrderService.java:582-605 — OrderLine.fullyReserved() = qtyReserved.compareTo(qty)==0 (OrderLine.java:86-88, compareTo — scale-safe, .equals EMAS). · Ro'yxat: OrderLineRepository.java:29-32 JPQL COUNT(ol) / SUM(CASE WHEN ol.qtyReserved = ol.qty THEN 1L ELSE 0L END), GROUP BY — bitta so'rov, N+1 yo'q. Ikkala yo'l ham REZERVDAN, 07 sikllariga havola yo'q. · Fixture xilma-xilligi TEKSHIRILDI — qotib qolmagan: 0/3 (10/0, 5/2, 4/3.9999 — chegara), 2/3 (10/10, 5/2, 4/4 — AC4 misoli), 3/3, ro'yxatda 1/2 (10/6, 3/3). 3.9999 vs 4.0000 chegarasi "yaqin lekin teng emas" shoxobchasini qamraydi. MUTATSIYA (6 ta, hammasi worktree ichida, tiriк qolgani YO'Q): · M1 ownership tekshiruvi o'chirildi (if(false)) → customerCannotGetAnotherCustomersOrderButCanGetOwn YIQILDI ✓ · M2 fullyReserved() → return true → orderCardComputesReadinessRatioFromReservationAtBoundaries YIQILDI ✓ · M3 lines_total → konstanta 3 → orderListShowsReadinessRatioForEachRowWithoutNPlusOne YIQILDI ✓ · M4 JPQL SUM sharti → har doim rost (qtyReserved>=0) → orderListShows... YIQILDI ✓ (ro'yxat yo'li M2 dan mustaqil qoplangan) · M5 oxirgi fail-closed 403 → return toDetailResponse → internalUserWithoutOrderViewPermissionAndNotCustomerGetsForbidden YIQILDI ✓ · M6 @RequirePermission("order.view") list dan olib tashlandi → listingOrdersWithoutOrderViewPermissionReturnsForbidden YIQILDI ✓ Har mutatsiyadan keyin fayl cp <fayl>.orig <fayl> bilan tiklandi; yakunda grep -rn MUTANT src/ bo'sh, worktree o'chirildi, asosiy daraxt fdf471a da toza. KONTRAKT: OrderResponse (lines_total/lines_ready), OrderLineResponse (qty_reserved/fully_reserved) maydonlari mos; SORTABLE_FIELDS = kontrakt nomlagan 6 maydon (created_at, received_at, ready_at, total_amount, order_number, status), default created_at,desc — mos; xatolik kodlari 400/401/403/404 mos. Drift yo'q. QAMROVDAGI BO'SHLIQ (bu ikki mezonga tegishli EMAS, T02 yopilishidan oldin yopilsin): · `sort` uchun test yo'q — na yaroqsiz qiymat (400 VALIDATION_ERROR, OrderService.java:643-666), na R7 ning asosiy stsenariysi `?status=ready_to_deliver&sort=ready_at,asc`. resolveSort mutatsiyasini ushlaydigan test yo'q. · list da org-node doirasi (kontrakt: "ichki foydalanuvchi ro'yxati — org-node doirasida") kod darajasida majburlanmagan: organization_id faqat ixtiyoriy filtr — order.view egasi filtrsiz BARCHA node buyurtmalarini ko'radi. Bu naqsh loyihada boshqa ro'yxatlarda ham shunday, shuning uchun bu bargning defekti deb belgilanmadi — PM qarori kerak.

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Tayyorlik ko'rsatkichi F5 bo'yicha rezervdan hisoblanadi (07 sikllaridan emas) — 3 qatordan 2 tasi band bo'lganda 2/3 (AC4)

qa-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz o'zganing buyurtmasini GET qila olmaydi (403)

coder-ep-10-t02-s04 statusni o'zgartirdi Ishlanyapti → Bloklangan

AC3675: qoldiq maskasi ("30 tagacha/ko'p") kontraktda GET /orders*/GET /orders/{id} javob sxemalarida yo'q (openapi/v1/orders.yaml SPEC BO'SHLIQLARI p.4, satr 147-152) — module doc §8.1-2 (satr 857-861) bu qoidani buyurtma YARATISH oqimidagi KATALOG ekraniga (02_products, EP-10-T08-S01) bog'laydi, 06_orders GET endpointlariga emas. Batafsili izoh — /comment yozuvida. AC3674/AC3676 kod+test bilan yopildi, commit fdf471a.

coder-ep-10-t02-s04 izoh qoldirdi

AC3674/AC3676 kod + test bilan yopildi (10/10 yashil, commit fdf471a). AC3675 ("mijoz javobida qoldiq 30 dan katta bo'lsa aniq son qaytmaydi") uchun BLOCKED: muzlatilgan kontraktda (openapi/v1/orders.yaml) GET /orders va GET /orders/{id} javob sxemalarida (OrderResponse/OrderLineResponse/OrderDetailResponse, satr 1747-2065) qoldiq/ombor mavjudligini ifodalovchi HECH QANDAY maydon yo'q. Kontraktning o'zi buni ATAYLAB shunday deb hujjatlashtirgan: fayl boshi "SPEC BO'SHLIQLARI p.4" (satr 147-152) — "06 da katalog/qoldiq endpoint'i ochilmadi (modul chegarasidan tashqarida) -> mijoz ilovasining katalog ekrani (EP-10-T08-S01) shu bo'shliqqa qaraydi", va listMyOrders tavsifida (satr 424-426) qayta takrorlangan. Module doc 06_orders.md da "30 tagacha/ko'p" iborasi FAQAT 2 joyda uchraydi: (a) §2.1 orders.source ustuni izohi (satr 149, sof eslatma) va (b) §8.1-2 (satr 857-861) — bu band aniq "2. Tovarlar ro'yxati: nom, kod, kategoriya, narx, rasm; qoldiq — ..." deb, YANGI BUYURTMA YARATISH oqimidagi KATALOG/TOVAR RO'YXATI ekranini tasvirlaydi, GET /orders (mavjud buyurtmalar ro'yxati) yoki GET /orders/{id} (buyurtma kartochkasi) EMAS. Xulosa: bu mezon 06_orders modulining GET /orders*/GET /orders/{id} doirasiga umuman tegishli emas — u 02_products/03_warehouse katalog-ko'rish endpoint'iga (hali ochilmagan, mijoz mobil katalogi EP-10-T08-S01) tegishli. Taxmin qilib yangi maydon/mantiq to'qimadim (skill qoidasi: "kontraktda yo'q bo'lsa -> blocked"). So'rov: (1) bu mezon EP-10-T02-S04 dan olib tashlanib tegishli katalog task'iga ko'chirilsinmi, yoki (2) agar chindan ham order javobiga tegishli deb topilsa — qaysi endpoint/maydon/qiymat shakli (masalan qty_available yoki mask string "ko'p") erp/ sessiyasida aniqlanib kontraktga (openapi/v1/orders.yaml yoki products/warehouse.yaml) yozilishi kerak.

coder-ep-10-t02-s04 yangiladi

Yangilandi: branch, commit_sha

coder-ep-10-t02-s04 qabul mezonini belgiladi

✓ Tayyorlik ko'rsatkichi F5 bo'yicha rezervdan hisoblanadi (07 sikllaridan emas) — 3 qatordan 2 tasi band bo'lganda 2/3 (AC4)

coder-ep-10-t02-s04 qabul mezonini belgiladi

✓ Mijoz o'zganing buyurtmasini GET qila olmaydi (403)

coder-ep-10-t02-s04 fayllarni qayd etdi

6 ta fayl qayd etildi

coder-ep-10-t02-s04 statusni o'zgartirdi Backlog → Ishlanyapti

Agent ishni boshladi

coder-ep-10-t02-s04 ishga oldi

pm-agent yaratdi

Ro'yxat va kartochka — GET /orders, GET /orders/{id}