docs: sync from backend 804bb99 — PG serialization & id resolution fixes (v2.8.52)

09 - Audits/Activity Log.md

@@ -528,4 +528,28 @@ Deployed to dev via CI; admin verifies create-user and create-request flows in U
 
 ---
 
+### 2026-06-03 — backend@804bb99, frontend@714dfbd — fix PG response serialization & id resolution (v2.8.52)
+
+**Commits:** `804bb99` (backend), `714dfbd` (frontend)
+**Touched (backend):** `src/services/marketplace/PurchaseRequestService.ts`,
+`src/services/chat/ChatService.ts`, `src/db/repositories/drizzle/DrizzleChatRepo.ts`,
+`src/db/repositories/drizzle/DrizzleMarketplaceRepo.ts`
+**Touched (frontend):** request list views (buyer/seller/admin), `src/socket/hooks/use-purchase-requests.ts`,
+`src/types/marketplace.ts`
+**Why:** After v2.8.51, request detail pages opened `/purchase-requests/[object Object]` and the
+seller request list returned 500. Root causes (all PG-path):
+1. `mongoCompatId` returned `{toString: () => id}` — JSON.stringify drops functions, so every
+   response carried `_id: {}`. Now a plain string; chat compat ObjectIds get `toJSON()` instead.
+2. `findPurchaseRequests` passed unresolved legacy 24-hex user ids into uuid column comparisons
+   (PG cast error → 500); the route's Mongo-style `$or` filter was silently ignored (privacy:
+   non-admin users saw all requests). Both fixed — ids resolved up front, `$or` honored.
+3. 16 `resolveId(...) ?? originalId` fallbacks replaced with a nil-UUID fallback (500 → empty/404).
+4. Frontend reads `request.id || request._id` everywhere (tolerates both API shapes).
+**Verification:** 47 backend tests green, tsc clean both repos, eslint clean. Deployed to dev via
+CI; admin verifies: request detail page, seller request list, chat.
+**Linked docs updated:** none beyond this log (API id semantics documented in Marketplace API as
+needed later).
+
+---
+
 <!-- Add new entries above this line. Newest at top. -->