@bongos/core 1.19.644 → 1.19.646

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.644",
-  "core_contract": "1.19.644",
-  "source_commit": "cdc649c80e371715361cb64f295771663d028801",
+  "core_version": "1.19.646",
+  "core_contract": "1.19.646",
+  "source_commit": "9648a16f755cae6136582c0d0ca4930a566a11af",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T17:41:14.263Z",
+  "built_at": "2026-09-10T18:10:26.956Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2600,
-  "tree_sha256": "8c4305075a816844d4abcbe56b413fa30c26237b066800b86dc6c4b348bef90b",
+  "tree_sha256": "69d3719087a6b6e7fb7c1a0d4889c6bf272f0258a7d7cc72458179525775f6df",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -172,7 +172,7 @@
     {
       "path": ".claude/skills/grade-recover/SKILL.md",
       "mode": "0000644",
-      "sha256": "51cf032ec08279f0f6cbd22a528493917b674ce87f007bcc54eb9ef94a8aad22"
+      "sha256": "4dbbf04c19558b33332d9ba1bb8747198ded19e1a3af06ef72ede58ee4eb95ad"
     },
     {
       "path": ".claude/skills/grader-health/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "013f4da6dd306f5c4107b1527c38e9a422511b7b81e1ac7b33a2239c3e14c302"
+      "sha256": "f4ceea78bdb8f6ba5fec64415aed58610a8ab011d3a8b550e517515904c8cfce"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5547,12 +5547,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "5e7bdb2c09e1e62aacb4b40843392e2c1ca1534a69191c00c3103a257f086c31"
+      "sha256": "b3df5f0d4273f44af60a7e09a8bef026a0f02085c7823c7912c70d067e55e127"
     },
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
-      "sha256": "ddedb76f43edbe3e7c918578fda94b97cb3822d97074af33393791fb1ec1cbef"
+      "sha256": "da653f475d6c91db8e84bff46c797bb68b61e48d561eacf7bfd228a119ac7266"
     },
     {
       "path": "modules/ideas/templates.js",
@@ -7722,12 +7722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f96527ae9191d470397057ba5d9df620b485cfac53854b04c6b4a9f4b2dd0073"
+      "sha256": "8def408bd91446b93b180b2696465b9bedaf1f8ebe15c671cd4f66a41f6b03da"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "11cc56ca7e914c5f0956f4c65d277cf92ca8098e62d987a907a43033886570ae"
+      "sha256": "62ee3c0059ddc570ef2fef4f2288b7714d9eb95f64d390f67720eb7d07c92cd5"
     },
     {
       "path": "public-docs/index.html",
@@ -7982,7 +7982,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "2d05a5e1dcb3a37480d42f6e0b30b26432a3fe02d671482f2d3762acb7bdb556"
+      "sha256": "cf333976f3c8fc9cfa1af57a121e5ee1f826d40fe7461bf1e32f939a59523663"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -8862,7 +8862,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "95b5fa325ea0407dd6cd3d9ae3a03a0a0f0478a0bfcf76d77cf36b13a7c36bea"
+      "sha256": "9853e719e4a695cc52ec9089298d05163210ed3b51ca9eceb7553bc0ed9c65bd"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8882,7 +8882,7 @@
     {
       "path": "scripts/gds/ship-honesty.js",
       "mode": "0000644",
-      "sha256": "32827178a46cc01c36c422e1adef433be99492e8444a8affbe51e5e8c1e8ce9f"
+      "sha256": "29116265032b48115c31df794aa4689e7ce3f5eaeef152ea1ca2390dc2078c39"
     },
     {
       "path": "scripts/gds/ship-io.js",
@@ -9217,7 +9217,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "8ee4e492d700f44d80c3e2deead51cc468f4c62fe3e473497f7b003a7aec8480"
+      "sha256": "88e734e42d8fd15ba24d75cafcc611de90e16362200e198e9a9bc4ee825bfbaf"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -9482,7 +9482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9784cea15d64b5a9b88797988bfd3e863c9a4d44b45126c77a9502d87ae5a2b0"
+      "sha256": "bb3a06612cea7d25b04efabda8659ed8a71b66859bab279f9b4e8a1e5dbadff3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9742,7 +9742,7 @@
     {
       "path": "tests/auth_page_gate.mjs",
       "mode": "0000644",
-      "sha256": "3ed218eada5e36170217ded839fdc80d1cbad4ec71086d9707f00115d6c622d2"
+      "sha256": "8011ca574306df12ae1e046e6a37ca9e779b29ad26d2bfc0508ae8d6b9f5a0b2"
     },
     {
       "path": "tests/auth_resolve_failure.mjs",
@@ -10067,7 +10067,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "e67c44808dda0823a4b2b0e4ddd4ea70735f33a41c335c2d4b168f39eb9807ad"
+      "sha256": "b0474476af85716848114d345f4be67beb2e01ad3ceab36a25d474c3e9e536c5"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -10502,7 +10502,7 @@
     {
       "path": "tests/filing_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "2a6de0e7411bb4796fe4f301af77c33f08a99307f2298ed83cd32c38cf059dc5"
+      "sha256": "815f2fa2ffd6e7a721507852d43b0490115a0b15393670f6035626bdf000e99c"
     },
     {
       "path": "tests/first_admin_bootstrap.mjs",
@@ -10902,7 +10902,7 @@
     {
       "path": "tests/government_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "eff61f5299bcaaf21e19dfa84eb4ff6b92d480f708568bc243e784953d1db40a"
+      "sha256": "8ae3eaaf0b7d9a0e93d58eda3d877abe4f59bed25ffbcdc4e42a67497398debf"
     },
     {
       "path": "tests/government_resolver.mjs",
@@ -12517,7 +12517,7 @@
     {
       "path": "tests/ship_cannot_lie.mjs",
       "mode": "0000644",
-      "sha256": "82f6f951cc50c34860545be0f309e18a796ebb5baa712ccb341e1fd0dd72a233"
+      "sha256": "d8d99b6cd465b04eaf13790b0bdfe9a76ce36d77660407d3a2c6a17ac7852e8c"
     },
     {
       "path": "tests/ship_card.mjs",

package/.claude/skills/grade-recover/SKILL.md

@@ -58,12 +58,14 @@ The panel ran and rejected the work. Recover by fixing, not by re-rolling:
 1. **Group `issues[]` by severity, then by worker.** Nit/minor findings are advisory by rubric policy — they cannot have caused the fail on their own, so do not start there. The fail came from blocker/major findings (or a gating axis under threshold).
 2. **For each blocker/major finding, add a checked-in `tests/*.mjs` case** that reproduces it, then fix until green. The grader treats throwaway verification as unverified — the committed test is what makes the fix real.
 3. **Fix real findings once; do not chase re-worded restatements** of a point you already answered (answer it in the commit or with a tracked task ref instead).
-4. Commit on the claim branch — the grader reads committed history — then:
+4. Commit on the claim branch — the grader reads committed history — then re-grade, saying how each finding was answered:
 
 ```bash
-node scripts/gds/ship.js <id> --regrade
+node scripts/gds/ship.js <id> --regrade --response-file response.md
 ```
 
+**`--response` is how you answer a finding; `--notes` is not** (task 1003702). The panel is given the task, your value summary, the changed files and the diff — it never reads ship notes, on a re-grade or on the first ship. `--response` rides to the panel fenced as the prior round's answer, so an already-answered finding cannot re-veto on re-wording alone. Passing `--notes` used to be accepted and silently dropped; it is now refused with this same guidance. Evidence itself still belongs in the **diff** — a committed test is what makes a fix real (step 2), and the panel can read every changed file.
+
 ### Not recoverable here — `REFUSED (authorization)`
 
 A grade block naming protected surfaces above your rank is an authorization wall, not a quality verdict: no re-grade at your rank can land that diff as-is. Split the protected files out of the diff and re-ship the rest, or hand the task to a builder at/above the floor the refusal names.

package/docs/module-api-changelog.md

@@ -1737,5 +1737,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.642 with no explicit bump. run 34509123612. (task 1002620)
   1.19.644 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.643 with no explicit bump. run 34509682128. (task 1002620)
+  1.19.645 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.644 with no explicit bump. run 34511775606. (task 1002620)
+  1.19.646 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.645 with no explicit bump. run 34512629504. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/routes/inbox.js

@@ -39,6 +39,9 @@ const inbox = require('../inbox');
 // and the deterministic scorer (R142) — both pure, both walk the declaration.
 const { validateFieldValues, templateFor, fieldOrder } = require('../templates');
 const { completenessScore, weakestSectionPayload, scoreFieldValues } = require('../completeness');
+// The trusted tier, spelled once (task 1003197 (D)) — routing.js owns METIC_PLUS
+// and already names 'criterion-proposal' in NEVER_ROUTE_KINDS.
+const { mayProposeCriterion, METIC_PLUS } = require('../routing');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('ideas');
 const { validateOrRespond, LIMITS, parseId } = api;
@@ -93,9 +96,16 @@ module.exports = function buildInboxRouter() {
     })) return;
     const body = req.body || {};
     if (body.kind === 'criterion-proposal') {
-      const rank = (req.builder?.rank || '').toLowerCase();
-      if (rank && rank !== 'metic' && rank !== 'archon') {
-        return res.fail('rank_forbidden', 403, { required: ['metic', 'archon'], actual: rank, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
+      // FAIL CLOSED (task 1003197 (D)). This was inline and read
+      // `if (rank && rank !== 'metic' && …)`, so an ABSENT rank ADMITTED. The
+      // predicate now sits with the one trusted-tier definition (routing.js), pure
+      // and denying by default. Still a rank test rather than
+      // requirePermission('idea.triage'): the gate is conditional on the request
+      // BODY, and requirePermission is route-level middleware that cannot be mounted
+      // per-payload — which is why that atom's catalog `guards` note names only
+      // PATCH /inbox/:id. Same audience either way; idea.triage floors at metic.
+      if (!mayProposeCriterion(req.builder?.rank)) {
+        return res.fail('rank_forbidden', 403, { required: [...METIC_PLUS], actual: req.builder?.rank ?? null, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
       }
     }
     // Full Idea capture (task 1002919 / BV1.R143). Only 'full' means anything

package/modules/ideas/routing.js

@@ -49,6 +49,25 @@ const NEVER_ROUTE_KINDS = new Set(['criterion-proposal', 'decision']);
 // separate, load-bearing gates (R05), and this decision is subordinate to both.
 const METIC_PLUS = new Set(['metic', 'archon']);
 
+// Who may FILE a kind='criterion-proposal' (V3.R87 / #306) — the same trusted tier,
+// read from the one definition above rather than a second copy. A proposal reshapes
+// the next version's scope-truth, so it is a trusted write even though ordinary
+// filing is open to everyone; POST /inbox asks this so a Xenos cannot slip one in by
+// raw curl after the /planning-session skill refuses to run for them.
+//
+// FAIL-CLOSED (task 1003197 (D)). The route held this inline as
+// `if (rank && rank !== 'metic' && …)`, so an ABSENT rank ADMITTED. Unreachable
+// today — builders.rank is NOT NULL behind an enum CHECK and requireBuilder 401s
+// first — but the gate was leaning on a schema invariant it never stated, and an
+// unknown rank is not evidence of authority. Case-insensitive but NOT trimmed:
+// 'METIC ' is a hostile shape, not a rank. Non-strings stringify and refuse rather
+// than throwing on .toLowerCase(). Lives here beside NEVER_ROUTE_KINDS, which
+// already names this same kind, and keeps the trusted tier spelled ONCE
+// (tests/filing_abuse_matrix.mjs holds both lines).
+function mayProposeCriterion(rank) {
+  return METIC_PLUS.has(String(rank ?? '').toLowerCase());
+}
+
 // A Full Idea (grade='full') is the Board Room's subject — it is ratified by
 // peers (goal 1000069), not converted into a task by its own filer. 'spark' and
 // 'quick' carry no such meaning and route normally.
@@ -292,4 +311,5 @@ module.exports = {
   NEVER_ROUTE_KINDS,
   HOMELESS_ROUTING_VECTORS,
   METIC_PLUS,
+  mayProposeCriterion,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.644",
+  "version": "1.19.646",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.644",
+      "version": "1.19.646",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.644",
+  "version": "1.19.646",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -431,7 +431,20 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       landedNow[name] = { module: mod.key, source: `.claude/skills/${name}`, coreShipped: true };
     }
   }
-  const withdrawable = Object.keys(landedPreviously).filter((n) => SKILL_NAME_RE.test(n) && !landedNow[n]);
+  // A name the CORE ships now is the core's, whatever an older manifest said — a core
+  // skill can take over a name a module once owned, and step 1 copies it in on this very
+  // run. Without this guard 1c deleted it again immediately (task 1003818, a regression
+  // in 1003632's own first cut). materializeModuleSkillsIntoCore states the same rule for
+  // the checkout side via its `tracked(name)` check; this is the instance-side twin.
+  //
+  // The `!skipSkills.has(name)` half is load-bearing, not belt-and-braces: when a DISABLED
+  // module declares a core-shipped name, step 1 SKIPS the copy (that is the task 2103b
+  // exclusion), so the instance's dir really is stale and must still be withdrawn. Keeping
+  // it on the strength of "the core ships this name" would resurrect exactly the bug 1c
+  // exists to fix. Deliberately asked of the CORE source tree rather than the roster, so a
+  // name no enabled module declares any more is still recognised as legitimately sourced.
+  const coreShipsNow = (name) => fs.existsSync(path.join(skillsSrc, name)) && !skipSkills.has(name);
+  const withdrawable = Object.keys(landedPreviously).filter((n) => SKILL_NAME_RE.test(n) && !landedNow[n] && !coreShipsNow(n));
   if (!overwrite) {
     // adopt mode never clobbers what the owner already has; withdrawing is a clobber.
     if (withdrawable.length) summary.notes.push(`${withdrawable.length} skill(s) of a now-disabled module were left in place (adopt mode does not withdraw): ${withdrawable.sort().join(', ')}.`);

package/scripts/gds/ship-flow.js

@@ -9,7 +9,7 @@
 'use strict';
 
 const { cliClient, requireSession, arg, detectWorktreeName } = require('./cli-lib');
-const { resolveProse, markShipProgress, smokeGateMessages } = require('./ship-honesty.js');
+const { resolveProse, markShipProgress, smokeGateMessages, proseFlagPresent, regradeNotesRefusal } = require('./ship-honesty.js');
 const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
 const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-map');
 const { matchOne } = require('../../src/bongos/path-match');
@@ -684,6 +684,16 @@ async function regradeMain() {
     console.error('usage: node scripts/gds/ship.js <task-id> --regrade [--summary-file <path|-> | --summary "..."] [--response-file <path|-> | --response "..."] [--no-merge] [--force] [--verified] [--base <ref>]');
     process.exit(2);
   }
+  // task 1003702: refuse --notes rather than swallowing it. The reasoning — why
+  // a refusal and not a persist — is in ship-honesty.js above regradeNotesRefusal
+  // and is not repeated here. What is load-bearing at THIS call site is the
+  // POSITION: before the preflight and before any grade spend, because a refusal
+  // that first costs a 4-worker panel run is barely better than the silence it
+  // replaces. tests/ship_cannot_lie.mjs pins that order.
+  if (proseFlagPresent(args, 'notes')) {
+    for (const line of regradeNotesRefusal(taskId)) console.error(line);
+    process.exit(2);
+  }
   const regradeProse = resolveProse(args, ['summary', 'response']);
   const summaryArg = regradeProse.summary;
   // task 1002662: the builder's response to the prior round's findings — how
@@ -753,6 +763,17 @@ async function regradeMain() {
   // re-grade is the FIRST time this task actually ships. Fall back to the
   // task's stored value_summary so the merge commit + Discord #ship-news post
   // carry meaningful text even when --summary is omitted.
+  //
+  // AND IT NEVER REACHES THE TASK ROW — task 1003702's acceptance 3 asked this
+  // question; the answer is a real, separate defect, filed as task 1003817.
+  // `summary` from here feeds the grader prompt, the merge commit message and
+  // the PR title/body, and NOTHING writes it back to tasks.value_summary. All
+  // three candidate write paths were read and ruled out: publish-branch accepts
+  // value_summary but uses it only for PR text; PATCH /tasks/:id does not accept
+  // the field at all; the claim-resolve route is the sole writer and a re-grade
+  // has no claim (which is why claimLike is synthesized above). Fixing it needs
+  // a server route change, so it is deliberately NOT folded into this CLI fix.
+  // tests/ship_cannot_lie.mjs pins both halves of that so the answer cannot rot.
   const summary = summaryArg || task.value_summary || '';
 
   // The grader helpers want a claim-like object for touches[] (preflight's
@@ -848,6 +869,11 @@ async function regradeMain() {
     card: {
       title: task.title,
       valueSummary: summary,
+      // Empty by design, not by omission (task 1003702). A re-grade takes no
+      // --notes at all now — it is refused above — so there are none from THIS
+      // round to show. The first ship's notes are the durable record and live on
+      // the resolved claim; re-printing them here would suggest this round
+      // produced them.
       notes: '',
       files: committedFiles,
       baseline: graderBaseline,

package/scripts/gds/ship-honesty.js

@@ -143,8 +143,61 @@ function smokeGateMessages(taskId) {
   };
 }
 
+// ---- --regrade must not swallow --notes (task 1003702) ----------------------
+//
+// THE THIRD WAY TO LOSE THE BUILDER'S PROSE, and the reason this lives in the
+// prose-loss file rather than beside regradeMain. `--regrade` resolves only
+// `summary` and `response`, so `--notes` parsed as an unknown flag, produced no
+// error, and vanished. A builder answering a "no evidence in the notes" blocker
+// passed it again in --notes, saw the ship run, and got the identical finding
+// back marked unanswered — with nothing anywhere saying why.
+//
+// AND THE FIX IS A REFUSAL, NOT A PERSIST, because the premise the bug was filed
+// under is wrong in the builder's favour: the panel NEVER reads ship notes, on a
+// first ship or a re-grade. modules/grading/grader-prompt.js buildPrompt() puts
+// the task row, the VALUE SUMMARY, the changed files, the diffstat and the diff
+// in the prompt and nothing else, and the workers get the same bundle. So
+// storing the notes would have fixed the silence and none of the substance: the
+// builder would pass --notes, watch it save, and STILL get "unanswered" — a
+// worse failure, because now it looks like it worked.
+//
+// The two channels that do reach the panel are named in the refusal: --response
+// (fenced into the prior-round block, task 1002662) and the DIFF itself, which
+// is why the workaround that actually worked on task 1003698 was committing the
+// evidence as a file. Nothing is written and nothing is lost: the first ship's
+// notes stay the durable ledger record, which is the one thing --notes on a
+// re-grade could legitimately have meant.
+function proseFlagPresent(args, name) {
+  const list = Array.isArray(args) ? args : [];
+  return list.some((a) => a === `--${name}` || String(a).startsWith(`--${name}=`)
+    || a === `--${name}-file` || String(a).startsWith(`--${name}-file=`));
+}
+
+// Pure so the refusal's WORDING is testable — a message that fails to name the
+// alternative is the same dead end with an error code on it.
+function regradeNotesRefusal(taskId) {
+  return [
+    '--regrade does not take --notes, and your notes have NOT been saved or graded.',
+    '',
+    'The grader never reads ship notes — not on a re-grade, and not on the first ship.',
+    'The panel is given the task, your VALUE SUMMARY, the changed files and the diff.',
+    'So notes cannot answer a finding, and silently keeping them would only look like it had.',
+    '',
+    'Put the evidence where the panel can actually see it:',
+    `  --response "..."   answers the prior round's findings; it rides to the panel fenced.`,
+    `  --response-file <path>   the safe form for prose (a shell eats backticks in an inline value).`,
+    '  the DIFF           commit the proof — a test, a dry-run log, a session-log file.',
+    '                     The panel reads the committed diff and can Read every changed file.',
+    '',
+    `  node scripts/gds/ship.js ${taskId} --regrade --response-file notes.md`,
+    '',
+    "The first ship's notes stay the durable record; nothing you wrote earlier was lost.",
+  ];
+}
+
 module.exports = {
   resolveProse, markShipProgress, fatalRecoveryLines, smokeGateMessages,
+  proseFlagPresent, regradeNotesRefusal,
   _resetForTest: () => { shipProgress = { stage: 'preflight', taskId: null }; },
   _peekForTest: () => shipProgress,
 };

package/src/bongos/auth.js

@@ -117,10 +117,15 @@ async function resolveSession(req) {
 //
 // A SESSION-SCOPE CAN ONLY EVER NARROW. Effective authority is (what the builder's
 // roles confer) ∩ (what this session's scope allows), with the allow-list
-// DENY-BY-DEFAULT. The intersection itself lives in the governance resolver
-// (resolveSessionPermissions — the composed answer the tab and permission gates
-// read); THIS file carries its route-reachability projection: "is this route
-// inside the session's scope at all". That projection is deliberately the ROLE-FREE
+// DENY-BY-DEFAULT. The governance resolver COMPOSES that intersection
+// (resolveSessionPermissions), but nothing on the request path reads it — it is
+// exported on the `government` port and exercised by
+// tests/government_session_scope.mjs, and that is the whole of its live use. The
+// ENFORCEMENT is the kernel's own route-reachability projection below: "is this
+// route inside the session's scope at all", run by requireBuilder and by
+// runPageGate. This comment used to say the permission gates read the resolver's
+// composed answer; they never have, and the next reviewer should not lose an hour
+// to that ghost (task 1003197 (B)). The projection is deliberately the ROLE-FREE
 // half — folding the builder's roles in here would change who can reach the
 // bootstrap routes (a builder on a rank with no seeded governance role resolves to
 // zero permissions by design — see tests/government_parity.mjs Part D), and R99 is
@@ -352,11 +357,15 @@ function signInWithReturn(req) {
 // unauthorized request is bounced before the file is ever served (curl-proof,
 // JS-disabled-proof). The client-side link-hiding in the hall is cosmetic UX.
 //
-// Each gate asks TWO questions, in order:
+// Each gate asks THREE questions, in order:
 //   1. IDENTITY  — is there a live session? (token from the gds_session cookie /
 //      legacy pms_session / Bearer, looked up fresh against builder_sessions).
 //      No → 302 into the web sign-in flow.
-//   2. AUTHORITY — does the builder HOLD the page's catalog permission, resolved
+//   2. SCOPE     — is a page inside this SESSION's scope at all? A narrowing scope
+//      (a box-baked token) reaches no page, whatever its builder's rank, exactly as
+//      requireBuilder denies it every route that declared nothing (task 1003197).
+//      No → 302 into the web sign-in flow: the remedy is a different session.
+//   3. AUTHORITY — does the builder HOLD the page's catalog permission, resolved
 //      per request through the `governance` port exactly as requirePermission
 //      does? No → 302 to an UNGATED hall page.
 //
@@ -504,6 +513,24 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
+  // SECURITY (task 1003197 (A)): SESSION-SCOPE, the same deny-by-default check
+  // requireBuilder runs above — the two auth paths must not diverge. resolveSession
+  // accepts a Bearer token with NO source filter, so before this a box-baked token
+  // could fetch a gated page SHELL (/builders, /watch, the tab shells) whenever its
+  // builder's rank held the page's permission. Every data endpoint underneath
+  // re-gates through requireBuilder and 403s box_scope, so the exposure was shells
+  // only — but a shell is still a surface a token living outside the ADR 0016 trust
+  // boundary was never meant to reach. Page routes declare no capability, so
+  // scopeCovers refuses EVERY narrowing scope here (and an unrecognised source with
+  // it), while an unscoped cli/web session passes untouched.
+  //
+  // Sign-in, not `deniedTo`: unlike the authority branch below, the remedy is a
+  // DIFFERENT SESSION — /builder-reauth mints a normal one — not a different page,
+  // and a box session has no browser cookie to loop the sign-in flow with.
+  if (!scopeCovers(sessionScopeFor(session.source), req.sessionScopeNeeds)) {
+    res.redirect(302, signInWithReturn(req));
+    return;
+  }
   const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
     // The rank door said no. A page whose data route admits a SECOND audience
@@ -759,6 +786,32 @@ function requirePermission(...perms) {
     const builderId = req.builder && req.builder.id;
     if (!builderId) return deny(null);
     if (required.length === 0) return deny(null);
+    // R100 (task 1003197 (C)): an ownership-scoped key has NO unconditional answer.
+    // It is parameterized by a concrete row this gate was never handed, so admitting
+    // on `held.has(key)` would collapse `.own` into `.any` — precisely the
+    // degradation the ownership axis exists to prevent. The resolver's
+    // builderHasPermissions refuses these for the same reason (resolver.js); mirror
+    // it so the kernel gate can never be the softer of the two doors. ZERO call
+    // sites pass an own-scoped key today (full enumeration, task 1003197) — this
+    // guards the future mis-authored gate that would otherwise be silently
+    // unconditional. The route wants authorizeOwned() in its handler, which cannot
+    // be called without naming the owner. LOUD, because this is a wiring bug in the
+    // route, not a fact about the caller.
+    const governance = seams.resolveOptional('government');
+    if (governance && typeof governance.isOwnershipScoped === 'function') {
+      const owned = required.filter((key) => {
+        try { return governance.isOwnershipScoped(key); } catch { return false; }
+      });
+      if (owned.length > 0) {
+        require('./logger').logger.child({ src: 'auth' })
+          .error({ keys: owned }, 'requirePermission: an ownership-scoped key cannot gate a route unconditionally — the handler must call authorizeOwned() with the row\'s owner');
+        return res.fail('permission_forbidden', {
+          status: 403,
+          message: `this route is gated on ownership-scoped permission${owned.length === 1 ? '' : 's'} ${owned.join(', ')}, which cannot be answered without a resource owner — denied fail-closed`,
+          details: { required, held: null, floors: null },
+        });
+      }
+    }
     // Shared with the page gates (R107): null = authority could not be established
     // (no port / malformed port / a throwing resolver) and is always a denial.
     // req.rawPermissionKeys rides the fold (task 1002556) when the session query

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.644'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.646'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -99,6 +99,64 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
+// ---- SESSION-SCOPE on the page path (task 1003197 (A)) ----------------------
+//
+// resolveSession accepts a Bearer token with no source filter, so before this the
+// page gate never asked the question requireBuilder asks: is a page inside this
+// SESSION's scope at all? A box-baked token (which lives on the box, outside the
+// ADR 0016 trust boundary) could therefore fetch a gated page SHELL whenever its
+// builder's rank held the page permission. The stub above resolves the permission
+// for EVERY builder, which is what makes these assertions about scope alone.
+
+console.log('\nrequireBuilderPage — session scope:');
+
+await t('box-scoped session → 302 to sign-in even though its builder holds the permission', async () => {
+  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'archon', status: 'active', source: 'box' };
+  lookupThrows = false;
+  const req = { headers: { authorization: 'Bearer boxtoken' } }; // a page route declares no scope
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'a box session must not be served a gated page shell');
+  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+    'the remedy is a different session (/builder-reauth), so sign-in — not deniedTo');
+});
+
+await t('a source the registry does not declare → denied, never treated as unscoped', async () => {
+  nextSession = { builder_id: 4, github_login: 'mystery', rank: 'archon', status: 'active', source: 'not-a-scope' };
+  const req = { headers: { authorization: 'Bearer whoknows' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'an unrecognised scope must fail closed, exactly as requireBuilder does');
+  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start');
+});
+
+await t('cli and web sessions are untouched by the scope check', async () => {
+  for (const source of ['cli', 'web']) {
+    nextSession = { builder_id: 1, github_login: 'someone', rank: 'xenos', status: 'active', source };
+    const req = { headers: { cookie: 'gds_session=validtoken' } };
+    const res = fakeRes();
+    let nexted = false;
+    await auth.requireBuilderPage(req, res, () => { nexted = true; });
+    assert.equal(nexted, true, `an unscoped ${source} session must still reach the page`);
+    assert.equal(res._redirect, null);
+  }
+});
+
+await t('a legacy session with no source field still reaches the page', async () => {
+  // The same invariant tests/box_scope_session.mjs pins for requireBuilder: absent
+  // source resolves to the UNSCOPED scope, so this gate can never lock out a real
+  // browser session minted before `source` was recorded.
+  nextSession = { builder_id: 2, github_login: 'legacy', rank: 'metic', status: 'active' };
+  const req = { headers: { cookie: 'gds_session=validtoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'absent source must never trip the page scope gate');
+  assert.equal(res._redirect, null);
+});
+
 seams._reset(); // leave the seam registry as we found it (the governance_* suites' pattern)
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/claude_materialize.mjs

@@ -318,6 +318,36 @@ t('materializeClaude: a skill the module STOPPED declaring is withdrawn too', ()
   for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
 });
 
+t('materializeClaude: a CORE skill that took over a module-owned name is NOT withdrawn — and a disabled module\'s core-shipped name still is (task 1003818)', () => {
+  // The regression this pins: step 1 copies the core's dir in, and 1c deleted it again in
+  // the SAME run, because no enabled module declared the name any more. The core-checkout
+  // twin has always guarded this via tracked() ("a core skill can take over a name a
+  // module once owned"); the instance side shipped without it in task 1003632.
+  const { core, inst, modDir } = withdrawFixture();
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });   // alpha lands, recorded
+
+  // the module stops declaring alpha; the core now ships its own
+  writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['beta'] } }));
+  mkdirSync(join(core, '.claude', 'skills', 'alpha'), { recursive: true });
+  writeFileSync(join(core, '.claude', 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\n---\nCORE OWNS THIS NOW\n');
+  const kept = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(kept.withdrawnSkills, [], 'a name the core ships now is the core\'s, whatever the manifest said');
+  assert.match(readFileSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md'), 'utf8'), /CORE OWNS THIS NOW/, 'and it is the core copy that survives');
+
+  // THE OTHER HALF, which the guard must not break: a DISABLED module declaring a
+  // core-shipped name means step 1 skips the copy, so the instance dir IS stale.
+  const inst2 = mkdtempSync(join(tmpdir(), 'wd-inst-'));
+  writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['alpha', 'beta'] } }));
+  m.materializeClaude({ coreRoot: core, instanceDir: inst2, dryRun: false });
+  assert.ok(existsSync(join(inst2, '.claude', 'skills', 'alpha')), 'landed while enabled');
+  mkdirSync(join(inst2, 'config'), { recursive: true });
+  writeFileSync(join(inst2, 'config', 'modules.json'), JSON.stringify({ modules: { foo: false } }));
+  const gone = m.materializeClaude({ coreRoot: core, instanceDir: inst2, dryRun: false });
+  assert.ok(gone.withdrawnSkills.includes('alpha'), 'a disabled module\'s core-shipped name is still withdrawn — step 1 skipped it, so the dir is stale');
+  assert.ok(!existsSync(join(inst2, '.claude', 'skills', 'alpha')));
+  for (const d of [core, inst, inst2]) rmSync(d, { recursive: true, force: true });
+});
+
 t('materializeClaude: a HAND-WRITTEN skill is never withdrawn, even when a disabled module declares its name', () => {
   const { core, inst } = withdrawFixture();
   // The owner wrote .claude/skills/alpha themselves; no materialize ever landed it,

package/tests/filing_abuse_matrix.mjs

@@ -36,6 +36,7 @@
 //   F17 get a keyword-guessed 'bug' from #ideas to mint work   → cannot: vector not trusted
 //   F18 forge/omit the vector to reach the homeless-bug door   → fail-closed, an inbox row
 //   F19 file a homeless NON-bug hoping for a free home         → inbox; only bugs get one
+//   F20 file a criterion-proposal with no/blank/padded rank    → refused, fail-closed
 //   P1  a Metic+ files a bug in an ordinary goal               → 'ready' (the C1 grant)
 //   P2  a Metic+ files into protected scope                    → allowed, floored to metic
 //   P3  a Metic+ files a HOMELESS bug from a trusted vector    → 'ready', in the maintenance goal
@@ -76,7 +77,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
 
 const routing = require('../modules/ideas/routing.js');
-const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR } = routing;
+const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR, mayProposeCriterion } = routing;
 const bugs = require('../modules/discord/discord-bugs.js');
 const { rateLimitPerHour } = bugs;
 const { scopeIncludesProtected, isModuleKey } = require('../src/bongos/module-scope-map.js');
@@ -477,6 +478,57 @@ await test('[pin] no OTHER module file mints a task from a filing without a row
     `a new filing vector must be added to KNOWN_FILING_VECTORS and given a matrix row: ${unaudited.join(', ')}`);
 });
 
+// =========================================================================
+// F20 — the criterion-proposal door (task 1003197 (D))
+// =========================================================================
+//
+// Filing is open to everyone, but kind='criterion-proposal' reshapes the next
+// version's scope-truth, so POST /inbox holds a Metic+ door in front of it. That
+// door was written `if (rank && rank !== 'metic' && …)`: an ABSENT rank walked
+// straight through. Unreachable today (builders.rank is NOT NULL behind an enum
+// CHECK, and requireBuilder 401s first) — but it was a gate leaning on a schema
+// invariant it never stated, which is the same shape as every "unreachable" bug
+// that later became reachable. The predicate is now pure and denies by default.
+
+await test('[F20] the criterion-proposal door refuses every sub-Metic shape, absent rank included', () => {
+  for (const rank of SUB_METIC) {
+    assert.equal(mayProposeCriterion(rank), false,
+      `rank ${JSON.stringify(rank)} must not be able to file a criterion proposal`);
+  }
+  // Named explicitly, because these three are the bug: they are the shapes the old
+  // `rank &&` guard ADMITTED, and a list-driven loop can lose a case silently.
+  for (const falsy of [null, undefined, '']) {
+    assert.equal(mayProposeCriterion(falsy), false,
+      'an unknown rank is not evidence of authority — the gate must fail CLOSED');
+  }
+});
+
+await test('[F20] it still admits Metic and Archon, in any casing', () => {
+  for (const rank of TRUSTED) {
+    assert.equal(mayProposeCriterion(rank), true,
+      `${JSON.stringify(rank)} is a trusted filer and must keep the door`);
+  }
+});
+
+await test('[F20] a padded rank is a hostile shape, not a rank — no trimming', () => {
+  // 'METIC ' appears in SUB_METIC on purpose. Trimming would WIDEN the audience,
+  // so the predicate lowercases and nothing else.
+  for (const padded of ['metic ', ' metic', 'archon ', '\tarchon']) {
+    assert.equal(mayProposeCriterion(padded), false);
+  }
+});
+
+await test('[F20] the route reads the domain predicate — no second copy of the door', () => {
+  const routeSrc = read('modules/ideas/routes/inbox.js');
+  const code = routeSrc.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.match(code, /mayProposeCriterion\(req\.builder\?\.rank\)/,
+    'the route must ask routing.js, so the fail-closed posture cannot drift');
+  assert.match(code, /require\('\.\.\/routing'\)/,
+    'and reach it by import, never by re-spelling the tier');
+  assert.ok(!/rank\s*&&\s*rank\s*!==/.test(code),
+    'the admits-on-falsy guard must not come back');
+});
+
 await test('[pin] there is ONE trusted-tier definition, and #bugs no longer keeps a copy', () => {
   // This pin used to assert that two spellings of "Metic+" AGREED — routing.js and
   // discord-bugs.js each carried one. R11 deleted the second, which is the better

package/tests/government_require_permission.mjs

@@ -403,3 +403,106 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     'a modules/*/routes gate still calls requireRank — migrate it to requirePermission, ' +
     'or add it to RETAINED with a "Still requireRank after BV1.R105" note explaining why');
 });
+
+// ---------------------------------------------------------------------------
+// the OWNERSHIP axis cannot gate a route (task 1003197 (C))
+// ---------------------------------------------------------------------------
+//
+// `held.has('box.manage.own')` is true for anyone whose rank carries the atom, so a
+// gate mounted on an ownership-scoped key would admit UNCONDITIONALLY — `.own`
+// collapsed into `.any`, the exact degradation the axis exists to prevent, because
+// the gate is never handed the row whose owner is the other half of the question.
+// The resolver's builderHasPermissions refuses these already; the kernel gate must
+// not be the softer door. Zero call sites pass one today — this is the guard on the
+// future mis-authored gate.
+//
+// `run` above stubs a port with resolveBuilderPermissions ONLY, so this needs its
+// own runner that also stubs isOwnershipScoped (the live port always carries it).
+async function runOwned(gate, req, { resolve, isOwnershipScoped }) {
+  seams._reset();
+  seams.registerProvider('government', { resolveBuilderPermissions: resolve, isOwnershipScoped });
+  const res = fakeRes();
+  let nexted = false;
+  await gate(req, res, () => { nexted = true; });
+  seams._reset();
+  return { res, nexted };
+}
+
+const OWNED_KEY = catalog.permissionKeys().find((k) => catalog.isOwnershipScoped(k));
+
+test('the catalog still declares at least one ownership-scoped key', () => {
+  // If the axis were ever emptied, the assertions below would pass vacuously.
+  assert.ok(OWNED_KEY, 'expected an ownership-scoped atom in the catalog (e.g. box.manage.own)');
+});
+
+test('an ownership-scoped key 403s even when the builder HOLDS it', async () => {
+  const { res, nexted } = await runOwned(
+    auth.requirePermission(OWNED_KEY), { builder: BUILDER },
+    { resolve: holding(OWNED_KEY), isOwnershipScoped: catalog.isOwnershipScoped },
+  );
+  assert.equal(nexted, false, 'holding an own-scoped atom is not an unconditional admit');
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.code, 'permission_forbidden');
+  assert.match(res._json.error.message, /ownership-scoped/,
+    'the denial must name the reason — a route wiring bug, not a missing grant');
+  assert.equal(res._json.error.details.held, null,
+    'never echo the held set on this branch: the denial is about the gate, not the caller');
+});
+
+test('one own-scoped key in a multi-key gate poisons the whole gate', async () => {
+  const { res, nexted } = await runOwned(
+    auth.requirePermission('idea.triage', OWNED_KEY), { builder: BUILDER },
+    { resolve: holding('idea.triage', OWNED_KEY), isOwnershipScoped: catalog.isOwnershipScoped },
+  );
+  assert.equal(nexted, false, 'the gate must refuse as a whole — a partial answer is not an answer');
+  assert.equal(res._status, 403);
+});
+
+test('an ordinary key still passes with isOwnershipScoped present on the port', async () => {
+  // The guard must be inert for every real gate in the tree.
+  const { res, nexted } = await runOwned(
+    auth.requirePermission('idea.triage'), { builder: BUILDER },
+    { resolve: holding('idea.triage'), isOwnershipScoped: catalog.isOwnershipScoped },
+  );
+  assert.equal(nexted, true);
+  assert.equal(res._status, null);
+});
+
+test('a throwing isOwnershipScoped does not admit and does not crash the gate', async () => {
+  // Fall through to the ordinary held check rather than 500 — but a key the caller
+  // does not hold must still deny, so the outcome is never an admit-by-error.
+  const { res, nexted } = await runOwned(
+    auth.requirePermission('government.manage'), { builder: BUILDER },
+    { resolve: holding('idea.triage'), isOwnershipScoped: () => { throw new Error('catalog blew up'); } },
+  );
+  assert.equal(nexted, false);
+  assert.equal(res._status, 403);
+});
+
+test('no route in the tree is gated on an ownership-scoped key today', () => {
+  // The enumeration the fix was written against, kept honest. A new gate mounted on
+  // an own-scoped atom would now 403 at runtime; this fails at BUILD time instead,
+  // naming the file, so nobody ships a route that can only ever deny.
+  const owned = catalog.permissionKeys().filter((k) => catalog.isOwnershipScoped(k));
+  const dirs = [path.join(ROOT, 'src', 'bongos', 'routes'), path.join(ROOT, 'modules')];
+  const offenders = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) { if (entry.name !== 'node_modules') walk(full); continue; }
+      if (!entry.name.endsWith('.js')) continue;
+      const text = fs.readFileSync(full, 'utf8');
+      for (const key of owned) {
+        // A gate is a call: requirePermission('<key>'), in any of its spellings.
+        if (new RegExp(`requirePermission\\s*\\([^)]*['"\`]${key.replace(/\./g, '\\.')}['"\`]`).test(text)) {
+          offenders.push(`${path.relative(ROOT, full)} :: ${key}`);
+        }
+      }
+    }
+  };
+  dirs.forEach(walk);
+  assert.deepEqual(offenders, [],
+    'requirePermission cannot answer an ownership-scoped key — the handler must call ' +
+    'authorizeOwned() with the row\'s owner instead');
+});

package/tests/ship_cannot_lie.mjs

@@ -14,13 +14,20 @@
 //     lands the task at 'completed' before the grade runs, and 'completed' is
 //     ALSO what a grade-failed task looks like — so a bare `fatal: <stack>`
 //     left nobody able to tell how far it got.
+//
+// (3) --regrade must not swallow --notes. Same shape as (1): prose handed to
+//     ship.js that reaches nothing, silently (task 1003702).
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const { argText } = require('../scripts/gds/cli-lib.js');
-const { fatalRecoveryLines, markShipProgress, _peekForTest } = require('../scripts/gds/ship-honesty.js');
+const {
+  fatalRecoveryLines, markShipProgress, _peekForTest,
+  proseFlagPresent, regradeNotesRefusal,
+} = require('../scripts/gds/ship-honesty.js');
 
 // Injected IO so no case touches the filesystem.
 const io = {
@@ -166,3 +173,98 @@ test('markShipProgress is the single writer, and ship.js re-exports the reader',
   assert.equal(typeof shipCli.fatalRecoveryLines, 'function', 'ship.js still exposes it');
   assert.equal(shipCli.fatalRecoveryLines, fatalRecoveryLines, 'same function, not a copy');
 });
+
+// ── (3) --regrade refuses --notes instead of swallowing it (task 1003702) ────
+//
+// The third way to lose the builder's prose, and the same incident shape as (1):
+// prose handed to ship.js that reaches nothing, with no error. --regrade
+// resolved only summary + response, so --notes parsed as an unknown flag and
+// vanished; a builder answering a "no evidence in the notes" blocker passed it
+// again there and got the identical finding back marked unanswered.
+
+test('every spelling of --notes is caught, and nothing else is', () => {
+  // All four forms argText accepts. Catching only the bare flag would leave
+  // --notes-file — the form the ship docs actively recommend for prose — silent,
+  // which is the exact defect wearing different clothes.
+  for (const argv of [
+    ['1', '--regrade', '--notes', 'x'],
+    ['1', '--regrade', '--notes=x'],
+    ['1', '--regrade', '--notes-file', 'n.md'],
+    ['1', '--regrade', '--notes-file=n.md'],
+  ]) {
+    assert.equal(proseFlagPresent(argv, 'notes'), true, `caught: ${argv.join(' ')}`);
+  }
+  // Not over-eager: the flags a re-grade legitimately takes must still pass, and
+  // a flag that merely CONTAINS the word is a different flag.
+  for (const argv of [
+    ['1', '--regrade'],
+    ['1', '--regrade', '--response-file', 'r.md'],
+    ['1', '--regrade', '--summary', 'x'],
+    ['1', '--regrade', '--no-notes-please'],
+    ['1', '--regrade', '--response', 'my --notes were wrong'],
+  ]) {
+    assert.equal(proseFlagPresent(argv, 'notes'), false, `not caught: ${argv.join(' ')}`);
+  }
+  // Generic over the flag name — it is not a --notes special case.
+  assert.equal(proseFlagPresent(['--response-file', 'r.md'], 'response'), true);
+});
+
+test('THE ACCEPTANCE: the refusal names where the evidence must go instead', () => {
+  // A non-zero exit that does not say what to do is the same dead end with an
+  // error code on it. The refusal has to carry the working channel, or a builder
+  // reads "not supported" and goes back to putting evidence nowhere.
+  const text = regradeNotesRefusal(1003698).join('\n');
+  assert.match(text, /--response/, 'names the channel that reaches the panel');
+  assert.match(text, /--response-file/, 'and its file form, the safe one for prose');
+  assert.match(text, /diff/i, 'and the diff, which is what the panel actually reads');
+  assert.match(text, /ship\.js 1003698 --regrade/, 'a runnable command with the real task id');
+  // It must not be reassuring about the thing that did not happen.
+  assert.match(text, /NOT been saved/, 'says plainly that the notes went nowhere');
+  // And it must not claim the notes were merely "not supported yet" — the
+  // substantive fact is that the grader never reads ship notes at all, so a
+  // builder does not go looking for a flag that would make them count.
+  assert.match(text, /never reads ship notes/, 'explains WHY, not just that it refused');
+});
+
+test('the refusal is wired into the regrade path, before any grade spend', () => {
+  // Wiring proof (the (1) lesson: a helper nothing calls is not a fix). Also
+  // pins the ORDER — a refusal that costs a 4-worker panel run first is barely
+  // better than the silence, so the guard must precede the preflight.
+  const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+  const regrade = src.slice(src.indexOf('async function regradeMain'));
+  const guard = regrade.indexOf("proseFlagPresent(args, 'notes')");
+  assert.ok(guard !== -1, 'regradeMain consults the guard');
+  const preflight = regrade.indexOf('preflight(claimLike');
+  assert.ok(preflight !== -1 && guard < preflight, 'it refuses before the preflight and the panel');
+  // The usage line must not advertise a flag the path refuses.
+  const usage = regrade.slice(0, regrade.indexOf('resolveProse'));
+  assert.ok(!/--notes/.test(usage.replace(/proseFlagPresent[^\n]*/g, '')
+    .replace(/\/\/[^\n]*/g, '')), 'usage does not offer --notes');
+});
+
+test('ACCEPTANCE 3: --summary reaches the GRADER on a re-grade but never the task row', () => {
+  // Task 1003702's third acceptance asked whether --summary reaches the stored
+  // value_summary on a re-grade. It does NOT, and that is a separate defect
+  // filed as task 1003817 (it needs a server route change; this task's fix is
+  // CLI-only). Pinned here rather than left in prose for the reason this whole
+  // file exists: the panel reads the DIFF, so an answer that lives only in ship
+  // notes is an answer nobody can check — which is the very bug task 1003702 is.
+  const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+  const regrade = src.slice(src.indexOf('async function regradeMain'));
+  const code = regrade.replace(/\/\/[^\n]*/g, ''); // comments describe, they do not write
+
+  // Half one — the threading is intact, so nothing regressed: --summary still
+  // falls back to the stored value and still reaches the grader and the card.
+  assert.match(code, /const summary = summaryArg \|\| task\.value_summary/,
+    'the stored summary is still the fallback when --summary is omitted');
+  assert.match(code, /gradeAndRecord\(\{[\s\S]{0,200}?summary,/,
+    'the summary still reaches the grader prompt');
+  assert.match(code, /valueSummary: summary/, 'and the completion card');
+
+  // Half two — and there is no writer. A `value_summary:` KEY would be a request
+  // payload; the legitimate read is `task.value_summary`, dot-access. If someone
+  // later adds the write (task 1003817), this assertion is what tells them to
+  // update the comment above `const summary` rather than leave it lying.
+  assert.ok(!/[^.]\bvalue_summary\s*:/.test(code),
+    'regradeMain writes value_summary nowhere — see task 1003817');
+});