@bongos/core 1.19.645 → 1.19.646

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.645",
-  "core_contract": "1.19.645",
-  "source_commit": "14b1d4c19840d818f49d383ed7c50189913860ac",
+  "core_version": "1.19.646",
+  "core_contract": "1.19.646",
+  "source_commit": "9648a16f755cae6136582c0d0ca4930a566a11af",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T18:02:00.629Z",
+  "built_at": "2026-09-10T18:10:26.956Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2600,
-  "tree_sha256": "39c1aaa7c37d7537a2b25d18b8de6e6096cef248e1549d529398fe0d2282e2c2",
+  "tree_sha256": "69d3719087a6b6e7fb7c1a0d4889c6bf272f0258a7d7cc72458179525775f6df",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -172,7 +172,7 @@
     {
       "path": ".claude/skills/grade-recover/SKILL.md",
       "mode": "0000644",
-      "sha256": "51cf032ec08279f0f6cbd22a528493917b674ce87f007bcc54eb9ef94a8aad22"
+      "sha256": "4dbbf04c19558b33332d9ba1bb8747198ded19e1a3af06ef72ede58ee4eb95ad"
     },
     {
       "path": ".claude/skills/grader-health/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7decbd6be1709b8c7fe6173a659d2caa8594bb766d353bece00c88a1e316f57e"
+      "sha256": "f4ceea78bdb8f6ba5fec64415aed58610a8ab011d3a8b550e517515904c8cfce"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7722,12 +7722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "de884c55a00c4f37989b00d9c574fdcde904f617941dc65ee21ece636efd63c8"
+      "sha256": "8def408bd91446b93b180b2696465b9bedaf1f8ebe15c671cd4f66a41f6b03da"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a2949e78ffe45c9e0442261dd19892266aa1930607dfaa309ce10754b119921e"
+      "sha256": "62ee3c0059ddc570ef2fef4f2288b7714d9eb95f64d390f67720eb7d07c92cd5"
     },
     {
       "path": "public-docs/index.html",
@@ -7982,7 +7982,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "2d05a5e1dcb3a37480d42f6e0b30b26432a3fe02d671482f2d3762acb7bdb556"
+      "sha256": "cf333976f3c8fc9cfa1af57a121e5ee1f826d40fe7461bf1e32f939a59523663"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -8862,7 +8862,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "95b5fa325ea0407dd6cd3d9ae3a03a0a0f0478a0bfcf76d77cf36b13a7c36bea"
+      "sha256": "9853e719e4a695cc52ec9089298d05163210ed3b51ca9eceb7553bc0ed9c65bd"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8882,7 +8882,7 @@
     {
       "path": "scripts/gds/ship-honesty.js",
       "mode": "0000644",
-      "sha256": "32827178a46cc01c36c422e1adef433be99492e8444a8affbe51e5e8c1e8ce9f"
+      "sha256": "29116265032b48115c31df794aa4689e7ce3f5eaeef152ea1ca2390dc2078c39"
     },
     {
       "path": "scripts/gds/ship-io.js",
@@ -9482,7 +9482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e5d854562fcdec46abd9212cfdfc5c05bd1b29b43525d00abb9d6acb39dac48c"
+      "sha256": "bb3a06612cea7d25b04efabda8659ed8a71b66859bab279f9b4e8a1e5dbadff3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10067,7 +10067,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "e67c44808dda0823a4b2b0e4ddd4ea70735f33a41c335c2d4b168f39eb9807ad"
+      "sha256": "b0474476af85716848114d345f4be67beb2e01ad3ceab36a25d474c3e9e536c5"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -12517,7 +12517,7 @@
     {
       "path": "tests/ship_cannot_lie.mjs",
       "mode": "0000644",
-      "sha256": "82f6f951cc50c34860545be0f309e18a796ebb5baa712ccb341e1fd0dd72a233"
+      "sha256": "d8d99b6cd465b04eaf13790b0bdfe9a76ce36d77660407d3a2c6a17ac7852e8c"
     },
     {
       "path": "tests/ship_card.mjs",

package/.claude/skills/grade-recover/SKILL.md

@@ -58,12 +58,14 @@ The panel ran and rejected the work. Recover by fixing, not by re-rolling:
 1. **Group `issues[]` by severity, then by worker.** Nit/minor findings are advisory by rubric policy — they cannot have caused the fail on their own, so do not start there. The fail came from blocker/major findings (or a gating axis under threshold).
 2. **For each blocker/major finding, add a checked-in `tests/*.mjs` case** that reproduces it, then fix until green. The grader treats throwaway verification as unverified — the committed test is what makes the fix real.
 3. **Fix real findings once; do not chase re-worded restatements** of a point you already answered (answer it in the commit or with a tracked task ref instead).
-4. Commit on the claim branch — the grader reads committed history — then:
+4. Commit on the claim branch — the grader reads committed history — then re-grade, saying how each finding was answered:
 
 ```bash
-node scripts/gds/ship.js <id> --regrade
+node scripts/gds/ship.js <id> --regrade --response-file response.md
 ```
 
+**`--response` is how you answer a finding; `--notes` is not** (task 1003702). The panel is given the task, your value summary, the changed files and the diff — it never reads ship notes, on a re-grade or on the first ship. `--response` rides to the panel fenced as the prior round's answer, so an already-answered finding cannot re-veto on re-wording alone. Passing `--notes` used to be accepted and silently dropped; it is now refused with this same guidance. Evidence itself still belongs in the **diff** — a committed test is what makes a fix real (step 2), and the panel can read every changed file.
+
 ### Not recoverable here — `REFUSED (authorization)`
 
 A grade block naming protected surfaces above your rank is an authorization wall, not a quality verdict: no re-grade at your rank can land that diff as-is. Split the protected files out of the diff and re-ship the rest, or hand the task to a builder at/above the floor the refusal names.

package/docs/module-api-changelog.md

@@ -1739,5 +1739,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.643 with no explicit bump. run 34509682128. (task 1002620)
   1.19.645 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.644 with no explicit bump. run 34511775606. (task 1002620)
+  1.19.646 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.645 with no explicit bump. run 34512629504. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.645",
+  "version": "1.19.646",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.645",
+      "version": "1.19.646",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.645",
+  "version": "1.19.646",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -431,7 +431,20 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       landedNow[name] = { module: mod.key, source: `.claude/skills/${name}`, coreShipped: true };
     }
   }
-  const withdrawable = Object.keys(landedPreviously).filter((n) => SKILL_NAME_RE.test(n) && !landedNow[n]);
+  // A name the CORE ships now is the core's, whatever an older manifest said — a core
+  // skill can take over a name a module once owned, and step 1 copies it in on this very
+  // run. Without this guard 1c deleted it again immediately (task 1003818, a regression
+  // in 1003632's own first cut). materializeModuleSkillsIntoCore states the same rule for
+  // the checkout side via its `tracked(name)` check; this is the instance-side twin.
+  //
+  // The `!skipSkills.has(name)` half is load-bearing, not belt-and-braces: when a DISABLED
+  // module declares a core-shipped name, step 1 SKIPS the copy (that is the task 2103b
+  // exclusion), so the instance's dir really is stale and must still be withdrawn. Keeping
+  // it on the strength of "the core ships this name" would resurrect exactly the bug 1c
+  // exists to fix. Deliberately asked of the CORE source tree rather than the roster, so a
+  // name no enabled module declares any more is still recognised as legitimately sourced.
+  const coreShipsNow = (name) => fs.existsSync(path.join(skillsSrc, name)) && !skipSkills.has(name);
+  const withdrawable = Object.keys(landedPreviously).filter((n) => SKILL_NAME_RE.test(n) && !landedNow[n] && !coreShipsNow(n));
   if (!overwrite) {
     // adopt mode never clobbers what the owner already has; withdrawing is a clobber.
     if (withdrawable.length) summary.notes.push(`${withdrawable.length} skill(s) of a now-disabled module were left in place (adopt mode does not withdraw): ${withdrawable.sort().join(', ')}.`);

package/scripts/gds/ship-flow.js

@@ -9,7 +9,7 @@
 'use strict';
 
 const { cliClient, requireSession, arg, detectWorktreeName } = require('./cli-lib');
-const { resolveProse, markShipProgress, smokeGateMessages } = require('./ship-honesty.js');
+const { resolveProse, markShipProgress, smokeGateMessages, proseFlagPresent, regradeNotesRefusal } = require('./ship-honesty.js');
 const { classifyEmptyShip } = require('../../modules/lifecycle/ship-preflight');
 const { scopeForModule, isModuleKey } = require('../../src/bongos/module-scope-map');
 const { matchOne } = require('../../src/bongos/path-match');
@@ -684,6 +684,16 @@ async function regradeMain() {
     console.error('usage: node scripts/gds/ship.js <task-id> --regrade [--summary-file <path|-> | --summary "..."] [--response-file <path|-> | --response "..."] [--no-merge] [--force] [--verified] [--base <ref>]');
     process.exit(2);
   }
+  // task 1003702: refuse --notes rather than swallowing it. The reasoning — why
+  // a refusal and not a persist — is in ship-honesty.js above regradeNotesRefusal
+  // and is not repeated here. What is load-bearing at THIS call site is the
+  // POSITION: before the preflight and before any grade spend, because a refusal
+  // that first costs a 4-worker panel run is barely better than the silence it
+  // replaces. tests/ship_cannot_lie.mjs pins that order.
+  if (proseFlagPresent(args, 'notes')) {
+    for (const line of regradeNotesRefusal(taskId)) console.error(line);
+    process.exit(2);
+  }
   const regradeProse = resolveProse(args, ['summary', 'response']);
   const summaryArg = regradeProse.summary;
   // task 1002662: the builder's response to the prior round's findings — how
@@ -753,6 +763,17 @@ async function regradeMain() {
   // re-grade is the FIRST time this task actually ships. Fall back to the
   // task's stored value_summary so the merge commit + Discord #ship-news post
   // carry meaningful text even when --summary is omitted.
+  //
+  // AND IT NEVER REACHES THE TASK ROW — task 1003702's acceptance 3 asked this
+  // question; the answer is a real, separate defect, filed as task 1003817.
+  // `summary` from here feeds the grader prompt, the merge commit message and
+  // the PR title/body, and NOTHING writes it back to tasks.value_summary. All
+  // three candidate write paths were read and ruled out: publish-branch accepts
+  // value_summary but uses it only for PR text; PATCH /tasks/:id does not accept
+  // the field at all; the claim-resolve route is the sole writer and a re-grade
+  // has no claim (which is why claimLike is synthesized above). Fixing it needs
+  // a server route change, so it is deliberately NOT folded into this CLI fix.
+  // tests/ship_cannot_lie.mjs pins both halves of that so the answer cannot rot.
   const summary = summaryArg || task.value_summary || '';
 
   // The grader helpers want a claim-like object for touches[] (preflight's
@@ -848,6 +869,11 @@ async function regradeMain() {
     card: {
       title: task.title,
       valueSummary: summary,
+      // Empty by design, not by omission (task 1003702). A re-grade takes no
+      // --notes at all now — it is refused above — so there are none from THIS
+      // round to show. The first ship's notes are the durable record and live on
+      // the resolved claim; re-printing them here would suggest this round
+      // produced them.
       notes: '',
       files: committedFiles,
       baseline: graderBaseline,

package/scripts/gds/ship-honesty.js

@@ -143,8 +143,61 @@ function smokeGateMessages(taskId) {
   };
 }
 
+// ---- --regrade must not swallow --notes (task 1003702) ----------------------
+//
+// THE THIRD WAY TO LOSE THE BUILDER'S PROSE, and the reason this lives in the
+// prose-loss file rather than beside regradeMain. `--regrade` resolves only
+// `summary` and `response`, so `--notes` parsed as an unknown flag, produced no
+// error, and vanished. A builder answering a "no evidence in the notes" blocker
+// passed it again in --notes, saw the ship run, and got the identical finding
+// back marked unanswered — with nothing anywhere saying why.
+//
+// AND THE FIX IS A REFUSAL, NOT A PERSIST, because the premise the bug was filed
+// under is wrong in the builder's favour: the panel NEVER reads ship notes, on a
+// first ship or a re-grade. modules/grading/grader-prompt.js buildPrompt() puts
+// the task row, the VALUE SUMMARY, the changed files, the diffstat and the diff
+// in the prompt and nothing else, and the workers get the same bundle. So
+// storing the notes would have fixed the silence and none of the substance: the
+// builder would pass --notes, watch it save, and STILL get "unanswered" — a
+// worse failure, because now it looks like it worked.
+//
+// The two channels that do reach the panel are named in the refusal: --response
+// (fenced into the prior-round block, task 1002662) and the DIFF itself, which
+// is why the workaround that actually worked on task 1003698 was committing the
+// evidence as a file. Nothing is written and nothing is lost: the first ship's
+// notes stay the durable ledger record, which is the one thing --notes on a
+// re-grade could legitimately have meant.
+function proseFlagPresent(args, name) {
+  const list = Array.isArray(args) ? args : [];
+  return list.some((a) => a === `--${name}` || String(a).startsWith(`--${name}=`)
+    || a === `--${name}-file` || String(a).startsWith(`--${name}-file=`));
+}
+
+// Pure so the refusal's WORDING is testable — a message that fails to name the
+// alternative is the same dead end with an error code on it.
+function regradeNotesRefusal(taskId) {
+  return [
+    '--regrade does not take --notes, and your notes have NOT been saved or graded.',
+    '',
+    'The grader never reads ship notes — not on a re-grade, and not on the first ship.',
+    'The panel is given the task, your VALUE SUMMARY, the changed files and the diff.',
+    'So notes cannot answer a finding, and silently keeping them would only look like it had.',
+    '',
+    'Put the evidence where the panel can actually see it:',
+    `  --response "..."   answers the prior round's findings; it rides to the panel fenced.`,
+    `  --response-file <path>   the safe form for prose (a shell eats backticks in an inline value).`,
+    '  the DIFF           commit the proof — a test, a dry-run log, a session-log file.',
+    '                     The panel reads the committed diff and can Read every changed file.',
+    '',
+    `  node scripts/gds/ship.js ${taskId} --regrade --response-file notes.md`,
+    '',
+    "The first ship's notes stay the durable record; nothing you wrote earlier was lost.",
+  ];
+}
+
 module.exports = {
   resolveProse, markShipProgress, fatalRecoveryLines, smokeGateMessages,
+  proseFlagPresent, regradeNotesRefusal,
   _resetForTest: () => { shipProgress = { stage: 'preflight', taskId: null }; },
   _peekForTest: () => shipProgress,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.645'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.646'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -318,6 +318,36 @@ t('materializeClaude: a skill the module STOPPED declaring is withdrawn too', ()
   for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
 });
 
+t('materializeClaude: a CORE skill that took over a module-owned name is NOT withdrawn — and a disabled module\'s core-shipped name still is (task 1003818)', () => {
+  // The regression this pins: step 1 copies the core's dir in, and 1c deleted it again in
+  // the SAME run, because no enabled module declared the name any more. The core-checkout
+  // twin has always guarded this via tracked() ("a core skill can take over a name a
+  // module once owned"); the instance side shipped without it in task 1003632.
+  const { core, inst, modDir } = withdrawFixture();
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });   // alpha lands, recorded
+
+  // the module stops declaring alpha; the core now ships its own
+  writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['beta'] } }));
+  mkdirSync(join(core, '.claude', 'skills', 'alpha'), { recursive: true });
+  writeFileSync(join(core, '.claude', 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\n---\nCORE OWNS THIS NOW\n');
+  const kept = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(kept.withdrawnSkills, [], 'a name the core ships now is the core\'s, whatever the manifest said');
+  assert.match(readFileSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md'), 'utf8'), /CORE OWNS THIS NOW/, 'and it is the core copy that survives');
+
+  // THE OTHER HALF, which the guard must not break: a DISABLED module declaring a
+  // core-shipped name means step 1 skips the copy, so the instance dir IS stale.
+  const inst2 = mkdtempSync(join(tmpdir(), 'wd-inst-'));
+  writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['alpha', 'beta'] } }));
+  m.materializeClaude({ coreRoot: core, instanceDir: inst2, dryRun: false });
+  assert.ok(existsSync(join(inst2, '.claude', 'skills', 'alpha')), 'landed while enabled');
+  mkdirSync(join(inst2, 'config'), { recursive: true });
+  writeFileSync(join(inst2, 'config', 'modules.json'), JSON.stringify({ modules: { foo: false } }));
+  const gone = m.materializeClaude({ coreRoot: core, instanceDir: inst2, dryRun: false });
+  assert.ok(gone.withdrawnSkills.includes('alpha'), 'a disabled module\'s core-shipped name is still withdrawn — step 1 skipped it, so the dir is stale');
+  assert.ok(!existsSync(join(inst2, '.claude', 'skills', 'alpha')));
+  for (const d of [core, inst, inst2]) rmSync(d, { recursive: true, force: true });
+});
+
 t('materializeClaude: a HAND-WRITTEN skill is never withdrawn, even when a disabled module declares its name', () => {
   const { core, inst } = withdrawFixture();
   // The owner wrote .claude/skills/alpha themselves; no materialize ever landed it,

package/tests/ship_cannot_lie.mjs

@@ -14,13 +14,20 @@
 //     lands the task at 'completed' before the grade runs, and 'completed' is
 //     ALSO what a grade-failed task looks like — so a bare `fatal: <stack>`
 //     left nobody able to tell how far it got.
+//
+// (3) --regrade must not swallow --notes. Same shape as (1): prose handed to
+//     ship.js that reaches nothing, silently (task 1003702).
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const { argText } = require('../scripts/gds/cli-lib.js');
-const { fatalRecoveryLines, markShipProgress, _peekForTest } = require('../scripts/gds/ship-honesty.js');
+const {
+  fatalRecoveryLines, markShipProgress, _peekForTest,
+  proseFlagPresent, regradeNotesRefusal,
+} = require('../scripts/gds/ship-honesty.js');
 
 // Injected IO so no case touches the filesystem.
 const io = {
@@ -166,3 +173,98 @@ test('markShipProgress is the single writer, and ship.js re-exports the reader',
   assert.equal(typeof shipCli.fatalRecoveryLines, 'function', 'ship.js still exposes it');
   assert.equal(shipCli.fatalRecoveryLines, fatalRecoveryLines, 'same function, not a copy');
 });
+
+// ── (3) --regrade refuses --notes instead of swallowing it (task 1003702) ────
+//
+// The third way to lose the builder's prose, and the same incident shape as (1):
+// prose handed to ship.js that reaches nothing, with no error. --regrade
+// resolved only summary + response, so --notes parsed as an unknown flag and
+// vanished; a builder answering a "no evidence in the notes" blocker passed it
+// again there and got the identical finding back marked unanswered.
+
+test('every spelling of --notes is caught, and nothing else is', () => {
+  // All four forms argText accepts. Catching only the bare flag would leave
+  // --notes-file — the form the ship docs actively recommend for prose — silent,
+  // which is the exact defect wearing different clothes.
+  for (const argv of [
+    ['1', '--regrade', '--notes', 'x'],
+    ['1', '--regrade', '--notes=x'],
+    ['1', '--regrade', '--notes-file', 'n.md'],
+    ['1', '--regrade', '--notes-file=n.md'],
+  ]) {
+    assert.equal(proseFlagPresent(argv, 'notes'), true, `caught: ${argv.join(' ')}`);
+  }
+  // Not over-eager: the flags a re-grade legitimately takes must still pass, and
+  // a flag that merely CONTAINS the word is a different flag.
+  for (const argv of [
+    ['1', '--regrade'],
+    ['1', '--regrade', '--response-file', 'r.md'],
+    ['1', '--regrade', '--summary', 'x'],
+    ['1', '--regrade', '--no-notes-please'],
+    ['1', '--regrade', '--response', 'my --notes were wrong'],
+  ]) {
+    assert.equal(proseFlagPresent(argv, 'notes'), false, `not caught: ${argv.join(' ')}`);
+  }
+  // Generic over the flag name — it is not a --notes special case.
+  assert.equal(proseFlagPresent(['--response-file', 'r.md'], 'response'), true);
+});
+
+test('THE ACCEPTANCE: the refusal names where the evidence must go instead', () => {
+  // A non-zero exit that does not say what to do is the same dead end with an
+  // error code on it. The refusal has to carry the working channel, or a builder
+  // reads "not supported" and goes back to putting evidence nowhere.
+  const text = regradeNotesRefusal(1003698).join('\n');
+  assert.match(text, /--response/, 'names the channel that reaches the panel');
+  assert.match(text, /--response-file/, 'and its file form, the safe one for prose');
+  assert.match(text, /diff/i, 'and the diff, which is what the panel actually reads');
+  assert.match(text, /ship\.js 1003698 --regrade/, 'a runnable command with the real task id');
+  // It must not be reassuring about the thing that did not happen.
+  assert.match(text, /NOT been saved/, 'says plainly that the notes went nowhere');
+  // And it must not claim the notes were merely "not supported yet" — the
+  // substantive fact is that the grader never reads ship notes at all, so a
+  // builder does not go looking for a flag that would make them count.
+  assert.match(text, /never reads ship notes/, 'explains WHY, not just that it refused');
+});
+
+test('the refusal is wired into the regrade path, before any grade spend', () => {
+  // Wiring proof (the (1) lesson: a helper nothing calls is not a fix). Also
+  // pins the ORDER — a refusal that costs a 4-worker panel run first is barely
+  // better than the silence, so the guard must precede the preflight.
+  const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+  const regrade = src.slice(src.indexOf('async function regradeMain'));
+  const guard = regrade.indexOf("proseFlagPresent(args, 'notes')");
+  assert.ok(guard !== -1, 'regradeMain consults the guard');
+  const preflight = regrade.indexOf('preflight(claimLike');
+  assert.ok(preflight !== -1 && guard < preflight, 'it refuses before the preflight and the panel');
+  // The usage line must not advertise a flag the path refuses.
+  const usage = regrade.slice(0, regrade.indexOf('resolveProse'));
+  assert.ok(!/--notes/.test(usage.replace(/proseFlagPresent[^\n]*/g, '')
+    .replace(/\/\/[^\n]*/g, '')), 'usage does not offer --notes');
+});
+
+test('ACCEPTANCE 3: --summary reaches the GRADER on a re-grade but never the task row', () => {
+  // Task 1003702's third acceptance asked whether --summary reaches the stored
+  // value_summary on a re-grade. It does NOT, and that is a separate defect
+  // filed as task 1003817 (it needs a server route change; this task's fix is
+  // CLI-only). Pinned here rather than left in prose for the reason this whole
+  // file exists: the panel reads the DIFF, so an answer that lives only in ship
+  // notes is an answer nobody can check — which is the very bug task 1003702 is.
+  const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+  const regrade = src.slice(src.indexOf('async function regradeMain'));
+  const code = regrade.replace(/\/\/[^\n]*/g, ''); // comments describe, they do not write
+
+  // Half one — the threading is intact, so nothing regressed: --summary still
+  // falls back to the stored value and still reaches the grader and the card.
+  assert.match(code, /const summary = summaryArg \|\| task\.value_summary/,
+    'the stored summary is still the fallback when --summary is omitted');
+  assert.match(code, /gradeAndRecord\(\{[\s\S]{0,200}?summary,/,
+    'the summary still reaches the grader prompt');
+  assert.match(code, /valueSummary: summary/, 'and the completion card');
+
+  // Half two — and there is no writer. A `value_summary:` KEY would be a request
+  // payload; the legitimate read is `task.value_summary`, dot-access. If someone
+  // later adds the write (task 1003817), this assertion is what tells them to
+  // update the comment above `const summary` rather than leave it lying.
+  assert.ok(!/[^.]\bvalue_summary\s*:/.test(code),
+    'regradeMain writes value_summary nowhere — see task 1003817');
+});