@bongos/core 1.19.647 → 1.19.648

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.647",
-  "core_contract": "1.19.647",
-  "source_commit": "8fa0f8d28d7d61f52297185e5c669d70a60480de",
+  "core_version": "1.19.648",
+  "core_contract": "1.19.648",
+  "source_commit": "0606a231569b44bdc2521fcee567031ea8ea6f08",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T18:40:35.458Z",
+  "built_at": "2026-09-10T19:06:50.891Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2107,
+    "functional_verbatim": 2109,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2601,
-  "tree_sha256": "7cebbe4108e45c224a38f2068e1e7a1d00552500b0b6f6d7f5c111d45f63a037",
+  "file_count": 2603,
+  "tree_sha256": "3260c3c3da2ae8a6b6630824444ada3145268a70b9194585231bb3391392db80",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a6b15120b937f2a73d47ef180956068560eb3ac3efe5cf58f3a021b544ff9bc0"
+      "sha256": "5ef1befd1a1b30e8ef9e8b8ca08f768361d2422f6ddba2160a5395d46a84d443"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1892,12 +1892,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0fa07d5f61ab66a43e0c51e51cfac8223afcb1aa12ea7342a226cb1832c0be62"
+      "sha256": "6c5f26c9c00387ecc84ed80726a4d62eca0f017f1d75c304d758961749fe616f"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "02c082bff4c5bebbf13cefeeb46a6b9cdff430cc32b65dd4e78a72248c6fd74f"
+      "sha256": "d63a4ab6e92a24d339a632360fb92246512e09eabbc5bff632881bda6d4abf50"
     },
     {
       "path": "docs/architecture.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0f1d4f5ea01f97e24ee83708c35267828f6d7fb2c64a47db9b7b94c43205951a"
+      "sha256": "f646af7c4521017e44e5dfef0b160c18907bfa0f07b5986603593485a34f2742"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5662,7 +5662,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "d8cce5b44106009987d3d32b711a114e4505b4e504bbc6fdfc84f161024ee0cd"
+      "sha256": "fb6503bdaf013a13752968844693cbf957484f033b9df27a66f93eacb91c2cfa"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "95ff6bc6e9f4ad652dc2aa6bc2c7c520409a2115c714cb4ba867fc80413691e8"
+      "sha256": "a568b425560d8d8f4523995442454233b69016a31934810c5d4b7d83baab0b09"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "cc86b3c05885c733cc28ba6e41f1b08cb8f0fe652e3181c1c88be4caabf18d61"
+      "sha256": "25bfb492572d553dbd19595addc0c337706ac2c83df71fb04d7fa199b07b715b"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -7727,12 +7727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b271a576a07b28caf13c7d64f1ba8407e3a4d5e53d13accf0da4ad461f94382e"
+      "sha256": "83135ce62c34647b4bc57872526cb9f550a9fef2148c585839d57c600763961b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e6e4d441aab1b961398eb377d6ac1e4cb9f072efcfa26bd5f51b878b116a8a3e"
+      "sha256": "a9a2455f79599041389b23a18607666ce74eba9be0199d21fbc62553824463f6"
     },
     {
       "path": "public-docs/index.html",
@@ -8867,7 +8867,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "9853e719e4a695cc52ec9089298d05163210ed3b51ca9eceb7553bc0ed9c65bd"
+      "sha256": "8bf28a3d4d15e83a1e94416ec2519d39bc2a3faa71303a4f2d22d429b6afaa95"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9487,7 +9487,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5394603956c3ec34e8377f82a7f493d7c029f0db1d99b236a0e024fd619fe869"
+      "sha256": "dadc321fdd8e6a6f856bb9260c555284b9859361c556d47b14b25df45db900b0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11147,7 +11147,7 @@
     {
       "path": "tests/home_bounded_reads.mjs",
       "mode": "0000644",
-      "sha256": "186a8ebd04cd4dc8021b3a36699468e9c0bcf78ca61ce9f7be7c3e25c632fb3e"
+      "sha256": "6853241b64b5f71dfb782956a4fab468a05aa2a9ee41d5159a4cbea5f0424f38"
     },
     {
       "path": "tests/hook_core_resolve.mjs",
@@ -11434,6 +11434,11 @@
       "mode": "0000644",
       "sha256": "7fa36152b6dbb17b2855d261ddbea96af63d26f97001273cd131104235ea431d"
     },
+    {
+      "path": "tests/lifecycle_facade_surface.mjs",
+      "mode": "0000644",
+      "sha256": "cc14604bf130022ce2533247d29187da6260a791f850f73051bd522252d1b115"
+    },
     {
       "path": "tests/linkify_check.mjs",
       "mode": "0000644",
@@ -11552,7 +11557,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "0d1bc299555d98aa2ad8571e0a5a185776ca727f95577c3308a7e4b36efbfd97"
+      "sha256": "e9271b1a67d201cfd075ce272b1a5a4f3b66c80dcfa5798ca3ea0d3f5048be43"
     },
     {
       "path": "tests/migration_namespace.mjs",
@@ -11792,7 +11797,12 @@
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
-      "sha256": "27a3b5023b6857f3f53734966bc7685757383f2b8dadfa3c0bf1aca2e7db5517"
+      "sha256": "db5e934ef61ddc8dc5804f25a9c84c04f30570db708fd6c77a157e101c69b4d4"
+    },
+    {
+      "path": "tests/patch_value_summary_e2e.mjs",
+      "mode": "0000644",
+      "sha256": "86f60e682284c5f36fa23c6df0ec8b137f40cc548562d6c4496d11d200edb9bf"
     },
     {
       "path": "tests/path_match.mjs",
@@ -12522,7 +12532,7 @@
     {
       "path": "tests/ship_cannot_lie.mjs",
       "mode": "0000644",
-      "sha256": "d8d99b6cd465b04eaf13790b0bdfe9a76ce36d77660407d3a2c6a17ac7852e8c"
+      "sha256": "18a3bb613fff3dcc0dfbffb2283a866726af4347c161fc28853b36b5bdd75512"
     },
     {
       "path": "tests/ship_card.mjs",

package/clients/bongos-client/index.d.ts

@@ -183,7 +183,7 @@ export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; descr
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; priority?: unknown; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; priority?: unknown; value_summary?: string; status?: unknown }
 export interface PostAccessRequestsInviteRequest { github_login: string }
 export interface PostAccessRequestsInviteResponse { ok: boolean; already_invited?: boolean; github_login?: unknown; request?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }

package/docs/api/openapi.json

@@ -18981,6 +18981,11 @@
             "maxLength": 200
           },
           "priority": {},
+          "value_summary": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1000
+          },
           "status": {}
         },
         "additionalProperties": false

package/docs/api-reference.md

@@ -593,7 +593,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — |  |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `priority`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `priority`, `value_summary`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/docs/module-api-changelog.md

@@ -1743,5 +1743,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.645 with no explicit bump. run 34512629504. (task 1002620)
   1.19.647 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.646 with no explicit bump. run 34515733973. (task 1002620)
+  1.19.648 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.647 with no explicit bump. run 34518387614. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -308,7 +308,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
-  'needs_migration', 'module_key', 'description', 'title', 'priority',
+  'needs_migration', 'module_key', 'description', 'title', 'priority', 'value_summary',
 ]);
 
 async function updateTaskColumn(id, column, value) {
@@ -383,6 +383,17 @@ async function updateTaskTitle(id, title) { return updateTaskColumn(id, 'title',
 // 1 = most urgent, 5 = least; null clears it back to unset (weighted as 5).
 async function updateTaskPriority(id, priority) { return updateTaskColumn(id, 'priority', priority); }
 
+// task 1003817: the shipped-value sentence — what the hall, /status and the
+// Discord #ship-news line all read. It was written in exactly ONE place, the
+// claim-resolve route, so a re-grade (which has no claim — regradeMain
+// synthesizes a claimLike precisely because the claim is gone) could correct
+// the summary in the PR and the merge commit and still leave the RECORD holding
+// the first ship's sentence forever. This is the write vector that path uses.
+// Rewritable, never blankable: the route refuses an empty or whitespace-only
+// value, which is this column's form of the COALESCE/NULLIF posture db-ship.js
+// keeps on every other value_summary write.
+async function updateTaskValueSummary(id, valueSummary) { return updateTaskColumn(id, 'value_summary', valueSummary); }
+
 
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
@@ -1037,5 +1048,6 @@ module.exports = {
   updateTaskRequiresRank,
   updateTaskSecuritySensitive,
   updateTaskStatus,
+  updateTaskValueSummary,
   versionAcceptsNewWork,
 };

package/modules/lifecycle/db.js

@@ -30,10 +30,16 @@
 // FACADE (task 1003204, goal 1000079). This file was a 5,748-line monolith; the
 // R03 de-monolith plan carved it into the twelve db-*.js units required below,
 // each cohesive and well under the 1,500-line ratchet. The carve was STRUCTURAL:
-// no function body changed, and the module.exports block at the bottom is the
-// original one verbatim — so every `require('./db')` call site, and every name
+// no function body changed, and every `require('./db')` call site, and every name
 // reachable through it, behaves exactly as before.
 //
+// The module.exports block was the carve's ORIGINAL list verbatim until task
+// 1003817, which replaced the db-tasks.js third of it with a spread — see the
+// long note above `const dbTasks` for why, and tests/lifecycle_facade_surface.mjs
+// for the assertion that keeps that surface identical. The other eleven units
+// are still re-listed by name; giving one of them a spread means giving it an
+// omit list and a surface pin too, because a bare spread publishes internals.
+//
 // The units form a DAG (no require cycles), in dependency order:
 //   db-shared → db-rank-authz → {db-versions, db-goals, db-tasks} → db-analytics
 //   → db-ship → db-claims;  db-deps-criteria and db-claim-reads stand alone.
@@ -100,38 +106,37 @@ const {
   setGoalVisibility,
   transferGoalOwnership,
 } = require('./db-goals.js');
-const {
-  REWARD_SUGGESTION_CAP,
-  createCriterion,
-  createTask,
-  findTaskBySourceRef,
-  generalGoalIdForVersion,
-  getTask,
-  listActiveClaims,
-  listClaimableTasks,
-  listTasks,
-  rankCrossDisciplineRecommendations,
-  rewardGateAssignment,
-  rewardGateError,
-  rewardMissing,
-  setCreditsReward,
-  suggestCreditsReward,
-  taskTouchesProtectedPath,
-  updateTaskAutomationTag,
-  updateTaskDescription,
-  updateTaskTitle,
-  updateTaskDiscipline,
-  updateTaskGoal,
-  updateTaskKind,
-  updateTaskModuleKey,
-  updateTaskNeedsMigration,
-  updateTaskNewcomerFriendly,
-  updateTaskParallelSafe,
-  updateTaskPriority,
-  updateTaskRequiresRank,
-  updateTaskSecuritySensitive,
-  updateTaskStatus,
-} = require('./db-tasks.js');
+// task 1003817: db-tasks.js's exports ARE this facade's task surface, so they are
+// spread into module.exports below instead of being re-listed name by name.
+//
+// WHY THE TWIN LIST HAD TO GO. What stood here was 31 sorted names destructured
+// from db-tasks.js purely so module.exports could name them again — not one was
+// called anywhere inside this file. Two hand-maintained copies of one list is
+// real duplication, and the `duplicate_window_count` ratchet reads it as such:
+// the lists were 29 identical normalized lines, one under the 30-line window, so
+// task 1003750 adding `updateTaskPriority` to both pushed the run to 30 and cost
+// an owner-decided baseline raise (59 → 60). That decision is recorded in
+// config/fitness-baselines.json along with the instruction for whoever added the
+// NEXT db-tasks function — this task, adding updateTaskValueSummary: fix the
+// facade, do not raise the baseline again. Spreading removes the whole class, so
+// the next setter costs nothing.
+//
+// TASK_FACADE_OMIT is what keeps this surface-PRESERVING rather than quietly
+// wider. Two of db-tasks.js's 33 exports were deliberately never re-exported
+// here, and a bare spread would publish them — which ADR 0091 §3 treats as a
+// real surface change, not a tidy-up. Naming them means dropping one has to be
+// somebody's decision. tests/lifecycle_facade_surface.mjs pins the resulting key
+// set, so this can never silently widen or narrow.
+const dbTasks = require('./db-tasks.js');
+const TASK_FACADE_OMIT = new Set([
+  // Internal to db-tasks.js's own queries — a SQL fragment, not a callable.
+  'CREDITS_AWARDED_SUBQUERY',
+  // The version-gate predicate; routes reach it through db-versions, not here.
+  'versionAcceptsNewWork',
+]);
+const dbTasksFacade = Object.fromEntries(
+  Object.entries(dbTasks).filter(([name]) => !TASK_FACADE_OMIT.has(name))
+);
 const {
   addDependency,
   addTaskCriterion,
@@ -214,6 +219,7 @@ const {
 } = require('./db-claims.js');
 
 module.exports = {
+  ...dbTasksFacade,
   tallyPeerVotes,
   PEER_VOTE_KARMA_LAG_DAYS,
   RANKS,
@@ -263,19 +269,6 @@ module.exports = {
   listCriteriaForGoal,
   archiveGoalWithDispositions,
   openTasksInGoal,
-  createTask,
-  generalGoalIdForVersion,
-  findTaskBySourceRef,
-  getTask,
-  listTasks,
-  updateTaskGoal,
-  createCriterion,
-  updateTaskKind,
-  updateTaskDescription,
-  updateTaskTitle,
-  updateTaskDiscipline,
-  updateTaskNewcomerFriendly,
-  updateTaskRequiresRank,
   xenosClaimAllowed,
   rankAllowsTask,
   REQUIRES_RANK_TIER,
@@ -290,31 +283,14 @@ module.exports = {
   LIVE_RANK_LADDER,
   deriveRequiredRank,
   highestRank,
-  rewardMissing,
-  suggestCreditsReward,
-  REWARD_SUGGESTION_CAP,
-  rewardGateAssignment,
-  rewardGateError,
-  setCreditsReward,
   THETES_GRADUATION_THRESHOLD,
   qualifiesForThetesGraduation,
   countShippedTasksForBuilder,
   singleRungPromotionError,
   disambiguateWorktreeName,
   foldWorktreeName,
-  updateTaskParallelSafe,
-  updateTaskPriority,
-  updateTaskSecuritySensitive,
-  updateTaskAutomationTag,
-  updateTaskNeedsMigration,
-  updateTaskModuleKey,
-  listClaimableTasks,
   capNewcomerTasks,
-  taskTouchesProtectedPath, // SR-12 / G2 (task 994): autonomous-fit protected-path exclusion (pure, testable)
   decorateGoalMembership, // task 1003137: feed-side joinable flag (pure, testable)
-  rankCrossDisciplineRecommendations,
-  listActiveClaims,
-  updateTaskStatus,
   getTaskDependencies,
   getTaskDependents,
   attachTaskDepSummaries,

package/modules/lifecycle/routes/task-write-routes.js

@@ -326,6 +326,14 @@ module.exports = function registerTaskWriteRoutes(router) {
       // A whole-goal re-rank (needed-vs-nice) had no route and had to run as SQL.
       // null clears it back to unset; the 1..5 bounds mirror tasks_priority_check.
       priority: {},                                      // 1..5 or null — checked inline
+      // task 1003817: the shipped-value sentence. Written in exactly one place
+      // before this — the claim-resolve route — so `ship.js --regrade --summary`
+      // (no claim, by definition) could correct it in the PR and the merge commit
+      // and still leave the hall, /status and the Discord ship line reading the
+      // FIRST ship's text forever. Same task.edit permission and audit_log trail
+      // as the title/description/priority edits above; minLength 1 (plus the
+      // whitespace check below) so the record can be rewritten, never blanked.
+      value_summary: { type: 'string', minLength: 1, maxLength: LIMITS.VALUE_SUMMARY },
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -354,6 +362,7 @@ module.exports = function registerTaskWriteRoutes(router) {
     const hasDescription = Object.prototype.hasOwnProperty.call(body, 'description');
     const hasTitle = Object.prototype.hasOwnProperty.call(body, 'title');
     const hasPriority = Object.prototype.hasOwnProperty.call(body, 'priority');
+    const hasValueSummary = Object.prototype.hasOwnProperty.call(body, 'value_summary');
     // #514: status is a lifecycle field, not a PATCH-able column — it moves only
     // through the dedicated transition routes. The #506 session tried
     // `PATCH status=ready`, got the generic no_supported_fields error, and had
@@ -365,8 +374,8 @@ module.exports = function registerTaskWriteRoutes(router) {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription && !hasTitle && !hasPriority) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, title, description, priority, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription && !hasTitle && !hasPriority && !hasValueSummary) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, title, description, value_summary, priority, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -393,6 +402,14 @@ module.exports = function registerTaskWriteRoutes(router) {
         return res.fail('bad_priority', { status: 400, message: `priority must be an integer ${TASK_FIELD_BOUNDS.priority.min}-${TASK_FIELD_BOUNDS.priority.max} (1 = most urgent), or null to clear` });
       }
     }
+    // task 1003817: minLength 1 refuses "" but not "   ", and the write trims —
+    // so without this a whitespace-only body would blank the shipped-value
+    // record through the one field whose whole point is that it survives. An
+    // omitted field writes nothing at all (hasValueSummary is false), which is
+    // this route's form of the COALESCE/NULLIF posture db-ship.js keeps.
+    if (hasValueSummary && body.value_summary.trim() === '') {
+      return res.fail('bad_value_summary', { status: 400, message: 'value_summary must be a non-empty sentence — the shipped-value record can be rewritten, never blanked. Omit the field to leave it unchanged.' });
+    }
     if (hasSecuritySensitive) {
       // task 990: explicit Archon-only-broadcast flag. Boolean only (no null) —
       // it gates whether ship.js routes the broadcast to the Archon-only
@@ -556,6 +573,15 @@ module.exports = function registerTaskWriteRoutes(router) {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasValueSummary) {
+      try {
+        updated = await db.updateTaskValueSummary(id, body.value_summary.trim());
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        log.error('[gds] PATCH /tasks/:id value_summary', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasGoalId) {
       try {
         updated = await db.updateTaskGoal(id, body.goal_id);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.647",
+  "version": "1.19.648",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.647",
+      "version": "1.19.648",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.647",
+  "version": "1.19.648",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-flow.js

@@ -659,6 +659,58 @@ async function shipMain() {
   });
 }
 
+// persistRegradeSummary — store a re-grade's corrected --summary on the task row
+// (task 1003817). A re-grade has no claim, so it cannot reach claim-resolve, the
+// only writer of tasks.value_summary before this; PATCH /tasks/:id is the route
+// it uses instead.
+//
+// WHY PATCH AND NOT publish-branch, which already RECEIVES value_summary and
+// could have persisted it with a one-line change: publish-branch is only called
+// when pushVia() === 'server'. A laptop land goes through ciLandLocal (gh), and
+// --no-merge / --db-only / --allow-empty never land at all — so persisting there
+// would have fixed one path of four and left the defect standing on the rest. It
+// would also have made publish-branch a SECOND writer racing claim-resolve on
+// the normal ship path, which sends the same field. Writing from here keeps one
+// writer per ship: the claim on a first ship, this on a re-grade.
+//
+// Three deliberate postures:
+//   - OMITTED --summary writes NOTHING. The stored value is the fallback the
+//     grader was already handed, so a re-grade that omits the flag must leave
+//     the row exactly as it was — the COALESCE/NULLIF posture every other
+//     value_summary write in db-ship.js keeps. This is acceptance 2.
+//   - UNCHANGED text writes nothing either, so a no-op edit mints no audit_log row.
+//   - A FAILURE is LOUD BUT NON-BLOCKING. The grade is the expensive step and it
+//     has not run yet; discarding a re-grade over a summary that did not persist
+//     would trade the cheap problem for the costly one. The builder is told
+//     plainly that the row still holds the old sentence, so nothing is silent.
+//     An older pinned core that has not learned the field is named as exactly
+//     that rather than reported as a generic error — the same forward-compat
+//     posture the resolve call in shipMain documents at length (task 1003767),
+//     because @cloudbongos/cli ships separately from the core and an instance
+//     pins its own core version.
+async function persistRegradeSummary({ taskId, summaryArg, task }) {
+  const next = (summaryArg || '').trim();
+  if (!next) return { written: false, reason: 'omitted' };
+  if (next === (task.value_summary || '').trim()) return { written: false, reason: 'unchanged' };
+  let r;
+  try {
+    r = await (await cliClient()).tasks.patchTasksId({ id: taskId, body: { value_summary: next } });
+  } catch (err) {
+    console.error(`  ⚠ value_summary NOT stored (${err && err.message ? err.message : 'request failed'}) — task #${taskId} keeps its previous summary. The grade below is unaffected.`);
+    return { written: false, reason: 'error' };
+  }
+  if (!r.ok) {
+    if (isUnknownFieldRejection(r.status, r.data, 'value_summary')) {
+      console.error(`  ⚠ value_summary NOT stored: this instance's core predates PATCH /tasks/:id accepting the field. Upgrade the core, or edit the summary in the hall. The grade below is unaffected.`);
+    } else {
+      console.error(`  ⚠ value_summary NOT stored (${apiErrorLine(r.data, r.status)}) — task #${taskId} keeps its previous summary. The grade below is unaffected.`);
+    }
+    return { written: false, reason: 'refused' };
+  }
+  console.log(`  value_summary updated on task #${taskId} — the hall, /status and the ship broadcast now read the corrected sentence.`);
+  return { written: true };
+}
+
 // ---------- Re-grade flow (#678) ----------
 //
 // `node scripts/gds/ship.js <id> --regrade` closes the task-595-regrade-gap
@@ -676,6 +728,7 @@ async function shipMain() {
 //   - grade: gradeAndRecord → POST /tasks/:id/grade (rank-open; applyGrade
 //     promotes completed→confirmed + awards credits on pass, idempotent)
 //   - on pass: the normal confirmed→shipped merge + sync tail runs.
+
 async function regradeMain() {
   await requireSession();
   const args = process.argv.slice(2);
@@ -764,16 +817,14 @@ async function regradeMain() {
   // task's stored value_summary so the merge commit + Discord #ship-news post
   // carry meaningful text even when --summary is omitted.
   //
-  // AND IT NEVER REACHES THE TASK ROW — task 1003702's acceptance 3 asked this
-  // question; the answer is a real, separate defect, filed as task 1003817.
-  // `summary` from here feeds the grader prompt, the merge commit message and
-  // the PR title/body, and NOTHING writes it back to tasks.value_summary. All
-  // three candidate write paths were read and ruled out: publish-branch accepts
-  // value_summary but uses it only for PR text; PATCH /tasks/:id does not accept
-  // the field at all; the claim-resolve route is the sole writer and a re-grade
-  // has no claim (which is why claimLike is synthesized above). Fixing it needs
-  // a server route change, so it is deliberately NOT folded into this CLI fix.
-  // tests/ship_cannot_lie.mjs pins both halves of that so the answer cannot rot.
+  // AND IT NOW REACHES THE TASK ROW TOO — task 1003817. It did not before: this
+  // `summary` fed the grader prompt, the merge commit message and the PR
+  // title/body and stopped there, so a builder who re-graded with a CORRECTED
+  // --summary saw it applied everywhere except the place that is the record —
+  // the hall, /status and the Discord #ship-news line all kept the first ship's
+  // sentence forever. persistRegradeSummary (below the preflight) is the write;
+  // PATCH /tasks/:id is the route it uses, and `value_summary` was added to that
+  // schema by this same task. tests/ship_cannot_lie.mjs pins the wiring.
   const summary = summaryArg || task.value_summary || '';
 
   // The grader helpers want a claim-like object for touches[] (preflight's
@@ -804,6 +855,14 @@ async function regradeMain() {
     process.exit(1);
   }
 
+  // ---- Persist a corrected --summary to the task row (task 1003817) ----
+  // Placed HERE deliberately: after the guards that can still abort the re-grade
+  // (so a refused run writes nothing), and BEFORE the grade — which is the order
+  // the normal ship already has, where claim-resolve stores value_summary and
+  // the panel runs afterwards. The row, the grader prompt, the merge commit and
+  // the PR then all carry the same sentence.
+  await persistRegradeSummary({ taskId, summaryArg, task });
+
   // ---- Delta-aware prior-round context (task 1002662) ----
   // The prior grade's findings + the builder's response + the interim fix diff
   // ride to the panel so an already-answered finding can't re-veto on

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.647'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.648'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/home_bounded_reads.mjs

@@ -99,16 +99,25 @@ await test('the limit is OPT-IN — the Work Board and /builder-start are untouc
 await test('every db.* the claimable handler calls actually exists', () => {
   // The bug this catches, caught the hard way: an earlier cut pushed the limit into the
   // db layer, was reverted, and left the route calling `db.listClaimableTasksPaged` — a
-  // function that no longer existed. Every assertion in this file is source text, and
-  // source text cannot see a missing symbol; a neighbouring suite found it instead.
+  // function that no longer existed. Every OTHER assertion in this file is source text,
+  // and source text cannot see a missing symbol; a neighbouring suite found it instead.
+  //
+  // So this one is not source text: it REQUIRES the facade and reads the real key. It
+  // used to grep db.js's module.exports block for each name, which was a proxy for
+  // exactly this and stopped being a valid one at task 1003817 — db.js now SPREADS
+  // db-tasks.js's exports instead of re-listing them, so `listClaimableTasks` is a live
+  // key that appears nowhere in the block's text. Requiring is safe here: the lifecycle
+  // db family is pool-lazy (tests/lifecycle_facade_surface.mjs relies on the same thing).
   const from = ROUTE.indexOf("router.get('/tasks/claimable'");
   const body = ROUTE.slice(from, ROUTE.indexOf('res.json({ claimable', from));
   const called = [...new Set([...body.matchAll(/\bdb\.([A-Za-z0-9_]+)\s*\(/g)].map((m) => m[1]))];
   assert.ok(called.length > 0, 'the handler calls the db layer');
-  const dbExports = read('modules/lifecycle/db.js');
-  const block = dbExports.slice(dbExports.lastIndexOf('module.exports'));
+  const db = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
   for (const fn of called) {
-    assert.ok(new RegExp(`\\b${fn}\\b`).test(block), `db.js must export ${fn} — the route calls it`);
+    assert.ok(
+      typeof db[fn] === 'function',
+      `db.js must export ${fn} — the route calls it, and this is the runtime check, not a text match`
+    );
   }
 });
 

package/tests/lifecycle_facade_surface.mjs

@@ -0,0 +1,112 @@
+// tests/lifecycle_facade_surface.mjs
+//
+// The lifecycle facade's TASK surface, pinned (task 1003817).
+//
+// WHY THIS FILE EXISTS. modules/lifecycle/db.js used to re-export db-tasks.js by
+// hand: 31 names destructured at the top purely so module.exports could list
+// them again, with no internal caller for a single one. Two hand-maintained
+// copies of one list is real duplication, and the `duplicate_window_count`
+// ratchet counted it — the two runs were 29 identical normalized lines, one
+// under the 30-line window, so task 1003750 adding `updateTaskPriority` to both
+// tipped it over and cost an owner-decided baseline raise (59 -> 60). The reason
+// recorded in config/fitness-baselines.json told whoever added the NEXT
+// db-tasks function to fix the facade instead of raising it again. Task 1003817
+// added `updateTaskValueSummary`, so this is that fix: db.js now spreads
+// db-tasks.js's exports minus an explicit omit list.
+//
+// A SPREAD IS CHEAPER TO MAINTAIN AND EASIER TO GET WRONG. Nothing stops it from
+// silently WIDENING the module's public surface (publishing an internal that was
+// deliberately withheld) or NARROWING it (a rename in db-tasks.js quietly
+// dropping a name every route calls, which is a runtime `undefined is not a
+// function` in an async Express handler — ADR 0091 §2 records exactly that
+// outage for `LIVE_RANK_LADDER`, where it hung the request until Cloudflare
+// 524'd). The old twin list at least failed loudly at require time. So the
+// safety the list used to provide is re-established here, as an assertion rather
+// than as boilerplate: db.js's task surface must be db-tasks.js's exports minus
+// TASK_FACADE_OMIT, exactly — no more, no fewer.
+//
+// No live DB: requiring the lifecycle db family is pool-lazy.
+//
+// Run:  node tests/lifecycle_facade_surface.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const require = createRequire(import.meta.url);
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try {
+    await fn();
+    console.log(`  ok  ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  FAIL ${name}`);
+    console.error('    ', err.message);
+    failed++;
+  }
+}
+
+const db = require(join(repoRoot, 'modules', 'lifecycle', 'db.js'));
+const dbTasks = require(join(repoRoot, 'modules', 'lifecycle', 'db-tasks.js'));
+const dbSrc = readFileSync(join(repoRoot, 'modules', 'lifecycle', 'db.js'), 'utf8');
+
+// The omit list is read from the SOURCE, not re-typed here — a test that hardcodes
+// the same two names cannot notice a third being added without a reason.
+function omitListFromSource(src) {
+  const block = src.match(/const TASK_FACADE_OMIT = new Set\(\[([\s\S]*?)\]\)/);
+  assert.ok(block, 'db.js must declare TASK_FACADE_OMIT so the withheld names are a named decision');
+  return block[1]
+    .split('\n')
+    .map((l) => l.replace(/\/\/.*/, '').trim())
+    .filter(Boolean)
+    .map((l) => l.replace(/^'|',?$/g, ''));
+}
+
+await test('db.js re-exports every db-tasks export except the named omissions', () => {
+  const omit = new Set(omitListFromSource(dbSrc));
+  const expected = Object.keys(dbTasks).filter((k) => !omit.has(k)).sort();
+  const actual = expected.filter((k) => Object.prototype.hasOwnProperty.call(db, k));
+  const missing = expected.filter((k) => !Object.prototype.hasOwnProperty.call(db, k));
+  assert.deepEqual(missing, [], `db.js dropped task surface: ${missing.join(', ')} — a route calling one of these gets undefined at runtime, not an error at require`);
+  assert.equal(actual.length, expected.length);
+});
+
+await test('and publishes NONE of the omitted internals', () => {
+  const omit = omitListFromSource(dbSrc);
+  assert.ok(omit.length > 0, 'the omit list is not empty — a bare spread would widen the surface');
+  for (const name of omit) {
+    assert.ok(
+      Object.prototype.hasOwnProperty.call(dbTasks, name),
+      `${name} is omitted from a surface it is not on — stale entry, remove it`
+    );
+    assert.ok(
+      !Object.prototype.hasOwnProperty.call(db, name),
+      `${name} is on the omit list but reachable through db.js — the spread widened the facade`
+    );
+  }
+});
+
+await test('the spread is what wires it, and the twin name list is gone', () => {
+  assert.match(dbSrc, /\.\.\.dbTasksFacade,/, 'module.exports spreads the filtered db-tasks surface');
+  assert.match(
+    dbSrc,
+    /const dbTasksFacade = Object\.fromEntries\(\s*Object\.entries\(dbTasks\)\.filter\(\(\[name\]\) => !TASK_FACADE_OMIT\.has\(name\)\)/,
+    'the filter is the omit list, not an inline literal'
+  );
+  // The regression this replaces: a `const { … } = require('./db-tasks.js')`
+  // destructure whose only purpose was to feed module.exports.
+  assert.ok(
+    !/const \{[\s\S]*?\} = require\('\.\/db-tasks\.js'\)/.test(dbSrc),
+    'db-tasks.js must not be hand-destructured again — that is the duplication this task removed'
+  );
+});
+
+console.log(`\nlifecycle_facade_surface: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/migration_allocation.mjs

@@ -205,6 +205,7 @@ function shouldReserveMigrationNumber(task) {
         [() => db.updateTaskDescription(1, 'edited body'), 'description'], // task 1002647
         [() => db.updateTaskTitle(1, 'corrected title'), 'title'], // task 1002792
         [() => db.updateTaskPriority(1, 2), 'priority'], // task 1003750
+        [() => db.updateTaskValueSummary(1, 'corrected summary'), 'value_summary'], // task 1003817
       ];
       for (const [call, column] of setters) {
         const before = seen.length;
@@ -255,6 +256,33 @@ function shouldReserveMigrationNumber(task) {
     assert.ok(guardAt > 0 && firstWriteAt > 0 && guardAt < firstWriteAt, 'the priority bounds check must run before the first write, not after');
   });
 
+  // task 1003817: value_summary was the FOURTH write-once field, and the one
+  // that is the public record — the hall, /status and the Discord #ship-news
+  // line all read it. It had exactly one writer, the claim-resolve route, so
+  // `ship.js --regrade --summary` (no claim, by definition) could correct it in
+  // the PR and the merge commit and leave the record holding the first ship's
+  // sentence forever.
+  await test('PATCH /tasks/:id accepts value_summary so a re-graded summary reaches the record (task 1003817)', () => {
+    assert.ok(
+      /value_summary: \{ type: 'string', minLength: 1, maxLength: LIMITS\.VALUE_SUMMARY \}/.test(routesSrc),
+      'the PATCH schema must declare value_summary with the shared limit — rewritable, never blankable'
+    );
+    assert.ok(/const hasValueSummary = Object\.prototype\.hasOwnProperty\.call\(body, 'value_summary'\)/.test(routesSrc), 'value_summary is gated like every other field');
+    assert.ok(/if \(!hasParent &&[^)]*!hasValueSummary\b/.test(routesSrc), 'a value_summary-only PATCH is a supported request');
+    assert.ok(/db\.updateTaskValueSummary\(id, body\.value_summary\.trim\(\)\)/.test(routesSrc), 'the write goes through the allowlisted setter');
+    assert.ok(
+      /async function updateTaskValueSummary/.test(dbSrc) && /updateTaskValueSummary,/.test(dbSrc),
+      'the lifecycle db family must define it and re-export it (the ADR 0093 facade contract)'
+    );
+    // minLength 1 refuses "" but not "   ", and the write trims — so the
+    // whitespace guard is what actually keeps the record un-blankable. It must
+    // sit above the first write, like the priority bounds check above.
+    const blankGuardAt = routesSrc.indexOf("res.fail('bad_value_summary'");
+    const firstWriteAt2 = routesSrc.indexOf('await db.updateTaskKind(');
+    assert.ok(blankGuardAt > 0, 'a whitespace-only value_summary is refused, not trimmed into a blank record');
+    assert.ok(blankGuardAt < firstWriteAt2, 'and that refusal runs before the first write');
+  });
+
   await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
     assert.ok(
       /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),

package/tests/patch_gate_ordering.mjs

@@ -49,6 +49,10 @@ const REFUSALS = [
   // task 1003750: priority joined the PATCH surface; its bounds check is a
   // validation refusal like the rest, so it must settle before the first write.
   "'bad_priority'",
+  // task 1003817: value_summary joined the PATCH surface. Its refusal is the
+  // blank guard — minLength 1 stops "" but not "   ", and the write trims — so
+  // it must settle before the first write like every other validation.
+  "'bad_value_summary'",
   'badKind(res)',
   "'bad_discipline'",
 ];

package/tests/patch_value_summary_e2e.mjs

@@ -0,0 +1,142 @@
+// tests/patch_value_summary_e2e.mjs — PATCH /tasks/:id value_summary over real
+// HTTP (task 1003817).
+//
+// WHY A SECOND FILE. migration_allocation.mjs pins the two halves in isolation:
+// the route's schema/gate/write as SOURCE TEXT, and db.updateTaskValueSummary
+// driven against a stubbed pool so the real `SET value_summary =` SQL is proven.
+// Neither exercises the WIRING, and the wiring is where this class of change
+// fails — the whole defect being fixed is a value that reached three consumers
+// and never reached the row. Specifically, source text cannot see that the
+// route's STRICT validator (ADR 0118) actually admits the new field: before this
+// task, `value_summary` on this route was a hard 400 `unknown_field`, and a
+// schema entry that is subtly wrong (mis-typed, mis-named, declared on the
+// create schema instead) fails exactly the same way while every text assertion
+// still passes.
+//
+// So this drives the REAL router over a real socket with the db layer stubbed at
+// the module boundary, the way task_visual_route_gate.mjs and
+// goal_archive_route_e2e.mjs do — the router under test is the shipped one.
+//
+// THE CASES WORTH THE FILE: (2) proves acceptance 1 end to end — a corrected
+// summary reaches the write. (4) and (5) prove acceptance 2 from the other side:
+// an OMITTED field must not touch the row at all, and a whitespace-only one must
+// be refused rather than trimmed into a blank record. `value_summary` is the
+// public shipped-value sentence, so blanking it is the one failure mode that is
+// worse than the bug.
+//
+// Run:  node tests/patch_value_summary_e2e.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+process.env.NODE_ENV = 'test';
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+
+api.requireBuilder = (req, _res, next) => { req.builder = { id: '3', rank: 'archon' }; next(); };
+api.requirePermission = () => (req, _res, next) => next();
+
+const TASK = { id: 5150, title: 'a task', status: 'completed', version_id: 'BONGOS-V2', value_summary: 'the FIRST ship sentence' };
+
+// Every write the handler can reach, recorded rather than performed — so a test
+// can assert not only what WAS written but that nothing else was.
+let writes = [];
+db.getTask = async () => ({ ...TASK });
+db.updateTaskValueSummary = async (id, v) => { writes.push({ fn: 'value_summary', id, v }); return { ...TASK, value_summary: v }; };
+db.updateTaskTitle = async (id, v) => { writes.push({ fn: 'title', id, v }); return { ...TASK, title: v }; };
+db.updateTaskKind = async (id, v) => { writes.push({ fn: 'kind', id, v }); return { ...TASK, kind: v }; };
+
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => {
+  res.fail = (code, statusOrOpts, details) => {
+    const o = typeof statusOrOpts === 'number' ? { status: statusOrOpts } : (statusOrOpts || {});
+    return res.status(o.status || 400).json({ error: code, message: o.message, details: o.details ?? details });
+  };
+  next();
+});
+app.use('/api/gds', require('../modules/lifecycle/routes/tasks.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/gds`;
+
+const patch = async (body) => {
+  writes = [];
+  const r = await fetch(`${base}/tasks/${TASK.id}`, {
+    method: 'PATCH',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return { status: r.status, body: await r.json().catch(() => null), writes };
+};
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('PATCH /tasks/:id value_summary (task 1003817):');
+
+// 1. The regression guard: this is what the route used to do with the field.
+await t('the field is no longer rejected as an unknown field', async () => {
+  const r = await patch({ value_summary: 'anything' });
+  assert.notEqual(r.body && r.body.error, 'unknown_field',
+    'the strict validator must ADMIT value_summary — a missing schema entry looks exactly like the original bug');
+  assert.notEqual(r.body && r.body.error, 'no_supported_fields',
+    'and the supported-fields guard must count it, or a value_summary-only PATCH is refused');
+});
+
+// 2. ACCEPTANCE 1, end to end.
+await t('a corrected summary reaches the write, trimmed', async () => {
+  const r = await patch({ value_summary: '  the CORRECTED sentence  ' });
+  assert.equal(r.status, 200, `expected 200, got ${r.status} ${JSON.stringify(r.body)}`);
+  assert.deepEqual(r.writes, [{ fn: 'value_summary', id: TASK.id, v: 'the CORRECTED sentence' }]);
+});
+
+// 3. It composes with the other planning fields rather than replacing them.
+await t('it can travel with another field in one body', async () => {
+  const r = await patch({ value_summary: 'both', title: 'new title' });
+  assert.equal(r.status, 200);
+  const fns = r.writes.map((w) => w.fn).sort();
+  assert.deepEqual(fns, ['title', 'value_summary']);
+});
+
+// 4. ACCEPTANCE 2, from the route's side.
+await t('ACCEPTANCE 2: an omitted value_summary writes nothing at all', async () => {
+  const r = await patch({ title: 'only the title' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.writes.filter((w) => w.fn === 'value_summary'), [],
+    'an omitted field must not reach the column — not even to write back what was there');
+});
+
+// 5. The failure mode worse than the bug.
+await t('a blank or whitespace-only summary is REFUSED, never written', async () => {
+  for (const bad of ['', '   ', '\t\n ']) {
+    const r = await patch({ value_summary: bad });
+    assert.equal(r.status, 400, `${JSON.stringify(bad)} must be refused, got ${r.status}`);
+    assert.deepEqual(r.writes, [], `${JSON.stringify(bad)} must not reach the column`);
+  }
+});
+
+// 6. And the refusal has to be diagnosable, since the caller is usually a script.
+await t('the refusal names the field and says omission is how you leave it alone', async () => {
+  const r = await patch({ value_summary: '   ' });
+  assert.equal(r.body.error, 'bad_value_summary');
+  assert.match(r.body.message, /never blanked/i);
+  assert.match(r.body.message, /omit/i);
+});
+
+// 7. The cap is the shared one, not a number re-typed on this route.
+await t('an over-long summary is refused by the shared LIMITS cap', async () => {
+  const r = await patch({ value_summary: 'x'.repeat(api.LIMITS.VALUE_SUMMARY + 1) });
+  assert.equal(r.status, 400);
+  assert.deepEqual(r.writes, []);
+});
+
+server.close();
+console.log(`\npatch_value_summary_e2e: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/ship_cannot_lie.mjs

@@ -242,15 +242,16 @@ test('the refusal is wired into the regrade path, before any grade spend', () =>
     .replace(/\/\/[^\n]*/g, '')), 'usage does not offer --notes');
 });
 
-test('ACCEPTANCE 3: --summary reaches the GRADER on a re-grade but never the task row', () => {
+test('ACCEPTANCE 3: --summary reaches the grader AND the task row on a re-grade', () => {
   // Task 1003702's third acceptance asked whether --summary reaches the stored
-  // value_summary on a re-grade. It does NOT, and that is a separate defect
-  // filed as task 1003817 (it needs a server route change; this task's fix is
-  // CLI-only). Pinned here rather than left in prose for the reason this whole
-  // file exists: the panel reads the DIFF, so an answer that lives only in ship
-  // notes is an answer nobody can check — which is the very bug task 1003702 is.
+  // value_summary on a re-grade. It did NOT — a separate defect, filed and fixed
+  // as task 1003817, which added value_summary to the PATCH /tasks/:id schema and
+  // the persistRegradeSummary call below. This test used to pin the ABSENCE of a
+  // writer; it now pins its PRESENCE, for the reason this whole file exists: the
+  // panel reads the DIFF, so an answer that lives only in ship notes is an answer
+  // nobody can check — which is the very bug task 1003702 was.
   const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
-  const regrade = src.slice(src.indexOf('async function regradeMain'));
+  const regrade = src.slice(src.indexOf('async function persistRegradeSummary'));
   const code = regrade.replace(/\/\/[^\n]*/g, ''); // comments describe, they do not write
 
   // Half one — the threading is intact, so nothing regressed: --summary still
@@ -261,10 +262,38 @@ test('ACCEPTANCE 3: --summary reaches the GRADER on a re-grade but never the tas
     'the summary still reaches the grader prompt');
   assert.match(code, /valueSummary: summary/, 'and the completion card');
 
-  // Half two — and there is no writer. A `value_summary:` KEY would be a request
-  // payload; the legitimate read is `task.value_summary`, dot-access. If someone
-  // later adds the write (task 1003817), this assertion is what tells them to
-  // update the comment above `const summary` rather than leave it lying.
-  assert.ok(!/[^.]\bvalue_summary\s*:/.test(code),
-    'regradeMain writes value_summary nowhere — see task 1003817');
+  // Half two — and now there IS a writer, wired into the path (the (1) lesson:
+  // a helper nothing calls is not a fix).
+  assert.match(code, /patchTasksId\(\{[\s\S]{0,80}?body: \{ value_summary: next \}/,
+    'persistRegradeSummary PATCHes value_summary onto the task row');
+  assert.match(code, /await persistRegradeSummary\(\{ taskId, summaryArg, task \}\)/,
+    'and regradeMain actually calls it');
+});
+
+test('a re-grade that omits --summary leaves the stored value_summary alone', () => {
+  // ACCEPTANCE 2. The row must survive an omitted flag: `summary` falls back to
+  // task.value_summary, so writing that fallback back would be a no-op at best
+  // and, on any future refactor of the fallback, a way to overwrite the record
+  // with something derived. persistRegradeSummary keys on summaryArg — the RAW
+  // flag — not on the resolved `summary`, and returns before the PATCH when it
+  // is absent. Pinned as source structure because the alternative (a live
+  // re-grade) costs a 4-worker panel run.
+  const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+  const start = src.indexOf('async function persistRegradeSummary');
+  const fn = src.slice(start, src.indexOf('async function regradeMain', start));
+  const code = fn.replace(/\/\/[^\n]*/g, '');
+
+  // It reads the raw flag, never the resolved fallback.
+  assert.match(code, /const next = \(summaryArg \|\| ''\)\.trim\(\)/,
+    'the guard keys on the raw --summary, not the stored-value fallback');
+
+  // Both early returns precede the only PATCH in the function.
+  const omitted = code.indexOf("reason: 'omitted'");
+  const unchanged = code.indexOf("reason: 'unchanged'");
+  const patch = code.indexOf('patchTasksId');
+  assert.ok(omitted !== -1 && omitted < patch, 'an omitted --summary returns before the write');
+  assert.ok(unchanged !== -1 && unchanged < patch, 'an unchanged --summary returns before the write too');
+
+  // And a failed write never aborts the re-grade — no process.exit, no throw.
+  assert.ok(!/process\.exit/.test(code), 'a summary that will not persist must not kill the re-grade');
 });