Add v_project_list and v_goal_list CRUD (user-requested scope expansion)

Two new console pages requested directly by the user, beyond 02-V's original declared non-goal ("不做完整多项目管理 UI（项目列表/切换）"): - v_project_list: full project list + rename + archive/reactivate. "Import an existing directory with real code" needs no new code -- project_scaffold.create_project() already only ever adds .graphlemon/ inside the target folder. New: src/project_query.py (list/get/update), GET/PUT/DELETE /api/projects[/:id]. DELETE archives (status='archived'), never a physical row delete -- project_id is FK-referenced from task/ artifact/bug_record/etc., and 01-M's own active/archived enum already models this as soft-delete. - v_goal_list: extends the existing v_task_board/v_task_detail rather than duplicating them. Added sort/order to task_query.list_tasks() (column whitelist, no injection surface) and edit/delete on v_task_detail, both restricted to status='queued' (task_query.TaskNotEditableError, HTTP 409) -- editing or deleting a goal after real work has referenced it would leave that history pointing at something that no longer matches reality. Implemented directly rather than through graphlemon's own self-hosting loop -- confirmed with the user first that implement_code() always uses a hardcoded single-node manifest (no plan_work_graph() call for Coder), so a multi-page/multi-endpoint feature like this would've been one unreviewable Coder session with no way to decompose it. Real bug found on first verification pass (not caught by the existing _insert_task test helper, which never writes execution_event): a real task_create.create_task() always writes an execution_event row in the same transaction (01-M's FK, no ON DELETE CASCADE) -- even a never-touched queued task already has one, so DELETE FROM task raised sqlite3.IntegrityError. Fixed by clearing the task's own execution_event rows first; new regression test goes through the real create_task() path. 474 tests green. Verified end-to-end against a real running server (every new endpoint exercised via curl) since the Chrome extension is still unavailable this session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Add v_project_list and v_goal_list CRUD (user-requested scope expansion)
Two new console pages requested directly by the user, beyond 02-V's original declared non-goal ("不做完整多项目管理 UI（项目列表/切换）"): - v_project_list: full project list + rename + archive/reactivate. "Import an existing directory with real code" needs no new code -- project_scaffold.create_project() already only ever adds .graphlemon/ inside the target folder. New: src/project_query.py (list/get/update), GET/PUT/DELETE /api/projects[/:id]. DELETE archives (status='archived'), never a physical row delete -- project_id is FK-referenced from task/ artifact/bug_record/etc., and 01-M's own active/archived enum already models this as soft-delete. - v_goal_list: extends the existing v_task_board/v_task_detail rather than duplicating them. Added sort/order to task_query.list_tasks() (column whitelist, no injection surface) and edit/delete on v_task_detail, both restricted to status='queued' (task_query.TaskNotEditableError, HTTP 409) -- editing or deleting a goal after real work has referenced it would leave that history pointing at something that no longer matches reality. Implemented directly rather than through graphlemon's own self-hosting loop -- confirmed with the user first that implement_code() always uses a hardcoded single-node manifest (no plan_work_graph() call for Coder), so a multi-page/multi-endpoint feature like this would've been one unreviewable Coder session with no way to decompose it. Real bug found on first verification pass (not caught by the existing _insert_task test helper, which never writes execution_event): a real task_create.create_task() always writes an execution_event row in the same transaction (01-M's FK, no ON DELETE CASCADE) -- even a never-touched queued task already has one, so DELETE FROM task raised sqlite3.IntegrityError. Fixed by clearing the task's own execution_event rows first; new regression test goes through the real create_task() path. 474 tests green. Verified end-to-end against a real running server (every new endpoint exercised via curl) since the Chrome extension is still unavailable this session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
bboonnee
1 parent a5f1618e
Showing 9 changed files with 832 additions and 11 deletions
docs/development-plan.md
frontend/app.js
frontend/index.html
src/backend_server.py
src/project_query.py
src/task_query.py
src/test_backend_server.py
src/test_project_query.py
src/test_task_query.py
@@ -460,3 +460,16 @@ U-041（回滚路径实现，含 §10 提到的 `git revert` 冲突处理）是 
 ## 4. 与 06-验收与测试锚点.md 的对应关系
 本文档不重新定义验收标准，Unit 的 Done 标准直接引用 06 节已有的 REQ-01~14 用例（happy/boundary/failure）。如果后续 06 节的验收用例发生变更，本文档对应 Unit 的 Done 标准需要同步更新，避免两份文档各说各话。
+
+---
+
+## 5. PH0-PH5 之外：用户直接请求的控制台功能扩展
+
+PH0-PH5（45 个 Unit）全部完成、U-042 真实自举压测进行中期间，用户直接向 Claude Code（不经过 graphlemon 自己的 Planner/Coder/Validator 闭环，原因见下）提出了两个新的控制台页面需求，是对 02-V 原有非目标"不做完整多项目管理 UI（项目列表/切换）"的明确、有意突破，不是发现遗漏后的补充。
+
+**为什么不走 graphlemon 自己的自举闭环去实现这个需求**：讨论过程中确认了当前 `implement_code()`（Coder 阶段）永远用一个写死的单节点 `graph_manifest`，从不调用 `plan_work_graph()` 规划自己的 Work Graph——不管 SDD 多详细，整个实现都只交给一次 Coder 会话，没有按视图/模块拆分执行的能力（U-031 当时明确把"造一个 Coder 图规划器"排除在集成范围之外）。这个需求涉及两个新页面、6+ 个新后端接口，用一次不可拆分的 Coder 会话去做风险高、不可控，所以直接由 Claude Code 实现，不走自举闭环。
+
+- **`v_project_list`（新增）**：项目列表 + 增删改查。"新建/导入项目"复用已有的 `v_project_setup`/`c_project_create` 流程——`project_scaffold.create_project()` 原本就只在目标目录下新增 `.graphlemon/`，不碰任何已有代码，"导入一个已有代码的目录"这条诉求不需要新代码。真正新增的是读/改半边：`src/project_query.py`（`list_projects`/`get_project`/`update_project`），新增 HTTP `GET /api/projects`、`GET /api/projects/:id`、`PUT /api/projects/:id`、`DELETE /api/projects/:id`（`DELETE` 语义是把 `status` 置为 `archived`，不是物理删除行——`project_id` 被 `task`/`artifact`/`bug_record` 等大量外键引用，物理删除要么违反约束要么需要级联删掉这些本该保留的审计历史，01-M 自己的 `active`/`archived` 枚举本来就是软删除的设计）。
+- **`v_goal_list`（对已有 `v_task_board`/`v_task_detail` 的扩展，非全新页面）**：搜索/筛选已有，新增排序（`task_query.list_tasks()` 加 `sort`/`order` 参数，白名单校验列名防注入）；`v_task_detail` 新增"编辑目标"/"删除任务"，仅在 `status='queued'` 时出现——一旦 Planner/Coder 已经基于这个 goal_text 产出过真实 artifact/work_graph_run，改写或删除就会让审计记录指向一个不存在的目标，这正是这个代码库一直在避免的不可追溯漂移，所以 `task_query.update_task_goal_text()`/`delete_task()` 都在非 `queued` 状态下拒绝（`TaskNotEditableError`，HTTP 409）。
+- **真实验证时发现并修复一个真 bug**：`delete_task()` 第一版对一个真实创建的（走 `task_create.create_task()`，不是测试自己手写的 INSERT）`queued` 任务执行 `DELETE FROM task` 时，真实抛出 `sqlite3.IntegrityError`——`task_create.create_task()` 自己在同一个事务里总会写一条 `execution_event` 行（01-M 自己的外键，没有 `ON DELETE CASCADE`），哪怕这个任务从没被 Planner/Coder/Validator 碰过，也已经至少有一条自己创建时留下的事件。补上了同事务内先删这条任务自己的 `execution_event`（`queued` 态下不可能有真正的 artifact/bug_record/work_graph_run，所以这是唯一可能挡路的外键）。这次 bug 是测试自己的 `_insert_task` 辅助函数（手写 INSERT，从不写 `execution_event`）从没暴露过的——单测通过不代表真的能用，加了一个走真实 `task_create.create_task()` 路径的回归测试锁死。
+- **验证方式**：`src/test_project_query.py`（12 个用例）、`src/test_task_query.py` 新增的排序/编辑/删除用例（含上面这条真实路径回归）、`src/test_backend_server.py` 新增两个真实 HTTP 路由测试类（`ProjectListAndCrudRouteTest`/`TaskCrudRouteTest`，真实起服务器+真实请求，不 mock）。浏览器扩展本次仍不可用，额外对着真实运行的服务器用 `curl` 走了一遍全部新增接口（含前面提到的真删除 bug 就是这一步抓到的）。474 个测试全绿。
@@ -76,6 +76,7 @@ function connectLogTailSocket(nodeExecId, { onChunk, onClose }) {
 const routes = {
   "#/": { render: renderDashboard, mount: mountDashboard },
+  "#/projects": { render: renderProjectList, mount: mountProjectList },
   "#/tasks": { render: renderTaskBoard, mount: mountTaskBoard },
   "#/artifacts": { render: renderArtifactBrowser, mount: mountArtifactBrowser },
   "#/skills": { render: renderSkillLibrary, mount: mountSkillLibrary },
@@ -132,6 +133,109 @@ function render() {
 window.addEventListener("hashchange", render);
 window.addEventListener("DOMContentLoaded", render);
+// ---- v_project_list (2026-08-03): project list + CRUD ----
+// 02-V originally declared "不做完整多项目管理 UI（项目列表/切换）" as an
+// MVP non-goal -- this page is a deliberate, explicit scope expansion
+// beyond that, requested directly by the user. Creation still goes through
+// v_project_setup's existing flow (pick a folder, optionally git-init it,
+// project_scaffold.create_project() already handles a folder that already
+// has real code in it correctly -- it only ever adds .graphlemon/ inside,
+// nothing about "importing" needs to be built separately). This page adds
+// the missing read/update/archive half: list every project, rename,
+// archive/reactivate, and select one as "current" to work in.
+
+function renderProjectList() {
+  return `
+    <div class="page page-wide">
+      <h1>项目</h1>
+      <div class="actions" style="margin-top:0;">
+        <a class="btn btn-primary" href="#/setup">+ 新建 / 导入项目</a>
+      </div>
+      <table class="data-table">
+        <thead>
+          <tr><th>名称</th><th>目标目录</th><th>状态</th><th>Goal 数</th><th>创建时间</th><th></th></tr>
+        </thead>
+        <tbody id="pl_rows"></tbody>
+      </table>
+    </div>
+  `;
+}
+
+function mountProjectList() {
+  const rowsEl = document.getElementById("pl_rows");
+
+  async function refresh() {
+    const resp = await fetch("/api/projects");
+    const projects = await resp.json();
+    if (projects.length === 0) {
+      rowsEl.innerHTML = '<tr><td colspan="6">还没有项目，<a href="#/setup">创建一个</a></td></tr>';
+      return;
+    }
+    rowsEl.innerHTML = projects.map((p) => (
+      '<tr data-project-id="' + p.project_id + '">'
+      + '<td><span class="pl-name-view" data-project-id="' + p.project_id + '">' + escapeHtml(p.name) + "</span>"
+      + '<span class="pl-name-edit" data-project-id="' + p.project_id + '" style="display:none;">'
+      + '<input type="text" class="pl-name-input" value="' + escapeHtml(p.name) + '">'
+      + '<button class="btn" data-action="save-rename" data-project-id="' + p.project_id + '" type="button">✓</button>'
+      + '<button class="btn" data-action="cancel-rename" data-project-id="' + p.project_id + '" type="button">✕</button>'
+      + "</span></td>"
+      + "<td>" + escapeHtml(p.target_folder_path) + "</td>"
+      + '<td><span class="badge ' + (p.status === "active" ? "done" : "") + '">' + p.status + "</span></td>"
+      + "<td>" + p.goal_count + "</td>"
+      + "<td>" + escapeHtml(p.created_at) + "</td>"
+      + "<td>"
+      + '<button class="btn" data-action="select" data-project-id="' + p.project_id + '" type="button">选择</button> '
+      + '<button class="btn" data-action="rename" data-project-id="' + p.project_id + '" type="button">重命名</button> '
+      + '<button class="btn' + (p.status === "active" ? " btn-danger" : "") + '" data-action="toggle-status" '
+      + 'data-project-id="' + p.project_id + '" data-current-status="' + p.status + '" type="button">'
+      + (p.status === "active" ? "归档" : "恢复")
+      + "</button>"
+      + "</td>"
+      + "</tr>"
+    )).join("");
+
+    for (const btn of rowsEl.querySelectorAll('button[data-action="select"]')) {
+      btn.addEventListener("click", () => {
+        setCurrentProjectId(btn.dataset.projectId);
+        window.location.hash = "#/tasks";
+      });
+    }
+    for (const btn of rowsEl.querySelectorAll('button[data-action="rename"]')) {
+      btn.addEventListener("click", () => {
+        const id = btn.dataset.projectId;
+        rowsEl.querySelector('.pl-name-view[data-project-id="' + id + '"]').style.display = "none";
+        rowsEl.querySelector('.pl-name-edit[data-project-id="' + id + '"]').style.display = "inline-block";
+      });
+    }
+    for (const span of rowsEl.querySelectorAll(".pl-name-edit")) {
+      const id = span.dataset.projectId;
+      span.querySelector('[data-action="cancel-rename"]').addEventListener("click", () => {
+        span.style.display = "none";
+        rowsEl.querySelector('.pl-name-view[data-project-id="' + id + '"]').style.display = "";
+      });
+      span.querySelector('[data-action="save-rename"]').addEventListener("click", () => {
+        const newName = span.querySelector(".pl-name-input").value.trim();
+        if (!newName) return;
+        fetch("/api/projects/" + encodeURIComponent(id), {
+          method: "PUT",
+          body: JSON.stringify({ name: newName }),
+        }).then(refresh);
+      });
+    }
+    for (const btn of rowsEl.querySelectorAll('button[data-action="toggle-status"]')) {
+      btn.addEventListener("click", () => {
+        const nextStatus = btn.dataset.currentStatus === "active" ? "archived" : "active";
+        fetch("/api/projects/" + encodeURIComponent(btn.dataset.projectId), {
+          method: "PUT",
+          body: JSON.stringify({ status: nextStatus }),
+        }).then(refresh);
+      });
+    }
+  }
+
+  refresh();
+}
+
 // ---- v_project_setup (02-V §2.1): create/switch project ----
 function renderProjectSetup() {
@@ -585,6 +689,9 @@ function renderTaskBoard() {
   return `
     <div class="page page-wide">
       <h1>任务看板</h1>
+      <div class="actions" style="margin-top:0;">
+        <a class="btn btn-primary" href="#/goals/new">+ 提出新目标</a>
+      </div>
       <div class="filters">
         <input type="text" id="tb_keyword" placeholder="搜索 goal_text" maxlength="128">
         <select id="tb_status">
@@ -597,6 +704,14 @@ function renderTaskBoard() {
           <option value="coder">coder</option>
           <option value="validator">validator</option>
         </select>
+        <select id="tb_sort">
+          <option value="updated_at:desc">按更新时间（新→旧）</option>
+          <option value="updated_at:asc">按更新时间（旧→新）</option>
+          <option value="created_at:desc">按创建时间（新→旧）</option>
+          <option value="created_at:asc">按创建时间（旧→新）</option>
+          <option value="goal_text:asc">按 goal_text（A→Z）</option>
+          <option value="status:asc">按状态</option>
+        </select>
       </div>
       <table class="data-table">
         <thead>
@@ -615,12 +730,16 @@ function mountTaskBoard() {
   const keywordEl = document.getElementById("tb_keyword");
   const statusEl = document.getElementById("tb_status");
   const orgNodeEl = document.getElementById("tb_org_node");
+  const sortEl = document.getElementById("tb_sort");
   async function refresh() {
     const params = new URLSearchParams({ project_id: projectId });
     if (keywordEl.value.trim()) params.set("keyword", keywordEl.value.trim());
     if (statusEl.value) params.set("status", statusEl.value);
     if (orgNodeEl.value) params.set("org_node", orgNodeEl.value);
+    const [sortField, sortOrder] = sortEl.value.split(":");
+    params.set("sort", sortField);
+    params.set("order", sortOrder);
     const resp = await fetch("/api/tasks?" + params.toString());
     const tasks = await resp.json();
     if (tasks.length === 0) {
@@ -647,6 +766,7 @@ function mountTaskBoard() {
   keywordEl.addEventListener("input", refresh);
   statusEl.addEventListener("change", refresh);
   orgNodeEl.addEventListener("change", refresh);
+  sortEl.addEventListener("change", refresh);
   refresh();
   let wasDisconnected = false;
@@ -933,8 +1053,36 @@ function mountTaskDetail(taskId) {
       ).join("") + "</ul>"
     ) : '<div class="hint">暂无 Bug 记录</div>';
+    // v_goal_list CRUD (2026-08-03): editing/deleting a goal is only safe
+    // while it's still 'queued' -- once real work has started, artifacts/
+    // bug_records/work_graph_runs all reference this task_id, and the
+    // backend (task_query.TaskNotEditableError) rejects both operations
+    // past that point anyway; hiding the controls here just avoids
+    // presenting an action that would visibly fail.
+    const goalCrudHtml = task.status !== "queued" ? "" : (
+      '<div class="btn-row" style="margin:0 0 16px;">'
+      + '<button class="btn" id="btn_edit_goal_text" type="button">编辑目标</button>'
+      + '<button class="btn btn-danger" id="btn_delete_goal" type="button">删除任务</button>'
+      + "</div>"
+      + '<div class="panel" id="edit_goal_panel" style="display:none;">'
+      + '<div class="field"><label>目标描述（goal_text）</label>'
+      + '<textarea id="edit_goal_textarea" rows="4">' + escapeHtml(task.goal_text) + "</textarea></div>"
+      + '<div id="edit_goal_error" class="error-banner" style="display:none;"></div>'
+      + '<div class="btn-row">'
+      + '<button class="btn" id="btn_cancel_edit_goal" type="button">取消</button>'
+      + '<button class="btn btn-primary" id="btn_save_goal_text" type="button">保存</button>'
+      + "</div></div>"
+      + '<div class="confirm-banner" id="delete_goal_confirm" style="display:none;">'
+      + "确认删除这个任务？此操作不可撤销。"
+      + '<div class="btn-row" style="margin-top:10px;">'
+      + '<button class="btn" id="btn_cancel_delete_goal" type="button">取消</button>'
+      + '<button class="btn btn-danger" id="btn_confirm_delete_goal" type="button">确认删除</button>'
+      + "</div></div>"
+    );
+
     content.innerHTML = (
       "<h1>" + escapeHtml(task.goal_text) + "</h1>"
+      + goalCrudHtml
       + alertHtml
       + '<div class="meta-row">'
       + "<div><b>STATUS</b>" + escapeHtml(task.status) + "</div>"
@@ -977,6 +1125,56 @@ function mountTaskDetail(taskId) {
         refresh();
       });
     }
+
+    const editBtn = document.getElementById("btn_edit_goal_text");
+    const deleteBtn = document.getElementById("btn_delete_goal");
+    if (editBtn) {
+      const editPanel = document.getElementById("edit_goal_panel");
+      const deleteConfirm = document.getElementById("delete_goal_confirm");
+      const textarea = document.getElementById("edit_goal_textarea");
+      const errorBox = document.getElementById("edit_goal_error");
+
+      editBtn.addEventListener("click", () => {
+        deleteConfirm.style.display = "none";
+        editPanel.style.display = "block";
+      });
+      document.getElementById("btn_cancel_edit_goal").addEventListener("click", () => {
+        editPanel.style.display = "none";
+      });
+      document.getElementById("btn_save_goal_text").addEventListener("click", async () => {
+        errorBox.style.display = "none";
+        const goalText = textarea.value.trim();
+        if (!goalText) {
+          errorBox.textContent = "目标描述不能为空";
+          errorBox.style.display = "block";
+          return;
+        }
+        const resp = await fetch("/api/tasks/" + taskId, {
+          method: "PUT",
+          body: JSON.stringify({ goal_text: goalText }),
+        });
+        const body = await resp.json();
+        if (resp.status !== 200) {
+          errorBox.textContent = body.error + (body.detail ? "：" + body.detail : "");
+          errorBox.style.display = "block";
+          return;
+        }
+        editPanel.style.display = "none";
+        refresh();
+      });
+
+      deleteBtn.addEventListener("click", () => {
+        editPanel.style.display = "none";
+        deleteConfirm.style.display = "block";
+      });
+      document.getElementById("btn_cancel_delete_goal").addEventListener("click", () => {
+        deleteConfirm.style.display = "none";
+      });
+      document.getElementById("btn_confirm_delete_goal").addEventListener("click", async () => {
+        await fetch("/api/tasks/" + taskId, { method: "DELETE" });
+        window.location.hash = "#/tasks";
+      });
+    }
   }
   async function refresh() {
@@ -8,6 +8,7 @@
 <body>
 <nav id="nav">
   <a href="#/">Dashboard</a>
+  <a href="#/projects">Projects</a>
   <a href="#/tasks">Tasks</a>
   <a href="#/artifacts">Artifacts</a>
   <a href="#/skills">Skills</a>
@@ -38,7 +38,7 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from src import (
     artifact_query, budget_guardrail, bug_record, deployment_query, execution_log,
-    org_loop_route, paths, project_scaffold, schema, settings_config,
+    org_loop_route, paths, project_query, project_scaffold, schema, settings_config,
     skill_query, skill_update, task_create, task_query, ws_subscribe,
 )
@@ -121,6 +121,7 @@ def _pick_folder_linux():
 _WS_PROJECTS_PREFIX = "/api/ws/projects/"
+_PROJECTS_PREFIX = "/api/projects/"
 _TASKS_PREFIX = "/api/tasks/"
 _WORK_NODES_PREFIX = "/api/work-nodes/"
 _WS_WORK_NODES_PREFIX = "/api/ws/work-nodes/"
@@ -143,6 +144,14 @@ class _Handler(BaseHTTPRequestHandler):
         if parsed.path.startswith(_WS_PROJECTS_PREFIX):
             self._handle_ws_subscribe(parsed.path, parsed.query)
             return
+        if parsed.path == "/api/projects":
+            self._handle_project_list()
+            return
+        if parsed.path.startswith(_PROJECTS_PREFIX):
+            project_id = parsed.path[len(_PROJECTS_PREFIX):]
+            if project_id and "/" not in project_id:
+                self._handle_project_get(project_id)
+                return
         if parsed.path == "/api/tasks":
             self._handle_task_list(parsed.query)
             return
@@ -232,6 +241,18 @@ class _Handler(BaseHTTPRequestHandler):
             self._handle_budget_update()
         elif self.path == "/api/settings/log-retention":
             self._handle_log_retention_update()
+        elif self.path.startswith(_PROJECTS_PREFIX) and "/" not in self.path[len(_PROJECTS_PREFIX):]:
+            self._handle_project_update(self.path[len(_PROJECTS_PREFIX):])
+        elif self.path.startswith(_TASKS_PREFIX) and "/" not in self.path[len(_TASKS_PREFIX):]:
+            self._handle_task_update(self.path[len(_TASKS_PREFIX):])
+        else:
+            self._send_json(404, {"error": "NOT_FOUND"})
+
+    def do_DELETE(self):
+        if self.path.startswith(_PROJECTS_PREFIX) and "/" not in self.path[len(_PROJECTS_PREFIX):]:
+            self._handle_project_delete(self.path[len(_PROJECTS_PREFIX):])
+        elif self.path.startswith(_TASKS_PREFIX) and "/" not in self.path[len(_TASKS_PREFIX):]:
+            self._handle_task_delete(self.path[len(_TASKS_PREFIX):])
         else:
             self._send_json(404, {"error": "NOT_FOUND"})
@@ -292,6 +313,49 @@ class _Handler(BaseHTTPRequestHandler):
         else:
             self._send_json(200, result)
+    def _handle_project_list(self):
+        with self.server.conn_lock:
+            result = project_query.list_projects(self.server.conn)
+        self._send_json(200, result)
+
+    def _handle_project_get(self, project_id):
+        try:
+            with self.server.conn_lock:
+                result = project_query.get_project(self.server.conn, project_id)
+        except project_query.ProjectNotFoundError:
+            self._send_json(404, {"error": "NOT_FOUND"})
+        else:
+            self._send_json(200, result)
+
+    def _handle_project_update(self, project_id):
+        payload, error = self._read_json_body()
+        if error:
+            self._send_json(400, error)
+            return
+        try:
+            with self.server.conn_lock:
+                result = project_query.update_project(
+                    self.server.conn, project_id, name=payload.get("name"), status=payload.get("status"),
+                )
+        except project_query.ProjectNotFoundError:
+            self._send_json(404, {"error": "NOT_FOUND"})
+        except project_query.InvalidParamError as e:
+            self._send_json(400, {"error": "INVALID_PARAM", "detail": str(e)})
+        else:
+            self._send_json(200, result)
+
+    def _handle_project_delete(self, project_id):
+        """"Delete" archives (project.status='archived') rather than
+        removing the row -- see project_query.py's own docstring for why a
+        real DELETE isn't safe here (FK-referenced history)."""
+        try:
+            with self.server.conn_lock:
+                result = project_query.update_project(self.server.conn, project_id, status="archived")
+        except project_query.ProjectNotFoundError:
+            self._send_json(404, {"error": "NOT_FOUND"})
+        else:
+            self._send_json(200, result)
+
     def _handle_task_create(self):
         payload, error = self._read_json_body()
         if error:
@@ -336,14 +400,20 @@ class _Handler(BaseHTTPRequestHandler):
         if not project_id:
             self._send_json(400, {"error": "INVALID_INPUT", "detail": "project_id is required"})
             return
-        with self.server.conn_lock:
-            result = task_query.list_tasks(
-                self.server.conn, project_id,
-                status=params.get("status", [None])[0],
-                org_node=params.get("org_node", [None])[0],
-                keyword=params.get("keyword", [None])[0],
-            )
-        self._send_json(200, result)
+        try:
+            with self.server.conn_lock:
+                result = task_query.list_tasks(
+                    self.server.conn, project_id,
+                    status=params.get("status", [None])[0],
+                    org_node=params.get("org_node", [None])[0],
+                    keyword=params.get("keyword", [None])[0],
+                    sort=params.get("sort", [None])[0],
+                    order=params.get("order", [None])[0],
+                )
+        except task_query.InvalidParamError as e:
+            self._send_json(400, {"error": "INVALID_PARAM", "detail": str(e)})
+        else:
+            self._send_json(200, result)
     def _handle_task_get(self, task_id):
         try:
@@ -354,6 +424,36 @@ class _Handler(BaseHTTPRequestHandler):
         else:
             self._send_json(200, result)
+    def _handle_task_update(self, task_id):
+        payload, error = self._read_json_body()
+        if error:
+            self._send_json(400, error)
+            return
+        goal_text = payload.get("goal_text")
+        if not goal_text:
+            self._send_json(400, {"error": "INVALID_PARAM", "detail": "goal_text is required"})
+            return
+        try:
+            with self.server.conn_lock:
+                result = task_query.update_task_goal_text(self.server.conn, task_id, goal_text)
+        except task_query.TaskNotFoundError:
+            self._send_json(404, {"error": "NOT_FOUND"})
+        except task_query.TaskNotEditableError as e:
+            self._send_json(409, {"error": "TASK_NOT_EDITABLE", "detail": str(e)})
+        else:
+            self._send_json(200, result)
+
+    def _handle_task_delete(self, task_id):
+        try:
+            with self.server.conn_lock:
+                task_query.delete_task(self.server.conn, task_id)
+        except task_query.TaskNotFoundError:
+            self._send_json(404, {"error": "NOT_FOUND"})
+        except task_query.TaskNotEditableError as e:
+            self._send_json(409, {"error": "TASK_NOT_EDITABLE", "detail": str(e)})
+        else:
+            self._send_json(200, {"task_id": task_id, "deleted": True})
+
     def _handle_task_route(self, task_id):
         """c_org_loop_route (03-C §3.11) -- the underlying route_org_loop()
         was built in U-016 with no HTTP route until now; v_task_detail's
+"""c_project_list / c_project_get / c_project_update (2026-08-03, v_project_list):
+02-V originally declared "不做完整多项目管理 UI（项目列表/切换）" as an MVP
+non-goal -- this is a deliberate, explicit scope expansion beyond that,
+requested directly by the user rather than found while implementing
+something else. Same read/update-query pattern as task_query.py.
+
+"Delete" maps to `project.status = 'archived'`, never a physical row
+delete -- 01-M's own status enum (`active`/`archived`) already models this
+as a soft-delete concept, and `project_id` is referenced via FK from
+task/artifact/bug_record/work_graph_run/etc.; a literal DELETE would either
+violate those constraints or need a destructive cascade that throws away
+real audit history this codebase otherwise goes out of its way to
+preserve (Git-tracked artifacts, bug records, ...). `c_project_create`
+(project_scaffold.py) already handles "point at a folder that already has
+real code in it" correctly -- it only ever creates `.graphlemon/` inside
+the target folder and never touches anything else there -- so importing an
+existing codebase needs no changes here, just this module's read/update
+side.
+"""
+
+_VALID_STATUSES = ("active", "archived")
+
+
+class ProjectNotFoundError(Exception):
+    """NOT_FOUND."""
+
+
+class InvalidParamError(Exception):
+    """INVALID_PARAM."""
+
+
+def list_projects(conn):
+    rows = conn.execute(
+        "SELECT project_id, name, target_folder_path, has_git_repo, status, created_at "
+        "FROM project ORDER BY created_at DESC"
+    ).fetchall()
+    projects = []
+    for r in rows:
+        goal_count = conn.execute("SELECT COUNT(*) FROM task WHERE project_id = ?", (r[0],)).fetchone()[0]
+        projects.append({
+            "project_id": r[0], "name": r[1], "target_folder_path": r[2],
+            "has_git_repo": bool(r[3]), "status": r[4], "created_at": r[5], "goal_count": goal_count,
+        })
+    return projects
+
+
+def get_project(conn, project_id):
+    row = conn.execute(
+        "SELECT project_id, name, target_folder_path, has_git_repo, graphlemon_subdir_initialized, "
+        "status, created_at FROM project WHERE project_id = ?",
+        (project_id,),
+    ).fetchone()
+    if row is None:
+        raise ProjectNotFoundError(project_id)
+    goal_count = conn.execute("SELECT COUNT(*) FROM task WHERE project_id = ?", (project_id,)).fetchone()[0]
+    return {
+        "project_id": row[0], "name": row[1], "target_folder_path": row[2],
+        "has_git_repo": bool(row[3]), "graphlemon_subdir_initialized": bool(row[4]),
+        "status": row[5], "created_at": row[6], "goal_count": goal_count,
+    }
+
+
+def update_project(conn, project_id, name=None, status=None):
+    """Returns the updated project (same shape as get_project). Either
+    field may be omitted; a call with neither is a harmless no-op read."""
+    if conn.execute("SELECT 1 FROM project WHERE project_id = ?", (project_id,)).fetchone() is None:
+        raise ProjectNotFoundError(project_id)
+    if status is not None and status not in _VALID_STATUSES:
+        raise InvalidParamError("status must be one of {}, got {!r}".format(_VALID_STATUSES, status))
+    if name is not None:
+        if not name.strip():
+            raise InvalidParamError("name cannot be blank")
+        conn.execute("UPDATE project SET name = ? WHERE project_id = ?", (name, project_id))
+    if status is not None:
+        conn.execute("UPDATE project SET status = ? WHERE project_id = ?", (status, project_id))
+    conn.commit()
+    return get_project(conn, project_id)
@@ -13,8 +13,21 @@ forcing the frontend to make N more round trips.
 import json
+_SORT_COLUMNS = ("created_at", "updated_at", "goal_text", "status")
-def list_tasks(conn, project_id, status=None, org_node=None, keyword=None):
+
+class InvalidParamError(Exception):
+    """INVALID_PARAM -- e.g. an unrecognized `sort` column."""
+
+
+def list_tasks(conn, project_id, status=None, org_node=None, keyword=None, sort=None, order=None):
+    """`sort`/`order` (2026-08-03, v_goal_list): defaults preserve the
+    original `updated_at DESC` behavior every existing caller (v_task_board)
+    already depends on. `sort` is validated against a fixed column
+    whitelist and never interpolated as anything other than one of those
+    literal strings -- this is the one query in this module built as a
+    dynamic ORDER BY, so it's worth being explicit that user input never
+    reaches the SQL text itself, only a pre-approved column name."""
     query = (
         "SELECT task_id, goal_text, task_type, status, assigned_org_node, loop_round, "
         "created_at, updated_at FROM task WHERE project_id = ?"
@@ -29,7 +42,13 @@ def list_tasks(conn, project_id, status=None, org_node=None, keyword=None):
     if keyword:
         query += " AND goal_text LIKE ?"
         params.append("%" + keyword + "%")
-    query += " ORDER BY updated_at DESC"
+
+    sort_column = sort or "updated_at"
+    if sort_column not in _SORT_COLUMNS:
+        raise InvalidParamError("sort must be one of {}, got {!r}".format(_SORT_COLUMNS, sort))
+    sort_direction = "ASC" if (order or "desc").lower() == "asc" else "DESC"
+    query += " ORDER BY {} {}".format(sort_column, sort_direction)
+
     rows = conn.execute(query, params).fetchall()
     return [
         {
@@ -44,6 +63,55 @@ class TaskNotFoundError(Exception):
     """NOT_FOUND -- 03-C §3.2: c_task_get on a nonexistent task_id."""
+class TaskNotEditableError(Exception):
+    """A goal's `goal_text` can only be edited or deleted while it's still
+    `queued` -- once Planner/Coder/Validator has started real work from it
+    (real artifacts, work_graph_runs, bug_records all reference task_id),
+    changing or removing the goal out from under that history would leave
+    those records pointing at a goal that no longer matches what was
+    actually built, which is exactly the kind of untraceable drift this
+    codebase otherwise goes out of its way to avoid."""
+
+
+def update_task_goal_text(conn, task_id, goal_text):
+    row = conn.execute("SELECT status FROM task WHERE task_id = ?", (task_id,)).fetchone()
+    if row is None:
+        raise TaskNotFoundError(task_id)
+    if row[0] != "queued":
+        raise TaskNotEditableError(
+            "task {} is status={}, goal_text can only be edited while queued".format(task_id, row[0])
+        )
+    conn.execute(
+        "UPDATE task SET goal_text = ?, updated_at = CURRENT_TIMESTAMP WHERE task_id = ?", (goal_text, task_id)
+    )
+    conn.commit()
+    return get_task(conn, task_id)
+
+
+def delete_task(conn, task_id):
+    row = conn.execute("SELECT status FROM task WHERE task_id = ?", (task_id,)).fetchone()
+    if row is None:
+        raise TaskNotFoundError(task_id)
+    if row[0] != "queued":
+        raise TaskNotEditableError(
+            "task {} is status={}, can only be deleted while queued".format(task_id, row[0])
+        )
+    # a real DELETE against a real queued task raised sqlite3.IntegrityError
+    # (2026-08-03, found on first real verification pass) -- task_create.
+    # create_task() always writes an execution_event row in the same
+    # transaction as the task itself (01-M's own FK, no ON DELETE CASCADE),
+    # so even a task that has never been touched by Planner/Coder/Validator
+    # already has at least one execution_event referencing it. Those rows
+    # are this task's own creation-time bookkeeping, not independent audit
+    # content worth preserving once the task itself is gone -- a queued
+    # task can't yet have any artifact/bug_record/work_graph_run rows
+    # (those only start existing once real work begins), so this is the
+    # only FK that can actually be in the way here.
+    conn.execute("DELETE FROM execution_event WHERE task_id = ?", (task_id,))
+    conn.execute("DELETE FROM task WHERE task_id = ?", (task_id,))
+    conn.commit()
+
+
 def get_task(conn, task_id):
     row = conn.execute(
         "SELECT task_id, project_id, goal_text, task_type, origin_ref, created_via, status, route, "
@@ -18,6 +18,7 @@ import tempfile
 import threading
 import time
 import unittest
+import urllib.parse
 from unittest.mock import patch
 from src import backend_server, execution_log, skill_update, ws_subscribe
@@ -350,6 +351,176 @@ class ProjectCreateRouteTest(unittest.TestCase):
         self.assertTrue(os.path.isdir(os.path.join(non_git, ".git")))
+class ProjectListAndCrudRouteTest(unittest.TestCase):
+    """v_project_list (2026-08-03): GET /api/projects (list), GET/PUT/DELETE
+    /api/projects/:id -- project_query.py's own logic is already covered by
+    test_project_query.py, this only exercises the HTTP wiring."""
+
+    def setUp(self):
+        self.server = backend_server.create_server(db_path=":memory:")
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
+        self.thread.start()
+        self.server.conn.execute(
+            "INSERT INTO project (project_id, name, target_folder_path, has_git_repo, status) "
+            "VALUES ('proj-1', 'P1', '/tmp/proj-1', 1, 'active')"
+        )
+        self.server.conn.commit()
+
+    def tearDown(self):
+        self.server.shutdown()
+        self.server.server_close()
+        self.thread.join(timeout=5)
+
+    def _get(self, path):
+        host, port = self.server.server_address
+        conn = http.client.HTTPConnection(host, port, timeout=5)
+        conn.request("GET", path)
+        resp = conn.getresponse()
+        body = json.loads(resp.read())
+        conn.close()
+        return resp.status, body
+
+    def _put(self, path, payload):
+        host, port = self.server.server_address
+        conn = http.client.HTTPConnection(host, port, timeout=5)
+        conn.request("PUT", path, body=json.dumps(payload).encode("utf-8"))
+        resp = conn.getresponse()
+        body = json.loads(resp.read())
+        conn.close()
+        return resp.status, body
+
+    def _delete(self, path):
+        host, port = self.server.server_address
+        conn = http.client.HTTPConnection(host, port, timeout=5)
+        conn.request("DELETE", path)
+        resp = conn.getresponse()
+        body = json.loads(resp.read())
+        conn.close()
+        return resp.status, body
+
+    def test_list_returns_all_projects(self):
+        status, body = self._get("/api/projects")
+        self.assertEqual(status, 200)
+        self.assertEqual([p["project_id"] for p in body], ["proj-1"])
+
+    def test_get_returns_project_detail(self):
+        status, body = self._get("/api/projects/proj-1")
+        self.assertEqual(status, 200)
+        self.assertEqual(body["name"], "P1")
+
+    def test_get_nonexistent_returns_404(self):
+        status, body = self._get("/api/projects/no-such-project")
+        self.assertEqual(status, 404)
+
+    def test_put_renames_project(self):
+        status, body = self._put("/api/projects/proj-1", {"name": "renamed"})
+        self.assertEqual(status, 200)
+        self.assertEqual(body["name"], "renamed")
+
+    def test_delete_archives_not_removes(self):
+        status, body = self._delete("/api/projects/proj-1")
+        self.assertEqual(status, 200)
+        self.assertEqual(body["status"], "archived")
+        status, body = self._get("/api/projects/proj-1")
+        self.assertEqual(status, 200)  # row still exists
+
+
+class TaskCrudRouteTest(unittest.TestCase):
+    """v_goal_list (2026-08-03): sort/order on GET /api/tasks, PUT/DELETE
+    /api/tasks/:id -- task_query.py's own logic is already covered by
+    test_task_query.py, this only exercises the HTTP wiring."""
+
+    def setUp(self):
+        self.server = backend_server.create_server(db_path=":memory:")
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
+        self.thread.start()
+        self.server.conn.execute(
+            "INSERT INTO project (project_id, name, target_folder_path, has_git_repo, status) "
+            "VALUES ('proj-1', 'P1', '/tmp/proj-1', 1, 'active')"
+        )
+        self.server.conn.execute(
+            "INSERT INTO task (task_id, project_id, goal_text, task_type, status, assigned_org_node) "
+            "VALUES ('task-1', 'proj-1', 'old goal', 'goal', 'queued', 'planner')"
+        )
+        self.server.conn.commit()
+
+    def tearDown(self):
+        self.server.shutdown()
+        self.server.server_close()
+        self.thread.join(timeout=5)
+
+    def _get(self, path):
+        host, port = self.server.server_address
+        conn = http.client.HTTPConnection(host, port, timeout=5)
+        conn.request("GET", path)
+        resp = conn.getresponse()
+        body = json.loads(resp.read())
+        conn.close()
+        return resp.status, body
+
+    def _put(self, path, payload):
+        host, port = self.server.server_address
+        conn = http.client.HTTPConnection(host, port, timeout=5)
+        conn.request("PUT", path, body=json.dumps(payload).encode("utf-8"))
+        resp = conn.getresponse()
+        body = json.loads(resp.read())
+        conn.close()
+        return resp.status, body
+
+    def _delete(self, path):
+        host, port = self.server.server_address
+        conn = http.client.HTTPConnection(host, port, timeout=5)
+        conn.request("DELETE", path)
+        resp = conn.getresponse()
+        body = json.loads(resp.read())
+        conn.close()
+        return resp.status, body
+
+    def test_list_invalid_sort_returns_400(self):
+        status, body = self._get("/api/tasks?project_id=proj-1&sort=" + urllib.parse.quote("x;DROP TABLE task"))
+        self.assertEqual(status, 400)
+        self.assertEqual(body["error"], "INVALID_PARAM")
+
+    def test_list_sort_asc_by_goal_text(self):
+        self.server.conn.execute(
+            "INSERT INTO task (task_id, project_id, goal_text, task_type, status, assigned_org_node) "
+            "VALUES ('task-2', 'proj-1', 'aaa', 'goal', 'queued', 'planner')"
+        )
+        self.server.conn.commit()
+        status, body = self._get("/api/tasks?project_id=proj-1&sort=goal_text&order=asc")
+        self.assertEqual(status, 200)
+        self.assertEqual([t["task_id"] for t in body], ["task-2", "task-1"])  # aaa, old goal
+
+    def test_put_edits_goal_text_while_queued(self):
+        status, body = self._put("/api/tasks/task-1", {"goal_text": "new goal"})
+        self.assertEqual(status, 200)
+        self.assertEqual(body["goal_text"], "new goal")
+
+    def test_put_missing_goal_text_returns_400(self):
+        status, body = self._put("/api/tasks/task-1", {})
+        self.assertEqual(status, 400)
+
+    def test_put_on_non_queued_task_returns_409(self):
+        self.server.conn.execute("UPDATE task SET status = 'coding' WHERE task_id = 'task-1'")
+        self.server.conn.commit()
+        status, body = self._put("/api/tasks/task-1", {"goal_text": "new goal"})
+        self.assertEqual(status, 409)
+        self.assertEqual(body["error"], "TASK_NOT_EDITABLE")
+
+    def test_delete_removes_queued_task(self):
+        status, body = self._delete("/api/tasks/task-1")
+        self.assertEqual(status, 200)
+        status, _ = self._get("/api/tasks/task-1")
+        self.assertEqual(status, 404)
+
+    def test_delete_on_non_queued_task_returns_409(self):
+        self.server.conn.execute("UPDATE task SET status = 'done' WHERE task_id = 'task-1'")
+        self.server.conn.commit()
+        status, body = self._delete("/api/tasks/task-1")
+        self.assertEqual(status, 409)
+        self.assertEqual(body["error"], "TASK_NOT_EDITABLE")
+
+
 class TaskAndBugReportRouteTest(unittest.TestCase):
     """U-023: c_task_create (03-C §3.1) + c_bug_report_create (03-C §3.1.1)
     wired to real HTTP routes for v_goal_composer/v_bug_feedback."""
+"""v_project_list tests: c_project_list/c_project_get/c_project_update
+(2026-08-03), real sqlite (no mocking needed).
+
+Run: python3 -m unittest src.test_project_query -v
+"""
+
+import unittest
+
+from src import project_query, schema
+
+
+class ProjectQueryTestBase(unittest.TestCase):
+    def setUp(self):
+        self.conn = schema.connect(":memory:")
+        schema.create_schema(self.conn)
+
+    def tearDown(self):
+        self.conn.close()
+
+    def _insert_project(self, project_id, name="P", target_folder_path=None, status="active"):
+        self.conn.execute(
+            "INSERT INTO project (project_id, name, target_folder_path, has_git_repo, status) "
+            "VALUES (?, ?, ?, 1, ?)",
+            (project_id, name, target_folder_path or ("/tmp/" + project_id), status),
+        )
+        self.conn.commit()
+
+
+class ListProjectsTest(ProjectQueryTestBase):
+    def test_lists_all_projects_with_goal_count(self):
+        self._insert_project("proj-1")
+        self._insert_project("proj-2")
+        self.conn.execute(
+            "INSERT INTO task (task_id, project_id, goal_text, task_type, status, assigned_org_node) "
+            "VALUES ('task-1', 'proj-1', 'goal', 'goal', 'queued', 'planner')"
+        )
+        self.conn.commit()
+
+        result = project_query.list_projects(self.conn)
+        by_id = {p["project_id"]: p for p in result}
+        self.assertEqual(by_id["proj-1"]["goal_count"], 1)
+        self.assertEqual(by_id["proj-2"]["goal_count"], 0)
+
+    def test_includes_archived_projects(self):
+        self._insert_project("proj-1", status="archived")
+        result = project_query.list_projects(self.conn)
+        self.assertEqual(result[0]["status"], "archived")
+
+
+class GetProjectTest(ProjectQueryTestBase):
+    def test_returns_project_detail(self):
+        self._insert_project("proj-1", name="My Project", target_folder_path="/tmp/my-project")
+        result = project_query.get_project(self.conn, "proj-1")
+        self.assertEqual(result["name"], "My Project")
+        self.assertEqual(result["target_folder_path"], "/tmp/my-project")
+        self.assertEqual(result["goal_count"], 0)
+
+    def test_nonexistent_project_raises_not_found(self):
+        with self.assertRaises(project_query.ProjectNotFoundError):
+            project_query.get_project(self.conn, "no-such-project")
+
+
+class UpdateProjectTest(ProjectQueryTestBase):
+    def test_renames_project(self):
+        self._insert_project("proj-1", name="old name")
+        result = project_query.update_project(self.conn, "proj-1", name="new name")
+        self.assertEqual(result["name"], "new name")
+
+    def test_archives_project(self):
+        self._insert_project("proj-1", status="active")
+        result = project_query.update_project(self.conn, "proj-1", status="archived")
+        self.assertEqual(result["status"], "archived")
+
+    def test_reactivates_archived_project(self):
+        self._insert_project("proj-1", status="archived")
+        result = project_query.update_project(self.conn, "proj-1", status="active")
+        self.assertEqual(result["status"], "active")
+
+    def test_invalid_status_rejected(self):
+        self._insert_project("proj-1")
+        with self.assertRaises(project_query.InvalidParamError):
+            project_query.update_project(self.conn, "proj-1", status="deleted")
+
+    def test_blank_name_rejected(self):
+        self._insert_project("proj-1")
+        with self.assertRaises(project_query.InvalidParamError):
+            project_query.update_project(self.conn, "proj-1", name="   ")
+
+    def test_nonexistent_project_raises_not_found(self):
+        with self.assertRaises(project_query.ProjectNotFoundError):
+            project_query.update_project(self.conn, "no-such-project", name="x")
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -175,5 +175,103 @@ class GetTaskTest(TaskQueryTestBase):
         self.assertEqual(node["quota_wait_started_at"], "2026-07-31 09:00:00")
+class ListTasksSortTest(TaskQueryTestBase):
+    def setUp(self):
+        super().setUp()
+        self._insert_task("task-a", goal_text="banana")
+        self.conn.execute(
+            "UPDATE task SET created_at = '2026-01-01 00:00:00', updated_at = '2026-01-01 00:00:00' "
+            "WHERE task_id = 'task-a'"
+        )
+        self._insert_task("task-b", goal_text="apple")
+        self.conn.execute(
+            "UPDATE task SET created_at = '2026-01-02 00:00:00', updated_at = '2026-01-02 00:00:00' "
+            "WHERE task_id = 'task-b'"
+        )
+        self._insert_task("task-c", goal_text="cherry")
+        self.conn.execute(
+            "UPDATE task SET created_at = '2026-01-03 00:00:00', updated_at = '2026-01-03 00:00:00' "
+            "WHERE task_id = 'task-c'"
+        )
+        self.conn.commit()
+
+    def test_default_sort_is_updated_at_desc_unchanged(self):
+        # existing v_task_board behavior must not shift under it
+        result = task_query.list_tasks(self.conn, "proj-1")
+        self.assertEqual([t["task_id"] for t in result], ["task-c", "task-b", "task-a"])
+
+    def test_sort_by_created_at_asc(self):
+        result = task_query.list_tasks(self.conn, "proj-1", sort="created_at", order="asc")
+        self.assertEqual([t["task_id"] for t in result], ["task-a", "task-b", "task-c"])
+
+    def test_sort_by_goal_text_asc(self):
+        result = task_query.list_tasks(self.conn, "proj-1", sort="goal_text", order="asc")
+        self.assertEqual([t["task_id"] for t in result], ["task-b", "task-a", "task-c"])  # apple, banana, cherry
+
+    def test_invalid_sort_column_rejected(self):
+        with self.assertRaises(task_query.InvalidParamError):
+            task_query.list_tasks(self.conn, "proj-1", sort="task_id; DROP TABLE task")
+
+
+class UpdateTaskGoalTextTest(TaskQueryTestBase):
+    def test_queued_task_can_be_edited(self):
+        self._insert_task("task-1", status="queued", goal_text="old")
+        result = task_query.update_task_goal_text(self.conn, "task-1", "new goal text")
+        self.assertEqual(result["goal_text"], "new goal text")
+
+    def test_nonexistent_task_raises_not_found(self):
+        with self.assertRaises(task_query.TaskNotFoundError):
+            task_query.update_task_goal_text(self.conn, "no-such-task", "x")
+
+    def test_in_progress_task_cannot_be_edited(self):
+        self._insert_task("task-1", status="coding")
+        with self.assertRaises(task_query.TaskNotEditableError):
+            task_query.update_task_goal_text(self.conn, "task-1", "new text")
+
+
+class DeleteTaskTest(TaskQueryTestBase):
+    def test_queued_task_can_be_deleted(self):
+        self._insert_task("task-1", status="queued")
+        task_query.delete_task(self.conn, "task-1")
+        self.assertEqual(self.conn.execute("SELECT COUNT(*) FROM task WHERE task_id = 'task-1'").fetchone()[0], 0)
+
+    def test_nonexistent_task_raises_not_found(self):
+        with self.assertRaises(task_query.TaskNotFoundError):
+            task_query.delete_task(self.conn, "no-such-task")
+
+    def test_done_task_cannot_be_deleted(self):
+        self._insert_task("task-1", status="done")
+        with self.assertRaises(task_query.TaskNotEditableError):
+            task_query.delete_task(self.conn, "task-1")
+        self.assertEqual(self.conn.execute("SELECT COUNT(*) FROM task WHERE task_id = 'task-1'").fetchone()[0], 1)
+
+    def test_real_task_create_task_can_still_be_deleted(self):
+        # 2026-08-03 regression: _insert_task (this file's own raw-INSERT
+        # helper) never writes an execution_event row, so it never caught
+        # the real bug -- task_create.create_task() always writes one
+        # execution_event in the same transaction as the task itself (01-M's
+        # own FK, no ON DELETE CASCADE), so even a never-touched queued task
+        # already has one referencing it, and a real DELETE FROM task raised
+        # sqlite3.IntegrityError until delete_task() also cleared it.
+        from src import task_create
+        result = task_create.create_task(self.conn, "proj-1", "a real goal")
+        self.assertEqual(
+            self.conn.execute(
+                "SELECT COUNT(*) FROM execution_event WHERE task_id = ?", (result["task_id"],)
+            ).fetchone()[0],
+            1,
+        )
+        task_query.delete_task(self.conn, result["task_id"])
+        self.assertEqual(
+            self.conn.execute("SELECT COUNT(*) FROM task WHERE task_id = ?", (result["task_id"],)).fetchone()[0], 0
+        )
+        self.assertEqual(
+            self.conn.execute(
+                "SELECT COUNT(*) FROM execution_event WHERE task_id = ?", (result["task_id"],)
+            ).fetchone()[0],
+            0,
+        )
+
+
 if __name__ == "__main__":
     unittest.main()