@bongos/core 1.19.286 → 1.19.288

package/docs/api/openapi.json

@@ -3609,6 +3609,72 @@
         ]
       }
     },
+    "/done-when/{criterionId}": {
+      "patch": {
+        "operationId": "patch_done_when_criterionId",
+        "tags": [
+          "done-when"
+        ],
+        "summary": "PATCH /done-when/:criterionId",
+        "description": "PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102). Was write-once: this file exposed create, satisfy and unsatisfy and nothing else, so wrong text had no API repair path. The incident that forced it: a shell-quoting error stripped backtick-wrapped literals out of three criteria on goal 1000073 at CREATION time — the intent was recorded, the text was wrong, and the only channels were prod SQL or archiving the goal (worse: criteria are version-level rows, so an archived goal's criteria linger in the version rollup). A SATISFIED criterion is REFUSED, by name — see prose-edits.criterionProseRefusal for why that is a decision and not a limitation: a satisfied criterion is a claim someone verified, and re-wording it re-points that verification at text nobody checked. Unsatisfy → edit → re-satisfy makes the undo a recorded act. Gated like criterion CREATION — BOTH HALVES. The permission `criterion.create` is only the RANK floor; the sibling POST /versions/:id/done-when also runs authorizeCriterionCreate, the per-goal owner|manager wall (ADR 0154). Copying just the rank half would let any Metic rewrite criteria on a goal they neither own, manage, nor belong to — reusing the SAME pure gate is the only way the claim \"gated like creation\" is true. (Caught by the grader on the first cut of task 1003102: the comment said it, the code did half of it.) rank: metic+archon — matches POST /versions/:id/done-when.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `criterion.create` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/done-when.js",
+        "x-permissions": [
+          "criterion.create"
+        ],
+        "parameters": [
+          {
+            "name": "criterionId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `criterionId`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchDoneWhenCriterionIdRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchDoneWhenCriterionIdResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/done-when/{criterionId}/satisfy": {
       "post": {
         "operationId": "post_done_when_criterionId_satisfy",
@@ -4212,6 +4278,49 @@
             "builderSession": []
           }
         ]
+      },
+      "patch": {
+        "operationId": "patch_goals_id",
+        "tags": [
+          "goals"
+        ],
+        "summary": "PATCH /goals/:id",
+        "description": "PATCH /goals/:id — correct a goal's own title/description (task 1003102). Handler + rationale + rank note: ../goal-edits.js. Pinned in route-rank-check.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
     "/goals/{id}/archive": {
@@ -5324,30 +5433,12 @@
             "description": "Path parameter `id`."
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PatchGoalsIdVisibilityRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PatchGoalsIdVisibilityResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
-            "$ref": "#/components/responses/ValidationFailed"
+            "$ref": "#/components/responses/BadRequest"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -6249,7 +6340,7 @@
           "inbox"
         ],
         "summary": "PATCH /inbox/:id",
-        "description": "Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. Criterion C2 assigns triage to Metic, so this widened from archon-only to metic+archon when the three-rank model went live. Any builder can still FILE an idea (POST /inbox above); a Xenos cannot triage. rank: metic+archon — idea triage shapes the backlog; criterion C2 / task 360 / ADR 0018.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `idea.triage` (all required).",
+        "description": "**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `idea.triage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/ideas/routes/inbox.js",
         "x-permissions": [
@@ -6308,6 +6399,69 @@
         ]
       }
     },
+    "/inbox/{id}/body": {
+      "patch": {
+        "operationId": "patch_inbox_id_body",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "PATCH /inbox/:id/body",
+        "description": "Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. Criterion C2 assigns triage to Metic, so this widened from archon-only to metic+archon when the three-rank model went live. Any builder can still FILE an idea (POST /inbox above); a Xenos cannot triage. rank: metic+archon — idea triage shapes the backlog; criterion C2 / task 360 / ADR 0018. PATCH /inbox/:id/body — correct an idea's own TEXT (task 1003102 / idea 1000740). A SEPARATE route rather than a new field on PATCH /inbox/:id, deliberately. That route is gated `requirePermission('idea.triage')`, and the ask here is that an idea's AUTHOR can fix their own words. Adding body_md there would have meant dropping the whole triage route to requireBuilder and re-authorizing every field in-handler — widening a pinned route's classified rank to reach one field. A new route with its own pin widens nothing: triage keeps its gate, and this one carries its own, narrower rule. AUTHOR (idea_inbox.captured_by) or a triager. The author case is the point: fixing your own typo must not require escalating to a Metic. rank: any-builder (requireBuilder) + the in-handler author|triage gate. Pinned in route-rank-check.MODULE_EXPECTED_RANKS['ideas']. asyncHandler (the doorway wrapper) owns the catch + the 500 log, so this route carries no console.error of its own — one central log site instead of a 16th copy of the same two lines in this file.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchInboxIdBodyRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchInboxIdBodyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/{id}/ratify": {
       "post": {
         "operationId": "post_inbox_id_ratify",
@@ -14674,6 +14828,39 @@
         ],
         "additionalProperties": false
       },
+      "PatchDoneWhenCriterionIdRequest": {
+        "type": "object",
+        "properties": {
+          "criterion_md": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 10000
+          }
+        },
+        "required": [
+          "criterion_md"
+        ],
+        "additionalProperties": false
+      },
+      "PatchDoneWhenCriterionIdResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "criterion": {},
+          "deltas": {},
+          "unchanged": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "criterion",
+          "deltas",
+          "unchanged"
+        ]
+      },
       "PatchGoalsIdMembersBuilderIdRequest": {
         "type": "object",
         "properties": {
@@ -14703,29 +14890,35 @@
           "changed"
         ]
       },
-      "PatchGoalsIdVisibilityRequest": {
+      "PatchInboxIdBodyRequest": {
         "type": "object",
         "properties": {
-          "visibility": {
-            "type": "string"
+          "body_md": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 50000
           }
         },
         "required": [
-          "visibility"
+          "body_md"
         ],
         "additionalProperties": false
       },
-      "PatchGoalsIdVisibilityResponse": {
+      "PatchInboxIdBodyResponse": {
         "type": "object",
         "properties": {
           "ok": {
             "type": "boolean"
           },
-          "goal": {}
+          "idea": {},
+          "delta": {},
+          "unchanged": {}
         },
         "required": [
           "ok",
-          "goal"
+          "idea",
+          "delta",
+          "unchanged"
         ]
       },
       "PatchInboxIdRequest": {
@@ -18353,9 +18546,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 290,
-  "x-schema-count": 326,
+  "x-endpoint-count": 293,
+  "x-schema-count": 328,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 218,
+  "x-response-schemas": 219,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 290 endpoints across 47 route files.
+> **Generated from the live route files** — the route file is authoritative. 293 endpoints across 47 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -172,10 +172,11 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/discord/channels/plan` | `metic+archon` | — | GET /api/bongos/discord/channels/plan — dry run. |
 | POST | `/api/bongos/discord/channels/reconcile` | `metic+archon` | — | POST /api/bongos/discord/channels/reconcile — apply the config to Discord now. |
 
-## `done-when` (3)
+## `done-when` (4)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| PATCH | `/api/bongos/done-when/:criterionId` | `metic+archon` | `criterion_md` | PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102). |
 | POST | `/api/bongos/done-when/:criterionId/satisfy` | `metic+archon` | `satisfied_by_task_id` | Auth (Metic+): confirm a criterion — flip it to satisfied. |
 | POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `metic+archon` | — | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
 | GET | `/api/bongos/done-when/pending-review` | `metic+archon` | — | Auth (Metic+): the criterion review queue — every criterion auto-flagged "met — pending review" (≥1 linked task, all shipped, not yet con… |
@@ -196,13 +197,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
 | POST | `/api/bongos/github/repos` | `any-builder` | `name` | creates a repo in the caller's OWN account. |
 
-## `goals` (24)
+## `goals` (25)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/goals` | `any-builder` | — | GET /goals?version=&status= — list goals (read). |
 | POST | `/api/bongos/goals` | `metic+archon` | `version_id`, `title`, `description`, `scope_modules`, `succeeds_goal_id` | POST /goals — create a goal. |
 | GET | `/api/bongos/goals/:id` | `any-builder` | — | GET /goals/:id — one goal with its members + linked criteria (read). |
+| PATCH | `/api/bongos/goals/:id` | `any-builder` | — | PATCH /goals/:id — correct a goal's own title/description (task 1003102). |
 | POST | `/api/bongos/goals/:id/archive` | `metic+archon` | — | POST /goals/:id/archive — retire a goal (open\|achieved → archived). |
 | GET | `/api/bongos/goals/:id/conflicts` | `any-builder` | — | GET /goals/:id/conflicts — the server-side task-conflict view (task 1736). |
 | POST | `/api/bongos/goals/:id/conflicts/resolve` | `any-builder` | `action`, `note`, `touches`, `first_task_id`, `then_task_id`, `task_id` | POST /goals/:id/conflicts/resolve — the owner/manager resolution actions for a detected conflict (task 1736; authority model ADR 0106): s… |
@@ -221,7 +223,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/goals/:id/suggest-criteria` | `any-builder` | — | GET /goals/:id/suggest-criteria?title=&description=&limit= — task 2165. |
 | POST | `/api/bongos/goals/:id/tasks` | `any-builder` | `title`, `description`, `touches`, `est_minutes`, `priority`, `kind`, `discipline`, `value_summary`, `parent_task_id` | POST /goals/:id/tasks — bounded task authoring within a goal's scope (BV1.R60 / ADR 0086 §3). |
 | POST | `/api/bongos/goals/:id/transfer` | `any-builder` | `builder_id` | POST /goals/:id/transfer — hand the goal to a new owner (task 1735). |
-| PATCH | `/api/bongos/goals/:id/visibility` | `any-builder` | `visibility` | PATCH /goals/:id/visibility — make a goal public\|private (task 1952 / ADR 0112). |
+| PATCH | `/api/bongos/goals/:id/visibility` | `any-builder` | — | PATCH /goals/:id/visibility — make a goal public\|private (task 1952 / ADR 0112). |
 | GET | `/api/bongos/goals/inbox` | `any-builder` | — | GET /goals/inbox — the caller's private-goals inbox (task 1952 / ADR 0112): { invitations: invites addressed to me (accept/decline); join… |
 | POST | `/api/bongos/goals/reorder` | `metic+archon` | `version_id`, `ordered_ids` | POST /goals/reorder — Archon drag-to-reorder: set the priority order of every goal WITHIN one version (task 1760). |
 
@@ -255,14 +257,15 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
 
-## `inbox` (7)
+## `inbox` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/inbox` | `any-builder` | — | read open ideas; skill-friction rows filtered by viewer rank. |
 | POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `goal_id`, `grade`, `template_key`, `field_values` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
-| PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
+| PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` |  |
+| PATCH | `/api/bongos/inbox/:id/body` | `any-builder` | `body_md` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |
 | POST | `/api/bongos/inbox/:id/resubmit` | `any-builder` | `field_values`, `template_key` | RESUBMIT a Full Idea after a rejection (R13 of goal 1000069, criterion C2: an idea never dies and never stalls). |
 | GET | `/api/bongos/inbox/awaiting-nod` | `metic+archon` | — | GET /inbox/awaiting-nod — the NOD QUEUE (task 1003066, BV1.R05). |

package/modules/ideas/inbox.js

@@ -546,6 +546,48 @@ async function countOpenIdeas({ viewerRank = null } = {}) {
 // open), then merge C into A, whose status still reads 'open'. So the chain
 // guard tests the TARGET COLUMN, not the target's status, and a target write
 // must carry status='merged'.
+// updateIdeaBody — correct an idea's PROSE (task 1003102 / idea 1000740).
+//
+// PATCH /inbox/:id accepts status, kind, promoted_to_task_id, reviewed_at,
+// merged_into_idea_id and triage_note — every field ABOUT the idea, and not the
+// idea itself. So a correction to the text had to live in a triage_note beside
+// the words it corrected, rather than in them.
+//
+// Returns { idea, delta } — delta is { field, from, to, from_len, to_len } with
+// clipped excerpts, or null when the text is unchanged. The global write-audit
+// middleware records only the REQUEST body (the NEW text), so an edit to durable
+// prose would otherwise leave no trace of what it replaced.
+//
+// BOUNDARY-FORCED DUPLICATION (ADR 0091 §2): the same excerpt/delta shaping lives
+// in modules/lifecycle/prose-edits.js for goals + criteria. A module may not
+// require a sibling module, and this is 6 lines of formatting — copied
+// deliberately and noted at both sites rather than pushed into the doorway.
+const BODY_AUDIT_EXCERPT = 120;
+async function updateIdeaBody(id, bodyMd) {
+  const ideaId = Number(id);
+  if (!Number.isFinite(ideaId)) throw new Error('updateIdeaBody: numeric id required');
+  const { rows: before } = await pool.query(`SELECT ${IDEA_COLS} FROM idea_inbox WHERE id = $1`, [ideaId]);
+  if (before.length === 0) return null;
+  const clip = (v) => {
+    const t = v == null ? '' : String(v).replace(/\s+/g, ' ').trim();
+    return t.length > BODY_AUDIT_EXCERPT ? `${t.slice(0, BODY_AUDIT_EXCERPT - 1)}…` : t;
+  };
+  const prev = before[0].body_md;
+  if (prev === bodyMd) return { idea: before[0], delta: null };
+  const { rows } = await pool.query(
+    `UPDATE idea_inbox SET body_md = $2 WHERE id = $1 RETURNING ${IDEA_COLS}`,
+    [ideaId, bodyMd]
+  );
+  return {
+    idea: rows[0],
+    delta: {
+      field: 'body_md', from: clip(prev), to: clip(bodyMd),
+      from_len: prev == null ? 0 : String(prev).length,
+      to_len: bodyMd == null ? 0 : String(bodyMd).length,
+    },
+  };
+}
+
 async function updateIdea(id, { status, kind, promoted_to_task_id, reviewed_at, merged_into_idea_id, triage_note } = {}) {
   if (merged_into_idea_id !== undefined && merged_into_idea_id !== null) {
     if (status !== 'merged') {
@@ -1056,6 +1098,7 @@ module.exports = {
   getIdeaGrade,
   // mutate
   updateIdea,
+  updateIdeaBody,
   setIdeaGrade,
   setIdeaCompleteness,
   // idea → task lineage (task 1002997 / BV1.R173) — the one-idea-many-tasks

package/modules/ideas/routes/inbox.js

@@ -448,6 +448,81 @@ module.exports = function buildInboxRouter() {
   // archon-only to metic+archon when the three-rank model went live. Any
   // builder can still FILE an idea (POST /inbox above); a Xenos cannot triage.
   // rank: metic+archon — idea triage shapes the backlog; criterion C2 / #360 / ADR 0018.
+  // PATCH /inbox/:id/body — correct an idea's own TEXT (task 1003102 / idea 1000740).
+  //
+  // A SEPARATE route rather than a new field on PATCH /inbox/:id, deliberately.
+  // That route is gated `requirePermission('idea.triage')`, and the ask here is
+  // that an idea's AUTHOR can fix their own words. Adding body_md there would have
+  // meant dropping the whole triage route to requireBuilder and re-authorizing
+  // every field in-handler — widening a pinned route's classified rank to reach
+  // one field. A new route with its own pin widens nothing: triage keeps its gate,
+  // and this one carries its own, narrower rule.
+  //
+  // AUTHOR (idea_inbox.captured_by) or a triager. The author case is the point:
+  // fixing your own typo must not require escalating to a Metic.
+  // rank: any-builder (requireBuilder) + the in-handler author|triage gate.
+  // Pinned in route-rank-check.MODULE_EXPECTED_RANKS['ideas'].
+  // asyncHandler (the doorway wrapper) owns the catch + the 500 log, so this
+  // route carries no console.error of its own — one central log site instead of
+  // a 16th copy of the same two lines in this file.
+  router.patch('/inbox/:id/body', api.requireBuilder, api.asyncHandler('PATCH /inbox/:id/body', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      body_md: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.DESCRIPTION },
+    })) return;
+    const id = Number(req.params.id);
+    if (!Number.isFinite(id)) return res.fail('bad_idea_id', 400);
+    const existing = await inbox.getIdea(id);
+    if (!existing) return res.fail('idea_not_found', 404);
+    // Ordered + fail-closed: authority first, and it reveals nothing about the
+    // idea a non-author could not already read from the inbox.
+    const isAuthor = existing.captured_by != null
+      && String(existing.captured_by) === String(req.builder.id);
+    // The doorway exposes requirePermission as MIDDLEWARE, not a callable
+    // predicate, and this decision is in-handler (it depends on the row), so the
+    // triager arm is expressed as the rank floor that `idea.triage` resolves to
+    // — the same floor PATCH /inbox/:id classifies at (metic+archon). Stated
+    // rather than hidden: if the permission's floor ever moves, this must move
+    // with it, and tests/prose_edits.mjs pins the pair.
+    // rankMeetsThreshold takes the ALLOWED-rank ARRAY (the floor is its
+    // lowest-authority member), not a single rank — passing a string makes it
+    // throw on .reduce, which is exactly the trap a dead fallback would have hidden.
+    const canTriage = api.rankMeetsThreshold(req.builder.rank, ['metic', 'archon']);
+    if (!isAuthor && !canTriage) {
+      return res.fail('not_idea_author', { status: 403, message: 'Only the idea\'s author (or a triager) may correct its text.' });
+    }
+    const result = await inbox.updateIdeaBody(id, req.body.body_md);
+    if (!result) return res.fail('idea_not_found', 404);
+    if (result.delta) {
+      const d = result.delta;
+      // Through api.logger — the seam this file already uses (see
+      // /inbox/awaiting-nod) — not a raw console call.
+      api.logger('ideas').info(`idea ${id} body edited by builder ${req.builder.id}${isAuthor ? ' (author)' : ' (triage)'}: "${d.from}" -> "${d.to}" (${d.from_len}->${d.to_len} chars)`);
+      // ...AND persist it. Task item 4 asks for an audit ROW on all three prose
+      // surfaces, and a log line is not one: not queryable, and it rotates away.
+      // The goal + criterion paths get this from lifecycle's recordProseEdit; a
+      // module may not require a sibling module, so this writes the same shape
+      // through the doorway's own insertAuditLog — boundary-forced duplication
+      // (ADR 0091 §2), noted at both sites. Best-effort: the edit already
+      // committed, so a failed audit write must not fail the request — but it is
+      // logged as an AUDIT GAP rather than swallowed, because a silent gap is the
+      // failure mode this task exists to close.
+      try {
+        await api.insertAuditLog({
+          builderId: req.builder.id,
+          route: `idea:${id}:prose-edit`,
+          method: 'PATCH',
+          requestBodyRedacted: JSON.stringify({ deltas: [d] }),
+          responseStatus: 200,
+          ip: req.ip || null,
+          userAgent: req.get ? req.get('user-agent') : null,
+        });
+      } catch (auditErr) {
+        api.logger('ideas').error(`AUDIT GAP: idea ${id} body edit landed but its audit row failed: ${auditErr && auditErr.message}`);
+      }
+    }
+    return res.json({ ok: true, idea: result.idea, delta: result.delta, unchanged: !result.delta });
+  }, { errorCode: 'idea_body_update_failed' }));
+
   router.patch('/inbox/:id', api.requireBuilder, api.requirePermission('idea.triage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       // Enum kept light — inbox.updateIdea returns a structured BAD_STATUS

package/modules/lifecycle/db.js

@@ -3863,7 +3863,7 @@ async function shipTask({ taskId, builderId }, deps = {}) {
         justUnlocked = [];
       }
     }
-
+    await doneWhen.closeCompletedWorkForShip(client, taskId); // task 1002069/ADR 0183 — in-txn criterion+goal close
     return {
       shipRow: rows[0], graduationBuilder, rankGraduation, actualShipperId,
       closedClaimCount: closedClaims.length,