@bongos/core 1.24.13 → 1.24.15

package/modules/lifecycle/task-name.js

@@ -0,0 +1,140 @@
+'use strict';
+// modules/lifecycle/task-name.js — every task's short name: 2-3 plain words, so a
+// person reads "task 1004745 - payout approvals" instead of a bare number (task 1004958).
+//
+// WHY. Sessions mention task numbers in passing ("task 1004745 is stranded", "after
+// 1004927 lands") as if the builder could keep up with them. A number alone means
+// nothing to the reader. The name is STORED (tasks.short_name, lifecycle_019), so it
+// is the same on every surface; createTask fills it, the publish-reconciler backfills
+// the rows created before it, and the task's author may change it (PATCH /tasks/:id).
+//
+// NOT A TRUNCATED TITLE. Titles open with words that describe nothing — "Goal 1000092
+// N9:", "fix(auth):", "PMS-V2 —", "V4.R38 —" — so `deriveTaskName` strips those labels,
+// keeps the title's head clause, drops filler words and keeps the first three that say
+// what the work is about.
+//
+// A SAFE STRING BY CONSTRUCTION. The startup notes inject text into every session and
+// print no builder-authored text raw (scripts/bongos/strand-watch.js). A name is at most
+// three lowercase words of [a-z0-9-] and 40 characters; `safeTaskName` re-checks that on
+// every read and the table CHECK holds it on every write, so a name can carry a topic
+// and nothing else. An author's edit goes through the same normaliser.
+//
+// Requires nothing, so a CLI can print a name without loading the pool.
+
+const MAX_WORDS = 3;
+const MAX_LEN = 40;
+const MAX_WORD_LEN = 20;
+// The same pattern, character for character, as core_289's CHECK (tests/task_name.mjs).
+const NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*( [a-z0-9]+(-[a-z0-9]+)*){0,2}$/;
+
+// Words that carry no topic: articles, prepositions, auxiliaries, quantifiers.
+const STOP = new Set((
+  'a an the and or but nor of to in on at by for from with without into onto over under about as '
+  + 'is are was were be been being am do does did done has have had having can could will would '
+  + 'shall should may might must need needs needed get gets got let lets make makes it its this '
+  + 'that these those there their them they we our us you your i me my he she his her so if then '
+  + 'than when what which who whom whose why how where while not no yes all any each every some '
+  + 'more most less only just also too very via per vs etc one two n new now still again once '
+  // …and labels that say how a task was filed, not what it is about.
+  + 'phase part step urgent hotfix wip tracking bundle proof spike'
+).split(' '));
+
+// Labels a title opens with that describe nothing. Applied repeatedly from the start.
+const LABELS = [
+  /^goal\s+\d+\s*(?:[a-z]{1,4}\d+[a-z]?\s*)?[:—–-]?\s*/i,           // "Goal 1000092 N9:"
+  /^(?:fix|feat|chore|docs|diag|refactor|test|tests|perf|ci|build|style|revert)(?:\([^)]*\))?!?\s*:\s*/i, // "fix(auth):"
+  // Every repeat is bounded (no nested unbounded quantifier), so a hostile title
+  // cannot make this backtrack super-linearly.
+  /^[A-Z][A-Za-z]{0,5}\d{0,4}(?:[.-][A-Za-z]{0,6}\d{1,4}[a-z]?){1,3}\s{0,3}[:—–-]\s*/, // "V4.R38 —", "PMS-V2 —", "BV2.TW14:"
+  /^[A-Z]{2,6}\s*[:—–]\s*/,                                          // "SEC:", "PMS —"
+  /^(?:task|idea|blocker)\s+#?\d+\s*[:—–-]?\s*/i,                    // "task 123:"
+  /^\[[^\]]{0,40}\]\s*/,                                             // "[wip]"
+  /^#?\d+\s*[:—–-]\s*/,                                              // "123 —"
+];
+
+// The head clause ends at the first strong separator.
+const HEAD_CUT = /\s[—–]\s|:\s|;\s|\s\(|\s\+\s|\s-\s|\s→\s|\.\s/;
+
+// Only the opening of a title can hold a name; reading at most this much bounds the
+// work per title whatever its length.
+const MAX_TITLE_READ = 200;
+
+function stripLabels(title) {
+  let s = String(title || '').slice(0, MAX_TITLE_READ).trim();
+  for (let guard = 0; guard < 6; guard++) {
+    const before = s;
+    for (const re of LABELS) s = s.replace(re, '');
+    s = s.trim();
+    if (s === before) break;
+  }
+  return s;
+}
+
+// One raw token to a name word, or null. "ship.js" → "ship", "gds_session" →
+// "gds-session", "#898" / "2026-06-12" / "V2" → null.
+function toWord(raw) {
+  let w = String(raw).normalize('NFKD').replace(/[\u0300-\u036f]/g, '').toLowerCase();
+  w = w.replace(/\.(?:js|mjs|cjs|ts|md|json|sql|sh|yml|yaml|html|css)$/, '');
+  w = w.replace(/_/g, '-').replace(/[^a-z0-9-]/g, '').replace(/-+/g, '-').replace(/^-|-$/g, '');
+  if (!w || STOP.has(w)) return null;
+  if (/\d/.test(w)) return null; // ids, dates, version labels, counts
+  if (w.length > MAX_WORD_LEN) w = w.slice(0, MAX_WORD_LEN).replace(/-+$/, '');
+  return w.length >= 2 ? w : null;
+}
+
+function wordsOf(text) {
+  return String(text).normalize('NFKD').replace(/[\u0300-\u036f]/g, '').split(/[\s/,]+/).map((t) => t.replace(/^[^\w]+|[^\w]+$/g, '')).map(toWord).filter(Boolean);
+}
+
+function fit(words) {
+  const out = [];
+  for (const w of words) {
+    if (out.includes(w)) continue;
+    const next = [...out, w].join(' ');
+    if (next.length > MAX_LEN) break;
+    out.push(w);
+    if (out.length === MAX_WORDS) break;
+  }
+  return out.length ? out.join(' ') : null;
+}
+
+function nameFrom(text) {
+  const body = stripLabels(text);
+  const cut = body.search(HEAD_CUT);
+  const head = cut > 0 ? body.slice(0, cut) : body;
+  const headWords = wordsOf(head);
+  // A head clause of one word ("Proof: forced-drift …") is itself a label; read on.
+  return fit(headWords.length >= 2 ? headWords : wordsOf(body));
+}
+
+// The name for a task: from its title, else (a title of only ids or labels) from the
+// opening of its description. Null only when neither has a topic word at all.
+function deriveTaskName(title, description) {
+  return nameFrom(title) || (description ? nameFrom(String(description).split(/\n\s*\n/)[0]) : null);
+}
+
+// A stored or authored name, re-checked. Returns the name or null — never anything else.
+function safeTaskName(v) {
+  if (typeof v !== 'string') return null;
+  return v.length <= MAX_LEN && NAME_RE.test(v) ? v : null;
+}
+
+// An author's edit, normalised to the same alphabet. Null when nothing usable is left.
+function normaliseAuthoredName(input) {
+  if (typeof input !== 'string') return null;
+  const words = input.split(/\s+/).map((t) => {
+    const w = t.normalize('NFKD').replace(/[\u0300-\u036f]/g, '').toLowerCase()
+      .replace(/_/g, '-').replace(/[^a-z0-9-]/g, '').replace(/-+/g, '-').replace(/^-|-$/g, '');
+    return w.slice(0, MAX_WORD_LEN).replace(/-+$/, '');
+  }).filter(Boolean);
+  if (!words.length || words.length > MAX_WORDS) return null;
+  return safeTaskName(words.join(' '));
+}
+
+// How a task is written to a person: "task N - name", or "task N" when it has none yet.
+function taskRef(id, name) {
+  const n = safeTaskName(name);
+  return n ? `task ${id} - ${n}` : `task ${id}`;
+}
+
+module.exports = { deriveTaskName, safeTaskName, normaliseAuthoredName, taskRef, MAX_WORDS, MAX_LEN, NAME_RE };

package/modules/market-watch/db.js

@@ -163,9 +163,18 @@ async function getItem(pool, { project, id, knownRuns = null }) {
 
 const CASE_FILE_SQL = `
   SELECT e.id, e.run_id, e.type, e.found_on, e.takeaway, e.dimension, e.source_url,
-         e.source_label, e.confidence, e.pinned, e.created_at
+         e.source_label, e.confidence, e.pinned, e.created_at,
+         c.decided_at AS corrected_at, c.reason AS correction_reason, COALESCE(c.wrong, false) AS marked_wrong
     FROM market_watch_log_entries e
     JOIN market_watch_items i ON i.id = e.item_id
+    -- the entry's latest applied correction (task 1005016): the proposal row is where who
+    -- proposed it, who approved it, when, why and the text it replaced are kept
+    LEFT JOIN LATERAL (
+      SELECT p.decided_at, p.reason, p.payload->>'wrong' = 'true' AS wrong
+        FROM market_watch_proposals p
+       WHERE p.project = i.project AND p.log_entry_id = e.id AND p.kind = 'correct_entry' AND p.status = 'applied'
+       ORDER BY p.decided_at DESC, p.id DESC
+       LIMIT 1) c ON true
    WHERE i.project = $1 AND e.item_id = $2
    ORDER BY e.pinned DESC, e.found_on DESC, e.id DESC`;
 

package/modules/market-watch/migrations/market_watch_004_entry_corrections.sql

@@ -0,0 +1,20 @@
+-- market_watch_004_entry_corrections.sql - the lookup of an entry's applied correction
+-- (task 1005016, goal 1000137).
+--
+-- An approved correct_entry proposal is applied to its log entry, and the proposal row
+-- keeps who, when, why and the replaced text. Two reads look that correction up once per
+-- entry: the item page's case file (modules/market-watch/db.js CASE_FILE_SQL, a LATERAL
+-- join for the latest applied correction) and the home's weekly reports
+-- (modules/market-watch/pages.js WEEK_ENTRIES_SQL, which skips an entry marked wrong).
+-- Without this index each of those scans the project's proposals per entry. The partial
+-- index holds exactly the rows they can match, in the order they read them.
+--
+-- Additive and idempotent, like 001 to 003.
+
+BEGIN;
+
+CREATE INDEX IF NOT EXISTS market_watch_proposals_entry_corrections
+  ON market_watch_proposals (log_entry_id, decided_at DESC, id DESC)
+  WHERE kind = 'correct_entry' AND status = 'applied';
+
+COMMIT;

package/modules/market-watch/pages.js

@@ -30,6 +30,7 @@ const STREAK_SLOTS = 9;
 const REASON_MAX = 280;
 const NAME_MAX = 120;
 const URL_MAX = 500;
+const TAKEAWAY_MAX = 500;
 const DIM_RE = /^[a-z][a-z0-9_]{0,59}$/;
 // The four the item page's "Propose a change" offers, then the two the other buttons file.
 const ITEM_KINDS = Object.freeze(['rescore', 'move_kind', 'add_source', 'correct_entry', 'remove_item']);
@@ -59,6 +60,11 @@ const WEEK_ENTRIES_SQL = `
     FROM market_watch_log_entries e
     JOIN market_watch_items i ON i.id = e.item_id
    WHERE i.project = $1 AND i.status <> 'removed' AND e.found_on >= $2::date
+     -- an entry whose latest applied correction marked it wrong (task 1005016) is no report
+     AND NOT COALESCE((SELECT p.payload->>'wrong' = 'true' FROM market_watch_proposals p
+                        WHERE p.project = i.project AND p.log_entry_id = e.id AND p.kind = 'correct_entry'
+                          AND p.status = 'applied'
+                        ORDER BY p.decided_at DESC, p.id DESC LIMIT 1), false)
    ORDER BY e.found_on DESC, e.id DESC
    LIMIT 1000`;
 
@@ -208,6 +214,9 @@ function shapeItem({ item, entries, history, rules, openProposals = 0 }) {
       id: Number(e.id), run: e.run, type: e.type, found_on: isoDay(e.found_on), takeaway: e.takeaway,
       dimension: e.dimension, source_url: e.source_url, source_label: e.source_label,
       confidence: Number(e.confidence), pinned: !!e.pinned,
+      // An applied correction (task 1005016): when it was made and why. The takeaway
+      // above already reads as corrected; a wrong entry keeps its text, flagged.
+      corrected: e.corrected_at ? { on: isoDay(e.corrected_at), reason: e.correction_reason || '', wrong: !!e.marked_wrong } : null,
     })),
     open_proposals: Number(openProposals) || 0,
   };
@@ -287,9 +296,19 @@ function normalizeProposal(body, { item = null, rubricKeys = null } = {}) {
     return { ok: true, value: { ...base, payload: { source_url: url } } };
   }
   if (kind === 'correct_entry') {
+    // The proposal carries the correction itself (task 1005016): either the takeaway as
+    // it should read, or a flag that the entry is wrong. The reason says why. Approving
+    // it on the rules page applies it to the entry (proposals.js).
     const entry = String(b.log_entry_id || '');
     if (!/^[1-9]\d{0,17}$/.test(entry)) return { ok: false, error: 'invalid_entry', message: 'Pick the entry to correct.' };
-    return { ok: true, value: { ...base, log_entry_id: Number(entry), payload: {} } };
+    const wrong = b.wrong === true || b.wrong === 'true';
+    const takeaway = oneLine(b.takeaway);
+    if (wrong && takeaway) return { ok: false, error: 'invalid_correction', message: 'Either correct the entry or mark it as wrong, not both.' };
+    if (wrong) return { ok: true, value: { ...base, log_entry_id: Number(entry), payload: { wrong: true, summary: 'Mark an entry as wrong' } } };
+    if (!takeaway) return { ok: false, error: 'correction_required', message: 'Write the entry as it should read, or mark it as wrong.' };
+    if (takeaway.length > TAKEAWAY_MAX) return { ok: false, error: 'correction_too_long', message: `Keep the correction to ${TAKEAWAY_MAX} characters.` };
+    const short = takeaway.length > 90 ? `${takeaway.slice(0, 89)}…` : takeaway;
+    return { ok: true, value: { ...base, log_entry_id: Number(entry), payload: { takeaway, summary: `Correct an entry to read "${short}"` } } };
   }
   return { ok: true, value: { ...base, payload: {} } }; // remove_item: stop tracking
 }

package/modules/market-watch/proposals.js

@@ -23,8 +23,12 @@
 //                name and link are already tracked as the 'to' kind.
 //   add_source   payload { source_url }: the link joins the item's facts.watch_sources
 //                (shown on the item page; the weekly run does not read it yet).
-//   correct_entry payload {} with log_entry_id: the reason IS the correction, written for
-//                a person to act on, so the decision is recorded as 'approved' only.
+//   correct_entry payload { takeaway } or { wrong: true } with log_entry_id (task 1005016):
+//                the entry's takeaway is rewritten to the corrected one, or the entry is
+//                left as found and read as marked wrong (db.caseFile; the home's reports
+//                skip it). The text it replaced is kept on the proposal (payload.was),
+//                beside who proposed it, who approved it, when, and the reason why. A
+//                correct_entry filed before then carries no correction and is refused.
 //   The four item-page payloads are written by modules/market-watch/pages.js (task 1004939).
 // A carried-out approval is status 'applied'; a recorded one is 'approved'. A decline is
 // 'rejected'. Every decision names who made it and when (decided_by, decided_at).
@@ -58,7 +62,7 @@ const SQL = Object.freeze({
     VALUES ($1, $2, 'member', $3, $4, $5::jsonb, $6, $7)
     RETURNING id, kind, status, created_at`,
   lock: `-- mw:proposal-lock
-    SELECT id, kind, origin, item_id, rule_version_id, payload, reason, proposed_by, status
+    SELECT id, kind, origin, item_id, log_entry_id, rule_version_id, payload, reason, proposed_by, status
       FROM market_watch_proposals WHERE id = $1 AND project = $2 FOR UPDATE`,
   maxVersion: `-- mw:rules-max-version
     SELECT COALESCE(max(version), 0)::int AS v FROM market_watch_rule_versions WHERE project = $1`,
@@ -117,6 +121,22 @@ const SQL = Object.freeze({
            updated_at = now()
      WHERE id = $1 AND project = $2 AND status <> 'removed'
     RETURNING id`,
+  // The entry a correction names, locked, scoped to the proposal's item and this project.
+  entryLock: `-- mw:entry-lock
+    SELECT e.id, e.item_id, e.run_id, e.takeaway
+      FROM market_watch_log_entries e
+      JOIN market_watch_items i ON i.id = e.item_id
+     WHERE e.id = $1 AND e.item_id = $3 AND i.project = $2
+       FOR UPDATE OF e`,
+  // The corrected takeaway, unless the same item already holds that takeaway from the
+  // same run (the unique index market_watch_log_entries_once would refuse it).
+  entryCorrect: `-- mw:entry-correct
+    UPDATE market_watch_log_entries e SET takeaway = $2::text
+     WHERE e.id = $1
+       AND NOT EXISTS (SELECT 1 FROM market_watch_log_entries o
+                        WHERE o.item_id = e.item_id AND o.run_id = e.run_id AND o.id <> e.id
+                          AND md5(o.takeaway) = md5($2::text))
+    RETURNING e.id`,
   atVote: `-- mw:proposal-at-vote
     UPDATE market_watch_proposals SET payload = payload || jsonb_build_object('matter_id', $3::text)
      WHERE id = $1 AND project = $2 AND status = 'open'`,
@@ -206,9 +226,20 @@ function itemChange(kind, payload) {
   return null;
 }
 
+// entryCorrection(payload) → { takeaway } | { wrong: true, takeaway: null } | null — what a
+// correct_entry carries (pages.normalizeProposal writes it), re-checked here. A proposal
+// filed before task 1005016 carries neither, so it cannot be applied (no_correction).
+function entryCorrection(payload) {
+  const p = payload || {};
+  if (p.wrong === true) return { wrong: true, takeaway: null };
+  const t = String(p.takeaway == null ? '' : p.takeaway).replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s+/g, ' ').trim();
+  return t && t.length <= 500 ? { takeaway: t } : null;
+}
+
 // decideProposal(pool, { project, id, decision, decidedBy, via, withTx }) →
 //   { ok: true, status, applied, version?, item_id? } |
-//   { ok: false, reason: 'not_found' | 'not_open' | 'no_active_rules' | 'no_longer_applies' | 'bad_payload' | 'item_gone' }
+//   { ok: false, reason: 'not_found' | 'not_open' | 'no_active_rules' | 'no_longer_applies' | 'bad_payload' | 'item_gone'
+//     | 'no_correction' | 'entry_gone' | 'same_as_another_entry' }
 // `via` is recorded on the proposal's payload when a government vote decided it
 // ({ decided_via: 'vote', matter_id }); an owner's own decision records nothing extra.
 // `withTx(fn)` runs fn(client) in one transaction (the doorway's withTx in production).
@@ -219,8 +250,8 @@ async function decideProposal({ project, id, decision, decidedBy, via = null, wi
     const { rows: [p] } = await client.query(SQL.lock, [id, project]);
     if (!p) return { ok: false, reason: 'not_found' };
     if (p.status !== 'open') return { ok: false, reason: 'not_open', status: p.status };
-    const extra = JSON.stringify(via || {});
-    const decide = async (status, { versionId = null, itemId = null } = {}) => {
+    const decide = async (status, { versionId = null, itemId = null, kept = null } = {}) => {
+      const extra = JSON.stringify({ ...(kept || {}), ...(via || {}) });
       const { rows: [d] } = await client.query(SQL.decide, [id, project, status, decidedBy, versionId, itemId, extra]);
       return d;
     };
@@ -268,9 +299,28 @@ async function decideProposal({ project, id, decision, decidedBy, via = null, wi
       await decide('applied');
       return { ok: true, status: 'applied', applied: true, item_id: Number(p.item_id) };
     }
+    if (p.kind === 'correct_entry') {
+      const c = entryCorrection(p.payload);
+      if (!c || p.log_entry_id == null || p.item_id == null) return { ok: false, reason: 'no_correction' };
+      const { rows: [e] } = await client.query(SQL.entryLock, [p.log_entry_id, project, p.item_id]);
+      if (!e) return { ok: false, reason: 'entry_gone' };
+      // A correction that reads the same as the entry already does (compared after the
+      // same one-line normalising entryCorrection applies) writes nothing to the entry;
+      // the proposal is still 'applied', since the entry now reads as it asked.
+      const now = String(e.takeaway).replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s+/g, ' ').trim();
+      if (c.takeaway != null && c.takeaway !== now) {
+        const { rows: [done] } = await client.query(SQL.entryCorrect, [e.id, c.takeaway]);
+        if (!done) return { ok: false, reason: 'same_as_another_entry' };
+      }
+      // Who proposed it (proposed_by), who approved it and when (decided_by, decided_at)
+      // and why (reason) are the proposal row's own columns; the text it replaced is kept
+      // on the row too, so the original finding is never lost.
+      await decide('applied', { kept: { was: e.takeaway } });
+      return { ok: true, status: 'applied', applied: true, item_id: Number(p.item_id), log_entry_id: Number(e.id) };
+    }
     await decide('approved');
     return { ok: true, status: 'approved', applied: false };
   });
 }
 
-module.exports = { createProposal, decideProposal, getOpen, markAtVote, itemFromPayload, itemChange, MAX_OPEN_PER_MEMBER };
+module.exports = { createProposal, decideProposal, getOpen, markAtVote, itemFromPayload, itemChange, entryCorrection, MAX_OPEN_PER_MEMBER };

package/modules/market-watch/routes/pages.js

@@ -87,6 +87,8 @@ module.exports = function buildMarketWatchPagesRouter(deps = {}) {
       value: {},
       url: { type: 'string', maxLength: 2000 },
       log_entry_id: {},
+      takeaway: { type: 'string', maxLength: 2000 }, // correct_entry: the entry as it should read
+      wrong: {},                                     // correct_entry: or the entry is wrong
       scout: { type: 'string', enum: pages.KINDS },
       name: { type: 'string', maxLength: 2000 },
     })) return;

package/modules/market-watch/routes/rules.js

@@ -87,6 +87,10 @@ const DECIDE_REFUSALS = Object.freeze({
   no_longer_applies: [409, 'The rules changed since this was proposed, so it no longer fits. Decline it and propose again.'],
   bad_payload: [409, 'This proposal does not name anything to add.'],
   item_gone: [409, 'That item is no longer on this project.'],
+  // a correct_entry (task 1005016)
+  no_correction: [409, 'This proposal does not say how the entry should read. Decline it and propose the correction again.'],
+  entry_gone: [409, 'That entry is no longer in this item\'s case file.'],
+  same_as_another_entry: [409, 'The item already has an entry from that run that reads the same. Decline this one.'],
 });
 
 module.exports = function buildMarketWatchRulesRouter() {

package/modules/platform-identity/terms-acceptance.js

@@ -48,11 +48,10 @@
 // ever READS the marker. tests/terms_acceptance.mjs holds both rules, and fails
 // any other server file that writes these columns or names the marker.
 //
-// A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
-// recorded and a sign-in never overwrites it, publishing a new TERMS_VERSION leaves every
-// existing row naming the text it actually agreed to — so the platform can see
-// who has not accepted the new one. Re-acceptance on revision is deliberately
-// NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
+// A REVISION IS RE-ACCEPTED AT THE NEXT BROWSER SIGN-IN (2026-10-30, the AI
+// features revision; supersedes ADR 0213 D4). Until then a row keeps naming the
+// text it actually agreed to, so the platform can see who has not accepted the
+// new one. A sign-in under the SAME version still never restamps.
 'use strict';
 
 // The version of the platform terms currently served at /terms. It is stamped
@@ -65,7 +64,7 @@
 // The terms_version column it fills is WRITE-ONLY today, on purpose: nothing
 // reads it until a revision needs to know who accepted which text (ADR 0213 D5).
 // It is not dead — dropping it would erase exactly that answer.
-const TERMS_VERSION = '2026-08-29';
+const TERMS_VERSION = '2026-10-30';
 
 // A Postgres placeholder, e.g. '$5'. Interpolated into SQL, so it is validated
 // rather than trusted — the account-visibility.js alias-guard pattern.
@@ -96,8 +95,9 @@ function acceptanceInsertValues(activateParam, versionParam) {
 
 // The ON CONFLICT DO UPDATE SET fragment — the write-once half. On the
 // activating sign-in: a grandfathered acceptance is replaced outright; any other
-// acceptance on record is kept (COALESCE), so a second sign-in re-reads the terms
-// without restamping them; and the source becomes 'signin' either way, since a
+// acceptance of an older version is replaced too (the person signed in under
+// the new text); any other acceptance on record is kept (COALESCE), so a
+// second sign-in re-reads the terms without restamping them; and the source becomes 'signin' either way, since a
 // human just accepted. Keying the replacement on the grandfather marker, not on
 // "no signin recorded", matters: an acceptance with no source (written by the
 // pre-024 code in the deploy window) is a real sign-in and keeps its date. A
@@ -111,7 +111,7 @@ function acceptanceConflictSet(activateParam, versionParam) {
   assertPlaceholder('acceptanceConflictSet', versionParam);
   const self = 'platform_identity_accounts';
   const signin = `${activateParam}::boolean`;
-  const replaces = `WHEN ${signin} AND ${self}.terms_accepted_source = 'grandfathered'`;
+  const replaces = `WHEN ${signin} AND (${self}.terms_accepted_source = 'grandfathered' OR ${self}.terms_version IS DISTINCT FROM ${versionParam}::text)`;
   return `terms_accepted_at = CASE ${replaces} THEN now()`
     + ` WHEN ${signin} THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
     + ` terms_version = CASE ${replaces} THEN ${versionParam}::text`

package/modules/public-landing/public/account-google.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The Link GitHub chip (task 1004996): a Google-only person, no GitHub way in, so the hub bar draws one very small chip with the engineer's icon at the head of its right side, linking to the GitHub link start; the ways-in section lists Google only with Link GitHub beside GitHub. stub.fixtures points the identity at fixtures/me-google.json (the stand-in login ~builder) and the ways-in read at fixtures/me-sign-in-methods-google.json. The default account.states.json (GitHub linked) draws no chip.",
+  "page": "/account",
+  "surface": "public-landing",
+  "stub": { "fixtures": { "me": "me-google", "me__sign-in-methods": "me-sign-in-methods-google" } },
+  "modes": ["dark"],
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/cross-project$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "Unauthorized"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "in-google": { "auth": true, "url": "/account#aWaysIn", "actions": [["wait", 500]], "expect": { "visible": ["#ghChip", "#who", "#waysList"], "attr": [["#ghChip", "href", "/api/bongos/auth/link/github/start"], ["#ghChip", "aria-label", "Link GitHub — needed for coding work"]] } }
+  }
+}

package/modules/public-landing/public/assets/cosmos.css

@@ -647,6 +647,16 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);
   font-family:var(--font-body);font-size:12px;font-weight:700;line-height:1;letter-spacing:0;vertical-align:middle;}
 .who>.invBadge{max-width:none;overflow:visible;}
+/* the Link GitHub chip (task 1004996; hub-bar.js, projects.html): very small and quiet, for
+   someone with no GitHub linked — a hairline pill with the engineer's glyph, never a banner;
+   under 900 the words fold away and the glyph keeps a 24px target */
+.ghChip{display:inline-flex;align-items:center;justify-content:center;gap:5px;min-height:24px;min-width:24px;padding:0 9px 0 7px;
+  flex:none;border:1px solid var(--rule);border-radius:var(--radius-pill);color:var(--ink-soft);
+  font-family:var(--label-face);font-size:11.5px;line-height:1;white-space:nowrap;text-decoration:none;
+  transition:color .2s cubic-bezier(.2,.7,.3,1),border-color .2s cubic-bezier(.2,.7,.3,1);}
+.ghChip:hover{color:var(--ink);border-color:var(--ink-faint);}
+.ghChip:focus-visible{outline:2px solid var(--focus);outline-offset:2px;}
+.ghChip svg{width:13px;height:13px;flex:none;fill:none;stroke:currentColor;stroke-width:1.4;stroke-linecap:round;stroke-linejoin:round;}
 .bandT .invBadge{margin-left:10px;}
 .invWaiting{margin:6px 0 4px;font-size:15.5px;font-weight:600;}
 /* keyboard focus on the two search pills is VISIBLE — the input's own outline
@@ -728,6 +738,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   .qWrap{flex:1 1 90px;max-width:480px;gap:10px;}
   .trig{font-size:13.5px;}
   .who>span{display:none;}
+  .ghChip{padding:0;}
+  .ghChip__label{display:none;}
   .signinDoor{padding:0 16px;font-size:13.5px;}
   .bandIn{padding:0 12px 16px;}
   .bandRow{grid-template-columns:1fr;gap:0;}

package/modules/public-landing/public/assets/hub-bar.js

@@ -116,14 +116,57 @@
     fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' }).then(finish, finish);
   });
 
+  // ---- the Link GitHub chip (task 1004996): signed in with no GitHub linked ----
+  // Very small and quiet: one link at the head of the bar's right side, carrying
+  // the engineer's icon (the hall's craft-mode.js ICONS.building), never a pop-up
+  // or banner. It starts the link (ADR 0396), whose answer lands on /account. A
+  // read that fails, or a child with no sign-in-methods route, draws nothing.
+  // Only a stand-in login (~<handle>, the Google-only row) is asked about:
+  // linking GitHub writes the real login over it, so anyone else has GitHub
+  // and costs no read. projects.html keeps its own copy, as it does of the bands.
+  var GH_TITLE = 'Link GitHub — needed for coding work';
+  function githubChip(me) {
+    var old = $('ghChip');
+    if (!me || String(me.github_login || '').charAt(0) !== '~') { if (old) old.remove(); return null; }
+    return fetch(API + '/me/sign-in-methods', { method: 'GET', credentials: 'same-origin', headers: { Accept: 'application/json' } })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) {
+        var methods = d && Array.isArray(d.methods) ? d.methods : null;
+        var show = !!methods && !methods.some(function (m) { return m && m.provider === 'github'; });
+        var bar = show && document.querySelector('.barRight');
+        if (!bar) { if ($('ghChip')) $('ghChip').remove(); return false; }
+        if ($('ghChip')) return true;
+        var a = document.createElement('a');
+        a.className = 'ghChip';
+        a.id = 'ghChip';
+        a.href = API + '/auth/link/github/start';
+        a.title = GH_TITLE;
+        a.setAttribute('aria-label', GH_TITLE);
+        var svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+        svg.setAttribute('viewBox', '0 0 16 16');
+        svg.setAttribute('aria-hidden', 'true');
+        var path = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+        path.setAttribute('d', 'M2 13.5h12M3.5 13.5V8.5h4v5M7.5 13.5V4.5h5v9');
+        svg.appendChild(path);
+        var label = document.createElement('span');
+        label.className = 'ghChip__label';
+        label.textContent = 'Link GitHub';
+        a.appendChild(svg);
+        a.appendChild(label);
+        bar.insertBefore(a, bar.firstChild);
+        return true;
+      }, function () { return false; });
+  }
+
   // ---- the identity read: the hub's own GET /me ----
   var ready = fetch(API + '/me', { method: 'GET', credentials: 'same-origin', headers: { Accept: 'application/json' } })
     .then(function (res) { return res.ok ? res.json().catch(function () { return null; }) : null; })
     .then(function (d) {
       var me = d ? (d.builder || d.me || d) : null;
       paint(me);
+      githubChip(me);
       return me;
     }, function () { paint(null); return null; });
 
-  window.HubBar = { paint: paint, ready: ready };
+  window.HubBar = { paint: paint, ready: ready, githubChip: githubChip };
 })();

package/modules/public-landing/public/privacy.html

@@ -124,10 +124,14 @@
     <ul>
       <li><b>GitHub</b> — for signing in, and for the repositories your projects ship to.</li>
       <li><b>The AI model provider</b> — when a shipped task is graded, the change it made is sent to the model the grader runs on, Anthropic's Claude, under the key of the builder or the instance.</li>
+      <li><b>AI features, through OpenRouter</b> — when you use AI Studio, your prompt, the files you attach, and short notes about the project are sent through OpenRouter to the AI company whose model answers (for example Google's Gemini). We set OpenRouter to use only companies that do not keep your prompts or train on them. Your requests, files and results are stored here so you can see them again, with what each one cost.</li>
       <!--apex-only:start--><li><b>Hosting</b> — projects hosted by the platform run on servers rented from DigitalOcean, with their web address and traffic passing through Cloudflare.</li><!--apex-only:end-->
     </ul>
     <p>Nothing is sold, and nothing is shared for advertising.</p>
 
+    <h2>Your age</h2>
+    <p>If you record your age, only its band is kept (for example "adult" or "16 to 17"), not your birthday. It decides whether you can be paid and whether you can use the AI features, which are for adults only.</p>
+
     <h2>Session length, and Leaving</h2>
     <p>Sign out to end a session. Browser sessions expire on their own; command-line tokens last until you revoke them from your settings.</p>
     <p>Your builder record and your shipped work stay attributed to you after you leave — the ledger of who built what is the point of the platform. The owner can deactivate a builder: that ends their sessions and releases their claims, and keeps the record.</p>
@@ -135,7 +139,7 @@
 
     <h2>The code is open</h2>
     <p>Every part of this — what is stored, where, and for how long — is public. This site runs Cloud Bongos, free software under the AGPL-3.0. <a href="{{sourceRepoUrl}}">Read the source.</a></p>
-    <p>This statement describes the software as it ships and changes when the software does. Revised August 2026.</p>
+    <p>This statement describes the software as it ships and changes when the software does. Revised October 2026.</p>
   </section>
 </main>
 

package/modules/public-landing/public/projects-google.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The Link GitHub chip on the hub (task 1004996): a Google-only person signed in on the sky, so projects.html's own bar copy draws the very small chip with the engineer's icon at the head of its right side. stub.fixtures points the identity at fixtures/me-google.json (the stand-in login ~builder) and the ways-in read at fixtures/me-sign-in-methods-google.json; the default projects.states.json (GitHub linked) draws none.",
+  "page": "/projects",
+  "surface": "public-landing",
+  "stub": { "fixtures": { "me": "me-google", "me__sign-in-methods": "me-sign-in-methods-google" } },
+  "modes": ["dark"],
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/api/bongos/instance$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "\\b404\\b", "Unauthorized"],
+  "ignoreControls": [".skip", ".vh"],
+  "states": {
+    "in-google": { "auth": true, "actions": [["wait", 800]], "expect": { "visible": ["#ghChip", "#who"], "attr": [["#ghChip", "href", "/api/bongos/auth/link/github/start"]] } }
+  }
+}

package/modules/public-landing/public/projects.html

@@ -11818,6 +11818,44 @@ summary{min-height:24px;padding:3px 0;}
     if (!signedIn && $('onlyMine').checked) { $('onlyMine').checked = false; applyMapFilter(); }
   }
 
+  /* The Link GitHub chip (task 1004996): signed in with no GitHub linked, one very
+     small link at the head of the bar's right side with the engineer's icon. It
+     starts the link (ADR 0396); the answer lands on /account. A failed read, or a
+     child with no sign-in-methods route, draws nothing. Only a stand-in login
+     (~<handle>) is asked about: linking GitHub writes the real login over it.
+     assets/hub-bar.js keeps the same lines for the pages without views; change both. */
+  var GH_TITLE = 'Link GitHub — needed for coding work';
+  function githubChip() {
+    if (!me || String(me.github_login || '').charAt(0) !== '~') return;
+    fetch(API + '/me/sign-in-methods', { method: 'GET', credentials: 'same-origin', headers: { Accept: 'application/json' } })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) {
+        var methods = d && Array.isArray(d.methods) ? d.methods : null;
+        var show = !!methods && !methods.some(function (m) { return m && m.provider === 'github'; });
+        var bar = show && document.querySelector('.barRight');
+        if (!bar) { if ($('ghChip')) $('ghChip').remove(); return; }
+        if ($('ghChip')) return;
+        var a = document.createElement('a');
+        a.className = 'ghChip';
+        a.id = 'ghChip';
+        a.href = API + '/auth/link/github/start';
+        a.title = GH_TITLE;
+        a.setAttribute('aria-label', GH_TITLE);
+        var svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+        svg.setAttribute('viewBox', '0 0 16 16');
+        svg.setAttribute('aria-hidden', 'true');
+        var path = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+        path.setAttribute('d', 'M2 13.5h12M3.5 13.5V8.5h4v5M7.5 13.5V4.5h5v9');
+        svg.appendChild(path);
+        var label = document.createElement('span');
+        label.className = 'ghChip__label';
+        label.textContent = 'Link GitHub';
+        a.appendChild(svg);
+        a.appendChild(label);
+        bar.insertBefore(a, bar.firstChild);
+      }, function () { /* no answer: no chip */ });
+  }
+
   /* Boot. The view is set FIRST, from the URL, so the page is navigable before
      any request resolves — /projects?view=new must land on the create view even
      if the identity call is slow or fails. */
@@ -11838,6 +11876,7 @@ summary{min-height:24px;padding:3px 0;}
       /* renderWho rebuilds the chip, so the waiting count is painted again on it (task 1004646) */
       if (window.InviteBadge) window.InviteBadge.refresh();
       paintShellIdentity();
+      githubChip();
       wizard.onAuth();
       $('gate').hidden = true;
       $('mine').hidden = false;