@bongos/core 1.24.14 → 1.24.15

package/modules/lifecycle/db-claim-reads.js

@@ -21,7 +21,7 @@ async function getActiveClaimsForBuilder(builderId) {
     `SELECT c.id AS claim_id, c.task_id, c.worktree_name, c.claimed_at,
             c.head_sha, c.reserved_migration_number,
             c.release_requested_by, c.release_requested_at, c.release_requested_note,
-            t.title, t.touches, t.priority, t.credits_reward, t.version_id, t.module_key,
+            t.title, t.short_name, t.touches, t.priority, t.credits_reward, t.version_id, t.module_key,
             -- task 1003855: the craft of the claimed work. A speciality contract is
             -- craft-scoped, so the Conductor needs to know which craft is in play
             -- before it can pick the right one to inject.

package/modules/lifecycle/db-ship.js

@@ -485,7 +485,7 @@ const UNPROVABLE_STRAND_REASON = 'strand:no_branch_no_tip';
 // release it.
 async function gatingRebaseTasksForBuilder(builderId, client = pool, graceMs = UNPROVABLE_GATE_GRACE_MS) {
   const { rows } = await client.query(
-    `SELECT id, title, needs_rebase_reason, needs_rebase_at
+    `SELECT id, title, short_name, needs_rebase_reason, needs_rebase_at
        FROM tasks
       WHERE needs_rebase = true AND status = 'confirmed' AND shipped_by = $1
         AND NOT (
@@ -501,7 +501,7 @@ async function gatingRebaseTasksForBuilder(builderId, client = pool, graceMs = U
 
 async function needsRebaseTasksForBuilder(builderId, client = pool) {
   const { rows } = await client.query(
-    `SELECT id, title, needs_rebase_reason, needs_rebase_at
+    `SELECT id, title, short_name, needs_rebase_reason, needs_rebase_at
        FROM tasks
       WHERE needs_rebase = true AND status = 'confirmed' AND shipped_by = $1
       ORDER BY needs_rebase_at ASC NULLS LAST, id ASC`,

package/modules/lifecycle/db-tasks.js

@@ -24,6 +24,7 @@ const { gateOnSpecTask } = require('./goal-spec-task.js');
 const { ensureArtistReviewGoal } = require('./artist-review-goal.js');
 const { notPageMarkerSql } = require('./page-tweak-artist.js');
 const { needsFilterWhere, capabilityFeedWhere } = require('./task-needs-gate.js');
+const { deriveTaskName } = require('./task-name.js');
 
 // -------------------------------------------------------------------------
 // Tasks
@@ -270,13 +271,13 @@ async function createTask({
                         est_minutes, est_cost_usd, manual_degree, priority,
                         automation_tag, credits_reward, source, source_ref, value_summary,
                         kind, discipline, parallel_safe, newcomer_friendly, needs_migration,
-                        security_sensitive, requires_rank, module_key, goal_id, created_by, promoted_at, needs)
+                        security_sensitive, requires_rank, module_key, goal_id, created_by, promoted_at, needs, short_name)
      VALUES ($1, $2, $3, $4, $5,
              $6, $7, $8, $9,
              $10, $11, $12, $13, $14,
              $15, $16, $17, $18, $19,
              $20, $21, $22, $23, $24,
-             CASE WHEN $4 IN ('ready','active') THEN now() ELSE NULL END, $25)
+             CASE WHEN $4 IN ('ready','active') THEN now() ELSE NULL END, $25, $26)
      RETURNING *`,
     [
       versionId,
@@ -303,7 +304,7 @@ async function createTask({
       moduleKey ?? null,
       goalIdEffective ?? null,
       createdBy ?? null,
-      Array.isArray(needs) ? needs : [],
+      Array.isArray(needs) ? needs : [], deriveTaskName(title, description), // $26: the short name (task 1004958)
     ]
   );
   // task 1677 / ADR 0096: audit each creation-time auto-assignment so the trail is
@@ -486,7 +487,6 @@ async function updateTaskPriority(id, priority) { return updateTaskColumn(id, 'p
 // keeps on every other value_summary write.
 async function updateTaskValueSummary(id, valueSummary) { return updateTaskColumn(id, 'value_summary', valueSummary); }
 
-
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
 // #360 / ADR 0018 + V3.R15 #239: open (or close) a task to Xenos claims by

package/modules/lifecycle/migrations/lifecycle_019_pay_type_gates.sql

@@ -0,0 +1,50 @@
+-- lifecycle_019_pay_type_gates.sql — task 1004991 (goal 1000092; ADR 0385, "Pay-type
+-- gates").
+--
+-- A pay type becomes switchable only after its gate is cleared and recorded. A
+-- gate is a short list of requirements per pay type (the list lives in
+-- modules/lifecycle/pay-type-gates.js, taken from the ADR's table); this table
+-- records, for each requirement, who said it is met, when, and the evidence they
+-- point at. The gate is cleared when every requirement's NEWEST row says 'cleared'.
+-- The instance is the project, so there is no project column: one database, one
+-- project.
+--
+-- A LIFECYCLE MIGRATION, NOT A CORE ONE: a brand-new table the lifecycle module
+-- owns (pay-type-gates.js is its only reader and writer), the lifecycle_018_pay_terms
+-- precedent.
+--
+-- RECORDS ONLY. Nothing here moves money. Clearing a requirement is a person's act
+-- (often with counsel) and the evidence column holds only a REFERENCE to it (a
+-- document title, a ticket, a processor verdict id) — never identity, tax or KYC
+-- data, which Bongos does not store.
+--
+-- APPEND-ONLY. Every clearing or revoking is a new row; the newest row per
+-- (pay_type, requirement) is current, and a row trigger refuses UPDATE and DELETE,
+-- so the table is its own audit trail. The database also refuses outright any row for
+-- eu_labour: until a later ADR enables it, no code path, however forged, can clear it.
+
+CREATE TABLE IF NOT EXISTS lifecycle_pay_type_gates (
+  id           bigserial PRIMARY KEY,
+  pay_type     text NOT NULL CHECK (pay_type IN
+                 ('cash', 'equity', 'module_share', 'credit_pool', 'non_monetary', 'self_managed')),
+  requirement  text NOT NULL CHECK (char_length(requirement) BETWEEN 1 AND 64),
+  state        text NOT NULL CHECK (state IN ('cleared', 'revoked')),
+  evidence_ref text NOT NULL CHECK (char_length(evidence_ref) BETWEEN 1 AND 500),
+  decided_by   bigint NOT NULL REFERENCES builders(id),
+  decided_at   timestamptz NOT NULL DEFAULT now()
+);
+
+-- The current state of a requirement: newest first.
+CREATE INDEX IF NOT EXISTS lifecycle_pay_type_gates_current
+  ON lifecycle_pay_type_gates (pay_type, requirement, decided_at DESC, id DESC);
+
+CREATE OR REPLACE FUNCTION lifecycle_pay_type_gates_refuse_change() RETURNS trigger AS $$
+BEGIN
+  RAISE EXCEPTION 'pay-type gates are a history: % on % is refused; record a new row instead', TG_OP, TG_TABLE_NAME
+    USING ERRCODE = 'check_violation';
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS lifecycle_pay_type_gates_append_only ON lifecycle_pay_type_gates;
+CREATE TRIGGER lifecycle_pay_type_gates_append_only BEFORE UPDATE OR DELETE ON lifecycle_pay_type_gates
+  FOR EACH ROW EXECUTE FUNCTION lifecycle_pay_type_gates_refuse_change();

package/modules/lifecycle/module.json

@@ -29,6 +29,7 @@
       "kickoff-seed",
       "rot",
       "project-settings",
+      "pay-type-gates",
       "artist-gate",
       "removal-proposals",
       "sky",

package/modules/lifecycle/pay-type-gates.js

@@ -0,0 +1,180 @@
+// modules/lifecycle/pay-type-gates.js — a pay type may be put on a task only after its
+// gate is cleared for the project (task 1004991, goal 1000092; ADR 0385 "Pay-type gates").
+//
+// A gate is a fixed list of requirements per pay type, taken from the ADR's table and
+// written down here as data. A person records each requirement as cleared (with a
+// reference to the evidence) or revoked; the gate is cleared when every requirement's
+// newest record says cleared. The pay-terms write paths ask `refuseUnclearedGates`
+// before they write, so the server refuses a pay term whose type has an open gate.
+//
+// FOUR RULES THIS FILE HOLDS:
+//   1. The list is data, not prose: REQUIREMENTS is the one place the ADR's table lives
+//      in code, and the table pins it against the pay-type list pay-terms.js accepts.
+//   2. eu_labour can never be cleared. It is not in any list a write accepts and the
+//      table's CHECK refuses a row for it, so no request, however forged, reaches a
+//      cleared state (a later ADR enables it, per ADR 0385's EU labour row).
+//   3. self_managed clears with one act, the acknowledgement that Bongos moves and
+//      guarantees nothing. Nothing else is asked of it.
+//   4. Records only. Evidence is a REFERENCE a person typed; Bongos stores no identity,
+//      tax or KYC data here, and nothing in this file moves money.
+//
+// Who may record a requirement is decided by the ROUTE (the project owner, on the
+// server — ADR 0016); who recorded it comes from the signed-in builder, never the body.
+
+const api = require('../../src/module-api');
+const { PAY_TYPES, SELF_MANAGED_LABEL } = require('./pay-terms');
+
+const NEVER_CLEARABLE = ['eu_labour'];
+const ACKNOWLEDGEMENT = 'bongos_moves_and_guarantees_nothing';
+const EVIDENCE_MAX = 500;
+
+// The machine-checkable list per pay type (ADR 0385, "Must exist first").
+const REQUIREMENTS = {
+  cash: [
+    ['processor_onboarding', 'Processor onboarding done'],
+    ['tax_details', 'Tax details collected'],
+    ['age_check', 'Age check passed'],
+    ['sanctions_screening', 'Sanctions screening done'],
+    ['signed_rule', 'Signed pay rule on file'],
+  ],
+  equity: [
+    ['counsel_approved_structure', 'The project\'s own counsel-approved structure'],
+    ['one_signature_per_grant', 'One signature per grant'],
+    ['no_percentage_fee', 'No percentage fee taken'],
+    ['wording_filter', 'Credit and valuation wording filter in force'],
+  ],
+  module_share: [
+    ['standard_module_licence', 'Standard module licence'],
+    ['takedown_contact', 'Takedown contact named'],
+    ['payee_onboarding', 'Payee onboarding done'],
+  ],
+  credit_pool: [
+    ['credit_wording_in_force', 'Credit wording rule (ADR 0385 decision 9) in force'],
+    ['model_inputs_visible', 'Model inputs visible to the people affected'],
+    ['signed_rule', 'Signed pay rule on file'],
+  ],
+  non_monetary: [
+    ['guardian_consent_13_15', 'Guardian consent for ages 13 to 15'],
+    ['no_cash_redemption', 'No cash redemption of any credit'],
+  ],
+  self_managed: [
+    [ACKNOWLEDGEMENT, 'Acknowledged: Bongos moves and guarantees nothing'],
+  ],
+};
+
+function requirementIds(payType) {
+  return (REQUIREMENTS[payType] || []).map(([id]) => id);
+}
+
+// PURE. The verdict for one pay type, from its current rows ({ requirement, state,
+// evidence_ref, decided_by, decided_at }, newest per requirement). A requirement with
+// no row, or whose newest row is revoked, is missing. Rows for requirements not in the
+// list are ignored, so a stray row can never clear a gate.
+function gateVerdict(payType, currentRows) {
+  if (NEVER_CLEARABLE.includes(payType)) {
+    return { pay_type: payType, cleared: false, never: true, requirements: [], missing: [] };
+  }
+  const byReq = new Map((currentRows || []).filter((r) => r.pay_type == null || r.pay_type === payType).map((r) => [r.requirement, r]));
+  const requirements = (REQUIREMENTS[payType] || []).map(([id, label]) => {
+    const r = byReq.get(id);
+    const met = !!r && r.state === 'cleared';
+    return {
+      requirement: id,
+      label,
+      met,
+      evidence_ref: r ? r.evidence_ref : null,
+      cleared_by: met ? r.decided_by : null,
+      cleared_at: met ? r.decided_at : null,
+    };
+  });
+  const missing = requirements.filter((x) => !x.met).map((x) => x.requirement);
+  return { pay_type: payType, cleared: requirements.length > 0 && missing.length === 0, never: false, requirements, missing };
+}
+
+// The newest row per (pay_type, requirement) for these pay types, one read.
+async function readCurrentRows(payTypes, { db } = {}) {
+  const exec = db || api.pool;
+  const { rows } = await exec.query(
+    `SELECT DISTINCT ON (pay_type, requirement) pay_type, requirement, state, evidence_ref, decided_by, decided_at
+       FROM lifecycle_pay_type_gates
+      WHERE pay_type = ANY($1::text[])
+      ORDER BY pay_type, requirement, decided_at DESC, id DESC`, [payTypes]);
+  return rows;
+}
+
+// Every pay type's verdict, for the owner's view (and the settings page).
+async function readGates({ db } = {}) {
+  const rows = await readCurrentRows(PAY_TYPES, { db });
+  const gates = PAY_TYPES.map((p) => gateVerdict(p, rows.filter((r) => r.pay_type === p)));
+  for (const p of NEVER_CLEARABLE) gates.push(gateVerdict(p, []));
+  return gates;
+}
+
+// PURE. A verdict as a non-owner may see it: met or missing per requirement, without the
+// evidence reference a person typed or who cleared it (those are the owner's own records).
+function withoutEvidence(gate) {
+  return { ...gate, requirements: gate.requirements.map(({ evidence_ref, cleared_by, cleared_at, ...rest }) => rest) };
+}
+
+// Checks a list of normalized terms against the gates. Returns null when every type
+// in it is cleared, else { code, message, pay_type, missing } for the first that is
+// not. One read however many terms there are, and none for an empty list.
+async function refuseUnclearedGates(terms, { db } = {}) {
+  const types = [...new Set((terms || []).map((t) => t.pay_type))];
+  if (!types.length) return null;
+  const rows = await readCurrentRows(types, { db });
+  for (const payType of types) {
+    const v = gateVerdict(payType, rows.filter((r) => r.pay_type === payType));
+    if (!v.cleared) {
+      return {
+        code: 'pay_type_gate_not_cleared',
+        pay_type: payType,
+        missing: v.missing,
+        message: `The ${payType} pay type is not switched on for this project: its gate is not cleared (still needed: ${v.missing.join(', ')}).`,
+      };
+    }
+  }
+  return null;
+}
+
+// PURE. Checks a request body to record one requirement. Returns { state, evidenceRef }
+// or { status, code, error }. The recorder is never read from the body.
+function normalizeGateWrite(payType, requirement, body) {
+  if (NEVER_CLEARABLE.includes(payType)) {
+    return { status: 409, code: 'pay_type_never_clearable', error: `${payType} cannot be cleared; it stays off until a later decision enables it.` };
+  }
+  if (!PAY_TYPES.includes(payType)) return { status: 404, code: 'unknown_pay_type', error: `pay type must be one of ${PAY_TYPES.join(', ')}.` };
+  if (!requirementIds(payType).includes(requirement)) {
+    return { status: 404, code: 'unknown_requirement', error: `${payType} has no such requirement; it has ${requirementIds(payType).join(', ')}.` };
+  }
+  const b = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
+  const extra = Object.keys(b).filter((k) => !['state', 'evidence_ref', 'acknowledged'].includes(k));
+  if (extra.length) return { status: 400, code: 'unknown_field', error: `unknown field: ${extra.join(', ')}.` };
+  if (b.state !== 'cleared' && b.state !== 'revoked') return { status: 400, code: 'bad_state', error: 'state is "cleared" or "revoked".' };
+  if (requirement === ACKNOWLEDGEMENT && b.state === 'cleared') {
+    if (b.acknowledged !== true) {
+      return { status: 400, code: 'acknowledgement_required', error: `Send acknowledged: true. It records: ${SELF_MANAGED_LABEL}` };
+    }
+    return { state: 'cleared', evidenceRef: SELF_MANAGED_LABEL };
+  }
+  const ev = typeof b.evidence_ref === 'string' ? b.evidence_ref.trim() : '';
+  if (!ev || ev.length > EVIDENCE_MAX) {
+    return { status: 400, code: 'bad_evidence_ref', error: `evidence_ref is a reference to the evidence (or the reason, for a revoke), 1 to ${EVIDENCE_MAX} characters.` };
+  }
+  return { state: b.state, evidenceRef: ev };
+}
+
+// Appends one record. Returns the gate's new verdict for that pay type.
+async function recordRequirement({ payType, requirement, state, evidenceRef, builderId }, { db } = {}) {
+  const exec = db || api.pool;
+  await exec.query(
+    `INSERT INTO lifecycle_pay_type_gates (pay_type, requirement, state, evidence_ref, decided_by)
+     VALUES ($1, $2, $3, $4, $5)`, [payType, requirement, state, evidenceRef, builderId]);
+  const rows = await readCurrentRows([payType], { db: exec });
+  return gateVerdict(payType, rows);
+}
+
+module.exports = {
+  REQUIREMENTS, ACKNOWLEDGEMENT,
+  requirementIds, gateVerdict, readGates, refuseUnclearedGates, normalizeGateWrite, recordRequirement, withoutEvidence,
+};

package/modules/lifecycle/publish-reconciler.js

@@ -981,6 +981,34 @@ async function runCraftAchievementBackfill(deps = {}) {
   }
 }
 
+// task 1004958: name the tasks that have no short name yet — every task created
+// before names existed, and any row a path outside createTask inserted. Pure DB,
+// idempotent (it writes only `short_name IS NULL` rows), and bounded: at most
+// TASK_NAME_BATCHES batches a run, so the first run on a big board drains it in
+// one go and every later run is one indexed read that finds next to nothing.
+const TASK_NAME_BATCHES = 20;
+async function runTaskNameBackfill(deps = {}) {
+  const { logFn, errFn } = loggers(deps);
+  const tasksDb = (deps.tasksDb && typeof deps.tasksDb.backfillTaskNames === 'function')
+    ? deps.tasksDb
+    : require('./task-name-db.js');
+  const exec = deps.pool || seams.pool;
+  let named = 0;
+  try {
+    for (let i = 0, after = 0; i < TASK_NAME_BATCHES; i++) {
+      const out = await tasksDb.backfillTaskNames({ exec, after });
+      named += out.named;
+      after = out.next;
+      if (!out.scanned) break;
+    }
+    if (named) logFn(`[publish-reconciler] task names: ${named} task(s) named`);
+    return { named };
+  } catch (e) {
+    errFn(`[publish-reconciler] task name backfill (non-blocking): ${e && e.message}`);
+    return { skipped: 'error', error: e && e.message, named };
+  }
+}
+
 // The sweeps one tick fires. Each is INDEPENDENT on purpose: the cost (task 1366)
 // and criterion (task 1002069) sweeps are pure DB — no push credential — and a
 // failure in either must never touch the confirmed→shipped work.
@@ -989,7 +1017,7 @@ async function runCraftAchievementBackfill(deps = {}) {
 // between runs; none means every tick (INTERVAL_MS). The publish, cost and
 // criterion sweeps keep the tick — a strand, an unpriced session and a newly
 // satisfiable criterion are all things someone is waiting on. The promotion sweep
-// and the craft backfill run HOURLY: the ship-time triggers already promote and
+// and the craft and task-name backfills run HOURLY: the ship-time triggers already promote and
 // unlock on the event, so these are backlog drains, and a drain an hour late
 // costs nobody anything while running it every 5 minutes cost every instance
 // ~288 scans a day.
@@ -1000,6 +1028,7 @@ const SWEEPS = [
   ['criterion sweep', runCriterionSweep],
   ['promotion sweep', runPromotionSweep, HOURLY_MS],
   ['craft achievement backfill', runCraftAchievementBackfill, HOURLY_MS],
+  ['task name backfill', runTaskNameBackfill, HOURLY_MS],
 ];
 
 // buildTick — one interval round, with a per-sweep overlap guard (task 1004924).
@@ -1083,6 +1112,7 @@ module.exports = {
   runPromotionSweep,
   runCriterionSweep,
   runCraftAchievementBackfill,
+  runTaskNameBackfill,
   buildTick,
   couldBeStaleGenerated,
   describeTarget,

package/modules/lifecycle/rebase-gate.js

@@ -70,8 +70,9 @@ function splitRebaseGate(rows, { limit = gateLimit() } = {}) {
 // the hint and the CLI can say "waiting, not on you".
 function rebaseRefusalTasks(split) {
   return [
-    ...split.gating.map((t) => ({ id: t.id, title: t.title, reason: t.needs_rebase_reason })),
-    ...split.waiting.map((t) => ({ id: t.id, title: t.title, reason: t.needs_rebase_reason, waiting: true, waits_on: t.waits_on })),
+    // task 1004958: short_name rides along so every surface can write "task N - name".
+    ...split.gating.map((t) => ({ id: t.id, short_name: t.short_name || null, title: t.title, reason: t.needs_rebase_reason })),
+    ...split.waiting.map((t) => ({ id: t.id, short_name: t.short_name || null, title: t.title, reason: t.needs_rebase_reason, waiting: true, waits_on: t.waits_on })),
   ];
 }
 

package/modules/lifecycle/routes/claims.js

@@ -100,12 +100,13 @@ function taskNotReadyHint(taskId, currentStatus) {
 // task 1004788: only the FIXABLE tasks gate (rebase-gate.js); a task set aside
 // because it waits on something outside the builder is listed after them as
 // "waiting, not on you" so nobody chases it.
+const { taskRef } = require('../task-name.js'); // task 1004958
 function rebaseRequiredHint(rebaseTasks) {
   const all = rebaseTasks || [];
-  const ids = all.filter((t) => !t.waiting).map((t) => `task ${t.id}`);
+  const ids = all.filter((t) => !t.waiting).map((t) => taskRef(t.id, t.short_name));
   const waiting = all.filter((t) => t.waiting);
   const aside = waiting.length
-    ? ` Waiting, not on you (set aside; they land on their own when what they wait on clears): ${waiting.map((t) => `task ${t.id} (${t.waits_on || 'outside you'})`).join('; ')}.`
+    ? ` Waiting, not on you (set aside; they land on their own when what they wait on clears): ${waiting.map((t) => `${taskRef(t.id, t.short_name)} (${t.waits_on || 'outside you'})`).join('; ')}.`
     : '';
   return `Your queue is gated: ${ids.length} confirmed task(s) of yours are waiting to land and need you (${ids.join(', ') || 'unknown'}).${aside} Clear it with /strand-fix N (works on any machine), or bring the branch up to date with \`git merge origin/main\` and re-ship — MERGE, never rebase: server-mediated publish is append-only, and rewriting a published branch makes it un-pushable (task 1002788). /merge-mode only if this machine has a GitHub push credential. To give up on one instead, /builder-release it. If CI is simply backed up, waiting is correct: a task already landed clears the gate on its own. If main's CI is red for a reason outside your branch, the fix is still claimable: a P1 kind=infra task passes this gate (task 1004370).`;
 }

package/modules/lifecycle/routes/pay-type-gates.js

@@ -0,0 +1,59 @@
+'use strict';
+
+// modules/lifecycle/routes/pay-type-gates.js — read, and record, the gate each pay type
+// must clear before it can be put on a task (task 1004991, goal 1000092; ADR 0385
+// "Pay-type gates"). The rules live in ../pay-type-gates.js; this file is the doorway.
+//
+// GET /pay-type-gates — every pay type's gate: each requirement, whether it is met, the
+//   evidence reference, and who cleared it and when. eu_labour is listed as never clearable.
+// PUT /pay-type-gates/:payType/:requirement — body { state: 'cleared'|'revoked',
+//   evidence_ref } (or { state: 'cleared', acknowledged: true } for the self-managed
+//   acknowledgement). Appends one record; the recorder is the signed-in owner, never the
+//   body. Clearing a real gate is a person's act, so nothing here clears one by itself.
+//
+// MODULE BOUNDARY: reaches core only through `../../../src/module-api`.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const gates = require('../pay-type-gates');
+
+const log = api.logger('lifecycle');
+
+module.exports = function buildPayTypeGatesRouter() {
+  const router = express.Router();
+
+  // rank: any-builder for met/missing (the same pay information `GET /pay-terms` shows, no person's
+  // money); the evidence references and who cleared each requirement are the owner's records, so
+  // they come back for an archon only.
+  router.get('/pay-type-gates', api.requireBuilder, async (req, res) => {
+    try {
+      const all = await gates.readGates();
+      res.json({ gates: req.builder.rank === 'archon' ? all : all.map(gates.withoutEvidence) });
+    } catch (err) {
+      log.error(`GET /pay-type-gates: ${err && err.message}`);
+      res.fail('pay_type_gates_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: payout.approve (archon floor). Whether a pay type is legal for this project is the
+  // owner's call, often with counsel, and it is the same authority that approves payouts — no new
+  // atom is minted for it (ADR 0016: enforced here, on the server).
+  router.put('/pay-type-gates/:payType/:requirement', api.requireBuilder, api.requirePermission('payout.approve'), async (req, res) => {
+    const { payType, requirement } = req.params;
+    // Unknown fields (a forged cleared_by, say) are refused here; the values are checked by the lib.
+    if (api.validateOrRespond(req, res, { state: {}, evidence_ref: {}, acknowledged: {} })) return;
+    const parsed = gates.normalizeGateWrite(payType, requirement, req.body);
+    if (parsed.error) return res.fail(parsed.code, { status: parsed.status, message: parsed.error });
+    try {
+      const gate = await gates.recordRequirement({
+        payType, requirement, state: parsed.state, evidenceRef: parsed.evidenceRef, builderId: req.builder.id,
+      });
+      res.json({ ok: true, gate });
+    } catch (err) {
+      log.error(`PUT /pay-type-gates: ${err && err.message}`);
+      res.fail('pay_type_gates_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/lifecycle/routes/project-settings.js

@@ -35,6 +35,7 @@ const api = require('../../../src/module-api');
 const goalCategory = require('../goal-category');
 const autopickup = require('../autopickup');
 const payTermsLib = require('../pay-terms'); // task 1004990
+const payTypeGates = require('../pay-type-gates'); // task 1004991
 
 const log = api.logger('lifecycle');
 
@@ -551,6 +552,9 @@ module.exports = function buildProjectSettingsRouter() {
     const parsed = payTermsLib.normalizePayTerms(req.body.terms);
     if (parsed.error) return res.fail('bad_pay_terms', { status: 400, message: parsed.error });
     try {
+      // task 1004991: the project's standing terms obey the same gate as a task's (ADR 0385).
+      const gateRefusal = await payTypeGates.refuseUnclearedGates(parsed.terms);
+      if (gateRefusal) return res.fail(gateRefusal.code, { status: 409, message: gateRefusal.message });
       await payTermsLib.setPayTerms({ taskId: null, terms: parsed.terms, builderId: req.builder.id });
       const policy = await payTermsLib.readProjectPayTerms();
       res.json({ ok: true, row: payTermsRow(policy) });

package/modules/lifecycle/routes/task-write-routes.js

@@ -29,6 +29,9 @@ const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, badNeeds, detectsMigration } = require('./task-route-helpers.js');
 const { describeCheckViolation } = require('../pg-constraint-fail.js');
 const payTermsLib = require('../pay-terms.js'); // task 1004990
+const payTypeGates = require('../pay-type-gates.js'); // task 1004991
+const taskName = require('../task-name.js'); // task 1004958
+const { updateTaskShortName } = require('../task-name-db.js');
 const { goalNotOpenRefusal } = require('./goal-route-authz.js');
 const { resolveUpkeepHome, isUpkeepFiling, UPKEEP_HINT } = require('../upkeep-home.js'); // task 1004597
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -332,6 +335,37 @@ module.exports = function registerTaskWriteRoutes(router) {
     }
   });
 
+  // PATCH /tasks/:id/short-name { short_name } — rename a task's 2-3 word name, the
+  // one sessions print as "task N - <name>" (task 1004958). Its own route because the
+  // owner's rule is that the task's AUTHOR may change it, and PATCH /tasks/:id is gated
+  // on task.edit, which an author below Metic does not hold. The name is normalised
+  // to task-name.js's alphabet (three lowercase words at most), so what reaches the
+  // startup notes is a topic and nothing else; the table CHECK holds the same shape.
+  // rank: any-builder, narrowed in the handler — the task's author, or a Metic or Archon.
+  router.patch('/tasks/:id/short-name', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { short_name: { required: true, type: 'string', maxLength: 80 } })) return;
+    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
+    if (id === null) return;
+    const name = taskName.normaliseAuthoredName(req.body.short_name);
+    if (!name) {
+      return res.fail('bad_short_name', { status: 400, message: `short_name must be 1-${taskName.MAX_WORDS} plain words (letters, digits, hyphens), ${taskName.MAX_LEN} characters at most` });
+    }
+    try {
+      const task = await db.getTask(id);
+      if (!task) return res.fail('task_not_found', 404);
+      const isAuthor = task.created_by != null && String(task.created_by) === String(req.builder.id);
+      if (!isAuthor && !auth.rankMeetsThreshold(req.builder.rank, ['metic', 'archon'])) {
+        return res.fail('not_task_author', { status: 403, message: 'only the task\'s author (or a Metic or Archon) may rename it' });
+      }
+      const updated = await updateTaskShortName(id, name);
+      if (!updated) return res.fail('task_not_found', 404);
+      return res.json({ task: updated });
+    } catch (err) {
+      log.error('[gds] PATCH /tasks/:id/short-name', err);
+      return res.fail('patch_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1),
   // body.discipline (mig 014), body.parallel_safe
   // (mig 028), and body.newcomer_friendly (#360 / ADR 0018 + V3.R15 #239 —
@@ -575,6 +609,15 @@ module.exports = function registerTaskWriteRoutes(router) {
       payTerms = payTermsLib.normalizePayTerms(body.pay_terms);
       if (payTerms.error) return res.fail('bad_pay_terms', { status: 400, message: payTerms.error });
       if (!(await db.getTask(id))) return res.fail('task_not_found', 404);
+      // task 1004991: a pay type goes on a task only once its gate is cleared (ADR 0385).
+      let gateRefusal;
+      try {
+        gateRefusal = await payTypeGates.refuseUnclearedGates(payTerms.terms);
+      } catch (err) {
+        log.error('[gds] PATCH /tasks/:id pay_terms gate read', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+      if (gateRefusal) return res.fail(gateRefusal.code, { status: 409, message: gateRefusal.message });
     }
     // ---- all gates passed: apply the writes. Order preserved from the old ----
     // shape — requires_rank still runs AFTER security_sensitive so a

package/modules/lifecycle/ship-card.js

@@ -19,6 +19,7 @@
 // emitCard() is the one I/O helper the CLIs share (print monospace + write HTML +
 // print the [otb-card-html] marker the skills pick up).
 
+const { safeTaskName, taskRef } = require('./task-name.js'); // task 1004958
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -523,6 +524,8 @@ function buildCardModel(input = {}) {
 
   return {
     stage, cfg, brand, taskId,
+    // task 1004958: the task's 2-3 word name, so the confirm line reads "task N - name".
+    shortName: safeTaskName(input.shortName),
     title: input.title || '',
     value,
     notes: input.notes || '',
@@ -751,7 +754,7 @@ function sanitizeOneLine(s) {
 
 function confirmLine(model) {
   const m = model || {};
-  const id = m.taskId != null ? `task ${m.taskId}` : 'task';
+  const id = m.taskId != null ? taskRef(m.taskId, m.shortName) : 'task';
   const word = (m.cfg && m.cfg.statusWord) ? String(m.cfg.statusWord).toLowerCase() : String(m.stage || 'done');
   // The stage's own rows already hold exactly the facts that stage cares about
   // (buildCardModel picks them per stage); reuse them rather than re-deriving,

package/modules/lifecycle/task-name-db.js

@@ -0,0 +1,55 @@
+'use strict';
+// modules/lifecycle/task-name-db.js — the two writes behind a task's short name
+// (task 1004958): the author's rename and the backfill of unnamed rows.
+//
+// WHY ITS OWN FILE. createTask (db-tasks.js) writes the name on every new task;
+// these two are the rest of the feature, and db-tasks.js sits at the 1,500-line
+// ratchet. The name itself is derived ONLY in task-name.js, so a backfilled name
+// and a born-with name can never disagree.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const { deriveTaskName } = require('./task-name.js');
+
+// The author's rename. The caller passes a name already through
+// task-name.normaliseAuthoredName; the table CHECK holds the same shape.
+async function updateTaskShortName(id, shortName, exec = pool) {
+  const { rows } = await exec.query(
+    'UPDATE tasks SET short_name = $1, updated_at = now() WHERE id = $2 RETURNING *',
+    [shortName, id]
+  );
+  return rows[0] ?? null;
+}
+
+// Name the tasks created before names existed (or by a path that skipped
+// createTask). Reads a batch of unnamed rows, derives each name in JS and writes
+// them in one statement; `short_name IS NULL` on the write too, so an author's
+// edit landing in between is never overwritten. A title with no topic word keeps
+// NULL and simply prints "task N". Stateless: the caller walks forward by passing
+// back `next` as `after`, so a row that stays unnamed is passed over rather than
+// re-read every batch, and two callers can never disturb each other's walk. The
+// publish-reconciler walks from 0 once an hour.
+async function backfillTaskNames({ after = 0, limit = 500, exec = pool } = {}) {
+  const { rows } = await exec.query(
+    'SELECT id, title, description FROM tasks WHERE short_name IS NULL AND id > $1 ORDER BY id LIMIT $2',
+    [after, limit]
+  );
+  if (!rows.length) return { named: 0, scanned: 0, next: after };
+  const next = Number(rows[rows.length - 1].id);
+  const ids = [];
+  const names = [];
+  for (const r of rows) {
+    const name = deriveTaskName(r.title, r.description);
+    if (name) { ids.push(r.id); names.push(name); }
+  }
+  if (!ids.length) return { named: 0, scanned: rows.length, next };
+  const res = await exec.query(
+    `UPDATE tasks t SET short_name = v.name
+       FROM unnest($1::bigint[], $2::text[]) AS v(id, name)
+      WHERE t.id = v.id AND t.short_name IS NULL`,
+    [ids, names]
+  );
+  return { named: res.rowCount || 0, scanned: rows.length, next };
+}
+
+module.exports = { updateTaskShortName, backfillTaskNames };