@bongos/core 1.24.14 → 1.24.16

package/modules/lifecycle/routes/task-write-routes.js

@@ -29,6 +29,9 @@ const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, badNeeds, detectsMigration } = require('./task-route-helpers.js');
 const { describeCheckViolation } = require('../pg-constraint-fail.js');
 const payTermsLib = require('../pay-terms.js'); // task 1004990
+const payTypeGates = require('../pay-type-gates.js'); // task 1004991
+const taskName = require('../task-name.js'); // task 1004958
+const { updateTaskShortName } = require('../task-name-db.js');
 const { goalNotOpenRefusal } = require('./goal-route-authz.js');
 const { resolveUpkeepHome, isUpkeepFiling, UPKEEP_HINT } = require('../upkeep-home.js'); // task 1004597
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -332,6 +335,37 @@ module.exports = function registerTaskWriteRoutes(router) {
     }
   });
 
+  // PATCH /tasks/:id/short-name { short_name } — rename a task's 2-3 word name, the
+  // one sessions print as "task N - <name>" (task 1004958). Its own route because the
+  // owner's rule is that the task's AUTHOR may change it, and PATCH /tasks/:id is gated
+  // on task.edit, which an author below Metic does not hold. The name is normalised
+  // to task-name.js's alphabet (three lowercase words at most), so what reaches the
+  // startup notes is a topic and nothing else; the table CHECK holds the same shape.
+  // rank: any-builder, narrowed in the handler — the task's author, or a Metic or Archon.
+  router.patch('/tasks/:id/short-name', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { short_name: { required: true, type: 'string', maxLength: 80 } })) return;
+    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
+    if (id === null) return;
+    const name = taskName.normaliseAuthoredName(req.body.short_name);
+    if (!name) {
+      return res.fail('bad_short_name', { status: 400, message: `short_name must be 1-${taskName.MAX_WORDS} plain words (letters, digits, hyphens), ${taskName.MAX_LEN} characters at most` });
+    }
+    try {
+      const task = await db.getTask(id);
+      if (!task) return res.fail('task_not_found', 404);
+      const isAuthor = task.created_by != null && String(task.created_by) === String(req.builder.id);
+      if (!isAuthor && !auth.rankMeetsThreshold(req.builder.rank, ['metic', 'archon'])) {
+        return res.fail('not_task_author', { status: 403, message: 'only the task\'s author (or a Metic or Archon) may rename it' });
+      }
+      const updated = await updateTaskShortName(id, name);
+      if (!updated) return res.fail('task_not_found', 404);
+      return res.json({ task: updated });
+    } catch (err) {
+      log.error('[gds] PATCH /tasks/:id/short-name', err);
+      return res.fail('patch_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1),
   // body.discipline (mig 014), body.parallel_safe
   // (mig 028), and body.newcomer_friendly (#360 / ADR 0018 + V3.R15 #239 —
@@ -575,6 +609,15 @@ module.exports = function registerTaskWriteRoutes(router) {
       payTerms = payTermsLib.normalizePayTerms(body.pay_terms);
       if (payTerms.error) return res.fail('bad_pay_terms', { status: 400, message: payTerms.error });
       if (!(await db.getTask(id))) return res.fail('task_not_found', 404);
+      // task 1004991: a pay type goes on a task only once its gate is cleared (ADR 0385).
+      let gateRefusal;
+      try {
+        gateRefusal = await payTypeGates.refuseUnclearedGates(payTerms.terms);
+      } catch (err) {
+        log.error('[gds] PATCH /tasks/:id pay_terms gate read', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+      if (gateRefusal) return res.fail(gateRefusal.code, { status: 409, message: gateRefusal.message });
     }
     // ---- all gates passed: apply the writes. Order preserved from the old ----
     // shape — requires_rank still runs AFTER security_sensitive so a

package/modules/lifecycle/ship-card.js

@@ -19,6 +19,7 @@
 // emitCard() is the one I/O helper the CLIs share (print monospace + write HTML +
 // print the [otb-card-html] marker the skills pick up).
 
+const { safeTaskName, taskRef } = require('./task-name.js'); // task 1004958
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -523,6 +524,8 @@ function buildCardModel(input = {}) {
 
   return {
     stage, cfg, brand, taskId,
+    // task 1004958: the task's 2-3 word name, so the confirm line reads "task N - name".
+    shortName: safeTaskName(input.shortName),
     title: input.title || '',
     value,
     notes: input.notes || '',
@@ -751,7 +754,7 @@ function sanitizeOneLine(s) {
 
 function confirmLine(model) {
   const m = model || {};
-  const id = m.taskId != null ? `task ${m.taskId}` : 'task';
+  const id = m.taskId != null ? taskRef(m.taskId, m.shortName) : 'task';
   const word = (m.cfg && m.cfg.statusWord) ? String(m.cfg.statusWord).toLowerCase() : String(m.stage || 'done');
   // The stage's own rows already hold exactly the facts that stage cares about
   // (buildCardModel picks them per stage); reuse them rather than re-deriving,

package/modules/lifecycle/task-name-db.js

@@ -0,0 +1,55 @@
+'use strict';
+// modules/lifecycle/task-name-db.js — the two writes behind a task's short name
+// (task 1004958): the author's rename and the backfill of unnamed rows.
+//
+// WHY ITS OWN FILE. createTask (db-tasks.js) writes the name on every new task;
+// these two are the rest of the feature, and db-tasks.js sits at the 1,500-line
+// ratchet. The name itself is derived ONLY in task-name.js, so a backfilled name
+// and a born-with name can never disagree.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const { deriveTaskName } = require('./task-name.js');
+
+// The author's rename. The caller passes a name already through
+// task-name.normaliseAuthoredName; the table CHECK holds the same shape.
+async function updateTaskShortName(id, shortName, exec = pool) {
+  const { rows } = await exec.query(
+    'UPDATE tasks SET short_name = $1, updated_at = now() WHERE id = $2 RETURNING *',
+    [shortName, id]
+  );
+  return rows[0] ?? null;
+}
+
+// Name the tasks created before names existed (or by a path that skipped
+// createTask). Reads a batch of unnamed rows, derives each name in JS and writes
+// them in one statement; `short_name IS NULL` on the write too, so an author's
+// edit landing in between is never overwritten. A title with no topic word keeps
+// NULL and simply prints "task N". Stateless: the caller walks forward by passing
+// back `next` as `after`, so a row that stays unnamed is passed over rather than
+// re-read every batch, and two callers can never disturb each other's walk. The
+// publish-reconciler walks from 0 once an hour.
+async function backfillTaskNames({ after = 0, limit = 500, exec = pool } = {}) {
+  const { rows } = await exec.query(
+    'SELECT id, title, description FROM tasks WHERE short_name IS NULL AND id > $1 ORDER BY id LIMIT $2',
+    [after, limit]
+  );
+  if (!rows.length) return { named: 0, scanned: 0, next: after };
+  const next = Number(rows[rows.length - 1].id);
+  const ids = [];
+  const names = [];
+  for (const r of rows) {
+    const name = deriveTaskName(r.title, r.description);
+    if (name) { ids.push(r.id); names.push(name); }
+  }
+  if (!ids.length) return { named: 0, scanned: rows.length, next };
+  const res = await exec.query(
+    `UPDATE tasks t SET short_name = v.name
+       FROM unnest($1::bigint[], $2::text[]) AS v(id, name)
+      WHERE t.id = v.id AND t.short_name IS NULL`,
+    [ids, names]
+  );
+  return { named: res.rowCount || 0, scanned: rows.length, next };
+}
+
+module.exports = { updateTaskShortName, backfillTaskNames };

package/modules/lifecycle/task-name.js

@@ -0,0 +1,140 @@
+'use strict';
+// modules/lifecycle/task-name.js — every task's short name: 2-3 plain words, so a
+// person reads "task 1004745 - payout approvals" instead of a bare number (task 1004958).
+//
+// WHY. Sessions mention task numbers in passing ("task 1004745 is stranded", "after
+// 1004927 lands") as if the builder could keep up with them. A number alone means
+// nothing to the reader. The name is STORED (tasks.short_name, lifecycle_019), so it
+// is the same on every surface; createTask fills it, the publish-reconciler backfills
+// the rows created before it, and the task's author may change it (PATCH /tasks/:id).
+//
+// NOT A TRUNCATED TITLE. Titles open with words that describe nothing — "Goal 1000092
+// N9:", "fix(auth):", "PMS-V2 —", "V4.R38 —" — so `deriveTaskName` strips those labels,
+// keeps the title's head clause, drops filler words and keeps the first three that say
+// what the work is about.
+//
+// A SAFE STRING BY CONSTRUCTION. The startup notes inject text into every session and
+// print no builder-authored text raw (scripts/bongos/strand-watch.js). A name is at most
+// three lowercase words of [a-z0-9-] and 40 characters; `safeTaskName` re-checks that on
+// every read and the table CHECK holds it on every write, so a name can carry a topic
+// and nothing else. An author's edit goes through the same normaliser.
+//
+// Requires nothing, so a CLI can print a name without loading the pool.
+
+const MAX_WORDS = 3;
+const MAX_LEN = 40;
+const MAX_WORD_LEN = 20;
+// The same pattern, character for character, as core_289's CHECK (tests/task_name.mjs).
+const NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*( [a-z0-9]+(-[a-z0-9]+)*){0,2}$/;
+
+// Words that carry no topic: articles, prepositions, auxiliaries, quantifiers.
+const STOP = new Set((
+  'a an the and or but nor of to in on at by for from with without into onto over under about as '
+  + 'is are was were be been being am do does did done has have had having can could will would '
+  + 'shall should may might must need needs needed get gets got let lets make makes it its this '
+  + 'that these those there their them they we our us you your i me my he she his her so if then '
+  + 'than when what which who whom whose why how where while not no yes all any each every some '
+  + 'more most less only just also too very via per vs etc one two n new now still again once '
+  // …and labels that say how a task was filed, not what it is about.
+  + 'phase part step urgent hotfix wip tracking bundle proof spike'
+).split(' '));
+
+// Labels a title opens with that describe nothing. Applied repeatedly from the start.
+const LABELS = [
+  /^goal\s+\d+\s*(?:[a-z]{1,4}\d+[a-z]?\s*)?[:—–-]?\s*/i,           // "Goal 1000092 N9:"
+  /^(?:fix|feat|chore|docs|diag|refactor|test|tests|perf|ci|build|style|revert)(?:\([^)]*\))?!?\s*:\s*/i, // "fix(auth):"
+  // Every repeat is bounded (no nested unbounded quantifier), so a hostile title
+  // cannot make this backtrack super-linearly.
+  /^[A-Z][A-Za-z]{0,5}\d{0,4}(?:[.-][A-Za-z]{0,6}\d{1,4}[a-z]?){1,3}\s{0,3}[:—–-]\s*/, // "V4.R38 —", "PMS-V2 —", "BV2.TW14:"
+  /^[A-Z]{2,6}\s*[:—–]\s*/,                                          // "SEC:", "PMS —"
+  /^(?:task|idea|blocker)\s+#?\d+\s*[:—–-]?\s*/i,                    // "task 123:"
+  /^\[[^\]]{0,40}\]\s*/,                                             // "[wip]"
+  /^#?\d+\s*[:—–-]\s*/,                                              // "123 —"
+];
+
+// The head clause ends at the first strong separator.
+const HEAD_CUT = /\s[—–]\s|:\s|;\s|\s\(|\s\+\s|\s-\s|\s→\s|\.\s/;
+
+// Only the opening of a title can hold a name; reading at most this much bounds the
+// work per title whatever its length.
+const MAX_TITLE_READ = 200;
+
+function stripLabels(title) {
+  let s = String(title || '').slice(0, MAX_TITLE_READ).trim();
+  for (let guard = 0; guard < 6; guard++) {
+    const before = s;
+    for (const re of LABELS) s = s.replace(re, '');
+    s = s.trim();
+    if (s === before) break;
+  }
+  return s;
+}
+
+// One raw token to a name word, or null. "ship.js" → "ship", "gds_session" →
+// "gds-session", "#898" / "2026-06-12" / "V2" → null.
+function toWord(raw) {
+  let w = String(raw).normalize('NFKD').replace(/[\u0300-\u036f]/g, '').toLowerCase();
+  w = w.replace(/\.(?:js|mjs|cjs|ts|md|json|sql|sh|yml|yaml|html|css)$/, '');
+  w = w.replace(/_/g, '-').replace(/[^a-z0-9-]/g, '').replace(/-+/g, '-').replace(/^-|-$/g, '');
+  if (!w || STOP.has(w)) return null;
+  if (/\d/.test(w)) return null; // ids, dates, version labels, counts
+  if (w.length > MAX_WORD_LEN) w = w.slice(0, MAX_WORD_LEN).replace(/-+$/, '');
+  return w.length >= 2 ? w : null;
+}
+
+function wordsOf(text) {
+  return String(text).normalize('NFKD').replace(/[\u0300-\u036f]/g, '').split(/[\s/,]+/).map((t) => t.replace(/^[^\w]+|[^\w]+$/g, '')).map(toWord).filter(Boolean);
+}
+
+function fit(words) {
+  const out = [];
+  for (const w of words) {
+    if (out.includes(w)) continue;
+    const next = [...out, w].join(' ');
+    if (next.length > MAX_LEN) break;
+    out.push(w);
+    if (out.length === MAX_WORDS) break;
+  }
+  return out.length ? out.join(' ') : null;
+}
+
+function nameFrom(text) {
+  const body = stripLabels(text);
+  const cut = body.search(HEAD_CUT);
+  const head = cut > 0 ? body.slice(0, cut) : body;
+  const headWords = wordsOf(head);
+  // A head clause of one word ("Proof: forced-drift …") is itself a label; read on.
+  return fit(headWords.length >= 2 ? headWords : wordsOf(body));
+}
+
+// The name for a task: from its title, else (a title of only ids or labels) from the
+// opening of its description. Null only when neither has a topic word at all.
+function deriveTaskName(title, description) {
+  return nameFrom(title) || (description ? nameFrom(String(description).split(/\n\s*\n/)[0]) : null);
+}
+
+// A stored or authored name, re-checked. Returns the name or null — never anything else.
+function safeTaskName(v) {
+  if (typeof v !== 'string') return null;
+  return v.length <= MAX_LEN && NAME_RE.test(v) ? v : null;
+}
+
+// An author's edit, normalised to the same alphabet. Null when nothing usable is left.
+function normaliseAuthoredName(input) {
+  if (typeof input !== 'string') return null;
+  const words = input.split(/\s+/).map((t) => {
+    const w = t.normalize('NFKD').replace(/[\u0300-\u036f]/g, '').toLowerCase()
+      .replace(/_/g, '-').replace(/[^a-z0-9-]/g, '').replace(/-+/g, '-').replace(/^-|-$/g, '');
+    return w.slice(0, MAX_WORD_LEN).replace(/-+$/, '');
+  }).filter(Boolean);
+  if (!words.length || words.length > MAX_WORDS) return null;
+  return safeTaskName(words.join(' '));
+}
+
+// How a task is written to a person: "task N - name", or "task N" when it has none yet.
+function taskRef(id, name) {
+  const n = safeTaskName(name);
+  return n ? `task ${id} - ${n}` : `task ${id}`;
+}
+
+module.exports = { deriveTaskName, safeTaskName, normaliseAuthoredName, taskRef, MAX_WORDS, MAX_LEN, NAME_RE };

package/modules/market-watch/db.js

@@ -163,9 +163,18 @@ async function getItem(pool, { project, id, knownRuns = null }) {
 
 const CASE_FILE_SQL = `
   SELECT e.id, e.run_id, e.type, e.found_on, e.takeaway, e.dimension, e.source_url,
-         e.source_label, e.confidence, e.pinned, e.created_at
+         e.source_label, e.confidence, e.pinned, e.created_at,
+         c.decided_at AS corrected_at, c.reason AS correction_reason, COALESCE(c.wrong, false) AS marked_wrong
     FROM market_watch_log_entries e
     JOIN market_watch_items i ON i.id = e.item_id
+    -- the entry's latest applied correction (task 1005016): the proposal row is where who
+    -- proposed it, who approved it, when, why and the text it replaced are kept
+    LEFT JOIN LATERAL (
+      SELECT p.decided_at, p.reason, p.payload->>'wrong' = 'true' AS wrong
+        FROM market_watch_proposals p
+       WHERE p.project = i.project AND p.log_entry_id = e.id AND p.kind = 'correct_entry' AND p.status = 'applied'
+       ORDER BY p.decided_at DESC, p.id DESC
+       LIMIT 1) c ON true
    WHERE i.project = $1 AND e.item_id = $2
    ORDER BY e.pinned DESC, e.found_on DESC, e.id DESC`;
 

package/modules/market-watch/migrations/market_watch_004_entry_corrections.sql

@@ -0,0 +1,20 @@
+-- market_watch_004_entry_corrections.sql - the lookup of an entry's applied correction
+-- (task 1005016, goal 1000137).
+--
+-- An approved correct_entry proposal is applied to its log entry, and the proposal row
+-- keeps who, when, why and the replaced text. Two reads look that correction up once per
+-- entry: the item page's case file (modules/market-watch/db.js CASE_FILE_SQL, a LATERAL
+-- join for the latest applied correction) and the home's weekly reports
+-- (modules/market-watch/pages.js WEEK_ENTRIES_SQL, which skips an entry marked wrong).
+-- Without this index each of those scans the project's proposals per entry. The partial
+-- index holds exactly the rows they can match, in the order they read them.
+--
+-- Additive and idempotent, like 001 to 003.
+
+BEGIN;
+
+CREATE INDEX IF NOT EXISTS market_watch_proposals_entry_corrections
+  ON market_watch_proposals (log_entry_id, decided_at DESC, id DESC)
+  WHERE kind = 'correct_entry' AND status = 'applied';
+
+COMMIT;

package/modules/market-watch/pages.js

@@ -30,6 +30,7 @@ const STREAK_SLOTS = 9;
 const REASON_MAX = 280;
 const NAME_MAX = 120;
 const URL_MAX = 500;
+const TAKEAWAY_MAX = 500;
 const DIM_RE = /^[a-z][a-z0-9_]{0,59}$/;
 // The four the item page's "Propose a change" offers, then the two the other buttons file.
 const ITEM_KINDS = Object.freeze(['rescore', 'move_kind', 'add_source', 'correct_entry', 'remove_item']);
@@ -59,6 +60,11 @@ const WEEK_ENTRIES_SQL = `
     FROM market_watch_log_entries e
     JOIN market_watch_items i ON i.id = e.item_id
    WHERE i.project = $1 AND i.status <> 'removed' AND e.found_on >= $2::date
+     -- an entry whose latest applied correction marked it wrong (task 1005016) is no report
+     AND NOT COALESCE((SELECT p.payload->>'wrong' = 'true' FROM market_watch_proposals p
+                        WHERE p.project = i.project AND p.log_entry_id = e.id AND p.kind = 'correct_entry'
+                          AND p.status = 'applied'
+                        ORDER BY p.decided_at DESC, p.id DESC LIMIT 1), false)
    ORDER BY e.found_on DESC, e.id DESC
    LIMIT 1000`;
 
@@ -208,6 +214,9 @@ function shapeItem({ item, entries, history, rules, openProposals = 0 }) {
       id: Number(e.id), run: e.run, type: e.type, found_on: isoDay(e.found_on), takeaway: e.takeaway,
       dimension: e.dimension, source_url: e.source_url, source_label: e.source_label,
       confidence: Number(e.confidence), pinned: !!e.pinned,
+      // An applied correction (task 1005016): when it was made and why. The takeaway
+      // above already reads as corrected; a wrong entry keeps its text, flagged.
+      corrected: e.corrected_at ? { on: isoDay(e.corrected_at), reason: e.correction_reason || '', wrong: !!e.marked_wrong } : null,
     })),
     open_proposals: Number(openProposals) || 0,
   };
@@ -287,9 +296,19 @@ function normalizeProposal(body, { item = null, rubricKeys = null } = {}) {
     return { ok: true, value: { ...base, payload: { source_url: url } } };
   }
   if (kind === 'correct_entry') {
+    // The proposal carries the correction itself (task 1005016): either the takeaway as
+    // it should read, or a flag that the entry is wrong. The reason says why. Approving
+    // it on the rules page applies it to the entry (proposals.js).
     const entry = String(b.log_entry_id || '');
     if (!/^[1-9]\d{0,17}$/.test(entry)) return { ok: false, error: 'invalid_entry', message: 'Pick the entry to correct.' };
-    return { ok: true, value: { ...base, log_entry_id: Number(entry), payload: {} } };
+    const wrong = b.wrong === true || b.wrong === 'true';
+    const takeaway = oneLine(b.takeaway);
+    if (wrong && takeaway) return { ok: false, error: 'invalid_correction', message: 'Either correct the entry or mark it as wrong, not both.' };
+    if (wrong) return { ok: true, value: { ...base, log_entry_id: Number(entry), payload: { wrong: true, summary: 'Mark an entry as wrong' } } };
+    if (!takeaway) return { ok: false, error: 'correction_required', message: 'Write the entry as it should read, or mark it as wrong.' };
+    if (takeaway.length > TAKEAWAY_MAX) return { ok: false, error: 'correction_too_long', message: `Keep the correction to ${TAKEAWAY_MAX} characters.` };
+    const short = takeaway.length > 90 ? `${takeaway.slice(0, 89)}…` : takeaway;
+    return { ok: true, value: { ...base, log_entry_id: Number(entry), payload: { takeaway, summary: `Correct an entry to read "${short}"` } } };
   }
   return { ok: true, value: { ...base, payload: {} } }; // remove_item: stop tracking
 }

package/modules/market-watch/proposals.js

@@ -23,8 +23,12 @@
 //                name and link are already tracked as the 'to' kind.
 //   add_source   payload { source_url }: the link joins the item's facts.watch_sources
 //                (shown on the item page; the weekly run does not read it yet).
-//   correct_entry payload {} with log_entry_id: the reason IS the correction, written for
-//                a person to act on, so the decision is recorded as 'approved' only.
+//   correct_entry payload { takeaway } or { wrong: true } with log_entry_id (task 1005016):
+//                the entry's takeaway is rewritten to the corrected one, or the entry is
+//                left as found and read as marked wrong (db.caseFile; the home's reports
+//                skip it). The text it replaced is kept on the proposal (payload.was),
+//                beside who proposed it, who approved it, when, and the reason why. A
+//                correct_entry filed before then carries no correction and is refused.
 //   The four item-page payloads are written by modules/market-watch/pages.js (task 1004939).
 // A carried-out approval is status 'applied'; a recorded one is 'approved'. A decline is
 // 'rejected'. Every decision names who made it and when (decided_by, decided_at).
@@ -58,7 +62,7 @@ const SQL = Object.freeze({
     VALUES ($1, $2, 'member', $3, $4, $5::jsonb, $6, $7)
     RETURNING id, kind, status, created_at`,
   lock: `-- mw:proposal-lock
-    SELECT id, kind, origin, item_id, rule_version_id, payload, reason, proposed_by, status
+    SELECT id, kind, origin, item_id, log_entry_id, rule_version_id, payload, reason, proposed_by, status
       FROM market_watch_proposals WHERE id = $1 AND project = $2 FOR UPDATE`,
   maxVersion: `-- mw:rules-max-version
     SELECT COALESCE(max(version), 0)::int AS v FROM market_watch_rule_versions WHERE project = $1`,
@@ -117,6 +121,22 @@ const SQL = Object.freeze({
            updated_at = now()
      WHERE id = $1 AND project = $2 AND status <> 'removed'
     RETURNING id`,
+  // The entry a correction names, locked, scoped to the proposal's item and this project.
+  entryLock: `-- mw:entry-lock
+    SELECT e.id, e.item_id, e.run_id, e.takeaway
+      FROM market_watch_log_entries e
+      JOIN market_watch_items i ON i.id = e.item_id
+     WHERE e.id = $1 AND e.item_id = $3 AND i.project = $2
+       FOR UPDATE OF e`,
+  // The corrected takeaway, unless the same item already holds that takeaway from the
+  // same run (the unique index market_watch_log_entries_once would refuse it).
+  entryCorrect: `-- mw:entry-correct
+    UPDATE market_watch_log_entries e SET takeaway = $2::text
+     WHERE e.id = $1
+       AND NOT EXISTS (SELECT 1 FROM market_watch_log_entries o
+                        WHERE o.item_id = e.item_id AND o.run_id = e.run_id AND o.id <> e.id
+                          AND md5(o.takeaway) = md5($2::text))
+    RETURNING e.id`,
   atVote: `-- mw:proposal-at-vote
     UPDATE market_watch_proposals SET payload = payload || jsonb_build_object('matter_id', $3::text)
      WHERE id = $1 AND project = $2 AND status = 'open'`,
@@ -206,9 +226,20 @@ function itemChange(kind, payload) {
   return null;
 }
 
+// entryCorrection(payload) → { takeaway } | { wrong: true, takeaway: null } | null — what a
+// correct_entry carries (pages.normalizeProposal writes it), re-checked here. A proposal
+// filed before task 1005016 carries neither, so it cannot be applied (no_correction).
+function entryCorrection(payload) {
+  const p = payload || {};
+  if (p.wrong === true) return { wrong: true, takeaway: null };
+  const t = String(p.takeaway == null ? '' : p.takeaway).replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s+/g, ' ').trim();
+  return t && t.length <= 500 ? { takeaway: t } : null;
+}
+
 // decideProposal(pool, { project, id, decision, decidedBy, via, withTx }) →
 //   { ok: true, status, applied, version?, item_id? } |
-//   { ok: false, reason: 'not_found' | 'not_open' | 'no_active_rules' | 'no_longer_applies' | 'bad_payload' | 'item_gone' }
+//   { ok: false, reason: 'not_found' | 'not_open' | 'no_active_rules' | 'no_longer_applies' | 'bad_payload' | 'item_gone'
+//     | 'no_correction' | 'entry_gone' | 'same_as_another_entry' }
 // `via` is recorded on the proposal's payload when a government vote decided it
 // ({ decided_via: 'vote', matter_id }); an owner's own decision records nothing extra.
 // `withTx(fn)` runs fn(client) in one transaction (the doorway's withTx in production).
@@ -219,8 +250,8 @@ async function decideProposal({ project, id, decision, decidedBy, via = null, wi
     const { rows: [p] } = await client.query(SQL.lock, [id, project]);
     if (!p) return { ok: false, reason: 'not_found' };
     if (p.status !== 'open') return { ok: false, reason: 'not_open', status: p.status };
-    const extra = JSON.stringify(via || {});
-    const decide = async (status, { versionId = null, itemId = null } = {}) => {
+    const decide = async (status, { versionId = null, itemId = null, kept = null } = {}) => {
+      const extra = JSON.stringify({ ...(kept || {}), ...(via || {}) });
       const { rows: [d] } = await client.query(SQL.decide, [id, project, status, decidedBy, versionId, itemId, extra]);
       return d;
     };
@@ -268,9 +299,28 @@ async function decideProposal({ project, id, decision, decidedBy, via = null, wi
       await decide('applied');
       return { ok: true, status: 'applied', applied: true, item_id: Number(p.item_id) };
     }
+    if (p.kind === 'correct_entry') {
+      const c = entryCorrection(p.payload);
+      if (!c || p.log_entry_id == null || p.item_id == null) return { ok: false, reason: 'no_correction' };
+      const { rows: [e] } = await client.query(SQL.entryLock, [p.log_entry_id, project, p.item_id]);
+      if (!e) return { ok: false, reason: 'entry_gone' };
+      // A correction that reads the same as the entry already does (compared after the
+      // same one-line normalising entryCorrection applies) writes nothing to the entry;
+      // the proposal is still 'applied', since the entry now reads as it asked.
+      const now = String(e.takeaway).replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s+/g, ' ').trim();
+      if (c.takeaway != null && c.takeaway !== now) {
+        const { rows: [done] } = await client.query(SQL.entryCorrect, [e.id, c.takeaway]);
+        if (!done) return { ok: false, reason: 'same_as_another_entry' };
+      }
+      // Who proposed it (proposed_by), who approved it and when (decided_by, decided_at)
+      // and why (reason) are the proposal row's own columns; the text it replaced is kept
+      // on the row too, so the original finding is never lost.
+      await decide('applied', { kept: { was: e.takeaway } });
+      return { ok: true, status: 'applied', applied: true, item_id: Number(p.item_id), log_entry_id: Number(e.id) };
+    }
     await decide('approved');
     return { ok: true, status: 'approved', applied: false };
   });
 }
 
-module.exports = { createProposal, decideProposal, getOpen, markAtVote, itemFromPayload, itemChange, MAX_OPEN_PER_MEMBER };
+module.exports = { createProposal, decideProposal, getOpen, markAtVote, itemFromPayload, itemChange, entryCorrection, MAX_OPEN_PER_MEMBER };

package/modules/market-watch/routes/pages.js

@@ -87,6 +87,8 @@ module.exports = function buildMarketWatchPagesRouter(deps = {}) {
       value: {},
       url: { type: 'string', maxLength: 2000 },
       log_entry_id: {},
+      takeaway: { type: 'string', maxLength: 2000 }, // correct_entry: the entry as it should read
+      wrong: {},                                     // correct_entry: or the entry is wrong
       scout: { type: 'string', enum: pages.KINDS },
       name: { type: 'string', maxLength: 2000 },
     })) return;

package/modules/market-watch/routes/rules.js

@@ -87,6 +87,10 @@ const DECIDE_REFUSALS = Object.freeze({
   no_longer_applies: [409, 'The rules changed since this was proposed, so it no longer fits. Decline it and propose again.'],
   bad_payload: [409, 'This proposal does not name anything to add.'],
   item_gone: [409, 'That item is no longer on this project.'],
+  // a correct_entry (task 1005016)
+  no_correction: [409, 'This proposal does not say how the entry should read. Decline it and propose the correction again.'],
+  entry_gone: [409, 'That entry is no longer in this item\'s case file.'],
+  same_as_another_entry: [409, 'The item already has an entry from that run that reads the same. Decline this one.'],
 });
 
 module.exports = function buildMarketWatchRulesRouter() {

package/modules/platform-identity/terms-acceptance.js

@@ -48,11 +48,10 @@
 // ever READS the marker. tests/terms_acceptance.mjs holds both rules, and fails
 // any other server file that writes these columns or names the marker.
 //
-// A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
-// recorded and a sign-in never overwrites it, publishing a new TERMS_VERSION leaves every
-// existing row naming the text it actually agreed to — so the platform can see
-// who has not accepted the new one. Re-acceptance on revision is deliberately
-// NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
+// A REVISION IS RE-ACCEPTED AT THE NEXT BROWSER SIGN-IN (2026-10-30, the AI
+// features revision; supersedes ADR 0213 D4). Until then a row keeps naming the
+// text it actually agreed to, so the platform can see who has not accepted the
+// new one. A sign-in under the SAME version still never restamps.
 'use strict';
 
 // The version of the platform terms currently served at /terms. It is stamped
@@ -65,7 +64,7 @@
 // The terms_version column it fills is WRITE-ONLY today, on purpose: nothing
 // reads it until a revision needs to know who accepted which text (ADR 0213 D5).
 // It is not dead — dropping it would erase exactly that answer.
-const TERMS_VERSION = '2026-08-29';
+const TERMS_VERSION = '2026-10-30';
 
 // A Postgres placeholder, e.g. '$5'. Interpolated into SQL, so it is validated
 // rather than trusted — the account-visibility.js alias-guard pattern.
@@ -96,8 +95,9 @@ function acceptanceInsertValues(activateParam, versionParam) {
 
 // The ON CONFLICT DO UPDATE SET fragment — the write-once half. On the
 // activating sign-in: a grandfathered acceptance is replaced outright; any other
-// acceptance on record is kept (COALESCE), so a second sign-in re-reads the terms
-// without restamping them; and the source becomes 'signin' either way, since a
+// acceptance of an older version is replaced too (the person signed in under
+// the new text); any other acceptance on record is kept (COALESCE), so a
+// second sign-in re-reads the terms without restamping them; and the source becomes 'signin' either way, since a
 // human just accepted. Keying the replacement on the grandfather marker, not on
 // "no signin recorded", matters: an acceptance with no source (written by the
 // pre-024 code in the deploy window) is a real sign-in and keeps its date. A
@@ -111,7 +111,7 @@ function acceptanceConflictSet(activateParam, versionParam) {
   assertPlaceholder('acceptanceConflictSet', versionParam);
   const self = 'platform_identity_accounts';
   const signin = `${activateParam}::boolean`;
-  const replaces = `WHEN ${signin} AND ${self}.terms_accepted_source = 'grandfathered'`;
+  const replaces = `WHEN ${signin} AND (${self}.terms_accepted_source = 'grandfathered' OR ${self}.terms_version IS DISTINCT FROM ${versionParam}::text)`;
   return `terms_accepted_at = CASE ${replaces} THEN now()`
     + ` WHEN ${signin} THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
     + ` terms_version = CASE ${replaces} THEN ${versionParam}::text`

package/modules/public-landing/public/account-google.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The Link GitHub chip (task 1004996): a Google-only person, no GitHub way in, so the hub bar draws one very small chip with the engineer's icon at the head of its right side, linking to the GitHub link start; the ways-in section lists Google only with Link GitHub beside GitHub. stub.fixtures points the identity at fixtures/me-google.json (the stand-in login ~builder) and the ways-in read at fixtures/me-sign-in-methods-google.json. The default account.states.json (GitHub linked) draws no chip.",
+  "page": "/account",
+  "surface": "public-landing",
+  "stub": { "fixtures": { "me": "me-google", "me__sign-in-methods": "me-sign-in-methods-google" } },
+  "modes": ["dark"],
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/cross-project$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "Unauthorized"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "in-google": { "auth": true, "url": "/account#aWaysIn", "actions": [["wait", 500]], "expect": { "visible": ["#ghChip", "#who", "#waysList"], "attr": [["#ghChip", "href", "/api/bongos/auth/link/github/start"], ["#ghChip", "aria-label", "Link GitHub — needed for coding work"]] } }
+  }
+}

package/modules/public-landing/public/assets/cosmos.css

@@ -647,6 +647,16 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);
   font-family:var(--font-body);font-size:12px;font-weight:700;line-height:1;letter-spacing:0;vertical-align:middle;}
 .who>.invBadge{max-width:none;overflow:visible;}
+/* the Link GitHub chip (task 1004996; hub-bar.js, projects.html): very small and quiet, for
+   someone with no GitHub linked — a hairline pill with the engineer's glyph, never a banner;
+   under 900 the words fold away and the glyph keeps a 24px target */
+.ghChip{display:inline-flex;align-items:center;justify-content:center;gap:5px;min-height:24px;min-width:24px;padding:0 9px 0 7px;
+  flex:none;border:1px solid var(--rule);border-radius:var(--radius-pill);color:var(--ink-soft);
+  font-family:var(--label-face);font-size:11.5px;line-height:1;white-space:nowrap;text-decoration:none;
+  transition:color .2s cubic-bezier(.2,.7,.3,1),border-color .2s cubic-bezier(.2,.7,.3,1);}
+.ghChip:hover{color:var(--ink);border-color:var(--ink-faint);}
+.ghChip:focus-visible{outline:2px solid var(--focus);outline-offset:2px;}
+.ghChip svg{width:13px;height:13px;flex:none;fill:none;stroke:currentColor;stroke-width:1.4;stroke-linecap:round;stroke-linejoin:round;}
 .bandT .invBadge{margin-left:10px;}
 .invWaiting{margin:6px 0 4px;font-size:15.5px;font-weight:600;}
 /* keyboard focus on the two search pills is VISIBLE — the input's own outline
@@ -728,6 +738,8 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   .qWrap{flex:1 1 90px;max-width:480px;gap:10px;}
   .trig{font-size:13.5px;}
   .who>span{display:none;}
+  .ghChip{padding:0;}
+  .ghChip__label{display:none;}
   .signinDoor{padding:0 16px;font-size:13.5px;}
   .bandIn{padding:0 12px 16px;}
   .bandRow{grid-template-columns:1fr;gap:0;}