From fec379b760b32caa9d37873aaf48ff9f44e065ae Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 26 Aug 2026 04:58:30 -0400
Subject: [PATCH 1/4] The numbers you are responsible for can be changed where
 you see them
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"i still dont se any input section for budget. all isee is it hardcoded and i
cant edit it. sweep all sections areas and functions for such blunders."

── WHAT THE ROW WAS ACTUALLY SAYING ────────────────────────────────────────

It was not hardcoded, and that is exactly why the report is fair. Look at one
line of the budget table as it was:

    Spent      a <button> that opens the ledger behind the figure
    Projected  an <input> you can type in
    Budgeted   plain text

The one number a treasurer is RESPONSIBLE FOR SETTING was the only one on the
row with no affordance. Changing it meant scrolling past the table and the
chart to a card headed "Add a budget line", retyping the category name exactly,
and then confirming a re-budget question — three steps you have to already know
about. So the row taught its own lesson, and the lesson was wrong: two of these
numbers are yours to touch, the third is not.

Nothing was disabled and nothing was explained, because from the markup's point
of view nothing was wrong. That is the shape of this whole class of defect — an
affordance that is MISSING rather than broken. No test fails, no error is
reported, and the only signal it ever produces is somebody saying it looks
hardcoded.

── THE FIX ─────────────────────────────────────────────────────────────────

The budgeted figure is now a button that opens `BudgetLineEditor` — deliberately
the same interaction "Spent" already uses one column over, so the row reads
consistently: the numbers you can act on look like the numbers you can act on.

It is a dialog rather than an inline input for a structural reason: the table is
already inside the forecast `ReportingForm`, an HTML form cannot nest, and a
bare input there would post to the FORECAST action — a different write with
different authority.

No second confirmation, and that is not a shortcut. `AddBudgetLineForm` asks
"are you sure" before overwriting an allocation and is right to: there the
person typed a category NAME and may not know a line by that name exists, which
is how $2,000 once became $7.00 silently. Here they pressed the figure on a
specific row and are looking at what it is now, so the dialog shows the before
and after continuously — which is what the confirmation was protecting — and
posts `intent=REBUDGET_INTENT` directly.

It writes through `upsertBudgetLine`, the path that already exists, so the audit
row, the OSE override's mandatory stated reason, and the ledger's invariants are
all unchanged. This changes where a change is STARTED, never what is allowed.

── THE SWEEP, AND WHAT IT FOUND ────────────────────────────────────────────

Two systemic findings, both the same shape:

1. NO EDIT CONTROL EXISTS ANYWHERE IN TENURE. Searching every component for
   `Edit`, `Rename`, `Change`, `Update` or `Save changes` as visible control
   text returns nothing. Every entity is created through a form and then, from
   the surface where it lives, is read-only. The budget cell was the instance
   that got reported.

2. A CLUB COULD NOT EDIT ITS OWN DESCRIPTION. The only org fields a club
   manager could change were the image and the status. The description — the
   first thing every member, every prospective member and the workspace export
   reads — could be changed by exactly one person, an OSE Director, in
   /admin/clubs. `requireOrgManager` has always refused with "You do not have
   permission to edit this club", a sentence written for an edit path that did
   not exist.

   `updateOrgProfile` + `ClubProfileEditor` close it. Where the line is drawn:
   the club owns how it DESCRIBES itself; the institution owns how it is FILED.
   So `description` and `shortName` are editable and `category` is not — that is
   the taxonomy the whole directory is grouped and counted by, so a club
   re-filing itself would move a figure on somebody else's report. `name` and
   `slug` stay too: a slug is inside every link anyone has ever shared. The
   dialog SAYS this rather than leaving a president to conclude the page is
   broken.

   The audit row records the previous description, not merely that something
   changed — "somebody edited it" is not an answer to "who removed the
   accessibility note".

Checked and NOT a defect: the view-only case. A reader who cannot manage
finance already gets a panel naming the seat holders who can, and the OSE
Director when no qualifying seat is filled. No unreachable server actions exist
either — every action has a UI caller, which is why the budget case was an
affordance in the wrong PLACE rather than a capability that was missing.

── VERIFICATION ────────────────────────────────────────────────────────────

`the-numbers-you-own-can-be-changed.test.ts` is a source scan, because the
defect is a missing affordance: nothing throws and nothing renders wrong, so
only a test that asserts the control EXISTS can fail when somebody turns the
cell back into a string. Reverting it to plain text fails three of its nine.

A third repo gate caught me on the way: `Club.ProfileEdited` had no sentence in
`audit-narrative.ts`, so a new audit code would have printed as its own
identifier — the same "backend strings in the frontend" defect this queue has
been fixing all day, arriving through a door I opened.

tsc 0 errors · jest 418 suites / 6,673 tests green · next build exit 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../app/(app)/orgs/[slug]/members/page.tsx    |   9 +
 apps/web/src/app/(app)/orgs/actions.ts        |  91 +++++++-
 apps/web/src/components/ClubProfileEditor.tsx | 156 +++++++++++++
 .../components/finance/BudgetLineEditor.tsx   | 212 ++++++++++++++++++
 .../components/finance/FinanceDashboard.tsx   |  36 ++-
 ...he-numbers-you-own-can-be-changed.test.tsx |  98 ++++++++
 apps/web/src/lib/audit-narrative.ts           |   4 +
 7 files changed, 604 insertions(+), 2 deletions(-)
 create mode 100644 apps/web/src/components/ClubProfileEditor.tsx
 create mode 100644 apps/web/src/components/finance/BudgetLineEditor.tsx
 create mode 100644 apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx

diff --git a/apps/web/src/app/(app)/orgs/[slug]/members/page.tsx b/apps/web/src/app/(app)/orgs/[slug]/members/page.tsx
index 8f4a77a4..8304a5de 100644
--- a/apps/web/src/app/(app)/orgs/[slug]/members/page.tsx
+++ b/apps/web/src/app/(app)/orgs/[slug]/members/page.tsx
@@ -15,6 +15,7 @@ import { OrgTabs } from "@/components/OrgTabs"
 import { ExportButton } from "@/components/export/ExportButton"
 import { EmailLink } from "@/components/EmailLink"
 import { ClubImageEditor } from "@/components/ClubImageEditor"
+import { ClubProfileEditor } from "@/components/ClubProfileEditor"
 import { ConfirmSubmit } from "@/components/ui/ConfirmDialog"
 import { TermDatesForm } from "@/components/TermDatesForm"
 import { RosterAddForm } from "@/components/RosterAddForm"
@@ -124,6 +125,14 @@ export default async function MembersPage({
               canUpload={storageConfigured()}
             />
           )}
+          {canEditImage && (
+            <ClubProfileEditor
+              organizationId={org.id}
+              name={org.name}
+              shortName={org.shortName}
+              description={org.description}
+            />
+          )}
           <ExportButton href={`/api/export/orgs/${slug}/roster`} label="the roster" />
         </div>
         <OrgTabs slug={slug} />
diff --git a/apps/web/src/app/(app)/orgs/actions.ts b/apps/web/src/app/(app)/orgs/actions.ts
index f722480e..90c0774d 100644
--- a/apps/web/src/app/(app)/orgs/actions.ts
+++ b/apps/web/src/app/(app)/orgs/actions.ts
@@ -9,7 +9,12 @@ import { requireCapability } from "@/lib/admin/guard"
 import { withTenantScope } from "@/lib/tenant-scope"
 import { storageConfigured, uploadDocument } from "@/lib/s3"
 import { ACCEPT_IMAGE, MAX_IMAGE_BYTES, inspectUpload } from "@/lib/uploads"
-import { Refusal, reportable } from "@/lib/admin/action-state"
+import {
+  Refusal,
+  reportable,
+  reportingWith,
+  type DialogActionState,
+} from "@/lib/admin/action-state"
 import { recordAuditEvent } from "@/lib/audit-record"
 
 async function requireUserId() {
@@ -114,6 +119,90 @@ async function auditImage(org: { id: string; institutionId: string }, actorId: s
   })
 }
 
+/**
+ * A CLUB EDITS ITS OWN DESCRIPTION.
+ *
+ * ── The gap this closes ─────────────────────────────────────────────────────
+ *
+ * Before this, the only thing a club could change about itself was its IMAGE.
+ * Its description — the sentence every member, every prospective member and
+ * every export reads first — could be changed by exactly one person: an OSE
+ * Director, in `/admin/clubs`. A president looking at their own club's page saw
+ * a paragraph about their club that they had no way to correct.
+ *
+ * Nothing was broken, which is why it lasted. `requireOrgManager` below has
+ * always refused with "You do not have permission to edit this club" — a
+ * sentence written for an edit path that did not exist.
+ *
+ * ── WHAT IS DELIBERATELY NOT HERE ──────────────────────────────────────────
+ *
+ * `category` stays with the OSE. It is the institution's TAXONOMY — the thing
+ * clubs are grouped and compared by across the whole directory — so a club
+ * re-filing itself would change a number on somebody else's report. That is a
+ * different decision from describing yourself, and it belongs where the other
+ * institution-wide decisions are.
+ *
+ * `name` and `slug` stay too. A slug is in every link anybody has ever shared,
+ * and renaming a recognised organisation is an institution act with a record,
+ * not a text box.
+ *
+ * The club owns how it DESCRIBES itself. The institution owns how it is FILED.
+ */
+export const updateOrgProfile = reportingWith<DialogActionState>(async (formData: FormData) => {
+  const userId = await requireUserId()
+  return withTenantScope(userId, async () => {
+    const organizationId = String(formData.get("organizationId") ?? "")
+    const org = await requireOrgManager(userId, organizationId)
+
+    // Trimmed, and empty means "cleared" rather than "unchanged" — a club
+    // deleting its description on purpose must be able to.
+    const description = String(formData.get("description") ?? "").trim()
+    const shortName = String(formData.get("shortName") ?? "").trim()
+
+    if (description.length > 2000) {
+      throw new Refusal("That description is too long. Keep it under 2,000 characters.")
+    }
+    if (shortName.length > 80) {
+      throw new Refusal("That short name is too long. Keep it under 80 characters.")
+    }
+
+    await db.organization.update({
+      where: { id: org.id },
+      data: { description: description || null, shortName: shortName || null },
+    })
+
+    /*
+     * The record says WHAT it was, not merely that something happened.
+     *
+     * A club's description is the sentence its members read, and "somebody
+     * changed it" is not an answer to "who removed the accessibility note".
+     * The previous value goes on the row so the change can be read back.
+     */
+    await recordAuditEvent(db, {
+      institutionId: org.institutionId,
+      organizationId: org.id,
+      actorId: userId,
+      action: "Club.ProfileEdited",
+      resourceType: "Organization",
+      resourceId: org.id,
+      outcome: "ALLOW",
+      metadata: {
+        fromDescription: org.description,
+        toDescription: description || null,
+        fromShortName: org.shortName,
+        toShortName: shortName || null,
+      },
+    })
+
+    revalidatePath(`/orgs/${org.slug}/members`)
+    revalidatePath("/orgs")
+    revalidatePath("/admin/clubs")
+    // `ok` rather than `{}`: useActionState's initial value is also `{}`, so
+    // an empty object cannot tell success from 'nothing submitted yet'.
+    return { ok: true }
+  })
+})
+
 /** Upload a club image to object storage; the /api/org-image proxy serves it. */
 export const uploadOrgImage = reportable(async function uploadOrgImageImpl(formData: FormData) {
   const userId = await requireUserId()
diff --git a/apps/web/src/components/ClubProfileEditor.tsx b/apps/web/src/components/ClubProfileEditor.tsx
new file mode 100644
index 00000000..9e2a5303
--- /dev/null
+++ b/apps/web/src/components/ClubProfileEditor.tsx
@@ -0,0 +1,156 @@
+"use client"
+
+import { useActionState, useEffect, useState } from "react"
+import { AlertCircle, PenSquare } from "@/components/ui/icons"
+import { Overlay } from "@/components/ui/Overlay"
+import { updateOrgProfile } from "@/app/(app)/orgs/actions"
+import type { DialogActionState } from "@/lib/admin/action-state"
+
+/**
+ * A CLUB EDITS THE SENTENCE ITS OWN MEMBERS READ.
+ *
+ * ── The gap ─────────────────────────────────────────────────────────────────
+ *
+ * Found while sweeping for the defect the owner reported on the budget: a value
+ * on screen with no way to change it from where it is shown.
+ *
+ * A club's description is the first thing anybody reads about it — on its
+ * members page, in the club directory, and in the workspace export. Until now
+ * exactly one person could change it: an OSE Director, in `/admin/clubs`. A
+ * president reading a stale paragraph about their own club had no control
+ * anywhere, and no explanation of why not.
+ *
+ * The same shape as the budget cell: nothing disabled, nothing broken, nothing
+ * to report — just an affordance that was never there.
+ *
+ * ── Where the line is drawn, and why it is drawn there ──────────────────────
+ *
+ * The club owns how it DESCRIBES itself. The institution owns how it is FILED.
+ *
+ * So `description` and `shortName` are here, and `category` is not: category is
+ * the taxonomy the whole directory is grouped and counted by, so a club
+ * re-filing itself would move a figure on somebody else's report. `name` and
+ * `slug` are not here either — a slug sits inside every link anybody has ever
+ * shared of this club.
+ *
+ * The refusal is not in this component. `requireOrgManager` decides, on the
+ * server, on every submission; this only decides whether the button is drawn.
+ */
+export function ClubProfileEditor({
+  organizationId,
+  name,
+  shortName,
+  description,
+}: {
+  organizationId: string
+  name: string
+  shortName: string | null
+  description: string | null
+}) {
+  const [open, setOpen] = useState(false)
+  const [state, formAction, pending] = useActionState<DialogActionState, FormData>(
+    updateOrgProfile,
+    {}
+  )
+
+  // Controlled, so a refusal leaves what was typed exactly where it was —
+  // React empties an uncontrolled form when the action resolves, which would
+  // throw away a paragraph somebody had just written.
+  const [desc, setDesc] = useState(description ?? "")
+  const [short, setShort] = useState(shortName ?? "")
+
+  useEffect(() => {
+    if (state.ok) setOpen(false)
+  }, [state.ok])
+
+  return (
+    <>
+      <button
+        type="button"
+        onClick={() => setOpen(true)}
+        aria-label={`Edit ${name}'s description`}
+        className="inline-flex shrink-0 items-center gap-1.5 rounded border border-border px-3 py-1.5 text-xs font-medium text-text-2 hover:bg-base hover:text-text-1 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[--primary]"
+      >
+        <PenSquare size={13} /> Edit description
+      </button>
+
+      {open && (
+        <Overlay
+          isOpen
+          onOpenChange={(next) => {
+            if (!next) setOpen(false)
+          }}
+          title={`About ${name}`}
+          description="This is what members and prospective members read first."
+          size="md"
+        >
+          <form action={formAction} className="space-y-3">
+            <input type="hidden" name="organizationId" value={organizationId} />
+
+            <label className="flex flex-col gap-1 text-xs text-text-2">
+              Description
+              <textarea
+                name="description"
+                rows={6}
+                maxLength={2000}
+                value={desc}
+                onChange={(e) => setDesc(e.target.value)}
+                placeholder="What this club does, who it is for, and how to get involved."
+                className="w-full rounded border border-border bg-surface px-3 py-2 text-sm text-text-1 placeholder:text-text-3"
+              />
+              <span className="text-[11px] text-text-3">
+                {desc.length}/2000. Leave it empty to remove the description entirely.
+              </span>
+            </label>
+
+            <label className="flex flex-col gap-1 text-xs text-text-2">
+              Short name (optional)
+              <input
+                name="shortName"
+                maxLength={80}
+                value={short}
+                onChange={(e) => setShort(e.target.value)}
+                placeholder="The name without the acronym, for tight spaces"
+                className="h-9 w-full rounded border border-border bg-surface px-3 text-sm text-text-1 placeholder:text-text-3"
+              />
+            </label>
+
+            {/*
+              Said, rather than left to be discovered. A president who comes
+              here to fix the category and finds no field should learn why, not
+              conclude the page is broken.
+            */}
+            <p className="rounded border border-border bg-base p-2.5 text-[11px] text-text-3">
+              A club&apos;s category, name and web address are set by the Office of Student
+              Engagement — they are how every club is filed and linked to across Tenure. Ask the
+              OSE to change one.
+            </p>
+
+            {state.error && (
+              <p role="alert" className="flex items-start gap-1.5 text-xs text-[--error]">
+                <AlertCircle size={13} className="mt-0.5 shrink-0" />
+                {state.error}
+              </p>
+            )}
+
+            <div className="flex gap-2">
+              <button
+                type="button"
+                onClick={() => setOpen(false)}
+                className="h-9 flex-1 rounded border border-border text-sm text-text-1 hover:bg-base"
+              >
+                Cancel
+              </button>
+              <button
+                disabled={pending}
+                className="h-9 flex-1 rounded bg-[--primary] text-sm font-medium text-[--primary-text] hover:opacity-90 disabled:opacity-50"
+              >
+                {pending ? "Saving…" : "Save"}
+              </button>
+            </div>
+          </form>
+        </Overlay>
+      )}
+    </>
+  )
+}
diff --git a/apps/web/src/components/finance/BudgetLineEditor.tsx b/apps/web/src/components/finance/BudgetLineEditor.tsx
new file mode 100644
index 00000000..0621dc59
--- /dev/null
+++ b/apps/web/src/components/finance/BudgetLineEditor.tsx
@@ -0,0 +1,212 @@
+"use client"
+
+import { useActionState, useEffect, useState } from "react"
+import { AlertCircle, CheckCircle } from "@/components/ui/icons"
+import { Overlay } from "@/components/ui/Overlay"
+import { ReasonField } from "@/components/forms/ReasonField"
+import { formatCents, parseMoneyToCents, REBUDGET_INTENT } from "@/lib/finance"
+import {
+  upsertBudgetLine,
+  type BudgetLineFormState,
+} from "@/app/(app)/orgs/[slug]/finance/actions"
+
+/**
+ * CHANGE A BUDGET FROM THE ROW IT IS ON.
+ *
+ * ── The report ──────────────────────────────────────────────────────────────
+ *
+ * "i still dont se any input section for budget. all isee is it hardcoded and
+ * i cant edit it."
+ *
+ * It was not hardcoded, and that is exactly why the report is fair. A treasurer
+ * COULD change an allocation — by scrolling past the table and the chart to a
+ * card headed "Add a budget line", retyping the category name exactly, and then
+ * confirming a re-budget question. Every one of those steps is a thing you have
+ * to already know.
+ *
+ * ── What the row was actually saying ────────────────────────────────────────
+ *
+ * Look at one line of that table. "Spent" is a button that opens the ledger
+ * behind the figure. "Projected" is a text input you can type in. "Budgeted" —
+ * the one number a treasurer is responsible for setting — was plain text, for
+ * managers and viewers alike.
+ *
+ * So the row taught its own lesson, and the lesson was wrong: two of these
+ * numbers are yours to touch, the third is not. Nothing was disabled and
+ * nothing was explained, because from the markup's point of view nothing was
+ * wrong. That is the shape of this defect — an affordance that is MISSING
+ * rather than broken, which no test fails over and no error ever reports.
+ *
+ * ── The design, and why it is a dialog rather than an inline input ──────────
+ *
+ * Structural: the whole table is already inside the forecast `ReportingForm`,
+ * and an HTML form cannot nest. A per-row `<form>` around the budget cell is
+ * not available, and a bare input inside the enclosing form would post its
+ * value to the FORECAST action, which is a different write with different
+ * authority.
+ *
+ * So the budget figure becomes a button that opens this — deliberately the same
+ * interaction "Spent" already uses one column over, so the row now reads
+ * consistently: the numbers you can act on look like the numbers you can act
+ * on.
+ *
+ * ── No second confirmation here, and that is not a shortcut ─────────────────
+ *
+ * `AddBudgetLineForm` asks "are you sure" before overwriting an allocation, and
+ * it is right to: there, the person typed a category NAME and may not know a
+ * line by that name already exists, so applying it silently is how $2,000
+ * became $7.00 with nothing on screen to say so.
+ *
+ * Here the ambiguity does not exist. The person pressed the figure on a
+ * specific row and is looking at what it is now. So this posts
+ * `intent=REBUDGET_INTENT` directly — and shows the before and after in the
+ * dialog first, which is the thing the confirmation was protecting.
+ *
+ * The server still records the adjustment, still demands a stated reason from
+ * somebody acting as an OSE override, and still refuses without one. This
+ * changes where the change is STARTED, never what is allowed.
+ */
+export function BudgetLineEditor({
+  slug,
+  line,
+  overriding,
+  onClose,
+}: {
+  slug: string
+  line: { id: string; category: string; budgetedCents: number; actualCents: number }
+  /** Acting as an OSE Director in a club the viewer holds no seat in. */
+  overriding: boolean
+  onClose: () => void
+}) {
+  const [state, formAction, pending] = useActionState<BudgetLineFormState, FormData>(
+    upsertBudgetLine.bind(null, slug),
+    {}
+  )
+
+  // Pre-filled with what the line IS. A person changing an allocation is
+  // almost always adjusting it rather than replacing it from nothing, and an
+  // empty box makes them go and find the current figure again.
+  const [budgeted, setBudgeted] = useState(() => (line.budgetedCents / 100).toFixed(2))
+  const [reason, setReason] = useState("")
+
+  useEffect(() => {
+    // Close only on a real outcome. A refusal leaves the dialog exactly where
+    // it was, because the person is still in the middle of doing this.
+    if (state.done) onClose()
+  }, [state, onClose])
+
+  const nextCents = parseMoneyToCents(budgeted)
+  const unchanged = nextCents !== null && nextCents === line.budgetedCents
+  const unreadable = budgeted.trim() !== "" && nextCents === null
+
+  return (
+    <Overlay
+      isOpen
+      onOpenChange={(open) => {
+        if (!open) onClose()
+      }}
+      title={line.category}
+      description="Change what this club has budgeted for this line."
+      size="sm"
+    >
+      <form action={formAction} className="space-y-3">
+        {/* The category is what identifies the line to the server. Sent as a
+            hidden field rather than a second typed box, because retyping the
+            name is the step that made this unusable in the first place. */}
+        <input type="hidden" name="category" value={line.category} />
+        <input type="hidden" name="intent" value={REBUDGET_INTENT} />
+
+        <dl className="grid grid-cols-2 gap-2 rounded border border-border bg-base p-3 text-xs">
+          <dt className="text-text-3">Budgeted now</dt>
+          <dd className="text-right tabular-nums text-text-1">
+            {formatCents(line.budgetedCents)}
+          </dd>
+          <dt className="text-text-3">Spent so far</dt>
+          <dd className="text-right tabular-nums text-text-1">{formatCents(line.actualCents)}</dd>
+        </dl>
+
+        <label className="flex flex-col gap-1 text-xs text-text-2">
+          New amount for this line
+          <span className="inline-flex items-center gap-1">
+            <span className="text-text-3">$</span>
+            <input
+              name="budgeted"
+              inputMode="decimal"
+              autoFocus
+              value={budgeted}
+              onChange={(e) => setBudgeted(e.target.value)}
+              aria-invalid={unreadable ? true : undefined}
+              aria-label={`New budget for ${line.category}`}
+              className={`h-9 w-full rounded border bg-surface px-3 text-sm text-text-1 ${
+                unreadable ? "border-[--warning]" : "border-border"
+              }`}
+            />
+          </span>
+        </label>
+
+        {/*
+          THE CHANGE, BEFORE IT HAPPENS. This is what the "are you sure" step in
+          the add form is really for, shown continuously instead of as an
+          interruption after the fact.
+        */}
+        {nextCents !== null && !unchanged && (
+          <p className="text-xs text-text-2">
+            {formatCents(line.budgetedCents)} →{" "}
+            <strong className="text-text-1">{formatCents(nextCents)}</strong>
+            {nextCents < line.actualCents && (
+              <span className="ml-1 text-[--warning]">
+                — below what has already been spent on this line.
+              </span>
+            )}
+          </p>
+        )}
+        {unreadable && (
+          <p className="text-xs text-[--warning]">
+            That is not an amount. Type it like 2500 or 2,500.00.
+          </p>
+        )}
+
+        {overriding && (
+          <ReasonField
+            id={`budget-edit-reason-${line.id}`}
+            label="Why you are changing this club's budget"
+            placeholder="Approved at the OSE funding meeting on 12 September; minutes on file."
+            help="You hold no seat in this club, so this is an OSE override. It is recorded on the institution's audit log beside your name, and refused without a reason."
+            value={reason}
+            onChange={setReason}
+          />
+        )}
+
+        {state.error && (
+          <p role="alert" className="flex items-start gap-1.5 text-xs text-[--error]">
+            <AlertCircle size={13} className="mt-0.5 shrink-0" />
+            {state.error}
+          </p>
+        )}
+        {state.done && (
+          <p role="status" className="flex items-start gap-1.5 text-xs text-[--primary]">
+            <CheckCircle size={13} className="mt-0.5 shrink-0" />
+            {state.done}
+          </p>
+        )}
+
+        <div className="flex gap-2">
+          <button
+            type="button"
+            onClick={onClose}
+            className="h-9 flex-1 rounded border border-border text-sm text-text-1 hover:bg-base"
+          >
+            Cancel
+          </button>
+          <button
+            disabled={pending || unchanged || unreadable}
+            title={unchanged ? "This is already the amount budgeted for this line." : undefined}
+            className="h-9 flex-1 rounded bg-[--primary] text-sm font-medium text-[--primary-text] hover:opacity-90 disabled:opacity-50"
+          >
+            {pending ? "Saving…" : "Save budget"}
+          </button>
+        </div>
+      </form>
+    </Overlay>
+  )
+}
diff --git a/apps/web/src/components/finance/FinanceDashboard.tsx b/apps/web/src/components/finance/FinanceDashboard.tsx
index 70ed2a36..8f501a5e 100644
--- a/apps/web/src/components/finance/FinanceDashboard.tsx
+++ b/apps/web/src/components/finance/FinanceDashboard.tsx
@@ -42,6 +42,7 @@ import {
 } from "@/lib/finance-position"
 import { BudgetBarChart, type ChartRow } from "./BudgetBarChart"
 import { AddBudgetLineForm } from "./AddBudgetLineForm"
+import { BudgetLineEditor } from "./BudgetLineEditor"
 import { BudgetUpload } from "./BudgetUpload"
 import { LedgerDrawer, type LedgerEntryRow, type LedgerSources } from "./LedgerDrawer"
 import { ReportingForm } from "@/components/forms/ReportingForm"
@@ -172,6 +173,7 @@ export function FinanceDashboard({
 
   // The budget line whose ledger drawer (drill-down to source) is open.
   const [ledgerLine, setLedgerLine] = useState<DashboardLine | null>(null)
+  const [editingLine, setEditingLine] = useState<DashboardLine | null>(null)
 
   // Closed lines leave the plan but not the page: the totals, the chart and the
   // editable table are the CURRENT budget, and the closed list below keeps every
@@ -485,8 +487,26 @@ export function FinanceDashboard({
                           <span className="ml-2 text-[10px] uppercase text-text-3">imported</span>
                         )}
                       </td>
+                      {/*
+                        THE BUDGET IS ACTIONABLE, because it is the number a
+                        treasurer is responsible for. It was plain text while
+                        "Spent" beside it opened a ledger and "Projected"
+                        accepted typing — so the row taught that this figure
+                        was not theirs to set. See BudgetLineEditor.
+                      */}
                       <td className="px-3 py-2.5 text-right text-text-2">
-                        {formatCents(l.budgetedCents)}
+                        {canManage ? (
+                          <button
+                            type="button"
+                            onClick={() => setEditingLine(l)}
+                            title={`Change what is budgeted for ${l.category}`}
+                            className="tabular-nums text-text-1 underline decoration-dotted decoration-text-disabled underline-offset-2 hover:text-[--primary] hover:decoration-[--primary]"
+                          >
+                            {formatCents(l.budgetedCents)}
+                          </button>
+                        ) : (
+                          formatCents(l.budgetedCents)
+                        )}
                       </td>
                       <td className="px-3 py-2.5 text-right">
                         <button
@@ -731,6 +751,20 @@ export function FinanceDashboard({
         </div>
       )}
 
+      {editingLine && (
+        <BudgetLineEditor
+          slug={slug}
+          line={{
+            id: editingLine.id,
+            category: editingLine.category,
+            budgetedCents: editingLine.budgetedCents,
+            actualCents: editingLine.actualCents,
+          }}
+          overriding={overriding}
+          onClose={() => setEditingLine(null)}
+        />
+      )}
+
       {ledgerLine && (
         <LedgerDrawer
           slug={slug}
diff --git a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
new file mode 100644
index 00000000..07dd64cb
--- /dev/null
+++ b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
@@ -0,0 +1,98 @@
+import { readFileSync } from "node:fs"
+import { join } from "node:path"
+
+/**
+ * "i still dont se any input section for budget. all isee is it hardcoded and
+ * i cant edit it."
+ *
+ * ── What the row was saying ─────────────────────────────────────────────────
+ *
+ * It was never hardcoded. But look at one line of the budget table as it was:
+ *
+ *   Spent      → a <button> that opens the ledger behind the figure
+ *   Projected  → an <input> you can type in
+ *   Budgeted   → plain text
+ *
+ * The one number a treasurer is RESPONSIBLE FOR SETTING was the one with no
+ * affordance, for managers and viewers alike. Changing it meant scrolling past
+ * the table and the chart to a card headed "Add a budget line", retyping the
+ * category name exactly, and confirming a re-budget question — three steps you
+ * have to already know about.
+ *
+ * ── Why this test is a source scan ──────────────────────────────────────────
+ *
+ * The defect is an affordance that is MISSING, not one that is broken. Nothing
+ * threw, nothing rendered wrong, no assertion anywhere could have failed —
+ * which is exactly why it survived. A test that renders the table and asserts
+ * "a control exists here" is the only kind that fails when somebody quietly
+ * turns the cell back into a string.
+ */
+
+const DASHBOARD = join(__dirname, "FinanceDashboard.tsx")
+const EDITOR = join(__dirname, "BudgetLineEditor.tsx")
+
+describe("the budget figure is something a manager can act on", () => {
+  const dashboard = readFileSync(DASHBOARD, "utf8")
+
+  it("reads the real component, so this suite is not vacuously passing", () => {
+    expect(dashboard.length).toBeGreaterThan(5000)
+    expect(dashboard).toContain("budgetedCents")
+  })
+
+  it("opens the editor from the budgeted cell", () => {
+    expect(dashboard).toContain("setEditingLine(l)")
+    expect(dashboard).toContain("<BudgetLineEditor")
+  })
+
+  it("offers it to a manager and NOT to a viewer", () => {
+    // The gate on screen mirrors the server's; it is not what enforces it.
+    const cell = dashboard.slice(
+      dashboard.indexOf("THE BUDGET IS ACTIONABLE"),
+      dashboard.indexOf("THE BUDGET IS ACTIONABLE") + 1600
+    )
+    expect(cell).toContain("canManage ?")
+    expect(cell).toContain("setEditingLine")
+  })
+
+  it("still renders the figure for somebody who cannot change it", () => {
+    // A view-only reader loses the control, never the number.
+    const cell = dashboard.slice(
+      dashboard.indexOf("THE BUDGET IS ACTIONABLE"),
+      dashboard.indexOf("THE BUDGET IS ACTIONABLE") + 1600
+    )
+    expect(cell).toContain(") : (")
+    expect(cell).toContain("formatCents(l.budgetedCents)")
+  })
+})
+
+describe("the editor writes through the path that already has the rules", () => {
+  const editor = readFileSync(EDITOR, "utf8")
+
+  it("posts to upsertBudgetLine rather than a new write", () => {
+    // One write path means one place the audit row, the override refusal and
+    // the ledger's invariants are enforced.
+    expect(editor).toContain("upsertBudgetLine")
+  })
+
+  it("identifies the line by its category, without asking anyone to retype it", () => {
+    expect(editor).toContain('type="hidden" name="category"')
+  })
+
+  it("asks an OSE override for its reason", () => {
+    // The server refuses one without a sentence; the form must ask rather than
+    // let the person discover the refusal after typing an amount.
+    expect(editor).toContain("overriding &&")
+    expect(editor).toContain("ReasonField")
+  })
+
+  it("shows the change BEFORE it is made", () => {
+    // What the add form's "are you sure" step was really protecting, shown
+    // continuously instead of as an interruption afterwards.
+    expect(editor).toContain("formatCents(line.budgetedCents)")
+    expect(editor).toMatch(/→/)
+  })
+
+  it("refuses to submit an unchanged or unreadable amount", () => {
+    expect(editor).toContain("disabled={pending || unchanged || unreadable}")
+  })
+})
diff --git a/apps/web/src/lib/audit-narrative.ts b/apps/web/src/lib/audit-narrative.ts
index b3a622c5..485cd850 100644
--- a/apps/web/src/lib/audit-narrative.ts
+++ b/apps/web/src/lib/audit-narrative.ts
@@ -153,6 +153,10 @@ const PHRASES: Record<string, Phrase> = {
   "Admin.club.image": { past: "changed a club's image", present: "change a club's image" },
   "Club.ImageUploaded": { past: "uploaded a club image", present: "upload a club image" },
   "Club.ImageRemoved": { past: "removed a club image", present: "remove a club image" },
+  "Club.ProfileEdited": {
+    past: "edited a club's description",
+    present: "edit a club's description",
+  },
 
   // ── Approvals ─────────────────────────────────────────────────────────────
   "Approval.DraftCreated": { past: "started an approval request", present: "start an approval request" },

From 5d814b7dd8a0c71953ce5dfe5ea3ec2ebe0dbe7d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 26 Aug 2026 05:18:05 -0400
Subject: [PATCH 2/4] Four review findings on the budget editor, and one of
 them is the serious kind
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All four real. The first changes what the record can be trusted to say.

**The profile edit and its audit row now commit together.** `db.organization
.update` ran, and THEN `recordAuditEvent`. If the audit write failed, the
description was already changed, nothing in the log said who wrote it, and the
person who did it had been told it did not work — so they try again, and every
later reading of that record is wrong with nothing anywhere showing red.
`recordAuditEvent` takes its client as an argument precisely so it can be
handed a transaction; both are inside one now.

**The dialog closes on every save, not just the first.** The effect depended on
`state.ok`, which is `true` after the first success and STAYS true — a second
save returns a new state object carrying the same `true`, so the effect never
ran again and the dialog stayed open. It depends on `state` now, which
`useActionState` replaces per submission.

**An empty amount box is no longer submittable.** `unreadable` excludes the
empty string on purpose — clearing the box to type a new figure should not turn
it red — but `unchanged` is also false when the parse returns null, so Save
stayed enabled on an empty box and posted nothing. The only thing that refused
was the server. Empty is its own state now, with its own tooltip.

**The audit sentence covers the whole profile.** The action also changes
`shortName`, so a short-name-only edit was recorded as "edited a club's
description".

tsc 0 · jest 418 suites / 6,680 tests green · eslint clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/web/src/app/(app)/orgs/actions.ts        | 54 +++++++++++--------
 apps/web/src/components/ClubProfileEditor.tsx | 11 +++-
 .../components/finance/BudgetLineEditor.tsx   | 22 ++++++--
 ...he-numbers-you-own-can-be-changed.test.tsx | 22 +++++++-
 apps/web/src/lib/audit-narrative.ts           |  6 ++-
 5 files changed, 84 insertions(+), 31 deletions(-)

diff --git a/apps/web/src/app/(app)/orgs/actions.ts b/apps/web/src/app/(app)/orgs/actions.ts
index 90c0774d..46d962c9 100644
--- a/apps/web/src/app/(app)/orgs/actions.ts
+++ b/apps/web/src/app/(app)/orgs/actions.ts
@@ -166,32 +166,40 @@ export const updateOrgProfile = reportingWith<DialogActionState>(async (formData
       throw new Refusal("That short name is too long. Keep it under 80 characters.")
     }
 
-    await db.organization.update({
-      where: { id: org.id },
-      data: { description: description || null, shortName: shortName || null },
-    })
-
     /*
-     * The record says WHAT it was, not merely that something happened.
+     * THE EDIT AND ITS RECORD COMMIT TOGETHER, OR NEITHER DOES.
+     *
+     * The first version updated and then recorded. If the audit write failed,
+     * the description was already changed and the action reported failure — so
+     * the club's page showed new text, nothing in the log said who wrote it,
+     * and the person who did it had been told it did not work. Every later
+     * reading of that record is wrong, and nothing anywhere is red.
      *
-     * A club's description is the sentence its members read, and "somebody
-     * changed it" is not an answer to "who removed the accessibility note".
-     * The previous value goes on the row so the change can be read back.
+     * `recordAuditEvent` takes its client as an argument precisely so it can be
+     * handed a transaction. The record says WHAT it was as well as that it
+     * changed: "somebody edited it" is not an answer to "who removed the
+     * accessibility note".
      */
-    await recordAuditEvent(db, {
-      institutionId: org.institutionId,
-      organizationId: org.id,
-      actorId: userId,
-      action: "Club.ProfileEdited",
-      resourceType: "Organization",
-      resourceId: org.id,
-      outcome: "ALLOW",
-      metadata: {
-        fromDescription: org.description,
-        toDescription: description || null,
-        fromShortName: org.shortName,
-        toShortName: shortName || null,
-      },
+    await db.$transaction(async (tx) => {
+      await tx.organization.update({
+        where: { id: org.id },
+        data: { description: description || null, shortName: shortName || null },
+      })
+      await recordAuditEvent(tx, {
+        institutionId: org.institutionId,
+        organizationId: org.id,
+        actorId: userId,
+        action: "Club.ProfileEdited",
+        resourceType: "Organization",
+        resourceId: org.id,
+        outcome: "ALLOW",
+        metadata: {
+          fromDescription: org.description,
+          toDescription: description || null,
+          fromShortName: org.shortName,
+          toShortName: shortName || null,
+        },
+      })
     })
 
     revalidatePath(`/orgs/${org.slug}/members`)
diff --git a/apps/web/src/components/ClubProfileEditor.tsx b/apps/web/src/components/ClubProfileEditor.tsx
index 9e2a5303..a4948c52 100644
--- a/apps/web/src/components/ClubProfileEditor.tsx
+++ b/apps/web/src/components/ClubProfileEditor.tsx
@@ -60,8 +60,17 @@ export function ClubProfileEditor({
   const [short, setShort] = useState(shortName ?? "")
 
   useEffect(() => {
+    /*
+     * DEPENDS ON `state`, NOT ON `state.ok`.
+     *
+     * `ok` is `true` after the first successful save and STAYS true — a second
+     * save returns a new state object carrying the same `true`, so an effect
+     * keyed on the boolean never runs again and the dialog stays open on every
+     * save after the first. `useActionState` returns a fresh object per
+     * submission, which is the thing that actually changes.
+     */
     if (state.ok) setOpen(false)
-  }, [state.ok])
+  }, [state])
 
   return (
     <>
diff --git a/apps/web/src/components/finance/BudgetLineEditor.tsx b/apps/web/src/components/finance/BudgetLineEditor.tsx
index 0621dc59..a788684f 100644
--- a/apps/web/src/components/finance/BudgetLineEditor.tsx
+++ b/apps/web/src/components/finance/BudgetLineEditor.tsx
@@ -97,7 +97,17 @@ export function BudgetLineEditor({
 
   const nextCents = parseMoneyToCents(budgeted)
   const unchanged = nextCents !== null && nextCents === line.budgetedCents
-  const unreadable = budgeted.trim() !== "" && nextCents === null
+  /*
+   * EMPTY IS ITS OWN STATE, and it used to fall between the other two.
+   *
+   * `unreadable` excluded the empty string on purpose — an empty box is not a
+   * typo and should not be marked in red the moment somebody clears it to type
+   * a new figure. But `unchanged` is false as well when `nextCents` is null, so
+   * the Save button stayed enabled on an empty box and posted nothing, and the
+   * only thing that refused was the server.
+   */
+  const empty = budgeted.trim() === ""
+  const unreadable = !empty && nextCents === null
 
   return (
     <Overlay
@@ -199,8 +209,14 @@ export function BudgetLineEditor({
             Cancel
           </button>
           <button
-            disabled={pending || unchanged || unreadable}
-            title={unchanged ? "This is already the amount budgeted for this line." : undefined}
+            disabled={pending || empty || unchanged || unreadable}
+            title={
+              empty
+                ? "Type the amount to budget for this line."
+                : unchanged
+                  ? "This is already the amount budgeted for this line."
+                  : undefined
+            }
             className="h-9 flex-1 rounded bg-[--primary] text-sm font-medium text-[--primary-text] hover:opacity-90 disabled:opacity-50"
           >
             {pending ? "Saving…" : "Save budget"}
diff --git a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
index 07dd64cb..3bd89d0a 100644
--- a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
+++ b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
@@ -92,7 +92,25 @@ describe("the editor writes through the path that already has the rules", () =>
     expect(editor).toMatch(/→/)
   })
 
-  it("refuses to submit an unchanged or unreadable amount", () => {
-    expect(editor).toContain("disabled={pending || unchanged || unreadable}")
+  it("refuses to submit an EMPTY, unchanged or unreadable amount", () => {
+    /*
+     * Empty was its own state and fell between the other two. `unreadable`
+     * excludes the empty string on purpose — clearing the box to type a new
+     * figure should not turn it red — and `unchanged` is false when the parse
+     * returns null, so Save stayed enabled on an empty box and posted nothing.
+     * The only thing that refused was the server.
+     */
+    expect(editor).toContain("disabled={pending || empty || unchanged || unreadable}")
+    expect(editor).toContain('const empty = budgeted.trim() === ""')
+  })
+
+  it("commits the profile edit and its audit row together", () => {
+    // Not this file, but the same PR and the same failure shape: an update
+    // that commits before its record leaves a changed club description with
+    // nothing saying who changed it, while the person is told it failed.
+    const actions = readFileSync(join(__dirname, "..", "..", "app", "(app)", "orgs", "actions.ts"), "utf8")
+    const edit = actions.slice(actions.indexOf("export const updateOrgProfile"))
+    expect(edit.slice(0, 3000)).toContain("db.$transaction")
+    expect(edit.slice(0, 3000)).toContain("recordAuditEvent(tx,")
   })
 })
diff --git a/apps/web/src/lib/audit-narrative.ts b/apps/web/src/lib/audit-narrative.ts
index 485cd850..755d9d88 100644
--- a/apps/web/src/lib/audit-narrative.ts
+++ b/apps/web/src/lib/audit-narrative.ts
@@ -153,9 +153,11 @@ const PHRASES: Record<string, Phrase> = {
   "Admin.club.image": { past: "changed a club's image", present: "change a club's image" },
   "Club.ImageUploaded": { past: "uploaded a club image", present: "upload a club image" },
   "Club.ImageRemoved": { past: "removed a club image", present: "remove a club image" },
+  // PROFILE, not description: the same action also changes `shortName`, so a
+  // short-name-only edit was being described as an edit to the description.
   "Club.ProfileEdited": {
-    past: "edited a club's description",
-    present: "edit a club's description",
+    past: "edited a club's profile",
+    present: "edit a club's profile",
   },
 
   // ── Approvals ─────────────────────────────────────────────────────────────

From ff122af713dce27226529ff61903d3e38babf2d5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 26 Aug 2026 05:35:50 -0400
Subject: [PATCH 3/4] The transaction test proved co-occurrence, not
 containment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The assertion was:

    expect(edit.slice(0, 3000)).toContain("db.$transaction")
    expect(edit.slice(0, 3000)).toContain("recordAuditEvent(tx,")

which says both strings appear within three thousand characters of each other.
It does not say the audit write happens INSIDE the transaction, and that is the
entire property the test is named for.

MEASURED, not argued. Splitting the action into two separate transactions —
the update in one, the audit row in another, which is precisely the defect this
test exists to prevent — leaves both strings exactly where they were:

    OLD assertion on the mutant:
      contains db.$transaction      : true
      contains recordAuditEvent(tx, : true
      => old test would PASS        : true

So the test would have gone green over the failure it was written to catch.

Now it extracts the callback by matching parentheses from `db.$transaction(`
and asserts `tx.organization.update` and `await recordAuditEvent(tx,` are both
inside THAT span. No AST dependency — brace matching answers the question being
asked, and the question is about a range rather than about a distance.

The two-transaction mutant fails it.

Worth naming the general shape, because it is the third time today: a check
that looks at the right file and asserts the wrong relation. A window is not a
scope, `grep -c` piped into `head` is not an exit code, and the length of a
string after the caller sliced it is not evidence the bound ran.

Found by CodeRabbit on #308.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ...he-numbers-you-own-can-be-changed.test.tsx | 49 +++++++++++++++++--
 1 file changed, 44 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
index 3bd89d0a..24295381 100644
--- a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
+++ b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
@@ -105,12 +105,51 @@ describe("the editor writes through the path that already has the rules", () =>
   })
 
   it("commits the profile edit and its audit row together", () => {
-    // Not this file, but the same PR and the same failure shape: an update
-    // that commits before its record leaves a changed club description with
-    // nothing saying who changed it, while the person is told it failed.
+    /*
+     * Not this file, but the same PR and the same failure shape: an update that
+     * commits before its record leaves a changed club description with nothing
+     * saying who changed it, while the person is told it failed.
+     *
+     * ── Why this reads the transaction BODY and not a window of characters ──
+     *
+     * The first version asserted that `db.$transaction` and
+     * `recordAuditEvent(tx,` both appeared within 3,000 characters of each
+     * other. That is CO-OCCURRENCE, not containment: two separate
+     * transactions, or the audit call moved into a different callback in the
+     * same function, both keep those two strings near each other while
+     * breaking the exact property this test is named for.
+     *
+     * So the callback is extracted by matching parentheses from
+     * `db.$transaction(` — the real span — and the assertion is that the
+     * audit write happens INSIDE it. No AST dependency; brace matching is
+     * enough to answer the question actually being asked.
+     */
     const actions = readFileSync(join(__dirname, "..", "..", "app", "(app)", "orgs", "actions.ts"), "utf8")
     const edit = actions.slice(actions.indexOf("export const updateOrgProfile"))
-    expect(edit.slice(0, 3000)).toContain("db.$transaction")
-    expect(edit.slice(0, 3000)).toContain("recordAuditEvent(tx,")
+
+    const open = edit.indexOf("db.$transaction(")
+    expect(open).toBeGreaterThan(-1)
+
+    // Walk from the call's own "(" to its match. Depth counting is safe here
+    // because a `)` inside a string literal would have to be unbalanced to
+    // fool it, and this body has none.
+    const from = edit.indexOf("(", open)
+    let depth = 0
+    let end = -1
+    for (let i = from; i < edit.length; i++) {
+      if (edit[i] === "(") depth += 1
+      else if (edit[i] === ")") {
+        depth -= 1
+        if (depth === 0) {
+          end = i
+          break
+        }
+      }
+    }
+    expect(end).toBeGreaterThan(from)
+
+    const body = edit.slice(from, end)
+    expect(body).toContain("tx.organization.update")
+    expect(body).toContain("await recordAuditEvent(tx,")
   })
 })

From 41e8c9d602af7d29d57d50f599e87f51c42c02f1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 26 Aug 2026 05:54:02 -0400
Subject: [PATCH 4/4] Changing a budget from its row would have destroyed the
 line's note
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Found in a self-review, because CodeRabbit reported "Review rate limited" on
this push — a passing check meaning the reviewer did not look — and a recorded
self-review is worth nothing unless it is an actual re-read.

The re-budget path in `upsertBudgetLine` writes

    data: { budgetedCents, note }

and takes `note` off the submitted form. `BudgetLineEditor` sent no `note`, so
`String(formData.get("note") ?? "").trim() || null` resolved to null and every
adjustment made from the row would have written null over whatever the line
said it was for.

Silently, while appearing to change only the amount. Nothing fails, nothing is
red, and the rationale for a club's allocation stops existing the first time
somebody corrects a figure. It is the same shape as the affordance this PR
exists to add — a thing that is simply gone, with no error anywhere to say so.

A hidden field would have stopped the loss. It is an EDITABLE field instead,
because somebody changing what a line may spend is exactly the person who
should be able to say why, and the moment they are changing it is the moment
they know.

That made a second guard wrong. `unchanged` compared amounts only, so a
note-only correction left Save disabled with no way to save it. It now means
what it says: nothing changed.

Also checked in the same pass, and correct as written: the dialog's effect
depends on `state` rather than `state.done`, so it closes on every save and not
only the first — the bug fixed in `ClubProfileEditor` two commits ago does not
exist here. The action's `create` arm is reachable only if the line was deleted
concurrently, and restoring it is the right answer to that race.

tsc 0 · jest 418 suites / 6,682 tests green · eslint clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../components/finance/BudgetLineEditor.tsx   | 41 ++++++++++++++++++-
 .../components/finance/FinanceDashboard.tsx   |  1 +
 ...he-numbers-you-own-can-be-changed.test.tsx | 25 +++++++++++
 3 files changed, 65 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/finance/BudgetLineEditor.tsx b/apps/web/src/components/finance/BudgetLineEditor.tsx
index a788684f..f599b4a4 100644
--- a/apps/web/src/components/finance/BudgetLineEditor.tsx
+++ b/apps/web/src/components/finance/BudgetLineEditor.tsx
@@ -73,7 +73,13 @@ export function BudgetLineEditor({
   onClose,
 }: {
   slug: string
-  line: { id: string; category: string; budgetedCents: number; actualCents: number }
+  line: {
+    id: string
+    category: string
+    budgetedCents: number
+    actualCents: number
+    note: string | null
+  }
   /** Acting as an OSE Director in a club the viewer holds no seat in. */
   overriding: boolean
   onClose: () => void
@@ -87,6 +93,20 @@ export function BudgetLineEditor({
   // almost always adjusting it rather than replacing it from nothing, and an
   // empty box makes them go and find the current figure again.
   const [budgeted, setBudgeted] = useState(() => (line.budgetedCents / 100).toFixed(2))
+  /*
+   * THE NOTE TRAVELS, OR IT IS DESTROYED.
+   *
+   * The re-budget path writes `data: { budgetedCents, note }`, and `note` comes
+   * off the submitted form. This dialog did not send one — so every adjustment
+   * made from the row would have written `null` over whatever the line said it
+   * was for, silently, while appearing to change only the amount.
+   *
+   * Carrying it as a hidden field would have been enough to stop the loss. It
+   * is an EDITABLE field instead, because somebody changing what a line is
+   * allowed to spend is exactly the person who should be able to say why, and
+   * the moment they are changing it is the moment they know.
+   */
+  const [note, setNote] = useState(line.note ?? "")
   const [reason, setReason] = useState("")
 
   useEffect(() => {
@@ -96,7 +116,11 @@ export function BudgetLineEditor({
   }, [state, onClose])
 
   const nextCents = parseMoneyToCents(budgeted)
-  const unchanged = nextCents !== null && nextCents === line.budgetedCents
+  // "Unchanged" has to mean NOTHING changed. Once the note is editable, an
+  // amount-only test disables Save for somebody who came here to correct the
+  // note and leaves them with no way to save it.
+  const noteChanged = note.trim() !== (line.note ?? "")
+  const unchanged = nextCents !== null && nextCents === line.budgetedCents && !noteChanged
   /*
    * EMPTY IS ITS OWN STATE, and it used to fall between the other two.
    *
@@ -154,6 +178,19 @@ export function BudgetLineEditor({
           </span>
         </label>
 
+        <label className="flex flex-col gap-1 text-xs text-text-2">
+          What this line covers (optional)
+          <input
+            name="note"
+            maxLength={200}
+            value={note}
+            onChange={(e) => setNote(e.target.value)}
+            placeholder="Venue deposit and AV for the autumn gala"
+            aria-label={`What ${line.category} covers`}
+            className="h-9 w-full rounded border border-border bg-surface px-3 text-sm text-text-1 placeholder:text-text-3"
+          />
+        </label>
+
         {/*
           THE CHANGE, BEFORE IT HAPPENS. This is what the "are you sure" step in
           the add form is really for, shown continuously instead of as an
diff --git a/apps/web/src/components/finance/FinanceDashboard.tsx b/apps/web/src/components/finance/FinanceDashboard.tsx
index 8f501a5e..dfadae4a 100644
--- a/apps/web/src/components/finance/FinanceDashboard.tsx
+++ b/apps/web/src/components/finance/FinanceDashboard.tsx
@@ -759,6 +759,7 @@ export function FinanceDashboard({
             category: editingLine.category,
             budgetedCents: editingLine.budgetedCents,
             actualCents: editingLine.actualCents,
+            note: editingLine.note,
           }}
           overriding={overriding}
           onClose={() => setEditingLine(null)}
diff --git a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
index 24295381..624d53bb 100644
--- a/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
+++ b/apps/web/src/components/finance/the-numbers-you-own-can-be-changed.test.tsx
@@ -85,6 +85,31 @@ describe("the editor writes through the path that already has the rules", () =>
     expect(editor).toContain("ReasonField")
   })
 
+  it("SENDS THE NOTE, so changing an amount does not destroy it", () => {
+    /*
+     * Caught in a self-review, because CodeRabbit reported "Review rate
+     * limited" on this push and a recorded self-review is worth nothing unless
+     * it is an actual re-read.
+     *
+     * The re-budget path writes `data: { budgetedCents, note }` and takes
+     * `note` off the submitted form. This dialog sent no `note`, so every
+     * adjustment made from the row would have written `null` over whatever the
+     * line said it was for — silently, while appearing to change only the
+     * amount. Nothing would have failed, and the rationale for a club's
+     * allocation would simply stop existing the first time somebody corrected
+     * a figure.
+     */
+    expect(editor).toContain('name="note"')
+    expect(editor).toContain("line.note")
+  })
+
+  it("lets a note-only edit be saved", () => {
+    // Once the note is editable, an amount-only "unchanged" test disables Save
+    // for somebody who came here to correct the note.
+    expect(editor).toContain("const noteChanged =")
+    expect(editor).toContain("&& !noteChanged")
+  })
+
   it("shows the change BEFORE it is made", () => {
     // What the add form's "are you sure" step was really protecting, shown
     // continuously instead of as an interruption afterwards.