refactor(library): auditor fields only through applyCorrection

readme.md

@@ -232,11 +232,13 @@ At 01:30 `ImageRepairService` repairs the pictures reported through `POST /api/l
 An AUDITOR (active role) corrects a game's name, header image, speedrun link, moods, endless flag and genres for
 every user (`game_correction`, V20). The value is also written into the cached row (`steam_game`, `game_speedrun`,
 `game_mood`), so no read joins the corrections. The refresh writers skip a corrected field: the Steam sync (name),
-the image repair (image), the IGDB add (name, image), the mood and speedrun upserts (SQL). **A new writer of these
-fields must do the same.** "Back to source" (`DELETE`) writes back the source value from the first correction and
+the image repair (image), the IGDB add (name, image), the mood and speedrun upserts (SQL). `SteamGame` has no
+setter for name and image: `applyCorrection` is the only Java writer, a refresh uses the guarded updates in
+`SteamGameRepository`. "Back to source" (`DELETE`) writes back the source value from the first correction and
 lets the next refresh ask IGDB or speedrun.com again. An image must be on a host of the frontend's CSP.
 Known limit: a mood or speedrun refresh that waits on the row lock while an auditor saves can still write the
-source value once (its guard sees the state from before the save); the auditor saves again.
+source value once (its guard sees the state from before the save); the auditor saves again. `save(new SteamGame(...))` on a
+stored key also overwrites a corrected name; the sync and the IGDB add do it only after `findById` found no row.
 
 ### Merging duplicates