This document is a draft. It is not legal advice and it is not in force. It becomes required only when the owner adopts it by a recorded decision in nexus-governance. Until then nothing here blocks anyone’s work.

A factual or data error, a wrong figure, a broken or missing licence, third-party material without rights, personal data published in error, an information hazard published by mistake, a wrong author or credit line, or a release that skipped a required gate.

• S1: harm to a person, personal data exposed, or an information hazard. Act within hours.
• S2: material error, rights problem, missing gate. Act within 2 days.
• S3: minor error or typo. Fix in the next version.

1. Report. Anyone writes to the contact form with subject "Publication error". The managing editor logs it and names an incident lead. 2. Contain. For S1 and S2 the incident lead may restrict the item on the network site while it is assessed. Restriction is shown on the page. Zenodo records cannot be deleted; contact the Zenodo community curators through the owner account if restriction is needed there. 3. Assess. What is wrong, since when, who is affected, what the effect on findings is. Check the agreements snapshot and licence manifest for the release. 4. Decide. Correct, express concern, retract, or withdraw. A correction is a new version with a note. Retractions are board decisions. 5. Fix. Build the new version through the normal pipeline and checks. No edits in place. 6. Notify. Authors, affected people, the Privacy Officer for personal data, the Secretariat, and where needed the funder or regulator. Notices follow PIPEDA, Quebec Law 25 and GDPR where they apply. 7. Publish the notice. Add an entry to the corrections log. 8. Review. Within 14 days, write what failed and what changes. Update the checklist or the gate if a rule was missed.

• Incident lead: managing editor or delegate.
• Decision: collection editor, with the board for retractions.
• Technical: hosting lead and the production editor.
• Legal and privacy: counsel and the Privacy Officer, to be named by the owner.

Keep the report, timeline, decision, notices and review. Keep personal data to the minimum. Retain under the privacy notice.

Do not delete evidence. Do not edit a published version. Do not discuss the incident publicly before the notice. Do not blame individuals in public notices.