@bongos/core 1.19.419 → 1.19.421

package/tests/effective_visibility_predicate.mjs

@@ -0,0 +1,891 @@
+// tests/effective_visibility_predicate.mjs
+//
+// THE EFFECTIVE-VISIBILITY STRUCTURAL GUARD — "every public read of a platform
+// account routes through the ONE shared predicate, and nothing else spells one"
+// (task 1002967, goal 1000045; privacy spec D1/D2, ADR 0171 D2/D4/D7, ADR 0202 D4).
+//
+// WHY THIS EXISTS. Wiring account_visibility into the four public reads that
+// exist today is the easy half and it is worth almost nothing on its own: the
+// surfaces this feature must hold are mostly NOT BUILT YET. Hub profile search,
+// the sitemap and the /u/<handle> page are all named in the spec and none of
+// them exists in this tree. So the thing that actually protects a private
+// account is not the four call sites — it is that the FIFTH read, written by
+// somebody else six months from now, cannot quietly grow its own variant of
+// "active and public". Drift between two public reads is not a bug that shows
+// up as a broken page; it is a privacy leak that shows up as nothing at all.
+//
+// THE MECHANISM — three layers, each catching what the one above cannot:
+//
+//   1. THE ONE DEFINITION. accountVisibleSql / isAccountVisible (existence),
+//      accountActiveSql / isAccountActive (the own-scope consent floor) and
+//      rollupVisibleSql / isRollupVisible (existence AND NOT hidden) are proved
+//      to be the same rule in SQL and in JS, and the rollup pair is proved to be
+//      COMPOSED from the existence pair rather than restating it — so the two
+//      forms cannot disagree even in principle.
+//
+//   2. THE SOLE-OWNER RULE. modules/platform-identity/account-visibility.js —
+//      the file ADR 0202 D4 named and task 1002295 landed, which this task
+//      ADOPTS rather than duplicating — is the only first-party server file
+//      allowed to compare profile_state / account_visibility / hide_stats
+//      against a literal. Any other file that does is a hand-written
+//      variant, and fails here. Exemptions exist but do not exempt: each carries
+//      a stated reason AND a checked obligation, on the own_scope_guard model.
+//
+//   3. THE ADOPTION RULE, with a discovery backstop. Every SELECT this repo
+//      issues against platform_identity_accounts is enumerated from the source,
+//      and each must either route through a shared predicate or be inventoried
+//      as a deliberately non-public read with a stated reason. A NEW read — the
+//      search endpoint, the sitemap builder — is discovered automatically and
+//      fails until its author makes that choice explicitly. That is the layer
+//      aimed at the surfaces that do not exist yet.
+//
+// Rejected alternatives, and why: a plain grep for the column names catches the
+// WRITE paths too (upsertAccount legitimately sets profile_state) and would be
+// silenced by an allowlist that then swallows real drift. Testing only the four
+// current call sites passes forever while the feature rots — it cannot fail for
+// the reason this task exists. Requiring an @visibility-checked annotation is
+// invisible exactly when the author forgets it, which is the failure mode.
+//
+// The behavioural half runs the REAL public route over a recording fake pool
+// (the tests/account_privacy_flags.mjs pattern): a private account 404s — never
+// 403 — and the response is BYTE-IDENTICAL for an anonymous viewer, a signed-in
+// stranger, and the account's own owner. That last one is the D2 reconciliation
+// and the reason the public read takes no viewer argument at all.
+//
+// DB-free by construction: source text plus a fake pool. No Postgres, no server
+// beyond an ephemeral loopback listener. It therefore runs in the lane that
+// actually executes (task 1002282: a proof that never runs is not a gate).
+//
+// Run:  node tests/effective_visibility_predicate.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+// The pure predicate module is imported as ESM so knip credits its exports
+// (a createRequire import reads as unused). It has no doorway dependency,
+// which is exactly what makes that safe.
+import {
+  ACCOUNT_VISIBILITY,
+  accountVisibleSql,
+  isAccountVisible,
+  accountActiveSql,
+  isAccountActive,
+  rollupVisibleSql,
+  isRollupVisible,
+  isRecruiterDiscoverable,
+} from '../modules/platform-identity/account-visibility.js';
+
+const require = createRequire(import.meta.url);
+const repo = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// The inventories — every exception carries a reason AND an obligation.
+// ===========================================================================
+
+// The one file allowed to spell the predicate. Everything else must import it.
+const PREDICATE_OWNER = 'modules/platform-identity/account-visibility.js';
+
+// Files that name a visibility column against a literal WITHOUT being the owner.
+//
+// An exemption is PER OCCURRENCE, not per file, and that granularity is the
+// point: platform-identity.js is simultaneously the file most likely to need one
+// and the file most likely to grow a real variant, so excusing it wholesale
+// would blind the guard exactly where it matters most. Each entry names the
+// exact spelling and how many of it are allowed; a SECOND one, or a different
+// one, still fails. Each also substitutes a checked obligation for the rule it
+// is excused from — an exemption that demanded nothing would make "add a line
+// here" the greenest fix for a red build.
+const SPELLING_EXEMPTIONS = [
+  {
+    file: 'modules/platform-identity/platform-identity.js',
+    allow: [{
+      text: 'hide_stats = true',
+      count: 1,
+      why: "hiddenGithubIds asks the OPPOSITE question to visibility — 'which of these accounts have hidden themselves' — for the closeness-graph consent gate. It must stay fail-closed on hide alone (ADR 0171 D4), so it is not expressible as the shared predicate and is not a variant of it.",
+    }],
+    obligation: (code) => /require\(\s*'\.\/account-visibility'\s*\)/.test(code),
+    demands: 'still imports the shared predicate rather than re-deriving one',
+  },
+  {
+    file: 'scripts/gds/seed-bv1-privacy-invites-tasks.js',
+    allow: [
+      { text: "profile_state='", count: 1, why: 'a one-shot historical seeder: this sits inside a task DESCRIPTION string, quoting the predicate as prose describing the work to be done. Its subject IS this predicate.' },
+      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same task description — prose, not a query.' },
+    ],
+    obligation: (code) => !/\.query\s*\(/.test(code),
+    demands: 'issues no database query at all — it posts task rows over HTTP',
+  },
+  {
+    file: 'scripts/gds/seed-bv1-r01-delta-tasks.js',
+    allow: [
+      { text: "profile_state='", count: 1, why: 'the ADR 0171 R01 seeder: the predicate is quoted as prose inside the task briefs this script files, the same shape as the privacy seeder above.' },
+      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same brief — prose describing work, never executed.' },
+    ],
+    obligation: (code) => !/\.query\s*\(/.test(code),
+    demands: 'issues no database query at all — it posts task rows over HTTP',
+  },
+];
+
+// Every SELECT against platform_identity_accounts that is deliberately NOT a
+// public read. A public read must route through a shared predicate instead; the
+// guard below enumerates the statements from source and demands one or the other,
+// so a NEW read cannot appear without landing in exactly one of these two piles.
+const NON_PUBLIC_READS = [
+  {
+    fn: 'getAccount',
+    why: 'the internal account read: own-scope Settings, and the re-read every writer in this module does after an upsert. It returns the flags themselves (they are its output), so gating it on them would make the owner unable to see their own setting.',
+  },
+  {
+    fn: 'getAccountByLogin',
+    why: 'resolves a github_login for the Archon-gated invite path (POST /projects/invite). Inviting a person is not publishing them: the caller already knows the login and the result never reaches a public body.',
+  },
+  {
+    fn: 'hiddenGithubIds',
+    why: 'the closeness-graph consent gate — it answers only "which of these accounts set hide_stats", the OPPOSITE question to visibility. Its callers are requireBuilder-gated and it must stay fail-closed on hide alone (ADR 0171 D4); joining addressability would silently empty the graph of every private account for readers who are allowed to see the edge.',
+  },
+];
+
+// Reads that fetch the predicate's columns and hand the DECISION to a named
+// caller, because the answer is viewer-relative and therefore cannot be a WHERE
+// clause. ADR 0202 D4 §2 is the live case: a private account you are already
+// connected to is addressable to YOU and to nobody else, so the row must come
+// back and the caller must judge it.
+//
+// This is not an excuse, it is a redirection of the obligation: the guard checks
+// that the read really does SELECT the columns (so the caller CAN decide) and
+// that the named gate really does call a shared predicate. Delete the gate and
+// this fails, even though the deferral is still listed.
+const DEFERRED_READS = [
+  {
+    fn: 'findAccountByHandle',
+    gatedBy: {
+      file: 'modules/platform-identity/routes/connections.js',
+      fn: 'visibleTarget',
+      // Naming the EXACT predicate matters: visibleTarget also calls
+      // isAccountActive for the own-scope floor, so "calls some shared helper"
+      // would still pass with the existence check deleted. It is the existence
+      // check that makes a private stranger a 404.
+      predicate: /\bisAccountVisible\s*\(/,
+    },
+    why: 'connections resolve a handle to a counterparty THIS VIEWER may address (ADR 0202 D4 §2) — publicly visible, or private-but-already-connected. That is viewer-relative by definition, so the predicate cannot live in the query; it lives one frame up, in visibleTarget, which answers the same null for an unknown handle, a provisional account and a private stranger alike.',
+  },
+];
+
+// Floors that keep this guard from going quietly vacuous — a regex that stopped
+// matching would otherwise "pass" by checking nothing.
+const MIN_ACCOUNT_SELECTS = 6;
+const MIN_PREDICATE_ADOPTERS = 3;
+const MIN_FILES_SCANNED = 300;
+
+// ===========================================================================
+// Machinery
+// ===========================================================================
+
+/**
+ * Blank comments while preserving every byte offset, so line numbers stay true.
+ * Comment prose in this repo discusses the predicate constantly (that is the
+ * point of the doc-comments); only real code may be judged. String and template
+ * literals are KEPT — a SQL predicate lives inside a template literal, so they
+ * are the evidence, not the noise.
+ */
+function blankComments(src) {
+  const out = src.split('');
+  let i = 0;
+  let state = 'code'; // code | line | block | sq | dq | tpl
+  while (i < src.length) {
+    const c = src[i];
+    const d = src[i + 1];
+    if (state === 'code') {
+      if (c === '/' && d === '/') { out[i] = ' '; out[i + 1] = ' '; i += 2; state = 'line'; continue; }
+      if (c === '/' && d === '*') { out[i] = ' '; out[i + 1] = ' '; i += 2; state = 'block'; continue; }
+      if (c === "'") { state = 'sq'; i++; continue; }
+      if (c === '"') { state = 'dq'; i++; continue; }
+      if (c === '`') { state = 'tpl'; i++; continue; }
+      i++; continue;
+    }
+    if (state === 'line') {
+      if (c === '\n') { state = 'code'; i++; continue; }
+      out[i] = ' '; i++; continue;
+    }
+    if (state === 'block') {
+      if (c === '*' && d === '/') { out[i] = ' '; out[i + 1] = ' '; i += 2; state = 'code'; continue; }
+      if (c !== '\n') out[i] = ' ';
+      i++; continue;
+    }
+    if (c === '\\') { i += 2; continue; }
+    if ((state === 'sq' && c === "'") || (state === 'dq' && c === '"') || (state === 'tpl' && c === '`')) { state = 'code'; i++; continue; }
+    i++;
+  }
+  return out.join('');
+}
+
+/**
+ * A hand-written visibility predicate, in either language. SQL `= 'active'` and
+ * JS `=== 'active'` are the same mistake wearing different syntax, so both count.
+ * Deliberately NOT here: a write (`profile_state = CASE WHEN …`) and a
+ * projection default (`account_visibility || 'public'`) — neither compares the
+ * column to a literal, and neither decides who may see anything.
+ */
+const SPELLINGS = [
+  [/\bprofile_state\s*(?:=|==|===|!=|!==|<>)\s*['"]/g, "profile_state compared to a literal"],
+  [/\baccount_visibility\s*(?:=|==|===|!=|!==|<>)\s*['"]/g, 'account_visibility compared to a literal'],
+  [/\bCOALESCE\s*\(\s*recruiter_discoverable/gi, 'the recruiter-reach COALESCE'],
+  [/\bNOT\s+(?:[A-Za-z_][\w]*\.)?hide_stats\b/g, 'a SQL NOT hide_stats'],
+  [/\bhide_stats\s*(?:=|==|===)\s*(?:true|false)\b/g, 'hide_stats compared to a boolean'],
+];
+
+function spellingsIn(code) {
+  const hits = [];
+  for (const [re, label] of SPELLINGS) {
+    for (const m of code.matchAll(re)) {
+      hits.push({ label, text: m[0].trim(), line: code.slice(0, m.index).split('\n').length });
+    }
+  }
+  return hits;
+}
+
+/** Walk a directory for first-party .js files. */
+function jsFiles(...dirs) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); }
+      else if (e.name.endsWith('.js')) out.push(p);
+    }
+  };
+  for (const d of dirs) walk(path.join(repo, d));
+  return out;
+}
+
+const rel = (abs) => path.relative(repo, abs).split(path.sep).join('/');
+
+/**
+ * A browser asset cannot enforce a server-side privacy predicate — it renders
+ * the owner their own stored setting, and the server is the gate this guard
+ * covers. Tests and migrations are the predicate's own documentation and proof.
+ */
+function isServerSource(relPath) {
+  return !relPath.includes('/public/')
+    && !relPath.includes('/tests/')
+    && !relPath.includes('/migrations/');
+}
+
+/** Top-level function declarations, in source order, as { name, at }. */
+function functionSpans(code) {
+  const fns = [...code.matchAll(/(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\(/g)]
+    .map((m) => ({ name: m[1], at: m.index }));
+  return fns.map((f, i) => ({
+    name: f.name,
+    at: f.at,
+    end: i + 1 < fns.length ? fns[i + 1].at : code.length,
+  }));
+}
+
+/**
+ * Every SQL template literal naming platform_identity_accounts, attributed to
+ * the function that issues it, with the statement's leading verb. This is the
+ * discovery half: it enumerates reads from the source rather than from a list
+ * somebody has to remember to update.
+ */
+function accountStatements(code) {
+  const spans = functionSpans(code);
+  const owner = (idx) => spans.find((s) => idx >= s.at && idx < s.end) || { name: '(top level)', at: 0, end: code.length };
+  const out = [];
+  for (const m of code.matchAll(/`([^`]*platform_identity_accounts[^`]*)`/g)) {
+    const sql = m[1].replace(/\s+/g, ' ').trim();
+    const verb = (sql.match(/^(WITH|SELECT|INSERT|UPDATE|DELETE)\b/i) || [, '?'])[1].toUpperCase();
+    const fn = owner(m.index);
+    out.push({ sql, verb, fn: fn.name, body: code.slice(fn.at, fn.end), line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+/** Does this function body route through one of the shared predicates? */
+const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|isAccountVisible|isAccountActive|isRollupVisible)\s*\(/;
+
+// ===========================================================================
+// Self-tests — the machinery is the guard, so it gets proved too.
+// ===========================================================================
+
+console.log('guard machinery:');
+
+t('blankComments erases prose but keeps offsets and the SQL inside template literals', () => {
+  const src = "const a = 1; // profile_state = 'active'\n/* account_visibility = 'public' */ const s = `WHERE profile_state = 'active'`;\n";
+  const out = blankComments(src);
+  assert.equal(out.length, src.length, 'offsets must be preserved');
+  assert.equal(spellingsIn(out).length, 1, 'exactly the one real predicate survives, not the two in comments');
+  assert.match(out, /WHERE profile_state = 'active'/, 'a SQL literal is the evidence and must survive');
+});
+
+t('SPELLINGS catch a hand-written variant in either language, and leave writes alone', () => {
+  const caught = (s) => spellingsIn(s).length > 0;
+  assert.ok(caught("WHERE pa.profile_state = 'active'"), 'SQL equality');
+  assert.ok(caught("if (a.profile_state !== 'active') return null;"), 'JS inequality');
+  assert.ok(caught("AND account_visibility = 'public'"), 'the existence axis in SQL');
+  assert.ok(caught("acct.account_visibility === 'private'"), 'the existence axis in JS');
+  assert.ok(caught('COALESCE(recruiter_discoverable, account_visibility)'), 'the recruiter COALESCE');
+  assert.ok(caught('AND NOT pa.hide_stats'), 'the hide half of a rollup predicate');
+  // A WRITE names the column but compares it to nothing — it decides no visibility.
+  assert.ok(!caught("profile_state = CASE WHEN $5::boolean THEN 'active' ELSE x END"), 'an upsert is not a predicate');
+  assert.ok(!caught("account_visibility: (acct && acct.account_visibility) || 'public'"), 'a projection default is not a predicate');
+  assert.ok(!caught('hide_stats = EXCLUDED.hide_stats'), 'an upsert assignment is not a predicate');
+});
+
+t('accountStatements attributes a SQL literal to the function that issues it', () => {
+  const code = [
+    'async function alpha() { return q(`SELECT 1 FROM platform_identity_accounts WHERE x`); }',
+    'async function beta() { return q(`INSERT INTO platform_identity_accounts (a) VALUES ($1)`); }',
+  ].join('\n');
+  const found = accountStatements(code);
+  assert.deepEqual(found.map((s) => [s.fn, s.verb]), [['alpha', 'SELECT'], ['beta', 'INSERT']]);
+});
+
+// ===========================================================================
+// 1. The ONE definition — SQL and JS cannot disagree
+// ===========================================================================
+
+console.log('\nthe one definition (two forms, one rule):');
+
+t('accountVisibleSql is the existence axis and NOTHING else', () => {
+  const bare = accountVisibleSql();
+  const aliased = accountVisibleSql('pa');
+  for (const sql of [bare, aliased]) {
+    assert.match(sql, /profile_state = 'active'/, 'consent floors it (ADR 0171 D3)');
+    assert.match(sql, /account_visibility = 'public'/, 'and the existence axis gates it (privacy spec D1)');
+    assert.doesNotMatch(sql, /hide_stats/,
+      'addressability must NOT include hide: hiding removes the rollup, not the page (spec D2)');
+    assert.doesNotMatch(sql, /recruiter_discoverable/,
+      'recruiting reach is a third question — isRecruiterDiscoverable answers it');
+  }
+  assert.match(aliased, /pa\.profile_state/, 'an alias qualifies every column');
+  assert.match(aliased, /pa\.account_visibility/);
+  assert.doesNotMatch(bare, /\w\.profile_state/, 'no alias when none is asked for');
+  assert.equal(accountVisibleSql(''), bare, 'an empty alias is the same as none');
+});
+
+t('rollupVisibleSql is COMPOSED from accountVisibleSql, never restated', () => {
+  // Composition is what makes drift impossible in principle rather than by
+  // review: change the existence rule and the rollup rule moves with it.
+  assert.ok(rollupVisibleSql('pa').includes(accountVisibleSql('pa')),
+    'the rollup predicate must literally contain the addressability predicate');
+  assert.ok(rollupVisibleSql().includes(accountVisibleSql()));
+  assert.match(rollupVisibleSql('pa'), /AND NOT pa\.hide_stats/, 'and add exactly the hide term');
+});
+
+t('the alias is the one interpolated thing, and both builders refuse a non-identifier', () => {
+  const inject = "pa; DROP TABLE platform_identity_accounts --";
+  assert.throws(() => accountVisibleSql(inject), /bare SQL identifier/);
+  assert.throws(() => rollupVisibleSql(inject), /bare SQL identifier/);
+});
+
+t('the JS ports answer exactly what the SQL asks, row for row', () => {
+  // The table IS the D2 matrix. Each row is checked against BOTH forms, which is
+  // the only way "a route and a query cannot drift" is more than a slogan.
+  const rows = [
+    { row: { profile_state: 'active', account_visibility: 'public', hide_stats: false }, visible: true, rollup: true },
+    { row: { profile_state: 'active', account_visibility: 'public', hide_stats: true }, visible: true, rollup: false },
+    { row: { profile_state: 'active', account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', account_visibility: 'private', hide_stats: true }, visible: false, rollup: false },
+    { row: { profile_state: 'provisional', account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'provisional', account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+  ];
+  for (const { row, visible, rollup } of rows) {
+    const id = JSON.stringify(row);
+    assert.equal(isAccountVisible(row), visible, `isAccountVisible ${id}`);
+    assert.equal(isRollupVisible(row), rollup, `isRollupVisible ${id}`);
+    // The SQL twin, evaluated the only honest way a DB-free test can: the
+    // fragment's own column comparisons, resolved against this row.
+    const sqlSaysVisible = /profile_state = 'active'/.test(accountVisibleSql())
+      && row.profile_state === 'active'
+      && row.account_visibility === 'public';
+    assert.equal(sqlSaysVisible, visible, `the SQL fragment agrees for ${id}`);
+  }
+});
+
+t('both ports are fail-closed on an absent or unreadable account', () => {
+  for (const bad of [null, undefined, {}, { profile_state: 'active' }, { account_visibility: 'public' }]) {
+    assert.equal(isAccountVisible(bad), false, `${JSON.stringify(bad)} is not visible`);
+    assert.equal(isRollupVisible(bad), false, `${JSON.stringify(bad)} has no public rollup`);
+  }
+});
+
+t('the recruiter-reach predicate still lives here, and is still the only COALESCE', () => {
+  // Task 1002967 MOVED it beside the others rather than adding a second variant
+  // (its own doc-comment forbids one). The reach axis is independent: an
+  // explicit true on a private account is the spec's D2 "private · discoverable".
+  assert.equal(isRecruiterDiscoverable({ account_visibility: 'public', recruiter_discoverable: null }), true);
+  assert.equal(isRecruiterDiscoverable({ account_visibility: 'private', recruiter_discoverable: null }), false);
+  assert.equal(isRecruiterDiscoverable({ account_visibility: 'private', recruiter_discoverable: true }), true);
+  assert.equal(isRecruiterDiscoverable(null), false);
+  assert.deepEqual(ACCOUNT_VISIBILITY, ['public', 'private']);
+  // ...and it is NOT the addressability predicate: a discoverable private
+  // account is still absent from every public read.
+  assert.equal(isAccountVisible({ profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), false,
+    'reach never buys addressability — that is what the D3 sliver is for');
+});
+
+// ===========================================================================
+// 2. The sole-owner rule — nothing else spells a variant
+// ===========================================================================
+
+console.log('\nthe sole-owner rule (no surface writes its own variant):');
+
+const scanned = jsFiles('modules', 'src', 'scripts').map((abs) => ({
+  abs, rel: rel(abs), code: blankComments(fs.readFileSync(abs, 'utf8')),
+})).filter((f) => isServerSource(f.rel));
+
+t('the guard actually scanned the repo (not a rotted walk over nothing)', () => {
+  assert.ok(scanned.length >= MIN_FILES_SCANNED,
+    `only ${scanned.length} server-side files scanned (floor ${MIN_FILES_SCANNED}) — the directory walk has rotted`);
+  assert.ok(scanned.some((f) => f.rel === PREDICATE_OWNER),
+    `${PREDICATE_OWNER} was not scanned — the owner file moved or vanished`);
+});
+
+t(`${PREDICATE_OWNER} really does define the predicate (the owner is not vacuous)`, () => {
+  const owner = scanned.find((f) => f.rel === PREDICATE_OWNER);
+  const hits = spellingsIn(owner.code);
+  assert.ok(hits.length >= 3,
+    `the owner file spells only ${hits.length} predicate term(s) — if the definition moved, this guard is now pointing at nothing`);
+});
+
+const usedExemptions = new Set();
+for (const f of scanned) {
+  if (f.rel === PREDICATE_OWNER) continue;
+  const hits = spellingsIn(f.code);
+  if (!hits.length) continue;
+  t(`${f.rel} — names a visibility column against a literal: it must be the owner, or exempt WITH an obligation`, () => {
+    const ex = SPELLING_EXEMPTIONS.find((e) => e.file === f.rel);
+    const blame = hits.map((h) => `${h.text} (line ${h.line}, ${h.label})`).join('; ');
+    const advice = `this is a second variant of the effective-visibility predicate, which is exactly how a private account leaks. `
+      + `Import it from ${PREDICATE_OWNER} instead. If this occurrence genuinely cannot be, add it to SPELLING_EXEMPTIONS with the exact spelling, a stated reason, and an obligation the guard can check.`;
+    assert.ok(ex, `hand-writes ${blame} — ${advice}`);
+    usedExemptions.add(ex.file);
+    assert.ok(ex.obligation(f.code),
+      `the exemption stands on a claim the guard checks — that this file ${ex.demands} — and that claim is now FALSE`);
+    // Per-occurrence, so an excused file cannot quietly grow a real variant.
+    for (const a of ex.allow) assert.ok(a.why && a.why.length > 40, `the allowance for "${a.text}" must carry a real stated reason`);
+    const budget = new Map(ex.allow.map((a) => [a.text, a.count]));
+    const unexcused = [];
+    for (const h of hits) {
+      const left = budget.get(h.text);
+      if (left > 0) budget.set(h.text, left - 1);
+      else unexcused.push(h);
+    }
+    assert.equal(unexcused.length, 0,
+      `is exempt for ${[...budget.keys()].map((k) => `"${k}"`).join(', ')}, but ALSO hand-writes `
+      + `${unexcused.map((h) => `${h.text} (line ${h.line})`).join('; ')} — ${advice}`);
+    for (const [text, left] of budget) {
+      assert.equal(left, 0, `the allowance for "${text}" has ${left} unused slot(s) — the occurrence is gone, so shrink or remove it`);
+    }
+  });
+}
+
+t('every listed spelling exemption still names a real, still-offending file', () => {
+  const stale = SPELLING_EXEMPTIONS.filter((e) => !usedExemptions.has(e.file)).map((e) => e.file);
+  assert.equal(stale.length, 0,
+    `stale exemption(s): ${stale.join(', ')} — the file no longer spells a predicate (or no longer exists), and an exemption for nothing silently widens the guard`);
+});
+
+// ===========================================================================
+// 3. The adoption rule + the discovery backstop
+// ===========================================================================
+
+console.log('\nthe adoption rule (every account READ is classified, including ones not written yet):');
+
+const allStatements = scanned.flatMap((f) => accountStatements(f.code).map((s) => ({ ...s, file: f.rel })));
+const reads = allStatements.filter((s) => s.verb === 'SELECT' || s.verb === 'WITH');
+const adopters = reads.filter((s) => ADOPTS.test(s.body));
+const claimedNonPublic = new Set();
+const claimedDeferred = new Set();
+
+t('the statement sweep found the account reads it is supposed to be judging', () => {
+  assert.ok(reads.length >= MIN_ACCOUNT_SELECTS,
+    `only ${reads.length} account read(s) discovered (floor ${MIN_ACCOUNT_SELECTS}) — the SQL-literal scan has rotted and this section is checking nothing`);
+});
+
+for (const s of reads) {
+  t(`${s.file}:${s.line} ${s.fn} — an account read is either predicate-gated or declared non-public`, () => {
+    if (ADOPTS.test(s.body)) return; // routes through the shared predicate
+
+    // Deferred: the decision is the caller's, and the guard checks that caller.
+    const deferred = DEFERRED_READS.find((r) => r.fn === s.fn);
+    if (deferred) {
+      claimedDeferred.add(deferred.fn);
+      assert.ok(deferred.why && deferred.why.length > 60,
+        'deferring a visibility decision is a privacy claim — it must carry a real reason');
+      for (const col of ['profile_state', 'account_visibility']) {
+        assert.match(s.sql, new RegExp(`\\b${col}\\b`),
+          `defers the decision to ${deferred.gatedBy.fn} but does not SELECT ${col} — the caller cannot judge a column it was not given`);
+      }
+      const gateFile = scanned.find((f) => f.rel === deferred.gatedBy.file);
+      assert.ok(gateFile, `the named gate file ${deferred.gatedBy.file} does not exist`);
+      const gate = functionSpans(gateFile.code).find((x) => x.name === deferred.gatedBy.fn);
+      assert.ok(gate, `${deferred.gatedBy.file} no longer defines ${deferred.gatedBy.fn} — the obligation this deferral rests on is GONE`);
+      const gateBody = gateFile.code.slice(gate.at, gate.end);
+      assert.match(deferred.gatedBy.predicate.source, /isAccountVisible|isRollupVisible/,
+        'a deferral must demand an EXISTENCE predicate — the consent floor alone is not what makes a private stranger a 404');
+      assert.match(gateBody, deferred.gatedBy.predicate,
+        `${deferred.gatedBy.fn} is named as the gate for ${s.fn} but no longer applies ${deferred.gatedBy.predicate} — the deferral now leads nowhere, and a private stranger is addressable`);
+      return;
+    }
+
+    const declared = NON_PUBLIC_READS.find((r) => r.fn === s.fn);
+    assert.ok(declared,
+      `SELECTs from platform_identity_accounts without routing through the shared effective-visibility predicate, and is not declared non-public. `
+      + `If this is a public read (search, a sitemap, a directory, a profile), join accountVisibleSql()/rollupVisibleSql() — or call isAccountVisible()/isRollupVisible() on the row. `
+      + `If it is deliberately internal or own-scoped, add it to NON_PUBLIC_READS with a stated reason. `
+      + `If the decision is genuinely viewer-relative, add it to DEFERRED_READS naming the caller that applies the predicate — the guard will check that caller.`);
+    claimedNonPublic.add(declared.fn);
+    assert.ok(declared.why && declared.why.length > 60,
+      'declaring a read non-public is a privacy claim — it must carry a real reason, not a label');
+  });
+}
+
+t('the shared predicate has real adopters (the wiring did not silently unwire itself)', () => {
+  const names = [...new Set(adopters.map((s) => s.fn))];
+  assert.ok(names.length >= MIN_PREDICATE_ADOPTERS,
+    `only ${names.length} account read(s) route through the shared predicate (floor ${MIN_PREDICATE_ADOPTERS}): ${names.join(', ')}`);
+  for (const required of ['resolveHandle', 'listScoutingRollup']) {
+    assert.ok(names.includes(required),
+      `${required} is a public read and no longer routes through the shared predicate`);
+  }
+});
+
+t('getPublicProfileExtras gates on the shared JS port (its SQL carries no predicate to join)', () => {
+  const pi = scanned.find((f) => f.rel === 'modules/platform-identity/platform-identity.js');
+  const span = functionSpans(pi.code).find((s) => s.name === 'getPublicProfileExtras');
+  assert.ok(span, 'getPublicProfileExtras vanished — the port behind every public rollup read');
+  const body = pi.code.slice(span.at, span.end);
+  assert.match(body, /isRollupVisible\s*\(/, 'the rollup port must gate on the shared JS predicate');
+  assert.match(body, /account_visibility/, 'and its SELECT must actually fetch the column the predicate reads');
+});
+
+t('every declared non-public read still exists (a stale declaration is a blind spot)', () => {
+  const stale = [
+    ...NON_PUBLIC_READS.filter((r) => !claimedNonPublic.has(r.fn)),
+    ...DEFERRED_READS.filter((r) => !claimedDeferred.has(r.fn)),
+  ].map((r) => r.fn);
+  assert.equal(stale.length, 0,
+    `declared non-public but no longer found as an account read: ${stale.join(', ')} — remove it, or the next function to take that name inherits the excuse`);
+});
+
+// ===========================================================================
+// 4. Behaviour — an EXECUTED boundary, not a string match
+// ===========================================================================
+//
+// The fake pool below is a small in-memory platform_identity_accounts table plus
+// a mini-interpreter that builds each statement's filter FROM THAT STATEMENT'S
+// OWN WHERE CLAUSE. So if accountVisibleSql() were dropped from resolveHandle,
+// the clause would genuinely stop carrying `account_visibility = 'public'`, the
+// private row would genuinely come back, and the 404 tests below would genuinely
+// fail with a 200 — the boundary is executed, not asserted against a string.
+// The interpreter REFUSES any predicate term it does not recognise, so a
+// rewritten clause it cannot read is a loud error rather than a silently absent
+// filter (the tests/own_session_revoke.mjs pattern, task 1003341).
+//
+// Everything above the pool is real: the real router, the real domain module,
+// over real HTTP.
+
+console.log('\nbehaviour (an executed privacy boundary):');
+
+const ACCOUNTS = [
+  { github_id: '4242', github_login: 'octo', display_name: 'Octo', avatar_url: null,
+    handle: 'octo', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // The private account this whole task exists for.
+  { github_id: '5150', github_login: 'ghost', display_name: 'Ghost', avatar_url: null,
+    handle: 'ghost', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+  // Private AND recruiter-discoverable — the spec's D2 "private · discoverable"
+  // row. Reach must not buy addressability: this one still 404s.
+  { github_id: '5151', github_login: 'scout', display_name: 'Scout', avatar_url: null,
+    handle: 'scout', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+  // Public but hidden — the axes are independent: the PAGE resolves, the numbers do not.
+  { github_id: '6060', github_login: 'shy', display_name: 'Shy', avatar_url: null,
+    handle: 'shy', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+  { github_id: '7070', github_login: 'newbie', display_name: 'Newbie', avatar_url: null,
+    handle: 'newbie', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // A private account inside the P01 rename window. Its OLD handle must 404 too —
+  // a 301 to the current handle would confirm the account exists.
+  { github_id: '8080', github_login: 'moved', display_name: 'Moved', avatar_url: null,
+    handle: 'moved-now', previous_handle: 'moved-was', bio: null, links: null, created_at: 'T',
+    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+  // ...and a PUBLIC one, so the control proves the 301 window still works.
+  { github_id: '9090', github_login: 'shifted', display_name: 'Shifted', avatar_url: null,
+    handle: 'shifted-now', previous_handle: 'shifted-was', bio: null, links: null, created_at: 'T',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+];
+
+// The columns this interpreter knows how to filter on. Anything else in a WHERE
+// clause throws — the guard against a predicate quietly degrading to no filter.
+const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
+
+/**
+ * Build a row test from a statement's own WHERE clause. Literal comparisons
+ * (profile_state = 'active') matter as much as placeholders here, because the
+ * effective-visibility predicate is made ENTIRELY of literal comparisons — a
+ * fake pool that only modelled $N filters would score the privacy terms as
+ * absent and pass no matter what.
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+
+  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
+  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
+
+  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
+  if (byId) { consumed.add(byId[1]); const v = params[Number(byId[1]) - 1]; tests.push((r) => String(r.github_id) === String(v)); }
+
+  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
+  if (byHandle) {
+    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
+    const v = String(params[Number(byHandle[1]) - 1]);
+    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
+  }
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_COLUMNS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+
+    // The scouting rollup: its privacy decision lives entirely in the EXISTS
+    // sub-select over the accounts table, so that is what is executed here —
+    // one result row per account the predicate admits. The aggregation above it
+    // is not the boundary and is not modelled.
+    if (/platform_identity_builder_project_activity/.test(sql) && /EXISTS \( SELECT 1 FROM platform_identity_accounts/.test(sql)) {
+      const inner = /EXISTS \( SELECT 1 FROM platform_identity_accounts pa WHERE (.+?)\) GROUP BY/.exec(sql);
+      assert.ok(inner, `the rollup EXISTS clause changed shape — the interpreter must be updated, not bypassed: ${sql.slice(0, 160)}`);
+      const match = accountFilter(inner[1].replace(/pa\.github_id = a\.github_id AND /, ''), params);
+      const rows = ACCOUNTS.filter(match).map((a) => ({
+        github_id: a.github_id, github_login: a.github_login, display_name: a.display_name,
+        avatar_url: a.avatar_url, project_count: 1, total_credits: 1, total_tasks_shipped: 1,
+        total_karma: 0, last_active: 'T', disciplines: null,
+      }));
+      return { rows, rowCount: rows.length };
+    }
+
+    if (/FROM platform_identity_accounts/.test(sql)) {
+      const where = sql.includes(' WHERE ') ? sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '') : '';
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      let rows = ACCOUNTS.filter(accountFilter(where, params));
+      if (/is_current/.test(cols)) {
+        // resolveHandle asks the row whether the handle it matched is the CURRENT
+        // one; that flag is what forks 200 from 301, so the fake must derive it
+        // rather than assume it. ORDER BY … DESC LIMIT 1 is modelled with it.
+        const asked = String(params[0]).toLowerCase();
+        rows = rows.map((r) => ({ ...r, is_current: String(r.handle || '').toLowerCase() === asked }))
+          .sort((a, b) => Number(b.is_current) - Number(a.is_current))
+          .slice(0, /LIMIT 1/.test(sql) ? 1 : rows.length);
+      }
+      return { rows, rowCount: rows.length };
+    }
+
+    // The rollup aggregates themselves — reached only AFTER the gate has passed,
+    // so they are canned. What they return is not what this file is proving.
+    if (/platform_identity_builder_project_activity/.test(sql)) {
+      return /projects/.test(sql)
+        ? { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }], rowCount: 1 }
+        : { rows: [], rowCount: 0 };
+    }
+    throw new Error(`fake pool: unhandled statement — ${sql.slice(0, 90)}`);
+  },
+};
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    // The public route's CORS wrapper is not under test — a pass-through keeps
+    // the doorway honest without dragging core config in.
+    corsPublicGet: () => (_req, _res, next) => next(),
+  },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const express = require('express');
+
+const app = express();
+app.use(attachFail);
+app.use('/api/gds', buildPublicProfileRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+
+// A viewer is expressed the only way this route could ever notice one: request
+// headers. The route has no requireBuilder, so a session cookie/bearer is the
+// most a viewer can be — and the point is that it changes nothing.
+function get(path_, headers = {}) {
+  calls = [];
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: path_, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, text: Buffer.concat(chunks).toString('utf8') }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+await ta('CONTROL: the fixture and the interpreter really work — a public account resolves', async () => {
+  // Without this, every 404 below could be a broken fake rather than a boundary.
+  const res = await get('/api/gds/profiles/octo');
+  assert.equal(res.status, 200, 'the feature must be a gate, not a blanket denial');
+  assert.match(res.text, /"handle":"octo"/);
+  assert.match(res.text, /"cross_project":\{/, 'and a public, unhidden account still gets its rollup');
+});
+
+await ta('a private account 404s on the public read — the row never leaves the database', async () => {
+  const res = await get('/api/gds/profiles/ghost');
+  assert.equal(res.status, 404, 'a private account must be indistinguishable from an unknown one');
+  assert.match(res.text, /profile_not_found/);
+  assert.ok(!res.text.includes('Ghost'), 'and nothing about the account may appear in the body');
+  assert.match(calls[0].sql, /account_visibility = 'public'/,
+    'the refusal came from the DATABASE predicate, not from a caller remembering to check');
+});
+
+await ta('private + recruiter-discoverable still 404s — reach never buys addressability', async () => {
+  const res = await get('/api/gds/profiles/scout');
+  assert.equal(res.status, 404,
+    "the spec's D2 private-discoverable row is served by the recruiter sliver, never by the public page");
+});
+
+await ta('a private account 404s on its PREVIOUS handle too — the 301 window is not a bypass', async () => {
+  const moved = await get('/api/gds/profiles/moved-was');
+  assert.equal(moved.status, 404, 'a 301 to the current handle would confirm the account exists');
+  assert.ok(!moved.text.includes('moved-now'), 'and must not name the handle it moved to');
+  // CONTROL: the rename window itself still works for a public account.
+  const shifted = await get('/api/gds/profiles/shifted-was');
+  assert.equal(shifted.status, 301, 'the P01 rename window is untouched for a public account');
+  assert.match(shifted.text, /shifted-now/);
+});
+
+await ta('a provisional account still 404s, and a hidden PUBLIC one still resolves', async () => {
+  assert.equal((await get('/api/gds/profiles/newbie')).status, 404, 'consent still floors everything (ADR 0171 D3)');
+  const shy = await get('/api/gds/profiles/shy');
+  assert.equal(shy.status, 200,
+    'hide removes the ROLLUP, not the page — addressability and hide are different invariants (spec D2)');
+  assert.match(shy.text, /"cross_project":null/, 'and the numbers are gone, indistinguishably from having none');
+});
+
+await ta('the public read answers 404 — NEVER 403 — on every path that can refuse', async () => {
+  const src = blankComments(fs.readFileSync(path.join(repo, 'modules/platform-identity/routes/public-profile.js'), 'utf8'));
+  assert.doesNotMatch(src, /\b403\b/,
+    'a 403 confirms the handle exists, which is the disclosure the 404 rule exists to prevent (spec D2 / ADR 0202 D4)');
+  for (const handle of ['ghost', 'scout', 'newbie', 'moved-was', 'nobody-at-all']) {
+    assert.equal((await get(`/api/gds/profiles/${handle}`)).status, 404, `${handle} must 404`);
+  }
+});
+
+await ta('the response is BYTE-IDENTICAL to a stranger, a signed-in viewer, and the owner', async () => {
+  // This is D2's viewer-independence reconciliation. The owner of a private
+  // account gets the same 404 as everyone else; their own page is composed from
+  // the own-scope side door (GET /me/cross-project → getOwnProfileExtras),
+  // never from this endpoint.
+  const viewers = [
+    ['anonymous', {}],
+    ['a signed-in stranger', { cookie: 'gds_session=stranger-token' }],
+    ['the account owner', { cookie: 'gds_session=ghost-own-token', authorization: 'Bearer ghost-own-token' }],
+  ];
+  const seen = [];
+  for (const [, headers] of viewers) seen.push(await get('/api/gds/profiles/ghost', headers));
+  for (let i = 1; i < seen.length; i++) {
+    assert.equal(seen[i].status, seen[0].status, `${viewers[i][0]} got a different status`);
+    assert.equal(seen[i].text, seen[0].text, `${viewers[i][0]} got a different body — the public read varied by viewer`);
+  }
+  // The structural reason it cannot vary: the read takes a handle and an options
+  // bag, and nothing else. A viewer parameter is how viewer-dependence arrives.
+  const params = /^[^(]*\(([^)]*)\)/.exec(pi.getPublicProfileByHandle.toString())[1];
+  assert.match(params, /^handle,\s*\{[^}]*pool[^}]*\}/,
+    `getPublicProfileByHandle(${params}) — the public read must take a handle and a pool bag only`);
+  assert.doesNotMatch(params, /viewer|builder|session|req\b/i, 'no viewer may reach the public read');
+  const routeSrc = blankComments(fs.readFileSync(path.join(repo, 'modules/platform-identity/routes/public-profile.js'), 'utf8'));
+  assert.doesNotMatch(routeSrc, /req\s*\.\s*builder\b/,
+    'the public profile route must never consult the viewer — that is what makes the 404 the same for everyone');
+});
+
+await ta('the own-scope side door still serves the owner their own record', async () => {
+  // The other half of D2: the public read 404s for everyone, and the owner's page
+  // is composed from HERE. getOwnProfileExtras is deliberately flag-blind.
+  calls = [];
+  const own = await pi.getOwnProfileExtras('5150', { pool });
+  assert.ok(own && own.totals, 'a private account must still be able to read its own numbers');
+  assert.ok(!calls.some((c) => /account_visibility|profile_state/.test(c.sql)),
+    'the self view applies no visibility predicate — that is what makes it a side door');
+});
+
+await ta('a private account is absent from the rollup, so it cannot leak by aggregate either', async () => {
+  calls = [];
+  assert.equal(await pi.getPublicProfileExtras('5150', { pool }), null,
+    'the port behind GET /builders/:id/profile must answer null for a private account');
+  assert.match(calls[0].sql, /account_visibility/, 'and it must SELECT the column to be able to say so');
+  assert.ok(await pi.getPublicProfileExtras('4242', { pool }), 'CONTROL: a public account still has one');
+  assert.equal(await pi.getPublicProfileExtras('6060', { pool }), null, 'a hidden account still has none');
+  assert.equal(await pi.getPublicProfileExtras('7070', { pool }), null, 'a provisional account still has none');
+});
+
+await ta('private accounts are absent from the leaderboard/directory rollup', async () => {
+  const rows = await pi.listScoutingRollup({ limit: 50, pool });
+  const shown = rows.map((r) => r.github_login).sort();
+  assert.deepEqual(shown, ['octo', 'shifted'],
+    'only active, publicly-visible, unhidden accounts reach /people and /scouting — '
+    + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private`);
+});
+
+server.close();
+
+// ===========================================================================
+// 5. Lane proof
+// ===========================================================================
+
+console.log('\ncoverage:');
+
+t('this guard runs in the DB-free unit lane (it is not parked as integration or known-failing)', () => {
+  const runner = fs.readFileSync(path.join(repo, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(
+    !/effective_visibility_predicate/.test(runner),
+    'effective_visibility_predicate is named in run-unit-tests.js — parked into INTEGRATION or KNOWN_FAILING it would gate nothing (task 1002282)'
+  );
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);