@bongos/core 1.19.426 → 1.19.428

package/modules/platform-identity/terms-acceptance.js

@@ -0,0 +1,97 @@
+// modules/platform-identity/terms-acceptance.js — THE platform T&C acceptance
+// record: which text is current, and the SQL that stamps a builder's acceptance
+// of it (ADR 0213, task 1002913).
+//
+// WHAT THIS ANSWERS: "did the hub itself witness this human accept the platform
+// terms, and which text did they accept?" — the artifact ADR 0141 §4 deferred
+// consent for cross-project aggregation to, and ADR 0171 D3 reserved a place for
+// ("the one path where a human is demonstrably at the hub, and where T&C
+// acceptance can later be captured, task 1002913").
+//
+// WHY ITS OWN FILE. platform-identity.js sits at the 1500-line fitness ratchet
+// with `oversized_file_count: 0` as the baseline — there is no headroom, and
+// four sessions have already set the precedent that new logic lands beside it
+// (account-visibility.js, application-echo.js, routes/connections.js,
+// src/bongos/routes/my-sessions.js). This file is that, for consent.
+//
+// THE WRITE SIDE ONLY — read the record through account-visibility.js. That file
+// is the SOLE owner of every effective-visibility answer, and acceptance is now
+// part of the consent axis it publishes (accountActiveSql / isAccountActive).
+// Nothing here compares terms_accepted_at to anything; these are the statements
+// that SET it. tests/effective_visibility_predicate.mjs enforces that split —
+// its SPELLINGS list fails any file but the owner that writes the acceptance
+// predicate, and deliberately does not match a write.
+//
+// WHY THE CALLER CANNOT FORGE ONE. These fragments have exactly one call site:
+// upsertAccount's `activate` branch, whose only caller is /sso/authorize
+// (routes/sso.js). There `activate: true` is a SOURCE LITERAL and every other
+// field comes from the hub's own resolved session — the ADR 0205 D3 property
+// established for recordFederatedSignin by task 1003340. No request-body field
+// reaches these statements, which is the whole point: an acceptance record a
+// caller could assert would be evidence of nothing.
+//
+// IDEMPOTENT BY CONSTRUCTION: the conflict branch is COALESCE(existing, new), so
+// the FIRST acceptance stands and a second sign-in never rewrites or duplicates
+// it. The two columns are only ever written together, so they cannot diverge.
+//
+// A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
+// recorded and never overwritten, publishing a new TERMS_VERSION leaves every
+// existing row naming the text it actually agreed to — so the platform can see
+// who has not accepted the new one. Re-acceptance on revision is deliberately
+// NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
+'use strict';
+
+// The version of the platform terms currently served at /terms. It is stamped
+// onto every acceptance, so it must match the version the page states — the
+// pairing is asserted by tests/terms_acceptance.mjs, which reads both.
+//
+// Date-stamped rather than numbered: the page says "Version <this>", and a
+// reader comparing page to record should not have to translate.
+const TERMS_VERSION = '2026-08-29';
+
+// A Postgres placeholder, e.g. '$5'. Interpolated into SQL, so it is validated
+// rather than trusted — the account-visibility.js alias-guard pattern.
+function assertPlaceholder(fn, value) {
+  if (!/^\$[1-9][0-9]*$/.test(String(value))) {
+    throw new Error(`${fn}: expected a Postgres placeholder like '$5', got ${JSON.stringify(value)}`);
+  }
+}
+
+// The acceptance columns, for an INSERT column list. Leading comma: it appends
+// to an existing list rather than standing alone.
+function acceptanceInsertColumns() {
+  return ', terms_accepted_at, terms_version';
+}
+
+// The matching VALUES fragment. A row created by a NON-activating caller
+// (ensureAccount's check-in / device-poll path) gets NULL — fail-closed: no hub
+// session witnessed that human, so there is no acceptance to record.
+function acceptanceInsertValues(activateParam, versionParam) {
+  assertPlaceholder('acceptanceInsertValues', activateParam);
+  assertPlaceholder('acceptanceInsertValues', versionParam);
+  return `, CASE WHEN ${activateParam}::boolean THEN now() ELSE NULL END`
+    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`;
+}
+
+// The ON CONFLICT DO UPDATE SET fragment — the idempotent half. COALESCE keeps
+// the FIRST acceptance, so signing in again re-reads the terms but does not
+// restamp them; a non-activating upsert leaves both columns exactly as they are,
+// mirroring the one-way rule profile_state already follows.
+//
+// Trailing comma: it sits between two other assignments in the SET list.
+function acceptanceConflictSet(activateParam, versionParam) {
+  assertPlaceholder('acceptanceConflictSet', activateParam);
+  assertPlaceholder('acceptanceConflictSet', versionParam);
+  const self = 'platform_identity_accounts';
+  return `terms_accepted_at = CASE WHEN ${activateParam}::boolean`
+    + ` THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
+    + ` terms_version = CASE WHEN ${activateParam}::boolean`
+    + ` THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`;
+}
+
+module.exports = {
+  TERMS_VERSION,
+  acceptanceInsertColumns,
+  acceptanceInsertValues,
+  acceptanceConflictSet,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.426",
+  "version": "1.19.428",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.426",
+      "version": "1.19.428",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.426",
+  "version": "1.19.428",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/terms.html

@@ -61,6 +61,14 @@
     <p>A project stood up from the hub runs on the platform's servers at your request. Any cost is shown before you confirm. Tearing it down stops its server; it keeps its database and backups so it can come back, and its web address stays with it while it can.</p>
     <!--apex-only:end-->
 
+    <!--apex-only:start-->
+    <h2>Your work across projects</h2>
+    <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the disciplines you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
+    <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
+    <p><b>What is public.</b> Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.</p>
+    <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>
 

package/scripts/hall-preview/server.js

@@ -116,6 +116,9 @@ const FIXTURE_FALLBACKS = [
   // craft and the page window are query string, which fixture matching ignores.
   [/^builders\/\d+\/activity$/, (q) => (q.section === 'goals' ? 'builders__activity-goals' : 'builders__activity-tasks')],
   [/^inbox\/by-builder\/\d+$/, 'inbox__by-builder'],
+  // the profile's connections section (task 1002296) — one degree fixture serves
+  // any handle, since the handle is the address and the label is the payload.
+  [/^connections\/degree\/[^/]+$/, 'connections__degree'],
 ];
 
 function loadFixture(name) {

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.426'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.428'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/connections_api.mjs

@@ -126,12 +126,15 @@ function call(method, path, body) {
   });
 }
 
-// The first query every route makes is the caller's own account (the
-// profile_state='active' floor, ADR 0202 D4 §1).
-const meActive = () => result([{ github_id: String(ME.github_id), profile_state: 'active', account_visibility: 'public', handle: 'octo' }]);
+// The first query every route makes is the caller's own account (the CONSENT
+// floor, ADR 0202 D4 §1). Since ADR 0213 that floor is two columns: the hub
+// witnessed the human AND that human accepted the platform terms, both written
+// by the same upsertAccount branch — so a consented fixture carries both.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+const meActive = () => result([{ github_id: String(ME.github_id), profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', handle: 'octo' }]);
 const account = (over = {}) => ({
   github_id: String(ADA), handle: 'ada', display_name: 'Ada', avatar_url: null,
-  profile_state: 'active', account_visibility: 'public', ...over,
+  profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', ...over,
 });
 
 // ===========================================================================
@@ -299,8 +302,9 @@ test('list: my connections, the count IS the array length, and paging is real',
   assert.match(calls[1].text, /LIMIT \$2 OFFSET \$3/,
     'a hard cap with no OFFSET would make the 501st connection unreachable while count still read 500');
   assert.deepEqual(calls[1].params, [ME.github_id, 2, 4]);
-  assert.match(calls[1].text, /\(pa\.profile_state = 'active'\)/,
-    'own scope floors on consent alone — a private account you connected with appears HERE (D4 §2)');
+  assert.match(calls[1].text, /\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\)/,
+    'own scope floors on consent alone — a private account you connected with appears HERE (D4 §2). '
+    + 'Consent is BOTH columns since ADR 0213: the hub witnessed them, and they accepted the platform terms.');
   assert.doesNotMatch(calls[1].text, /account_visibility/,
     "…and applying the PUBLIC predicate here would erase your own connections from your own list");
 });
@@ -478,8 +482,9 @@ test('degree: 3rd degree runs exactly ONE more query, capped at FANOUT_1 then FA
   assertBounded(far.text, 'far');
   assert.deepEqual(far.params, [ME.github_id, String(ADA), conn.FANOUT_1, conn.FANOUT_2],
     'the caps are the ADR 0202 D3 constants, bound as parameters');
-  assert.match(far.text, /\(pa\.profile_state = 'active' AND pa\.account_visibility = 'public'\)/,
-    'a hop BEYOND the viewer\'s own connections must clear the full public predicate');
+  assert.match(far.text, /\(\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\) AND pa\.account_visibility = 'public'\)/,
+    'a hop BEYOND the viewer\'s own connections must clear the full public predicate — the ADR 0213 '
+    + 'consent pair AND the existence axis, composed rather than restated');
 });
 
 test('degree: past DEGREE_MAX the answer is null — "out of network", not a deeper search', async () => {

package/tests/connections_ownership.mjs

@@ -106,9 +106,14 @@ function predicateFor(rawWhere, params) {
   return (r) => tests.every((fn) => fn(r));
 }
 
+// Consent is two columns since ADR 0213 (task 1002913): the hub witnessed this
+// human AND that human accepted the platform terms. Both are written by the same
+// upsertAccount branch, so a genuinely consented account always carries both —
+// and isAccountActive, which every route here floors on, checks both.
 const ACCOUNT = {
   id: 1, github_id: String(ME), github_login: 'octo', display_name: 'Octo', avatar_url: null,
-  profile_state: 'active', hide_stats: false, account_visibility: 'public',
+  profile_state: 'active', terms_accepted_at: '2026-08-29T00:00:00.000Z',
+  hide_stats: false, account_visibility: 'public',
   recruiter_discoverable: null, handle: 'octo', previous_handle: null,
 };
 

package/tests/effective_visibility_predicate.mjs

@@ -256,6 +256,14 @@ const SPELLINGS = [
   [/\bCOALESCE\s*\(\s*(?:[A-Za-z_$][\w$]*|\$\{[^}]*\})?\s*\.?\s*recruiter_discoverable/gi, 'the recruiter-reach COALESCE'],
   [/\bNOT\s+(?:[A-Za-z_][\w]*\.)?hide_stats\b/g, 'a SQL NOT hide_stats'],
   [/\bhide_stats\s*(?:=|==|===)\s*(?:true|false)\b/g, 'hide_stats compared to a boolean'],
+  // The ADR 0213 acceptance half of the consent axis (task 1002913), in the two
+  // syntaxes a drift copy would actually be written in: the SQL NULL test the
+  // owner emits (bare, aliased, or through a `${q}` prefix) and the JS twin's
+  // null comparison. Written against the form the source REALLY carries, because
+  // a rule matching only a spelling nobody uses is the hole task 1002290 found in
+  // the reach COALESCE — the whole reason that entry now pins four forms.
+  [/\bterms_accepted_at\s+IS\s+(?:NOT\s+)?NULL\b/gi, 'a terms-acceptance NULL test'],
+  [/\bterms_accepted_at\s*(?:=|==|===|!=|!==|<>)\s*null\b/gi, 'terms_accepted_at compared to null'],
 ];
 
 function spellingsIn(code) {
@@ -369,6 +377,16 @@ t('SPELLINGS catch a hand-written variant in either language, and leave writes a
   assert.ok(caught('COALESCE(${alias}.recruiter_discoverable, TRUE)'), 'a template alias AND a dot — the drift copy most likely to be written');
   assert.ok(!caught('COALESCE(hide_stats, false)'), 'and it is the REACH column it watches, not any COALESCE');
   assert.ok(caught('AND NOT pa.hide_stats'), 'the hide half of a rollup predicate');
+  // The ADR 0213 consent half, in every form that ships or could drift. The bare
+  // and `${q}` forms are what the owner emits today; the aliased form is what a
+  // drift copy in a joined query would most likely write.
+  assert.ok(caught('AND terms_accepted_at IS NOT NULL'), 'the acceptance NULL test, bare');
+  assert.ok(caught('AND pa.terms_accepted_at IS NOT NULL'), 'the acceptance NULL test, aliased');
+  assert.ok(caught('`AND ${q}terms_accepted_at IS NOT NULL`'), 'the acceptance NULL test, as the builder writes it');
+  assert.ok(caught('WHERE terms_accepted_at IS NULL'), 'and the inverted test — the same decision, negated');
+  assert.ok(caught('if (a.terms_accepted_at != null) return a;'), 'the JS twin of the acceptance test');
+  assert.ok(!caught('COALESCE(platform_identity_accounts.terms_accepted_at, now())'), 'a write is not a predicate');
+  assert.ok(!caught('SELECT profile_state, terms_accepted_at, account_visibility'), 'and naming the column in a projection decides nothing');
   // A WRITE names the column but compares it to nothing — it decides no visibility.
   assert.ok(!caught("profile_state = CASE WHEN $5::boolean THEN 'active' ELSE x END"), 'an upsert is not a predicate');
   assert.ok(!caught("account_visibility: (acct && acct.account_visibility) || 'public'"), 'a projection default is not a predicate');
@@ -439,13 +457,24 @@ t('the alias is the one interpolated thing, and every builder refuses a non-iden
 t('the JS ports answer exactly what the SQL asks, row for row', () => {
   // The table IS the D2 matrix. Each row is checked against BOTH forms, which is
   // the only way "a route and a query cannot drift" is more than a slogan.
+  // ADR 0213 (task 1002913) made consent TWO columns: the hub witnessed the human
+  // (profile_state) AND that human accepted the platform terms (terms_accepted_at).
+  // Both are stamped by the same upsertAccount branch, so `active` + NULL only
+  // occurs for a row predating the terms — which must NOT publish.
+  const ACCEPTED = new Date('2026-08-29T00:00:00Z');
   const rows = [
-    { row: { profile_state: 'active', account_visibility: 'public', hide_stats: false }, visible: true, rollup: true },
-    { row: { profile_state: 'active', account_visibility: 'public', hide_stats: true }, visible: true, rollup: false },
-    { row: { profile_state: 'active', account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
-    { row: { profile_state: 'active', account_visibility: 'private', hide_stats: true }, visible: false, rollup: false },
-    { row: { profile_state: 'provisional', account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
-    { row: { profile_state: 'provisional', account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'public', hide_stats: false }, visible: true, rollup: true },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'public', hide_stats: true }, visible: true, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'private', hide_stats: true }, visible: false, rollup: false },
+    { row: { profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    // The ADR 0213 axis: witnessed but never accepted (a legacy row, or a state
+    // no post-0213 write can produce) is NOT consented, so it publishes nothing.
+    { row: { profile_state: 'active', terms_accepted_at: null, account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: null, account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    // …and acceptance alone never substitutes for the hub's own witness.
+    { row: { profile_state: 'provisional', terms_accepted_at: ACCEPTED, account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
   ];
   for (const { row, visible, rollup } of rows) {
     const id = JSON.stringify(row);
@@ -454,7 +483,9 @@ t('the JS ports answer exactly what the SQL asks, row for row', () => {
     // The SQL twin, evaluated the only honest way a DB-free test can: the
     // fragment's own column comparisons, resolved against this row.
     const sqlSaysVisible = /profile_state = 'active'/.test(accountVisibleSql())
+      && /terms_accepted_at IS NOT NULL/.test(accountVisibleSql())
       && row.profile_state === 'active'
+      && row.terms_accepted_at != null
       && row.account_visibility === 'public';
     assert.equal(sqlSaysVisible, visible, `the SQL fragment agrees for ${id}`);
   }
@@ -646,41 +677,59 @@ t('every declared non-public read still exists (a stale declaration is a blind s
 
 console.log('\nbehaviour (an executed privacy boundary):');
 
+// Every consented fixture carries an acceptance stamp, because after ADR 0213
+// (task 1002913) the consent axis is profile_state AND terms_accepted_at — the
+// same upsertAccount branch writes both, so a real consented row always has one.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+
 const ACCOUNTS = [
   { github_id: '4242', github_login: 'octo', display_name: 'Octo', avatar_url: null,
     handle: 'octo', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
   // The private account this whole task exists for.
   { github_id: '5150', github_login: 'ghost', display_name: 'Ghost', avatar_url: null,
     handle: 'ghost', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
   // Private AND recruiter-discoverable — the spec's D2 "private · discoverable"
   // row. Reach must not buy addressability: this one still 404s.
   { github_id: '5151', github_login: 'scout', display_name: 'Scout', avatar_url: null,
     handle: 'scout', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
   // Public but hidden — the axes are independent: the PAGE resolves, the numbers do not.
   { github_id: '6060', github_login: 'shy', display_name: 'Shy', avatar_url: null,
     handle: 'shy', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
   { github_id: '7070', github_login: 'newbie', display_name: 'Newbie', avatar_url: null,
     handle: 'newbie', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // ADR 0213 (task 1002913): the hub witnessed this human, but no acceptance of
+  // the platform terms is on record — a row from before the terms existed. Public
+  // and unhidden on every OTHER axis, so if consent were still one column it would
+  // resolve. It must 404: the T&C is what "public by default" was always premised
+  // on, and this account never saw one. It re-publishes on its next hub sign-in.
+  { github_id: '7171', github_login: 'legacy', display_name: 'Legacy', avatar_url: null,
+    handle: 'legacy', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'active', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
   // A private account inside the P01 rename window. Its OLD handle must 404 too —
   // a 301 to the current handle would confirm the account exists.
   { github_id: '8080', github_login: 'moved', display_name: 'Moved', avatar_url: null,
     handle: 'moved-now', previous_handle: 'moved-was', bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
   // ...and a PUBLIC one, so the control proves the 301 window still works.
   { github_id: '9090', github_login: 'shifted', display_name: 'Shifted', avatar_url: null,
     handle: 'shifted-now', previous_handle: 'shifted-was', bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
 ];
 
 // The columns this interpreter knows how to filter on. Anything else in a WHERE
 // clause throws — the guard against a predicate quietly degrading to no filter.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
+// The columns this interpreter knows how to answer an IS [NOT] NULL test on.
+// Separate from KNOWN_COLUMNS because a NULL test is a different syntax the
+// literal-comparison sweep cannot see (ADR 0213 / task 1002913).
+const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
+
 /**
  * Build a row test from a statement's own WHERE clause. Literal comparisons
  * (profile_state = 'active') matter as much as placeholders here, because the
@@ -691,8 +740,22 @@ const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stat
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
+  // NULL-test terms this interpreter actually turned into a filter, as opposed
+  // to column names it merely recognises. The final sweep compares the two.
+  const modelled = new Set();
 
   if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  // The ADR 0213 acceptance half of the consent axis. It is a NULL test, not a
+  // literal comparison, so neither refusal sweep below would have caught it —
+  // an unmodelled IS NOT NULL degrades to no filter exactly like an unread $N.
+  // Hence the third sweep at the end of this function, and hence `modelled`:
+  // the sweep must prove a filter was APPLIED, not merely that the column is a
+  // name it recognises. (Checking recognition alone left this interpreter
+  // scoring a deleted filter as fine — found by mutation while writing it.)
+  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
+    modelled.add('terms_accepted_at');
+    tests.push((r) => r.terms_accepted_at != null);
+  }
   if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
   if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
   // The recruiting-reach COALESCE (task 1002290). Modelled through the shared JS
@@ -721,6 +784,18 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
+  // A NULL test is a filter too. Without this sweep the ADR 0213 acceptance term
+  // could be dropped from the predicate and this interpreter would score it as
+  // absent-and-fine, which is the failure mode the other two sweeps exist to
+  // prevent one syntax over.
+  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
+    if (!KNOWN_NULL_TESTS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+    if (!modelled.has(m[1])) {
+      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it, which is the silent-pass it exists to refuse`);
+    }
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -913,7 +988,7 @@ await ta('private accounts are absent from the leaderboard/directory rollup', as
   const shown = rows.map((r) => r.github_login).sort();
   assert.deepEqual(shown, ['octo', 'shifted'],
     'only active, publicly-visible, unhidden accounts reach /people and /scouting — '
-    + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private`);
+    + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private, legacy never accepted the terms (ADR 0213)`);
 });
 
 server.close();