@bongos/core 1.19.426 → 1.19.428

package/tests/terms_acceptance.mjs

@@ -0,0 +1,573 @@
+// tests/terms_acceptance.mjs
+//
+// THE PLATFORM T&C ACCEPTANCE RECORD — "the hub's own sign-in is the only thing
+// that can say a human accepted the platform terms, it says so once, and nothing
+// publishes without it" (ADR 0213, task 1002913; the artifact ADR 0141 §4
+// deferred cross-project-aggregation consent to and ADR 0171 D3 reserved a place
+// for).
+//
+// WHY THIS EXISTS. An acceptance record is only worth the evidence behind it. If
+// a caller can assert one — a body field, a query param, a header — then the
+// record says nothing except "somebody claimed this", and the consent premise the
+// whole public-by-default profile rests on ("tied to having a platform account,
+// which already carries platform T&C consent", public-profiles spec) is a
+// fiction. So the property under test is not "acceptance is stored" but
+// "acceptance CANNOT BE FORGED, and cannot be silently restamped".
+//
+// THE MECHANISM — four things, each of which can genuinely fail here:
+//
+//   1. THE PAGE. /terms carries the cross-project section, and it is apex-only:
+//      a claim about the platform must not ship inside a child project's page
+//      (task 1002748). Run through the real stripApexOnly, not asserted by eye.
+//
+//   2. THE CAPTURE POINT. The acceptance columns are written by exactly one
+//      statement, reached from exactly one route — /sso/authorize, where
+//      `activate: true` is a SOURCE LITERAL and every other field comes from the
+//      hub's own resolved session (the ADR 0205 D3 property task 1003340
+//      established for recordFederatedSignin). The test drives the REAL router
+//      over real HTTP with an attacker-controlled query string and body, and
+//      proves neither reaches the statement.
+//
+//   3. IDEMPOTENCE, EXECUTED. The fake pool below is a real little
+//      platform_identity_accounts table plus an interpreter that reads the
+//      upsert's OWN column assignments and applies them. So COALESCE is not
+//      asserted against a string: signing in twice actually runs the conflict
+//      branch, and if the COALESCE were dropped the second sign-in would really
+//      overwrite the first timestamp and the assertion would really fail.
+//      The interpreter REFUSES an assignment shape it does not recognise rather
+//      than skipping it — an unread assignment must never read as "unchanged"
+//      (the tests/own_session_revoke.mjs / effective_visibility_predicate.mjs
+//      pattern: a filter this thing cannot read must never degrade to no filter).
+//
+//   4. THE ADR 0171 D3 TIE. Consent is now two columns, and the shared predicate
+//      is what enforces it. An account the hub witnessed but that never accepted
+//      is not consented — checked through the real account-visibility.js, which
+//      is the only file allowed to answer that question.
+//
+// DB-free by construction: static HTML, a fake pool, and an ephemeral loopback
+// listener. It therefore runs in the lane that actually EXECUTES — see the lane
+// proof at the bottom, which exists because three tests (hub_profile_leak,
+// handle_machinery, profile_fields) declared themselves integration, were in
+// NEITHER lane, and asserted nothing for months (task 1002806, learning 1000218).
+//
+// Run:  node tests/terms_acceptance.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import express from 'express';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+// ESM import so knip credits the exports (a createRequire import reads as
+// unused — the repo's standing blind spot, learning: knip-createrequire).
+import {
+  isAccountActive,
+  isAccountVisible,
+  accountActiveSql,
+} from '../modules/platform-identity/account-visibility.js';
+import {
+  TERMS_VERSION,
+  acceptanceInsertColumns,
+  acceptanceInsertValues,
+  acceptanceConflictSet,
+} from '../modules/platform-identity/terms-acceptance.js';
+
+const require = createRequire(import.meta.url);
+const repo = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// 1. The page — the consent text exists, and it is a platform-only claim
+// ===========================================================================
+
+console.log('the page (/terms carries the consent the ADR deferred to it):');
+
+const termsHtml = fs.readFileSync(path.join(repo, 'public-landing', 'terms.html'), 'utf8');
+const { stripApexOnly } = require('../src/platform-server.js');
+
+t('the terms page states what crosses between projects', () => {
+  assert.match(termsHtml, /Your work across projects/,
+    'the section ADR 0141 §4 deferred consent to is missing from the page');
+  // The four things the wording must carry for the mechanism to be honest.
+  assert.match(termsHtml, /karma/i, 'the data that crosses must be named, not gestured at');
+  assert.match(termsHtml, /descriptive analytics and never authority/i,
+    'ADR 0016: a cross-project number describes, it never governs — this is the load-bearing sentence');
+  assert.match(termsHtml, /public by default/i, 'what becoming public means must be stated');
+  assert.match(termsHtml, /hide your statistics/i, 'and the opt-outs that exist');
+});
+
+t('the acceptance the page promises is the one the code actually keeps', () => {
+  assert.match(termsHtml, /stores the date you accepted these terms/i,
+    'the page must tell the reader an acceptance record is kept');
+  assert.match(termsHtml, /signing in again does not change the original date/i,
+    'and that it is written once — the property the COALESCE below actually provides');
+});
+
+t('the cross-project claim is apex-only — it never ships in a child project page', () => {
+  const stripped = stripApexOnly(termsHtml);
+  assert.doesNotMatch(stripped, /Your work across projects/,
+    'a claim about THE PLATFORM survived into a child project page (task 1002748)');
+  // ...and the stripper did not simply eat the page.
+  assert.match(stripped, /Fair use/, 'the portable spine must survive stripping');
+  assert.match(stripped, /Your projects and your code/);
+});
+
+// ===========================================================================
+// 2. The SQL fragments — shape, and the guard against a smuggled placeholder
+// ===========================================================================
+
+console.log('\nthe fragments (the write side, in one place):');
+
+t('the acceptance fragments refuse anything that is not a Postgres placeholder', () => {
+  for (const bad of ['5', '$0', 'x', "$5; DROP TABLE platform_identity_accounts --", '', null]) {
+    assert.throws(() => acceptanceInsertValues(bad, '$6'), /Postgres placeholder/,
+      `insert values accepted ${JSON.stringify(bad)}`);
+    assert.throws(() => acceptanceConflictSet('$5', bad), /Postgres placeholder/,
+      `conflict set accepted ${JSON.stringify(bad)}`);
+  }
+});
+
+t('the conflict fragment is COALESCE-shaped — the first acceptance is the one that stands', () => {
+  const set = acceptanceConflictSet('$5', '$6');
+  assert.match(set, /COALESCE\(platform_identity_accounts\.terms_accepted_at, now\(\)\)/,
+    'without COALESCE every sign-in restamps, and the record stops meaning "when you accepted"');
+  assert.match(set, /COALESCE\(platform_identity_accounts\.terms_version, \$6::text\)/);
+  assert.match(set, /ELSE platform_identity_accounts\.terms_accepted_at END/,
+    'a NON-activating upsert must leave the record exactly as it was');
+});
+
+t('the insert fragment writes NULL for a caller the hub did not witness', () => {
+  const values = acceptanceInsertValues('$5', '$6');
+  assert.match(values, /CASE WHEN \$5::boolean THEN now\(\) ELSE NULL END/,
+    'a check-in / device-poll account has no acceptance — fail-closed');
+  assert.equal(acceptanceInsertColumns(), ', terms_accepted_at, terms_version');
+});
+
+// ===========================================================================
+// The fake pool: a real little accounts table + an assignment interpreter
+// ===========================================================================
+
+// Split a SQL list on top-level commas — depth-aware, so a CASE expression or a
+// COALESCE(a, b) is ONE element rather than two.
+function splitTopLevel(s) {
+  const out = [];
+  let depth = 0;
+  let caseDepth = 0;
+  let buf = '';
+  const tokens = s.split(/(\(|\)|,|\bCASE\b|\bEND\b)/i);
+  for (const tok of tokens) {
+    if (tok === '(') depth++;
+    else if (tok === ')') depth--;
+    else if (/^CASE$/i.test(tok)) caseDepth++;
+    else if (/^END$/i.test(tok)) caseDepth--;
+    if (tok === ',' && depth === 0 && caseDepth === 0) { out.push(buf.trim()); buf = ''; continue; }
+    buf += tok;
+  }
+  if (buf.trim()) out.push(buf.trim());
+  return out;
+}
+
+// The value a recognised acceptance assignment produces. Deliberately NOT a
+// permissive `.*?` match: every shape this understands is spelled out, and an
+// unrecognised one THROWS. A SET list matched loosely is how a deleted audit
+// trail passes a test that looks like it is checking one.
+function evalAcceptance(expr, { col, activate, existing, params, now }) {
+  const self = `platform_identity_accounts.${col}`;
+  const src = (tok) => {
+    if (/^now\(\)$/i.test(tok)) return now;
+    const m = /^\$(\d+)::text$/.exec(tok);
+    if (m) return params[Number(m[1]) - 1];
+    throw new Error(`unrecognised source expression "${tok}" for ${col}`);
+  };
+  const esc = self.replace(/[.]/g, '\\.');
+  let m;
+
+  // The shipped, idempotent shape: activate ? (existing ?? src) : existing
+  m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean THEN COALESCE\\(${esc}, (.+?)\\) ELSE ${esc} END$`, 'i').exec(expr);
+  if (m) return activate ? (existing != null ? existing : src(m[2])) : existing;
+
+  // The overwriting shape — a real possibility, and the one the idempotence
+  // assertion below must be able to tell apart from the shipped one.
+  m = new RegExp(`^CASE WHEN \\$(\\d+)::boolean THEN (.+?) ELSE ${esc} END$`, 'i').exec(expr);
+  if (m) return activate ? src(m[2]) : existing;
+
+  // The INSERT-branch shape: activate ? src : NULL
+  m = /^CASE WHEN \$(\d+)::boolean THEN (.+?) ELSE NULL END$/i.exec(expr);
+  if (m) return activate ? src(m[2]) : null;
+
+  // Unconditional — a caller-independent write. Recognised so the "non-activating
+  // paths never stamp" assertion can catch it rather than erroring out.
+  if (/^(now\(\)|\$\d+::text)$/i.test(expr)) return src(expr);
+
+  throw new Error(
+    `fake pool: unrecognised assignment for ${col}: "${expr}" — an assignment this interpreter `
+    + 'cannot read must never be treated as "leaves the column alone"');
+}
+
+const NOW = '2026-08-29T12:00:00.000Z';
+const LATER = '2026-08-30T09:30:00.000Z';
+
+function makePool() {
+  const accounts = new Map();      // github_id -> row
+  const calls = [];
+  let clock = NOW;
+  const pool = {
+    setClock(v) { clock = v; },
+    accounts,
+    calls,
+    query: async (text, params = []) => {
+      const sql = String(text).replace(/\s+/g, ' ').trim();
+      calls.push({ sql, params });
+
+      if (/^SELECT .* FROM platform_identity_sso_clients/i.test(sql)) {
+        return { rows: [{ client_id: 'proj-a', status: 'active', redirect_uris: ['https://proj-a.example/callback'] }], rowCount: 1 };
+      }
+
+      // The account upsert — the statement under test.
+      if (/^INSERT INTO platform_identity_accounts/i.test(sql)) {
+        const cols = splitTopLevel(/INSERT INTO platform_identity_accounts \(([^)]+)\)/i.exec(sql)[1]).map((c) => c.trim());
+        const id = String(params[0]);
+        const existing = accounts.get(id);
+
+        if (/ON CONFLICT \(github_id\) DO NOTHING/i.test(sql)) {
+          if (!existing) accounts.set(id, { github_id: id, github_login: params[1], profile_state: 'provisional', terms_accepted_at: null, terms_version: null, account_visibility: 'public', hide_stats: false, handle: 'h' });
+          return { rows: [], rowCount: existing ? 0 : 1 };
+        }
+
+        const valuesRaw = /VALUES \((.+?)\) ON CONFLICT/i.exec(sql);
+        assert.ok(valuesRaw, `the upsert changed shape — update the interpreter, do not bypass it: ${sql.slice(0, 200)}`);
+        const values = splitTopLevel(valuesRaw[1]);
+        assert.equal(values.length, cols.length, 'the INSERT column list and VALUES list must line up');
+
+        const activate = params[4] === true;
+        let row;
+        if (!existing) {
+          row = { github_id: id, github_login: params[1], account_visibility: 'public', hide_stats: false, handle: 'h' };
+          for (const col of ['terms_accepted_at', 'terms_version']) {
+            const i = cols.indexOf(col);
+            assert.notEqual(i, -1, `the upsert stopped writing ${col} on insert`);
+            row[col] = evalAcceptance(values[i], { col, activate, existing: null, params, now: clock });
+          }
+          row.profile_state = activate ? 'active' : 'provisional';
+          accounts.set(id, row);
+        } else {
+          row = existing;
+          const setRaw = /DO UPDATE SET (.+?) RETURNING/i.exec(sql);
+          assert.ok(setRaw, 'the conflict branch changed shape — update the interpreter');
+          const assigns = new Map();
+          for (const a of splitTopLevel(setRaw[1])) {
+            const eq = a.indexOf('=');
+            assigns.set(a.slice(0, eq).trim(), a.slice(eq + 1).trim());
+          }
+          for (const col of ['terms_accepted_at', 'terms_version']) {
+            assert.ok(assigns.has(col), `the conflict branch stopped writing ${col} — an account that signs in again would never record its acceptance`);
+            row[col] = evalAcceptance(assigns.get(col), { col, activate, existing: row[col], params, now: clock });
+          }
+          if (activate) row.profile_state = 'active';
+        }
+        return { rows: [{ ...row }], rowCount: 1 };
+      }
+
+      if (/^SELECT .* FROM platform_identity_accounts/i.test(sql)) {
+        const row = accounts.get(String(params[0]));
+        return { rows: row ? [{ ...row }] : [], rowCount: row ? 1 : 0 };
+      }
+
+      // Handle seeding, auth-code minting, and anything else the route does.
+      if (/platform_identity_auth_codes/i.test(sql)) return { rows: [{ code: 'CODE' }], rowCount: 1 };
+      return { rows: [], rowCount: 0 };
+    },
+  };
+  return pool;
+}
+
+// ---- the real SSO router over the real domain module, core pinned ----------
+
+const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+const pool = makePool();
+let SESSION = null;
+
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    // The hub's OWN session resolver. It reads the request only to find a
+    // session; nothing a caller sends can change what it returns here.
+    resolveSession: async () => SESSION,
+    logger: () => noopLog,
+    hasProvider: () => true,
+    registerProvider: () => {},
+    on: () => () => {},
+    resolveEnv: () => null,
+    userAgent: () => 'cloud-bongos-tests',
+    LIVE_RANK_LADDER: ['xenos', 'thetes', 'metic', 'archon'],
+  },
+};
+
+const buildSsoRoutes = require('../modules/platform-identity/routes/sso.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildSsoRoutes());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const port = server.address().port;
+
+// Raw http.request, not fetch: fetch's keep-alive sockets outlive the listener
+// and closing it under them trips a libuv assert on Windows, which exits the
+// process non-zero with every assertion green — a test that reports success and
+// fails the lane. This is the tests/effective_visibility_predicate.mjs shape.
+function request(path_) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: path_ }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({
+        status: res.statusCode,
+        location: res.headers.location || '',
+        text: Buffer.concat(chunks).toString('utf8'),
+      }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const HUB_SESSION = {
+  github_id: '4242', github_login: 'octo', display_name: 'Octo',
+  avatar_url: null, status: 'active', source: 'web', system_role: null,
+};
+const REDIRECT = 'https://proj-a.example/callback';
+const authorize = (qs = '') => request(
+  `/sso/authorize?client_id=proj-a&redirect_uri=${encodeURIComponent(REDIRECT)}${qs}`,
+);
+
+// ===========================================================================
+// 3. The capture point — the hub's own sign-in, and nothing else
+// ===========================================================================
+
+console.log('\nthe capture point (only the hub can say a human accepted):');
+
+await ta('CONTROL: a hub-session authorize records the acceptance', async () => {
+  SESSION = HUB_SESSION;
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  const res = await authorize();
+  assert.equal(res.status, 302, 'the authorize leg should hand back a code');
+  const row = pool.accounts.get('4242');
+  assert.ok(row, 'no account was written at all — the rest of this section would pass vacuously');
+  assert.equal(row.terms_accepted_at, NOW, 'the acceptance was not stamped by the hub sign-in');
+  assert.equal(row.terms_version, TERMS_VERSION, 'the record must name WHICH text was accepted');
+  assert.equal(row.profile_state, 'active');
+});
+
+await ta('the acceptance cannot be forged from the query string or the body', async () => {
+  SESSION = HUB_SESSION;
+  pool.accounts.clear();
+  pool.calls.length = 0;
+  pool.setClock(NOW);
+  const forged = '1999-01-01T00:00:00.000Z';
+  // Everything an attacker can reach: query params named exactly like the
+  // columns and the flag, plus a body on the same route.
+  const res = await request(
+    `/sso/authorize?client_id=proj-a&redirect_uri=${encodeURIComponent(REDIRECT)}`
+    + `&terms_accepted_at=${encodeURIComponent(forged)}&terms_version=FORGED&activate=true`
+    + '&profile_state=active',
+  );
+  assert.equal(res.status, 302);
+  const row = pool.accounts.get('4242');
+  assert.equal(row.terms_accepted_at, NOW, 'a caller-supplied timestamp reached the acceptance record');
+  assert.equal(row.terms_version, TERMS_VERSION, 'a caller-supplied version reached the acceptance record');
+
+  // And structurally: the forged values are nowhere in the statement's params,
+  // so there is no path by which a later refactor could start reading them.
+  const upserts = pool.calls.filter((c) => /INSERT INTO platform_identity_accounts/i.test(c.sql) && /DO UPDATE/i.test(c.sql));
+  assert.equal(upserts.length, 1, `expected exactly one account upsert, got ${upserts.length}`);
+  const flat = JSON.stringify(upserts[0].params);
+  assert.doesNotMatch(flat, /FORGED/, 'a caller-controlled value was bound into the acceptance statement');
+  assert.doesNotMatch(flat, /1999/, 'a caller-controlled timestamp was bound into the acceptance statement');
+  assert.equal(upserts[0].params.length, 6,
+    'the statement grew a parameter — every one of them must come from the hub session or a constant');
+  assert.equal(upserts[0].params[5], TERMS_VERSION, 'the version parameter must be the server constant');
+  assert.equal(upserts[0].params[4], true, 'activate must be the literal true the route passes, not a parsed input');
+});
+
+await ta('no hub session, no acceptance — the unauthenticated caller is bounced, not recorded', async () => {
+  SESSION = null;
+  pool.accounts.clear();
+  const res = await authorize();
+  assert.equal(res.status, 302);
+  assert.match(res.location, /\/auth\/web\/start/,
+    'an anonymous caller must be sent to the hub sign-in');
+  assert.equal(pool.accounts.size, 0, 'an account (and an acceptance) was created for a caller with no session');
+});
+
+await ta('a dev-box session cannot mint an acceptance either (ADR 0016 trust boundary)', async () => {
+  SESSION = { ...HUB_SESSION, source: 'box' };
+  pool.accounts.clear();
+  const res = await authorize();
+  assert.equal(res.status, 403);
+  assert.equal(pool.accounts.size, 0, 'a box-scoped session recorded a platform T&C acceptance');
+});
+
+// ===========================================================================
+// 4. Idempotence — executed, not asserted against a string
+// ===========================================================================
+
+console.log('\nidempotence (the first acceptance is the one that stands):');
+
+await ta('signing in twice does not rewrite or duplicate the acceptance', async () => {
+  SESSION = HUB_SESSION;
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  await authorize();
+  const first = pool.accounts.get('4242').terms_accepted_at;
+  assert.equal(first, NOW);
+
+  // A second sign-in, a day later. This really runs the ON CONFLICT branch.
+  pool.setClock(LATER);
+  await authorize();
+  const row = pool.accounts.get('4242');
+  assert.equal(row.terms_accepted_at, NOW,
+    `the second sign-in restamped the acceptance (${row.terms_accepted_at}) — the record no longer says when consent was actually given`);
+  assert.equal(row.terms_version, TERMS_VERSION);
+  assert.equal(pool.accounts.size, 1, 'a second row was created — one account, one acceptance');
+});
+
+await ta('a NON-activating write never touches an existing acceptance', async () => {
+  SESSION = HUB_SESSION;
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  await authorize();
+
+  // ensureAccount is the federated path (check-in / device-poll): it must not
+  // create, restamp, or clear an acceptance.
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  pool.setClock(LATER);
+  await pi.ensureAccount({ githubId: '4242', githubLogin: 'octo', displayName: 'x', avatarUrl: null }, { pool });
+  assert.equal(pool.accounts.get('4242').terms_accepted_at, NOW,
+    'a federated check-in changed the acceptance record');
+});
+
+await ta('a federated check-in creates an account with NO acceptance at all', async () => {
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  await pi.ensureAccount({ githubId: '9999', githubLogin: 'newbie', displayName: null, avatarUrl: null }, { pool });
+  const row = pool.accounts.get('9999');
+  assert.ok(row, 'the check-in should still create the provisional account shell');
+  assert.equal(row.terms_accepted_at, null,
+    'an account created by a project check-in has never seen the platform terms — it must not carry an acceptance');
+  assert.equal(row.profile_state, 'provisional');
+});
+
+server.close();
+
+// ===========================================================================
+// 5. The ADR 0171 D3 tie — consent is two columns, in the one shared predicate
+// ===========================================================================
+
+console.log('\nthe D3 tie (nothing publishes on a consent premise that was never true):');
+
+t('the shared consent predicate requires the acceptance, in both forms', () => {
+  const witnessedAndAccepted = { profile_state: 'active', terms_accepted_at: NOW, account_visibility: 'public' };
+  const witnessedOnly = { profile_state: 'active', terms_accepted_at: null, account_visibility: 'public' };
+  const acceptedOnly = { profile_state: 'provisional', terms_accepted_at: NOW, account_visibility: 'public' };
+
+  assert.equal(isAccountActive(witnessedAndAccepted), true);
+  assert.equal(isAccountActive(witnessedOnly), false,
+    'an account the hub witnessed before the terms existed is NOT consented (ADR 0213)');
+  assert.equal(isAccountActive(acceptedOnly), false,
+    'and an acceptance alone never substitutes for the hub having witnessed the human (D3)');
+  assert.equal(isAccountVisible(witnessedOnly), false, 'so it is not publicly addressable either');
+
+  assert.match(accountActiveSql(), /terms_accepted_at IS NOT NULL/,
+    'the SQL twin must ask the same question as the JS twin');
+  assert.match(accountActiveSql('pa'), /pa\.terms_accepted_at IS NOT NULL/, 'and qualify it under an alias');
+});
+
+t('the page and the code agree on which version is current', () => {
+  assert.match(termsHtml, new RegExp(TERMS_VERSION.replace(/-/g, '\\-')),
+    `the page must state the version the code stamps (${TERMS_VERSION}) — a record naming a text the reader `
+    + 'cannot find is not evidence of anything');
+});
+
+// ===========================================================================
+// 6. The projection rule — a twin cannot judge a column it was not given
+// ===========================================================================
+
+// The SQL predicate reads the column straight off the table, so it is safe. The
+// JS twins are not: they judge a ROW, and a row is only as good as its SELECT
+// list. Drop terms_accepted_at from a projection and isAccountActive() answers
+// false for EVERYONE holding that row — connections denies every builder, the
+// profile port returns null for every account — silently, with every other test
+// still green. That is a deny-all outage dressed as a privacy feature, and it is
+// exactly the failure a mutation found here.
+//
+// So: every read whose row is handed to a JS twin must project both consent
+// columns. Enumerated from source, not from a list someone maintains by hand.
+
+console.log('\nthe projection rule (every twin-fed read carries the consent columns):');
+
+const TWIN_FED_READS = [
+  { file: 'modules/platform-identity/platform-identity.js', fn: 'getAccount',
+    why: 'routes/connections.js actingAccount() calls isAccountActive on this row' },
+  { file: 'modules/platform-identity/platform-identity.js', fn: 'getPublicProfileExtras',
+    why: 'it calls isRollupVisible on this row before returning any numbers' },
+  { file: 'modules/platform-identity/connections.js', fn: 'findAccountByHandle',
+    why: 'routes/connections.js visibleTarget() calls isAccountVisible/isAccountActive on this row' },
+];
+
+for (const { file, fn, why } of TWIN_FED_READS) {
+  t(`${file.split('/').pop()} ${fn}() projects the consent columns — ${why}`, () => {
+    const code = fs.readFileSync(path.join(repo, file), 'utf8');
+    const at = code.indexOf(`function ${fn}(`);
+    assert.notEqual(at, -1, `${fn} no longer exists in ${file} — this rule now guards nothing`);
+    // The function's own body, to its closing brace at column 0.
+    const end = code.indexOf('\n}', at);
+    assert.notEqual(end, -1, `could not bound ${fn}`);
+    const body = code.slice(at, end);
+    assert.match(body, /SELECT/i, `${fn} no longer issues a SELECT — update this rule rather than deleting it`);
+    assert.match(body, /\bterms_accepted_at\b/,
+      `${fn} selects the row a JS consent twin judges, but does NOT project terms_accepted_at. `
+      + 'The twin reads undefined, answers false for every account, and the surface denies everyone '
+      + 'with no error anywhere (ADR 0213).');
+    assert.match(body, /\bprofile_state\b/,
+      `${fn} does not project profile_state — the other half of the same answer`);
+  });
+}
+
+// ===========================================================================
+// 7. Lane proof
+// ===========================================================================
+
+console.log('\ncoverage:');
+
+t('this proof runs in the DB-free unit lane (it is not parked as integration or known-failing)', () => {
+  const runner = fs.readFileSync(path.join(repo, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(
+    !/terms_acceptance/.test(runner),
+    'terms_acceptance is named in run-unit-tests.js — parked into INTEGRATION or KNOWN_FAILING it would gate '
+    + 'nothing, which is exactly how hub_profile_leak / handle_machinery / profile_fields asserted nothing for '
+    + 'months (task 1002806, learning 1000218)');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);