@bongos/core 1.19.427 → 1.19.428

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.427",
+  "version": "1.19.428",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.427",
+      "version": "1.19.428",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.427",
+  "version": "1.19.428",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/terms.html

@@ -61,6 +61,14 @@
     <p>A project stood up from the hub runs on the platform's servers at your request. Any cost is shown before you confirm. Tearing it down stops its server; it keeps its database and backups so it can come back, and its web address stays with it while it can.</p>
     <!--apex-only:end-->
 
+    <!--apex-only:start-->
+    <h2>Your work across projects</h2>
+    <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the disciplines you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
+    <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
+    <p><b>What is public.</b> Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.</p>
+    <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>
 

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.427'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.428'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/connections_api.mjs

@@ -126,12 +126,15 @@ function call(method, path, body) {
   });
 }
 
-// The first query every route makes is the caller's own account (the
-// profile_state='active' floor, ADR 0202 D4 §1).
-const meActive = () => result([{ github_id: String(ME.github_id), profile_state: 'active', account_visibility: 'public', handle: 'octo' }]);
+// The first query every route makes is the caller's own account (the CONSENT
+// floor, ADR 0202 D4 §1). Since ADR 0213 that floor is two columns: the hub
+// witnessed the human AND that human accepted the platform terms, both written
+// by the same upsertAccount branch — so a consented fixture carries both.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+const meActive = () => result([{ github_id: String(ME.github_id), profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', handle: 'octo' }]);
 const account = (over = {}) => ({
   github_id: String(ADA), handle: 'ada', display_name: 'Ada', avatar_url: null,
-  profile_state: 'active', account_visibility: 'public', ...over,
+  profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', ...over,
 });
 
 // ===========================================================================
@@ -299,8 +302,9 @@ test('list: my connections, the count IS the array length, and paging is real',
   assert.match(calls[1].text, /LIMIT \$2 OFFSET \$3/,
     'a hard cap with no OFFSET would make the 501st connection unreachable while count still read 500');
   assert.deepEqual(calls[1].params, [ME.github_id, 2, 4]);
-  assert.match(calls[1].text, /\(pa\.profile_state = 'active'\)/,
-    'own scope floors on consent alone — a private account you connected with appears HERE (D4 §2)');
+  assert.match(calls[1].text, /\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\)/,
+    'own scope floors on consent alone — a private account you connected with appears HERE (D4 §2). '
+    + 'Consent is BOTH columns since ADR 0213: the hub witnessed them, and they accepted the platform terms.');
   assert.doesNotMatch(calls[1].text, /account_visibility/,
     "…and applying the PUBLIC predicate here would erase your own connections from your own list");
 });
@@ -478,8 +482,9 @@ test('degree: 3rd degree runs exactly ONE more query, capped at FANOUT_1 then FA
   assertBounded(far.text, 'far');
   assert.deepEqual(far.params, [ME.github_id, String(ADA), conn.FANOUT_1, conn.FANOUT_2],
     'the caps are the ADR 0202 D3 constants, bound as parameters');
-  assert.match(far.text, /\(pa\.profile_state = 'active' AND pa\.account_visibility = 'public'\)/,
-    'a hop BEYOND the viewer\'s own connections must clear the full public predicate');
+  assert.match(far.text, /\(\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\) AND pa\.account_visibility = 'public'\)/,
+    'a hop BEYOND the viewer\'s own connections must clear the full public predicate — the ADR 0213 '
+    + 'consent pair AND the existence axis, composed rather than restated');
 });
 
 test('degree: past DEGREE_MAX the answer is null — "out of network", not a deeper search', async () => {

package/tests/connections_ownership.mjs

@@ -106,9 +106,14 @@ function predicateFor(rawWhere, params) {
   return (r) => tests.every((fn) => fn(r));
 }
 
+// Consent is two columns since ADR 0213 (task 1002913): the hub witnessed this
+// human AND that human accepted the platform terms. Both are written by the same
+// upsertAccount branch, so a genuinely consented account always carries both —
+// and isAccountActive, which every route here floors on, checks both.
 const ACCOUNT = {
   id: 1, github_id: String(ME), github_login: 'octo', display_name: 'Octo', avatar_url: null,
-  profile_state: 'active', hide_stats: false, account_visibility: 'public',
+  profile_state: 'active', terms_accepted_at: '2026-08-29T00:00:00.000Z',
+  hide_stats: false, account_visibility: 'public',
   recruiter_discoverable: null, handle: 'octo', previous_handle: null,
 };
 

package/tests/effective_visibility_predicate.mjs

@@ -256,6 +256,14 @@ const SPELLINGS = [
   [/\bCOALESCE\s*\(\s*(?:[A-Za-z_$][\w$]*|\$\{[^}]*\})?\s*\.?\s*recruiter_discoverable/gi, 'the recruiter-reach COALESCE'],
   [/\bNOT\s+(?:[A-Za-z_][\w]*\.)?hide_stats\b/g, 'a SQL NOT hide_stats'],
   [/\bhide_stats\s*(?:=|==|===)\s*(?:true|false)\b/g, 'hide_stats compared to a boolean'],
+  // The ADR 0213 acceptance half of the consent axis (task 1002913), in the two
+  // syntaxes a drift copy would actually be written in: the SQL NULL test the
+  // owner emits (bare, aliased, or through a `${q}` prefix) and the JS twin's
+  // null comparison. Written against the form the source REALLY carries, because
+  // a rule matching only a spelling nobody uses is the hole task 1002290 found in
+  // the reach COALESCE — the whole reason that entry now pins four forms.
+  [/\bterms_accepted_at\s+IS\s+(?:NOT\s+)?NULL\b/gi, 'a terms-acceptance NULL test'],
+  [/\bterms_accepted_at\s*(?:=|==|===|!=|!==|<>)\s*null\b/gi, 'terms_accepted_at compared to null'],
 ];
 
 function spellingsIn(code) {
@@ -369,6 +377,16 @@ t('SPELLINGS catch a hand-written variant in either language, and leave writes a
   assert.ok(caught('COALESCE(${alias}.recruiter_discoverable, TRUE)'), 'a template alias AND a dot — the drift copy most likely to be written');
   assert.ok(!caught('COALESCE(hide_stats, false)'), 'and it is the REACH column it watches, not any COALESCE');
   assert.ok(caught('AND NOT pa.hide_stats'), 'the hide half of a rollup predicate');
+  // The ADR 0213 consent half, in every form that ships or could drift. The bare
+  // and `${q}` forms are what the owner emits today; the aliased form is what a
+  // drift copy in a joined query would most likely write.
+  assert.ok(caught('AND terms_accepted_at IS NOT NULL'), 'the acceptance NULL test, bare');
+  assert.ok(caught('AND pa.terms_accepted_at IS NOT NULL'), 'the acceptance NULL test, aliased');
+  assert.ok(caught('`AND ${q}terms_accepted_at IS NOT NULL`'), 'the acceptance NULL test, as the builder writes it');
+  assert.ok(caught('WHERE terms_accepted_at IS NULL'), 'and the inverted test — the same decision, negated');
+  assert.ok(caught('if (a.terms_accepted_at != null) return a;'), 'the JS twin of the acceptance test');
+  assert.ok(!caught('COALESCE(platform_identity_accounts.terms_accepted_at, now())'), 'a write is not a predicate');
+  assert.ok(!caught('SELECT profile_state, terms_accepted_at, account_visibility'), 'and naming the column in a projection decides nothing');
   // A WRITE names the column but compares it to nothing — it decides no visibility.
   assert.ok(!caught("profile_state = CASE WHEN $5::boolean THEN 'active' ELSE x END"), 'an upsert is not a predicate');
   assert.ok(!caught("account_visibility: (acct && acct.account_visibility) || 'public'"), 'a projection default is not a predicate');
@@ -439,13 +457,24 @@ t('the alias is the one interpolated thing, and every builder refuses a non-iden
 t('the JS ports answer exactly what the SQL asks, row for row', () => {
   // The table IS the D2 matrix. Each row is checked against BOTH forms, which is
   // the only way "a route and a query cannot drift" is more than a slogan.
+  // ADR 0213 (task 1002913) made consent TWO columns: the hub witnessed the human
+  // (profile_state) AND that human accepted the platform terms (terms_accepted_at).
+  // Both are stamped by the same upsertAccount branch, so `active` + NULL only
+  // occurs for a row predating the terms — which must NOT publish.
+  const ACCEPTED = new Date('2026-08-29T00:00:00Z');
   const rows = [
-    { row: { profile_state: 'active', account_visibility: 'public', hide_stats: false }, visible: true, rollup: true },
-    { row: { profile_state: 'active', account_visibility: 'public', hide_stats: true }, visible: true, rollup: false },
-    { row: { profile_state: 'active', account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
-    { row: { profile_state: 'active', account_visibility: 'private', hide_stats: true }, visible: false, rollup: false },
-    { row: { profile_state: 'provisional', account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
-    { row: { profile_state: 'provisional', account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'public', hide_stats: false }, visible: true, rollup: true },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'public', hide_stats: true }, visible: true, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: ACCEPTED, account_visibility: 'private', hide_stats: true }, visible: false, rollup: false },
+    { row: { profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    // The ADR 0213 axis: witnessed but never accepted (a legacy row, or a state
+    // no post-0213 write can produce) is NOT consented, so it publishes nothing.
+    { row: { profile_state: 'active', terms_accepted_at: null, account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
+    { row: { profile_state: 'active', terms_accepted_at: null, account_visibility: 'private', hide_stats: false }, visible: false, rollup: false },
+    // …and acceptance alone never substitutes for the hub's own witness.
+    { row: { profile_state: 'provisional', terms_accepted_at: ACCEPTED, account_visibility: 'public', hide_stats: false }, visible: false, rollup: false },
   ];
   for (const { row, visible, rollup } of rows) {
     const id = JSON.stringify(row);
@@ -454,7 +483,9 @@ t('the JS ports answer exactly what the SQL asks, row for row', () => {
     // The SQL twin, evaluated the only honest way a DB-free test can: the
     // fragment's own column comparisons, resolved against this row.
     const sqlSaysVisible = /profile_state = 'active'/.test(accountVisibleSql())
+      && /terms_accepted_at IS NOT NULL/.test(accountVisibleSql())
       && row.profile_state === 'active'
+      && row.terms_accepted_at != null
       && row.account_visibility === 'public';
     assert.equal(sqlSaysVisible, visible, `the SQL fragment agrees for ${id}`);
   }
@@ -646,41 +677,59 @@ t('every declared non-public read still exists (a stale declaration is a blind s
 
 console.log('\nbehaviour (an executed privacy boundary):');
 
+// Every consented fixture carries an acceptance stamp, because after ADR 0213
+// (task 1002913) the consent axis is profile_state AND terms_accepted_at — the
+// same upsertAccount branch writes both, so a real consented row always has one.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+
 const ACCOUNTS = [
   { github_id: '4242', github_login: 'octo', display_name: 'Octo', avatar_url: null,
     handle: 'octo', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
   // The private account this whole task exists for.
   { github_id: '5150', github_login: 'ghost', display_name: 'Ghost', avatar_url: null,
     handle: 'ghost', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
   // Private AND recruiter-discoverable — the spec's D2 "private · discoverable"
   // row. Reach must not buy addressability: this one still 404s.
   { github_id: '5151', github_login: 'scout', display_name: 'Scout', avatar_url: null,
     handle: 'scout', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
   // Public but hidden — the axes are independent: the PAGE resolves, the numbers do not.
   { github_id: '6060', github_login: 'shy', display_name: 'Shy', avatar_url: null,
     handle: 'shy', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
   { github_id: '7070', github_login: 'newbie', display_name: 'Newbie', avatar_url: null,
     handle: 'newbie', previous_handle: null, bio: null, links: null, created_at: 'T',
-    profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // ADR 0213 (task 1002913): the hub witnessed this human, but no acceptance of
+  // the platform terms is on record — a row from before the terms existed. Public
+  // and unhidden on every OTHER axis, so if consent were still one column it would
+  // resolve. It must 404: the T&C is what "public by default" was always premised
+  // on, and this account never saw one. It re-publishes on its next hub sign-in.
+  { github_id: '7171', github_login: 'legacy', display_name: 'Legacy', avatar_url: null,
+    handle: 'legacy', previous_handle: null, bio: null, links: null, created_at: 'T',
+    profile_state: 'active', terms_accepted_at: null, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
   // A private account inside the P01 rename window. Its OLD handle must 404 too —
   // a 301 to the current handle would confirm the account exists.
   { github_id: '8080', github_login: 'moved', display_name: 'Moved', avatar_url: null,
     handle: 'moved-now', previous_handle: 'moved-was', bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
   // ...and a PUBLIC one, so the control proves the 301 window still works.
   { github_id: '9090', github_login: 'shifted', display_name: 'Shifted', avatar_url: null,
     handle: 'shifted-now', previous_handle: 'shifted-was', bio: null, links: null, created_at: 'T',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
 ];
 
 // The columns this interpreter knows how to filter on. Anything else in a WHERE
 // clause throws — the guard against a predicate quietly degrading to no filter.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
+// The columns this interpreter knows how to answer an IS [NOT] NULL test on.
+// Separate from KNOWN_COLUMNS because a NULL test is a different syntax the
+// literal-comparison sweep cannot see (ADR 0213 / task 1002913).
+const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
+
 /**
  * Build a row test from a statement's own WHERE clause. Literal comparisons
  * (profile_state = 'active') matter as much as placeholders here, because the
@@ -691,8 +740,22 @@ const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stat
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
+  // NULL-test terms this interpreter actually turned into a filter, as opposed
+  // to column names it merely recognises. The final sweep compares the two.
+  const modelled = new Set();
 
   if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  // The ADR 0213 acceptance half of the consent axis. It is a NULL test, not a
+  // literal comparison, so neither refusal sweep below would have caught it —
+  // an unmodelled IS NOT NULL degrades to no filter exactly like an unread $N.
+  // Hence the third sweep at the end of this function, and hence `modelled`:
+  // the sweep must prove a filter was APPLIED, not merely that the column is a
+  // name it recognises. (Checking recognition alone left this interpreter
+  // scoring a deleted filter as fine — found by mutation while writing it.)
+  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
+    modelled.add('terms_accepted_at');
+    tests.push((r) => r.terms_accepted_at != null);
+  }
   if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
   if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
   // The recruiting-reach COALESCE (task 1002290). Modelled through the shared JS
@@ -721,6 +784,18 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
+  // A NULL test is a filter too. Without this sweep the ADR 0213 acceptance term
+  // could be dropped from the predicate and this interpreter would score it as
+  // absent-and-fine, which is the failure mode the other two sweeps exist to
+  // prevent one syntax over.
+  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
+    if (!KNOWN_NULL_TESTS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+    if (!modelled.has(m[1])) {
+      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it, which is the silent-pass it exists to refuse`);
+    }
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -913,7 +988,7 @@ await ta('private accounts are absent from the leaderboard/directory rollup', as
   const shown = rows.map((r) => r.github_login).sort();
   assert.deepEqual(shown, ['octo', 'shifted'],
     'only active, publicly-visible, unhidden accounts reach /people and /scouting — '
-    + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private`);
+    + `got ${JSON.stringify(shown)}; ghost/scout are private, shy is hidden, newbie is provisional, moved is private, legacy never accepted the terms (ADR 0213)`);
 });
 
 server.close();

package/tests/profile_connections_ui.mjs

@@ -51,6 +51,16 @@ import vm from 'node:vm';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+// The REAL predicates, not a copy. accountFloor() below used to spell these
+// itself, which made it a hand-maintained mirror of account-visibility.js —
+// and it drifted the moment ADR 0213 made consent two columns. Imported, the
+// next change to the shared rule moves this guard with it instead.
+import {
+  accountVisibleSql,
+  accountActiveSql,
+  isAccountVisible,
+  isAccountActive,
+} from '../modules/platform-identity/account-visibility.js';
 
 const require = createRequire(import.meta.url);
 const express = require('express');
@@ -86,7 +96,8 @@ let nextEdgeId = 1;
 
 const acct = (githubId, handle, name, over = {}) => ({
   id: githubId, github_id: String(githubId), github_login: handle, display_name: name,
-  avatar_url: null, profile_state: 'active', hide_stats: false, account_visibility: 'public',
+  avatar_url: null, profile_state: 'active', terms_accepted_at: '2026-08-29T00:00:00.000Z',
+  hide_stats: false, account_visibility: 'public',
   recruiter_discoverable: null, handle, previous_handle: null, handle_changed_at: null,
   bio: null, links: null, display_name_source: 'github',
   created_at: new Date(0).toISOString(), updated_at: new Date(0).toISOString(), ...over,
@@ -111,7 +122,7 @@ function seed() {
     acct(CY, 'cy', 'Cy'),
     acct(ZED, 'zed', 'Zed'),
     acct(VIC, 'vic', 'Vic', { account_visibility: 'private' }),
-    acct(PROV, 'prov', 'Prov', { profile_state: 'provisional' }),
+    acct(PROV, 'prov', 'Prov', { profile_state: 'provisional', terms_accepted_at: null }),
     acct(SEC, 'sec', 'Sec', { account_visibility: 'private' }),
     acct(NEW, 'newbie', 'Newbie'),
     acct(COOL, 'cooled', 'Cooled'),
@@ -195,14 +206,14 @@ function predicateFor(rawWhere, params) {
 // read that stopped joining one of them stops matching here and throws, which
 // is the point: the pool must not be more permissive than the SQL.
 function accountFloor(sql, { alias = 'pa', axis }) {
-  const visible = `(${alias}.profile_state = 'active' AND ${alias}.account_visibility = 'public')`;
-  const active = `(${alias}.profile_state = 'active')`;
+  const visible = accountVisibleSql(alias);
+  const active = accountActiveSql(alias);
   if (axis === 'visible') {
     if (!sql.includes(visible)) throw new Error(`fake pool: expected the public visibility floor ${visible} in — ${sql}`);
-    return (a) => !!a && a.profile_state === 'active' && a.account_visibility === 'public';
+    return isAccountVisible;
   }
   if (!sql.includes(active)) throw new Error(`fake pool: expected the consent floor ${active} in — ${sql}`);
-  return (a) => !!a && a.profile_state === 'active';
+  return isAccountActive;
 }
 
 const iso = (ms) => (ms == null ? null : new Date(ms).toISOString());
@@ -230,9 +241,13 @@ const pool = {
       const hit = accounts
         .filter((a) => String(a.handle).toLowerCase() === want || String(a.previous_handle).toLowerCase() === want)
         .sort((x, y) => Number(String(y.handle).toLowerCase() === want) - Number(String(x.handle).toLowerCase() === want));
+      // Mirrors findAccountByHandle's real projection. terms_accepted_at is part
+      // of it since ADR 0213 — a row missing it reads as unconsented to the JS
+      // twin, which is the silent deny-all this projection must not fake.
       return { rows: hit.slice(0, 1).map((a) => ({
         github_id: a.github_id, handle: a.handle, display_name: a.display_name,
-        avatar_url: a.avatar_url, profile_state: a.profile_state, account_visibility: a.account_visibility,
+        avatar_url: a.avatar_url, profile_state: a.profile_state,
+        terms_accepted_at: a.terms_accepted_at, account_visibility: a.account_visibility,
       })), rowCount: Math.min(hit.length, 1) };
     }
 

package/tests/profile_privacy_owner_view.mjs

@@ -76,23 +76,28 @@ const GHOST = '5150';  // active · PRIVATE         — the owner-renders subjec
 const SHY = '6060';    // active · public · HIDDEN — the no-partial-numbers subject
 const NOSY = '7777';   // active · public          — the stranger at the side door
 
+// ADR 0213 (task 1002913): consent is profile_state AND an acceptance of the
+// platform terms, both written by the same statement — so a consented fixture
+// carries both, and one carrying only the first is a row from before the terms.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+
 const ACCOUNTS = [
   { id: 1, github_id: OCTO, github_login: 'octo', display_name: 'Octo', avatar_url: null,
     handle: 'octo', previous_handle: null, handle_changed_at: null, bio: null, links: null,
     display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
   { id: 2, github_id: GHOST, github_login: 'ghost', display_name: 'Ghost', avatar_url: null,
     handle: 'ghost', previous_handle: null, handle_changed_at: null, bio: 'ghost-bio-515007', links: null,
     display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
-    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
   { id: 3, github_id: SHY, github_login: 'shy', display_name: 'Shy', avatar_url: null,
     handle: 'shy', previous_handle: null, handle_changed_at: null, bio: null, links: null,
     display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
-    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
   { id: 4, github_id: NOSY, github_login: 'nosy', display_name: 'Nosy', avatar_url: null,
     handle: 'nosy', previous_handle: null, handle_changed_at: null, bio: null, links: null,
     display_name_source: 'github', created_at: 'T0', updated_at: 'T0',
-    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+    profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
 ];
 
 // Every number and name the cross-project rollup can produce, per account.
@@ -135,6 +140,10 @@ function sentinelsOf(githubId) {
 // anything else throws — a WHERE it cannot read must never degrade to no WHERE.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
+// Columns this interpreter can answer an IS [NOT] NULL test on — a different
+// syntax from the literal comparisons above, hence its own set (ADR 0213).
+const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
+
 /**
  * Build a row test from a statement's own WHERE text. Literal comparisons carry
  * as much weight as placeholders here: the effective-visibility predicate is
@@ -144,8 +153,18 @@ const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stat
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
+  // NULL-test terms actually turned into a filter, as opposed to column names
+  // merely recognised. The final sweep compares the two (ADR 0213).
+  const modelled = new Set();
 
   if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  // The ADR 0213 consent half. It is a NULL test, not a literal comparison, so
+  // neither sweep below would see it — an unmodelled IS NOT NULL degrades to no
+  // filter exactly like an unread $N, which is what those sweeps exist to refuse.
+  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
+    modelled.add('terms_accepted_at');
+    tests.push((r) => r.terms_accepted_at != null);
+  }
   if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
   if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
 
@@ -173,6 +192,14 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
+  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
+    if (!KNOWN_NULL_TESTS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}"`);
+    }
+    if (!modelled.has(m[1])) {
+      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it`);
+    }
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 

package/tests/profile_route.mjs

@@ -354,25 +354,28 @@ const PROOF_PROJECTS = [
 const sumOf = (k) => PROOF_PROJECTS.reduce((n, p) => n + p[k], 0);
 
 // The one account row the reads consult. setAccountHideStats mutates it.
-const hubAccount = { profile_state: 'active', account_visibility: 'public', hide_stats: false, handle: 'r06-handle' };
+// ADR 0213 (task 1002913): consent is profile_state AND an acceptance of the
+// platform terms, both stamped by the same upsertAccount branch.
+const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
+const hubAccount = { profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false, handle: 'r06-handle' };
 
 // The scouting "table": one visible builder plus the THREE that consent and
 // visibility exclude (the private row joined at task 1002967 — the same axis,
 // enforced by the same shared predicate).
 const SCOUTING_TABLE = [
-  { profile_state: 'active', account_visibility: 'public', hide_stats: false,
+  { profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: false,
     row: { github_id: '11', github_login: 'r06-visible', display_name: 'Visible', avatar_url: null,
       project_count: 2, total_credits: 5, total_tasks_shipped: 1, total_karma: 0,
       last_active: '2026-08-01T00:00:00.000Z', disciplines: ['engineer'] } },
-  { profile_state: 'active', account_visibility: 'public', hide_stats: true,
+  { profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'public', hide_stats: true,
     row: { github_id: '12', github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null,
       project_count: 7, total_credits: 88817, total_tasks_shipped: 6613, total_karma: 5519,
       last_active: '2026-08-02T00:00:00.000Z', disciplines: ['ui'] } },
-  { profile_state: 'provisional', account_visibility: 'public', hide_stats: false,
+  { profile_state: 'provisional', terms_accepted_at: null, account_visibility: 'public', hide_stats: false,
     row: { github_id: '13', github_login: PROV_LOGIN, display_name: 'Provisional', avatar_url: null,
       project_count: 1, total_credits: 71713, total_tasks_shipped: 1, total_karma: 0,
       last_active: '2026-08-03T00:00:00.000Z', disciplines: [] } },
-  { profile_state: 'active', account_visibility: 'private', hide_stats: false,
+  { profile_state: 'active', terms_accepted_at: ACCEPTED_AT, account_visibility: 'private', hide_stats: false,
     row: { github_id: '14', github_login: PRIVATE_LOGIN, display_name: 'Private', avatar_url: null,
       project_count: 3, total_credits: 63127, total_tasks_shipped: 4409, total_karma: 2287,
       last_active: '2026-08-04T00:00:00.000Z', disciplines: ['engineer'] } },
@@ -389,6 +392,7 @@ const engine = {
     if (/AS project_count/.test(sql)) {
       let rows = SCOUTING_TABLE;
       if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/pa\.terms_accepted_at IS NOT NULL/.test(sql)) rows = rows.filter((r) => r.terms_accepted_at != null);
       if (/pa\.account_visibility = 'public'/.test(sql)) rows = rows.filter((r) => r.account_visibility === 'public');
       if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
       return { rows: rows.map((r) => ({ ...r.row })) };
@@ -398,10 +402,13 @@ const engine = {
       hubAccount.hide_stats = !!params[4];
       return { rows: [{ github_id: String(HUB_GITHUB_ID), github_login: 'jaxri', ...hubAccount }] };
     }
-    // getPublicProfileExtras' consent read — three columns since task 1002967
-    // wired the existence axis in (the shared rollupIsVisible port reads them).
-    if (/SELECT profile_state, account_visibility, hide_stats/.test(sql)) {
+    // getPublicProfileExtras' consent read. Matched on the columns it must
+    // carry rather than on the exact SELECT list: pinning the full list meant
+    // that adding terms_accepted_at (ADR 0213) silently unhooked this branch and
+    // the read fell through to the wrong answer with every other test green.
+    if (/SELECT profile_state,.*hide_stats/.test(sql) && /FROM platform_identity_accounts/.test(sql)) {
       return { rows: [{ profile_state: hubAccount.profile_state,
+        terms_accepted_at: hubAccount.terms_accepted_at,
         account_visibility: hubAccount.account_visibility, hide_stats: hubAccount.hide_stats }] };
     }
     // getRollupForBuilder's per-project rows (the client_id → origin two-hop).