@bongos/core 1.19.427 → 1.19.429

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1580,
-    "unique_ids": 1374,
-    "certain": 1580,
+    "strings": 1589,
+    "unique_ids": 1383,
+    "certain": 1589,
     "heuristic": 0,
     "duplicate_ids": 157
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 73,
-      "strings": 1164
+      "files": 74,
+      "strings": 1165
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -23,7 +23,7 @@
     "landing": {
       "at": "public-landing",
       "files": 5,
-      "strings": 318
+      "strings": 326
     }
   },
   "blind_spots": [
@@ -92,7 +92,7 @@
         "public-landing/index.html:900",
         "public-landing/privacy.html:80",
         "public-landing/projects.html:1115",
-        "public-landing/terms.html:76"
+        "public-landing/terms.html:84"
       ]
     },
     {
@@ -105,7 +105,7 @@
         "public-landing/index.html:900",
         "public-landing/privacy.html:80",
         "public-landing/projects.html:1115",
-        "public-landing/terms.html:76"
+        "public-landing/terms.html:84"
       ]
     },
     {
@@ -142,7 +142,7 @@
         "public-landing/contact.html:71",
         "public-landing/index.html:900",
         "public-landing/privacy.html:80",
-        "public-landing/terms.html:76"
+        "public-landing/terms.html:84"
       ]
     },
     {
@@ -623,7 +623,7 @@
       "text": "Cross-project record",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/profile.html:47",
+        "modules/hall-ui/public/profile.html:52",
         "modules/hall-ui/public/settings.html:86"
       ]
     },
@@ -1104,7 +1104,7 @@
       "occurrences": 2,
       "at": [
         "public-landing/privacy.html:75",
-        "public-landing/terms.html:71"
+        "public-landing/terms.html:79"
       ]
     },
     {
@@ -1183,8 +1183,8 @@
       "text": "Request sent",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/profile-connections.js:82",
-        "modules/hall-ui/public/profile-connections.js:130"
+        "modules/hall-ui/public/profile-connections.js:86",
+        "modules/hall-ui/public/profile-connections.js:134"
       ]
     },
     {
@@ -1414,7 +1414,7 @@
       "occurrences": 2,
       "at": [
         "public-landing/privacy.html:72",
-        "public-landing/terms.html:72"
+        "public-landing/terms.html:80"
       ]
     },
     {
@@ -1484,7 +1484,7 @@
       "occurrences": 2,
       "at": [
         "public-landing/contact.html:59",
-        "public-landing/terms.html:72"
+        "public-landing/terms.html:80"
       ]
     },
     {
@@ -2141,7 +2141,7 @@
       "surface": "builders-hall",
       "text": "Activity, by craft",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 84,
+      "line": 89,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -2663,7 +2663,7 @@
       "surface": "builders-hall",
       "text": "By the numbers",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 37,
+      "line": 42,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -3599,7 +3599,7 @@
       "surface": "builders-hall",
       "text": "Could not load the profile.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 620,
+      "line": 625,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4112,7 +4112,7 @@
       "surface": "builders-hall",
       "text": "Cross-project record",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 47,
+      "line": 52,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -4517,7 +4517,7 @@
       "surface": "builders-hall",
       "text": "Every idea this builder captured — promoted, discarded, merged, or still open.",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 104,
+      "line": 109,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -4895,7 +4895,7 @@
       "surface": "builders-hall",
       "text": "Goals created",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 96,
+      "line": 101,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -5201,7 +5201,7 @@
       "surface": "builders-hall",
       "text": "Ideas filed, and what became of them",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 103,
+      "line": 108,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -5678,7 +5678,7 @@
       "surface": "builders-hall",
       "text": "Loading profile…",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 23,
+      "line": 28,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7334,7 +7334,7 @@
       "surface": "builders-hall",
       "text": "Recent works",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 61,
+      "line": 66,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -7577,7 +7577,7 @@
       "surface": "builders-hall",
       "text": "Request sent",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 82,
+      "line": 86,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7586,7 +7586,7 @@
       "surface": "builders-hall",
       "text": "Request sent",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 130,
+      "line": 134,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7905,6 +7905,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a9c398651862",
+      "surface": "builders-hall",
+      "text": "See the cross-project record",
+      "file": "modules/hall-ui/public/profile-canonical.js",
+      "line": 114,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "17d5b5739f46",
       "surface": "builders-hall",
@@ -8162,7 +8171,7 @@
       "surface": "builders-hall",
       "text": "Sign in to the platform once to activate your profile before connecting.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 216,
+      "line": 220,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8288,7 +8297,7 @@
       "surface": "builders-hall",
       "text": "Something went wrong. Try again.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 271,
+      "line": 275,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8594,7 +8603,7 @@
       "surface": "builders-hall",
       "text": "That request is no longer available.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 266,
+      "line": 270,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8729,7 +8738,7 @@
       "surface": "builders-hall",
       "text": "The most recent works this builder has shipped.",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 62,
+      "line": 67,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -8954,7 +8963,7 @@
       "surface": "builders-hall",
       "text": "They have asked to connect.",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 199,
+      "line": 203,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9458,7 +9467,7 @@
       "surface": "builders-hall",
       "text": "What this builder has done, seen one craft at a time.",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 85,
+      "line": 90,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -9638,7 +9647,7 @@
       "surface": "builders-hall",
       "text": "Works completed",
       "file": "modules/hall-ui/public/profile.html",
-      "line": 91,
+      "line": 96,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -11420,7 +11429,7 @@
       "surface": "builders-hall",
       "text": "{…} asking to connect",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 132,
+      "line": 136,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11663,7 +11672,7 @@
       "surface": "builders-hall",
       "text": "{…} you have sent",
       "file": "modules/hall-ui/public/profile-connections.js",
-      "line": 133,
+      "line": 137,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12257,7 +12266,7 @@
       "surface": "landing",
       "text": "A non-profit, capture-resistant commons.",
       "file": "public-landing/terms.html",
-      "line": 76,
+      "line": 84,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12518,7 +12527,7 @@
       "surface": "landing",
       "text": "Built by agents, on Cloud Bongos.",
       "file": "public-landing/terms.html",
-      "line": 76,
+      "line": 84,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12698,7 +12707,7 @@
       "surface": "landing",
       "text": "Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.",
       "file": "public-landing/terms.html",
-      "line": 65,
+      "line": 73,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12779,7 +12788,7 @@
       "surface": "landing",
       "text": "Fair use",
       "file": "public-landing/terms.html",
-      "line": 64,
+      "line": 72,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12882,6 +12891,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "0808df6e434c",
+      "surface": "landing",
+      "text": "From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform’s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.",
+      "file": "public-landing/terms.html",
+      "line": 69,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "8bb1f00b1558",
       "surface": "landing",
@@ -13170,6 +13188,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "69400ca12477",
+      "surface": "landing",
+      "text": "Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.",
+      "file": "public-landing/terms.html",
+      "line": 68,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "8329bb1a3693",
       "surface": "landing",
@@ -13238,7 +13265,7 @@
       "surface": "landing",
       "text": "Open source (AGPL-3.0)",
       "file": "public-landing/terms.html",
-      "line": 76,
+      "line": 84,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13382,7 +13409,7 @@
       "surface": "landing",
       "text": "Questions go through the",
       "file": "public-landing/terms.html",
-      "line": 72,
+      "line": 80,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13400,7 +13427,7 @@
       "surface": "landing",
       "text": "Read the source.",
       "file": "public-landing/terms.html",
-      "line": 71,
+      "line": 79,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13881,6 +13908,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "198f1eac5a95",
+      "surface": "landing",
+      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once — signing in again does not change the original date. This is version",
+      "file": "public-landing/terms.html",
+      "line": 70,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",
@@ -13944,12 +13980,21 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "02e596cc4569",
+      "surface": "landing",
+      "text": "These numbers describe; they do not govern.",
+      "file": "public-landing/terms.html",
+      "line": 67,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "ea7de26ce2f0",
       "surface": "landing",
       "text": "These terms ship with the software and change with it. The version served on this page is the one that applies; the repository keeps the history.",
       "file": "public-landing/terms.html",
-      "line": 71,
+      "line": 79,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14003,7 +14048,7 @@
       "surface": "landing",
       "text": "To the extent the law allows, the people running {{productName}} are not liable for loss arising from its use. It is free software, offered without warranty, as the AGPL-3.0 states.",
       "file": "public-landing/terms.html",
-      "line": 68,
+      "line": 76,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14106,6 +14151,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "9b3312899fb1",
+      "surface": "landing",
+      "text": "What is public.",
+      "file": "public-landing/terms.html",
+      "line": 68,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "b19e6b7ddc42",
       "surface": "landing",
@@ -14142,6 +14196,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "6130dcb60532",
+      "surface": "landing",
+      "text": "What you control.",
+      "file": "public-landing/terms.html",
+      "line": 69,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "b938baf0f723",
       "surface": "landing",
@@ -14250,6 +14313,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "0f06f7e72ea7",
+      "surface": "landing",
+      "text": "Your acceptance is recorded.",
+      "file": "public-landing/terms.html",
+      "line": 70,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "a4d2357d486b",
       "surface": "landing",
@@ -14358,6 +14430,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "cd379e3e0111",
+      "surface": "landing",
+      "text": "Your work across projects",
+      "file": "public-landing/terms.html",
+      "line": 65,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "bb158e10340b",
       "surface": "landing",
@@ -14444,7 +14525,7 @@
       "surface": "landing",
       "text": "contact page",
       "file": "public-landing/terms.html",
-      "line": 72,
+      "line": 80,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14606,7 +14687,7 @@
       "surface": "landing",
       "text": "privacy page",
       "file": "public-landing/terms.html",
-      "line": 72,
+      "line": 80,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -244,7 +244,7 @@
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)
 │       └── map.js               ← (Phase D + ADR 0012): two-grid INITIAL_MAP {ground, objects}; isBlocked checks both layers (mirrors public/game/world/{terrain,map}.js)
 │   (public-status/ moved to modules/status-ui/public/ in BV1.R84 — see the modules/ block above)
-│   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
+│   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; ideas.{html,js,css}=the Full Idea composer (task 1002928 / R152 of goal 1000062 — the five R141 fields with a live R142 completeness meter, both fetched from the server so the page carries no copy of the rules; drafts in localStorage so navigation costs nothing. Task 1002930 / R154 added the SPARK QUEUE above it and a second mode: `?develop=<id>` reuses the same form to develop a spark — the spark's words shown above the fields, its title read-only, and the file routed to POST /inbox/:id/develop instead of POST /inbox, under its own per-idea draft key); idea.html/idea.js=the idea-detail PAGE (/idea/:id, task 1002929 / R153 — the SECOND two-segment hall page after /task/:id: grade, the five answers in template order, the score, and both attributions. The GRADE decides what the page contains — a quick idea gets no five-field skeleton. task-detail.js keeps the #/idea/N overlay because ~320 of its lines are the Metic+ triage panel; the overlay now links here); profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); profile-connections.js=section 6 of that page, the hub-only connections block (task 1002296 / R20 of goal 1000045 — the viewer-relative 1st/2nd/3rd/out-of-network label, the mutuals it was computed from, the connect button, and on your own profile both request queues plus your connections ledger. Loaded BEFORE profile.js, which calls window.OTBConnections.render behind a guard, so a page that omits the script simply has no section; the section reveals only when the hub's /connections routes answer, exactly as the cross-project record does. ADR 0212 records why it is on this page rather than the not-yet-built /u/&lt;handle&gt;, and why it addresses a builder by github_login and then uses the canonical handle the API echoes back); profile-canonical.js=the canonical-profile wiring for that page (task 1002804 / P08, ADR 0214 — on a FEDERATED instance the rel=canonical plus the visible "see the cross-project record" link-out ADR 0171 D1 asks for; on the HUB the numeric ?id= form redirects to the handle URL instead, because a page cannot both redirect to a URL and declare it canonical. All three read ONE resolver, modules/platform-identity/canonical-profile.js, which answers null while /u/&lt;handle&gt; does not exist — so everything is dark today and one boolean turns it all on together); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
 ├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
 ├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json; release recipe docs/recipes/devbox-app-release.md
@@ -351,10 +351,12 @@ tests/
 ├── own_scope_guard.mjs           ← (task 1003343, goal 1000045 criterion own-scope-held-by-a-test): the OWN-SCOPE structural guard, generalised out of memory_isolation.mjs. An explicit inventory of own-scoped route files; inside them the route's declared PATH decides — a path naming no builder must never read a subject from the request (direct, optional-chained, destructured, aliased, computed-key or header), a path that DOES name one needs a per-route exemption whose gate the guard verifies is present. Repo-wide backstop: any file mounting a `/me` route must be in the inventory. Source-grepping, so it runs in the DB-free `unit` lane.
 ├── account_existence_rate_limit.mjs ← (task 1003339, goal 1000045, ADR 0209): the two PUBLIC account-existence probes (onboarding GET /access-requests/status + core GET /auth/web/admission-status) share ONE per-IP budget. Counts to the limit on each route, proves the budget is shared in both directions and when alternated, moves Date.now to prove the window slides on the real mounted route, and proves a refused probe issues no query. DB-free; mutation-checked three ways.
 ├── effective_visibility_predicate.mjs ← (task 1002967, goal 1000045): the EFFECTIVE-VISIBILITY structural guard over `modules/platform-identity/account-visibility.js` (the file task 1002295 landed and this task ADOPTED rather than duplicating). Three layers — SQL and JS agree row-for-row over the privacy-spec D2 matrix; that file is the only one allowed to compare `profile_state`/`account_visibility`/`hide_stats` to a literal (per-occurrence exemptions, each with a reason and a checked obligation); and every `SELECT` on `platform_identity_accounts` is enumerated FROM SOURCE and must join a shared predicate, be declared non-public, or be a checked deferral to a named caller — so a read that does not exist yet (hub search, the sitemap) fails the build until its author classifies it. Behavioural half runs the real `/profiles/:handle` route over an in-memory accounts table filtered by each statement's own WHERE clause: private → 404 (never 403), byte-identical to stranger and owner alike. DB-free `unit` lane.
+├── canonical_profile_url.mjs      ← (task 1002804, goal 1000045 criterion C1, ADR 0214): the P08 proof — the canonical profile URL is resolved in ONE place, `handle` reaches `GET /builders/:id/profile` under the EXISTENCE predicate (so a hidden builder keeps their address), absent/provisional/private are BYTE-IDENTICAL so the numeric-id redirect cannot become an existence oracle, and the widened response still leaks no private column. Real core router over a WHERE-derived fake pool on a real socket; the real browser script in a vm above a stub DOM, run twice — as shipped (every surface dark, because `/u/<handle>` still 404s) and with the liveness constant flipped, so the three live behaviours are proved rather than deferred. Asserts its own DB-free lane membership. DB-free `unit` lane.
 ├── application_lifecycle.mjs     ← (task 1002284, goal 1000045, ADR 0201 D1/D3.2/D4 + ADR 0208): the application lifecycle EXECUTED — apply, list-pending, approve, decline, RESCIND (`invited → dismissed`), idempotency on the state already held, and the two things that must never happen: a builder without `access_request.review` moving the queue, and a VOUCH buying admission. Real router, REAL `requirePermission` resolving against the real government catalog's rank seed, and the REAL `hasInvitedAccessRequest` from `src/bongos/db-kernel.js` pointed at the same in-memory `access_requests` table (a stubbed `./pool`), whose filter is built from each statement's own WHERE clause and which refuses a predicate it cannot read. The no-authority proof seeds a vouched row and asserts the approve path and the admission read are byte-identical to the unvouched twin, and that no statement on either path names `applicant_github_id`/`vouched_at`. DB-free `unit` lane.
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
 ├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
+├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```
 

package/docs/module-api-changelog.md

@@ -1291,5 +1291,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.425 with no explicit bump. run 33270772607. (task 1002620)
   1.19.427 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.426 with no explicit bump. run 33271340372. (task 1002620)
+  1.19.428 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.427 with no explicit bump. run 33274315388. (task 1002620)
+  1.19.429 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.428 with no explicit bump. run 33274860035. (task 1002620)
 ---------------------------------------------------------------------------
 ```