@bongos/core 1.19.430 → 1.19.432

package/docs/copy-registry.json

@@ -62,10 +62,10 @@
         "modules/hall-ui/public/settings.js:103",
         "modules/hall-ui/public/settings.js:455",
         "modules/hall-ui/public/settings.js:524",
-        "modules/hall-ui/public/settings.js:669",
-        "modules/hall-ui/public/settings.js:767",
-        "modules/hall-ui/public/settings.js:847",
-        "modules/hall-ui/public/settings.js:1122"
+        "modules/hall-ui/public/settings.js:678",
+        "modules/hall-ui/public/settings.js:776",
+        "modules/hall-ui/public/settings.js:856",
+        "modules/hall-ui/public/settings.js:1131"
       ]
     },
     {
@@ -535,7 +535,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/hall-render.js:855",
-        "modules/hall-ui/public/settings.js:912"
+        "modules/hall-ui/public/settings.js:921"
       ]
     },
     {
@@ -615,7 +615,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/builders.js:356",
-        "modules/hall-ui/public/settings.js:768"
+        "modules/hall-ui/public/settings.js:777"
       ]
     },
     {
@@ -1364,8 +1364,8 @@
       "text": "Your preferences, {…}.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/settings.js:841",
-        "modules/hall-ui/public/settings.js:1374"
+        "modules/hall-ui/public/settings.js:850",
+        "modules/hall-ui/public/settings.js:1383"
       ]
     },
     {
@@ -2781,7 +2781,7 @@
       "surface": "builders-hall",
       "text": "Checking your key…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1099,
+      "line": 1108,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3114,7 +3114,7 @@
       "surface": "builders-hall",
       "text": "Connect Discord & join the server",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 912,
+      "line": 921,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3384,7 +3384,7 @@
       "surface": "builders-hall",
       "text": "Could not copy automatically — select and copy manually. ({…})",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 979,
+      "line": 988,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3645,7 +3645,7 @@
       "surface": "builders-hall",
       "text": "Could not load your account. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1357,
+      "line": 1366,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3672,7 +3672,7 @@
       "surface": "builders-hall",
       "text": "Could not load your settings.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1360,
+      "line": 1369,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3708,7 +3708,7 @@
       "surface": "builders-hall",
       "text": "Could not remove your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1179,
+      "line": 1188,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3717,7 +3717,7 @@
       "surface": "builders-hall",
       "text": "Could not remove. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1178,
+      "line": 1187,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3789,7 +3789,7 @@
       "surface": "builders-hall",
       "text": "Could not save your key. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1123,
+      "line": 1132,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3798,7 +3798,7 @@
       "surface": "builders-hall",
       "text": "Could not save your name. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 848,
+      "line": 857,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3816,7 +3816,7 @@
       "surface": "builders-hall",
       "text": "Could not save your preference. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 768,
+      "line": 777,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3825,7 +3825,7 @@
       "surface": "builders-hall",
       "text": "Could not save your privacy preference. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 670,
+      "line": 679,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3897,7 +3897,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 669,
+      "line": 678,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3906,7 +3906,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 767,
+      "line": 776,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3915,7 +3915,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 847,
+      "line": 856,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3924,7 +3924,7 @@
       "surface": "builders-hall",
       "text": "Could not save. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1122,
+      "line": 1131,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3942,7 +3942,7 @@
       "surface": "builders-hall",
       "text": "Could not set up key storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1159,
+      "line": 1168,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3951,7 +3951,7 @@
       "surface": "builders-hall",
       "text": "Could not set up storage. Try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1158,
+      "line": 1167,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4230,7 +4230,7 @@
       "surface": "builders-hall",
       "text": "Discord connected ✓",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 905,
+      "line": 914,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4239,7 +4239,7 @@
       "surface": "builders-hall",
       "text": "Discord unlinked.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 924,
+      "line": 933,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4581,7 +4581,7 @@
       "surface": "builders-hall",
       "text": "Expires {…} · refreshes on use.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 974,
+      "line": 983,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4725,7 +4725,7 @@
       "surface": "builders-hall",
       "text": "Fresh CLI token issued. Paste it in your terminal:",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 971,
+      "line": 980,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4788,7 +4788,7 @@
       "surface": "builders-hall",
       "text": "Get a free key ↗",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1003,
+      "line": 1012,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5247,7 +5247,7 @@
       "surface": "builders-hall",
       "text": "Image key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1175,
+      "line": 1184,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5463,7 +5463,7 @@
       "surface": "builders-hall",
       "text": "Key removed.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1174,
+      "line": 1183,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5472,7 +5472,7 @@
       "surface": "builders-hall",
       "text": "Key storage is being set up by an Archon — check back shortly. {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1053,
+      "line": 1062,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5481,7 +5481,7 @@
       "surface": "builders-hall",
       "text": "Key storage isn't set up yet. As an Archon you can turn it on now — the server generates and safely stores the master key (no terminal needed).",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1049,
+      "line": 1058,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5553,7 +5553,7 @@
       "surface": "builders-hall",
       "text": "Latest version: v{…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1443,
+      "line": 1452,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5598,7 +5598,7 @@
       "surface": "builders-hall",
       "text": "Link first — your rank role is set the moment you join.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 913,
+      "line": 922,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6048,7 +6048,7 @@
       "surface": "builders-hall",
       "text": "Name cannot be blank.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 816,
+      "line": 825,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6057,7 +6057,7 @@
       "surface": "builders-hall",
       "text": "Name must be {…} characters or fewer.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 821,
+      "line": 830,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6165,7 +6165,7 @@
       "surface": "builders-hall",
       "text": "No builder account found for this sign-in.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1365,
+      "line": 1374,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6903,7 +6903,7 @@
       "surface": "builders-hall",
       "text": "Paste command copied.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 978,
+      "line": 987,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6912,7 +6912,7 @@
       "surface": "builders-hall",
       "text": "Paste your key first.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1098,
+      "line": 1107,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7236,7 +7236,7 @@
       "surface": "builders-hall",
       "text": "Re-issue failed: {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 983,
+      "line": 992,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7461,7 +7461,7 @@
       "surface": "builders-hall",
       "text": "Remove your image-generation key? Art generation will stop until you add one again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1166,
+      "line": 1175,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7749,7 +7749,7 @@
       "surface": "builders-hall",
       "text": "Save key",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1034,
+      "line": 1043,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8028,7 +8028,7 @@
       "surface": "builders-hall",
       "text": "Set up key storage",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1050,
+      "line": 1059,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8046,7 +8046,7 @@
       "surface": "builders-hall",
       "text": "Setting up key storage…",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1134,
+      "line": 1143,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9243,7 +9243,7 @@
       "surface": "builders-hall",
       "text": "Unlink failed: {…}",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 929,
+      "line": 938,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9783,7 +9783,7 @@
       "surface": "builders-hall",
       "text": "You're in the {…} server with your rank role.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 906,
+      "line": 915,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9891,7 +9891,7 @@
       "surface": "builders-hall",
       "text": "Your image-generation key settings could not be loaded. Reload the page to try again.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1201,
+      "line": 1210,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9909,7 +9909,7 @@
       "surface": "builders-hall",
       "text": "Your name cannot be blank.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 817,
+      "line": 826,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9918,7 +9918,7 @@
       "surface": "builders-hall",
       "text": "Your name must be {…} characters or fewer.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 822,
+      "line": 831,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9945,7 +9945,7 @@
       "surface": "builders-hall",
       "text": "Your preferences, {…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 841,
+      "line": 850,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9954,14 +9954,14 @@
       "surface": "builders-hall",
       "text": "Your preferences, {…}.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1374,
+      "line": 1383,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
     {
-      "id": "73ee3dc369a5",
+      "id": "b6dceaace783",
       "surface": "builders-hall",
-      "text": "Your profile page setting applies now — private already answers \"not found\" everywhere your profile is read. Recruiter discoverability applies now too — switching it off takes you out of the People directory immediately, and back on puts you there again.",
+      "text": "Your profile page setting applies now — private already answers \"not found\" everywhere your profile is read. Recruiter discoverability applies now too — switching it off removes you from both recruiting surfaces immediately, and back on puts you there again.",
       "file": "modules/hall-ui/public/settings.html",
       "line": 110,
       "origin": "html-text",
@@ -11700,7 +11700,7 @@
       "surface": "builders-hall",
       "text": "{…} · Stored encrypted; never shown again after saving.",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 1036,
+      "line": 1045,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11799,7 +11799,7 @@
       "surface": "builders-hall",
       "text": "· follows your profile setting",
       "file": "modules/hall-ui/public/settings.js",
-      "line": 622,
+      "line": 631,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -357,6 +357,7 @@ tests/
 ├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
+├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```
 

package/docs/module-api-changelog.md

@@ -1297,5 +1297,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.428 with no explicit bump. run 33274860035. (task 1002620)
   1.19.430 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.429 with no explicit bump. run 33275468532. (task 1002620)
+  1.19.431 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.430 with no explicit bump. run 33277001235. (task 1002620)
+  1.19.432 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.431 with no explicit bump. run 33279328366. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -704,6 +704,8 @@ function createClient(opts = {}) {
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
+      // GET /scouting/{handle} — rank: archon — GET /scouting/:handle
+      getScoutingHandle: (args) => request("GET", "/scouting/{handle}", { hasBody: false }, args),
     },
     "search": {
       // POST /search — rank: any-builder — POST /search

package/modules/hall-ui/public/settings.html

@@ -109,7 +109,7 @@
               <p class="settings-status" id="privacy-status" role="status" aria-live="polite"></p>
               <p class="section-note">Your profile page setting applies now — private already answers "not found"
                 everywhere your profile is read. Recruiter discoverability applies now too — switching
-                it off takes you out of the People directory immediately, and back on puts you there again.</p>
+                it off removes you from both recruiting surfaces immediately, and back on puts you there again.</p>
             </section>
 
             <!-- CRAFT — discipline preferences (GET /me, PATCH /me/disciplines). -->

package/modules/hall-ui/public/settings.js

@@ -601,10 +601,15 @@
   // read joins the shared effective-visibility predicate, so private really does
   // 404 — including to the owner, which the row must say out loud: a page that
   // vanishes for you too is surprising unless you are told where your record went
-  // (here, Settings). DISCOVERABILITY went live with task 1002290:
-  // listScoutingRollup joins the reach predicate, so opting out really does empty
-  // the People directory of you. It names THAT surface and no wider set: the D3
-  // sliver is unbuilt, and no guard holds a promise about a surface that is not.
+  // (here, Settings). DISCOVERABILITY went live in two halves: task 1002290 (the People directory)
+  // and task 1002968 (the D3 pre-accept sliver). BOTH recruiting reads now join
+  // the reach axis — listScoutingRollup via scoutingListableSql, the sliver via
+  // recruiterSliverVisibleSql — so the row may finally name both, which is exactly
+  // what 1002290 narrowed it away from while the second surface was unbuilt. The
+  // wider claim is CHECKABLE rather than open-ended: account_privacy_flags.mjs
+  // pins that the recruiting surface has exactly those two reads and that each one
+  // joins reach, so a third would red the guard before this sentence could quietly
+  // become false.
   function renderPrivacy(data) {
     const wrap = $('#privacy-rows');
     if (!wrap) return;
@@ -612,13 +617,17 @@
     const discoverable = !!(data && data.recruiter_discoverable_effective);
     const follows = !data || data.recruiter_discoverable == null;
     const grant = data && data.hide_stats
-      ? 'Because your cross-project record is hidden, they will see your name and nothing else.'
-      : 'They will see your name, your disciplines, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on.';
+      ? 'Because your cross-project record is hidden, they will see your name and your picture, and nothing else.'
+      : 'They will see your name, your picture, your disciplines, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on.';
+    // The surprising half, and only where it applies: a private profile answers
+    // "not found" to every visitor, and this one switch is the exception.
+    const despitePrivate = isPublic ? ''
+      : ' This is the one thing a recruiter can see while your profile page is private.';
     wrap.innerHTML =
       privacyRow('visibility', 'Public profile page', isPublic ? 'Public' : 'Private', isPublic,
         'Public means anyone can open your profile page and find you by name. Private hides the page from everyone — including you: it answers "not found" to every visitor, and you read your own record here in Settings instead.', '') +
       privacyRow('discoverable', 'Discoverable by recruiters', discoverable ? 'On' : 'Off', discoverable,
-        `Recruiters looking for builders can find you. ${grant} Turning this off takes you out of the People directory straight away.`,
+        `Recruiters looking for builders can find you. ${grant}${despitePrivate} Turning this off removes you from both recruiting surfaces — the People directory, and a recruiter's look-up of one builder — straight away.`,
         follows ? ' <span class="voices__default">· follows your profile setting</span>' : '');
   }
 
@@ -646,7 +655,7 @@
     }
     return on
       ? 'Saved — recruiters can find you.'
-      : 'Saved — you are out of the People directory.';
+      : 'Saved — you are out of the recruiting surfaces.';
   }
 
   // PATCH any own-scoped privacy flag (routes/profile.js): { hide_stats } and/or

package/modules/platform-identity/account-visibility.js

@@ -34,6 +34,11 @@
 //   scoutingListableSql                    THE DIRECTORY — numbers AND reach,
 //       the ONE predicate the recruiting directory joins (ADR 0210, task
 //       1002290). Composed, never restated.
+//   recruiterSliverVisibleSql / isRecruiterSliverVisible  THE PRE-ACCEPT
+//       SLIVER — consent AND reach, WITHOUT the existence axis (ADR 0215, task
+//       1002968; privacy spec D3). The one predicate that deliberately does not
+//       floor on accountVisibleSql, because a PRIVATE, discoverable account is
+//       precisely its subject. Composed, never restated.
 //
 // The rollup pair was originally left to "the rollup readers" to apply. Task
 // 1002967 moved it here for the reason this file exists: there are two such
@@ -200,6 +205,46 @@ function scoutingListableSql(alias) {
   return `(${rollupVisibleSql(alias)} AND ${recruiterReachSql(alias)})`;
 }
 
+// recruiterSliverVisibleSql — THE predicate the PRE-ACCEPT recruiter sliver
+// joins: the CONSENT floor AND the reach axis (ADR 0215, privacy spec D3; task
+// 1002968). modules/platform-identity/recruiter-sliver.js is its one reader.
+//
+// WHY IT FLOORS ON CONSENT AND NOT ON EXISTENCE — the one deliberate difference
+// in this file. Every other public answer here ANDs accountVisibleSql, which
+// carries account_visibility = 'public'. This one must not, because the account
+// the D3 sliver EXISTS to serve is the private, explicitly-discoverable one —
+// the privacy spec's D2 "private, discoverable" row. Flooring on the existence
+// axis would empty the sliver of exactly its subject and leave it a redundant,
+// poorer copy of the directory.
+//
+// THAT IS SAFE ONLY BECAUSE THE REACH HALF IS AN EXPLICIT OPT-IN FOR A PRIVATE
+// ACCOUNT. recruiterReachSql is COALESCE(recruiter_discoverable, visibility =
+// 'public'): for a private account the NULL default resolves to FALSE, so a
+// private account reaches this surface only when its owner set the flag to true
+// by hand. Dropping the existence axis therefore widens nothing on its own — it
+// hands the decision to the account, which is what consent means.
+//
+// profile_state = 'active' still floors it, so a PROVISIONAL account is never
+// recruiter-visible (spec D3, said out loud). And this predicate answers only
+// WHO may appear; WHAT appears is the whitelist in recruiter-sliver.js, which
+// shrinks to name-only under hide_stats. Never authority (ADR 0016): being
+// reachable by a recruiter grants the account nothing and costs it nothing.
+function recruiterSliverVisibleSql(alias) {
+  // Validated here as well as in both delegates, for the scoutingListableSql
+  // reason: a security property must not rest on template evaluation order, and
+  // the error should name the function the caller actually called.
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('recruiterSliverVisibleSql: alias must be a bare SQL identifier');
+  }
+  return `(${accountActiveSql(alias)} AND ${recruiterReachSql(alias)})`;
+}
+
+// The JS twin of recruiterSliverVisibleSql, for a reader that already holds the
+// row. Fail-closed on an absent account, like every port above it.
+function isRecruiterSliverVisible(account) {
+  return isAccountActive(account) && isRecruiterDiscoverable(account);
+}
+
 module.exports = {
   isAccountVisible,
   accountVisibleSql,
@@ -211,4 +256,6 @@ module.exports = {
   isRecruiterDiscoverable,
   recruiterReachSql,
   scoutingListableSql,
+  recruiterSliverVisibleSql,
+  isRecruiterSliverVisible,
 };

package/modules/platform-identity/platform-identity.js

@@ -947,9 +947,9 @@ async function setAccountHideStats({ githubId, githubLogin, displayName, avatarU
 // touches ONLY the flags the caller sent — never identity re-sync, never
 // profile_state (activation stays /sso/authorize's alone, D3), never hide_stats
 // (which keeps its own writer, setAccountHideStats).
-//
-// recruiter_discoverable accepts null on purpose: that is the caller RESETTING
-// the flag to "follow visibility", not an omitted field.
+// recruiter_discoverable accepts null on purpose (the caller RESETTING it to
+// "follow visibility"), and GOING PRIVATE resets it too unless the PATCH names
+// it — a true set while PUBLIC is not consent to be seen once private (ADR 0215).
 async function setAccountPrivacy({ githubId, githubLogin, displayName, avatarUrl, fields = {} }, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return { error: 'no_account' };
   const setVisibility = 'account_visibility' in fields;
@@ -970,7 +970,7 @@ async function setAccountPrivacy({ githubId, githubLogin, displayName, avatarUrl
        account_visibility     = CASE WHEN $7::boolean THEN EXCLUDED.account_visibility
                                      ELSE platform_identity_accounts.account_visibility END,
        recruiter_discoverable = CASE WHEN $8::boolean THEN EXCLUDED.recruiter_discoverable
-                                     ELSE platform_identity_accounts.recruiter_discoverable END,
+                                     WHEN $7::boolean AND EXCLUDED.account_visibility = 'private' THEN NULL ELSE platform_identity_accounts.recruiter_discoverable END,
        updated_at = now()
      RETURNING github_id, github_login, profile_state, hide_stats,
                account_visibility, recruiter_discoverable, handle`,