@bongos/core 1.19.430 → 1.19.432

package/tests/connections_ownership.mjs

@@ -71,6 +71,22 @@ const row = (id) => rows.find((r) => r.id === id);
  * Build a row filter from a statement's own WHERE text. Every placeholder the
  * clause mentions must be consumed by a fragment below; one that is not throws,
  * so a predicate this cannot read can never degrade into "no constraint".
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS (task 1003354, idea 1000877). Every matched
+ * term is now BLANKED to ` TRUE `, and whatever survives must be a pure
+ * conjunction — whitespace, parentheses and `AND`. Two things that used to slip
+ * through in silence:
+ *
+ *   A LITERAL-ONLY term binds no placeholder, so the sweep below cannot see it.
+ *     `AND seen_at IS NULL` appearing (or disappearing) changed nothing here.
+ *   AN `AND` REWRITTEN TO `OR` is the dangerous one on THIS table: accept and
+ *     decline are `id = $1 AND addressee_github_id = $2::bigint AND status =
+ *     'pending'`, so an `OR` would let anyone accept anyone's request by id —
+ *     the exact isolation this file exists to prove. A term-collecting
+ *     interpreter re-imposes the `AND` and stays green through it.
+ *
+ * The remove path's either-side disjunction is the ONE legitimate `OR`, and it
+ * is consumed as a whole unit before the check, which is what lets it survive.
  */
 function predicateFor(rawWhere, params) {
   let where = rawWhere;
@@ -89,13 +105,17 @@ function predicateFor(rawWhere, params) {
   }
 
   let m;
-  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
-  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
-  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
-  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
+  // Each matcher BLANKS what it consumed, so the residue below is exactly the
+  // part of the clause this interpreter did not understand.
+  const eat = () => { where = where.replace(m[0], ' TRUE '); };
+  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
+  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); eat(); }
+  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); eat(); }
+  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
   if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.created_at > Date.now() - days * DAY);
+    eat();
   }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
@@ -103,6 +123,10 @@ function predicateFor(rawWhere, params) {
       throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
     }
   }
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, never a silently different filter`);
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -209,6 +233,22 @@ test('the interpreter refuses a predicate it cannot read, rather than ignoring i
     /unread predicate on \$2/,
     'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens'
   );
+  assert.throws(
+    () => predicateFor("id = $1 AND seen_at IS NULL", [1]),
+    /unmodelled boolean structure/,
+    'a literal-only term binds no placeholder, so the sweep above cannot see it at all'
+  );
+  assert.throws(
+    () => predicateFor("id = $1 OR addressee_github_id = $2::bigint", [1, ME]),
+    /unmodelled boolean structure/,
+    'and the one that matters here: with OR, accept/decline would act on ANY row matching the id '
+    + 'alone — anyone accepting anyone\'s request. A term-collecting interpreter re-imposes the AND '
+    + 'and every isolation assertion below stays green (idea 1000877, task 1003354)'
+  );
+  assert.doesNotThrow(
+    () => predicateFor("id = $1 AND addressee_github_id = $2::bigint AND status = 'pending'", [1, ME]),
+    'and the real accept/decline clause still parses clean'
+  );
 });
 
 test('the interpreter really does narrow on the owner column', () => {

package/tests/effective_visibility_predicate.mjs

@@ -79,6 +79,8 @@ import {
   isRecruiterDiscoverable,
   recruiterReachSql,
   scoutingListableSql,
+  recruiterSliverVisibleSql,
+  isRecruiterSliverVisible,
 } from '../modules/platform-identity/account-visibility.js';
 
 const require = createRequire(import.meta.url);
@@ -119,6 +121,10 @@ const SPELLING_EXEMPTIONS = [
       text: 'hide_stats = true',
       count: 1,
       why: "hiddenGithubIds asks the OPPOSITE question to visibility — 'which of these accounts have hidden themselves' — for the closeness-graph consent gate. It must stay fail-closed on hide alone (ADR 0171 D4), so it is not expressible as the shared predicate and is not a variant of it.",
+    }, {
+      text: "account_visibility = '",
+      count: 1,
+      why: "setAccountPrivacy's ON CONFLICT branch, and a WRITE rather than a read gate — it reads EXCLUDED, the value being written, to decide whether this PATCH re-arms recruiter_discoverable to its 'follow visibility' default. Going private without naming reach must clear an explicit true, because that true was set while PUBLIC and meant 'recruiters may see my public profile' (ADR 0215, task 1002968); the D3 sliver has no existence floor and would otherwise read that stale consent as fresh. It gates no read, so it cannot be expressed as the shared predicate and is not a variant of one — the SPELLINGS comment already excludes writes in principle, and this is the occurrence its regex cannot tell apart.",
     }],
     obligation: (code) => /require\(\s*'\.\/account-visibility'\s*\)/.test(code),
     demands: 'still imports the shared predicate rather than re-deriving one',
@@ -341,8 +347,14 @@ function accountStatements(code) {
  * recruiterReachSql inside the owner file, so a reader that joins it has adopted
  * the shared rule — but it must be named here, or wiring the recruiting reach in
  * would read as a reader that stopped adopting anything.
+ * recruiterSliverVisibleSql (task 1002968) is here on the same terms and one
+ * caveat: it is the ONE composed answer that deliberately omits the existence
+ * axis, because the private-but-discoverable account is the D3 sliver's subject.
+ * That is a decision recorded in the owner file and asserted above — not a
+ * reader quietly dropping a term, which is what this regex would otherwise let
+ * through unnoticed.
  */
-const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|isAccountVisible|isAccountActive|isRollupVisible)\s*\(/;
+const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|recruiterSliverVisibleSql|isAccountVisible|isAccountActive|isRollupVisible|isRecruiterSliverVisible)\s*\(/;
 
 // ===========================================================================
 // Self-tests — the machinery is the guard, so it gets proved too.
@@ -513,6 +525,30 @@ t('the recruiter-reach predicate still lives here, and is still the only COALESC
     'reach never buys addressability — that is what the D3 sliver is for');
 });
 
+t('recruiterSliverVisibleSql is COMPOSED from consent AND reach, and omits existence ON PURPOSE (task 1002968)', () => {
+  // The pre-accept sliver is the one effective answer that must NOT floor on the
+  // existence axis: the privacy spec's D2 "private · discoverable" row is the
+  // account it exists to serve, and ANDing accountVisibleSql would empty it of
+  // exactly that account while leaving every test above still green.
+  assert.ok(recruiterSliverVisibleSql('pa').includes(accountActiveSql('pa')),
+    'the consent floor, literally contained — a provisional account is never recruiter-visible (spec D3)');
+  assert.ok(recruiterSliverVisibleSql('pa').includes(recruiterReachSql('pa')),
+    'and the reach axis, literally contained — the opt-out empties this surface too');
+  assert.ok(!recruiterSliverVisibleSql('pa').includes(accountVisibleSql('pa')),
+    'and NOT the existence axis: dropping it is safe only because reach is an explicit opt-IN for a private account');
+  assert.doesNotMatch(recruiterSliverVisibleSql(), /hide_stats/,
+    'hide changes the SHAPE of the sliver (name-only), never who appears in it');
+  // The JS twin, over the same D2 matrix the SQL is judged on.
+  const accepted = { terms_accepted_at: 'T1' };  // the T&C half of the consent floor (ADR 0213)
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), true);
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'active', account_visibility: 'private', recruiter_discoverable: null }), false);
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'provisional', account_visibility: 'public', recruiter_discoverable: true }), false);
+  assert.equal(isRecruiterSliverVisible({ profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), false,
+    'and the sliver inherits the T&C floor by COMPOSITION — an account that never accepted is not recruiter-visible');
+  assert.equal(isRecruiterSliverVisible(null), false, 'fail-closed on an absent account');
+  assert.throws(() => recruiterSliverVisibleSql('pa; DROP TABLE x --'), /bare SQL identifier/);
+});
+
 // ===========================================================================
 // 2. The sole-owner rule — nothing else spells a variant
 // ===========================================================================
@@ -640,6 +676,27 @@ t('the shared predicate has real adopters (the wiring did not silently unwire it
   }
 });
 
+t('the EXISTENCE-LESS predicate has exactly one reader, and it is the sliver (task 1002968)', () => {
+  // recruiterSliverVisibleSql counts as adoption in ADOPTS above, which is what
+  // lets the sliver's own read pass the classification rule — and that is a hole
+  // unless the predicate is also PINNED to its one caller. It is the only shared
+  // answer that omits `account_visibility = 'public'`, so a future public read
+  // that joined it would look adopted while quietly serving private accounts.
+  // BOTH FORMS, because the same diff put both into ADOPTS. Pinning only the SQL
+  // one left the JS twin as an open door: a new module file doing
+  // `rows.filter(isRecruiterSliverVisible)` over an ungated
+  // `SELECT … FROM platform_identity_accounts WHERE handle ILIKE $1` passed this
+  // entire guard — that is the hub profile search this file's own header names
+  // as the read that must fail the build, sailing through on the one predicate
+  // that omits the existence axis (found in adversarial review, task 1002968).
+  // Enumerated from source, so a second reader fails here rather than in review.
+  const readers = scanned
+    .filter((f) => f.rel !== PREDICATE_OWNER && /\b(?:recruiterSliverVisibleSql|isRecruiterSliverVisible)\s*\(/.test(f.code))
+    .map((f) => f.rel);
+  assert.deepEqual(readers, ['modules/platform-identity/recruiter-sliver.js'],
+    'the pre-accept predicate is the recruiting sliver\'s alone — every other read must floor on the existence axis');
+});
+
 t('getPublicProfileExtras gates on the shared JS port (its SQL carries no predicate to join)', () => {
   const pi = scanned.find((f) => f.rel === 'modules/platform-identity/platform-identity.js');
   const span = functionSpans(pi.code).find((s) => s.name === 'getPublicProfileExtras');
@@ -725,55 +782,72 @@ const ACCOUNTS = [
 // clause throws — the guard against a predicate quietly degrading to no filter.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
-// The columns this interpreter knows how to answer an IS [NOT] NULL test on.
-// Separate from KNOWN_COLUMNS because a NULL test is a different syntax the
-// literal-comparison sweep cannot see (ADR 0213 / task 1002913).
-const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
-
 /**
  * Build a row test from a statement's own WHERE clause. Literal comparisons
  * (profile_state = 'active') matter as much as placeholders here, because the
  * effective-visibility predicate is made ENTIRELY of literal comparisons — a
  * fake pool that only modelled $N filters would score the privacy terms as
  * absent and pass no matter what.
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS, which is why this is a CONSUMING parse.
+ * Two ways a term-collecting interpreter lies, and this shape closes both:
+ *
+ *   THE MISSING TERM. The ADR 0213 acceptance half is a NULL TEST — a third
+ *     syntax neither the placeholder sweep nor the literal sweep can see. An
+ *     unmodelled one degrades to no filter exactly like an unread $N.
+ *   THE REWRITTEN JOINER. Collecting recognised terms and ANDing them re-imposes
+ *     an `AND` the SQL may no longer contain: rewrite accountVisibleSql's `AND`
+ *     to `OR` and Postgres serves every ACTIVE account, private ones included,
+ *     while the fake answers exactly as before (idea 1000877, from the
+ *     adversarial review of task 1002968).
+ *
+ * So each recognised term is REMOVED from the text as it is matched and the
+ * residue must be a pure conjunction. That single check subsumes the NULL-test
+ * bookkeeping this function used to carry — recognition and application can no
+ * longer come apart, because an unapplied term is simply still there.
  */
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
-  // NULL-test terms this interpreter actually turned into a filter, as opposed
-  // to column names it merely recognises. The final sweep compares the two.
-  const modelled = new Set();
-
-  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
-  // The ADR 0213 acceptance half of the consent axis. It is a NULL test, not a
-  // literal comparison, so neither refusal sweep below would have caught it —
-  // an unmodelled IS NOT NULL degrades to no filter exactly like an unread $N.
-  // Hence the third sweep at the end of this function, and hence `modelled`:
-  // the sweep must prove a filter was APPLIED, not merely that the column is a
-  // name it recognises. (Checking recognition alone left this interpreter
-  // scoring a deleted filter as fine — found by mutation while writing it.)
-  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
-    modelled.add('terms_accepted_at');
-    tests.push((r) => r.terms_accepted_at != null);
-  }
-  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
-  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
-  // The recruiting-reach COALESCE (task 1002290). Modelled through the shared JS
-  // twin, not re-implemented — an interpreter that read this term its own way
-  // could agree with a WRONG query. Unmodelled it would degrade to no filter,
-  // which is precisely what this interpreter exists to refuse.
-  if (/COALESCE\((?:[a-z_]+\.)?recruiter_discoverable,/.test(where)) tests.push(isRecruiterDiscoverable);
-
-  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
-  if (byId) { consumed.add(byId[1]); const v = params[Number(byId[1]) - 1]; tests.push((r) => String(r.github_id) === String(v)); }
-
-  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
-  if (byHandle) {
-    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
-    const v = String(params[Number(byHandle[1]) - 1]);
-    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
-  }
+  let residue = where;
+  // Match a term, model it, and CONSUME its text so the leftovers can be judged.
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
 
+  // The recruiting-reach COALESCE (task 1002290) FIRST, because it spells
+  // `account_visibility = 'public'` inside itself as its own fallback —
+  // consuming it first stops that fallback being scored as a separate existence
+  // check. Modelled through the shared JS twin, not re-implemented: an
+  // interpreter that read this term its own way could agree with a WRONG query.
+  take(/\bCOALESCE\((?:[a-z_]+\.)?recruiter_discoverable,\s*(?:[a-z_]+\.)?account_visibility = 'public'\s*\)/,
+    () => isRecruiterDiscoverable);
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
+
+  // The rename window's disjunction is the ONE legitimate OR in this repo's
+  // account reads, so it is consumed as a single unit — leaving a bare `OR`
+  // behind would trip the structure check below.
+  take(/lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/, (m) => {
+    consumed.add(m[1]); consumed.add(m[2]);
+    const v = String(params[Number(m[1]) - 1]);
+    return (r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v;
+  });
+
+  // The TERM guards run before the STRUCTURE guard, so an unreadable term is
+  // reported as the unreadable term it is rather than as leftover text.
   for (const m of where.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
       throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
@@ -784,17 +858,8 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
-  // A NULL test is a filter too. Without this sweep the ADR 0213 acceptance term
-  // could be dropped from the predicate and this interpreter would score it as
-  // absent-and-fine, which is the failure mode the other two sweeps exist to
-  // prevent one syntax over.
-  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
-    if (!KNOWN_NULL_TESTS.has(m[1])) {
-      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
-    }
-    if (!modelled.has(m[1])) {
-      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it, which is the silent-pass it exists to refuse`);
-    }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -886,6 +951,28 @@ function get(path_, headers = {}) {
   });
 }
 
+t('CALIBRATION: the interpreter refuses what it cannot model, rather than ignoring it', () => {
+  // The behavioural half below is worth exactly as much as this. Every 404 it
+  // asserts is produced by accountFilter, so an interpreter that silently
+  // dropped a term would keep them all green while the predicate rotted.
+  assert.throws(() => accountFilter("profile_state = 'active' AND tier = 'gold'", []),
+    /unrecognised literal comparison on tier/);
+  assert.throws(() => accountFilter("profile_state = 'active' AND cohort = $1", ['beta']),
+    /unrecognised predicate on \$1/);
+  assert.throws(() => accountFilter("profile_state = 'active' AND deleted_at IS NULL", []),
+    /unmodelled boolean structure/,
+    'a NULL TEST is a third syntax, invisible to both sweeps above — the ADR 0213 shape');
+  assert.throws(() => accountFilter("profile_state = 'active' OR account_visibility = 'public'", []),
+    /unmodelled boolean structure/,
+    'an AND rewritten to OR serves every ACTIVE account including the private ones; a '
+    + 're-imposed AND would keep every 404 below green (idea 1000877)');
+  // ...and the real predicates still parse clean, in every composed form.
+  for (const clause of [accountActiveSql('pa'), accountVisibleSql('pa'), rollupVisibleSql('pa'),
+    scoutingListableSql('pa'), recruiterSliverVisibleSql('pa')]) {
+    assert.doesNotThrow(() => accountFilter(clause, []), `the shared predicate ${clause} must still be readable`);
+  }
+});
+
 await ta('CONTROL: the fixture and the interpreter really work — a public account resolves', async () => {
   // Without this, every 404 below could be a broken fake rather than a boundary.
   const res = await get('/api/gds/profiles/octo');

package/tests/government_require_permission.mjs

@@ -352,6 +352,28 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     // worth doing — it means minting an atom over the write — but it is the
     // continuing R107/R108 migration's job, not this ADR's.
     'security/routes/scans.js',
+    // Still requireRank after BV1.R105 — and for a reason the other holdouts do
+    // not have: the atom this gate WANTS is specified, named, and deliberately
+    // owned by another wave. `GET /scouting/:handle` is the privacy spec's D3
+    // pre-accept recruiter sliver (task 1002968, ADR 0215 D4), and D3 gates it on
+    // `project.recruit` — declared in spec D1 as FLOOR ARCHON, widenable per
+    // instance. That atom does not exist: ADR 0201 D3 and ADR 0210 both refuse to
+    // mint it outside the project-admin-console wave that defines it (spike
+    // 1002786 R3), because a third definition before any had shipped is the drift
+    // they were avoiding.
+    //
+    // The three ways out are all worse. Minting it here forks its definition.
+    // Borrowing a different archon atom (`access_request.review`, say) would name
+    // the wrong authority on a privacy surface. And reusing the sibling route's
+    // `project.curate`-or-project-owner door — the tidy option, and what the first
+    // draft did — is WIDER than the signed floor on both halves, on the first
+    // surface on this platform that discloses a PRIVATE account.
+    //
+    // So the floor is held by rank until the atom lands, which is the one spelling
+    // that neither invents authority nor widens it. It is temporary by
+    // construction: blocker 1000126 carries the audience question to the owner,
+    // and spike 1002786 R3 mints the atom that removes this entry.
+    'platform-identity/routes/scouting.js',
   ].sort();
 
   const modulesDir = path.join(ROOT, 'modules');

package/tests/handle_machinery.mjs

@@ -64,6 +64,12 @@ try {
   // simply land with handle NULL — the re-run seeds only those. Idempotence is
   // part of what this proves.
   await q(migrationSql('platform_identity_008_handle.sql')).catch(() => {});
+  // getAccount projects them and resolveHandle floors on accountVisibleSql,
+  // which reads account_visibility (012) and terms_accepted_at (019) — without
+  // these a FRESH database answers 42703 "column does not exist" rather than a
+  // handle assertion.
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await cleanup();
 
   await q(
@@ -116,7 +122,15 @@ try {
   const prov = await pi.resolveHandle('p01-again', { pool });
   ok(prov === null, 'a provisional account is not addressable — even by its current handle');
 
-  await q(`UPDATE platform_identity_accounts SET profile_state = 'active' WHERE github_id = ANY($1::bigint[])`, [[FRESH, TWIN_A]]);
+  // Both consent columns, because since ADR 0213 addressability floors on BOTH
+  // and they are stamped by the SAME upsertAccount branch — an UPDATE that set
+  // only profile_state would model a state the code cannot produce, and the
+  // handle would stay unaddressable for a reason this file is not about.
+  await q(
+    `UPDATE platform_identity_accounts SET profile_state = 'active', terms_accepted_at = now()
+      WHERE github_id = ANY($1::bigint[])`,
+    [[FRESH, TWIN_A]],
+  );
 
   const cur = await pi.resolveHandle('P01-Again', { pool });
   ok(cur && cur.account && cur.account.handle === 'p01-again', 'the current handle resolves case-insensitively');

package/tests/hub_profile_leak.mjs

@@ -104,6 +104,10 @@ function get(port, path) {
 const NEVER_IN_A_BODY = [
   SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
   'profile_state', 'hide_stats', 'github_id', 'display_name_source',
+  // The ADR 0213 consent column joins the list on the same terms as
+  // profile_state: it is an INPUT to the public predicate, never an output, and
+  // when the account accepted the terms is nobody else's business.
+  'terms_accepted_at',
 ];
 function assertNoSentinels(text, where) {
   for (const s of NEVER_IN_A_BODY) {
@@ -119,16 +123,26 @@ try {
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
   await q(migrationSql('platform_identity_008_handle.sql'));
   await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  // resolveHandle floors on accountVisibleSql, which reads account_visibility
+  // (012) and terms_accepted_at (019). Without these a FRESH database answers
+  // 42703 "column does not exist" instead of a 404-vs-200 assertion.
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await cleanup();
 
   // The active account carries the P02 fields + a user-set name source, so the
   // 200 proves bio/links serialize while display_name_source never does.
+  //
+  // The consented rows stamp terms_accepted_at as well as profile_state: since
+  // ADR 0213 addressability floors on BOTH, and a fixture seeding only the
+  // first is a pre-terms account that 404s. The provisional row keeps NULL —
+  // it is not consented on either column.
   await q(
     `INSERT INTO platform_identity_accounts
-       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle, bio, links, display_name_source)
-     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4, 'Builds things.', '{"website":"https://p05.example/"}', 'user'),
-            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL, NULL, NULL, 'github'),
-            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL, NULL, NULL, 'github')`,
+       (github_id, github_login, display_name, avatar_url, profile_state, terms_accepted_at, hide_stats, handle, previous_handle, bio, links, display_name_source)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', now(), false, 'p05-active', $4, 'Builds things.', '{"website":"https://p05.example/"}', 'user'),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', now(), true,  'p05-hidden', NULL, NULL, NULL, 'github'),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', NULL, false, 'p05-prov', NULL, NULL, NULL, 'github')`,
     [ACTIVE, HIDDEN, PROV, SECRET_PREV],
   );
   await q(

package/tests/own_session_revoke.mjs

@@ -81,28 +81,65 @@ function seed() {
 // Build a row filter from the statement's OWN where clause. Every placeholder the
 // clause mentions must be consumed by a fragment below; one that is not throws,
 // so a predicate this cannot read can never degrade into "no constraint".
+//
+// IT READS STRUCTURE, NOT JUST TERMS (task 1003354, idea 1000877). Each matched
+// term is REMOVED from the clause, and whatever survives must be a pure
+// conjunction — whitespace, parentheses and `AND`. Three holes this closes, all
+// of them "the interpreter silently answered a question it was not asked":
+//
+//   A LITERAL-ONLY term binds no placeholder, so the sweep below cannot see it.
+//     `revoked_at IS NULL` could be deleted from the real revoke statement and
+//     this fake would keep answering as though it were there.
+//   AN `AND` REWRITTEN TO `OR` is the dangerous one on this table: revoke is
+//     `id = $1 AND builder_id = $2`, so an `OR` lets any builder revoke any
+//     session by id — the exact own-scope isolation this file exists to prove —
+//     while a term-collecting interpreter re-imposes the `AND` and stays green.
+//   A CLAUSE WITH NO READABLE TERM used to yield an empty `tests` array, which
+//     matches EVERY row. A statement that carries a WHERE must narrow.
+//
+// The session-expiry disjunction is the ONE legitimate `OR` here and is consumed
+// as a whole unit, which is what lets it survive the check.
 function predicateFor(sql, params) {
-  const where = sql.includes(' WHERE ') ? sql.slice(sql.indexOf(' WHERE ') + 7) : '';
+  // The tail is not part of the predicate. It has to go before the residue is
+  // judged, or `ORDER BY last_used_at DESC` would read as an unmodelled term.
+  const raw = sql.includes(' WHERE ')
+    ? sql.slice(sql.indexOf(' WHERE ') + 7).split(/ (?:ORDER BY|GROUP BY|RETURNING|LIMIT|OFFSET) /)[0]
+    : '';
   const tests = [];
   const consumed = new Set();
+  let residue = raw;
+  // Some terms bind a placeholder and some are pure literals (`revoked_at IS
+  // NULL`), so the bound value is resolved only when there IS a capture group —
+  // passing `params[NaN]` and relying on the maker to ignore it would work by
+  // accident, and would break silently the day a no-capture maker read its arg.
   const take = (re, make) => {
-    const m = re.exec(where);
+    const m = re.exec(residue);
     if (!m) return;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    if (m[1] === undefined) { tests.push(make()); return; }
     consumed.add(m[1]);
     tests.push(make(params[Number(m[1]) - 1]));
   };
+  // The expiry disjunction FIRST, as a unit — otherwise the bare-column matchers
+  // would tear it in half and leave a dangling `OR` behind.
+  take(/\(?expires_at IS NULL OR expires_at > now\(\)\)?/,
+    () => (r) => r.expires_at === null || r.expires_at > new Date());
   take(/\b(?:s\.)?token = \$(\d+)/, (v) => (r) => r.token === v);
   take(/(?<!_)\b(?:s\.)?id = \$(\d+)/, (v) => (r) => String(r.id) === String(v));
   take(/\bbuilder_id = \$(\d+)/, (v) => (r) => String(r.builder_id) === String(v));
-  if (/revoked_at IS NULL/.test(where)) tests.push((r) => r.revoked_at === null);
-  if (/expires_at IS NULL OR expires_at > now\(\)/.test(where)) {
-    tests.push((r) => r.expires_at === null || r.expires_at > new Date());
-  }
-  for (const m of where.matchAll(/\$(\d+)/g)) {
+  take(/\brevoked_at IS NULL/, () => (r) => r.revoked_at === null);
+
+  for (const m of raw.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
-      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — the interpreter must not silently ignore a filter`);
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${raw}" — the interpreter must not silently ignore a filter`);
     }
   }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${raw}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, never a silently different filter`);
+  }
+  if (raw && !tests.length) {
+    throw new Error(`fake pool: the predicate in "${raw}" carried NO readable term — an empty filter matches every row, which is the opposite of what a WHERE is for`);
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -189,7 +226,38 @@ const aliveFor = (builderId) => sessions.filter((s) => s.builder_id === builderI
 // 1 — a xenos can see and kill their OWN sessions, with no Archon in sight
 // ===========================================================================
 
-console.log('own scope — a non-admin builder manages their own sessions:');
+console.log('calibration — the instrument is checked before it is trusted:');
+
+await t('the interpreter refuses what it cannot model, rather than ignoring it', () => {
+  // This file had no calibration at all until task 1003354, which is how it kept
+  // three silently-permissive paths: an unread literal, an OR it re-ANDed, and
+  // an empty predicate that matched every row. Every isolation assertion below
+  // is produced by predicateFor, so each of those made the whole file decorative.
+  assert.throws(() => predicateFor('SELECT id FROM builder_sessions WHERE id = $1 AND source = $2', [1, 'cli']),
+    /unrecognised predicate on \$2/,
+    'an unread placeholder — the older half of the rule');
+  assert.throws(() => predicateFor('SELECT id FROM builder_sessions WHERE id = $1 AND source IS NULL', [1]),
+    /unmodelled boolean structure/,
+    'a literal-only term binds nothing, so the placeholder sweep cannot see it');
+  assert.throws(() => predicateFor('UPDATE builder_sessions SET revoked_at = now() WHERE id = $1 OR builder_id = $2', [1, 1]),
+    /unmodelled boolean structure/,
+    'and the one that matters here: with OR, any builder revokes any session by id — while a '
+    + 'term-collecting interpreter re-imposes the AND and every test below stays green (idea 1000877)');
+  assert.throws(() => predicateFor('SELECT id FROM builder_sessions WHERE source IS NOT NULL', []),
+    /unmodelled boolean structure/,
+    'and a clause with no readable term at all: an empty filter matches every row');
+  // ...and the real statements still parse clean.
+  assert.doesNotThrow(() => predicateFor(
+    'SELECT id FROM builder_sessions WHERE builder_id = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now()) ORDER BY last_used_at DESC, id DESC',
+    [1],
+  ), 'the own-scope list, tail and legitimate OR included');
+  assert.doesNotThrow(() => predicateFor(
+    'UPDATE builder_sessions SET revoked_at = now() WHERE id = $1 AND builder_id = $2 AND revoked_at IS NULL RETURNING id',
+    [1, 1],
+  ), 'and the revoke');
+});
+
+console.log('\nown scope — a non-admin builder manages their own sessions:');
 
 await t('GET /me/sessions lists only the caller\'s LIVE sessions', async () => {
   seed(); calls = [];