@bongos/core 1.19.430 → 1.19.432

package/tests/profile_connections_ui.mjs

@@ -163,7 +163,7 @@ function predicateFor(rawWhere, params) {
     where = where.replace(m[0], ' TRUE ');
   }
   // The unordered pair, likewise stripped before the one-sided matchers.
-  m = /pair_lo = LEAST\(\$(\d+)::bigint, \$(\d+)::bigint\)\s*AND\s*(?:c\.)?pair_hi = GREATEST\(\$(\d+)::bigint, \$(\d+)::bigint\)/.exec(where);
+  m = /(?:[a-z_]+\.)?pair_lo = LEAST\(\$(\d+)::bigint, \$(\d+)::bigint\)\s*AND\s*(?:[a-z_]+\.)?pair_hi = GREATEST\(\$(\d+)::bigint, \$(\d+)::bigint\)/.exec(where);
   if (m) {
     const a = p(m[1]); const b = p(m[2]); p(m[3]); p(m[4]);
     const lo = Math.min(Number(a), Number(b)); const hi = Math.max(Number(a), Number(b));
@@ -172,26 +172,33 @@ function predicateFor(rawWhere, params) {
     where = where.replace(m[0], ' TRUE ');
   }
 
-  if ((m = /\bid = ANY\(\$(\d+)::bigint\[\]\)/.exec(where))) {
+  // Each matcher BLANKS what it consumed, so the residue below is exactly the
+  // part of the clause this interpreter did not understand.
+  const eat = () => { where = where.replace(m[0], ' TRUE '); };
+  if ((m = /\b(?:[a-z_]+\.)?id = ANY\(\$(\d+)::bigint\[\]\)/.exec(where))) {
     const ids = p(m[1]).map(String);
     tests.push((r) => ids.includes(String(r.id)));
+    eat();
   }
-  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
-  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
-  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
-  if (/\bseen_at IS NULL\b/.test(where)) tests.push((r) => !r.seen_at);
-  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
-  if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+  if ((m = /\b(?:[a-z_]+\.)?id = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?addressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?requester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?seen_at IS NULL\b/.exec(where))) { tests.push((r) => !r.seen_at); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?status = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
+  if ((m = /(?:[a-z_]+\.)?created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.created_at > Date.now() - days * DAY);
+    eat();
   }
-  if ((m = /created_at <= now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+  if ((m = /(?:[a-z_]+\.)?created_at <= now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.created_at <= Date.now() - days * DAY);
+    eat();
   }
-  if ((m = /resolved_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+  if ((m = /(?:[a-z_]+\.)?resolved_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.resolved_at != null && r.resolved_at > Date.now() - days * DAY);
+    eat();
   }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
@@ -199,6 +206,18 @@ function predicateFor(rawWhere, params) {
       throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
     }
   }
+  // AND THE JOINER IS PART OF THE PREDICATE (task 1003354, idea 1000877). What
+  // survives must be a pure conjunction: whitespace, parentheses and `AND`. A
+  // literal-only term binds no placeholder and is invisible to the sweep above,
+  // and an `AND` rewritten to `OR` would let accept/decline act on a row
+  // matching the id alone — anyone answering anyone's request — while a
+  // term-collecting interpreter re-imposes the `AND` and stays green. The two
+  // legitimate ORs (the either-side clause and the unordered pair) are consumed
+  // as whole units above, which is what lets them survive this check.
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, never a silently different filter`);
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -505,6 +524,26 @@ test('the fake pool refuses a read that dropped its account floor', () => {
     'a read that stopped joining the floor must break the harness, not pass it');
 });
 
+test('the fake pool refuses a boolean SHAPE it cannot model, not just a term', () => {
+  // Task 1003354 / idea 1000877. The placeholder sweep above cannot see a
+  // literal-only term at all, and nothing saw the JOINER: an `AND` rewritten to
+  // `OR` would let accept/decline act on a row matching the id alone — anyone
+  // answering anyone's request — while a term-collecting interpreter re-imposes
+  // the `AND` and every isolation assertion in this file stays green.
+  assert.throws(() => predicateFor("id = $1 AND note IS NULL", [1]),
+    /unmodelled boolean structure/,
+    'a literal-only term binds no placeholder');
+  assert.throws(() => predicateFor("id = $1 OR addressee_github_id = $2::bigint", [1, ME]),
+    /unmodelled boolean structure/,
+    'and the joiner is part of the predicate');
+  // The two legitimate ORs are consumed as whole units, so they still parse.
+  assert.doesNotThrow(() => predicateFor(
+    "id = $1 AND status = 'accepted' AND (requester_github_id = $2::bigint OR addressee_github_id = $2::bigint)", [1, ME]));
+  assert.doesNotThrow(() => predicateFor(
+    "c.pair_lo = LEAST($1::bigint, $2::bigint) AND c.pair_hi = GREATEST($1::bigint, $2::bigint) AND c.status = 'pending' AND c.created_at <= now() - make_interval(days => $3::int)",
+    [ME, ADA, 30]), 'the aliased expiry clause, alias prefixes included');
+});
+
 // ===========================================================================
 // 1. The surface: the section exists, ships hidden, and profile.js calls it
 // ===========================================================================

package/tests/profile_privacy_owner_view.mjs

@@ -79,6 +79,10 @@ const NOSY = '7777';   // active · public          — the stranger at the side
 // ADR 0213 (task 1002913): consent is profile_state AND an acceptance of the
 // platform terms, both written by the same statement — so a consented fixture
 // carries both, and one carrying only the first is a row from before the terms.
+// Every fixture here accepts, deliberately: the never-accepted row and the 404
+// it earns belong to tests/effective_visibility_predicate.mjs, which owns the
+// consent matrix. This file's subject is the OWNER's page, so re-seeding that
+// row here would duplicate a proof rather than add one.
 const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
 
 const ACCOUNTS = [
@@ -140,48 +144,64 @@ function sentinelsOf(githubId) {
 // anything else throws — a WHERE it cannot read must never degrade to no WHERE.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
-// Columns this interpreter can answer an IS [NOT] NULL test on — a different
-// syntax from the literal comparisons above, hence its own set (ADR 0213).
-const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
-
 /**
  * Build a row test from a statement's own WHERE text. Literal comparisons carry
  * as much weight as placeholders here: the effective-visibility predicate is
  * made ENTIRELY of literal comparisons, so a fake that modelled only $N filters
  * would score the privacy terms as absent and pass however the code changed.
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS, which is why this is a CONSUMING parse
+ * rather than a list of `.test()` calls. An interpreter that merely COLLECTS the
+ * terms it recognises and ANDs them re-imposes an `AND` the SQL may no longer
+ * contain: rewrite accountVisibleSql's `AND` to `OR` and Postgres serves every
+ * ACTIVE account — private ones included — while a term-collecting fake answers
+ * exactly as before and every 404 assertion in this file stays green (idea
+ * 1000877, from the adversarial review of task 1002968). So each recognised term
+ * is REMOVED from the text as it is matched, and whatever survives must be
+ * nothing but whitespace, parentheses and `AND`.
+ *
+ * That also subsumes the NULL-test bookkeeping this function used to carry: an
+ * `IS NOT NULL` nobody modelled now survives in the residue and is refused
+ * there, so recognition and application cannot come apart (ADR 0213).
  */
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
-  // NULL-test terms actually turned into a filter, as opposed to column names
-  // merely recognised. The final sweep compares the two (ADR 0213).
-  const modelled = new Set();
-
-  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  let residue = where;
+  // Match a term, model it, and CONSUME its text so the leftovers can be judged.
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
+
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
   // The ADR 0213 consent half. It is a NULL test, not a literal comparison, so
-  // neither sweep below would see it — an unmodelled IS NOT NULL degrades to no
-  // filter exactly like an unread $N, which is what those sweeps exist to refuse.
-  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
-    modelled.add('terms_accepted_at');
-    tests.push((r) => r.terms_accepted_at != null);
-  }
-  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
-  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
-
-  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
-  if (byId) {
-    consumed.add(byId[1]);
-    const v = params[Number(byId[1]) - 1];
-    tests.push((r) => String(r.github_id) === String(v));
-  }
+  // the two term sweeps below cannot see it at all — only the structure guard
+  // can, which is exactly why that guard exists.
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
 
-  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
-  if (byHandle) {
-    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
-    const v = String(params[Number(byHandle[1]) - 1]);
-    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
-  }
+  // The rename window's disjunction is the ONE legitimate OR in this repo's
+  // account reads, so it is consumed as a single unit — leaving a bare `OR`
+  // behind would trip the structure check below.
+  take(/lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/, (m) => {
+    consumed.add(m[1]); consumed.add(m[2]);
+    const v = String(params[Number(m[1]) - 1]);
+    return (r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v;
+  });
 
+  // The TERM guards run before the STRUCTURE guard, so an unreadable term is
+  // reported as the unreadable term it is rather than as leftover text.
   for (const m of where.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
       throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
@@ -192,13 +212,8 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
-  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
-    if (!KNOWN_NULL_TESTS.has(m[1])) {
-      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}"`);
-    }
-    if (!modelled.has(m[1])) {
-      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it`);
-    }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -332,6 +347,22 @@ test('the interpreter refuses a predicate it cannot read, rather than ignoring i
     /unrecognised literal comparison on shadow_banned/,
     'the privacy predicate is made of LITERAL comparisons — an unmodelled one must not read as absent',
   );
+  assert.throws(
+    () => accountFilter("profile_state = 'active' AND deleted_at IS NULL", []),
+    /unmodelled boolean structure/,
+    'a NULL TEST is a third syntax again, invisible to both sweeps above — the shape that let the '
+    + 'ADR 0213 acceptance term be dropped silently elsewhere (task 1003354)',
+  );
+  assert.throws(
+    () => accountFilter("profile_state = 'active' OR account_visibility = 'public'", []),
+    /unmodelled boolean structure/,
+    'and an AND rewritten to OR: in Postgres that serves every ACTIVE account including the private '
+    + 'ones, so an interpreter that re-imposed the AND would keep every 404 below green (idea 1000877)',
+  );
+  assert.doesNotThrow(
+    () => accountFilter("(profile_state = 'active' AND terms_accepted_at IS NOT NULL) AND account_visibility = 'public'", []),
+    'and the real predicate still parses clean — this is a filter on the unreadable, not a blanket refusal',
+  );
 });
 
 test('the interpreter really does narrow on the visibility literals', () => {

package/tests/profile_rollup_consent.mjs

@@ -3,9 +3,11 @@
 // Proves the consent + hide semantics against real SQL — pg-mem cannot execute
 // unnest(), so the rollup queries need a live Postgres (the task-1002911
 // precedent). Replays the module's actual migrations, then asserts:
-//   1. listScoutingRollup lists ONLY active + not-hidden builders (D2/D3) —
-//      provisional and hidden accounts drop out of /people + /scouting by
-//      construction.
+//   1. listScoutingRollup lists ONLY consented + not-hidden builders (D2/D3) —
+//      provisional, hidden and never-accepted accounts drop out of /people +
+//      /scouting by construction. Consent is TWO columns since ADR 0213
+//      (profile_state='active' AND terms_accepted_at IS NOT NULL), and the
+//      LEGACY fixture is the pre-terms row that proves the second one.
 //   2. getRollupForBuilder aggregates un-fanned and names ONLY projects whose
 //      catalog row is publicly listed (featured + active); everything else is
 //      counted in more_projects, never named. client_id never crosses.
@@ -44,8 +46,12 @@ try {
 }
 
 // High-numbered fixture ids so a shared DB can never collide with real data.
-const ACTIVE = 90002278, HIDDEN = 90002279, PROV = 90002280, LAZY = 90002281;
-const ALL_IDS = [ACTIVE, HIDDEN, PROV, LAZY];
+// LEGACY is the ADR 0213 shape: profile_state='active' from before the platform
+// terms existed, so terms_accepted_at is NULL. Consent is TWO columns now, and
+// this is the row that makes that second column load-bearing here — delete the
+// acceptance term from accountActiveSql and this fixture is the one that flips.
+const ACTIVE = 90002278, HIDDEN = 90002279, PROV = 90002280, LAZY = 90002281, LEGACY = 90002283;
+const ALL_IDS = [ACTIVE, HIDDEN, PROV, LAZY, LEGACY];
 const PUB_CLIENT = 't1002278-pub', PRIV_CLIENT = 't1002278-priv', LOST_CLIENT = 't1002278-lost';
 const ALL_CLIENTS = [PUB_CLIENT, PRIV_CLIENT, LOST_CLIENT];
 const PUB_ORIGIN = 'https://t1002278-pub.example', PRIV_ORIGIN = 'https://t1002278-priv.example';
@@ -63,19 +69,32 @@ let pass = 0;
 const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
 
 try {
-  // The module's actual migrations (idempotent).
+  // The module's actual migrations (idempotent). 012 and 019 are here because
+  // the predicates under test READ their columns: accountVisibleSql compares
+  // account_visibility, scoutingListableSql COALESCEs recruiter_discoverable
+  // (012), and the consent floor tests terms_accepted_at (019). Without them a
+  // FRESH database answers 42703 "column does not exist" — an infrastructure
+  // error dressed up as a boundary failure — instead of a clean assertion.
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_004_projects.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await cleanup();
 
+  // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND
+  // an acceptance of the platform terms. A fixture that seeds only the first is
+  // a row from BEFORE the terms shipped, and is deliberately not consented — so
+  // every consented fixture here stamps both, exactly as upsertAccount's
+  // activate branch does, and LEGACY stamps only the first on purpose.
   await q(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, profile_state, hide_stats)
-     VALUES ($1, 'active-b', 'Active', 'active', false),
-            ($2, 'hidden-b', 'Hidden', 'active', true),
-            ($3, 'prov-b',   'Prov',   'provisional', false)`,
-    [ACTIVE, HIDDEN, PROV],
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, profile_state, hide_stats, terms_accepted_at)
+     VALUES ($1, 'active-b', 'Active', 'active', false, now()),
+            ($2, 'hidden-b', 'Hidden', 'active', true,  now()),
+            ($3, 'prov-b',   'Prov',   'provisional', false, NULL),
+            ($4, 'legacy-b', 'Legacy', 'active', false, NULL)`,
+    [ACTIVE, HIDDEN, PROV, LEGACY],
   );
   // Three reporting projects: one publicly catalogued (featured+active), one
   // catalogued but NOT featured (→ never named), one with no catalog row at all.
@@ -96,15 +115,21 @@ try {
             ($2, $4,  50, 2, 1, 'archon', '{artist}',      '2026-02-01T00:00:00Z'),
             ($3, $4,  25, 1, 0, NULL,     '{}',            '2026-03-01T00:00:00Z'),
             ($1, $5,  60, 4, 2, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z'),
-            ($1, $6,  10, 1, 0, 'xenos',  '{engineer}',    '2026-01-01T00:00:00Z')`,
-    [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV],
+            ($1, $6,  10, 1, 0, 'xenos',  '{engineer}',    '2026-01-01T00:00:00Z'),
+            ($1, $7,  90, 3, 1, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z')`,
+    [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV, LEGACY],
   );
 
   // 1 — the scouting/people predicate (D2/D3).
   const listed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
-  ok(listed.includes(ACTIVE), 'active + visible builder is listed');
+  ok(listed.includes(ACTIVE), 'active + accepted + visible builder is listed');
   ok(!listed.includes(HIDDEN), 'hide_stats builder drops out of the scouting rollup');
   ok(!listed.includes(PROV), 'provisional (no hub-session consent) builder drops out');
+  // The ADR 0213 half, against real SQL. LEGACY differs from ACTIVE in ONE
+  // column, so this is the acceptance term and nothing else: an account
+  // activated before the platform terms existed has no consent to aggregate on
+  // and does not publish until it re-accepts at its next hub sign-in.
+  ok(!listed.includes(LEGACY), 'active but never-accepted (pre-terms) builder drops out too — consent is two columns');
 
   // 2 — getRollupForBuilder semantics.
   const r = await pi.getRollupForBuilder(ACTIVE, { pool });
@@ -124,6 +149,7 @@ try {
   // 3 — the port reads.
   ok(await pi.getPublicProfileExtras(HIDDEN, { pool }) === null, 'public read → null for a hidden builder');
   ok(await pi.getPublicProfileExtras(PROV, { pool }) === null, 'public read → null for a provisional builder');
+  ok(await pi.getPublicProfileExtras(LEGACY, { pool }) === null, 'public read → null for an active builder who never accepted the terms (ADR 0213)');
   ok(await pi.getPublicProfileExtras(99999999999, { pool }) === null, 'public read → null with no account');
   ok(await pi.getPublicProfileExtras('system:bfg', { pool }) === null, 'non-numeric principal → null, no bigint cast error');
   const pub = await pi.getPublicProfileExtras(ACTIVE, { pool });
@@ -138,9 +164,15 @@ try {
   await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b', activate: true }, { pool });
   acct = await pi.getAccount(LAZY, { pool });
   ok(acct.profile_state === 'active', 'an authorize-path upsert (activate) flips it active');
+  // BOTH consent columns come from that ONE branch (ADR 0213), which is what
+  // makes "active without an acceptance" a legacy shape rather than a state the
+  // code can still produce — and what makes the LEGACY fixture above honest.
+  ok(acct.terms_accepted_at !== null, 'the same activate branch stamps the T&C acceptance');
+  const firstAccept = acct.terms_accepted_at;
   await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b' }, { pool });
   acct = await pi.getAccount(LAZY, { pool });
   ok(acct.profile_state === 'active', 'a later plain upsert never demotes an active account');
+  ok(String(acct.terms_accepted_at) === String(firstAccept), 'and never rewrites the acceptance — the FIRST one stands (idempotent by COALESCE)');
 
   // 4b — the live hide toggle (R03, task 1002279): flipping hide_stats takes
   // effect IMMEDIATELY on every public read — the profile port and the

package/tests/profile_route.mjs

@@ -159,6 +159,9 @@ require.cache[authPath] = {
     requireBuilder: (_req, _res, next) => next(),
     requireRank: () => (_req, _res, next) => next(),
     requirePermission: () => (_req, _res, next) => next(),
+    // ADR 0215 D4: the sliver route beside the directory gates on RANK, so the
+    // partial doorway must answer requireRank too or the router will not load.
+    requireRank: () => (_req, _res, next) => next(),
   },
 };
 
@@ -434,6 +437,9 @@ require.cache[moduleApiPath] = {
     pool: engine,
     requireBuilder: (_req, _res, next) => next(),
     requirePermission: () => (_req, _res, next) => next(),
+    // ADR 0215 D4: the sliver route beside the directory gates on RANK, so the
+    // partial doorway must answer requireRank too or the router will not load.
+    requireRank: () => (_req, _res, next) => next(),
     parsePagination: () => ({ limit: 100, offset: 0 }),
     corsPublicGet: () => (_req, _res, next) => next(),
   },