@bongos/core 1.19.431 → 1.19.432

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.431",
-  "core_contract": "1.19.431",
-  "source_commit": "4fd9f0748403564b999e3e0459d44c169c751d4b",
+  "core_version": "1.19.432",
+  "core_contract": "1.19.432",
+  "source_commit": "4eb69cf372f019d1c3948b76a4622fcd52d1f366",
   "source_ref": "HEAD",
-  "built_at": "2026-08-29T21:48:51.014Z",
+  "built_at": "2026-08-29T22:45:12.145Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 365,
+    "docs_redacted": 366,
     "agent_docs_stubbed": 23,
     "functional_verbatim": 1740,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2128,
-  "tree_sha256": "bc4e3ea3fba769c809456cccf0abb0abcc8d513d047083307f7431afbc38f780",
+  "file_count": 2129,
+  "tree_sha256": "d3a5f9d13efe32c537eb55d7798e144187ea1f6ca7d55d178e93f76265fe0a0e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1574,10 +1574,15 @@
       "mode": "0000644",
       "sha256": "8c248b7e041f21da26ef55cb79c8bcaf20713d3e271ea7ee0de851d452c19e58"
     },
+    {
+      "path": "docs/adr/0216-a-fake-pool-interpreter-must-fail-loudly-not-silently-ignore.md",
+      "mode": "0000644",
+      "sha256": "779df4072b2096f1f6a106013a1600e694908c009f4608a9b6a86a82cf225d7d"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "5cf8b81ec623dd3614683c2114c1fee38ddc5c3a1bf73e2c69ac4fe8ef79ff25"
+      "sha256": "ce67295dd5d29df98dcb2fedc1998d980a575e11a46fb3fb9b78f56b98660db7"
     },
     {
       "path": "docs/api-reference.md",
@@ -1977,7 +1982,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bd4bbd81fbdd0cbffbcc882bb8bd876caf4aacc863a0e4ae3b331ee8133053e6"
+      "sha256": "d05842c9eadbfddf0b3d29e0ccb27cabd6d9416bb2d3a86cf40717fde68a2314"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5587,12 +5592,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bf42d45381a85e4f5794f08f0deaf9e7baee6787599cbb0f034153c03e06affb"
+      "sha256": "600722d9ed042b5ca38ffcf70b4db65df50e730d58a717a65a86334d83cb7a62"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b2c2d95bd1b8ef2a9d5c6dfa42362827ddf2e50beddbc8765460885ecabd4cf5"
+      "sha256": "d6ec836d3cf795c5aa9c7f84fff005ce337e30bcf5855fc99875437e76e851b9"
     },
     {
       "path": "public-docs/index.html",
@@ -7722,7 +7727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a5f2a1e430a0dc50156d93a88ed4bd1b6c6bc232eed2ea1aab4ae017ee768777"
+      "sha256": "6838d7c37cb8446a2f2e8f5a0c672049a4ede70feea5f0f9de0d9386eef797c6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7862,12 +7867,12 @@
     {
       "path": "tests/application_echo.mjs",
       "mode": "0000644",
-      "sha256": "6272bf127a71c682b482353dc2f56e527f54a351805f8b5d7d66be66db111c25"
+      "sha256": "f32263937f78ac7497fb940e1b7859151f7d794a729c5c9305b149f8677ad722"
     },
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "ddf0dd72bda85e452485ed8869feb2fe39d0d230c6647a1573c5ea87efbee42b"
+      "sha256": "ac8128aa0834f420ee744e057cd2baa01569611052d199dba9e5d28986ff1166"
     },
     {
       "path": "tests/architect.mjs",
@@ -8312,7 +8317,7 @@
     {
       "path": "tests/connections_ownership.mjs",
       "mode": "0000644",
-      "sha256": "58fa2cbe6866697402fc22037a4b615c642311f40c85e4b19555de55e7591eb1"
+      "sha256": "ddd4a2dbd488b4455e1f227745cfd90456f8b4971e647d2be007e7783cc0a28c"
     },
     {
       "path": "tests/consumer_layout_boot.mjs",
@@ -8592,7 +8597,7 @@
     {
       "path": "tests/effective_visibility_predicate.mjs",
       "mode": "0000644",
-      "sha256": "88ff4b377f71785545e3aed908df70b505af40453f47695646a9f72bf7250ab0"
+      "sha256": "17b7292dba01d25f160d2dd292661e5c236b3f390399e66bfab09124b551eb8f"
     },
     {
       "path": "tests/est_advisory.mjs",
@@ -9107,7 +9112,7 @@
     {
       "path": "tests/handle_machinery.mjs",
       "mode": "0000644",
-      "sha256": "a86e615af8b148572abf562b3c7b0d556076286e76e2d8d576f782a90ba3d457"
+      "sha256": "209c1ebf3e57c6fed05eda28ef57033c7ed7da3e1a41670fc9aae05497b29698"
     },
     {
       "path": "tests/help_requests.mjs",
@@ -9142,7 +9147,7 @@
     {
       "path": "tests/hub_profile_leak.mjs",
       "mode": "0000644",
-      "sha256": "ea992d1ab2ddedc27aaa5348a397356bef91a4c1ad9b295eb1a0ed1c4fc707e9"
+      "sha256": "e9609a8adad0c460c24db69211f02beef3699e3e841d44c1385105c4f5c93385"
     },
     {
       "path": "tests/hub_recent_ships.mjs",
@@ -9672,7 +9677,7 @@
     {
       "path": "tests/own_session_revoke.mjs",
       "mode": "0000644",
-      "sha256": "756920320b74c9094d1be12108efb8ddbb39341b8d122afd9454ffd084a2efe5"
+      "sha256": "34ae2846e314ad4ba732a40257fb81f7b4e4be3e81e3b6d1f478c3bb0690f23d"
     },
     {
       "path": "tests/package_core.mjs",
@@ -9752,7 +9757,7 @@
     {
       "path": "tests/profile_connections_ui.mjs",
       "mode": "0000644",
-      "sha256": "1e6923437bcafbbb396d43202a4fe5c9d49dd9baef059d84aa2520bd64a195b6"
+      "sha256": "6a5e6bd1fa52d8d757436efcfca19ffb5c2a7470f1a6583f26802a24689b4eb8"
     },
     {
       "path": "tests/profile_fields.mjs",
@@ -9767,12 +9772,12 @@
     {
       "path": "tests/profile_privacy_owner_view.mjs",
       "mode": "0000644",
-      "sha256": "75cc928587baac3151104c3ff4a1cfd39436fc7255f3afac818079724d6dbab1"
+      "sha256": "f5e664627bf60830c241539cd001b5eebc55a5786c191154bdd6b6f3dbd745ed"
     },
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
-      "sha256": "b926ffa5d4e96ef223e4057ecc3e64d678ca1e16ec4afe79cb90cbf3e35e65e0"
+      "sha256": "130672f5f844f2552f98bdc3e7b30fa9d49dd460e81c02a60c5684db6617f804"
     },
     {
       "path": "tests/profile_route.mjs",
@@ -10062,7 +10067,7 @@
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",
       "mode": "0000644",
-      "sha256": "db4aa5ab365d1d2e9884b2c5a3f2abc40942e123844b7d5434434ddce680fd13"
+      "sha256": "db4f7dc8fc076c908bbb09b00672a8e3619ef6234d7a0574954b06637c989e10"
     },
     {
       "path": "tests/scouting_page_gate.mjs",
@@ -10072,7 +10077,7 @@
     {
       "path": "tests/scouting_rollup_fanout.mjs",
       "mode": "0000644",
-      "sha256": "3451cb25abd4eb819a7b951d1e06310d575faf6145808711fcdd2e2afb655ec3"
+      "sha256": "dd40bf29dd83c4424cd23bfe3985381226898653f2edf4d883a5b32f108bafa3"
     },
     {
       "path": "tests/scrubber_corpus.mjs",

package/docs/adr/0216-a-fake-pool-interpreter-must-fail-loudly-not-silently-ignore.md

@@ -0,0 +1,102 @@
+# ADR 0216 — A fake-pool interpreter must FAIL LOUDLY on what it cannot model; the refusal is uniform, the interpreters stay separate
+
+- **Status:** accepted
+- **Date:** 2026-08-29
+- **Task:** [task 1003354](https://cloudbongos.com/builders#/task/1003354) (folding in idea 1000877, raised by the adversarial review of [task 1002968](https://cloudbongos.com/builders#/task/1002968))
+- **Relates to:** [ADR 0202](<redacted>.md) D4 and [ADR 0213](<redacted>.md) (the predicates these interpreters stand in for), [ADR 0215](<redacted>.md) D7 (where the structure guard was first written), [ADR 0091](<redacted>.md) §2 (deliberate duplication across a boundary)
+
+## Context
+
+Nine test files in this repo carry a **fake pool** — an in-memory Postgres substitute whose row filter is derived from *each statement's own `WHERE` text* rather than hand-written. That design is deliberate and good: it is what makes a proof like `tests/connections_ownership.mjs` say something about the real query instead of about a canned response. Delete `addressee_github_id = $2::bigint` from the real SQL and the fake genuinely stops applying it, so a stranger's row genuinely moves and the test genuinely reds.
+
+The design has one failure mode, and it is silent: **a term the interpreter does not recognise is simply not applied.** A predicate the fake cannot read degrades to *no* predicate, the boundary becomes vacuous, and every assertion above it keeps passing. Each file already understood a piece of this and guarded it:
+
+- an unread `$N` placeholder throws (all nine);
+- a literal comparison on an unknown column throws (four);
+- an unmodelled `IS [NOT] NULL` throws (two, added by [ADR 0213](<redacted>.md)).
+
+Every one of those guards is a **term** guard, and three separate reviews found the same thing: the term list is not the predicate.
+
+**The missing term.** ADR 0213 made consent two columns — `profile_state = 'active' AND terms_accepted_at IS NOT NULL`. `tests/scouting_owner_access_and_reach.mjs` modelled the first and not the second. A `NULL` test is a *third syntax*: the placeholder sweep scans `$N`, the literal sweep matches `col = '…'`, and neither can see `IS NOT NULL` at all. So the term was dropped in silence and the suite reported **17 passed, 0 failed** while modelling a predicate the database no longer had — inside a file whose own header states that exact failure is impossible.
+
+**The rewritten joiner.** The adversarial review of task 1002968 found the deeper one. An interpreter that COLLECTS the terms it recognises and `AND`s them **re-imposes an `AND` the SQL may no longer contain.** Rewrite a predicate's `AND` to `OR` and Postgres serves every *active* account on the platform — private ones included — or lets any builder revoke any session by id; the term-collecting fake answers exactly as it did before, and every isolation and 404 assertion in the file stays green. Task 1002968 fixed the three copies it owned and filed the rest as idea 1000877.
+
+**Recognition is not application.** ADR 0213's own first draft checked only that the column *name* was recognised, and a mutation deleting the filter still passed. It needed a second set to prove the term had been turned into a filter — which is bookkeeping that can itself go stale.
+
+The common shape of all three is one sentence: **the interpreter silently answered a question it was not asked.**
+
+## Decision
+
+### D1 — The governing rule: an interpreter that cannot model a term must REFUSE the statement, never ignore the term
+
+This is the rule the fake-pool pattern always implied and never stated. It is not "model every term" — a test fake is allowed to be incomplete. It is that **incompleteness must be loud.** A statement carrying anything this interpreter cannot faithfully reproduce is an error thrown at the test, not a filter quietly dropped from the answer.
+
+Refusing is safe in a way ignoring is not, and the asymmetry is the whole argument: a refusal fails the build *today*, in the session that changed the SQL, with the unreadable text in the message. A silent drop fails nothing, ever, and the proof above it becomes decorative without anyone learning that it did.
+
+### D2 — The mechanism is a CONSUMING parse with a pure-conjunction residue check
+
+Term guards cannot express D1, because a guard has to know a term exists before it can complain about it — and the whole problem is the terms nobody thought of. So the interpreter is inverted: instead of listing what it recognises, it accounts for **everything the clause contains**.
+
+Each recognised term is matched, modelled, and **spliced out of the text**. Whatever survives is exactly the part the interpreter did not understand, and it must be nothing but whitespace, parentheses and `AND`:
+
+```js
+if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) throw new Error(`fake pool: unmodelled boolean structure …`);
+```
+
+That single check subsumes every term guard that came before it and closes all three defects at once. An unmodelled `IS NOT NULL` survives in the residue. An `OR`, a `NOT`, a `CASE` survives in the residue. And **recognition can no longer come apart from application** — a term the interpreter recognised but did not apply is, by construction, still there — which retires ADR 0213's `modelled`-set bookkeeping rather than maintaining it.
+
+A legitimate `OR` — the handle rename window, connections' either-side clause, the session-expiry disjunction, the rescind transition guard — is consumed as a **whole unit**, which is both how it survives the check and how it stays honest: a matcher that tore one in half would leave a dangling `OR` and be refused.
+
+Two term guards are kept in front of the structure guard, not because they add coverage but because they add a **better error**: an unreadable `$N` or an unknown column is reported as the thing it is, rather than as leftover text.
+
+### D3 — The interpreters stay SEPARATE; only the refusal is uniform
+
+Nine copies of nearly-identical machinery is the shape that normally demands extraction, and it was considered and rejected. Task 1002968 concluded these are independent by construction; this ADR agrees, with the reason written down:
+
+**What differs is the term vocabulary, and it differs completely.** These interpreters stand in for different tables — `platform_identity_accounts`, `platform_identity_connections`, `builder_sessions`, `access_requests`, `platform_identity_application_echoes`, `<redacted>` — and share almost no term. A shared registry would have to accept every table's vocabulary, which makes it a small SQL engine: more code than the copies it replaces, harder to reason about, and a new place for a bug to hide *behind* the guard rather than in front of it. It would also couple unrelated proofs — a session-revoke test would fail to a change in a connections matcher.
+
+**What must never differ is the refusal**, and that is three lines and one regex. So the discipline is: identical guard, identical error message, in every copy — and each copy carries its **own calibration test** pinning the four refusals (unknown literal, unread placeholder, unmodelled `NULL` test, `OR`) plus a `doesNotThrow` over the real composed predicate, so the guard is a filter on the unreadable and not a blanket refusal.
+
+That per-file calibration is the anti-drift mechanism a shared helper would otherwise have provided, and it is strictly better at the job: a shared helper proves the guard exists *somewhere*; a calibration test in each file proves the guard is *reached* by that file's own statements.
+
+### D4 — A modelled term proves nothing until a fixture makes it observable
+
+The corollary, learned twice in one session. Modelling `terms_accepted_at IS NOT NULL` while every fixture carries an acceptance is a filter that filters nothing: delete the term from the real predicate and the answer does not change, so the mutation does not bite and the proof is cosmetic.
+
+Every axis a predicate carries therefore needs **one fixture that differs on that axis alone**. Three were added here — a pre-terms account in the scouting directory and in the real-DB rollup proof, and a pending membership in the application echo — each differing from the control in exactly one column, so the mutation that deletes the term has somewhere to land.
+
+Where a file deliberately does *not* carry such a fixture because another file owns that matrix, the comment says so. An absence that is a decision reads differently from an absence that is an oversight, and only the first survives the next reader.
+
+### D5 — Every copy is verified BY MUTATION, against the real source
+
+No copy was accepted on green. For each, a term was deleted or an `AND` rewritten to `OR` **in the real module**, the file was required to go red, and the source was reverted. Ten mutations, ten reds, every one of them a 0-failure pass before this work:
+
+| mutation (in real source, reverted) | file | before → after |
+|---|---|---|
+| `accountActiveSql`: delete the acceptance term | `scouting_owner_access_and_reach` | 0 → 2 failed |
+| `accountVisibleSql`: `AND` → `OR` | `scouting_owner_access_and_reach` | 0 → 10 failed |
+| `accountActiveSql`: delete the acceptance term | `effective_visibility_predicate` | 0 → 2 failed |
+| `accountVisibleSql`: `AND` → `OR` | `effective_visibility_predicate` | 0 → 8 failed |
+| `accountVisibleSql`: `AND` → `OR` | `profile_privacy_owner_view` | 0 → 3 failed |
+| `listRecentApplications`: `AND` → `OR` | `application_echo` | 0 → 1 failed |
+| `listMembershipsForAccount`: `AND` → `OR` | `application_echo` | 0 → 6 failed |
+| `listMembershipsForAccount`: delete the pending term | `application_echo` | 0 → 3 failed |
+| `acceptConnection`: `AND` → `OR` | `connections_ownership` · `profile_connections_ui` | 0 → 4 · 0 → 1 failed |
+| `revokeSessionForBuilder`: `AND` → `OR` | `own_session_revoke` | 0 → 4 failed |
+| `listActiveSessionsForBuilder`: delete `revoked_at IS NULL` | `own_session_revoke` | 0 → 2 failed |
+
+## Consequences
+
+- **Nine fake pools now refuse what they cannot read.** `tests/recruiter_sliver_boundary.mjs` (where the pattern originated), `effective_visibility_predicate`, `profile_privacy_owner_view`, `scouting_owner_access_and_reach` (both of its filters), `connections_ownership`, `profile_connections_ui`, `own_session_revoke`, `application_echo`, `application_lifecycle`. `canonical_profile_url` is deliberately untouched: its residue must be **empty**, which is strictly stronger, so it already refuses an `OR`.
+- **Adding a term to a shared predicate now BREAKS the tests that model it**, loudly, in the session that adds it — instead of being silently absorbed. That is the intended cost and the entire point: ADR 0213 tightened `accountActiveSql` and five proofs absorbed the change without noticing.
+- **`own_session_revoke.mjs` had no calibration test at all** and three silently-permissive paths, including a clause with no readable term yielding an empty filter that matched every row. On a table where the predicate *is* the own-scope boundary.
+- **`application_echo.mjs` was deleting a term before interpreting it** — `membership_kind <> 'pending'` was `.replace`d out of the clause, so dropping it from the real query would have been invisible (the replace would simply no-op). Stripping a term you do not want to model is the same defect as ignoring one; the term is modelled now.
+- **A residue check must strip the statement's tail** (`ORDER BY`, `RETURNING`, `LIMIT`) and consume table aliases, or it refuses correct statements. Both were found by the guard failing honestly on real SQL, which is the guard working.
+
+## Alternatives rejected
+
+- **One shared interpreter module.** D3. The vocabulary is per-table and shares almost nothing; the shared thing would be a small SQL engine, and it would couple unrelated proofs.
+- **A fitness check asserting every fake pool carries the guard.** Tempting, and it would catch a *new* copy written without one. Rejected for now: it would have to identify "a fake pool" by heuristic, and a heuristic gate over test internals is a maintenance surface with a false-positive cost. The per-file calibration tests hold the copies that exist; a tenth copy written without one is a review question. Recorded here as the known gap rather than papered over.
+- **Keeping the `KNOWN_NULL_TESTS` + `modelled` pair alongside the structure guard.** Strictly weaker and now redundant: an unapplied term is still in the residue. Two sets to keep in sync, for nothing.
+- **Parsing the boolean tree properly.** A real parser would let the fake *model* an `OR` rather than refuse it. That is a worse trade for a test double: refusing is a one-line invariant, and no statement in this repo needs a disjunction the unit-consumption approach cannot handle.
+- **Accepting green as verification.** The failure this ADR exists for is invisible to a passing suite, by definition. D5.

package/docs/adr/README.md

@@ -302,5 +302,6 @@ This keeps the decision history honest and traceable.
 | 0210 | [**The recruiting directory graduates on an instance-asserted ownership claim, and the recruiting opt-out gates the directory and nothing else** ([task 1002290](https://cloudbongos.com/builders#/task/1002290), R14, goal 1000045 criterion C5 — "project owners, not only Archons, browse builder profiles to recruit"). Two independent problems wore one task id. The reach flag `recruiter_discoverable` protected nobody — task 1002967 said so, and the Settings row stayed in the future tense because of it. And "widen the Archon-only /scouting" was already stale (ADR 0157 lowered `project.curate` to metic) while hiding the real question: **a project owner is not a rank**, and someone who registers a project is an Archon on their OWN instance and usually a bare `xenos` on the hub where the directory lives, so no floor reaches them without reaching every stranger. **D1** "project owner" on the hub is `<redacted>.membership_kind = 'owner'` — written by the PROJECT itself at `POST /sso/membership/check-in` from its own first-admin config, and refused unless the hub's own `signin_verified_at` witness stands (ADR 0205) — and never `platform_identity_projects.owner_github_id`, the hub-curated column ADR 0201 D3 names and forbids; the prohibition is about a hub-held list consulted before an ADMISSION on someone else's box, and this is the hub reading the instance's own mirrored claim before a read of the hub's OWN directory. **D2** the two doors are an OR in `modules/platform-identity/scouting-authz.js` (the `goal-authz.js` owner-or-rank shape, kept out of `platform-identity.js` at its size ratchet): ownership is asked first and a "no" falls through to the UNMODIFIED `requirePermission`, so a refusal keeps its exact code, `required`/`held` and floors map — the widening can only admit; the atom is spelled in the ROUTE's middleware list, because a gate hidden in the helper would make `route-rank-check.js` and `gen-api-docs.js` record this privileged route as `any-builder`; and a broken ownership read falls closed onto the rank door rather than admitting or 500ing. No atom is minted — `project.recruit` belongs to the console wave (spike 1002786 R3). **D3** `PAGE_GATES` gains an optional `alsoAdmits` naming a function on the `platform-identity.hub` port, declared on `requireProjectCuratePage` alone and consulted only after the permission check refused, so the `/people` shell admits exactly the two audiences its data route does; absent port, absent function or a throw all deny. **D4** the reach COALESCE gets its SQL twin in `account-visibility.js` (its sole owner) and composes into `scoutingListableSql` = rollup AND reach, which `listScoutingRollup` joins — but reach is deliberately NOT folded into `rollupVisibleSql`, because the community spec D3 says the opt-out governs the recruiting surface only and folding it down would silently empty a future public leaderboard. **D5** no migration: both columns exist and migration 003's `(github_id)` index already serves the probe. **D6** the ownership query JOINs `platform_identity_sso_clients` on `status='active'` — a membership row never expires and nothing ages it out, so suspending the client (the lever that already stops a project signing anyone in) had to revoke the read it derives, or suspending a rogue project would leave its owner reading every builder on the platform forever. The task's own adversarial review also found the sole-owner drift guard was matching only the UNALIASED spelling of the reach COALESCE — i.e. not the one that ships — and two fail-open defaults (a prototype-reachable `alsoAdmits`, and an alias guard resting on template evaluation order); all three fixed and mutation-checked. ⚠ Honest limits recorded, not fixed: the hall NAV still hides People from a project owner (task 1003349, sequenced with R15 which owns that surface), the `touchMembership` write path stays as ADR 0205 left it, and `openapi.json` cannot express "or owner". ⚠ And DELEGATES do not reach the directory yet (blocker 1000122 + task 1003350, linked) — an instance reports `owner` for its first admin only, so the registrant half works and the delegate half needs the instance to report `owner` for any archon, which changes a cross-version wire contract and a shipped bucketing; filed as blocker 1000122, and nothing here changes when it is answered. Rejected: lowering the floor further (a floor low enough to admit a registrant excludes nobody); a `project.owner` atom (ADR 0201 D3 rejected it); minting `project.recruit` here; gating on `owner_github_id`; folding reach into the rollup predicate; widening `membershipKind()` on our own judgement; shipping the route without the page.](<redacted>.md) | platform identity / authz + privacy |
 | 0215 | [**The pre-accept recruiter sliver is a CEILING, not a step: a whitelist keyed by consent-and-reach, on the recruiting surface’s own door** ([task 1002968](https://cloudbongos.com/builders#/task/1002968), PV3 · goal 1000045 criteria C2/C5; privacy spec D3, owner-signed 2026-08-16). Privacy spec D2 has a row nothing could serve — **private · discoverable** — and ADR 0210 D4 named the reason: *“the full rollup is never its disclosure — the D3 sliver is”*. Decisions: **D1** the audience predicate is `recruiterSliverVisibleSql` = `accountActiveSql AND recruiterReachSql`, composed in `account-visibility.js` (its sole owner) and the ONE composed answer that deliberately **omits the existence axis** — ANDing `accountVisibleSql` would empty the sliver of exactly the account it serves; dropping it is safe only because reach is `COALESCE(recruiter_discoverable, visibility=’public’)`, so a private account reaches this surface only by its owner’s explicit opt-IN — and, after adversarial review, that opt-IN must be the one they MEANT: `setAccountPrivacy` now resets `recruiter_discoverable` to NULL when a PATCH turns an account private without naming reach, because a `true` set while PUBLIC meant “recruiters may see my public profile” and this predicate would have activated that stale consent silently. `profile_state=’active’` still floors it (a provisional account is never recruiter-visible) and `hide_stats` is absent, because hide changes the sliver’s SHAPE, never who appears in it; the guard PINS that existence-less predicate to its one reader, since a future public read joining it would look adopted while serving private accounts. **D2** the projection is a literal whitelist — `handle`, `display_name`, `avatar_url`, `disciplines`, `active_recently`, and under `hide_stats` the last two are **absent, not null**, with the activity query never issued at all (the cheapest way for a later edit to leak a number is for it to already be in hand). `last_active` is compared to the 30-day window IN SQL and only the boolean returns, so the date never enters the process; `github_id`/`github_login` are never KEYS, every count and any profile URL stay out — with one limit stated rather than glossed: the avatar D3 grants is GitHub’s own URL and embeds the account id, so the proof pins WHERE the id may appear instead of claiming an absence the code does not deliver. **D3** the handle is an ADDRESS, not a door — `GET /profiles/:handle` joins `accountVisibleSql` and 404s for the very account whose sliver was just read (asserted, with a 200 control), and a PREVIOUS handle resolves to nothing here unlike the public page’s 301, because a recruiting read has no shared links to preserve and a redirect would confirm a rename. **D4** one route, `GET /scouting/:handle`, beside the directory in `routes/scouting.js` but deliberately NOT sharing its gate: **no `project.recruit` atom is minted** (ADR 0201 D3 and ADR 0210 both reserve it for the console wave that defines it), and until it exists the sliver holds spec D1’s declared floor for that atom — `api.requireRank('archon')`. The first draft reused the directory’s door and that was WIDER than the owner-signed floor on both halves (`project.curate` at metic, OR any project owner — typically a bare xenos), on the first surface that discloses a PRIVATE account; narrowing after people are disclosed is not recoverable, widening later is. The audience question is the owner’s and is FILED, not taken — blocker 1000126, with the C5 tension it carries and a one-line swap either way. 404 never 403 (a 403 confirms the handle), `no-store` (ADR 0171 D5). **D5** it grants nothing (ADR 0016): the module is required by exactly ONE first-party server file — the route that serializes it — enumerated from source, and no rank/role/permission/membership travels with it. **D6** the Settings copy widens back from “the People directory” (narrowed by task 1002290 while this was unbuilt) to name **both** recruiting surfaces — “both” and not “every”, because a guard asserts `routes/scouting.js` mounts exactly two routes and that both readers compose `recruiterReachSql`. The half that was actually WRONG was the grant itself: the copy promised a hidden account “your name and nothing else” while the sliver also ships the AVATAR, never named the picture in the shown branch, and never told a private account this is the one thing a recruiter sees while their page answers “not found”. The guard now iterates SLIVER_KEYS from the module instead of checking transcribed phrases, so a sixth granted field cannot ship undescribed. **D7** no migration; the port lives beside `getPublicProfileExtras` in the MODULE, not the file, which is on the 1500-line ratchet. The proof is a whitelist over the module’s own exported key list, planted improbable sentinels asserted absent from the whole body with controls against vacuity, and a fake pool that reads boolean STRUCTURE — the house interpreter collects terms and ANDs them, so rewriting this predicate’s `AND` to `OR` (which in Postgres serves EVERY active account) passed all three test files green until each term was made to be CONSUMED and the residue required to be pure conjunction. That hole is still open in five sibling proofs (idea 1000877). Four further defects came out of the same review: the credits/karma sentinels sat on rows the sliver never reads, a “control” compared a fixture to itself, and the one-reader pin missed the predicate’s JS twin. ⚠ Honest limits: **no UI consumes it yet** (the recruiting view is the console wave’s and task 1002972’s); **the audience is UNRESOLVED** (blocker 1000126) and the archon floor is narrower than goal C5 describes, so project owners cannot use the sliver today; the two-route guard counts only `routes/scouting.js`, so a recruiting read added elsewhere would not trip it; the route is unmetered (idea 1000876); and `active_recently` understates for a builder whose only project never reports a rollup. Rejected: flooring on `accountVisibleSql`; folding reach into `rollupVisibleSql`; minting `project.recruit`; **reusing the directory’s door**; leaving a stale `recruiter_discoverable = true` to read as consent after an account goes private; a second route file; null-instead-of-absent rollup keys; a profile URL / `github_login` / a project count / a raw `last_active`; 301-ing a previous handle; 403 for a non-discoverable builder.](<redacted>.md) | platform identity / privacy |
 | 0213 | [**The platform T&C acceptance is the hub's own witness, written once, and consent becomes two columns** ([task 1002913](https://cloudbongos.com/builders#/task/1002913), goal 1000045). ADR 0141 §4 deferred consent for cross-project aggregation to "the platform T&C" and ADR 0171 D3 wrote its own definition around the moment that acceptance "can later be captured" - but no acceptance record existed, and while `/terms` DOES exist (task 1003251) it says nothing about work crossing between projects, so the public-profile premise ("already carries platform T&C consent") was untrue for every account. The scouting.js:6 pointer the task named had also been overwritten by ADR 0210, so the debt was going invisible rather than getting paid. Decision: `terms_accepted_at` + `terms_version` on `platform_identity_accounts` (migration 019), written ONLY by `upsertAccount`'s `activate` branch - one caller, /sso/authorize, where `activate: true` is a source literal and every field comes from the hub's resolved session (the ADR 0205 D3 property; a record a caller could assert is evidence of nothing). COALESCE makes it write-once, so the column keeps meaning WHEN consent was given. The consent axis in `account-visibility.js` becomes `profile_state = 'active' AND terms_accepted_at IS NOT NULL`, composed into every other predicate, which is what makes the tie structural rather than a promise. NO backfill (D4): existing active accounts re-accept on their next hub sign-in - ADR 0171 D3's own rule and P03's ratified rationale - and that visible consequence, plus the wording itself, went to the owner on blocker 1000123. Rejected: an acceptances TABLE (no event stream yet), a click-through gate (an interstitial in a redirect built to be invisible; additive later), backfilling (records a consent that never happened), deriving profile_state from the timestamp, and putting the predicate in `terms-acceptance.js` (a second owner of an effective-visibility answer, which ADR 0202 D4 forbids).](<redacted>.md) | platform identity / consent / privacy |
+| 0216 | [**A fake-pool interpreter must FAIL LOUDLY on what it cannot model; the refusal is uniform, the interpreters stay separate** ([task 1003354](https://cloudbongos.com/builders#/task/1003354), folding in idea 1000877 from the adversarial review of [task 1002968](https://cloudbongos.com/builders#/task/1002968)). Nine test files carry a **fake pool** whose row filter is derived from each statement’s own WHERE text — the design that makes an isolation proof say something about the real query rather than about a canned response. It has one silent failure mode: a term the interpreter does not recognise is simply not applied, so the boundary goes vacuous and every assertion above it keeps passing. Each file guarded a piece of that (unread `$N`, unknown literal, unmodelled `IS NULL`) and every one of those is a **term** guard — and the term list is not the predicate. Three reviews found the same shape. **The missing term:** ADR 0213 made consent two columns and `scouting_owner_access_and_reach.mjs` modelled only the first; a NULL test is a third syntax neither sweep can see, so the suite reported 17 passed while modelling a predicate the database no longer had, inside a file whose own header calls that impossible. **The rewritten joiner:** an interpreter that COLLECTS recognised terms and ANDs them re-imposes an `AND` the SQL may no longer contain — rewrite a predicate’s `AND` to `OR` and Postgres serves every active account on the platform, or lets any builder revoke any session by id, while the fake answers exactly as before. **Recognition is not application:** ADR 0213’s own first draft checked only that a column name was recognised, and a mutation deleting the filter still passed. Decisions: **D1** the governing rule — an interpreter that cannot model a term must REFUSE the statement, never ignore the term; incompleteness is allowed, silence is not, because a refusal fails the build in the session that changed the SQL while a silent drop fails nothing ever. **D2** the mechanism is a CONSUMING parse: each recognised term is spliced out of the text and the residue must be a pure conjunction (`/^[\s()]*(?:AND[\s()]*)*$/`), which subsumes every term guard, catches `OR`/`NOT`/`CASE`, and retires ADR 0213’s `modelled`-set bookkeeping because an unapplied term is by construction still there; a legitimate `OR` (the rename window, the either-side clause, the expiry disjunction, the rescind guard) is consumed as a whole unit. **D3** the interpreters stay SEPARATE and only the refusal is uniform — the term vocabulary differs completely across six tables, so a shared registry would be a small SQL engine and would couple unrelated proofs; instead every copy carries the identical guard and its OWN calibration test, which is strictly better anti-drift than extraction (a helper proves the guard exists somewhere; a calibration test proves it is reached by that file’s own statements). **D4** a modelled term proves nothing until a fixture makes it observable — three fixtures added, each differing from its control in exactly one column, so the mutation that deletes the term has somewhere to land; where a file deliberately lacks one because another owns that matrix, the comment says so. **D5** every copy verified BY MUTATION against the real source — ten mutations, ten reds, each a 0-failure pass beforehand. ⚠ Honest limits: no fitness check asserts a NEW fake pool carries the guard (identifying “a fake pool” needs a heuristic, and a heuristic gate over test internals has a false-positive cost) — the per-file calibration tests hold the nine that exist and a tenth is a review question; `canonical_profile_url.mjs` is untouched because its residue must be EMPTY, strictly stronger already. Rejected: one shared interpreter module; a fitness heuristic; keeping `KNOWN_NULL_TESTS` + `modelled` beside the structure guard; parsing the boolean tree properly; accepting green as verification.](<redacted>.md) | testing / proof integrity |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/module-api-changelog.md

@@ -1299,5 +1299,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.429 with no explicit bump. run 33275468532. (task 1002620)
   1.19.431 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.430 with no explicit bump. run 33277001235. (task 1002620)
+  1.19.432 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.431 with no explicit bump. run 33279328366. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.431",
+  "version": "1.19.432",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.431",
+      "version": "1.19.432",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.431",
+  "version": "1.19.432",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.431'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.432'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/application_echo.mjs

@@ -111,9 +111,18 @@ function seed() {
     { github_id: ME, client_id: 'proj-joined', applied_at: now - 5 * DAY },
     { github_id: ME, client_id: 'proj-stale', applied_at: now - 40 * DAY },
     { github_id: 9999, client_id: 'proj-someone-elses', applied_at: now - DAY },
+    // Applied to a project that has since INVITED them — a pending membership,
+    // which is not building on it. The echo must survive.
+    { github_id: ME, client_id: 'proj-invited', applied_at: now - 3 * DAY },
   ];
   memberships = [
     { client_id: 'proj-joined', membership_kind: 'builder', joined_at: now - 4 * DAY, last_active: now, project_name: 'Joined', project_origin: 'https://joined.example', owner_github_id: null },
+    // The row `listMembershipsForAccount`'s `membership_kind <> 'pending'` exists
+    // to exclude. Without it a pending INVITE would read as membership, and the
+    // card would flip to "you build here" for a project the person never joined
+    // — so this fixture is what makes that term observable rather than merely
+    // modelled (task 1003354).
+    { client_id: 'proj-invited', membership_kind: 'pending', joined_at: now - DAY, last_active: null, project_name: 'Invited', project_origin: 'https://invited.example', owner_github_id: null },
   ];
   echoFails = false;
   statements = [];
@@ -140,6 +149,11 @@ function predicateFor(rawWhere, params) {
   if ((m = /\bclient_id = \$(\d+)/.exec(where))) {
     const v = p(m[1]); tests.push((r) => r.client_id === v); eat();
   }
+  // listMembershipsForAccount's pending exclusion. Modelled rather than stripped
+  // before interpreting, so deleting it from the real query changes this answer.
+  if ((m = /\bm\.membership_kind <> 'pending'/.exec(where))) {
+    tests.push((r) => r.membership_kind !== 'pending'); eat();
+  }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(ph[1])) {
@@ -155,12 +169,16 @@ function predicateFor(rawWhere, params) {
   // had already hidden one real filter, so the residual is swept too: this is
   // what makes "refuses a predicate it cannot read" true of ALL predicates
   // rather than only parameterised ones.
-  const residual = where
-    .replace(/\bTRUE\b/gi, ' ')
-    .replace(/\b(?:AND|OR)\b/gi, ' ')
-    .replace(/[()\s]/g, '');
-  if (residual) {
-    throw new Error(`fake pool: unmodelled predicate "${residual}" in "${rawWhere}" — a filter the interpreter cannot read must be a loud error, not a silent no-op`);
+  //
+  // AND THE JOINER IS PART OF THE PREDICATE (task 1003354, idea 1000877). This
+  // sweep used to erase `OR` alongside `AND`, so an `AND` rewritten to `OR` left
+  // the fake still ANDing its collected terms and every test green — while the
+  // real query would return a row matching ANY one of its terms, i.e. every
+  // other account's applications. What survives must therefore be a PURE
+  // CONJUNCTION: whitespace, parentheses and `AND`, nothing else.
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, not a silent no-op`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -182,7 +200,11 @@ const pool = {
 
     if (/FROM platform_identity_project_memberships m/.test(sql)) {
       m = /WHERE (.+?) ORDER BY/.exec(sql);
-      return { rows: memberships.filter(predicateFor(m[1].replace(/ AND m\.membership_kind <> 'pending'/, ''), params)) };
+      // The pending exclusion is MODELLED, not stripped. It used to be deleted
+      // from the clause before interpreting, which meant dropping it from the
+      // real query would have been invisible here — the `.replace` would simply
+      // no-op and the residual sweep would never see the term (task 1003354).
+      return { rows: memberships.filter(predicateFor(m[1], params)) };
     }
 
     if (/^DELETE FROM platform_identity_project_memberships WHERE client_id = \$1 AND github_id = \$2$/.test(sql)) {
@@ -296,8 +318,11 @@ const join = (note) => call('POST', '/api/gds/my-projects/join', { origin: 'http
 
 test('the interpreter refuses a predicate it cannot read — parameterised or not', () => {
   assert.throws(() => predicateFor('github_id = $1::bigint AND something = $2', [1, 2]), /unread predicate on \$2/);
-  assert.throws(() => predicateFor("github_id = $1::bigint AND client_id <> 'x'", [1]), /unmodelled predicate/,
+  assert.throws(() => predicateFor("github_id = $1::bigint AND status <> 'x'", [1]), /unmodelled boolean structure/,
     'a literal-only filter binds nothing, so the placeholder sweep alone would miss it');
+  assert.throws(() => predicateFor('github_id = $1::bigint OR client_id = $2', [1, 'p']), /unmodelled boolean structure/,
+    'and an AND rewritten to OR: the real query would then return every OTHER account\'s rows, '
+    + 'while an interpreter that re-imposed the AND would stay green (idea 1000877, task 1003354)');
 });
 
 // ── the echo is written only for an application the project actually took ────
@@ -369,7 +394,8 @@ test('GET /my-projects reports what was applied to and when — and no status',
   const r = await call('GET', '/api/gds/my-projects');
   assert.equal(r.status, 200);
   const applied = r.json.applied;
-  assert.deepEqual(applied.map((a) => a.client_id), ['proj-open']);
+  assert.deepEqual(applied.map((a) => a.client_id), ['proj-open', 'proj-invited'],
+    'newest first, and proj-invited is here because a PENDING membership is an invitation, not a join');
   assert.equal(applied[0].name, 'Target', 'a client_id alone is not renderable');
   assert.equal(applied[0].origin, 'https://target.example');
   assert.ok(applied[0].applied_at);
@@ -383,6 +409,14 @@ test('a project the applicant now BUILDS on drops out of applied — membership
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined']);
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-joined'),
     'an approval becomes visible by the card flipping to member, never by the echo claiming it');
+  // The other side of that same term: a PENDING row is an invitation, not a
+  // membership, so the project stays in `applied` and out of `building`. Delete
+  // `membership_kind <> 'pending'` from listMembershipsForAccount and both
+  // halves flip — which is what makes the read's own exclusion provable here.
+  assert.ok(!r.json.building.some((b) => b.client_id === 'proj-invited'),
+    'a pending invite is not building on the project');
+  assert.ok(r.json.applied.some((a) => a.client_id === 'proj-invited'),
+    'and their application is still on file — nothing has approved it');
 });
 
 test('an echo older than the window is invisible, not deleted', async () => {

package/tests/application_lifecycle.mjs

@@ -126,12 +126,17 @@ function predicateFor(rawWhere, params) {
   // had already hidden one real filter, so the residual is swept too: this is
   // what makes "refuses a predicate it cannot read" true of ALL predicates
   // rather than only parameterised ones.
-  const residual = where
-    .replace(/\bTRUE\b/gi, ' ')
-    .replace(/\b(?:AND|OR)\b/gi, ' ')
-    .replace(/[()\s]/g, '');
-  if (residual) {
-    throw new Error(`fake pool: unmodelled predicate "${residual}" in "${rawWhere}" — a filter the interpreter cannot read must be a loud error, not a silent no-op`);
+  //
+  // AND THE JOINER IS PART OF THE PREDICATE (task 1003354, idea 1000877). This
+  // sweep used to erase `OR` alongside `AND`, so an `AND` rewritten to `OR` left
+  // the fake still ANDing its collected terms and every test green — while the
+  // real UPDATE would resolve a row matching ANY one of its terms. What survives
+  // must therefore be a PURE CONJUNCTION: whitespace, parentheses and `AND`. The
+  // transition guard's legitimate `OR` is consumed as a whole unit above, which
+  // is what lets it survive this tightening.
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, not a silent no-op`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -312,9 +317,15 @@ test('the interpreter refuses a predicate it cannot read, rather than ignoring i
 test('the interpreter refuses a LITERAL-ONLY predicate too — the hole review found', () => {
   assert.throws(
     () => predicateFor("id = $1 AND resolved_at IS NULL", [1]),
-    /unmodelled predicate/,
+    /unmodelled boolean structure/,
     'a filter that binds nothing is invisible to the placeholder sweep, so the residual is swept as well'
   );
+  assert.throws(
+    () => predicateFor("id = $1 OR status = 'pending'", [1]),
+    /unmodelled boolean structure/,
+    'and an AND rewritten to OR: the resolve UPDATE would then act on a row matching ANY one of its '
+    + 'terms, while an interpreter that re-imposed the AND stays green (idea 1000877, task 1003354)'
+  );
   // and the modelled shapes still parse clean
   assert.doesNotThrow(() => predicateFor("lower(github_login) = lower($1) AND status = 'invited'", ['ada']));
 });

package/tests/connections_ownership.mjs

@@ -71,6 +71,22 @@ const row = (id) => rows.find((r) => r.id === id);
  * Build a row filter from a statement's own WHERE text. Every placeholder the
  * clause mentions must be consumed by a fragment below; one that is not throws,
  * so a predicate this cannot read can never degrade into "no constraint".
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS (task 1003354, idea 1000877). Every matched
+ * term is now BLANKED to ` TRUE `, and whatever survives must be a pure
+ * conjunction — whitespace, parentheses and `AND`. Two things that used to slip
+ * through in silence:
+ *
+ *   A LITERAL-ONLY term binds no placeholder, so the sweep below cannot see it.
+ *     `AND seen_at IS NULL` appearing (or disappearing) changed nothing here.
+ *   AN `AND` REWRITTEN TO `OR` is the dangerous one on THIS table: accept and
+ *     decline are `id = $1 AND addressee_github_id = $2::bigint AND status =
+ *     'pending'`, so an `OR` would let anyone accept anyone's request by id —
+ *     the exact isolation this file exists to prove. A term-collecting
+ *     interpreter re-imposes the `AND` and stays green through it.
+ *
+ * The remove path's either-side disjunction is the ONE legitimate `OR`, and it
+ * is consumed as a whole unit before the check, which is what lets it survive.
  */
 function predicateFor(rawWhere, params) {
   let where = rawWhere;
@@ -89,13 +105,17 @@ function predicateFor(rawWhere, params) {
   }
 
   let m;
-  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
-  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
-  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
-  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
+  // Each matcher BLANKS what it consumed, so the residue below is exactly the
+  // part of the clause this interpreter did not understand.
+  const eat = () => { where = where.replace(m[0], ' TRUE '); };
+  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
+  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); eat(); }
+  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); eat(); }
+  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
   if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.created_at > Date.now() - days * DAY);
+    eat();
   }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
@@ -103,6 +123,10 @@ function predicateFor(rawWhere, params) {
       throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
     }
   }
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, never a silently different filter`);
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -209,6 +233,22 @@ test('the interpreter refuses a predicate it cannot read, rather than ignoring i
     /unread predicate on \$2/,
     'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens'
   );
+  assert.throws(
+    () => predicateFor("id = $1 AND seen_at IS NULL", [1]),
+    /unmodelled boolean structure/,
+    'a literal-only term binds no placeholder, so the sweep above cannot see it at all'
+  );
+  assert.throws(
+    () => predicateFor("id = $1 OR addressee_github_id = $2::bigint", [1, ME]),
+    /unmodelled boolean structure/,
+    'and the one that matters here: with OR, accept/decline would act on ANY row matching the id '
+    + 'alone — anyone accepting anyone\'s request. A term-collecting interpreter re-imposes the AND '
+    + 'and every isolation assertion below stays green (idea 1000877, task 1003354)'
+  );
+  assert.doesNotThrow(
+    () => predicateFor("id = $1 AND addressee_github_id = $2::bigint AND status = 'pending'", [1, ME]),
+    'and the real accept/decline clause still parses clean'
+  );
 });
 
 test('the interpreter really does narrow on the owner column', () => {