@bongos/core 1.19.431 → 1.19.432

package/tests/effective_visibility_predicate.mjs

@@ -782,55 +782,72 @@ const ACCOUNTS = [
 // clause throws — the guard against a predicate quietly degrading to no filter.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
-// The columns this interpreter knows how to answer an IS [NOT] NULL test on.
-// Separate from KNOWN_COLUMNS because a NULL test is a different syntax the
-// literal-comparison sweep cannot see (ADR 0213 / task 1002913).
-const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
-
 /**
  * Build a row test from a statement's own WHERE clause. Literal comparisons
  * (profile_state = 'active') matter as much as placeholders here, because the
  * effective-visibility predicate is made ENTIRELY of literal comparisons — a
  * fake pool that only modelled $N filters would score the privacy terms as
  * absent and pass no matter what.
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS, which is why this is a CONSUMING parse.
+ * Two ways a term-collecting interpreter lies, and this shape closes both:
+ *
+ *   THE MISSING TERM. The ADR 0213 acceptance half is a NULL TEST — a third
+ *     syntax neither the placeholder sweep nor the literal sweep can see. An
+ *     unmodelled one degrades to no filter exactly like an unread $N.
+ *   THE REWRITTEN JOINER. Collecting recognised terms and ANDing them re-imposes
+ *     an `AND` the SQL may no longer contain: rewrite accountVisibleSql's `AND`
+ *     to `OR` and Postgres serves every ACTIVE account, private ones included,
+ *     while the fake answers exactly as before (idea 1000877, from the
+ *     adversarial review of task 1002968).
+ *
+ * So each recognised term is REMOVED from the text as it is matched and the
+ * residue must be a pure conjunction. That single check subsumes the NULL-test
+ * bookkeeping this function used to carry — recognition and application can no
+ * longer come apart, because an unapplied term is simply still there.
  */
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
-  // NULL-test terms this interpreter actually turned into a filter, as opposed
-  // to column names it merely recognises. The final sweep compares the two.
-  const modelled = new Set();
-
-  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
-  // The ADR 0213 acceptance half of the consent axis. It is a NULL test, not a
-  // literal comparison, so neither refusal sweep below would have caught it —
-  // an unmodelled IS NOT NULL degrades to no filter exactly like an unread $N.
-  // Hence the third sweep at the end of this function, and hence `modelled`:
-  // the sweep must prove a filter was APPLIED, not merely that the column is a
-  // name it recognises. (Checking recognition alone left this interpreter
-  // scoring a deleted filter as fine — found by mutation while writing it.)
-  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
-    modelled.add('terms_accepted_at');
-    tests.push((r) => r.terms_accepted_at != null);
-  }
-  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
-  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
-  // The recruiting-reach COALESCE (task 1002290). Modelled through the shared JS
-  // twin, not re-implemented — an interpreter that read this term its own way
-  // could agree with a WRONG query. Unmodelled it would degrade to no filter,
-  // which is precisely what this interpreter exists to refuse.
-  if (/COALESCE\((?:[a-z_]+\.)?recruiter_discoverable,/.test(where)) tests.push(isRecruiterDiscoverable);
-
-  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
-  if (byId) { consumed.add(byId[1]); const v = params[Number(byId[1]) - 1]; tests.push((r) => String(r.github_id) === String(v)); }
-
-  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
-  if (byHandle) {
-    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
-    const v = String(params[Number(byHandle[1]) - 1]);
-    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
-  }
+  let residue = where;
+  // Match a term, model it, and CONSUME its text so the leftovers can be judged.
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
 
+  // The recruiting-reach COALESCE (task 1002290) FIRST, because it spells
+  // `account_visibility = 'public'` inside itself as its own fallback —
+  // consuming it first stops that fallback being scored as a separate existence
+  // check. Modelled through the shared JS twin, not re-implemented: an
+  // interpreter that read this term its own way could agree with a WRONG query.
+  take(/\bCOALESCE\((?:[a-z_]+\.)?recruiter_discoverable,\s*(?:[a-z_]+\.)?account_visibility = 'public'\s*\)/,
+    () => isRecruiterDiscoverable);
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
+
+  // The rename window's disjunction is the ONE legitimate OR in this repo's
+  // account reads, so it is consumed as a single unit — leaving a bare `OR`
+  // behind would trip the structure check below.
+  take(/lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/, (m) => {
+    consumed.add(m[1]); consumed.add(m[2]);
+    const v = String(params[Number(m[1]) - 1]);
+    return (r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v;
+  });
+
+  // The TERM guards run before the STRUCTURE guard, so an unreadable term is
+  // reported as the unreadable term it is rather than as leftover text.
   for (const m of where.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
       throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
@@ -841,17 +858,8 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
-  // A NULL test is a filter too. Without this sweep the ADR 0213 acceptance term
-  // could be dropped from the predicate and this interpreter would score it as
-  // absent-and-fine, which is the failure mode the other two sweeps exist to
-  // prevent one syntax over.
-  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
-    if (!KNOWN_NULL_TESTS.has(m[1])) {
-      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
-    }
-    if (!modelled.has(m[1])) {
-      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it, which is the silent-pass it exists to refuse`);
-    }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -943,6 +951,28 @@ function get(path_, headers = {}) {
   });
 }
 
+t('CALIBRATION: the interpreter refuses what it cannot model, rather than ignoring it', () => {
+  // The behavioural half below is worth exactly as much as this. Every 404 it
+  // asserts is produced by accountFilter, so an interpreter that silently
+  // dropped a term would keep them all green while the predicate rotted.
+  assert.throws(() => accountFilter("profile_state = 'active' AND tier = 'gold'", []),
+    /unrecognised literal comparison on tier/);
+  assert.throws(() => accountFilter("profile_state = 'active' AND cohort = $1", ['beta']),
+    /unrecognised predicate on \$1/);
+  assert.throws(() => accountFilter("profile_state = 'active' AND deleted_at IS NULL", []),
+    /unmodelled boolean structure/,
+    'a NULL TEST is a third syntax, invisible to both sweeps above — the ADR 0213 shape');
+  assert.throws(() => accountFilter("profile_state = 'active' OR account_visibility = 'public'", []),
+    /unmodelled boolean structure/,
+    'an AND rewritten to OR serves every ACTIVE account including the private ones; a '
+    + 're-imposed AND would keep every 404 below green (idea 1000877)');
+  // ...and the real predicates still parse clean, in every composed form.
+  for (const clause of [accountActiveSql('pa'), accountVisibleSql('pa'), rollupVisibleSql('pa'),
+    scoutingListableSql('pa'), recruiterSliverVisibleSql('pa')]) {
+    assert.doesNotThrow(() => accountFilter(clause, []), `the shared predicate ${clause} must still be readable`);
+  }
+});
+
 await ta('CONTROL: the fixture and the interpreter really work — a public account resolves', async () => {
   // Without this, every 404 below could be a broken fake rather than a boundary.
   const res = await get('/api/gds/profiles/octo');

package/tests/handle_machinery.mjs

@@ -64,6 +64,12 @@ try {
   // simply land with handle NULL — the re-run seeds only those. Idempotence is
   // part of what this proves.
   await q(migrationSql('platform_identity_008_handle.sql')).catch(() => {});
+  // getAccount projects them and resolveHandle floors on accountVisibleSql,
+  // which reads account_visibility (012) and terms_accepted_at (019) — without
+  // these a FRESH database answers 42703 "column does not exist" rather than a
+  // handle assertion.
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await cleanup();
 
   await q(
@@ -116,7 +122,15 @@ try {
   const prov = await pi.resolveHandle('p01-again', { pool });
   ok(prov === null, 'a provisional account is not addressable — even by its current handle');
 
-  await q(`UPDATE platform_identity_accounts SET profile_state = 'active' WHERE github_id = ANY($1::bigint[])`, [[FRESH, TWIN_A]]);
+  // Both consent columns, because since ADR 0213 addressability floors on BOTH
+  // and they are stamped by the SAME upsertAccount branch — an UPDATE that set
+  // only profile_state would model a state the code cannot produce, and the
+  // handle would stay unaddressable for a reason this file is not about.
+  await q(
+    `UPDATE platform_identity_accounts SET profile_state = 'active', terms_accepted_at = now()
+      WHERE github_id = ANY($1::bigint[])`,
+    [[FRESH, TWIN_A]],
+  );
 
   const cur = await pi.resolveHandle('P01-Again', { pool });
   ok(cur && cur.account && cur.account.handle === 'p01-again', 'the current handle resolves case-insensitively');

package/tests/hub_profile_leak.mjs

@@ -104,6 +104,10 @@ function get(port, path) {
 const NEVER_IN_A_BODY = [
   SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
   'profile_state', 'hide_stats', 'github_id', 'display_name_source',
+  // The ADR 0213 consent column joins the list on the same terms as
+  // profile_state: it is an INPUT to the public predicate, never an output, and
+  // when the account accepted the terms is nobody else's business.
+  'terms_accepted_at',
 ];
 function assertNoSentinels(text, where) {
   for (const s of NEVER_IN_A_BODY) {
@@ -119,16 +123,26 @@ try {
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
   await q(migrationSql('platform_identity_008_handle.sql'));
   await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  // resolveHandle floors on accountVisibleSql, which reads account_visibility
+  // (012) and terms_accepted_at (019). Without these a FRESH database answers
+  // 42703 "column does not exist" instead of a 404-vs-200 assertion.
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await cleanup();
 
   // The active account carries the P02 fields + a user-set name source, so the
   // 200 proves bio/links serialize while display_name_source never does.
+  //
+  // The consented rows stamp terms_accepted_at as well as profile_state: since
+  // ADR 0213 addressability floors on BOTH, and a fixture seeding only the
+  // first is a pre-terms account that 404s. The provisional row keeps NULL —
+  // it is not consented on either column.
   await q(
     `INSERT INTO platform_identity_accounts
-       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle, bio, links, display_name_source)
-     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4, 'Builds things.', '{"website":"https://p05.example/"}', 'user'),
-            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL, NULL, NULL, 'github'),
-            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL, NULL, NULL, 'github')`,
+       (github_id, github_login, display_name, avatar_url, profile_state, terms_accepted_at, hide_stats, handle, previous_handle, bio, links, display_name_source)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', now(), false, 'p05-active', $4, 'Builds things.', '{"website":"https://p05.example/"}', 'user'),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', now(), true,  'p05-hidden', NULL, NULL, NULL, 'github'),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', NULL, false, 'p05-prov', NULL, NULL, NULL, 'github')`,
     [ACTIVE, HIDDEN, PROV, SECRET_PREV],
   );
   await q(

package/tests/own_session_revoke.mjs

@@ -81,28 +81,65 @@ function seed() {
 // Build a row filter from the statement's OWN where clause. Every placeholder the
 // clause mentions must be consumed by a fragment below; one that is not throws,
 // so a predicate this cannot read can never degrade into "no constraint".
+//
+// IT READS STRUCTURE, NOT JUST TERMS (task 1003354, idea 1000877). Each matched
+// term is REMOVED from the clause, and whatever survives must be a pure
+// conjunction — whitespace, parentheses and `AND`. Three holes this closes, all
+// of them "the interpreter silently answered a question it was not asked":
+//
+//   A LITERAL-ONLY term binds no placeholder, so the sweep below cannot see it.
+//     `revoked_at IS NULL` could be deleted from the real revoke statement and
+//     this fake would keep answering as though it were there.
+//   AN `AND` REWRITTEN TO `OR` is the dangerous one on this table: revoke is
+//     `id = $1 AND builder_id = $2`, so an `OR` lets any builder revoke any
+//     session by id — the exact own-scope isolation this file exists to prove —
+//     while a term-collecting interpreter re-imposes the `AND` and stays green.
+//   A CLAUSE WITH NO READABLE TERM used to yield an empty `tests` array, which
+//     matches EVERY row. A statement that carries a WHERE must narrow.
+//
+// The session-expiry disjunction is the ONE legitimate `OR` here and is consumed
+// as a whole unit, which is what lets it survive the check.
 function predicateFor(sql, params) {
-  const where = sql.includes(' WHERE ') ? sql.slice(sql.indexOf(' WHERE ') + 7) : '';
+  // The tail is not part of the predicate. It has to go before the residue is
+  // judged, or `ORDER BY last_used_at DESC` would read as an unmodelled term.
+  const raw = sql.includes(' WHERE ')
+    ? sql.slice(sql.indexOf(' WHERE ') + 7).split(/ (?:ORDER BY|GROUP BY|RETURNING|LIMIT|OFFSET) /)[0]
+    : '';
   const tests = [];
   const consumed = new Set();
+  let residue = raw;
+  // Some terms bind a placeholder and some are pure literals (`revoked_at IS
+  // NULL`), so the bound value is resolved only when there IS a capture group —
+  // passing `params[NaN]` and relying on the maker to ignore it would work by
+  // accident, and would break silently the day a no-capture maker read its arg.
   const take = (re, make) => {
-    const m = re.exec(where);
+    const m = re.exec(residue);
     if (!m) return;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    if (m[1] === undefined) { tests.push(make()); return; }
     consumed.add(m[1]);
     tests.push(make(params[Number(m[1]) - 1]));
   };
+  // The expiry disjunction FIRST, as a unit — otherwise the bare-column matchers
+  // would tear it in half and leave a dangling `OR` behind.
+  take(/\(?expires_at IS NULL OR expires_at > now\(\)\)?/,
+    () => (r) => r.expires_at === null || r.expires_at > new Date());
   take(/\b(?:s\.)?token = \$(\d+)/, (v) => (r) => r.token === v);
   take(/(?<!_)\b(?:s\.)?id = \$(\d+)/, (v) => (r) => String(r.id) === String(v));
   take(/\bbuilder_id = \$(\d+)/, (v) => (r) => String(r.builder_id) === String(v));
-  if (/revoked_at IS NULL/.test(where)) tests.push((r) => r.revoked_at === null);
-  if (/expires_at IS NULL OR expires_at > now\(\)/.test(where)) {
-    tests.push((r) => r.expires_at === null || r.expires_at > new Date());
-  }
-  for (const m of where.matchAll(/\$(\d+)/g)) {
+  take(/\brevoked_at IS NULL/, () => (r) => r.revoked_at === null);
+
+  for (const m of raw.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
-      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — the interpreter must not silently ignore a filter`);
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${raw}" — the interpreter must not silently ignore a filter`);
     }
   }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${raw}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, never a silently different filter`);
+  }
+  if (raw && !tests.length) {
+    throw new Error(`fake pool: the predicate in "${raw}" carried NO readable term — an empty filter matches every row, which is the opposite of what a WHERE is for`);
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -189,7 +226,38 @@ const aliveFor = (builderId) => sessions.filter((s) => s.builder_id === builderI
 // 1 — a xenos can see and kill their OWN sessions, with no Archon in sight
 // ===========================================================================
 
-console.log('own scope — a non-admin builder manages their own sessions:');
+console.log('calibration — the instrument is checked before it is trusted:');
+
+await t('the interpreter refuses what it cannot model, rather than ignoring it', () => {
+  // This file had no calibration at all until task 1003354, which is how it kept
+  // three silently-permissive paths: an unread literal, an OR it re-ANDed, and
+  // an empty predicate that matched every row. Every isolation assertion below
+  // is produced by predicateFor, so each of those made the whole file decorative.
+  assert.throws(() => predicateFor('SELECT id FROM builder_sessions WHERE id = $1 AND source = $2', [1, 'cli']),
+    /unrecognised predicate on \$2/,
+    'an unread placeholder — the older half of the rule');
+  assert.throws(() => predicateFor('SELECT id FROM builder_sessions WHERE id = $1 AND source IS NULL', [1]),
+    /unmodelled boolean structure/,
+    'a literal-only term binds nothing, so the placeholder sweep cannot see it');
+  assert.throws(() => predicateFor('UPDATE builder_sessions SET revoked_at = now() WHERE id = $1 OR builder_id = $2', [1, 1]),
+    /unmodelled boolean structure/,
+    'and the one that matters here: with OR, any builder revokes any session by id — while a '
+    + 'term-collecting interpreter re-imposes the AND and every test below stays green (idea 1000877)');
+  assert.throws(() => predicateFor('SELECT id FROM builder_sessions WHERE source IS NOT NULL', []),
+    /unmodelled boolean structure/,
+    'and a clause with no readable term at all: an empty filter matches every row');
+  // ...and the real statements still parse clean.
+  assert.doesNotThrow(() => predicateFor(
+    'SELECT id FROM builder_sessions WHERE builder_id = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now()) ORDER BY last_used_at DESC, id DESC',
+    [1],
+  ), 'the own-scope list, tail and legitimate OR included');
+  assert.doesNotThrow(() => predicateFor(
+    'UPDATE builder_sessions SET revoked_at = now() WHERE id = $1 AND builder_id = $2 AND revoked_at IS NULL RETURNING id',
+    [1, 1],
+  ), 'and the revoke');
+});
+
+console.log('\nown scope — a non-admin builder manages their own sessions:');
 
 await t('GET /me/sessions lists only the caller\'s LIVE sessions', async () => {
   seed(); calls = [];

package/tests/profile_connections_ui.mjs

@@ -163,7 +163,7 @@ function predicateFor(rawWhere, params) {
     where = where.replace(m[0], ' TRUE ');
   }
   // The unordered pair, likewise stripped before the one-sided matchers.
-  m = /pair_lo = LEAST\(\$(\d+)::bigint, \$(\d+)::bigint\)\s*AND\s*(?:c\.)?pair_hi = GREATEST\(\$(\d+)::bigint, \$(\d+)::bigint\)/.exec(where);
+  m = /(?:[a-z_]+\.)?pair_lo = LEAST\(\$(\d+)::bigint, \$(\d+)::bigint\)\s*AND\s*(?:[a-z_]+\.)?pair_hi = GREATEST\(\$(\d+)::bigint, \$(\d+)::bigint\)/.exec(where);
   if (m) {
     const a = p(m[1]); const b = p(m[2]); p(m[3]); p(m[4]);
     const lo = Math.min(Number(a), Number(b)); const hi = Math.max(Number(a), Number(b));
@@ -172,26 +172,33 @@ function predicateFor(rawWhere, params) {
     where = where.replace(m[0], ' TRUE ');
   }
 
-  if ((m = /\bid = ANY\(\$(\d+)::bigint\[\]\)/.exec(where))) {
+  // Each matcher BLANKS what it consumed, so the residue below is exactly the
+  // part of the clause this interpreter did not understand.
+  const eat = () => { where = where.replace(m[0], ' TRUE '); };
+  if ((m = /\b(?:[a-z_]+\.)?id = ANY\(\$(\d+)::bigint\[\]\)/.exec(where))) {
     const ids = p(m[1]).map(String);
     tests.push((r) => ids.includes(String(r.id)));
+    eat();
   }
-  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
-  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
-  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
-  if (/\bseen_at IS NULL\b/.test(where)) tests.push((r) => !r.seen_at);
-  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
-  if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+  if ((m = /\b(?:[a-z_]+\.)?id = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?addressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?requester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?seen_at IS NULL\b/.exec(where))) { tests.push((r) => !r.seen_at); eat(); }
+  if ((m = /\b(?:[a-z_]+\.)?status = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
+  if ((m = /(?:[a-z_]+\.)?created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.created_at > Date.now() - days * DAY);
+    eat();
   }
-  if ((m = /created_at <= now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+  if ((m = /(?:[a-z_]+\.)?created_at <= now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.created_at <= Date.now() - days * DAY);
+    eat();
   }
-  if ((m = /resolved_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+  if ((m = /(?:[a-z_]+\.)?resolved_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
     const days = Number(p(m[1]));
     tests.push((r) => r.resolved_at != null && r.resolved_at > Date.now() - days * DAY);
+    eat();
   }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
@@ -199,6 +206,18 @@ function predicateFor(rawWhere, params) {
       throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
     }
   }
+  // AND THE JOINER IS PART OF THE PREDICATE (task 1003354, idea 1000877). What
+  // survives must be a pure conjunction: whitespace, parentheses and `AND`. A
+  // literal-only term binds no placeholder and is invisible to the sweep above,
+  // and an `AND` rewritten to `OR` would let accept/decline act on a row
+  // matching the id alone — anyone answering anyone's request — while a
+  // term-collecting interpreter re-imposes the `AND` and stays green. The two
+  // legitimate ORs (the either-side clause and the unordered pair) are consumed
+  // as whole units above, which is what lets them survive this check.
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, never a silently different filter`);
+  }
   return (r) => tests.every((fn) => fn(r));
 }
 
@@ -505,6 +524,26 @@ test('the fake pool refuses a read that dropped its account floor', () => {
     'a read that stopped joining the floor must break the harness, not pass it');
 });
 
+test('the fake pool refuses a boolean SHAPE it cannot model, not just a term', () => {
+  // Task 1003354 / idea 1000877. The placeholder sweep above cannot see a
+  // literal-only term at all, and nothing saw the JOINER: an `AND` rewritten to
+  // `OR` would let accept/decline act on a row matching the id alone — anyone
+  // answering anyone's request — while a term-collecting interpreter re-imposes
+  // the `AND` and every isolation assertion in this file stays green.
+  assert.throws(() => predicateFor("id = $1 AND note IS NULL", [1]),
+    /unmodelled boolean structure/,
+    'a literal-only term binds no placeholder');
+  assert.throws(() => predicateFor("id = $1 OR addressee_github_id = $2::bigint", [1, ME]),
+    /unmodelled boolean structure/,
+    'and the joiner is part of the predicate');
+  // The two legitimate ORs are consumed as whole units, so they still parse.
+  assert.doesNotThrow(() => predicateFor(
+    "id = $1 AND status = 'accepted' AND (requester_github_id = $2::bigint OR addressee_github_id = $2::bigint)", [1, ME]));
+  assert.doesNotThrow(() => predicateFor(
+    "c.pair_lo = LEAST($1::bigint, $2::bigint) AND c.pair_hi = GREATEST($1::bigint, $2::bigint) AND c.status = 'pending' AND c.created_at <= now() - make_interval(days => $3::int)",
+    [ME, ADA, 30]), 'the aliased expiry clause, alias prefixes included');
+});
+
 // ===========================================================================
 // 1. The surface: the section exists, ships hidden, and profile.js calls it
 // ===========================================================================

package/tests/profile_privacy_owner_view.mjs

@@ -79,6 +79,10 @@ const NOSY = '7777';   // active · public          — the stranger at the side
 // ADR 0213 (task 1002913): consent is profile_state AND an acceptance of the
 // platform terms, both written by the same statement — so a consented fixture
 // carries both, and one carrying only the first is a row from before the terms.
+// Every fixture here accepts, deliberately: the never-accepted row and the 404
+// it earns belong to tests/effective_visibility_predicate.mjs, which owns the
+// consent matrix. This file's subject is the OWNER's page, so re-seeding that
+// row here would duplicate a proof rather than add one.
 const ACCEPTED_AT = '2026-08-29T00:00:00.000Z';
 
 const ACCOUNTS = [
@@ -140,48 +144,64 @@ function sentinelsOf(githubId) {
 // anything else throws — a WHERE it cannot read must never degrade to no WHERE.
 const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle']);
 
-// Columns this interpreter can answer an IS [NOT] NULL test on — a different
-// syntax from the literal comparisons above, hence its own set (ADR 0213).
-const KNOWN_NULL_TESTS = new Set(['terms_accepted_at']);
-
 /**
  * Build a row test from a statement's own WHERE text. Literal comparisons carry
  * as much weight as placeholders here: the effective-visibility predicate is
  * made ENTIRELY of literal comparisons, so a fake that modelled only $N filters
  * would score the privacy terms as absent and pass however the code changed.
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS, which is why this is a CONSUMING parse
+ * rather than a list of `.test()` calls. An interpreter that merely COLLECTS the
+ * terms it recognises and ANDs them re-imposes an `AND` the SQL may no longer
+ * contain: rewrite accountVisibleSql's `AND` to `OR` and Postgres serves every
+ * ACTIVE account — private ones included — while a term-collecting fake answers
+ * exactly as before and every 404 assertion in this file stays green (idea
+ * 1000877, from the adversarial review of task 1002968). So each recognised term
+ * is REMOVED from the text as it is matched, and whatever survives must be
+ * nothing but whitespace, parentheses and `AND`.
+ *
+ * That also subsumes the NULL-test bookkeeping this function used to carry: an
+ * `IS NOT NULL` nobody modelled now survives in the residue and is refused
+ * there, so recognition and application cannot come apart (ADR 0213).
  */
 function accountFilter(where, params) {
   const tests = [];
   const consumed = new Set();
-  // NULL-test terms actually turned into a filter, as opposed to column names
-  // merely recognised. The final sweep compares the two (ADR 0213).
-  const modelled = new Set();
-
-  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  let residue = where;
+  // Match a term, model it, and CONSUME its text so the leftovers can be judged.
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
+
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
   // The ADR 0213 consent half. It is a NULL test, not a literal comparison, so
-  // neither sweep below would see it — an unmodelled IS NOT NULL degrades to no
-  // filter exactly like an unread $N, which is what those sweeps exist to refuse.
-  if (/\bterms_accepted_at IS NOT NULL/.test(where)) {
-    modelled.add('terms_accepted_at');
-    tests.push((r) => r.terms_accepted_at != null);
-  }
-  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
-  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
-
-  const byId = /\b(?:[a-z_]+\.)?github_id = \$(\d+)/.exec(where);
-  if (byId) {
-    consumed.add(byId[1]);
-    const v = params[Number(byId[1]) - 1];
-    tests.push((r) => String(r.github_id) === String(v));
-  }
+  // the two term sweeps below cannot see it at all — only the structure guard
+  // can, which is exactly why that guard exists.
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
 
-  const byHandle = /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/.exec(where);
-  if (byHandle) {
-    consumed.add(byHandle[1]); consumed.add(byHandle[2]);
-    const v = String(params[Number(byHandle[1]) - 1]);
-    tests.push((r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v);
-  }
+  // The rename window's disjunction is the ONE legitimate OR in this repo's
+  // account reads, so it is consumed as a single unit — leaving a bare `OR`
+  // behind would trip the structure check below.
+  take(/lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/, (m) => {
+    consumed.add(m[1]); consumed.add(m[2]);
+    const v = String(params[Number(m[1]) - 1]);
+    return (r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v;
+  });
 
+  // The TERM guards run before the STRUCTURE guard, so an unreadable term is
+  // reported as the unreadable term it is rather than as leftover text.
   for (const m of where.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
       throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
@@ -192,13 +212,8 @@ function accountFilter(where, params) {
       throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
     }
   }
-  for (const m of where.matchAll(/\b([a-z_]+)\s+IS\s+(?:NOT\s+)?NULL\b/gi)) {
-    if (!KNOWN_NULL_TESTS.has(m[1])) {
-      throw new Error(`fake pool: unrecognised NULL test on ${m[1]} in "${where}"`);
-    }
-    if (!modelled.has(m[1])) {
-      throw new Error(`fake pool: NULL test on ${m[1]} in "${where}" was recognised but never MODELLED — the clause is present and this interpreter is ignoring it`);
-    }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -332,6 +347,22 @@ test('the interpreter refuses a predicate it cannot read, rather than ignoring i
     /unrecognised literal comparison on shadow_banned/,
     'the privacy predicate is made of LITERAL comparisons — an unmodelled one must not read as absent',
   );
+  assert.throws(
+    () => accountFilter("profile_state = 'active' AND deleted_at IS NULL", []),
+    /unmodelled boolean structure/,
+    'a NULL TEST is a third syntax again, invisible to both sweeps above — the shape that let the '
+    + 'ADR 0213 acceptance term be dropped silently elsewhere (task 1003354)',
+  );
+  assert.throws(
+    () => accountFilter("profile_state = 'active' OR account_visibility = 'public'", []),
+    /unmodelled boolean structure/,
+    'and an AND rewritten to OR: in Postgres that serves every ACTIVE account including the private '
+    + 'ones, so an interpreter that re-imposed the AND would keep every 404 below green (idea 1000877)',
+  );
+  assert.doesNotThrow(
+    () => accountFilter("(profile_state = 'active' AND terms_accepted_at IS NOT NULL) AND account_visibility = 'public'", []),
+    'and the real predicate still parses clean — this is a filter on the unreadable, not a blanket refusal',
+  );
 });
 
 test('the interpreter really does narrow on the visibility literals', () => {