@bongos/core 1.20.16 → 1.20.18

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.16",
-  "core_contract": "1.20.16",
-  "source_commit": "594ee4d4c853130397cd87e0095a3b50e03ad4b0",
+  "core_version": "1.20.18",
+  "core_contract": "1.20.18",
+  "source_commit": "e1841ec9f7044de186bb75988136b6dfb0835ef7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T12:51:52.406Z",
+  "built_at": "2026-09-30T13:46:50.940Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3210,
-  "tree_sha256": "9a6832279c80fa1b768101f4b2c4c13e626f023be26da7232d0596ef21accfa9",
+  "tree_sha256": "34fda46e51438cef84700eb352c0f4dc3a8552cd8e8fc962864f4f500e09047d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1537,7 +1537,7 @@
     {
       "path": "docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md",
       "mode": "0000644",
-      "sha256": "fd6c8d2e3868f2ba42262406b9fbd9ba12cb547a9eac61ddb7b9422afde6b3ab"
+      "sha256": "2e00d10ae548548bc8708058b0beb08fc0631aa29f27f6905ef630fdf4c6099b"
     },
     {
       "path": "docs/adr/0214-canonical-profile-url-one-resolver-dark-until-the-page-exists.md",
@@ -1547,7 +1547,7 @@
     {
       "path": "docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md",
       "mode": "0000644",
-      "sha256": "828e785306df71d1620e0bb541d0ce3cce9ff65dcd996adc4a817803000cbb7c"
+      "sha256": "15d0455b7a29968c01ea01fb64d9c01fb63d7d2db0ef351df5f0fb9dfa677a94"
     },
     {
       "path": "docs/adr/0216-a-fake-pool-interpreter-must-fail-loudly-not-silently-ignore.md",
@@ -2242,7 +2242,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c1360ad6a6659819a5a2db72cef07fd3631a3052745ef4fcf20075e9849f7fbd"
+      "sha256": "829ba538e06cca081f0540bf819f280ba36e738a553e5fa3634af5f5af5bc5b0"
     },
     {
       "path": "docs/architecture.md",
@@ -2267,12 +2267,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "f4485fd6eecabff171add19c577d0c94b90b1e5e4e90e71f0af23bbd84085791"
+      "sha256": "08ef6d32a1c5cfea14e7ddd54a4e7ab2e34818199a45e0422a4fce31b72567a7"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f8b6e13542de4d3fe03cbfc6a4873c8a7fd7c3ea29e9b535d80c70d2d986340a"
+      "sha256": "a405d02a6308a53e9322437f21daf86cb7e7f0d6d8b15a25639b7fdbcb7c2fd1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2664b90799e3d947cdce43f2eb6c05699da1aafad223fef1b6eafd463c4478e3"
+      "sha256": "99307d7bab261c46f7e80d768b014352d9f3c47ec2c72088acfac7bc700dd06f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "b959e7b3c6b623f81e4f5752fa6573621c79d6e8948d18b2b4c939101e65930b"
+      "sha256": "6ba44419e75dcb245e386e077eba647e744c56861b8b81c9002bbe7528369f0c"
     },
     {
       "path": "docs/project-context.template.md",
@@ -7057,7 +7057,7 @@
     {
       "path": "modules/platform-identity/read-rate-limit.js",
       "mode": "0000644",
-      "sha256": "dc11b89460e4cca22af1ab61672104ac99298f477c1bad890d688f87456494fa"
+      "sha256": "fb22fef7442c1488499dce4ec8aafce30400166df51f5c7bd88577c83fb8873e"
     },
     {
       "path": "modules/platform-identity/recruiter-sliver.js",
@@ -7112,7 +7112,7 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "fbd1f8679be51718131d3d95d6ed7d8dcd1ebe091df6cfc190b69fd62c00013c"
+      "sha256": "3fbaaafe605fd891c449499ca85a716f9b8780bb1869f25b32162593ada8fedd"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
@@ -8032,7 +8032,7 @@
     {
       "path": "modules/public-landing/public/terms.html",
       "mode": "0000644",
-      "sha256": "639d96a2bf6b28fabbcad64a01e3b97aab83dabe8182455074f2845e053b2696"
+      "sha256": "39aae17cd14c496533f9a212f37378571d9d621c078353e41900a02c5355df5f"
     },
     {
       "path": "modules/render-deploy/deploys.js",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "979f117fe308e4c9d4c2b8d9765fc7a8314c490d8cb134215efd61cded7cf30e"
+      "sha256": "35d3b7a5f69caee9c6a98b7c34c02daec4289cd0548637d05ff41fd23d1926c4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f5ff021f7aedefb0c74cd4e019815aaada727a00b4a1dc7609f369aa41186b85"
+      "sha256": "9807202c95ba59b5f8104eb0c6701241d989800e67fdddf8252bc569b9a74c96"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "95ae54225e9925f4d47f66179e6a081db5668a217c0000b94c06c992a2cae479"
+      "sha256": "19b0f5588a02e7517cc25668a59df836f8ee1a183e1f1ec4a2b63d79214b3808"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0d0657d70e9b17cb8f11328fd85f36df2bb7d67c1f44cac8745364e6558bc453"
+      "sha256": "3f49c56de113748d04529b5028e1ac2fca037cf00c1d6be6e531346dcfbea552"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14842,7 +14842,7 @@
     {
       "path": "tests/recruiter_sliver_boundary.mjs",
       "mode": "0000644",
-      "sha256": "522df6e7930347ff312ef5b2cb98cfde3c53f7465a133618dd970872241bc2b3"
+      "sha256": "34c56222c40ab58be128f380a2881a2d17bd6c483560d878f6de01a00bcef297"
     },
     {
       "path": "tests/redteam_followup_kind.mjs",
@@ -15757,7 +15757,7 @@
     {
       "path": "tests/terms_acceptance.mjs",
       "mode": "0000644",
-      "sha256": "d73eea1d83bdf132f5973a67013bd01270b54253ef6eb979c801b019d6f67c6f"
+      "sha256": "80ea17a764ba05a05af0967e9951370b814c20c3518a37f1c3ca1a9ca0d044cf"
     },
     {
       "path": "tests/terms_grandfather_db.mjs",

package/docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md

@@ -29,6 +29,8 @@ This is deliberately the ADR 0205 D3 property, reused. An acceptance record a ca
 
 > **Amended 2026-09-25 ([task 1003353](https://cloudbongos.com/builders#/task/1003353); [blocker 1000124](https://cloudbongos.com/builders#/blocker/1000124)) — what "the hub's own sign-in" means.** `GET /sso/authorize` is reached when a builder uses their platform account to sign in to a **project**; the only builder of that URL is a child instance's `idpAuthorizeUrl`. Signing in to the hub itself creates a hub session and never touches `platform_identity_accounts`, so it records no acceptance. `/terms` said "signed in here"; it now names a project sign-in. The owner chose to also capture the hub's own sign-in ([task 1003361](https://cloudbongos.com/builders#/task/1003361)), which will make this a second capture point rather than a wording fix. Two smaller corrections to the text above: the device poll does not go through `ensureAccount`, it is a non-activating `upsertAccount`, and so is `PATCH /me/handle`; `ensureAccount` is the federated membership check-in alone. The outcome was always the same (neither writes an acceptance), and both paths are now executed in `tests/terms_acceptance.mjs` rather than asserted as text.
 
+> **Amended 2026-09-30 ([task 1004265](https://cloudbongos.com/builders#/task/1004265)) — a project sign-in *in the browser*.** The CLI's project sign-in (`POST /sso/device/poll`) also uses the platform account, and it stays **non-activating on purpose**. The person approves it on GitHub's device page, never on a hub page, so these terms are never in front of them — and the same branch that stamps the acceptance also flips `profile_state` to active, which ADR 0171 D3 reserves for the one path "where a human is demonstrably at the hub" — and D3 names the device poll as `provisional` in so many words. Stamping it would record consent nobody was shown and re-decide D3 by implementation convenience. `/terms` therefore names a project sign-in **in your browser**, and says that a command-line sign-in records nothing and why, so a CLI-only builder is not left guessing why they are unpublished. `tests/terms_acceptance.mjs` §3 drives the real device-poll route (no acceptance, still provisional, the non-activating literal, a forged body refused before any write) and a later browser sign-in stamping that same account. The "next hub sign-in" wording under D4 is left for task 1003361, which makes it true.
+
 ### D2 — Written once. The first acceptance is the one that stands
 
 The conflict branch writes `COALESCE(platform_identity_accounts.terms_accepted_at, now())`. Signing in again re-reads the terms but does not restamp them, so the column keeps meaning *when consent was given* rather than *when this account was last seen*. `terms_version` is COALESCE'd the same way and always written in the same statement, so the pair cannot diverge.

package/docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md

@@ -61,7 +61,7 @@ A **previous** handle resolves to nothing here either, deliberately unlike `reso
 
 ### D4 — The sliver holds spec D3's **archon floor**; the directory's wider door is not reused, and the audience goes to the owner
 
-`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')`; the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
+`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')` (behind its own read budget since [task 1003540](https://cloudbongos.com/builders#/task/1003540) — see the last honest limit); the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
 
 Spec D3 says the sliver is "gated at the route by `project.recruit`" — and that atom **does not exist**. ADR 0201 D3 and ADR 0210 both refuse to mint it, on the same grounds: it belongs to the project-admin-console wave ([spike 1002786](https://cloudbongos.com/builders#/task/1002786) R3), which defines it, and minting it in a third place would fork its definition across three waves before any had shipped. **So which door does it use meanwhile?** The first draft reused the directory's, and that was wrong in the dangerous direction. Spec D1 declares the missing atom's shape — **floor archon**, widenable per instance through the governance tab — while the directory admits `project.curate` at the **metic** floor (ADR 0157) **OR any project owner**, who is typically a bare `xenos` on the hub (ADR 0210 D2). That door is *wider* than the signed floor on both halves. Reusing it would have widened an owner-signed privacy decision by implementation convenience, on the first surface that discloses a private account — and narrowing after people have been disclosed is not a recoverable move, while widening later is. So the sliver holds D3's declared floor, by rank, until the atom exists.
 
@@ -102,7 +102,7 @@ Both columns exist (migration `platform_identity_012_account_privacy.sql`); the
 - **A recruiting read added in another FILE would not trip the two-route guard.** D6's count is over `routes/scouting.js` alone, so the "both recruiting surfaces" copy could become false without reddening. Sweeping every route file for reach-joining reads is a structural guard of its own and belongs with the shared-predicate work, not here.
 - **`getRecruiterSliver` (the by-id port spec D3 names) has no production caller yet** — [task 1002972](https://cloudbongos.com/builders#/task/1002972) is its consumer. The route uses the by-handle sibling; the proof exercises both.
 - **`active_recently` is coarse by design and coarse in practice.** It is derived from `max(last_active)` across the rollup, which is refreshed on federated sign-in and on ship — so a builder active only on a project that never reports will read as inactive. That understates rather than overstates, which is the safe direction for a privacy surface.
-- **This route is not rate-limited, and there is an asymmetry worth naming.** `GET /profiles/:handle` carries a per-IP read limiter precisely so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` — which is authenticated and permission-gated, so it starts from a much stronger position — has none. The asymmetry that remains is specific: a reader of this surface can probe guessed handles unmetered and learn *which private accounts opted into recruiting*, a set no other surface publishes. It is bounded by needing to guess a private account's handle (nothing publishes it) and by the audience already holding the full rollup of every public builder, so it is a widening of degree, not of kind. It is **not** fixable by reusing `accountExistenceReadRateLimit`: ADR 0209's whole decision is one budget per oracle, and this is a different oracle — sharing it would hand an enumerator the sum of two budgets on the route it cares about. The right fix is a dedicated budget behind a doorway-exported factory, which is a decision about the doorway rather than about the sliver; filed rather than smuggled in here.
+- **~~This route is not rate-limited~~ — closed by [task 1003540](https://cloudbongos.com/builders#/task/1003540); what was open, and why the fix took the shape it did.** `GET /profiles/:handle` carries a per-IP read limiter so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` shipped with none: a reader could probe guessed handles and learn *which private accounts opted into recruiting*, a set no other surface publishes — bounded by needing to guess a private handle, so a widening of degree, not of kind. It now spends its **own** per-IP budget, `recruiter-sliver-read`, at the `/public/*` posture (120 reads / 60s), mounted **ahead of** `requireBuilder`: the tag takes the route off core's default read ceiling (`rate-limit.js` #6), so a limiter behind the gate would have left every refused probe unmetered. It is **not** `accountExistenceReadRateLimit` — ADR 0209 is one budget per oracle, and sharing would hand an enumerator the sum of two. This note used to name a **doorway-exported factory** as the fix. That was wrong on ADR 0209's own terms, which rejects a limiter factory on the doorway as *"more general and more wrong"* (two call sites with matching config get two budgets), and it was overtaken: the module has had its own single limiter factory since task 1002978 (`modules/platform-identity/read-rate-limit.js`, mounted by the community and guild reads). The sliver's budget is one instance from that factory, built at module scope so every router the file builds spends from the same bucket — no new copy, and no change to the doorway. `tests/recruiter_sliver_boundary.mjs` §6b pins the budget, its position ahead of the gate, and that it is none of core's shared instances.
 
 **Rejected:**
 

package/docs/api/openapi.json

@@ -16630,7 +16630,7 @@
           "scouting"
         ],
         "summary": "GET /scouting/:handle",
-        "description": "the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR 0215 D4, task 1002968). This is the FIRST surface on the platform that discloses a PRIVATE account, and its audience is deliberately NOT the directory's. WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210 both refuse to mint it outside the project-admin-console wave that defines it (spike 1002786 R3), and this task does not either. The directory's door (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than the signed floor on both halves, so adopting it here would widen an owner-signed privacy decision by implementation convenience. Until the atom lands, the honest reading of D3 is its floor, held by rank. Whether the wider recruiting audience is authorized for this surface is the owner's call and is filed as a blocker, NOT resolved here; when it is answered, this one line moves and nothing else does. 404, never 403, for a builder who is not recruiter-reachable: a 403 would confirm the handle exists, which is the disclosure the opt-out removes. The sliver's own predicate does the deciding, inside the module.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).",
+        "description": "the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR 0215 D4, task 1002968). This is the FIRST surface on the platform that discloses a PRIVATE account, and its audience is deliberately NOT the directory's. WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210 both refuse to mint it outside the project-admin-console wave that defines it (spike 1002786 R3), and this task does not either. The directory's door (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than the signed floor on both halves, so adopting it here would widen an owner-signed privacy decision by implementation convenience. Until the atom lands, the honest reading of D3 is its floor, held by rank. Whether the wider recruiting audience is authorized for this surface is the owner's call and is filed as a blocker, NOT resolved here; when it is answered, this one line moves and nothing else does. 404, never 403, for a builder who is not recruiter-reachable: a 403 would confirm the handle exists, which is the disclosure the opt-out removes. The sliver's own predicate does the deciding, inside the module. Rate-limited per IP (120 reads / 60s, 429 scope `recruiter-sliver-read`), and the budget is spent FIRST, ahead of the gate: its tag takes this route off core's default read ceiling, so a limiter behind requireBuilder would leave every refused probe unmetered.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).",
         "x-rank": "archon",
         "x-source": "modules/platform-identity/routes/scouting.js",
         "parameters": [

package/docs/copy-inventory.md

@@ -4,7 +4,7 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2189 strings** across 3 surfaces · 1889 distinct pieces of copy · 2189 certain, 0 heuristic · 207 shown in more than one place.
+**2188 strings** across 3 surfaces · 1888 distinct pieces of copy · 2188 certain, 0 heuristic · 207 shown in more than one place.
 
 ## Surfaces
 
@@ -12,7 +12,7 @@
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 109 | 1617 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
-| `landing` | `modules/public-landing/public` | 6 | 472 |
+| `landing` | `modules/public-landing/public` | 6 | 471 |
 
 ## Confidence, and why it is on every row
 
@@ -1805,7 +1805,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 472 strings
+## `landing` — 471 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1940,7 +1940,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `485c565b5745` | certain | How people join | `modules/public-landing/public/projects.html:910` |
 | `4b542b000afa` | certain | How this project is drawn: on the sky, in your list, at the top of this page and on its card. A planet is a | `modules/public-landing/public/projects.html:1030` |
 | `9f31eaed8252` | certain | If you grant repository access while creating a project, that permission is used to create or adopt your repos | `modules/public-landing/public/privacy.html:55` |
-| `3b1cbe9e33aa` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:71` |
+| `d37e2fbde8c6` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:71` |
 | `607551ae732b` | certain | Invite a builder | `modules/public-landing/public/projects.html:1003` |
 | `20786b02f47a` | certain | Invite builders | `modules/public-landing/public/projects.html:1492` |
 | `a1256030d879` | certain | Invite only | `modules/public-landing/public/projects.html:914` |
@@ -1979,7 +1979,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `837fdaa0936a` | certain | Nothing matches that. | `modules/public-landing/public/projects.html:707` |
 | `1bc11853e893` | certain | On the map | `modules/public-landing/public/projects.html:929` |
 | `b4ac8f44710c` | certain | On the public map | `modules/public-landing/public/projects.html:851` |
-| `7fe31ce20c09` | certain | Once you have signed in to a project with your platform account and accepted these terms, your profile and tha | `modules/public-landing/public/terms.html:68` |
+| `1fdda2903cf9` | certain | Once you have signed in to a project in your browser with your platform account and accepted these terms, your | `modules/public-landing/public/terms.html:68` |
 | `8329bb1a3693` | certain | One tap files the request and the platform starts standing your project up — server, database, address. Here's | `modules/public-landing/public/projects.html:1462` |
 | `86cde1930d84` | certain | Only mine | `modules/public-landing/public/projects.html:477` |
 | `f82fe1982ab3` | certain | Open an issue on the repository | `modules/public-landing/public/contact.html:52` |
@@ -2092,7 +2092,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fb416bf1a26b` | certain | The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub | `modules/public-landing/public/projects.html:1355` |
 | `a954f0dce9a3` | certain | The platform | `modules/public-landing/public/contact.html:65` |
 | `4fd8f5746cc5` | certain | The platform is run as a non-profit, capture-resistant commons. | `modules/public-landing/public/terms.html:50` |
-| `dede132846fe` | certain | The platform stores the date you accepted these terms, and which version, on your account. It is written when  | `modules/public-landing/public/terms.html:70` |
 | `20fcebaa85c4` | certain | The project hub needs JavaScript — the map, your projects, and starting a new one all live here. You can read  | `modules/public-landing/public/projects.html:530` |
 | `4a740b5afe73` | certain | The project map | `modules/public-landing/public/projects.html:540` |
 | `345fec12e5d8` | certain | The repository | `modules/public-landing/public/contact.html:50` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2189,
-    "unique_ids": 1889,
-    "certain": 2189,
+    "strings": 2188,
+    "unique_ids": 1888,
+    "certain": 2188,
     "heuristic": 0,
     "duplicate_ids": 207
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 6,
-      "strings": 472
+      "strings": 471
     }
   },
   "blind_spots": [
@@ -17936,9 +17936,9 @@
       "confidence": "certain"
     },
     {
-      "id": "3b1cbe9e33aa",
+      "id": "d37e2fbde8c6",
       "surface": "landing",
-      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.",
+      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.",
       "file": "modules/public-landing/public/terms.html",
       "line": 71,
       "origin": "html-text",
@@ -18287,9 +18287,9 @@
       "confidence": "certain"
     },
     {
-      "id": "7fe31ce20c09",
+      "id": "1fdda2903cf9",
       "surface": "landing",
-      "text": "Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
+      "text": "Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
       "file": "modules/public-landing/public/terms.html",
       "line": 68,
       "origin": "html-text",
@@ -19303,15 +19303,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "dede132846fe",
-      "surface": "landing",
-      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once — signing in again does not change the date you accepted. This is version",
-      "file": "modules/public-landing/public/terms.html",
-      "line": 70,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -2689,5 +2689,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.14 with no explicit bump. run 36713710510. (task 1002620)
   1.20.16 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.15 with no explicit bump. run 36717488992. (task 1002620)
+  1.20.17 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.16 with no explicit bump. run 36722139698. (task 1002620)
+  1.20.18 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.17 with no explicit bump. run 36724081934. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":39,"lines":3791,"placed":1278,"shared":254,"unplaced":2259,"omitted_data":2054},
+  "counts": {"pages":39,"lines":3791,"placed":1277,"shared":254,"unplaced":2260,"omitted_data":2054},
   "pages": [
     {
       "id": "builders:atlas",
@@ -4132,9 +4132,9 @@
       "surface": "landing",
       "title": "{{productName}} — Terms",
       "states_read": ["default"],
-      "files_hash": "1523219e46cd7488",
-      "reading_hash": "a68fd4a222091122",
-      "counts": {"lines":45,"placed":29,"shared":9,"unplaced":7},
+      "files_hash": "5f1171d0ce6fb7d3",
+      "reading_hash": "007bea800099720b",
+      "counts": {"lines":45,"placed":28,"shared":9,"unplaced":8},
       "omitted": {"data":1},
       "notes": [],
       "lines": [
@@ -4158,13 +4158,13 @@
         {"key":"L0018","section":"Your work across projects","text":"These numbers describe; they do not govern.","placement":"placed","file":"modules/public-landing/public/terms.html","line":67,"string_id":"02e596cc4569"},
         {"key":"L0019","section":"Your work across projects","text":"Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and {…} may treat it as permission. A rank shown here is that project’s own standing for you, as that project reported it — the platform holds no rank of its own.","placement":"unplaced"},
         {"key":"L0020","section":"Your work across projects","text":"What is public.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"9b3312899fb1"},
-        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"7fe31ce20c09"},
+        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"1fdda2903cf9"},
         {"key":"L0022","section":"Your work across projects","text":"What you control.","placement":"placed","file":"modules/public-landing/public/terms.html","line":69,"string_id":"6130dcb60532"},
         {"key":"L0023","section":"Your work across projects","text":"From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform’s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.","placement":"placed","file":"modules/public-landing/public/terms.html","line":69,"string_id":"0808df6e434c"},
         {"key":"L0024","section":"Your work across projects","text":"Your acceptance is recorded.","placement":"placed","file":"modules/public-landing/public/terms.html","line":70,"string_id":"0f06f7e72ea7"},
-        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once — signing in again does not change the date you accepted. This is version","placement":"placed","file":"modules/public-landing/public/terms.html","line":70,"string_id":"dede132846fe"},
+        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version","placement":"unplaced"},
         {"key":"L0026","section":"Your work across projects","text":"Accounts from before these terms.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"9b02ec8a2e21"},
-        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"3b1cbe9e33aa"},
+        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"d37e2fbde8c6"},
         {"key":"L0028","section":"Fair use","text":"Fair use","placement":"placed","file":"modules/public-landing/public/terms.html","line":73,"string_id":"2585087f4873"},
         {"key":"L0029","section":"Fair use","text":"Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.","placement":"placed","file":"modules/public-landing/public/terms.html","line":74,"string_id":"8d812912c392"},
         {"key":"L0030","section":"Liability","text":"Liability","placement":"unplaced"},

package/modules/platform-identity/read-rate-limit.js

@@ -1,12 +1,14 @@
-// modules/platform-identity/read-rate-limit.js — a per-IP read cap for an
-// UNAUTHENTICATED public GET in this module. The global limiter meters writes
+// modules/platform-identity/read-rate-limit.js — a per-IP read cap for a GET
+// in this module that must not be scripted at line rate. The global limiter meters writes
 // only, and core's per-IP sliding window (src/bongos/middleware/rate-limit.js
 // perIpSlidingWindow) reaches modules only as ready-built instances on the
 // doorway (ADR 0209: an instance per budget), none of which is this module's.
 // This is the module-side twin of that function — same 429 envelope and
 // headers — written once (task 1002978) and mounted by the community reads
-// (routes/community-leaderboard.js, routes/community-search.js) and the public
-// guild read (routes/guilds-public.js).
+// (routes/community-leaderboard.js, routes/community-search.js), the public
+// guild read (routes/guilds-public.js) and the recruiter sliver
+// (routes/scouting.js GET /scouting/:handle, task 1003540 — authenticated, but a
+// handle probe there reveals who opted into recruiting).
 // routes/public-profile.js and routes/sso.js still carry older vendored copies.
 'use strict';
 

package/modules/platform-identity/routes/scouting.js

@@ -41,9 +41,26 @@ const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
 const recruiterSliver = require('../recruiter-sliver');
 const scoutingNameOnly = require('../scouting-name-only');
+const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool, requireBuilder, parsePagination } = api;
 
+// The sliver's per-IP read budget (task 1003540, ADR 0215). Probing guessed
+// handles tells a reader WHICH private accounts opted into recruiting — a set no
+// other surface publishes — so the probe is metered at the /public/* posture.
+// Its OWN budget, never accountExistenceReadRateLimit: ADR 0209 is one budget per
+// oracle, and sharing hands an enumerator the sum of two. Built ONCE at module
+// scope, so every router this file builds spends from the same bucket, by the
+// module's one limiter factory rather than a vendored copy. Not a doorway
+// factory: ADR 0209 rejected that shape because two call sites get two budgets.
+const SLIVER_READ_WINDOW_MS = 60 * 1000;
+const SLIVER_READ_LIMIT = 120;
+const sliverReadRateLimit = createReadRateLimit({
+  scope: 'recruiter-sliver-read',
+  limit: SLIVER_READ_LIMIT,
+  windowMs: SLIVER_READ_WINDOW_MS,
+});
+
 // Resolved at CALL time, never at load. Proofs that exercise this route pin a
 // PARTIAL doorway (tests/profile_route.mjs stubs pool + the two gates and
 // nothing else), and a module-scope api.logger() would make this file
@@ -118,8 +135,14 @@ module.exports = function scoutingRoutes() {
   // 404, never 403, for a builder who is not recruiter-reachable: a 403 would
   // confirm the handle exists, which is the disclosure the opt-out removes. The
   // sliver's own predicate does the deciding, inside the module.
+  //
+  // Rate-limited per IP (120 reads / 60s, 429 scope `recruiter-sliver-read`),
+  // and the budget is spent FIRST, ahead of the gate: its tag takes this route
+  // off core's default read ceiling, so a limiter behind requireBuilder would
+  // leave every refused probe unmetered.
   router.get(
     '/scouting/:handle',
+    sliverReadRateLimit,
     requireBuilder,
     api.requireRank('archon'),
     async (req, res) => {
@@ -139,3 +162,7 @@ module.exports = function scoutingRoutes() {
 
   return router;
 };
+
+// Exported for tests — the sliver's budget instance and its limits (the
+// routes/community-search.js precedent).
+module.exports._internals = { sliverReadRateLimit, SLIVER_READ_LIMIT, SLIVER_READ_WINDOW_MS };

package/modules/public-landing/public/terms.html

@@ -65,10 +65,10 @@
     <h2>Your work across projects</h2>
     <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the roles you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
     <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
-    <p><b>What is public.</b> Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
+    <p><b>What is public.</b> Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
     <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
-    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once &mdash; signing in again does not change the date you accepted. This is version <b>2026-08-29</b>.</p>
-    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once &mdash; signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub&rsquo;s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version <b>2026-08-29</b>.</p>
+    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.</p>
     <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.16",
+  "version": "1.20.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.16",
+      "version": "1.20.18",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.16",
+  "version": "1.20.18",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8152,5 +8152,17 @@
       "id": "1004185",
       "text": "Cleaned out leftover code for a hosting option we retired, with proof that every live project's setup is unchanged — no project sees any difference."
     }
+  ],
+  "1.20.17": [
+    {
+      "id": "1003540",
+      "text": "Guessing someone's private profile name on the recruiting page is now speed-limited, so it can't be used to discover who is open to recruiting."
+    }
+  ],
+  "1.20.18": [
+    {
+      "id": "1004265",
+      "text": "The terms page now says your agreement is recorded when you sign in to a project in your browser, and explains why a command-line-only sign-in doesn't publish your profile."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.16'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.18'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/recruiter_sliver_boundary.mjs

@@ -57,6 +57,8 @@
 // project owner — is wider on both halves. A metic operator and a project owner
 // both read the directory and are both refused here, which is asserted in both
 // directions so a later "tidy-up" onto one shared gate cannot pass quietly.
+// And the read BUDGET ahead of that gate (§6b, task 1003540): the sliver's own
+// per-IP bucket, never a shared one (ADR 0209), so a handle probe is metered.
 //
 // MECHANISM (tests/profile_privacy_owner_view.mjs + tests/connections_ownership.mjs):
 // in-memory tables whose row filter is built FROM EACH STATEMENT'S OWN WHERE
@@ -802,6 +804,73 @@ test('each route spells its OWN gate in its OWN middleware list', () => {
     'and the sliver must never pick up the directory wider door by accident');
 });
 
+// ===========================================================================
+// 6b. THE READ BUDGET — its own, and ahead of the gate (task 1003540)
+// ===========================================================================
+
+// The middleware list of one route, as the router a fresh scoutingRoutes() builds.
+const handlersOf = (routePath) => buildScoutingRoutes().stack
+  .find((l) => l.route && l.route.path === routePath).route.stack.map((l) => l.handle);
+
+test('the sliver spends its OWN per-IP read budget, and one budget however many routers mount it', () => {
+  // Probing guessed handles tells a reader WHICH private accounts opted into
+  // recruiting — a set no other surface publishes — so the probe is metered
+  // (ADR 0215's honest limit, closed). ADR 0209: one budget per oracle. Sharing
+  // an existing budget would hand an enumerator the sum of two, and a limiter
+  // built per router would hand a second mount a second budget.
+  const { sliverReadRateLimit } = buildScoutingRoutes._internals;
+  assert.equal(sliverReadRateLimit.meteredScope, 'recruiter-sliver-read');
+  assert.equal(handlersOf('/scouting/:handle')[0], sliverReadRateLimit);
+  assert.equal(handlersOf('/scouting/:handle')[0], handlersOf('/scouting/:handle')[0],
+    'two routers built from this file spend from ONE budget, not one each');
+  const core = require('../src/bongos/middleware/rate-limit.js');
+  for (const other of [core.accountExistenceReadRateLimit, core.publicProjectFeedRateLimit, core.publicReadRateLimitMiddleware]) {
+    assert.notEqual(sliverReadRateLimit, other, `the sliver must not spend the ${other.meteredScope} budget`);
+  }
+  assert.ok(!handlersOf('/scouting').includes(sliverReadRateLimit),
+    'the directory is a different read and does not spend the sliver budget');
+});
+
+test('the budget runs AHEAD of the gate, so an unauthenticated probe is metered too', () => {
+  // A tagged route is skipped by core's default read ceiling (rate-limit.js #6).
+  // Behind requireBuilder, this limiter would leave every refused probe unmetered
+  // — looser than the ceiling it replaces.
+  const handlers = handlersOf('/scouting/:handle');
+  const { sliverReadRateLimit } = buildScoutingRoutes._internals;
+  assert.equal(handlers.indexOf(sliverReadRateLimit), 0, 'the limiter is the first handler on the route');
+});
+
+test('120 reads a minute per IP, then a 429 that names the sliver budget', () => {
+  const { sliverReadRateLimit, SLIVER_READ_LIMIT, SLIVER_READ_WINDOW_MS } = buildScoutingRoutes._internals;
+  assert.equal(SLIVER_READ_LIMIT, 120, 'the /public/* posture');
+  assert.equal(SLIVER_READ_WINDOW_MS, 60 * 1000);
+  const mkRes = () => {
+    const r = { _status: 200, _json: null, _headers: {} };
+    r.set = (k, v) => { r._headers[k] = v; return r; };
+    r.status = (s) => { r._status = s; return r; };
+    r.json = (j) => { r._json = j; return r; };
+    attachFail({}, r, () => {});
+    return r;
+  };
+  // A documentation-range IP of its own, so the HTTP tests above keep their bucket.
+  const req = { ip: '203.0.113.140' };
+  let allowed = 0;
+  for (let i = 0; i < SLIVER_READ_LIMIT; i++) sliverReadRateLimit(req, mkRes(), () => { allowed++; });
+  assert.equal(allowed, SLIVER_READ_LIMIT, 'every read up to the cap passes');
+  const res = mkRes();
+  let nexted = false;
+  sliverReadRateLimit(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'the read past the cap never reaches the gate or the query');
+  assert.equal(res._status, 429);
+  assert.equal(res._json.error.code, 'rate_limited');
+  assert.equal(res._headers['X-RateLimit-Scope'], 'recruiter-sliver-read');
+  assert.equal(res._headers['X-RateLimit-Limit'], '120');
+  assert.ok(Number(res._headers['Retry-After']) >= 1, 'a Retry-After header is set');
+  let otherPassed = false;
+  sliverReadRateLimit({ ip: '203.0.113.141' }, mkRes(), () => { otherPassed = true; });
+  assert.equal(otherPassed, true, 'one address hitting the cap does not throttle another');
+});
+
 // ===========================================================================
 // 7. IT GRANTS NOTHING (ADR 0016)
 // ===========================================================================

package/tests/terms_acceptance.mjs

@@ -118,20 +118,32 @@ t('the acceptance the page promises is the one the code actually keeps', () => {
 });
 
 // The capture point is GET /sso/authorize — reached when a builder uses their
-// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
-// nothing (blocker 1000124, task 1003353), so the page must not say "here".
-// Task 1003361 adds the hub's own sign-in as a second capture point; when it
-// lands, this wording and §3 below change together.
-t('the page names the sign-in the code actually watches — a project sign-in, not "here" (blocker 1000124)', () => {
+// platform account to sign in to a PROJECT, IN A BROWSER. Signing in to the hub
+// itself stamps nothing (blocker 1000124, task 1003353), so the page must not say
+// "here"; and the CLI's project sign-in (the device poll) stamps nothing either
+// (task 1004265, executed in §3), so the page must say "in your browser" and tell a
+// command-line builder why. Task 1003361 adds the hub's own sign-in as a second
+// capture point; when it lands, this wording and §3 below change together.
+t('the page names the sign-in the code actually watches — a project sign-in in the browser, not "here" (blocker 1000124)', () => {
   const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
   assert.doesNotMatch(section, /sign(?:ed|ing)? in here/i,
     'the page promises that signing in to this site records acceptance — the code never stamps that sign-in');
-  assert.match(section, /Once you have signed in to a project with your platform account and accepted these terms/,
+  assert.match(section, /Once you have signed in to a project in your browser with your platform account and accepted these terms/,
     'what makes a profile public must name the moment the code captures');
   assert.match(section, /never signed in to a project that way stays provisional/,
     'and the provisional case must be the same moment, negated');
-  assert.match(section, /written when you sign in to a project with your platform account, and only once/,
+  assert.match(section, /written when you sign in to a project in your browser with your platform account, and only once/,
     'the acceptance paragraph must name the same capture point');
+  assert.doesNotMatch(section, /sign(?:ed)? in to a project with your platform account/,
+    'an unqualified "project sign-in" also covers the command line, which records nothing (task 1004265)');
+});
+
+t('the page tells a command-line-only builder that their sign-in records nothing, and why (task 1004265)', () => {
+  const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
+  assert.match(section, /Signing in from the command line does not record it/,
+    'a CLI-only builder stays unpublished, and the page must say so rather than leave them to guess');
+  assert.match(section, /on GitHub’s page, where these terms are not shown/,
+    'and why: the device approval never puts these terms in front of them');
 });
 
 t('the page says which acceptances were given on a builder’s behalf, and that the record marks them (task 1003360)', () => {
@@ -139,7 +151,7 @@ t('the page says which acceptances were given on a builder’s behalf, and that
     'the owner chose to grandfather AND to say so on the page — the page must tell a pre-existing builder what was recorded for them');
   assert.match(termsHtml, /marks that acceptance as grandfathered/i,
     'and that the record keeps it distinguishable from one they gave');
-  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project/i,
+  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project in your browser/i,
     'and what happens when they do sign in — the conflict branch below really does replace it');
   assert.doesNotMatch(termsHtml, /written only by signing in/i,
     'the page still says acceptance is written ONLY by signing in, which is false for every grandfathered account');
@@ -503,6 +515,100 @@ await ta('a session of an undeclared source (a leftover dev-box token) cannot mi
   assert.equal(pool.accounts.size, 0, 'a session of an undeclared source recorded a platform T&C acceptance');
 });
 
+// The CLI's project sign-in (POST /sso/device/poll) also uses the platform account,
+// and it deliberately records NOTHING (task 1004265). The approval happens on
+// GitHub's device page, never on a hub page, so these terms are never in front of
+// the person — and activation is ADR 0171 D3's "a human is demonstrably at the hub",
+// which the same branch stamps. So the page names a BROWSER sign-in and says why a
+// command-line one does not count; this drives the real route to hold that claim.
+function post(path_, body) {
+  const payload = JSON.stringify(body);
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      host: '127.0.0.1', port, method: 'POST', path: path_,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// GitHub's side of the device flow, answered as approved for `identity`. The route
+// reaches both modules through their exports objects, so this swaps the network leg
+// and the signing key only — the route, its upsert and the fake pool stay real.
+async function withApprovedDevice(identity, fn) {
+  const hubDevice = require('../modules/platform-identity/hub-device.js');
+  const hubKeys = require('../modules/platform-identity/hub-keys.js');
+  const saved = {
+    hubDeviceConfigured: hubDevice.hubDeviceConfigured,
+    pollHubGithubDevice: hubDevice.pollHubGithubDevice,
+    hubSigningConfigured: hubKeys.hubSigningConfigured,
+    mintHubAssertion: hubKeys.mintHubAssertion,
+  };
+  hubDevice.hubDeviceConfigured = () => true;
+  hubDevice.pollHubGithubDevice = async () => ({ state: 'ok', client_id: 'proj-a', identity });
+  hubKeys.hubSigningConfigured = () => true;
+  hubKeys.mintHubAssertion = () => 'ASSERTION';
+  try { return await fn(); } finally {
+    hubDevice.hubDeviceConfigured = saved.hubDeviceConfigured;
+    hubDevice.pollHubGithubDevice = saved.pollHubGithubDevice;
+    hubKeys.hubSigningConfigured = saved.hubSigningConfigured;
+    hubKeys.mintHubAssertion = saved.mintHubAssertion;
+  }
+}
+
+const CLI_IDENTITY = { github_id: '5151', github_login: 'cli-only', display_name: 'Cli Only', avatar_url: null };
+
+await ta('a CLI-only project sign-in (the device poll) signs the builder in and records NO acceptance (task 1004265)', async () => {
+  SESSION = null;
+  pool.accounts.clear();
+  pool.calls.length = 0;
+  pool.setClock(NOW);
+  const res = await withApprovedDevice(CLI_IDENTITY, () => post('/sso/device/poll', { device_code: 'dc-1' }));
+  assert.equal(res.status, 200, 'CONTROL: the device poll must succeed, or the absence below proves nothing');
+  assert.equal(res.json && res.json.assertion, 'ASSERTION', 'CONTROL: the CLI got its sign-in assertion');
+  const row = pool.accounts.get('5151');
+  assert.ok(row, 'CONTROL: the device poll writes the platform account — the absence below is of the stamp, not the row');
+  assert.equal(row.terms_accepted_at, null,
+    'a command-line sign-in stamped an acceptance — nobody was shown the terms on that path; if this is now intended, /terms and ADR 0213 change with it');
+  assert.equal(row.terms_version, null);
+  assert.equal(row.profile_state, 'provisional', 'and it activates nothing (ADR 0171 D3: activation is a human at the hub)');
+  const upserts = pool.calls.filter((c) => /INSERT INTO platform_identity_accounts/i.test(c.sql) && /DO UPDATE/i.test(c.sql));
+  assert.equal(upserts.length, 1);
+  assert.equal(upserts[0].params[4], false, 'the device poll must pass the non-activating literal');
+});
+
+await ta('the device poll takes no acceptance from its body either — an extra field is refused before any write', async () => {
+  pool.accounts.clear();
+  const res = await withApprovedDevice(CLI_IDENTITY, () => post('/sso/device/poll', {
+    device_code: 'dc-2', activate: true, terms_accepted_at: '1999-01-01T00:00:00.000Z', terms_version: 'FORGED',
+  }));
+  assert.equal(res.status, 400, 'the strict validator must refuse fields the route does not declare');
+  assert.equal(pool.accounts.size, 0, 'a refused poll still wrote an account');
+});
+
+await ta('a CLI-only builder who later signs in to a project in the browser IS stamped then', async () => {
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  await withApprovedDevice({ ...CLI_IDENTITY, github_id: '4242', github_login: 'octo' },
+    () => post('/sso/device/poll', { device_code: 'dc-3' }));
+  assert.equal(pool.accounts.get('4242').terms_accepted_at, null);
+  SESSION = HUB_SESSION;
+  pool.setClock(LATER);
+  assert.equal((await authorize()).status, 302);
+  const row = pool.accounts.get('4242');
+  assert.equal(row.terms_accepted_at, LATER, 'the browser sign-in the page names must stamp the account the CLI created');
+  assert.equal(row.profile_state, 'active');
+});
+
 // ===========================================================================
 // 4. Idempotence — executed, not asserted against a string
 // ===========================================================================