@bongos/core 1.20.17 → 1.20.19

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.17",
-  "core_contract": "1.20.17",
-  "source_commit": "4e92fa5764cf7041b99baefbf8d249edbba9159d",
+  "core_version": "1.20.19",
+  "core_contract": "1.20.19",
+  "source_commit": "634240626e5878bfa71f84a126f2a5066315c631",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T13:31:15.089Z",
+  "built_at": "2026-09-30T14:16:31.957Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 556,
+    "docs_redacted": 557,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2628,
+    "functional_verbatim": 2631,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3210,
-  "tree_sha256": "4715c740ddb7d2c5cdfed3960679731b4a2cdef5b901f92945ba362f12f26570",
+  "file_count": 3214,
+  "tree_sha256": "1941a2dc44fb870a71c3227166d032c854f48237c2fef4cc958e355f9658f585",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1537,7 +1537,7 @@
     {
       "path": "docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md",
       "mode": "0000644",
-      "sha256": "fd6c8d2e3868f2ba42262406b9fbd9ba12cb547a9eac61ddb7b9422afde6b3ab"
+      "sha256": "2e00d10ae548548bc8708058b0beb08fc0631aa29f27f6905ef630fdf4c6099b"
     },
     {
       "path": "docs/adr/0214-canonical-profile-url-one-resolver-dark-until-the-page-exists.md",
@@ -2229,10 +2229,15 @@
       "mode": "0000644",
       "sha256": "4ca4eae961c994cae0dd9d306ea0a5a6f9ce660de161a62c5ccd125d910f70ec"
     },
+    {
+      "path": "docs/adr/0352-a-rollup-report-carries-its-as-of-in-a-header.md",
+      "mode": "0000644",
+      "sha256": "d74b4f6262d4f23fd67f73771bbe8187e9cb92fa321b83ffb33ef03cf96d1236"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "bcfa8004aeaebbfb6c32c53042665d7da49098e80dd858a3f353420f8ef2c523"
+      "sha256": "943ac0f8c9c0b2dc5ef2a05241b0bac329c5fa986b09425841e12e62f4f9b936"
     },
     {
       "path": "docs/api-reference.md",
@@ -2242,7 +2247,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "829ba538e06cca081f0540bf819f280ba36e738a553e5fa3634af5f5af5bc5b0"
+      "sha256": "796e47e332b7788981b5118aabfbacdc9b728e22796da301cedce44ac1ab8dc6"
     },
     {
       "path": "docs/architecture.md",
@@ -2267,12 +2272,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "f4485fd6eecabff171add19c577d0c94b90b1e5e4e90e71f0af23bbd84085791"
+      "sha256": "08ef6d32a1c5cfea14e7ddd54a4e7ab2e34818199a45e0422a4fce31b72567a7"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f8b6e13542de4d3fe03cbfc6a4873c8a7fd7c3ea29e9b535d80c70d2d986340a"
+      "sha256": "a405d02a6308a53e9322437f21daf86cb7e7f0d6d8b15a25639b7fdbcb7c2fd1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2772,7 +2777,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c2490d5cdc3d8044ad02ba2ade0a9918e8c3d041e79f0ac0d61f3126152053d1"
+      "sha256": "f7fe6c9e2a06b6dfb71087791b38b22ff4ce57f897320ade88e65a131fdb4160"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2862,7 +2867,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "b959e7b3c6b623f81e4f5752fa6573621c79d6e8948d18b2b4c939101e65930b"
+      "sha256": "6ba44419e75dcb245e386e077eba647e744c56861b8b81c9002bbe7528369f0c"
     },
     {
       "path": "docs/project-context.template.md",
@@ -7009,6 +7014,11 @@
       "mode": "0000644",
       "sha256": "72be4f7e3aa3afa47dd78de7a57dcdf57b877675b44fbdf02f6607a8632e1787"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_026_activity_reported_as_of.sql",
+      "mode": "0000644",
+      "sha256": "9f8d582d626dec82b55b96272f9d6d7f6c1488ac28bd9a98ab673404afde0c8e"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -7022,7 +7032,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "badb8e19541a08a35f85037bc9f5130c553403ae75017423354d255f972cbe46"
+      "sha256": "a823bd5e79795f93aa011470088b5840bf2ada6fb696fbf6b9b1c6c2ea85e5ef"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -7117,7 +7127,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "aa1bceddd27140e33d12f1c22ca362ba35352d837b556422b54633fd4fcedfc0"
+      "sha256": "2906d873fa46a2745fbbecefdeb81194f6f433e97deed65ee5fbee3e9a7fa140"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -7142,7 +7152,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "788915622457990f61b7b95cc6266d1e285097100100be06419145702191c9ce"
+      "sha256": "93d74c10d601eab840da83b5d33d7bbf51907830626401cc27fadb138441fcc3"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -8032,7 +8042,7 @@
     {
       "path": "modules/public-landing/public/terms.html",
       "mode": "0000644",
-      "sha256": "639d96a2bf6b28fabbcad64a01e3b97aab83dabe8182455074f2845e053b2696"
+      "sha256": "39aae17cd14c496533f9a212f37378571d9d621c078353e41900a02c5355df5f"
     },
     {
       "path": "modules/render-deploy/deploys.js",
@@ -8862,12 +8872,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f04a559437cf80ab6eeb46905a8f943091dd4601e02b7d7ae58ca57aae35b050"
+      "sha256": "01b48ab609eb6e0b51a3420a79cd5e13158e3bf3f996a5bd30dbd1c2927c5b91"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b8cd817f9d22b1222c06404648c197080fce17573ce0c83f43b4f03f87fb06b4"
+      "sha256": "15c8438b1ea0a683e536e21ca2ed353042533ddf893b727c3835d5422595797a"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8897,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "06f6c8587835146b2f325adf518aca1e74699cb2f38f0313ad4bf7f5fe37577c"
+      "sha256": "426ac20e29712617fe5881fdc428ff184ab09e2e0cfc093a99b1f10c192291a3"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10047,7 +10057,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "55ffec8533dc352849c2a9bb40663a1a0c95d72d466360bf47091e9491683b0b"
+      "sha256": "456b185fcbab4fb486fb15aecf0de260183c9eda9942c12c0123000a8baeaa57"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10667,7 +10677,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "2d11e7b745a0476fa0643fd997c2e17a49709bae1ef93a7c4636f7efd18c7ab0"
+      "sha256": "9fd9311df751a418985073db3aed97825e52d2a45ca7501b93f93cf5019c1fe6"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -11002,7 +11012,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ae8085fdd1b2e41ff442de4a863b7b105bebaad915054a0cfa38bb57321289be"
+      "sha256": "f80e044dd532aabc41f3731129d98f63c98c2d60a9a4fc3eecbf713e3a86650e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11104,10 +11114,20 @@
       "mode": "0000644",
       "sha256": "f7434d510d656e5081f735d1f9356ecb11e8c3630a86a86137c3290134541c8d"
     },
+    {
+      "path": "tests/activity_rollup_as_of.mjs",
+      "mode": "0000644",
+      "sha256": "d5903404f0fed48e599b68f259e0d79a44d11c249bb69bc4b59643e7dac62cbb"
+    },
+    {
+      "path": "tests/activity_rollup_order_db.mjs",
+      "mode": "0000644",
+      "sha256": "497b453aa441ba06276d5146fc71f54da111a12c7c0c2e192da199cc1f2812ec"
+    },
     {
       "path": "tests/activity_snapshots_db.mjs",
       "mode": "0000644",
-      "sha256": "219569f3160eb22a89e92a217b854a194afba6ebc7032dc07eff2534efc4390a"
+      "sha256": "73cb5a43e3f3ce61dd7f57720e523a310390ed60ed491d39fdaf8b8e9c78053a"
     },
     {
       "path": "tests/admission_ceiling_gate.mjs",
@@ -14347,7 +14367,7 @@
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
-      "sha256": "986cd6a9aa83743f5d2bc6083803e6ed576f6b7b35a8c6dc05e9096fa022f898"
+      "sha256": "093f078f965454e535d6026c1852a0e0668695809f270f84e5d26dba4025abbd"
     },
     {
       "path": "tests/profile_route.mjs",
@@ -15757,7 +15777,7 @@
     {
       "path": "tests/terms_acceptance.mjs",
       "mode": "0000644",
-      "sha256": "d73eea1d83bdf132f5973a67013bd01270b54253ef6eb979c801b019d6f67c6f"
+      "sha256": "80ea17a764ba05a05af0967e9951370b814c20c3518a37f1c3ca1a9ca0d044cf"
     },
     {
       "path": "tests/terms_grandfather_db.mjs",

package/docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md

@@ -29,6 +29,8 @@ This is deliberately the ADR 0205 D3 property, reused. An acceptance record a ca
 
 > **Amended 2026-09-25 ([task 1003353](https://cloudbongos.com/builders#/task/1003353); [blocker 1000124](https://cloudbongos.com/builders#/blocker/1000124)) — what "the hub's own sign-in" means.** `GET /sso/authorize` is reached when a builder uses their platform account to sign in to a **project**; the only builder of that URL is a child instance's `idpAuthorizeUrl`. Signing in to the hub itself creates a hub session and never touches `platform_identity_accounts`, so it records no acceptance. `/terms` said "signed in here"; it now names a project sign-in. The owner chose to also capture the hub's own sign-in ([task 1003361](https://cloudbongos.com/builders#/task/1003361)), which will make this a second capture point rather than a wording fix. Two smaller corrections to the text above: the device poll does not go through `ensureAccount`, it is a non-activating `upsertAccount`, and so is `PATCH /me/handle`; `ensureAccount` is the federated membership check-in alone. The outcome was always the same (neither writes an acceptance), and both paths are now executed in `tests/terms_acceptance.mjs` rather than asserted as text.
 
+> **Amended 2026-09-30 ([task 1004265](https://cloudbongos.com/builders#/task/1004265)) — a project sign-in *in the browser*.** The CLI's project sign-in (`POST /sso/device/poll`) also uses the platform account, and it stays **non-activating on purpose**. The person approves it on GitHub's device page, never on a hub page, so these terms are never in front of them — and the same branch that stamps the acceptance also flips `profile_state` to active, which ADR 0171 D3 reserves for the one path "where a human is demonstrably at the hub" — and D3 names the device poll as `provisional` in so many words. Stamping it would record consent nobody was shown and re-decide D3 by implementation convenience. `/terms` therefore names a project sign-in **in your browser**, and says that a command-line sign-in records nothing and why, so a CLI-only builder is not left guessing why they are unpublished. `tests/terms_acceptance.mjs` §3 drives the real device-poll route (no acceptance, still provisional, the non-activating literal, a forged body refused before any write) and a later browser sign-in stamping that same account. The "next hub sign-in" wording under D4 is left for task 1003361, which makes it true.
+
 ### D2 — Written once. The first acceptance is the one that stands
 
 The conflict branch writes `COALESCE(platform_identity_accounts.terms_accepted_at, now())`. Signing in again re-reads the terms but does not restamp them, so the column keeps meaning *when consent was given* rather than *when this account was last seen*. `terms_version` is COALESCE'd the same way and always written in the same statement, so the pair cannot diverge.

package/docs/adr/0352-a-rollup-report-carries-its-as-of-in-a-header.md

@@ -0,0 +1,38 @@
+# ADR 0352 — A rollup report carries its "as of" in a header, and the hub keeps the newest
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004268](https://cloudbongos.com/builders#/task/1004268) (goal 1000110), found in [task 1004244](https://cloudbongos.com/builders#/task/1004244)'s code review
+- **Interacts with:** [ADR 0141](<redacted>.md) §4 (the activity rollup), [ADR 0171](0171-profile-rollup-join-and-consent.md) D7 (a report is third-party self-report), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) §5 (module-namespaced migrations)
+
+## Context
+
+`POST /sso/activity/rollup` upserted the live activity row last-writer-wins, and a report carried no timestamp. An instance pushes one on every federated sign-in and one on every ship, so a sign-in report read earlier and a ship report read later can reach the hub together, and the older one can commit last. The live row and, since task 1004244, the newest snapshot then show the older totals. The leaderboard reads a regression that never happened until the builder's next report. It is low-urgency, since the next report corrects it, but it is wrong in exactly the place people compare numbers.
+
+The fix the task names is for the instance to send when it read the totals, and for the hub to refuse an older report. What is not obvious is where that stamp travels.
+
+## Decision
+
+**D1 — The stamp is a request header, `Bongos-Report-As-Of`, not a body field.** The hub validates the rollup body strictly (`validateOrRespond`), so an unknown field is a 400. The hub and its instances upgrade independently, and an instance can run a newer core than the hub (today the hub's pin trails main). A body field sent by an upgraded instance would be refused by a hub that predates it. The sender never reads the response, so every report from that instance would be lost silently until the hub caught up. An unknown header is ignored, so the header is safe in both directions: an old hub ignores it, and a new hub treats its absence as "unstamped".
+
+**D2 — Unstamped means the old behaviour, never a refusal.** A missing or unparseable header binds NULL. A NULL on either side of the comparison (an older instance's report, or a row written before migration 026) applies last-writer-wins, as before. An unstamped report also clears the stored stamp, so a stamp never outlives the numbers it described. A malformed header is not a 400, for D1's reason: a refusal drops the report, when the only thing lost should be its ordering.
+
+**D3 — The guard is a WHERE on the upsert's conflict branch.** `ON CONFLICT (client_id, github_id) DO UPDATE … WHERE EXCLUDED.reported_as_of IS NULL OR <row>.reported_as_of IS NULL OR EXCLUDED.reported_as_of >= <row>.reported_as_of`. A skipped update still takes the row lock, so racing reports stay queued exactly as task 1004244 arranged, and the snapshot beside it copies an unchanged live row, which records nothing. Ties apply (the later arrival wins, as before).
+
+**D4 — The stamp is the instance's clock, compared only with itself, and clamped to the hub's.** A row's stored stamp only ever comes from the same client for the same builder, so skew between an instance and the hub does not matter. A stamp later than the hub's `now()` is stored as `now()`, so an instance whose clock runs ahead cannot freeze the row until its clock is reached. The sender stamps before its first read, so a report is never ordered ahead of totals read after it.
+
+## Consequences
+
+- Migration `platform_identity_026_activity_reported_as_of.sql` adds one nullable column, with no backfill and no default. An invented stamp on an existing row could refuse an honest report from an instance whose clock reads earlier than the hub's.
+- A mixed fleet behaves as before until each instance upgrades. An upgraded instance talking to an old hub is also unaffected.
+- **Honest limit:** an instance clock that steps backwards (an NTP correction after running fast) has its reports refused until it passes the last stamp it sent. The skew bounds this, the clamp bounds the skew by the hub's own time, and the next report after that applies. A report refused this way still answers `{ ok: true }`, because the instance ignores the body.
+- **The pattern generalises:** a field added to a hub↔instance wire that the older side validates strictly must be able to ride where the older side ignores it, or the change must land on the hub first and be released before any instance sends it.
+
+Proof: `tests/activity_rollup_order_db.mjs` (real Postgres: the out-of-order race, ties, NULLs on each side, the future clamp, and ten rounds of five racing writers ending on the latest stamp with the snapshot agreeing) and `tests/activity_rollup_as_of.mjs` (DB-free: the sender stamps a header before its reads and never the body; the route binds it and degrades a bad one to unstamped).
+
+## Alternatives considered
+
+- **A body field `as_of`.** This is what the task sketched. It is lost against any older hub (D1).
+- **`GREATEST` on each total.** Credits and karma can legitimately fall, so this would pin a clawback forever.
+- **The standard `Date` header.** It has one-second granularity, and a sign-in push and a ship push inside the same second are exactly the case being fixed.
+- **A 400 on a malformed stamp.** It turns a sender bug into silent data loss (D2).

package/docs/adr/README.md

@@ -470,3 +470,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0349 | [**A version preview is a sandboxed child the web tier launches, reached by a cookie** ([task 1004300](https://cloudbongos.com/builders#/task/1004300), goal 1000090 — BONGOS-V2, owner Lars, approved 2026-09-29). Amends ADR 0293 D1 for this feature only. **D1 (owner):** route by a `bongos_preview` cookie through an optional `request.divert` seam, not a path; forward only with the cookie, off the sign-in and preview paths, with no Bearer, and with `core.pin.move` re-checked on every request. **D2 (owner):** the npm-release module launches the preview itself, with a deny-by-default environment, a dump-and-restore copy of the database (never a template copy), one at a time, 20-minute idle stop, published versions within 30 of the running one. **D3:** the same database role and no egress firewall are accepted for now.](0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md) | modules / npm-release / deploy |
 | 0350 | [**The hub holds a per-project WRITE deploy key, so a hosted project's upgraded pin always reaches its GitHub repo** ([task 1004291](https://cloudbongos.com/builders#/task/1004291), follow-up to task 1004065). Amends ADR 0176. The owner's token lasts one hour and the checkout's own key is read-only, so most hosted upgrades ended "GitHub was not updated". **D1:** a second deploy key per repo, registered `read_only: false` as `cloudbongos-pin-<slug>`, the pull key untouched. **D2:** kept outside every checkout in the runner's own directory (0700 dir, 0600 key, modes verified), unreadable by the project's account. **D3:** minted at standup and whenever a fresh owner token finds none, so reconnecting GitHub once is enough. **D4:** `pushUpgradePin` tries write key, then owner token, then origin, never forced. **D5:** revoked on teardown and disconnect. **D6:** a project on the shared app user is refused a key: "needs its own account first". **D7:** /deploy says reconnecting sets up lasting access.](0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md) | provisioning / security |
 | 0351 | [**A criterion closes on a UAT, not on its linked tasks shipping** ([task 1004392](https://cloudbongos.com/builders#/task/1004392), goal 1000089 — working area 3). Supersedes ADR 0183's close rule. `wa7-government` had closed on six Board Room navigation tasks while nothing it describes was on the live site. **D1:** three checks — Code (linked tasks done, ≥1 shipped; automatic), Live, UAT — and the sweep closes a criterion only with a CURRENT sign-off (no older than the newest linked ship). **D2 (owner):** "Awaiting UAT" is a visible state. **D3 (owner):** one step; the signer is refused if they shipped linked work, the project owner excepted. **D4 (owner):** an mp4/webm up to 100 MB on the project's own server. **D5 (owner):** backend-only is set while a criterion is open and takes a recording-free sign-off. **D6 (owner):** Live is read via the `deploy.taskWhere` port where the site can tell, attested otherwise. **D7 (owner):** already-closed criteria stay closed ("Closed before UAT"). **D8:** `/satisfy` is a recorded override that needs a reason. **D9:** `/goal-uat` + `scripts/gds/uat.js`; the hall is task 1004402.](0351-a-criterion-closes-on-a-uat.md) | lifecycle / criteria / review |
+| 0352 | [**A rollup report carries its "as of" in a header, and the hub keeps the newest** ([task 1004268](https://cloudbongos.com/builders#/task/1004268), goal 1000110). `POST /sso/activity/rollup` was last-writer-wins with no report timestamp, so a sign-in push read earlier and a ship push read later could land the older totals last. **D1:** the instance's read time rides a `Bongos-Report-As-Of` HEADER, not a body field, because the hub validates the body strictly and hub and instances upgrade independently: a body field from a newer instance would 400 on an older hub and lose the report, while an unknown header is ignored. **D2:** missing or unparseable = unstamped = last-writer-wins, never a 400. **D3:** the guard is a WHERE on the upsert's conflict branch (migration 026, `reported_as_of`, no backfill); a skipped update keeps the row lock, so the task 1004244 snapshot stays in step. **D4:** the stamp is compared only with the same client's, and clamped to the hub's `now()`.](0352-a-rollup-report-carries-its-as-of-in-a-header.md) | platform identity / federation |

package/docs/api/openapi.json

@@ -18502,7 +18502,7 @@
           "sso"
         ],
         "summary": "POST /sso/activity/rollup",
-        "description": "POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). Server-to-server, client_id+client_secret auth. Keyed to the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting view — never authority. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). Server-to-server, client_id+client_secret auth. Keyed to the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting view — never authority. Optional `Bongos-Report-As-Of` header (task 1004268): when the instance read these totals, so an older report landing last cannot overwrite a newer one. A HEADER, not a body field, because the body is validated strictly and the hub and its instances upgrade independently: a new instance's body field would 400 on an older hub and the report would be lost, while an unknown header is ignored. Absent or unparseable reads as unstamped (last-writer-wins, as before) rather than a 400 — the sender never reads the response, so a refusal would silently drop the report instead of only its ordering. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/platform-identity/routes/sso.js",
         "requestBody": {

package/docs/copy-inventory.md

@@ -4,7 +4,7 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2189 strings** across 3 surfaces · 1889 distinct pieces of copy · 2189 certain, 0 heuristic · 207 shown in more than one place.
+**2188 strings** across 3 surfaces · 1888 distinct pieces of copy · 2188 certain, 0 heuristic · 207 shown in more than one place.
 
 ## Surfaces
 
@@ -12,7 +12,7 @@
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 109 | 1617 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
-| `landing` | `modules/public-landing/public` | 6 | 472 |
+| `landing` | `modules/public-landing/public` | 6 | 471 |
 
 ## Confidence, and why it is on every row
 
@@ -1805,7 +1805,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 472 strings
+## `landing` — 471 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1940,7 +1940,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `485c565b5745` | certain | How people join | `modules/public-landing/public/projects.html:910` |
 | `4b542b000afa` | certain | How this project is drawn: on the sky, in your list, at the top of this page and on its card. A planet is a | `modules/public-landing/public/projects.html:1030` |
 | `9f31eaed8252` | certain | If you grant repository access while creating a project, that permission is used to create or adopt your repos | `modules/public-landing/public/privacy.html:55` |
-| `3b1cbe9e33aa` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:71` |
+| `d37e2fbde8c6` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:71` |
 | `607551ae732b` | certain | Invite a builder | `modules/public-landing/public/projects.html:1003` |
 | `20786b02f47a` | certain | Invite builders | `modules/public-landing/public/projects.html:1492` |
 | `a1256030d879` | certain | Invite only | `modules/public-landing/public/projects.html:914` |
@@ -1979,7 +1979,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `837fdaa0936a` | certain | Nothing matches that. | `modules/public-landing/public/projects.html:707` |
 | `1bc11853e893` | certain | On the map | `modules/public-landing/public/projects.html:929` |
 | `b4ac8f44710c` | certain | On the public map | `modules/public-landing/public/projects.html:851` |
-| `7fe31ce20c09` | certain | Once you have signed in to a project with your platform account and accepted these terms, your profile and tha | `modules/public-landing/public/terms.html:68` |
+| `1fdda2903cf9` | certain | Once you have signed in to a project in your browser with your platform account and accepted these terms, your | `modules/public-landing/public/terms.html:68` |
 | `8329bb1a3693` | certain | One tap files the request and the platform starts standing your project up — server, database, address. Here's | `modules/public-landing/public/projects.html:1462` |
 | `86cde1930d84` | certain | Only mine | `modules/public-landing/public/projects.html:477` |
 | `f82fe1982ab3` | certain | Open an issue on the repository | `modules/public-landing/public/contact.html:52` |
@@ -2092,7 +2092,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fb416bf1a26b` | certain | The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub | `modules/public-landing/public/projects.html:1355` |
 | `a954f0dce9a3` | certain | The platform | `modules/public-landing/public/contact.html:65` |
 | `4fd8f5746cc5` | certain | The platform is run as a non-profit, capture-resistant commons. | `modules/public-landing/public/terms.html:50` |
-| `dede132846fe` | certain | The platform stores the date you accepted these terms, and which version, on your account. It is written when  | `modules/public-landing/public/terms.html:70` |
 | `20fcebaa85c4` | certain | The project hub needs JavaScript — the map, your projects, and starting a new one all live here. You can read  | `modules/public-landing/public/projects.html:530` |
 | `4a740b5afe73` | certain | The project map | `modules/public-landing/public/projects.html:540` |
 | `345fec12e5d8` | certain | The repository | `modules/public-landing/public/contact.html:50` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2189,
-    "unique_ids": 1889,
-    "certain": 2189,
+    "strings": 2188,
+    "unique_ids": 1888,
+    "certain": 2188,
     "heuristic": 0,
     "duplicate_ids": 207
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 6,
-      "strings": 472
+      "strings": 471
     }
   },
   "blind_spots": [
@@ -17936,9 +17936,9 @@
       "confidence": "certain"
     },
     {
-      "id": "3b1cbe9e33aa",
+      "id": "d37e2fbde8c6",
       "surface": "landing",
-      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.",
+      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.",
       "file": "modules/public-landing/public/terms.html",
       "line": 71,
       "origin": "html-text",
@@ -18287,9 +18287,9 @@
       "confidence": "certain"
     },
     {
-      "id": "7fe31ce20c09",
+      "id": "1fdda2903cf9",
       "surface": "landing",
-      "text": "Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
+      "text": "Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
       "file": "modules/public-landing/public/terms.html",
       "line": 68,
       "origin": "html-text",
@@ -19303,15 +19303,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "dede132846fe",
-      "surface": "landing",
-      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once — signing in again does not change the date you accepted. This is version",
-      "file": "modules/public-landing/public/terms.html",
-      "line": 70,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -2691,5 +2691,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.15 with no explicit bump. run 36717488992. (task 1002620)
   1.20.17 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.16 with no explicit bump. run 36722139698. (task 1002620)
+  1.20.18 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.17 with no explicit bump. run 36724081934. (task 1002620)
+  1.20.19 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.18 with no explicit bump. run 36727774141. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":39,"lines":3791,"placed":1278,"shared":254,"unplaced":2259,"omitted_data":2054},
+  "counts": {"pages":39,"lines":3791,"placed":1277,"shared":254,"unplaced":2260,"omitted_data":2054},
   "pages": [
     {
       "id": "builders:atlas",
@@ -4132,9 +4132,9 @@
       "surface": "landing",
       "title": "{{productName}} — Terms",
       "states_read": ["default"],
-      "files_hash": "1523219e46cd7488",
-      "reading_hash": "a68fd4a222091122",
-      "counts": {"lines":45,"placed":29,"shared":9,"unplaced":7},
+      "files_hash": "5f1171d0ce6fb7d3",
+      "reading_hash": "007bea800099720b",
+      "counts": {"lines":45,"placed":28,"shared":9,"unplaced":8},
       "omitted": {"data":1},
       "notes": [],
       "lines": [
@@ -4158,13 +4158,13 @@
         {"key":"L0018","section":"Your work across projects","text":"These numbers describe; they do not govern.","placement":"placed","file":"modules/public-landing/public/terms.html","line":67,"string_id":"02e596cc4569"},
         {"key":"L0019","section":"Your work across projects","text":"Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and {…} may treat it as permission. A rank shown here is that project’s own standing for you, as that project reported it — the platform holds no rank of its own.","placement":"unplaced"},
         {"key":"L0020","section":"Your work across projects","text":"What is public.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"9b3312899fb1"},
-        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"7fe31ce20c09"},
+        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"1fdda2903cf9"},
         {"key":"L0022","section":"Your work across projects","text":"What you control.","placement":"placed","file":"modules/public-landing/public/terms.html","line":69,"string_id":"6130dcb60532"},
         {"key":"L0023","section":"Your work across projects","text":"From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform’s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.","placement":"placed","file":"modules/public-landing/public/terms.html","line":69,"string_id":"0808df6e434c"},
         {"key":"L0024","section":"Your work across projects","text":"Your acceptance is recorded.","placement":"placed","file":"modules/public-landing/public/terms.html","line":70,"string_id":"0f06f7e72ea7"},
-        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once — signing in again does not change the date you accepted. This is version","placement":"placed","file":"modules/public-landing/public/terms.html","line":70,"string_id":"dede132846fe"},
+        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version","placement":"unplaced"},
         {"key":"L0026","section":"Your work across projects","text":"Accounts from before these terms.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"9b02ec8a2e21"},
-        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"3b1cbe9e33aa"},
+        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"d37e2fbde8c6"},
         {"key":"L0028","section":"Fair use","text":"Fair use","placement":"placed","file":"modules/public-landing/public/terms.html","line":73,"string_id":"2585087f4873"},
         {"key":"L0029","section":"Fair use","text":"Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.","placement":"placed","file":"modules/public-landing/public/terms.html","line":74,"string_id":"8d812912c392"},
         {"key":"L0030","section":"Liability","text":"Liability","placement":"unplaced"},

package/modules/platform-identity/migrations/platform_identity_026_activity_reported_as_of.sql

@@ -0,0 +1,27 @@
+-- platform_identity_026_activity_reported_as_of.sql — WHEN the reporting instance
+-- read the totals a rollup carries (task 1004268).
+--
+-- WHY. POST /sso/activity/rollup upserted the live activity row last-writer-wins,
+-- and a report carried no timestamp. A sign-in report and a ship report racing to
+-- the hub could commit in the wrong order, leaving the older totals live (and, since
+-- task 1004244, as the newest snapshot) — a leaderboard regression that never
+-- happened, until the builder's next report.
+--
+-- WHAT. One nullable column: the instance's own "as of" for the stored totals, sent
+-- as the Bongos-Report-As-Of header and clamped to the hub's clock on write.
+-- upsertActivity's conflict branch applies a report only when its stamp is at least
+-- this one. NULL means "unstamped" — every row written before this column, and every
+-- report from an instance too old to send the header — and an unstamped side always
+-- applies, which is exactly the old behaviour.
+--
+-- No backfill, no default: inventing a stamp for an existing row would make it
+-- refuse an honest report from an instance whose clock reads earlier than the hub's.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_builder_project_activity
+  ADD COLUMN IF NOT EXISTS reported_as_of timestamptz;
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -664,8 +664,10 @@ function sanitizeRecentShips(raw, clientOrigin) {
 // Descriptive analytics — never authority. Refreshes last_active on each report.
 // `clientOrigin` is the AUTHENTICATED client's registered origin (never a
 // caller-named one) and exists only to bound the ship links — see
-// origin-containment.js:urlWithinOrigin.
-async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null }, { pool = defaultPool } = {}) {
+// origin-containment.js:urlWithinOrigin. `asOf` is when the instance read these
+// totals (task 1004268, migration 026): an older report never overwrites a newer
+// one; unstamped (an older instance) keeps last-writer-wins; a future stamp is clamped.
+async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null, asOf = null }, { pool = defaultPool } = {}) {
   // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
   // lazy getter over db-kernel's canonical four-rank ladder).
   const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
@@ -677,17 +679,20 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
   return api.withTx(async (client) => {
     const { rows } = await client.query(
       `INSERT INTO platform_identity_builder_project_activity
-         (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now())
+         (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at, reported_as_of)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now(),
+               CASE WHEN $9::timestamptz IS NULL THEN NULL ELSE LEAST($9::timestamptz, now()) END)
        ON CONFLICT (client_id, github_id) DO UPDATE SET
          credits = EXCLUDED.credits, tasks_shipped = EXCLUDED.tasks_shipped, karma = EXCLUDED.karma,
          rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
-         recent_ships = EXCLUDED.recent_ships,
+         recent_ships = EXCLUDED.recent_ships, reported_as_of = EXCLUDED.reported_as_of,
          last_active = now(), updated_at = now()
+       WHERE EXCLUDED.reported_as_of IS NULL OR platform_identity_builder_project_activity.reported_as_of IS NULL
+          OR EXCLUDED.reported_as_of >= platform_identity_builder_project_activity.reported_as_of
        RETURNING id, client_id, github_id`,
       // jsonb is bound as a JSON STRING: node-postgres serializes a JS array as a
       // Postgres ARRAY literal, which the jsonb column would reject.
-      [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships)],
+      [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships), asOf],
     );
     // Windowed data plane (task 1002977) — best-effort, see activity-snapshots.js.
     await recordActivitySnapshot({ clientId, githubId }, { client });

package/modules/platform-identity/routes/sso.js

@@ -83,6 +83,14 @@ const log = api.logger('platform-identity');
 
 const { pool, validateOrRespond, resolveSession } = api;
 
+// The Bongos-Report-As-Of header of a rollup as an ISO timestamp, or null when it
+// is absent or unparseable (task 1004268; see POST /sso/activity/rollup).
+function reportAsOf(req) {
+  const raw = req.get ? req.get('Bongos-Report-As-Of') : null;
+  const ms = typeof raw === 'string' && raw.length <= 64 ? Date.parse(raw) : NaN;
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+}
+
 // Minimal standalone error page for the browser leg (no template engine / deps).
 // The /sso/authorize failures are pre-redirect (bad client / bad redirect_uri), so
 // we must render our OWN page rather than bounce to an unvalidated URI.
@@ -538,6 +546,15 @@ module.exports = function ssoRoutes() {
   // the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting
   // view — never authority.
   //
+  // Optional `Bongos-Report-As-Of` header (task 1004268): when the instance read
+  // these totals, so an older report landing last cannot overwrite a newer one.
+  // A HEADER, not a body field, because the body is validated strictly and the hub
+  // and its instances upgrade independently: a new instance's body field would 400
+  // on an older hub and the report would be lost, while an unknown header is
+  // ignored. Absent or unparseable reads as unstamped (last-writer-wins, as before)
+  // rather than a 400 — the sender never reads the response, so a refusal would
+  // silently drop the report instead of only its ordering.
+  //
   // rank: public — authenticated by client_id + client_secret, not a builder rank.
   router.post('/sso/activity/rollup', async (req, res) => {
     if (validateOrRespond(req, res, {
@@ -595,6 +612,7 @@ module.exports = function ssoRoutes() {
         // ship link must fall inside (task 1002803). Taken from the client row,
         // never from the body, for the same reason client_id is.
         clientOrigin: client.origin,
+        asOf: reportAsOf(req),
       }, { pool });
       res.json({ ok: true });
     } catch (err) {

package/modules/platform-identity/tests/platform-identity.mjs

@@ -595,8 +595,9 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
   // recent_ships (task 1002803) rides the same row as a jsonb STRING param —
   // an empty list when the sender reported none, never NULL. Its own cap,
-  // shape and link bound are covered by tests/hub_recent_ships.mjs.
-  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]']);
+  // shape and link bound are covered by tests/hub_recent_ships.mjs. The last param
+  // is the report's as-of stamp (task 1004268): null when the sender gave none.
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]', null]);
 });
 
 await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {

package/modules/public-landing/public/terms.html

@@ -65,10 +65,10 @@
     <h2>Your work across projects</h2>
     <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the roles you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
     <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
-    <p><b>What is public.</b> Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
+    <p><b>What is public.</b> Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
     <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
-    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once &mdash; signing in again does not change the date you accepted. This is version <b>2026-08-29</b>.</p>
-    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once &mdash; signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub&rsquo;s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version <b>2026-08-29</b>.</p>
+    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.</p>
     <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.17",
+  "version": "1.20.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.17",
+      "version": "1.20.19",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.17",
+  "version": "1.20.19",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8158,5 +8158,17 @@
       "id": "1003540",
       "text": "Guessing someone's private profile name on the recruiting page is now speed-limited, so it can't be used to discover who is open to recruiting."
     }
+  ],
+  "1.20.18": [
+    {
+      "id": "1004265",
+      "text": "The terms page now says your agreement is recorded when you sign in to a project in your browser, and explains why a command-line-only sign-in doesn't publish your profile."
+    }
+  ],
+  "1.20.19": [
+    {
+      "id": "1004268",
+      "text": "Builders' activity numbers on the platform can no longer briefly go backwards when two updates arrive at the same time."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -87,6 +87,10 @@ const INTEGRATION = new Set([
   // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
   // a fake pool can prove the query shape but not which reports it inserts.
   'activity_snapshots_db',
+  // task 1004268: an older rollup report never overwrites a newer one — a WHERE on
+  // the upsert's conflict branch, whose NULL handling and racing-writer outcome only
+  // a real Postgres settles (the DB-free sibling is activity_rollup_as_of).
+  'activity_rollup_order_db',
   // task 1002978: the windowed leaderboard against real SQL. Which snapshot
   // becomes a window baseline (a LATERAL at-or-before probe), a missing baseline
   // counting as zero, and the privacy matrix filtering are all planner facts the

package/src/bongos/auth-admission.js

@@ -148,6 +148,10 @@ async function reportActivityRollup({ builderId, githubId = null }) {
   const idp = loadIdpConfig();
   if (!idp) return;
   try {
+    // Stamped BEFORE the reads: the hub keeps whichever report was read latest, so a
+    // sign-in push and a ship push racing to it cannot land the older totals last
+    // (task 1004268). A header, not a body field — see the hub's rollup route.
+    const asOf = new Date().toISOString();
     // Snapshot the builder's talent signals directly from the DB (auth.js is a
     // kernel file — it uses pool, never a non-kernel domain module like metrics.js).
     const b = await pool.query(
@@ -162,7 +166,10 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     const recentShips = await recentShipsForRollup(builderId);
     await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+      headers: {
+        'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent(),
+        'Bongos-Report-As-Of': asOf,
+      },
       body: JSON.stringify({
         client_id: idp.clientId,
         client_secret: idp.clientSecret,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.19'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/activity_rollup_as_of.mjs

@@ -0,0 +1,172 @@
+// tests/activity_rollup_as_of.mjs — task 1004268, the two ends of the wire.
+//
+// A rollup report now says WHEN the instance read its totals, so the hub can keep
+// the newest one when a sign-in push and a ship push race (the ordering itself is
+// proven against real SQL in tests/activity_rollup_order_db.mjs). This file holds
+// the two halves a fake can settle:
+//
+//   1. THE SENDER stamps every report with a `Bongos-Report-As-Of` header, taken
+//      BEFORE it reads the totals, and never puts the stamp in the body — the hub
+//      validates the body strictly, so a body field from a newer instance would
+//      400 on an older hub and lose the report.
+//   2. THE HUB ROUTE binds that header as the upsert's stamp, and reads a missing
+//      or unparseable one as "unstamped" (last-writer-wins, the old behaviour)
+//      rather than refusing — the sender never reads the response, so a 400 would
+//      silently drop the report, not just its ordering.
+//
+// DB-free: the core half pins require.cache and stubs fetch (the
+// tests/hub_recent_ships.mjs idiom); the hub half drives the real route handler
+// over a recording fake pool.
+//
+// Run:  node tests/activity_rollup_as_of.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+function mockPool(answer = () => ({ rows: [] })) {
+  const calls = [];
+  const query = async (text, params = []) => {
+    calls.push({ text: String(text), params, at: Date.now() });
+    return answer(String(text), params) || { rows: [] };
+  };
+  return {
+    calls,
+    query,
+    connect: async () => ({ query, release: () => {} }),
+    find: (re) => calls.find((c) => re.test(c.text)),
+  };
+}
+
+// ---- 1. the sender ----------------------------------------------------------
+
+console.log('\n1. the instance stamps each report, in a header:');
+
+const pin = (rel, exports) => {
+  const p = require.resolve(rel);
+  require.cache[p] = { id: p, filename: p, loaded: true, exports };
+};
+
+await t('reportActivityRollup sends Bongos-Report-As-Of, stamped before the totals were read', async () => {
+  const senderPool = mockPool((sql) => {
+    if (/FROM builders WHERE id/.test(sql)) {
+      return { rows: [{ github_id: 42, total_credits: 7, karma: 1, rank: 'metic', preferred_disciplines: ['engineer'] }] };
+    }
+    if (/count\(\*\)/.test(sql)) return { rows: [{ n: 3 }] };
+    return { rows: [] };
+  });
+  pin('../src/bongos/pool.js', { pool: senderPool });
+  pin('../src/bongos/auth-config.js', {
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' }),
+  });
+  delete require.cache[require.resolve('../src/bongos/auth-admission.js')];
+  const { reportActivityRollup } = require('../src/bongos/auth-admission.js');
+
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async (url, opts) => { sent.push({ url, opts }); return { ok: true, json: async () => ({ ok: true }) }; };
+  const before = Date.now();
+  try {
+    await reportActivityRollup({ builderId: 7 });
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+  assert.equal(sent.length, 1, 'exactly one rollup was sent');
+  assert.match(sent[0].url, /\/sso\/activity\/rollup$/);
+  const stamp = sent[0].opts.headers['Bongos-Report-As-Of'];
+  assert.equal(typeof stamp, 'string', 'the report carries its as-of header');
+  const ms = Date.parse(stamp);
+  assert.ok(Number.isFinite(ms) && new Date(ms).toISOString() === stamp, `an ISO timestamp, got ${stamp}`);
+  assert.ok(ms >= before && ms <= senderPool.calls[0].at,
+    'stamped BEFORE the first read — a stamp taken after could order a report ahead of totals read later');
+  const body = JSON.parse(sent[0].opts.body);
+  assert.equal(body.credits, 7, 'CONTROL: the body still carries the totals');
+  assert.ok(!Object.keys(body).some((k) => /as_?of/i.test(k)),
+    'the stamp must never ride the body: an older hub validates it strictly and would 400 the whole report');
+});
+
+// ---- 2. the hub route --------------------------------------------------------
+
+console.log('\n2. the hub binds the stamp, and an unusable one degrades to unstamped:');
+
+const SECRET = 'as-of-secret';
+function hubRoute() {
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  const rollupPool = mockPool((sql) => {
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: 'https://p.example' }] };
+    }
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member', signin_verified_at: '2026-08-29T00:00:00.000Z' }] };
+    }
+    return { rows: [{ id: 1 }] };
+  });
+  const helpers = require('../src/bongos/routes/_helpers.js');
+  const realApi = require('../src/module-api.js');
+  const moduleApiPath = require.resolve('../src/module-api.js');
+  require.cache[moduleApiPath] = {
+    id: moduleApiPath, filename: moduleApiPath, loaded: true,
+    exports: {
+      pool: rollupPool,
+      validateOrRespond: helpers.validateOrRespond,
+      resolveSession: async () => null,
+      logger: () => ({ info() {}, warn() {}, error() {} }),
+      LIVE_RANK_LADDER: realApi.LIVE_RANK_LADDER,
+      withTx: realApi.withTx,
+      corsPublicGet: () => (_q, _s, next) => next(),
+      on: () => () => {},
+      hasProvider: () => false,
+      registerProvider: () => {},
+    },
+  };
+  delete require.cache[require.resolve('../modules/platform-identity/routes/sso.js')];
+  const router = require('../modules/platform-identity/routes/sso.js')();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/sso/activity/rollup');
+  return { handle: layer.route.stack[0].handle, rollupPool };
+}
+
+async function postRollup(headers) {
+  const { handle, rollupPool } = hubRoute();
+  const res = { body: null, failure: null };
+  res.json = (b) => { res.body = b; return res; };
+  res.fail = (code, ...rest) => { res.failure = { code, rest }; return res; };
+  const lower = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]));
+  const req = {
+    get: (name) => lower[name.toLowerCase()],
+    body: { client_id: 'c1', client_secret: SECRET, github_id: 42, credits: 10, tasks_shipped: 2, karma: 1 },
+  };
+  await handle(req, res, () => {});
+  const insert = rollupPool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  return { res, stamp: insert ? insert.params[8] : undefined };
+}
+
+await t('a stamped report binds its as-of as the upsert stamp', async () => {
+  const { res, stamp } = await postRollup({ 'Bongos-Report-As-Of': '2026-09-30T12:00:10.123Z' });
+  assert.equal(res.failure, null, JSON.stringify(res.failure));
+  assert.deepEqual(res.body, { ok: true });
+  assert.equal(stamp, '2026-09-30T12:00:10.123Z');
+});
+
+await t('no header (an older instance) is unstamped — the report still applies', async () => {
+  const { res, stamp } = await postRollup({});
+  assert.deepEqual(res.body, { ok: true });
+  assert.equal(stamp, null);
+});
+
+await t('an unparseable or oversized header is unstamped, never a 400 that would drop the report', async () => {
+  for (const bad of ['yesterday-ish', '', 'x'.repeat(200)]) {
+    const { res, stamp } = await postRollup({ 'Bongos-Report-As-Of': bad });
+    assert.equal(res.failure, null, `a bad stamp (${bad.slice(0, 20)}) refused the whole report`);
+    assert.equal(stamp, null, `a bad stamp (${bad.slice(0, 20)}) was bound`);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/activity_rollup_order_db.mjs

@@ -0,0 +1,131 @@
+// tests/activity_rollup_order_db.mjs — task 1004268 (real DB).
+//
+// A rollup report computed EARLIER never overwrites one computed LATER. The
+// instance stamps each report with the moment it read the totals (the
+// Bongos-Report-As-Of header, carried here as upsertActivity's `asOf`), and the
+// live row's ON CONFLICT DO UPDATE only fires when the incoming stamp is at least
+// the stored one. Before this, a sign-in report and a ship report racing to the
+// hub were last-writer-wins, so the older totals could commit last and the
+// leaderboard would read a regression that never happened.
+//
+// Only a real Postgres can settle this: the guard is a WHERE on the conflict
+// branch, and what it does with NULLs (a report from an instance too old to stamp,
+// a row written before the column existed) and with a skipped update (does the
+// snapshot beside it still agree with the live row?) is planner behaviour, not
+// statement shape.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/activity_rollup_order_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`activity_rollup_order_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const ORDER = 90042681, LEGACY = 90042682, FUTURE = 90042683, RACE = 90042684;
+const IDS = [ORDER, LEGACY, FUTURE, RACE];
+const CLIENT = 't1004268-client';
+const q = (sql, params) => pool.query(sql, params);
+const report = (githubId, credits, asOf) =>
+  pi.upsertActivity({ clientId: CLIENT, githubId, credits, tasksShipped: 1, karma: 0, asOf }, { pool });
+const at = (sec) => new Date(Date.UTC(2026, 8, 30, 12, 0, sec)).toISOString();
+
+async function cleanup() {
+  await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+}
+async function live(githubId) {
+  const { rows } = await q(
+    `SELECT credits, reported_as_of FROM platform_identity_builder_project_activity
+      WHERE client_id = $1 AND github_id = $2`, [CLIENT, githubId]);
+  return rows[0];
+}
+async function newestSnapshot(githubId) {
+  const { rows } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at DESC, id DESC LIMIT 1`, [CLIENT, githubId]);
+  return rows[0] ? rows[0].credits : null;
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of ['platform_identity_005_builder_activity.sql', 'platform_identity_012_recent_ships.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql']) {
+    await q(migrationSql(f));
+  }
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql')); // idempotent: replays cleanly
+  await cleanup();
+
+  // 1 — the race the task describes, landed in the bad order.
+  await report(ORDER, 200, at(20)); // the ship report, computed later, lands first
+  await report(ORDER, 100, at(10)); // the sign-in report, computed earlier, lands last
+  same((await live(ORDER)).credits, 200, 'an older report landing last does not overwrite the newer totals');
+  same(await newestSnapshot(ORDER), 200, 'and the snapshot history does not record the regression either');
+  await report(ORDER, 300, at(30));
+  same((await live(ORDER)).credits, 300, 'a genuinely newer report still applies');
+  await report(ORDER, 250, at(30));
+  same((await live(ORDER)).credits, 250, 'an equal stamp applies (ties go to the later arrival, as before)');
+
+  // 2 — mixed versions. An instance too old to stamp sends no as_of: last-writer-wins,
+  // exactly as before, and it clears the guard rather than leaving a stamp its numbers
+  // no longer match.
+  await report(LEGACY, 10, null);
+  same((await live(LEGACY)).reported_as_of, null, 'an unstamped report stores no stamp');
+  await report(LEGACY, 20, at(10));
+  same((await live(LEGACY)).credits, 20, 'a stamped report over an unstamped row applies');
+  await report(LEGACY, 5, null);
+  same([(await live(LEGACY)).credits, (await live(LEGACY)).reported_as_of], [5, null],
+    'an unstamped report always applies and clears the stamp (the old behaviour, for old instances)');
+  await report(LEGACY, 30, at(1));
+  same((await live(LEGACY)).credits, 30, 'after it, the next stamped report applies whatever its stamp');
+
+  // 3 — a sender whose clock runs ahead cannot freeze the row: a stamp past the hub's
+  // own now() is stored as now(), so the next honest report is not refused until then.
+  await report(FUTURE, 1, new Date(Date.now() + 365 * 86400e3).toISOString());
+  const stored = new Date((await live(FUTURE)).reported_as_of).getTime();
+  ok(stored <= Date.now() + 1000, 'a future stamp is clamped to the hub clock');
+  await report(FUTURE, 2, new Date(Date.now() + 2000).toISOString());
+  same((await live(FUTURE)).credits, 2, 'so the next report from a correct clock still applies');
+
+  // 4 — racing writers: the row lock queues them, and whatever the commit order the
+  // row ends on the report with the LATEST stamp, and the newest snapshot agrees.
+  for (let round = 0; round < 10; round++) {
+    await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = $1', [RACE]);
+    await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = $1', [RACE]);
+    const stamps = [1, 2, 3, 4, 5].sort(() => Math.random() - 0.5);
+    await Promise.all(stamps.map((s) => report(RACE, s * 100, at(s))));
+    const row = await live(RACE);
+    assert.equal(row.credits, 500, `round ${round}: the row ended on ${row.credits}, not the latest-stamped 500`);
+    assert.equal(await newestSnapshot(RACE), 500, `round ${round}: the newest snapshot disagrees with the live row`);
+  }
+  pass++; console.log('  ok - 10 rounds of five racing reports in random order: the latest stamp always wins');
+
+  console.log(`\nactivity_rollup_order_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/activity_snapshots_db.mjs

@@ -97,6 +97,8 @@ try {
   // column); without it here, the upsertActivity steps fail 42703 on a fresh database.
   await q(migrationSql('platform_identity_012_recent_ships.sql'));
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  // upsertActivity also writes reported_as_of (task 1004268) — same reason as 012 above.
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
   await cleanup();
 
   // 1 — the writer snapshots the LIVE row, and only when it changed.

package/tests/profile_rollup_consent.mjs

@@ -100,6 +100,8 @@ try {
   // before the fixtures, so its one-shot grandfather never sees LEGACY below.
   await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  // upsertActivity also writes reported_as_of (026, task 1004268): 42703 without it.
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND

package/tests/terms_acceptance.mjs

@@ -118,20 +118,32 @@ t('the acceptance the page promises is the one the code actually keeps', () => {
 });
 
 // The capture point is GET /sso/authorize — reached when a builder uses their
-// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
-// nothing (blocker 1000124, task 1003353), so the page must not say "here".
-// Task 1003361 adds the hub's own sign-in as a second capture point; when it
-// lands, this wording and §3 below change together.
-t('the page names the sign-in the code actually watches — a project sign-in, not "here" (blocker 1000124)', () => {
+// platform account to sign in to a PROJECT, IN A BROWSER. Signing in to the hub
+// itself stamps nothing (blocker 1000124, task 1003353), so the page must not say
+// "here"; and the CLI's project sign-in (the device poll) stamps nothing either
+// (task 1004265, executed in §3), so the page must say "in your browser" and tell a
+// command-line builder why. Task 1003361 adds the hub's own sign-in as a second
+// capture point; when it lands, this wording and §3 below change together.
+t('the page names the sign-in the code actually watches — a project sign-in in the browser, not "here" (blocker 1000124)', () => {
   const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
   assert.doesNotMatch(section, /sign(?:ed|ing)? in here/i,
     'the page promises that signing in to this site records acceptance — the code never stamps that sign-in');
-  assert.match(section, /Once you have signed in to a project with your platform account and accepted these terms/,
+  assert.match(section, /Once you have signed in to a project in your browser with your platform account and accepted these terms/,
     'what makes a profile public must name the moment the code captures');
   assert.match(section, /never signed in to a project that way stays provisional/,
     'and the provisional case must be the same moment, negated');
-  assert.match(section, /written when you sign in to a project with your platform account, and only once/,
+  assert.match(section, /written when you sign in to a project in your browser with your platform account, and only once/,
     'the acceptance paragraph must name the same capture point');
+  assert.doesNotMatch(section, /sign(?:ed)? in to a project with your platform account/,
+    'an unqualified "project sign-in" also covers the command line, which records nothing (task 1004265)');
+});
+
+t('the page tells a command-line-only builder that their sign-in records nothing, and why (task 1004265)', () => {
+  const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
+  assert.match(section, /Signing in from the command line does not record it/,
+    'a CLI-only builder stays unpublished, and the page must say so rather than leave them to guess');
+  assert.match(section, /on GitHub’s page, where these terms are not shown/,
+    'and why: the device approval never puts these terms in front of them');
 });
 
 t('the page says which acceptances were given on a builder’s behalf, and that the record marks them (task 1003360)', () => {
@@ -139,7 +151,7 @@ t('the page says which acceptances were given on a builder’s behalf, and that
     'the owner chose to grandfather AND to say so on the page — the page must tell a pre-existing builder what was recorded for them');
   assert.match(termsHtml, /marks that acceptance as grandfathered/i,
     'and that the record keeps it distinguishable from one they gave');
-  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project/i,
+  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project in your browser/i,
     'and what happens when they do sign in — the conflict branch below really does replace it');
   assert.doesNotMatch(termsHtml, /written only by signing in/i,
     'the page still says acceptance is written ONLY by signing in, which is false for every grandfathered account');
@@ -503,6 +515,100 @@ await ta('a session of an undeclared source (a leftover dev-box token) cannot mi
   assert.equal(pool.accounts.size, 0, 'a session of an undeclared source recorded a platform T&C acceptance');
 });
 
+// The CLI's project sign-in (POST /sso/device/poll) also uses the platform account,
+// and it deliberately records NOTHING (task 1004265). The approval happens on
+// GitHub's device page, never on a hub page, so these terms are never in front of
+// the person — and activation is ADR 0171 D3's "a human is demonstrably at the hub",
+// which the same branch stamps. So the page names a BROWSER sign-in and says why a
+// command-line one does not count; this drives the real route to hold that claim.
+function post(path_, body) {
+  const payload = JSON.stringify(body);
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      host: '127.0.0.1', port, method: 'POST', path: path_,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// GitHub's side of the device flow, answered as approved for `identity`. The route
+// reaches both modules through their exports objects, so this swaps the network leg
+// and the signing key only — the route, its upsert and the fake pool stay real.
+async function withApprovedDevice(identity, fn) {
+  const hubDevice = require('../modules/platform-identity/hub-device.js');
+  const hubKeys = require('../modules/platform-identity/hub-keys.js');
+  const saved = {
+    hubDeviceConfigured: hubDevice.hubDeviceConfigured,
+    pollHubGithubDevice: hubDevice.pollHubGithubDevice,
+    hubSigningConfigured: hubKeys.hubSigningConfigured,
+    mintHubAssertion: hubKeys.mintHubAssertion,
+  };
+  hubDevice.hubDeviceConfigured = () => true;
+  hubDevice.pollHubGithubDevice = async () => ({ state: 'ok', client_id: 'proj-a', identity });
+  hubKeys.hubSigningConfigured = () => true;
+  hubKeys.mintHubAssertion = () => 'ASSERTION';
+  try { return await fn(); } finally {
+    hubDevice.hubDeviceConfigured = saved.hubDeviceConfigured;
+    hubDevice.pollHubGithubDevice = saved.pollHubGithubDevice;
+    hubKeys.hubSigningConfigured = saved.hubSigningConfigured;
+    hubKeys.mintHubAssertion = saved.mintHubAssertion;
+  }
+}
+
+const CLI_IDENTITY = { github_id: '5151', github_login: 'cli-only', display_name: 'Cli Only', avatar_url: null };
+
+await ta('a CLI-only project sign-in (the device poll) signs the builder in and records NO acceptance (task 1004265)', async () => {
+  SESSION = null;
+  pool.accounts.clear();
+  pool.calls.length = 0;
+  pool.setClock(NOW);
+  const res = await withApprovedDevice(CLI_IDENTITY, () => post('/sso/device/poll', { device_code: 'dc-1' }));
+  assert.equal(res.status, 200, 'CONTROL: the device poll must succeed, or the absence below proves nothing');
+  assert.equal(res.json && res.json.assertion, 'ASSERTION', 'CONTROL: the CLI got its sign-in assertion');
+  const row = pool.accounts.get('5151');
+  assert.ok(row, 'CONTROL: the device poll writes the platform account — the absence below is of the stamp, not the row');
+  assert.equal(row.terms_accepted_at, null,
+    'a command-line sign-in stamped an acceptance — nobody was shown the terms on that path; if this is now intended, /terms and ADR 0213 change with it');
+  assert.equal(row.terms_version, null);
+  assert.equal(row.profile_state, 'provisional', 'and it activates nothing (ADR 0171 D3: activation is a human at the hub)');
+  const upserts = pool.calls.filter((c) => /INSERT INTO platform_identity_accounts/i.test(c.sql) && /DO UPDATE/i.test(c.sql));
+  assert.equal(upserts.length, 1);
+  assert.equal(upserts[0].params[4], false, 'the device poll must pass the non-activating literal');
+});
+
+await ta('the device poll takes no acceptance from its body either — an extra field is refused before any write', async () => {
+  pool.accounts.clear();
+  const res = await withApprovedDevice(CLI_IDENTITY, () => post('/sso/device/poll', {
+    device_code: 'dc-2', activate: true, terms_accepted_at: '1999-01-01T00:00:00.000Z', terms_version: 'FORGED',
+  }));
+  assert.equal(res.status, 400, 'the strict validator must refuse fields the route does not declare');
+  assert.equal(pool.accounts.size, 0, 'a refused poll still wrote an account');
+});
+
+await ta('a CLI-only builder who later signs in to a project in the browser IS stamped then', async () => {
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  await withApprovedDevice({ ...CLI_IDENTITY, github_id: '4242', github_login: 'octo' },
+    () => post('/sso/device/poll', { device_code: 'dc-3' }));
+  assert.equal(pool.accounts.get('4242').terms_accepted_at, null);
+  SESSION = HUB_SESSION;
+  pool.setClock(LATER);
+  assert.equal((await authorize()).status, 302);
+  const row = pool.accounts.get('4242');
+  assert.equal(row.terms_accepted_at, LATER, 'the browser sign-in the page names must stamp the account the CLI created');
+  assert.equal(row.profile_state, 'active');
+});
+
 // ===========================================================================
 // 4. Idempotence — executed, not asserted against a string
 // ===========================================================================