@bongos/core 1.20.49 → 1.20.51

package/modules/hall-ui/public/style.css

@@ -1051,15 +1051,71 @@ html[data-fullscreen="on"] .app-topbar {
 }
 html[data-fullscreen="on"] .app-topbar > :not(.topbar-side),
 html[data-fullscreen="on"] .topbar-side > :not(.fullscreen-toggle) { display: none; }
+/* task 1004430: the way back must read on ANY ground. The hall's glass is
+   near-clear, so over the black sky in the light theme it was a dark glyph on
+   black — the page looked stuck without its bars. The card tone plus a drop
+   shadow and a ring keeps it legible on paper, on the sky and in either mode. */
 html[data-fullscreen="on"] .fullscreen-toggle {
   pointer-events: auto;
-  width: 36px; height: 36px;
+  width: auto; height: 36px;
+  gap: 6px;
+  padding: 0 14px 0 10px;
   color: var(--ink);
-  background: var(--glass);
-  box-shadow: inset 0 0 0 1px var(--glass-edge);
-  backdrop-filter: blur(var(--glass-blur));
-  -webkit-backdrop-filter: blur(var(--glass-blur));
+  background: var(--bg-card);
+  box-shadow: 0 0 0 1px var(--rule), 0 4px 16px rgba(0, 0, 0, .35);
+  font-size: 13px;
+  font-weight: 500;
+  white-space: nowrap;
+}
+/* A phone has no room for the words; the round button keeps its card tone. */
+@media (max-width: 640px) {
+  html[data-fullscreen="on"] .fullscreen-toggle { width: 36px; padding: 0; }
+  .fullscreen-toggle__label { display: none; }
+}
+html[data-fullscreen="on"] .fullscreen-toggle:hover { color: var(--accent-ink); }
+/* A page with no full-screen layout of its own steps its content clear of the
+   corner button; the sky and the studio lay themselves out (shell.js `plain`). */
+html[data-fullscreen="on"][data-fullscreen-plain="on"] .app-content { padding-top: 60px; }
+/* Said once on entering, since the choice is remembered and a page can open in it. */
+.fullscreen-hint {
+  position: fixed;
+  top: 56px;
+  right: 12px;
+  z-index: var(--z-topbar);
+  max-width: min(320px, calc(100vw - 24px));
+  padding: 8px 12px;
+  border-radius: 10px;
+  background: var(--bg-card);
+  color: var(--ink);
+  font-size: 13px;
+  line-height: 1.4;
+  box-shadow: 0 0 0 1px var(--rule), 0 4px 16px rgba(0, 0, 0, .35);
+  pointer-events: none;
+}
+
+/* THE BACK LINK (task 1004430): at the head of the bar when the page was
+   reached from inside another hall page. 24px floor on both axes. */
+.topbar-back {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  min-height: 32px;
+  min-width: 32px;
+  padding: 0 10px 0 6px;
+  margin-right: -4px;
+  border-radius: var(--radius-pill);
+  color: var(--ink-soft);
+  font-size: 13px;
+  text-decoration: none;
+  white-space: nowrap;
+  flex-shrink: 0;
+  max-width: 40vw;
+  overflow: hidden;
+  text-overflow: ellipsis;
 }
+.topbar-back:hover { color: var(--ink); background: var(--rule-soft); }
+.topbar-back svg { width: 16px; height: 16px; flex-shrink: 0; }
+@media (max-width: 480px) { .topbar-back__label { display: none; } .topbar-back { padding: 0 8px; } }
 .zoom-toggle__pct {
   font-size: 12px;
   font-weight: 500;

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-founding-commands"></script>
+<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.css

@@ -7,11 +7,11 @@
    ONE SHEET, TWO DOORS (part 4, task 1004232): /thinking and /goal-map are the
    same page opened in different lenses, so both are named below.
    IN THE HALL (task 1004327): /thinking now loads style.css and sits in the
-   hall chrome; /goal-map is still standalone. So the sky's tokens and ground
-   sit on /thinking's STAGE (main.sky-stage) instead of its body — the chrome
+   hall chrome, and /goal-map joined it in task 1004430. So the sky's tokens and
+   ground sit on the STAGE (main.sky-stage) instead of its body — the chrome
    around the stage keeps the hall's own palette in both modes — and the sky's
    few global rules are written :where()-scoped, so they cost no specificity
-   (goal-map renders exactly as before) and never reach the chrome. */
+   and never reach the chrome. */
 /* The template declared these on :root. They sit on the page's body here,
    with the template's values untouched, because the server splices the
    branding pack's own :root (--ink, --accent, --rule …) into <head> AFTER this
@@ -21,7 +21,7 @@
    its own — tests/hall_reading_world.mjs; color-scheme inherits from body
    too). Same reason `body` below is qualified: a pack backdrop is written as
    `body{background:…}` and the void must win. */
-body[data-page="goal-map"], body[data-page="thinking"] .sky-stage {
+body[data-page] .sky-stage {
   color-scheme: dark;
   --void: #000000; --ink: #ffffff; --ink-soft: #c0c0c0; --ink-faint: #a8a8a8; --ink-dim: #65656a; --ink-ghost: #3a3a3f;
   --rule: rgba(255,255,255,.16); --rule-soft: rgba(255,255,255,.08); --glass: rgba(255,255,255,.075); --glass-strong: rgba(255,255,255,.14);
@@ -30,15 +30,15 @@ body[data-page="goal-map"], body[data-page="thinking"] .sky-stage {
   --face: Manrope, "Segoe UI", system-ui, -apple-system, sans-serif;
 }
 html, body { height: 100%; }
-body[data-page="goal-map"], body[data-page="thinking"] .sky-stage { margin: 0; background: var(--void); color: var(--ink); font-family: var(--face); font-size: 15px; line-height: 1.5; overflow: hidden; overflow: clip; -webkit-font-smoothing: antialiased; }
+body[data-page] .sky-stage { margin: 0; background: var(--void); color: var(--ink); font-family: var(--face); font-size: 15px; line-height: 1.5; overflow: hidden; overflow: clip; -webkit-font-smoothing: antialiased; }
 /* clip, not just hidden (task 1004342): a hidden-overflow box is still scrollable, so
    focus scrolled the stage sideways to show the footer hint and the whole sky slid
    left. clip cuts the same pixels and cannot be scrolled; hidden stays as the fallback. */
-body[data-page="thinking"] { overflow: hidden; overflow: clip; }
-:where(body[data-page="goal-map"], .sky-stage) button { font-family: inherit; }
-:where(body[data-page="goal-map"], .sky-stage) a { color: var(--accent); }
-:where(body[data-page="goal-map"], .sky-stage) .lbl { font: var(--label); letter-spacing: .14em; text-transform: uppercase; color: var(--ink-faint); }
-:where(body[data-page="goal-map"], .sky-stage) .mono { font: var(--mono); font-variant-numeric: tabular-nums; }
+body[data-page="thinking"], body[data-page="goal-map"] { overflow: hidden; overflow: clip; }
+:where(.sky-stage) button { font-family: inherit; }
+:where(.sky-stage) a { color: var(--accent); }
+:where(.sky-stage) .lbl { font: var(--label); letter-spacing: .14em; text-transform: uppercase; color: var(--ink-faint); }
+:where(.sky-stage) .mono { font: var(--mono); font-variant-numeric: tabular-nums; }
 [hidden] { display: none !important; }
 
 /* THE STAGE (task 1004327). The box under the hall's top bar and beside its
@@ -55,11 +55,15 @@ html[data-fullscreen="on"] .sky-stage { top: 0; left: 0; }
 @media (max-width: 768px) { .sky-stage { left: 0; } }
 /* The full-screen switch floats top right over the stage, where the sky's
    tools end; the strip steps in by the button's width so nothing sits under it. */
-html[data-fullscreen="on"] .sky-stage .top { padding-right: 64px; }
+html[data-fullscreen="on"] .sky-stage .top { padding-right: 184px; }
 /* Under 900 the brand takes a row of its own (the template's rule below), so
    only that row steps in and the tools keep their width. */
 @media (max-width: 900px) {
   html[data-fullscreen="on"] .sky-stage .top { padding-right: 16px; }
+  html[data-fullscreen="on"] .sky-stage .brand { padding-right: 168px; }
+}
+/* Under 640 the exit is the round button again (style.css). */
+@media (max-width: 640px) {
   html[data-fullscreen="on"] .sky-stage .brand { padding-right: 48px; }
 }
 /* style.css rules whose names the template also uses — each one reset to what

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-09-30-founding-commands"></script>
+<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.css

@@ -136,10 +136,16 @@ html[data-fullscreen="on"] .tw-room { top: 0; left: 0; }
 /* In full screen the shell's one button floats over the night room in either
    theme, so on this page it wears the room's glass, not the hall's light ink. */
 html[data-fullscreen="on"] body[data-page="tweak-editor"] .fullscreen-toggle {
+  /* task 1004430: the shell's exit is a labelled pill, but this bar is laid out
+     for a 36px button in the corner, so the words would sit on submit. The
+     room keeps the round button; its name and title still say "Exit". */
+  width: 36px;
+  padding: 0;
   color: #ffffff;
   background: rgba(255, 255, 255, .07);
   box-shadow: inset 0 0 0 1px rgba(255, 255, 255, .16);
 }
+body[data-page="tweak-editor"] .fullscreen-toggle__label { display: none; }
 
 /* THE GLASS TOP BAR. Sticky, so the four doors stay in reach down a long page
    and the paper passes under the glass. In full screen it steps in far enough

package/modules/hall-ui/public/tweak-editor.html

@@ -49,7 +49,7 @@
         <!-- A <div>, not a <header>: the shell's top bar is the page's one
              <header> (the kit's one-header-main-h1 floor). -->
         <div class="tw-bar" id="tw-bar">
-          <a class="tw-back" href="/builders/studio">← studio</a>
+          <a class="tw-back" data-own-back href="/builders/studio">← studio</a>
           <span class="tw-name"><span id="tw-name">Tweak a page</span> <span class="tw-surface" id="tw-surface"></span></span>
           <span class="tw-counter" id="tw-counter" aria-live="polite"></span>
           <div class="tw-actions">
@@ -140,7 +140,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-founding-commands"></script>
+<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-founding-commands"></script>
+<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-founding-commands"></script>
+<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/hall-navigation.md

@@ -0,0 +1,22 @@
+# Hall navigation — the Back link and the standard full-screen switch (task 1004430)
+
+Covers: every shelled hall page (`shell.js`, `style.css`), plus `goal-map.html` joining the chrome.
+
+## The Back link
+
+- `shell.js` renders `#topbar-back` ("← <label>") at the head of the top bar when the page was reached from INSIDE another hall page. The origin is `?from=` first, then a same-origin `document.referrer`; the label is that page's `NAV` label (or "task N" / "idea N" / "goal N" for a record).
+- **A sidebar hop is not a drill-down.** A sidebar link click writes a one-shot `sessionStorage['hall-nav-hop']` naming its target; the page it lands on reads and deletes it, and shows no Back link. Without this every page reached from the sidebar would carry a Back link, which is just history.
+- When the origin came from the referrer, the click runs `history.back()`, so a list comes back with its scroll and filters; the `href` is still the real address for a new tab.
+- A page drawing its own record back link (`.rec-back` — `task.html`, `idea.html`) keeps it; the bar adds no second one. The origin's own `?from=` is dropped so back links never chain.
+- `/profile?id=N` highlights **Builders**, not your own Profile, unless `/me` says the id is yours.
+
+## Full screen is standard
+
+- Every shelled page gets the switch. `<body data-fullscreen-switch="off">` opts out. The bare attribute means "this page lays itself out for full screen" (sky, studio, tweak editor); a page without it is **plain**, and the shell sets `html[data-fullscreen-plain="on"]` so `style.css` pads `.app-content` clear of the corner button.
+- In full screen the button is a labelled pill, an icon plus "Exit full screen", in `--bg-card` with a ring and a drop shadow, not the hall's near-clear glass. Under 640px it drops the words, and the tweak editor keeps the 36px round button because its bar is laid out for one. A page whose own back link is not `.rec-back` marks it `data-own-back`. On the black sky in the light theme the glass button was a dark icon on black, and because the choice is remembered per page, `/thinking` looked stuck with no bars. Entering full screen (or a page opening in it) also shows a 4.5s `#fullscreen-hint` saying how to leave.
+
+## The project sky joined the hall
+
+`goal-map.html` now uses thinking.html's structure: sidebar and top-bar mounts, `style.css`, `shell.js`, the sky inside `<main id="hall-main" class="sky-stage">`, and a `<div class="brand">` because the shell's bar is the page's one `<header>`. In `thinking.css` both pages share one stage rule, `body[data-page] .sky-stage`. No hall page is standalone any more (`tests/hall_audit.mjs` `STANDALONE_EXEMPT` is empty).
+
+Tests: `tests/hall_fullscreen.mjs` (the standard switch, `plain`, Back link cases), `tests/goal_map_page.mjs`, `tests/hall_audit.mjs` §8.

package/modules/hall-ui/records/sky.md

@@ -31,6 +31,8 @@ Pinned by `tests/hall_sky.mjs` (31 cases: the reads, the five objects, the two c
 - **The sky's palette lives on the stage, not the body, on `/thinking`** — so the chrome around it keeps the hall's own light and dark. `style.css` now loads under `thinking.css`, and the handful of hall rules whose names the template also uses (`.skip`, `.filters`, `.foot`, `:focus-visible`, text inputs, `* { box-sizing }`) are reset under `:where(.sky-stage)` at the same specificity, before the sky's own rules. The sky's global rules are `:where()`-scoped for the same reason, which leaves `/goal-map` byte-for-byte in its old cascade.
 - **Both pages render in both modes now.** The chrome follows the hall theme; the sky's stage is the void in both. The `full` and `full-back` states in both states files (and `full-list` in the sky's) press the switch.
 
+**Superseded for `/goal-map` by task 1004430 (owner, 2026-09-30):** the project sky joined the hall chrome the same way, with the same switch. Both pages now share one stage rule (`body[data-page] .sky-stage`), `STANDALONE_EXEMPT` is empty, and the full-screen button uses the card tone so it can be seen on the void. See [`hall-navigation.md`](hall-navigation.md).
+
 ## Two skies, one renderer (task 1004328, BV2.TW21)
 
 **Owner decision 2026-09-27: "Your thinking is only your thinking."** Part 4's "one page, two doors" above is SUPERSEDED: the two pages share the renderer and nothing else. The owner confirmed that "the your projects tab" means the whole-project lens, its switch and the project-map features. What this settled:

package/modules/platform-identity/routes/sso.js

@@ -25,6 +25,7 @@ const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // The D7 applicant-profile read (task 1002972) and the echo that gates it.
 const applicantProfile = require('../applicant-profile');
+const terms = require('../terms-acceptance');
 const applicationEcho = require('../application-echo');
 const instanceFeedback = require('../instance-feedback');
 
@@ -204,6 +205,10 @@ function registerSeams() {
       // Floors on the EXISTENCE predicate, not the rollup one: hide_stats
       // suppresses numbers, never addressability.
       getPublicHandle: (githubId) => canonicalProfile.getPublicHandle(githubId, { pool }),
+      // task 1004417 (BV2.PS05): the terms version /terms states, read by provisioning
+      // when a founder ticks the create wizard's terms box. A READ of the constant only —
+      // it stamps nothing on any account (that stays terms-acceptance.js's alone).
+      termsVersion: () => terms.TERMS_VERSION,
     });
   }
 }

package/modules/provisioning/migrations/provisioning_033_terms_ack.sql

@@ -0,0 +1,33 @@
+-- provisioning_033_terms_ack.sql — the founder's terms acknowledgement, kept on the project
+-- (task 1004417, BV2.PS05; goal 1000121, spec docs/specs/bongos-v2-project-startup.md).
+--
+-- WHY THIS EXISTS. The create wizard now opens on a terms screen: the founder ticks "I can
+-- sign legally, or can get a signature, for the use of this platform, and I acknowledge the
+-- terms and conditions" before anything else is asked. The owner chose (2026-09-30) to keep
+-- that record ON THE PROJECT, not on the person's platform account: the account-level stamp
+-- is ADR 0213's, written only at a witnessed sign-in (and task 1003361 adds the hub's own
+-- sign-in as its second capture point). This one says who founded WHICH project under WHICH
+-- text, which a later terms revision needs to know per project.
+--
+-- WHAT IT ADDS.
+--   provisioning_instances.terms_ack_at      — when the create that ticked the box was filed.
+--   provisioning_instances.terms_ack_version — the terms version the SERVER stamped: read from
+--     platform-identity's TERMS_VERSION through the platform-identity.hub port, never from the
+--     request body, so a caller cannot record agreement to a text it names itself. NULL on an
+--     instance with no hub to ask (the acknowledgement time is still kept).
+--
+-- The names are deliberately NOT terms_accepted_at / terms_version: those are the account's
+-- acceptance columns, and tests/terms_acceptance.mjs fails any second server file that writes
+-- them. This is a different record with a different owner.
+--
+-- Nullable, no backfill: a project created before this shipped never saw the screen, and a
+-- NULL says exactly that. Written once, at create; an idempotent re-request never rewrites it.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS terms_ack_at timestamptz;
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS terms_ack_version text;
+
+COMMIT;

package/modules/provisioning/onboard-plan.js

@@ -26,6 +26,11 @@
 // an existing repo; ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so
 // `mode` only relabels the github-repo / init / scaffold steps.
 //
+// The hub wizard's FRONT DOOR (task 1004417 — the terms tick, then demo or create) is
+// deliberately NOT a step here: it comes before the rail, sets up nothing, and its record
+// is the project's own terms columns (./terms-ack.js), not a plan key. The /new-project
+// skill's "step 0" says the same for the other forms.
+//
 // `opts.domain` (task 1002703): the terminal enter-hall step names the instance's own
 // hall address when the renderer knows the domain, and falls back to the `bongos dev`
 // local-hall one-liner when it doesn't — the hall is the point of creating a project,

package/modules/provisioning/provisioning.js

@@ -1076,7 +1076,7 @@ async function listAllInstances(db, { status } = {}) {
 // re-fetches the existing row and returns { created:false } so the ROUTE can
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
-async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules }) {
+async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules, termsAck }) {
   // Unknown/absent coerces to the shape that costs nothing and trusts nothing. Was
   // 'co-tenant' (then the free front door); that shape is now retired + unrequestable,
   // so coercing to it would mint a row no caller is allowed to ask for.
@@ -1103,12 +1103,15 @@ async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShap
   try {
     const { rows } = await db.query(
       `INSERT INTO provisioning_instances
-         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode, type, description, detail, modules)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14::jsonb)
+         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode, type, description, detail, modules, terms_ack_at, terms_ack_version)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14::jsonb, CASE WHEN $15::boolean THEN now() END, $16)
        RETURNING *`,
       [ownerBuilderId, slug, targetRef ?? null, shape, domain ?? null,
        dbName ?? null, port ?? null, tier ?? null, cost, mode, declaredType,
-       told, JSON.stringify(answers), picked === null ? null : JSON.stringify(picked)]
+       told, JSON.stringify(answers), picked === null ? null : JSON.stringify(picked),
+       // the wizard's terms screen (task 1004417, ./terms-ack.js): the route resolved the
+       // version server-side; no acknowledgement leaves both columns NULL
+       !!termsAck, (termsAck && termsAck.version) || null]
     );
     return { instance: rows[0], created: true };
   } catch (e) {

package/modules/provisioning/routes/provisioning.js

@@ -56,7 +56,7 @@ const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 const { requireAuthorityForShape } = require('../paid-shape-gate');
 const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
-const { adoptCredentialFault } = require('../credential-preflight');
+const { adoptCredentialFault } = require('../credential-preflight'); const { termsAcknowledgement } = require('../terms-ack');
 const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
@@ -323,7 +323,7 @@ module.exports = function provisioningRoutes() {
       // exactly the set the panel preselected. An explicit [] is the different
       // answer "none of them". maxItems is a sanity ceiling well above a catalog
       // that is three modules wide today.
-      modules: { type: 'array', itemsType: 'string', maxItems: 50 },
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' },   // the latter: the wizard's terms tick (task 1004417, ../terms-ack.js)
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
@@ -426,7 +426,7 @@ module.exports = function provisioningRoutes() {
         description: body.description, detail: body.detail,
         // The picker's selection (task 1002339) — absent for the same reason and
         // with the same standing: skipped, and resolved from the bundle on read.
-        modules: body.modules,
+        modules: body.modules, termsAck: termsAcknowledgement(body),
       });
       if (req.releaseFreePlace) await req.releaseFreePlace();   // the row exists: the one-free lock's work is done (../free-place-lock.js)
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).

package/modules/provisioning/terms-ack.js

@@ -0,0 +1,36 @@
+// modules/provisioning/terms-ack.js — the founder's terms acknowledgement, as the create
+// route records it (task 1004417, BV2.PS05; migration provisioning_033).
+//
+// The wizard's first screen asks the founder to tick one box before anything else. The
+// request carries only that the box was ticked (`terms_acknowledged: true`). WHICH terms
+// is the server's answer, never the caller's: the version is read from platform-identity's
+// TERMS_VERSION — the same constant /terms states and ADR 0213 stamps on an account —
+// through the platform-identity.hub port. A body cannot name the text it agreed to, so a
+// forged version is not a thing this record can hold.
+//
+// resolveOptional, not a `consumes` entry: platform-identity is hub-only (`default:
+// false`), so an instance running provisioning without it has no terms version to ask for.
+// The acknowledgement is still kept there, with a NULL version, rather than dropped —
+// the founder did tick the box.
+//
+// Its own file because routes/provisioning.js sits a few lines under the 1500-line
+// fitness ratchet.
+'use strict';
+
+const api = require('../../src/module-api');
+
+function currentTermsVersion() {
+  const hub = api.resolveOptional('platform-identity.hub');
+  const v = hub && typeof hub.termsVersion === 'function' ? hub.termsVersion() : null;
+  return typeof v === 'string' && v ? v : null;
+}
+
+// The record createInstance writes, or null when the box was not ticked (an older client,
+// the CLI, an adopt run from a script — none of them showed the screen, and a NULL row
+// says exactly that). Strictly `true`: the validator already refuses a non-boolean.
+function termsAcknowledgement(body) {
+  if (!body || body.terms_acknowledged !== true) return null;
+  return { version: currentTermsVersion() };
+}
+
+module.exports = { termsAcknowledgement };