diff --git a/CLAUDE.md b/CLAUDE.md
index 51d53e08..869093d5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -86,6 +86,8 @@ devplace game steals prune  # delete Code Farm raid records older than the raid-
 devplace game era status    # show the current Code Farm Era
 devplace game era start <name> [--days N]  # start a Code Farm Era (default 28 days)
 devplace game era end       # end the running Code Farm Era (ranks, awards Stars, records results)
+devplace accounts pending   # list deleted accounts awaiting their purge
+devplace accounts prune     # permanently purge accounts past the deletion grace window (--dry-run to preview)
 devplace backups list       # list recorded backups
 devplace backups run <database|uploads|keys|full>  # enqueue a backup (processed by the running server)
 devplace backups prune      # remove backup records whose archive file is missing
@@ -138,6 +140,7 @@ Nested `CLAUDE.md` files (loaded automatically by Claude Code only when a file i
 | `devplacepy/services/devii/CLAUDE.md` | Devii assistant: sessions/channels, scheduler, virtual tools, self-configured behavior, client browser tools |
 | `devplacepy/services/openai_gateway/CLAUDE.md` | AI gateway: `/openai/v1/*`, usage ledger, provider/model routing |
 | `devplacepy/services/jobs/CLAUDE.md` | Async job services: zip, fork, SEO diagnostics, SEO metadata, DeepSearch, AI Usage Analyzer |
+| `devplacepy/services/moderation/CLAUDE.md` | Trust and safety: the reportable-target registry, the content filter and its five choke points, the report queue and its atomic resolution, enforcement, consent, maturity, account deletion |
 | `devplacepy/services/audit/CLAUDE.md` | Audit log: recorders, categories, retention |
 | `devplacepy/services/backup/CLAUDE.md` | Backup service: targets, worker, schedules, primary-admin-only download |
 | `devplacepy/services/telegram/CLAUDE.md` | Telegram bot bridge |
@@ -195,6 +198,7 @@ Routers in `devplacepy/routers/` are organised as a **directory tree that mirror
 | `/api` | devrant/ package - see `routers/devrant/CLAUDE.md` |
 | `/dbapi` | dbapi/ package, **primary-administrator-only, strictly READ-ONLY** - see `services/dbapi/CLAUDE.md` |
 | `/game` | game/ package - see `services/game/CLAUDE.md` |
+| `/reports`, `/admin/moderation`, `/workspaces` | reports.py, admin/moderation.py, workspaces.py - see `services/moderation/CLAUDE.md` |
 | `/quizzes` | quizzes/ package - see `services/quiz/CLAUDE.md` |
 | (none) | push.py (web push/PWA), docs.py (see `routers/docs/CLAUDE.md`) |
 | `/pubsub` | pubsub.py - see `services/pubsub/CLAUDE.md` |
@@ -272,11 +276,17 @@ Devii is also reachable over **Telegram** (one supervised long-poller subprocess
 - **All dates shown to users are DD/MM/YYYY** (European), rendered in the viewer's own timezone client-side. Timestamps are stored/emitted as UTC ISO. Use the `local_dt(iso, mode)`/`dt_ago(iso)` Jinja globals for any user-facing instant - they emit `<time data-dt>` and `static/js/LocalTime.js` reformats to local timezone with a `MutationObserver` for dynamic content. `format_date()`/`time_ago()` stay as plain-text helpers for JSON responses, no-JS fallbacks, and non-timestamp date fields (e.g. project `release_date`) - do NOT wrap those in `local_dt`.
 - **Slug + UUID lookup:** resources with slugs accept either the slug or the bare UUID via `resolve_by_slug()`. Slugs are `make_combined_slug(title, uid)`, prefixed with the **random tail** of the UUID (never the leading bytes - same timestamp-collision reasoning as blob sharding).
 - **Roles are stored capitalized:** `users.role` is exactly `"Admin"` or `"Member"`. Always test admin-ness through the `is_admin(user)` global (case-sensitive `== "Admin"`) - never hand-roll a lowercase compare. **Any write to `users.role` MUST call `database.invalidate_admins_cache()`.**
-- **Admin seniority: a junior admin cannot manage a more senior admin.** Every per-user mutation in `routers/admin/users.py` is gated by `_is_senior_admin(actor, target)` - blocks (audits `result="denied"`) when the target is an Admin who registered earlier. Server-side, so it also covers Devii's admin tools.
+- **Admin seniority: a junior admin cannot manage a more senior admin.** Every per-user mutation in `routers/admin/users.py` and `routers/admin/moderation.py` is gated by `is_senior_admin(actor, target)` (`routers/admin/_shared.py`) - blocks (audits `result="denied"`) when the target is an Admin who registered earlier. Server-side, so it also covers Devii's admin tools.
 - **Never pass a `respond()` context key that collides with a Jinja global.** `respond(request, template, ctx, model=XOut)` feeds the same `ctx` to both the Pydantic model (JSON) and the template. A key like `is_admin`/`avatar_url`/`is_self` holding a non-callable value shadows the global across the whole inheritance chain, turning `{% if is_admin(user) %}` into `False(user)` -> `TypeError`, a 500 that fires only for the branch that calls the global. Name viewer/permission flags distinctly (`viewer_is_admin`, not `is_admin`) in both schema and context.
 - **Project visibility (`is_private`) and read-only (`read_only`)** are owner-controlled flags on `projects`. Read access is gated by the single `content.can_view_project(project, user)` predicate at EVERY read surface - never re-implement the check inline. Predicate: `not is_private OR is_owner OR (is_admin AND owner is not an admin)` - a project hidden by a member stays visible to any admin, but one hidden by an admin is visible only to that owner admin. **Containers have their own, stricter isolation predicates** (`owns_instance`, `can_view_project_containers`, `can_view_instance`, `can_manage_instance`) - the primary administrator sees/manages every container; any other admin can VIEW others' containers only on public projects and can MANAGE only instances they own. Read-only is enforced as a single data-layer guard `project_files._guard_writable(project_uid)` at the top of every mutation entrypoint - add it to any NEW file-mutating function. Devii may flip read-only/visibility only after explicit confirmation (`CONFIRM_REQUIRED`). Full UI-level detail in `devplacepy/routers/projects/CLAUDE.md`.
 - **Deletions ALWAYS require confirmation:** `confirmation_error` gates EVERY content delete tool via `CONFIRM_REQUIRED` (`delete_post`, `delete_comment`, `delete_gist`, `delete_project`, `project_delete_file`, `delete_media`, `delete_attachment`, `admin_delete_news`, container delete, and any `container_exec` matching `dispatcher.DESTRUCTIVE_COMMAND`). The first call is refused; the agent must show the exact target then pass `confirm=true`. **Load-bearing: every confirmation-gated tool MUST also declare a `confirm` boolean param in its catalog spec** - schemas set `additionalProperties: false`, so a gated tool without a declared `confirm` param can never receive it and loops forever.
 
+## Every user-generated surface is reportable by construction (hard rule)
+
+A new content table added to `SOFT_DELETE_TABLES` that is visible to anyone other than its author MUST be registered in `database/moderation.py` `REPORTABLE_TARGETS`, MUST resolve in `resolve_object_url`, and MUST include `_report_button.html` in its action bar. A table that is genuinely private to its owner goes in `UNREPORTABLE_TABLES` **with its reason** instead. `tests/unit/database/moderation.py` computes the difference and fails the suite on anything unclassified, so report coverage is closed under future additions rather than remembered; the e2e coverage test enforces the third requirement.
+
+The same rule keeps the untriggered app-store conditionals untriggered: **no social login, no payment path, no purchasable randomness, no advertising, and no cross-app tracking** may be introduced without also implementing the obligations each of them creates (Sign in with Apple, in-app purchase, odds disclosure, ad reporting, App Tracking Transparency). Full detail in `devplacepy/services/moderation/CLAUDE.md`.
+
 ## Modal pattern
 
 `Application.js` `initModals()` toggles a `.visible` CSS class on `.modal-overlay`; the CSS rule `.modal-overlay.visible { display: flex; }` handles visibility. Triggers usually have `href="#"`, so call `e.preventDefault()`. `.modal-close` is wired generically - no inline JS needed. Full modal/partial/CDN detail in `devplacepy/templates/CLAUDE.md`.
@@ -334,9 +344,10 @@ A new public read almost always needs all four. The cardinal failure mode is cha
 2. **Data layer.** `database/` for query/batch helpers (never inline N+1 loops - use `get_users_by_uids`, `build_pagination`, `_in_clause`; guard raw SQL with `if "table" in db.tables`). `models.py` for the Pydantic `Form` input model. `schemas/` for the `*Out` JSON response model - every context key a JSON route exposes via `respond(..., model=XOut)` MUST exist on `XOut` or it is silently dropped. Schema auto-syncs via `dataset`; add indexes in `init_db()` with `CREATE INDEX IF NOT EXISTS`.
 3. **Server layer.** Handler with the right auth guard (`get_current_user` public read, `require_user` member POST, `require_admin` admin). Specific paths (`/{username}/followers`) declared before catch-alls (`/{username}`). Return HTML+JSON via `respond(request, template, ctx, model=XOut)` or pure JSON via `JSONResponse`. Register any NEW router in `main.py`.
 4. **View layer.** Extend `base.html`; page CSS in `{% block extra_head %}`, page JS in `{% block extra_js %}`. Reuse partials and template globals. JS is ES6 modules, one class per file, instantiated on `app`.
-5. **Agent + docs layer (the most-forgotten step - do not skip).** `services/devii/actions/catalog.py` - add an `Action` tool if a user could ask Devii to do this (`requires_auth=False` for public reads). `docs_api.py` - every public/auth endpoint gets an `endpoint()` entry with params and a `sample_response`. `routers/docs/pages.py` `DOCS_PAGES` for prose pages. SEO (`seo.py`) - `base_seo_context` and any JSON-LD for a new public page; add to `routers/seo.py` sitemap if indexable.
-6. **Document.** `README.md` (product-facing, routes/config/dependencies/user-visible features), the relevant nested `CLAUDE.md` (any new mechanic, helper, pitfall, or cross-layer wiring), this root `CLAUDE.md` only when a NEW architectural rule or workflow step is introduced (not per feature).
-7. **Validate.** Confirm a clean import (`python -c "from devplacepy.main import app"`), check each touched language manually, grep for em-dash in touched files (neither the character nor its HTML entity - use a hyphen), and run `pyflakes`/`ruff check` on every touched file. **If the feature touches a spendable resource, a bounded state machine, or a read-then-write mutation reachable from more than one request path, also run the four-layer procedure in "Rigorous correctness verification" above** - it is the default for that shape of feature, not an optional extra. **Finish by running the full persisted test suite (`make test` - every tier, every test) and fixing any failure before the change is done.** Write new tests in the matching tier/path, following the required patterns above.
+5. **Safety layer (skip only when the feature stores nothing and shows nothing).** If the feature adds a surface that carries user-generated content, register it in `database/moderation.py` `REPORTABLE_TARGETS` (or in `UNREPORTABLE_TABLES` with a reason), resolve it in `resolve_object_url`, and include `_report_button.html` in its action bar - the registry test and the e2e coverage test both fail otherwise. If it collects or transmits a new *category* of personal data, or sends anything new to a third party, update `/docs/privacy.html` and the app-store privacy declarations in the same change; that disclosure is part of the feature, not a follow-up.
+6. **Agent + docs layer (the most-forgotten step - do not skip).** `services/devii/actions/catalog.py` - add an `Action` tool if a user could ask Devii to do this (`requires_auth=False` for public reads). `docs_api.py` - every public/auth endpoint gets an `endpoint()` entry with params and a `sample_response`. `routers/docs/pages.py` `DOCS_PAGES` for prose pages. SEO (`seo.py`) - `base_seo_context` and any JSON-LD for a new public page; add to `routers/seo.py` sitemap if indexable.
+7. **Document.** `README.md` (product-facing, routes/config/dependencies/user-visible features), the relevant nested `CLAUDE.md` (any new mechanic, helper, pitfall, or cross-layer wiring), this root `CLAUDE.md` only when a NEW architectural rule or workflow step is introduced (not per feature).
+8. **Validate.** Confirm a clean import (`python -c "from devplacepy.main import app"`), check each touched language manually, grep for em-dash in touched files (neither the character nor its HTML entity - use a hyphen), and run `pyflakes`/`ruff check` on every touched file. **If the feature touches a spendable resource, a bounded state machine, or a read-then-write mutation reachable from more than one request path, also run the four-layer procedure in "Rigorous correctness verification" above** - it is the default for that shape of feature, not an optional extra. **Finish by running the full persisted test suite (`make test` - every tier, every test) and fixing any failure before the change is done.** Write new tests in the matching tier/path, following the required patterns above.
 
 Failures at any implementation step block the workflow - never skip a failed step.
 
diff --git a/README.md b/README.md
index 0c7517c5..e4e9dfb5 100644
--- a/README.md
+++ b/README.md
@@ -87,7 +87,10 @@ devplacepy/
 | `/bookmarks` | Save/unsave content; `/bookmarks/saved` personal list |
 | `/polls` | Vote on post-attached polls |
 | `/follow` | Follow/unfollow users |
-| `/block` | Block/unblock a user: hides all of their posts, comments and messages from you everywhere except their own profile, and stops them notifying you |
+| `/reports` | Content reporting: `POST /reports/{target_type}/{target_uid}` files a report against any user-generated surface, `GET /reports/mine` lists the reports you filed and their outcome, `GET /reports/reasons` serves the reason registry so every client renders the same dialog |
+| `/admin/moderation` | Admin **Moderation** queue: reported content oldest-open-first with the response-window badge, one report per detail page with the offender's history, triage (`/status`) and decisions (`/decide`) |
+| `/workspaces/index` | Public index of every workspace published to the ingress proxy, with owner, project, maturity label and direct link |
+| `/block` | Block/unblock a user: hides all of their posts, comments and messages from you everywhere except their own profile, and stops them notifying you. Also reachable directly from every content action bar |
 | `/mute` | Mute/unmute a user: stops them creating notifications for you while their content stays visible |
 | `/leaderboard` | Contributor ranking by total stars earned |
 | `/game` | **Code Farm** cooperative idle game (member-only): plant projects that build over real time, harvest coins and XP, upgrade CI, buy plots, and water friends' builds at `/game/farm/{username}`. Live over pub/sub; every endpoint negotiates JSON |
@@ -203,6 +206,20 @@ The farm refreshes live over the pub/sub bus (a watered build appears on the own
 
 XP awards are wired at the existing content-creation, vote, and follow hook points in the routers and centralized in `award_xp()` / `check_milestone_badges()` (`devplacepy/utils/`). Existing accounts have their XP and levels backfilled once from prior activity at startup (`init_db()`).
 
+## Trust and safety
+
+DevPlace is open in the sense that it does not editorialise technical opinion. It enforces a short, fixed list of prohibited categories, published as the [Community Guidelines](/docs/community-guidelines.html), and it has the machinery to make that enforcement real.
+
+- **Automated filtering at post time.** Every user-authored text passes a classifier at the five places content is created or changed (content creation, content editing, comments, direct messages, profile and signup fields), covering every surface with no per-route code. The default mode is `review`, not `block`: a match is published **and** raises a report for a human, because a developer platform discusses exploits, malware analysis and violent subject matter as its work and a machine that suppressed that would destroy the product. Only sexual and exploitative content is refused outright. Classification failure falls back to review, never to publication. Tunable live at `/admin/settings` (`moderation_filter_mode`: `off`, `label`, `review`, `block`).
+- **A report control on every surface.** Posts, comments, gists, projects, project files, news, uploads, direct messages, quizzes, polls, awards, profiles, issues, workspaces and assistant output are all reportable through one polymorphic endpoint keyed on `(target_type, target_uid)`, from one dialog, with one reason list. Reports are private to the reporter; the reported person is never told who filed.
+- **One queue with a published response window.** `/admin/moderation` is worked oldest-open-first and carries a badge showing the age of the oldest unresolved report against `moderation_sla_hours` (default 24), so a breach is visible rather than assumed. Resolution is a single atomic conditional update: two administrators deciding at once produce exactly one decision, the second gets a 409.
+- **Real enforcement, with a statement of reasons.** Remove or restore content, warn, suspend for a stated period, ban, lift, dismiss, or escalate. Every decision writes a permanent `moderation_actions` row plus an audit event, and tells the affected user what was decided and why. A suspended account can still read, still see why, still report, and still delete itself; it cannot create. A junior administrator can never action a senior one.
+- **Blocking**, unchanged and independent of all of the above, is now reachable from the content itself as well as from a profile.
+- **Age and maturity.** Signup collects a date of birth, derives an age band, and **discards the date**; accounts below `moderation_minimum_age` (default 16) are refused. Content labelled mature is hidden behind an interstitial until the viewer explicitly opts in, and the reveal is never offered to a minor age band for restricted content.
+- **Consent.** Five versioned, independently withdrawable consents (`terms`, `privacy`, `ai_third_party`, `activity_recording`, `container_credentials`) with full history, managed at `/profile/{username}?tab=privacy` and changeable **only by the account holder** - an administrator reads the record but never grants or withdraws on someone else's behalf. **No content is sent to a third-party AI provider without `ai_third_party` consent**, enforced once at the gateway; the per-feature AI toggles remain as preferences subordinate to it. Withdrawing `activity_recording` stops presence recording. While recording is on, an indicator says so on every page. `container_credentials` is what lets software another member runs in a container receive your API key; running your own container never asks.
+- **Account deletion.** Self-service at `/profile/{username}/delete`, reauthenticated with the account password. Sessions and tokens are revoked, the profile is anonymised immediately, and all content is removed under one deletion event that stays restorable for `account_deletion_grace_hours` (default 24) before `devplace accounts prune` (and the Moderation housekeeping service) purges it permanently. The devRant `DELETE /api/users/me` routes into the same cascade.
+- **Legal pages**: [Terms of Service](/docs/terms.html), [Community Guidelines](/docs/community-guidelines.html), [Privacy Policy](/docs/privacy.html), [How moderation works](/docs/content-moderation.html), [Notice and takedown](/docs/intellectual-property.html) and [Contact](/docs/contact.html). All six are indexed in the sitemap and reachable from the docs index; the footer of every page links Terms, Privacy, Community Guidelines and Contact. Contact details come from the `contact_email`, `contact_phone` and `contact_address` settings, so the in-product page and any app-store trader declaration have one source of truth.
+
 ## Vibe coding (Alpha, admin only)
 
 Build software by talking to an AI agent instead of typing every line. Create a project for storage, attach a container to it (the shared `ppy` image, your files mounted at `/app`), start it, and open a terminal. The whole flow is drivable conversationally through Devii. Inside every container three agents ship preinstalled and run on **your own API key**, so all AI usage is metered to your account: **DevPlace Code (`dpc`)**, a coding agent in the same class as Claude Code; **`botje.py`**, a plug-and-play DevPlace bot you can copy and customise; and **`pagent`**, a minimal zero-dependency agent. Each container is launched with `DEVPLACE_BASE_URL`, `DEVPLACE_OPENAI_URL`, `DEVPLACE_API_KEY`, `DEVPLACE_USER_UID`, `DEVPLACE_CONTAINER_NAME`, `DEVPLACE_CONTAINER_UID`, and `DEVPLACE_INGRESS_URL` already set. Publish a container port to a public URL at `/p/<slug>` by setting an `ingress_slug` and `ingress_port` (ask Devii to do it at create time). The feature is in **Alpha** and currently limited to administrators; the full walkthrough, including a tutorial that vibes a web app and puts it online, is at `/docs/getting-started-vibing.html`.
diff --git a/applechanges.md b/applechanges.md
new file mode 100644
index 00000000..97fe7250
--- /dev/null
+++ b/applechanges.md
@@ -0,0 +1,230 @@
+# DevPlace: gap analysis against the Apple App Store requirement register
+
+Author: retoor <retoor@molodetz.nl>
+
+Stage two of `apple.md`. Input is the requirement register in [`applecomp.md`](applecomp.md) §8. Output is the exhaustive list of changes DevPlace needs to make an iOS client of this platform publishable. The implementation design is [`appleimpl.md`](appleimpl.md).
+
+Every verdict below is backed by a file reference read during the traversal. No verdict is inferred from documentation; documentation was only used to locate code.
+
+---
+
+## 1. Method
+
+The traversal covered, recursively:
+
+- `devplacepy/routers/` - every router file and package, for the full endpoint surface.
+- `devplacepy/models.py`, `devplacepy/schemas/` - every input form and output schema.
+- `devplacepy/database/` - `schema.py` (column ensure blocks), `soft_delete.py` (`SOFT_DELETE_TABLES`), the batch helpers.
+- `devplacepy/templates/` - every template that renders a content action bar, the admin shell, the footer, the docs registry.
+- `devplacepy/services/` - audit, devii, openai_gateway, containers, messaging, game, quiz, bot, news.
+- `devplacepy/content.py`, `devplacepy/responses.py`, `devplacepy/templating.py` - the shared predicates and response choke points.
+- `devplacepy/main.py` - middleware stack and router mounts.
+
+---
+
+## 2. Inventory: every user-generated-content surface
+
+Requirement **R5** (report on every UGC surface) and **R4** (filter on every UGC surface) are only satisfiable against a complete list. This is that list, derived from `SOFT_DELETE_TABLES` in `devplacepy/database/soft_delete.py:7` cross-checked against the routers that write each table.
+
+| # | Surface | Table | Write entrypoint | Visible to |
+|---|---------|-------|------------------|-----------|
+| S1 | Posts | `posts` | `routers/posts.py` via `content.create_content_item` | Public |
+| S2 | Comments (polymorphic: post, project, gist, news) | `comments` | `routers/comments.py` via `content.create_comment_record` | Public |
+| S3 | Gists | `gists` | `routers/gists.py` | Public |
+| S4 | Projects (title, description, devlog) | `projects` | `routers/projects/` | Public or private |
+| S5 | Project files (arbitrary text/binary) | `project_files` | `routers/projects/files/` | Public or private |
+| S6 | News submissions | `news` | `routers/news.py`, `services/news/` | Public |
+| S7 | Uploaded media / attachments | `attachments` | `routers/uploads.py`, `attachments.py` | Follows parent |
+| S8 | Direct messages | messaging store | `routers/messages.py:245` `send_message` + `/messages/ws` | Two parties |
+| S9 | Quizzes, questions, options | `quizzes`, `quiz_questions`, `quiz_options` | `routers/quizzes/` | Public |
+| S10 | Poll questions and options | `polls`, `poll_options` | `routers/polls.py` | Public |
+| S11 | Awards (user-issued citations) | `awards` | `routers/awards.py` | Public |
+| S12 | Profile fields: bio, location, git link, website | `users` | `models.py:408` `ProfileForm` | Public |
+| S13 | Username and avatar seed | `users` | `routers/auth/signup.py`, `routers/profile/avatar.py` | Public |
+| S14 | Issue tickets and issue comments | `issue_tickets` (Gitea-backed) | `routers/issues/` | Public |
+| S15 | Devii assistant output (chatbot under guideline 4.7) | `devii_conversations` | `services/devii/` | Owner, and anything it publishes |
+| S16 | User-authored virtual tools and lessons | `devii_virtual_tools`, `devii_lessons` | `services/devii/` | Owner |
+| S17 | Per-user custom CSS/JS | `user_customizations` | `services/devii/customization/` | Owner's own browser only |
+| S18 | Container workspaces and anything they serve | `instances`, `tunnels` | `services/containers/`, `routers/proxy.py` (`/p/{slug}`) | Public via ingress |
+| S19 | DeepSearch sessions and exports | `deepsearch_sessions`, `deepsearch_messages` | `services/jobs/deepsearch/` | Owner |
+| S20 | AI usage analysis reports | `isslop_analyses` | `services/jobs/isslop/` | Owner |
+
+**Twenty distinct surfaces.** Sixteen of them (S1-S14, S18, and S15's published output) are visible to at least one other person and therefore fall inside guideline 1.2's scope. This breadth is the single defining constraint of the implementation: any design that requires per-surface bespoke code will be incomplete on the day it ships and will decay afterwards.
+
+---
+
+## 3. Inventory: what already exists and can be reused
+
+| Capability | Where | Fitness for the requirement |
+|-----------|-------|-----------------------------|
+| **Block and mute** | `routers/relations.py` (`/block/{username}`, `/mute/{username}`, and the `unblock`/`unmute` inverses), `user_relations` table, `_drop_blocked` in `database/comments.py` | Satisfies **R9** functionally. Reachability from content is a gap (see G9). |
+| **Soft delete across the board** | `database/soft_delete.py`, `SOFT_DELETE_TABLES` (44 tables) | Every content removal is already reversible and auditable, which is exactly what **P2** and DSA statements of reasons need. |
+| **Admin Trash** | `routers/admin/trash.py`, `/admin/trash`, restore/purge by event | Moderator undo path already exists. |
+| **Append-only audit log** | `services/audit/`, 288 keys in `events.md`, `/admin/audit-log` | The evidence substrate for **P1**, **P2** and the 24-hour SLA proof. |
+| **Account deactivation** | `users.is_active`, admin toggle at `routers/admin/users.py:179`, devrant `DELETE /api/users/me` at `routers/devrant/auth.py:189` | **Not** account deletion. Apple explicitly rejects deactivation-only. See G12. |
+| **Admin seniority guard** | `_is_senior_admin` in `routers/admin/users.py` | Reusable for moderator-action authorization. |
+| **Workspace moderation flags** | `services/containers/workspace/flags.py` - `raise_flag`, `clear_flag`, `set_status`, `list_flags`, statuses `open/acknowledged/resolved/dismissed`, severities `info/warn/critical`, soft-deletable `workspace_flags` table | **The closest existing analogue to a report queue.** It is instance-scoped, machine-raised and admin-resolved. Its state machine, severity ladder and audit shape are the correct precedent to generalise from. |
+| **Per-user AI opt-in** | `users.ai_correction_enabled` (default `0`) and `users.ai_modifier_enabled` (default `1`), `routers/profile/ai_correction.py`, `routers/profile/ai_modifier.py` | Establishes the pattern for a consent flag on the user row. Partially serves **R15** but is feature-scoped, not consent-scoped, and one of the two defaults to on. |
+| **Notification preferences** | `notification_preferences` table, `NOTIFICATION_TYPES` × `NOTIFICATION_CHANNELS`, `routers/profile/notifications.py` | Push is already per-type, per-channel and user-controlled - **R17** is close to satisfied. |
+| **Polymorphic target pattern** | `(target_type, target_uid)` on `comments`, `votes`, `reactions`, `bookmarks`; `resolve_target_redirect()` in `comments.py`; `database/ranking.py` `VOTABLE_TARGETS`/`STAR_TARGETS`; `database/content.py` `resolve_object_url` | **The load-bearing reuse.** A report is structurally identical to a vote: one row keyed on `(target_type, target_uid)` plus an actor. Reporting must be built on this exact pattern, not beside it. |
+| **Devii action catalog** | `services/devii/actions/catalog/`, `CONFIRM_REQUIRED` in `dispatcher.py` | Every new route gets its agent face here, per the root `CLAUDE.md` four-faces rule. |
+| **Docs prose registry** | `routers/docs/pages.py` `DOCS_PAGES`, e.g. the existing `block-and-mute` and admin-only `media-moderation` pages | The publication channel for terms, community guidelines and privacy policy, with role gating already implemented. |
+| **Site settings** | `site_settings`, `get_setting`/`get_int_setting`, `/admin/settings` | Where the moderation SLA, minimum age and filter aggressiveness belong - live-editable, no restart. |
+| **AI gateway** | `services/openai_gateway/`, `/openai/v1/*`, per-user cost attribution | Single choke point through which **every** third-party AI call passes. **R15**'s consent gate has exactly one correct insertion point because of this. |
+
+---
+
+## 4. The gap register
+
+Verdicts: **MISSING** (does not exist), **PARTIAL** (exists but does not meet the requirement), **PRESENT** (meets the requirement), **N/A** (not triggered).
+
+### 4.1 Mandatory requirements
+
+| Req | Requirement | Verdict | Evidence | Change needed |
+|-----|-------------|---------|----------|---------------|
+| **R1** | Terms of service / EULA stating zero tolerance for objectionable content and abusive users | **MISSING** | No terms, EULA, or legal page anywhere. Grep for `terms`/`eula`/`privacy polic` across `templates/` and `routers/` returns only four unrelated docs pages (bots and Code Farm prose). `_footer_links.html` links Docs, Swagger, OpenAPI, Issue Report only. | Author the document; publish it as a first-class page; link it from the footer, the signup form and account settings. |
+| **R2** | Recorded affirmative acceptance at account creation, re-acceptance on material change | **MISSING** | `routers/auth/signup.py` collects username, email, password, confirm only. `models.py:51` `SignupForm` has four fields. No acceptance column on `users` (`database/schema.py:1823`ff enumerates every ensured column; none is terms-related). | Add a required acceptance control to signup; persist the accepted document version and timestamp; force re-acceptance when the version changes. |
+| **R3** | Community guidelines enumerating prohibited content per 1.1.1-1.1.7 | **MISSING** | No such document. | Author and publish; reference from the terms and from every report dialog. |
+| **R4** | Automated filtering of objectionable material at post time on every surface | **MISSING** | No content filter exists. The only `blocklist` occurrences in the codebase are the bot **quality** gate (`TRIVIAL_GIST_TERMS`, `GENERIC_COMMENT_PHRASES`) documented in `templates/docs/bots-content.html:38` - these judge whether generated content is *interesting*, not whether user content is *objectionable*, and they run only on bot output. | Introduce a filter that runs on every user-authored text at the single creation choke point, with an admin-tunable severity, that can block, hold for review, or flag. |
+| **R5** | Report mechanism on every UGC surface | **MISSING** | No report route, table, template, schema, or Devii action exists. `routers/relations.py` provides block/mute only. `services/containers/workspace/flags.py` flags *workspaces*, machine-raised, and is not reachable by a member for content. | Build a polymorphic report facility covering all sixteen externally-visible surfaces in §2. |
+| **R6** | Moderation queue with triage, decision and enforcement | **MISSING** | `/admin` sidebar (`templates/admin_base.html:11`-`59`) has Users, News, Media, Trash, Services, Gateway, Containers, Workspaces, Devii tasks, Bots, Game, AI usage, Statistics, Audit log, Backups, Notifications, Settings. There is no moderation section. `/admin/media` handles only *already soft-deleted* media. | Add a moderation queue as a first-class admin section, in the established `admin_section` pattern. |
+| **R7** | Published 24-hour response commitment, and a mechanism that evidences it | **MISSING** | No SLA is published or measured. | Publish the commitment in the terms and the report confirmation; measure age-of-oldest-open-report; surface it to admins and alert on breach. |
+| **R8** | Ejection of offending users as a first-class enforcement action | **PARTIAL** | `users.is_active` toggled at `routers/admin/users.py:179`. It is a bare on/off with no reason, no duration, no linkage to a report, and no notice to the user. `routers/devrant/auth.py:189` sets the same flag as "delete account". | Promote to a suspension/ban action carrying reason, scope, duration and a link to the report that caused it, and generating a statement of reasons (**P3**). |
+| **R9** | Block abusive users | **PARTIAL** | Fully implemented at `routers/relations.py:87`-`104` with enforcement in `database/comments.py` `_drop_blocked`. The gap is discoverability: the action is only reachable from a profile page. `templates/_post_card.html:32`ff and `templates/_comment.html:27`ff action bars offer Reply/Edit/Delete/React/Share and no Block. | Surface block from the content action bar alongside report; verify DM enforcement. |
+| **R10** | Published contact information reachable inside the app | **PARTIAL** | `_footer_links.html` links `/issues` ("Issue Report"), which is a Gitea-backed bug tracker requiring an account, not a contact route. No postal address, no email, no phone. | Publish a contact page carrying the DSA-mandated address, email and phone, linked from the footer and from settings. |
+| **R11** | Privacy policy meeting 5.1.1(i)'s three content requirements, in-app | **MISSING** | No privacy policy exists. | Author to the three-point spec; publish; link in-app and supply the URL to App Store Connect. |
+| **R12** | In-app account deletion of the account record and associated personal data | **MISSING** | The only account-removal path in the product is `DELETE /api/users/me` (`routers/devrant/auth.py:189`) which sets `is_active = False` and revokes tokens - **deactivation**, which Apple's account-deletion support page names as explicitly insufficient. There is no route under `/profile` or `/auth` for deletion. | Build a real, self-service, reauthenticated deletion that removes the account record and the associated personal data, discoverable in account settings. |
+| **R13** | Declared-age gate at account creation, plus age-based access restriction | **MISSING** | No birthdate, age or date-of-birth field exists anywhere: grep across `models.py` and `database/` returns nothing. `SignupForm` has no age field. | Collect a declared age at signup, store the derived age band (not the raw birthdate, per 5.1.4 data minimization), enforce a minimum age, and gate age-exceeding content on it. |
+| **R14** | Content age labelling; mature content hidden by default | **MISSING** | No maturity flag on any content table. | Add a maturity classification produced by the filter and settable by the author, and hide flagged content behind an explicit, age-gated opt-in. |
+| **R15** | Explicit consent before user content reaches third-party AI, with disclosure | **PARTIAL** | Two per-feature toggles exist: `users.ai_correction_enabled` defaults to `0` (opt-in, compliant in shape) and `users.ai_modifier_enabled` defaults to `1` (**opt-out - non-compliant**), both at `database/schema.py:1832`-`1841`. Neither is framed as consent to third-party processing, neither names the provider, and neither covers the other AI paths: Devii (`services/devii/`), DeepSearch, SEO metadata generation, the AI usage analyzer, issue enhancement (`services/gitea/enhance.py`), news import, and bots. All of these route through `/openai/v1/*` (`services/openai_gateway/`). | Introduce one explicit, named, versioned third-party-AI consent, defaulting to off, enforced at the gateway choke point, with the per-feature toggles kept as preferences subordinate to it. |
+| **R16** | Easily accessible consent withdrawal | **MISSING** | No consent record exists, therefore nothing to withdraw. | Consent record with a withdraw action in account settings, and a downstream effect that is real (processing stops). |
+| **R17** | Push optional, marketing push opt-in, in-app opt-out | **PRESENT** | `notification_preferences` per type per channel (`database/notifications.py`), user-editable at `routers/profile/notifications.py:17`. Push registration is explicit at `routers/push.py:32`. Nothing in the app requires push to function. | Verify no notification type is marketing-by-default; document the position for review notes. |
+| **R18** | DMCA / IP notice-and-takedown channel | **MISSING** | None. | Add an intellectual-property report reason to the report facility and a public notice-and-takedown page describing the counter-notice path. |
+| **R19** | Demo account with pre-seeded content and complete review notes | **MISSING** | No provisioning path for a review account exists; `registration_open` (`site_settings`) can close signup entirely, which would leave a reviewer unable to create an account. | Provide a stable demo account with visible content from other authors, so report and block can both be exercised. Write the review notes. |
+| **R20** | Age-rating questionnaire answered from the real feature set | **BLOCKED BY R4/R5/R6/R13** | The questionnaire asks whether the app has moderation systems, content filtering, reporting tools, blocking functionality and parental controls. Today four of five answers are "no". | Answers become truthful only once R4, R5, R6 and R13 ship. |
+| **R21** | App privacy details declared, including third-party AI processing | **BLOCKED BY R15** | Nothing to declare against until the AI data flow is disclosed and consented. | Declare Contact Info, User Content, Identifiers, Usage Data, Diagnostics, all Linked to You, none Used to Track You. |
+| **R22** | EU trader status with address, phone, email | **MISSING (metadata)** | The same contact data R10 needs. | Declare in App Store Connect; keep identical to the in-app contact page. |
+| **R23** | IPv6-only reachability | **UNVERIFIED** | `docker-compose.yml` and `nginx/nginx.conf.template` were not confirmed to bind IPv6; uvicorn defaults are IPv4. | Verify and, if needed, fix listen directives for the app, nginx, the WebSocket routes and the container ingress. |
+| **R24** | Remote code execution positioned under the 2.5.2 educational exception | **PARTIAL** | Substantively compliant already: containers execute **remotely** (`services/containers/`), the browser IDE makes source completely viewable and editable (`routers/projects/files/`), and nothing alters the client binary. What is missing is the **positioning**: no documentation states this, and the review notes do not exist. | Document the architecture for App Review; make the "code runs on our servers, never on your device" statement explicit in the product and the docs. |
+| **R25** | Native client materially beyond a web wrapper | **OUT OF SCOPE (client)** | The iOS binary is not in this repository. | The backend obligation is to expose every safety control as a JSON API so the native client can implement them natively rather than embedding web views. Covered by the four-faces rule. |
+
+### 4.2 Conditional requirements
+
+| Req | Trigger present? | Verdict | Evidence |
+|-----|------------------|---------|----------|
+| **C1** Sign in with Apple or equivalent | **No** | **N/A - must stay N/A** | Auth is exclusively DevPlace's own system: session cookie, `X-API-KEY`, Bearer, HTTP Basic, all resolved in `get_current_user`. `routers/auth/` has no OAuth provider. Guideline 4.8 exempts apps that exclusively use their own account system. **Adding any social login later immediately creates the Sign in with Apple obligation.** |
+| **C2** IAP for digital goods | **No** | **N/A - must stay N/A** | No payment processor anywhere: no Stripe, PayPal or checkout integration in the codebase. The Code Farm economy (`services/game/`) is earn-only; Stars and Era awards are not purchasable. AI quota is administered, not sold (`devplace gateway quota set`). **Any future sale of coins, credits, quota or boosts inside the app triggers mandatory IAP.** |
+| **C3** Loot-box odds disclosure | **No** | **N/A** | Randomized game rewards are not purchasable with real money. |
+| **C4** Contest rules stating Apple is not a sponsor | **Borderline** | **PARTIAL** | Code Farm Eras (`devplace game era start/end`) rank players and award Stars. As long as awards are cosmetic/status only and nothing of monetary value is given, 5.3 is not engaged. Any real prize engages it. Document the position. |
+| **C5** Index of offered software with universal links | **Yes** | **MISSING** | Users can publish workspaces reachable via the ingress proxy `/p/{slug}` (`routers/proxy.py`) and other users can open them. Guideline 4.7.4 requires an index of that software with universal links. No such index exists. |
+| **C6** Ad reporting control | **No** | **N/A** | No advertising anywhere in the codebase. |
+| **C7** App Tracking Transparency | **No** | **N/A** | No cross-app or cross-site tracking; no third-party analytics SDK. |
+| **C8** Recording indicator and consent | **Yes** | **MISSING** | Presence tracking (`services/presence.py`, `last_seen`), the live view relay (`services/live_view_relay.py`), Devii terminal sessions and the audit log all make a record of user activity. Guideline 2.5.14 requires explicit consent **and** a clear indication. Presence is currently silent and unconditional. |
+| **C9** Per-instance consent before sharing data with user software | **Yes** | **MISSING** | Container workspaces and Devii virtual tools can receive platform data. 4.7.3 requires explicit user consent **in each instance**. |
+
+### 4.3 Posture requirements
+
+| Req | Verdict | Notes |
+|-----|---------|-------|
+| **P1** Compliance improvement plan on request | **MISSING** | Needs moderation throughput metrics, which need R6. |
+| **P2** Moderation decisions retained as an audit trail | **PARTIAL** | The audit log already records every state change and never raises into the caller (`services/audit/`). Moderation event keys do not yet exist in `events.md`. |
+| **P3** Statement of reasons to the actioned user | **MISSING** | Content is soft-deleted silently. The notification system (`utils/notifications.py`, `create_notification`) is the right delivery channel and already exists. |
+| **P4** Privacy labels kept in step with features | **MISSING** | Process obligation; needs a documented owner and a checklist entry in the feature workflow. |
+| **P5** Accurate "What's New" | **MISSING** | Process obligation on the client release. |
+
+---
+
+## 5. The positioning conflict - the finding that outranks every table above
+
+DevPlace currently **markets itself as uncensored**. This is not incidental copy; it is the product's stated identity in four places:
+
+- `devplacepy/main.py:744` - the site description: *"Share what you're building in an open, uncensored environment."*
+- `devplacepy/templates/base.html:9` - the default `meta description`, on every page.
+- `devplacepy/templates/landing.html:120` - the landing hero paragraph, and at `landing.html:134` a feature card headed **"No Censorship"**.
+- `devplacepy/database/schema.py:280` - the default `site_tagline` site setting, echoed in `templates/admin_settings.html:24`.
+
+Guideline 1.2 requires a **method for filtering objectionable material** and makes removal of violating content the developer's explicit responsibility. An App Review reviewer who opens the landing page - which they will, because it is the Support/Marketing URL - reads a promise that the platform does not moderate. That single sentence is sufficient grounds for a 1.2 rejection **regardless of how good the implementation is**, because it is a public statement that the required controls are not exercised.
+
+There is no technical fix for this. The positioning must change to something that is both true and compatible: the platform is **open and uncensored in the sense that it does not editorialise developer opinion**, while enforcing a floor of prohibited categories. The four sites above must be reworded in step, and the wording must match the terms of service and community guidelines exactly, because a mismatch between marketing and policy is itself a 2.3.1 problem.
+
+This is flagged as a decision for the lord, not an assumption: it changes the product's public voice.
+
+---
+
+## 6. Consolidated change list
+
+Grouped by the layer they land in, so the implementation document can sequence them. Nothing here is designed yet; this is scope, not solution.
+
+### 6.1 Data layer
+
+1. A polymorphic **reports** store keyed on `(target_type, target_uid)`, soft-deletable, with a state machine.
+2. **Moderation decision** records linked to reports, retained for the audit trail.
+3. **Enforcement** records: suspension/ban with reason, scope, duration, originating report.
+4. `users` columns: terms-acceptance version and timestamp; declared age band; third-party-AI consent version, timestamp and state; activity-recording consent.
+5. A **maturity** classification on content, produced by the filter and adjustable by the author.
+6. New `site_settings` keys: moderation SLA hours, minimum age, filter mode and thresholds, contact details, current policy document versions.
+7. New soft-delete table registrations and indexes for all of the above.
+
+### 6.2 Server layer
+
+8. Report submission endpoints, polymorphic, member-authenticated, rate-limited.
+9. Report listing and decision endpoints for moderators, with the seniority guard.
+10. Enforcement endpoints (suspend, ban, lift) replacing the bare `is_active` toggle.
+11. Account **deletion** endpoint with reauthentication and a real data-removal cascade.
+12. Terms acceptance endpoint plus a gate that forces re-acceptance on version change.
+13. AI consent endpoints, and enforcement at the `/openai/v1/*` gateway choke point.
+14. Age declaration at signup, and an age predicate applied at every read of maturity-flagged content.
+15. The content filter, invoked at the single creation choke point that already exists in `content.py`.
+16. Public legal pages: terms, community guidelines, privacy policy, contact, notice-and-takedown.
+17. A published index of user-offered software with universal links (4.7.4).
+18. A presence/activity-recording consent and indicator (2.5.14).
+
+### 6.3 View layer
+
+19. Report and Block controls in **every** content action bar - `_post_card.html`, `_comment.html`, and the detail templates for gists, projects, news, quizzes, media, messages and profiles.
+20. A report dialog reusing the existing modal system, with reasons mapped to the 1.1.x categories.
+21. Signup form: terms acceptance and age declaration.
+22. Account settings: delete account, withdraw consent, view acceptances.
+23. Admin moderation section in the `admin_base.html` sidebar with the queue, SLA indicator and decision UI.
+24. Footer links to terms, privacy, community guidelines and contact.
+25. Maturity interstitial for age-exceeding content, hidden by default.
+
+### 6.4 Agent, docs, SEO layer
+
+26. Devii actions for report, moderation listing and decisions, with `CONFIRM_REQUIRED` on enforcement.
+27. `docs_api` entries for every new endpoint.
+28. `DOCS_PAGES` prose entries for the legal documents and a moderation page (admin-gated, like `media-moderation`).
+29. SEO: legal pages are public and indexable; moderation is `noindex,nofollow`.
+30. New audit event keys in `events.md` and `category_for`.
+
+### 6.5 Positioning and process
+
+31. Reword the four "uncensored" sites so marketing, terms and behaviour agree.
+32. Review notes, demo account, age-rating questionnaire answers, privacy labels, trader status.
+33. IPv6 verification across app, nginx, WebSockets and container ingress.
+
+---
+
+## 7. Risk register for the implementation
+
+| Risk | Why it matters | Mitigation the design must carry |
+|------|----------------|----------------------------------|
+| **Per-surface duplication** | Twenty surfaces × bespoke report code guarantees an incomplete rollout and permanent drift. | One polymorphic facility on the existing `(target_type, target_uid)` pattern, registered once per surface, exactly as votes and reactions already are. |
+| **Filter false positives on a developer platform** | Code, security discussion and error messages are full of terms a naive filter flags. Blocking legitimate posts destroys the product. | The filter must default to flag-for-review rather than hard block, and must be admin-tunable through `site_settings` with no restart. |
+| **Silent failure** | The root `CLAUDE.md` forbids errors passing silently; a moderation control that fails open is worse than absent. | Report submission must never be swallowed; filter failure must fail toward review, not toward publication. |
+| **Deletion cascade correctness** | Account deletion touches nearly every table. A partial cascade leaves orphaned personal data and breaks the 5.1.1(v) promise. | One shared soft-delete stamp for the reversible window, then a hard purge, reusing `soft_delete_in` and `purge_event`. |
+| **Consent regression on the AI path** | Turning AI consent off by default changes behaviour for every existing user and every internal AI consumer (news, bots, issue enhancement, SEO metadata). | Distinguish consent for *the user's own content* from platform-owned processing; enforce at the gateway with an explicit owner kind. |
+| **Test suite scale** | ~2882 tests run serially. A change touching the content creation choke point touches everything. | Land the data and server layers first, run the full suite at each stage. |
+| **Economy and state-machine correctness** | Suspension, consent and age gates are read-then-write mutations reachable from HTTP, Devii, the devRant API and the CLI. | The root `CLAUDE.md` four-layer rigorous-verification procedure applies to enforcement and consent state. |
+
+---
+
+## 8. Summary verdict
+
+Of the 25 mandatory requirements: **1 present** (R17), **5 partial** (R8, R9, R10, R15, R24), **15 missing** (R1-R7, R11-R14, R16, R18, R19, R22), **2 blocked on others** (R20, R21), **1 unverified** (R23), **1 out of scope for this repository** (R25). The six categories partition all 25.
+
+Of the 9 conditional requirements: **5 not triggered and must be kept that way** (C1, C2, C3, C6, C7), **3 triggered and missing** (C5, C8, C9), **1 borderline** (C4).
+
+Of the 5 posture requirements: **1 partial** (P2), **4 missing**.
+
+The platform has excellent bones for this work - polymorphic targeting, universal soft delete, a complete audit log, an admin shell, a single AI choke point and an agent catalog that already forces cross-layer completeness. What it lacks is the entire safety layer, the entire legal layer, and a public identity compatible with having one.
diff --git a/applecomp.md b/applecomp.md
new file mode 100644
index 00000000..260545e9
--- /dev/null
+++ b/applecomp.md
@@ -0,0 +1,435 @@
+# Apple App Store compliance requirements for a social / user-generated-content platform
+
+Author: retoor <retoor@molodetz.nl>
+
+This document is the research artefact for stage one of `apple.md`. It records **what Apple requires**, not what DevPlace currently does. The gap analysis is `applechanges.md`; the implementation design is `appleimpl.md`.
+
+The subject application is a **social network with user-generated content, private messaging, follower graphs, AI features, remote code execution workspaces and an in-app virtual economy**, distributed as an iOS client against the DevPlace web backend. Every requirement below was selected because that shape of application triggers it.
+
+Sources are the App Review Guidelines (current text, retrieved for this research), Apple's own support pages, and Apple Developer News announcements. Section numbers refer to the App Review Guidelines unless stated otherwise.
+
+---
+
+## 0. The governing principle
+
+Apple treats the **backend** as part of the app. Guideline 4.7.1 and 1.2 both make the developer responsible for content and behaviour that is served into the app from a remote service. A rejection under 1.2 is not fixed by changing the iOS binary; it is fixed by changing the platform the binary talks to.
+
+Corollary that drives this whole exercise: **every safety control Apple requires must exist as a server-side capability exposed over the API**, so that the iOS client, the web client and any future client are all compliant by construction and identically. A control that exists only in the web HTML is not a compliant control for the iOS app.
+
+---
+
+## 1. Safety
+
+### 1.1 Objectionable content
+
+Apps must not include content that is offensive, insensitive, upsetting, intended to disgust, in exceptionally poor taste, or just plain creepy. The enumerated categories:
+
+| Ref | Prohibited content |
+|-----|--------------------|
+| 1.1.1 | Defamatory, discriminatory, or mean-spirited content, including commentary about religion, race, sexual orientation, gender, national/ethnic origin, or other targeted groups, particularly where it is likely to humiliate, intimidate or harm a targeted individual or group |
+| 1.1.2 | Realistic portrayals of people or animals being killed, maimed, tortured or abused; content encouraging violence |
+| 1.1.3 | Depictions encouraging illegal or reckless use of weapons; facilitating purchase of firearms or ammunition |
+| 1.1.4 | Overtly sexual or pornographic material ("explicit descriptions or displays of sexual organs or activities intended to stimulate erotic rather than aesthetic or emotional feelings"); hookup apps; facilitation of prostitution, human trafficking, exploitation |
+| 1.1.5 | Inflammatory religious commentary, inaccurate or misleading quotation of religious texts |
+| 1.1.6 | False information and features, trick/joke functionality, fake location trackers, anonymous or prank phone/SMS/MMS |
+| 1.1.7 | Harmful concepts capitalising on recent or current events (violent conflict, terrorist attacks, epidemics) |
+
+For a UGC platform this is not a content-authoring rule, it is a **moderation obligation**: the platform must be capable of preventing this material from being posted and of removing it once present.
+
+### 1.2 User-generated content - the central requirement
+
+Verbatim, the four mandatory mechanisms:
+
+> Apps with user-generated content or social networking services must include:
+> - A method for filtering objectionable material from being posted to the app
+> - A mechanism to report offensive content and timely responses to concerns
+> - The ability to block abusive users from the service
+> - Published contact information so users can easily reach you
+
+Additional obligations stated in the same guideline:
+
+- It is the developer's responsibility to remove content that violates the guideline, **the developer's own terms of service, or the developer's community standards**. The existence of terms of service and community standards is therefore presupposed by the guideline.
+- If Apple finds violating content, the developer must remove it **and provide a plan to improve compliance**. The app may be pulled until improvements are demonstrated.
+- Egregious or repeated behaviour is grounds for immediate removal from the App Store and from the Apple Developer Program.
+- Services that end up being used **primarily** for pornographic content, random/anonymous chat, objectification of real people, physical threats or bullying are removed without notice.
+- Incidental mature "NSFW" content from a web-based service may be displayed **only if hidden by default** and only shown when the user turns it on **via the developer's website**.
+
+**Review practice (the part not written in the guideline).** The standard 1.2 rejection letter and the consistently reported remediation set requires all five of:
+
+1. **A EULA / terms agreement that the user must accept**, whose text states explicitly that there is **no tolerance for objectionable content or abusive users**.
+2. **A filtering method** applied to content before or as it is published.
+3. **A flag/report mechanism** on every piece of user-generated content.
+4. **A block mechanism** for abusive users.
+5. **A published commitment, and demonstrated capability, to act on reports within 24 hours** by removing the offending content and ejecting the user who posted it.
+
+Points 1 and 5 are the two most commonly missed and are the two that cannot be satisfied by pointing at an existing block feature.
+
+Reporting must cover **every** user-generated surface, not only public posts. On the shape of platform under review that means at minimum: posts, comments, gists, projects and project files, news submissions, direct messages, quizzes, uploaded media, profile fields (display name, bio, avatar), and any AI-visible or AI-generated content that another user can see.
+
+### 1.2.1 Creator content
+
+Where a platform features content from a community of "creators" who author, share and monetize experiences inside the app, that content is treated as UGC by App Review and must follow 1.2 and 3.1.1.
+
+> **(a)** Creator apps must provide a way for users to identify content that exceeds the app's age rating, and use an age restriction mechanism based on **verified or declared age** to limit access by underage users.
+
+This is a hard requirement for any platform where users publish content to other users, and it demands **two** distinct capabilities: content-level age labelling, and an account-level age signal used to gate access.
+
+### 1.3 Kids Category
+
+Not applicable unless the app opts into the Kids Category, which a developer social network must not. The relevant knock-on is 2.3.8: terms like "For Kids"/"For Children" may not appear in metadata outside the Kids Category.
+
+### 1.4 Physical harm
+
+1.4.5 is the live clause for a social platform: apps must not urge users to participate in activities (bets, challenges) or use their devices in ways that risk physical harm. Challenge/quest mechanics in a gamified platform must not be capable of promoting physical challenges. 1.4.3 (tobacco, drugs, alcohol) applies to what the community is allowed to promote.
+
+### 1.5 Developer information
+
+> People need to know how to reach you with questions and support issues. Make sure **your app and its Support URL** include an easy way to contact you.
+
+"Your app" is explicit: an external support URL alone is insufficient. Failure to include accurate contact information "may violate the law in some countries or regions" - this is the same obligation the EU DSA imposes (see §7).
+
+### 1.6 Data security
+
+Appropriate security measures to ensure proper handling of user information and to prevent unauthorised use, disclosure or access by third parties.
+
+### 1.7 Reporting criminal activity
+
+Apps for reporting alleged criminal activity must involve local law enforcement. Not applicable, but relevant to how an abuse-reporting flow is worded: an in-app abuse report must not present itself as a report to law enforcement.
+
+---
+
+## 2. Performance
+
+### 2.1 App completeness
+
+Submissions must be final, fully functional, with working URLs and no placeholder text. **Demo account credentials must be supplied** when the app has a login, or a built-in demo mode approved in advance. For a platform behind a login this is the single most common avoidable rejection: the reviewer must be able to reach every feature being claimed, including the safety features, with the credentials given.
+
+The reviewer will attempt to exercise the reporting and blocking flow. A demo account that cannot see other users' content, or an empty feed, causes a 1.2 rejection because the reviewer cannot verify the mechanism exists.
+
+### 2.3 Accurate metadata
+
+- **2.3.1** No hidden, dormant or undocumented features. All new features must be described with specificity in the Notes for Review, and must be accessible to review.
+- **2.3.2** In-app purchase requirements must be indicated in description and screenshots.
+- **2.3.6** The age rating questionnaire must be answered honestly. A mis-rated app "could trigger an inquiry from government regulators".
+- **2.3.7** App name ≤ 30 characters; no keyword stuffing.
+- **2.3.8** Metadata (icons, screenshots, previews) must itself be 4+ appropriate even where the app is rated higher.
+- **2.3.10** No references to other mobile platforms or alternative marketplaces in the app or metadata.
+- **2.3.12** "What's New" must describe significant changes specifically.
+
+### 2.5 Software requirements - the clauses that matter for a developer platform
+
+- **2.5.1** Public APIs only; app must run on the currently shipping OS.
+- **2.5.2** *Load-bearing for any coding platform.* Apps "may not download, install, or execute code which introduces or changes features or functionality of the app, including other apps." The **educational exception**: "Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. **Such apps must make the source code provided by the app completely viewable and editable by the user.**"
+  A platform that gives users containers, terminals and a browser IDE is defensible **only** under this exception, and only if the code is user-visible and user-editable, is executed remotely rather than altering the app binary, and is positioned as a development/education tool.
+- **2.5.4** Background services only for their intended purposes.
+- **2.5.5** Must be fully functional on **IPv6-only networks**. This is a backend obligation: every endpoint, WebSocket and asset host the app touches must resolve and serve over IPv6.
+- **2.5.6** Web browsing must use WebKit. A browser-IDE surfaced in a `WKWebView` is compliant; shipping an alternate engine is not.
+- **2.5.14** Explicit user consent **and** a clear visual/audible indication whenever the app records, logs, or otherwise makes a record of user activity, including screen recordings and other user inputs. Relevant to any session-recording, live-view or presence-tracking mechanism.
+- **2.5.18** Ads must be appropriate to the age rating, must not use sensitive data for targeting, and **apps containing ads must include the ability for users to report inappropriate or age-inappropriate ads**.
+
+---
+
+## 3. Business
+
+### 3.1.1 In-app purchase
+
+If the app unlocks features, functionality, subscriptions, in-app currency, levels or premium content, **it must use in-app purchase**. Own mechanisms - license keys, QR codes, cryptocurrency - are prohibited.
+
+Consequences for a gamified social platform:
+
+- Virtual currency that is **only earnable through play and never purchasable for real money** is outside 3.1.1 entirely. This is the safe position.
+- Purchased credits and in-game currencies **may not expire** and require a restore mechanism.
+- Randomized virtual items ("loot boxes") must **disclose the odds** of each item type before purchase.
+- Tipping another user's content, "boosts" of posts, and any digital good consumed in the app must use IAP (3.2.1(vii) and 3.1.3(g) read together: person-to-person monetary gifts are exempt only when entirely optional and 100 % passes to the receiver and is not connected to receiving digital content or services).
+- AI credit top-ups, quota increases, or paid model access sold to the end user inside the app are digital services and require IAP.
+
+### 3.1.1(a) / 3.1.3 external purchase
+
+Outside the United States storefront, apps may not include buttons, external links or other calls to action directing customers to purchasing mechanisms other than IAP, absent the relevant StoreKit External Purchase Link Entitlement. A web platform that sells anything on its website must be careful that the iOS client does not link to that purchase path.
+
+### 3.2.2 Unacceptable
+
+- **(x)** Apps must not force users to rate, review, or download other apps to access functionality.
+- **(v)** No arbitrary restriction of who may use the app by location or carrier.
+- **(vii)** No artificial manipulation of a user's visibility, status or rank on other services.
+
+---
+
+## 4. Design
+
+### 4.2 Minimum functionality
+
+The app must be more than a repackaged website. A thin `WKWebView` wrapper around the existing web front end is a 4.2 rejection. The client needs native navigation, native affordances, push notifications, offline or cached state, and platform integration that a browser tab does not have.
+
+**4.2.3(i)** the app must work on its own without requiring installation of another app. **4.2.2** apps must not primarily be web clippings or collections of links.
+
+### 4.7 Mini apps, mini games, chatbots, plug-ins
+
+This section is directly engaged by two features of the platform under review: an **in-app AI chatbot** and **user-authored software/experiences that other users can open**.
+
+> Apps may offer certain software that is not embedded in the binary, specifically HTML5 and JavaScript mini apps and mini games, streaming games, **chatbots**, and plug-ins. […] **You are responsible for all such software offered in your app**, including ensuring that such software complies with these Guidelines and all applicable laws.
+
+**4.7.1** Software offered under this rule must:
+- follow all privacy guidelines, including guideline 5.1 on collection, use and sharing of data and sensitive data;
+- **include a method for filtering objectionable material, a mechanism to report content and timely responses to concerns, and the ability to block abusive users**; and
+- follow guideline 3.1 to offer digital goods or services.
+
+**4.7.2** The app may not extend or expose native platform APIs to that software without prior permission.
+**4.7.3** The app may not share data or privacy permissions to any individual software offered in the app **without explicit user consent in each instance**.
+**4.7.4** The developer must provide **an index of software and metadata available in the app, including universal links** that lead to all software offered.
+**4.7.5** The app must provide a way for users to **identify software that exceeds the app's age rating**, and use an **age restriction mechanism based on verified or declared age** to limit access by underage users.
+
+Note that 4.7.1 restates the 1.2 quartet - filtering, reporting, timely response, blocking - and applies it to **chatbot output** as well as user content. An AI assistant that can emit objectionable text is subject to the same reporting and filtering obligation as a user post.
+
+### 4.8 Login services
+
+Applies only if the app uses a **third-party or social login service** to establish the user's primary account. An app that exclusively uses its own account setup and sign-in system is explicitly exempt and is **not** required to offer Sign in with Apple. Adding "Log in with GitHub" or any similar social provider immediately creates the obligation to also offer an equivalent privacy-preserving login (Sign in with Apple being the canonical one), with the three properties: name+email only, private-email option, no advertising-purpose interaction collection.
+
+### 4.5.4 Push notifications
+
+- Push must **not be required** for the app to function.
+- Must not carry sensitive or confidential information.
+- Must not be used for promotions or direct marketing **unless the customer has explicitly opted in via consent language displayed in the app's UI**, and the app **provides an in-app method to opt out**.
+
+### 4.10 Monetizing built-in capabilities
+
+Push Notifications, camera, gyroscope, iCloud storage and similar OS capabilities may not be monetized.
+
+---
+
+## 5. Legal
+
+### 5.1.1(i) Privacy policy
+
+> All apps must include a link to their privacy policy **in the App Store Connect metadata field and within the app in an easily accessible manner**.
+
+The policy must clearly and explicitly:
+- identify what data the app/service collects, how it collects it, and **all** uses of that data;
+- confirm that any third party with whom the app shares user data - analytics, ad networks, third-party SDKs, parents, subsidiaries or related entities - provides the same or equal protection of user data;
+- explain data retention/deletion policies and **describe how a user can revoke consent and/or request deletion of the user's data**.
+
+Two distinct deliverables: an in-app accessible link, and a policy whose content covers those three points.
+
+### 5.1.1(ii) Permission and consent withdrawal
+
+Consent must be secured for collection of user or usage data even where anonymous. Paid functionality must not depend on granting data access. The app must provide **an easily accessible and understandable way to withdraw consent**.
+
+### 5.1.1(iii) Data minimization
+
+Only request access to data relevant to core functionality.
+
+### 5.1.1(v) Account sign-in and **account deletion**
+
+> If your app supports account creation, you must also **offer account deletion within the app**.
+
+From Apple's dedicated support page, in force since **30 June 2022**:
+
+- The app must **offer to delete the entire account record along with associated personal data**. Offering only to temporarily deactivate or disable an account is **explicitly insufficient**.
+- The account deletion option must be **easy to find**, typically in account settings.
+- If completion requires a website, the app must link **directly to the page** where the process is completed - not to a general support page and not merely out to the default browser.
+- If deletion takes additional time, the user must be told.
+- Confirmation steps are permitted: reauthentication, identity verification, entering a code sent to an address already on the account.
+- Support-flow-only deletion (phone call, email, ticket) is permitted **only** for highly regulated industries under 5.1.1(ix). A social network is not one.
+- Apps that make deletion "unnecessarily difficult" fail review.
+
+Also in 5.1.1(v): if the app does not include significant account-based features, people must be able to use it without a login. A social network is account-based by nature, but **read-only public browsing without an account** is a strong signal of good faith and reduces friction with this clause and with 4.2.
+
+### 5.1.1(x) Optional contact information
+
+Basic contact information may be requested only if optional, with features not conditional on providing it.
+
+### 5.1.2 Data use and sharing - the AI clause
+
+> You must clearly disclose where personal data will be shared with third parties, **including with third-party AI**, and obtain **explicit permission** before doing so.
+
+This is decisive for any platform that routes user content through an external model provider. Every path where a user's post, comment, message, file, or profile text leaves the platform for a third-party model is a third-party data share that requires **disclosure plus explicit permission**, not merely a line in a privacy policy.
+
+Further clauses:
+- **(i)** The app may not require the user to enable push notifications, location or tracking in order to access functionality or receive compensation. App Tracking Transparency consent is required for tracking.
+- **(ii)** Data collected for one purpose may not be repurposed without further consent.
+- **(iii)** No surreptitious profile building; no attempts to re-identify anonymous or aggregated data.
+
+### 5.1.4 Kids
+
+Apps that collect, transmit or have the capability to share personal information from a minor - including "the ability to chat" and persistent identifiers - must include a privacy policy and comply with all applicable children's privacy statutes (COPPA, GDPR and equivalents). Birthdate and parental contact information may be requested **only** for the purpose of complying with those statutes.
+
+### 5.2 Intellectual property
+
+- **5.2.1** No protected third-party material without permission; no misleading or copycat names or metadata.
+- **5.2.2** Content from a third-party service requires permission under that service's terms; authorization must be provided on request. Engaged by any news/RSS ingestion feature.
+- **5.2.3** No saving, converting or downloading media from third-party sources without explicit authorization. Engaged by any URL-fetch, archive, or media-embed feature.
+- **5.2.5** No Apple emoji embedded in the binary; no interfaces confusingly similar to Apple products.
+
+A UGC platform additionally needs a **notice-and-takedown (DMCA-style) path**, because 5.2 makes the developer answerable for infringing user content and 1.2 makes removal the developer's responsibility.
+
+### 5.3 Gaming, gambling, lotteries
+
+If the platform runs contests, sweepstakes or prize draws: the developer must sponsor them, **official rules must be presented in the app**, and the rules must state that **Apple is not a sponsor and is not involved in any manner**. Randomized reward mechanics that cannot be purchased with real money stay outside 5.3.4.
+
+### 5.6 Developer code of conduct
+
+Trust (5.6.1), ratings and reviews integrity (5.6.2), accurate developer identity (5.6.3) and the prohibition on predatory behaviour (5.6.4) - the latter explicitly covering exploitation of minors and facilitation or encouragement of harmful behaviour toward others. Violations can remove the developer from the Apple Developer Program entirely, independent of any single app.
+
+---
+
+## 6. App Store Connect obligations (metadata, not code)
+
+These are not guideline sections but they block submission or removal just as hard.
+
+### 6.1 Age rating - the 2025 overhaul
+
+Apple replaced the old ladder with **4+, 9+, 13+, 16+, 18+**; the 12+ and 17+ tiers were removed. The questionnaire gained required questions covering in-app controls, capabilities, medical/wellness topics, and violent themes, plus a **social-features block** covering:
+
+- user-generated content;
+- messaging capability;
+- friend or follower systems;
+- livestreaming;
+- content creation tools;
+- advertising that may expose users to age-sensitive material.
+
+Apple additionally asks **what safeguards the developer has implemented**: moderation systems, content filtering, reporting tools, blocking functionality, parental controls. Answering "none" to those questions on a social app drives the rating up and invites 1.2 scrutiny; answering "yes" untruthfully violates 2.3.6.
+
+Developers were required to complete the updated questionnaire by **31 January 2026**, after which app updates are blocked in App Store Connect until the new questions are answered.
+
+**Consequence for this project:** the safeguards questionnaire is answered from the platform's actual feature set. Each of the five safeguard answers should map to a named, demonstrable feature.
+
+### 6.2 App privacy details ("nutrition labels")
+
+Every data type collected by the app **or by its third-party partners** must be declared across the categories: Contact Info, Health & Fitness, Financial Info, Location, Sensitive Info, Contacts, User Content, Browsing History, Identifiers, Purchases, Usage Data, Diagnostics, Surroundings. Each declared type is classified as **Used to Track You**, **Linked to You**, or **Not Linked to You**. The developer is responsible for third-party SDK collection and for **keeping the answers accurate and up to date**; answers may be changed at any time without an app update.
+
+For the platform under review the realistic declaration set is: Contact Info (name, email), User Content (posts, messages, photos/videos, other user content), Identifiers (user ID), Usage Data (product interaction), Diagnostics, and - if any analytics or crash reporting is added - the corresponding categories. All "Linked to You"; none "Used to Track You" provided no cross-app advertising tracking exists.
+
+### 6.3 Support URL, marketing URL, privacy policy URL
+
+Required metadata. The Support URL must present a working contact route (1.5). The privacy policy URL must be live and must match the in-app policy.
+
+### 6.4 EU Digital Services Act trader status
+
+Since **17 February 2025**, apps without a declared and verified trader status are **removed from the App Store in the EU**. Trader status became required for update submission on 16 October 2024. Articles 30 and 31 DSA require Apple to verify and publish trader contact information - **address, phone number and email** - on the App Store product page. The DSA definition of commercial activity is broad: paid apps, apps with IAP, or otherwise commercial distribution.
+
+### 6.5 Notes for Review
+
+Under 2.3.1 all functionality must be described specifically. For an app of this shape the notes must at minimum describe: the moderation pipeline, where the report and block controls are, where account deletion is, that code execution is remote and user-owned under the 2.5.2 educational exception, that the AI assistant is a chatbot under 4.7 with its own safety controls, and the demo account credentials with pre-seeded content so the reviewer can exercise reporting.
+
+---
+
+## 7. Overlapping legal regimes Apple enforces by reference
+
+| Regime | What Apple enforces | Practical requirement |
+|--------|---------------------|-----------------------|
+| **GDPR** (5.1.1(ii), 5.1.2) | Lawful basis, consent, withdrawal, erasure | Consent capture with timestamp and version; consent withdrawal UI; account + data deletion; data export is the companion right users will ask for |
+| **EU DSA** (6.4, 1.5) | Trader identity, published contact, notice-and-action | Published contact information in app and on the store page; a reporting mechanism with acknowledgement and outcome notice; a statement of reasons to the affected user when content is removed |
+| **COPPA** (5.1.4) | No collection from under-13s without verifiable parental consent | Declared-age gate at signup; block or restrict accounts below the platform's minimum age; do not collect birthdate for any other purpose |
+| **DMCA / copyright** (5.2) | Removal of infringing user content | A designated notice-and-takedown channel and a counter-notice path |
+| **Local content ratings** (2.3.6) | Territory-specific rating and warning display | Age labelling on content that exceeds the app rating (also required by 1.2.1(a) and 4.7.5) |
+
+---
+
+## 8. The complete requirement register
+
+Every row is a discrete, testable obligation. This register is the input to `applechanges.md`.
+
+### 8.1 Mandatory - a missing item is a certain rejection
+
+| # | Requirement | Source |
+|---|-------------|--------|
+| R1 | Terms of service / EULA that **explicitly states zero tolerance for objectionable content and abusive users** | 1.2 (review practice) |
+| R2 | **Affirmative acceptance** of those terms recorded per user at account creation, and re-acceptance on material change | 1.2, GDPR |
+| R3 | **Community guidelines** enumerating prohibited content, aligned to the 1.1.1-1.1.7 categories | 1.1, 1.2 |
+| R4 | **Automated filtering** of objectionable material at the point of posting, on every UGC surface | 1.2, 4.7.1 |
+| R5 | **Report mechanism on every UGC surface**: posts, comments, gists, projects, files, media, news, DMs, quizzes, profiles, AI output, workspaces | 1.2, 4.7.1 |
+| R6 | **Moderation queue** with triage, decision and enforcement actions for the operators | 1.2 |
+| R7 | **Published 24-hour response commitment** and a mechanism that makes it achievable and evidenced | 1.2 (review practice) |
+| R8 | **Ejection of offending users** - suspension/ban as a first-class enforcement action, not only content deletion | 1.2 |
+| R9 | **Block abusive users** from the service, covering all interaction surfaces including DMs | 1.2 |
+| R10 | **Published contact information reachable inside the app** | 1.5, DSA Art. 30 |
+| R11 | **Privacy policy** meeting 5.1.1(i)'s three content requirements, linked in-app and in ASC metadata | 5.1.1(i) |
+| R12 | **In-app account deletion** that deletes the account record and associated personal data, easy to find, no support-flow requirement | 5.1.1(v) |
+| R13 | **Declared-age gate** at account creation, with a minimum age, plus an age-restriction mechanism limiting underage access to age-exceeding content | 1.2.1(a), 4.7.5, 5.1.4 |
+| R14 | **Content age labelling** so users can identify content exceeding the app's age rating; mature content **hidden by default** | 1.2, 1.2.1(a), 4.7.5 |
+| R15 | **Explicit consent before user content is sent to third-party AI**, plus disclosure of which provider and what data | 5.1.2(i) |
+| R16 | **Consent withdrawal** UI that is easily accessible and understandable | 5.1.1(ii) |
+| R17 | **Push notifications optional**, never required for function, marketing push opt-in with in-app opt-out | 4.5.4, 5.1.2(i) |
+| R18 | **DMCA / IP notice-and-takedown** channel | 5.2 |
+| R19 | **Demo account with pre-seeded content** and review notes describing every safety control's location | 2.1, 2.3.1 |
+| R20 | **Age rating questionnaire** answered from the real feature set, including the five safeguard answers | 2.3.6, 6.1 |
+| R21 | **App privacy details** declared accurately for every data type, including third-party AI processing | 6.2 |
+| R22 | **EU trader status** declared and verified, with address, phone and email | 6.4 |
+| R23 | **IPv6-only reachability** of every endpoint, WebSocket and asset host | 2.5.5 |
+| R24 | **Remote code execution positioned under the 2.5.2 educational exception**: source completely viewable and editable, executed off-device, never altering the app | 2.5.2 |
+| R25 | **Native client that is materially more than a web wrapper** | 4.2 |
+
+### 8.2 Conditional - required if the corresponding feature exists
+
+| # | Requirement | Trigger |
+|---|-------------|---------|
+| C1 | Sign in with Apple or an equivalent privacy-preserving login | Any third-party/social login is offered |
+| C2 | In-app purchase for every digital good, currency, credit, boost, tip or premium unlock | Anything is sold to end users in-app |
+| C3 | Loot-box odds disclosure | Randomized purchasable rewards |
+| C4 | Official contest rules in-app stating Apple is not a sponsor | Any sweepstake, contest or raffle |
+| C5 | Index of all offered mini apps/software with universal links | Users can open other users' software from the app |
+| C6 | Ad reporting control | Advertising is displayed |
+| C7 | ATT prompt | Any cross-app/site tracking |
+| C8 | Recording indicator and consent | Any session/screen/activity recording |
+| C9 | Per-instance consent before sharing data or permissions with a mini app | Mini apps receive user data |
+
+### 8.3 Posture requirements - not a single feature, an ongoing obligation
+
+| # | Requirement | Source |
+|---|-------------|--------|
+| P1 | Ability to produce, on Apple's request, a **compliance improvement plan** and evidence of moderation throughput | 1.2 |
+| P2 | Retention of moderation decisions as an audit trail | 1.2, DSA |
+| P3 | Statement of reasons to the user whose content is removed or whose account is actioned | DSA Art. 17 |
+| P4 | Keeping privacy labels and the privacy policy in step with feature changes | 6.2, 5.1.1(i) |
+| P5 | Accurate "What's New" text for significant changes | 2.3.12 |
+
+---
+
+## 9. Where reviewers actually look
+
+Ordered by observed rejection frequency for this application shape:
+
+1. **Report control not visible on the first screen of content the reviewer opens.** The reviewer opens the feed, taps a post, and looks for a report affordance. If it is buried behind a profile menu, the app is rejected under 1.2 even though the mechanism exists.
+2. **No terms acceptance at signup.** The reviewer creates an account with the demo credentials or a fresh account and looks for the EULA gate.
+3. **Account deletion not found in settings.** The reviewer opens account settings and searches for "Delete account".
+4. **Privacy policy not reachable in-app.**
+5. **Demo account sees an empty feed**, so nothing can be reported or blocked.
+6. **Blocking present but not reachable from the content itself**, only from a profile.
+7. **AI feature sending content to a third party with no disclosure or consent.**
+8. **No age gate on a platform with messaging and follower systems.**
+
+---
+
+## 10. Determination for this platform
+
+Applying the register to the DevPlace shape:
+
+- **Applicable in full:** R1-R25 except where noted below.
+- **C1 not triggered** provided the platform continues to use exclusively its own account system. Adding any social login triggers it immediately.
+- **C2 not triggered** provided no in-app purchase of any digital good, currency, credit or quota exists and none is linked to. The in-app virtual economy must remain earn-only.
+- **C3 not triggered** while randomized rewards are not purchasable.
+- **C4 triggered** by any leaderboard prize, era award or contest that awards something of value; the safe position is that awards are purely cosmetic/status and are not framed as a contest with prizes.
+- **C5 triggered** if a user can open another user's running workspace, published site or executable project from the app.
+- **C6, C7 not triggered** while there is no advertising and no cross-app tracking.
+- **C8 triggered** by presence tracking, live view relay, session recording or terminal session capture that records user activity.
+- **C9 triggered** by any path where platform user data is passed into a user-authored workspace or plug-in.
+
+The single largest exposure is **R5 breadth**: reporting must exist on every surface, and the platform under review has an unusually large number of distinct UGC surfaces. The second largest is **R15**, because AI is woven through the platform and every path that sends user text to a model provider is a third-party data share.
+
+---
+
+## Sources
+
+- [App Review Guidelines](https://developer.apple.com/app-store/review/guidelines/)
+- [Offering Account Deletion in Your App](https://developer.apple.com/support/offering-account-deletion-in-your-app/)
+- [App Privacy Details on the App Store](https://developer.apple.com/app-store/app-privacy-details/)
+- [Updated age ratings in App Store Connect](https://developer.apple.com/news/?id=ks775ehf)
+- [Age rating questionnaire now includes social media questions](https://developer.apple.com/news/?id=tlur8uvi)
+- [Apple overhauls App Store age ratings](https://www.macrumors.com/2025/07/25/apple-overhauls-app-store-age-ratings/)
+- [Apple notifies developers of new App Store age rating system](https://9to5mac.com/2025/07/24/apple-notifies-developers-of-new-app-store-age-rating-system/)
+- [Apps without trader status will be removed from the App Store in the EU](https://developer.apple.com/news/?id=einwn76m)
+- [Manage European Union Digital Services Act trader requirements](https://developer.apple.com/help/app-store-connect/manage-compliance-information/manage-european-union-digital-services-act-trader-requirements/)
+- [Provide your trader status in App Store Connect](https://developer.apple.com/news/?id=x60uzbu9)
+- [Resolving App Store Guideline 1.2 - User Generated Content](https://buddyboss.com/docs/app-store-guideline-1-2-safety-user-generated-content/)
+- [Complying with Apple App Store UGC requirements](https://www.termsfeed.com/videos/apple-app-store-comply-ugc-requirements/)
+- [Guideline 1.2 - Safety - User-Generated Content (Apple Developer Forums)](https://developer.apple.com/forums/thread/807358)
diff --git a/appleimpl.md b/appleimpl.md
new file mode 100644
index 00000000..02bd5eb5
--- /dev/null
+++ b/appleimpl.md
@@ -0,0 +1,583 @@
+# DevPlace: App Store compliance implementation design
+
+Author: retoor <retoor@molodetz.nl>
+
+Stage three of `apple.md`. Inputs are [`applecomp.md`](applecomp.md) (what Apple requires) and [`applechanges.md`](applechanges.md) (what DevPlace lacks). This document is the design: the most consistent, DRY, caveat-free way to implement every gap inside the conventions this codebase already enforces.
+
+Nothing here is implemented. This is the specification the lord is asked to approve.
+
+---
+
+## 1. Design axioms
+
+Each axiom is derived from an existing DevPlace pattern, named with its precedent. No axiom is invented for this feature.
+
+| # | Axiom | Precedent in the codebase |
+|---|-------|---------------------------|
+| **A1** | **One polymorphic facility, never twenty per-surface features.** A report is structurally a vote: an actor, a `(target_type, target_uid)` pair, a payload. | `comments`, `votes`, `reactions`, `bookmarks` all key on `(target_type, target_uid)`; `VOTABLE_TARGETS` in `database/ranking.py:11`; `REACTABLE` in `routers/reactions.py:17` |
+| **A2** | **The target set is a registry, not a literal.** Every consumer reads the same dict; adding a surface is one line. | `VOTABLE_TARGETS`, `STAR_TARGETS`, `NOTIFICATION_TYPES`, `SOFT_DELETE_TABLES`, `DOCS_PAGES`, `DATA_PATHS` |
+| **A3** | **Machine-raised and human-raised entries share one queue and one state machine.** | `services/containers/workspace/flags.py`: `raise_flag` is machine-driven, `set_status` is admin-driven, statuses `open/acknowledged/resolved/dismissed`, severities `info/warn/critical` |
+| **A4** | **Every route has four faces:** HTML, JSON, Devii action, API docs. | Root `CLAUDE.md`, "Anatomy of a feature" |
+| **A5** | **Removal is soft; garbage collection is hard; cascades share one stamp.** | `database/soft_delete.py`, `SOFT_DELETE_TABLES` (44 tables), `soft_delete_in`, `purge_event`, `/admin/trash` |
+| **A6** | **Runtime policy lives in `site_settings`,** read through `get_setting`/`get_int_setting`, live-editable at `/admin/settings`, never in code constants. | `database/schema.py:276`, `rate_limit_per_minute`, `maintenance_mode`, `registration_open` |
+| **A7** | **Action bars are composed from included partials** with `{% set _type %}{% set _uid %}{% include %}`. | `_reaction_bar.html` included from `_post_card.html:37` and `_comment.html:37` |
+| **A8** | **Non-response-critical side-effects go through `background.submit`;** audit and notifications are already funnelled there. | `services/background.py`, `utils/notifications.py:68` |
+| **A9** | **Never a silent failure.** A safety control that swallows an error is worse than absent. | Root `CLAUDE.md`; `services/audit` never raises into the caller but always records |
+| **A10** | **Legal and policy prose is a docs page,** with the existing role gating, SEO context and search index. | `routers/docs/pages.py` `DOCS_PAGES`; the admin-only `media-moderation` page proves gating works |
+| **A11** | **Owner-or-admin, with the seniority guard on admin-versus-admin.** | `content.is_owner`, `_is_senior_admin` in `routers/admin/users.py` |
+| **A12** | **The AI gateway is the single choke point for third-party model calls,** so consent is enforced in exactly one place. | `services/openai_gateway/`, `INTERNAL_GATEWAY_URL` |
+
+---
+
+## 2. The unifying abstraction
+
+Everything in this design hangs off **one registry** and **one queue**.
+
+### 2.1 The moderation target registry
+
+New module `devplacepy/database/moderation.py`, mirroring `database/ranking.py` exactly in shape and placement:
+
+```
+REPORTABLE_TARGETS: dict[str, str]   # target_type -> table name
+MATURITY_TARGETS: set[str]           # subset that can carry an age label
+```
+
+`REPORTABLE_TARGETS` covers every externally-visible surface from `applechanges.md` §2:
+
+`post`, `comment`, `gist`, `project`, `project_file`, `news`, `attachment`, `message`, `quiz`, `poll`, `award`, `user`, `issue`, `workspace`, `devii_output`.
+
+`MATURITY_TARGETS` is the subset that renders long-form authored content: `post`, `comment`, `gist`, `project`, `news`, `attachment`, `quiz`.
+
+**Why a registry rather than per-surface code.** A report route, a report button, a moderation queue row, a Devii action parameter enum, an API docs enum and a test fixture all need the same list. With a registry they read it; without one they drift. This is the same reason `VOTABLE_TARGETS` exists.
+
+**The completeness invariant.** A unit test asserts that every entry in `REPORTABLE_TARGETS` resolves to a real table (or an explicitly listed virtual surface) **and** that every externally-visible table in `SOFT_DELETE_TABLES` appears in `REPORTABLE_TARGETS`. Adding a new UGC surface without adding it to the registry fails the suite. Requirement R5 is therefore satisfied not by diligence but by construction. This is the load-bearing correctness claim of the whole design; §11 formalises it.
+
+### 2.2 The single queue
+
+One table, `content_reports`, with two producers:
+
+- **members**, via the report control on every content action bar;
+- **the filter**, via a system-raised entry when classification returns `review`.
+
+This is `workspace_flags` generalised from one instance type to the registry. Same state machine (`open → acknowledged → actioned | dismissed`), same severity ladder (`info | warn | critical`), same soft-delete participation, same admin resolution surface. One queue means one SLA measurement, one admin screen, one audit shape, and one place where the 24-hour commitment is either met or visibly not.
+
+### 2.3 URL resolution is already solved
+
+`database/content.py:22` `resolve_object_url(target_type, target_uid)` already maps `post`, `project`, `news`, `issue`, `gist`, `quiz`, `comment` and `award` to their canonical URLs, recursing through comments to their parents. It gains the remaining registry entries (`project_file`, `attachment`, `message`, `user`, `workspace`, `poll`, `devii_output`). Every moderation surface then links to its subject for free, using the function the notification system already uses.
+
+---
+
+## 3. Data layer
+
+All schema changes land in `devplacepy/database/schema.py` `init_db()` following the existing `has_column` / `create_column_by_example` / `_index` idiom, and every new table is registered in `SOFT_DELETE_TABLES`.
+
+### 3.1 `content_reports`
+
+| Column | Type | Notes |
+|--------|------|-------|
+| `uid` | text | `generate_uid()` |
+| `reporter_uid` | text | user uid, or `system` for filter-raised (mirrors `audit.record_system`) |
+| `target_type` | text | key of `REPORTABLE_TARGETS` |
+| `target_uid` | text | subject uid |
+| `owner_uid` | text | author of the reported content, denormalised at insert so the queue never N+1s |
+| `reason` | text | key of `REPORT_REASONS` (§3.6) |
+| `detail` | text | reporter's free text, max 2000 |
+| `severity` | text | `info` / `warn` / `critical` |
+| `status` | text | `open` / `acknowledged` / `actioned` / `dismissed` |
+| `origin` | text | `member` / `filter` |
+| `categories` | text | JSON list of matched 1.1.x category keys, filter-raised only |
+| `resolved_by` | text | admin uid |
+| `resolved_at` | text | ISO |
+| `created_at`, `updated_at` | text | ISO |
+| `deleted_at`, `deleted_by` | text | soft delete |
+
+Indexes: `(status, created_at)` for the queue and the SLA scan; `(target_type, target_uid)` for "is this already reported"; `(reporter_uid)` for the reporter's own list; `(owner_uid)` for offender history. Partial soft-delete index per the standing convention.
+
+**Duplicate handling** follows `raise_flag` precisely: an open report for the same `(target_type, target_uid, reporter_uid)` is updated, not duplicated. A different reporter on the same target creates a new row; the queue groups by target and shows the count, which is exactly how a real moderation queue prioritises.
+
+### 3.2 `moderation_actions`
+
+The decision record. One row per moderator decision, linked to the report that triggered it.
+
+`uid`, `report_uid`, `actor_uid`, `action`, `target_type`, `target_uid`, `subject_uid`, `reason`, `notes`, `expires_at`, `created_at`, soft-delete columns.
+
+`action` ∈ `remove_content`, `restore_content`, `warn`, `suspend`, `ban`, `lift`, `dismiss`, `escalate`.
+
+This is the DSA statement-of-reasons substrate (P3) and the compliance-plan evidence (P1). It is separate from the audit log because the audit log is append-only infrastructure and this is queryable moderation state with its own lifecycle - the same reason `workspace_flags` exists alongside the audit log.
+
+### 3.3 `content_maturity`
+
+Polymorphic age label, one row per labelled item. `uid`, `target_type`, `target_uid`, `level`, `source`, `set_by`, `created_at`, soft-delete columns.
+
+`level` ∈ `general`, `mature`, `restricted`. `source` ∈ `author`, `filter`, `moderator`.
+
+Read through a batch helper `get_maturity_by_targets(target_type, uids)` modelled exactly on `database/engagement.py` `get_reactions_by_targets` - no N+1, one query per listing. Absence of a row means `general`, so nothing needs backfilling and no existing row is touched.
+
+### 3.4 `user_consents`
+
+`uid`, `owner_kind`, `owner_id`, `kind`, `version`, `state`, `granted_at`, `withdrawn_at`, `created_at`, soft-delete columns.
+
+`owner_kind`/`owner_id` reuse the `owner_for(request)` convention from the customization subsystem verbatim, so guests are covered by the same table. `kind` ∈ `terms`, `privacy`, `ai_third_party`, `activity_recording`. `state` ∈ `granted`, `withdrawn`.
+
+Consent is **versioned and append-only in effect**: withdrawing writes `withdrawn_at` and a new grant writes a new row, so the full consent history is provable - which is what GDPR and Apple both actually require.
+
+### 3.5 `users` columns
+
+Added with the existing `has_column` guard block at `database/schema.py:1823`:
+
+| Column | Default | Purpose |
+|--------|---------|---------|
+| `terms_version` | `""` | Accepted document version (R2) |
+| `terms_accepted_at` | `""` | ISO timestamp (R2) |
+| `age_band` | `""` | `under_min` / `13_15` / `16_17` / `adult` (R13) |
+| `age_declared_at` | `""` | ISO timestamp |
+| `mature_opt_in` | `0` | Explicit opt-in to see mature-labelled content (R14) |
+| `suspended_until` | `""` | ISO; empty means not suspended (R8) |
+| `suspension_reason` | `""` | Shown to the user (P3) |
+| `deletion_requested_at` | `""` | Starts the deletion clock (R12) |
+
+**No birthdate is stored.** 5.1.4 permits collecting it only to comply with children's privacy statutes; data minimization (5.1.1(iii)) then requires storing only the derived band. The signup form collects a date, derives the band, and discards the date. This is both the compliant and the simpler design.
+
+### 3.6 Registries and constants
+
+`devplacepy/database/moderation.py` also owns:
+
+- `REPORT_REASONS: dict[str, str]` - key to label, mapped one-to-one onto the guideline categories so the age-rating questionnaire and the community guidelines can be written from the same list: `hate` (1.1.1), `violence` (1.1.2), `weapons` (1.1.3), `sexual` (1.1.4), `religious` (1.1.5), `misinformation` (1.1.6), `exploitative` (1.1.7), `harassment`, `spam`, `intellectual_property` (5.2 / R18), `self_harm`, `illegal`, `other`.
+- `REPORT_STATUSES`, `REPORT_SEVERITIES`, `MODERATION_ACTIONS`, `MATURITY_LEVELS`, `CONSENT_KINDS`, `AGE_BANDS`.
+
+One list, consumed by the form validator, the Devii action schema, the API docs enum, the admin filter dropdown and the community-guidelines page. Changing a reason is one edit.
+
+### 3.7 `site_settings` keys
+
+Added to the defaults block at `database/schema.py:276`, editable live at `/admin/settings` (A6):
+
+| Key | Default | Purpose |
+|-----|---------|---------|
+| `moderation_sla_hours` | `24` | The published commitment (R7) |
+| `moderation_filter_mode` | `review` | `off` / `label` / `review` / `block` (R4) |
+| `moderation_minimum_age` | `16` | Signup floor (R13) |
+| `moderation_mature_default_hidden` | `1` | Mature content hidden by default (R14) |
+| `contact_email`, `contact_phone`, `contact_address` | empty | Published contact + DSA trader data (R10, R22) |
+| `terms_version`, `privacy_version`, `guidelines_version` | `1` | Bump forces re-acceptance (R2) |
+| `ai_third_party_provider` | `""` | Named in the consent copy (R15) |
+| `account_deletion_grace_hours` | `24` | Reversible window before purge (R12) |
+
+---
+
+## 4. The content filter
+
+`devplacepy/services/moderation/` - a new service package alongside `services/audit/`, `services/game/` and the rest, with its own nested `CLAUDE.md`.
+
+### 4.1 Shape
+
+```
+services/moderation/
+    __init__.py      record()-style entrypoints, the only public surface
+    filter.py        classify(text) -> Classification
+    rules.py         the category rule set
+    queue.py         raise_report / set_status / decide / list_reports
+    enforcement.py   suspend / ban / lift / remove_content
+    sla.py           oldest_open_age / breach_count
+```
+
+`Classification` is a frozen dataclass (`verdict`, `categories`, `maturity`, `score`) - dataclasses over fixed-key dicts, per the standing style rule.
+
+`verdict` ∈ `allow`, `label`, `review`, `block`, resolved against `moderation_filter_mode` so an administrator can dial the platform from advisory to strict without a deploy.
+
+### 4.2 Where it runs - exactly five call sites
+
+The filter is invoked only at choke points that already exist, so no surface can be missed and no surface needs bespoke code:
+
+1. `content.create_content_item` (`content.py:197`) - posts, projects, gists, news, quizzes.
+2. `content.create_comment_record` (`content.py:361`) - every comment on every parent type.
+3. `content.edit_content_item` and `content.edit_comment_record` - edits, so a clean post cannot be edited into a violation.
+4. `routers/messages.py:245` `send_message` and the WebSocket send path - direct messages.
+5. `routers/profile/index.py` profile update and `routers/auth/signup.py` - bio, location, links, username.
+
+Five call sites cover twenty surfaces because the codebase already funnels creation. This is the direct payoff of DevPlace's existing structure.
+
+### 4.3 Behaviour, and why it is safe on a developer platform
+
+The single largest implementation risk identified in `applechanges.md` §7 is false positives: a security-focused developer community discusses exploits, weapons-grade cryptography and violent language in code review. A naive block destroys the product.
+
+The design answers this structurally:
+
+- **The default mode is `review`, not `block`.** A flagged item is published **and** a system report is raised. Nothing legitimate is ever suppressed by a machine.
+- **Only the `sexual` and `exploitative` categories default to `block`**, because those are the two where Apple removes apps without notice and where no developer-platform false-positive case exists.
+- **Thresholds are `site_settings`,** tunable live while watching the queue.
+- **A failure in the filter fails to `review`, never to `allow`** (A9). If classification raises, the content is published and a `critical` system report is raised naming the failure. A moderation control that fails open is worse than absent.
+
+This gives Apple the "method for filtering objectionable material from being posted" that 1.2 requires, gives the platform a human in the loop, and gives the community no false suppression.
+
+---
+
+## 5. Server layer
+
+### 5.1 Reporting - `devplacepy/routers/reports.py`, mounted at `/reports`
+
+Mirrors `routers/reactions.py` line for line.
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| `POST` | `/reports/{target_type}/{target_uid}` | member | Submit a report |
+| `GET` | `/reports/mine` | member | The reporter's own reports and their outcomes (DSA Art. 16 acknowledgement) |
+| `GET` | `/reports/reasons` | public | The reason registry, so any client renders the same dialog |
+
+Input model `ReportForm` in `models.py` (`reason`, `detail`); output schema `ReportOut` / `ReportListOut` in `schemas/moderation.py`. `respond(request, template, ctx, model=ReportOut)` gives HTML and JSON from one handler. Rate limiting is already global on POST via the existing middleware; no per-route limiter is added.
+
+Submitting a report **always** notifies the reporter through `create_notification` with the acknowledgement and the SLA, and **never** notifies the reported user (that happens only on decision, as a statement of reasons).
+
+### 5.2 Moderation queue - `devplacepy/routers/admin/moderation.py`
+
+Registered in the `admin/` package exactly like `trash.py` and `media.py`, with `admin_section = "moderation"`.
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `GET` | `/admin/moderation` | The queue, grouped by target, sorted oldest-open-first, with the SLA badge |
+| `GET` | `/admin/moderation/{uid}` | One report, its target rendered in place, the offender's history |
+| `POST` | `/admin/moderation/{uid}/status` | `acknowledge` / `dismiss` |
+| `POST` | `/admin/moderation/{uid}/decide` | Apply a `MODERATION_ACTIONS` decision |
+
+Every decision writes a `moderation_actions` row, records an audit event, and - where the decision affects a user - delivers a statement of reasons through `create_notification`.
+
+### 5.3 Enforcement - extending `routers/admin/users.py`
+
+The bare `is_active` toggle at `admin/users.py:179` is kept for backward compatibility and joined by:
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `POST` | `/admin/users/{uid}/suspend` | Reason + duration; writes `suspended_until`, `suspension_reason` |
+| `POST` | `/admin/users/{uid}/lift` | Clears both |
+| `POST` | `/admin/users/{uid}/ban` | Permanent; `is_active = False` **with** a recorded reason |
+
+All three pass through the existing `_is_senior_admin(actor, target)` guard (A11), so a junior admin cannot suspend a senior one - server-side, therefore also covering Devii.
+
+Enforcement is read by one new predicate in `content.py`, `is_suspended(user)`, consulted by `require_user` so a suspended account can still read, still see why, and still delete their account, but cannot post. This is one predicate at one choke point, not a scattered check.
+
+### 5.4 Account deletion - `routers/profile/delete.py`
+
+Follows the `regenerate-avatar` precedent (owner-or-admin, POST under `/profile/{username}/…`, audited, cache-invalidating).
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `GET` | `/profile/{username}/delete` | The confirmation page: what will be deleted, what is retained and why, the grace window |
+| `POST` | `/profile/{username}/delete` | Requires the account password (reauthentication, explicitly permitted by Apple); starts deletion |
+
+**The cascade**, using one shared stamp (A5):
+
+1. Stamp `deletion_requested_at`, revoke every session and access token, invalidate the user cache.
+2. `soft_delete_in(table, "user_uid", [uid], deleted_by=uid, stamp=stamp)` across every table in `SOFT_DELETE_TABLES` that carries a `user_uid` - one stamp, so `/admin/trash` can restore the entire event atomically within the grace window.
+3. Anonymise the `users` row immediately: username tombstoned, email, bio, location, links, avatar seed, API key and password hash cleared. **From the user's and every other user's point of view, the account is gone the moment they confirm.**
+4. A GC sweep (`devplace accounts prune`, and a scheduled pass in the existing service manager) hard-purges the stamped event after `account_deletion_grace_hours`, using `purge_event(stamp)` - the function that already exists.
+
+The confirmation page states the grace window explicitly, satisfying Apple's "if the deletion request will take additional time to complete, let them know."
+
+The devRant `DELETE /api/users/me` at `routers/devrant/auth.py:189` is re-pointed at this same cascade, because a deactivation masquerading as a deletion is exactly what Apple names as insufficient, and because two paths must not mean two behaviours.
+
+### 5.5 Terms, age and consent
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `POST` | `/auth/accept-terms` | Records acceptance of the current `terms_version` |
+| `POST` | `/profile/{username}/consent` | Grant or withdraw a `CONSENT_KINDS` entry |
+| `GET` | `/profile/{username}?tab=privacy` | Acceptances, consents, withdrawal controls, deletion entry point |
+
+`SignupForm` (`models.py:51`) gains `birth_date` and `accept_terms`, both required, validated Pydantic-natively like every other form in the project. The validator derives `age_band`, rejects below `moderation_minimum_age`, and the raw date never reaches the database.
+
+**The re-acceptance gate** is a middleware in the existing stack in `main.py`, sitting beside the maintenance gate it is modelled on: an authenticated user whose `terms_version` is behind the setting is redirected to the acceptance page for any mutating request, while reads, `/static`, `/auth`, `/docs` and account deletion stay open. A user must never be trapped: they can always read, always accept, and always delete their account.
+
+### 5.6 Third-party AI consent - one gate at one choke point
+
+Enforced in `services/openai_gateway/` where every internal AI consumer already converges (A12).
+
+The rule distinguishes two things that the existing code currently conflates:
+
+- **User-content processing** - the user's own post, comment, message, file or prompt is sent to the provider. Requires a granted `ai_third_party` consent for that user. Default: **not granted**.
+- **Platform processing** - news import, bot personas, SEO metadata for platform-owned text. Not user content, not gated by user consent.
+
+The gateway resolves the owner it is acting for and refuses a user-content call without consent, returning a structured error the callers already know how to surface. The existing `ai_correction_enabled` and `ai_modifier_enabled` flags survive unchanged as **preferences**, subordinate to consent: consent withdrawn means the feature is off regardless of the preference. `ai_modifier_enabled`'s default of `1` becomes harmless, because consent gates it. No existing preference is silently flipped; the gate is simply added above them.
+
+The consent copy names the provider from `ai_third_party_provider`, states what is sent and why, and links the privacy policy - the three things 5.1.2(i) demands.
+
+### 5.7 Activity-recording consent and indicator (C8)
+
+`activity_recording` consent covers presence (`services/presence.py`), the live view relay and Devii terminal session capture. Guideline 2.5.14 wants consent **and** a clear indication. The indication reuses the existing presence dot partial `_presence_dot.html` and the response-time badge idiom in `base.html`: a small, always-visible recording indicator when a session is being captured. Withdrawing consent stops presence writes for that user; they simply appear offline.
+
+### 5.8 The software index (C5 / 4.7.4)
+
+`GET /workspaces/index` - a public, paginated index of every user-published workspace reachable through the `/p/{slug}` ingress, with its owner, description, maturity label and canonical URL. This is the "index of software and metadata available in your app… including universal links" that 4.7.4 requires. It reuses the existing listing machinery (`build_pagination`, `_card_link.html`, `paginate_diverse`) and is added to the sitemap.
+
+---
+
+## 6. View layer
+
+### 6.1 One partial, included everywhere
+
+`templates/_report_button.html`, included with the same two-variable idiom as `_reaction_bar.html` (A7):
+
+```
+{% set _type = "post" %}{% set _uid = item.post['uid'] %}{% set _owner = item.post['user_uid'] %}
+{% include "_report_button.html" %}
+```
+
+It renders **Report** and, when the viewer is not the owner, **Block**, both `guest_disabled(user)`, both matching the existing `post-action-btn` / `comment-action-btn` visual language exactly. Placing Block here closes gap G9 from `applechanges.md`: blocking becomes reachable from the content, not only from a profile.
+
+Include sites: `_post_card.html`, `_comment.html`, `post.html`, `gist_detail.html`, `project_detail.html`, `news_detail.html`, `quiz.html`, `_media_gallery.html`, `messages.html`, `profile.html`, `_award_badge.html`, `project_files.html`, `issue_detail.html`, `containers_instance.html`.
+
+**One partial, fourteen include sites, zero duplicated markup.** A template that renders content and omits the include is caught by the e2e coverage test in §10.
+
+### 6.2 One dialog
+
+`templates/_report_dialog.html` is included once in `base.html`, exactly as the reaction picker is a single palette reused by every bar. `static/js/ReportDialog.js` - one ES6 class, registered on `app`, using the existing `Http` helper and the established `.modal-overlay` / `.visible` modal pattern - reads `data-report-type` and `data-report-uid` from the clicked button, populates the reason list from `/reports/reasons`, and posts. No new modal machinery, no third-party library.
+
+### 6.3 Maturity gate
+
+`templates/_maturity_gate.html`: an interstitial rendered in place of a `mature`-labelled item for a viewer who has not opted in or whose `age_band` is below the threshold. Reveal is a single control that sets `mature_opt_in`; it is not offered at all to `13_15` or `16_17` bands for `restricted` content. Content stays hidden by default, which is precisely 1.2's wording.
+
+### 6.4 Admin
+
+`templates/admin_moderation.html` extends `admin_base.html` with `admin_section = "moderation"`, and a sidebar entry is added to `admin_base.html` between Media and Trash - the natural neighbours. The queue header carries the SLA badge: oldest open report age against `moderation_sla_hours`, green under, red over. That badge is the mechanism that makes the published 24-hour commitment (R7) real rather than aspirational.
+
+### 6.5 Legal pages and the footer
+
+Legal prose ships as `DOCS_PAGES` entries (A10) under a new `SECTION_LEGAL = "Legal"`, placed in the `AUDIENCE_START` group so it is one click from `/docs`:
+
+| Slug | Title | Requirement |
+|------|-------|-------------|
+| `terms` | Terms of Service | R1, R2 |
+| `community-guidelines` | Community Guidelines | R3 |
+| `privacy` | Privacy Policy | R11 |
+| `contact` | Contact | R10, R22 |
+| `content-moderation` | How moderation works | R7, P1 |
+| `intellectual-property` | Notice and takedown | R18 |
+| `moderation-operations` | Operating the queue (admin-gated, like `media-moderation`) | P1, P2 |
+
+`_footer_links.html` gains Terms, Privacy, Guidelines and Contact alongside the existing four links. This is the "easily accessible in the app" that 5.1.1(i) and 1.5 both require, and it is on every page because the footer is in `base.html`.
+
+`contact` renders `contact_email`, `contact_phone` and `contact_address` from `site_settings`, so the in-app contact data and the App Store Connect trader data have one source of truth and cannot drift (R10 ≡ R22).
+
+### 6.6 Signup
+
+`templates/signup.html` gains a date-of-birth field and a required terms checkbox whose label links `/docs/terms.html` and `/docs/community-guidelines.html`. Both are validated by `SignupForm`, so the error path is the existing global `RequestValidationError` handler that already re-renders auth pages with messages.
+
+---
+
+## 7. Agent, docs and SEO layer
+
+Per A4, nothing ships with fewer than four faces.
+
+- **Devii** - `services/devii/actions/catalog/moderation.py` exporting `MODERATION_ACTIONS`: `report_content`, `list_my_reports`, `list_reports` (admin), `decide_report` (admin), `suspend_user` (admin), `lift_suspension` (admin), `delete_my_account`, `set_consent`, `accept_terms`. `delete_my_account`, `decide_report`, `suspend_user` and `ban_user` join `CONFIRM_REQUIRED` in `dispatcher.py`, **each declaring a `confirm` boolean param in its catalog spec** - the load-bearing detail the root `CLAUDE.md` calls out, without which a gated tool loops forever.
+- **API docs** - `docs_api/groups/moderation.py`, a new group with `endpoint()` entries and `sample_response` for every route above, plus the reason enum sourced from `REPORT_REASONS`.
+- **SEO** - legal pages are public and indexable, added to `routers/seo.py`'s sitemap; `/reports/*` and `/admin/moderation/*` are `noindex,nofollow` via `base_seo_context`.
+- **Audit** - new keys in `events.md` and `services/audit/categories.py` `category_for` under a new `moderation` category: `report.create`, `report.status`, `report.decide`, `moderation.suspend`, `moderation.ban`, `moderation.lift`, `moderation.remove`, `moderation.restore`, `filter.block`, `filter.review`, `account.delete.request`, `account.delete.purge`, `consent.grant`, `consent.withdraw`, `terms.accept`.
+- **README.md** gains the moderation, legal and account-deletion surfaces; the root `CLAUDE.md` gains one new architectural rule (§8.1 below); `services/moderation/CLAUDE.md` and `routers/CLAUDE.md` carry the detail.
+
+---
+
+## 8. The two things that are not code
+
+### 8.1 The new architectural rule for the root `CLAUDE.md`
+
+> **Every user-generated surface is reportable by construction.** A new content table added to `SOFT_DELETE_TABLES` that is visible to anyone other than its author MUST be registered in `database/moderation.py` `REPORTABLE_TARGETS`, MUST resolve in `resolve_object_url`, and MUST include `_report_button.html` in its action bar. The registry completeness test enforces the first two; the template coverage test enforces the third.
+
+### 8.2 The positioning change
+
+`applechanges.md` §5 established that four sites currently promise an uncensored platform, and that this alone is grounds for a 1.2 rejection. The design changes them in step so that marketing, terms and behaviour state the same thing:
+
+| Site | Current | Proposed |
+|------|---------|----------|
+| `main.py:744` site description | "…in an open, uncensored environment." | "…in an open environment built by developers, for developers." |
+| `templates/base.html:9` meta description | same string | same replacement |
+| `templates/landing.html:120` hero | same string | same replacement |
+| `templates/landing.html:134` feature card | "No Censorship" | "No Gatekeeping" - with body copy stating that DevPlace does not editorialise technical opinion, and that a short list of prohibited categories is enforced, linking the community guidelines |
+| `database/schema.py:280` default `site_tagline` | same string | same replacement |
+
+This is the one item in this document that changes the product's public voice rather than its capabilities. It is presented as a decision, not an assumption, and it is the single change with the highest effect on the outcome of review.
+
+---
+
+## 9. Sequencing
+
+Six phases. Each phase is independently shippable, leaves the platform working, and ends with the full suite (`make test`, all three tiers) green. No phase depends on a later one.
+
+| Phase | Contents | Requirements closed |
+|-------|----------|---------------------|
+| **1. Foundation** | `database/moderation.py` registry and constants; `content_reports`, `moderation_actions`, `content_maturity`, `user_consents` tables; `users` columns; `site_settings` keys; `SOFT_DELETE_TABLES` registration; `resolve_object_url` extension; the registry completeness test | substrate for R4-R8, R13-R16 |
+| **2. Reporting and moderation** | `services/moderation/` queue; `routers/reports.py`; `routers/admin/moderation.py`; enforcement routes; `_report_button.html` at all fourteen sites; `_report_dialog.html` + `ReportDialog.js`; `admin_moderation.html` + sidebar; SLA badge; audit keys; Devii actions; API docs | **R5, R6, R7, R8, R9, P1, P2, P3** |
+| **3. Legal and contact** | The seven docs pages; footer links; contact settings; the positioning rewording | **R1, R3, R10, R11, R18, R22** |
+| **4. Consent, terms, age** | Signup terms + date of birth; re-acceptance middleware; consent routes and privacy tab; the AI gateway consent gate; activity-recording consent and indicator | **R2, R13, R15, R16, C8, C9** |
+| **5. Deletion** | `routers/profile/delete.py`; the stamped cascade; `devplace accounts prune`; devRant re-point; the confirmation page | **R12** |
+| **6. Filter, maturity, index, posture** | `services/moderation/filter.py` at the five choke points; `content_maturity` + `_maturity_gate.html`; `/workspaces/index`; IPv6 verification; demo account; review notes; questionnaire and privacy-label answers | **R4, R14, R19, R20, R21, R23, R24, C5** |
+
+Phases 2 and 3 together answer the guideline that actually rejects apps. Phase 5 answers the guideline that most often rejects them on the second attempt. Nothing is deferred to "later"; six phases is the whole scope.
+
+---
+
+## 10. Test plan
+
+Following the tier rules in `tests/CLAUDE.md`: tier is decided by fixtures, path mirrors the URL for `api`/`e2e` and the module for `unit`.
+
+**`tests/unit/database/moderation.py`**
+- The registry completeness invariant (§11.1) - the single most important test in this feature.
+- `REPORT_REASONS` keys are stable and cover every guideline category.
+- `resolve_object_url` returns a non-`/feed` URL for every registry entry.
+- Filter classification: property checks over the category rule set, asserting monotonicity of score against rule matches and that `verdict` never weakens as mode strengthens.
+- Age-band derivation across the full date domain, including leap days and the exact boundary.
+
+**`tests/api/reports/*.py`**
+- Report every registry target type; assert one row, correct `owner_uid`, correct audit event.
+- Duplicate report from the same reporter updates rather than duplicates; from a different reporter creates a second row.
+- Guests are refused; suspended users are refused posting but permitted reporting and deletion.
+- `/reports/mine` shows outcomes; a reporter never sees another reporter's report.
+
+**`tests/api/admin/moderation.py`**
+- Queue ordering is oldest-open-first; SLA badge flips at the configured hour.
+- Every `MODERATION_ACTIONS` decision writes a `moderation_actions` row, an audit row, and a notification.
+- The seniority guard blocks a junior admin actioning a senior one and audits `result="denied"`.
+
+**`tests/api/profile/delete.py`**
+- Deletion requires the correct password; wrong password does not delete.
+- After deletion the account is unreachable, sessions are revoked, content is gone from every listing.
+- Restore within the grace window from `/admin/trash` restores the whole event under one stamp.
+- After the grace window `purge_event` removes every row and no personal data remains in any table.
+
+**`tests/api/auth/terms.py`, `tests/api/profile/consent.py`**
+- Signup without acceptance or below the minimum age fails with a rendered message.
+- Bumping `terms_version` forces re-acceptance on the next mutating request and never on a read.
+- A gateway user-content call without `ai_third_party` consent is refused; with consent it proceeds; withdrawal takes effect immediately.
+
+**`tests/e2e/`**
+- **Coverage test:** for each of the fourteen include sites, load the page and assert a report control is present and reachable. This is the test that keeps R5 true over time.
+- Report a post end to end through the dialog; confirm the toast, the notification and the queue row.
+- Block from a comment action bar; confirm the author's content disappears from the feed.
+- Delete an account through the UI and confirm the login no longer works.
+- The maturity interstitial hides labelled content and reveals it only on explicit opt-in.
+
+**Rigorous verification (root `CLAUDE.md`, four-layer procedure).** Suspension state, consent state and the deletion cascade are all read-then-write mutations reachable from HTTP, Devii, the devRant API and the CLI, so the procedure applies in full and is not optional:
+
+1. **Property checks** over the filter score function and the age-band function across their whole input domain.
+2. **Stateful fuzzing** of report → decide → suspend → lift → delete sequences against a temp DB, asserting after every action that a report never leaves its state machine, a suspension never outlives its expiry, consent history is never rewritten, and no user is ever both deleted and active.
+3. **Concurrency with real separate OS processes**: concurrent decisions on one report must produce exactly one `moderation_actions` row; concurrent deletion requests must produce exactly one cascade. Both are closed with a single atomic conditional `UPDATE … WHERE` at the chokepoint, checked through `db.executable.execute(text(...)).rowcount`, per the standing rule. **Every new column added in §3.5 is written at insert time for new rows and `COALESCE`d in every precondition and arithmetic update**, because a column absent from a row's original `INSERT` is SQL `NULL`, and `NULL = 0` is `NULL`, not true - the exact trap the root `CLAUDE.md` records.
+4. **`pyflakes` / `ruff check`** on every touched file, catching the in-function import that neither a clean compile nor a clean app import would.
+
+---
+
+## 11. Proof of solidity
+
+`apple.md` asks for a mathematical proof that the implementation is solid. A design cannot be proved correct in the abstract; what can be proved is that **coverage is total and stays total**. Three claims, each discharged by a mechanism rather than by diligence.
+
+### 11.1 Claim 1 - surface coverage is total, and remains total
+
+Let `U` be the set of externally-visible user-generated surfaces, `R` the set of `REPORTABLE_TARGETS` keys, `T` the set of tables in `SOFT_DELETE_TABLES`, and `V ⊆ T` those visible beyond their author.
+
+The design requires `V ⊆ R` and enforces it with a unit test that computes `V` from `SOFT_DELETE_TABLES` minus an explicit, reviewed exclusion list of owner-private tables, and asserts the inclusion. A developer adding a UGC table without registering it **fails the suite**.
+
+Since the report route, the report partial, the Devii action enum, the API docs enum and the admin filter all derive from `R`, coverage of every consumer follows from `V ⊆ R` by construction. Requirement **R5** is therefore not "implemented on sixteen surfaces" but *closed under future additions* - which is the only form of this guarantee worth having, because 1.2 rejections happen on the surface someone forgot.
+
+Formally: coverage is the composition `V ↪ R → {route, partial, action, docs, filter}`. The inclusion is test-enforced; the maps are total functions over `R`; therefore the composition is total over `V`. ∎
+
+### 11.2 Claim 2 - every Apple requirement maps to a named artifact
+
+The map `requirement → artifact` below is total over the mandatory register and over every triggered conditional. No requirement lacks an artifact; no artifact exists without a requirement.
+
+| Req | Artifact | Phase |
+|-----|----------|-------|
+| R1 | `/docs/terms.html` + `terms_version` | 3 |
+| R2 | `SignupForm.accept_terms`, `users.terms_version`, re-acceptance middleware | 4 |
+| R3 | `/docs/community-guidelines.html` from `REPORT_REASONS` | 3 |
+| R4 | `services/moderation/filter.py` at five choke points | 6 |
+| R5 | `REPORTABLE_TARGETS` + `/reports/{target_type}/{target_uid}` + `_report_button.html` | 1, 2 |
+| R6 | `/admin/moderation` + `moderation_actions` | 2 |
+| R7 | `moderation_sla_hours` + the SLA badge + `/docs/content-moderation.html` | 2, 3 |
+| R8 | `/admin/users/{uid}/suspend`, `/ban`, `/lift` + `is_suspended` | 2 |
+| R9 | existing `routers/relations.py` + Block in `_report_button.html` | 2 |
+| R10 | `/docs/contact.html` from `contact_*` settings + footer | 3 |
+| R11 | `/docs/privacy.html` + footer + ASC metadata | 3 |
+| R12 | `routers/profile/delete.py` + stamped cascade + `devplace accounts prune` | 5 |
+| R13 | `SignupForm.birth_date` → `users.age_band` + `moderation_minimum_age` | 4 |
+| R14 | `content_maturity` + `_maturity_gate.html` + `mature_opt_in` | 6 |
+| R15 | `user_consents.ai_third_party` + the gateway gate | 4 |
+| R16 | `POST /profile/{username}/consent` + the privacy tab | 4 |
+| R17 | existing `notification_preferences` (verified, documented) | 6 |
+| R18 | `intellectual_property` reason + `/docs/intellectual-property.html` | 3 |
+| R19 | demo account + review notes | 6 |
+| R20 | questionnaire answered from R4/R5/R6/R13 | 6 |
+| R21 | privacy labels derived from R15's disclosure | 6 |
+| R22 | `contact_*` settings ≡ ASC trader data | 3 |
+| R23 | IPv6 verification of app, nginx, WebSockets, ingress | 6 |
+| R24 | architecture statement in docs + review notes | 6 |
+| R25 | every control exposed as JSON by A4 | 1-6 |
+| C4 | contest position documented | 3 |
+| C5 | `/workspaces/index` | 6 |
+| C8 | `activity_recording` consent + indicator | 4 |
+| C9 | per-instance consent before data reaches user software | 4 |
+| P1 | `moderation_actions` + SLA metrics | 2 |
+| P2 | audit `moderation` category + `moderation_actions` | 2 |
+| P3 | statement of reasons via `create_notification` | 2 |
+| P4 | privacy-label step added to the feature workflow | 6 |
+| P5 | release-notes discipline | 6 |
+
+C1, C2, C3, C6 and C7 are untriggered and the design introduces nothing that triggers them: no social login, no payment path, no purchasable randomness, no advertising, no cross-app tracking. Keeping them untriggered is itself recorded as a constraint in the root `CLAUDE.md` rule of §8.1's neighbourhood.
+
+### 11.3 Claim 3 - the design introduces no inconsistency
+
+Consistency is checked against every convention the repository enforces:
+
+| Convention | How this design satisfies it |
+|-----------|------------------------------|
+| Polymorphic `(target_type, target_uid)` | `content_reports`, `content_maturity` use it verbatim |
+| Registry over literal | `REPORTABLE_TARGETS` beside `VOTABLE_TARGETS` |
+| Soft delete everywhere, one stamp per cascade | All four new tables registered; deletion uses one stamp |
+| Runtime policy in `site_settings` | Eleven new keys, zero new constants |
+| Four faces per route | Every route has HTML, JSON, Devii action, API docs |
+| Shared `templates` instance, partial reuse | One partial, one dialog, fourteen includes |
+| ES6 module, one class per file, on `app` | `ReportDialog.js` |
+| Design tokens, no literals | Report and SLA styling uses existing tokens and `--z-*` bands |
+| No comments, no docstrings | The design specifies none |
+| Author attribution at the top of every file | Every new file |
+| European dates, UTC storage | `local_dt` / `dt_ago` for every timestamp shown |
+| Owner-or-admin, seniority guard | `is_owner`, `_is_senior_admin` reused unchanged |
+| `CONFIRM_REQUIRED` with a declared `confirm` param | Four gated Devii tools |
+| Batch helpers, never N+1 | `get_maturity_by_targets`, denormalised `owner_uid` |
+| Never fail silently | Filter fails to `review`; report submission never swallows |
+| No forbidden name patterns, no em-dash | Enforced at authoring and by `/validate` |
+
+Zero new patterns are introduced. Every mechanism in this design is an existing DevPlace mechanism applied to a new target set. That is the sense in which it is DRY, and the sense in which it is consistent. ∎
+
+---
+
+## 12. Verification loop
+
+`apple.md` asks that the former steps be repeated recursively until the result is proved solid. Three passes were run over `applecomp.md` → `applechanges.md` → this document. Each pass fed a correction back into the earlier documents, which are the corrected versions.
+
+**Pass 1 - requirement completeness.** The first register covered guideline 1.2 and 5.1.1 only. Re-reading the guidelines against the platform's actual feature list added: 4.7 in full (the AI assistant is a chatbot under it, and it restates the 1.2 quartet), 2.5.2 and its educational exception (the container platform), 2.5.14 (presence and session recording), 4.7.4 (the software index), 2.5.5 (IPv6), 5.3 (Code Farm Eras), 6.1's 2025 age-rating overhaul and 6.4's DSA trader status. **Nine requirements were missing from the first draft.** They are R23, R24, C5, C8, C9, and the metadata requirements R20-R22, and the 5.3 position in C4.
+
+**Pass 2 - surface completeness.** The first gap analysis listed eight UGC surfaces from the routers. Re-deriving the list from `SOFT_DELETE_TABLES` rather than from the routers produced **twenty**, including four that a router-first reading misses entirely: awards, poll options, quiz options and workspace-served content. That correction is what forced A1 and A2, and therefore the registry, and therefore the completeness invariant of §11.1. A per-surface design would have shipped incomplete.
+
+**Pass 3 - consistency and caveat elimination.** Re-reading the design against the conventions produced five corrections, each removing a caveat rather than documenting one:
+
+1. Maturity was originally a column on each content table - twenty migrations and a permanent drift risk. Replaced by the polymorphic `content_maturity` table with a batch helper, matching `reactions`.
+2. The filter was originally to be called from each router - twenty call sites. Replaced by five existing choke points in `content.py`, `messages.py` and the profile/signup path.
+3. AI consent was originally a per-feature toggle, which would have needed a gate in every AI consumer. Replaced by one gate at the gateway, with the existing toggles demoted to preferences - no existing preference is flipped and no consumer changes.
+4. Account deletion was originally an immediate hard purge, which conflicts with `/admin/trash`, with the audit trail, and with accidental loss. Replaced by an immediate anonymisation plus a stamped soft-delete event and a GC purge, which is both the compliant behaviour and the behaviour the codebase already has primitives for.
+5. Legal pages were originally new routes. Replaced by `DOCS_PAGES` entries, which brings role gating, SEO, the search index and the export for free, and adds no routing.
+
+**Pass 4 - factual re-verification against the source tree.** Every file reference, line number and count asserted across all three documents was re-read from the source rather than trusted. Three errors were found and corrected in place:
+
+1. `SOFT_DELETE_TABLES` was stated as 46 tables in `applechanges.md` §3 and in A5 above; the real count, computed from `database/soft_delete.py`, is **44**.
+2. `applechanges.md` §8's mandatory-requirement tally summed to 26 across 25 requirements, because R2 was counted as both missing and partial. Corrected to a true partition: 1 present, 5 partial, 15 missing, 2 blocked, 1 unverified, 1 out of scope.
+3. The conditional tally said "4 not triggered … (C1, C2, C3, C6, C7 - five, counting C7)". Corrected to 5 not triggered, 3 missing, 1 borderline.
+
+Everything else verified exactly: `main.py:744`, `templates/base.html:9`, `landing.html:120` and `:134`, `schema.py:276`/`:280`/`:1823`, `soft_delete.py:7`, `ranking.py:11`, `reactions.py:17`, `content.py:197`/`:361`, `database/content.py:22`, `models.py:51`/`:408`, `admin/users.py:179`, `devrant/auth.py:189`, `messages.py:245`, `notifications.py:68`, `admin_base.html:11`-`59`, and the existence of all fourteen include-site templates plus `routers/profile/index.py`, `services/audit/categories.py`, `services/devii/actions/spec.py` and `docs_api/_shared.py`.
+
+**Pass 5 - fixed point.** A fifth pass over all three documents produced no further correction: every mandatory requirement maps to an artifact (§11.2), every artifact maps to a requirement, every surface is covered by construction (§11.1), and every convention is satisfied (§11.3). The documents are consistent with each other and with the source tree as read. The loop has converged.
+
+**The one open decision** deliberately left to the lord, because it is a product-voice decision and not a technical one, is §8.2: the rewording of the four "uncensored" sites. Everything else in this design is fully specified and requires no further input.
+
+---
+
+## 13. What approval authorises
+
+Approving this document authorises implementation of phases 1 through 6 in §9, in order, each phase validated with `python -c "from devplacepy.main import app"`, per-language manual checks, `ruff check` / `pyflakes` on every touched file, the four-layer rigorous verification of §10 where it applies, and the **full test suite (`make test`, all three tiers, every test) green before the phase is considered done**.
+
+Documentation updated in step: `README.md`, the root `CLAUDE.md` (one new rule, §8.1), `devplacepy/routers/CLAUDE.md`, a new `devplacepy/services/moderation/CLAUDE.md`, `devplacepy/database/CLAUDE.md`, `devplacepy/templates/CLAUDE.md`, `events.md`, and the seven new docs pages.
diff --git a/devplacepy/cli/__init__.py b/devplacepy/cli/__init__.py
index b5258afe..673197f3 100644
--- a/devplacepy/cli/__init__.py
+++ b/devplacepy/cli/__init__.py
@@ -2,6 +2,7 @@
 
 from devplacepy.cli.main import main, build_parser
 from devplacepy.cli._shared import _audit_cli
+from devplacepy.cli.accounts import cmd_accounts_pending, cmd_accounts_prune
 from devplacepy.cli.roles import cmd_role_get, cmd_role_set
 from devplacepy.cli.apikeys import cmd_apikey_get, cmd_apikey_reset, cmd_apikey_backfill
 from devplacepy.cli.tokens import (
@@ -49,6 +50,8 @@ __all__ = [
     "main",
     "build_parser",
     "_audit_cli",
+    "cmd_accounts_pending",
+    "cmd_accounts_prune",
     "cmd_role_get",
     "cmd_role_set",
     "cmd_apikey_get",
diff --git a/devplacepy/cli/accounts.py b/devplacepy/cli/accounts.py
new file mode 100644
index 00000000..87105e7b
--- /dev/null
+++ b/devplacepy/cli/accounts.py
@@ -0,0 +1,46 @@
+# retoor <retoor@molodetz.nl>
+
+from devplacepy.cli._shared import _audit_cli
+
+
+def cmd_accounts_prune(args):
+    from devplacepy.services.moderation import deletion
+
+    pending = deletion.due_purges()
+    if args.dry_run:
+        for row in pending:
+            print(f"{row['uid']} deleted at {row['deletion_requested_at']}")
+        print(f"{len(pending)} account(s) due for purge")
+        return
+    purged = deletion.purge_due()
+    _audit_cli(
+        "cli.accounts.prune",
+        f"CLI purged {purged} deleted account(s) past the grace window",
+        metadata={"count": purged},
+    )
+    print(f"Purged {purged} deleted account(s)")
+
+
+def cmd_accounts_pending(args):
+    from devplacepy.services.moderation import deletion
+
+    pending = deletion.due_purges()
+    for row in pending:
+        print(f"{row['uid']}\t{row['deletion_requested_at']}")
+    print(f"{len(pending)} account(s) past the {deletion.grace_hours()}h grace window")
+
+
+def register_accounts(subparsers):
+    accounts = subparsers.add_parser("accounts", help="Deleted account management")
+    accounts_sub = accounts.add_subparsers(title="action", dest="action")
+    prune = accounts_sub.add_parser(
+        "prune", help="Permanently purge accounts past the deletion grace window"
+    )
+    prune.add_argument(
+        "--dry-run", action="store_true", help="List what would be purged and exit"
+    )
+    prune.set_defaults(func=cmd_accounts_prune)
+    pending = accounts_sub.add_parser(
+        "pending", help="List deleted accounts awaiting their purge"
+    )
+    pending.set_defaults(func=cmd_accounts_pending)
diff --git a/devplacepy/cli/main.py b/devplacepy/cli/main.py
index 7922b9ad..02d312ec 100644
--- a/devplacepy/cli/main.py
+++ b/devplacepy/cli/main.py
@@ -2,6 +2,7 @@
 
 import argparse
 import sys
+from devplacepy.cli.accounts import register_accounts
 from devplacepy.cli.roles import register_roles
 from devplacepy.cli.apikeys import register_apikeys
 from devplacepy.cli.tokens import register_tokens
@@ -36,6 +37,7 @@ def build_parser():
     register_quiz(sub)
     register_gateway(sub)
     register_messaging(sub)
+    register_accounts(sub)
 
     return parser
 
diff --git a/devplacepy/content.py b/devplacepy/content.py
index e4b70a6b..25fc306c 100644
--- a/devplacepy/content.py
+++ b/devplacepy/content.py
@@ -31,6 +31,11 @@ from devplacepy.database import (
     soft_delete_engagement,
     soft_delete_fork_relations,
     load_comments,
+    band_allows_mature,
+    band_allows_restricted,
+    get_maturity,
+    get_maturity_by_targets,
+    get_int_setting,
     _now_iso,
     db,
 )
@@ -51,6 +56,11 @@ from devplacepy.services.audit import record as audit
 from devplacepy.services.correction import schedule_correction
 from devplacepy.services.ai_modifier import schedule_modification
 from devplacepy.services.seo_meta import schedule_seo_meta_for_table
+from devplacepy.services.moderation.screening import (
+    record as record_screening,
+    refuse_if_blocked,
+    screen_fields,
+)
 
 CREATE_METADATA_KEYS = ("project_type", "is_private", "language", "topic", "status")
 
@@ -79,6 +89,30 @@ def is_owner(item: dict | None, user: dict | None) -> bool:
     return bool(item and user and item["user_uid"] == user["uid"])
 
 
+def mature_hidden_by_default() -> bool:
+    return get_int_setting("moderation_mature_default_hidden", 1) != 0
+
+
+def maturity_hidden(level: str | None, user: dict | None) -> bool:
+    if not level or level == "general":
+        return False
+    if not mature_hidden_by_default():
+        return False
+    if not user:
+        return True
+    band = user.get("age_band") or "adult"
+    allowed = (
+        band_allows_restricted(band) if level == "restricted" else band_allows_mature(band)
+    )
+    return not (allowed and bool(user.get("mature_opt_in")))
+
+
+def is_suspended(user: dict | None) -> bool:
+    from devplacepy.database import suspension_active
+
+    return suspension_active(user)
+
+
 def _owner_is_admin(project: dict) -> bool:
     owner_uid = project.get("user_uid")
     owner = get_users_by_uids([owner_uid]).get(owner_uid) if owner_uid else None
@@ -206,6 +240,8 @@ def create_content_item(
     attachment_uids: list | None,
     request=None,
 ) -> tuple[str, str]:
+    screening = screen_fields(table_name, fields)
+    refuse_if_blocked(screening)
     uid = generate_uid()
     slug = make_combined_slug(slug_source, uid)
     get_table(table_name).insert(
@@ -251,6 +287,13 @@ def create_content_item(
         metadata=metadata or None,
         links=links,
     )
+    record_screening(
+        screening,
+        target_type=target_type,
+        target_uid=uid,
+        actor_uid=user["uid"],
+        request=request,
+    )
     schedule_correction(user, table_name, uid, request)
     schedule_modification(user, table_name, uid, request)
     schedule_seo_meta_for_table(table_name, uid)
@@ -367,6 +410,8 @@ def create_comment_record(
     parent_uid: str | None = None,
     attachment_uids: list | None = None,
 ) -> tuple[str, str]:
+    screening = screen_fields("comments", {"content": content})
+    refuse_if_blocked(screening)
     comment_uid = generate_uid()
     redirect_url = resolve_object_url(target_type, target_uid)
     insert = {
@@ -417,6 +462,13 @@ def create_comment_record(
                 )
 
     create_mention_notifications(content, user["uid"], comment_url)
+    record_screening(
+        screening,
+        target_type="comment",
+        target_uid=comment_uid,
+        actor_uid=user["uid"],
+        request=request,
+    )
     schedule_correction(user, "comments", comment_uid, request)
     schedule_modification(user, "comments", comment_uid, request)
     logger.info(f"Comment by {user['username']} on {target_type} {target_uid}")
@@ -441,10 +493,19 @@ def create_comment_record(
 def edit_comment_record(request, user: dict, comment: dict, content: str) -> str:
     target_type = comment.get("target_type", "post")
     target_uid = comment.get("target_uid") or comment.get("post_uid", "")
+    screening = screen_fields("comments", {"content": content})
+    refuse_if_blocked(screening)
     updated_at = datetime.now(timezone.utc).isoformat()
     get_table("comments").update(
         {"uid": comment["uid"], "content": content, "updated_at": updated_at}, ["uid"]
     )
+    record_screening(
+        screening,
+        target_type="comment",
+        target_uid=comment["uid"],
+        actor_uid=user["uid"],
+        request=request,
+    )
     schedule_correction(user, "comments", comment["uid"], request)
     schedule_modification(user, "comments", comment["uid"], request)
     logger.info(f"Comment {comment['uid']} edited by {user['username']}")
@@ -567,6 +628,7 @@ def detail_context(
         "bookmarked": detail.get("bookmarked", False),
         "poll": detail.get("poll"),
         "project_link": detail.get("project_link"),
+        "maturity": detail.get("maturity", "general"),
     }
     if extra:
         context.update(extra)
@@ -601,11 +663,20 @@ def edit_content_item(
         if wants_json(request):
             return json_error(403, "Not allowed")
         return RedirectResponse(url=redirect_fail, status_code=302)
+    screening = screen_fields(table_name, update_fields)
+    refuse_if_blocked(screening)
     update_fields = {
         **update_fields,
         "updated_at": datetime.now(timezone.utc).isoformat(),
     }
     table.update({"uid": item["uid"], **update_fields}, ["uid"])
+    record_screening(
+        screening,
+        target_type=kind,
+        target_uid=item["uid"],
+        actor_uid=user["uid"],
+        request=request,
+    )
     schedule_correction(user, table_name, item["uid"], request)
     schedule_modification(user, table_name, item["uid"], request)
     schedule_seo_meta_for_table(table_name, item["uid"], regenerate=True)
@@ -747,6 +818,7 @@ def load_detail(
         "bookmarked": bookmarked,
         "poll": get_poll_for_post(item["uid"], user) if target_type == "post" else None,
         "project_link": get_project_by_uid(item.get("project_uid")) if target_type == "post" else None,
+        "maturity": get_maturity(target_type, item["uid"])["level"],
     }
 
 
@@ -762,6 +834,7 @@ def enrich_items(
     user_votes = (
         get_user_votes(user["uid"], [item["uid"] for item in items]) if user else {}
     )
+    maturity = get_maturity_by_targets(key, [item["uid"] for item in items])
     enriched = []
     for item in items:
         entry = {
@@ -769,6 +842,7 @@ def enrich_items(
             "author": authors.get(item["user_uid"]),
             "time_ago": time_ago(item[ts_field]),
             "my_vote": user_votes.get(item["uid"], 0),
+            "maturity": maturity.get(item["uid"], {}).get("level", "general"),
         }
         for name, source in extra_maps.items():
             entry[name] = (
diff --git a/devplacepy/database/CLAUDE.md b/devplacepy/database/CLAUDE.md
index b2739809..484573f1 100644
--- a/devplacepy/database/CLAUDE.md
+++ b/devplacepy/database/CLAUDE.md
@@ -146,6 +146,23 @@ The profile **Media** tab (`/profile/{username}?tab=media`, public) is a paginat
 - **Devii:** `list_media` (public) and `delete_media` (auth, in `CONFIRM_REQUIRED`) in the catalog.
 - **Docs visibility (deliberate):** members and guests must never be told this is a *soft* delete. The public prose page `docs/media-gallery.html` (General) and the member-facing `media-delete` API endpoint (Profiles group) describe deletion as a plain "remove" - no soft-delete, restore, trash, or purge language. All moderation mechanics live on the admin-only `docs/media-moderation` prose page (`admin: True`) and in the admin API group (`media-restore`, `admin-media`, `admin-media-purge`, all `auth="admin"`), which `docs_search` excludes from member results and `routers/docs/` package 404s for non-admins. Because `docs_search._strip` keeps the text *inside* `{% if %}` blocks, admin content must live on a separate `admin: True` page, never inline-gated on a public page (a public page may only carry an admin-gated *link*). The member `MediaItemOut` schema omits `deleted_at`; the admin-only `AdminMediaItemOut` adds it.
 
+## Moderation, consent and maturity tables (`database/moderation.py`)
+
+Four soft-deletable tables carry the trust-and-safety layer; the full subsystem is documented in `devplacepy/services/moderation/CLAUDE.md`.
+
+| Table | Shape | Notes |
+|---|---|---|
+| `content_reports` | `(target_type, target_uid)` + `reporter_uid` + `owner_uid` | The one queue. `owner_uid` is denormalised at insert so the admin list never N+1s. Indexes `(status, created_at)` for the queue and SLA scan, `(target_type, target_uid)` for duplicate detection, `(reporter_uid)`, `(owner_uid)` |
+| `moderation_actions` | one row per moderator decision, linked to its report | Queryable moderation state with its own lifecycle - deliberately separate from the append-only audit log, the same way `workspace_flags` is |
+| `content_maturity` | `(target_type, target_uid)` -> `level` | Polymorphic age label. Read through the batch helper `get_maturity_by_targets`, never per row. **Absence of a row means `general`**, so nothing needed backfilling |
+| `user_consents` | `(owner_kind, owner_id, kind)` | Append-only in effect: withdrawing stamps `withdrawn_at` on the current row and inserts a new one, so the history is provable |
+
+`REPORTABLE_TARGETS` (target type -> table) is the registry every consumer reads, exactly like `VOTABLE_TARGETS`. `UNREPORTABLE_TABLES` is its explicit counterpart: each entry names a soft-deletable table and **why** it carries no reportable content. `tests/unit/database/moderation.py` asserts the two partition `SOFT_DELETE_TABLES`, so a new user-generated table cannot be added without classifying it.
+
+The `users` columns added alongside are ensured in `backfill_api_keys()` like every other non-signup column: `terms_version`, `terms_accepted_at`, `age_band`, `age_declared_at`, `mature_opt_in`, `suspended_until`, `suspension_reason`, `deletion_requested_at`. `mature_opt_in` is normalised from NULL to `0` in the same `with db:` block that fixes the AI-modifier defaults, because it is read as a flag. **No date of birth is ever stored** - only the derived `age_band`.
+
+Two atomic conditional updates protect this data and must never become read-then-write: `queue.claim_open` (report resolution) and `deletion.claim_deletion` (the account-deletion cascade). The latter's precondition is `COALESCE(deletion_requested_at, '') = ''` because the column is SQL `NULL` on rows that predate it - the exact `NULL = 0` trap recorded above.
+
 ## Role-based visibility (generic + DRY)
 
 - **One source of truth for role/visibility checks**, registered as Jinja globals in `templating.py` - never hand-roll `user.get('role') == 'Admin'` or `user['uid'] == x['user_uid']` in a template again:
@@ -192,6 +209,15 @@ Site settings are seeded on startup (`site_settings` table):
 | `maintenance_message` | scheduled-maintenance text | Body shown on the maintenance 503 page |
 | `customization_enabled` | `"1"` | When `"0"`, `custom_css_tag`/`custom_js_tag` inject nothing (feature off) |
 | `customization_js_enabled` | `"1"` | When `"0"`, custom CSS still serves but custom JS is suppressed |
+| `moderation_sla_hours` | `"24"` | The published moderation response window; the admin queue badge turns red past it |
+| `moderation_filter_mode` | `"review"` | `off`/`label`/`review`/`block` - how the content filter acts on a match |
+| `moderation_filter_review_score` | `"2"` | Rule score at which a match becomes a report rather than a label |
+| `moderation_minimum_age` | `"16"` | Signup floor; only the derived age band is stored |
+| `moderation_mature_default_hidden` | `"1"` | Hide mature-labelled content behind an interstitial by default |
+| `account_deletion_grace_hours` | `"24"` | Reversible window before a deleted account is purged |
+| `contact_email` / `contact_phone` / `contact_address` | `""` | Published contact details, rendered on `/docs/contact.html` |
+| `terms_version` / `privacy_version` / `guidelines_version` | `"1"` | Bumping `terms_version` forces re-acceptance before the next write. **Every reader uses `get_setting(key, "1") or "1"`** - an empty stored value must read as the default or the gate 403s every write |
+| `ai_third_party_provider` | `""` | Named in the consent copy and the privacy policy |
 | `extra_head` | `""` | Raw HTML emitted verbatim into every page `<head>` by `templating.extra_head_tag()`; site-wide trusted-admin input, not sanitized |
 
 Besides the site/news/upload keys above, the **Operational** group is admin-editable at `/admin/settings`: `site_url` (public origin for absolute links incl. container ingress; resolved by `seo.public_base_url()` = setting -> `DEVPLACE_SITE_URL` env -> request origin), `rate_limit_per_minute`, `rate_limit_window_seconds`, `news_service_interval`, `session_max_age_days`, `session_remember_days`, `registration_open`, `maintenance_mode`, `maintenance_message`, `docs_search_mode` (`agent`|`bm25`, default `agent` - picks the `/docs/search.html` surface: the in-page Devii chat or the classic BM25 list; a viewer over their daily AI limit, or a guest when Devii is disabled, auto-falls-back to BM25 via `routers/docs/views.py` `_agent_search_state`), `outbound_proxy_url` (empty by default - when set, every `stealth.stealth_async_client`/`stealth_sync_client` call across the whole app routes through it via `stealth.configured_proxy_url()`; validated as `http(s)://`/`socks5(h)://` with a host in `AdminSettingsForm`; falls back to `DEVPLACE_OUTBOUND_PROXY_URL` when unset - see the "Outbound HTTP" note in the root `CLAUDE.md`). The **Custom Code** key `extra_head` is the sole key in the settings handler's `CLEARABLE_SETTINGS` set, so saving an empty textarea removes it (the default loop skips empty values).
diff --git a/devplacepy/database/__init__.py b/devplacepy/database/__init__.py
index da55287d..3b78cdbe 100644
--- a/devplacepy/database/__init__.py
+++ b/devplacepy/database/__init__.py
@@ -36,6 +36,43 @@ from .forks import record_fork, get_fork_parent, count_forks, soft_delete_fork_r
 from .follows import get_follow_counts, get_follow_list, get_following_among
 from .deepsearch import _ds_now, create_deepsearch_session, update_deepsearch_session, get_deepsearch_session, add_deepsearch_message, get_deepsearch_messages, get_cached_deepsearch_url, upsert_deepsearch_url_cache
 from .ranking import VOTABLE_TARGETS, STAR_TARGETS, _authors_cache, _ranked_authors, _rank_map, get_top_authors, get_leaderboard, get_user_rank, get_user_stars, clear_user_stars, update_target_stars, soft_delete_engagement, delete_engagement, get_target_owner_uid
+from .moderation import (
+    ACTIONS_TABLE,
+    ADULT_AGE,
+    AGE_BANDS,
+    CONSENTS_TABLE,
+    CONSENT_KINDS,
+    CONSENT_STATES,
+    MATURITY_LEVELS,
+    MATURITY_SOURCES,
+    MATURITY_TABLE,
+    MATURITY_TARGETS,
+    MODERATION_ACTIONS,
+    MODERATION_TABLES,
+    REPORTABLE_TARGETS,
+    REPORTS_TABLE,
+    REPORT_OPEN_STATUSES,
+    REPORT_ORIGINS,
+    REPORT_REASONS,
+    REPORT_SEVERITIES,
+    REPORT_STATUSES,
+    SYSTEM_ACTOR,
+    UNREPORTABLE_TABLES,
+    age_band_for,
+    band_allows_mature,
+    band_allows_restricted,
+    consent_granted,
+    consent_state,
+    get_maturity,
+    get_maturity_by_targets,
+    list_consents,
+    minimum_age,
+    report_reason_options,
+    set_consent,
+    set_maturity,
+    suspension_active,
+    years_between,
+)
 from .comments import _drop_blocked, _build_comment_items, load_comments, get_recent_comments_by_target_uids, get_recent_comments_by_post_uids, load_comments_by_target_uids
 from .content import resolve_by_slug, resolve_object_url, get_uids_by_username_match, text_search_clause, get_daily_topic, get_featured_news, get_trending_topics
 from .attachments_data import get_attachments, get_attachments_by_type, get_news_images_by_uids, delete_attachment_record, delete_attachments, _delete_attachment_file, get_user_media, get_user_attachments, get_user_attachment, get_deleted_media
@@ -217,6 +254,40 @@ __all__ = [
     "soft_delete_engagement",
     "delete_engagement",
     "get_target_owner_uid",
+    "ACTIONS_TABLE",
+    "ADULT_AGE",
+    "AGE_BANDS",
+    "CONSENTS_TABLE",
+    "CONSENT_KINDS",
+    "CONSENT_STATES",
+    "MATURITY_LEVELS",
+    "MATURITY_SOURCES",
+    "MATURITY_TABLE",
+    "MATURITY_TARGETS",
+    "MODERATION_ACTIONS",
+    "MODERATION_TABLES",
+    "REPORTABLE_TARGETS",
+    "REPORTS_TABLE",
+    "REPORT_OPEN_STATUSES",
+    "REPORT_ORIGINS",
+    "REPORT_REASONS",
+    "REPORT_SEVERITIES",
+    "REPORT_STATUSES",
+    "SYSTEM_ACTOR",
+    "UNREPORTABLE_TABLES",
+    "age_band_for",
+    "band_allows_mature",
+    "band_allows_restricted",
+    "consent_granted",
+    "consent_state",
+    "get_maturity",
+    "get_maturity_by_targets",
+    "list_consents",
+    "report_reason_options",
+    "set_consent",
+    "set_maturity",
+    "suspension_active",
+    "years_between",
     "_drop_blocked",
     "_build_comment_items",
     "load_comments",
diff --git a/devplacepy/database/content.py b/devplacepy/database/content.py
index fcc4e8b5..50bfea27 100644
--- a/devplacepy/database/content.py
+++ b/devplacepy/database/content.py
@@ -56,6 +56,44 @@ def resolve_object_url(target_type: str, target_uid: str) -> str:
             receiver = get_table("users").find_one(uid=award.get("receiver_uid", ""))
             if receiver:
                 return f"/profile/{receiver['username']}?tab=awards#award-{award.get('slug', '')}"
+        return "/feed"
+    if target_type == "user":
+        person = get_table("users").find_one(uid=target_uid)
+        return f"/profile/{person['username']}" if person else "/feed"
+    if target_type == "project_file":
+        node = get_table("project_files").find_one(uid=target_uid)
+        if not node:
+            return "/projects"
+        project = get_table("projects").find_one(uid=node.get("project_uid", ""))
+        if not project:
+            return "/projects"
+        slug = project.get("slug") or project["uid"]
+        return f"/projects/{slug}/files?path={node.get('path', '')}"
+    if target_type == "attachment":
+        attachment = get_table("attachments").find_one(uid=target_uid)
+        if not attachment:
+            return "/feed"
+        parent_type = attachment.get("target_type") or ""
+        parent_uid = attachment.get("target_uid") or ""
+        if parent_type and parent_uid:
+            return resolve_object_url(parent_type, parent_uid)
+        owner = get_table("users").find_one(uid=attachment.get("user_uid", ""))
+        return f"/profile/{owner['username']}?tab=media" if owner else "/feed"
+    if target_type == "message":
+        message = get_table("messages").find_one(uid=target_uid)
+        if not message:
+            return "/messages"
+        return f"/messages?with_uid={message.get('sender_uid', '')}"
+    if target_type == "poll":
+        poll = get_table("polls").find_one(uid=target_uid)
+        if not poll:
+            return "/feed"
+        return resolve_object_url("post", poll.get("post_uid", ""))
+    if target_type == "workspace":
+        instance = get_table("instances").find_one(uid=target_uid)
+        return f"/admin/containers/{instance['uid']}" if instance else "/admin/containers"
+    if target_type == "devii_output":
+        return "/devii"
     return "/feed"
 
 
diff --git a/devplacepy/database/moderation.py b/devplacepy/database/moderation.py
new file mode 100644
index 00000000..0cf7cf90
--- /dev/null
+++ b/devplacepy/database/moderation.py
@@ -0,0 +1,328 @@
+# retoor <retoor@molodetz.nl>
+
+from datetime import date, datetime, timezone
+
+from .core import _in_clause, _now_iso, db, get_table
+from .settings import get_int_setting
+
+
+REPORTABLE_TARGETS: dict[str, str] = {
+    "post": "posts",
+    "comment": "comments",
+    "gist": "gists",
+    "project": "projects",
+    "project_file": "project_files",
+    "news": "news",
+    "attachment": "attachments",
+    "message": "messages",
+    "quiz": "quizzes",
+    "poll": "polls",
+    "award": "awards",
+    "user": "users",
+    "issue": "issue_tickets",
+    "workspace": "instances",
+    "devii_output": "devii_conversations",
+}
+
+
+MATURITY_TARGETS: set[str] = {
+    "post",
+    "comment",
+    "gist",
+    "project",
+    "news",
+    "attachment",
+    "quiz",
+}
+
+
+UNREPORTABLE_TABLES: dict[str, str] = {
+    "news_images": "child rows of a reportable news article",
+    "poll_options": "child rows of a reportable poll",
+    "quiz_questions": "child rows of a reportable quiz",
+    "quiz_options": "child rows of a reportable quiz",
+    "tunnels": "child rows of a reportable workspace instance",
+    "issue_comment_authors": "authorship index for reportable issue comments",
+    "votes": "engagement counters, carry no authored content",
+    "reactions": "engagement counters, carry no authored content",
+    "bookmarks": "private to the owner",
+    "follows": "relationship rows, carry no authored content",
+    "poll_votes": "private ballots",
+    "quiz_attempts": "private to the participant",
+    "quiz_answers": "private to the participant",
+    "sessions": "authentication state",
+    "access_tokens": "authentication state",
+    "devrant_tokens": "authentication state",
+    "user_relations": "private block and mute lists",
+    "notification_preferences": "private to the owner",
+    "user_customizations": "runs only in the owner's own browser",
+    "devii_tasks": "private to the owner",
+    "devii_lessons": "private to the owner",
+    "devii_virtual_tools": "private to the owner",
+    "deepsearch_sessions": "private to the owner",
+    "deepsearch_messages": "private to the owner",
+    "isslop_analyses": "generated from a public URL, not authored content",
+    "email_accounts": "private mailbox credentials",
+    "instance_schedules": "child rows of a reportable workspace instance",
+    "workspace_flags": "moderation records, not authored content",
+    "content_reports": "moderation records, readable only by the reporter and moderators",
+    "moderation_actions": "moderation records, not authored content",
+    "content_maturity": "moderation labels, not authored content",
+    "user_consents": "private consent history of the account holder",
+    "backup_schedules": "operator configuration",
+    "project_forks": "lineage index for reportable projects",
+    "seo_metadata": "generated metadata for reportable content",
+}
+
+
+REPORT_REASONS: dict[str, str] = {
+    "hate": "Hate speech or discriminatory content",
+    "violence": "Realistic violence or threats",
+    "weapons": "Weapons or dangerous instructions",
+    "sexual": "Sexual or pornographic content",
+    "religious": "Content targeting religion or belief",
+    "misinformation": "False or misleading information",
+    "exploitative": "Content exploiting a person",
+    "harassment": "Harassment or bullying",
+    "spam": "Spam or unwanted promotion",
+    "intellectual_property": "Copyright or trademark infringement",
+    "self_harm": "Self-harm or suicide",
+    "illegal": "Illegal activity",
+    "other": "Something else",
+}
+
+
+def report_reason_options() -> list[dict[str, str]]:
+    return [{"key": key, "label": label} for key, label in REPORT_REASONS.items()]
+
+
+REPORT_STATUSES: tuple[str, ...] = ("open", "acknowledged", "actioned", "dismissed")
+REPORT_OPEN_STATUSES: tuple[str, ...] = ("open", "acknowledged")
+REPORT_SEVERITIES: tuple[str, ...] = ("info", "warn", "critical")
+REPORT_ORIGINS: tuple[str, ...] = ("member", "filter")
+
+MODERATION_ACTIONS: tuple[str, ...] = (
+    "remove_content",
+    "restore_content",
+    "warn",
+    "suspend",
+    "ban",
+    "lift",
+    "dismiss",
+    "escalate",
+)
+
+MATURITY_LEVELS: tuple[str, ...] = ("general", "mature", "restricted")
+MATURITY_SOURCES: tuple[str, ...] = ("author", "filter", "moderator")
+
+CONSENT_KINDS: dict[str, str] = {
+    "terms": "Terms of Service and Community Guidelines",
+    "privacy": "Privacy Policy",
+    "ai_third_party": "Processing of your content by a third-party AI provider",
+    "activity_recording": "Recording of your presence and session activity",
+    "container_credentials": (
+        "Sharing your DevPlace credentials with software another member runs "
+        "in a container"
+    ),
+}
+CONSENT_STATES: tuple[str, ...] = ("granted", "withdrawn")
+
+AGE_BANDS: tuple[str, ...] = ("under_min", "13_15", "16_17", "adult")
+
+ADULT_AGE = 18
+TEEN_AGE = 16
+YOUNG_TEEN_AGE = 13
+
+MINIMUM_AGE_FLOOR = YOUNG_TEEN_AGE
+DEFAULT_MINIMUM_AGE = TEEN_AGE
+
+SYSTEM_ACTOR = "system"
+
+REPORTS_TABLE = "content_reports"
+ACTIONS_TABLE = "moderation_actions"
+MATURITY_TABLE = "content_maturity"
+CONSENTS_TABLE = "user_consents"
+
+MODERATION_TABLES: tuple[str, ...] = (
+    REPORTS_TABLE,
+    ACTIONS_TABLE,
+    MATURITY_TABLE,
+    CONSENTS_TABLE,
+)
+
+
+def years_between(born: date, today: date) -> int:
+    years = today.year - born.year
+    if (today.month, today.day) < (born.month, born.day):
+        years -= 1
+    return years
+
+
+def minimum_age() -> int:
+    return max(
+        MINIMUM_AGE_FLOOR,
+        get_int_setting("moderation_minimum_age", DEFAULT_MINIMUM_AGE),
+    )
+
+
+def age_band_for(age: int) -> str:
+    if age >= ADULT_AGE:
+        return "adult"
+    if age >= TEEN_AGE:
+        return "16_17"
+    if age >= YOUNG_TEEN_AGE:
+        return "13_15"
+    return "under_min"
+
+
+def band_allows_mature(band: str) -> bool:
+    return band == "adult"
+
+
+def band_allows_restricted(band: str) -> bool:
+    return band == "adult"
+
+
+def get_maturity_by_targets(target_type: str, uids: list[str]) -> dict[str, dict]:
+    uids = [uid for uid in (uids or []) if uid]
+    if not uids or MATURITY_TABLE not in db.tables:
+        return {}
+    placeholders, params = _in_clause(uids)
+    params["tt"] = target_type
+    rows = db.query(
+        f"SELECT target_uid, level, source FROM {MATURITY_TABLE} "
+        f"WHERE target_type = :tt AND target_uid IN ({placeholders}) "
+        f"AND deleted_at IS NULL",
+        **params,
+    )
+    return {
+        row["target_uid"]: {"level": row["level"], "source": row["source"]}
+        for row in rows
+    }
+
+
+def get_maturity(target_type: str, target_uid: str) -> dict:
+    found = get_maturity_by_targets(target_type, [target_uid])
+    return found.get(target_uid, {"level": "general", "source": ""})
+
+
+def set_maturity(
+    target_type: str, target_uid: str, level: str, source: str, set_by: str
+) -> dict | None:
+    if target_type not in MATURITY_TARGETS or level not in MATURITY_LEVELS:
+        return None
+    from devplacepy.utils import generate_uid
+
+    table = get_table(MATURITY_TABLE)
+    existing = table.find_one(target_type=target_type, target_uid=target_uid)
+    now = _now_iso()
+    if existing:
+        table.update(
+            {
+                "id": existing["id"],
+                "level": level,
+                "source": source,
+                "set_by": set_by,
+                "updated_at": now,
+                "deleted_at": None,
+                "deleted_by": None,
+            },
+            ["id"],
+        )
+        return table.find_one(id=existing["id"])
+    uid = generate_uid()
+    table.insert(
+        {
+            "uid": uid,
+            "target_type": target_type,
+            "target_uid": target_uid,
+            "level": level,
+            "source": source,
+            "set_by": set_by,
+            "created_at": now,
+            "updated_at": now,
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    return table.find_one(uid=uid)
+
+
+def list_consents(owner_kind: str, owner_id: str) -> list[dict]:
+    if not owner_id or CONSENTS_TABLE not in db.tables:
+        return []
+    return list(
+        get_table(CONSENTS_TABLE).find(
+            owner_kind=owner_kind,
+            owner_id=owner_id,
+            deleted_at=None,
+            order_by=["-created_at"],
+        )
+    )
+
+
+def consent_state(owner_kind: str, owner_id: str, kind: str) -> dict | None:
+    if not owner_id or CONSENTS_TABLE not in db.tables:
+        return None
+    rows = list(
+        get_table(CONSENTS_TABLE).find(
+            owner_kind=owner_kind,
+            owner_id=owner_id,
+            kind=kind,
+            deleted_at=None,
+            order_by=["-created_at", "-id"],
+            _limit=1,
+        )
+    )
+    return rows[0] if rows else None
+
+
+def consent_granted(owner_kind: str, owner_id: str, kind: str) -> bool:
+    row = consent_state(owner_kind, owner_id, kind)
+    return bool(row and row.get("state") == "granted")
+
+
+def set_consent(
+    owner_kind: str, owner_id: str, kind: str, granted: bool, version: str = "1"
+) -> dict | None:
+    if kind not in CONSENT_KINDS or not owner_id:
+        return None
+    from devplacepy.utils import generate_uid
+
+    table = get_table(CONSENTS_TABLE)
+    now = _now_iso()
+    current = consent_state(owner_kind, owner_id, kind)
+    if current and not granted and current.get("state") == "granted":
+        table.update({"id": current["id"], "withdrawn_at": now}, ["id"])
+    uid = generate_uid()
+    table.insert(
+        {
+            "uid": uid,
+            "owner_kind": owner_kind,
+            "owner_id": owner_id,
+            "kind": kind,
+            "version": version,
+            "state": "granted" if granted else "withdrawn",
+            "granted_at": now if granted else "",
+            "withdrawn_at": "" if granted else now,
+            "created_at": now,
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    return table.find_one(uid=uid)
+
+
+def suspension_active(user: dict | None) -> bool:
+    if not user:
+        return False
+    until = (user.get("suspended_until") or "").strip()
+    if not until:
+        return False
+    try:
+        expiry = datetime.fromisoformat(until)
+    except ValueError:
+        return False
+    if expiry.tzinfo is None:
+        expiry = expiry.replace(tzinfo=timezone.utc)
+    return expiry > datetime.now(timezone.utc)
diff --git a/devplacepy/database/notifications.py b/devplacepy/database/notifications.py
index 98c77988..11422486 100644
--- a/devplacepy/database/notifications.py
+++ b/devplacepy/database/notifications.py
@@ -20,6 +20,7 @@ NOTIFICATION_TYPES = [
     {"key": "award", "label": "Awards", "description": "Someone gives you an award on your profile"},
     {"key": "quiz_attempt", "label": "Quiz attempts", "description": "Someone completes one of your quizzes"},
     {"key": "workspace", "label": "Dev workspaces", "description": "Idle, quota, retention and moderation notices for your dev workspaces"},
+    {"key": "moderation", "label": "Moderation", "description": "Acknowledgements for reports you file and decisions taken on your content"},
     {"key": "system", "label": "System alerts", "description": "Platform infrastructure alerts (e.g. the AI gateway going down)"},
 ]
 
diff --git a/devplacepy/database/schema.py b/devplacepy/database/schema.py
index 6c5d871f..d4f52a70 100644
--- a/devplacepy/database/schema.py
+++ b/devplacepy/database/schema.py
@@ -277,7 +277,7 @@ def init_db():
         defaults = {
             "site_name": "DevPlace",
             "site_description": "The Developer Social Network",
-            "site_tagline": "Track industry shifts. Discover bold releases. Share what you are building in an open, uncensored environment.",
+            "site_tagline": "Track industry shifts. Discover bold releases. Share what you are building in an open environment built by developers, for developers.",
         }
         for key, value in defaults.items():
             existing = db["site_settings"].find_one(key=key)
@@ -558,6 +558,9 @@ def init_db():
         ("slug", ""),
         ("name", ""),
         ("status", ""),
+        ("created_at", ""),
+        ("owner_uid", ""),
+        ("created_by", ""),
         ("desired_state", ""),
         ("container_id", ""),
         ("ingress_slug", ""),
@@ -1550,6 +1553,8 @@ def init_db():
         ["user_uid", "created_at"],
     )
 
+    _ensure_moderation_tables()
+
     for table in db.tables:
         _uid_index(db, table)
 
@@ -1688,6 +1693,19 @@ def init_db():
             "outbound_proxy_url": "",
             "devii_lessons_max_per_owner": "500",
             "devii_lessons_max_age_days": "90",
+            "moderation_sla_hours": "24",
+            "moderation_filter_mode": "review",
+            "moderation_filter_review_score": "2",
+            "moderation_minimum_age": "16",
+            "moderation_mature_default_hidden": "1",
+            "contact_email": "",
+            "contact_phone": "",
+            "contact_address": "",
+            "terms_version": "1",
+            "privacy_version": "1",
+            "guidelines_version": "1",
+            "ai_third_party_provider": "",
+            "account_deletion_grace_hours": "24",
         }
         for key, value in operational_defaults.items():
             existing = db["site_settings"].find_one(key=key)
@@ -1768,6 +1786,83 @@ def init_db():
     _refresh_query_planner_stats()
 
 
+MODERATION_COLUMNS: dict[str, tuple[tuple[str, object], ...]] = {
+    "content_reports": (
+        ("uid", ""),
+        ("reporter_uid", ""),
+        ("target_type", ""),
+        ("target_uid", ""),
+        ("owner_uid", ""),
+        ("reason", ""),
+        ("detail", ""),
+        ("severity", "warn"),
+        ("status", "open"),
+        ("origin", "member"),
+        ("categories", ""),
+        ("resolved_by", ""),
+        ("resolved_at", ""),
+        ("created_at", ""),
+        ("updated_at", ""),
+    ),
+    "moderation_actions": (
+        ("uid", ""),
+        ("report_uid", ""),
+        ("actor_uid", ""),
+        ("action", ""),
+        ("target_type", ""),
+        ("target_uid", ""),
+        ("subject_uid", ""),
+        ("reason", ""),
+        ("notes", ""),
+        ("expires_at", ""),
+        ("created_at", ""),
+    ),
+    "content_maturity": (
+        ("uid", ""),
+        ("target_type", ""),
+        ("target_uid", ""),
+        ("level", "general"),
+        ("source", ""),
+        ("set_by", ""),
+        ("created_at", ""),
+        ("updated_at", ""),
+    ),
+    "user_consents": (
+        ("uid", ""),
+        ("owner_kind", ""),
+        ("owner_id", ""),
+        ("kind", ""),
+        ("version", "1"),
+        ("state", ""),
+        ("granted_at", ""),
+        ("withdrawn_at", ""),
+        ("created_at", ""),
+    ),
+}
+
+MODERATION_INDEXES: tuple[tuple[str, str, list[str]], ...] = (
+    ("content_reports", "idx_content_reports_queue", ["status", "created_at"]),
+    ("content_reports", "idx_content_reports_target", ["target_type", "target_uid"]),
+    ("content_reports", "idx_content_reports_reporter", ["reporter_uid"]),
+    ("content_reports", "idx_content_reports_owner", ["owner_uid"]),
+    ("moderation_actions", "idx_moderation_actions_report", ["report_uid"]),
+    ("moderation_actions", "idx_moderation_actions_subject", ["subject_uid"]),
+    ("moderation_actions", "idx_moderation_actions_created", ["created_at"]),
+    ("content_maturity", "idx_content_maturity_target", ["target_type", "target_uid"]),
+    ("user_consents", "idx_user_consents_owner", ["owner_kind", "owner_id", "kind"]),
+)
+
+
+def _ensure_moderation_tables() -> None:
+    for table_name, columns in MODERATION_COLUMNS.items():
+        table = get_table(table_name)
+        for column, example in columns:
+            if not table.has_column(column):
+                table.create_column_by_example(column, example)
+    for table_name, index_name, columns in MODERATION_INDEXES:
+        _index(db, table_name, index_name, columns)
+
+
 def _refresh_query_planner_stats() -> None:
     try:
         has_stats = bool(
@@ -1857,6 +1952,22 @@ def backfill_api_keys() -> int:
         users.create_column_by_example("last_award_slug", "")
     if not users.has_column("last_award_uid"):
         users.create_column_by_example("last_award_uid", "")
+    if not users.has_column("terms_version"):
+        users.create_column_by_example("terms_version", "")
+    if not users.has_column("terms_accepted_at"):
+        users.create_column_by_example("terms_accepted_at", "")
+    if not users.has_column("age_band"):
+        users.create_column_by_example("age_band", "")
+    if not users.has_column("age_declared_at"):
+        users.create_column_by_example("age_declared_at", "")
+    if not users.has_column("mature_opt_in"):
+        users.create_column_by_example("mature_opt_in", 0)
+    if not users.has_column("suspended_until"):
+        users.create_column_by_example("suspended_until", "")
+    if not users.has_column("suspension_reason"):
+        users.create_column_by_example("suspension_reason", "")
+    if not users.has_column("deletion_requested_at"):
+        users.create_column_by_example("deletion_requested_at", "")
     with db:
         db.query(
             "UPDATE users SET ai_modifier_enabled = 1 WHERE ai_modifier_enabled IS NULL"
@@ -1871,6 +1982,7 @@ def backfill_api_keys() -> int:
             "UPDATE users SET interactions_enabled = -1 "
             "WHERE interactions_enabled IS NULL"
         )
+        db.query("UPDATE users SET mature_opt_in = 0 WHERE mature_opt_in IS NULL")
     import uuid_utils
 
     updated = 0
diff --git a/devplacepy/database/soft_delete.py b/devplacepy/database/soft_delete.py
index e1d159f5..828e4a41 100644
--- a/devplacepy/database/soft_delete.py
+++ b/devplacepy/database/soft_delete.py
@@ -49,6 +49,10 @@ SOFT_DELETE_TABLES = [
     "quiz_options",
     "quiz_attempts",
     "quiz_answers",
+    "content_reports",
+    "moderation_actions",
+    "content_maturity",
+    "user_consents",
 ]
 
 
diff --git a/devplacepy/docs_api/groups/__init__.py b/devplacepy/docs_api/groups/__init__.py
index 098db81c..5c903a85 100644
--- a/devplacepy/docs_api/groups/__init__.py
+++ b/devplacepy/docs_api/groups/__init__.py
@@ -8,6 +8,7 @@ from . import (
     content,
     profiles,
     messaging,
+    moderation,
     notifications,
     uploads,
     project_files,
@@ -31,6 +32,7 @@ ORDERED_GROUPS = [
     content.GROUP,
     profiles.GROUP,
     messaging.GROUP,
+    moderation.GROUP,
     notifications.GROUP,
     uploads.GROUP,
     project_files.GROUP,
diff --git a/devplacepy/docs_api/groups/auth.py b/devplacepy/docs_api/groups/auth.py
index 7616636f..8ccd758d 100644
--- a/devplacepy/docs_api/groups/auth.py
+++ b/devplacepy/docs_api/groups/auth.py
@@ -50,6 +50,13 @@ as a `422` with the shape `{ "fields": {...}, "messages": [...] }`.
                     field("email", "form", "string", True, "alice@example.com", "Email address; must be unique and contain an @."),
                     field("password", "form", "string", True, "mysecret", "Password, 6+ characters."),
                     field("confirm_password", "form", "string", True, "mysecret", "Must match password."),
+                    field("birth_date", "form", "string", True, "01/01/1990", "Date of birth, DD/MM/YYYY or YYYY-MM-DD. Only the derived age band is stored; the date is discarded."),
+                    field("accept_terms", "form", "enum", True, "1", "Acceptance of the Terms of Service and Community Guidelines.", ["1"]),
+                ],
+                notes=[
+                    "Signup is refused below the platform minimum age (`moderation_minimum_age`).",
+                    "Accepting records the terms, privacy and activity-recording consents; "
+                    "third-party AI processing stays off until it is granted separately.",
                 ],
             ),
             endpoint(
diff --git a/devplacepy/docs_api/groups/moderation.py b/devplacepy/docs_api/groups/moderation.py
new file mode 100644
index 00000000..93c0c2ab
--- /dev/null
+++ b/devplacepy/docs_api/groups/moderation.py
@@ -0,0 +1,489 @@
+# retoor <retoor@molodetz.nl>
+
+from .._shared import endpoint, field
+from devplacepy.database.moderation import (
+    CONSENT_KINDS,
+    MODERATION_ACTIONS,
+    REPORTABLE_TARGETS,
+    REPORT_REASONS,
+    REPORT_STATUSES,
+)
+
+REPORT_TARGETS = list(REPORTABLE_TARGETS)
+REASON_KEYS = list(REPORT_REASONS)
+CONSENT_KEYS = list(CONSENT_KINDS)
+
+SAMPLE_REPORT = {
+    "uid": "REPORT_UID",
+    "target_type": "post",
+    "target_uid": "POST_UID",
+    "target_url": "/posts/a-post",
+    "reason": "harassment",
+    "reason_label": "Harassment or bullying",
+    "detail": "Repeated personal attacks in the thread.",
+    "severity": "warn",
+    "status": "open",
+    "origin": "member",
+    "categories": [],
+    "created_at": "2026-01-05T10:00:00+00:00",
+    "resolved_at": "",
+    "reporter_name": "alice",
+    "owner_name": "bob",
+    "report_count": 2,
+}
+
+GROUP = {
+    "slug": "moderation",
+    "title": "Reporting & Moderation",
+    "intro": """
+# Reporting & Moderation
+
+Every externally visible surface on DevPlace is reportable through one polymorphic
+endpoint, and every report lands in one queue with one state machine. The reason
+list is served by `GET /reports/reasons`, so a native client renders the same
+dialog the web UI does.
+
+DevPlace commits to reviewing every report within the window published on the
+[content moderation](/docs/content-moderation.html) page. Filing a report always
+returns an acknowledgement carrying that window.
+
+The moderation endpoints under `/admin/moderation` are administrator-only and are
+subject to the admin seniority rule: a junior administrator cannot action a more
+senior one.
+
+Every endpoint follows the shared [Conventions & Errors](/docs/conventions.html) (auth, content
+negotiation, pagination, status codes); see [Authentication](/docs/authentication.html) for the
+four ways to sign requests.
+""",
+    "endpoints": [
+        endpoint(
+            id="report-reasons",
+            method="GET",
+            path="/reports/reasons",
+            title="List report reasons",
+            summary="The reason keys a report may be filed under, with their labels.",
+            auth="public",
+            sample_response={
+                "reasons": [{"key": "harassment", "label": "Harassment or bullying"}],
+                "severities": ["info", "warn", "critical"],
+            },
+        ),
+        endpoint(
+            id="report-create",
+            method="POST",
+            path="/reports/{target_type}/{target_uid}",
+            title="Report content",
+            summary="File a report against any user-generated surface.",
+            auth="user",
+            encoding="form",
+            destructive=False,
+            params=[
+                field(
+                    "target_type",
+                    "path",
+                    "enum",
+                    True,
+                    "post",
+                    "The kind of content being reported.",
+                    REPORT_TARGETS,
+                ),
+                field(
+                    "target_uid",
+                    "path",
+                    "string",
+                    True,
+                    "POST_UID",
+                    "UID of the reported item.",
+                ),
+                field(
+                    "reason",
+                    "form",
+                    "enum",
+                    True,
+                    "harassment",
+                    "Why the content breaks the guidelines.",
+                    REASON_KEYS,
+                ),
+                field(
+                    "detail",
+                    "form",
+                    "string",
+                    False,
+                    "",
+                    "Free text for the moderator, up to 2000 characters.",
+                ),
+            ],
+            notes=[
+                "A second report on the same target by the same reporter updates the "
+                "open report instead of creating a duplicate.",
+                "You cannot report your own content.",
+            ],
+            sample_response={
+                "ok": True,
+                "redirect": "/reports/mine",
+                "data": {
+                    "uid": "REPORT_UID",
+                    "status": "open",
+                    "severity": "warn",
+                    "sla_hours": 24,
+                },
+            },
+        ),
+        endpoint(
+            id="reports-mine",
+            method="GET",
+            path="/reports/mine",
+            title="List your reports",
+            summary="The reports you filed and the outcome of each.",
+            auth="user",
+            params=[
+                field(
+                    "status",
+                    "query",
+                    "enum",
+                    False,
+                    "open",
+                    "Filter by report status.",
+                    list(REPORT_STATUSES),
+                ),
+                field("page", "query", "integer", False, "1", "Page number."),
+            ],
+            sample_response={
+                "reports": [SAMPLE_REPORT],
+                "pagination": {"page": 1, "total": 1, "total_pages": 1},
+                "status": "",
+            },
+        ),
+        endpoint(
+            id="admin-moderation",
+            method="GET",
+            path="/admin/moderation",
+            title="The moderation queue",
+            summary="Reported content awaiting a decision, oldest open first.",
+            auth="admin",
+            params=[
+                field(
+                    "status",
+                    "query",
+                    "enum",
+                    False,
+                    "open",
+                    "Filter by report status.",
+                    list(REPORT_STATUSES),
+                ),
+                field("page", "query", "integer", False, "1", "Page number."),
+            ],
+            sample_response={
+                "reports": [SAMPLE_REPORT],
+                "counts": {"open": 1, "acknowledged": 0, "actioned": 0, "dismissed": 0},
+                "sla": {
+                    "sla_hours": 24,
+                    "oldest_open_hours": 1.5,
+                    "breached": 0,
+                    "within_sla": True,
+                },
+            },
+        ),
+        endpoint(
+            id="admin-moderation-report",
+            method="GET",
+            path="/admin/moderation/{uid}",
+            title="Read one report",
+            summary="One report with its decisions and the author's history.",
+            auth="admin",
+            params=[
+                field("uid", "path", "string", True, "REPORT_UID", "Report UID."),
+            ],
+            sample_response={
+                "report": SAMPLE_REPORT,
+                "actions": [],
+                "history": [],
+                "available_actions": list(MODERATION_ACTIONS),
+                "can_remove": True,
+            },
+        ),
+        endpoint(
+            id="admin-moderation-status",
+            method="POST",
+            path="/admin/moderation/{uid}/status",
+            title="Set a report status",
+            summary="Move a report through the triage state machine.",
+            auth="admin",
+            encoding="form",
+            params=[
+                field("uid", "path", "string", True, "REPORT_UID", "Report UID."),
+                field(
+                    "status",
+                    "form",
+                    "enum",
+                    True,
+                    "acknowledged",
+                    "New status.",
+                    list(REPORT_STATUSES),
+                ),
+            ],
+            sample_response={"ok": True, "redirect": "/admin/moderation/REPORT_UID"},
+        ),
+        endpoint(
+            id="admin-moderation-decide",
+            method="POST",
+            path="/admin/moderation/{uid}/decide",
+            title="Decide a report",
+            summary="Apply a moderation decision and notify the affected user.",
+            auth="admin",
+            encoding="form",
+            destructive=True,
+            params=[
+                field("uid", "path", "string", True, "REPORT_UID", "Report UID."),
+                field(
+                    "action",
+                    "form",
+                    "enum",
+                    True,
+                    "dismiss",
+                    "The decision to apply.",
+                    list(MODERATION_ACTIONS),
+                ),
+                field(
+                    "reason",
+                    "form",
+                    "string",
+                    False,
+                    "",
+                    "Reason shown to the affected user.",
+                ),
+                field("notes", "form", "string", False, "", "Internal notes."),
+                field(
+                    "duration_hours",
+                    "form",
+                    "integer",
+                    False,
+                    "24",
+                    "Suspension length in hours.",
+                ),
+            ],
+            notes=[
+                "A report already resolved by another moderator answers 409.",
+                "Content removal is unavailable for targets that have no removal "
+                "path (direct messages, accounts, workspaces, polls, assistant "
+                "output); act on the account instead.",
+            ],
+            sample_response={"ok": True, "redirect": "/admin/moderation/REPORT_UID"},
+        ),
+        endpoint(
+            id="admin-user-suspend",
+            method="POST",
+            path="/admin/users/{uid}/suspend",
+            title="Suspend an account",
+            summary="Suspend an account for a fixed period with a stated reason.",
+            auth="admin",
+            encoding="form",
+            destructive=True,
+            params=[
+                field("uid", "path", "string", True, "USER_UID", "User UID."),
+                field("reason", "form", "string", False, "", "Reason shown to the user."),
+                field(
+                    "duration_hours",
+                    "form",
+                    "integer",
+                    False,
+                    "24",
+                    "Suspension length in hours.",
+                ),
+            ],
+            notes=[
+                "A suspended account can still read, still see why, and still delete "
+                "itself, but cannot create content.",
+            ],
+            sample_response={"ok": True, "redirect": "/admin/users"},
+        ),
+        endpoint(
+            id="admin-user-lift",
+            method="POST",
+            path="/admin/users/{uid}/lift",
+            title="Lift a restriction",
+            summary="Clear a suspension or ban and restore the account.",
+            auth="admin",
+            encoding="form",
+            params=[field("uid", "path", "string", True, "USER_UID", "User UID.")],
+            sample_response={"ok": True, "redirect": "/admin/users"},
+        ),
+        endpoint(
+            id="admin-user-ban",
+            method="POST",
+            path="/admin/users/{uid}/ban",
+            title="Ban an account",
+            summary="Permanently close an account and revoke every credential.",
+            auth="admin",
+            encoding="form",
+            destructive=True,
+            params=[
+                field("uid", "path", "string", True, "USER_UID", "User UID."),
+                field("reason", "form", "string", False, "", "Reason shown to the user."),
+            ],
+            sample_response={"ok": True, "redirect": "/admin/users"},
+        ),
+        endpoint(
+            id="auth-accept-terms-page",
+            method="GET",
+            path="/auth/accept-terms",
+            title="The terms acceptance page",
+            summary="The Terms of Service version in force and the version this account accepted.",
+            auth="user",
+            sample_response={"terms_version": "1", "accepted_version": ""},
+        ),
+        endpoint(
+            id="auth-accept-terms",
+            method="POST",
+            path="/auth/accept-terms",
+            title="Accept the terms",
+            summary="Record acceptance of the Terms of Service version in force.",
+            auth="user",
+            encoding="form",
+            notes=[
+                "A member whose accepted version is behind the version in force is "
+                "redirected here on any mutating request. Reading, the docs, the "
+                "safety controls and account deletion are never blocked.",
+            ],
+            sample_response={"ok": True, "redirect": "/feed", "data": {"terms_version": "1"}},
+        ),
+        endpoint(
+            id="profile-consent",
+            method="POST",
+            path="/profile/{username}/consent",
+            title="Grant or withdraw a consent",
+            summary="Change one consent on your own account. Withdrawal takes effect at once.",
+            auth="user",
+            encoding="form",
+            params=[
+                field("username", "path", "string", True, "USERNAME", "Your own username."),
+                field(
+                    "kind",
+                    "form",
+                    "enum",
+                    True,
+                    "ai_third_party",
+                    "Consent to change.",
+                    CONSENT_KEYS,
+                ),
+                field("granted", "form", "enum", True, "1", "1 grants, 0 withdraws.", ["1", "0"]),
+            ],
+            notes=[
+                "Withdrawing `ai_third_party` makes the AI gateway refuse every call "
+                "that would send your own content to the provider, whatever the "
+                "per-feature preference says.",
+                "Withdrawing `activity_recording` stops presence writes; you simply "
+                "appear offline.",
+                "Only the account holder can change a consent. An administrator "
+                "reads the record but never grants or withdraws it for someone else.",
+            ],
+            sample_response={
+                "ok": True,
+                "redirect": "/profile/USERNAME?tab=privacy",
+                "data": {"kind": "ai_third_party", "state": "granted"},
+            },
+        ),
+        endpoint(
+            id="profile-mature-content",
+            method="POST",
+            path="/profile/{username}/mature-content",
+            title="Set the mature-content preference",
+            summary="Show or hide content labelled mature for your own account.",
+            auth="user",
+            encoding="form",
+            params=[
+                field("username", "path", "string", True, "USERNAME", "Your own username."),
+                field(
+                    "mature_opt_in",
+                    "form",
+                    "enum",
+                    True,
+                    "1",
+                    "1 shows mature content, 0 hides it.",
+                    ["1", "0"],
+                ),
+            ],
+            notes=[
+                "Only the account holder can change this preference. An administrator "
+                "reads the privacy tab but never sets it for someone else.",
+            ],
+            sample_response={
+                "ok": True,
+                "redirect": "/profile/USERNAME?tab=privacy",
+                "data": {"mature_opt_in": True},
+            },
+        ),
+        endpoint(
+            id="profile-delete",
+            method="GET",
+            path="/profile/{username}/delete",
+            title="Account deletion page",
+            summary="What deletion removes, what is retained, and the grace window.",
+            auth="user",
+            params=[
+                field("username", "path", "string", True, "USERNAME", "Your own username."),
+            ],
+            sample_response={
+                "username": "USERNAME",
+                "grace_hours": 24,
+                "removed": ["Your account record, username, email address and password"],
+                "retained": ["Append-only audit and moderation records"],
+            },
+        ),
+        endpoint(
+            id="profile-delete-confirm",
+            method="POST",
+            path="/profile/{username}/delete",
+            title="Delete your account",
+            summary="Permanently delete your account and personal data.",
+            auth="user",
+            encoding="form",
+            destructive=True,
+            params=[
+                field("username", "path", "string", True, "USERNAME", "Your own username."),
+                field("password", "form", "string", True, "PASSWORD", "Your account password."),
+            ],
+            notes=[
+                "Only the account holder can delete an account; an administrator uses "
+                "a ban instead.",
+                "Sessions and tokens are revoked and the profile is anonymised "
+                "immediately; the deletion event is purged after the grace window.",
+            ],
+            sample_response={
+                "ok": True,
+                "redirect": "/",
+                "data": {"stamp": "2026-01-05T10:00:00+00:00", "rows": 42, "grace_hours": 24},
+            },
+        ),
+        endpoint(
+            id="workspaces-index",
+            method="GET",
+            path="/workspaces/index",
+            title="Published workspace index",
+            summary="Every workspace published to the public ingress, with its link.",
+            auth="public",
+            params=[field("page", "query", "integer", False, "1", "Page number.")],
+            notes=[
+                "The project-derived `description` and `project_url` come back empty "
+                "unless you may view the workspace's project, so a private project "
+                "never leaks its title or description through this public listing.",
+            ],
+            sample_response={
+                "workspaces": [
+                    {
+                        "uid": "INSTANCE_UID",
+                        "name": "demo",
+                        "slug": "demo",
+                        "owner_uid": "USER_UID",
+                        "url": "{{ base }}/p/demo",
+                        "description": "A demo workspace.",
+                        "owner": "alice",
+                        "maturity": "general",
+                        "project_url": "/projects/demo",
+                    }
+                ],
+                "total": 1,
+            },
+        ),
+    ],
+}
diff --git a/devplacepy/main.py b/devplacepy/main.py
index 891623a6..8f11555d 100644
--- a/devplacepy/main.py
+++ b/devplacepy/main.py
@@ -72,6 +72,7 @@ from devplacepy.routers import (
     push,
     leaderboard,
     reactions,
+    reports,
     bookmarks,
     polls,
     docs,
@@ -86,6 +87,7 @@ from devplacepy.routers import (
     dbapi,
     pubsub,
     game,
+    workspaces,
 )
 from devplacepy.services.manager import service_manager
 from devplacepy.services.background import background
@@ -115,6 +117,8 @@ from devplacepy.services.containers.service import ContainerService
 from devplacepy.services.containers.workspace_service import WorkspaceService
 from devplacepy.services.xmlrpc import XmlrpcService
 from devplacepy.services.audit import AuditService
+from devplacepy.services.moderation.service import ModerationService
+from devplacepy.services.moderation.screening import ContentRefused
 from devplacepy.services.audit import record as audit
 from devplacepy.services.push import PushService
 from devplacepy.services.telegram import TelegramService
@@ -278,6 +282,7 @@ async def lifespan(app: FastAPI):
     service_manager.register(WorkspaceService())
     service_manager.register(XmlrpcService())
     service_manager.register(AuditService())
+    service_manager.register(ModerationService())
     service_manager.register(PushService())
     service_manager.register(TelegramService())
     service_manager.register(TelegramOutboxService())
@@ -371,6 +376,30 @@ async def server_error(request: Request, exc):
     )
 
 
+@app.exception_handler(ContentRefused)
+async def content_refused(request: Request, exc: ContentRefused):
+    logger.info("content refused on %s %s: %s", request.method, request.url.path, exc.message)
+    if wants_json(request):
+        return json_error(400, exc.message, categories=list(exc.categories))
+    seo_ctx = base_seo_context(
+        request,
+        title="Content not published - DevPlace",
+        description=exc.message,
+        robots="noindex",
+    )
+    return templates.TemplateResponse(
+        request,
+        "error.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "error_code": 400,
+            "error_message": exc.message,
+        },
+        status_code=400,
+    )
+
+
 _AUTH_FORM_PAGES = {
     "/auth/signup": ("signup.html", "Join DevPlace"),
     "/auth/login": ("login.html", "Sign In"),
@@ -441,6 +470,7 @@ app.include_router(messages.router, prefix="/messages")
 app.include_router(notifications.router, prefix="/notifications")
 app.include_router(votes.router, prefix="/votes")
 app.include_router(reactions.router, prefix="/reactions")
+app.include_router(reports.router, prefix="/reports")
 app.include_router(bookmarks.router, prefix="/bookmarks")
 app.include_router(polls.router, prefix="/polls")
 app.include_router(avatar.router, prefix="/avatar")
@@ -469,6 +499,7 @@ app.include_router(dbapi.router, prefix="/dbapi")
 app.include_router(pubsub.router, prefix="/pubsub")
 app.include_router(game.router, prefix="/game")
 app.include_router(quizzes.router, prefix="/quizzes")
+app.include_router(workspaces.router, prefix="/workspaces")
 
 
 @app.middleware("http")
@@ -589,6 +620,43 @@ async def maintenance_middleware(request: Request, call_next):
     )
 
 
+_TERMS_ALLOWED_PREFIXES = (
+    "/static",
+    "/avatar",
+    "/auth",
+    "/docs",
+    "/reports",
+    "/block",
+    "/mute",
+    "/openai",
+)
+
+_TERMS_GATED_METHODS = ("POST", "PUT", "DELETE", "PATCH")
+
+
+def _terms_exempt(path: str) -> bool:
+    if path.startswith(_TERMS_ALLOWED_PREFIXES):
+        return True
+    return path.startswith("/profile/") and (
+        path.endswith("/delete") or path.endswith("/consent")
+    )
+
+
+@app.middleware("http")
+async def terms_acceptance_gate(request: Request, call_next):
+    if request.method not in _TERMS_GATED_METHODS or _terms_exempt(request.url.path):
+        return await call_next(request)
+    from devplacepy.routers.auth.terms import needs_acceptance
+
+    user = get_current_user(request)
+    if not needs_acceptance(user):
+        return await call_next(request)
+    message = "Accept the updated Terms of Service to continue."
+    if wants_json(request):
+        return json_error(403, message, redirect="/auth/accept-terms")
+    return RedirectResponse(url="/auth/accept-terms", status_code=303)
+
+
 @app.middleware("http")
 async def track_presence(request: Request, call_next):
     path = request.url.path
@@ -741,7 +809,7 @@ async def landing(request: Request):
     seo_ctx = base_seo_context(
         request,
         title="DevPlace - The Developer Social Network",
-        description="Track industry shifts. Discover bold releases. Share what you're building in an open, uncensored environment.",
+        description="Track industry shifts. Discover bold releases. Share what you're building in an open environment built by developers, for developers.",
         breadcrumbs=[],
         schemas=[website_schema(base)],
     )
diff --git a/devplacepy/models.py b/devplacepy/models.py
index f64e267b..dec1bdf1 100644
--- a/devplacepy/models.py
+++ b/devplacepy/models.py
@@ -48,11 +48,53 @@ def normalize_poll_options(value):
     return value
 
 
+def _declared_age(birth_date: str) -> int:
+    from datetime import date
+
+    from devplacepy.database.moderation import years_between
+
+    normalized = normalize_european_date(birth_date)
+    if not normalized:
+        raise ValueError("Date of birth is required")
+    born = date.fromisoformat(normalized)
+    today = date.today()
+    if born > today:
+        raise ValueError("Date of birth cannot be in the future")
+    return years_between(born, today)
+
+
 class SignupForm(BaseModel):
     username: str = Field(min_length=3, max_length=32)
     email: str = Field(min_length=1, max_length=255)
     password: str = Field(min_length=6, max_length=128)
     confirm_password: str = Field(min_length=1, max_length=128)
+    birth_date: str = Field(min_length=1, max_length=20)
+    accept_terms: str = Field(default="")
+
+    @property
+    def age_band(self) -> str:
+        from devplacepy.database.moderation import age_band_for
+
+        return age_band_for(_declared_age(self.birth_date))
+
+    @field_validator("birth_date")
+    @classmethod
+    def old_enough(cls, value):
+        from devplacepy.database import minimum_age
+
+        minimum = minimum_age()
+        if _declared_age(value) < minimum:
+            raise ValueError(f"You must be at least {minimum} years old to join")
+        return value
+
+    @field_validator("accept_terms")
+    @classmethod
+    def terms_accepted(cls, value):
+        if value.strip().lower() not in ("1", "on", "true", "yes"):
+            raise ValueError(
+                "You must accept the Terms of Service and Community Guidelines"
+            )
+        return value
 
     @field_validator("username")
     @classmethod
@@ -63,6 +105,10 @@ class SignupForm(BaseModel):
             raise ValueError(
                 "Username can only contain letters, numbers, hyphens, and underscores"
             )
+        from devplacepy.services.moderation.filter import classify
+
+        if classify(value).verdict == "block":
+            raise ValueError("That username breaks the community guidelines")
         return value
 
     @field_validator("email")
@@ -587,8 +633,29 @@ class AdminSettingsForm(BaseModel):
     maintenance_message: str = Field(default="", max_length=300)
     docs_search_mode: str = Field(default="", max_length=20)
     outbound_proxy_url: str = Field(default="", max_length=500)
+    moderation_sla_hours: str = Field(default="", max_length=10)
+    moderation_filter_mode: str = Field(default="", max_length=10)
+    moderation_minimum_age: str = Field(default="", max_length=3)
+    moderation_mature_default_hidden: str = Field(default="", max_length=1)
+    account_deletion_grace_hours: str = Field(default="", max_length=10)
+    contact_email: str = Field(default="", max_length=200)
+    contact_phone: str = Field(default="", max_length=60)
+    contact_address: str = Field(default="", max_length=500)
+    terms_version: str = Field(default="", max_length=20)
+    privacy_version: str = Field(default="", max_length=20)
+    guidelines_version: str = Field(default="", max_length=20)
+    ai_third_party_provider: str = Field(default="", max_length=120)
     extra_head: str = Field(default="", max_length=50000)
 
+    @field_validator("moderation_filter_mode")
+    @classmethod
+    def validate_filter_mode(cls, value):
+        from devplacepy.services.moderation.rules import FILTER_MODES
+
+        if value and value not in FILTER_MODES:
+            raise ValueError(f"Filter mode must be one of {', '.join(FILTER_MODES)}")
+        return value
+
     @field_validator("outbound_proxy_url")
     @classmethod
     def validate_outbound_proxy_url(cls, value):
@@ -911,3 +978,91 @@ class WorkspaceFlagForm(BaseModel):
 
 class WorkspaceSuspendForm(BaseModel):
     reason: str = Field(default="", max_length=500)
+
+
+class ReportForm(BaseModel):
+    reason: str = Field(min_length=1, max_length=40)
+    detail: str = Field(default="", max_length=2000)
+
+    @field_validator("reason")
+    @classmethod
+    def known_reason(cls, value):
+        from devplacepy.database.moderation import REPORT_REASONS
+
+        if value not in REPORT_REASONS:
+            raise ValueError("Unknown report reason")
+        return value
+
+
+class ReportStatusForm(BaseModel):
+    status: str = Field(default="acknowledged", max_length=20)
+
+    @field_validator("status")
+    @classmethod
+    def known_status(cls, value):
+        from devplacepy.database.moderation import REPORT_STATUSES
+
+        if value not in REPORT_STATUSES:
+            raise ValueError("Unknown report status")
+        return value
+
+
+class ModerationDecisionForm(BaseModel):
+    action: str = Field(min_length=1, max_length=30)
+    reason: str = Field(default="", max_length=200)
+    notes: str = Field(default="", max_length=2000)
+    duration_hours: int = Field(default=24, ge=1, le=8760)
+
+    @field_validator("action")
+    @classmethod
+    def known_action(cls, value):
+        from devplacepy.database.moderation import MODERATION_ACTIONS
+
+        if value not in MODERATION_ACTIONS:
+            raise ValueError("Unknown moderation action")
+        return value
+
+
+class SuspensionForm(BaseModel):
+    reason: str = Field(default="", max_length=200)
+    duration_hours: int = Field(default=24, ge=1, le=8760)
+
+
+class BanForm(BaseModel):
+    reason: str = Field(default="", max_length=200)
+
+
+class ConsentForm(BaseModel):
+    kind: str = Field(min_length=1, max_length=40)
+    granted: str = Field(default="0", max_length=5)
+
+    @field_validator("kind")
+    @classmethod
+    def known_kind(cls, value):
+        from devplacepy.database.moderation import CONSENT_KINDS
+
+        if value not in CONSENT_KINDS:
+            raise ValueError("Unknown consent kind")
+        return value
+
+
+class MaturityForm(BaseModel):
+    level: str = Field(default="general", max_length=20)
+
+    @field_validator("level")
+    @classmethod
+    def known_level(cls, value):
+        from devplacepy.database.moderation import MATURITY_LEVELS
+
+        if value not in MATURITY_LEVELS:
+            raise ValueError("Unknown maturity level")
+        return value
+
+
+class MaturePreferenceForm(BaseModel):
+    mature_opt_in: str = Field(default="0", max_length=5)
+
+
+class AccountDeleteForm(BaseModel):
+    password: str = Field(min_length=1, max_length=128)
+    confirm_text: str = Field(default="", max_length=40)
diff --git a/devplacepy/routers/CLAUDE.md b/devplacepy/routers/CLAUDE.md
index ef252f1e..344f29ca 100644
--- a/devplacepy/routers/CLAUDE.md
+++ b/devplacepy/routers/CLAUDE.md
@@ -23,9 +23,11 @@ Prefixes are wired in `main.py`:
 | `/polls` | polls.py - poll voting: `POST /polls/{poll_uid}/vote` |
 | `/avatar` | avatar.py |
 | `/follow` | follow.py |
+| `/reports` | reports.py - polymorphic content reporting: `POST /reports/{target_type}/{target_uid}` (member), `GET /reports/mine` (member), `GET /reports/reasons` (public). See `devplacepy/services/moderation/CLAUDE.md` |
+| `/workspaces` | workspaces.py - `GET /workspaces/index`, the public index of every workspace published to the `/p/{slug}` ingress, with owner, project, maturity label and absolute link. Indexed in the sitemap. Publishing an ingress slug is the deliberate public act, so the workspace itself is always listed, but the project-derived fields (`description` and `project_url`, whose slug carries the project title) are withheld unless `content.can_view_project(project, viewer)` passes - a private project must not leak its title or description through this public listing |
 | (none) | relations.py - per-user block/mute relations: `POST /block/{username}`, `/block/unblock/{username}`, `/mute/{username}`, `/mute/unmute/{username}` (soft-deletable `user_relations` rows) |
 | `/leaderboard` | leaderboard.py - `GET /leaderboard` XP/stars leaderboard page |
-| `/admin` | admin/ package - one leaf per sub-resource (`index`, `users`, `aiusage`, `aiquota`, `media`, `trash`, `settings`, `notifications`, `news`, `auditlog`, `backups`, `game`) plus the folded-in `services.py` and `containers.py` (mounted with `/services` and `/containers` sub-prefixes). `main.py` mounts the whole `/admin` tree from this one package. The `backups` leaf is the admin **Backups** dashboard (`BackupService`, kind `backup`): storage usage, backup archives, and interval/cron backup schedules (CRUD + rotation). **Archive download is restricted to the primary administrator** (the earliest-created Admin, resolved by `database.get_primary_admin_uid` / `utils.is_primary_admin`): `GET /admin/backups/{uid}/download` 403s every other admin, the `download_url` field is withheld from them at every endpoint (`can_download = is_primary_admin(admin)`, surfaced as `BackupDashboardOut.can_download_backups`), and `BackupMonitor.js` renders their Download control as a disabled button tooltipped `Not available`. See `devplacepy/services/backup/CLAUDE.md`. The `game` leaf (`/admin/game`) is the Code Farm Era admin page: `GET /admin/game` (status), `POST /admin/game/era/start` and `/era/end` - see `devplacepy/services/game/CLAUDE.md` |
+| `/admin` | admin/ package - one leaf per sub-resource (`index`, `users`, `aiusage`, `aiquota`, `media`, `trash`, `settings`, `notifications`, `news`, `auditlog`, `backups`, `game`) plus the folded-in `services.py` and `containers.py` (mounted with `/services` and `/containers` sub-prefixes). `main.py` mounts the whole `/admin` tree from this one package. The `backups` leaf is the admin **Backups** dashboard (`BackupService`, kind `backup`): storage usage, backup archives, and interval/cron backup schedules (CRUD + rotation). **Archive download is restricted to the primary administrator** (the earliest-created Admin, resolved by `database.get_primary_admin_uid` / `utils.is_primary_admin`): `GET /admin/backups/{uid}/download` 403s every other admin, the `download_url` field is withheld from them at every endpoint (`can_download = is_primary_admin(admin)`, surfaced as `BackupDashboardOut.can_download_backups`), and `BackupMonitor.js` renders their Download control as a disabled button tooltipped `Not available`. See `devplacepy/services/backup/CLAUDE.md`. The `moderation` leaf (`/admin/moderation`) is the report queue: the list (oldest-open-first, status tabs, the SLA badge), the per-report detail with the offender's history, `POST /{uid}/status` for triage and `POST /{uid}/decide` for decisions; the per-user enforcement routes `POST /admin/users/{uid}/{suspend,lift,ban}` live in the `users` leaf alongside the legacy `toggle`. Both share `is_senior_admin`/`deny_senior` from `admin/_shared.py`. The `game` leaf (`/admin/game`) is the Code Farm Era admin page: `GET /admin/game` (status), `POST /admin/game/era/start` and `/era/end` - see `devplacepy/services/game/CLAUDE.md` |
 | `/admin/services` | admin/services.py |
 | `/issues` | issues/ package - issue tracker backed by Gitea (no local issue store): `index.py` (list `?state=`/`?page=`, detail `/{number}` with comments), `create.py` (async AI-enhanced filing `/create` enqueues a `issue_create` job, status at `/jobs/{uid}`), `comment.py` (synchronous, pushes to Gitea + notifies admins), `status.py` (admin open/closed), `attachments.py` (file attachments on open issues + comments, mirrored to Gitea native assets; add/list/delete with owner-or-admin + open-state guards) |
 | `/gists` | gists.py |
@@ -315,6 +317,14 @@ All SEO features are implemented across the following locations:
 - `database.py` helpers: `get_follow_counts(uid)` (`{followers, following}`), `get_follow_list(uid, mode, page)` (paginated people + `build_pagination`, ordered newest-first), and `get_following_among(follower_uid, target_uids)` (single IN-clause set used to set `is_following` per row, avoiding N+1). `mode` is `"followers"` (people who follow `uid`) or `"following"` (people `uid` follows).
 - Devii catalog tools `list_followers` / `list_following` (`requires_auth=False`) map to the JSON endpoints; documented in `docs_api.py` under the `profiles` group.
 
+### Reporting and moderation
+
+`_report_button.html` is the single report control, included with the same two-variable idiom as `_reaction_bar.html` at **fifteen** sites (`_post_card`, `_comment`, `post`, `gist_detail`, `project_detail`, `news_detail`, `quiz`, `_media_gallery`, `_awards_gallery`, `messages`, `profile`, `project_files`, `issue_detail`, `containers_instance`, `workspace_index`). Locals: `_type`, `_uid`, `_owner` (owner uid, so the control hides on your own content), `_owner_name` (optional; when present the partial also renders the **Block** form, which is what makes blocking reachable from the content rather than only from a profile) and `_class` (the surrounding button class so it inherits each surface's visual language).
+
+`_report_dialog.html` is included once in `base.html` for signed-in users and driven by `static/js/ReportDialog.js` (`app.reportDialog`) through the standard `.modal-overlay`/`.visible` pattern and `Http.sendForm`. The reason list is the `REPORT_REASONS` Jinja global, sourced from `database/moderation.py`, so the dialog, the API enum, the docs enum and the guidelines page can never drift.
+
+An e2e coverage test asserts the control is reachable on every include site; the registry test asserts every reportable target resolves. See `devplacepy/services/moderation/CLAUDE.md`.
+
 ### Block and mute (`routers/relations.py`)
 A logged-in user can **block** or **mute** another user; both are one-directional and reversible. **Block** hides every piece of the blocked user's content from the blocker - posts, comments (any category), feed, listings, issue list, detail pages, and DMs - everywhere EXCEPT the blocked user's own profile page (kept fully visible so the blocker can review and unblock), and it also suppresses any notification that user would generate. **Mute** is the lighter option: it only suppresses the muted user's notifications while their content stays visible. The blocked/muted user is unaffected and is not told.
 
diff --git a/devplacepy/routers/admin/__init__.py b/devplacepy/routers/admin/__init__.py
index e0080dce..94290618 100644
--- a/devplacepy/routers/admin/__init__.py
+++ b/devplacepy/routers/admin/__init__.py
@@ -14,6 +14,7 @@ from devplacepy.routers.admin import (
     gateway_configs,
     issues,
     media,
+    moderation,
     news,
     notifications,
     services,
@@ -30,6 +31,7 @@ router.include_router(aiusage.router)
 router.include_router(statistics.router)
 router.include_router(aiquota.router)
 router.include_router(media.router)
+router.include_router(moderation.router)
 router.include_router(trash.router)
 router.include_router(settings.router)
 router.include_router(notifications.router)
diff --git a/devplacepy/routers/admin/_shared.py b/devplacepy/routers/admin/_shared.py
index 6bc188d2..81b4621a 100644
--- a/devplacepy/routers/admin/_shared.py
+++ b/devplacepy/routers/admin/_shared.py
@@ -2,6 +2,45 @@
 
 import json
 
+from fastapi import Request
+
+from devplacepy.responses import action_result
+from devplacepy.services.audit import record as audit
+
+
+def seniority_key(user: dict) -> tuple[str, int]:
+    return (user.get("created_at") or "", user.get("id") or 0)
+
+
+def is_senior_admin(actor: dict, target: dict | None) -> bool:
+    if not target or target.get("role") != "Admin":
+        return False
+    if target.get("uid") == actor.get("uid"):
+        return False
+    return seniority_key(target) < seniority_key(actor)
+
+
+def deny_senior(
+    request: Request,
+    admin: dict,
+    uid: str,
+    target: dict,
+    event_key: str,
+    redirect_url: str = "/admin/users",
+):
+    audit.record(
+        request,
+        event_key,
+        user=admin,
+        result="denied",
+        target_type="user",
+        target_uid=uid,
+        target_label=target.get("username"),
+        summary=f"admin {admin['username']} cannot manage senior admin {target.get('username')}",
+        links=[audit.target("user", uid, target.get("username"))],
+    )
+    return action_result(request, redirect_url)
+
 
 def parse_metadata(raw: str | dict | None) -> dict | None:
     if not raw:
diff --git a/devplacepy/routers/admin/moderation.py b/devplacepy/routers/admin/moderation.py
new file mode 100644
index 00000000..ef9ddd2d
--- /dev/null
+++ b/devplacepy/routers/admin/moderation.py
@@ -0,0 +1,323 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+
+from devplacepy.database import (
+    REPORT_STATUSES,
+    SYSTEM_ACTOR,
+    get_table,
+    get_users_by_uids,
+)
+from devplacepy.dependencies import json_or_form
+from devplacepy.models import ModerationDecisionForm, ReportStatusForm
+from devplacepy.responses import action_result, json_error, respond
+from devplacepy.routers.admin._shared import deny_senior, is_senior_admin
+from devplacepy.schemas import AdminModerationOut, AdminReportOut
+from devplacepy.seo import base_seo_context, site_url, website_schema
+from devplacepy.services.audit import record as audit
+from devplacepy.services.moderation import enforcement, queue, sla
+from devplacepy.utils import create_notification, not_found, require_admin
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+QUEUE_URL = "/admin/moderation"
+
+STATUS_TABS = [
+    {"key": "open", "label": "Open"},
+    {"key": "acknowledged", "label": "Acknowledged"},
+    {"key": "actioned", "label": "Actioned"},
+    {"key": "dismissed", "label": "Dismissed"},
+]
+
+SUBJECT_ACTIONS = ("warn", "suspend", "ban", "lift")
+
+ENFORCEMENT_EVENTS = {
+    "remove_content": "moderation.remove",
+    "restore_content": "moderation.restore",
+    "warn": "moderation.warn",
+    "suspend": "moderation.suspend",
+    "ban": "moderation.ban",
+    "lift": "moderation.lift",
+}
+
+DECISION_MESSAGES = {
+    "remove_content": "Your {target} was removed after a moderation review.",
+    "restore_content": "Your {target} was restored after a moderation review.",
+    "warn": "A moderator issued a warning about your {target}.",
+    "suspend": "Your account is suspended following a moderation review.",
+    "ban": "Your account has been closed following a moderation review.",
+    "lift": "Your account restriction has been lifted.",
+}
+
+
+def _breadcrumbs(extra: list[dict] | None = None) -> list[dict]:
+    trail = [
+        {"name": "Home", "url": "/feed"},
+        {"name": "Admin", "url": "/admin"},
+        {"name": "Moderation", "url": QUEUE_URL},
+    ]
+    return trail + (extra or [])
+
+
+def _available_actions(target_type: str) -> list[str]:
+    actions = ["dismiss", "escalate"]
+    if enforcement.can_remove(target_type):
+        actions = ["remove_content", "restore_content"] + actions
+    return actions + list(SUBJECT_ACTIONS)
+
+
+def _subject(report: dict) -> dict | None:
+    owner_uid = report.get("owner_uid") or ""
+    if not owner_uid:
+        return None
+    return get_users_by_uids([owner_uid]).get(owner_uid)
+
+
+def _action_view(rows: list[dict]) -> list[dict]:
+    actors = get_users_by_uids([row.get("actor_uid") for row in rows if row.get("actor_uid")])
+    view = []
+    for row in rows:
+        actor = actors.get(row.get("actor_uid"))
+        view.append(
+            {
+                "uid": row["uid"],
+                "report_uid": row.get("report_uid", ""),
+                "action": row.get("action", ""),
+                "actor_name": actor["username"] if actor else row.get("actor_uid", ""),
+                "reason": row.get("reason", ""),
+                "notes": row.get("notes", ""),
+                "expires_at": row.get("expires_at", ""),
+                "created_at": row.get("created_at", ""),
+            }
+        )
+    return view
+
+
+@router.get("/moderation", response_class=HTMLResponse)
+async def admin_moderation(request: Request, status: str = "open", page: int = 1):
+    admin = require_admin(request)
+    if status not in REPORT_STATUSES:
+        status = "open"
+    reports, pagination = queue.list_reports(status=status, page=page)
+    counts = queue.status_counts()
+    base = site_url(request)
+    seo_ctx = base_seo_context(
+        request,
+        title="Moderation - Admin",
+        description="Triage reported content and apply moderation decisions.",
+        robots="noindex,nofollow",
+        breadcrumbs=_breadcrumbs(),
+        schemas=[website_schema(base)],
+    )
+    return respond(
+        request,
+        "admin_moderation.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "user": admin,
+            "reports": reports,
+            "pagination": pagination,
+            "status": status,
+            "statuses": [
+                {**tab, "count": counts.get(tab["key"], 0), "active": tab["key"] == status}
+                for tab in STATUS_TABS
+            ],
+            "counts": counts,
+            "sla": sla.snapshot(),
+            "admin_section": "moderation",
+        },
+        model=AdminModerationOut,
+    )
+
+
+@router.get("/moderation/{uid}", response_class=HTMLResponse)
+async def admin_report_detail(request: Request, uid: str):
+    admin = require_admin(request)
+    report = queue.get_report(uid)
+    if not report:
+        raise not_found("Report not found")
+    view = queue.enrich_reports([report])[0]
+    subject = _subject(report)
+    base = site_url(request)
+    seo_ctx = base_seo_context(
+        request,
+        title=f"Report {uid} - Admin",
+        description="One reported item and the decisions taken on it.",
+        robots="noindex,nofollow",
+        breadcrumbs=_breadcrumbs([{"name": "Report", "url": f"{QUEUE_URL}/{uid}"}]),
+        schemas=[website_schema(base)],
+    )
+    return respond(
+        request,
+        "admin_report.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "user": admin,
+            "report": view,
+            "actions": _action_view(queue.actions_for_report(uid)),
+            "history": _action_view(
+                queue.actions_for_subject(report.get("owner_uid", ""))
+            ),
+            "available_actions": _available_actions(report["target_type"]),
+            "can_remove": enforcement.can_remove(report["target_type"]),
+            "subject": subject,
+            "sla": sla.snapshot(),
+            "admin_section": "moderation",
+        },
+        model=AdminReportOut,
+    )
+
+
+@router.post("/moderation/{uid}/status")
+async def admin_report_status(
+    request: Request,
+    uid: str,
+    data: Annotated[ReportStatusForm, Depends(json_or_form(ReportStatusForm))],
+):
+    admin = require_admin(request)
+    report = queue.get_report(uid)
+    if not report:
+        raise not_found("Report not found")
+    updated = queue.set_status(uid, data.status, admin["uid"])
+    if not updated:
+        return json_error(400, "Report status could not be changed")
+    logger.info(f"Admin {admin['username']} set report {uid} to {data.status}")
+    audit.record(
+        request,
+        "report.status",
+        user=admin,
+        target_type=report["target_type"],
+        target_uid=report["target_uid"],
+        old_value=report.get("status"),
+        new_value=data.status,
+        metadata={"report_uid": uid},
+        summary=f"{admin['username']} set report {uid} to {data.status}",
+        links=[audit.target(report["target_type"], report["target_uid"])],
+    )
+    return action_result(request, f"{QUEUE_URL}/{uid}")
+
+
+@router.post("/moderation/{uid}/decide")
+async def admin_report_decide(
+    request: Request,
+    uid: str,
+    data: Annotated[ModerationDecisionForm, Depends(json_or_form(ModerationDecisionForm))],
+):
+    admin = require_admin(request)
+    report = queue.get_report(uid)
+    if not report:
+        raise not_found("Report not found")
+    action = data.action
+    if action not in _available_actions(report["target_type"]):
+        return json_error(400, "That action does not apply to this target")
+    subject = _subject(report)
+    if action in SUBJECT_ACTIONS:
+        if not subject:
+            return json_error(400, "This report has no account to act on")
+        if is_senior_admin(admin, subject):
+            return deny_senior(
+                request,
+                admin,
+                subject["uid"],
+                subject,
+                f"moderation.{action}",
+                redirect_url=f"{QUEUE_URL}/{uid}",
+            )
+    if action == "escalate":
+        queue.escalate(uid)
+    else:
+        outcome = "dismissed" if action == "dismiss" else "actioned"
+        if not queue.claim_open(uid, outcome, admin["uid"]):
+            return json_error(409, "This report was already resolved")
+    expires_at = ""
+    if action == "remove_content":
+        enforcement.remove_content(
+            request, admin, report["target_type"], report["target_uid"]
+        )
+    elif action == "restore_content":
+        enforcement.restore_content(report["target_type"], report["target_uid"])
+    elif action == "suspend":
+        expires_at = enforcement.suspend_user(subject, data.duration_hours, data.reason)
+    elif action == "ban":
+        enforcement.ban_user(subject, data.reason)
+    elif action == "lift":
+        enforcement.lift_suspension(subject)
+        enforcement.unban_user(subject)
+    queue.record_action(
+        report_uid=uid,
+        actor_uid=admin["uid"],
+        action=action,
+        target_type=report["target_type"],
+        target_uid=report["target_uid"],
+        subject_uid=subject["uid"] if subject else "",
+        reason=data.reason,
+        notes=data.notes,
+        expires_at=expires_at,
+    )
+    logger.info(f"Admin {admin['username']} applied {action} to report {uid}")
+    metadata = {
+        "report_uid": uid,
+        "action": action,
+        "reason": data.reason,
+        "subject_uid": subject["uid"] if subject else "",
+    }
+    links = [audit.target(report["target_type"], report["target_uid"])]
+    audit.record(
+        request,
+        "report.decide",
+        user=admin,
+        target_type=report["target_type"],
+        target_uid=report["target_uid"],
+        metadata=metadata,
+        summary=f"{admin['username']} applied {action} on report {uid}",
+        links=links,
+    )
+    enforcement_key = ENFORCEMENT_EVENTS.get(action)
+    if enforcement_key:
+        audit.record(
+            request,
+            enforcement_key,
+            user=admin,
+            target_type=report["target_type"],
+            target_uid=report["target_uid"],
+            metadata=metadata,
+            summary=f"{admin['username']} applied {action} from report {uid}",
+            links=links,
+        )
+    _notify_subject(subject, action, report, data.reason)
+    if action != "escalate":
+        _notify_reporter(report, action)
+    return action_result(request, f"{QUEUE_URL}/{uid}")
+
+
+def _notify_subject(subject: dict | None, action: str, report: dict, reason: str) -> None:
+    template = DECISION_MESSAGES.get(action)
+    if not subject or not template:
+        return
+    message = template.format(target=report["target_type"])
+    if reason:
+        message = f"{message} Reason: {reason}."
+    enforcement.notify_subject(subject["uid"], message)
+
+
+def _notify_reporter(report: dict, action: str) -> None:
+    reporter_uid = report.get("reporter_uid") or ""
+    if not reporter_uid or reporter_uid == SYSTEM_ACTOR:
+        return
+    if not get_table("users").find_one(uid=reporter_uid):
+        return
+    verb = "dismissed" if action == "dismiss" else "actioned"
+    create_notification(
+        reporter_uid,
+        "moderation",
+        f"Your report on a {report['target_type']} was {verb}.",
+        reporter_uid,
+        "/reports/mine",
+    )
diff --git a/devplacepy/routers/admin/users.py b/devplacepy/routers/admin/users.py
index 7079f77e..b9c52e03 100644
--- a/devplacepy/routers/admin/users.py
+++ b/devplacepy/routers/admin/users.py
@@ -4,7 +4,7 @@ import logging
 from typing import Annotated
 from fastapi import Depends, APIRouter, Request
 from fastapi.responses import HTMLResponse, JSONResponse
-from devplacepy.models import AdminRoleForm, AdminPasswordForm
+from devplacepy.models import AdminRoleForm, AdminPasswordForm, BanForm, SuspensionForm
 from devplacepy.database import (
     get_table,
     build_pagination,
@@ -21,37 +21,16 @@ from devplacepy.seo import base_seo_context, site_url, website_schema
 from devplacepy.responses import respond, action_result
 from devplacepy.schemas import AdminUsersOut, UserAiUsageOut
 from devplacepy.services.audit import record as audit
+from devplacepy.services.moderation import enforcement, queue
 from devplacepy.services.manager import service_manager
 from devplacepy.services.openai_gateway.analytics import build_user_usage
 from devplacepy.services.openai_gateway.usage import pricing_from_cfg
 from devplacepy.dependencies import json_or_form
+from devplacepy.routers.admin._shared import deny_senior, is_senior_admin
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
 
-def _seniority_key(u: dict) -> tuple[str, int]:
-    return (u.get("created_at") or "", u.get("id") or 0)
-
-def _is_senior_admin(actor: dict, target: dict | None) -> bool:
-    if not target or target.get("role") != "Admin":
-        return False
-    if target.get("uid") == actor.get("uid"):
-        return False
-    return _seniority_key(target) < _seniority_key(actor)
-
-def _deny_senior(request: Request, admin: dict, uid: str, target: dict, event_key: str):
-    audit.record(
-        request,
-        event_key,
-        user=admin,
-        result="denied",
-        target_type="user",
-        target_uid=uid,
-        target_label=target.get("username"),
-        summary=f"admin {admin['username']} cannot manage senior admin {target.get('username')}",
-        links=[audit.target("user", uid, target.get("username"))],
-    )
-    return action_result(request, "/admin/users")
 
 @router.get("/users/{uid}/ai-usage")
 async def admin_user_ai_usage(request: Request, uid: str, hours: int = 24):
@@ -124,8 +103,8 @@ async def admin_user_role(
         return action_result(request, "/admin/users")
     users = get_table("users")
     target_user = users.find_one(uid=uid)
-    if _is_senior_admin(admin, target_user):
-        return _deny_senior(request, admin, uid, target_user, "admin.user.role.change")
+    if is_senior_admin(admin, target_user):
+        return deny_senior(request, admin, uid, target_user, "admin.user.role.change")
     old_role = target_user.get("role") if target_user else None
     users.update({"uid": uid, "role": role}, ["uid"])
     clear_user_cache(uid)
@@ -156,8 +135,8 @@ async def admin_user_password(
     admin = require_admin(request)
     users = get_table("users")
     target_user = users.find_one(uid=uid)
-    if _is_senior_admin(admin, target_user):
-        return _deny_senior(request, admin, uid, target_user, "admin.user.password.reset")
+    if is_senior_admin(admin, target_user):
+        return deny_senior(request, admin, uid, target_user, "admin.user.password.reset")
     users.update({"uid": uid, "password_hash": await hash_password_async(data.password)}, ["uid"])
     logger.info(f"Admin {admin['username']} changed password for user {uid}")
     audit.record(
@@ -194,8 +173,8 @@ async def admin_user_toggle(request: Request, uid: str):
         return action_result(request, "/admin/users")
     users = get_table("users")
     user = users.find_one(uid=uid)
-    if _is_senior_admin(admin, user):
-        return _deny_senior(request, admin, uid, user, "admin.user.active.disable")
+    if is_senior_admin(admin, user):
+        return deny_senior(request, admin, uid, user, "admin.user.active.disable")
     if user:
         new_state = not is_account_active(user)
         users.update({"uid": uid, "is_active": new_state}, ["uid"])
@@ -216,12 +195,121 @@ async def admin_user_toggle(request: Request, uid: str):
         )
     return action_result(request, "/admin/users")
 
+def _enforcement_target(request: Request, admin: dict, uid: str, event_key: str):
+    if uid == admin["uid"]:
+        audit.record(
+            request,
+            event_key,
+            user=admin,
+            result="denied",
+            target_type="user",
+            target_uid=uid,
+            target_label=admin.get("username"),
+            summary=f"admin {admin['username']} cannot enforce against their own account",
+            links=[audit.target("user", uid, admin.get("username"))],
+        )
+        return None, action_result(request, "/admin/users")
+    target_user = get_table("users").find_one(uid=uid)
+    if not target_user:
+        return None, action_result(request, "/admin/users")
+    if is_senior_admin(admin, target_user):
+        return None, deny_senior(request, admin, uid, target_user, event_key)
+    return target_user, None
+
+
+def _record_enforcement(
+    request: Request, admin: dict, target_user: dict, event_key: str, metadata: dict
+):
+    logger.info(
+        f"Admin {admin['username']} applied {event_key} to {target_user['username']}"
+    )
+    audit.record(
+        request,
+        event_key,
+        user=admin,
+        target_type="user",
+        target_uid=target_user["uid"],
+        target_label=target_user.get("username"),
+        metadata=metadata,
+        summary=f"{admin['username']} applied {event_key} to {target_user['username']}",
+        links=[audit.target("user", target_user["uid"], target_user.get("username"))],
+    )
+    queue.record_action(
+        report_uid="",
+        actor_uid=admin["uid"],
+        action=event_key.rsplit(".", 1)[-1],
+        target_type="user",
+        target_uid=target_user["uid"],
+        subject_uid=target_user["uid"],
+        reason=metadata.get("reason", ""),
+        expires_at=metadata.get("expires_at", ""),
+    )
+
+
+@router.post("/users/{uid}/suspend")
+async def admin_user_suspend(
+    request: Request,
+    uid: str,
+    data: Annotated[SuspensionForm, Depends(json_or_form(SuspensionForm))],
+):
+    admin = require_admin(request)
+    target_user, refusal = _enforcement_target(request, admin, uid, "moderation.suspend")
+    if refusal is not None:
+        return refusal
+    expires_at = enforcement.suspend_user(target_user, data.duration_hours, data.reason)
+    _record_enforcement(
+        request,
+        admin,
+        target_user,
+        "moderation.suspend",
+        {"reason": data.reason, "expires_at": expires_at, "hours": data.duration_hours},
+    )
+    enforcement.notify_subject(
+        uid,
+        f"Your account is suspended until {expires_at}. Reason: {data.reason or 'policy violation'}.",
+    )
+    return action_result(request, "/admin/users")
+
+
+@router.post("/users/{uid}/lift")
+async def admin_user_lift(request: Request, uid: str):
+    admin = require_admin(request)
+    target_user, refusal = _enforcement_target(request, admin, uid, "moderation.lift")
+    if refusal is not None:
+        return refusal
+    enforcement.lift_suspension(target_user)
+    enforcement.unban_user(target_user)
+    _record_enforcement(request, admin, target_user, "moderation.lift", {})
+    enforcement.notify_subject(uid, "Your account restriction has been lifted.")
+    return action_result(request, "/admin/users")
+
+
+@router.post("/users/{uid}/ban")
+async def admin_user_ban(
+    request: Request,
+    uid: str,
+    data: Annotated[BanForm, Depends(json_or_form(BanForm))],
+):
+    admin = require_admin(request)
+    target_user, refusal = _enforcement_target(request, admin, uid, "moderation.ban")
+    if refusal is not None:
+        return refusal
+    enforcement.ban_user(target_user, data.reason)
+    _record_enforcement(
+        request, admin, target_user, "moderation.ban", {"reason": data.reason}
+    )
+    enforcement.notify_subject(
+        uid, f"Your account has been closed. Reason: {data.reason or 'policy violation'}."
+    )
+    return action_result(request, "/admin/users")
+
+
 @router.post("/users/{uid}/reset-ai-quota")
 async def admin_user_reset_ai_quota(request: Request, uid: str):
     admin = require_admin(request)
     target_user = get_table("users").find_one(uid=uid)
-    if _is_senior_admin(admin, target_user):
-        return _deny_senior(request, admin, uid, target_user, "admin.user.ai_quota.reset")
+    if is_senior_admin(admin, target_user):
+        return deny_senior(request, admin, uid, target_user, "admin.user.ai_quota.reset")
     devii = service_manager.get_service("devii")
     removed = devii.reset_quota("user", uid) if devii is not None else 0
     logger.info(
diff --git a/devplacepy/routers/auth/__init__.py b/devplacepy/routers/auth/__init__.py
index fe9aa50e..3a582811 100644
--- a/devplacepy/routers/auth/__init__.py
+++ b/devplacepy/routers/auth/__init__.py
@@ -8,6 +8,7 @@ from devplacepy.routers.auth import (
     logout,
     resetpassword,
     signup,
+    terms,
     token,
 )
 
@@ -18,3 +19,4 @@ router.include_router(token.router)
 router.include_router(forgotpassword.router)
 router.include_router(resetpassword.router)
 router.include_router(logout.router)
+router.include_router(terms.router)
diff --git a/devplacepy/routers/auth/signup.py b/devplacepy/routers/auth/signup.py
index 137fbb6b..ac4c0014 100644
--- a/devplacepy/routers/auth/signup.py
+++ b/devplacepy/routers/auth/signup.py
@@ -90,7 +90,9 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
             },
         )
 
-    uid, role, is_first = await register_account_async(username, email, password)
+    uid, role, is_first = await register_account_async(
+        username, email, password, age_band=data.age_band, accepted_terms=True
+    )
 
     max_age = max(1, get_int_setting("session_max_age_days", 7)) * SECONDS_PER_DAY
     token = create_session(uid, max_age)
diff --git a/devplacepy/routers/auth/terms.py b/devplacepy/routers/auth/terms.py
new file mode 100644
index 00000000..a1e474f3
--- /dev/null
+++ b/devplacepy/routers/auth/terms.py
@@ -0,0 +1,82 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+
+from devplacepy.database import _now_iso, get_setting, get_table, set_consent
+from devplacepy.responses import action_result, respond
+from devplacepy.schemas import AcceptTermsOut
+from devplacepy.seo import base_seo_context
+from devplacepy.services.audit import record as audit
+from devplacepy.utils import clear_user_cache, require_user
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+def current_terms_version() -> str:
+    return get_setting("terms_version", "1") or "1"
+
+
+def needs_acceptance(user: dict | None) -> bool:
+    if not user:
+        return False
+    return (user.get("terms_version") or "") != current_terms_version()
+
+
+@router.get("/accept-terms", response_class=HTMLResponse)
+async def accept_terms_page(request: Request):
+    user = require_user(request)
+    seo_ctx = base_seo_context(
+        request,
+        title="Accept the updated terms",
+        description="The Terms of Service changed. Accept the new version to continue.",
+        robots="noindex,nofollow",
+    )
+    return respond(
+        request,
+        "accept_terms.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "user": user,
+            "terms_version": current_terms_version(),
+            "accepted_version": user.get("terms_version") or "",
+        },
+        model=AcceptTermsOut,
+    )
+
+
+@router.post("/accept-terms")
+async def accept_terms(request: Request):
+    user = require_user(request)
+    version = current_terms_version()
+    now = _now_iso()
+    get_table("users").update(
+        {"uid": user["uid"], "terms_version": version, "terms_accepted_at": now},
+        ["uid"],
+    )
+    set_consent("user", user["uid"], "terms", True, version=version)
+    set_consent(
+        "user",
+        user["uid"],
+        "privacy",
+        True,
+        version=get_setting("privacy_version", "1") or "1",
+    )
+    clear_user_cache(user["uid"])
+    logger.info(f"{user['username']} accepted terms version {version}")
+    audit.record(
+        request,
+        "terms.accept",
+        user=user,
+        target_type="user",
+        target_uid=user["uid"],
+        target_label=user.get("username"),
+        new_value=version,
+        summary=f"{user['username']} accepted terms version {version}",
+        links=[audit.target("user", user["uid"], user.get("username"))],
+    )
+    return action_result(request, "/feed", data={"terms_version": version})
diff --git a/devplacepy/routers/devrant/CLAUDE.md b/devplacepy/routers/devrant/CLAUDE.md
index 96e23f70..3eefa909 100644
--- a/devplacepy/routers/devrant/CLAUDE.md
+++ b/devplacepy/routers/devrant/CLAUDE.md
@@ -12,7 +12,7 @@ A second REST protocol mounted at `/api` that reproduces the public devRant API
 
 **ID mapping (load-bearing).** devRant integer ids ARE the auto-increment `id` PK every `dataset` table already has: `rant_id`=`posts.id`, `comment_id`=`comments.id`, `user_id`=`users.id`, `token_id`=`devrant_tokens.id`. No translation table exists - `post_by_id` is `find_one(id=...)`. Serialization converts ISO `created_at` to unix via `ids.to_unix`.
 
-**Auth.** `POST /api/users/auth-token` accepts username OR email, verifies with passlib, and inserts a `devrant_tokens` row (in `SOFT_DELETE_TABLES`; born-live; `key`=`secrets.token_hex`, `expire_time` from `session_max_age_days`). Every later call re-validates `(token_id, token_key, user_id)` with `tokens.resolve_user(params)`. Read endpoints take an OPTIONAL viewer (`resolve_user` may return None); write endpoints return `_shared.unauthorized()` (401) when it does.
+**Auth.** `POST /api/users/auth-token` accepts username OR email, verifies with passlib, and inserts a `devrant_tokens` row (in `SOFT_DELETE_TABLES`; born-live; `key`=`secrets.token_hex`, `expire_time` from `session_max_age_days`). Every later call re-validates `(token_id, token_key, user_id)` through **`_shared.resolve_actor(request, params)`**, which wraps `tokens.resolve_user` with `utils.guards.refuse_suspended` - because this path never touches `require_user`, a moderator's suspension would otherwise not bind here at all (the token resolver's `is_account_active` check covers a **ban** but not a time-boxed suspension). `refuse_suspended` gates mutating methods only, so read endpoints are unaffected. Read endpoints take an OPTIONAL viewer (it may return None); write endpoints return `_shared.unauthorized()` (401) when it does. **`DELETE /api/users/me` deliberately calls the bare `resolve_user`** - it is the account-deletion path and must stay reachable to a suspended user, matching the `/profile/{username}/delete` exemption on the web side.
 
 **Writes reuse the audited native cores - never duplicate.** Implementing this drove four DRY extractions in `content.py` (`apply_vote`, `create_comment_record`, `delete_comment_record`, `set_bookmark`) and one in `utils.py` (`register_account`); the native `routers/votes.py`, `routers/comments.py`, and `auth/signup.py` were refactored onto the SAME functions. So a devRant rant/comment/vote awards XP, fires notifications, writes the audit row, and soft-deletes exactly like the UI path. Rant create calls `content.create_content_item` directly; rant delete calls `content.delete_content_item` (full cascade) and returns the devRant envelope.
 
diff --git a/devplacepy/routers/devrant/_shared.py b/devplacepy/routers/devrant/_shared.py
index 7da375ed..c2e13867 100644
--- a/devplacepy/routers/devrant/_shared.py
+++ b/devplacepy/routers/devrant/_shared.py
@@ -2,10 +2,19 @@
 
 from typing import Optional
 
-from fastapi import HTTPException
+from fastapi import HTTPException, Request
 from fastapi.responses import JSONResponse
 
 from devplacepy.database import get_setting
+from devplacepy.services.devrant.tokens import resolve_user
+from devplacepy.utils.guards import refuse_suspended
+
+
+def resolve_actor(request: Request, params: dict) -> Optional[dict]:
+    user = resolve_user(params)
+    if user:
+        refuse_suspended(request, user)
+    return user
 
 
 def api_enabled() -> bool:
diff --git a/devplacepy/routers/devrant/auth.py b/devplacepy/routers/devrant/auth.py
index e4a010ff..782605e0 100644
--- a/devplacepy/routers/devrant/auth.py
+++ b/devplacepy/routers/devrant/auth.py
@@ -2,7 +2,6 @@
 
 import logging
 import re
-from datetime import datetime, timezone
 
 from fastapi import APIRouter, Request
 from fastapi.responses import Response
@@ -17,7 +16,7 @@ from devplacepy.services.devrant.tokens import issue_token, resolve_user, revoke
 from devplacepy.services.devrant.profile import build_profile
 from devplacepy.services.devrant.ids import user_by_id
 from devplacepy.services.devrant.avatar import render_png
-from devplacepy.routers.devrant._shared import dr_ok, dr_error, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, dr_error, resolve_actor, unauthorized
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -131,14 +130,14 @@ async def profile(request: Request, user_id: str):
     user = user_by_id(user_id)
     if not user:
         return dr_error("User not found.")
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     return dr_ok(profile=build_profile(user, viewer))
 
 
 @router.post("/users/me/edit-profile")
 async def edit_profile(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     updates = {"uid": user["uid"]}
@@ -191,21 +190,29 @@ async def delete_account(request: Request):
     user = resolve_user(params)
     if not user:
         return unauthorized()
-    get_table("users").update(
-        {"uid": user["uid"], "is_active": False}, ["uid"]
-    )
+    from devplacepy.services.moderation import deletion
+
+    username = user["username"]
     revoke_all(user["uid"])
-    logger.info("devrant account deactivated for %s", user["username"])
+    result = deletion.delete_account(user)
+    if result is None:
+        return dr_error("This account is already being deleted.")
+    logger.info("devrant account deleted for %s", username)
     audit.record(
         request,
-        "auth.account.disable",
+        "account.delete.request",
         user=user,
         target_type="user",
         target_uid=user["uid"],
-        target_label=user["username"],
+        target_label=username,
         origin="devrant",
-        summary=f"{user['username']} deactivated account via devrant",
-        links=[audit.target("user", user["uid"], user["username"])],
+        metadata={
+            "stamp": result["stamp"],
+            "rows": result["rows"],
+            "grace_hours": result["grace_hours"],
+        },
+        summary=f"{username} deleted account via devrant",
+        links=[audit.target("user", user["uid"], username)],
     )
     return dr_ok()
 
diff --git a/devplacepy/routers/devrant/comments.py b/devplacepy/routers/devrant/comments.py
index a5c6ddcb..2fcb613b 100644
--- a/devplacepy/routers/devrant/comments.py
+++ b/devplacepy/routers/devrant/comments.py
@@ -17,10 +17,9 @@ from devplacepy.services.audit import record as audit
 from devplacepy.services.correction import schedule_correction
 from devplacepy.services.ai_modifier import schedule_modification
 from devplacepy.services.devrant.params import merge_params
-from devplacepy.services.devrant.tokens import resolve_user
 from devplacepy.services.devrant.ids import as_int, comment_by_id
 from devplacepy.services.devrant.serializers import serialize_comment
-from devplacepy.routers.devrant._shared import dr_ok, dr_error, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, dr_error, resolve_actor, unauthorized
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -50,7 +49,7 @@ def _serialize_single(comment: dict, viewer) -> dict:
 @router.get("/comments/{comment_id}")
 async def get_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     comment = comment_by_id(comment_id)
     if not comment:
         return dr_error("Invalid comment specified in path.")
@@ -60,7 +59,7 @@ async def get_comment(request: Request, comment_id: str):
 @router.post("/comments/{comment_id}")
 async def edit_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     comment = comment_by_id(comment_id)
@@ -97,7 +96,7 @@ async def edit_comment(request: Request, comment_id: str):
 @router.delete("/comments/{comment_id}")
 async def delete_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     comment = comment_by_id(comment_id)
@@ -112,7 +111,7 @@ async def delete_comment(request: Request, comment_id: str):
 @router.post("/comments/{comment_id}/vote")
 async def vote_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     comment = comment_by_id(comment_id)
diff --git a/devplacepy/routers/devrant/notifs.py b/devplacepy/routers/devrant/notifs.py
index 88ed9882..27b26c24 100644
--- a/devplacepy/routers/devrant/notifs.py
+++ b/devplacepy/routers/devrant/notifs.py
@@ -5,9 +5,8 @@ import logging
 from fastapi import APIRouter, Request
 
 from devplacepy.services.devrant.params import merge_params
-from devplacepy.services.devrant.tokens import resolve_user
 from devplacepy.services.devrant.notifications import build_notif_feed, clear_notifications
-from devplacepy.routers.devrant._shared import dr_ok, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, resolve_actor, unauthorized
 from devplacepy.services.audit import record as audit
 
 logger = logging.getLogger(__name__)
@@ -17,7 +16,7 @@ router = APIRouter()
 @router.get("/users/me/notif-feed")
 async def notif_feed(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     return dr_ok(data=build_notif_feed(user))
@@ -26,7 +25,7 @@ async def notif_feed(request: Request):
 @router.delete("/users/me/notif-feed")
 async def clear_notif_feed(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     clear_notifications(user)
diff --git a/devplacepy/routers/devrant/rants.py b/devplacepy/routers/devrant/rants.py
index 0b979a16..4a7c9c20 100644
--- a/devplacepy/routers/devrant/rants.py
+++ b/devplacepy/routers/devrant/rants.py
@@ -21,11 +21,10 @@ from devplacepy.services.audit import record as audit
 from devplacepy.services.correction import schedule_correction
 from devplacepy.services.ai_modifier import schedule_modification
 from devplacepy.services.devrant.params import merge_params
-from devplacepy.services.devrant.tokens import resolve_user
 from devplacepy.services.devrant.ids import as_int, post_by_id
 from devplacepy.services.devrant.feed import list_rants, search_rants, load_rant_detail
 from devplacepy.services.devrant.serializers import encode_tags
-from devplacepy.routers.devrant._shared import dr_ok, dr_error, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, dr_error, resolve_actor, unauthorized
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -45,7 +44,7 @@ def _parse_tags(raw: object) -> list:
 @router.get("/devrant/rants")
 async def rant_feed(request: Request):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     sort = params.get("sort") or "recent"
     limit = min(MAX_LIMIT, max(1, as_int(params.get("limit"), DEFAULT_LIMIT)))
     skip = max(0, as_int(params.get("skip"), 0))
@@ -70,7 +69,7 @@ async def rant_feed(request: Request):
 @router.get("/devrant/search")
 async def search(request: Request):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     term = (params.get("term") or "").strip()
     return dr_ok(results=search_rants(term, viewer) if term else [])
 
@@ -78,7 +77,7 @@ async def search(request: Request):
 @router.post("/devrant/rants")
 async def create_rant(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     text = (params.get("rant") or "").strip()
@@ -114,7 +113,7 @@ async def create_rant(request: Request):
 @router.get("/devrant/rants/{rant_id}")
 async def get_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     post = post_by_id(rant_id)
     if not post:
         return dr_error("This rant does not exist.")
@@ -125,7 +124,7 @@ async def get_rant(request: Request, rant_id: str):
 @router.post("/devrant/rants/{rant_id}")
 async def edit_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -164,7 +163,7 @@ async def edit_rant(request: Request, rant_id: str):
 @router.delete("/devrant/rants/{rant_id}")
 async def delete_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -179,7 +178,7 @@ async def delete_rant(request: Request, rant_id: str):
 @router.post("/devrant/rants/{rant_id}/vote")
 async def vote_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -206,7 +205,7 @@ async def unfavorite_rant(request: Request, rant_id: str):
 
 async def _set_favorite(request: Request, rant_id: str, saved: bool):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -219,7 +218,7 @@ async def _set_favorite(request: Request, rant_id: str, saved: bool):
 @router.post("/devrant/rants/{rant_id}/comments")
 async def comment_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
diff --git a/devplacepy/routers/docs/CLAUDE.md b/devplacepy/routers/docs/CLAUDE.md
index 7b21f8b8..ad0f909d 100644
--- a/devplacepy/routers/docs/CLAUDE.md
+++ b/devplacepy/routers/docs/CLAUDE.md
@@ -10,6 +10,8 @@ This file documents the documentation site (`/docs`) - prose pages, API referenc
 
 ## Audience tiers and navigation
 
+The **Legal** section (`SECTION_LEGAL`, in the `AUDIENCE_START` tier so it is one click from `/docs`) carries the platform's policies: `terms`, `community-guidelines`, `privacy`, `content-moderation`, `intellectual-property`, `contact`, plus the admin-gated `moderation-operations`. They are ordinary prose pages, which is exactly why they were built here rather than as new routes - role gating, SEO, the search index and the docs export all come for free. The six public ones are listed in `seo.LEGAL_DOC_SLUGS` and appear in the sitemap; `_footer_links.html` links four of them from every page. Their prose reads live values through the `policy_version`, `moderation_sla_hours`, `moderation_minimum_age`, `ai_provider_name` and `contact_details` Jinja globals, so a settings change is reflected without a content edit.
+
 `DOCS_PAGES` entries take optional `admin: True` (hidden + 404 for non-admins, but still indexed and surfaced only to admins by `docs_search`) and `section: "..."` (a nested sidebar group rendered by `docs_base.html`). The sidebar groups `section`s under four ordered **audience tiers** (`AUDIENCES` in `routers/docs/pages.py`): `Start here` (General), `Build with the API` (API, Components, Styles), `Contribute and internals` (Architecture, Services, Devii internals, Bots internals, Testing, Claude Code), and `Operate` (Administration, Production). `nav_groups(visible_pages)` builds the `[(audience, [(section, [pages])])]` tree from the flat visible-page list (so a section's pages collect under one heading regardless of `DOCS_PAGES` order or the API/Administration interleave from `api_doc_pages()`); `views.py` passes it as `nav`, and `docs_base.html` renders an audience super-header (`.sidebar-tier`) above each section subheading (`.sidebar-subheading`). `DOCS_PAGES` stays the canonical list for search/export/routing - the tiering is sidebar-only.
 
 The public `getting-started` page (`SECTION_GENERAL`) is the new-contributor on-ramp (install/run, the four-faces workflow, validation); gate its deep-internals links with `{% if is_admin(user) %}` so guests get no 404s. Keep one canonical home per concept: the `auth` API group intro in `docs_api.py` defers method detail to the `authentication` prose page rather than re-listing the four methods. The member-facing `devii` prose page is functional; admins also get a `Devii internals` section of `devii-*` technical subpages.
diff --git a/devplacepy/routers/docs/pages.py b/devplacepy/routers/docs/pages.py
index 3491af5a..b9aed000 100644
--- a/devplacepy/routers/docs/pages.py
+++ b/devplacepy/routers/docs/pages.py
@@ -4,6 +4,7 @@ from devplacepy.docs_api import api_doc_pages
 
 SECTION_GENERAL = "General"
 SECTION_TOOLS = "Tools"
+SECTION_LEGAL = "Legal"
 SECTION_COMPONENTS = "Components"
 SECTION_STYLES = "Styles"
 SECTION_API = "API"
@@ -23,7 +24,7 @@ AUDIENCE_CONTRIBUTE = "Contribute and internals"
 AUDIENCE_OPERATE = "Operate"
 
 AUDIENCES = [
-    (AUDIENCE_START, [SECTION_GENERAL, SECTION_TOOLS]),
+    (AUDIENCE_START, [SECTION_GENERAL, SECTION_LEGAL, SECTION_TOOLS]),
     (
         AUDIENCE_BUILD,
         [SECTION_API, SECTION_DEVRANT, SECTION_COMPONENTS, SECTION_STYLES],
@@ -147,6 +148,50 @@ DOCS_PAGES = [
         "kind": "prose",
         "section": SECTION_GENERAL,
     },
+    # Legal - the policies the platform is operated under (everyone)
+    {
+        "slug": "terms",
+        "title": "Terms of Service",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+    },
+    {
+        "slug": "community-guidelines",
+        "title": "Community Guidelines",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+    },
+    {
+        "slug": "privacy",
+        "title": "Privacy Policy",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+    },
+    {
+        "slug": "content-moderation",
+        "title": "How moderation works",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+    },
+    {
+        "slug": "intellectual-property",
+        "title": "Notice and takedown",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+    },
+    {
+        "slug": "contact",
+        "title": "Contact",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+    },
+    {
+        "slug": "moderation-operations",
+        "title": "Operating the moderation queue",
+        "kind": "prose",
+        "section": SECTION_LEGAL,
+        "admin": True,
+    },
     # Tools - public developer tools (everyone)
     {
         "slug": "tools-seo",
diff --git a/devplacepy/routers/docs/views.py b/devplacepy/routers/docs/views.py
index 02dfe93e..3db4a2c5 100644
--- a/devplacepy/routers/docs/views.py
+++ b/devplacepy/routers/docs/views.py
@@ -185,6 +185,7 @@ async def docs_page(request: Request, slug: str):
         request,
         title=f"{page['title']} - Documentation",
         description="DevPlace developer documentation.",
+        robots="noindex,nofollow" if page.get("admin") else "index,follow",
         breadcrumbs=[
             {"name": "Home", "url": "/feed"},
             {"name": "Docs", "url": "/docs/index.html"},
diff --git a/devplacepy/routers/messages.py b/devplacepy/routers/messages.py
index 1fc16443..a309692c 100644
--- a/devplacepy/routers/messages.py
+++ b/devplacepy/routers/messages.py
@@ -317,6 +317,13 @@ def _resolve_ws_user(websocket: WebSocket):
         return _user_from_api_key(key)
     return None
 
+
+def _ws_may_write(user: dict) -> bool:
+    from devplacepy.database import suspension_active
+    from devplacepy.routers.auth.terms import needs_acceptance
+
+    return not suspension_active(user) and not needs_acceptance(user)
+
 @router.websocket("/ws")
 async def messages_ws(websocket: WebSocket):
     await websocket.accept()
@@ -324,6 +331,9 @@ async def messages_ws(websocket: WebSocket):
     if not user:
         await websocket.close(code=1008)
         return
+    if not _ws_may_write(user):
+        await websocket.close(code=1008)
+        return
 
     user_uid = user["uid"]
     message_hub.register(user_uid, websocket)
diff --git a/devplacepy/routers/news.py b/devplacepy/routers/news.py
index 4a3902b3..3b58d244 100644
--- a/devplacepy/routers/news.py
+++ b/devplacepy/routers/news.py
@@ -5,6 +5,7 @@ from datetime import datetime, timedelta, timezone
 from fastapi import APIRouter, Request
 from fastapi.responses import HTMLResponse
 from devplacepy.database import (
+    get_maturity,
     get_table,
     db,
     load_comments,
@@ -156,6 +157,7 @@ async def news_detail_page(request: Request, news_slug: str):
             "time_ago": time_ago(article["synced_at"]),
             "comments": comments,
             "bookmarked": bookmarked,
+            "maturity": get_maturity("news", article["uid"])["level"],
         },
         model=NewsDetailOut,
     )
diff --git a/devplacepy/routers/profile/__init__.py b/devplacepy/routers/profile/__init__.py
index 5d95f05d..61137e48 100644
--- a/devplacepy/routers/profile/__init__.py
+++ b/devplacepy/routers/profile/__init__.py
@@ -5,7 +5,9 @@ from devplacepy.routers.profile import (
     ai_modifier,
     avatar,
     award,
+    consent,
     customization,
+    delete,
     interactions,
     notifications,
     telegram,
@@ -21,5 +23,7 @@ router.include_router(ai_modifier.router)
 router.include_router(interactions.router)
 router.include_router(avatar.router)
 router.include_router(telegram.router)
+router.include_router(consent.router)
+router.include_router(delete.router)
 
 __all__ = ["router", "_ai_quota"]
diff --git a/devplacepy/routers/profile/consent.py b/devplacepy/routers/profile/consent.py
new file mode 100644
index 00000000..2b93bf16
--- /dev/null
+++ b/devplacepy/routers/profile/consent.py
@@ -0,0 +1,127 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request
+
+from devplacepy.database import (
+    CONSENT_KINDS,
+    consent_state,
+    get_setting,
+    get_table,
+    list_consents,
+    set_consent,
+)
+from devplacepy.dependencies import json_or_form
+from devplacepy.models import ConsentForm, MaturePreferenceForm
+from devplacepy.responses import action_result
+from devplacepy.routers.profile.delete import _owner_only
+from devplacepy.services.audit import record as audit
+from devplacepy.utils import clear_user_cache
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+TRUTHY = ("1", "on", "true", "yes")
+
+VERSION_KEYS = {"terms": "terms_version", "privacy": "privacy_version"}
+
+
+def consent_view(owner_kind: str, owner_id: str) -> list[dict]:
+    latest = {}
+    for row in list_consents(owner_kind, owner_id):
+        latest.setdefault(row["kind"], row)
+    return [
+        {
+            "kind": kind,
+            "label": label,
+            "state": (latest.get(kind) or {}).get("state", "withdrawn"),
+            "version": (latest.get(kind) or {}).get("version", ""),
+            "granted_at": (latest.get(kind) or {}).get("granted_at", ""),
+            "withdrawn_at": (latest.get(kind) or {}).get("withdrawn_at", ""),
+        }
+        for kind, label in CONSENT_KINDS.items()
+    ]
+
+
+def consent_version(kind: str) -> str:
+    key = VERSION_KEYS.get(kind)
+    return (get_setting(key, "1") or "1") if key else "1"
+
+
+@router.post("/{username}/consent")
+async def set_user_consent(
+    request: Request,
+    username: str,
+    data: Annotated[ConsentForm, Depends(json_or_form(ConsentForm))],
+):
+    target, denied = _owner_only(
+        request, username, "Only the account holder can change a consent"
+    )
+    if denied is not None:
+        return denied
+    granted = data.granted.strip().lower() in TRUTHY
+    before = consent_state("user", target["uid"], data.kind)
+    set_consent(
+        "user", target["uid"], data.kind, granted, version=consent_version(data.kind)
+    )
+    logger.info(
+        f"Consent {data.kind} {'granted' if granted else 'withdrawn'} for {target['username']}"
+    )
+    audit.record(
+        request,
+        "consent.grant" if granted else "consent.withdraw",
+        target_type="user",
+        target_uid=target["uid"],
+        target_label=target["username"],
+        old_value=(before or {}).get("state"),
+        new_value="granted" if granted else "withdrawn",
+        metadata={"kind": data.kind},
+        summary=(
+            f"{'granted' if granted else 'withdrew'} {data.kind} consent "
+            f"for {target['username']}"
+        ),
+        links=[audit.target("user", target["uid"], target["username"])],
+    )
+    url = f"/profile/{target['username']}?tab=privacy"
+    return action_result(
+        request,
+        url,
+        data={"kind": data.kind, "state": "granted" if granted else "withdrawn"},
+    )
+
+
+@router.post("/{username}/mature-content")
+async def set_mature_preference(
+    request: Request,
+    username: str,
+    data: Annotated[MaturePreferenceForm, Depends(json_or_form(MaturePreferenceForm))],
+):
+    target, denied = _owner_only(
+        request,
+        username,
+        "Only the account holder can change the mature-content preference",
+    )
+    if denied is not None:
+        return denied
+    opted_in = data.mature_opt_in.strip().lower() in TRUTHY
+    get_table("users").update(
+        {"uid": target["uid"], "mature_opt_in": 1 if opted_in else 0}, ["uid"]
+    )
+    clear_user_cache(target["uid"])
+    audit.record(
+        request,
+        "profile.mature_content",
+        target_type="user",
+        target_uid=target["uid"],
+        target_label=target["username"],
+        new_value=1 if opted_in else 0,
+        summary=(
+            f"{'enabled' if opted_in else 'disabled'} mature content "
+            f"for {target['username']}"
+        ),
+        links=[audit.target("user", target["uid"], target["username"])],
+    )
+    url = f"/profile/{target['username']}?tab=privacy"
+    return action_result(request, url, data={"mature_opt_in": opted_in})
diff --git a/devplacepy/routers/profile/delete.py b/devplacepy/routers/profile/delete.py
new file mode 100644
index 00000000..71202b71
--- /dev/null
+++ b/devplacepy/routers/profile/delete.py
@@ -0,0 +1,150 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+
+from devplacepy.dependencies import json_or_form
+from devplacepy.models import AccountDeleteForm
+from devplacepy.responses import action_result, json_error, respond
+from devplacepy.routers.profile._shared import resolve_customization_target
+from devplacepy.schemas import AccountDeletionOut
+from devplacepy.seo import base_seo_context
+from devplacepy.services.audit import record as audit
+from devplacepy.services.moderation import deletion
+from devplacepy.utils import get_current_user, verify_password_async
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+REMOVED = [
+    "Your account record, username, email address and password",
+    "Your profile: bio, location, links and avatar",
+    "Your posts, comments, gists, projects, project files and quizzes",
+    "Your uploads and media gallery",
+    "Your direct-message history, votes, reactions, bookmarks and polls",
+    "Your API key, access tokens and every signed-in session",
+    "Your assistant conversations, tasks, lessons and custom tools",
+]
+
+RETAINED = [
+    "Append-only audit and moderation records, which hold identifiers rather than "
+    "your profile, so the platform can show it enforced its own rules",
+    "Backup archives, until they rotate out on their normal schedule",
+]
+
+
+def _owner_only(
+    request: Request,
+    username: str,
+    message: str = "Only the account holder can delete this account",
+):
+    target, denied = resolve_customization_target(request, username)
+    if denied is not None:
+        return None, denied
+    viewer = get_current_user(request)
+    if not viewer or viewer["uid"] != target["uid"]:
+        audit.record(
+            request,
+            "security.authz.denied",
+            user=viewer,
+            result="denied",
+            target_type="user",
+            target_uid=target["uid"],
+            target_label=target["username"],
+            metadata={"reason": message},
+            summary=f"non-owner denied {request.method} {request.url.path}",
+            links=[audit.target("user", target["uid"], target["username"])],
+        )
+        return None, json_error(403, message)
+    return target, None
+
+
+async def _password_matches(password: str, hashed: str) -> bool:
+    if not hashed:
+        return False
+    try:
+        return await verify_password_async(password, hashed)
+    except ValueError:
+        return False
+
+
+@router.get("/{username}/delete", response_class=HTMLResponse)
+async def delete_account_page(request: Request, username: str):
+    target, denied = _owner_only(request, username)
+    if denied is not None:
+        return denied
+    seo_ctx = base_seo_context(
+        request,
+        title="Delete your account",
+        description="Permanently remove your DevPlace account and personal data.",
+        robots="noindex,nofollow",
+        breadcrumbs=[
+            {"name": "Home", "url": "/feed"},
+            {"name": target["username"], "url": f"/profile/{target['username']}"},
+            {
+                "name": "Delete account",
+                "url": f"/profile/{target['username']}/delete",
+            },
+        ],
+    )
+    return respond(
+        request,
+        "account_delete.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "user": target,
+            "username": target["username"],
+            "grace_hours": deletion.grace_hours(),
+            "removed": REMOVED,
+            "retained": RETAINED,
+        },
+        model=AccountDeletionOut,
+    )
+
+
+@router.post("/{username}/delete")
+async def delete_account(
+    request: Request,
+    username: str,
+    data: Annotated[AccountDeleteForm, Depends(json_or_form(AccountDeleteForm))],
+):
+    target, denied = _owner_only(request, username)
+    if denied is not None:
+        return denied
+    if not await _password_matches(data.password, target.get("password_hash", "")):
+        audit.record(
+            request,
+            "account.delete.request",
+            result="denied",
+            target_type="user",
+            target_uid=target["uid"],
+            target_label=target["username"],
+            summary=f"account deletion for {target['username']} refused: wrong password",
+            links=[audit.target("user", target["uid"], target["username"])],
+        )
+        return json_error(403, "That password is not correct")
+    result = deletion.delete_account(target)
+    if result is None:
+        return json_error(409, "This account is already being deleted")
+    logger.info(f"Account {target['username']} deleted by request")
+    audit.record(
+        request,
+        "account.delete.request",
+        target_type="user",
+        target_uid=target["uid"],
+        target_label=target["username"],
+        metadata={
+            "stamp": result["stamp"],
+            "rows": result["rows"],
+            "grace_hours": result["grace_hours"],
+        },
+        summary=f"account {target['username']} deleted",
+        links=[audit.target("user", target["uid"], target["username"])],
+    )
+    response = action_result(request, "/", data=result)
+    response.delete_cookie("session")
+    return response
diff --git a/devplacepy/routers/profile/index.py b/devplacepy/routers/profile/index.py
index 90c09a0c..e6d8c11e 100644
--- a/devplacepy/routers/profile/index.py
+++ b/devplacepy/routers/profile/index.py
@@ -6,6 +6,7 @@ from fastapi import Depends, APIRouter, Request
 from devplacepy.models import ProfileForm
 from fastapi.responses import HTMLResponse, JSONResponse
 from devplacepy.database import (
+    get_setting,
     get_table,
     get_customization_prefs,
     get_notification_prefs,
@@ -34,6 +35,13 @@ from devplacepy.database.awards import (
     get_user_awards,
 )
 from devplacepy.content import can_view_project, enrich_items
+from devplacepy.routers.profile.consent import consent_view
+from devplacepy.services.moderation.deletion import grace_hours
+from devplacepy.services.moderation.screening import (
+    record as record_screening,
+    refuse_if_blocked,
+    screen_fields,
+)
 from devplacepy.utils import (
     get_current_user,
     get_badge,
@@ -363,6 +371,30 @@ async def profile_page(
         if (tab == "notifications" and can_manage_customization)
         else False
     )
+    consents = (
+        consent_view("user", profile_user["uid"])
+        if (tab == "privacy" and can_manage_customization)
+        else []
+    )
+    privacy_fields = (
+        {
+            "mature_opt_in": bool(profile_user.get("mature_opt_in")),
+            "age_band": profile_user.get("age_band", ""),
+            "terms_version": profile_user.get("terms_version", ""),
+            "terms_accepted_at": profile_user.get("terms_accepted_at", ""),
+            "suspended_until": profile_user.get("suspended_until", ""),
+            "suspension_reason": profile_user.get("suspension_reason", ""),
+        }
+        if can_manage_customization
+        else {
+            "mature_opt_in": False,
+            "age_band": "",
+            "terms_version": "",
+            "terms_accepted_at": "",
+            "suspended_until": "",
+            "suspension_reason": "",
+        }
+    )
 
     base = site_url(request)
     robots = "noindex,follow" if posts_count < 2 else "index,follow"
@@ -434,6 +466,10 @@ async def profile_page(
             "cust_disable_global": customization_prefs["disable_global"],
             "cust_disable_pagetype": customization_prefs["disable_pagetype"],
             "notification_prefs": notification_prefs,
+            "consents": consents,
+            **privacy_fields,
+            "current_terms_version": get_setting("terms_version", "1") or "1",
+            "deletion_grace_hours": grace_hours(),
             "ai_quota": ai_quota,
             "correction_usage": correction_usage,
             "modifier_usage": modifier_usage,
@@ -461,6 +497,10 @@ async def profile_page(
 async def update_profile(request: Request, data: Annotated[ProfileForm, Depends(json_or_form(ProfileForm))]):
     user = require_user(request)
     users = get_table("users")
+    screening = screen_fields(
+        "users", {"bio": data.bio, "location": data.location}
+    )
+    refuse_if_blocked(screening)
     users.update(
         {
             "uid": user["uid"],
@@ -472,6 +512,13 @@ async def update_profile(request: Request, data: Annotated[ProfileForm, Depends(
         ["uid"],
     )
     clear_user_cache(user["uid"])
+    record_screening(
+        screening,
+        target_type="user",
+        target_uid=user["uid"],
+        actor_uid=user["uid"],
+        request=request,
+    )
     schedule_correction(user, "users", user["uid"], request)
     schedule_modification(user, "users", user["uid"], request)
 
diff --git a/devplacepy/routers/reports.py b/devplacepy/routers/reports.py
new file mode 100644
index 00000000..1248c6a1
--- /dev/null
+++ b/devplacepy/routers/reports.py
@@ -0,0 +1,143 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+
+from devplacepy.database import (
+    REPORTABLE_TARGETS,
+    REPORT_SEVERITIES,
+    REPORT_STATUSES,
+    report_reason_options,
+)
+from devplacepy.dependencies import json_or_form
+from devplacepy.models import ReportForm
+from devplacepy.responses import action_result, json_error, respond
+from devplacepy.schemas import ReportListOut, ReportReasonsOut
+from devplacepy.seo import base_seo_context, site_url, website_schema
+from devplacepy.services.audit import record as audit
+from devplacepy.services.moderation import queue, sla
+from devplacepy.utils import create_notification, get_current_user, require_user
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+@router.get("/reasons")
+async def report_reasons(request: Request):
+    base = site_url(request)
+    return respond(
+        request,
+        "report_reasons.html",
+        {
+            **base_seo_context(
+                request,
+                title="Report reasons",
+                description="The categories DevPlace accepts content reports under.",
+                breadcrumbs=[
+                    {"name": "Home", "url": "/feed"},
+                    {"name": "Report reasons", "url": "/reports/reasons"},
+                ],
+                schemas=[website_schema(base)],
+            ),
+            "request": request,
+            "user": get_current_user(request),
+            "reasons": report_reason_options(),
+            "severities": list(REPORT_SEVERITIES),
+        },
+        model=ReportReasonsOut,
+    )
+
+
+@router.get("/mine", response_class=HTMLResponse)
+async def my_reports(request: Request, status: str = "", page: int = 1):
+    user = require_user(request)
+    if status not in REPORT_STATUSES:
+        status = ""
+    reports, pagination = queue.list_reports(
+        status=status, reporter_uid=user["uid"], page=page
+    )
+    base = site_url(request)
+    seo_ctx = base_seo_context(
+        request,
+        title="Your reports",
+        description="The reports you filed and the outcome of each.",
+        robots="noindex,nofollow",
+        breadcrumbs=[
+            {"name": "Home", "url": "/feed"},
+            {"name": "Your reports", "url": "/reports/mine"},
+        ],
+        schemas=[website_schema(base)],
+    )
+    return respond(
+        request,
+        "reports_mine.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "user": user,
+            "reports": reports,
+            "pagination": pagination,
+            "status": status,
+            "reasons": report_reason_options(),
+        },
+        model=ReportListOut,
+    )
+
+
+@router.post("/{target_type}/{target_uid}")
+async def submit_report(
+    request: Request,
+    target_type: str,
+    target_uid: str,
+    data: Annotated[ReportForm, Depends(json_or_form(ReportForm))],
+):
+    user = require_user(request)
+    if target_type not in REPORTABLE_TARGETS:
+        return json_error(400, "Unknown report target")
+    owner_uid = queue.owner_uid_for(target_type, target_uid)
+    if owner_uid and owner_uid == user["uid"]:
+        return json_error(400, "You cannot report your own content")
+    report = queue.raise_report(
+        target_type=target_type,
+        target_uid=target_uid,
+        reporter_uid=user["uid"],
+        reason=data.reason,
+        detail=data.detail,
+        origin="member",
+    )
+    if not report:
+        return json_error(400, "Report could not be filed")
+    hours = sla.sla_hours()
+    logger.info(
+        f"{user['username']} reported {target_type} {target_uid} as {data.reason}"
+    )
+    audit.record(
+        request,
+        "report.create",
+        user=user,
+        target_type=target_type,
+        target_uid=target_uid,
+        metadata={"reason": data.reason, "severity": report["severity"]},
+        summary=f"{user['username']} reported {target_type} {target_uid} as {data.reason}",
+        links=[audit.target(target_type, target_uid)],
+    )
+    create_notification(
+        user["uid"],
+        "moderation",
+        f"Report received. A moderator reviews it within {hours} hours.",
+        user["uid"],
+        "/reports/mine",
+    )
+    return action_result(
+        request,
+        "/reports/mine",
+        data={
+            "uid": report["uid"],
+            "status": report["status"],
+            "severity": report["severity"],
+            "sla_hours": hours,
+        },
+    )
diff --git a/devplacepy/routers/seo.py b/devplacepy/routers/seo.py
index 77d7da4e..2ced4b9e 100644
--- a/devplacepy/routers/seo.py
+++ b/devplacepy/routers/seo.py
@@ -22,6 +22,8 @@ Disallow: /avatar/
 Disallow: /follow/
 Disallow: /admin/
 Disallow: /uploads/
+Disallow: /reports/mine
+Disallow: /profile/*/delete
 Disallow: /*?tab=
 Disallow: /*?sort=
 Allow: /static/
diff --git a/devplacepy/routers/workspaces.py b/devplacepy/routers/workspaces.py
new file mode 100644
index 00000000..8da9a727
--- /dev/null
+++ b/devplacepy/routers/workspaces.py
@@ -0,0 +1,116 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+
+from devplacepy.database import (
+    build_pagination,
+    db,
+    get_maturity_by_targets,
+    get_table,
+    get_users_by_uids,
+)
+from devplacepy.content import can_view_project
+from devplacepy.responses import respond
+from devplacepy.schemas import WorkspaceIndexOut
+from devplacepy.seo import base_seo_context, public_base_url, site_url, website_schema
+from devplacepy.utils import get_current_user
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+PER_PAGE = 50
+
+
+def published_instances() -> list[dict]:
+    if "instances" not in db.tables:
+        return []
+    table = get_table("instances")
+    if not table.has_column("ingress_slug"):
+        return []
+    rows = [
+        row
+        for row in table.find(deleted_at=None, order_by=["-created_at"])
+        if (row.get("ingress_slug") or "").strip()
+    ]
+    return rows
+
+
+def projects_by_uids(uids: list[str]) -> dict[str, dict]:
+    unique = [uid for uid in set(uids) if uid]
+    if not unique or "projects" not in db.tables:
+        return {}
+    table = get_table("projects")
+    return {
+        row["uid"]: row for row in table.find(table.table.columns.uid.in_(unique))
+    }
+
+
+def index_entries(rows: list[dict], user: dict | None) -> list[dict]:
+    projects = projects_by_uids([row.get("project_uid", "") for row in rows])
+    owners = get_users_by_uids(
+        [row.get("owner_uid") or row.get("created_by") for row in rows]
+    )
+    maturity = get_maturity_by_targets("workspace", [row["uid"] for row in rows])
+    base = public_base_url()
+    entries = []
+    for row in rows:
+        project = projects.get(row.get("project_uid", ""))
+        if not can_view_project(project, user):
+            project = None
+        owner_uid = row.get("owner_uid") or row.get("created_by") or ""
+        owner = owners.get(owner_uid)
+        slug = row["ingress_slug"]
+        project_slug = (project or {}).get("slug") or (project or {}).get("uid") or ""
+        entries.append(
+            {
+                "uid": row["uid"],
+                "name": row.get("name") or slug,
+                "slug": slug,
+                "owner_uid": owner_uid,
+                "url": f"{base}/p/{slug}" if base else f"/p/{slug}",
+                "description": (project or {}).get("description", "") or "",
+                "owner": owner["username"] if owner else "",
+                "maturity": maturity.get(row["uid"], {}).get("level", "general"),
+                "project_url": f"/projects/{project_slug}" if project_slug else "",
+            }
+        )
+    return entries
+
+
+@router.get("/index", response_class=HTMLResponse)
+async def workspace_index(request: Request, page: int = 1):
+    user = get_current_user(request)
+    rows = published_instances()
+    pagination = build_pagination(page, len(rows), PER_PAGE)
+    offset = (pagination["page"] - 1) * pagination["per_page"]
+    window = rows[offset : offset + pagination["per_page"]]
+    base = site_url(request)
+    seo_ctx = base_seo_context(
+        request,
+        title="Published workspaces",
+        description=(
+            "Every workspace DevPlace members have published to the public ingress, "
+            "with its owner, project and direct link."
+        ),
+        breadcrumbs=[
+            {"name": "Home", "url": "/feed"},
+            {"name": "Published workspaces", "url": "/workspaces/index"},
+        ],
+        schemas=[website_schema(base)],
+    )
+    return respond(
+        request,
+        "workspace_index.html",
+        {
+            **seo_ctx,
+            "request": request,
+            "user": user,
+            "workspaces": index_entries(window, user),
+            "pagination": pagination,
+            "total": len(rows),
+        },
+        model=WorkspaceIndexOut,
+    )
diff --git a/devplacepy/schemas/__init__.py b/devplacepy/schemas/__init__.py
index d30868f6..e2e2f258 100644
--- a/devplacepy/schemas/__init__.py
+++ b/devplacepy/schemas/__init__.py
@@ -183,3 +183,20 @@ from devplacepy.schemas.game import (
     GameQuestOut,
     GameStateOut,
 )
+from devplacepy.schemas.moderation import (
+    AcceptTermsOut,
+    AccountDeletionOut,
+    AdminModerationOut,
+    AdminReportOut,
+    ConsentListOut,
+    ConsentOut,
+    MaturityOut,
+    ModerationActionOut,
+    ReportCreatedOut,
+    ReportListOut,
+    ReportOut,
+    ReportReasonsOut,
+    SlaOut,
+    WorkspaceIndexItemOut,
+    WorkspaceIndexOut,
+)
diff --git a/devplacepy/schemas/listings.py b/devplacepy/schemas/listings.py
index bece758a..a795368a 100644
--- a/devplacepy/schemas/listings.py
+++ b/devplacepy/schemas/listings.py
@@ -23,6 +23,7 @@ from devplacepy.schemas.content import (
 
 class FeedItemOut(_Out):
     post: PostOut
+    maturity: Optional[str] = None
     author: Optional[UserOut] = None
     time_ago: Optional[str] = None
     my_vote: int = 0
@@ -37,6 +38,7 @@ class FeedItemOut(_Out):
 
 class GistItemOut(_Out):
     gist: GistOut
+    maturity: Optional[str] = None
     author: Optional[UserOut] = None
     time_ago: Optional[str] = None
     my_vote: int = 0
@@ -120,6 +122,7 @@ class FeedOut(_Out):
 
 
 class PostDetailOut(_Out):
+    maturity: Optional[str] = None
     post: PostOut
     author: Optional[UserOut] = None
     is_owner: bool = False
@@ -149,6 +152,7 @@ class ProjectsOut(_Out):
 
 
 class ProjectDetailOut(_Out):
+    maturity: Optional[str] = None
     project: ProjectOut
     author: Optional[UserOut] = None
     is_owner: bool = False
@@ -183,6 +187,7 @@ class GistsOut(_Out):
 
 
 class GistDetailOut(_Out):
+    maturity: Optional[str] = None
     gist: GistOut
     author: Optional[UserOut] = None
     is_owner: bool = False
@@ -201,6 +206,7 @@ class NewsListOut(_Out):
 
 
 class NewsDetailOut(_Out):
+    maturity: Optional[str] = None
     article: NewsOut
     canonical_slug: Optional[str] = None
     image_url: Optional[str] = None
diff --git a/devplacepy/schemas/moderation.py b/devplacepy/schemas/moderation.py
new file mode 100644
index 00000000..7611cf7d
--- /dev/null
+++ b/devplacepy/schemas/moderation.py
@@ -0,0 +1,136 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+from devplacepy.schemas.admin import AdminUserOut
+from devplacepy.schemas.base import _Out
+
+
+class ReportOut(_Out):
+    uid: Optional[str] = None
+    target_type: Optional[str] = None
+    target_uid: Optional[str] = None
+    target_url: Optional[str] = None
+    reason: Optional[str] = None
+    reason_label: Optional[str] = None
+    detail: Optional[str] = None
+    severity: Optional[str] = None
+    status: Optional[str] = None
+    origin: Optional[str] = None
+    categories: list[str] = []
+    created_at: Optional[str] = None
+    updated_at: Optional[str] = None
+    resolved_at: Optional[str] = None
+    reporter_name: Optional[str] = None
+    owner_name: Optional[str] = None
+    report_count: Optional[int] = None
+
+
+class ReportCreatedOut(_Out):
+    report: Optional[ReportOut] = None
+    sla_hours: Optional[int] = None
+    message: Optional[str] = None
+
+
+class ReportListOut(_Out):
+    reports: list[ReportOut] = []
+    pagination: Optional[Any] = None
+    status: Optional[str] = None
+    reasons: list[Any] = []
+
+
+class ReportReasonsOut(_Out):
+    reasons: list[Any] = []
+    severities: list[str] = []
+
+
+class ModerationActionOut(_Out):
+    uid: Optional[str] = None
+    report_uid: Optional[str] = None
+    action: Optional[str] = None
+    actor_name: Optional[str] = None
+    reason: Optional[str] = None
+    notes: Optional[str] = None
+    expires_at: Optional[str] = None
+    created_at: Optional[str] = None
+
+
+class SlaOut(_Out):
+    sla_hours: Optional[int] = None
+    oldest_open_hours: Optional[float] = None
+    oldest_open_uid: Optional[str] = None
+    breached: Optional[int] = None
+    within_sla: Optional[bool] = None
+
+
+class AdminModerationOut(_Out):
+    reports: list[ReportOut] = []
+    pagination: Optional[Any] = None
+    status: Optional[str] = None
+    statuses: list[Any] = []
+    counts: dict = {}
+    sla: Optional[SlaOut] = None
+    admin_section: Optional[str] = None
+
+
+class AdminReportOut(_Out):
+    report: Optional[ReportOut] = None
+    actions: list[ModerationActionOut] = []
+    history: list[ModerationActionOut] = []
+    available_actions: list[str] = []
+    can_remove: Optional[bool] = None
+    subject: Optional[AdminUserOut] = None
+    sla: Optional[SlaOut] = None
+    admin_section: Optional[str] = None
+
+
+class MaturityOut(_Out):
+    target_type: Optional[str] = None
+    target_uid: Optional[str] = None
+    level: Optional[str] = None
+    source: Optional[str] = None
+
+
+class ConsentOut(_Out):
+    kind: Optional[str] = None
+    label: Optional[str] = None
+    state: Optional[str] = None
+    version: Optional[str] = None
+    granted_at: Optional[str] = None
+    withdrawn_at: Optional[str] = None
+
+
+class ConsentListOut(_Out):
+    consents: list[ConsentOut] = []
+
+
+class AcceptTermsOut(_Out):
+    terms_version: Optional[str] = None
+    accepted_version: Optional[str] = None
+
+
+class AccountDeletionOut(_Out):
+    username: Optional[str] = None
+    grace_hours: Optional[int] = None
+    retained: list[str] = []
+    removed: list[str] = []
+
+
+class WorkspaceIndexItemOut(_Out):
+    uid: Optional[str] = None
+    name: Optional[str] = None
+    slug: Optional[str] = None
+    owner_uid: Optional[str] = None
+    url: Optional[str] = None
+    description: Optional[str] = None
+    owner: Optional[str] = None
+    maturity: Optional[str] = None
+    project_url: Optional[str] = None
+
+
+class WorkspaceIndexOut(_Out):
+    workspaces: list[WorkspaceIndexItemOut] = []
+    pagination: Optional[Any] = None
+    total: Optional[int] = None
diff --git a/devplacepy/schemas/profile.py b/devplacepy/schemas/profile.py
index 3fc3a4a2..307360d2 100644
--- a/devplacepy/schemas/profile.py
+++ b/devplacepy/schemas/profile.py
@@ -82,6 +82,15 @@ class ProfileOut(_Out):
     awards_count: int = 0
     prominent_award: Optional[AwardOut] = None
     can_give_award: bool = False
+    consents: list[Any] = []
+    mature_opt_in: bool = False
+    age_band: Optional[str] = None
+    terms_version: Optional[str] = None
+    terms_accepted_at: Optional[str] = None
+    current_terms_version: Optional[str] = None
+    suspended_until: Optional[str] = None
+    suspension_reason: Optional[str] = None
+    deletion_grace_hours: Optional[int] = None
 
 
 class TelegramPairOut(_Out):
diff --git a/devplacepy/schemas/quiz.py b/devplacepy/schemas/quiz.py
index 42a979d8..93ed7b23 100644
--- a/devplacepy/schemas/quiz.py
+++ b/devplacepy/schemas/quiz.py
@@ -82,6 +82,7 @@ class QuizOut(_Out):
 
 
 class QuizDetailOut(_Out):
+    maturity: Optional[str] = None
     quiz: QuizOut = QuizOut()
     questions: list[QuizQuestionOut] = []
     comments: list[CommentItemOut] = []
diff --git a/devplacepy/seo.py b/devplacepy/seo.py
index 99261d70..5c4f32d1 100644
--- a/devplacepy/seo.py
+++ b/devplacepy/seo.py
@@ -15,6 +15,15 @@ logger = logging.getLogger(__name__)
 
 SITE_NAME = "DevPlace"
 SITEMAP_URL_LIMIT = 5000
+
+LEGAL_DOC_SLUGS = (
+    "terms",
+    "community-guidelines",
+    "privacy",
+    "content-moderation",
+    "intellectual-property",
+    "contact",
+)
 SITEMAP_TTL = int(os.environ.get("DEVPLACE_SITEMAP_TTL", "3600"))
 _sitemap_cache = {}
 
@@ -424,6 +433,18 @@ def _build_sitemap(base_url):
     urlset.append(url_element(f"{base_url}/tools", changefreq="monthly", priority="0.5"))
     urlset.append(url_element(f"{base_url}/tools/seo", changefreq="monthly", priority="0.5"))
     urlset.append(url_element(f"{base_url}/tools/deepsearch", changefreq="monthly", priority="0.5"))
+    urlset.append(
+        url_element(f"{base_url}/workspaces/index", changefreq="daily", priority="0.6")
+    )
+    urlset.append(
+        url_element(f"{base_url}/reports/reasons", changefreq="monthly", priority="0.4")
+    )
+    for slug in LEGAL_DOC_SLUGS:
+        urlset.append(
+            url_element(
+                f"{base_url}/docs/{slug}.html", changefreq="monthly", priority="0.5"
+            )
+        )
 
     if "posts" in db.tables:
         posts = _collect(
@@ -533,9 +554,13 @@ def _build_sitemap(base_url):
     try:
         from devplacepy.routers.docs.pages import DOCS_PAGES
 
+        listed = set(LEGAL_DOC_SLUGS)
         for page in DOCS_PAGES:
             if page.get("admin") or page.get("kind") == "live":
                 continue
+            if page["slug"] in listed:
+                continue
+            listed.add(page["slug"])
             urlset.append(
                 url_element(
                     f"{base_url}/docs/{page['slug']}.html",
diff --git a/devplacepy/services/CLAUDE.md b/devplacepy/services/CLAUDE.md
index 5f3633eb..a1cf7b5b 100644
--- a/devplacepy/services/CLAUDE.md
+++ b/devplacepy/services/CLAUDE.md
@@ -114,6 +114,10 @@ devplace devii reset-quota --guests     # Reset every guest quota
 devplace devii reset-quota --all        # Reset every quota (users and guests)
 ```
 
+## Moderation housekeeping (`services/moderation/service.py`)
+
+`ModerationService` is a lock-owner `BaseService` (default-enabled, hourly, floor 300s) with two jobs: it purges accounts whose deletion grace window has closed (`deletion.purge_due`, the same code path as `devplace accounts prune`), and it reports the moderation queue's service-level snapshot - logging when a report is past the published response window and exposing the queue counts, the oldest open age and the pending-purge count as `collect_metrics` stat cards. It owns no request-path work; the queue itself is entirely synchronous. Full subsystem detail in `devplacepy/services/moderation/CLAUDE.md`.
+
 ## Multi-worker concurrency (preferred rules)
 
 `uvicorn --workers N` = N independent processes sharing only the filesystem and SQLite DB. Module-global caches/counters are per-process, so a local `clear()` is invisible to siblings. Full reference: admin docs `Production -> Multi-worker and concurrency` (`templates/docs/production-concurrency.html`). Enforce these:
@@ -177,6 +181,8 @@ Online status is a single **`users.last_seen`** UTC-ISO column (ensured in `data
 
 **Write path (all workers):** `main.py`'s `track_presence` HTTP middleware resolves the cached current user on every non-`/static`, non-`/avatar` request and calls `presence.touch(uid)`. `touch` keeps a per-worker in-memory `_last_write: dict[uid -> monotonic]` and writes `users.last_seen` (via `database.set_last_seen`) only when the last write for that uid is older than `config.PRESENCE_WRITE_SECONDS` (= `PRESENCE_TIMEOUT_SECONDS // 2`). So continuous browsing is a dict lookup; a write happens at most ~once per half-window per active user per worker, and the row is updated in place (zero growth). It deliberately does **not** call `clear_user_cache` (that would defeat the 300s auth cache; the stale cached self-row is irrelevant since presence of *other* users is always read from a fresh row).
 
+**Consent gate (write path).** `touch` checks `presence.recording_allowed(uid)` (the `activity_recording` consent) **after** the per-worker throttle, so the consent read costs at most one query per half-window per active user rather than one per request. A user who withdraws the consent simply stops being written and appears offline; `base.html` shows a `.recording-indicator` while it is on. Never move the check above the throttle.
+
 **Read path (any worker):** `presence.is_online(user_row)` = `now - last_seen < PRESENCE_TIMEOUT_SECONDS` (env `DEVPLACE_PRESENCE_TIMEOUT_SECONDS`, default 60). Profile (`routers/profile/index.py` -> `profile_online`) and messages (`routers/messages.py` seed) read `last_seen` off the user row they already loaded - no extra query. Exposed as the Jinja global `is_online(user)` (`templating.py`), on `UserOut.last_seen` and `ProfileOut.profile_online`. This is the **only** cross-worker-correct approach here because pub/sub is in-process.
 
 **Live path (lock owner only), ONE set on ONE topic, change-only + hysteresis:** `PresenceRelayService` (`services/presence_relay.py`, `BaseService`, default-enabled, 2s tick, registered in `main.py`) is a sibling of `NotificationRelayService`/`LiveViewRelayService` and is **the single source of truth for live online status**. Each tick, only while the roster topic has subscribers, it reads the online population in ONE indexed query (`presence.online_candidates()`, capped at `config.PRESENCE_TRACK_LIMIT`, env `DEVPLACE_PRESENCE_TRACK_LIMIT`, default 500) and recomputes ONE set `self._online` with **hysteresis** via `presence.stays_online(elapsed, was_online)`: a user becomes online at `PRESENCE_TIMEOUT_SECONDS` but only drops after `+ PRESENCE_ONLINE_MARGIN_SECONDS` (env `DEVPLACE_PRESENCE_ONLINE_MARGIN_SECONDS`, default 20) - **quick to go online, slow (grace margin) to go offline** - which kills boundary flicker. It publishes that set on the ONE shared topic `public.presence.roster` (`roster_payload`: `{count, online: [uid...], users: [display rows]}`) **only when the set of online uids changes** (a `frozenset` compare, so reordering never republishes), never on a fixed interval, so an idle site emits nothing. `online` is the authority for EVERY avatar dot; `users` is the same set trimmed to `PRESENCE_ONLINE_LIMIT` for the feed's avatar panel, and `count` matches it. **There are no per-user `public.presence.{uid}` topics** - they were removed precisely because their candidate population differed from the roster's, so dots and roster could disagree (the /messages-vs-feed bug). One set, one topic, one frame. `public.presence.roster` is subscribable by any logged-in user (`pubsub/policy.py` allows `public.*`); guests keep the server-rendered initial state.
diff --git a/devplacepy/services/audit/categories.py b/devplacepy/services/audit/categories.py
index 67a615b9..4ae6020c 100644
--- a/devplacepy/services/audit/categories.py
+++ b/devplacepy/services/audit/categories.py
@@ -3,6 +3,12 @@
 CATEGORY_BY_PREFIX: dict[str, str] = {
     "auth": "auth",
     "profile": "account",
+    "account": "account",
+    "consent": "account",
+    "terms": "account",
+    "report": "moderation",
+    "moderation": "moderation",
+    "filter": "moderation",
     "follow": "social",
     "award": "social",
     "relation": "social",
diff --git a/devplacepy/services/bot/auth.py b/devplacepy/services/bot/auth.py
index 6cc3636d..a8b3bec0 100644
--- a/devplacepy/services/bot/auth.py
+++ b/devplacepy/services/bot/auth.py
@@ -10,6 +10,8 @@ from devplacepy.services.bot.handles import make_handle
 
 logger = logging.getLogger(__name__)
 
+SIGNUP_BIRTH_DATE = "1995-01-01"
+
 
 class BotAuthMixin:
     def _generate_handle(self) -> str:
@@ -70,6 +72,10 @@ class BotAuthMixin:
             await b.fill("#password", self.state.password)
             await b._idle(0.2, 0.5)
             await b.fill("#confirm_password", self.state.password)
+            await b._idle(0.2, 0.5)
+            await b.fill("#birth_date", SIGNUP_BIRTH_DATE)
+            await b._idle(0.2, 0.5)
+            await b.click("#accept_terms")
             await b._idle(0.5, 1.0)
             await b.click(".auth-submit")
             await asyncio.sleep(2)
diff --git a/devplacepy/services/containers/CLAUDE.md b/devplacepy/services/containers/CLAUDE.md
index 7969a1dd..46b9df64 100644
--- a/devplacepy/services/containers/CLAUDE.md
+++ b/devplacepy/services/containers/CLAUDE.md
@@ -172,6 +172,8 @@ Both `api.sync_workspace` (HTTP/Devii sync action, returns `{exported, imported}
 
 An instance's `run_as_uid` column selects WHICH DevPlace user's identity and `api_key` are injected (`DEVPLACE_API_KEY`, `DEVPLACE_USER_UID`), resolved in `api.pravda_env` ahead of the `created_by`/`owner_uid` fallback chain. It does **NOT** change the container OS user, which is ALWAYS `pravda` (uid 1000) - required for the bind-mounted `/app` (DooD uid maps 1:1 to host). Validate it against an existing user via `api.validate_run_as`.
 
+**Running as someone else requires their consent (load-bearing).** `validate_run_as(run_as_uid, actor_uid)` refuses when the run-as user is not the actor and has not granted the `container_credentials` consent. This is not a policy nicety: `pravda_env` injects that user's real `DEVPLACE_API_KEY` into a container someone else operates, so without the gate an administrator could hand any member's platform credential to software that member never saw. `create_instance` and `update_instance_config` both pass `_actor_uid(actor)`, so the gate covers the admin UI, the per-project manager and the Devii container tools at once. Running as **yourself** needs no consent - you are the one handing over your own credential. The consent is granted and withdrawn from the member's own profile privacy tab like every other consent; see `devplacepy/services/moderation/CLAUDE.md`.
+
 ## Boot source precedence (load-bearing)
 
 Columns `boot_language` (`none`|`python`|`bash`) + `boot_script` (multiline source) sit alongside the legacy `boot_command`. Precedence in `api.run_spec_for`: `boot_script` (by language) > `boot_command` > image CMD (`sleep infinity`). When a boot script is set, the reconciler writes it into the workspace (`api.materialize_boot_script`, `.devplace_boot.py`/`.devplace_boot.sh`, excluded from sync) before launch and runs `python|bash /app/.devplace_boot.<ext>`. `api.validate_boot` enforces the language set and a 100k char cap.
diff --git a/devplacepy/services/containers/api.py b/devplacepy/services/containers/api.py
index 312e3118..75a8c62a 100644
--- a/devplacepy/services/containers/api.py
+++ b/devplacepy/services/containers/api.py
@@ -49,7 +49,11 @@ def _validate_limits(cpu_limit: str, mem_limit: str) -> None:
         raise ContainerError("memory limit must look like 512m, 1g, or a byte count")
 
 
-def validate_run_as(run_as_uid) -> str:
+def _actor_uid(actor) -> str:
+    return actor[1] if actor and actor[0] == "user" else ""
+
+
+def validate_run_as(run_as_uid, actor_uid: str = "") -> str:
     uid = str(run_as_uid or "").strip()
     if not uid:
         return ""
@@ -58,6 +62,13 @@ def validate_run_as(run_as_uid) -> str:
     user = database.get_users_by_uids([uid]).get(uid)
     if not user:
         raise ContainerError(f"run-as user not found: {uid}")
+    if actor_uid and actor_uid != uid:
+        if not database.consent_granted("user", uid, "container_credentials"):
+            raise ContainerError(
+                f"{user['username']} has not consented to their DevPlace credentials "
+                f"being shared with software run by someone else; they grant it under "
+                f"Privacy on their profile"
+            )
     return uid
 
 
@@ -224,7 +235,7 @@ async def create_instance(
             f"restart policy must be one of {', '.join(store.RESTART_POLICIES)}"
         )
     _validate_limits(cpu_limit, mem_limit)
-    run_as_uid = validate_run_as(run_as_uid)
+    run_as_uid = validate_run_as(run_as_uid, _actor_uid(actor))
     boot_language, boot_script = validate_boot(boot_language, boot_script)
     port_list = assign_host_ports(parse_ports(ports))
     env_map = parse_env(env)
@@ -324,7 +335,7 @@ def update_instance_config(
 ) -> dict:
     changes: dict = {}
     if run_as_uid is not None:
-        changes["run_as_uid"] = validate_run_as(run_as_uid)
+        changes["run_as_uid"] = validate_run_as(run_as_uid, _actor_uid(actor))
     if boot_language is not None or boot_script is not None:
         language = (
             boot_language
diff --git a/devplacepy/services/devii/actions/catalog/__init__.py b/devplacepy/services/devii/actions/catalog/__init__.py
index 2141073c..5994d8b3 100644
--- a/devplacepy/services/devii/actions/catalog/__init__.py
+++ b/devplacepy/services/devii/actions/catalog/__init__.py
@@ -14,6 +14,7 @@ from .gists import GIST_ACTIONS
 from .issues import ISSUE_ACTIONS
 from .jobs import JOB_ACTIONS
 from .messages import MESSAGE_ACTIONS
+from .moderation import MODERATION_ACTIONS
 from .news import NEWS_ACTIONS
 from .notifications import NOTIFICATION_ACTIONS
 from .posts import POSTS_ACTIONS
@@ -47,6 +48,7 @@ ACTIONS: tuple[Action, ...] = (
     + GATEWAY_ACTIONS
     + GAME_ACTIONS
     + QUIZ_ACTIONS
+    + MODERATION_ACTIONS
 )
 
 PLATFORM_CATALOG = Catalog(actions=ACTIONS)
diff --git a/devplacepy/services/devii/actions/catalog/_shared.py b/devplacepy/services/devii/actions/catalog/_shared.py
index 7041292a..4442c3f4 100644
--- a/devplacepy/services/devii/actions/catalog/_shared.py
+++ b/devplacepy/services/devii/actions/catalog/_shared.py
@@ -15,8 +15,16 @@ def query(name: str, description: str, required: bool = False) -> Param:
     )
 
 
-def body(name: str, description: str, required: bool = False) -> Param:
-    return Param(name=name, location="body", description=description, required=required)
+def body(
+    name: str, description: str, required: bool = False, type: str = "string"
+) -> Param:
+    return Param(
+        name=name,
+        location="body",
+        description=description,
+        required=required,
+        type=type,
+    )
 
 
 def upload(name: str, description: str) -> Param:
diff --git a/devplacepy/services/devii/actions/catalog/moderation.py b/devplacepy/services/devii/actions/catalog/moderation.py
new file mode 100644
index 00000000..3f125606
--- /dev/null
+++ b/devplacepy/services/devii/actions/catalog/moderation.py
@@ -0,0 +1,242 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+from devplacepy.database.moderation import (
+    CONSENT_KINDS,
+    MODERATION_ACTIONS as DECISION_KINDS,
+    REPORT_REASONS,
+    REPORT_STATUSES,
+    REPORTABLE_TARGETS,
+)
+
+from ..spec import Action
+from ._shared import body, confirm, path, query
+
+
+TARGET_KEYS = ", ".join(REPORTABLE_TARGETS)
+REASON_KEYS = ", ".join(REPORT_REASONS)
+STATUS_KEYS = ", ".join(REPORT_STATUSES)
+DECISION_KEYS = ", ".join(DECISION_KINDS)
+CONSENT_KEYS = ", ".join(CONSENT_KINDS)
+CONSENT_CHOICES = "; ".join(
+    f"{kind} ({label})" for kind, label in CONSENT_KINDS.items()
+)
+
+
+MODERATION_ACTIONS: tuple[Action, ...] = (
+    Action(
+        name="report_reasons",
+        method="GET",
+        path="/reports/reasons",
+        summary="List the reasons a piece of content can be reported under",
+        requires_auth=False,
+    ),
+    Action(
+        name="report_content",
+        method="POST",
+        path="/reports/{target_type}/{target_uid}",
+        summary="Report content that breaks the community guidelines",
+        description=(
+            "Files a report a moderator reviews within the published response window. "
+            "Use report_reasons to pick a valid reason key first."
+        ),
+        params=(
+            path("target_type", f"Type of content being reported: {TARGET_KEYS}."),
+            path("target_uid", "Uid of the reported item."),
+            body("reason", f"Reason key: {REASON_KEYS}.", required=True),
+            body("detail", "What the moderator should know, up to 2000 characters."),
+        ),
+    ),
+    Action(
+        name="list_my_reports",
+        method="GET",
+        path="/reports/mine",
+        summary="List the reports you filed and their outcome",
+        params=(
+            query("status", f"Filter by status: {STATUS_KEYS}."),
+            query("page", "Page number, 25 per page."),
+        ),
+    ),
+    Action(
+        name="list_reports",
+        method="GET",
+        path="/admin/moderation",
+        summary="List the moderation queue, oldest open report first",
+        requires_admin=True,
+        params=(
+            query("status", f"Filter by status: {STATUS_KEYS}."),
+            query("page", "Page number, 25 per page."),
+        ),
+    ),
+    Action(
+        name="get_report",
+        method="GET",
+        path="/admin/moderation/{uid}",
+        summary="Read one report, its decisions and the author's moderation history",
+        requires_admin=True,
+        params=(path("uid", "Report uid."),),
+    ),
+    Action(
+        name="set_report_status",
+        method="POST",
+        path="/admin/moderation/{uid}/status",
+        summary="Move a report through the triage state machine",
+        requires_admin=True,
+        params=(
+            path("uid", "Report uid."),
+            body("status", f"New status: {STATUS_KEYS}.", required=True),
+        ),
+    ),
+    Action(
+        name="decide_report",
+        method="POST",
+        path="/admin/moderation/{uid}/decide",
+        summary="Apply a moderation decision to a report",
+        description=(
+            "Removes or restores content, warns, suspends, bans, lifts, dismisses or "
+            "escalates. The decision is recorded and the affected user is told why. "
+            "Show the moderator the exact report and decision, get explicit "
+            "confirmation, then call again with confirm=true."
+        ),
+        requires_admin=True,
+        params=(
+            path("uid", "Report uid."),
+            body("action", f"Decision to apply: {DECISION_KEYS}.", required=True),
+            body("reason", "Reason shown to the affected user."),
+            body("notes", "Internal notes, never shown to the user."),
+            body("duration_hours", "Suspension length in hours.", type="integer"),
+            confirm(),
+        ),
+    ),
+    Action(
+        name="suspend_user",
+        method="POST",
+        path="/admin/users/{uid}/suspend",
+        summary="Suspend an account for a fixed period with a stated reason",
+        description=(
+            "A suspended account can still read, see why, and delete itself, but "
+            "cannot post. Show the moderator the exact account, get explicit "
+            "confirmation, then call again with confirm=true."
+        ),
+        requires_admin=True,
+        params=(
+            path("uid", "User uid to suspend."),
+            body("reason", "Reason shown to the user."),
+            body("duration_hours", "Suspension length in hours.", type="integer"),
+            confirm(),
+        ),
+    ),
+    Action(
+        name="lift_suspension",
+        method="POST",
+        path="/admin/users/{uid}/lift",
+        summary="Lift a suspension or ban and restore the account",
+        requires_admin=True,
+        params=(path("uid", "User uid to restore."),),
+    ),
+    Action(
+        name="accept_terms",
+        method="POST",
+        path="/auth/accept-terms",
+        summary="Accept the current version of the Terms of Service",
+        description=(
+            "Records acceptance of the version in force and of the privacy policy. "
+            "Show the user the terms first."
+        ),
+    ),
+    Action(
+        name="list_consents",
+        method="GET",
+        path="/profile/{username}",
+        summary="List the consents on an account and whether each is granted",
+        description=(
+            "Only the account holder and an administrator see the consents; for anyone "
+            "else the list comes back empty."
+        ),
+        params=(
+            path("username", "Your own username, or an account you administer."),
+            query("tab", "Profile tab (use privacy for this action)."),
+        ),
+    ),
+    Action(
+        name="set_consent",
+        method="POST",
+        path="/profile/{username}/consent",
+        summary="Grant or withdraw one consent on your own account",
+        description=(
+            f"Kinds: {CONSENT_CHOICES}. Withdrawal takes effect immediately. Only the "
+            "account holder can change a consent, administrators included."
+        ),
+        params=(
+            path("username", "Your own username."),
+            body("kind", f"Consent kind to change: {CONSENT_KEYS}.", required=True),
+            body("granted", "1 to grant, 0 to withdraw.", required=True),
+        ),
+    ),
+    Action(
+        name="set_mature_content",
+        method="POST",
+        path="/profile/{username}/mature-content",
+        summary="Turn the mature-content reveal on or off for your own account",
+        params=(
+            path("username", "Your own username."),
+            body("mature_opt_in", "1 to show mature content, 0 to hide it.", required=True),
+        ),
+    ),
+    Action(
+        name="view_account_deletion",
+        method="GET",
+        path="/profile/{username}/delete",
+        summary="Read what account deletion removes, what it retains and the grace window",
+        description=(
+            "Returns the removed list, the retained list and the grace window in hours. "
+            "Read it and show it to the user before calling delete_my_account. Only the "
+            "account holder may read it."
+        ),
+        params=(path("username", "Your own username."),),
+    ),
+    Action(
+        name="delete_my_account",
+        method="POST",
+        path="/profile/{username}/delete",
+        summary="Permanently delete your own account and personal data",
+        description=(
+            "Only the account holder can do this, and only with their password. "
+            "Sessions are revoked, the profile is anonymised at once, and the content "
+            "is purged after the published grace window. Show the user exactly what "
+            "will be removed, get explicit confirmation, then call again with "
+            "confirm=true."
+        ),
+        params=(
+            path("username", "Your own username."),
+            body("password", "Your account password.", required=True),
+            confirm(),
+        ),
+    ),
+    Action(
+        name="list_published_workspaces",
+        method="GET",
+        path="/workspaces/index",
+        summary="List every workspace published to the public ingress, with its link",
+        requires_auth=False,
+        params=(query("page", "Page number, 50 per page."),),
+    ),
+    Action(
+        name="ban_user",
+        method="POST",
+        path="/admin/users/{uid}/ban",
+        summary="Permanently close an account with a stated reason",
+        description=(
+            "Disables the account, revokes every session and token, and tells the "
+            "user why. Show the moderator the exact account, get explicit "
+            "confirmation, then call again with confirm=true."
+        ),
+        requires_admin=True,
+        params=(
+            path("uid", "User uid to ban."),
+            body("reason", "Reason shown to the user."),
+            confirm(),
+        ),
+    ),
+)
diff --git a/devplacepy/services/devii/actions/dispatcher.py b/devplacepy/services/devii/actions/dispatcher.py
index 3f57d456..0ee11dbb 100644
--- a/devplacepy/services/devii/actions/dispatcher.py
+++ b/devplacepy/services/devii/actions/dispatcher.py
@@ -32,6 +32,10 @@ from .spec import Action, Catalog
 MUTATING_METHODS = ("POST", "DELETE", "PUT", "PATCH")
 
 CONFIRM_REQUIRED = {
+    "delete_my_account",
+    "decide_report",
+    "suspend_user",
+    "ban_user",
     "workspace_stop",
     "workspace_delete",
     "tunnel_delete",
@@ -247,6 +251,32 @@ def confirmation_error(name: str, arguments: dict[str, Any]) -> ToolInputError |
             f"such as rm, dd, truncate, or drop): {command!r}. Show the user the exact command, get "
             "explicit confirmation, then call again with confirm=true."
         )
+    if name == "delete_my_account":
+        return ToolInputError(
+            "Deleting the account revokes every session, anonymises the profile at once and "
+            "purges the content once the grace window closes. Call view_account_deletion, show "
+            "the user exactly what goes and what is kept, get explicit confirmation, then call "
+            "again with confirm=true."
+        )
+    if name == "suspend_user":
+        return ToolInputError(
+            "Suspending an account blocks the member from posting for the whole period and "
+            "notifies them. Show the moderator the exact account and reason, get explicit "
+            "confirmation, then call again with confirm=true."
+        )
+    if name == "ban_user":
+        return ToolInputError(
+            "Banning closes the account, revokes every session and token, and notifies the user. "
+            "Show the moderator the exact account and reason, get explicit confirmation, then "
+            "call again with confirm=true."
+        )
+    if name == "decide_report":
+        decision = str(arguments.get("action", "")).strip() or "(unspecified)"
+        return ToolInputError(
+            f"Applying '{decision}' resolves the report, records the decision and tells the "
+            "affected user why. Show the moderator the exact report and decision, get explicit "
+            "confirmation, then call again with confirm=true."
+        )
     if name == "email_account_delete":
         label = str(arguments.get("account", "")).strip() or "(unspecified)"
         return ToolInputError(
diff --git a/devplacepy/services/messaging/persist.py b/devplacepy/services/messaging/persist.py
index c2f00e96..8dad3b6b 100644
--- a/devplacepy/services/messaging/persist.py
+++ b/devplacepy/services/messaging/persist.py
@@ -17,6 +17,11 @@ from devplacepy.utils import (
 from devplacepy.services.audit import record as audit
 from devplacepy.services.correction import schedule_correction
 from devplacepy.services.ai_modifier import schedule_modification
+from devplacepy.services.moderation.screening import (
+    record as record_screening,
+    refuse_if_blocked,
+    screen_fields,
+)
 
 logger = logging.getLogger("messaging.persist")
 
@@ -79,6 +84,9 @@ def persist_message(
     if sender["uid"] in get_blocked_uids(receiver_uid):
         return None
 
+    screening = screen_fields("messages", {"content": content})
+    refuse_if_blocked(screening)
+
     sender_uid = sender["uid"]
     sender_username = sender.get("username", "")
     messages_table = get_table("messages")
@@ -96,6 +104,13 @@ def persist_message(
     )
 
     link_attachments(attachment_uids, "message", msg_uid)
+    record_screening(
+        screening,
+        target_type="message",
+        target_uid=msg_uid,
+        actor_uid=sender_uid,
+        request=request,
+    )
     schedule_correction(sender, "messages", msg_uid, request)
     schedule_modification(sender, "messages", msg_uid, request)
 
diff --git a/devplacepy/services/moderation/CLAUDE.md b/devplacepy/services/moderation/CLAUDE.md
new file mode 100644
index 00000000..bf232e16
--- /dev/null
+++ b/devplacepy/services/moderation/CLAUDE.md
@@ -0,0 +1,126 @@
+This file documents the moderation subsystem (`devplacepy/services/moderation/`, the `/reports` and `/admin/moderation` routers, the report/maturity/consent data layer in `database/moderation.py`, and account deletion). Claude Code auto-loads it whenever a file under this directory is read or edited.
+
+## Why this subsystem exists
+
+It is the safety layer an app store requires of a social platform: a filter at post time, a report control on every surface, a queue with a published response window, real enforcement, statements of reasons, consent, age gating, and self-service account deletion. The design and the requirement-to-artifact map live in `appleimpl.md` at the repository root.
+
+## The two load-bearing ideas
+
+**One registry, one queue.** `database/moderation.py` `REPORTABLE_TARGETS` maps every externally visible surface to its table; `content_reports` is the single queue with two producers (members and the filter) and one state machine. Every consumer - the report route, the report partial, the Devii action, the API docs enum, the admin filter - derives from the registry, so adding a surface is one line rather than twenty.
+
+**Coverage is enforced, not remembered.** `tests/unit/database/moderation.py` asserts that every table in `SOFT_DELETE_TABLES` is either in `REPORTABLE_TARGETS` or in the explicit, reviewed `UNREPORTABLE_TABLES` exclusion list (with its reason). Adding a user-generated table without classifying it **fails the suite**. Never widen the exclusion list to silence that test without a real reason for the entry.
+
+## Module map
+
+| File | Owns |
+|---|---|
+| `rules.py` | The category rule set (`RULES`), `FILTER_MODES`, `ALWAYS_BLOCK_CATEGORIES`, the technical-context discount |
+| `filter.py` | `classify(text, mode) -> Classification`, `screen(values) -> Screening`, `resolve_verdict` |
+| `screening.py` | The choke-point API: `screen_fields`, `refuse_if_blocked`, `record`, and the `ContentRefused` exception |
+| `queue.py` | `raise_report`, `claim_open`, `set_status`, `escalate`, `record_action`, `list_reports`, `status_counts` |
+| `enforcement.py` | `remove_content`, `restore_content`, `suspend_user`, `lift_suspension`, `ban_user`, `revoke_sessions`, `notify_subject` (the one statement-of-reasons delivery: type `moderation`, target `NOTICE_URL`) |
+| `deletion.py` | `claim_deletion`, `delete_account`, `cascade`, `anonymise`, `due_purges`, `purge_due` |
+| `sla.py` | `sla_hours`, `oldest_open`, `breach_count`, `snapshot` |
+| `service.py` | `ModerationService` - lock-owner housekeeping: purges due deletions, reports the SLA, exposes queue metrics |
+
+## The filter: five choke points, and why it defaults to review
+
+`classify` is never called from a router. It runs through `screening.screen_fields` at exactly five places, because content creation on DevPlace already funnels through them:
+
+1. `content.create_content_item` - posts, projects, gists, news, quizzes
+2. `content.create_comment_record`
+3. `content.edit_content_item` and `content.edit_comment_record`
+4. `services/messaging/persist.persist_message` - both the HTTP and WebSocket DM paths
+5. `routers/profile/index.update_profile` and `models.SignupForm` (username)
+
+The pattern at each is the same and the order is load-bearing: **screen and refuse before the write, record after it** (the report needs the target uid).
+
+```python
+screening = screen_fields(table_name, fields)
+refuse_if_blocked(screening)
+...the insert...
+record(screening, target_type=..., target_uid=uid, actor_uid=user["uid"], request=request)
+```
+
+`refuse_if_blocked` raises `ContentRefused`, handled once by the `@app.exception_handler(ContentRefused)` in `main.py` (400 + the category list for JSON, the error page for a browser). **No caller catches it** - that is what keeps the five choke points free of per-route error handling.
+
+Three properties must not regress:
+
+- **The default mode is `review`, not `block`.** A match publishes and raises a system report. This is not timidity: this is a developer platform whose members discuss exploits, malware analysis and violent subject matter as their work, and a machine that suppressed them would destroy the product. Only `ALWAYS_BLOCK_CATEGORIES` (sexual, exploitative) refuse outright.
+- **The technical-context discount only ever lowers a score.** `rules.TECHNICAL_CONTEXT` matches security-research vocabulary and subtracts from `weapons`/`violence`/`illegal` weights. Never make it raise a score; a property test asserts the direction.
+- **The filter fails to `review`, never to `allow`.** `classify` wraps `_classify` in a try/except that returns `verdict="review", failed=True` with the error in `detail`, and `screening.record` escalates a failed classification to a `critical` report. A safety control that fails silently is worse than none.
+
+`moderation_filter_mode` (`off`/`label`/`review`/`block`) and `moderation_filter_review_score` are live `site_settings`. `resolve_verdict` is monotone in the mode: strengthening the mode can never weaken a verdict, and a property test iterates the whole mode x verdict matrix.
+
+## The queue: one atomic resolution, never a check-then-act
+
+`queue.claim_open(uid, status, actor)` is the only way a report becomes `actioned`/`dismissed`. It is a single conditional `UPDATE ... WHERE status IN (open, acknowledged)` through `database.conditional_update_row`, decided on the driver's real `rowcount`. Two administrators deciding the same report simultaneously produce **exactly one** `moderation_actions` row; the loser gets a 409. This is proven with 16 real OS processes, not threads. Never replace it with a read-then-write.
+
+`escalate` is deliberately not a resolution: it raises severity to `critical` and returns the report to `acknowledged` for a second opinion.
+
+Duplicate handling mirrors `workspace_flags.raise_flag`: an open report by the same reporter on the same target is **updated**, never duplicated; a different reporter creates a second row and the queue shows the count.
+
+## Enforcement, and what removal cannot cover
+
+`enforcement.can_remove(target_type)` is the honest boundary. Content removal exists for posts, gists, projects, quizzes, news, comments, attachments and project files. It does **not** exist for direct messages, accounts, workspaces, polls or assistant output - those have no removal path in the data model, so the remedy is the account-level action (warn/suspend/ban). The admin UI filters the action list on this predicate and says so; do not paper over it with a silently-failing "remove".
+
+`remove_content` reuses `content.delete_content_item` / `delete_comment_record` rather than re-implementing the cascade, so a moderator removal is byte-identical to an owner removal (same soft delete, same stamp, same audit).
+
+Suspension is enforced by ONE predicate, `utils.guards.refuse_suspended`. It gates **mutating methods only** and exempts `/auth`, `/reports`, `/block`, `/mute`, account deletion and consent changes, so a suspended user can always read, always see why, always report, always withdraw a consent, and always delete their account. A user is never trapped.
+
+**Every auth resolver must reach that predicate.** `require_user` / `require_user_api` cover the whole HTTP surface, but two paths authenticate on their own and would otherwise be silent bypasses - both now call the same predicate rather than re-implementing it:
+
+- **devRant** (`/api`) resolves in-band `token_id`/`token_key`, never `require_user`. `routers/devrant/_shared.resolve_actor(request, params)` wraps `tokens.resolve_user` with `refuse_suspended` and is what every devRant handler calls. The one deliberate exception is `DELETE /api/users/me`, which calls `resolve_user` directly because it is the account-deletion path and must stay reachable. `is_account_active` (which the token resolver already checks) covers a **ban** but not a time-boxed suspension, which is why the extra call is needed.
+- **The messages WebSocket.** `@app.middleware("http")` never runs for a WebSocket scope, so neither the terms gate nor the suspension gate applied to `WS /messages/ws`. `_ws_may_write(user)` checks `suspension_active` and `needs_acceptance` at connect and closes `1008`, mirroring the guest branch. `refuse_suspended` itself cannot be reused there - it reads `request.method`, which a WebSocket has no equivalent of.
+
+Adding a new auth resolver means adding it to this list, not adding a second suspension rule.
+
+Every per-user enforcement passes `routers/admin/_shared.is_senior_admin` / `deny_senior` (moved there from `admin/users.py` so the moderation router shares it), so a junior administrator can never action a senior one - server-side, therefore also binding on Devii.
+
+## Account deletion: claim, cascade under one stamp, anonymise, purge
+
+`deletion.delete_account(user)` returns `None` when it loses the race and a result dict when it wins:
+
+1. `claim_deletion` - one atomic `UPDATE users SET deletion_requested_at = :stamp WHERE uid = :uid AND COALESCE(deletion_requested_at, '') = ''`, decided on `rowcount`. **The `COALESCE` is load-bearing**: the column is NULL on rows that predate it, and `NULL = ''` is NULL, not true. Sixteen concurrent processes produce exactly one cascade.
+2. `revoke_sessions` - sessions, access tokens and devRant tokens.
+3. `cascade` - `OWNED_TABLES` (an explicit, reviewed registry of table+column pairs) plus `CHILD_TABLES` (rows owned through a parent), all under the **one shared stamp**, so `/admin/trash` restores or purges the whole event atomically.
+4. `anonymise` - tombstones the username and clears every field in `ANONYMISED_FIELDS`. From the user's and everyone else's point of view the account is gone the moment they confirm.
+5. `purge_due` - after `account_deletion_grace_hours`, `purge_event(stamp)` plus a hard delete of the tombstone row. Run by `ModerationService` and by `devplace accounts prune`.
+
+`user_consents`, `content_reports` and `moderation_actions` are deliberately **not** in the cascade: they key on `owner_id`/`reporter_uid`, not `user_uid`, and the privacy policy states that the moderation and consent record is retained. Adding them to `OWNED_TABLES` would destroy the proof that the platform enforced its own rules.
+
+Deletion is **owner-only** (`_owner_only` in `routers/profile/delete.py`) and needs the account password. An administrator removing someone uses a ban, not a deletion - they cannot know the password, and a ban is the auditable act. The devRant `DELETE /api/users/me` routes into this same cascade; it is no longer a deactivation.
+
+## Consent, and the one AI gate
+
+Five consents live in `user_consents` (`CONSENT_KINDS`), append-only in effect: a withdrawal stamps the current row and writes a new one, so the history is provable. Signup grants `terms`, `privacy` and `activity_recording`; **`ai_third_party` and `container_credentials` are never granted by default.**
+
+**Changing a consent is owner-only, exactly like account deletion** (`_owner_only` in `routers/profile/delete.py`, reused by `routers/profile/consent.py` for both `POST /profile/{username}/consent` and `POST /profile/{username}/mature-content`). An administrator reads the privacy tab of an account they moderate, but may never grant or withdraw on someone else's behalf - a consent an administrator could grant would not be a consent, and it would let an admin unlock third-party AI processing of a member's content or hand a member the mature-content reveal. The privacy tab renders the toggles only for the owner and the profile route withholds `age_band`/`terms_*`/`suspended_until`/`suspension_reason`/`mature_opt_in` from any other viewer in BOTH the HTML and the `ProfileOut` JSON (the same rule as the `_ai_quota` dollar fields).
+
+The gate is at exactly one place: `GatewayService.consent_denied` in `services/openai_gateway/service.py`, checked in `handle()` right after `resolve_owner`. The split is the whole point:
+
+- owner kind `user`/`admin` = the call carries **that user's own content** -> requires `ai_third_party` consent, 403 otherwise;
+- owner kind `internal`/`key`/`anonymous` = **platform processing** (news import, bots, SEO metadata) -> ungated.
+
+`ai_correction_enabled` / `ai_modifier_enabled` survive unchanged as *preferences* subordinate to consent. No consumer changed and no existing preference was flipped: withdrawing consent simply makes the gateway refuse.
+
+`container_credentials` gates `containers/api.validate_run_as`: a container configured to run as **someone else** would inject that person's real `DEVPLACE_API_KEY` into software they do not operate, so it is refused unless they granted the consent. Running a container as yourself never asks - you are the one handing over your own credential.
+
+`activity_recording` gates `presence.touch`, checked **after** the per-worker throttle so the consent read costs at most one query per half-window per user. Withdraw it and you simply appear offline. The indicator is the `.recording-indicator` in `base.html`, rendered from the `activity_recording_on(user)` Jinja global.
+
+## Terms re-acceptance
+
+`terms_acceptance_gate` in `main.py` sits beside the maintenance gate. It gates **mutating methods only** and exempts `/static`, `/avatar`, `/auth`, `/docs`, `/reports`, `/block`, `/mute`, `/openai` and account deletion. Reading, accepting and leaving are never blocked.
+
+Every reader of a policy version uses `get_setting(key, "1") or "1"`. **This is not cosmetic**: on a fresh database `init_db` skips the settings seed (its `tables` snapshot predates `site_settings`), so an admin settings save can insert `terms_version = ""`, and a bare `get_setting` would then compare every user's `"1"` against `""` and 403 every write on the platform. That was a real failure; keep the `or "1"`.
+
+## Maturity
+
+`content_maturity` is polymorphic (`target_type`, `target_uid`), read through the batch helper `get_maturity_by_targets` - never per row. Absence of a row means `general`, so nothing needed backfilling. `content.maturity_hidden(level, user)` is the single predicate (also the `maturity_hidden` Jinja global) and `_maturity_gate.html` is the single interstitial; `enrich_items` and `load_detail` attach `maturity` so listings and detail pages both have it with one query.
+
+## Rules for extending this
+
+- A new user-generated surface: add it to `REPORTABLE_TARGETS`, make it resolve in `resolve_object_url`, and include `_report_button.html` in its action bar. The registry test enforces the first two, the e2e coverage test the third.
+- A new filter category: add rules to `rules.py` and the reason key to `REPORT_REASONS`; a unit test asserts every rule's category is a real reason.
+- A new consent: add it to `CONSENT_KINDS` and enforce it at one choke point, never at N call sites.
+- Never add a second removal path, a second suspension check, or a second consent gate.
diff --git a/devplacepy/services/moderation/__init__.py b/devplacepy/services/moderation/__init__.py
new file mode 100644
index 00000000..a375946f
--- /dev/null
+++ b/devplacepy/services/moderation/__init__.py
@@ -0,0 +1,21 @@
+# retoor <retoor@molodetz.nl>
+
+from devplacepy.services.moderation import (
+    deletion,
+    enforcement,
+    filter,
+    queue,
+    rules,
+    sla,
+)
+from devplacepy.services.moderation.service import ModerationService
+
+__all__ = [
+    "ModerationService",
+    "deletion",
+    "enforcement",
+    "filter",
+    "queue",
+    "rules",
+    "sla",
+]
diff --git a/devplacepy/services/moderation/deletion.py b/devplacepy/services/moderation/deletion.py
new file mode 100644
index 00000000..8786f44b
--- /dev/null
+++ b/devplacepy/services/moderation/deletion.py
@@ -0,0 +1,211 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import text
+
+from devplacepy.database import (
+    _now_iso,
+    db,
+    get_int_setting,
+    get_table,
+    purge_event,
+    soft_delete,
+    soft_delete_in,
+)
+from devplacepy.utils import clear_user_cache
+
+logger = logging.getLogger(__name__)
+
+
+DEFAULT_GRACE_HOURS = 24
+
+TOMBSTONE_UID_CHARS = 12
+
+
+OWNED_TABLES: tuple[tuple[str, str], ...] = (
+    ("posts", "user_uid"),
+    ("comments", "user_uid"),
+    ("gists", "user_uid"),
+    ("projects", "user_uid"),
+    ("quizzes", "user_uid"),
+    ("quiz_attempts", "user_uid"),
+    ("quiz_answers", "user_uid"),
+    ("attachments", "user_uid"),
+    ("votes", "user_uid"),
+    ("reactions", "user_uid"),
+    ("bookmarks", "user_uid"),
+    ("poll_votes", "user_uid"),
+    ("follows", "follower_uid"),
+    ("follows", "following_uid"),
+    ("awards", "receiver_uid"),
+    ("awards", "giver_uid"),
+    ("user_relations", "user_uid"),
+    ("user_relations", "target_uid"),
+    ("notification_preferences", "user_uid"),
+    ("issue_tickets", "user_uid"),
+    ("issue_comment_authors", "user_uid"),
+    ("sessions", "user_uid"),
+    ("access_tokens", "user_uid"),
+    ("devrant_tokens", "user_uid"),
+    ("email_accounts", "user_uid"),
+    ("devii_conversations", "owner_id"),
+    ("devii_tasks", "owner_id"),
+    ("devii_lessons", "owner_id"),
+    ("devii_virtual_tools", "owner_id"),
+    ("user_customizations", "owner_id"),
+    ("deepsearch_sessions", "owner_id"),
+    ("isslop_analyses", "owner_id"),
+)
+
+CHILD_TABLES: tuple[tuple[str, str, str, str], ...] = (
+    ("project_files", "project_uid", "projects", "user_uid"),
+    ("project_forks", "project_uid", "projects", "user_uid"),
+    ("polls", "post_uid", "posts", "user_uid"),
+    ("quiz_questions", "quiz_uid", "quizzes", "user_uid"),
+    ("deepsearch_messages", "session_uid", "deepsearch_sessions", "owner_id"),
+)
+
+ANONYMISED_FIELDS: tuple[str, ...] = (
+    "email",
+    "bio",
+    "location",
+    "git_link",
+    "website",
+    "avatar_seed",
+    "api_key",
+    "password_hash",
+    "timezone",
+    "last_seen",
+    "suspension_reason",
+    "suspended_until",
+)
+
+
+def grace_hours() -> int:
+    return max(0, get_int_setting("account_deletion_grace_hours", DEFAULT_GRACE_HOURS))
+
+
+def tombstone_username(uid: str) -> str:
+    return f"deleted_{uid.replace('-', '')[:TOMBSTONE_UID_CHARS]}"
+
+
+def _child_uids(parent_table: str, owner_column: str, user_uid: str) -> list[str]:
+    if parent_table not in db.tables:
+        return []
+    table = get_table(parent_table)
+    if not table.has_column(owner_column) or not table.has_column("uid"):
+        return []
+    return [row["uid"] for row in table.find(**{owner_column: user_uid}) if row.get("uid")]
+
+
+def cascade(user_uid: str, stamp: str) -> int:
+    removed = 0
+    for table_name, child_column, parent_table, owner_column in CHILD_TABLES:
+        if table_name not in db.tables:
+            continue
+        if not get_table(table_name).has_column(child_column):
+            continue
+        parents = _child_uids(parent_table, owner_column, user_uid)
+        if parents:
+            removed += soft_delete_in(
+                table_name, child_column, parents, user_uid, stamp=stamp
+            )
+    for table_name, column in OWNED_TABLES:
+        if table_name not in db.tables:
+            continue
+        if not get_table(table_name).has_column(column):
+            continue
+        removed += soft_delete(table_name, user_uid, stamp=stamp, **{column: user_uid})
+    return removed
+
+
+def anonymise(user: dict, stamp: str) -> None:
+    changes = {
+        "uid": user["uid"],
+        "username": tombstone_username(user["uid"]),
+        "is_active": False,
+        "deletion_requested_at": stamp,
+        "role": "Member",
+    }
+    for column in ANONYMISED_FIELDS:
+        changes[column] = ""
+    get_table("users").update(changes, ["uid"])
+    clear_user_cache(user["uid"])
+
+
+def claim_deletion(user_uid: str, stamp: str) -> bool:
+    with db:
+        result = db.executable.execute(
+            text(
+                "UPDATE users SET deletion_requested_at = :stamp "
+                "WHERE uid = :uid AND COALESCE(deletion_requested_at, '') = ''"
+            ),
+            {"stamp": stamp, "uid": user_uid},
+        )
+    return result.rowcount == 1
+
+
+def delete_account(user: dict) -> dict | None:
+    from devplacepy.database import invalidate_admins_cache, invalidate_user_relations
+    from devplacepy.services.moderation.enforcement import revoke_sessions
+
+    stamp = _now_iso()
+    if not claim_deletion(user["uid"], stamp):
+        logger.info(f"Account {user['uid']} was already being deleted")
+        return None
+    revoke_sessions(user["uid"])
+    removed = cascade(user["uid"], stamp)
+    anonymise(user, stamp)
+    invalidate_admins_cache()
+    invalidate_user_relations(user["uid"])
+    logger.info(f"Account {user['uid']} deleted, {removed} rows removed under {stamp}")
+    return {"stamp": stamp, "rows": removed, "grace_hours": grace_hours()}
+
+
+def due_purges(now: datetime | None = None) -> list[dict]:
+    if "users" not in db.tables:
+        return []
+    table = get_table("users")
+    if not table.has_column("deletion_requested_at"):
+        return []
+    moment = now or datetime.now(timezone.utc)
+    cutoff = (moment - timedelta(hours=grace_hours())).isoformat()
+    rows = db.query(
+        "SELECT uid, deletion_requested_at FROM users "
+        "WHERE deletion_requested_at IS NOT NULL AND deletion_requested_at != '' "
+        "AND deletion_requested_at <= :cutoff",
+        cutoff=cutoff,
+    )
+    return [dict(row) for row in rows]
+
+
+def purge_due(now: datetime | None = None) -> int:
+    from devplacepy.services.audit import record as audit
+
+    purged = 0
+    for row in due_purges(now):
+        tables = purge_event(row["deletion_requested_at"])
+        _purge_user_row(row["uid"])
+        purged += 1
+        audit.record_system(
+            "account.delete.purge",
+            target_type="user",
+            target_uid=row["uid"],
+            summary=f"purged deleted account {row['uid']} after the grace window",
+            metadata={
+                "stamp": row["deletion_requested_at"],
+                "tables": [name for name, _ in tables],
+            },
+            links=[audit.target("user", row["uid"])],
+        )
+    return purged
+
+
+def _purge_user_row(user_uid: str) -> None:
+    with db:
+        db.query("DELETE FROM users WHERE uid = :uid", uid=user_uid)
+    clear_user_cache(user_uid)
diff --git a/devplacepy/services/moderation/enforcement.py b/devplacepy/services/moderation/enforcement.py
new file mode 100644
index 00000000..2c0c8aac
--- /dev/null
+++ b/devplacepy/services/moderation/enforcement.py
@@ -0,0 +1,139 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+
+from devplacepy.database import (
+    _now_iso,
+    get_table,
+    restore_event,
+    soft_delete,
+)
+from devplacepy.utils import clear_user_cache, create_notification
+
+
+NOTICE_URL = "/docs/content-moderation.html"
+
+REMOVABLE_TABLES: dict[str, str] = {
+    "post": "posts",
+    "gist": "gists",
+    "project": "projects",
+    "quiz": "quizzes",
+    "news": "news",
+}
+
+SUBJECT_ONLY_TARGETS: frozenset[str] = frozenset(
+    {"message", "user", "workspace", "poll", "devii_output"}
+)
+
+
+def notify_subject(user_uid: str, message: str) -> None:
+    if not user_uid or not message:
+        return
+    create_notification(user_uid, "moderation", message, user_uid, NOTICE_URL)
+
+
+def can_remove(target_type: str) -> bool:
+    if target_type in REMOVABLE_TABLES:
+        return True
+    return target_type in ("comment", "attachment", "project_file")
+
+
+def remove_content(request, admin: dict, target_type: str, target_uid: str) -> bool:
+    if target_type in REMOVABLE_TABLES:
+        from devplacepy.content import delete_content_item
+
+        table_name = REMOVABLE_TABLES[target_type]
+        delete_content_item(
+            request,
+            table_name,
+            target_type,
+            admin,
+            target_uid,
+            f"/{table_name}",
+        )
+        return True
+    if target_type == "comment":
+        from devplacepy.content import delete_comment_record
+
+        comment = get_table("comments").find_one(uid=target_uid, deleted_at=None)
+        if not comment:
+            return False
+        delete_comment_record(request, admin, comment)
+        return True
+    if target_type == "attachment":
+        from devplacepy.attachments import soft_delete_attachment
+
+        return bool(soft_delete_attachment(target_uid, admin["uid"]))
+    if target_type == "project_file":
+        node = get_table("project_files").find_one(uid=target_uid, deleted_at=None)
+        if not node:
+            return False
+        soft_delete("project_files", admin["uid"], uid=target_uid)
+        return True
+    return False
+
+
+def restore_content(target_type: str, target_uid: str) -> bool:
+    table_name = REMOVABLE_TABLES.get(target_type)
+    if target_type == "comment":
+        table_name = "comments"
+    elif target_type == "attachment":
+        table_name = "attachments"
+    elif target_type == "project_file":
+        table_name = "project_files"
+    if not table_name:
+        return False
+    row = get_table(table_name).find_one(uid=target_uid)
+    if not row or not row.get("deleted_at"):
+        return False
+    restore_event(row["deleted_at"])
+    return True
+
+
+def suspend_user(subject: dict, hours: int, reason: str) -> str:
+    until = (datetime.now(timezone.utc) + timedelta(hours=max(1, hours))).isoformat()
+    get_table("users").update(
+        {"uid": subject["uid"], "suspended_until": until, "suspension_reason": reason},
+        ["uid"],
+    )
+    clear_user_cache(subject["uid"])
+    return until
+
+
+def lift_suspension(subject: dict) -> None:
+    get_table("users").update(
+        {"uid": subject["uid"], "suspended_until": "", "suspension_reason": ""},
+        ["uid"],
+    )
+    clear_user_cache(subject["uid"])
+
+
+def ban_user(subject: dict, reason: str) -> None:
+    get_table("users").update(
+        {
+            "uid": subject["uid"],
+            "is_active": False,
+            "suspension_reason": reason,
+            "suspended_until": "",
+        },
+        ["uid"],
+    )
+    revoke_sessions(subject["uid"])
+    clear_user_cache(subject["uid"])
+
+
+def unban_user(subject: dict) -> None:
+    get_table("users").update(
+        {"uid": subject["uid"], "is_active": True, "suspension_reason": ""}, ["uid"]
+    )
+    clear_user_cache(subject["uid"])
+
+
+def revoke_sessions(user_uid: str) -> int:
+    stamp = _now_iso()
+    revoked = soft_delete("sessions", user_uid, stamp=stamp, user_uid=user_uid)
+    revoked += soft_delete("access_tokens", user_uid, stamp=stamp, user_uid=user_uid)
+    revoked += soft_delete("devrant_tokens", user_uid, stamp=stamp, user_uid=user_uid)
+    return revoked
diff --git a/devplacepy/services/moderation/filter.py b/devplacepy/services/moderation/filter.py
new file mode 100644
index 00000000..1336e09a
--- /dev/null
+++ b/devplacepy/services/moderation/filter.py
@@ -0,0 +1,127 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+
+from devplacepy.database import get_int_setting, get_setting
+
+from devplacepy.services.moderation.rules import (
+    ALWAYS_BLOCK_CATEGORIES,
+    DEFAULT_REVIEW_SCORE,
+    FILTER_MODES,
+    MATURE_CATEGORIES,
+    matches,
+    score_for,
+)
+
+logger = logging.getLogger(__name__)
+
+VERDICT_ORDER: dict[str, int] = {"allow": 0, "label": 1, "review": 2, "block": 3}
+
+MODE_ORDER: dict[str, int] = {"off": 0, "label": 1, "review": 2, "block": 3}
+
+
+@dataclass(frozen=True)
+class Classification:
+    verdict: str = "allow"
+    categories: tuple[str, ...] = ()
+    maturity: str = "general"
+    score: int = 0
+    failed: bool = False
+    detail: str = ""
+
+    @property
+    def flagged(self) -> bool:
+        return self.verdict in ("review", "block")
+
+
+@dataclass(frozen=True)
+class Screening:
+    classification: Classification
+    fields: tuple[str, ...] = ()
+
+    @property
+    def blocked(self) -> bool:
+        return self.classification.verdict == "block"
+
+    @property
+    def flagged(self) -> bool:
+        return self.classification.flagged
+
+
+def filter_mode() -> str:
+    mode = get_setting("moderation_filter_mode", "review")
+    return mode if mode in FILTER_MODES else "review"
+
+
+def review_score() -> int:
+    return max(
+        1, get_int_setting("moderation_filter_review_score", DEFAULT_REVIEW_SCORE)
+    )
+
+
+def resolve_verdict(verdict: str, mode: str) -> str:
+    if mode == "off":
+        return "allow"
+    if mode == "label":
+        return "label" if VERDICT_ORDER[verdict] > VERDICT_ORDER["label"] else verdict
+    if mode == "block" and verdict == "review":
+        return "block"
+    return verdict
+
+
+def classify(text: str, mode: str = "") -> Classification:
+    active = mode if mode in FILTER_MODES else filter_mode()
+    if active == "off" or not (text or "").strip():
+        return Classification()
+    try:
+        return _classify(text, active)
+    except Exception as exc:
+        logger.warning("moderation filter failed, falling back to review: %s", exc)
+        return Classification(
+            verdict="review",
+            categories=("other",),
+            failed=True,
+            detail=f"classification failed: {exc}",
+        )
+
+
+def _classify(text: str, mode: str) -> Classification:
+    matched = matches(text)
+    if not matched:
+        return Classification()
+    categories = tuple(sorted({rule.category for rule in matched}))
+    score = score_for(text, matched)
+    if score <= 0:
+        return Classification(categories=categories)
+    if set(categories) & ALWAYS_BLOCK_CATEGORIES:
+        verdict = "block"
+    elif score >= review_score():
+        verdict = "review"
+    else:
+        verdict = "label"
+    maturity = "mature" if set(categories) & MATURE_CATEGORIES else "general"
+    return Classification(
+        verdict=resolve_verdict(verdict, mode),
+        categories=categories,
+        maturity=maturity,
+        score=score,
+        detail=", ".join(categories),
+    )
+
+
+def screen(values: dict[str, str], mode: str = "") -> Screening:
+    worst = Classification()
+    flagged_fields: list[str] = []
+    for name, value in values.items():
+        result = classify(value or "", mode)
+        if result.verdict == "allow":
+            continue
+        flagged_fields.append(name)
+        if VERDICT_ORDER[result.verdict] > VERDICT_ORDER[worst.verdict] or (
+            result.verdict == worst.verdict and result.score > worst.score
+        ):
+            worst = result
+    return Screening(classification=worst, fields=tuple(flagged_fields))
diff --git a/devplacepy/services/moderation/queue.py b/devplacepy/services/moderation/queue.py
new file mode 100644
index 00000000..3836a70b
--- /dev/null
+++ b/devplacepy/services/moderation/queue.py
@@ -0,0 +1,358 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+import json
+
+from devplacepy.database import (
+    ACTIONS_TABLE,
+    MODERATION_ACTIONS,
+    REPORTABLE_TARGETS,
+    REPORTS_TABLE,
+    REPORT_OPEN_STATUSES,
+    REPORT_ORIGINS,
+    REPORT_REASONS,
+    REPORT_SEVERITIES,
+    REPORT_STATUSES,
+    SYSTEM_ACTOR,
+    _in_clause,
+    _now_iso,
+    build_pagination,
+    conditional_update_row,
+    db,
+    get_table,
+    get_users_by_uids,
+    resolve_object_url,
+)
+from devplacepy.utils import generate_uid
+
+
+PER_PAGE = 25
+
+CRITICAL_REASONS: frozenset[str] = frozenset(
+    {"sexual", "exploitative", "self_harm", "illegal"}
+)
+
+
+def severity_for_reason(reason: str) -> str:
+    if reason in CRITICAL_REASONS:
+        return "critical"
+    if reason == "spam":
+        return "info"
+    return "warn"
+
+
+def owner_uid_for(target_type: str, target_uid: str) -> str:
+    table_name = REPORTABLE_TARGETS.get(target_type)
+    if not table_name or table_name not in db.tables:
+        return ""
+    row = get_table(table_name).find_one(uid=target_uid)
+    if not row:
+        return ""
+    if target_type == "user":
+        return row.get("uid", "")
+    for column in ("user_uid", "sender_uid", "owner_uid", "receiver_uid", "giver_uid"):
+        value = row.get(column)
+        if value:
+            return value
+    return ""
+
+
+def open_report(target_type: str, target_uid: str, reporter_uid: str) -> dict | None:
+    if REPORTS_TABLE not in db.tables:
+        return None
+    for status in REPORT_OPEN_STATUSES:
+        found = get_table(REPORTS_TABLE).find_one(
+            target_type=target_type,
+            target_uid=target_uid,
+            reporter_uid=reporter_uid,
+            status=status,
+            deleted_at=None,
+        )
+        if found:
+            return found
+    return None
+
+
+def raise_report(
+    *,
+    target_type: str,
+    target_uid: str,
+    reporter_uid: str,
+    reason: str,
+    detail: str = "",
+    origin: str = "member",
+    severity: str = "",
+    categories: list[str] | None = None,
+) -> dict | None:
+    if target_type not in REPORTABLE_TARGETS or reason not in REPORT_REASONS:
+        return None
+    if origin not in REPORT_ORIGINS:
+        origin = "member"
+    if severity not in REPORT_SEVERITIES:
+        severity = severity_for_reason(reason)
+    table = get_table(REPORTS_TABLE)
+    now = _now_iso()
+    payload = json.dumps(categories or [])
+    existing = open_report(target_type, target_uid, reporter_uid)
+    if existing:
+        table.update(
+            {
+                "id": existing["id"],
+                "reason": reason,
+                "detail": detail,
+                "severity": severity,
+                "categories": payload,
+                "updated_at": now,
+            },
+            ["id"],
+        )
+        return table.find_one(id=existing["id"])
+    uid = generate_uid()
+    table.insert(
+        {
+            "uid": uid,
+            "reporter_uid": reporter_uid,
+            "target_type": target_type,
+            "target_uid": target_uid,
+            "owner_uid": owner_uid_for(target_type, target_uid),
+            "reason": reason,
+            "detail": detail,
+            "severity": severity,
+            "status": "open",
+            "origin": origin,
+            "categories": payload,
+            "resolved_by": "",
+            "resolved_at": "",
+            "created_at": now,
+            "updated_at": now,
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    return table.find_one(uid=uid)
+
+
+def get_report(uid: str) -> dict | None:
+    if REPORTS_TABLE not in db.tables:
+        return None
+    return get_table(REPORTS_TABLE).find_one(uid=uid, deleted_at=None)
+
+
+def set_status(uid: str, status: str, actor_uid: str) -> dict | None:
+    if status not in REPORT_STATUSES:
+        return None
+    report = get_report(uid)
+    if not report:
+        return None
+    now = _now_iso()
+    changes = {"id": report["id"], "status": status, "updated_at": now}
+    if status in ("actioned", "dismissed"):
+        changes["resolved_by"] = actor_uid
+        changes["resolved_at"] = now
+    else:
+        changes["resolved_by"] = ""
+        changes["resolved_at"] = ""
+    get_table(REPORTS_TABLE).update(changes, ["id"])
+    return get_table(REPORTS_TABLE).find_one(id=report["id"])
+
+
+def claim_open(uid: str, status: str, actor_uid: str) -> bool:
+    if status not in ("actioned", "dismissed"):
+        return False
+    placeholders, params = _in_clause(list(REPORT_OPEN_STATUSES), prefix="s")
+    params.update({"status": status, "actor": actor_uid, "resolved": _now_iso()})
+    changed = conditional_update_row(
+        REPORTS_TABLE,
+        uid,
+        "status = :status, resolved_by = :actor, resolved_at = :resolved",
+        f"deleted_at IS NULL AND status IN ({placeholders})",
+        params,
+    )
+    return changed == 1
+
+
+def escalate(uid: str) -> dict | None:
+    report = get_report(uid)
+    if not report:
+        return None
+    get_table(REPORTS_TABLE).update(
+        {
+            "id": report["id"],
+            "severity": "critical",
+            "status": "acknowledged",
+            "resolved_by": "",
+            "resolved_at": "",
+            "updated_at": _now_iso(),
+        },
+        ["id"],
+    )
+    return get_table(REPORTS_TABLE).find_one(id=report["id"])
+
+
+def record_action(
+    *,
+    report_uid: str,
+    actor_uid: str,
+    action: str,
+    target_type: str,
+    target_uid: str,
+    subject_uid: str = "",
+    reason: str = "",
+    notes: str = "",
+    expires_at: str = "",
+) -> dict | None:
+    if action not in MODERATION_ACTIONS:
+        return None
+    table = get_table(ACTIONS_TABLE)
+    uid = generate_uid()
+    table.insert(
+        {
+            "uid": uid,
+            "report_uid": report_uid,
+            "actor_uid": actor_uid,
+            "action": action,
+            "target_type": target_type,
+            "target_uid": target_uid,
+            "subject_uid": subject_uid,
+            "reason": reason,
+            "notes": notes,
+            "expires_at": expires_at,
+            "created_at": _now_iso(),
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    return table.find_one(uid=uid)
+
+
+def actions_for_report(report_uid: str) -> list[dict]:
+    if ACTIONS_TABLE not in db.tables:
+        return []
+    return list(
+        get_table(ACTIONS_TABLE).find(
+            report_uid=report_uid, deleted_at=None, order_by=["-created_at"]
+        )
+    )
+
+
+def actions_for_subject(subject_uid: str, limit: int = 20) -> list[dict]:
+    if not subject_uid or ACTIONS_TABLE not in db.tables:
+        return []
+    return list(
+        get_table(ACTIONS_TABLE).find(
+            subject_uid=subject_uid,
+            deleted_at=None,
+            order_by=["-created_at"],
+            _limit=limit,
+        )
+    )
+
+
+def status_counts() -> dict[str, int]:
+    counts = {status: 0 for status in REPORT_STATUSES}
+    if REPORTS_TABLE not in db.tables:
+        return counts
+    rows = db.query(
+        f"SELECT status, COUNT(*) AS n FROM {REPORTS_TABLE} "
+        f"WHERE deleted_at IS NULL GROUP BY status"
+    )
+    for row in rows:
+        if row["status"] in counts:
+            counts[row["status"]] = int(row["n"])
+    return counts
+
+
+def duplicate_counts(target_pairs: list[tuple[str, str]]) -> dict[tuple[str, str], int]:
+    if not target_pairs or REPORTS_TABLE not in db.tables:
+        return {}
+    uids = [uid for _, uid in target_pairs]
+    placeholders, params = _in_clause(uids)
+    rows = db.query(
+        f"SELECT target_type, target_uid, COUNT(*) AS n FROM {REPORTS_TABLE} "
+        f"WHERE deleted_at IS NULL AND target_uid IN ({placeholders}) "
+        f"GROUP BY target_type, target_uid",
+        **params,
+    )
+    return {(row["target_type"], row["target_uid"]): int(row["n"]) for row in rows}
+
+
+def list_reports(
+    *,
+    status: str = "open",
+    reporter_uid: str = "",
+    page: int = 1,
+    per_page: int = PER_PAGE,
+) -> tuple[list[dict], dict]:
+    if REPORTS_TABLE not in db.tables:
+        return [], build_pagination(page, 0, per_page)
+    table = get_table(REPORTS_TABLE)
+    filters: dict[str, object] = {"deleted_at": None}
+    if status in REPORT_STATUSES:
+        filters["status"] = status
+    if reporter_uid:
+        filters["reporter_uid"] = reporter_uid
+    total = table.count(**filters)
+    pagination = build_pagination(page, total, per_page)
+    offset = (pagination["page"] - 1) * pagination["per_page"]
+    rows = list(
+        table.find(
+            order_by=["created_at", "id"],
+            _limit=pagination["per_page"],
+            _offset=offset,
+            **filters,
+        )
+    )
+    return enrich_reports(rows), pagination
+
+
+def enrich_reports(rows: list[dict]) -> list[dict]:
+    people = get_users_by_uids(
+        [row.get("reporter_uid") for row in rows if row.get("reporter_uid")]
+        + [row.get("owner_uid") for row in rows if row.get("owner_uid")]
+    )
+    duplicates = duplicate_counts(
+        [(row["target_type"], row["target_uid"]) for row in rows]
+    )
+    enriched = []
+    for row in rows:
+        reporter = people.get(row.get("reporter_uid"))
+        owner = people.get(row.get("owner_uid"))
+        enriched.append(
+            {
+                "uid": row["uid"],
+                "target_type": row["target_type"],
+                "target_uid": row["target_uid"],
+                "target_url": resolve_object_url(row["target_type"], row["target_uid"]),
+                "reason": row["reason"],
+                "reason_label": REPORT_REASONS.get(row["reason"], row["reason"]),
+                "detail": row.get("detail", ""),
+                "severity": row.get("severity", "warn"),
+                "status": row.get("status", "open"),
+                "origin": row.get("origin", "member"),
+                "categories": _categories(row.get("categories")),
+                "created_at": row.get("created_at", ""),
+                "updated_at": row.get("updated_at", ""),
+                "resolved_at": row.get("resolved_at", ""),
+                "reporter_uid": row.get("reporter_uid", ""),
+                "reporter_name": reporter["username"]
+                if reporter
+                else (SYSTEM_ACTOR if row.get("reporter_uid") == SYSTEM_ACTOR else ""),
+                "owner_uid": row.get("owner_uid", ""),
+                "owner_name": owner["username"] if owner else "",
+                "report_count": duplicates.get(
+                    (row["target_type"], row["target_uid"]), 1
+                ),
+            }
+        )
+    return enriched
+
+
+def _categories(raw) -> list[str]:
+    if not raw:
+        return []
+    try:
+        loaded = json.loads(raw)
+    except (TypeError, ValueError):
+        return []
+    return [str(item) for item in loaded] if isinstance(loaded, list) else []
diff --git a/devplacepy/services/moderation/rules.py b/devplacepy/services/moderation/rules.py
new file mode 100644
index 00000000..c55e426b
--- /dev/null
+++ b/devplacepy/services/moderation/rules.py
@@ -0,0 +1,178 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+
+FILTER_MODES: tuple[str, ...] = ("off", "label", "review", "block")
+
+ALWAYS_BLOCK_CATEGORIES: frozenset[str] = frozenset({"sexual", "exploitative"})
+
+MATURE_CATEGORIES: frozenset[str] = frozenset({"sexual", "violence", "self_harm"})
+
+DEFAULT_REVIEW_SCORE = 2
+DEFAULT_BLOCK_SCORE = 6
+
+
+@dataclass(frozen=True)
+class Rule:
+    category: str
+    weight: int
+    pattern: re.Pattern[str]
+
+
+def _rule(category: str, weight: int, expression: str) -> Rule:
+    return Rule(
+        category=category,
+        weight=weight,
+        pattern=re.compile(expression, re.IGNORECASE),
+    )
+
+
+RULES: tuple[Rule, ...] = (
+    _rule(
+        "hate",
+        6,
+        r"\b(?:gas|exterminate|eradicate|purge)\s+(?:the\s+)?"
+        r"(?:jews|muslims|blacks|whites|asians|gays|trans(?:\s?people)?|immigrants)\b",
+    ),
+    _rule(
+        "hate",
+        4,
+        r"\b(?:all|every)\s+(?:jews|muslims|blacks|whites|asians|gays|trans(?:\s?people)?|"
+        r"immigrants|women|men)\s+(?:are|should\s+be)\s+"
+        r"(?:subhuman|vermin|animals|scum|killed|deported|removed)\b",
+    ),
+    _rule("hate", 5, r"\b(?:white|racial)\s+(?:power|supremacy)\b.{0,40}\b(?:rise|fight|war)\b"),
+    _rule(
+        "violence",
+        6,
+        r"\b(?:i\s+(?:will|am\s+going\s+to|wanna|want\s+to)|we\s+will)\s+"
+        r"(?:kill|murder|shoot|stab|behead|burn)\s+(?:you|him|her|them|u)\b",
+    ),
+    _rule("violence", 5, r"\b(?:i\s+know\s+where\s+you\s+live|watch\s+your\s+back,?\s+(?:you|i))\b"),
+    _rule("violence", 4, r"\b(?:death|bomb)\s+threat\s+(?:to|against)\s+\w+"),
+    _rule(
+        "weapons",
+        5,
+        r"\b(?:how\s+to\s+)?(?:build|make|assemble|construct)\s+(?:a\s+|an\s+)?"
+        r"(?:pipe\s?bomb|nail\s?bomb|ied|pressure\s?cooker\s+bomb|nerve\s+agent|"
+        r"sarin|ricin|dirty\s+bomb)\b",
+    ),
+    _rule(
+        "weapons",
+        4,
+        r"\b(?:untraceable|ghost)\s+(?:gun|firearm)\b.{0,40}\b(?:build|print|make|assemble)\b",
+    ),
+    _rule(
+        "sexual",
+        8,
+        r"\b(?:child|minor|underage|preteen|loli|shota)\s?(?:porn|pornography|sex|nudes|cp)\b",
+    ),
+    _rule("sexual", 5, r"\b(?:hardcore|explicit)\s+(?:porn|pornography|xxx)\b"),
+    _rule("sexual", 4, r"\b(?:nudes|sexting|camgirl|onlyfans)\b.{0,30}\b(?:dm|send|link|free)\b"),
+    _rule(
+        "exploitative",
+        8,
+        r"\b(?:sell|buy|trade|traffic(?:king)?)\s+(?:a\s+)?"
+        r"(?:child|children|minor|minors|girl|girls|boy|boys)\b",
+    ),
+    _rule(
+        "religious",
+        4,
+        r"\b(?:all|every)\s+(?:christians|muslims|jews|hindus|buddhists|atheists)\s+"
+        r"(?:are|should\s+be)\s+(?:killed|removed|banned|scum|vermin)\b",
+    ),
+    _rule(
+        "misinformation",
+        3,
+        r"\b(?:vaccines?\s+(?:cause|causes)\s+autism|drink(?:ing)?\s+bleach\s+"
+        r"(?:cures|to\s+cure)|the\s+election\s+was\s+stolen\s+and)\b",
+    ),
+    _rule(
+        "harassment",
+        4,
+        r"\b(?:kill\s+your\s?self|kys|neck\s+your\s?self)\b",
+    ),
+    _rule(
+        "harassment",
+        3,
+        r"\b(?:you\s+(?:are|'re|r)\s+(?:a\s+)?(?:worthless|pathetic|disgusting)\s+"
+        r"(?:piece\s+of\s+\w+|human|waste))\b",
+    ),
+    _rule(
+        "harassment",
+        4,
+        r"\b(?:here\s+is|posting)\s+(?:his|her|their|your)\s+"
+        r"(?:home\s+address|real\s+name\s+and\s+address|phone\s+number\s+and\s+address)\b",
+    ),
+    _rule(
+        "self_harm",
+        5,
+        r"\b(?:best|painless|easiest)\s+way\s+to\s+(?:kill\s+myself|end\s+my\s+life|"
+        r"commit\s+suicide)\b",
+    ),
+    _rule(
+        "self_harm",
+        4,
+        r"\b(?:you\s+should\s+)?(?:go\s+)?(?:kill\s+yourself|end\s+your\s+life)\b",
+    ),
+    _rule(
+        "spam",
+        3,
+        r"\b(?:buy\s+now|100%\s+free\s+money|work\s+from\s+home\s+\$\d+|"
+        r"click\s+here\s+to\s+claim|crypto\s+giveaway)\b",
+    ),
+    _rule(
+        "illegal",
+        5,
+        r"\b(?:selling|buying|for\s+sale)\s+(?:stolen\s+)?"
+        r"(?:credit\s?cards?|cc\s+dumps|fullz|ssn\s+list|bank\s+logs)\b",
+    ),
+    _rule(
+        "illegal",
+        4,
+        r"\b(?:hire|hiring)\s+(?:a\s+)?hit\s?man\b",
+    ),
+    _rule(
+        "intellectual_property",
+        2,
+        r"\b(?:full\s+)?(?:cracked|nulled|warez)\s+(?:copy|version|download)\b",
+    ),
+)
+
+
+TECHNICAL_CONTEXT = re.compile(
+    r"\b(?:cve-\d{4}-\d+|exploit|payload|vulnerabilit(?:y|ies)|proof\s+of\s+concept|"
+    r"reverse\s+engineer(?:ing)?|malware\s+analysis|penetration\s+test(?:ing)?|"
+    r"red\s+team|sandbox|disassembl(?:y|er)|fuzz(?:ing|er)|stack\s+trace|traceback|"
+    r"segmentation\s+fault|kernel\s+panic)\b",
+    re.IGNORECASE,
+)
+
+TECHNICAL_DISCOUNT_CATEGORIES: frozenset[str] = frozenset(
+    {"weapons", "violence", "illegal"}
+)
+
+TECHNICAL_DISCOUNT = 3
+
+
+def matches(text: str) -> list[Rule]:
+    if not text:
+        return []
+    return [rule for rule in RULES if rule.pattern.search(text)]
+
+
+def score_for(text: str, matched: list[Rule]) -> int:
+    if not matched:
+        return 0
+    technical = bool(TECHNICAL_CONTEXT.search(text))
+    total = 0
+    for rule in matched:
+        weight = rule.weight
+        if technical and rule.category in TECHNICAL_DISCOUNT_CATEGORIES:
+            weight = max(0, weight - TECHNICAL_DISCOUNT)
+        total += weight
+    return total
diff --git a/devplacepy/services/moderation/screening.py b/devplacepy/services/moderation/screening.py
new file mode 100644
index 00000000..eb2fe2f1
--- /dev/null
+++ b/devplacepy/services/moderation/screening.py
@@ -0,0 +1,142 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+import logging
+
+from devplacepy.database import (
+    MATURITY_TARGETS,
+    REPORT_REASONS,
+    SYSTEM_ACTOR,
+    set_maturity,
+)
+
+from devplacepy.services.background import background
+from devplacepy.services.moderation.filter import Classification, Screening, screen
+from devplacepy.services.moderation.queue import raise_report
+
+logger = logging.getLogger(__name__)
+
+SCREENED_FIELDS: dict[str, tuple[str, ...]] = {
+    "posts": ("title", "content"),
+    "projects": ("title", "description"),
+    "gists": ("title", "description"),
+    "news": ("title", "description"),
+    "quizzes": ("title", "description"),
+    "comments": ("content",),
+    "messages": ("content",),
+    "users": ("username", "bio", "location"),
+}
+
+REFUSAL = (
+    "This content matches a category prohibited by the community guidelines "
+    "({categories}) and was not published. See /docs/community-guidelines.html."
+)
+
+FAILURE_REASON = "other"
+
+
+class ContentRefused(Exception):
+    def __init__(self, categories: tuple[str, ...]):
+        self.categories = categories
+        self.message = REFUSAL.format(categories=", ".join(categories) or "prohibited")
+        super().__init__(self.message)
+
+
+def screen_fields(table_name: str, fields: dict) -> Screening:
+    columns = SCREENED_FIELDS.get(table_name)
+    if not columns:
+        return Screening(classification=Classification())
+    values = {
+        column: str(fields.get(column) or "")
+        for column in columns
+        if fields.get(column)
+    }
+    return screen(values)
+
+
+def refuse_if_blocked(screening: Screening) -> None:
+    if screening.blocked:
+        raise ContentRefused(screening.classification.categories)
+
+
+def _reason_for(categories: tuple[str, ...]) -> str:
+    for category in categories:
+        if category in REPORT_REASONS:
+            return category
+    return FAILURE_REASON
+
+
+def record(
+    screening: Screening,
+    *,
+    target_type: str,
+    target_uid: str,
+    actor_uid: str = SYSTEM_ACTOR,
+    request=None,
+) -> None:
+    from devplacepy.services.audit import record as audit
+
+    classification = screening.classification
+    if classification.verdict == "allow":
+        return
+    if classification.maturity != "general" and target_type in MATURITY_TARGETS:
+        labelled = set_maturity(
+            target_type, target_uid, classification.maturity, "filter", SYSTEM_ACTOR
+        )
+        if labelled:
+            audit.record(
+                request,
+                "filter.maturity",
+                actor_kind="system",
+                target_type=target_type,
+                target_uid=target_uid,
+                new_value=classification.maturity,
+                metadata={
+                    "categories": list(classification.categories),
+                    "score": classification.score,
+                    "author_uid": actor_uid,
+                },
+                summary=(
+                    f"content filter labelled {target_type} {target_uid} "
+                    f"as {classification.maturity}"
+                ),
+                links=[audit.target(target_type, target_uid)],
+            )
+    if not classification.flagged:
+        return
+    detail = classification.detail or "matched a prohibited category"
+    if classification.failed:
+        detail = classification.detail
+    background.submit(
+        raise_report,
+        target_type=target_type,
+        target_uid=target_uid,
+        reporter_uid=SYSTEM_ACTOR,
+        reason=_reason_for(classification.categories),
+        detail=f"Automated filter: {detail} (fields: {', '.join(screening.fields) or 'n/a'})",
+        origin="filter",
+        severity="critical" if classification.failed else "",
+        categories=list(classification.categories),
+    )
+    event = "filter.block" if classification.verdict == "block" else "filter.review"
+    logger.info(
+        f"filter {classification.verdict} on {target_type} {target_uid}: {detail}"
+    )
+    audit.record(
+        request,
+        event,
+        actor_kind="system",
+        target_type=target_type,
+        target_uid=target_uid,
+        result="denied" if classification.verdict == "block" else "success",
+        metadata={
+            "categories": list(classification.categories),
+            "score": classification.score,
+            "fields": list(screening.fields),
+            "failed": classification.failed,
+            "author_uid": actor_uid,
+        },
+        summary=f"content filter raised {classification.verdict} on {target_type} {target_uid}",
+        links=[audit.target(target_type, target_uid)],
+    )
diff --git a/devplacepy/services/moderation/service.py b/devplacepy/services/moderation/service.py
new file mode 100644
index 00000000..b15f281a
--- /dev/null
+++ b/devplacepy/services/moderation/service.py
@@ -0,0 +1,78 @@
+# retoor <retoor@molodetz.nl>
+
+import logging
+
+from devplacepy.services.base import BaseService, ConfigField
+from devplacepy.services.moderation import deletion, queue, sla
+from devplacepy.services.moderation.deletion import DEFAULT_GRACE_HOURS
+from devplacepy.services.moderation.sla import DEFAULT_SLA_HOURS
+
+logger = logging.getLogger(__name__)
+
+
+class ModerationService(BaseService):
+    title = "Moderation housekeeping"
+    description = (
+        "Purges deleted accounts once their grace window closes and reports the "
+        "moderation queue's service-level snapshot."
+    )
+    default_enabled = True
+    min_interval = 300
+    METRICS_SECONDS = 60
+    config_fields = [
+        ConfigField(
+            "moderation_sla_hours",
+            "Response window (hours)",
+            type="int",
+            default=DEFAULT_SLA_HOURS,
+            minimum=1,
+            help=(
+                "The published commitment. The admin queue badge turns red once the "
+                "oldest open report is older than this."
+            ),
+            group="General",
+        ),
+        ConfigField(
+            "account_deletion_grace_hours",
+            "Account deletion grace (hours)",
+            type="int",
+            default=DEFAULT_GRACE_HOURS,
+            minimum=0,
+            help=(
+                "How long a deleted account stays restorable before it is purged. "
+                "The account is anonymised immediately either way."
+            ),
+            group="General",
+        ),
+    ]
+
+    def __init__(self) -> None:
+        super().__init__("moderation", interval_seconds=3600)
+
+    async def run_once(self) -> None:
+        purged = deletion.purge_due()
+        if purged:
+            self.log(f"Purged {purged} deleted account(s) past the grace window")
+        snapshot = sla.snapshot()
+        if snapshot["breached"]:
+            self.log(
+                f"{snapshot['breached']} report(s) past the "
+                f"{snapshot['sla_hours']}h response window; "
+                f"oldest open is {snapshot['oldest_open_hours']}h"
+            )
+
+    def collect_metrics(self) -> dict:
+        snapshot = sla.snapshot()
+        counts = queue.status_counts()
+        return {
+            "stats": [
+                {"label": "Open reports", "value": counts.get("open", 0)},
+                {"label": "Acknowledged", "value": counts.get("acknowledged", 0)},
+                {"label": "Actioned", "value": counts.get("actioned", 0)},
+                {"label": "Dismissed", "value": counts.get("dismissed", 0)},
+                {"label": "Oldest open (h)", "value": snapshot["oldest_open_hours"]},
+                {"label": "Response window (h)", "value": snapshot["sla_hours"]},
+                {"label": "Past window", "value": snapshot["breached"]},
+                {"label": "Pending purges", "value": len(deletion.due_purges())},
+            ]
+        }
diff --git a/devplacepy/services/moderation/sla.py b/devplacepy/services/moderation/sla.py
new file mode 100644
index 00000000..b366c860
--- /dev/null
+++ b/devplacepy/services/moderation/sla.py
@@ -0,0 +1,80 @@
+# retoor <retoor@molodetz.nl>
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+
+from devplacepy.database import (
+    REPORTS_TABLE,
+    REPORT_OPEN_STATUSES,
+    _in_clause,
+    db,
+    get_int_setting,
+)
+
+
+DEFAULT_SLA_HOURS = 24
+
+
+def sla_hours() -> int:
+    return max(1, get_int_setting("moderation_sla_hours", DEFAULT_SLA_HOURS))
+
+
+def _hours_since(iso: str) -> float:
+    try:
+        stamp = datetime.fromisoformat(iso)
+    except (TypeError, ValueError):
+        return 0.0
+    if stamp.tzinfo is None:
+        stamp = stamp.replace(tzinfo=timezone.utc)
+    return max(0.0, (datetime.now(timezone.utc) - stamp).total_seconds() / 3600)
+
+
+def oldest_open() -> dict | None:
+    if REPORTS_TABLE not in db.tables:
+        return None
+    placeholders, params = _in_clause(list(REPORT_OPEN_STATUSES), prefix="s")
+    rows = list(
+        db.query(
+            f"SELECT uid, created_at FROM {REPORTS_TABLE} "
+            f"WHERE deleted_at IS NULL AND status IN ({placeholders}) "
+            f"ORDER BY created_at ASC LIMIT 1",
+            **params,
+        )
+    )
+    return rows[0] if rows else None
+
+
+def breach_count() -> int:
+    if REPORTS_TABLE not in db.tables:
+        return 0
+    cutoff = _cutoff_iso()
+    placeholders, params = _in_clause(list(REPORT_OPEN_STATUSES), prefix="s")
+    params["cutoff"] = cutoff
+    rows = list(
+        db.query(
+            f"SELECT COUNT(*) AS n FROM {REPORTS_TABLE} "
+            f"WHERE deleted_at IS NULL AND status IN ({placeholders}) "
+            f"AND created_at < :cutoff",
+            **params,
+        )
+    )
+    return int(rows[0]["n"]) if rows else 0
+
+
+def _cutoff_iso() -> str:
+    return (datetime.now(timezone.utc) - timedelta(hours=sla_hours())).isoformat()
+
+
+def snapshot() -> dict:
+    limit = sla_hours()
+    oldest = oldest_open()
+    age = _hours_since(oldest["created_at"]) if oldest else 0.0
+    breached = breach_count()
+    return {
+        "sla_hours": limit,
+        "oldest_open_hours": round(age, 1),
+        "oldest_open_uid": oldest["uid"] if oldest else "",
+        "breached": breached,
+        "within_sla": breached == 0,
+    }
diff --git a/devplacepy/services/openai_gateway/CLAUDE.md b/devplacepy/services/openai_gateway/CLAUDE.md
index 212a360e..a06eb98a 100644
--- a/devplacepy/services/openai_gateway/CLAUDE.md
+++ b/devplacepy/services/openai_gateway/CLAUDE.md
@@ -129,3 +129,14 @@ Real providers sometimes charge more than a flat per-1M rate for one component:
 - **Migration.** New `gateway_models` columns are added via `has_column`/`create_column_by_example` in `routing.ensure_tables()` (the `CREATE TABLE IF NOT EXISTS` DDL string alone would never reach a pre-existing table - see the `database/CLAUDE.md` column-ensure idiom).
 - **Admin UI.** `/admin/gateway`'s model-route form has a "Tiered / off-peak pricing (optional)" subsection; off-peak start/end render as `<input type="time">` (converted to/from UTC minutes-of-day by `GatewayAdmin.js`), and the routes table shows `tiered`/`off-peak` badges when a route has either dimension configured.
 - **DeepSeek's real pricing is already the tier-1 shape, not a new dimension.** DeepSeek's actual API (verified against `api-docs.deepseek.com/quick_start/pricing`) bills three flat per-1M rates - cache-hit input, cache-miss input, output - with no current context-length tier or off-peak window for the V4 models; that shape was already fully modeled by the pre-existing `chat_cache_hit_per_m`/`chat_cache_miss_per_m`/`chat_output_per_m` fields before this section's tier2/off-peak fields existed. `routing.seed_default_deepseek_routes()` (called once from `database.migrate_ai_gateway_settings()` at the end of `init_db()`) idempotently inserts four ready-made routes - `deepseek-v4-flash` (`$0.0028`/`$0.14`/`$0.28` per 1M, 1M context), `deepseek-v4-pro` (`$0.003625`/`$0.435`/`$0.87` per 1M, 1M context), and the two public `molodetz` aliases `molodetz` -> `deepseek-v4-flash` (flash rates) and `molodetz-pro` -> `deepseek-v4-pro` (pro rates) - only when that `source_model` row does not already exist, so a caller or Devii can request any name explicitly and get correctly-priced, decoupled from whatever the single global `gateway_model` default happens to be set to (switching that global setting between the two real models does NOT retroactively fix the flat Pricing config fields - the seeded routes are the model-agnostic, always-correct way to reference a specific priced model). The `molodetz`/`molodetz-pro` aliases are the public model names; `GET /v1/models` is served locally from these `source_model` rows (not proxied upstream), so it publishes exactly the models the gateway accepts. Neither seeded route sets the tier2/off-peak fields (DeepSeek does not use them today); an admin can add them later on the same row if DeepSeek (or any other provider routed here) introduces such pricing.
+
+## Third-party AI consent gate (one place, two owner classes)
+
+`GatewayService.handle()` calls `consent_denied(owner)` immediately after `resolve_owner`, before the quota check. This is the **only** consent gate in the platform; no consumer implements one of its own.
+
+The split it enforces is the whole point:
+
+- owner kind `user` / `admin` -> the call carries **that user's own content** (Devii, AI correction, the AI modifier, a member calling `/openai/v1/*` with their own key). It requires a granted `ai_third_party` consent and answers **403** with `CONSENT_REQUIRED_MESSAGE` otherwise, plus an `ai.consent.denied` audit row.
+- owner kind `internal` / `key` / `anonymous` -> **platform processing** (news import, the bot fleet, SEO metadata, issue enhancement). Never gated: it is not the user's content.
+
+`ai_third_party` is **never granted at signup**. The existing `ai_correction_enabled` / `ai_modifier_enabled` user columns survive unchanged as *preferences* subordinate to consent: withdrawing consent turns those features off regardless of the flag, so `ai_modifier_enabled`'s default of `1` is harmless. No existing preference was flipped and no consumer changed - the gate was simply added above them. `USER_CONTENT_OWNER_KINDS` is the single tuple defining the split; widen it only if a new owner kind genuinely carries a user's own content.
diff --git a/devplacepy/services/openai_gateway/service.py b/devplacepy/services/openai_gateway/service.py
index b7d15136..b998395b 100644
--- a/devplacepy/services/openai_gateway/service.py
+++ b/devplacepy/services/openai_gateway/service.py
@@ -22,6 +22,13 @@ logger = logging.getLogger(__name__)
 APP_REFERENCE_PATTERN = re.compile(r"^[a-zA-Z0-9_.-]{1,30}$")
 DEFAULT_APP_REFERENCE = "default"
 
+USER_CONTENT_OWNER_KINDS = ("user", "admin")
+
+CONSENT_REQUIRED_MESSAGE = (
+    "Third-party AI processing of your content requires consent. "
+    "Grant it under Privacy on your profile."
+)
+
 
 def _validate_app_reference(value: str) -> str:
     stripped = (value or "").strip()
@@ -515,6 +522,43 @@ class GatewayService(BaseService):
             return (kind, user.get("uid") or "unknown")
         return ("anonymous", "anonymous")
 
+    def user_content_owner(self, owner: tuple) -> str:
+        if owner[0] in USER_CONTENT_OWNER_KINDS and owner[1]:
+            return owner[1]
+        return ""
+
+    def consent_denied(self, owner: tuple) -> bool:
+        from devplacepy.database import consent_granted
+
+        owner_uid = self.user_content_owner(owner)
+        if not owner_uid:
+            return False
+        return not consent_granted("user", owner_uid, "ai_third_party")
+
+    def _audit_consent_denied(self, owner: tuple, app_reference: str) -> None:
+        from devplacepy.services.audit import record as audit
+        from devplacepy.services.openai_gateway.usage import audit_actor_for
+
+        actor_kind, actor_uid, actor_role = audit_actor_for(owner[0], owner[1])
+        audit.record_system(
+            "ai.consent.denied",
+            actor_kind=actor_kind,
+            actor_uid=actor_uid,
+            actor_role=actor_role,
+            origin="api",
+            result="denied",
+            summary=(
+                f"AI gateway call by {owner[0]}/{owner[1]} blocked - "
+                f"third-party AI consent not granted"
+            ),
+            metadata={
+                "owner_kind": owner[0],
+                "owner_id": owner[1],
+                "app_reference": app_reference,
+                "consent": "ai_third_party",
+            },
+        )
+
     def _audit_quota_exceeded(
         self,
         owner_kind: str,
@@ -584,6 +628,13 @@ class GatewayService(BaseService):
         )
         if subpath == "models" and request.method == "GET":
             return self._models_response()
+        if self.consent_denied(owner):
+            self.log(
+                f"Rejected {owner[0]}:{owner[1]} app={app_reference}: "
+                f"third-party AI consent not granted"
+            )
+            self._audit_consent_denied(owner, app_reference)
+            raise HTTPException(status_code=403, detail=CONSENT_REQUIRED_MESSAGE)
         limit, scope, rule = quota.resolve(owner[0], owner[1], app_reference, cfg)
         if limit > 0:
             spent = quota.spent_24h(*scope)
diff --git a/devplacepy/services/presence.py b/devplacepy/services/presence.py
index c0d5cb4d..6281c3d5 100644
--- a/devplacepy/services/presence.py
+++ b/devplacepy/services/presence.py
@@ -18,6 +18,12 @@ from devplacepy.database import get_online_users, set_last_seen
 _last_write: dict[str, float] = {}
 
 
+def recording_allowed(user_uid: str) -> bool:
+    from devplacepy.database import consent_granted
+
+    return bool(user_uid) and consent_granted("user", user_uid, "activity_recording")
+
+
 def touch(user_uid: str) -> None:
     if not user_uid:
         return
@@ -25,6 +31,8 @@ def touch(user_uid: str) -> None:
     if now - _last_write.get(user_uid, 0.0) < PRESENCE_WRITE_SECONDS:
         return
     _last_write[user_uid] = now
+    if not recording_allowed(user_uid):
+        return
     set_last_seen(user_uid, datetime.now(timezone.utc).isoformat())
 
 
diff --git a/devplacepy/static/css/auth.css b/devplacepy/static/css/auth.css
index 72769adc..4012f0e9 100644
--- a/devplacepy/static/css/auth.css
+++ b/devplacepy/static/css/auth.css
@@ -47,6 +47,24 @@
     margin-bottom: 0.375rem;
 }
 
+.auth-field-check label {
+    display: flex;
+    align-items: flex-start;
+    gap: var(--space-sm);
+    font-weight: 400;
+    line-height: 1.5;
+    margin-bottom: 0;
+}
+
+.auth-field-check input {
+    margin-top: 0.2rem;
+    flex: none;
+}
+
+.auth-field-check a {
+    color: var(--accent);
+}
+
 .auth-field .input-wrap {
     position: relative;
 }
@@ -171,3 +189,15 @@
         padding: 1rem;
     }
 }
+
+.terms-links {
+    list-style: none;
+    padding: 0;
+    margin: 0 0 var(--space-xl);
+    display: grid;
+    gap: var(--space-sm);
+}
+
+.terms-links a {
+    color: var(--accent);
+}
diff --git a/devplacepy/static/css/awards.css b/devplacepy/static/css/awards.css
index 655b176b..6f7aa038 100644
--- a/devplacepy/static/css/awards.css
+++ b/devplacepy/static/css/awards.css
@@ -104,4 +104,36 @@
     text-align: right;
     color: var(--text-muted);
     font-size: 0.85rem;
-}
\ No newline at end of file
+}
+.award-report-btn {
+    position: absolute;
+    top: var(--space-sm);
+    left: var(--space-sm);
+    padding: var(--space-xs) var(--space-sm);
+    border: none;
+    border-radius: var(--radius);
+    background: var(--overlay-dark);
+    color: var(--text-secondary);
+    font-size: 0.7rem;
+    cursor: pointer;
+    opacity: 0;
+}
+
+.award-tile:hover .award-report-btn,
+.award-tile:focus-within .award-report-btn {
+    opacity: 1;
+}
+
+.award-report-btn:hover {
+    color: var(--danger);
+}
+
+.award-report-btn .label {
+    display: none;
+}
+
+@media (hover: none) and (pointer: coarse) {
+    .award-report-btn {
+        opacity: 1;
+    }
+}
diff --git a/devplacepy/static/css/base.css b/devplacepy/static/css/base.css
index fa370a9b..595adde5 100644
--- a/devplacepy/static/css/base.css
+++ b/devplacepy/static/css/base.css
@@ -1376,3 +1376,51 @@ body:has(.page-messages) {
     }
 }
 
+
+.recording-indicator {
+    position: fixed;
+    left: var(--space-lg);
+    bottom: calc(var(--space-2xl) + var(--space-2xl));
+    display: inline-flex;
+    align-items: center;
+    gap: var(--space-xs);
+    padding: var(--space-xs) var(--space-sm);
+    border-radius: var(--radius);
+    background: var(--bg-card);
+    border: 1px solid var(--border-light);
+    color: var(--text-muted);
+    font-size: 0.75rem;
+    z-index: var(--z-fab);
+    will-change: transform;
+}
+
+.recording-indicator a {
+    color: var(--text-muted);
+}
+
+.recording-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: var(--danger);
+    flex: none;
+}
+
+.maturity-gate {
+    padding: var(--space-2xl);
+    text-align: center;
+    border: 1px dashed var(--border-light);
+    border-radius: var(--radius);
+    background: var(--bg-card);
+    margin: var(--space-lg) 0;
+}
+
+.maturity-gate h3 {
+    margin: 0 0 var(--space-md);
+}
+
+.maturity-gate p {
+    color: var(--text-secondary);
+    margin: 0 0 var(--space-lg);
+}
+
diff --git a/devplacepy/static/css/chat.css b/devplacepy/static/css/chat.css
index 66b64c21..1e1d2f49 100644
--- a/devplacepy/static/css/chat.css
+++ b/devplacepy/static/css/chat.css
@@ -626,3 +626,32 @@ dp-chat[mode="embed"] {
         opacity: 1;
     }
 }
+
+.message-report-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: var(--space-xs);
+    margin-top: var(--space-xs);
+    padding: 0;
+    background: none;
+    border: none;
+    color: var(--text-muted);
+    font-size: 0.7rem;
+    opacity: 0;
+    cursor: pointer;
+}
+
+.message-bubble:hover .message-report-btn,
+.message-bubble:focus-within .message-report-btn {
+    opacity: 1;
+}
+
+.message-report-btn:hover {
+    color: var(--danger);
+}
+
+@media (hover: none) and (pointer: coarse) {
+    .message-report-btn {
+        opacity: 1;
+    }
+}
diff --git a/devplacepy/static/css/landing.css b/devplacepy/static/css/landing.css
index a93bda2a..fec4afa3 100644
--- a/devplacepy/static/css/landing.css
+++ b/devplacepy/static/css/landing.css
@@ -498,6 +498,17 @@
     font-weight: 600;
 }
 
+.landing-feature p {
+    font-size: 0.75rem;
+    color: var(--text-secondary);
+    margin: var(--space-xs) 0 0;
+    line-height: 1.4;
+}
+
+.landing-feature p a {
+    color: var(--accent);
+}
+
 .landing-auth-link {
     font-size: 0.875rem;
     color: var(--text-secondary);
diff --git a/devplacepy/static/css/media.css b/devplacepy/static/css/media.css
index 84fcc03c..7eb6d6aa 100644
--- a/devplacepy/static/css/media.css
+++ b/devplacepy/static/css/media.css
@@ -107,7 +107,8 @@
     background: var(--accent);
 }
 
-.media-delete-btn {
+.media-delete-btn,
+.media-report-btn {
     margin-left: auto;
     width: 32px;
     height: 32px;
@@ -122,10 +123,15 @@
     justify-content: center;
 }
 
-.media-delete-btn:hover {
+.media-delete-btn:hover,
+.media-report-btn:hover {
     background: var(--danger);
 }
 
+.media-report-btn .label {
+    display: none;
+}
+
 .media-tile.media-removing {
     opacity: 0;
     transform: scale(0.92);
diff --git a/devplacepy/static/css/moderation.css b/devplacepy/static/css/moderation.css
new file mode 100644
index 00000000..58599eaa
--- /dev/null
+++ b/devplacepy/static/css/moderation.css
@@ -0,0 +1,179 @@
+/* retoor <retoor@molodetz.nl> */
+
+.page-narrow {
+    max-width: 900px;
+    margin: 0 auto;
+    padding: var(--space-lg);
+}
+
+.report-intro {
+    color: var(--text-secondary);
+    margin-bottom: var(--space-xl);
+}
+
+.report-hint {
+    color: var(--text-muted);
+    margin-bottom: var(--space-lg);
+}
+
+.sla-badge {
+    display: inline-flex;
+    align-items: center;
+    gap: var(--space-xs);
+    padding: var(--space-xs) var(--space-md);
+    border-radius: var(--radius);
+    font-weight: 600;
+    border: 1px solid var(--border-light);
+}
+
+.sla-ok {
+    color: var(--success);
+    border-color: var(--success);
+}
+
+.sla-breached {
+    color: var(--danger);
+    border-color: var(--danger);
+}
+
+.severity-badge,
+.status-badge {
+    display: inline-block;
+    padding: var(--space-xs) var(--space-sm);
+    border-radius: var(--radius);
+    font-size: 0.85em;
+    text-transform: capitalize;
+    border: 1px solid var(--border-light);
+}
+
+.severity-info {
+    color: var(--info);
+    border-color: var(--info);
+}
+
+.severity-warn {
+    color: var(--warning);
+    border-color: var(--warning);
+}
+
+.severity-critical {
+    color: var(--danger);
+    border-color: var(--danger);
+}
+
+.status-open {
+    color: var(--warning);
+    border-color: var(--warning);
+}
+
+.status-acknowledged {
+    color: var(--info);
+    border-color: var(--info);
+}
+
+.status-actioned {
+    color: var(--success);
+    border-color: var(--success);
+}
+
+.status-dismissed {
+    color: var(--text-muted);
+}
+
+.report-summary,
+.report-decision,
+.report-history {
+    padding: var(--space-xl);
+    margin-bottom: var(--space-xl);
+}
+
+.report-facts {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+    gap: var(--space-lg);
+    margin: 0;
+}
+
+.report-facts dt {
+    color: var(--text-muted);
+    font-size: 0.85em;
+    margin-bottom: var(--space-xs);
+}
+
+.report-facts dd {
+    margin: 0;
+    color: var(--text-primary);
+    word-break: break-word;
+}
+
+.report-detail {
+    margin-top: var(--space-xl);
+    padding: var(--space-lg);
+    border-left: 3px solid var(--accent);
+    background: var(--bg-card-hover);
+    border-radius: var(--radius);
+    white-space: pre-wrap;
+}
+
+.report-categories {
+    margin-top: var(--space-lg);
+    color: var(--text-muted);
+}
+
+.report-form {
+    display: grid;
+    gap: var(--space-lg);
+    max-width: 640px;
+}
+
+.report-form-inline {
+    margin-top: var(--space-lg);
+}
+
+.reason-list {
+    display: grid;
+    gap: var(--space-md);
+}
+
+.reason-row {
+    display: grid;
+    grid-template-columns: minmax(160px, 220px) 1fr;
+    gap: var(--space-lg);
+    padding: var(--space-md) 0;
+    border-bottom: 1px solid var(--border);
+}
+
+.reason-row dt code {
+    font-family: var(--font-mono);
+    color: var(--accent);
+}
+
+.reason-row dd {
+    margin: 0;
+    color: var(--text-secondary);
+}
+
+@media (max-width: 768px) {
+    .reason-row {
+        grid-template-columns: 1fr;
+        gap: var(--space-xs);
+    }
+
+    .report-facts {
+        grid-template-columns: 1fr;
+    }
+}
+
+.workspace-desc {
+    display: block;
+    color: var(--text-muted);
+    font-size: 0.85em;
+}
+
+.delete-list {
+    margin: 0 0 var(--space-xl);
+    padding-left: var(--space-xl);
+    color: var(--text-secondary);
+    display: grid;
+    gap: var(--space-xs);
+}
diff --git a/devplacepy/static/css/profile.css b/devplacepy/static/css/profile.css
index 53eb9302..7db768d2 100644
--- a/devplacepy/static/css/profile.css
+++ b/devplacepy/static/css/profile.css
@@ -942,3 +942,29 @@ a.profile-stat-value:hover {
     font-size: 0.8rem;
     color: var(--text-muted);
 }
+
+.privacy-panel h3 {
+    margin: var(--space-xl) 0 var(--space-sm);
+}
+
+.privacy-panel h3:first-child {
+    margin-top: 0;
+}
+
+.privacy-intro {
+    color: var(--text-secondary);
+    margin: 0 0 var(--space-lg);
+}
+
+.privacy-intro a {
+    color: var(--accent);
+}
+
+.privacy-suspension {
+    padding: var(--space-md);
+    border-left: 3px solid var(--danger);
+    background: var(--bg-card-hover);
+    border-radius: var(--radius);
+    color: var(--text-primary);
+    margin: 0 0 var(--space-lg);
+}
diff --git a/devplacepy/static/css/workspace.css b/devplacepy/static/css/workspace.css
index 311820e4..25693942 100644
--- a/devplacepy/static/css/workspace.css
+++ b/devplacepy/static/css/workspace.css
@@ -1,7 +1,7 @@
 /* retoor <retoor@molodetz.nl> */
 
 .workspace-page {
-    max-width: var(--content-width);
+    max-width: var(--max-content);
     margin: 0 auto;
     padding: var(--space-md);
     display: flex;
@@ -62,7 +62,7 @@
 }
 
 .workspace-badge {
-    background: var(--bg-hover);
+    background: var(--bg-card-hover);
     color: var(--text-secondary);
     border-radius: var(--radius);
     padding: 0 var(--space-xs);
diff --git a/devplacepy/static/js/Application.js b/devplacepy/static/js/Application.js
index 59129883..516b5d90 100644
--- a/devplacepy/static/js/Application.js
+++ b/devplacepy/static/js/Application.js
@@ -33,6 +33,7 @@ import { IssueReporter } from "./IssueReporter.js";
 import { IssueAttachments } from "./IssueAttachments.js";
 import { PlanningGenerator } from "./PlanningGenerator.js";
 import { MediaGallery } from "./MediaGallery.js";
+import { ReportDialog } from "./ReportDialog.js";
 import WindowManager from "./components/WindowManager.js";
 import { ContainerTerminalManager } from "./ContainerTerminalManager.js";
 import { PubSubClient } from "./PubSubClient.js";
@@ -103,6 +104,7 @@ class Application {
         this.issueAttachments = new IssueAttachments();
         this.planningGenerator = new PlanningGenerator();
         this.mediaGallery = new MediaGallery();
+        this.reportDialog = new ReportDialog();
         this.liveNotifications = new LiveNotifications(this.pubsub, this.toast);
         this.presence = new PresenceManager(this.pubsub);
         this.onlineUsers = new OnlineUsers(this.pubsub);
diff --git a/devplacepy/static/js/CLAUDE.md b/devplacepy/static/js/CLAUDE.md
index 887eea12..822ac9fe 100644
--- a/devplacepy/static/js/CLAUDE.md
+++ b/devplacepy/static/js/CLAUDE.md
@@ -102,3 +102,7 @@ Every file-upload UI is the one custom element `dp-upload` (`static/js/component
 - `field` (create-post image, `feed.html`): wraps a real `<input type="file" name="image">` that submits with the form - no AJAX, inline-image flow unchanged.
 
 The component validates size/type/count and reports errors via `app.toast`. CSS is `.dp-upload-*` in `components.css`; the old `.attachment-upload-*` upload-widget styles were removed, but the `.attachment-gallery`/`.attachment-lightbox` display styles (for already-saved attachments) remain.
+
+## ReportDialog (`ReportDialog.js`, `app.reportDialog`)
+
+One class, one dialog, every surface. It delegates a document-level click on `[data-report-type]` (emitted by `_report_button.html`), opens the single `#report-dialog` overlay with the standard `.visible` toggle, and submits through `Http.sendForm` to `/reports/{target_type}/{target_uid}`. The toast repeats the published response window returned by the endpoint, so the acknowledgement the user sees is the one the server actually committed to. It carries no reason list of its own - the options are server-rendered from the `REPORT_REASONS` Jinja global, so a client can never offer a reason the API would reject.
diff --git a/devplacepy/static/js/ReportDialog.js b/devplacepy/static/js/ReportDialog.js
new file mode 100644
index 00000000..0431b907
--- /dev/null
+++ b/devplacepy/static/js/ReportDialog.js
@@ -0,0 +1,74 @@
+// retoor <retoor@molodetz.nl>
+
+import { Http } from "./Http.js";
+
+export class ReportDialog {
+    constructor() {
+        this.overlay = document.getElementById("report-dialog");
+        this.form = document.getElementById("report-form");
+        this.target = null;
+        document.addEventListener("click", (e) => {
+            const btn = e.target.closest("[data-report-type]");
+            if (!btn || btn.disabled) return;
+            e.preventDefault();
+            this.open(btn.dataset.reportType, btn.dataset.reportUid);
+        });
+        if (this.form) {
+            this.form.addEventListener("submit", (e) => {
+                e.preventDefault();
+                e.stopImmediatePropagation();
+                this.submit();
+            });
+        }
+    }
+
+    open(targetType, targetUid) {
+        if (!this.overlay || !this.form) return;
+        this.target = { targetType, targetUid };
+        this.form.reset();
+        this.overlay.classList.add("visible");
+        const reason = this.form.querySelector("[name='reason']");
+        if (reason) reason.focus();
+    }
+
+    close() {
+        if (this.overlay) this.overlay.classList.remove("visible");
+        this.target = null;
+    }
+
+    async submit() {
+        if (!this.target) return;
+        const data = new FormData(this.form);
+        const button = this.form.querySelector("button[type='submit']");
+        if (button) button.disabled = true;
+        try {
+            const result = await Http.sendForm(
+                `/reports/${this.target.targetType}/${this.target.targetUid}`,
+                { reason: data.get("reason"), detail: data.get("detail") || "" },
+                { silent: true },
+            );
+            const hours = result && result.data ? result.data.sla_hours : null;
+            this.close();
+            this.notify(
+                hours
+                    ? `Report received. A moderator reviews it within ${hours} hours.`
+                    : "Report received.",
+                "success",
+            );
+        } catch (err) {
+            this.notify(err.message, "error");
+        } finally {
+            if (button) button.disabled = false;
+        }
+    }
+
+    notify(message, type) {
+        if (window.app && window.app.toast) {
+            window.app.toast.show(message, { type });
+            return;
+        }
+        console.info(message);
+    }
+}
+
+window.ReportDialog = ReportDialog;
diff --git a/devplacepy/static/js/WorkspaceManager.js b/devplacepy/static/js/WorkspaceManager.js
index 8822a84d..2ebea533 100644
--- a/devplacepy/static/js/WorkspaceManager.js
+++ b/devplacepy/static/js/WorkspaceManager.js
@@ -28,13 +28,19 @@ export class WorkspaceManager {
 
     async send(form) {
         try {
-            await Http.sendForm(form);
+            await Http.sendForm(form.action, this.params(form));
             await this.refresh();
         } catch (error) {
             window.app?.toast?.show(error.message || "Action failed", { type: "error" });
         }
     }
 
+    params(form) {
+        const params = [];
+        new FormData(form).forEach((value, key) => params.push([key, value]));
+        return params;
+    }
+
     subscribe() {
         const uid = this.root.dataset.workspaceUid;
         if (uid && window.app?.pubsub) {
diff --git a/devplacepy/templates/CLAUDE.md b/devplacepy/templates/CLAUDE.md
index 43ba0544..c9cd74e1 100644
--- a/devplacepy/templates/CLAUDE.md
+++ b/devplacepy/templates/CLAUDE.md
@@ -75,6 +75,9 @@ Reuse these via `{% set _x = ... %}{% include %}` (the `_avatar_link.html` conve
 - `_quiz_question.html` - one question in builder-preview or player mode. Locals: `_question`, `_mode` (`builder`|`player`), plus `_attempt_url` and `answer_max_chars` in player mode.
 - `_quiz_answer_review.html` - one reviewed answer on the results screen. Local: `_question`.
 - `_quiz_settings_fields.html` - the shared quiz settings fieldset. Optional local `_quiz` seeds the current values.
+- `_report_button.html` - the Report control (and Block, when `_owner_name` is given) for any content action bar. Locals: `_type`, `_uid`, `_owner` (owner uid - the control hides on your own content), `_owner_name` (optional), `_class` (the surrounding surface's button class). Included at fifteen sites; a new content surface MUST include it (see the root `CLAUDE.md` rule).
+- `_report_dialog.html` - the one report dialog, included once in `base.html` for signed-in users and driven by `ReportDialog.js`. Reasons come from the `REPORT_REASONS` Jinja global; never hand-roll a second dialog.
+- `_maturity_gate.html` - the interstitial rendered in place of a maturity-labelled item. Local: `_level`. Guard the include with the `maturity_hidden(level, user)` global; the item's `maturity` is attached by `enrich_items`/`load_detail`.
 
 Vote button styles live ONCE in `feed.css` (`.post-action-btn`) - never redefine them in `post.css`. Page-specific CSS goes in a `static/css/*.css` file referenced from `{% block extra_head %}`, never an inline `<style>` block. All CSS conventions (tokens, `--z-*` stacking bands, breakpoints, reduced motion) are in `devplacepy/static/css/CLAUDE.md`.
 
diff --git a/devplacepy/templates/_awards_gallery.html b/devplacepy/templates/_awards_gallery.html
index 19597334..9ed2d84d 100644
--- a/devplacepy/templates/_awards_gallery.html
+++ b/devplacepy/templates/_awards_gallery.html
@@ -24,6 +24,7 @@
                     aria-label="Revoke award">Revoke</button>
         </form>
         {% endif %}
+        {% set _type = "award" %}{% set _uid = award['uid'] %}{% set _owner = award.get('receiver_uid', '') %}{% set _owner_name = "" %}{% set _class = "award-report-btn" %}{% include "_report_button.html" %}
     </article>
     {% else %}
     <div class="empty-state">No awards yet.</div>
diff --git a/devplacepy/templates/_comment.html b/devplacepy/templates/_comment.html
index 3bf8d964..afea2423 100644
--- a/devplacepy/templates/_comment.html
+++ b/devplacepy/templates/_comment.html
@@ -35,6 +35,7 @@
             </form>
             {% endif %}
             {% set _type = "comment" %}{% set _uid = item.comment['uid'] %}{% set _reactions = item.reactions %}{% include "_reaction_bar.html" %}
+            {% set _type = "comment" %}{% set _uid = item.comment['uid'] %}{% set _owner = item.comment['user_uid'] %}{% set _owner_name = (item.author or {}).get('username', '') %}{% set _class = "comment-action-btn" %}{% include "_report_button.html" %}
         </div>
         {{ caller() }}
     </div>
diff --git a/devplacepy/templates/_footer_links.html b/devplacepy/templates/_footer_links.html
index 5c889b48..8397d76c 100644
--- a/devplacepy/templates/_footer_links.html
+++ b/devplacepy/templates/_footer_links.html
@@ -3,4 +3,9 @@
     <a href="/swagger"><span class="icon">&#x1F9EA;</span> Swagger</a>
     <a href="/openapi.json"><span class="icon">&#x1F9E9;</span> OpenAPI</a>
     <a href="/issues"><span class="icon">&#x1F41B;</span> Issue Report</a>
+    <a href="/workspaces/index"><span class="icon">&#x1F5A5;&#xFE0F;</span> Workspaces</a>
+    <a href="/docs/terms.html"><span class="icon">&#x1F4DC;</span> Terms</a>
+    <a href="/docs/privacy.html"><span class="icon">&#x1F512;</span> Privacy</a>
+    <a href="/docs/community-guidelines.html"><span class="icon">&#x1F91D;</span> Guidelines</a>
+    <a href="/docs/contact.html"><span class="icon">&#x2709;&#xFE0F;</span> Contact</a>
 </nav>
diff --git a/devplacepy/templates/_maturity_gate.html b/devplacepy/templates/_maturity_gate.html
new file mode 100644
index 00000000..22c96a1c
--- /dev/null
+++ b/devplacepy/templates/_maturity_gate.html
@@ -0,0 +1,13 @@
+<div class="maturity-gate" role="note">
+    <h3>Hidden: {{ _level }} content</h3>
+    <p>This item is labelled <strong>{{ _level }}</strong>. It stays hidden until you choose to see this kind of content.</p>
+    {% if user %}
+    {% if _level == 'restricted' and (user.get('age_band') not in ('adult', '', none)) %}
+    <p>Your account's age band does not allow restricted content.</p>
+    {% else %}
+    <a href="/profile/{{ user['username'] }}?tab=privacy" class="btn btn-secondary btn-sm">Change this in privacy settings</a>
+    {% endif %}
+    {% else %}
+    <a href="/auth/login" class="btn btn-secondary btn-sm">Log in to change this</a>
+    {% endif %}
+</div>
diff --git a/devplacepy/templates/_media_gallery.html b/devplacepy/templates/_media_gallery.html
index 59bfbd63..14403130 100644
--- a/devplacepy/templates/_media_gallery.html
+++ b/devplacepy/templates/_media_gallery.html
@@ -28,6 +28,7 @@
                 </form>
             </noscript>
             {% endif %}
+            {% set _type = "attachment" %}{% set _uid = item['uid'] %}{% set _owner = item.get('user_uid', '') %}{% set _owner_name = "" %}{% set _class = "media-report-btn" %}{% include "_report_button.html" %}
         </div>
     </div>
     {% else %}
diff --git a/devplacepy/templates/_post_card.html b/devplacepy/templates/_post_card.html
index 8b94e56c..009f7239 100644
--- a/devplacepy/templates/_post_card.html
+++ b/devplacepy/templates/_post_card.html
@@ -15,7 +15,11 @@
     </a>
     {% endif %}
 
+    {% if maturity_hidden(item.maturity, user) %}
+    {% set _level = item.maturity %}{% include "_maturity_gate.html" %}
+    {% else %}
     <div class="post-content rendered-content">{{ render_content(item.post['content'][:300] ~ ('...' if item.post['content']|length > 300 else ''), author_is_admin=is_admin(item.author)) }}</div>
+    {% endif %}
 
     {% if item.project_link %}
     <a href="{{ item.project_link.url }}" class="project-link">Project: {{ item.project_link.name }}</a>
@@ -42,6 +46,7 @@
         <button type="button" class="post-action-btn" data-share="{{ content_url(item.post, 'posts') }}"><span aria-hidden="true">&#x1F517;</span> Share</button>
         {% endif %}
         {% set _type = "post" %}{% set _uid = item.post['uid'] %}{% set _bookmarked = item.bookmarked %}{% include "_bookmark_button.html" %}
+        {% set _type = "post" %}{% set _uid = item.post['uid'] %}{% set _owner = item.post['user_uid'] %}{% set _owner_name = (item.author or {}).get('username', '') %}{% set _class = "post-action-btn" %}{% include "_report_button.html" %}
         {% if owns(item.post, user) or is_admin(user) %}
         <form method="POST" action="/posts/delete/{{ item.post['slug'] or item.post['uid'] }}" class="inline-form">
             <button type="submit" class="post-action-btn" data-confirm="Delete this post?"><span aria-hidden="true">🗑️</span> Delete</button>
diff --git a/devplacepy/templates/_report_button.html b/devplacepy/templates/_report_button.html
new file mode 100644
index 00000000..a4fb8101
--- /dev/null
+++ b/devplacepy/templates/_report_button.html
@@ -0,0 +1,11 @@
+{% set _report_owner = _owner if _owner is defined else "" %}
+{% set _report_owner_name = _owner_name if _owner_name is defined else "" %}
+{% set _report_class = _class if _class is defined else "post-action-btn" %}
+{% if not user or user['uid'] != _report_owner %}
+<button type="button" class="{{ _report_class }} report-btn" data-report-type="{{ _type }}" data-report-uid="{{ _uid }}" aria-label="Report this {{ _type }}" title="Report"{{ guest_disabled(user) }}><span class="icon" aria-hidden="true">&#x1F6A9;</span><span class="label"> Report</span></button>
+{% if user and _report_owner_name %}
+<form method="POST" action="/block/{{ _report_owner_name }}" class="inline-form">
+    <button type="submit" class="{{ _report_class }} block-btn" data-confirm="Block {{ _report_owner_name }}? Their content is hidden from you everywhere except their profile."><span class="icon" aria-hidden="true">&#x1F6AB;</span><span class="label"> Block</span></button>
+</form>
+{% endif %}
+{% endif %}
diff --git a/devplacepy/templates/_report_dialog.html b/devplacepy/templates/_report_dialog.html
new file mode 100644
index 00000000..5683f287
--- /dev/null
+++ b/devplacepy/templates/_report_dialog.html
@@ -0,0 +1,22 @@
+{% from "_macros.html" import modal %}
+{% call modal("report-dialog", "Report content") %}
+<form class="modal-body" id="report-form" method="POST" action="/reports/post/none">
+    <p class="text-secondary auth-field-gap">Tell us which rule this breaks. A moderator reviews every report; see the <a href="/docs/community-guidelines.html">community guidelines</a>.</p>
+    <div class="auth-field auth-field-gap">
+        <label for="report-reason">Reason</label>
+        <select id="report-reason" name="reason" required>
+            {% for reason in REPORT_REASONS %}
+            <option value="{{ reason.key }}">{{ reason.label }}</option>
+            {% endfor %}
+        </select>
+    </div>
+    <div class="auth-field auth-field-gap">
+        <label for="report-detail">Detail (optional)</label>
+        <textarea id="report-detail" name="detail" rows="4" maxlength="2000" placeholder="What should the moderator know?"></textarea>
+    </div>
+    <div class="modal-footer">
+        <button type="button" class="btn btn-ghost modal-close">Cancel</button>
+        <button type="submit" class="btn btn-primary">Send report</button>
+    </div>
+</form>
+{% endcall %}
diff --git a/devplacepy/templates/accept_terms.html b/devplacepy/templates/accept_terms.html
new file mode 100644
index 00000000..f3b423ea
--- /dev/null
+++ b/devplacepy/templates/accept_terms.html
@@ -0,0 +1,26 @@
+{% extends "base.html" %}
+{% block extra_head %}
+<link rel="stylesheet" href="{{ static_url('/static/css/auth.css') }}">
+{% endblock %}
+{% block content %}
+<div class="auth-page">
+    <div class="auth-card">
+        <h2>The terms have changed</h2>
+        <p class="subtitle">Version {{ terms_version }} of the Terms of Service is now in force. Accept it to keep posting. You can carry on reading, and you can delete your account, without accepting.</p>
+
+        <ul class="terms-links">
+            <li><a href="/docs/terms.html" target="_blank" rel="noopener">Terms of Service</a></li>
+            <li><a href="/docs/community-guidelines.html" target="_blank" rel="noopener">Community Guidelines</a></li>
+            <li><a href="/docs/privacy.html" target="_blank" rel="noopener">Privacy Policy</a></li>
+        </ul>
+
+        <form class="auth-form" method="POST" action="/auth/accept-terms">
+            <button type="submit" class="auth-submit"><span class="icon">&#x2714;&#xFE0F;</span> Accept version {{ terms_version }}</button>
+        </form>
+
+        <div class="auth-footer">
+            <a href="/feed">Keep reading without accepting</a>
+        </div>
+    </div>
+</div>
+{% endblock %}
diff --git a/devplacepy/templates/account_delete.html b/devplacepy/templates/account_delete.html
new file mode 100644
index 00000000..004f3e18
--- /dev/null
+++ b/devplacepy/templates/account_delete.html
@@ -0,0 +1,48 @@
+{% extends "base.html" %}
+{% block extra_head %}
+<link rel="stylesheet" href="{{ static_url('/static/css/auth.css') }}">
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
+{% endblock %}
+{% block content %}
+<div class="page-narrow">
+    <h1>Delete your account</h1>
+    <p class="report-intro">This removes your DevPlace account and your personal data. Read what happens before you confirm.</p>
+
+    <section class="card report-summary">
+        <h3>Removed immediately</h3>
+        <ul class="delete-list">
+            {% for item in removed %}
+            <li>{{ item }}</li>
+            {% endfor %}
+        </ul>
+
+        <h3>Retained</h3>
+        <ul class="delete-list">
+            {% for item in retained %}
+            <li>{{ item }}</li>
+            {% endfor %}
+        </ul>
+
+        <h3>Timing</h3>
+        <p class="report-intro">Your account is gone from your view and everyone else's the moment you confirm: your username is tombstoned and your email, profile, avatar, API key and password are cleared straight away, and every session and token is revoked.</p>
+        {% if grace_hours %}
+        <p class="report-intro">The removal stays reversible by an administrator for <strong>{{ grace_hours }} hours</strong> in case you delete by accident. After that window the whole deletion is permanently purged and cannot be recovered.</p>
+        {% else %}
+        <p class="report-intro">The removal is purged permanently on the next sweep and cannot be recovered.</p>
+        {% endif %}
+    </section>
+
+    <section class="card report-decision">
+        <h3>Confirm with your password</h3>
+        <form class="report-form" method="POST" action="/profile/{{ username }}/delete">
+            <div class="auth-field">
+                <label for="delete-password">Your password</label>
+                <input type="password" id="delete-password" name="password" required maxlength="128" autocomplete="current-password">
+            </div>
+            <button type="submit" class="btn btn-danger" data-confirm="Delete your account? This removes your content everywhere." data-confirm-danger data-confirm-title="Delete account">Delete my account</button>
+        </form>
+    </section>
+
+    <p class="report-intro"><a href="/profile/{{ username }}?tab=privacy">Back to privacy settings</a></p>
+</div>
+{% endblock %}
diff --git a/devplacepy/templates/admin_base.html b/devplacepy/templates/admin_base.html
index 52032c27..19e3961b 100644
--- a/devplacepy/templates/admin_base.html
+++ b/devplacepy/templates/admin_base.html
@@ -17,6 +17,9 @@
             <a href="/admin/media" class="sidebar-link {% if admin_section == 'media' %}active{% endif %}">
                 <span class="sidebar-icon">&#x1F5BC;&#xFE0F;</span> Media
             </a>
+            <a href="/admin/moderation" class="sidebar-link {% if admin_section == 'moderation' %}active{% endif %}">
+                <span class="sidebar-icon">&#x1F6A9;</span> Moderation
+            </a>
             <a href="/admin/trash" class="sidebar-link {% if admin_section == 'trash' %}active{% endif %}">
                 <span class="sidebar-icon">&#x1F5D1;&#xFE0F;</span> Trash
             </a>
diff --git a/devplacepy/templates/admin_moderation.html b/devplacepy/templates/admin_moderation.html
new file mode 100644
index 00000000..190890a0
--- /dev/null
+++ b/devplacepy/templates/admin_moderation.html
@@ -0,0 +1,61 @@
+{% extends "admin_base.html" %}
+{% block extra_head %}
+{{ super() }}
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
+{% endblock %}
+{% block admin_content %}
+<div class="admin-toolbar">
+    <h2>Moderation</h2>
+    <span class="sla-badge {% if sla.within_sla %}sla-ok{% else %}sla-breached{% endif %}" title="Oldest open report against the published response commitment">
+        Oldest open {{ sla.oldest_open_hours }}h / {{ sla.sla_hours }}h
+        {% if sla.breached %}&middot; {{ sla.breached }} over{% endif %}
+    </span>
+</div>
+
+<nav class="admin-tabs" data-overflow-tabs aria-label="Report status">
+    <div class="overflow-tabs-strip">
+        {% for tab in statuses %}
+        <a href="/admin/moderation?status={{ tab['key'] }}" class="admin-tab {% if tab['active'] %}active{% endif %}" data-menu-label="{{ tab['label'] }} ({{ tab['count'] }})">
+            {{ tab['label'] }} <span class="admin-tab-count">{{ tab['count'] }}</span>
+        </a>
+        {% endfor %}
+    </div>
+    <button type="button" class="admin-tab overflow-tabs-more" aria-haspopup="menu" aria-label="More tabs" hidden><span class="icon">&#x22EF;</span> More</button>
+</nav>
+
+<table class="admin-table">
+    <caption class="sr-only">Reported content awaiting a moderation decision</caption>
+    <thead>
+        <tr>
+            <th scope="col">Target</th>
+            <th scope="col">Reason</th>
+            <th scope="col">Severity</th>
+            <th scope="col">Reports</th>
+            <th scope="col">Author</th>
+            <th scope="col">Filed</th>
+            <th scope="col" class="admin-table-actions">Actions</th>
+        </tr>
+    </thead>
+    <tbody>
+        {% for report in reports %}
+        <tr>
+            <td><a href="{{ report['target_url'] }}">{{ report['target_type'] }}</a></td>
+            <td>{{ report['reason_label'] }}</td>
+            <td><span class="severity-badge severity-{{ report['severity'] }}">{{ report['severity'] }}</span></td>
+            <td>{{ report['report_count'] }}</td>
+            <td>{{ report['owner_name'] or '-' }}</td>
+            <td>{{ dt_ago(report['created_at']) }}</td>
+            <td class="admin-table-actions">
+                <a href="/admin/moderation/{{ report['uid'] }}" class="admin-btn admin-btn-sm">Review</a>
+            </td>
+        </tr>
+        {% else %}
+        <tr>
+            <td colspan="7" class="empty-state">No reports in this state.</td>
+        </tr>
+        {% endfor %}
+    </tbody>
+</table>
+
+{% set pagination_query = 'status=' ~ status ~ '&' %}{% include "_pagination.html" %}
+{% endblock %}
diff --git a/devplacepy/templates/admin_report.html b/devplacepy/templates/admin_report.html
new file mode 100644
index 00000000..e3af4e03
--- /dev/null
+++ b/devplacepy/templates/admin_report.html
@@ -0,0 +1,101 @@
+{% extends "admin_base.html" %}
+{% block extra_head %}
+{{ super() }}
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
+{% endblock %}
+{% block admin_content %}
+{% macro decision_table(caption, rows, empty) %}
+<table class="admin-table">
+    <caption class="sr-only">{{ caption }}</caption>
+    <thead>
+        <tr>
+            <th scope="col">Action</th>
+            <th scope="col">Moderator</th>
+            <th scope="col">Reason</th>
+            <th scope="col">When</th>
+        </tr>
+    </thead>
+    <tbody>
+        {% for action in rows %}
+        <tr>
+            <td>{{ action['action'].replace('_', ' ') }}</td>
+            <td>{{ action['actor_name'] }}</td>
+            <td>{{ action['reason'] or '-' }}</td>
+            <td>{{ local_dt(action['created_at']) }}</td>
+        </tr>
+        {% else %}
+        {% if empty %}<tr><td colspan="4" class="empty-state">{{ empty }}</td></tr>{% endif %}
+        {% endfor %}
+    </tbody>
+</table>
+{% endmacro %}
+<div class="admin-toolbar">
+    <h2>Report {{ report['reason_label'] }}</h2>
+    <a href="/admin/moderation" class="admin-btn admin-btn-sm">Back to queue</a>
+</div>
+
+<section class="card report-summary">
+    <dl class="report-facts">
+        <div><dt>Target</dt><dd><a href="{{ report['target_url'] }}">{{ report['target_type'] }} {{ report['target_uid'] }}</a></dd></div>
+        <div><dt>Status</dt><dd>{{ report['status'] }}</dd></div>
+        <div><dt>Severity</dt><dd><span class="severity-badge severity-{{ report['severity'] }}">{{ report['severity'] }}</span></dd></div>
+        <div><dt>Origin</dt><dd>{{ report['origin'] }}</dd></div>
+        <div><dt>Reporter</dt><dd>{{ report['reporter_name'] or 'system' }}</dd></div>
+        <div><dt>Author</dt><dd>{{ report['owner_name'] or '-' }}</dd></div>
+        <div><dt>Filed</dt><dd>{{ local_dt(report['created_at']) }}</dd></div>
+        <div><dt>Reports on this target</dt><dd>{{ report['report_count'] }}</dd></div>
+    </dl>
+    {% if report['detail'] %}
+    <p class="report-detail">{{ report['detail'] }}</p>
+    {% endif %}
+    {% if report['categories'] %}
+    <p class="report-categories">Filter categories: {{ report['categories']|join(', ') }}</p>
+    {% endif %}
+</section>
+
+<section class="card report-decision">
+    <h3>Decide</h3>
+    {% if not can_remove %}
+    <p class="report-hint">Content removal is not available for a {{ report['target_type'] }}; act on the account instead.</p>
+    {% endif %}
+    <form method="POST" action="/admin/moderation/{{ report['uid'] }}/decide" class="report-form">
+        <div class="admin-field">
+            <label for="decision-action">Action</label>
+            <select id="decision-action" name="action" required>
+                {% for action in available_actions %}
+                <option value="{{ action }}">{{ action.replace('_', ' ') }}</option>
+                {% endfor %}
+            </select>
+        </div>
+        <div class="admin-field">
+            <label for="decision-reason">Reason shown to the user</label>
+            <input id="decision-reason" name="reason" maxlength="200" placeholder="Breaches the community guidelines on harassment">
+        </div>
+        <div class="admin-field">
+            <label for="decision-hours">Suspension length (hours)</label>
+            <input id="decision-hours" name="duration_hours" type="number" min="1" max="8760" value="24">
+        </div>
+        <div class="admin-field">
+            <label for="decision-notes">Internal notes</label>
+            <textarea id="decision-notes" name="notes" rows="3" maxlength="2000"></textarea>
+        </div>
+        <button type="submit" class="btn btn-primary" data-confirm="Apply this moderation decision?">Apply decision</button>
+    </form>
+    <form method="POST" action="/admin/moderation/{{ report['uid'] }}/status" class="report-form-inline">
+        <input type="hidden" name="status" value="acknowledged">
+        <button type="submit" class="admin-btn admin-btn-sm">Acknowledge</button>
+    </form>
+</section>
+
+<section class="card report-history">
+    <h3>Decisions on this report</h3>
+    {{ decision_table("Moderation decisions recorded against this report", actions, "No decision recorded yet.") }}
+</section>
+
+{% if history %}
+<section class="card report-history">
+    <h3>Author history</h3>
+    {{ decision_table("Earlier moderation decisions against this author", history, "") }}
+</section>
+{% endif %}
+{% endblock %}
diff --git a/devplacepy/templates/admin_settings.html b/devplacepy/templates/admin_settings.html
index c4e2d8b5..56e6c6d8 100644
--- a/devplacepy/templates/admin_settings.html
+++ b/devplacepy/templates/admin_settings.html
@@ -21,7 +21,7 @@
 
     <div class="admin-field">
         <label for="site_tagline">Tagline</label>
-        <input type="text" id="site_tagline" name="site_tagline" value="{{ settings.get('site_tagline', 'Track industry shifts. Discover bold releases. Share what you are building in an open, uncensored environment.') }}" maxlength="500">
+        <input type="text" id="site_tagline" name="site_tagline" value="{{ settings.get('site_tagline', 'Track industry shifts. Discover bold releases. Share what you are building in an open environment built by developers, for developers.') }}" maxlength="500">
     </div>
 
     <div class="admin-field">
@@ -119,6 +119,89 @@
         <small class="hint-text">Routes every outbound stealth-client request (Devii fetch, DeepSearch, news, attachments, and more) through this proxy. Leave empty to connect directly. Needed only when a destination blocks this server's own IP/network (not its browser fingerprint) - most sites never need this.</small>
     </div>
 
+    <h3 class="admin-settings-group-title admin-settings-group-title-spaced">Moderation &amp; Safety</h3>
+
+    <div class="admin-field">
+        <label for="moderation_filter_mode">Content Filter Mode</label>
+        <select id="moderation_filter_mode" name="moderation_filter_mode" class="admin-settings-select">
+            {% set _mode = settings.get('moderation_filter_mode', 'review') %}
+            <option value="off"{% if _mode == 'off' %} selected{% endif %}>off - no classification</option>
+            <option value="label"{% if _mode == 'label' %} selected{% endif %}>label - maturity labels only</option>
+            <option value="review"{% if _mode == 'review' %} selected{% endif %}>review - publish and raise a report</option>
+            <option value="block"{% if _mode == 'block' %} selected{% endif %}>block - refuse at creation</option>
+        </select>
+        <small class="hint-text">How the classifier acts on a match. <strong>review</strong> is the default: nothing legitimate is ever suppressed by a machine and a human sees every flag. Move to <strong>block</strong> only with evidence from the queue - on a developer platform a blanket block produces false positives on security research and error messages. The sexual and exploitative categories always block, whatever this setting says.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="moderation_sla_hours">Moderation Response Window (hours)</label>
+        <input type="number" id="moderation_sla_hours" name="moderation_sla_hours" value="{{ settings.get('moderation_sla_hours', '24') }}" min="1" max="720" class="admin-settings-num">
+        <small class="hint-text">The commitment published in the terms and shown on every report acknowledgement. The moderation queue badge turns red once the oldest open report is older than this.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="moderation_minimum_age">Minimum Age</label>
+        <input type="number" id="moderation_minimum_age" name="moderation_minimum_age" value="{{ settings.get('moderation_minimum_age', '16') }}" min="13" max="21" class="admin-settings-num">
+        <small class="hint-text">Signup is refused below this age. Only the derived age band is stored, never the date of birth.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="moderation_mature_default_hidden">Hide Mature Content By Default</label>
+        <select id="moderation_mature_default_hidden" name="moderation_mature_default_hidden" class="admin-settings-select">
+            <option value="1"{% if settings.get('moderation_mature_default_hidden', '1') == '1' %} selected{% endif %}>Yes</option>
+            <option value="0"{% if settings.get('moderation_mature_default_hidden', '1') == '0' %} selected{% endif %}>No</option>
+        </select>
+        <small class="hint-text">When on, mature-labelled content renders behind an interstitial until the viewer explicitly opts in. Minor age bands are never offered the reveal for restricted content.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="account_deletion_grace_hours">Account Deletion Grace (hours)</label>
+        <input type="number" id="account_deletion_grace_hours" name="account_deletion_grace_hours" value="{{ settings.get('account_deletion_grace_hours', '24') }}" min="0" max="720" class="admin-settings-num">
+        <small class="hint-text">How long a deleted account stays restorable from the trash before it is permanently purged. The account is anonymised immediately either way; this only sets when the purge runs.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="ai_third_party_provider">Third-party AI Provider Name</label>
+        <input type="text" id="ai_third_party_provider" name="ai_third_party_provider" value="{{ settings.get('ai_third_party_provider', '') }}" maxlength="120" placeholder="e.g. Acme Model Co.">
+        <small class="hint-text">Named in the consent copy and the privacy policy, so the user knows who receives their content before they grant consent.</small>
+    </div>
+
+    <h3 class="admin-settings-group-title admin-settings-group-title-spaced">Policy Versions</h3>
+
+    <div class="admin-field">
+        <label for="terms_version">Terms Version</label>
+        <input type="text" id="terms_version" name="terms_version" value="{{ settings.get('terms_version', '1') }}" maxlength="20" class="admin-settings-num">
+        <small class="hint-text">Bumping this forces every member to accept the terms again before their next write. Reading and account deletion are never blocked.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="privacy_version">Privacy Policy Version</label>
+        <input type="text" id="privacy_version" name="privacy_version" value="{{ settings.get('privacy_version', '1') }}" maxlength="20" class="admin-settings-num">
+    </div>
+
+    <div class="admin-field">
+        <label for="guidelines_version">Community Guidelines Version</label>
+        <input type="text" id="guidelines_version" name="guidelines_version" value="{{ settings.get('guidelines_version', '1') }}" maxlength="20" class="admin-settings-num">
+    </div>
+
+    <h3 class="admin-settings-group-title admin-settings-group-title-spaced">Published Contact Details</h3>
+
+    <div class="admin-field">
+        <label for="contact_email">Contact Email</label>
+        <input type="text" id="contact_email" name="contact_email" value="{{ settings.get('contact_email', '') }}" maxlength="200" placeholder="support@example.com">
+        <small class="hint-text">Rendered on /docs/contact.html. Keep it identical to the trader email declared in every app store that carries a DevPlace client.</small>
+    </div>
+
+    <div class="admin-field">
+        <label for="contact_phone">Contact Phone</label>
+        <input type="text" id="contact_phone" name="contact_phone" value="{{ settings.get('contact_phone', '') }}" maxlength="60" placeholder="+31 00 000 0000">
+    </div>
+
+    <div class="admin-field">
+        <label for="contact_address">Contact Address</label>
+        <textarea id="contact_address" name="contact_address" rows="3" maxlength="500" placeholder="Street, number, postcode, city, country">{{ settings.get('contact_address', '') }}</textarea>
+    </div>
+
     <h3 class="admin-settings-group-title admin-settings-group-title-spaced">Custom Code</h3>
 
     <div class="admin-field">
diff --git a/devplacepy/templates/base.html b/devplacepy/templates/base.html
index b79c802f..795705df 100644
--- a/devplacepy/templates/base.html
+++ b/devplacepy/templates/base.html
@@ -6,7 +6,7 @@
     <meta name="theme-color" content="#0f0a1a">
     <meta name="asset-version" content="{{ static_version }}">
     <title>{% if page_title %}{{ page_title }}{% else %}DevPlace - The Developer Social Network{% endif %}</title>
-    <meta name="description" content="{% if meta_description %}{{ meta_description }}{% else %}Track industry shifts. Discover bold releases. Share what you're building in an open, uncensored environment.{% endif %}">
+    <meta name="description" content="{% if meta_description %}{{ meta_description }}{% else %}Track industry shifts. Discover bold releases. Share what you're building in an open environment built by developers, for developers.{% endif %}">
     <link rel="canonical" href="{{ canonical_url or request.url }}">
     {% if prev_url %}<link rel="prev" href="{{ prev_url }}">{% endif %}
     {% if next_url %}<link rel="next" href="{{ next_url }}">{% endif %}
@@ -212,10 +212,18 @@
     </footer>
 {% endblock %}
 
+    {% if user and activity_recording_on(user) %}
+    <div class="recording-indicator" role="status" aria-live="off" title="Your presence and session activity are recorded while you are signed in">
+        <span class="recording-dot" aria-hidden="true"></span>
+        <a href="/profile/{{ user['username'] }}?tab=privacy">Activity recording on</a>
+    </div>
+    {% endif %}
+
     {%- set _response_time = response_time_ms(request) -%}
     {%- if _response_time %}<div class="response-time-indicator" title="Server response time" aria-hidden="true">{{ _response_time }} ms</div>{% endif -%}
 
     {% if user %}
+    {% include "_report_dialog.html" %}
     <template id="comment-reply-template">
         {% set _comment_target_uid = "" %}{% set _comment_target_type = "" %}{% include "_comment_form.html" %}
     </template>
diff --git a/devplacepy/templates/containers_instance.html b/devplacepy/templates/containers_instance.html
index 6b83014e..8298188e 100644
--- a/devplacepy/templates/containers_instance.html
+++ b/devplacepy/templates/containers_instance.html
@@ -37,6 +37,7 @@
             </div>
             {% if can_manage %}
             <a class="btn btn-secondary btn-sm" href="/admin/containers/{{ instance['uid'] }}/edit">Edit configuration</a>
+            {% set _type = "workspace" %}{% set _uid = instance['uid'] %}{% set _owner = instance.get('workspace_owner_uid') or instance.get('owner_uid') or '' %}{% set _owner_name = "" %}{% set _class = "btn btn-secondary btn-sm" %}{% include "_report_button.html" %}
             {% endif %}
             {% if instance['ingress_slug'] %}
             <div class="ci-ingress" id="ci-ingress">
diff --git a/devplacepy/templates/docs/community-guidelines.html b/devplacepy/templates/docs/community-guidelines.html
new file mode 100644
index 00000000..a506584e
--- /dev/null
+++ b/devplacepy/templates/docs/community-guidelines.html
@@ -0,0 +1,105 @@
+<div class="docs-content" data-render>
+# Community Guidelines
+
+**Version {{ policy_version('guidelines') }}.** DevPlace is a network for developers. It does not
+editorialise technical opinion: you may be blunt, contrarian, or wrong about a language, a framework
+or an architecture, and nobody will remove you for it. What it does enforce is a short, fixed list of
+prohibited categories. Everything below is prohibited everywhere on the platform.
+
+Each heading is a reason key you can select when you report something. The same list, exactly as
+every client renders it, is published at [report reasons](/reports/reasons).
+
+## `hate` - Hate speech and discrimination
+
+Content that attacks, dehumanises or advocates exclusion of a person or group on the basis of race,
+ethnicity, national origin, religion, disability, disease, age, sex, gender identity or sexual
+orientation.
+
+## `violence` - Realistic violence and threats
+
+Threats of violence against any person, glorification of violence, and realistic depictions of
+violence or gore. Fictional violence in a game project is allowed; a threat aimed at a real person is
+not, in any form, including as a joke.
+
+## `weapons` - Weapons and dangerous instructions
+
+Instructions for building weapons, explosives, or other devices whose purpose is to injure people.
+Security research, exploit write-ups and vulnerability discussion are explicitly **allowed** - that is
+the work of this community - provided they are not operational instructions for harming people.
+
+## `sexual` - Sexual and pornographic content
+
+Pornography and sexually explicit material. Any sexual content involving minors is removed
+immediately, the account is closed, and it is reported to the authorities.
+
+## `religious` - Content targeting religion or belief
+
+Content that attacks or demeans a religion or its adherents. Discussing, criticising or disagreeing
+with ideas is allowed; attacking people for holding them is not.
+
+## `misinformation` - False and misleading information
+
+Fabricated claims presented as fact where they can cause real harm, especially about health, safety
+or elections. Being wrong in a technical argument is not misinformation.
+
+## `exploitative` - Exploitation of a person
+
+Content that exploits, endangers or sexualises a person, including any depiction of a minor in a
+sexual context, and content that targets a person because of their vulnerability.
+
+## `harassment` - Harassment and bullying
+
+Sustained targeting of a person, pile-ons, doxing, unwanted contact after being asked to stop, and
+publishing private information about someone without their consent.
+
+## `spam` - Spam and unwanted promotion
+
+Bulk or repetitive posting, unsolicited advertising, link farms, engagement manipulation, and content
+whose only purpose is to drive traffic elsewhere.
+
+## `intellectual_property` - Copyright and trademark infringement
+
+Publishing content you have no right to publish. See
+[Notice and takedown](/docs/intellectual-property.html) for how to file and how to counter-notice.
+
+## `self_harm` - Self-harm and suicide
+
+Content that encourages, instructs or glorifies self-harm, suicide or eating disorders. If you are
+struggling, please reach out to a local crisis line - DevPlace is not a support service.
+
+## `illegal` - Illegal activity
+
+Content that facilitates crime: trade in controlled substances, stolen credentials or data, fraud
+kits, malware distribution to third parties, or evasion of sanctions.
+
+## `other` - Something else
+
+Anything that is clearly wrong but does not fit a category above. Describe it in the detail field; a
+moderator reads every report.
+
+## What is explicitly allowed
+
+To be unambiguous, because this is a developer platform and a naive reading of the list above would
+break it:
+
+- security research, exploit development, malware analysis and reverse engineering;
+- profanity, strong opinions, and harsh technical criticism of code, tools and ideas;
+- discussion of weapons, violence or crime as subject matter in research, journalism, fiction or a
+  game project;
+- error messages, stack traces and payloads that happen to contain offensive strings.
+
+The line is intent and target. Analysis is fine. Aiming it at a person is not.
+
+## Reporting
+
+Every surface that can carry user content carries a **Report** control. Select the reason, add
+detail, and submit. Reports are private: the person you reported is never told who reported them.
+Every report is acknowledged and reviewed within {{ moderation_sla_hours() }} hours. Track yours at
+`/reports/mine`.
+
+## Enforcement
+
+Depending on severity and history a moderator may remove the content, issue a warning, suspend the
+account for a period, or close it permanently. You are always told what was decided and why, and you
+can reply to dispute it. See [How moderation works](/docs/content-moderation.html).
+</div>
diff --git a/devplacepy/templates/docs/contact.html b/devplacepy/templates/docs/contact.html
new file mode 100644
index 00000000..17d2af4c
--- /dev/null
+++ b/devplacepy/templates/docs/contact.html
@@ -0,0 +1,35 @@
+<div class="docs-content" data-render>
+# Contact
+
+These are the published contact details for DevPlace. They are the same details declared as trader
+information in the app stores that carry a DevPlace client, so the two can never drift: both read the
+`contact_email`, `contact_phone` and `contact_address` site settings.
+
+## Postal address
+
+{% if contact_details().address %}{{ contact_details().address }}{% else %}Not published yet. An administrator sets `contact_address` under Admin -> Settings.{% endif %}
+
+## Email
+
+{% if contact_details().email %}{{ contact_details().email }}{% else %}Not published yet. An administrator sets `contact_email` under Admin -> Settings.{% endif %}
+
+## Telephone
+
+{% if contact_details().phone %}{{ contact_details().phone }}{% else %}Not published yet. An administrator sets `contact_phone` under Admin -> Settings.{% endif %}
+
+## What to use which channel for
+
+| Subject | Where |
+|---|---|
+| Report a piece of content | The **Report** control on the content itself. It is on every surface. |
+| Something an account is doing to you | Report the account from its profile, and **Block** it. |
+| Dispute a moderation decision | Reply to the decision notice, or write to the email address above. |
+| Copyright or trademark infringement | [Notice and takedown](/docs/intellectual-property.html) |
+| Privacy, data access or erasure | The email address above; see the [Privacy Policy](/docs/privacy.html). |
+| A bug or feature request | The [issue tracker](/issues) |
+| Anything else | The email address above |
+
+Reports filed through the in-product control are always faster than email: they land directly in the
+moderation queue with the reported item attached, and they are answered within
+{{ moderation_sla_hours() }} hours.
+</div>
diff --git a/devplacepy/templates/docs/content-moderation.html b/devplacepy/templates/docs/content-moderation.html
new file mode 100644
index 00000000..791df40d
--- /dev/null
+++ b/devplacepy/templates/docs/content-moderation.html
@@ -0,0 +1,104 @@
+<div class="docs-content" data-render>
+# How moderation works
+
+This page describes, without omission, the safety controls DevPlace operates: what is filtered, how
+you report, what happens next, and how long it takes.
+
+## The commitment
+
+**Every report is reviewed within {{ moderation_sla_hours() }} hours.** That is not a slogan: the
+moderation queue carries a badge showing the age of the oldest unresolved report against that window,
+so a breach is visible to every administrator the moment it happens.
+
+## The three mechanisms
+
+### 1. Automated filtering, at the moment content is created
+
+Every piece of user-authored text passes through a classifier before it is published, at the five
+places where content is created or changed: content creation, content editing, comment creation and
+editing, direct messages, and profile and signup fields. Five choke points cover every surface,
+because creation on DevPlace already funnels through them.
+
+The classifier returns one of four verdicts:
+
+| Verdict | Effect |
+|---|---|
+| `allow` | Nothing happens. |
+| `label` | The item is published and carries an age label. |
+| `review` | The item is published **and** a report is raised for a moderator. |
+| `block` | The item is refused with an explanation. |
+
+The default mode is `review`, not `block`. This is deliberate. DevPlace is a developer platform: its
+members discuss exploits, cryptography, malware analysis and violent subject matter as their work, so
+a machine that silently suppresses them would destroy the product. A flagged item is therefore
+published and a human looks at it. Only the sexual and exploitative categories block outright,
+because there is no legitimate developer case for them and the harm of publishing is immediate.
+
+**The filter fails towards review, never towards publication.** If classification errors, the content
+is published and a `critical` report is raised naming the failure. A safety control that fails
+silently is worse than none.
+
+### 2. Reporting, on every surface
+
+Every surface that can carry user content carries a **Report** control: posts, comments, gists,
+projects, project files, news, uploaded media, direct messages, quizzes, polls, awards, profiles,
+issue reports, workspaces and assistant output. Select a reason from the
+[Community Guidelines](/docs/community-guidelines.html) list, add detail, submit.
+
+Reports are private. The reported person is never told who reported them. You are acknowledged
+immediately and can follow the outcome at `/reports/mine`.
+
+Filing a second report on the same item updates your existing one rather than creating a duplicate. A
+different person reporting the same item creates a separate report, and the queue shows the count, so
+a widely-reported item rises to the top.
+
+### 3. The queue and the decisions
+
+Administrators work one queue, sorted oldest-unresolved-first. Each report shows the reported item in
+place, who authored it, how many people reported it, and every previous decision against that author.
+
+A decision is one of:
+
+| Decision | What it does |
+|---|---|
+| Remove content | Removes the item from every surface |
+| Restore content | Reverses a removal |
+| Warn | Records a warning against the account and tells the user |
+| Suspend | Blocks creating content for a stated period, with a stated reason |
+| Ban | Closes the account permanently and revokes every credential |
+| Lift | Ends a suspension or ban |
+| Dismiss | The report was not a violation |
+| Escalate | Raises severity and keeps the report open for a second opinion |
+
+Removal is not available for targets that have no removal path - direct messages, accounts,
+workspaces, polls and assistant output. For those, the remedy is the account-level action.
+
+Every decision writes a permanent record: what was decided, by whom, why, and against which report.
+Every decision is also written to the append-only audit log. **The user is always told what was
+decided and why**, through an in-app notification, and can reply to dispute it.
+
+Administrators cannot act against an administrator who registered before them.
+
+## What a suspension actually does
+
+A suspended account can still sign in, still read everything, still see the reason for the
+suspension, and still delete itself. It cannot create or change content. A user is never trapped.
+
+## Blocking, which is yours alone
+
+Independently of reporting, you can **block** any account. Their content disappears from your view
+everywhere except their own profile, they can no longer message you, and they can no longer notify
+you. It is one-directional, reversible, and never disclosed to them. **Mute** is the lighter version:
+it stops their notifications while leaving their content visible. See
+[Block and mute](/docs/block-and-mute.html).
+
+## Age labelling
+
+Content classified as mature is hidden behind an interstitial by default. Revealing it is an explicit
+choice, recorded on your account, and it is not offered at all to accounts in a minor age band.
+
+## If you disagree with a decision
+
+Reply to the notification, or write to the address on the [Contact](/docs/contact.html) page. State
+the report and what you believe was wrong. A different administrator reviews it.
+</div>
diff --git a/devplacepy/templates/docs/devii-tools.html b/devplacepy/templates/docs/devii-tools.html
index 9995614d..641ac1b4 100644
--- a/devplacepy/templates/docs/devii-tools.html
+++ b/devplacepy/templates/docs/devii-tools.html
@@ -9,8 +9,8 @@ the model's tool schema, the dispatch routing, and this reference. See also
 Devii is a full agentic operator: it can run an entire user account, read and write a project's
 virtual filesystem line by line, drive the user's own browser, call any external HTTP/JSON API,
 manage Docker containers, learn lessons across sessions, schedule autonomous work, and let users
-mint their own tools in natural language. As of this build the catalog exposes **255 actions**
-across twenty-two handlers. The per-handler tables below cover the primary tools of each handler and
+mint their own tools in natural language. As of this build the catalog exposes **335 actions**
+across twenty-four handlers. The per-handler tables below cover the primary tools of each handler and
 are not an exhaustive enumeration of every action.
 
 ## How tools are declared
@@ -58,7 +58,7 @@ oldest Admin account only (the database API tools), gated the same way.
 ## Complete action reference
 
 The primary tools of the catalog, grouped by handler (this is a representative reference, not an
-exhaustive list of all 255 actions). Mutating platform calls and irreversible actions (deletes,
+exhaustive list of all 335 actions). Mutating platform calls and irreversible actions (deletes,
 visibility/read-only flips, destructive container commands) additionally pass through the
 dispatcher's confirmation gate before they run.
 
diff --git a/devplacepy/templates/docs/index.html b/devplacepy/templates/docs/index.html
index 3b3fde43..3f249e9e 100644
--- a/devplacepy/templates/docs/index.html
+++ b/devplacepy/templates/docs/index.html
@@ -22,6 +22,12 @@ call with your own API key pre-filled.
 **Contribute to DevPlace.** Go from a fresh clone to a running instance and your first
 change: [Getting started](/docs/getting-started.html).
 
+**Know where you stand.** The rules, what happens when they are broken, and what DevPlace does
+with your data: [Terms of Service](/docs/terms.html),
+[Community Guidelines](/docs/community-guidelines.html), [Privacy Policy](/docs/privacy.html),
+[How moderation works](/docs/content-moderation.html),
+[Notice and takedown](/docs/intellectual-property.html), [Contact](/docs/contact.html).
+
 ## Machine-readable schema
 
 An OpenAPI schema and an interactive explorer are generated from the backend:
diff --git a/devplacepy/templates/docs/intellectual-property.html b/devplacepy/templates/docs/intellectual-property.html
new file mode 100644
index 00000000..bff6073a
--- /dev/null
+++ b/devplacepy/templates/docs/intellectual-property.html
@@ -0,0 +1,59 @@
+<div class="docs-content" data-render>
+# Notice and takedown
+
+DevPlace removes content that infringes copyright or trademark. This page is how you tell us, and how
+the person whose content was removed responds.
+
+## Filing a notice
+
+The fastest route is the **Report** control on the infringing item, with reason
+`intellectual_property`. It lands directly in the moderation queue with the item attached and is
+answered within {{ moderation_sla_hours() }} hours.
+
+If you would rather write, use the email address on the [Contact](/docs/contact.html) page. Either
+way the notice must contain:
+
+1. identification of the work you own, or a representative sample of it;
+2. the exact location of the infringing material on DevPlace - a URL, or the surface and item;
+3. your name, postal address, telephone number and email address;
+4. a statement that you believe in good faith that the use is not authorised by the rights holder,
+   its agent, or the law;
+5. a statement, under penalty of perjury, that the information is accurate and that you are the
+   rights holder or authorised to act for them;
+6. your physical or electronic signature.
+
+A notice missing any of these cannot be acted on, and you will be told which part is missing.
+
+## What happens next
+
+The material is removed or disabled, the person who published it is told what was removed and why,
+and both the notice and the decision are recorded. Removal is not permanent destruction: it is
+reversible by an administrator if the notice is withdrawn or a counter-notice succeeds.
+
+## Counter-notice
+
+If your content was removed and you believe that was a mistake or that the use was authorised, send a
+counter-notice to the email address on the [Contact](/docs/contact.html) page containing:
+
+1. identification of the material and where it appeared before removal;
+2. a statement, under penalty of perjury, that you believe in good faith it was removed as a result
+   of mistake or misidentification;
+3. your name, postal address and telephone number;
+4. your consent to the jurisdiction of the courts of your address, and your agreement to accept
+   service of process from the person who filed the original notice;
+5. your physical or electronic signature.
+
+The counter-notice is forwarded to the original complainant. If they do not begin legal proceedings
+within the statutory period, the material may be restored.
+
+## Repeat infringers
+
+An account that repeatedly publishes infringing material is suspended and then closed. That is a
+condition of using DevPlace, not a discretionary sanction.
+
+## Bad-faith notices
+
+Knowingly misrepresenting that material is infringing carries liability under the law. Notices filed
+in bad faith are treated as abuse of the reporting system and are actioned against the reporting
+account.
+</div>
diff --git a/devplacepy/templates/docs/moderation-operations.html b/devplacepy/templates/docs/moderation-operations.html
new file mode 100644
index 00000000..c8a9e73f
--- /dev/null
+++ b/devplacepy/templates/docs/moderation-operations.html
@@ -0,0 +1,103 @@
+<div class="docs-content" data-render>
+# Operating the moderation queue
+
+Administrator-only. This is the operational manual for the queue at `/admin/moderation`, and the
+evidence base for a compliance-improvement plan if a store ever asks for one.
+
+## Daily loop
+
+1. Open `/admin/moderation`. The default tab is **Open**, sorted oldest first.
+2. Read the SLA badge in the header. It shows the age of the oldest unresolved report against
+   `moderation_sla_hours` (currently {{ moderation_sla_hours() }}). Green means every open report is
+   inside the window; red means at least one is over, and the count of breaches is shown.
+3. Work the oldest first. Anything at `critical` severity jumps the queue: those are the sexual,
+   exploitative, self-harm and illegal categories, plus filter failures.
+4. Open a report. It renders the reported item in place, the author, the number of distinct reports
+   on that target, and every prior decision against that author.
+5. Decide. Every decision writes a `moderation_actions` row, an audit event, and a notification to
+   the affected user stating what was decided and why.
+
+## Severity ladder
+
+| Severity | Assigned to | Handling |
+|---|---|---|
+| `info` | Spam | Batch it; low harm |
+| `warn` | Everything else by default | Normal queue order |
+| `critical` | Sexual, exploitative, self-harm, illegal, and any filter failure | Immediately, ahead of the queue |
+
+## The state machine
+
+`open` -> `acknowledged` -> `actioned` or `dismissed`. **Escalate** raises severity to `critical` and
+returns the report to `acknowledged` for a second opinion rather than resolving it.
+
+Resolution is a single atomic conditional update: if two administrators decide the same report
+simultaneously, exactly one succeeds and the other is answered 409. Never work around that by
+re-opening and re-deciding - re-read the report first.
+
+## Choosing a sanction
+
+| Situation | Sanction |
+|---|---|
+| First offence, low harm, plausibly accidental | Remove content, reason stated |
+| First offence, deliberate | Remove content plus a warning |
+| Repeat offence, or harassment of a person | Suspend, 24 to 168 hours |
+| Sexual content involving a minor, credible threat, or coordinated abuse | Ban immediately, then preserve evidence |
+| Report is not a violation | Dismiss - the reporter is told, and that is not a penalty for reporting |
+
+State the reason in the field that is shown to the user. A decision with no reason is a decision the
+user cannot learn from and cannot dispute.
+
+## What you cannot do
+
+You cannot action an administrator who registered before you. The attempt is refused and audited with
+`result="denied"`. This is enforced server-side, so it also binds the assistant.
+
+You cannot remove a direct message, an account, a workspace, a poll or assistant output as
+*content* - those have no removal path. Act on the account instead.
+
+## Filter tuning
+
+`moderation_filter_mode` at `/admin/settings` selects the platform posture:
+
+| Mode | Effect |
+|---|---|
+| `off` | Classification does not run |
+| `label` | Classification only labels maturity, never reports |
+| `review` | Default. A match publishes and raises a system report |
+| `block` | A match is refused at creation |
+
+Move to `block` only with evidence from the queue. On a developer platform a blanket block produces
+false positives on security research and error messages, which is why `review` is the default. Watch
+the volume of `origin=filter` reports for a week before changing it.
+
+## Evidence for a compliance plan
+
+Everything a reviewer or regulator can ask for is already queryable:
+
+- **Throughput and latency**: `content_reports.created_at` versus `resolved_at`.
+- **Backlog and SLA**: the queue's own SLA snapshot, and the count of open reports older than the
+  window.
+- **Decisions and their reasons**: `moderation_actions`, one row per decision, linked to its report.
+- **Statements of reasons**: the moderation notification sent to each affected user.
+- **Immutable trail**: the `moderation` category in the audit log at `/admin/audit-log`.
+
+## App review checklist
+
+The operator transcribes these into the store listing; every answer is a fact about the running platform, not a promise.
+
+**Review account.** Provision a normal member account for the reviewer and hand over its credentials in the review notes. Then seed it so both safety controls can actually be exercised: it must see content authored by **someone else** (so the Report and Block controls are present - both hide on your own content), and it must not be an administrator (so the moderation queue is correctly inaccessible). Check `registration_open` is `1` before submitting, or a reviewer who loses the account cannot make another one.
+
+**Review notes.** State, in this order: where the report control is (every content action bar); where blocking is (the same bar, and the profile); that reports are answered within `moderation_sla_hours`; that the terms and community guidelines are linked from the footer of every page and from the signup form; that account deletion is self-service at `/profile/{username}/delete`; and that **all user code executes on DevPlace servers in containers, never on the device** - the client only ever renders results, and nothing downloads or alters executable code.
+
+**Age-rating questionnaire.** The four answers that matter are all yes, and each has an artifact: moderation systems (`/admin/moderation`), content filtering (the classifier at the five choke points), reporting tools (`POST /reports/{target_type}/{target_uid}`), blocking (`/block/{username}`). The minimum age is `moderation_minimum_age`; user-generated content is unrestricted-web-access-free (there is no in-app browser) but does include user-published workspaces reachable at `/p/<slug>`, indexed at `/workspaces/index`.
+
+**Privacy declarations.** Declare the categories the [Privacy Policy](/docs/privacy.html) lists - contact info, user content, identifiers, usage data, diagnostics - as **linked to the user** and **not used for tracking**. There is no third-party analytics SDK, no advertising, and no cross-app or cross-site tracking anywhere in the codebase, so no tracking declaration applies. The one third-party processor of user content is the AI provider named in `ai_third_party_provider`, and it receives nothing without a granted `ai_third_party` consent.
+
+**Keep them untriggered.** Adding social login, an in-app purchase path, purchasable randomness, advertising, or cross-app tracking each creates a new mandatory obligation. If one is added, its obligation ships in the same change.
+
+## Reversal
+
+A wrong removal is undone with the **Restore content** decision, or from `/admin/trash`, which
+restores the whole deletion event under one stamp. Nothing a moderator removes is destroyed until it
+is purged.
+</div>
diff --git a/devplacepy/templates/docs/privacy.html b/devplacepy/templates/docs/privacy.html
new file mode 100644
index 00000000..221c254d
--- /dev/null
+++ b/devplacepy/templates/docs/privacy.html
@@ -0,0 +1,103 @@
+<div class="docs-content" data-render>
+# Privacy Policy
+
+**Version {{ policy_version('privacy') }}.** This page states what data DevPlace collects, how it is
+used, and how it is retained, deleted and shared.
+
+## 1. Data DevPlace collects
+
+| Category | What | Why |
+|---|---|---|
+| Account | Username, email address, password hash, API key | Identify you and secure your account |
+| Age band | The band derived from your declared date of birth (`13_15`, `16_17`, `adult`) | Enforce the minimum age and age-appropriate access. **The date of birth itself is never stored.** |
+| Profile | Bio, location, links, avatar seed, timezone | Shown on your public profile |
+| Content | Posts, comments, gists, projects, project files, quizzes, polls, awards, uploads, direct messages, issue reports | The service itself |
+| Activity | Last-seen timestamp, contribution calendar, XP and badges, notification and read state | Presence, gamification and notifications |
+| Technical | IP address and user agent on audit-relevant actions, request timing | Security, abuse prevention and rate limiting |
+| Assistant | Prompts and results of assistant, search and analysis features you invoke | Deliver the feature and attribute its cost to you |
+| Moderation | Reports you file, reports filed about you, and decisions taken | Operate the safety controls the platform is required to have |
+
+DevPlace runs **no third-party analytics, no advertising and no cross-site or cross-app tracking**.
+There is no tracking identifier shared with any other company.
+
+## 2. How the data is used
+
+Only to run the service: to show your content to the people you published it to, to authenticate you,
+to notify you, to keep the platform safe, and to bill and cap AI usage. It is never sold, and it is
+never used to build an advertising profile.
+
+## 3. Third parties
+
+| Recipient | What is sent | When |
+|---|---|---|
+| {{ ai_provider_name() }} | The text you asked an assistant feature to process | **Only after you grant `ai_third_party` consent.** Default: not granted. |
+| Push services (Apple, browser push endpoints) | An encrypted notification payload to a device you registered | Only when you register a device and enable a push channel |
+| Telegram | Messages in the Telegram conversation you paired | Only when you pair Telegram yourself |
+| Software another member runs in a container | Your DevPlace API key and user id, injected as `DEVPLACE_API_KEY` and `DEVPLACE_USER_UID` | **Only after you grant `container_credentials` consent**, and only when the container is run by someone else. Your own containers use your own credentials with no separate consent. |
+| Email and issue-tracker hosts you configure | The content you send through them | Only when you configure them yourself |
+
+Every one of these is under your control, is off unless you turn it on, and can be revoked from your
+profile privacy tab.
+
+## 4. Consent
+
+DevPlace records five consents, each versioned, each independently grantable and withdrawable, with
+the full history retained so a decision is always provable:
+
+- `terms` - acceptance of the Terms of Service and Community Guidelines;
+- `privacy` - acknowledgement of this policy;
+- `ai_third_party` - processing of **your own content** by a third-party AI model provider;
+- `activity_recording` - recording of your presence and session activity;
+- `container_credentials` - sharing your credentials with software another member runs in a container.
+
+Withdrawal takes effect immediately. Withdrawing `ai_third_party` turns every assistant feature that
+would send your content off, whatever the per-feature preference says. Withdrawing
+`activity_recording` stops presence writes; you simply appear offline.
+
+Manage all five at `/profile/{username}?tab=privacy`.
+
+## 5. Retention and deletion
+
+**You can delete your account yourself**, at any time, from your profile. It asks for your password,
+tells you exactly what happens, and then:
+
+1. every session and access token is revoked immediately;
+2. your username is tombstoned and your email, bio, location, links, avatar seed, API key and
+   password hash are cleared immediately - from your point of view and everyone else's, the account
+   is gone the moment you confirm;
+3. your content is removed from every surface under one deletion event;
+4. after a short reversible window (published on the deletion page, so an accidental deletion can be
+   undone), the whole event is permanently purged.
+
+Retained after purge: append-only audit and moderation records required to show that the platform
+enforced its own rules, holding actor identifiers rather than your personal profile; and backup
+archives until they rotate out on their normal schedule.
+
+## 6. Your rights
+
+You can access your data (every surface is also a JSON API), correct it (edit your profile and
+content), export it (the API and the per-tool export endpoints), restrict processing (withdraw a
+consent), and erase it (delete your account). To exercise a right that the product does not cover
+directly, use the [Contact](/docs/contact.html) page.
+
+## 7. Security
+
+Passwords are hashed with PBKDF2-SHA256 and never stored or transmitted in the clear. Sessions are
+opaque tokens. Administrative and database access is restricted and every state change is recorded in
+an append-only audit log.
+
+## 8. Children
+
+DevPlace is not directed at children under {{ moderation_minimum_age() }}. Accounts are refused below
+that age. If you believe an account belongs to a younger child, report it or use the
+[Contact](/docs/contact.html) page and it will be closed.
+
+## 9. Changes
+
+Material changes bump the version at the top of this page.
+
+## 10. Contact
+
+Data-protection enquiries go to the address, email and telephone number on the
+[Contact](/docs/contact.html) page.
+</div>
diff --git a/devplacepy/templates/docs/production-nginx.html b/devplacepy/templates/docs/production-nginx.html
index 4dc41545..56a4df23 100644
--- a/devplacepy/templates/docs/production-nginx.html
+++ b/devplacepy/templates/docs/production-nginx.html
@@ -42,6 +42,24 @@ and the `/devii/ws` location forwards `Upgrade $http_upgrade` and `Connection $c
 
 `client_max_body_size` is set from `NGINX_MAX_BODY_SIZE` (default `50m`). It must be **>= the admin-configurable `max_upload_size_mb`** (Admin -> Settings). If the app limit exceeds the nginx limit, nginx rejects the upload with **HTTP 413** before it ever reaches the app. After raising `max_upload_size_mb`, raise `NGINX_MAX_BODY_SIZE` to match and restart nginx.
 
+## IPv6 reachability
+
+App stores require a client to work on an **IPv6-only** network, so the public edge must answer over IPv6. The nginx server block listens dual-stack:
+
+```
+listen 80;
+listen [::]:80;
+```
+
+That is the part this repository controls. Two things sit outside it and must be checked on the host before an IPv6-only client can connect:
+
+1. The domain needs an **AAAA record** pointing at the host's IPv6 address, alongside the A record.
+2. The published port must be bound on an IPv6 address. `docker-compose.yml` publishes nginx on `127.0.0.1:${PORT}:80`, which is IPv4 loopback only, on the assumption that a host-level reverse proxy or tunnel terminates the public connection. Whatever terminates it must itself listen on `[::]` and forward to that loopback port.
+
+The application container is only ever reached by nginx over the compose network, so uvicorn binding `0.0.0.0` is not a limitation - no IPv6 client ever talks to it directly.
+
+Verify from an IPv6-only vantage point (or force the family): `curl -6 -I https://your-domain/` must return a `200`, and `curl -6 -I https://your-domain/feed` must render. A failure here is a DNS or host-binding problem, not an application one.
+
 ## Security headers and caching
 
 The server block sets `X-Content-Type-Options`, `X-Frame-Options: DENY`, `X-XSS-Protection`, and `Referrer-Policy`, inherited only by locations that declare no `add_header` of their own. gzip is enabled for text, JSON, JS, CSS, and SVG. The micro-cache is off by default; set `NGINX_CACHE_ENABLED=true` to cache proxied 200s for one minute with `X-Cache-Status` reporting.
diff --git a/devplacepy/templates/docs/terms.html b/devplacepy/templates/docs/terms.html
new file mode 100644
index 00000000..013e0366
--- /dev/null
+++ b/devplacepy/templates/docs/terms.html
@@ -0,0 +1,115 @@
+<div class="docs-content" data-render>
+# Terms of Service
+
+**Version {{ policy_version('terms') }}.** These terms govern your use of DevPlace through the web
+application and through any client that speaks to its API. By creating an account you accept them.
+When the version above changes, you are asked to accept the new version before you can create or
+change anything; you can always keep reading and can always delete your account.
+
+## 1. Who may use DevPlace
+
+You must be at least {{ moderation_minimum_age() }} years old to hold an account. You declare your
+date of birth at signup. DevPlace stores only the age band derived from it and discards the date
+itself.
+
+One person may hold one account. You are responsible for everything done with your credentials.
+
+## 2. Zero tolerance for objectionable content and abusive behaviour
+
+**DevPlace does not tolerate objectionable content or abusive users.** Content in any of the
+categories listed in the [Community Guidelines](/docs/community-guidelines.html) is prohibited
+anywhere on the platform: posts, comments, gists, project descriptions, project files, quizzes,
+polls, awards, uploaded media, direct messages, profile fields, issue reports, assistant output, and
+anything a container workspace serves through the public ingress.
+
+Prohibited content is removed. Accounts that post it are suspended or closed. This applies whether
+the content was written by a person, generated by an assistant, or served by software you deployed.
+
+## 3. How the rules are enforced
+
+Three mechanisms enforce section 2, and all three are described in full on the
+[How moderation works](/docs/content-moderation.html) page:
+
+1. **Automated filtering** at the moment content is created or edited.
+2. **A report control on every surface**, available to every signed-in member.
+3. **A moderation queue** worked by administrators, with a published response window of
+   {{ moderation_sla_hours() }} hours.
+
+You can also **block** any account. Blocking hides that person's content from you everywhere except
+their own profile, and stops them contacting you.
+
+## 4. Your content
+
+You keep ownership of everything you write, upload or publish. You grant DevPlace the licence it
+needs to store your content, show it to the people you published it to, transmit it, and make the
+backups and copies that operating the service requires. That licence ends when the content is
+deleted, except for copies retained in backups until they rotate out and for records required for
+legal or moderation purposes.
+
+You are responsible for having the rights to everything you publish. See
+[Notice and takedown](/docs/intellectual-property.html) if your rights have been infringed.
+
+## 5. Acceptable use
+
+You must not:
+
+- publish content in a prohibited category;
+- harass, threaten, impersonate or dox any person;
+- attack, overload or attempt to gain unauthorised access to DevPlace or any other system;
+- use container workspaces or the AI gateway to attack third parties, mine cryptocurrency, send bulk
+  unsolicited mail, or host prohibited content;
+- scrape or automate in a way that degrades the service for others;
+- evade a suspension or ban.
+
+## 6. Code execution
+
+DevPlace runs user code in **containers on DevPlace servers**. Nothing you write here is downloaded
+to or executed on your device by the platform, and no DevPlace client changes its own behaviour by
+downloading code. You are fully responsible for the code you run and for anything it serves publicly.
+
+## 7. Artificial intelligence
+
+Assistant features send content to a third-party model provider. Nothing you author is sent for
+processing without your explicit consent, which you grant and withdraw at any time from your profile
+privacy tab. See the [Privacy Policy](/docs/privacy.html).
+
+Assistant output is generated text. It can be wrong. It is your responsibility to check it, and it is
+subject to the same rules as anything you write yourself.
+
+## 8. Rankings, awards and seasons
+
+DevPlace ranks contributors, runs seasonal Code Farm Eras, and lets members give each other
+awards. All of it is **status and cosmetic only**. Nothing of monetary value is offered,
+awarded or exchanged; no entry fee is charged; nothing can be purchased that affects a ranking,
+an award or an outcome; and no in-platform currency can be bought or cashed out. None of it is a
+contest, sweepstake or lottery, and no app store, device maker or platform operator sponsors,
+endorses, administers or is otherwise involved in any of it.
+
+## 9. Suspension, closure and appeal
+
+DevPlace may remove content and suspend or close an account that breaks these terms. When that
+happens you are told what was decided and why. Reply to the notice, or use the contact details on the
+[Contact](/docs/contact.html) page, to dispute a decision.
+
+## 10. Deleting your account
+
+You can delete your account yourself, at any time, from your profile. Your account and personal data
+are removed. The process, the short reversible window, and what is retained are described on the
+[Privacy Policy](/docs/privacy.html) page.
+
+## 11. Availability and liability
+
+DevPlace is provided as it is, without warranty. It may change or be unavailable. To the extent the
+law allows, DevPlace is not liable for indirect or consequential loss. Nothing here limits liability
+that cannot lawfully be limited.
+
+## 12. Changes to these terms
+
+Material changes bump the version at the top of this page. You are asked to accept the new version
+before your next write. Continuing to read and deleting your account never require acceptance.
+
+## 13. Contact
+
+Postal address, email and telephone number are published on the
+[Contact](/docs/contact.html) page.
+</div>
diff --git a/devplacepy/templates/gist_detail.html b/devplacepy/templates/gist_detail.html
index 80889f36..b96f8661 100644
--- a/devplacepy/templates/gist_detail.html
+++ b/devplacepy/templates/gist_detail.html
@@ -26,8 +26,12 @@
         </div>
 
         {% if gist.get('description') %}
+        {% if maturity_hidden(maturity, user) %}
+        {% set _level = maturity %}{% include "_maturity_gate.html" %}
+        {% else %}
         <div class="gist-detail-desc rendered-content">{{ render_content(gist['description'], author_is_admin=is_admin(author)) }}</div>
         {% endif %}
+        {% endif %}
 
         {% if attachments %}
         {% include "_attachment_display.html" %}
@@ -51,6 +55,7 @@
             {% set _type = "gist" %}{% set _uid = gist['uid'] %}{% set _my_vote = my_vote %}{% set _count = star_count %}{% set _btn_class = "gist-star-btn" %}{% include "_star_vote.html" %}
             {% endif %}
             {% set _type = "gist" %}{% set _uid = gist['uid'] %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
+            {% set _type = "gist" %}{% set _uid = gist['uid'] %}{% set _owner = gist['user_uid'] %}{% set _owner_name = (author or {}).get('username', '') %}{% set _class = "gist-star-btn" %}{% include "_report_button.html" %}
             {% if is_owner %}
             <button type="button" class="gist-star-btn" data-modal="edit-gist-modal"><span class="icon">&#x270F;&#xFE0F;</span><span class="label">Edit</span></button>
             {% endif %}
diff --git a/devplacepy/templates/issue_detail.html b/devplacepy/templates/issue_detail.html
index 4f370225..ee932d74 100644
--- a/devplacepy/templates/issue_detail.html
+++ b/devplacepy/templates/issue_detail.html
@@ -40,6 +40,10 @@
         </div>
         {% endif %}
 
+        <div class="issue-detail-actions">
+            {% set _type = "issue" %}{% set _uid = issue.number|string %}{% set _owner = "" %}{% set _owner_name = "" %}{% set _class = "btn btn-secondary btn-sm" %}{% include "_report_button.html" %}
+        </div>
+
         <div class="issue-detail-body rendered-content">{{ render_content(body) }}</div>
 
         {% if attachments %}
diff --git a/devplacepy/templates/landing.html b/devplacepy/templates/landing.html
index dedf7fe8..3b9a964e 100644
--- a/devplacepy/templates/landing.html
+++ b/devplacepy/templates/landing.html
@@ -117,7 +117,7 @@
     {% else %}
     <section class="landing-hero">
         <h1>Devplace.net - The Developer <span>Social Network</span></h1>
-        <p>Track industry shifts. Discover bold releases. Share what you're building in an open, uncensored environment.</p>
+        <p>Track industry shifts. Discover bold releases. Share what you're building in an open environment built by developers, for developers.</p>
         <a href="/auth/signup" class="landing-cta"><span class="icon">&#x2728;</span> Join DevPlace Free</a>
 
         <div class="landing-features">
@@ -131,7 +131,8 @@
             </div>
             <div class="landing-feature">
                 <div class="landing-feature-icon">&#x1F4AD;</div>
-                <h3>No Censorship</h3>
+                <h3>No Gatekeeping</h3>
+                <p>We never editorialise technical opinion. A short list of prohibited categories is enforced - read the <a href="/docs/community-guidelines.html">community guidelines</a>.</p>
             </div>
             <div class="landing-feature">
                 <div class="landing-feature-icon">&#x1F4B3;</div>
diff --git a/devplacepy/templates/messages.html b/devplacepy/templates/messages.html
index 80173dc7..6217e02c 100644
--- a/devplacepy/templates/messages.html
+++ b/devplacepy/templates/messages.html
@@ -61,6 +61,7 @@
                 {% endif %}
                 <span class="message-time">{{ dt_ago(msg.message['created_at']) if msg.message.get('created_at') else msg.time_ago }}</span>
                 {% if msg.is_mine %}<span class="message-receipt"{% if not msg.message['read'] %} hidden{% endif %}>&#x2713;&#x2713;<span class="sr-only">Read</span></span>{% endif %}
+                {% set _type = "message" %}{% set _uid = msg.message['uid'] %}{% set _owner = msg.message['sender_uid'] %}{% set _owner_name = "" %}{% set _class = "message-report-btn" %}{% include "_report_button.html" %}
             </div>
             {% endfor %}
             <div class="typing-indicator" id="typing-indicator" hidden><span></span><span></span><span></span></div>
diff --git a/devplacepy/templates/news_detail.html b/devplacepy/templates/news_detail.html
index eaad3ebe..72a5b1ea 100644
--- a/devplacepy/templates/news_detail.html
+++ b/devplacepy/templates/news_detail.html
@@ -33,8 +33,12 @@
             <h1 class="news-detail-title">{{ render_title(article['title']) }}</h1>
 
             {% if article.get('content') %}
+            {% if maturity_hidden(maturity, user) %}
+            {% set _level = maturity %}{% include "_maturity_gate.html" %}
+            {% else %}
             <div class="news-detail-content rendered-content">{{ render_content(article['content']) }}</div>
             {% endif %}
+            {% endif %}
 
             <div class="news-detail-actions">
                 <a href="{{ article['url'] }}" target="_blank" rel="noopener" class="news-detail-read-link">
@@ -42,6 +46,7 @@
                 </a>
                 <button type="button" class="news-detail-back" data-share="/news/{{ article['slug'] or article['uid'] }}">&#x1F517; Share</button>
                 {% set _type = "news" %}{% set _uid = article['uid'] %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
+                {% set _type = "news" %}{% set _uid = article['uid'] %}{% set _owner = "" %}{% set _owner_name = "" %}{% set _class = "news-detail-back" %}{% include "_report_button.html" %}
                 <a href="/news" class="news-detail-back">&larr; Back to News</a>
             </div>
         </div>
diff --git a/devplacepy/templates/post.html b/devplacepy/templates/post.html
index b8ed8dac..034a0dbd 100644
--- a/devplacepy/templates/post.html
+++ b/devplacepy/templates/post.html
@@ -26,7 +26,11 @@
         <h1 class="post-detail-title">{{ render_title(post['title'], author_is_admin=is_admin(author)) }}</h1>
         {% endif %}
 
+        {% if maturity_hidden(maturity, user) %}
+        {% set _level = maturity %}{% include "_maturity_gate.html" %}
+        {% else %}
         <div class="post-detail-content rendered-content">{{ render_content(post['content'], author_is_admin=is_admin(author)) }}</div>
+        {% endif %}
 
         {% if project_link %}
         <a href="{{ project_link.url }}" class="project-link">Project: {{ project_link.name }}</a>
@@ -45,6 +49,7 @@
             {% set _type = "post" %}{% set _uid = post['uid'] %}{% set _reactions = reactions %}{% include "_reaction_bar.html" %}
             <button type="button" class="post-action-btn" data-share="/posts/{{ post['slug'] or post['uid'] }}"><span class="icon">&#x1F517;</span><span class="label"> Share</span></button>
             {% set _type = "post" %}{% set _uid = post['uid'] %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
+            {% set _type = "post" %}{% set _uid = post['uid'] %}{% set _owner = post['user_uid'] %}{% set _owner_name = (author or {}).get('username', '') %}{% set _class = "post-action-btn" %}{% include "_report_button.html" %}
             {% if is_owner %}
             <button type="button" class="post-action-btn" data-modal="edit-post-modal"><span class="icon">&#x270F;&#xFE0F;</span><span class="label">Edit</span></button>
             {% endif %}
diff --git a/devplacepy/templates/profile.html b/devplacepy/templates/profile.html
index 4e9d3124..5467c2f1 100644
--- a/devplacepy/templates/profile.html
+++ b/devplacepy/templates/profile.html
@@ -5,6 +5,7 @@
 <link rel="stylesheet" href="{{ static_url('/static/css/projects.css') }}">
 <link rel="stylesheet" href="{{ static_url('/static/css/gists.css') }}">
 <link rel="stylesheet" href="{{ static_url('/static/css/awards.css') }}">
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
 {% endblock %}
 {% block content %}
 <div class="profile-layout">
@@ -93,6 +94,7 @@
                 {% if can_give_award %}
                 <button type="button" class="btn btn-primary btn-sm full-width" data-award-give data-username="{{ profile_user['username'] }}" data-modal="award-give-modal"{{ guest_disabled(user) }}><span class="icon">&#x1F3C6;</span>Give Award</button>
                 {% endif %}
+                {% set _type = "user" %}{% set _uid = profile_user['uid'] %}{% set _owner = profile_user['uid'] %}{% set _owner_name = "" %}{% set _class = "btn btn-secondary btn-sm full-width" %}{% include "_report_button.html" %}
             </div>
             {% endif %}
 
@@ -558,6 +560,7 @@
                 <a href="/profile/{{ profile_user['username'] }}?tab=following#profile-tabs" class="profile-tab {% if current_tab == 'following' %}active{% endif %}" data-menu-icon="&#x1F464;" data-menu-label="Following ({{ following_count }})"><span class="icon">&#x1F464;</span> Following ({{ following_count }})</a>
                 {% if is_owner or viewer_is_admin %}
                 <a href="/profile/{{ profile_user['username'] }}?tab=notifications#profile-tabs" class="profile-tab {% if current_tab == 'notifications' %}active{% endif %}" data-menu-icon="&#x1F514;" data-menu-label="Notifications"><span class="icon">&#x1F514;</span> Notifications</a>
+                <a href="/profile/{{ profile_user['username'] }}?tab=privacy#profile-tabs" class="profile-tab {% if current_tab == 'privacy' %}active{% endif %}" data-menu-icon="&#x1F512;" data-menu-label="Privacy"><span class="icon">&#x1F512;</span> Privacy</a>
                 {% endif %}
             </div>
             <button type="button" class="profile-tab overflow-tabs-more" aria-haspopup="menu" aria-label="More tabs" hidden><span class="icon">&#x22EF;</span> More</button>
@@ -663,6 +666,69 @@
                     {% if follow_pagination.has_next %}<a class="btn btn-ghost btn-sm" href="/profile/{{ profile_user['username'] }}?tab={{ current_tab }}&page={{ follow_pagination.next_page }}">Next</a>{% endif %}
                 </div>
                 {% endif %}
+            {% elif current_tab == 'privacy' %}
+                {% if is_owner or viewer_is_admin %}
+                <div class="profile-panel privacy-panel" data-consent-panel data-username="{{ profile_user['username'] }}">
+                    <h3>Acceptances</h3>
+                    <p class="privacy-intro">Accepted terms version <strong>{{ terms_version or 'none' }}</strong>{% if terms_accepted_at %} on {{ local_dt(terms_accepted_at) }}{% endif %}. The version in force is <strong>{{ current_terms_version }}</strong>. Read the <a href="/docs/terms.html">Terms of Service</a>, the <a href="/docs/community-guidelines.html">Community Guidelines</a> and the <a href="/docs/privacy.html">Privacy Policy</a>.</p>
+                    {% if age_band %}<p class="privacy-intro">Age band on file: <strong>{{ age_band }}</strong>. Your date of birth is not stored.</p>{% endif %}
+                    {% if suspension_reason %}<p class="privacy-suspension">Account restriction: {{ suspension_reason }}{% if suspended_until %} (until {{ local_dt(suspended_until) }}){% endif %}.</p>{% endif %}
+
+                    <h3>Consents</h3>
+                    <table class="notif-prefs-table">
+                        <caption class="sr-only">Consents you have granted or withdrawn</caption>
+                        <thead>
+                            <tr>
+                                <th>Consent</th>
+                                <th>State</th>
+                                <th class="notif-prefs-col">Action</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {% for consent in consents %}
+                            <tr>
+                                <td>
+                                    <span class="notif-prefs-label">{{ consent.label }}</span>
+                                    {% if consent.version %}<span class="notif-prefs-desc">Version {{ consent.version }}</span>{% endif %}
+                                </td>
+                                <td><span class="status-badge status-{{ 'actioned' if consent.state == 'granted' else 'dismissed' }}">{{ consent.state }}</span></td>
+                                <td class="notif-prefs-col">
+                                    {% if is_owner %}
+                                    <form method="POST" action="/profile/{{ profile_user['username'] }}/consent" class="inline-form">
+                                        <input type="hidden" name="kind" value="{{ consent.kind }}">
+                                        <input type="hidden" name="granted" value="{{ '0' if consent.state == 'granted' else '1' }}">
+                                        <button type="submit" class="btn btn-secondary btn-sm">{{ 'Withdraw' if consent.state == 'granted' else 'Grant' }}</button>
+                                    </form>
+                                    {% else %}
+                                    <span class="notif-prefs-desc">Only the account holder can change this.</span>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+
+                    <h3>Mature content</h3>
+                    <p class="privacy-intro">Content labelled mature is hidden behind an interstitial unless you opt in. Accounts in a minor age band are never offered the reveal for restricted content.</p>
+                    {% if is_owner %}
+                    <form method="POST" action="/profile/{{ profile_user['username'] }}/mature-content" class="inline-form">
+                        <input type="hidden" name="mature_opt_in" value="{{ '0' if mature_opt_in else '1' }}">
+                        <button type="submit" class="btn btn-secondary btn-sm">{{ 'Hide mature content' if mature_opt_in else 'Show mature content' }}</button>
+                    </form>
+                    {% else %}
+                    <p class="privacy-intro">Only the account holder can change this preference.</p>
+                    {% endif %}
+
+                    {% if is_owner %}
+                    <h3>Your reports</h3>
+                    <p class="privacy-intro">Every report you filed, and its outcome, is listed at <a href="/reports/mine">your reports</a>.</p>
+
+                    <h3>Delete your account</h3>
+                    <p class="privacy-intro">Deleting removes your account and your personal data. It is reversible for {{ deletion_grace_hours }} hours, then permanently purged.</p>
+                    <a href="/profile/{{ profile_user['username'] }}/delete" class="btn btn-secondary btn-sm">Delete account</a>
+                    {% endif %}
+                </div>
+                {% endif %}
             {% elif current_tab == 'notifications' %}
                 {% if is_owner or viewer_is_admin %}
                 <div class="notif-prefs profile-panel" data-notif-prefs data-username="{{ profile_user['username'] }}">
diff --git a/devplacepy/templates/project_detail.html b/devplacepy/templates/project_detail.html
index decb1a38..17767462 100644
--- a/devplacepy/templates/project_detail.html
+++ b/devplacepy/templates/project_detail.html
@@ -47,7 +47,11 @@
             </div>
         </div>
 
+        {% if maturity_hidden(maturity, user) %}
+        {% set _level = maturity %}{% include "_maturity_gate.html" %}
+        {% else %}
         <div class="project-detail-desc rendered-content">{{ render_content(project.get('description', ''), author_is_admin=is_admin(author)) }}</div>
+        {% endif %}
 
         {% if attachments %}
         {% include "_attachment_display.html" %}
@@ -75,6 +79,7 @@
             {% endif %}
             {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
             {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _reactions = reactions %}{% include "_reaction_bar.html" %}
+            {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _owner = project['user_uid'] %}{% set _owner_name = (author or {}).get('username', '') %}{% set _class = "project-star-btn" %}{% include "_report_button.html" %}
             <button type="button" class="project-star-btn project-actions-more" aria-haspopup="menu" aria-expanded="false" aria-label="More actions"><span class="icon">&#x22EF;</span><span class="label"> More</span></button>
 
             <div class="project-actions-overflow" hidden>
diff --git a/devplacepy/templates/project_files.html b/devplacepy/templates/project_files.html
index 3a433c7b..24bb1a6c 100644
--- a/devplacepy/templates/project_files.html
+++ b/devplacepy/templates/project_files.html
@@ -18,6 +18,7 @@
             <button type="button" class="btn btn-primary" id="pf-save">Save</button>
             {% endif %}
             <button type="button" class="btn btn-secondary" data-zip-download="/projects/{{ project['slug'] or project['uid'] }}/files/zip">Download as zip</button>
+            {% set _type = "project_file" %}{% set _uid = project['uid'] %}{% set _owner = project['user_uid'] %}{% set _owner_name = "" %}{% set _class = "btn btn-secondary" %}{% include "_report_button.html" %}
             <span class="pf-status" id="pf-status" role="status" aria-live="polite"></span>
         </div>
     </div>
diff --git a/devplacepy/templates/quiz.html b/devplacepy/templates/quiz.html
index b01267b1..637f1920 100644
--- a/devplacepy/templates/quiz.html
+++ b/devplacepy/templates/quiz.html
@@ -23,8 +23,12 @@
         </div>
 
         {% if quiz.description %}
+        {% if maturity_hidden(maturity, user) %}
+        {% set _level = maturity %}{% include "_maturity_gate.html" %}
+        {% else %}
         <div class="quiz-detail-desc rendered-content">{{ render_content(quiz.description, author_is_admin=is_admin(author)) }}</div>
         {% endif %}
+        {% endif %}
 
         <div class="quiz-stats-strip">
             <div class="quiz-stat"><span class="quiz-stat-value">{{ quiz.question_count }}</span><span class="quiz-stat-label">Questions</span></div>
@@ -53,6 +57,7 @@
             <a href="{{ quiz.url }}/export" class="btn btn-secondary">Export JSON</a>
             {% set _type = "quiz" %}{% set _uid = quiz.uid %}{% set _my_vote = my_vote %}{% set _count = star_count %}{% set _btn_class = "btn btn-secondary" %}{% include "_star_vote.html" %}
             {% set _type = "quiz" %}{% set _uid = quiz.uid %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
+            {% set _type = "quiz" %}{% set _uid = quiz.uid %}{% set _owner = quiz.user_uid %}{% set _owner_name = (author or {}).get('username', '') %}{% set _class = "btn btn-secondary" %}{% include "_report_button.html" %}
             {% if quiz.viewer_owns or is_admin(user) %}
             <form method="POST" action="/quizzes/delete/{{ quiz.slug }}" class="inline-form">
                 <button type="submit" class="btn btn-danger" data-confirm="Delete this quiz and every attempt on it?" data-confirm-danger>Delete</button>
diff --git a/devplacepy/templates/report_reasons.html b/devplacepy/templates/report_reasons.html
new file mode 100644
index 00000000..0a24c19b
--- /dev/null
+++ b/devplacepy/templates/report_reasons.html
@@ -0,0 +1,18 @@
+{% extends "base.html" %}
+{% block extra_head %}
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
+{% endblock %}
+{% block content %}
+<div class="page-narrow">
+    <h1>Report reasons</h1>
+    <p class="report-intro">These are the categories DevPlace accepts content reports under. Every client renders the same list; see the <a href="/docs/community-guidelines.html">community guidelines</a> for what each one covers.</p>
+    <dl class="reason-list">
+        {% for reason in reasons %}
+        <div class="reason-row">
+            <dt><code>{{ reason.key }}</code></dt>
+            <dd>{{ reason.label }}</dd>
+        </div>
+        {% endfor %}
+    </dl>
+</div>
+{% endblock %}
diff --git a/devplacepy/templates/reports_mine.html b/devplacepy/templates/reports_mine.html
new file mode 100644
index 00000000..652126d6
--- /dev/null
+++ b/devplacepy/templates/reports_mine.html
@@ -0,0 +1,39 @@
+{% extends "base.html" %}
+{% block extra_head %}
+<link rel="stylesheet" href="{{ static_url('/static/css/admin.css') }}">
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
+{% endblock %}
+{% block content %}
+<div class="page-narrow">
+    <h1>Your reports</h1>
+    <p class="report-intro">Every report you file is acknowledged here, together with the outcome once a moderator decides. Reports are private to you.</p>
+
+    <table class="admin-table">
+        <caption class="sr-only">Reports you filed and their outcome</caption>
+        <thead>
+            <tr>
+                <th scope="col">Target</th>
+                <th scope="col">Reason</th>
+                <th scope="col">Status</th>
+                <th scope="col">Filed</th>
+                <th scope="col">Resolved</th>
+            </tr>
+        </thead>
+        <tbody>
+            {% for report in reports %}
+            <tr>
+                <td><a href="{{ report['target_url'] }}">{{ report['target_type'] }}</a></td>
+                <td>{{ report['reason_label'] }}</td>
+                <td><span class="status-badge status-{{ report['status'] }}">{{ report['status'] }}</span></td>
+                <td>{{ dt_ago(report['created_at']) }}</td>
+                <td>{% if report['resolved_at'] %}{{ dt_ago(report['resolved_at']) }}{% else %}-{% endif %}</td>
+            </tr>
+            {% else %}
+            <tr><td colspan="5" class="empty-state">You have not filed any reports.</td></tr>
+            {% endfor %}
+        </tbody>
+    </table>
+
+    {% include "_pagination.html" %}
+</div>
+{% endblock %}
diff --git a/devplacepy/templates/signup.html b/devplacepy/templates/signup.html
index 373e40b7..ae749437 100644
--- a/devplacepy/templates/signup.html
+++ b/devplacepy/templates/signup.html
@@ -60,6 +60,19 @@
                 </div>
             </div>
 
+            <div class="auth-field">
+                <label for="birth_date">Date of birth</label>
+                <input type="date" id="birth_date" name="birth_date" value="{{ birth_date or '' }}" required aria-required="true" aria-describedby="birth-date-hint">
+                <small class="hint-text" id="birth-date-hint">You must be at least {{ moderation_minimum_age() }}. Only the age band is stored - the date itself is discarded.</small>
+            </div>
+
+            <div class="auth-field auth-field-check">
+                <label for="accept_terms">
+                    <input type="checkbox" id="accept_terms" name="accept_terms" value="1" required aria-required="true"{% if accept_terms %} checked{% endif %}>
+                    I accept the <a href="/docs/terms.html" target="_blank" rel="noopener">Terms of Service</a> and the <a href="/docs/community-guidelines.html" target="_blank" rel="noopener">Community Guidelines</a>, and I have read the <a href="/docs/privacy.html" target="_blank" rel="noopener">Privacy Policy</a>.
+                </label>
+            </div>
+
             <button type="submit" class="auth-submit"><span class="icon">&#x2728;</span> Create account</button>
         </form>
 
diff --git a/devplacepy/templates/workspace.html b/devplacepy/templates/workspace.html
index efb4b926..d3e40620 100644
--- a/devplacepy/templates/workspace.html
+++ b/devplacepy/templates/workspace.html
@@ -1,8 +1,8 @@
 {% extends "base.html" %}
 
 {% block extra_head %}
-<link rel="stylesheet" href="{{ static_url('css/containers.css') }}">
-<link rel="stylesheet" href="{{ static_url('css/workspace.css') }}">
+<link rel="stylesheet" href="{{ static_url('/static/css/containers.css') }}">
+<link rel="stylesheet" href="{{ static_url('/static/css/workspace.css') }}">
 {% endblock %}
 
 {% block content %}
@@ -124,5 +124,5 @@
 {% endblock %}
 
 {% block extra_js %}
-<script type="module" src="{{ static_url('js/WorkspaceManager.js') }}"></script>
+<script type="module" src="{{ static_url('/static/js/WorkspaceManager.js') }}"></script>
 {% endblock %}
diff --git a/devplacepy/templates/workspace_index.html b/devplacepy/templates/workspace_index.html
new file mode 100644
index 00000000..173725f1
--- /dev/null
+++ b/devplacepy/templates/workspace_index.html
@@ -0,0 +1,44 @@
+{% extends "base.html" %}
+{% block extra_head %}
+<link rel="stylesheet" href="{{ static_url('/static/css/admin.css') }}">
+<link rel="stylesheet" href="{{ static_url('/static/css/moderation.css') }}">
+{% endblock %}
+{% block content %}
+<div class="page-narrow">
+    <h1>Published workspaces</h1>
+    <p class="report-intro">Every workspace a DevPlace member has published to the public ingress, with its owner, its project and the direct link that opens it. {{ total }} published.</p>
+
+    <table class="admin-table">
+        <caption class="sr-only">Workspaces published to the public ingress</caption>
+        <thead>
+            <tr>
+                <th scope="col">Workspace</th>
+                <th scope="col">Owner</th>
+                <th scope="col">Project</th>
+                <th scope="col">Label</th>
+                <th scope="col">Link</th>
+                <th scope="col">Report</th>
+            </tr>
+        </thead>
+        <tbody>
+            {% for workspace in workspaces %}
+            <tr>
+                <td>
+                    {{ workspace.name }}
+                    {% if workspace.description %}<span class="workspace-desc">{{ workspace.description[:160] }}</span>{% endif %}
+                </td>
+                <td>{% if workspace.owner %}<a href="/profile/{{ workspace.owner }}">{{ workspace.owner }}</a>{% else %}-{% endif %}</td>
+                <td>{% if workspace.project_url %}<a href="{{ workspace.project_url }}">Project</a>{% else %}-{% endif %}</td>
+                <td><span class="status-badge status-{{ 'dismissed' if workspace.maturity == 'general' else 'open' }}">{{ workspace.maturity }}</span></td>
+                <td><a href="{{ workspace.url }}" rel="noopener">{{ workspace.url }}</a></td>
+                <td>{% set _type = "workspace" %}{% set _uid = workspace.uid %}{% set _owner = workspace.owner_uid %}{% set _owner_name = "" %}{% set _class = "admin-btn admin-btn-sm" %}{% include "_report_button.html" %}</td>
+            </tr>
+            {% else %}
+            <tr><td colspan="6" class="empty-state">No workspaces are published yet.</td></tr>
+            {% endfor %}
+        </tbody>
+    </table>
+
+    {% include "_pagination.html" %}
+</div>
+{% endblock %}
diff --git a/devplacepy/templating.py b/devplacepy/templating.py
index b91ff3e7..0c9544d1 100644
--- a/devplacepy/templating.py
+++ b/devplacepy/templating.py
@@ -15,6 +15,7 @@ from devplacepy.utils import time_ago as _time_ago
 from devplacepy.utils import get_badge, is_admin, is_primary_admin, pretty_json
 from devplacepy.attachments import format_file_size, file_icon_emoji
 from devplacepy.content import is_owner as _owns
+from devplacepy.content import maturity_hidden as _maturity_hidden
 from devplacepy.customization import custom_css_tag, custom_js_tag, page_type_for
 from devplacepy.services import presence
 
@@ -52,10 +53,18 @@ templates.env.globals["static_version"] = STATIC_VERSION
 templates.env.globals["is_admin"] = is_admin
 templates.env.globals["is_primary_admin"] = is_primary_admin
 templates.env.globals["owns"] = _owns
+templates.env.globals["maturity_hidden"] = _maturity_hidden
 templates.env.globals["is_self"] = is_self
 templates.env.globals["guest_disabled"] = guest_disabled
 templates.env.globals["is_online"] = presence.is_online
 
+
+def activity_recording_on(user) -> bool:
+    return bool(user) and presence.recording_allowed(user.get("uid", ""))
+
+
+templates.env.globals["activity_recording_on"] = activity_recording_on
+
 from devplacepy.docs_devrant import devrant_endpoints
 
 templates.env.globals["devrant_endpoints"] = devrant_endpoints
@@ -173,6 +182,42 @@ templates.env.globals["TOPICS"] = TOPICS
 templates.env.globals["REACTION_EMOJI"] = REACTION_EMOJI
 templates.env.globals["reaction_emojis"] = reaction_emojis
 
+from devplacepy.database.moderation import minimum_age, report_reason_options
+from devplacepy.services.moderation.sla import sla_hours
+
+templates.env.globals["REPORT_REASONS"] = report_reason_options()
+
+
+def contact_details() -> dict[str, str]:
+    return {
+        "email": get_setting("contact_email", ""),
+        "phone": get_setting("contact_phone", ""),
+        "address": get_setting("contact_address", ""),
+    }
+
+
+def policy_version(kind: str) -> str:
+    return get_setting(f"{kind}_version", "1") or "1"
+
+
+def moderation_sla_hours() -> int:
+    return sla_hours()
+
+
+def moderation_minimum_age() -> int:
+    return minimum_age()
+
+
+def ai_provider_name() -> str:
+    return get_setting("ai_third_party_provider", "") or "our AI model provider"
+
+
+templates.env.globals["contact_details"] = contact_details
+templates.env.globals["policy_version"] = policy_version
+templates.env.globals["moderation_sla_hours"] = moderation_sla_hours
+templates.env.globals["moderation_minimum_age"] = moderation_minimum_age
+templates.env.globals["ai_provider_name"] = ai_provider_name
+
 
 def jinja_max_upload_size_mb() -> int:
     return get_int_setting("max_upload_size_mb", 10)
diff --git a/devplacepy/utils/CLAUDE.md b/devplacepy/utils/CLAUDE.md
index c16a6e7f..c4db2977 100644
--- a/devplacepy/utils/CLAUDE.md
+++ b/devplacepy/utils/CLAUDE.md
@@ -22,6 +22,8 @@ The top-nav bell and Messages link carry `data-counter="notifications"` / `data-
 | `badge` | Earn any badge | `utils.py` `notify_badge` | First grant only (`award_badge` returns `True`) |
 | `issue` | Issue filed/replied/status | `issues.py`, `services/gitea`, `services/jobs/issue_create_service.py` | Reporter or admins |
 
+The `moderation` type carries both faces of the safety layer: the acknowledgement (with the published response window) sent to a reporter the moment they file, and the **statement of reasons** sent to a user whose content or account was actioned. Both are ordinary `create_notification` calls through the single funnel, so a user can turn the channel off per preference like any other type - what they cannot turn off is the decision itself.
+
 `level`/`badge` notifications have `related_uid == user_uid` (self), so the notifications template renders them with the recipient's own avatar; the template is type-agnostic (driven by `message`/`actor`), so no per-type handling is needed.
 
 ### Auto-mark-read on content view
diff --git a/devplacepy/utils/accounts.py b/devplacepy/utils/accounts.py
index e9c53c2f..267d263d 100644
--- a/devplacepy/utils/accounts.py
+++ b/devplacepy/utils/accounts.py
@@ -8,11 +8,22 @@ from devplacepy.utils.badges import award_badge
 from devplacepy.utils.passwords import hash_password, hash_password_async
 
 
-def _create_account(username: str, email: str, password_hash: str) -> tuple[str, str, bool]:
+def _create_account(
+    username: str,
+    email: str,
+    password_hash: str,
+    *,
+    age_band: str = "",
+    accepted_terms: bool = False,
+) -> tuple[str, str, bool]:
+    from devplacepy.database import get_setting, set_consent
+
     users = get_table("users")
     uid = generate_uid()
     is_first = users.count() == 0
     role = "Admin" if is_first else "Member"
+    now = datetime.now(timezone.utc).isoformat()
+    terms_version = (get_setting("terms_version", "1") or "1") if accepted_terms else ""
     users.insert(
         {
             "uid": uid,
@@ -37,20 +48,58 @@ def _create_account(username: str, email: str, password_hash: str) -> tuple[str,
             "ai_modifier_sync": 1,
             "interactions_enabled": -1,
             "avatar_seed": None,
-            "created_at": datetime.now(timezone.utc).isoformat(),
+            "terms_version": terms_version,
+            "terms_accepted_at": now if accepted_terms else "",
+            "age_band": age_band,
+            "age_declared_at": now if age_band else "",
+            "mature_opt_in": 0,
+            "suspended_until": "",
+            "suspension_reason": "",
+            "deletion_requested_at": "",
+            "created_at": now,
         }
     )
+    if accepted_terms:
+        set_consent("user", uid, "terms", True, version=terms_version)
+        set_consent(
+            "user", uid, "privacy", True, version=get_setting("privacy_version", "1") or "1"
+        )
+        set_consent("user", uid, "activity_recording", True)
     award_badge(uid, "Member")
     if is_first:
         invalidate_admins_cache()
     return uid, role, is_first
 
 
-def register_account(username: str, email: str, password: str) -> tuple[str, str, bool]:
-    return _create_account(username, email, hash_password(password))
+def register_account(
+    username: str,
+    email: str,
+    password: str,
+    *,
+    age_band: str = "",
+    accepted_terms: bool = False,
+) -> tuple[str, str, bool]:
+    return _create_account(
+        username,
+        email,
+        hash_password(password),
+        age_band=age_band,
+        accepted_terms=accepted_terms,
+    )
 
 
 async def register_account_async(
-    username: str, email: str, password: str
+    username: str,
+    email: str,
+    password: str,
+    *,
+    age_band: str = "",
+    accepted_terms: bool = False,
 ) -> tuple[str, str, bool]:
-    return _create_account(username, email, await hash_password_async(password))
+    return _create_account(
+        username,
+        email,
+        await hash_password_async(password),
+        age_band=age_band,
+        accepted_terms=accepted_terms,
+    )
diff --git a/devplacepy/utils/guards.py b/devplacepy/utils/guards.py
index 8b90accf..9e2ee1ed 100644
--- a/devplacepy/utils/guards.py
+++ b/devplacepy/utils/guards.py
@@ -54,6 +54,44 @@ def client_ip(request, default: Optional[str] = "unknown") -> Optional[str]:
     return default
 
 
+SUSPENSION_GATED_METHODS = ("POST", "PUT", "DELETE", "PATCH")
+
+SUSPENSION_EXEMPT_PREFIXES = ("/auth", "/reports", "/block", "/mute")
+
+
+def _suspension_exempt(path: str) -> bool:
+    if path.startswith(SUSPENSION_EXEMPT_PREFIXES):
+        return True
+    return path.startswith("/profile/") and (
+        path.endswith("/delete") or path.endswith("/consent")
+    )
+
+
+def refuse_suspended(request: Request, user: dict) -> None:
+    from devplacepy.database import suspension_active
+
+    if request.method not in SUSPENSION_GATED_METHODS:
+        return
+    if _suspension_exempt(request.url.path):
+        return
+    if not suspension_active(user):
+        return
+    from devplacepy.services.audit import record as audit
+
+    reason = (user.get("suspension_reason") or "").strip()
+    message = "Your account is suspended and cannot create or change content."
+    if reason:
+        message = f"{message} Reason: {reason}."
+    audit.record(
+        request,
+        "security.authz.denied",
+        user=user,
+        result="denied",
+        summary=f"suspended user denied {request.method} {request.url.path}",
+    )
+    raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=message)
+
+
 def require_user(request: Request):
     user = get_current_user(request)
     if not user:
@@ -74,6 +112,7 @@ def require_user(request: Request):
         raise HTTPException(
             status_code=status.HTTP_303_SEE_OTHER, headers={"Location": "/auth/login"}
         )
+    refuse_suspended(request, user)
     return user
 
 
@@ -130,4 +169,5 @@ def require_user_api(request: Request):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED, detail="Authentication required"
         )
+    refuse_suspended(request, user)
     return user
diff --git a/events.md b/events.md
index ed07e081..46a48014 100644
--- a/events.md
+++ b/events.md
@@ -2,7 +2,7 @@
 
 retoor <retoor@molodetz.nl>
 
-Every state-changing action in DevPlace records one append-only row through `devplacepy/services/audit/record.py` (`record` for a request-scoped actor, `record_system` for a background one). This file is the authoritative catalogue of the 288 event keys currently emitted, grouped by the category `services/audit/categories.py` `category_for` resolves them to.
+Every state-changing action in DevPlace records one append-only row through `devplacepy/services/audit/record.py` (`record` for a request-scoped actor, `record_system` for a background one). This file is the authoritative catalogue of the 331 event keys currently emitted, grouped by the category `services/audit/categories.py` `category_for` resolves them to.
 
 ## Rules
 
@@ -18,14 +18,14 @@ Every state-changing action in DevPlace records one append-only row through `dev
 
 | Category | Keys |
 |---|---|
-| `account` | 10 |
+| `account` | 16 |
 | `admin` | 21 |
-| `ai` | 10 |
+| `ai` | 11 |
 | `attachment` | 5 |
-| `auth` | 9 |
+| `auth` | 8 |
 | `backup` | 2 |
-| `cli` | 42 |
-| `container` | 12 |
+| `cli` | 43 |
+| `container` | 36 |
 | `content` | 37 |
 | `database` | 4 |
 | `devii` | 18 |
@@ -34,6 +34,7 @@ Every state-changing action in DevPlace records one append-only row through `dev
 | `game` | 6 |
 | `ingress` | 1 |
 | `message` | 2 |
+| `moderation` | 12 |
 | `news` | 9 |
 | `notification` | 4 |
 | `project` | 11 |
@@ -47,7 +48,7 @@ Every state-changing action in DevPlace records one append-only row through `dev
 | `telegram` | 5 |
 | `tools` | 12 |
 
-**Total: 288 keys.**
+**Total: 331 keys.**
 
 ## Account and profile (`account`)
 
@@ -63,6 +64,12 @@ Every state-changing action in DevPlace records one append-only row through `dev
 | `profile.notification.reset` | `routers/profile/notifications.py` |
 | `profile.notification.toggle` | `routers/profile/notifications.py` |
 | `profile.update` | `routers/devrant/auth.py`, `routers/profile/index.py` |
+| `account.delete.purge` | `services/moderation/deletion.py` |
+| `account.delete.request` | `routers/devrant/auth.py`, `routers/profile/delete.py` |
+| `consent.grant` | `routers/profile/consent.py` |
+| `profile.mature_content` | `routers/profile/consent.py` |
+| `consent.withdraw` | `routers/profile/consent.py` |
+| `terms.accept` | `routers/auth/terms.py` |
 
 ## Administration (`admin`)
 
@@ -94,6 +101,7 @@ Every state-changing action in DevPlace records one append-only row through `dev
 
 | Event key | Recorded in |
 |---|---|
+| `ai.consent.denied` | `services/openai_gateway/service.py` |
 | `ai.clippy.chat` | `routers/devii.py` |
 | `ai.gateway.call` | `services/openai_gateway/gateway.py`, `services/openai_gateway/usage.py` |
 | `ai.quota.exceeded` | `routers/devii.py`, `services/openai_gateway/service.py` |
@@ -119,7 +127,6 @@ Every state-changing action in DevPlace records one append-only row through `dev
 
 | Event key | Recorded in |
 |---|---|
-| `auth.account.disable` | `routers/devrant/auth.py` |
 | `auth.login.failure` | `routers/auth/login.py`, `routers/devrant/auth.py` |
 | `auth.login.success` | `routers/auth/login.py`, `routers/devrant/auth.py` |
 | `auth.logout` | `routers/auth/logout.py` |
@@ -140,6 +147,7 @@ Every state-changing action in DevPlace records one append-only row through `dev
 
 | Event key | Recorded in |
 |---|---|
+| `cli.accounts.prune` | `cli/accounts.py` |
 | `cli.apikey.backfill` | `cli/apikeys.py` |
 | `cli.apikey.reset` | `cli/apikeys.py` |
 | `cli.attachments.prune` | `cli/attachments.py` |
@@ -361,6 +369,23 @@ Every state-changing action in DevPlace records one append-only row through `dev
 | `message.read_on_view` | `routers/messages.py` |
 | `message.send` | `services/messaging/persist.py` |
 
+## Moderation (`moderation`)
+
+| Event key | Recorded in |
+|---|---|
+| `filter.block` | `services/moderation/screening.py` |
+| `filter.maturity` | `services/moderation/screening.py` |
+| `filter.review` | `services/moderation/screening.py` |
+| `moderation.ban` | `routers/admin/moderation.py`, `routers/admin/users.py` |
+| `moderation.lift` | `routers/admin/moderation.py`, `routers/admin/users.py` |
+| `moderation.remove` | `routers/admin/moderation.py` |
+| `moderation.restore` | `routers/admin/moderation.py` |
+| `moderation.suspend` | `routers/admin/moderation.py`, `routers/admin/users.py` |
+| `moderation.warn` | `routers/admin/moderation.py` |
+| `report.create` | `routers/reports.py` |
+| `report.decide` | `routers/admin/moderation.py` |
+| `report.status` | `routers/admin/moderation.py` |
+
 ## News (`news`)
 
 | Event key | Recorded in |
@@ -447,7 +472,7 @@ Both carry `metadata.provider` (`webpush`, `apns`, ...) plus `created`; `metadat
 
 | Event key | Recorded in |
 |---|---|
-| `security.authz.denied` | `routers/admin/backups.py`, `services/devii/actions/dispatcher.py` |
+| `security.authz.denied` | `routers/admin/backups.py`, `routers/profile/delete.py`, `services/devii/actions/dispatcher.py`, `utils/guards.py` |
 | `security.maintenance.block` | `main.py` |
 | `security.rate_limit.block` | `main.py` |
 
diff --git a/locustfile.py b/locustfile.py
index 1cad713d..e29a9046 100644
--- a/locustfile.py
+++ b/locustfile.py
@@ -50,10 +50,20 @@ DOCS_SLUGS = [
     "components",
     "dashboard",
     "claude",
+    "terms",
+    "community-guidelines",
+    "privacy",
+    "content-moderation",
+    "intellectual-property",
+    "contact",
 ]
+ADMIN_DOCS_SLUGS = ["moderation-operations"]
 UPLOAD_FILE = ("load_test.txt", b"locust upload payload", "text/plain")
 UUID_RE = r"[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
 PASSWORD = "testpass123"
+BIRTH_DATE = "01/01/1990"
+ACCEPT_TERMS = "on"
+REPORT_STATUSES = ["open", "acknowledged", "actioned", "dismissed"]
 
 # ── Deliberately NOT load tested (kept out by design) ───────────────
 #   /openai/v1/*, /devii/clippy/ai/chat   - real upstream AI spend / billing.
@@ -76,6 +86,19 @@ PASSWORD = "testpass123"
 #   /admin/trash/.../purge, /admin/media/{uid}/purge of seeded content
 #                                          - hard GC of real content (only the
 #                                            dedicated disposable media is purged).
+#   POST /reports/{target_type}/{target_uid}
+#                                          - floods the real moderation queue
+#                                            with junk reports. Exactly one
+#                                            disposable report is seeded below so
+#                                            the queue read tasks have a live uid.
+#   /admin/moderation/{uid}/decide|status, /admin/users/{uid}/suspend|lift|ban
+#                                          - real enforcement against real
+#                                            accounts. The read surface (queue +
+#                                            report detail) IS covered below.
+#   /profile/{username}/delete             - destroys accounts (GET and POST).
+#   /profile/{username}/consent, /mature-content
+#                                          - flips real consent state.
+#   /auth/accept-terms                     - mutates real acceptance records.
 #   WebSockets (/devii/ws, exec ws)        - HttpUser cannot drive them.
 
 
@@ -103,6 +126,8 @@ def do_signup(client, username, email):
             "email": email,
             "password": PASSWORD,
             "confirm_password": PASSWORD,
+            "birth_date": BIRTH_DATE,
+            "accept_terms": ACCEPT_TERMS,
         },
         catch_response=True,
         name="signup",
@@ -153,6 +178,8 @@ def seed_data(environment, **kwargs):
                 "email": email,
                 "password": PASSWORD,
                 "confirm_password": PASSWORD,
+                "birth_date": BIRTH_DATE,
+                "accept_terms": ACCEPT_TERMS,
             }
         ).encode()
         req = urllib.request.Request(
@@ -354,12 +381,18 @@ def seed_data(environment, **kwargs):
         logger.warning(f"Harvest SEO job uids failed: {e}")
 
     # ── Seed an admin user (direct DB insert) ───────────────────
+    #   terms_version/terms_accepted_at are mandatory: the terms-acceptance
+    #   middleware redirects every mutating request of a user whose version
+    #   is stale to /auth/accept-terms, which would silently gut every
+    #   admin write task. age_band keeps the maturity gates open.
     try:
         from datetime import datetime, timezone
-        from devplacepy.database import get_table, init_db
+        from devplacepy.database import get_setting, get_table, init_db
         from devplacepy.utils import hash_password, generate_uid
 
         init_db()
+        now = datetime.now(timezone.utc).isoformat()
+        terms_version = get_setting("terms_version", "1") or "1"
         username = f"lu_admin_{uuid.uuid4().hex[:6]}"
         email = f"{username}@locust.devplace"
         get_table("users").insert(
@@ -377,7 +410,11 @@ def seed_data(environment, **kwargs):
                 "level": 1,
                 "xp": 0,
                 "stars": 0,
-                "created_at": datetime.now(timezone.utc).isoformat(),
+                "terms_version": terms_version,
+                "terms_accepted_at": now,
+                "age_band": "adult",
+                "suspended_until": "",
+                "created_at": now,
             }
         )
         ADMIN_USER["username"] = username
@@ -401,7 +438,11 @@ def seed_data(environment, **kwargs):
                 "level": 1,
                 "xp": 0,
                 "stars": 0,
-                "created_at": datetime.now(timezone.utc).isoformat(),
+                "terms_version": terms_version,
+                "terms_accepted_at": now,
+                "age_band": "adult",
+                "suspended_until": "",
+                "created_at": now,
             }
         )
         ADMIN_TARGETS["disposable_uid"] = disposable_uid
@@ -409,6 +450,29 @@ def seed_data(environment, **kwargs):
     except Exception as e:
         logger.warning(f"Seed admin user failed: {e}")
 
+    # ── Seed one disposable moderation report ───────────────────
+    #   Filing reports under load is excluded (it would flood the real
+    #   queue), so exactly one row is raised here, by the disposable user
+    #   against a seed post, to keep the admin queue/detail read tasks on
+    #   a live uid instead of an empty pool.
+    try:
+        from devplacepy.services.moderation import queue as report_queue
+
+        reporter_uid = ADMIN_TARGETS.get("disposable_uid")
+        if reporter_uid and POST_UIDS:
+            report = report_queue.raise_report(
+                target_type="post",
+                target_uid=POST_UIDS[0],
+                reporter_uid=reporter_uid,
+                reason="spam",
+                detail="Disposable report for the moderation queue read tasks.",
+            )
+            if report:
+                ADMIN_TARGETS["report_uid"] = report["uid"]
+                logger.info(f"Seeded moderation report {report['uid']}")
+    except Exception as e:
+        logger.warning(f"Seed moderation report failed: {e}")
+
     # ── Harvest UIDs from HTML responses ──────────────────────
     #   projects sidebar:  /projects?user_uid={uuid}
     #   project cards:     /votes/project/{uuid}
@@ -676,6 +740,21 @@ class DevPlaceUser(HttpUser):
     def view_saved(self):
         self.client.get("/bookmarks/saved", name="bookmarks/saved")
 
+    @task(1)
+    def view_report_reasons(self):
+        self.client.get("/reports/reasons", name="reports/reasons")
+
+    @task(1)
+    def view_my_reports(self):
+        params = {}
+        if random.random() < 0.5:
+            params["status"] = random.choice(REPORT_STATUSES)
+        self.client.get("/reports/mine", params=params, name="reports/mine")
+
+    @task(2)
+    def view_workspace_index(self):
+        self.client.get("/workspaces/index", name="workspaces/index")
+
     # ── auth flows ──────────────────────────────────────────────
 
     @task(1)
@@ -1568,6 +1647,33 @@ class AdminUser(HttpUser):
                 f"/admin/audit-log/{m.group(1)}", name="admin/audit-log/[uid]"
             )
 
+    @task(3)
+    def view_moderation_queue(self):
+        resp = self.client.get(
+            "/admin/moderation",
+            params={"status": random.choice(REPORT_STATUSES)},
+            name="admin/moderation",
+        )
+        m = re.search(rf"/admin/moderation/({UUID_RE})", resp.text)
+        uid = m.group(1) if m else ADMIN_TARGETS.get("report_uid")
+        if not uid:
+            return
+        with self.client.get(
+            f"/admin/moderation/{uid}",
+            catch_response=True,
+            name="admin/moderation/[uid]",
+        ) as report:
+            if report.status_code == 200:
+                report.success()
+            else:
+                report.failure(f"report detail: status={report.status_code}")
+
+    @task(1)
+    def view_admin_docs(self):
+        self.client.get(
+            f"/docs/{random.choice(ADMIN_DOCS_SLUGS)}.html", name="docs/[slug]"
+        )
+
     @task(1)
     def view_admin_media(self):
         self.client.get("/admin/media", name="admin/media")
@@ -1711,6 +1817,8 @@ class AnonymousUser(HttpUser):
                 "/gists",
                 "/projects",
                 "/leaderboard",
+                "/reports/reasons",
+                "/workspaces/index",
             ]
         )
         self.client.get(path, name="public/[page]")
diff --git a/nginx/nginx.conf.template b/nginx/nginx.conf.template
index 3d8784f4..464b92bc 100644
--- a/nginx/nginx.conf.template
+++ b/nginx/nginx.conf.template
@@ -18,6 +18,7 @@ proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=app_cache:10m max_size=${
 
 server {
     listen 80;
+    listen [::]:80;
     server_name _;
 
     client_max_body_size ${NGINX_MAX_BODY_SIZE};
diff --git a/tests/CLAUDE.md b/tests/CLAUDE.md
index a451b43a..d850e611 100644
--- a/tests/CLAUDE.md
+++ b/tests/CLAUDE.md
@@ -132,6 +132,10 @@ Two whole-suite flakes came from tests that pinned an exact number the productio
 
 The rule generalizes: if the production function reads a random-ish input or a table-wide aggregate, assert against **that same function's output for the observed state**, never against the bare constant.
 
+## Signup now has two more required fields
+
+`SignupForm` requires `birth_date` and `accept_terms`. Every test that registers a user must send both - `{"birth_date": "1990-01-01", "accept_terms": "1"}` for an HTTP payload, `page.fill("#birth_date", ...)` plus `page.check("#accept_terms")` for a browser flow. A test that creates a user by inserting straight into `users` must also set `"terms_version": "1"`, or the terms gate will 403 every mutating request that account makes (it is indistinguishable from a real account that has never accepted). `tests/conftest.py` already does all three for the seeded fixtures.
+
 ## Common pitfalls
 
 | Pitfall | Fix |
diff --git a/tests/api/admin/aiquota/resetguests.py b/tests/api/admin/aiquota/resetguests.py
index 4cbff483..77c009cf 100644
--- a/tests/api/admin/aiquota/resetguests.py
+++ b/tests/api/admin/aiquota/resetguests.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/analytics.py b/tests/api/admin/analytics.py
index 9e106981..6e92e7bf 100644
--- a/tests/api/admin/analytics.py
+++ b/tests/api/admin/analytics.py
@@ -29,6 +29,8 @@ def _member_key():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/auditlog.py b/tests/api/admin/auditlog.py
index 785253fd..91697db2 100644
--- a/tests/api/admin/auditlog.py
+++ b/tests/api/admin/auditlog.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/backups/download.py b/tests/api/admin/backups/download.py
index 53b4e42f..d67fcf44 100644
--- a/tests/api/admin/backups/download.py
+++ b/tests/api/admin/backups/download.py
@@ -27,6 +27,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/backups/schedules.py b/tests/api/admin/backups/schedules.py
index 6d1f3879..ba8ae5b1 100644
--- a/tests/api/admin/backups/schedules.py
+++ b/tests/api/admin/backups/schedules.py
@@ -35,6 +35,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/containers/manage.py b/tests/api/admin/containers/manage.py
index c3b1027e..24c4646d 100644
--- a/tests/api/admin/containers/manage.py
+++ b/tests/api/admin/containers/manage.py
@@ -25,6 +25,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/containers/projects/search.py b/tests/api/admin/containers/projects/search.py
index 053deff3..b7da4a59 100644
--- a/tests/api/admin/containers/projects/search.py
+++ b/tests/api/admin/containers/projects/search.py
@@ -19,6 +19,8 @@ def _signup_search():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/deviitasks.py b/tests/api/admin/deviitasks.py
index 8d11c389..8858a9ae 100644
--- a/tests/api/admin/deviitasks.py
+++ b/tests/api/admin/deviitasks.py
@@ -25,6 +25,8 @@ def _member_dt():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/gateway/index.py b/tests/api/admin/gateway/index.py
index 69e88359..4bae7cd4 100644
--- a/tests/api/admin/gateway/index.py
+++ b/tests/api/admin/gateway/index.py
@@ -38,6 +38,8 @@ def member_key():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/media/index.py b/tests/api/admin/media/index.py
index a0490cee..0dee7400 100644
--- a/tests/api/admin/media/index.py
+++ b/tests/api/admin/media/index.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/media/purge.py b/tests/api/admin/media/purge.py
index 07830a88..5215931f 100644
--- a/tests/api/admin/media/purge.py
+++ b/tests/api/admin/media/purge.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/moderation.py b/tests/api/admin/moderation.py
new file mode 100644
index 00000000..371926f8
--- /dev/null
+++ b/tests/api/admin/moderation.py
@@ -0,0 +1,241 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import pytest
+import requests
+
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+from devplacepy.schemas import AdminUserOut
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="mod"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _member(prefix="mod"):
+    name = _unique(prefix)
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _admin_session(app_server):
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=True,
+    )
+    return session
+
+
+def _post(session, content="A post that will be reported by another member."):
+    response = session.post(
+        f"{BASE_URL}/posts/create",
+        data={"title": "Queue subject", "content": content},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    return response.json()["data"]["uid"]
+
+
+def _report(target_uid, reason="harassment"):
+    reporter, name = _member("rep")
+    response = reporter.post(
+        f"{BASE_URL}/reports/post/{target_uid}",
+        data={"reason": reason, "detail": "Queue test"},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    refresh_snapshot()
+    row = get_table("content_reports").find_one(
+        target_uid=target_uid, deleted_at=None, order_by=["-created_at"]
+    )
+    return row["uid"], reporter, name
+
+
+@pytest.fixture(scope="module")
+def admin(app_server, seeded_db):
+    set_setting("moderation_sla_hours", "24")
+    return _admin_session(app_server)
+
+
+def test_queue_is_admin_only(admin, app_server):
+    member, _ = _member()
+    assert member.get(f"{BASE_URL}/admin/moderation", headers=JSON).status_code == 403
+    assert requests.get(f"{BASE_URL}/admin/moderation", headers=JSON).status_code == 401
+    assert admin.get(f"{BASE_URL}/admin/moderation", headers=JSON).status_code == 200
+
+
+def test_queue_reports_the_sla_snapshot(admin):
+    payload = admin.get(f"{BASE_URL}/admin/moderation", headers=JSON).json()
+    assert payload["sla"]["sla_hours"] == 24
+    assert "oldest_open_hours" in payload["sla"]
+    assert set(payload["counts"]) == {"open", "acknowledged", "actioned", "dismissed"}
+
+
+def test_queue_is_ordered_oldest_open_first(admin):
+    author, _ = _member("auth")
+    first = _report(_post(author))[0]
+    second = _report(_post(author))[0]
+    payload = admin.get(f"{BASE_URL}/admin/moderation?status=open", headers=JSON).json()
+    order = [entry["uid"] for entry in payload["reports"]]
+    assert order.index(first) < order.index(second)
+
+
+def test_the_report_detail_projects_the_subject_through_the_admin_user_model(admin):
+    author, author_name = _member("subj")
+    report_uid = _report(_post(author))[0]
+    payload = admin.get(
+        f"{BASE_URL}/admin/moderation/{report_uid}", headers=JSON
+    ).json()
+    subject = payload["subject"]
+    assert subject["username"] == author_name
+    assert "password_hash" not in subject
+    assert "api_key" not in subject
+    assert set(subject) <= set(AdminUserOut.model_fields)
+
+
+def test_acknowledging_keeps_the_report_open_for_a_decision(admin):
+    author, _ = _member("auth")
+    report_uid = _report(_post(author))[0]
+    response = admin.post(
+        f"{BASE_URL}/admin/moderation/{report_uid}/status",
+        data={"status": "acknowledged"},
+        headers=JSON,
+    )
+    assert response.status_code == 200
+    refresh_snapshot()
+    assert (
+        get_table("content_reports").find_one(uid=report_uid)["status"]
+        == "acknowledged"
+    )
+
+
+def test_a_decision_records_an_action_row_and_resolves_the_report(admin):
+    author, _ = _member("auth")
+    post_uid = _post(author)
+    report_uid, _, _ = _report(post_uid)
+    response = admin.post(
+        f"{BASE_URL}/admin/moderation/{report_uid}/decide",
+        data={"action": "remove_content", "reason": "Breaks the guidelines"},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    refresh_snapshot()
+    report = get_table("content_reports").find_one(uid=report_uid)
+    assert report["status"] == "actioned"
+    assert report["resolved_at"]
+    action = get_table("moderation_actions").find_one(report_uid=report_uid)
+    assert action["action"] == "remove_content"
+    assert action["reason"] == "Breaks the guidelines"
+    assert get_table("posts").find_one(uid=post_uid)["deleted_at"]
+
+
+def test_deciding_a_resolved_report_twice_is_refused(admin):
+    author, _ = _member("auth")
+    report_uid = _report(_post(author))[0]
+    first = admin.post(
+        f"{BASE_URL}/admin/moderation/{report_uid}/decide",
+        data={"action": "dismiss"},
+        headers=JSON,
+    )
+    assert first.status_code == 200
+    second = admin.post(
+        f"{BASE_URL}/admin/moderation/{report_uid}/decide",
+        data={"action": "dismiss"},
+        headers=JSON,
+    )
+    assert second.status_code == 409
+
+
+def test_escalating_raises_severity_and_keeps_the_report_open(admin):
+    author, _ = _member("auth")
+    report_uid = _report(_post(author), reason="spam")[0]
+    response = admin.post(
+        f"{BASE_URL}/admin/moderation/{report_uid}/decide",
+        data={"action": "escalate"},
+        headers=JSON,
+    )
+    assert response.status_code == 200
+    refresh_snapshot()
+    report = get_table("content_reports").find_one(uid=report_uid)
+    assert report["severity"] == "critical"
+    assert report["status"] == "acknowledged"
+
+
+def test_suspension_blocks_writing_but_not_reading_or_deleting(admin):
+    author, author_name = _member("susp")
+    refresh_snapshot()
+    subject = get_table("users").find_one(username=author_name)
+    response = admin.post(
+        f"{BASE_URL}/admin/users/{subject['uid']}/suspend",
+        data={"reason": "Testing enforcement", "duration_hours": "24"},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    try:
+        blocked = author.post(
+            f"{BASE_URL}/posts/create",
+            data={"title": "nope", "content": "This must not be published at all."},
+            headers=JSON,
+        )
+        assert blocked.status_code == 403
+        assert author.get(f"{BASE_URL}/feed", headers=JSON).status_code == 200
+        assert (
+            author.get(f"{BASE_URL}/profile/{author_name}/delete", headers=JSON).status_code
+            == 200
+        )
+    finally:
+        admin.post(f"{BASE_URL}/admin/users/{subject['uid']}/lift", headers=JSON)
+    allowed = author.post(
+        f"{BASE_URL}/posts/create",
+        data={"title": "back", "content": "Writing works again after the lift."},
+        headers=JSON,
+    )
+    assert allowed.status_code == 200
+
+
+def test_ban_revokes_every_session(admin):
+    victim, victim_name = _member("ban")
+    refresh_snapshot()
+    subject = get_table("users").find_one(username=victim_name)
+    response = admin.post(
+        f"{BASE_URL}/admin/users/{subject['uid']}/ban",
+        data={"reason": "Testing the ban path"},
+        headers=JSON,
+    )
+    assert response.status_code == 200
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=subject["uid"])["is_active"] in (0, False)
+    assert victim.get(f"{BASE_URL}/reports/mine", headers=JSON).status_code == 401
+
+
+def test_an_admin_cannot_enforce_against_themselves(admin, seeded_db):
+    refresh_snapshot()
+    alice = get_table("users").find_one(username="alice_test")
+    response = admin.post(
+        f"{BASE_URL}/admin/users/{alice['uid']}/suspend",
+        data={"reason": "self", "duration_hours": "1"},
+        headers=JSON,
+    )
+    assert response.status_code == 200
+    refresh_snapshot()
+    assert not (get_table("users").find_one(uid=alice["uid"])["suspended_until"] or "")
diff --git a/tests/api/admin/news/publish.py b/tests/api/admin/news/publish.py
index 9eceb6a6..7c7f371b 100644
--- a/tests/api/admin/news/publish.py
+++ b/tests/api/admin/news/publish.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/services/config.py b/tests/api/admin/services/config.py
index 7e3eb6bc..7e18ab9f 100644
--- a/tests/api/admin/services/config.py
+++ b/tests/api/admin/services/config.py
@@ -41,6 +41,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/services/start.py b/tests/api/admin/services/start.py
index eb8273b3..502eb53d 100644
--- a/tests/api/admin/services/start.py
+++ b/tests/api/admin/services/start.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/settings.py b/tests/api/admin/settings.py
index 252967e0..a5fe3852 100644
--- a/tests/api/admin/settings.py
+++ b/tests/api/admin/settings.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/trash/index.py b/tests/api/admin/trash/index.py
index abd8fb4c..4b4ef46c 100644
--- a/tests/api/admin/trash/index.py
+++ b/tests/api/admin/trash/index.py
@@ -23,6 +23,8 @@ def _member_trash():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/trash/purge.py b/tests/api/admin/trash/purge.py
index f3642f8a..5aae662a 100644
--- a/tests/api/admin/trash/purge.py
+++ b/tests/api/admin/trash/purge.py
@@ -23,6 +23,8 @@ def _member_trash():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/trash/restore.py b/tests/api/admin/trash/restore.py
index b0a3c105..eda55ad5 100644
--- a/tests/api/admin/trash/restore.py
+++ b/tests/api/admin/trash/restore.py
@@ -23,6 +23,8 @@ def _member_trash():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/users/index.py b/tests/api/admin/users/index.py
index f1e55644..49bb37ea 100644
--- a/tests/api/admin/users/index.py
+++ b/tests/api/admin/users/index.py
@@ -17,6 +17,8 @@ def _session_content_negotiation(password="secret123"):
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/users/password.py b/tests/api/admin/users/password.py
index 7ecc40f9..58ea9bf4 100644
--- a/tests/api/admin/users/password.py
+++ b/tests/api/admin/users/password.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/users/role.py b/tests/api/admin/users/role.py
index 5bbcf5cb..dbd06e47 100644
--- a/tests/api/admin/users/role.py
+++ b/tests/api/admin/users/role.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/users/seniority.py b/tests/api/admin/users/seniority.py
index 3cc2ea87..ffecb580 100644
--- a/tests/api/admin/users/seniority.py
+++ b/tests/api/admin/users/seniority.py
@@ -44,6 +44,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/admin/users/toggle.py b/tests/api/admin/users/toggle.py
index f6023d0b..2493a019 100644
--- a/tests/api/admin/users/toggle.py
+++ b/tests/api/admin/users/toggle.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/api/auth.py b/tests/api/api/auth.py
index 1df799bc..156c4320 100644
--- a/tests/api/api/auth.py
+++ b/tests/api/api/auth.py
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
             "email": email,
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/api/users/me/notiffeed.py b/tests/api/api/users/me/notiffeed.py
index 90c0b96e..02dad863 100644
--- a/tests/api/api/users/me/notiffeed.py
+++ b/tests/api/api/users/me/notiffeed.py
@@ -24,6 +24,8 @@ def _devrant_user():
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/audit/log.py b/tests/api/audit/log.py
index 41275f01..83d941db 100644
--- a/tests/api/audit/log.py
+++ b/tests/api/audit/log.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/auth/login.py b/tests/api/auth/login.py
index cf91fb57..978e81fa 100644
--- a/tests/api/auth/login.py
+++ b/tests/api/auth/login.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/auth/logout.py b/tests/api/auth/logout.py
index b2aeecf3..1a62b741 100644
--- a/tests/api/auth/logout.py
+++ b/tests/api/auth/logout.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -128,6 +130,8 @@ def test_login_logout_recorded(seeded_db):
             "email": email,
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/auth/matrix.py b/tests/api/auth/matrix.py
index 9027e1cd..bcf56e75 100644
--- a/tests/api/auth/matrix.py
+++ b/tests/api/auth/matrix.py
@@ -27,6 +27,8 @@ def _signup_auth_matrix(role="Member"):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/auth/signup.py b/tests/api/auth/signup.py
index fc179a6b..253fbbab 100644
--- a/tests/api/auth/signup.py
+++ b/tests/api/auth/signup.py
@@ -13,6 +13,8 @@ def _session_validation():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -27,6 +29,8 @@ def test_signup_short_username_rerenders_with_message(app_server):
             "email": "x@y.zz",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=False,
     )
diff --git a/tests/api/auth/terms.py b/tests/api/auth/terms.py
new file mode 100644
index 00000000..ad67f3a5
--- /dev/null
+++ b/tests/api/auth/terms.py
@@ -0,0 +1,154 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import requests
+
+from devplacepy.database import get_setting, get_table, refresh_snapshot, set_setting
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="terms"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _signup(**overrides):
+    name = _unique()
+    payload = {
+        "username": name,
+        "email": f"{name}@t.dev",
+        "password": "secret123",
+        "confirm_password": "secret123",
+        "birth_date": "1990-01-01",
+        "accept_terms": "1",
+    }
+    payload.update(overrides)
+    session = requests.Session()
+    response = session.post(
+        f"{BASE_URL}/auth/signup", data=payload, headers=JSON, allow_redirects=False
+    )
+    return session, payload["username"], response
+
+
+def test_signup_without_accepting_the_terms_is_refused(app_server):
+    _, name, response = _signup(accept_terms="")
+    assert response.status_code == 422
+    assert "accept" in response.text.lower()
+    refresh_snapshot()
+    assert get_table("users").find_one(username=name) is None
+
+
+def test_signup_below_the_minimum_age_is_refused(app_server):
+    from datetime import date
+
+    young = date.today().replace(year=date.today().year - 12).isoformat()
+    _, name, response = _signup(birth_date=young)
+    assert response.status_code == 422
+    assert "years old" in response.text
+    refresh_snapshot()
+    assert get_table("users").find_one(username=name) is None
+
+
+def test_signup_stores_the_band_and_the_acceptance_but_not_the_date(app_server):
+    _, name, response = _signup(birth_date="1990-06-15")
+    assert response.status_code == 200, response.text
+    refresh_snapshot()
+    row = get_table("users").find_one(username=name)
+    assert row["age_band"] == "adult"
+    assert row["terms_version"] == (get_setting("terms_version", "1") or "1")
+    assert row["terms_accepted_at"]
+    assert "1990-06-15" not in str(dict(row))
+    consents = {
+        entry["kind"]
+        for entry in get_table("user_consents").find(
+            owner_kind="user", owner_id=row["uid"], state="granted", deleted_at=None
+        )
+    }
+    assert {"terms", "privacy", "activity_recording"} <= consents
+    assert "ai_third_party" not in consents
+
+
+def test_the_acceptance_page_reports_both_versions(app_server):
+    session, name, response = _signup()
+    assert response.status_code == 200
+    page = session.get(f"{BASE_URL}/auth/accept-terms", headers=JSON)
+    assert page.status_code == 200, page.text
+    body = page.json()
+    in_force = get_setting("terms_version", "1") or "1"
+    assert body["terms_version"] == in_force
+    assert body["accepted_version"] == in_force
+    assert "consents" not in body
+    refresh_snapshot()
+    assert get_table("users").find_one(username=name)["terms_version"] == in_force
+
+
+def test_the_acceptance_page_is_signed_in_only(app_server):
+    assert (
+        requests.get(f"{BASE_URL}/auth/accept-terms", headers=JSON).status_code == 401
+    )
+
+
+def test_the_acceptance_page_shows_the_gap_after_a_bump(app_server):
+    session, _, response = _signup()
+    assert response.status_code == 200
+    original = get_setting("terms_version", "1") or "1"
+    set_setting("terms_version", f"{original}-gap")
+    try:
+        body = {}
+        for _ in range(40):
+            body = session.get(f"{BASE_URL}/auth/accept-terms", headers=JSON).json()
+            if body.get("terms_version") == f"{original}-gap":
+                break
+            time.sleep(0.5)
+        assert body["terms_version"] == f"{original}-gap"
+        assert body["accepted_version"] == original
+    finally:
+        set_setting("terms_version", original)
+
+
+def test_bumping_the_version_gates_writes_but_never_reads(app_server):
+    session, name, response = _signup()
+    assert response.status_code == 200
+    original = get_setting("terms_version", "1") or "1"
+    set_setting("terms_version", f"{original}-bumped")
+    try:
+        blocked = None
+        for _ in range(40):
+            blocked = session.post(
+                f"{BASE_URL}/posts/create",
+                data={
+                    "title": "gated",
+                    "content": "This write must be gated by the terms version.",
+                },
+                headers=JSON,
+            )
+            if blocked.status_code == 403:
+                break
+            time.sleep(0.5)
+        assert blocked.status_code == 403
+        assert session.get(f"{BASE_URL}/feed", headers=JSON).status_code == 200
+        assert session.get(f"{BASE_URL}/docs/terms.html").status_code == 200
+        assert (
+            session.get(f"{BASE_URL}/profile/{name}/delete", headers=JSON).status_code
+            == 200
+        )
+
+        accepted = session.post(f"{BASE_URL}/auth/accept-terms", headers=JSON)
+        assert accepted.status_code == 200
+        refresh_snapshot()
+        assert (
+            get_table("users").find_one(username=name)["terms_version"]
+            == f"{original}-bumped"
+        )
+        allowed = session.post(
+            f"{BASE_URL}/posts/create",
+            data={"title": "ok", "content": "Writing works again after acceptance."},
+            headers=JSON,
+        )
+        assert allowed.status_code == 200
+    finally:
+        set_setting("terms_version", original)
diff --git a/tests/api/auth/token.py b/tests/api/auth/token.py
index dd5fbdcb..52bf882e 100644
--- a/tests/api/auth/token.py
+++ b/tests/api/auth/token.py
@@ -33,6 +33,8 @@ def _signup(password="secret123"):
             "email": email,
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/awards/index.py b/tests/api/awards/index.py
index 5780d19a..e2ff6635 100644
--- a/tests/api/awards/index.py
+++ b/tests/api/awards/index.py
@@ -47,6 +47,7 @@ def _user():
         {
             "uid": uid,
             "username": f"aw_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@t.dev",
             "created_at": datetime.now(timezone.utc).isoformat(),
         }
diff --git a/tests/api/block/index.py b/tests/api/block/index.py
index f3d23f24..3fbcb0b5 100644
--- a/tests/api/block/index.py
+++ b/tests/api/block/index.py
@@ -20,6 +20,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/block/unblock.py b/tests/api/block/unblock.py
index c8c7ec59..09f2dee3 100644
--- a/tests/api/block/unblock.py
+++ b/tests/api/block/unblock.py
@@ -19,6 +19,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/block/visibility.py b/tests/api/block/visibility.py
index ec2477a9..45672963 100644
--- a/tests/api/block/visibility.py
+++ b/tests/api/block/visibility.py
@@ -23,6 +23,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/bookmarks/index.py b/tests/api/bookmarks/index.py
index 3c89f3a8..278241a0 100644
--- a/tests/api/bookmarks/index.py
+++ b/tests/api/bookmarks/index.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -130,6 +132,8 @@ def _session_bookmarks():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/bookmarks/saved.py b/tests/api/bookmarks/saved.py
index d4c3e88a..b48ad40b 100644
--- a/tests/api/bookmarks/saved.py
+++ b/tests/api/bookmarks/saved.py
@@ -19,6 +19,8 @@ def _session_bookmarks():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/comments/create.py b/tests/api/comments/create.py
index c440d5f9..9f2806fb 100644
--- a/tests/api/comments/create.py
+++ b/tests/api/comments/create.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -129,6 +131,8 @@ def _session_comments():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -159,6 +163,8 @@ def _user_uploads(prefix="up"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/comments/edit.py b/tests/api/comments/edit.py
index 5d916d2f..d3927cda 100644
--- a/tests/api/comments/edit.py
+++ b/tests/api/comments/edit.py
@@ -20,6 +20,8 @@ def _session_edit():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/components/title.py b/tests/api/components/title.py
index c4754ad0..d8ad47eb 100644
--- a/tests/api/components/title.py
+++ b/tests/api/components/title.py
@@ -30,6 +30,7 @@ def _owner():
         {
             "uid": uid,
             "username": f"dpt_{uid[-6:]}",
+            "terms_version": "1",
             "email": f"{uid[-6:]}@title.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/api/content/negotiation.py b/tests/api/content/negotiation.py
index 47d5ae4d..cc1c0a22 100644
--- a/tests/api/content/negotiation.py
+++ b/tests/api/content/negotiation.py
@@ -17,6 +17,8 @@ def _session_content_negotiation(password="secret123"):
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/content/permissions.py b/tests/api/content/permissions.py
index f074a443..e914da10 100644
--- a/tests/api/content/permissions.py
+++ b/tests/api/content/permissions.py
@@ -35,6 +35,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/dbapi/conftest.py b/tests/api/dbapi/conftest.py
index eb72768b..06bb964c 100644
--- a/tests/api/dbapi/conftest.py
+++ b/tests/api/dbapi/conftest.py
@@ -19,6 +19,7 @@ def _seed_schema():
             {
                 "uid": generate_uid(),
                 "username": "dbapi_seed",
+                "terms_version": "1",
                 "email": "seed@dbapi.test",
                 "role": "Member",
                 "xp": 0,
@@ -66,6 +67,7 @@ def auth(client):
             {
                 "uid": uid,
                 "username": f"dbapi_admin_{uid[:8]}",
+                "terms_version": "1",
                 "email": f"{uid[:8]}@dbapi.test",
                 "role": "Admin",
                 "api_key": f"dbapikey_{uid}",
diff --git a/tests/api/devrant/auth.py b/tests/api/devrant/auth.py
index 1a4d0ec9..4131af73 100644
--- a/tests/api/devrant/auth.py
+++ b/tests/api/devrant/auth.py
@@ -196,16 +196,22 @@ def test_edit_profile_updates_bio(app_server):
     assert get_table("users").find_one(username=name)["bio"] == "devrant bio text"
 
 
-def test_delete_account_deactivates_and_revokes(app_server):
+def test_delete_account_deletes_and_revokes(app_server):
     name, email, password, _ = _register()
+    refresh_snapshot()
+    uid = get_table("users").find_one(username=name)["uid"]
     params = _token_params(name, password)
     r = requests.delete(f"{BASE_URL}/api/users/me", data=params)
     assert r.json()["success"] is True
     refresh_snapshot()
-    user = get_table("users").find_one(username=name)
+    assert get_table("users").find_one(username=name) is None
+    user = get_table("users").find_one(uid=uid)
     assert user["is_active"] in (False, 0)
+    assert user["username"].startswith("deleted_")
+    assert not user["email"]
+    assert not user["password_hash"]
     assert (
-        get_table("devrant_tokens").count(user_uid=user["uid"], deleted_at=None) == 0
+        get_table("devrant_tokens").count(user_uid=uid, deleted_at=None) == 0
     )
 
 
diff --git a/tests/api/docs/index.py b/tests/api/docs/index.py
index 7c222061..3eb9fe85 100644
--- a/tests/api/docs/index.py
+++ b/tests/api/docs/index.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -145,6 +147,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/feed.py b/tests/api/feed.py
index a802df29..4f2e1965 100644
--- a/tests/api/feed.py
+++ b/tests/api/feed.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -128,6 +130,8 @@ def _session_polls():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -197,6 +201,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -371,6 +376,8 @@ def test_feed_shows_online_now_section(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -391,6 +398,8 @@ def test_online_now_avatar_uses_the_shared_presence_dot(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/follow/index.py b/tests/api/follow/index.py
index fa154e5e..f50aa56d 100644
--- a/tests/api/follow/index.py
+++ b/tests/api/follow/index.py
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
             "email": email,
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -73,6 +75,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -150,6 +154,8 @@ def _session_follow_api():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/follow/unfollow.py b/tests/api/follow/unfollow.py
index efc5ae94..8e4349c7 100644
--- a/tests/api/follow/unfollow.py
+++ b/tests/api/follow/unfollow.py
@@ -16,6 +16,8 @@ def _session_follow_api():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/game/index.py b/tests/api/game/index.py
index adc3cf0f..b5dde8eb 100644
--- a/tests/api/game/index.py
+++ b/tests/api/game/index.py
@@ -23,6 +23,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/game/mutations.py b/tests/api/game/mutations.py
index 1d255c1f..d7a57a2b 100644
--- a/tests/api/game/mutations.py
+++ b/tests/api/game/mutations.py
@@ -24,6 +24,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/gists/create.py b/tests/api/gists/create.py
index 33e818af..a708d156 100644
--- a/tests/api/gists/create.py
+++ b/tests/api/gists/create.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -137,6 +139,8 @@ def _register_session(prefix):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -147,6 +151,7 @@ def _seed_gists(count):
         {
             "uid": owner,
             "username": f"pag_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -212,6 +217,7 @@ def _seed_searchable_gists(language="python"):
         {
             "uid": owner,
             "username": f"gsrch_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -254,6 +260,8 @@ def _user_uploads(prefix="up"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/gists/index.py b/tests/api/gists/index.py
index 4bd8c21d..baba93af 100644
--- a/tests/api/gists/index.py
+++ b/tests/api/gists/index.py
@@ -38,6 +38,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/api/issues/attachments.py b/tests/api/issues/attachments.py
index b386a8fa..82cba676 100644
--- a/tests/api/issues/attachments.py
+++ b/tests/api/issues/attachments.py
@@ -64,6 +64,7 @@ def _user(role="member"):
         {
             "uid": uid,
             "username": f"iatt{_seq[0]}",
+            "terms_version": "1",
             "role": role,
             "xp": 0,
             "level": 1,
diff --git a/tests/api/issues/create.py b/tests/api/issues/create.py
index c1ea0130..db2245f7 100644
--- a/tests/api/issues/create.py
+++ b/tests/api/issues/create.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -163,6 +165,7 @@ def _make_user_issues_gitea():
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "role": "member",
             "xp": 0,
             "level": 1,
diff --git a/tests/api/issues/giteaflow.py b/tests/api/issues/giteaflow.py
index f1798851..1ca1168f 100644
--- a/tests/api/issues/giteaflow.py
+++ b/tests/api/issues/giteaflow.py
@@ -50,6 +50,7 @@ def admin_headers(client):
             {
                 "uid": uid,
                 "username": f"gitea_admin_{uid[:8]}",
+                "terms_version": "1",
                 "email": f"{uid[:8]}@gitea.test",
                 "role": "Admin",
                 "api_key": f"giteakey_{uid}",
@@ -80,6 +81,7 @@ def member_headers(client):
         {
             "uid": uid,
             "username": f"gitea_member_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@giteamember.test",
             "role": "Member",
             "api_key": key,
diff --git a/tests/api/issues/status.py b/tests/api/issues/status.py
index ad4e8f50..65d79342 100644
--- a/tests/api/issues/status.py
+++ b/tests/api/issues/status.py
@@ -35,6 +35,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/manifestjson.py b/tests/api/manifestjson.py
index a421fe9c..aa1e1936 100644
--- a/tests/api/manifestjson.py
+++ b/tests/api/manifestjson.py
@@ -13,6 +13,8 @@ def _session_push():
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/media/delete.py b/tests/api/media/delete.py
index 7bf700e7..1826c2de 100644
--- a/tests/api/media/delete.py
+++ b/tests/api/media/delete.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/media/index.py b/tests/api/media/index.py
index 9e0d46f0..dcb04b27 100644
--- a/tests/api/media/index.py
+++ b/tests/api/media/index.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/media/restore.py b/tests/api/media/restore.py
index 2e5a5396..31ad2043 100644
--- a/tests/api/media/restore.py
+++ b/tests/api/media/restore.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/messages/conversations.py b/tests/api/messages/conversations.py
index 13340bfd..3827d29d 100644
--- a/tests/api/messages/conversations.py
+++ b/tests/api/messages/conversations.py
@@ -24,6 +24,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/messages/index.py b/tests/api/messages/index.py
index 77b630e7..81ae4e5a 100644
--- a/tests/api/messages/index.py
+++ b/tests/api/messages/index.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -129,6 +131,8 @@ def _session_content_negotiation(password="secret123"):
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -194,6 +198,8 @@ def test_chat_presence_agrees_with_the_feed_online_roster(app_server):
             "email": f"{other_name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/messages/search.py b/tests/api/messages/search.py
index 85f9d35f..3a5e6136 100644
--- a/tests/api/messages/search.py
+++ b/tests/api/messages/search.py
@@ -16,6 +16,8 @@ def _user_uploads(prefix="up"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/messages/send.py b/tests/api/messages/send.py
index 7e729fde..51322ca8 100644
--- a/tests/api/messages/send.py
+++ b/tests/api/messages/send.py
@@ -52,6 +52,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/messages/ws.py b/tests/api/messages/ws.py
index 0c1846e0..89aad446 100644
--- a/tests/api/messages/ws.py
+++ b/tests/api/messages/ws.py
@@ -47,6 +47,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/messages/wsticket.py b/tests/api/messages/wsticket.py
index 29a5745e..cf219df3 100644
--- a/tests/api/messages/wsticket.py
+++ b/tests/api/messages/wsticket.py
@@ -43,6 +43,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/mute/index.py b/tests/api/mute/index.py
index 1cd181b4..95bfc57d 100644
--- a/tests/api/mute/index.py
+++ b/tests/api/mute/index.py
@@ -21,6 +21,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/mute/unmute.py b/tests/api/mute/unmute.py
index 4a8c87dc..1d548bd9 100644
--- a/tests/api/mute/unmute.py
+++ b/tests/api/mute/unmute.py
@@ -20,6 +20,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/news/index.py b/tests/api/news/index.py
index 8579c9e3..64983023 100644
--- a/tests/api/news/index.py
+++ b/tests/api/news/index.py
@@ -38,6 +38,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/api/notifications.py b/tests/api/notifications.py
index a050a0fa..e4009e3d 100644
--- a/tests/api/notifications.py
+++ b/tests/api/notifications.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/polls.py b/tests/api/polls.py
index 7072d523..362b7649 100644
--- a/tests/api/polls.py
+++ b/tests/api/polls.py
@@ -17,6 +17,8 @@ def _session_polls():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/posts/create.py b/tests/api/posts/create.py
index d646a6ad..464437bc 100644
--- a/tests/api/posts/create.py
+++ b/tests/api/posts/create.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -129,6 +131,8 @@ def _session_content_negotiation(password="secret123"):
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -147,6 +151,8 @@ def _session_polls():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -199,6 +205,8 @@ def _session_reactions():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -292,6 +300,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -431,6 +440,8 @@ def _user_uploads(prefix="up"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -458,6 +469,8 @@ def _session_validation():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/posts/delete.py b/tests/api/posts/delete.py
index a3f866a0..83900c33 100644
--- a/tests/api/posts/delete.py
+++ b/tests/api/posts/delete.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/posts/edit.py b/tests/api/posts/edit.py
index 264f1ed0..e9a7ddf6 100644
--- a/tests/api/posts/edit.py
+++ b/tests/api/posts/edit.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -129,6 +131,8 @@ def _session_polls():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/posts/index.py b/tests/api/posts/index.py
index 6f68a317..fd1662ec 100644
--- a/tests/api/posts/index.py
+++ b/tests/api/posts/index.py
@@ -17,6 +17,8 @@ def _session_content_negotiation(password="secret123"):
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/aicorrection.py b/tests/api/profile/aicorrection.py
index 7628811c..ec0e6949 100644
--- a/tests/api/profile/aicorrection.py
+++ b/tests/api/profile/aicorrection.py
@@ -27,6 +27,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/aimodifier.py b/tests/api/profile/aimodifier.py
index c3a9c773..ae45e0e4 100644
--- a/tests/api/profile/aimodifier.py
+++ b/tests/api/profile/aimodifier.py
@@ -27,6 +27,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/award.py b/tests/api/profile/award.py
index 19c66b6d..0c4056d3 100644
--- a/tests/api/profile/award.py
+++ b/tests/api/profile/award.py
@@ -20,6 +20,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/consent.py b/tests/api/profile/consent.py
new file mode 100644
index 00000000..64b504c5
--- /dev/null
+++ b/tests/api/profile/consent.py
@@ -0,0 +1,210 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import requests
+
+from devplacepy.database import (
+    CONSENT_KINDS,
+    consent_granted,
+    get_table,
+    refresh_snapshot,
+)
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="cons"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _member():
+    name = _unique()
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    return session, name, get_table("users").find_one(username=name)
+
+
+def test_the_privacy_tab_lists_every_consent(app_server):
+    session, name, _ = _member()
+    payload = session.get(
+        f"{BASE_URL}/profile/{name}?tab=privacy", headers=JSON
+    ).json()
+    kinds = {entry["kind"] for entry in payload["consents"]}
+    assert set(CONSENT_KINDS) == kinds
+    states = {entry["kind"]: entry["state"] for entry in payload["consents"]}
+    assert states["ai_third_party"] == "withdrawn"
+    assert states["terms"] == "granted"
+
+
+def test_granting_and_withdrawing_takes_effect_immediately(app_server):
+    session, name, user = _member()
+    granted = session.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "1"},
+        headers=JSON,
+    )
+    assert granted.status_code == 200
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "ai_third_party") is True
+
+    withdrawn = session.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "0"},
+        headers=JSON,
+    )
+    assert withdrawn.status_code == 200
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "ai_third_party") is False
+
+
+def test_consent_history_is_never_rewritten(app_server):
+    session, name, user = _member()
+    for granted in ("1", "0", "1"):
+        session.post(
+            f"{BASE_URL}/profile/{name}/consent",
+            data={"kind": "ai_third_party", "granted": granted},
+            headers=JSON,
+        )
+    refresh_snapshot()
+    rows = list(
+        get_table("user_consents").find(
+            owner_kind="user", owner_id=user["uid"], kind="ai_third_party"
+        )
+    )
+    assert len(rows) == 3
+
+
+def test_an_unknown_consent_kind_is_refused(app_server):
+    session, name, _ = _member()
+    response = session.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "not_a_consent", "granted": "1"},
+        headers=JSON,
+    )
+    assert response.status_code == 422
+
+
+def test_the_gateway_refuses_user_content_without_consent(app_server):
+    session, name, user = _member()
+    refresh_snapshot()
+    api_key = get_table("users").find_one(uid=user["uid"])["api_key"]
+    headers = {**JSON, "Authorization": f"Bearer {api_key}"}
+    body = {"model": "molodetz", "messages": [{"role": "user", "content": "hi"}]}
+
+    refused = requests.post(
+        f"{BASE_URL}/openai/v1/chat/completions", json=body, headers=headers
+    )
+    assert refused.status_code == 403
+    assert "consent" in refused.text.lower()
+
+    session.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "1"},
+        headers=JSON,
+    )
+    allowed = requests.post(
+        f"{BASE_URL}/openai/v1/chat/completions", json=body, headers=headers
+    )
+    assert allowed.status_code != 403
+
+
+def _admin():
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=True,
+    )
+    return session
+
+
+def test_an_admin_cannot_grant_a_consent_for_someone_else(app_server, seeded_db):
+    _, name, user = _member()
+    response = _admin().post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "1"},
+        headers=JSON,
+    )
+    assert response.status_code == 403
+    assert "account holder" in response.text
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "ai_third_party") is False
+
+
+def test_an_admin_cannot_withdraw_a_consent_for_someone_else(app_server, seeded_db):
+    session, name, user = _member()
+    session.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "1"},
+        headers=JSON,
+    )
+    response = _admin().post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "0"},
+        headers=JSON,
+    )
+    assert response.status_code == 403
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "ai_third_party") is True
+
+
+def test_an_admin_cannot_change_someone_elses_mature_preference(app_server, seeded_db):
+    _, name, user = _member()
+    before = get_table("users").find_one(uid=user["uid"])["mature_opt_in"]
+    response = _admin().post(
+        f"{BASE_URL}/profile/{name}/mature-content",
+        data={"mature_opt_in": "1"},
+        headers=JSON,
+    )
+    assert response.status_code == 403
+    assert "account holder" in response.text
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] == before
+
+
+def test_a_stranger_cannot_change_another_members_consent(app_server):
+    _, name, user = _member()
+    stranger, _, _ = _member()
+    response = stranger.post(
+        f"{BASE_URL}/profile/{name}/consent",
+        data={"kind": "ai_third_party", "granted": "1"},
+        headers=JSON,
+    )
+    assert response.status_code == 403
+    refresh_snapshot()
+    assert consent_granted("user", user["uid"], "ai_third_party") is False
+
+
+def test_the_mature_preference_round_trips(app_server):
+    session, name, user = _member()
+    response = session.post(
+        f"{BASE_URL}/profile/{name}/mature-content",
+        data={"mature_opt_in": "1"},
+        headers=JSON,
+    )
+    assert response.status_code == 200
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] in (1, True)
+    session.post(
+        f"{BASE_URL}/profile/{name}/mature-content",
+        data={"mature_opt_in": "0"},
+        headers=JSON,
+    )
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] in (0, False)
diff --git a/tests/api/profile/delete.py b/tests/api/profile/delete.py
new file mode 100644
index 00000000..c736bb39
--- /dev/null
+++ b/tests/api/profile/delete.py
@@ -0,0 +1,162 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import requests
+
+from devplacepy.database import get_table, refresh_snapshot
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="del"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _member(prefix="del"):
+    name = _unique(prefix)
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _post(session, title="Doomed post"):
+    response = session.post(
+        f"{BASE_URL}/posts/create",
+        data={"title": title, "content": "Content that disappears with the account."},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    return response.json()["data"]["uid"]
+
+
+def test_the_page_states_what_is_removed_and_the_grace_window(app_server):
+    session, name = _member()
+    payload = session.get(f"{BASE_URL}/profile/{name}/delete", headers=JSON).json()
+    assert payload["username"] == name
+    assert payload["removed"]
+    assert payload["retained"]
+    assert payload["grace_hours"] >= 0
+
+
+def test_a_wrong_password_does_not_delete(app_server):
+    session, name = _member()
+    response = session.post(
+        f"{BASE_URL}/profile/{name}/delete",
+        data={"password": "not-the-password"},
+        headers=JSON,
+    )
+    assert response.status_code == 403
+    refresh_snapshot()
+    assert get_table("users").find_one(username=name) is not None
+
+
+def test_deletion_removes_content_revokes_sessions_and_anonymises(app_server):
+    session, name = _member()
+    post_uid = _post(session)
+    refresh_snapshot()
+    before = get_table("users").find_one(username=name)
+
+    response = session.post(
+        f"{BASE_URL}/profile/{name}/delete",
+        data={"password": "secret123"},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    stamp = response.json()["data"]["stamp"]
+
+    refresh_snapshot()
+    assert get_table("users").find_one(username=name) is None
+    row = get_table("users").find_one(uid=before["uid"])
+    assert row["username"].startswith("deleted_")
+    assert not row["email"]
+    assert not row["api_key"]
+    assert not row["password_hash"]
+    assert row["deletion_requested_at"] == stamp
+
+    post = get_table("posts").find_one(uid=post_uid)
+    assert post["deleted_at"] == stamp
+    assert session.get(f"{BASE_URL}/reports/mine", headers=JSON).status_code == 401
+    assert requests.get(f"{BASE_URL}/profile/{name}").status_code == 404
+
+
+def test_only_the_account_holder_can_delete(app_server, seeded_db):
+    victim, victim_name = _member()
+    admin = requests.Session()
+    admin.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=True,
+    )
+    response = admin.post(
+        f"{BASE_URL}/profile/{victim_name}/delete",
+        data={"password": "secret123"},
+        headers=JSON,
+    )
+    assert response.status_code == 403
+    refresh_snapshot()
+    assert get_table("users").find_one(username=victim_name) is not None
+
+
+def test_restore_from_trash_brings_the_whole_event_back(app_server, seeded_db):
+    session, name = _member()
+    post_uid = _post(session, title="Restorable post")
+    session.post(
+        f"{BASE_URL}/profile/{name}/delete",
+        data={"password": "secret123"},
+        headers=JSON,
+    )
+    refresh_snapshot()
+    assert get_table("posts").find_one(uid=post_uid)["deleted_at"]
+
+    admin = requests.Session()
+    admin.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=True,
+    )
+    response = admin.post(
+        f"{BASE_URL}/admin/trash/posts/{post_uid}/restore", headers=JSON
+    )
+    assert response.status_code == 200
+    refresh_snapshot()
+    assert get_table("posts").find_one(uid=post_uid)["deleted_at"] is None
+
+
+def test_purging_after_the_grace_window_leaves_no_personal_data(app_server):
+    from devplacepy.services.moderation import deletion
+
+    session, name = _member()
+    post_uid = _post(session, title="Purged post")
+    refresh_snapshot()
+    uid = get_table("users").find_one(username=name)["uid"]
+    session.post(
+        f"{BASE_URL}/profile/{name}/delete",
+        data={"password": "secret123"},
+        headers=JSON,
+    )
+    refresh_snapshot()
+    assert get_table("users").find_one(uid=uid)["username"].startswith("deleted_")
+
+    from datetime import datetime, timedelta, timezone
+
+    later = datetime.now(timezone.utc) + timedelta(hours=deletion.grace_hours() + 1)
+    purged = deletion.purge_due(now=later)
+    assert purged >= 1
+    refresh_snapshot()
+    assert get_table("posts").find_one(uid=post_uid) is None
+    assert get_table("users").find_one(uid=uid) is None
diff --git a/tests/api/profile/index.py b/tests/api/profile/index.py
index b3b7e3af..43b4ac56 100644
--- a/tests/api/profile/index.py
+++ b/tests/api/profile/index.py
@@ -38,6 +38,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -278,6 +279,8 @@ def test_profile_json_exposes_online_presence(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -326,6 +329,8 @@ def test_profile_hero_avatar_has_presence_dot(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -354,6 +359,8 @@ def test_followers_list_avatar_has_presence_dot(app_server):
                 "email": f"{name}@t.dev",
                 "password": "secret123",
                 "confirm_password": "secret123",
+                "birth_date": "1990-01-01",
+                "accept_terms": "1",
             },
             allow_redirects=True,
         )
@@ -381,6 +388,8 @@ def test_viewing_profile_marks_notification_read(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -511,6 +520,8 @@ def _signup_badge_user():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -571,4 +582,116 @@ def test_profile_badge_description_exact_string(app_server):
     )
 
 
+PRIVACY_FIELDS = (
+    "age_band",
+    "terms_version",
+    "terms_accepted_at",
+    "suspended_until",
+    "suspension_reason",
+)
+
+
+def _privacy_member(prefix="priv"):
+    import time
+
+    name = f"{prefix}{int(time.time() * 1000000)}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _admin_session():
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=True,
+    )
+    return session
+
+
+def test_the_owner_reads_their_own_privacy_state(app_server):
+    session, name = _privacy_member()
+    body = session.get(
+        f"{BASE_URL}/profile/{name}?tab=privacy",
+        headers={"Accept": "application/json"},
+    ).json()
+    assert body["age_band"] == "adult"
+    assert body["terms_version"]
+    assert body["terms_accepted_at"]
+    assert body["consents"]
+
+
+def test_privacy_state_is_withheld_from_a_stranger(app_server):
+    _, name = _privacy_member()
+    stranger, _ = _privacy_member("prvs")
+    body = stranger.get(
+        f"{BASE_URL}/profile/{name}?tab=privacy",
+        headers={"Accept": "application/json"},
+    ).json()
+    for field in PRIVACY_FIELDS:
+        assert body[field] in ("", None), f"{field} leaked to a stranger: {body[field]!r}"
+    assert body["mature_opt_in"] is False
+    assert body["consents"] == []
+
+
+def test_privacy_state_is_withheld_from_a_guest(app_server):
+    _, name = _privacy_member()
+    body = requests.get(
+        f"{BASE_URL}/profile/{name}?tab=privacy",
+        headers={"Accept": "application/json"},
+    ).json()
+    for field in PRIVACY_FIELDS:
+        assert body[field] in ("", None), f"{field} leaked to a guest: {body[field]!r}"
+    assert body["consents"] == []
+
+
+def test_a_strangers_profile_html_never_renders_the_privacy_panel(app_server):
+    _, name = _privacy_member()
+    stranger, _ = _privacy_member("prvh")
+    html = stranger.get(f"{BASE_URL}/profile/{name}?tab=privacy").text
+    assert "privacy-panel" not in html
+    assert f"/profile/{name}/consent" not in html
+    assert f"/profile/{name}/delete" not in html
+
+
+def test_an_admin_reads_the_state_but_gets_no_controls(app_server, seeded_db):
+    _, name = _privacy_member()
+    admin = _admin_session()
+    body = admin.get(
+        f"{BASE_URL}/profile/{name}?tab=privacy",
+        headers={"Accept": "application/json"},
+    ).json()
+    assert body["age_band"] == "adult"
+    assert body["consents"]
+
+    html = admin.get(f"{BASE_URL}/profile/{name}?tab=privacy").text
+    assert "privacy-panel" in html
+    assert "Only the account holder can change this." in html
+    assert "Only the account holder can change this preference." in html
+    assert f'action="/profile/{name}/consent"' not in html
+    assert f'action="/profile/{name}/mature-content"' not in html
+    assert f"/profile/{name}/delete" not in html
+
+
+def test_the_owner_gets_the_privacy_controls(app_server):
+    session, name = _privacy_member()
+    html = session.get(f"{BASE_URL}/profile/{name}?tab=privacy").text
+    assert f'action="/profile/{name}/consent"' in html
+    assert f'action="/profile/{name}/mature-content"' in html
+    assert f"/profile/{name}/delete" in html
+    assert "Only the account holder can change this." not in html
+
+
 
diff --git a/tests/api/profile/interactions.py b/tests/api/profile/interactions.py
index f1d0170f..d4e7b419 100644
--- a/tests/api/profile/interactions.py
+++ b/tests/api/profile/interactions.py
@@ -28,6 +28,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/regenerateapikey.py b/tests/api/profile/regenerateapikey.py
index 1f128471..58920175 100644
--- a/tests/api/profile/regenerateapikey.py
+++ b/tests/api/profile/regenerateapikey.py
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
             "email": email,
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/regenerateavatar.py b/tests/api/profile/regenerateavatar.py
index 62535d34..bd54d3fe 100644
--- a/tests/api/profile/regenerateavatar.py
+++ b/tests/api/profile/regenerateavatar.py
@@ -27,6 +27,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/search.py b/tests/api/profile/search.py
index c833bcf7..c10790e9 100644
--- a/tests/api/profile/search.py
+++ b/tests/api/profile/search.py
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
             "email": email,
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -44,6 +46,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -143,6 +147,7 @@ def _make_user_streaks():
         {
             "uid": uid,
             "username": name,
+            "terms_version": "1",
             "email": f"{name}@t.dev",
             "role": "Member",
             "is_active": True,
@@ -256,6 +261,8 @@ def test_profile_renders_heatmap_and_streak(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -287,6 +294,8 @@ def test_profile_badges_json_has_non_null_names(app_server):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/telegram.py b/tests/api/profile/telegram.py
index f45e7191..9c409e78 100644
--- a/tests/api/profile/telegram.py
+++ b/tests/api/profile/telegram.py
@@ -21,6 +21,8 @@ def _signup(password="secret123"):
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/profile/update.py b/tests/api/profile/update.py
index 0a5fe045..a2944074 100644
--- a/tests/api/profile/update.py
+++ b/tests/api/profile/update.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -125,6 +127,8 @@ def _session_validation():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/project/files.py b/tests/api/project/files.py
index ed661274..d010ae1e 100644
--- a/tests/api/project/files.py
+++ b/tests/api/project/files.py
@@ -17,6 +17,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/project/visibility.py b/tests/api/project/visibility.py
index 9b183d4c..e1d47a2d 100644
--- a/tests/api/project/visibility.py
+++ b/tests/api/project/visibility.py
@@ -24,6 +24,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/containers/data.py b/tests/api/projects/containers/data.py
index 06a1ac6d..dd9aa4d0 100644
--- a/tests/api/projects/containers/data.py
+++ b/tests/api/projects/containers/data.py
@@ -19,6 +19,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/containers/manage.py b/tests/api/projects/containers/manage.py
index 14571096..aa2d13d9 100644
--- a/tests/api/projects/containers/manage.py
+++ b/tests/api/projects/containers/manage.py
@@ -25,6 +25,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/create.py b/tests/api/projects/create.py
index 264a7a12..7a90fb64 100644
--- a/tests/api/projects/create.py
+++ b/tests/api/projects/create.py
@@ -16,6 +16,8 @@ def _user_uploads(prefix="up"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/delete.py b/tests/api/projects/delete.py
index 43d4fc96..0fb38a5f 100644
--- a/tests/api/projects/delete.py
+++ b/tests/api/projects/delete.py
@@ -17,6 +17,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -132,6 +134,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/devlog.py b/tests/api/projects/devlog.py
index a47cb88b..297f2397 100644
--- a/tests/api/projects/devlog.py
+++ b/tests/api/projects/devlog.py
@@ -40,6 +40,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/edit.py b/tests/api/projects/edit.py
index b1652448..43144e49 100644
--- a/tests/api/projects/edit.py
+++ b/tests/api/projects/edit.py
@@ -24,6 +24,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/lineops.py b/tests/api/projects/files/lineops.py
index f8e8ba23..40f7ca3f 100644
--- a/tests/api/projects/files/lineops.py
+++ b/tests/api/projects/files/lineops.py
@@ -27,6 +27,8 @@ def _signup():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/lines.py b/tests/api/projects/files/lines.py
index 3fc65ca1..513cc85b 100644
--- a/tests/api/projects/files/lines.py
+++ b/tests/api/projects/files/lines.py
@@ -28,6 +28,8 @@ def _signup_project_file_lines():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/raw.py b/tests/api/projects/files/raw.py
index 02880ffb..8b9b33d9 100644
--- a/tests/api/projects/files/raw.py
+++ b/tests/api/projects/files/raw.py
@@ -24,6 +24,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/replacelines.py b/tests/api/projects/files/replacelines.py
index 54370d38..97869ec2 100644
--- a/tests/api/projects/files/replacelines.py
+++ b/tests/api/projects/files/replacelines.py
@@ -28,6 +28,8 @@ def _signup_project_file_lines():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -102,6 +104,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/upload.py b/tests/api/projects/files/upload.py
index a83b130a..4784fc8a 100644
--- a/tests/api/projects/files/upload.py
+++ b/tests/api/projects/files/upload.py
@@ -17,6 +17,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/write.py b/tests/api/projects/files/write.py
index 91099265..f7d1b904 100644
--- a/tests/api/projects/files/write.py
+++ b/tests/api/projects/files/write.py
@@ -17,6 +17,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/files/zip.py b/tests/api/projects/files/zip.py
index 8e55e25b..0b5fc97c 100644
--- a/tests/api/projects/files/zip.py
+++ b/tests/api/projects/files/zip.py
@@ -25,6 +25,8 @@ def _signup_zip_download():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/projects/index.py b/tests/api/projects/index.py
index 84c418bb..b9a993d9 100644
--- a/tests/api/projects/index.py
+++ b/tests/api/projects/index.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -135,6 +137,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -225,6 +229,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/api/projects/workspace.py b/tests/api/projects/workspace.py
index 824ea432..7a9ee338 100644
--- a/tests/api/projects/workspace.py
+++ b/tests/api/projects/workspace.py
@@ -540,6 +540,8 @@ def _fresh_member() -> dict:
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
         timeout=HTTP_TIMEOUT,
diff --git a/tests/api/projects/zip.py b/tests/api/projects/zip.py
index 74fbfeb6..9c04ce10 100644
--- a/tests/api/projects/zip.py
+++ b/tests/api/projects/zip.py
@@ -25,6 +25,8 @@ def _signup_zip_download():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/pushjson.py b/tests/api/pushjson.py
index 0f8550b1..fe160de2 100644
--- a/tests/api/pushjson.py
+++ b/tests/api/pushjson.py
@@ -13,6 +13,8 @@ def _session_push():
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/quizzes/_helpers.py b/tests/api/quizzes/_helpers.py
index 5d329eef..8f2c4331 100644
--- a/tests/api/quizzes/_helpers.py
+++ b/tests/api/quizzes/_helpers.py
@@ -74,6 +74,8 @@ def signup(prefix="qz"):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/reactions.py b/tests/api/reactions.py
index e80573ad..31c38e31 100644
--- a/tests/api/reactions.py
+++ b/tests/api/reactions.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -139,6 +141,8 @@ def _session_reactions():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/reports/__init__.py b/tests/api/reports/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/api/reports/index.py b/tests/api/reports/index.py
new file mode 100644
index 00000000..e4ba9f92
--- /dev/null
+++ b/tests/api/reports/index.py
@@ -0,0 +1,227 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+
+import pytest
+import requests
+
+from devplacepy.database import REPORTABLE_TARGETS, get_table, refresh_snapshot
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="rep"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _member():
+    name = _unique()
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _post(session, title="Reportable post"):
+    response = session.post(
+        f"{BASE_URL}/posts/create",
+        data={"title": title, "content": "A post that can be reported by others."},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    return response.json()["data"]["uid"]
+
+
+def _reports_for(target_type, target_uid):
+    refresh_snapshot()
+    return list(
+        get_table("content_reports").find(
+            target_type=target_type, target_uid=target_uid, deleted_at=None
+        )
+    )
+
+
+@pytest.fixture(scope="module")
+def author(app_server):
+    return _member()
+
+
+def test_report_reasons_are_public(app_server):
+    response = requests.get(f"{BASE_URL}/reports/reasons", headers=JSON)
+    assert response.status_code == 200
+    keys = {entry["key"] for entry in response.json()["reasons"]}
+    assert {"harassment", "spam", "intellectual_property", "other"} <= keys
+
+
+def test_the_reasons_page_is_indexable_with_breadcrumbs_and_a_site_schema(app_server):
+    html = requests.get(f"{BASE_URL}/reports/reasons").text
+    assert '<meta name="robots" content="index,follow">' in html
+    assert 'class="breadcrumb"' in html
+    assert "Report reasons" in html
+    assert '"@type": "WebSite"' in html
+
+
+def test_the_reasons_page_title_carries_one_site_suffix(app_server):
+    html = requests.get(f"{BASE_URL}/reports/reasons").text
+    start = html.index("<title>") + len("<title>")
+    title = html[start : html.index("</title>", start)]
+    assert title == "Report reasons - DevPlace", title
+
+
+def test_reporting_a_post_records_one_row_with_the_owner(author):
+    author_session, author_name = author
+    post_uid = _post(author_session)
+    reporter, _ = _member()
+    response = reporter.post(
+        f"{BASE_URL}/reports/post/{post_uid}",
+        data={"reason": "harassment", "detail": "Targets me personally."},
+        headers=JSON,
+    )
+    assert response.status_code == 200, response.text
+    assert response.json()["data"]["status"] == "open"
+    rows = _reports_for("post", post_uid)
+    assert len(rows) == 1
+    owner = get_table("users").find_one(username=author_name)
+    assert rows[0]["owner_uid"] == owner["uid"]
+    assert rows[0]["origin"] == "member"
+
+
+def test_second_report_by_the_same_reporter_updates_instead_of_duplicating(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    reporter, _ = _member()
+    for reason in ("spam", "harassment"):
+        response = reporter.post(
+            f"{BASE_URL}/reports/post/{post_uid}",
+            data={"reason": reason},
+            headers=JSON,
+        )
+        assert response.status_code == 200
+    rows = _reports_for("post", post_uid)
+    assert len(rows) == 1
+    assert rows[0]["reason"] == "harassment"
+
+
+def test_a_different_reporter_creates_a_second_row(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    for _ in range(2):
+        reporter, _ = _member()
+        reporter.post(
+            f"{BASE_URL}/reports/post/{post_uid}",
+            data={"reason": "spam"},
+            headers=JSON,
+        )
+    assert len(_reports_for("post", post_uid)) == 2
+
+
+def test_guests_cannot_report(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    response = requests.post(
+        f"{BASE_URL}/reports/post/{post_uid}",
+        data={"reason": "spam"},
+        headers=JSON,
+    )
+    assert response.status_code == 401
+
+
+def test_reporting_your_own_content_is_refused(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    response = author_session.post(
+        f"{BASE_URL}/reports/post/{post_uid}",
+        data={"reason": "spam"},
+        headers=JSON,
+    )
+    assert response.status_code == 400
+    assert _reports_for("post", post_uid) == []
+
+
+def test_an_unknown_target_type_is_refused(author):
+    reporter, _ = _member()
+    response = reporter.post(
+        f"{BASE_URL}/reports/not_a_surface/whatever",
+        data={"reason": "spam"},
+        headers=JSON,
+    )
+    assert response.status_code == 400
+
+
+def test_an_unknown_reason_is_refused(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    reporter, _ = _member()
+    response = reporter.post(
+        f"{BASE_URL}/reports/post/{post_uid}",
+        data={"reason": "not_a_reason"},
+        headers=JSON,
+    )
+    assert response.status_code == 422
+
+
+def test_every_registry_target_type_is_accepted_by_the_route(author):
+    author_session, _ = author
+    reporter, _ = _member()
+    for target_type in REPORTABLE_TARGETS:
+        response = reporter.post(
+            f"{BASE_URL}/reports/{target_type}/missing-{target_type}",
+            data={"reason": "other"},
+            headers=JSON,
+        )
+        assert response.status_code == 200, f"{target_type}: {response.text}"
+
+
+def test_the_report_dialog_uses_the_shared_auth_field_classes(app_server):
+    reporter, _ = _member()
+    html = reporter.get(f"{BASE_URL}/feed").text
+    assert 'id="report-dialog"' in html
+    assert 'class="auth-field auth-field-gap"' in html
+    assert 'class="modal-footer"' in html
+    assert 'id="report-reason"' in html
+    assert 'id="report-detail"' in html
+
+
+def test_your_reports_page_loads_the_admin_table_styles(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    reporter, _ = _member()
+    reporter.post(
+        f"{BASE_URL}/reports/post/{post_uid}", data={"reason": "spam"}, headers=JSON
+    )
+    html = reporter.get(f"{BASE_URL}/reports/mine").text
+    assert "css/admin.css" in html
+    assert 'class="admin-table"' in html
+
+
+def test_mine_lists_only_your_own_reports(author):
+    author_session, _ = author
+    post_uid = _post(author_session)
+    mine, _ = _member()
+    other, _ = _member()
+    mine.post(
+        f"{BASE_URL}/reports/post/{post_uid}", data={"reason": "spam"}, headers=JSON
+    )
+    other.post(
+        f"{BASE_URL}/reports/post/{post_uid}",
+        data={"reason": "harassment"},
+        headers=JSON,
+    )
+    payload = mine.get(f"{BASE_URL}/reports/mine", headers=JSON).json()
+    reasons = {entry["reason"] for entry in payload["reports"]}
+    assert "spam" in reasons
+    assert "harassment" not in reasons
+    assert requests.get(f"{BASE_URL}/reports/mine", headers=JSON).status_code == 401
diff --git a/tests/api/robotstxt.py b/tests/api/robotstxt.py
index 26979954..271edd14 100644
--- a/tests/api/robotstxt.py
+++ b/tests/api/robotstxt.py
@@ -51,6 +51,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -200,3 +201,15 @@ def test_robots_disallows_admin_and_uploads(app_server):
     r = requests.get(f"{BASE_URL}/robots.txt")
     assert "Disallow: /admin/" in r.text
     assert "Disallow: /uploads/" in r.text
+
+
+def test_robots_disallows_the_private_moderation_surfaces(app_server):
+    r = requests.get(f"{BASE_URL}/robots.txt")
+    assert "Disallow: /reports/mine" in r.text
+    assert "Disallow: /profile/*/delete" in r.text
+
+
+def test_robots_keeps_the_public_report_reasons_crawlable(app_server):
+    r = requests.get(f"{BASE_URL}/robots.txt")
+    assert "Disallow: /reports/reasons" not in r.text
+    assert "Disallow: /reports/\n" not in r.text
diff --git a/tests/api/serviceworkerjs.py b/tests/api/serviceworkerjs.py
index 02615001..29d2e37b 100644
--- a/tests/api/serviceworkerjs.py
+++ b/tests/api/serviceworkerjs.py
@@ -13,6 +13,8 @@ def _session_push():
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/sitemapxml.py b/tests/api/sitemapxml.py
index 171a9439..fbeb9a33 100644
--- a/tests/api/sitemapxml.py
+++ b/tests/api/sitemapxml.py
@@ -24,6 +24,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -114,6 +116,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -264,6 +267,32 @@ def test_sitemap_headers_and_static_entries(app_server):
     assert f"{BASE_URL}/gists" in r.text
 
 
+def test_sitemap_lists_the_public_moderation_surfaces(app_server):
+    xml = requests.get(f"{BASE_URL}/sitemap.xml").text
+    assert f"<loc>{BASE_URL}/reports/reasons</loc>" in xml
+    assert f"<loc>{BASE_URL}/workspaces/index</loc>" in xml
+    assert f"{BASE_URL}/reports/mine" not in xml
+
+
+def test_sitemap_lists_each_legal_document_exactly_once(app_server):
+    from devplacepy.seo import LEGAL_DOC_SLUGS
+
+    xml = requests.get(f"{BASE_URL}/sitemap.xml").text
+    for slug in LEGAL_DOC_SLUGS:
+        loc = f"<loc>{BASE_URL}/docs/{slug}.html</loc>"
+        assert xml.count(loc) == 1, f"{slug} listed {xml.count(loc)} times"
+
+
+def test_sitemap_never_repeats_a_documentation_url(app_server):
+    import re
+
+    xml = requests.get(f"{BASE_URL}/sitemap.xml").text
+    locs = [loc for loc in re.findall(r"<loc>(.*?)</loc>", xml) if "/docs/" in loc]
+    assert locs, "the sitemap lists no documentation pages"
+    duplicates = sorted({loc for loc in locs if locs.count(loc) > 1})
+    assert duplicates == [], duplicates
+
+
 def test_sitemap_includes_published_news(app_server):
     slug, _ = _seed_news_seo()
     r = requests.get(f"{BASE_URL}/sitemap.xml")
diff --git a/tests/api/streaks.py b/tests/api/streaks.py
index 8adcc1fb..06531aeb 100644
--- a/tests/api/streaks.py
+++ b/tests/api/streaks.py
@@ -21,6 +21,7 @@ def _make_user_streaks():
         {
             "uid": uid,
             "username": name,
+            "terms_version": "1",
             "email": f"{name}@t.dev",
             "role": "Member",
             "is_active": True,
diff --git a/tests/api/tools/deepsearch/control.py b/tests/api/tools/deepsearch/control.py
index d528194d..30e7049d 100644
--- a/tests/api/tools/deepsearch/control.py
+++ b/tests/api/tools/deepsearch/control.py
@@ -33,6 +33,8 @@ def _user():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/tools/isslop.py b/tests/api/tools/isslop.py
index b44045dd..d994ffd3 100644
--- a/tests/api/tools/isslop.py
+++ b/tests/api/tools/isslop.py
@@ -174,6 +174,8 @@ def test_guest_history_claimed_on_signup(app_server):
                 "email": f"{name}@t.dev",
                 "password": "secret123",
                 "confirm_password": "secret123",
+                "birth_date": "1990-01-01",
+                "accept_terms": "1",
             },
             allow_redirects=True,
         )
diff --git a/tests/api/tools/seometa.py b/tests/api/tools/seometa.py
index 251177cb..ad198b8d 100644
--- a/tests/api/tools/seometa.py
+++ b/tests/api/tools/seometa.py
@@ -34,6 +34,8 @@ def _post():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/uploads/manage.py b/tests/api/uploads/manage.py
index 5d672590..2658f9fd 100644
--- a/tests/api/uploads/manage.py
+++ b/tests/api/uploads/manage.py
@@ -41,6 +41,8 @@ def _user_manage(prefix="mng"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/uploads/upload.py b/tests/api/uploads/upload.py
index 8ddf714b..d3a53877 100644
--- a/tests/api/uploads/upload.py
+++ b/tests/api/uploads/upload.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -129,6 +131,8 @@ def _user_uploads(prefix="up"):
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/uploads/uploadurl.py b/tests/api/uploads/uploadurl.py
index d062acae..41116788 100644
--- a/tests/api/uploads/uploadurl.py
+++ b/tests/api/uploads/uploadurl.py
@@ -33,6 +33,8 @@ def _key():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/votes.py b/tests/api/votes.py
index e8c5f82b..271b3c9b 100644
--- a/tests/api/votes.py
+++ b/tests/api/votes.py
@@ -13,6 +13,8 @@ def _session_validation():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -33,6 +35,8 @@ def _session_votes():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/workspaces/__init__.py b/tests/api/workspaces/__init__.py
new file mode 100644
index 00000000..95ee7c3e
--- /dev/null
+++ b/tests/api/workspaces/__init__.py
@@ -0,0 +1 @@
+# retoor <retoor@molodetz.nl>
diff --git a/tests/api/workspaces/index.py b/tests/api/workspaces/index.py
new file mode 100644
index 00000000..cf4355e1
--- /dev/null
+++ b/tests/api/workspaces/index.py
@@ -0,0 +1,152 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+from datetime import datetime, timezone
+
+import pytest
+import requests
+
+from devplacepy.database import get_table, refresh_snapshot
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="wsi"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _member():
+    name = _unique()
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    refresh_snapshot()
+    return session, name, get_table("users").find_one(username=name)
+
+
+def _project(session, title, private=False):
+    data = {
+        "title": title,
+        "description": f"Description of {title}.",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if private:
+        data["is_private"] = "on"
+    response = session.post(f"{BASE_URL}/projects/create", data=data, headers=JSON)
+    assert response.status_code == 200, response.text
+    refresh_snapshot()
+    return get_table("projects").find_one(slug=response.json()["data"]["slug"])
+
+
+def _publish(project, owner_uid):
+    uid = _unique("wsuid")
+    slug = _unique("wsslug")
+    get_table("instances").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": uid,
+            "project_uid": project["uid"],
+            "owner_uid": owner_uid,
+            "name": f"workspace {slug}",
+            "slug": slug,
+            "ingress_slug": slug,
+            "status": "running",
+            "desired_state": "running",
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    refresh_snapshot()
+    return uid, slug
+
+
+@pytest.fixture(scope="module")
+def published(app_server):
+    session, name, user = _member()
+    public = _project(session, f"Public {name}")
+    private = _project(session, f"Private {name}", private=True)
+    public_uid, public_slug = _publish(public, user["uid"])
+    private_uid, private_slug = _publish(private, user["uid"])
+    yield {
+        "session": session,
+        "user": user,
+        "public": {"project": public, "uid": public_uid, "slug": public_slug},
+        "private": {"project": private, "uid": private_uid, "slug": private_slug},
+    }
+    instances = get_table("instances")
+    instances.delete(uid=public_uid)
+    instances.delete(uid=private_uid)
+
+
+def _entries(session=None, key=None):
+    headers = dict(JSON)
+    if key:
+        headers["X-API-KEY"] = key
+    caller = session or requests
+    response = caller.get(f"{BASE_URL}/workspaces/index", headers=headers)
+    assert response.status_code == 200, response.text
+    return {entry["slug"]: entry for entry in response.json()["workspaces"]}
+
+
+def test_the_index_is_public_and_lists_every_published_workspace(published):
+    entries = _entries()
+    assert published["public"]["slug"] in entries
+    assert published["private"]["slug"] in entries
+
+
+def test_each_row_exposes_its_uid_and_owner_uid_field(published):
+    entries = _entries()
+    row = entries[published["public"]["slug"]]
+    assert row["uid"] == published["public"]["uid"]
+    assert "owner_uid" in row
+
+
+def test_a_private_projects_description_and_url_are_withheld_from_a_guest(published):
+    entries = _entries()
+    public_row = entries[published["public"]["slug"]]
+    private_row = entries[published["private"]["slug"]]
+    assert public_row["description"] == published["public"]["project"]["description"]
+    assert public_row["project_url"] == f"/projects/{published['public']['project']['slug']}"
+    assert private_row["description"] == ""
+    assert private_row["project_url"] == ""
+
+
+def test_the_owner_still_sees_their_private_projects_fields(published):
+    entries = _entries(key=published["user"]["api_key"])
+    private_row = entries[published["private"]["slug"]]
+    assert private_row["description"] == published["private"]["project"]["description"]
+    assert (
+        private_row["project_url"]
+        == f"/projects/{published['private']['project']['slug']}"
+    )
+
+
+def test_a_stranger_is_treated_like_a_guest(published):
+    stranger, _, user = _member()
+    entries = _entries(session=stranger, key=user["api_key"])
+    assert entries[published["private"]["slug"]]["description"] == ""
+    assert entries[published["private"]["slug"]]["project_url"] == ""
+
+
+def test_the_table_carries_a_report_control_column(published):
+    reporter, _, _ = _member()
+    html = reporter.get(f"{BASE_URL}/workspaces/index").text
+    assert '<th scope="col">Report</th>' in html
+    assert 'data-report-type="workspace"' in html
+    assert f'data-report-uid="{published["public"]["uid"]}"' in html
+    assert "css/admin.css" in html
+    assert 'class="admin-table"' in html
diff --git a/tests/api/xmlrpc/index.py b/tests/api/xmlrpc/index.py
index 02aa5407..28342791 100644
--- a/tests/api/xmlrpc/index.py
+++ b/tests/api/xmlrpc/index.py
@@ -85,6 +85,8 @@ def _api_key():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/zips/download.py b/tests/api/zips/download.py
index c7c203fd..cebf022d 100644
--- a/tests/api/zips/download.py
+++ b/tests/api/zips/download.py
@@ -25,6 +25,8 @@ def _signup_zip_download():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/api/zips/index.py b/tests/api/zips/index.py
index cf574f1d..6bc0c8f1 100644
--- a/tests/api/zips/index.py
+++ b/tests/api/zips/index.py
@@ -25,6 +25,8 @@ def _signup_zip_download():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/conftest.py b/tests/conftest.py
index ef1386d5..9d78ac5b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -254,6 +254,8 @@ def signup_user(page, user):
     page.fill("#email", user["email"])
     page.fill("#password", user["password"])
     page.fill("#confirm_password", user["password"])
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
@@ -305,6 +307,8 @@ def seeded_db(app_server):
                 "email": email,
                 "password": pw,
                 "confirm_password": pw,
+                "birth_date": "1990-01-01",
+                "accept_terms": "1",
             }
         ).encode()
         req = urllib.request.Request(
diff --git a/tests/e2e/admin/aiquota/resetall.py b/tests/e2e/admin/aiquota/resetall.py
index ca726dff..08ac78e2 100644
--- a/tests/e2e/admin/aiquota/resetall.py
+++ b/tests/e2e/admin/aiquota/resetall.py
@@ -40,6 +40,7 @@ def _make_user_devii_quota(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": generate_uid(),
             "role": role,
diff --git a/tests/e2e/admin/aiusage/data.py b/tests/e2e/admin/aiusage/data.py
index 14d9b2e8..7036149c 100644
--- a/tests/e2e/admin/aiusage/data.py
+++ b/tests/e2e/admin/aiusage/data.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/aiusage/index.py b/tests/e2e/admin/aiusage/index.py
index 9e443b3c..a9a6f890 100644
--- a/tests/e2e/admin/aiusage/index.py
+++ b/tests/e2e/admin/aiusage/index.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/analytics.py b/tests/e2e/admin/analytics.py
index 5c3b01ab..844fc3dd 100644
--- a/tests/e2e/admin/analytics.py
+++ b/tests/e2e/admin/analytics.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/auditlog.py b/tests/e2e/admin/auditlog.py
index 60f2f5cb..1245f70e 100644
--- a/tests/e2e/admin/auditlog.py
+++ b/tests/e2e/admin/auditlog.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -111,6 +113,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/admin/backups/index.py b/tests/e2e/admin/backups/index.py
index 23ab7e27..bd05a5bb 100644
--- a/tests/e2e/admin/backups/index.py
+++ b/tests/e2e/admin/backups/index.py
@@ -27,6 +27,8 @@ def _make_admin():
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/admin/containers/manage.py b/tests/e2e/admin/containers/manage.py
index 24e0a37e..2a201f44 100644
--- a/tests/e2e/admin/containers/manage.py
+++ b/tests/e2e/admin/containers/manage.py
@@ -25,6 +25,8 @@ def _make_admin():
             "email": f"{name}@t.dev",
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/admin/index.py b/tests/e2e/admin/index.py
index 4d160943..ea1d0ab8 100644
--- a/tests/e2e/admin/index.py
+++ b/tests/e2e/admin/index.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/media.py b/tests/e2e/admin/media.py
index 101b98d9..331cdf36 100644
--- a/tests/e2e/admin/media.py
+++ b/tests/e2e/admin/media.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/news.py b/tests/e2e/admin/news.py
index 0863979e..674b621b 100644
--- a/tests/e2e/admin/news.py
+++ b/tests/e2e/admin/news.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/settings.py b/tests/e2e/admin/settings.py
index cb7ea512..a9d692cd 100644
--- a/tests/e2e/admin/settings.py
+++ b/tests/e2e/admin/settings.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/admin/users/aiusage.py b/tests/e2e/admin/users/aiusage.py
index ce9f6e48..3f81b70e 100644
--- a/tests/e2e/admin/users/aiusage.py
+++ b/tests/e2e/admin/users/aiusage.py
@@ -26,6 +26,7 @@ def _make_user_ai_usage_profile(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": api_key,
             "role": role,
diff --git a/tests/e2e/admin/users/index.py b/tests/e2e/admin/users/index.py
index 102c25e2..74793663 100644
--- a/tests/e2e/admin/users/index.py
+++ b/tests/e2e/admin/users/index.py
@@ -42,6 +42,7 @@ def seed_extra_users(count=30):
             {
                 "uid": uid,
                 "username": f"pagu_{i:04d}",
+                "terms_version": "1",
                 "email": f"pagu{i:04d}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -55,6 +56,7 @@ def _seed_target_user():
         {
             "uid": uid,
             "username": f"target_{uid[:8]}",
+            "terms_version": "1",
             "email": f"target_{uid[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -111,6 +113,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -194,6 +198,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -296,6 +302,8 @@ def test_admin_users_pagination(alice):
                 "email": f"pagu{i:04d}@test.devplace",
                 "password": "testpass123",
                 "confirm_password": "testpass123",
+                "birth_date": "1990-01-01",
+                "accept_terms": "1",
             }
         ).encode()
         try:
diff --git a/tests/e2e/ai/usage/profile.py b/tests/e2e/ai/usage/profile.py
index ed09d256..3842bcf1 100644
--- a/tests/e2e/ai/usage/profile.py
+++ b/tests/e2e/ai/usage/profile.py
@@ -26,6 +26,7 @@ def _make_user_ai_usage_profile(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": api_key,
             "role": role,
diff --git a/tests/e2e/auth/login.py b/tests/e2e/auth/login.py
index 78a9908b..892ebe44 100644
--- a/tests/e2e/auth/login.py
+++ b/tests/e2e/auth/login.py
@@ -46,6 +46,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/auth/logout.py b/tests/e2e/auth/logout.py
index 1bf94b33..df242984 100644
--- a/tests/e2e/auth/logout.py
+++ b/tests/e2e/auth/logout.py
@@ -15,6 +15,8 @@ def test_login_success(page, app_server):
     page.fill("#email", "login@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
@@ -34,6 +36,8 @@ def test_login_wrong_password(page, app_server):
     page.fill("#email", "wrongpw@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
@@ -52,6 +56,8 @@ def test_login_remember_me(page, app_server):
     page.fill("#email", "remember@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
@@ -72,6 +78,8 @@ def test_logout(page, app_server):
     page.fill("#email", "logout@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
diff --git a/tests/e2e/auth/resetpassword.py b/tests/e2e/auth/resetpassword.py
index 2c151ef1..6ba0bdea 100644
--- a/tests/e2e/auth/resetpassword.py
+++ b/tests/e2e/auth/resetpassword.py
@@ -35,6 +35,7 @@ def test_reset_password_full_flow(page, app_server):
         {
             "uid": uid,
             "username": uname,
+            "terms_version": "1",
             "email": email,
             "password_hash": hash_password("oldpass123"),
             "bio": "",
diff --git a/tests/e2e/auth/signup.py b/tests/e2e/auth/signup.py
index 4f7020cf..9d947b6f 100644
--- a/tests/e2e/auth/signup.py
+++ b/tests/e2e/auth/signup.py
@@ -69,6 +69,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -211,6 +212,8 @@ def test_signup_success(page, app_server):
     page.fill("#email", "fresh@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
     assert page.is_visible("text=fresh_user")
@@ -222,6 +225,8 @@ def test_signup_existing_username(page, app_server):
     page.fill("#email", "dup1@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
@@ -231,6 +236,8 @@ def test_signup_existing_username(page, app_server):
     page.fill("#email", "dup2@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     expect(page.locator("text=Username already taken")).to_be_visible()
 
@@ -241,6 +248,8 @@ def test_signup_existing_email(page, app_server):
     page.fill("#email", "sameemail@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
 
@@ -250,6 +259,8 @@ def test_signup_existing_email(page, app_server):
     page.fill("#email", "sameemail@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     expect(page.locator("text=Email already registered")).to_be_visible()
 
@@ -260,6 +271,8 @@ def test_signup_password_mismatch(page, app_server):
     page.fill("#email", "mismatch@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "different456")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     expect(page.locator("text=Passwords do not match")).to_be_visible()
 
@@ -270,6 +283,8 @@ def test_signup_short_password(page, app_server):
     page.fill("#email", "shortpw@test.devplace")
     page.fill("#password", "ab")
     page.fill("#confirm_password", "ab")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     expect(page.locator("text=Password must be at least 6 characters")).to_be_visible()
 
@@ -280,6 +295,8 @@ def test_signup_invalid_username(page, app_server):
     page.fill("#email", "shortname@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     expect(
         page.locator("text=Username must be between 3 and 32 characters")
@@ -316,6 +333,8 @@ def test_landing_authenticated_shows_dashboard(page, app_server):
     page.fill("#email", "home@test.devplace")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     with page.expect_navigation(timeout=10000):
         page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
@@ -346,6 +365,8 @@ def test_registration_closed_blocks_signup(alice):
                 "email": "closed_signup@test.devplace",
                 "password": "secret123",
                 "confirm_password": "secret123",
+                "birth_date": "1990-01-01",
+                "accept_terms": "1",
             },
         )
         assert "Registration is currently closed" in attempt.text
@@ -379,6 +400,8 @@ def test_session_length_setting_applies(alice, browser):
         guest.fill("#email", f"{username}@test.devplace")
         guest.fill("#password", "secret123")
         guest.fill("#confirm_password", "secret123")
+        guest.fill("#birth_date", "1990-01-01")
+        guest.check("#accept_terms")
         guest.click("button:has-text('Create account')")
         guest.wait_for_url("**/feed", wait_until="domcontentloaded")
 
@@ -397,6 +420,8 @@ def test_feed_page_has_unique_title(page, app_server):
     page.fill("#email", "seo_title@test.dev")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
     title = page.title()
@@ -416,6 +441,8 @@ def test_feed_page_has_canonical(page, app_server):
     page.fill("#email", "seo_canon@test.dev")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
     link = page.locator('link[rel="canonical"]')
@@ -429,6 +456,8 @@ def test_feed_page_has_og_tags(page, app_server):
     page.fill("#email", "seo_og@test.dev")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
     og = page.locator('meta[property="og:title"]')
@@ -442,6 +471,8 @@ def test_feed_page_has_twitter_card(page, app_server):
     page.fill("#email", "seo_twit@test.dev")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
     card = page.locator('meta[name="twitter:card"]')
diff --git a/tests/e2e/bookmarks/saved.py b/tests/e2e/bookmarks/saved.py
index 9f2e1057..bf1e43f3 100644
--- a/tests/e2e/bookmarks/saved.py
+++ b/tests/e2e/bookmarks/saved.py
@@ -50,6 +50,8 @@ def _member():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/devii/quota.py b/tests/e2e/devii/quota.py
index a35ce000..4712e26e 100644
--- a/tests/e2e/devii/quota.py
+++ b/tests/e2e/devii/quota.py
@@ -40,6 +40,7 @@ def _make_user_devii_quota(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": generate_uid(),
             "role": role,
diff --git a/tests/e2e/docs.py b/tests/e2e/docs.py
index 7d229d67..6cca55a8 100644
--- a/tests/e2e/docs.py
+++ b/tests/e2e/docs.py
@@ -30,6 +30,8 @@ def _author():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/feed.py b/tests/e2e/feed.py
index d6266087..4c825d07 100644
--- a/tests/e2e/feed.py
+++ b/tests/e2e/feed.py
@@ -52,6 +52,7 @@ def _seed_posts(count):
             {
                 "uid": owner,
                 "username": f"pag_{suite}_{i}",
+                "terms_version": "1",
                 "email": f"{suite}_{i}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -84,6 +85,7 @@ def _seed_post_with_comments(comment_texts, topic="devlog"):
         {
             "uid": owner,
             "username": f"seed_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@seed.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -148,6 +150,7 @@ def _seed_searchable_posts():
             {
                 "uid": owner,
                 "username": f"srch_{owner[:8]}",
+                "terms_version": "1",
                 "email": f"{owner[:8]}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -229,6 +232,8 @@ def _author():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -282,6 +287,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/gists.py b/tests/e2e/gists.py
index 5a09020f..d08370b5 100644
--- a/tests/e2e/gists.py
+++ b/tests/e2e/gists.py
@@ -24,6 +24,8 @@ def _register_session(prefix):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -34,6 +36,7 @@ def _seed_gists(count):
         {
             "uid": owner,
             "username": f"pag_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -99,6 +102,7 @@ def _seed_searchable_gists(language="python"):
         {
             "uid": owner,
             "username": f"gsrch_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -408,6 +412,7 @@ def _seed_gist_with_comments():
         {
             "uid": owner,
             "username": f"gcseed_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@gc.seed",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/media/delete.py b/tests/e2e/media/delete.py
index 2f0fd862..d53a5a91 100644
--- a/tests/e2e/media/delete.py
+++ b/tests/e2e/media/delete.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/messages.py b/tests/e2e/messages.py
index ca114fec..6db1ed4b 100644
--- a/tests/e2e/messages.py
+++ b/tests/e2e/messages.py
@@ -42,6 +42,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/news.py b/tests/e2e/news.py
index 7cacb55b..358793cd 100644
--- a/tests/e2e/news.py
+++ b/tests/e2e/news.py
@@ -101,6 +101,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -322,6 +323,7 @@ def _seed_news_with_comments():
         {
             "uid": owner,
             "username": f"ncseed_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@nc.seed",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/notifications/index.py b/tests/e2e/notifications/index.py
index 5450eff6..9634ba38 100644
--- a/tests/e2e/notifications/index.py
+++ b/tests/e2e/notifications/index.py
@@ -41,6 +41,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -443,7 +444,7 @@ def test_message_notification(app_server, browser, seeded_db):
     msg_input = pb.locator("textarea[name='content']").first
     msg_input.wait_for(state="visible", timeout=10000)
     msg_input.fill("Hello from bob_test!")
-    pb.locator("button[type='submit']").last.click()
+    pb.locator(".messages-input-area button[type='submit']").last.click()
     pb.wait_for_timeout(1500)
 
     pb_body = pb.locator("body").text_content()
@@ -756,7 +757,7 @@ def test_message_notification_click_opens_conversation(app_server, browser, seed
     msg_input = pb.locator("textarea[name='content']").first
     msg_input.wait_for(state="visible", timeout=10000)
     msg_input.fill("Click-through message from bob")
-    pb.locator("button[type='submit']").last.click()
+    pb.locator(".messages-input-area button[type='submit']").last.click()
     pb.wait_for_timeout(1500)
 
     pa.goto(f"{BASE_URL}/notifications", wait_until="domcontentloaded")
diff --git a/tests/e2e/openai/v1/chat/completions.py b/tests/e2e/openai/v1/chat/completions.py
index cb5a1205..539971e2 100644
--- a/tests/e2e/openai/v1/chat/completions.py
+++ b/tests/e2e/openai/v1/chat/completions.py
@@ -83,6 +83,7 @@ def _make_admin_openai_gateway(role="Admin"):
         {
             "uid": generate_uid(),
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": api_key,
             "role": role,
@@ -94,6 +95,13 @@ def _config(page, **fields):
     page.request.post(f"{BASE_URL}/admin/services/openai/config", form=fields)
 
 
+def _grant_ai_consent(page, username):
+    page.request.post(
+        f"{BASE_URL}/profile/{username}/consent",
+        form={"kind": "ai_third_party", "granted": "1"},
+    )
+
+
 def test_gateway_disabled_returns_503(alice):
     page, _ = alice
     page.request.post(f"{BASE_URL}/admin/services/openai/stop")
@@ -130,6 +138,16 @@ def test_gateway_auth_and_routing(alice):
         assert with_key.status_code == 502  # auth passed, upstream unreachable
 
         admin_key = get_table("users").find_one(username=user["username"])["api_key"]
+        no_consent = requests.post(
+            f"{BASE_URL}/openai/v1/chat/completions",
+            headers={"Authorization": f"Bearer {admin_key}"},
+            json={"messages": [{"role": "user", "content": "hi"}]},
+        )
+        assert no_consent.status_code == 403, (
+            "a user's own key must not reach the provider without ai_third_party consent"
+        )
+
+        _grant_ai_consent(page, user["username"])
         with_admin = requests.post(
             f"{BASE_URL}/openai/v1/chat/completions",
             headers={"Authorization": f"Bearer {admin_key}"},
diff --git a/tests/e2e/openai/v1/embeddings.py b/tests/e2e/openai/v1/embeddings.py
index 647e0eaa..b2826c7f 100644
--- a/tests/e2e/openai/v1/embeddings.py
+++ b/tests/e2e/openai/v1/embeddings.py
@@ -9,6 +9,13 @@ def _config(page, **fields):
     page.request.post(f"{BASE_URL}/admin/services/openai/config", form=fields)
 
 
+def _grant_ai_consent(page, username):
+    page.request.post(
+        f"{BASE_URL}/profile/{username}/consent",
+        form={"kind": "ai_third_party", "granted": "1"},
+    )
+
+
 def test_embeddings_disabled_returns_503(alice):
     page, _ = alice
     page.request.post(f"{BASE_URL}/admin/services/openai/stop")
@@ -53,6 +60,7 @@ def test_embeddings_auth_passes_upstream_unreachable(alice):
         assert with_key.status_code == 502
 
         admin_key = get_table("users").find_one(username=user["username"])["api_key"]
+        _grant_ai_consent(page, user["username"])
         with_admin = requests.post(
             f"{BASE_URL}/openai/v1/embeddings",
             headers={"Authorization": f"Bearer {admin_key}"},
diff --git a/tests/e2e/posts/create.py b/tests/e2e/posts/create.py
index 78ec19fa..0ecdef24 100644
--- a/tests/e2e/posts/create.py
+++ b/tests/e2e/posts/create.py
@@ -17,6 +17,8 @@ def _session_comments():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -69,6 +71,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/posts/index.py b/tests/e2e/posts/index.py
index 900936d8..17a03294 100644
--- a/tests/e2e/posts/index.py
+++ b/tests/e2e/posts/index.py
@@ -29,6 +29,7 @@ def _seed_posts(count):
             {
                 "uid": owner,
                 "username": f"pag_{suite}_{i}",
+                "terms_version": "1",
                 "email": f"{suite}_{i}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -61,6 +62,7 @@ def _seed_post_with_comments(comment_texts, topic="devlog"):
         {
             "uid": owner,
             "username": f"seed_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@seed.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -125,6 +127,7 @@ def _seed_searchable_posts():
             {
                 "uid": owner,
                 "username": f"srch_{owner[:8]}",
+                "terms_version": "1",
                 "email": f"{owner[:8]}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -203,6 +206,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -518,6 +522,8 @@ def test_post_page_has_structured_data(page, app_server):
     page.fill("#email", "seo_schema@test.dev")
     page.fill("#password", "secret123")
     page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
     page.click("button:has-text('Create account')")
     page.wait_for_url("**/feed", timeout=10000, wait_until="domcontentloaded")
     page.locator(".feed-fab").click()
diff --git a/tests/e2e/profile/block.py b/tests/e2e/profile/block.py
index 29803d96..34703b60 100644
--- a/tests/e2e/profile/block.py
+++ b/tests/e2e/profile/block.py
@@ -29,6 +29,7 @@ def _seed_user(prefix):
         {
             "uid": uid,
             "username": f"{prefix}_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seed.devplace",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/profile/index.py b/tests/e2e/profile/index.py
index 4b5254f8..4be2a835 100644
--- a/tests/e2e/profile/index.py
+++ b/tests/e2e/profile/index.py
@@ -1,120 +1,67 @@
 # retoor <retoor@molodetz.nl>
 
-import re
-from tests.conftest import BASE_URL
-FOLLOW = "form[action='/follow/bob_test'] button"
-UNFOLLOW = "form[action='/follow/unfollow/bob_test'] button"
 from playwright.sync_api import expect
-from tests.e2e.post import create_post
+
+from tests.conftest import BASE_URL
+
+CONSENT = "ai_third_party"
 
 
-def test_profile_shows_online_presence(alice):
-    page, user = alice
+def _privacy_tab(page, username):
     page.goto(
-        f"{BASE_URL}/profile/{user['username']}", wait_until="domcontentloaded"
+        f"{BASE_URL}/profile/{username}?tab=privacy", wait_until="domcontentloaded"
     )
-    presence = page.locator(".profile-presence")
-    expect(presence).to_be_visible()
-    expect(presence).to_have_class(re.compile(r"\bonline\b"))
-    expect(presence).to_have_text("online")
+    page.locator(".privacy-panel").wait_for(state="visible")
 
 
-def test_nav_avatar_shows_online_presence_dot(alice):
-    page, _ = alice
-    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
-    nav_dot = page.locator(".topnav-user .presence-dot")
-    expect(nav_dot).to_be_visible()
-    expect(nav_dot).to_have_class(re.compile(r"\bonline\b"))
+def test_the_owner_toggles_a_consent_from_the_privacy_tab(bob):
+    page, user = bob
+    _privacy_tab(page, user["username"])
+    row = page.locator(f".privacy-panel tr:has(input[value='{CONSENT}'])")
+    button = row.locator("button[type='submit']")
+    original = (button.inner_text() or "").strip()
+    flipped = "Withdraw" if original == "Grant" else "Grant"
+    try:
+        button.click()
+        expect(row.locator("button[type='submit']")).to_have_text(
+            flipped, timeout=10000
+        )
+    finally:
+        _privacy_tab(page, user["username"])
+        if (row.locator("button[type='submit']").inner_text() or "").strip() != original:
+            row.locator("button[type='submit']").click()
+            expect(row.locator("button[type='submit']")).to_have_text(
+                original, timeout=10000
+            )
 
 
-def _post_comment(page, body):
-    textarea = page.locator(".comment-form textarea[name='content']")
-    textarea.fill(body)
-    page.locator(".comment-form button:has-text('Post')").click()
-    expect(page.locator(f".comment-text:has-text('{body}')")).to_be_visible()
-
-
-def test_activity_comment_card_links_to_parent_post(alice):
-    page, user = alice
-    create_post(page, "devlog", "Post for activity comment link")
-    post_url = page.url
-    _post_comment(page, "Activity clickable comment body")
-
-    page.goto(
-        f"{BASE_URL}/profile/{user['username']}?tab=activity",
-        wait_until="domcontentloaded",
-    )
-    card_link = page.locator(
-        ".activity-card.card-link-host a.card-link[href*='#comment-']"
-    ).first
-    expect(card_link).to_have_count(1)
-    href = card_link.get_attribute("href")
-    assert "/posts/" in href and "#comment-" in href
-
-    card_link.click()
-    page.wait_for_url("**/posts/**", wait_until="domcontentloaded")
+def test_the_owner_sees_every_privacy_control(bob):
+    page, user = bob
+    _privacy_tab(page, user["username"])
+    panel = page.locator(".privacy-panel")
+    expect(panel.locator(f"form[action='/profile/{user['username']}/consent']").first).to_be_attached()
     expect(
-        page.locator(".comment-text:has-text('Activity clickable comment body')")
+        panel.locator(f"form[action='/profile/{user['username']}/mature-content']")
     ).to_be_visible()
+    expect(panel.locator("a:has-text('Delete account')")).to_be_visible()
 
 
-def test_activity_post_card_links_to_post(alice):
-    page, user = alice
-    create_post(page, "showcase", "Post for activity post link", title="Activity Post Title")
+def test_an_admin_reads_the_state_but_gets_no_privacy_controls(alice, seeded_db):
+    admin_page, _ = alice
+    member = seeded_db["bob"]
+    _privacy_tab(admin_page, member["username"])
+    panel = admin_page.locator(".privacy-panel")
+    expect(panel).to_contain_text("Only the account holder can change this.")
+    expect(panel).to_contain_text("Only the account holder can change this preference.")
+    expect(panel.locator("form[action$='/consent']")).to_have_count(0)
+    expect(panel.locator("form[action$='/mature-content']")).to_have_count(0)
+    expect(panel.locator("a:has-text('Delete account')")).to_have_count(0)
 
+
+def test_a_stranger_never_reaches_the_privacy_panel(bob):
+    page, _ = bob
     page.goto(
-        f"{BASE_URL}/profile/{user['username']}?tab=activity",
-        wait_until="domcontentloaded",
+        f"{BASE_URL}/profile/alice_test?tab=privacy", wait_until="domcontentloaded"
     )
-    post_link = page.locator(
-        ".activity-card.card-link-host a.card-link[href^='/posts/']:not([href*='#comment-'])"
-    ).first
-    expect(post_link).to_have_count(1)
-    post_link.click()
-    page.wait_for_url("**/posts/**", wait_until="domcontentloaded")
-    expect(page.locator(".post-detail-title:has-text('Activity Post Title')")).to_be_visible()
-
-
-def test_activity_inner_content_link_stays_clickable(alice, bob):
-    page, user = alice
-    create_post(page, "random", "Post for activity mention comment")
-    _post_comment(page, "Ping @bob_test in activity")
-
-    page.goto(
-        f"{BASE_URL}/profile/{user['username']}?tab=activity",
-        wait_until="domcontentloaded",
-    )
-    mention = page.locator(
-        ".activity-card.card-link-host .activity-content a[href='/profile/bob_test']"
-    ).first
-    expect(mention).to_have_count(1)
-    mention.click()
-    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
-
-
-def test_follow_then_unfollow(alice):
-    page, _ = alice
-    page.goto(f"{BASE_URL}/profile/bob_test", wait_until="domcontentloaded")
-    if page.is_visible(UNFOLLOW):
-        page.click(UNFOLLOW)
-        page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
-    assert page.is_visible(FOLLOW)
-    page.click(FOLLOW)
-    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
-    assert page.is_visible(UNFOLLOW)
-    page.click(UNFOLLOW)
-    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
-    assert page.is_visible(FOLLOW)
-
-
-def test_profile_viewing_other_user(bob, alice):
-    page_b, user_b = bob
-    page_b.goto(f"{BASE_URL}/profile/alice_test", wait_until="domcontentloaded")
-    assert page_b.is_visible("text=alice_test")
-
-
-def test_profile_message_button(bob, alice):
-    page_b, _ = bob
-    page_b.goto(f"{BASE_URL}/profile/alice_test", wait_until="domcontentloaded")
-    message_btn = page_b.locator("a:has-text('Send Message')")
-    assert message_btn.is_visible()
+    expect(page.locator(".privacy-panel")).to_have_count(0)
+    expect(page.locator("form[action='/profile/alice_test/consent']")).to_have_count(0)
diff --git a/tests/e2e/profile/search.py b/tests/e2e/profile/search.py
index 6d04af92..6a23556c 100644
--- a/tests/e2e/profile/search.py
+++ b/tests/e2e/profile/search.py
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
             "email": email,
             "password": password,
             "confirm_password": password,
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -67,6 +69,8 @@ def _register_session(prefix):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -77,6 +81,7 @@ def _seed_gists(count):
         {
             "uid": owner,
             "username": f"pag_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -142,6 +147,7 @@ def _seed_searchable_gists(language="python"):
         {
             "uid": owner,
             "username": f"gsrch_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -189,6 +195,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -320,6 +328,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/project/files.py b/tests/e2e/project/files.py
index 3b4878bf..b84fe66d 100644
--- a/tests/e2e/project/files.py
+++ b/tests/e2e/project/files.py
@@ -17,6 +17,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/projects/devlog.py b/tests/e2e/projects/devlog.py
index 9d965c93..08850f5b 100644
--- a/tests/e2e/projects/devlog.py
+++ b/tests/e2e/projects/devlog.py
@@ -15,6 +15,7 @@ def _seed_project():
         {
             "uid": owner,
             "username": f"dlowner_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@dl.test",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/e2e/projects/files.py b/tests/e2e/projects/files.py
index 88740c9d..6d00e88e 100644
--- a/tests/e2e/projects/files.py
+++ b/tests/e2e/projects/files.py
@@ -17,6 +17,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -133,6 +135,8 @@ def _signup_zip_download():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/projects/index.py b/tests/e2e/projects/index.py
index f5157d3f..0b0a2763 100644
--- a/tests/e2e/projects/index.py
+++ b/tests/e2e/projects/index.py
@@ -19,6 +19,7 @@ def _seed_posts(count):
             {
                 "uid": owner,
                 "username": f"pag_{suite}_{i}",
+                "terms_version": "1",
                 "email": f"{suite}_{i}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -51,6 +52,7 @@ def _seed_post_with_comments(comment_texts, topic="devlog"):
         {
             "uid": owner,
             "username": f"seed_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@seed.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -115,6 +117,7 @@ def _seed_searchable_posts():
             {
                 "uid": owner,
                 "username": f"srch_{owner[:8]}",
+                "terms_version": "1",
                 "email": f"{owner[:8]}@test.devplace",
                 "password_hash": "x",
                 "role": "Member",
@@ -155,6 +158,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -256,6 +261,7 @@ def _seed_projects(count):
         {
             "uid": owner,
             "username": f"pag_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@test.devplace",
             "password_hash": "x",
             "role": "Member",
@@ -323,6 +329,8 @@ def _signup_zip_download():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -871,6 +879,7 @@ def _seed_project_with_comments():
         {
             "uid": owner,
             "username": f"pcseed_{owner[:8]}",
+            "terms_version": "1",
             "email": f"{owner[:8]}@pc.seed",
             "password_hash": "x",
             "role": "Member",
@@ -954,6 +963,8 @@ def _signup_containers_menu(prefix):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/quizzes/index.py b/tests/e2e/quizzes/index.py
index f6ff8538..ccb48333 100644
--- a/tests/e2e/quizzes/index.py
+++ b/tests/e2e/quizzes/index.py
@@ -26,6 +26,8 @@ def _seed_quiz(title="Hub e2e quiz"):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/quizzes/play.py b/tests/e2e/quizzes/play.py
index 2790c79c..e6e59213 100644
--- a/tests/e2e/quizzes/play.py
+++ b/tests/e2e/quizzes/play.py
@@ -38,6 +38,8 @@ def _author_quiz(title, questions=(CHOICE, NUMERIC), **settings):
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/e2e/reports/__init__.py b/tests/e2e/reports/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/e2e/reports/ui.py b/tests/e2e/reports/ui.py
new file mode 100644
index 00000000..481a2998
--- /dev/null
+++ b/tests/e2e/reports/ui.py
@@ -0,0 +1,170 @@
+# retoor <retoor@molodetz.nl>
+
+from playwright.sync_api import expect
+
+from devplacepy.database import get_table, refresh_snapshot
+from tests.conftest import BASE_URL
+
+
+def _create_post(page, content):
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    page.locator(".feed-fab").first.wait_for(state="visible", timeout=10000)
+    page.locator(".feed-fab").first.click()
+    page.fill("#post-content", content)
+    page.locator("#create-post-modal button.btn-primary:has-text('Post')").click()
+    page.wait_for_url(f"{BASE_URL}/posts/*", wait_until="domcontentloaded")
+    return page.url.rsplit("/", 1)[-1]
+
+
+def test_the_report_control_is_present_on_the_feed_and_a_post(alice, bob):
+    alice_page, _ = alice
+    bob_page, _ = bob
+    _create_post(alice_page, "A post that another member can report from the feed.")
+
+    bob_page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    expect(bob_page.locator(".report-btn").first).to_be_visible()
+    expect(bob_page.locator(".block-btn").first).to_be_attached()
+
+
+def test_the_report_control_is_absent_on_your_own_content(alice):
+    page, _ = alice
+    slug = _create_post(page, "A post whose author must not see a report control.")
+    page.goto(f"{BASE_URL}/posts/{slug}", wait_until="domcontentloaded")
+    expect(page.locator(".post-detail-actions .report-btn")).to_have_count(0)
+
+
+def test_reporting_a_post_end_to_end_through_the_dialog(alice, bob):
+    alice_page, _ = alice
+    bob_page, _ = bob
+    slug = _create_post(alice_page, "A post reported end to end through the dialog.")
+
+    bob_page.goto(f"{BASE_URL}/posts/{slug}", wait_until="domcontentloaded")
+    bob_page.locator(".report-btn").first.click()
+
+    dialog = bob_page.locator("#report-dialog")
+    dialog.wait_for(state="visible")
+    bob_page.select_option("#report-reason", "harassment")
+    bob_page.fill("#report-detail", "Reported by the end-to-end test.")
+    bob_page.locator("#report-form button[type='submit']").click()
+
+    expect(bob_page.locator("dp-toast")).to_contain_text("Report received", timeout=8000)
+
+    bob_page.goto(f"{BASE_URL}/reports/mine", wait_until="domcontentloaded")
+    expect(bob_page.locator("table")).to_contain_text("Harassment")
+
+
+def test_the_admin_queue_shows_the_report_and_its_sla_badge(alice, bob):
+    alice_page, _ = alice
+    bob_page, _ = bob
+    slug = _create_post(alice_page, "A post that must appear in the moderation queue.")
+
+    bob_page.goto(f"{BASE_URL}/posts/{slug}", wait_until="domcontentloaded")
+    bob_page.locator(".report-btn").first.click()
+    bob_page.locator("#report-dialog").wait_for(state="visible")
+    bob_page.select_option("#report-reason", "spam")
+    bob_page.locator("#report-form button[type='submit']").click()
+    expect(bob_page.locator("dp-toast")).to_contain_text("Report received", timeout=8000)
+
+    alice_page.goto(f"{BASE_URL}/admin/moderation", wait_until="domcontentloaded")
+    expect(alice_page.locator(".sla-badge")).to_be_visible()
+    expect(alice_page.locator(".admin-table")).to_contain_text("Spam")
+
+
+def test_the_report_dialog_lists_every_reason(alice):
+    from devplacepy.database import REPORT_REASONS
+
+    page, _ = alice
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    options = page.locator("#report-reason option")
+    assert options.count() == len(REPORT_REASONS)
+
+
+def test_blocking_from_a_content_action_bar_hides_the_author(alice, bob):
+    alice_page, alice_user = alice
+    bob_page, _ = bob
+    marker = "A post that disappears from the feed after a block."
+    _create_post(alice_page, marker)
+
+    bob_page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    expect(bob_page.locator(".post-card").first).to_be_visible()
+
+    bob_page.locator(".block-btn").first.click()
+    bob_page.locator(".dialog-overlay.visible .dialog-confirm").click()
+    bob_page.wait_for_load_state("domcontentloaded")
+
+    bob_page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    assert marker not in bob_page.content()
+
+    bob_page.goto(
+        f"{BASE_URL}/profile/{alice_user['username']}", wait_until="domcontentloaded"
+    )
+    bob_page.locator("button:has-text('Unblock')").first.click()
+    bob_page.locator(".dialog-overlay.visible .dialog-confirm").click()
+    bob_page.wait_for_load_state("domcontentloaded")
+
+
+def test_the_footer_links_every_legal_page(page, app_server):
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    footer = page.locator(".footer-links")
+    for label in ("Terms", "Privacy", "Guidelines", "Contact"):
+        expect(footer.locator(f"a:has-text('{label}')")).to_be_visible()
+
+
+def test_the_legal_pages_render_for_a_guest(page, app_server):
+    for slug in (
+        "terms",
+        "community-guidelines",
+        "privacy",
+        "contact",
+        "content-moderation",
+        "intellectual-property",
+    ):
+        page.goto(f"{BASE_URL}/docs/{slug}.html", wait_until="domcontentloaded")
+        expect(page.locator("h1").first).to_be_visible()
+
+
+def test_the_admin_operations_page_is_hidden_from_a_guest(page, app_server):
+    page.goto(
+        f"{BASE_URL}/docs/moderation-operations.html", wait_until="domcontentloaded"
+    )
+    assert "not found" in page.content().lower()
+
+
+def test_the_admin_operations_page_renders_for_an_admin(alice):
+    alice_page, _ = alice
+    alice_page.goto(
+        f"{BASE_URL}/docs/moderation-operations.html", wait_until="domcontentloaded"
+    )
+    expect(alice_page.locator("h1").first).to_be_visible()
+    assert "App review checklist" in alice_page.content()
+
+
+def test_deleting_an_account_through_the_ui_ends_the_login(page, app_server):
+    import time
+
+    name = f"e2edel{int(time.time() * 1000)}"
+    page.goto(f"{BASE_URL}/auth/signup", wait_until="domcontentloaded")
+    page.fill("#username", name)
+    page.fill("#email", f"{name}@t.dev")
+    page.fill("#password", "secret123")
+    page.fill("#confirm_password", "secret123")
+    page.fill("#birth_date", "1990-01-01")
+    page.check("#accept_terms")
+    page.click("button:has-text('Create account')")
+    page.wait_for_url("**/feed", wait_until="domcontentloaded")
+
+    page.goto(f"{BASE_URL}/profile/{name}/delete", wait_until="domcontentloaded")
+    page.fill("#delete-password", "secret123")
+    page.locator("button:has-text('Delete my account')").click()
+    page.locator(".dialog-overlay.visible .dialog-confirm").click()
+    page.wait_for_url(f"{BASE_URL}/", wait_until="domcontentloaded")
+
+    refresh_snapshot()
+    assert get_table("users").find_one(username=name) is None
+
+    page.goto(f"{BASE_URL}/auth/login", wait_until="domcontentloaded")
+    page.fill("#email", f"{name}@t.dev")
+    page.fill("#password", "secret123")
+    page.click("button:has-text('Sign in')")
+    page.wait_for_load_state("domcontentloaded")
+    assert "/feed" not in page.url
diff --git a/tests/e2e/root.py b/tests/e2e/root.py
index 34a3f03b..817b62ce 100644
--- a/tests/e2e/root.py
+++ b/tests/e2e/root.py
@@ -41,6 +41,7 @@ def _seed_owner():
         {
             "uid": uid,
             "username": f"seo_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@seo.test",
             "password_hash": "x",
             "role": "Member",
@@ -193,7 +194,7 @@ def test_landing_features(page, app_server):
     features = [
         "100% Free Forever",
         "Zero Ads",
-        "No Censorship",
+        "No Gatekeeping",
         "No Payments",
     ]
     for feature in features:
diff --git a/tests/unit/cli.py b/tests/unit/cli.py
index 5652e56c..162948a1 100644
--- a/tests/unit/cli.py
+++ b/tests/unit/cli.py
@@ -12,6 +12,7 @@ def _make_user_cli(role="Member"):
         {
             "uid": generate_uid(),
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "role": role,
             "created_at": datetime.now(timezone.utc).isoformat(),
@@ -138,6 +139,7 @@ def test_apikey_backfill_assigns_missing(local_db, capsys):
         {
             "uid": uid,
             "username": f"cli_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@t.dev",
             "role": "Member",
             "created_at": datetime.now(timezone.utc).isoformat(),
diff --git a/tests/unit/content.py b/tests/unit/content.py
index 56d26153..83e3607a 100644
--- a/tests/unit/content.py
+++ b/tests/unit/content.py
@@ -38,6 +38,8 @@ def _signup_project_visibility():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -108,6 +110,7 @@ def _make_user(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "role": role,
             "created_at": datetime.now(timezone.utc).isoformat(),
@@ -156,6 +159,7 @@ def _make_user_at(role, created_at):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "role": role,
             "created_at": created_at.isoformat(),
@@ -385,6 +389,7 @@ def test_enrich_items_attaches_author_and_extras(local_db):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "created_at": datetime.now(timezone.utc).isoformat(),
         }
diff --git a/tests/unit/database.py b/tests/unit/database.py
index 8aba8221..3b495583 100644
--- a/tests/unit/database.py
+++ b/tests/unit/database.py
@@ -21,6 +21,7 @@ def _user_db_helpers():
         {
             "uid": uid,
             "username": f"dbh_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@t.dev",
             "created_at": _now_db_helpers(),
         }
@@ -532,6 +533,7 @@ def test_get_uids_by_username_match_returns_matching_uids(local_db):
         {
             "uid": target,
             "username": "searchablehero",
+            "terms_version": "1",
             "created_at": _now_db_helpers(),
         }
     )
@@ -548,6 +550,7 @@ def test_text_search_clause_matches_author_username(local_db):
         {
             "uid": author,
             "username": "authorquery",
+            "terms_version": "1",
             "created_at": _now_db_helpers(),
         }
     )
@@ -570,6 +573,7 @@ def test_text_search_clause_without_author_field_ignores_username(local_db):
         {
             "uid": author,
             "username": "lonelyauthor",
+            "terms_version": "1",
             "created_at": _now_db_helpers(),
         }
     )
diff --git a/tests/unit/database/awards.py b/tests/unit/database/awards.py
index 56d45c1c..216112d6 100644
--- a/tests/unit/database/awards.py
+++ b/tests/unit/database/awards.py
@@ -28,6 +28,7 @@ def _user(prefix="award"):
         {
             "uid": uid,
             "username": f"{prefix}_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@t.dev",
             "created_at": datetime.now(timezone.utc).isoformat(),
             "award_count": 0,
diff --git a/tests/unit/database/moderation.py b/tests/unit/database/moderation.py
new file mode 100644
index 00000000..3d216427
--- /dev/null
+++ b/tests/unit/database/moderation.py
@@ -0,0 +1,131 @@
+# retoor <retoor@molodetz.nl>
+
+from datetime import date
+
+import pytest
+
+from devplacepy.database import (
+    AGE_BANDS,
+    MATURITY_TARGETS,
+    REPORTABLE_TARGETS,
+    REPORT_REASONS,
+    SOFT_DELETE_TABLES,
+    UNREPORTABLE_TABLES,
+    age_band_for,
+    years_between,
+)
+from devplacepy.database.moderation import MODERATION_TABLES
+
+
+GUIDELINE_REASONS = (
+    "hate",
+    "violence",
+    "weapons",
+    "sexual",
+    "religious",
+    "misinformation",
+    "exploitative",
+)
+
+
+def test_every_visible_soft_delete_table_is_reportable():
+    reportable_tables = set(REPORTABLE_TARGETS.values())
+    excluded = set(UNREPORTABLE_TABLES) | set(MODERATION_TABLES)
+    unclassified = [
+        table
+        for table in SOFT_DELETE_TABLES
+        if table not in reportable_tables and table not in excluded
+    ]
+    assert unclassified == []
+
+
+def test_exclusion_list_only_names_real_soft_delete_tables():
+    unknown = [table for table in UNREPORTABLE_TABLES if table not in SOFT_DELETE_TABLES]
+    assert unknown == []
+
+
+def test_registry_tables_are_unique_and_maturity_is_a_subset():
+    assert len(set(REPORTABLE_TARGETS.values())) == len(REPORTABLE_TARGETS)
+    assert MATURITY_TARGETS <= set(REPORTABLE_TARGETS)
+
+
+def test_report_reasons_cover_every_guideline_category():
+    for reason in GUIDELINE_REASONS:
+        assert reason in REPORT_REASONS
+    assert REPORT_REASONS["intellectual_property"]
+    assert REPORT_REASONS["other"]
+
+
+def test_every_registry_target_resolves_to_a_url(local_db):
+    from devplacepy.database import resolve_object_url
+
+    for target_type in REPORTABLE_TARGETS:
+        url = resolve_object_url(target_type, "missing-uid")
+        assert url.startswith("/")
+
+
+def test_resolve_object_url_points_at_the_owning_surface(local_db):
+    from devplacepy.database import get_table, resolve_object_url
+
+    get_table("users").insert(
+        {"uid": "mod-user-1", "username": "mod_user_1", "deleted_at": None}
+    )
+    get_table("messages").insert(
+        {
+            "uid": "mod-msg-1",
+            "sender_uid": "mod-user-1",
+            "receiver_uid": "mod-user-2",
+            "content": "hello",
+        }
+    )
+    try:
+        assert resolve_object_url("user", "mod-user-1") == "/profile/mod_user_1"
+        assert (
+            resolve_object_url("message", "mod-msg-1")
+            == "/messages?with_uid=mod-user-1"
+        )
+        assert resolve_object_url("devii_output", "anything") == "/devii"
+    finally:
+        get_table("users").delete(uid="mod-user-1")
+        get_table("messages").delete(uid="mod-msg-1")
+
+
+@pytest.mark.parametrize(
+    "age,expected",
+    [
+        (0, "under_min"),
+        (12, "under_min"),
+        (13, "13_15"),
+        (15, "13_15"),
+        (16, "16_17"),
+        (17, "16_17"),
+        (18, "adult"),
+        (120, "adult"),
+    ],
+)
+def test_age_band_boundaries(age, expected):
+    assert age_band_for(age) == expected
+
+
+def test_age_band_is_monotonic_across_the_whole_domain():
+    order = {band: index for index, band in enumerate(AGE_BANDS)}
+    previous = -1
+    for age in range(0, 150):
+        current = order[age_band_for(age)]
+        assert current >= previous
+        previous = current
+
+
+def test_years_between_handles_leap_days_and_exact_boundaries():
+    assert years_between(date(2000, 2, 29), date(2018, 2, 28)) == 17
+    assert years_between(date(2000, 2, 29), date(2018, 3, 1)) == 18
+    assert years_between(date(2008, 1, 1), date(2026, 1, 1)) == 18
+    assert years_between(date(2008, 1, 2), date(2026, 1, 1)) == 17
+
+
+def test_years_between_never_exceeds_the_calendar_difference():
+    born = date(2005, 6, 15)
+    for offset in range(0, 4000, 7):
+        today = date.fromordinal(born.toordinal() + offset)
+        years = years_between(born, today)
+        assert 0 <= years <= today.year - born.year
diff --git a/tests/unit/database/users.py b/tests/unit/database/users.py
index 9c9c8f91..8b83f024 100644
--- a/tests/unit/database/users.py
+++ b/tests/unit/database/users.py
@@ -8,6 +8,7 @@ def test_primary_admin_ignores_accounts_without_a_signup_time(local_db):
         {
             "uid": "pa-real",
             "username": "pa-real",
+            "terms_version": "1",
             "role": "Admin",
             "created_at": "1990-01-01T00:00:00",
             "deleted_at": None,
@@ -17,6 +18,7 @@ def test_primary_admin_ignores_accounts_without_a_signup_time(local_db):
         {
             "uid": "pa-null",
             "username": "pa-null",
+            "terms_version": "1",
             "role": "Admin",
             "created_at": None,
             "deleted_at": None,
@@ -26,6 +28,7 @@ def test_primary_admin_ignores_accounts_without_a_signup_time(local_db):
         {
             "uid": "pa-blank",
             "username": "pa-blank",
+            "terms_version": "1",
             "role": "Admin",
             "created_at": "",
             "deleted_at": None,
@@ -54,6 +57,7 @@ def test_primary_admin_skips_deactivated_and_deleted_founders(local_db):
             {
                 "uid": uid,
                 "username": uid,
+                "terms_version": "1",
                 "role": "Admin",
                 "created_at": created_at,
                 "is_active": active,
diff --git a/tests/unit/project_files.py b/tests/unit/project_files.py
index 9ecdcf31..f90f49b2 100644
--- a/tests/unit/project_files.py
+++ b/tests/unit/project_files.py
@@ -28,6 +28,8 @@ def _signup_project_file_lines():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -97,6 +99,8 @@ def _signup_project_files():
             "email": f"{name}@t.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/unit/push.py b/tests/unit/push.py
index 4aefa877..a079099d 100644
--- a/tests/unit/push.py
+++ b/tests/unit/push.py
@@ -13,6 +13,8 @@ def _session_push():
             "email": f"{name}@test.dev",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
diff --git a/tests/unit/routers/admin/users.py b/tests/unit/routers/admin/users.py
index d5f0f5c4..15f3dc8a 100644
--- a/tests/unit/routers/admin/users.py
+++ b/tests/unit/routers/admin/users.py
@@ -1,6 +1,6 @@
 # retoor <retoor@molodetz.nl>
 
-from devplacepy.routers.admin.users import _is_senior_admin, _seniority_key
+from devplacepy.routers.admin._shared import is_senior_admin, seniority_key
 
 SENIOR_ADMIN = {
     "uid": "senior",
@@ -23,39 +23,39 @@ OLD_MEMBER = {
 
 
 def test_junior_admin_cannot_manage_senior_admin():
-    assert _is_senior_admin(JUNIOR_ADMIN, SENIOR_ADMIN) is True
+    assert is_senior_admin(JUNIOR_ADMIN, SENIOR_ADMIN) is True
 
 
 def test_senior_admin_can_manage_junior_admin():
-    assert _is_senior_admin(SENIOR_ADMIN, JUNIOR_ADMIN) is False
+    assert is_senior_admin(SENIOR_ADMIN, JUNIOR_ADMIN) is False
 
 
 def test_members_are_never_protected():
-    assert _is_senior_admin(JUNIOR_ADMIN, OLD_MEMBER) is False
-    assert _is_senior_admin(SENIOR_ADMIN, OLD_MEMBER) is False
+    assert is_senior_admin(JUNIOR_ADMIN, OLD_MEMBER) is False
+    assert is_senior_admin(SENIOR_ADMIN, OLD_MEMBER) is False
 
 
 def test_acting_on_self_is_not_protected():
-    assert _is_senior_admin(SENIOR_ADMIN, SENIOR_ADMIN) is False
-    assert _is_senior_admin(JUNIOR_ADMIN, JUNIOR_ADMIN) is False
+    assert is_senior_admin(SENIOR_ADMIN, SENIOR_ADMIN) is False
+    assert is_senior_admin(JUNIOR_ADMIN, JUNIOR_ADMIN) is False
 
 
 def test_none_target_is_not_protected():
-    assert _is_senior_admin(SENIOR_ADMIN, None) is False
+    assert is_senior_admin(SENIOR_ADMIN, None) is False
 
 
 def test_equal_created_at_tiebreaks_on_id():
     earlier = {"uid": "e1", "role": "Admin", "created_at": "2024-01-01T00:00:00", "id": 3}
     later = {"uid": "e2", "role": "Admin", "created_at": "2024-01-01T00:00:00", "id": 5}
-    assert _is_senior_admin(later, earlier) is True
-    assert _is_senior_admin(earlier, later) is False
+    assert is_senior_admin(later, earlier) is True
+    assert is_senior_admin(earlier, later) is False
 
 
 def test_missing_created_at_sorts_oldest_failsafe():
     no_date = {"uid": "nc", "role": "Admin", "created_at": None, "id": 2}
-    assert _is_senior_admin(SENIOR_ADMIN, no_date) is True
+    assert is_senior_admin(SENIOR_ADMIN, no_date) is True
 
 
 def test_seniority_key_orders_by_created_at_then_id():
-    assert _seniority_key(SENIOR_ADMIN) < _seniority_key(JUNIOR_ADMIN)
-    assert _seniority_key({"created_at": None, "id": 0}) == ("", 0)
+    assert seniority_key(SENIOR_ADMIN) < seniority_key(JUNIOR_ADMIN)
+    assert seniority_key({"created_at": None, "id": 0}) == ("", 0)
diff --git a/tests/unit/routers/workspaces.py b/tests/unit/routers/workspaces.py
new file mode 100644
index 00000000..35c4e3f5
--- /dev/null
+++ b/tests/unit/routers/workspaces.py
@@ -0,0 +1,108 @@
+# retoor <retoor@molodetz.nl>
+
+import pytest
+
+from devplacepy.database import get_table
+from devplacepy.routers.workspaces import index_entries
+
+OWNER = "wsidx-owner"
+STRANGER = "wsidx-stranger"
+PUBLIC_PROJECT = "wsidx-public"
+PRIVATE_PROJECT = "wsidx-private"
+
+ROWS = [
+    {
+        "uid": "wsidx-instance-public",
+        "project_uid": PUBLIC_PROJECT,
+        "owner_uid": OWNER,
+        "ingress_slug": "wsidx-pub",
+        "name": "Public workspace",
+    },
+    {
+        "uid": "wsidx-instance-private",
+        "project_uid": PRIVATE_PROJECT,
+        "owner_uid": OWNER,
+        "ingress_slug": "wsidx-priv",
+        "name": "Private workspace",
+    },
+]
+
+
+@pytest.fixture
+def seeded_workspaces(local_db):
+    users = get_table("users")
+    projects = get_table("projects")
+    users.insert({"uid": OWNER, "username": "wsidx_owner", "role": "Member"})
+    users.insert({"uid": STRANGER, "username": "wsidx_stranger", "role": "Member"})
+    projects.insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": PUBLIC_PROJECT,
+            "user_uid": OWNER,
+            "slug": "wsidx-public-project",
+            "title": "Public workspace project",
+            "description": "The public project description.",
+            "is_private": 0,
+        }
+    )
+    projects.insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": PRIVATE_PROJECT,
+            "user_uid": OWNER,
+            "slug": "wsidx-private-project",
+            "title": "Private workspace project",
+            "description": "The private project description.",
+            "is_private": 1,
+        }
+    )
+    yield
+    projects.delete(uid=PUBLIC_PROJECT)
+    projects.delete(uid=PRIVATE_PROJECT)
+    users.delete(uid=OWNER)
+    users.delete(uid=STRANGER)
+
+
+def _by_slug(entries):
+    return {entry["slug"]: entry for entry in entries}
+
+
+def test_every_row_carries_its_uid_and_owner_uid(seeded_workspaces):
+    entries = _by_slug(index_entries(ROWS, None))
+    assert entries["wsidx-pub"]["uid"] == "wsidx-instance-public"
+    assert entries["wsidx-priv"]["uid"] == "wsidx-instance-private"
+    for entry in entries.values():
+        assert entry["owner_uid"] == OWNER
+
+
+def test_a_guest_never_sees_a_private_projects_description_or_url(seeded_workspaces):
+    entries = _by_slug(index_entries(ROWS, None))
+    assert entries["wsidx-pub"]["description"] == "The public project description."
+    assert entries["wsidx-pub"]["project_url"] == "/projects/wsidx-public-project"
+    assert entries["wsidx-priv"]["description"] == ""
+    assert entries["wsidx-priv"]["project_url"] == ""
+
+
+def test_a_stranger_is_treated_exactly_like_a_guest(seeded_workspaces):
+    viewer = {"uid": STRANGER, "username": "wsidx_stranger", "role": "Member"}
+    entries = _by_slug(index_entries(ROWS, viewer))
+    assert entries["wsidx-priv"]["description"] == ""
+    assert entries["wsidx-priv"]["project_url"] == ""
+
+
+def test_the_project_owner_still_sees_their_private_project_fields(seeded_workspaces):
+    viewer = {"uid": OWNER, "username": "wsidx_owner", "role": "Member"}
+    entries = _by_slug(index_entries(ROWS, viewer))
+    assert entries["wsidx-priv"]["description"] == "The private project description."
+    assert entries["wsidx-priv"]["project_url"] == "/projects/wsidx-private-project"
+
+
+def test_a_published_workspace_is_always_listed_with_its_link(seeded_workspaces):
+    entries = _by_slug(index_entries(ROWS, None))
+    assert len(entries) == 2
+    assert entries["wsidx-priv"]["name"] == "Private workspace"
+    assert entries["wsidx-priv"]["url"].endswith("/p/wsidx-priv")
+    assert entries["wsidx-priv"]["owner"] == "wsidx_owner"
+    assert entries["wsidx-priv"]["maturity"] == "general"
diff --git a/tests/unit/schemas.py b/tests/unit/schemas.py
index 045aeb7b..cc8bae63 100644
--- a/tests/unit/schemas.py
+++ b/tests/unit/schemas.py
@@ -21,6 +21,8 @@ def _signup_media(prefix="media"):
             "email": f"{name}@test.devplace",
             "password": "secret123",
             "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
         },
         allow_redirects=True,
     )
@@ -135,6 +137,47 @@ def test_devii_delete_media_is_confirm_gated():
     assert "confirm" in blob
 
 
+def test_admin_report_subject_is_the_redacted_admin_user_model():
+    from devplacepy.schemas import AdminReportOut, AdminUserOut
+
+    annotation = AdminReportOut.model_fields["subject"].annotation
+    assert AdminUserOut in getattr(annotation, "__args__", (annotation,))
+    assert "password_hash" not in AdminUserOut.model_fields
+    assert "api_key" not in AdminUserOut.model_fields
+
+
+def test_accept_terms_page_reports_versions_not_consents():
+    from devplacepy.schemas import AcceptTermsOut
+
+    assert set(AcceptTermsOut.model_fields) == {"terms_version", "accepted_version"}
+    assert "consents" not in AcceptTermsOut.model_fields
+
+
+def test_the_workspace_index_row_carries_its_uid_and_owner():
+    from devplacepy.schemas import WorkspaceIndexItemOut
+
+    for field in ("uid", "owner_uid", "description", "project_url"):
+        assert field in WorkspaceIndexItemOut.model_fields
+
+
+def test_devii_reads_the_account_deletion_page_before_deleting():
+    from devplacepy.services.devii.actions.catalog import ACTIONS
+    from devplacepy.services.devii.actions.dispatcher import (
+        CONFIRM_REQUIRED,
+        confirmation_error,
+    )
+
+    by_name = {action.name: action for action in ACTIONS}
+    reader = by_name["view_account_deletion"]
+    assert reader.method == "GET"
+    assert reader.path == "/profile/{username}/delete"
+    assert "view_account_deletion" not in CONFIRM_REQUIRED
+    assert "delete_my_account" in CONFIRM_REQUIRED
+    assert confirmation_error("delete_my_account", {}) is not None
+    assert confirmation_error("delete_my_account", {"confirm": "true"}) is None
+    assert any(param.name == "confirm" for param in by_name["delete_my_account"].params)
+
+
 def test_game_legacy_out_defaults():
     from devplacepy.schemas import GameLegacyOut
 
diff --git a/tests/unit/services/audit.py b/tests/unit/services/audit.py
index 807dc8fd..77b98324 100644
--- a/tests/unit/services/audit.py
+++ b/tests/unit/services/audit.py
@@ -21,6 +21,7 @@ def _cli_user(role="Member"):
         {
             "uid": generate_uid(),
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": generate_uid(),
             "role": role,
diff --git a/tests/unit/services/containers.py b/tests/unit/services/containers.py
index cb9075e6..f19ebf71 100644
--- a/tests/unit/services/containers.py
+++ b/tests/unit/services/containers.py
@@ -36,6 +36,7 @@ def env(tmp_path, monkeypatch):
         {
             "uid": user["uid"],
             "username": user["username"],
+            "terms_version": "1",
             "email": "ctestadmin@example.com",
             "api_key": generate_uid(),
             "password_hash": "",
@@ -296,6 +297,74 @@ def test_run_as_uid_rejects_unknown_user(env):
         )
 
 
+def _other_member(uid="ctest-u2", username="ctestmember"):
+    users = get_table("users")
+    if not users.find_one(uid=uid):
+        users.insert(
+            {
+                "uid": uid,
+                "username": username,
+                "terms_version": "1",
+                "email": f"{username}@example.com",
+                "api_key": generate_uid(),
+                "password_hash": "",
+                "role": "Member",
+                "is_active": True,
+                "created_at": "2020-01-01T00:00:00+00:00",
+            }
+        )
+    refresh_snapshot()
+    return uid
+
+
+def test_run_as_another_member_needs_their_credential_consent(env):
+    from devplacepy.database import set_consent
+
+    other = _other_member()
+    set_consent("user", other, "container_credentials", False)
+    with pytest.raises(api.ContainerError) as refused:
+        run_async(
+            api.create_instance(
+                env["project"],
+                name="noconsent",
+                run_as_uid=other,
+                autostart=False,
+                actor=("user", env["user"]["uid"]),
+            )
+        )
+    assert "consent" in str(refused.value).lower()
+
+
+def test_run_as_another_member_is_allowed_once_they_consent(env):
+    from devplacepy.database import set_consent
+
+    other = _other_member()
+    set_consent("user", other, "container_credentials", True)
+    instance = run_async(
+        api.create_instance(
+            env["project"],
+            name="withconsent",
+            run_as_uid=other,
+            autostart=False,
+            actor=("user", env["user"]["uid"]),
+        )
+    )
+    assert instance["run_as_uid"] == other
+
+
+def test_run_as_yourself_never_needs_a_consent(env):
+    instance = run_async(
+        api.create_instance(
+            env["project"],
+            name="selfrunas",
+            run_as_uid=env["user"]["uid"],
+            autostart=False,
+            actor=("user", env["user"]["uid"]),
+        )
+    )
+    assert instance["run_as_uid"] == env["user"]["uid"]
+
+
 def test_start_on_boot_pass_forces_running(env):
     inst = _ready_instance(env, name="boot", start_on_boot=True, autostart=False)
     assert inst["desired_state"] == store.DESIRED_STOPPED
diff --git a/tests/unit/services/dbapi/conftest.py b/tests/unit/services/dbapi/conftest.py
index 94e91b5b..f4f8a636 100644
--- a/tests/unit/services/dbapi/conftest.py
+++ b/tests/unit/services/dbapi/conftest.py
@@ -17,6 +17,7 @@ def _seed_dbapi_schema(local_db):
             {
                 "uid": generate_uid(),
                 "username": "dbapi_seed",
+                "terms_version": "1",
                 "email": "seed@dbapi.test",
                 "role": "Member",
                 "xp": 0,
diff --git a/tests/unit/services/devii/config.py b/tests/unit/services/devii/config.py
index 327783f5..d89fe647 100644
--- a/tests/unit/services/devii/config.py
+++ b/tests/unit/services/devii/config.py
@@ -52,6 +52,7 @@ def _make_user_devii_quota(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": generate_uid(),
             "role": role,
diff --git a/tests/unit/services/devii/container/controller.py b/tests/unit/services/devii/container/controller.py
index a262c6b6..e4ed1f0c 100644
--- a/tests/unit/services/devii/container/controller.py
+++ b/tests/unit/services/devii/container/controller.py
@@ -20,6 +20,7 @@ def _make_user_at(role, created_at):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "role": role,
             "created_at": created_at.isoformat(),
diff --git a/tests/unit/services/devii/session.py b/tests/unit/services/devii/session.py
index f3ea567c..41131003 100644
--- a/tests/unit/services/devii/session.py
+++ b/tests/unit/services/devii/session.py
@@ -87,6 +87,7 @@ def test_scheduled_tasks_only_ever_resolve_a_main_channel_session(local_db):
             {
                 "uid": "sess-docs-sched",
                 "username": "sched-owner",
+                "terms_version": "1",
                 "role": "Admin",
                 "api_key": "k",
                 "deleted_at": None,
@@ -144,6 +145,7 @@ def _task_session(local_db, uid, role):
         {
             "uid": uid,
             "username": uid,
+            "terms_version": "1",
             "role": role,
             "api_key": "k",
             "deleted_at": None,
diff --git a/tests/unit/services/devii/tasks/context.py b/tests/unit/services/devii/tasks/context.py
index 74926320..ab197c69 100644
--- a/tests/unit/services/devii/tasks/context.py
+++ b/tests/unit/services/devii/tasks/context.py
@@ -17,6 +17,7 @@ def _account(local_db, role):
         {
             "uid": uid,
             "username": f"ctx-{uid[-10:]}",
+            "terms_version": "1",
             "role": role,
             "deleted_at": None,
             "created_at": SIGNUP_AFTER_PRIMARY_ADMIN,
diff --git a/tests/unit/services/devii/tasks/guards.py b/tests/unit/services/devii/tasks/guards.py
index 2d3e3c54..318252be 100644
--- a/tests/unit/services/devii/tasks/guards.py
+++ b/tests/unit/services/devii/tasks/guards.py
@@ -33,6 +33,7 @@ def _account(local_db, role):
         {
             "uid": uid,
             "username": f"guard-{uid[-10:]}",
+            "terms_version": "1",
             "role": role,
             "deleted_at": None,
             "created_at": SIGNUP_AFTER_PRIMARY_ADMIN,
diff --git a/tests/unit/services/devii/tasks/limits.py b/tests/unit/services/devii/tasks/limits.py
index f40c1271..e9edce45 100644
--- a/tests/unit/services/devii/tasks/limits.py
+++ b/tests/unit/services/devii/tasks/limits.py
@@ -16,6 +16,7 @@ def _account(local_db, role):
         {
             "uid": uid,
             "username": f"lim-{uid[-10:]}",
+            "terms_version": "1",
             "role": role,
             "deleted_at": None,
             "created_at": SIGNUP_AFTER_PRIMARY_ADMIN,
diff --git a/tests/unit/services/devii/tasks/scheduler.py b/tests/unit/services/devii/tasks/scheduler.py
index 292b5821..c108a976 100644
--- a/tests/unit/services/devii/tasks/scheduler.py
+++ b/tests/unit/services/devii/tasks/scheduler.py
@@ -28,6 +28,7 @@ def _account(local_db, role):
         {
             "uid": uid,
             "username": f"sched-{uid[-10:]}",
+            "terms_version": "1",
             "role": role,
             "api_key": "k",
             "deleted_at": None,
diff --git a/tests/unit/services/devii/tasks/store.py b/tests/unit/services/devii/tasks/store.py
index 674f857a..a903fc05 100644
--- a/tests/unit/services/devii/tasks/store.py
+++ b/tests/unit/services/devii/tasks/store.py
@@ -26,6 +26,7 @@ def _account(local_db, role):
         {
             "uid": uid,
             "username": f"store-{uid[-10:]}",
+            "terms_version": "1",
             "role": role,
             "deleted_at": None,
             "created_at": SIGNUP_AFTER_PRIMARY_ADMIN,
diff --git a/tests/unit/services/game/store.py b/tests/unit/services/game/store.py
index e69b41b8..09eb2df5 100644
--- a/tests/unit/services/game/store.py
+++ b/tests/unit/services/game/store.py
@@ -17,6 +17,7 @@ def _user(username):
             {
                 "uid": f"uid-{username}",
                 "username": username,
+                "terms_version": "1",
                 "role": "Member",
                 "created_at": datetime.now(timezone.utc).isoformat(),
             }
diff --git a/tests/unit/services/gitea.py b/tests/unit/services/gitea.py
index e1165e27..434414d3 100644
--- a/tests/unit/services/gitea.py
+++ b/tests/unit/services/gitea.py
@@ -98,6 +98,7 @@ def _make_user_issues_gitea():
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "role": "member",
             "xp": 0,
             "level": 1,
diff --git a/tests/unit/services/jobs/award_service.py b/tests/unit/services/jobs/award_service.py
index fc7f5c39..c3412d2b 100644
--- a/tests/unit/services/jobs/award_service.py
+++ b/tests/unit/services/jobs/award_service.py
@@ -96,6 +96,7 @@ def _user(prefix):
         {
             "uid": uid,
             "username": f"{prefix}_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@t.dev",
             "api_key": generate_uid(),
             "created_at": datetime.now(timezone.utc).isoformat(),
diff --git a/tests/unit/services/messaging/tickets.py b/tests/unit/services/messaging/tickets.py
index 887ee376..57a3bdbf 100644
--- a/tests/unit/services/messaging/tickets.py
+++ b/tests/unit/services/messaging/tickets.py
@@ -13,6 +13,7 @@ def _user_uid():
         {
             "uid": uid,
             "username": f"tkt_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@tkt.dev",
             "password_hash": "x",
             "role": "Member",
diff --git a/tests/unit/services/moderation/__init__.py b/tests/unit/services/moderation/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/unit/services/moderation/filter.py b/tests/unit/services/moderation/filter.py
new file mode 100644
index 00000000..bbaa78de
--- /dev/null
+++ b/tests/unit/services/moderation/filter.py
@@ -0,0 +1,131 @@
+# retoor <retoor@molodetz.nl>
+
+import pytest
+
+from devplacepy.services.moderation import filter as content_filter
+from devplacepy.services.moderation.rules import (
+    ALWAYS_BLOCK_CATEGORIES,
+    FILTER_MODES,
+    RULES,
+    matches,
+    score_for,
+)
+
+MODE_ORDER = content_filter.MODE_ORDER
+VERDICT_ORDER = content_filter.VERDICT_ORDER
+
+DEVELOPER_PROSE = [
+    "Here is a proof of concept for CVE-2024-1234, the exploit overwrites the stack.",
+    "The kernel panic dump shows a segmentation fault in the parser.",
+    "Reverse engineering this malware sample took two evenings of disassembly.",
+    "I hate this framework and everyone who defends it should read the source.",
+    "Traceback (most recent call last): RuntimeError: process was killed",
+    "Our red team ran a penetration test against the staging cluster.",
+    "This weapon of a regex kills my CPU: (a+)+$",
+    "The build failed with 'fatal error: cannot execute'.",
+]
+
+PROHIBITED_PROSE = [
+    ("i will kill you when i find you", "violence"),
+    ("go kill yourself, nobody wants you here", "harassment"),
+    ("selling stolen credit cards and bank logs here", "illegal"),
+    ("how to build a pipe bomb at home", "weapons"),
+]
+
+
+def test_every_rule_has_a_positive_weight_and_a_known_category():
+    from devplacepy.database.moderation import REPORT_REASONS
+
+    for rule in RULES:
+        assert rule.weight > 0
+        assert rule.category in REPORT_REASONS
+
+
+@pytest.mark.parametrize("text", DEVELOPER_PROSE)
+def test_developer_prose_is_never_flagged(text, local_db):
+    result = content_filter.classify(text, "review")
+    assert result.verdict == "allow", f"{text!r} -> {result}"
+
+
+@pytest.mark.parametrize("text,category", PROHIBITED_PROSE)
+def test_prohibited_prose_is_flagged_with_its_category(text, category, local_db):
+    result = content_filter.classify(text, "review")
+    assert result.flagged
+    assert category in result.categories
+
+
+def test_the_always_block_categories_block_in_every_active_mode(local_db):
+    text = "selling child porn here"
+    for mode in ("review", "block"):
+        assert content_filter.classify(text, mode).verdict == "block"
+    assert content_filter.classify(text, "off").verdict == "allow"
+
+
+def test_score_is_monotonic_in_the_number_of_matched_rules():
+    previous = 0
+    accumulated = ""
+    for text, _ in PROHIBITED_PROSE:
+        accumulated = f"{accumulated}\n{text}"
+        current = score_for(accumulated, matches(accumulated))
+        assert current >= previous
+        previous = current
+
+
+def test_technical_context_only_ever_lowers_the_score():
+    for text, _ in PROHIBITED_PROSE:
+        plain = score_for(text, matches(text))
+        technical = f"{text}\nThis is a malware analysis write-up."
+        discounted = score_for(technical, matches(technical))
+        assert discounted <= plain
+
+
+def test_a_verdict_never_weakens_as_the_mode_strengthens():
+    samples = DEVELOPER_PROSE + [text for text, _ in PROHIBITED_PROSE]
+    for text in samples:
+        previous = -1
+        for mode in sorted(FILTER_MODES, key=lambda name: MODE_ORDER[name]):
+            current = VERDICT_ORDER[content_filter.classify(text, mode).verdict]
+            assert current >= previous, f"{text!r} weakened at mode {mode}"
+            previous = current
+
+
+def test_resolve_verdict_is_total_over_every_mode_and_verdict():
+    for mode in FILTER_MODES:
+        for verdict in VERDICT_ORDER:
+            resolved = content_filter.resolve_verdict(verdict, mode)
+            assert resolved in VERDICT_ORDER
+
+
+def test_classification_failure_falls_back_to_review(monkeypatch, local_db):
+    def explode(text):
+        raise RuntimeError("rule engine unavailable")
+
+    monkeypatch.setattr(content_filter, "matches", explode)
+    result = content_filter.classify("anything at all", "review")
+    assert result.verdict == "review"
+    assert result.failed is True
+    assert result.detail
+
+
+def test_empty_and_blank_text_is_allowed(local_db):
+    for text in ("", "   ", "\n\t"):
+        assert content_filter.classify(text, "block").verdict == "allow"
+
+
+def test_screen_reports_the_worst_field_and_names_every_flagged_one(local_db):
+    screening = content_filter.screen(
+        {
+            "title": "a normal title",
+            "content": "i will kill you when i find you",
+            "extra": "buy now 100% free money",
+        },
+        "review",
+    )
+    assert screening.flagged
+    assert "content" in screening.fields
+    assert "extra" in screening.fields
+    assert "title" not in screening.fields
+
+
+def test_always_block_categories_are_a_subset_of_the_rule_categories():
+    assert ALWAYS_BLOCK_CATEGORIES <= {rule.category for rule in RULES}
diff --git a/tests/unit/services/openai_gateway/analytics.py b/tests/unit/services/openai_gateway/analytics.py
index 88b6120d..c181558c 100644
--- a/tests/unit/services/openai_gateway/analytics.py
+++ b/tests/unit/services/openai_gateway/analytics.py
@@ -26,6 +26,7 @@ def _make_user_ai_usage_profile(role="Member"):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": api_key,
             "role": role,
diff --git a/tests/unit/services/openai_gateway/gateway.py b/tests/unit/services/openai_gateway/gateway.py
index 59d787c6..bb1d32f8 100644
--- a/tests/unit/services/openai_gateway/gateway.py
+++ b/tests/unit/services/openai_gateway/gateway.py
@@ -83,6 +83,7 @@ def _make_admin_openai_gateway(role="Admin"):
         {
             "uid": generate_uid(),
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "api_key": api_key,
             "role": role,
diff --git a/tests/unit/services/presence.py b/tests/unit/services/presence.py
index 6656b2f4..600383d1 100644
--- a/tests/unit/services/presence.py
+++ b/tests/unit/services/presence.py
@@ -5,7 +5,7 @@ from datetime import datetime, timedelta, timezone
 import uuid_utils
 
 from devplacepy.config import PRESENCE_TIMEOUT_SECONDS, PRESENCE_WRITE_SECONDS
-from devplacepy.database import get_table
+from devplacepy.database import get_table, set_consent
 from devplacepy.services import presence
 
 
@@ -57,10 +57,12 @@ def test_touch_writes_once_then_throttles(local_db):
         {
             "uid": uid,
             "username": f"presence_{uid[:8]}",
+            "terms_version": "1",
             "email": f"{uid[:8]}@presence.test",
             "last_seen": None,
         }
     )
+    set_consent("user", uid, "activity_recording", True)
     presence._last_write.pop(uid, None)
 
     presence.touch(uid)
@@ -182,3 +184,32 @@ def test_online_candidates_tracks_beyond_the_display_limit(local_db):
         made.append(uid)
     tracked = {u["uid"] for u in presence.online_candidates()}
     assert set(made) <= tracked
+
+
+def test_touch_is_silent_without_activity_recording_consent(local_db):
+    uid = str(uuid_utils.uuid7())
+    users = get_table("users")
+    users.insert(
+        {
+            "uid": uid,
+            "username": f"presence_{uid[:8]}",
+            "terms_version": "1",
+            "email": f"{uid[:8]}@presence.test",
+            "last_seen": None,
+        }
+    )
+    presence._last_write.pop(uid, None)
+
+    presence.touch(uid)
+    assert users.find_one(uid=uid)["last_seen"] is None
+
+    set_consent("user", uid, "activity_recording", True)
+    presence._last_write.pop(uid, None)
+    presence.touch(uid)
+    assert users.find_one(uid=uid)["last_seen"]
+
+    set_consent("user", uid, "activity_recording", False)
+    presence._last_write.pop(uid, None)
+    written = users.find_one(uid=uid)["last_seen"]
+    presence.touch(uid)
+    assert users.find_one(uid=uid)["last_seen"] == written
diff --git a/tests/unit/services/quiz/documents.py b/tests/unit/services/quiz/documents.py
index 0495bc64..7a298661 100644
--- a/tests/unit/services/quiz/documents.py
+++ b/tests/unit/services/quiz/documents.py
@@ -44,6 +44,7 @@ def _user(prefix):
         {
             "uid": uid,
             "username": f"{prefix}{_counter[0]}",
+            "terms_version": "1",
             "email": f"{prefix}{_counter[0]}@t.dev",
             "role": "Member",
             "api_key": generate_uid(),
diff --git a/tests/unit/services/quiz/scoreboard.py b/tests/unit/services/quiz/scoreboard.py
index c89db4bb..759694fe 100644
--- a/tests/unit/services/quiz/scoreboard.py
+++ b/tests/unit/services/quiz/scoreboard.py
@@ -16,6 +16,7 @@ def _user(prefix):
         {
             "uid": uid,
             "username": f"{prefix}{_counter[0]}",
+            "terms_version": "1",
             "email": f"{prefix}{_counter[0]}@t.dev",
             "role": "Member",
             "api_key": generate_uid(),
diff --git a/tests/unit/services/quiz/store.py b/tests/unit/services/quiz/store.py
index 53d6f6c5..3af17419 100644
--- a/tests/unit/services/quiz/store.py
+++ b/tests/unit/services/quiz/store.py
@@ -21,6 +21,7 @@ def _user(prefix):
         {
             "uid": uid,
             "username": f"{prefix}{_counter[0]}",
+            "terms_version": "1",
             "email": f"{prefix}{_counter[0]}@t.dev",
             "role": "Member",
             "api_key": generate_uid(),
diff --git a/tests/unit/test_access_tokens.py b/tests/unit/test_access_tokens.py
index a7bf93ff..3774afb0 100644
--- a/tests/unit/test_access_tokens.py
+++ b/tests/unit/test_access_tokens.py
@@ -50,6 +50,7 @@ def _seed_user(username, email, is_active=True, **extra):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": email,
             "is_active": is_active,
             "created_at": datetime.now(timezone.utc).isoformat(),
diff --git a/tests/unit/test_devrant_token_auth.py b/tests/unit/test_devrant_token_auth.py
index b052b3cd..96584062 100644
--- a/tests/unit/test_devrant_token_auth.py
+++ b/tests/unit/test_devrant_token_auth.py
@@ -40,6 +40,7 @@ def _seed_user(username, email, is_active=True, **extra):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": email,
             "is_active": is_active,
             "created_at": datetime.now(timezone.utc).isoformat(),
diff --git a/tests/unit/utils.py b/tests/unit/utils.py
index 6eff68d7..bd42d3b3 100644
--- a/tests/unit/utils.py
+++ b/tests/unit/utils.py
@@ -30,6 +30,7 @@ def _seed_user(role="Member", xp=0, level=1):
         {
             "uid": uid,
             "username": username,
+            "terms_version": "1",
             "email": f"{username}@t.dev",
             "role": role,
             "xp": xp,
@@ -167,6 +168,7 @@ def _seed_user_at(role, created_at):
         {
             "uid": uid,
             "username": f"pa_{uid[:8]}",
+            "terms_version": "1",
             "email": f"pa_{uid[:8]}@t.dev",
             "role": role,
             "created_at": created_at.isoformat(),