account-data: pin openvibe-sdk 0.74.0 and guard every table with a person column (#133)

ddiff --git a/README.md b/README.md
iindex df9da57..6a661da 100644
---- a/README.md
++++ b/README.md
@@@ -150,6 +150,6 @@ AGPL-3.0-only. See [LICENSE](LICENSE).
  
  <!-- versions:start -->
  - openvibe-contracts: v0.222.0
--- openvibe-sdk: v0.73.0
++- openvibe-sdk: v0.74.0
  - openvibe-shared: v4.48.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex f836633..b08a367 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,7 +7,7 @@
    "port": 4940,
    "domain": "openvibe.space",
    "contracts": "openvibe-contracts v0.222.0",
--  "sdk": "openvibe-sdk v0.73.0",
++  "sdk": "openvibe-sdk v0.74.0",
    "shared": "openvibe-shared v4.48.0",
    "capabilities": [
      "space.site.manage",
ddiff --git a/package-lock.json b/package-lock.json
iindex 39265db..c3cf0d5 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -16,7 +16,7 @@
          "express-rate-limit": "^7.5.0",
          "helmet": "^8.1.0",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.73.0",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.48.0",
          "pg": "^8.23.0",
          "quickjs-emscripten": "0.32.0"
@@@ -1138,9 +1138,9 @@
        }
      },
      "node_modules/openvibe-sdk": {
--      "version": "0.73.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.73.0",
--      "integrity": "sha512-XClxoVm9M6RA8eXlGgYZ0u6q9n5h79mCXqAAEg9fX21KgcqP69RmG+cX+6wrOf7TaEj7eSBWMxHjiIeIa9N7Dg==",
++      "version": "0.74.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
++      "integrity": "sha512-DO9KVPnUriY/I4lX6ZEJtXaUvRDbJyqnqJxvlpl+zkNGFILpmuBXVJogNOCfK071Qci1gg7C4Iw1Xrseklcajg==",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex 0e89ac4..28060a8 100644
---- a/package.json
++++ b/package.json
@@@ -2,7 +2,7 @@
    "name": "openvibe-space",
    "version": "0.1.0",
    "private": true,
--  "description": "OpenVibe.Space — staff-only static hosting for the OpenVibe network; dynamic pages and spaces are planned. Forum URLs redirect to OpenVibe.Community.",
++  "description": "OpenVibe.Space \u2014 staff-only static hosting for the OpenVibe network; dynamic pages and spaces are planned. Forum URLs redirect to OpenVibe.Community.",
    "main": "server/index.js",
    "scripts": {
      "start": "node server/index.js",
@@@ -28,7 +28,7 @@
      "express-rate-limit": "^7.5.0",
      "helmet": "^8.1.0",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.222.0",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.73.0",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.48.0",
      "pg": "^8.23.0",
      "quickjs-emscripten": "0.32.0"
ddiff --git a/server/account-data.js b/server/account-data.js
iindex 11dc2e4..377e94b 100644
---- a/server/account-data.js
++++ b/server/account-data.js
@@@ -24,6 +24,14 @@ const TABLES = [
      { table: 'space_app_codes', subject: 'subject', file: null },
      { table: 'space_app_counters', subject: 'scope', value: (usr) => `build:${usr}`, file: null },
      { table: 'space_project_members', subject: 'principal', file: 'hosting-project-roles.json', columns: ['project_id', 'role', 'created_at'] },
++    // The forum spaces this person started: the space stays as the community's record, without its creator.
++    { table: 'spaces', subject: 'created_by', file: 'forum-spaces.json', columns: ['id', 'slug', 'name', 'description', 'visibility', 'created_at'], order: 'id', erase: { anonymize: {} } },
++    // Hosting rows belong to their project; created_by is the audit trail of who acted, kept for accountability.
++    { table: 'space_sites', subject: 'created_by', file: null, erase: { keep: 'the site belongs to its project; created_by is the audit trail of who created it' } },
++    { table: 'space_domains', subject: 'created_by', file: null, erase: { keep: 'the domain belongs to its project; created_by is the audit trail of who added it' } },
++    { table: 'space_deploys', subject: 'created_by', file: null, erase: { keep: 'the deploy belongs to its project; created_by is the audit trail of who made it' } },
++    { table: 'space_site_sources', subject: 'created_by', file: null, erase: { keep: 'the site source belongs to its project; created_by and updated_by are the audit trail' } },
++    { table: 'space_takedowns', subject: 'created_by', file: null, erase: { keep: 'a moderation record stays attributed for accountability' } },
  ];
  
  async function extraExport(db, subject) {
ddiff --git a/test/account-data.test.js b/test/account-data.test.js
iindex 81df95b..3c02ce3 100644
---- a/test/account-data.test.js
++++ b/test/account-data.test.js
@@@ -9,6 +9,8 @@
  const assert = require('assert');
  const crypto = require('crypto');
  const { boot, check, done } = require('./stageb/boot');
++const { uncovered } = require('openvibe-sdk/account-data');
++const { TABLES } = require('../server/account-data');
  
  const ORIGIN = 'https://openvibe.space';
  const b64url = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
@@@ -17,6 +19,17 @@ const b64url = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g
      const sent = [];
      const accountSend = async (path, body) => { sent.push({ path, body }); return { ok: true, status: 200, json: async () => ({}) }; };
      const t = await boot({ accountSend, env: { SPACE_EVENTS_SECRET: 'events-secret-for-tests-0123456789abcdef' } });
++    await check('every table that names a person is covered or exempted with a reason', async () => {
++        const missing = await uncovered(t.ctx.store.db, {
++            tables: TABLES,
++            exempt: {
++                account_data_events: 'the ledger of requests itself: which export and deletion Space applied',
++                account_data_events_forum: 'the forum ledger of requests itself: which export and deletion the Space forum applied',
++            },
++        });
++        assert.deepStrictEqual(missing, [], `a table with a person column is neither covered nor exempted: ${missing.join(', ')}`);
++    });
++
      const { csrfToken } = require('../server/auth/forms');
      const alice = t.user('alice'), bob = t.user('bob');
      const csrf = (u) => csrfToken(t.config, { subject: u.subject });