PR #329 published the Terms and Privacy pages, but a footer link is browsewrap — the weak form of assent. Nothing asked the player to agree, nothing recorded that they had, and a brand-new player's only "this is fiction" disclosure was the masthead one-liner. Issue #330 closes that: a clickwrap checkbox gates the OAuth sign-in buttons, the acceptance is recorded server-side with a version and timestamp, and a fresh device meets a one-time fiction/AI notice on /play.

Three moving parts, in order below: the checkbox and how its tick survives the OAuth redirect; the return leg that records it; and the notice dialog with the tour-deferral wiring. A migration (0012) adds the evidence table. The PR also finishes a truth sweep: eight files still described sign-in as a "magic link" that "upgrades the user in place" — the actual mechanism discards the anonymous id, and that fact is exactly why the recording works the way it does.

The checkbox renders inside SignInForm, so all three sign-in surfaces (settings, the buy modal's gate, the runs popover) inherit it. The copy is the owner's locked line — 18+, Terms, Privacy, links opening in a new tab so the form isn't lost mid-sign-in. Both provider buttons carry :disabled="busy || !accepted" plus an aria-describedby pointing at the label, and start() re-checks the gate for any click that bypasses the attribute.

Acceptance can't be recorded before the redirect: signInWithOAuth lands a new player on a fresh account and a returning player on their existing one — the pre-redirect anonymous id is discarded either way. So the tick waits in the legal store and is flushed only once a signed-in session exists.

The flag lives in sessionStorage, not localStorage, and that choice is the store's load-bearing comment: sessionStorage survives the same-tab OAuth round-trip but dies with the tab. A tick abandoned at the provider can never be flushed days later under whoever signs in next on a shared browser — the adversarial review flagged that fabrication path against the localStorage draft, and this kills it. The cost is small because every future sign-in re-ticks the box anyway. The notice acknowledgment, by contrast, means "once per device, forever" and stays in localStorage.

/play's mount already finalizes the OAuth return. After the balance settles — on every branch — the flush runs when the session is non-anonymous. The gate reads !accountAnonymous rather than email truthiness, so an email-less OAuth identity still records; and because the server refuses anonymous subjects anyway, a stale client gate can't write junk.