create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/leads/index.ts

@@ -16,42 +16,65 @@ import {
   routeLead,
 } from "../../services/lead-routing.js";
 
+/**
+ * Read a named string field from the body, falling back to the same-named
+ * field inside `body.payload` when the top-level value is absent — the
+ * step-flow envelope (`{ siteId, source, payload: <record> }`) carries its
+ * identity fields inside `payload` rather than at the top level. A top-level
+ * value always wins.
+ */
+function liftString(
+  body: Record<string, unknown>,
+  payload: Record<string, unknown>,
+  key: string,
+): string {
+  const topLevel = body[key];
+  if (typeof topLevel === "string") return topLevel;
+  const fromPayload = payload[key];
+  return (typeof fromPayload === "string" ? fromPayload : topLevel) as string;
+}
+
 /**
  * Build a typed RouteLeadInput from the raw request body for a given kind.
  * Explicit destructure per kind prevents unknown fields (e.g. attacker-supplied
  * `id`) from reaching the service — the service's .strict() Zod schemas provide
- * a second layer, but we also keep the handler clean at the boundary.
+ * a second layer, but we also keep the handler clean at the boundary. Lifting
+ * `email`/`name`/`phone` out of `payload` (see liftString above) reads by
+ * explicit field name only — it does not spread `payload`'s other keys, so
+ * the same discipline holds. `payload` itself is passed through unchanged.
  */
 function buildInput(
   kind: LeadKind,
   body: Record<string, unknown>,
 ): RouteLeadInput {
-  if (kind === "lead") {
+  const payload = (body["payload"] ?? {}) as Record<string, unknown>;
+
+  if (kind === "submit") {
     return {
       kind,
       siteId: body["siteId"] as string,
       source: body["source"] as string,
-      email: body["email"] as string,
-      payload: (body["payload"] ?? {}) as Record<string, unknown>,
+      email: liftString(body, payload, "email"),
+      payload,
     };
   }
   if (kind === "subscribe") {
     return {
       kind,
       siteId: body["siteId"] as string,
-      email: body["email"] as string,
+      email: liftString(body, payload, "email"),
       source: body["source"] as string,
     };
   }
   return {
     kind,
     siteId: body["siteId"] as string,
-    name: body["name"] as string,
-    phone: body["phone"] as string,
+    name: liftString(body, payload, "name"),
+    phone: liftString(body, payload, "phone"),
     ...(body["preferredTime"] !== undefined && {
       preferredTime: body["preferredTime"] as string,
     }),
-    payload: (body["payload"] ?? {}) as Record<string, unknown>,
+    payload,
   };
 }
 
@@ -59,6 +82,17 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
   return async (fastify) => {
     fastify.post(`/v1/leads/${kind}`, async (request, reply) => {
       const body = request.body as Record<string, unknown>;
+      // request.ip became attacker-influenceable when trustProxy: true went
+      // instance-wide (server.ts, #4730/#4778) — leads/index.ts was never
+      // itself touched by that PR. Traced every consumer of this value
+      // (#5112, DEF-004): lead-routing.ts's structured log field and its
+      // opt-in (LEAD_CAPTURE_INCLUDE_IP) persisted metadata.ip both RECORD
+      // the value; neither branches routing, persistence, or dedup on it.
+      // The best-effort/record-only posture is judged sufficient — the same
+      // trade-off server.ts's own trustProxy comment already accepts. The
+      // private @working-theory/lead-routing package (not present in this
+      // repo, not inspectable) is the one consumer this trace could not
+      // complete; see docs/specs/5112-leads-ip-trace-spec.md §8.
       const sourceMeta = {
         ip: request.ip,
         userAgent: request.headers["user-agent"],
@@ -125,6 +159,6 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
   };
 }
 
-export const leadSubmitRoute = makeLeadsRoute("lead");
+export const leadSubmitRoute = makeLeadsRoute("submit");
 export const leadSubscribeRoute = makeLeadsRoute("subscribe");
 export const leadCallbackRoute = makeLeadsRoute("callback");

package/templates/apps/api/src/routes/project-listings/__tests__/configured-application.test.ts

@@ -0,0 +1,558 @@
+/**
+ * @file configured-application.test.ts
+ *
+ * THE ACCEPTANCE GATE for the two halves of the application the SITE now
+ * decides (#5048 D5/D6), plus the control that deliberately does not ship
+ * (D7).
+ *
+ * #5036 validated a fixed payload against a fixed schema: ten words of
+ * headline, twenty-five of one-liner, and every one of eleven fields
+ * required. Both were one consuming site's editorial decisions compiled into
+ * the published package, and the second was worse than a preference — steps
+ * are individually optional, so a field whose step a site never renders
+ * cannot be supplied, and requiring it refuses a valid application with a
+ * message naming a question the founder was never shown.
+ *
+ * Both now derive from the site's SERVER-side `SiteListingConfig`
+ * (`wordCaps`, `collectedFields`), and the schemas are compiled per request
+ * by `buildProjectListingDraftPatchSchema` / `buildProjectListingSubmitSchema`.
+ *
+ * The tests that would fail QUIETLY, and are the reason this file exists:
+ *   - a configured cap that is not actually consulted looks identical to one
+ *     that is, until a site sets three and the tenth word still passes — so
+ *     each cap assertion pins the SITE's number and shows the value AT the
+ *     cap is accepted, and a default-config pair proves the previous
+ *     behaviour is unchanged for a site that says nothing;
+ *   - a site that does not collect `address` submitting successfully is the
+ *     core regression guard for D5: the fixed schema #5036 shipped would
+ *     refuse it, with `address` named as missing;
+ *   - no honeypot and no start-to-submit timing check exists anywhere on this
+ *     surface — #316 D6b removed both and #5039 deliberately keeps that
+ *     channel open, so their ABSENCE is worth pinning before someone
+ *     helpfully re-adds one.
+ *
+ * Same harness as `drafts.test.ts`: real routes, real services, mocked
+ * `lib/prisma.js` over a small in-memory row store, `routeLead` running for
+ * real against a per-test temp path.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
+jest.mock("../../../lib/prisma.js");
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+import {
+  projectListingApplicationFieldsSchema,
+  projectListingStartSchema,
+  SITE_LISTING_CONFIG_DEFAULTS,
+} from "@working-theory/validation";
+
+import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import { prisma } from "../../../lib/prisma.js";
+import { patchProjectListingDraftRoute } from "../patch-draft.js";
+import { startProjectListingRoute } from "../start.js";
+import { submitProjectListingRoute } from "../submit.js";
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const SITE_ID = "site-1";
+const SITE_KEY = "pk-site-1";
+
+const opt = (value: string, label: string) => ({ value, label });
+
+const VALID_QUESTIONS = {
+  q2: {
+    prompt: "Why are you here?",
+    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
+  },
+  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
+  q5: {
+    prompt: "Urgency?",
+    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
+  },
+  q6: {
+    prompt: "Pain?",
+    options: [
+      opt("low", "Low"),
+      opt("medium", "Medium"),
+      opt("high", "High"),
+      opt("critical", "Critical"),
+    ],
+  },
+  q7: { prompt: "Anything else?" },
+  extras: [],
+};
+
+const START_PAYLOAD = {
+  siteKey: SITE_KEY,
+  founderName: "Ada Founder",
+  founderEmail: "ada@example.com",
+  consent: true,
+};
+
+/** Everything the ten steps after step one collect. */
+const COMPLETE_APPLICATION = {
+  name: "My Project",
+  headline: "Ten words or fewer for the tile title here",
+  oneLiner: "A short sentence describing what the project does for its people.",
+  problem: "The problem is real and this describes it.",
+  product: "wireframes",
+  commitment: "part-time",
+  teamComposition: "co-founders",
+  faqs: [
+    { question: "Q one?", answer: "A one." },
+    { question: "Q two?", answer: "A two." },
+    { question: "Q three?", answer: "A three." },
+  ],
+  address: "1 Founder Way, Springfield",
+  questions: VALID_QUESTIONS,
+};
+
+/** The same application with no `address` — the D5 case. */
+const { address: _address, ...APPLICATION_WITHOUT_ADDRESS } = COMPLETE_APPLICATION;
+
+/** Every collected field except `address`, in the shape an operator writes. */
+const COLLECTED_WITHOUT_ADDRESS = SITE_LISTING_CONFIG_DEFAULTS.collectedFields.filter(
+  (field) => field !== "address",
+);
+
+/** `n` whitespace-separated words. */
+const words = (n: number) => Array.from({ length: n }, (_, i) => `word${i + 1}`).join(" ");
+
+// ─── The in-memory row store the Prisma mock is backed by ───────────────────
+
+type Row = Record<string, unknown>;
+
+let rows: Row[];
+let nextId: number;
+/**
+ * The `SiteListingConfig.data` blob this site is running on, per test. `null`
+ * means NO ROW — the platform defaults, which is the "site that says nothing"
+ * half of every pair below.
+ */
+let configData: Record<string, unknown> | null;
+
+function matches(row: Row, where: Record<string, unknown>): boolean {
+  return Object.entries(where).every(([key, value]) => {
+    if (key === "OR") {
+      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
+    }
+    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+      const clause = value as Record<string, unknown>;
+      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
+      if ("not" in clause) return row[key] !== clause["not"];
+      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
+      if ("startsWith" in clause) {
+        return (
+          typeof row[key] === "string" &&
+          (row[key] as string).startsWith(clause["startsWith"] as string)
+        );
+      }
+    }
+    return row[key] === value;
+  });
+}
+
+function installStore(): void {
+  rows = [];
+  nextId = 1;
+  configData = null;
+
+  (prisma.lead.create as jest.Mock).mockImplementation(() =>
+    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
+  );
+
+  // One delegate, two lookups (#5048 D2/D6): `where.publicKey` resolves the
+  // site key, `where.siteId` reads the config the schemas are compiled from.
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
+      if (where.publicKey !== undefined) {
+        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
+      }
+      return Promise.resolve(configData === null ? null : { data: configData });
+    },
+  );
+
+  // #5275 — the grant write `start` makes after the row. Append-only; it only
+  // needs to resolve here (drafts.test.ts asserts on what it is called with).
+  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
+    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
+  );
+
+  // #5275 — `start` writes the row and its grant in one interactive
+  // transaction; the mock hands the same store-backed client through.
+  (prisma.$transaction as jest.Mock).mockImplementation(
+    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
+  );
+  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
+    const now = new Date();
+    const row: Row = {
+      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
+      slug: null,
+      name: null,
+      oneLiner: null,
+      problem: null,
+      url: null,
+      product: null,
+      commitment: null,
+      teamComposition: null,
+      faqs: null,
+      anythingElse: null,
+      address: null,
+      questions: null,
+      founderCompany: null,
+      leadId: null,
+      headline: null,
+      logoMarkUrl: null,
+      logoWordmarkUrl: null,
+      featured: false,
+      decidedAt: null,
+      decidedBy: null,
+      issueUrl: null,
+      experimentKey: null,
+      windowEndsAt: null,
+      createdAt: now,
+      updatedAt: now,
+      ...data,
+    };
+    rows.push(row);
+    return Promise.resolve(row);
+  });
+
+  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
+  );
+
+  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(rows.filter((row) => matches(row, where))),
+  );
+
+  (prisma.projectListing.update as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const row = rows.find((r) => matches(r, where));
+      Object.assign(row!, data, { updatedAt: new Date() });
+      return Promise.resolve(row);
+    },
+  );
+
+  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
+    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
+      const matched = rows.filter((r) => matches(r, where));
+      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
+      return Promise.resolve({ count: matched.length });
+    },
+  );
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  await app.register(startProjectListingRoute);
+  await app.register(patchProjectListingDraftRoute);
+  await app.register(submitProjectListingRoute);
+  await app.ready();
+  return app;
+}
+
+async function startDraft(
+  app: FastifyInstance,
+): Promise<{ id: string; resumeToken: string }> {
+  const res = await app.inject({
+    method: "POST",
+    url: "/v1/project-listings",
+    payload: START_PAYLOAD,
+  });
+  expect(res.statusCode).toBe(201);
+  return (res.json() as { data: { id: string; resumeToken: string } }).data;
+}
+
+const patch = (
+  app: FastifyInstance,
+  draft: { id: string; resumeToken: string },
+  payload: Record<string, unknown>,
+) =>
+  app.inject({
+    method: "PATCH",
+    url: `/v1/project-listings/drafts/${draft.id}`,
+    headers: bearer(draft.resumeToken),
+    payload,
+  });
+
+const submit = (app: FastifyInstance, draft: { id: string; resumeToken: string }) =>
+  app.inject({
+    method: "POST",
+    url: `/v1/project-listings/drafts/${draft.id}/submit`,
+    headers: bearer(draft.resumeToken),
+  });
+
+const messageOf = (res: { json: () => unknown }) =>
+  (res.json() as { error: { message: string } }).error.message;
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe("the site's own application config (#5048 D5/D6)", () => {
+  setupLeadFileEnv("project-listing-configured");
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  // ── D6 — the word caps are the site's numbers ──
+
+  describe("configured word caps (D6)", () => {
+    /** Three words of headline, five of one-liner — nobody's platform default. */
+    const TIGHT_CAPS = { wordCaps: { headline: 3, oneLiner: 5 } };
+
+    it("patch: refuses a headline over THIS SITE's cap, naming the site's number", async () => {
+      configData = TIGHT_CAPS;
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { headline: words(4) });
+
+      expect(res.statusCode).toBe(400);
+      // Pinned to the CONFIGURED number, not to a constant: a message naming
+      // ten here would mean the cap came from the package, and the four-word
+      // refusal would be a coincidence of the platform default rather than
+      // this site's terms being enforced.
+      expect(messageOf(res)).toBe("headline must be 3 words or fewer");
+      expect(messageOf(res)).not.toContain("10");
+      expect(rows[0]!["headline"]).toBeNull();
+    });
+
+    it("patch: ACCEPTS a headline at exactly the site's cap", async () => {
+      // The other half of the pair. Without it the test above passes just as
+      // well against a surface that refuses every headline it is given.
+      configData = TIGHT_CAPS;
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { headline: words(3) });
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["headline"]).toBe(words(3));
+    });
+
+    it("patch: enforces the site's oneLiner cap too, at its own number", async () => {
+      configData = TIGHT_CAPS;
+      const draft = await startDraft(app);
+
+      const over = await patch(app, draft, { oneLiner: words(6) });
+      const at = await patch(app, draft, { oneLiner: words(5) });
+
+      expect(over.statusCode).toBe(400);
+      expect(messageOf(over)).toBe("oneLiner must be 5 words or fewer");
+      expect(at.statusCode).toBe(200);
+      expect(rows[0]!["oneLiner"]).toBe(words(5));
+    });
+
+    it("patch: a site with NO config row keeps the previous ten-word headline behaviour", async () => {
+      // The defaults reproduce #5036's constants exactly, so a site that says
+      // nothing sees no change — which is the whole claim D6 makes about
+      // turning a constant into configuration.
+      configData = null;
+      const draft = await startDraft(app);
+
+      const ten = await patch(app, draft, { headline: words(10) });
+      const eleven = await patch(app, draft, { headline: words(11) });
+
+      expect(ten.statusCode).toBe(200);
+      expect(eleven.statusCode).toBe(400);
+      expect(messageOf(eleven)).toBe("headline must be 10 words or fewer");
+      // The eleventh word never landed on the row.
+      expect(rows[0]!["headline"]).toBe(words(10));
+    });
+
+    it("patch: a site with NO config row keeps the previous twenty-five-word oneLiner behaviour", async () => {
+      configData = null;
+      const draft = await startDraft(app);
+
+      const twentyFive = await patch(app, draft, { oneLiner: words(25) });
+      const twentySix = await patch(app, draft, { oneLiner: words(26) });
+
+      expect(twentyFive.statusCode).toBe(200);
+      expect(twentySix.statusCode).toBe(400);
+      expect(messageOf(twentySix)).toBe("oneLiner must be 25 words or fewer");
+    });
+  });
+
+  // ── D5 — completeness derives from the collected-field set ──
+
+  describe("derived completeness (D5)", () => {
+    it("submit: a site that does not collect `address` accepts a draft that has none", async () => {
+      // THE regression guard. #5036's fixed schema required `address` of every
+      // site; a site whose step set never asks for one would have its founders
+      // refused at submit, naming a question they were never shown.
+      configData = { collectedFields: COLLECTED_WITHOUT_ADDRESS };
+      const draft = await startDraft(app);
+      await patch(app, draft, APPLICATION_WITHOUT_ADDRESS);
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({ ok: true, data: { id: draft.id, slug: "my-project" } });
+      expect(rows[0]!["status"]).toBe("requested");
+      // Never collected, so never stored — not silently defaulted to something.
+      expect(rows[0]!["address"]).toBeNull();
+    });
+
+    it("submit: the DEFAULT config still refuses that same draft, naming `address`", async () => {
+      // The other half: the field is only optional because THIS SITE said so.
+      configData = null;
+      const draft = await startDraft(app);
+      await patch(app, draft, APPLICATION_WITHOUT_ADDRESS);
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(422);
+      const body = res.json() as { error: { code: string; missingFields: string[] } };
+      expect(body.error.code).toBe("incomplete_application");
+      expect(body.error.missingFields).toEqual(["address"]);
+      expect(rows[0]!["status"]).toBe("draft");
+    });
+
+    it("patch: REFUSES a write to a field the site does not collect", async () => {
+      // The collected set is a WRITE gate, not only a completeness floor.
+      // `address` rides the public read by design (#5036 D6), so a site whose
+      // step set omits the address step must not have one written into a draft
+      // by an anonymous caller who knows the field name — and then published on
+      // its listing page. Narrowing `submit` alone left that open, because a
+      // value already on the row is simply carried.
+      configData = { collectedFields: COLLECTED_WITHOUT_ADDRESS };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { address: COMPLETE_APPLICATION.address });
+
+      expect(res.statusCode).toBe(400);
+      expect(rows[0]!["address"]).toBeNull();
+    });
+
+    it("submit: a value ALREADY on the row for an uncollected field does not block submit", async () => {
+      // The other direction, and the reason `buildProjectListingSubmitSchema`
+      // DROPS an uncollected field rather than making it optional: a site that
+      // narrows its step set after a draft was opened must not strand that
+      // draft. The write gate above stops NEW writes; this stops an existing
+      // value from failing `.strict()`.
+      configData = null;
+      const draft = await startDraft(app);
+      await patch(app, draft, COMPLETE_APPLICATION); // address included
+
+      configData = { collectedFields: COLLECTED_WITHOUT_ADDRESS };
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["status"]).toBe("requested");
+      expect(rows[0]!["address"]).toBe(COMPLETE_APPLICATION.address);
+    });
+
+    it("submit: a collected-but-OPTIONAL field does not block submit when absent", async () => {
+      configData = null;
+      // These three are collected by default and still optional — the
+      // distinction the missing-field list turns on.
+      for (const field of ["url", "anythingElse", "founderCompany"]) {
+        expect(SITE_LISTING_CONFIG_DEFAULTS.collectedFields).toContain(field);
+      }
+
+      const draft = await startDraft(app);
+      await patch(app, draft, COMPLETE_APPLICATION); // carries none of the three
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["url"]).toBeNull();
+      expect(rows[0]!["anythingElse"]).toBeNull();
+      expect(rows[0]!["founderCompany"]).toBeNull();
+    });
+  });
+
+  // ── D7 — the controls that deliberately do not ship ──
+
+  describe("no anti-automation control ships (D7)", () => {
+    const read = (relative: string) =>
+      readFileSync(join(__dirname, "..", "..", "..", relative), "utf8");
+
+    const SURFACE_FILES = [
+      "routes/project-listings/start.ts",
+      "routes/project-listings/patch-draft.ts",
+      "routes/project-listings/public.ts",
+      "routes/project-listings/submit.ts",
+      "services/project-listings.ts",
+    ];
+
+    it("no honeypot field exists in the payload the surface accepts", async () => {
+      // Asserted on the SCHEMAS, not on the prose: a decoy field would have to
+      // be accepted somewhere to be a honeypot at all.
+      const fields = [
+        ...Object.keys(projectListingStartSchema.shape),
+        ...Object.keys(projectListingApplicationFieldsSchema.shape),
+      ];
+      for (const field of fields) {
+        expect(field).not.toMatch(/honey|_?trap|decoy|confirmEmail|website2/i);
+      }
+      // And nothing on the surface names one.
+      for (const file of SURFACE_FILES) {
+        expect(read(file)).not.toMatch(/honeypot/i);
+      }
+    });
+
+    it("no timing heuristic gates the start-to-submit interval", async () => {
+      // #5039 deliberately opens the agent channel a "too fast to be human"
+      // check would close, and an agent completes a ten-step form in
+      // milliseconds. A named heuristic anywhere on the surface is the
+      // regression; so is `submit` reaching for a clock to compare the draft's
+      // own `createdAt` against.
+      for (const file of SURFACE_FILES) {
+        expect(read(file)).not.toMatch(
+          /tooFast|too_fast|minElapsed|minSeconds|minDuration|dwellTime|timeOnPage|humanTiming/i,
+        );
+      }
+
+      const service = read("services/project-listings.ts");
+      const submitBody = service.slice(
+        service.indexOf("export async function submitProjectListingDraft"),
+      );
+      const submitOnly = submitBody.slice(0, submitBody.indexOf("\nfunction isUniqueViolation"));
+      expect(submitOnly).not.toContain("createdAt");
+      expect(submitOnly).not.toContain("Date.now(");
+    });
+
+    it("an application completed in the same millisecond as its draft still submits", async () => {
+      // The behavioural half: nothing about how fast the eleven fields arrived
+      // is consulted. This whole test runs inside one tick.
+      configData = null;
+      const draft = await startDraft(app);
+      await patch(app, draft, COMPLETE_APPLICATION);
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+    });
+  });
+});