create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/services/project-listings.ts

@@ -0,0 +1,1472 @@
+/**
+ * @file project-listings.ts
+ * @description The founder's-application-row service (#4998, reshaped by
+ * #5036) — writes, reads, and transitions `ProjectListing` (ADR 0009 D3
+ * service-layer convention, mirroring `lead-routing.ts` and
+ * `waitlist-dashboard.ts`).
+ *
+ * The single anonymous create became THREE operations when the application
+ * became a ten-step form that saves as it goes (#5036 D1):
+ *
+ *   start   name + email + consent -> a `draft` row and a resume token
+ *   patch   merges a partial payload; asserts no completeness
+ *   submit  validates the WHOLE application, `draft` -> `requested`
+ *
+ * Validation therefore moved from write-time to submit-time, and that is why
+ * every application field is nullable on the row: a half-filled draft is a
+ * legitimate row, and only `submit` asserts it is finished.
+ *
+ * `submitProjectListingDraft` calls `routeLead` (kind `submit`, source
+ * `projects-apply`) for the Lead write — never a duplicate Lead-shaped insert.
+ * The Lead is written at SUBMIT rather than at start: the founder's contact
+ * details are already captured on the listing row itself at step one, so a
+ * Lead at step one adds no capture, and what it DOES add is an operator
+ * notification email per abandoned first step on an anonymous route (PR #5042
+ * security review, finding 4). Every tenant read/write
+ * is scoped by `siteId` (`request.tenant.workspaceId`) — there is no
+ * client-supplied site id on any tenant route. `waitlistCount` joins THROUGH
+ * `experimentId` (`WaitlistExperiment.id` -> `.key` -> `WaitlistScore.experimentKey`,
+ * scoped by `siteId`), 0 when a listing carries no `experimentKey`.
+ *
+ * PII boundary: this module never logs `founderEmail`, `founderName`, or
+ * `questions` — the same discipline `lead-routing.ts` documents. The resume
+ * token is never logged either, at any level: it is the ONLY credential on
+ * the anonymous draft surface.
+ */
+
+import { createHash, randomBytes } from "node:crypto";
+
+import type { Prisma, Role } from "@working-theory/database";
+import { logger } from "@working-theory/observability";
+import {
+  clampWindowDays,
+  buildProjectListingDraftPatchSchema,
+  buildProjectListingSubmitSchema,
+  composeAddressLine,
+  flowAddressValueSchema,
+  publicSiteAnswers,
+  PROJECT_LISTING_CONCURRENT_LIMIT,
+  PROJECT_LISTING_NON_TERMINAL_STATUSES,
+} from "@working-theory/validation";
+import type {
+  FlowAddressValue,
+  ProjectListing,
+  ProjectListingDraftPatchInput,
+  ProjectListingFaqs,
+  ProjectListingPublic,
+  ProjectListingQuestions,
+  ProjectListingStartInput,
+} from "@working-theory/validation";
+
+import { prisma } from "../lib/prisma.js";
+
+import {
+  consentConfigForSite,
+  MAX_CONSENT_KEYS,
+  recordConsent,
+  recordLegacyConsent,
+  requiredConsentUnmet,
+} from "./consent.js";
+import { routeLead, type SourceMeta } from "./lead-routing.js";
+import { listingConfigFor } from "./listing-config.js";
+
+// ─── Role floor ─────────────────────────────────────────────────────────────
+
+/**
+ * The membership role this floor is expressed in (#5182).
+ *
+ * Previously `import type { MembershipRole } from "./tenant-context.js"` — a
+ * multi-tenant SLICE file the OSS strip removes, which makes a type-only import
+ * of it a TS2307 on the public tree exactly as a value import would be (spec
+ * D1). `Role` is the Prisma enum `Membership.role` is actually declared as
+ * (`database/auth/schema.prisma:25-33`), so it is the same three values from
+ * the non-slice home they originate in rather than a restatement — and this
+ * file already imports from `@working-theory/database` two lines up.
+ */
+
+/** Reads/writes require `owner` or `admin` — the same floor as the waitlist dashboard. */
+export const PROJECT_LISTING_ROLES: ReadonlySet<Role> = new Set<Role>([
+  "owner",
+  "admin",
+]);
+
+// ─── The computed lifecycle state ───────────────────────────────────────────
+
+type ProjectListingStatus = ProjectListing["status"];
+
+/**
+ * Resolve a row's LIFECYCLE status from its STORED status (#5033 D3).
+ *
+ * `closed` is the one state nothing writes. An `active` listing whose window
+ * end has passed reads `closed`, here, on every read, with no job having run.
+ * Storing it instead would need a scheduler whose failure leaves expired
+ * listings publicly open — a silent, wrong-way failure. This makes that
+ * unrepresentable.
+ *
+ * A FEATURED row is exempt (#5036 D6b). The operator's own products become
+ * listing rows carrying `featured: true`, and such a row is not a time-boxed
+ * validation experiment: it has no meaningful window and must not vanish from
+ * the shelf because a date passed. Its `windowEndsAt` may be null, and it
+ * reads `active` either way.
+ *
+ * A null window on a NON-featured `active` row is an ERROR, not a licence to
+ * stay open forever: every real listing is time-boxed by design, and the whole
+ * point of computing `closed` rather than storing it is that an expired
+ * listing cannot linger. It is logged and read `closed` — failing toward the
+ * closed shelf rather than toward a publicly-open listing nothing bounds.
+ * `draft`, `requested` and `rejected` rows legitimately carry no window and
+ * are not touched by any of this.
+ */
+export function computeListingStatus(
+  storedStatus: string,
+  windowEndsAt: Date | null,
+  now: Date,
+  featured: boolean,
+): ProjectListingStatus {
+  if (storedStatus !== "active") return storedStatus as ProjectListingStatus;
+  if (featured) return "active";
+  if (windowEndsAt === null) {
+    logger.error(
+      { kind: "active_listing_without_window" },
+      "[project-listings] a non-featured active listing carries no window end; reading it closed",
+    );
+    return "closed";
+  }
+  return windowEndsAt.getTime() <= now.getTime() ? "closed" : "active";
+}
+
+// ─── Slug derivation (#5033 D2) ─────────────────────────────────────────────
+
+/** The `name`-derived slug's length cap. */
+const SLUG_MAX_LENGTH = 48;
+
+/** The slug a name with no alphanumeric content falls back to before suffixing. */
+const SLUG_FALLBACK = "listing";
+
+/**
+ * Derive a slug from a listing `name`: lowercase, every non-alphanumeric run
+ * to a single hyphen, trimmed of leading/trailing hyphens, truncated to 48.
+ * A name carrying no alphanumerics at all (the payload allows it — `name` is
+ * only bounded by length) falls back to `listing`, which the site-scoped
+ * suffixing below then disambiguates like any other collision.
+ */
+export function deriveListingSlug(name: string): string {
+  const base = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, SLUG_MAX_LENGTH)
+    .replace(/-+$/, "");
+  return base.length > 0 ? base : SLUG_FALLBACK;
+}
+
+/**
+ * The most same-prefix slugs one create will read before giving up.
+ *
+ * The collision read is a prefix scan, and `base` derives from a fully
+ * caller-controlled `name` on an ANONYMOUS route — a one-character name makes
+ * the prefix match most of the site's slugs, and every accepted application
+ * adds another row to that family. Unbounded, the cost of a create would grow
+ * with the number of listings an attacker had already filed. Bounded, a
+ * pathological family degrades to the same `slug_taken` 409 a genuine race
+ * already produces, rather than to an ever-slower table scan.
+ */
+const SLUG_COLLISION_SCAN_LIMIT = 200;
+
+/**
+ * The first free slug for `base` on this site. Uniqueness is already scoped
+ * `@@unique([siteId, slug])`, so the suffix is too: a second "Atlas" on this
+ * site becomes `atlas-2` even if `atlas` is taken on another.
+ *
+ * Two concurrent creates of the same name can still both resolve the same
+ * free slug and race to the insert; the loser hits the unique constraint and
+ * is reported as `slug_taken`, exactly as it was when the client supplied the
+ * slug itself.
+ */
+async function firstFreeSlug(siteId: string, base: string): Promise<string> {
+  const rows = await prisma.projectListing.findMany({
+    where: { siteId, slug: { startsWith: base } },
+    select: { slug: true },
+    take: SLUG_COLLISION_SCAN_LIMIT,
+  });
+  const taken = new Set(rows.map((r) => r.slug));
+  if (!taken.has(base)) return base;
+
+  // Bounded by `taken.size + 1` iterations — one of the first `n` candidates
+  // is necessarily free.
+  let suffix = 2;
+  while (taken.has(`${base}-${suffix}`)) suffix += 1;
+  return `${base}-${suffix}`;
+}
+
+// ─── Row shape ──────────────────────────────────────────────────────────────
+
+const PROJECT_LISTING_SELECT = {
+  id: true,
+  siteId: true,
+  leadId: true,
+  slug: true,
+  name: true,
+  oneLiner: true,
+  problem: true,
+  url: true,
+  product: true,
+  commitment: true,
+  teamComposition: true,
+  faqs: true,
+  anythingElse: true,
+  address: true,
+  // #5279 — the structured parts beside the display string.
+  addressLine1: true,
+  addressLine2: true,
+  addressCity: true,
+  addressRegion: true,
+  addressPostalCode: true,
+  addressCountry: true,
+  questions: true,
+  // #5285 — the site's own answers, and the window the applicant asked for.
+  // `windowDays` rides the select because `submit` re-validates the assembled
+  // application, and `requestedWindowDays` is one of its fields now.
+  siteAnswers: true,
+  windowDays: true,
+  founderName: true,
+  founderEmail: true,
+  founderCompany: true,
+  headline: true,
+  logoMarkUrl: true,
+  logoWordmarkUrl: true,
+  featured: true,
+  status: true,
+  consentAt: true,
+  decidedAt: true,
+  decidedBy: true,
+  issueUrl: true,
+  experimentKey: true,
+  windowEndsAt: true,
+  createdAt: true,
+  updatedAt: true,
+} as const satisfies Prisma.ProjectListingSelect;
+
+type ProjectListingRow = Prisma.ProjectListingGetPayload<{
+  select: typeof PROJECT_LISTING_SELECT;
+}>;
+
+/**
+ * The structured address parts of a row, or null (#5279).
+ *
+ * Exported because `project-listing-decision.ts` renders the same row shape
+ * and must answer the same way — two readers guessing separately at what
+ * "has parts" means is exactly how one of them starts emitting a half-filled
+ * object.
+ *
+ * The rule is the composite's REQUIRED set: the five non-optional parts are
+ * all present, or there are no parts. `addressLine2` is optional in the
+ * fieldset, so it rides along when present and is simply absent when not. A
+ * row written before #5279 has all six columns null and answers null here —
+ * never a partial object reconstructed from `address`, which nothing in this
+ * repo parses.
+ *
+ * `.safeParse` rather than a cast: these are six nullable TEXT columns, and
+ * the emitted object must satisfy `flowAddressValueSchema` or the row fails
+ * its own response schema downstream. A shape that somehow does not (a
+ * `country` that is not an alpha-2 code, say) answers null rather than
+ * putting an invalid address on the PUBLIC read.
+ */
+export function addressPartsFromRow(row: {
+  addressLine1: string | null;
+  addressLine2: string | null;
+  addressCity: string | null;
+  addressRegion: string | null;
+  addressPostalCode: string | null;
+  addressCountry: string | null;
+}): FlowAddressValue | null {
+  if (
+    row.addressLine1 === null ||
+    row.addressCity === null ||
+    row.addressRegion === null ||
+    row.addressPostalCode === null ||
+    row.addressCountry === null
+  ) {
+    return null;
+  }
+  const parsed = flowAddressValueSchema.safeParse({
+    addressLine1: row.addressLine1,
+    ...(row.addressLine2 !== null && { addressLine2: row.addressLine2 }),
+    city: row.addressCity,
+    region: row.addressRegion,
+    postalCode: row.addressPostalCode,
+    country: row.addressCountry,
+  });
+  return parsed.success ? parsed.data : null;
+}
+
+/**
+ * The site-answers object of a row, or null (#5285).
+ *
+ * Exported for the same reason `addressPartsFromRow` is: the operator's
+ * decision payload renders the same row shape and must answer the same way.
+ *
+ * The column is `Json?`, so Prisma types it as `JsonValue` — an array, a
+ * number and a string all satisfy it. Only ever written by
+ * `draftUpdateData` from a body the site's own declarations validated, so a
+ * row holding anything else is a row somebody wrote around this service.
+ * A non-object answers null rather than being cast: a value of the wrong
+ * SHAPE reaching the response schema would fail the whole read, and one
+ * malformed row must not take a listing page down.
+ *
+ * Non-string members are dropped for the same reason — the store is
+ * `Record<string, string>`, and what is handed back has to actually be one.
+ */
+export function siteAnswersFromRow(value: Prisma.JsonValue | null): Record<string, string> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry): entry is [string, string] => typeof entry[1] === "string",
+    ),
+  );
+}
+
+/**
+ * `now` is passed rather than read inside so one read renders every row of a
+ * list against a single instant. `featuredEnabled` is the site's config
+ * switch (#5033 D6): where a site has not enabled a featured shelf, the flag
+ * never surfaces. The tenant dashboard passes `true` — an operator manages
+ * the flag and must see what they set.
+ */
+function toResponseRow(
+  row: ProjectListingRow,
+  waitlistCount: number,
+  now: Date,
+  featuredEnabled: boolean,
+): ProjectListing {
+  return {
+    id: row.id,
+    siteId: row.siteId,
+    leadId: row.leadId,
+    slug: row.slug,
+    name: row.name,
+    headline: row.headline,
+    oneLiner: row.oneLiner,
+    problem: row.problem,
+    url: row.url,
+    product: row.product as ProjectListing["product"],
+    commitment: row.commitment as ProjectListing["commitment"],
+    teamComposition: row.teamComposition as ProjectListing["teamComposition"],
+    faqs: row.faqs as unknown as ProjectListingFaqs | null,
+    anythingElse: row.anythingElse,
+    address: row.address,
+    addressParts: addressPartsFromRow(row),
+    founderName: row.founderName,
+    founderEmail: row.founderEmail,
+    founderCompany: row.founderCompany,
+    questions: row.questions as unknown as ProjectListingQuestions | null,
+    logoMarkUrl: row.logoMarkUrl,
+    logoWordmarkUrl: row.logoWordmarkUrl,
+    // #5285 — UNFILTERED here, deliberately. This row shape serves the tenant
+    // dashboard and the founder's own draft read, both of which are entitled
+    // to every answer. The PUBLIC read is the one that must not carry an
+    // `operator-only` answer, and it narrows this through `publicSiteAnswers`
+    // in `publicProjectListings` — one filter, on the one read that publishes.
+    siteAnswers: siteAnswersFromRow(row.siteAnswers),
+    featured: featuredEnabled && row.featured,
+    // The row's OWN flag decides the closed exemption (#5036 D6b), not the
+    // site's `featuredEnabled` switch: that switch governs whether the flag
+    // SURFACES on a read, not whether the listing is time-boxed.
+    status: computeListingStatus(row.status, row.windowEndsAt, now, row.featured),
+    consentAt: row.consentAt.toISOString(),
+    decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
+    decidedBy: row.decidedBy,
+    issueUrl: row.issueUrl,
+    experimentKey: row.experimentKey,
+    windowEndsAt: row.windowEndsAt ? row.windowEndsAt.toISOString() : null,
+    waitlistCount,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+/**
+ * `waitlistCount` per row, keyed by `experimentKey`.
+ *
+ * Since #5036 D6d the listing stores the experiment's KEY rather than its id,
+ * and that key is the same string `WaitlistScore.experimentKey` holds — so the
+ * `WaitlistExperiment` read that existed purely to translate one into the
+ * other is gone. One `WaitlistScore.count` per DISTINCT key remains, bounded
+ * by the small number of distinct experiments a dashboard page carries rather
+ * than by row count (`waitlist-dashboard.ts`'s "one read across every returned
+ * row" discipline).
+ */
+async function attachWaitlistCounts(
+  siteId: string,
+  rows: readonly ProjectListingRow[],
+): Promise<Map<string, number>> {
+  const experimentKeys = [
+    ...new Set(rows.map((r) => r.experimentKey).filter((v): v is string => v != null)),
+  ];
+  if (experimentKeys.length === 0) return new Map();
+
+  const counts = new Map<string, number>();
+  await Promise.all(
+    experimentKeys.map(async (experimentKey) => {
+      const count = await prisma.waitlistScore.count({
+        where: { siteId, experimentKey },
+      });
+      counts.set(experimentKey, count);
+    }),
+  );
+  return counts;
+}
+
+function waitlistCountFor(row: ProjectListingRow, counts: Map<string, number>): number {
+  return row.experimentKey ? (counts.get(row.experimentKey) ?? 0) : 0;
+}
+
+// ─── The founder's key (#5036 D7) ──────────────────────────────────────────
+
+/**
+ * Normalize the email a founder is counted under.
+ *
+ * Trim and lowercase, so `Ada@Example.com ` and `ada@example.com` are one
+ * founder rather than two. Postgres text equality is case-sensitive, so
+ * without this the concurrent-listing limit is evaded by holding down shift.
+ *
+ * Deliberately NOT stripping plus-tags: `ada+two@example.com` still counts as
+ * a different founder. Plus-addressing is a legitimate, widely-used feature
+ * and treating it as evasion would refuse real applicants; closing that gap
+ * properly needs a verified email, which this anonymous surface does not have.
+ */
+function normalizeFounderEmail(email: string): string {
+  return email.trim().toLowerCase();
+}
+
+/**
+ * How long an unsubmitted draft occupies one of a founder's two slots
+ * (#5036 D7).
+ *
+ * Drafts MUST count, or the limit is evaded by never submitting. But
+ * `founderEmail` is unverified on an anonymous surface, so anyone can open a
+ * draft in a stranger's name — and a draft that counted forever would let two
+ * anonymous requests lock a named founder out of ever applying, with no
+ * operator remedy (there is no route that deletes a listing; PR #5042 security
+ * review, finding 1).
+ *
+ * Bounding the window keeps D7's intent — an application in progress holds a
+ * slot, so not submitting evades nothing — while making that lockout expire on
+ * its own. Fourteen days is far longer than a ten-step form takes and far
+ * shorter than "forever".
+ *
+ * This bounds the QUOTA impact, not retention: an abandoned draft still holds
+ * the founder's name, email and address in the table. A retention sweep is a
+ * separate unit and is not in this change.
+ */
+const DRAFT_HOLDS_A_SLOT_DAYS = 14;
+
+// ─── The resume token (#5036 D1) ───────────────────────────────────────────
+
+/**
+ * The token's entropy, in bytes. 256 bits — the same floor the repo's other
+ * capability tokens carry, and far beyond guessing at any request rate the
+ * `leadsScope` rate limiter permits.
+ */
+const RESUME_TOKEN_BYTES = 32;
+
+/**
+ * Mint an opaque resume token. Returned to the caller EXACTLY once, at
+ * `start`: only its digest is stored, so the server cannot hand it back a
+ * second time and an attacker who reads the table still cannot present one.
+ */
+function mintResumeToken(): string {
+  return randomBytes(RESUME_TOKEN_BYTES).toString("base64url");
+}
+
+/**
+ * What the column holds. A plain sha-256 with no salt and no stretching is
+ * correct here and a KDF would not be: the input is 256 bits of CSPRNG output,
+ * not a human-chosen secret, so there is no dictionary to precompute and
+ * nothing for a work factor to slow down.
+ */
+function hashResumeToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+/**
+ * Resolve the ONE draft a token grants access to (#5036 D1).
+ *
+ * Both the id and the token's digest are in the `where`, so a valid token
+ * presented against a different listing's id resolves to nothing: a token is
+ * bound to one listing and grants access to no other. `status: "draft"` is in
+ * there too — `submit` clears the digest, so a token that leaks after
+ * submission is inert twice over.
+ *
+ * The comparison is an equality test on a 256-bit digest inside Postgres.
+ * There is no application-level secret compare to make constant-time, and no
+ * practical timing signal in matching digests of that width.
+ */
+async function findDraftByToken(
+  id: string,
+  resumeToken: string,
+): Promise<ProjectListingRow | null> {
+  return prisma.projectListing.findFirst({
+    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
+    select: PROJECT_LISTING_SELECT,
+  });
+}
+
+// ─── start (POST, anonymous) ────────────────────────────────────────────────
+
+/**
+ * `start` has one failure mode of its own to report (#5275): a `consents`
+ * map that does not GRANT every purpose the site's registry marks required —
+ * declined, or simply absent. The legacy literal says the founder consented;
+ * a `false` (or nothing) beside it for the required purpose says they did
+ * not — the body contradicts itself, and the row must not be created on it
+ * (it would go on to publish the founder's address against a recorded
+ * decline, or with no evidence row at all). An oversized map is the same
+ * 400. Everything else is as before: the site's config falls back to the
+ * platform defaults rather than erroring, and a Prisma failure is a 500
+ * through the framework. The Lead write — the step that used to give this
+ * operation a `persist_failed`/`config_missing` surface — moved to `submit`.
+ */
+export type StartProjectListingDraftResult =
+  | {
+      ok: true;
+      id: string;
+      resumeToken: string;
+    }
+  | { ok: false; error: { kind: "invalid_input"; message: string } };
+
+/**
+ * Create a `draft` from step one — the founder's name, email and consent.
+ *
+ * `siteId` is a PARAMETER, not a field of `input` (#5048 D2). The payload
+ * names the site by its public key and the route resolves it through
+ * `siteIdForPublicKey` before calling here, so no request body carries a
+ * tenant identifier and nothing a caller sends can choose which site an
+ * application is filed against.
+ *
+ * The site's own terms are read SERVER-SIDE and stamped now, so a listing is
+ * granted the terms that were in force when it applied; nothing in `input`
+ * can reach them. The applicant's *requested* window is clamped here, not
+ * rejected, because a founder who could post their own bound could post an
+ * unbounded one.
+ *
+ * No slug yet: it is derived from `name` at SUBMIT (#5033 D2), which is the
+ * first moment a name exists.
+ */
+export async function startProjectListingDraft(
+  siteId: string,
+  input: ProjectListingStartInput,
+): Promise<StartProjectListingDraftResult> {
+  const { founderName, requestedWindowDays } = input;
+  const founderEmail = normalizeFounderEmail(input.founderEmail);
+
+  const listingConfig = await listingConfigFor(siteId);
+  const windowDays = clampWindowDays(requestedWindowDays, listingConfig);
+
+  // #5275 — refuse BEFORE the row exists: a required purpose not granted
+  // (declined or absent) is a body that contradicts its own `consent: true`,
+  // and an oversized map is not a form's answer.
+  const consentConfig = await consentConfigForSite(siteId);
+  if (input.consents) {
+    if (Object.keys(input.consents).length > MAX_CONSENT_KEYS) {
+      return {
+        ok: false,
+        error: {
+          kind: "invalid_input",
+          message: `consents carries more than ${MAX_CONSENT_KEYS} purposes`,
+        },
+      };
+    }
+    const unmet = requiredConsentUnmet(consentConfig, input.consents);
+    if (unmet !== undefined) {
+      return {
+        ok: false,
+        error: {
+          kind: "invalid_input",
+          message: `required consent purpose "${unmet}" was not granted`,
+        },
+      };
+    }
+  }
+
+  const resumeToken = mintResumeToken();
+  // #5275 — the row and its grant record land in ONE transaction: from here
+  // on `consentAt` and the ConsentGrant row are stamped by the SAME
+  // affirmative act, and a grant write that fails takes the row with it
+  // rather than stranding a "consented" listing with no evidence (security
+  // review, Medium 2). A body carrying `consents` records the wording the
+  // founder read (resolved server-side from the same registry the renderer
+  // used, D7); a body carrying only the legacy `consent: true` literal
+  // records one grant marked unrecoverable (D11) rather than today's
+  // wording, which nobody was shown.
+  const consents = input.consents;
+  const locale = input.locale ?? "en";
+  const row = await prisma.$transaction(async (tx) => {
+    const created = await tx.projectListing.create({
+      data: {
+        siteId,
+        founderName,
+        founderEmail,
+        status: "draft",
+        consentAt: new Date(),
+        resumeTokenHash: hashResumeToken(resumeToken),
+        windowDays,
+      },
+      select: { id: true },
+    });
+    const subject = { siteId, subjectType: "project_listing", subjectId: created.id };
+    if (consents) {
+      await recordConsent({ ...subject, locale, config: consentConfig, consents }, tx);
+    } else {
+      await recordLegacyConsent({ ...subject, config: consentConfig }, tx);
+    }
+    return created;
+  });
+
+  return { ok: true, id: row.id, resumeToken };
+}
+
+// ─── patch (PATCH, anonymous, token-gated) ──────────────────────────────────
+
+export type PatchProjectListingDraftResult =
+  | { ok: true; value: ProjectListing }
+  | {
+      ok: false;
+      error:
+        | { kind: "not_found"; message: string }
+        | { kind: "invalid_input"; message: string };
+    };
+
+/**
+ * What `draftUpdateData` cannot read off the patch body (#5285).
+ *
+ * Both members are the SERVER's, and that is why they are a second argument
+ * rather than two more payload fields: `windowDays` is the applicant's
+ * request already clamped against the site's own maximum, and
+ * `storedSiteAnswers` is what is on the row, which the merge needs and a
+ * request body must never be able to supply.
+ */
+interface DraftUpdateContext {
+  /** The clamped window, when the patch asked for one. */
+  windowDays?: number;
+  /** The answers already stored, for the merge. */
+  storedSiteAnswers?: Record<string, string>;
+}
+
+/**
+ * Translate a validated partial application into a Prisma update.
+ *
+ * Only the keys the caller actually sent are written: an absent key is
+ * `undefined`, which Prisma omits from the UPDATE, so patching one field
+ * cannot blank the nine the founder filled in on earlier steps.
+ *
+ * #5279 — THIS IS WHERE THE DISPLAY ADDRESS IS COMPOSED, and the only place.
+ * `address` is a union of the legacy display STRING and the structured PARTS
+ * (`flowAddressValueSchema`), and the two branches write different columns:
+ *
+ *   string → `address` verbatim, no part column touched. A founder who typed
+ *            a line gets that line stored exactly as typed, and a draft
+ *            written before #5279 keeps patching as it always did.
+ *   parts  → the six part columns, PLUS `address` composed from them by
+ *            `composeAddressLine`.
+ *
+ * The derivation runs ONE WAY ONLY. Nothing anywhere derives parts from a
+ * line: address parsing guesses, and a wrong guess silently corrupts the
+ * party identification a listing's privacy notice points at (#5036 D6), with
+ * nothing on the row to mark it as invented.
+ */
+function draftUpdateData(
+  patch: ProjectListingDraftPatchInput,
+  context: DraftUpdateContext,
+): Prisma.ProjectListingUpdateInput {
+  return {
+    ...(patch.name !== undefined && { name: patch.name }),
+    ...(patch.headline !== undefined && { headline: patch.headline }),
+    ...(patch.oneLiner !== undefined && { oneLiner: patch.oneLiner }),
+    ...(patch.problem !== undefined && { problem: patch.problem }),
+    ...(patch.url !== undefined && { url: patch.url }),
+    ...(patch.product !== undefined && { product: patch.product }),
+    ...(patch.commitment !== undefined && { commitment: patch.commitment }),
+    ...(patch.teamComposition !== undefined && { teamComposition: patch.teamComposition }),
+    ...(patch.faqs !== undefined && { faqs: patch.faqs as unknown as Prisma.InputJsonValue }),
+    ...(patch.anythingElse !== undefined && { anythingElse: patch.anythingElse }),
+    ...(patch.address !== undefined &&
+      (typeof patch.address === "string"
+        ? { address: patch.address }
+        : {
+            address: composeAddressLine(patch.address),
+            addressLine1: patch.address.addressLine1,
+            addressLine2: patch.address.addressLine2 ?? null,
+            addressCity: patch.address.city,
+            addressRegion: patch.address.region,
+            addressPostalCode: patch.address.postalCode,
+            addressCountry: patch.address.country,
+          })),
+    ...(patch.founderCompany !== undefined && { founderCompany: patch.founderCompany }),
+    ...(patch.questions !== undefined && {
+      questions: patch.questions as unknown as Prisma.InputJsonValue,
+    }),
+    ...(patch.logoMarkUrl !== undefined && { logoMarkUrl: patch.logoMarkUrl }),
+    ...(patch.logoWordmarkUrl !== undefined && {
+      logoWordmarkUrl: patch.logoWordmarkUrl,
+    }),
+    // #5285 — the applicant's REQUEST, already clamped by the caller against
+    // the site's own `maxWindowDays`. It is written to `windowDays`, the same
+    // column `start` writes, because there is one window per listing and the
+    // screen that asks for it is the site's choice of screen, not a second
+    // field. Clamped and not refused, for the reason `startProjectListingDraft`
+    // gives: a founder who could post their own bound could post an unbounded
+    // one.
+    ...(context.windowDays !== undefined && { windowDays: context.windowDays }),
+    // #5285 — MERGED, never replaced. A founder patches one screen at a time,
+    // so a body carrying screen four's two answers must not blank screen
+    // two's. The incoming keys win; everything already stored is carried.
+    // Every incoming id was checked against the site's declarations by the
+    // compiled patch schema, so nothing undeclared can enter here.
+    ...(patch.siteAnswers !== undefined && {
+      siteAnswers: {
+        ...context.storedSiteAnswers,
+        ...patch.siteAnswers,
+      } as Prisma.InputJsonValue,
+    }),
+  };
+}
+
+/**
+ * Merge a partial application into a draft and hand back the merged row.
+ *
+ * Enforces NO completeness — that is `submit`'s job alone, and the split is
+ * the whole point of the lifecycle. Returning the merged row is what makes a
+ * step's save verifiable by the client that wrote it.
+ */
+export async function patchProjectListingDraft(
+  id: string,
+  resumeToken: string,
+  body: unknown,
+): Promise<PatchProjectListingDraftResult> {
+  // The word caps are the SITE's (#5048 D6), so the body cannot be validated
+  // until the draft's site is known. This read resolves that and nothing
+  // else — it is not the write's guard, which stays the compare-and-swap
+  // below. A caller holding no valid token never gets past it, so a bad token
+  // still answers `not_found` before any body is inspected.
+  const owner = await prisma.projectListing.findFirst({
+    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
+    // #5285 — `siteAnswers` rides this read because the write MERGES into it
+    // (a founder patches one screen at a time). It is still not the write's
+    // guard: the compare-and-swap below is, and a concurrent patch of a
+    // DIFFERENT screen can still lose its answers to this one, exactly as it
+    // can already lose a column. The store is one row's worth of one
+    // founder's own form, not a shared document.
+    select: { siteId: true, siteAnswers: true },
+  });
+  if (!owner) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  const listingConfig = await listingConfigFor(owner.siteId);
+  const parsed = buildProjectListingDraftPatchSchema(
+    listingConfig.wordCaps,
+    listingConfig.collectedFields,
+    listingConfig.siteAnswers,
+  ).safeParse(body);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      error: {
+        kind: "invalid_input",
+        message: parsed.error.issues[0]?.message ?? "invalid input",
+      },
+    };
+  }
+  const patch: ProjectListingDraftPatchInput = parsed.data;
+
+  const stored = siteAnswersFromRow(owner.siteAnswers);
+  const context: DraftUpdateContext = {
+    // THE CLAMP, and the reason `requestedWindowDays` is safe to accept from
+    // an anonymous body at all (#5285). The site's `maxWindowDays` is read
+    // server-side and caps everything; the payload carries a REQUEST. A
+    // founder who could post their own bound could post an unbounded one, and
+    // this is the only place a patched window reaches a column.
+    ...(patch.requestedWindowDays !== undefined && {
+      windowDays: clampWindowDays(patch.requestedWindowDays, listingConfig),
+    }),
+    // What is on the row already, so the merge below adds to it rather than
+    // replacing it. It comes from the ROW and never from the body.
+    ...(stored !== null && { storedSiteAnswers: stored }),
+  };
+
+  // A GUARDED `updateMany`, not a read-then-write: the token check and the
+  // write are one statement, so a concurrent `submit` cannot flip the row to
+  // `requested` in between and let this patch land on an application the
+  // operator is already reviewing (PR #5042 security review, finding 3). The
+  // same compare-and-swap shape `submit` and `decideListing` already use.
+  const updated = await prisma.projectListing.updateMany({
+    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
+    data: draftUpdateData(patch, context),
+  });
+  if (updated.count === 0) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  return { ok: true, value: toResponseRow(row, 0, new Date(), true) };
+}
+
+// ─── submit (POST, anonymous, token-gated) ──────────────────────────────────
+
+export type SubmitProjectListingDraftResult =
+  | { ok: true; id: string; slug: string; listing: ProjectListing }
+  | {
+      ok: false;
+      error:
+        | { kind: "not_found"; message: string }
+        | { kind: "incomplete"; message: string; missingFields: string[] }
+        | { kind: "listing_limit_reached"; message: string }
+        | { kind: "slug_taken"; message: string };
+    };
+
+/**
+ * The application, assembled from the stored row for `submit` to validate.
+ *
+ * Narrowed to the site's COLLECTED fields (#5048 D5). The built submit schema
+ * is `.strict()` over exactly that set, so a stored value for a field the site
+ * does not collect would otherwise fail as an unrecognised key — which is the
+ * right shape for a REQUEST body and the wrong one for a row that may carry a
+ * value written before the site narrowed its step set.
+ */
+function applicationFromRow(
+  row: ProjectListingRow,
+  collectedFields: readonly string[],
+): Record<string, unknown> {
+  const collected = new Set(collectedFields);
+  const all: Record<string, unknown> = {
+    name: row.name,
+    headline: row.headline,
+    oneLiner: row.oneLiner,
+    problem: row.problem,
+    ...(row.url !== null && { url: row.url }),
+    product: row.product,
+    commitment: row.commitment,
+    teamComposition: row.teamComposition,
+    faqs: row.faqs,
+    ...(row.anythingElse !== null && { anythingElse: row.anythingElse }),
+    address: row.address,
+    ...(row.founderCompany !== null && { founderCompany: row.founderCompany }),
+    questions: row.questions,
+    // #5285 — the three fields that became writable. Each is optional in the
+    // application schema, so a row that never carried one simply omits it and
+    // `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
+    // `windowDays` the row actually holds, not what was asked for: the
+    // request is not stored anywhere, and re-asserting it would be asserting
+    // a number nothing ever agreed to.
+    ...(row.logoMarkUrl !== null && { logoMarkUrl: row.logoMarkUrl }),
+    ...(row.logoWordmarkUrl !== null && { logoWordmarkUrl: row.logoWordmarkUrl }),
+    ...(row.windowDays !== null && { requestedWindowDays: row.windowDays }),
+  };
+  return Object.fromEntries(
+    Object.entries(all).filter(([key]) => collected.has(key)),
+  );
+}
+
+/**
+ * Count the founder's OTHER non-terminal listings on this site (#5036 D7).
+ *
+ * Drafts count. A limit drafts escaped would be evaded by never submitting,
+ * which is exactly the state a ten-step form leaves a founder in by default.
+ *
+ * The stored-status filter is a first pass, not the answer: `closed` is
+ * computed, so an `active` row whose window has elapsed is terminal and must
+ * not count. `computeListingStatus` is the one place that knows this, and
+ * consulting it here is the same discipline the CSV sweep learned in #5033.
+ */
+async function countOtherNonTerminalListings(
+  siteId: string,
+  founderEmail: string,
+  exceptId: string,
+): Promise<number> {
+  const now = new Date();
+  const draftCutoff = new Date(now.getTime() - DRAFT_HOLDS_A_SLOT_DAYS * 24 * 60 * 60 * 1000);
+
+  const rows = await prisma.projectListing.findMany({
+    where: {
+      siteId,
+      founderEmail,
+      id: { not: exceptId },
+      OR: [
+        // Every non-terminal state except `draft`, which the clause below
+        // handles on its own terms. Derived from the shared constant rather
+        // than typed out, so a fifth non-terminal state is counted the day it
+        // is added.
+        {
+          status: {
+            in: PROJECT_LISTING_NON_TERMINAL_STATUSES.filter((s) => s !== "draft"),
+          },
+        },
+        // A draft holds a slot only while it is live — see
+        // `DRAFT_HOLDS_A_SLOT_DAYS`. It still counts, so not submitting evades
+        // nothing; it just stops counting once the application is plainly
+        // abandoned, which is what keeps an unverified email from locking a
+        // named founder out permanently.
+        { status: "draft", createdAt: { gt: draftCutoff } },
+      ],
+    },
+    select: { status: true, windowEndsAt: true, featured: true },
+  });
+  return rows.filter(
+    (r) => computeListingStatus(r.status, r.windowEndsAt, now, r.featured) !== "closed",
+  ).length;
+}
+
+/**
+ * Validate the whole application and move the row `draft` -> `requested`.
+ *
+ * Three things happen here and nowhere else: completeness is asserted (an
+ * incomplete draft comes back with the offending fields NAMED, so the form can
+ * send the founder to the step that owns each one); the concurrent-listing
+ * limit binds; and the slug is derived, which is the first moment a `name`
+ * exists to derive it from.
+ *
+ * The transition write is a GUARDED `updateMany` on `status: "draft"`, so two
+ * concurrent submits of the same draft cannot both succeed — the loser reads
+ * as `not_found`, the same answer a spent token gets. The token's digest is
+ * cleared in that same write: a token that leaks after submission grants
+ * nothing.
+ *
+ * The Lead write and the Slack post are both side effects of that committed
+ * transition and both fail soft, in that order — never before it, or a submit
+ * that lost the race would still have put an application in the operator's
+ * pipeline with no listing behind it.
+ */
+export async function submitProjectListingDraft(
+  id: string,
+  resumeToken: string,
+  sourceMeta: SourceMeta,
+): Promise<SubmitProjectListingDraftResult> {
+  const draft = await findDraftByToken(id, resumeToken);
+  if (!draft) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  // #5048 D5 — completeness derives from the site's CONFIGURED collected-field
+  // set, never from a fixed schema. Steps are individually optional, so a
+  // field whose step the site never rendered was never asked for; requiring it
+  // would refuse a valid application naming a question the founder never saw.
+  //
+  // The set comes from the site's own server-side `SiteListingConfig`. It is
+  // never read from the request: a caller that could post its own required-
+  // field set could post an empty one and submit a blank listing.
+  const listingConfig = await listingConfigFor(draft.siteId);
+  const submitSchema = buildProjectListingSubmitSchema(
+    listingConfig.wordCaps,
+    listingConfig.collectedFields,
+  );
+  const parsed = submitSchema.safeParse(
+    applicationFromRow(draft, listingConfig.collectedFields),
+  );
+  if (!parsed.success) {
+    const missingFields = [
+      ...new Set(parsed.error.issues.map((issue) => String(issue.path[0]))),
+    ].sort();
+    return {
+      ok: false,
+      error: {
+        kind: "incomplete",
+        message: `application is incomplete: ${missingFields.join(", ")}`,
+        missingFields,
+      },
+    };
+  }
+
+  const concurrent = await countOtherNonTerminalListings(
+    draft.siteId,
+    draft.founderEmail,
+    draft.id,
+  );
+  if (concurrent >= PROJECT_LISTING_CONCURRENT_LIMIT) {
+    return {
+      ok: false,
+      error: {
+        kind: "listing_limit_reached",
+        message: `a founder may hold at most ${PROJECT_LISTING_CONCURRENT_LIMIT} listings at once`,
+      },
+    };
+  }
+
+  // `name` may be absent from the picked schema if a site does not collect it
+  // (#5048 D5), so the slug derives from the ROW rather than from the parsed
+  // payload. A site that collects no name has none to derive from, and the
+  // founder's own name is the only other stable string on the row.
+  const base = deriveListingSlug(draft.name ?? draft.founderName);
+  const slug = await firstFreeSlug(draft.siteId, base);
+
+  const transition = async (candidate: string): Promise<number | "taken"> => {
+    try {
+      const updated = await prisma.projectListing.updateMany({
+        where: { id, status: "draft" },
+        data: { status: "requested", slug: candidate, resumeTokenHash: null },
+      });
+      return updated.count;
+    } catch (err) {
+      if (isUniqueViolation(err)) return "taken";
+      throw err;
+    }
+  };
+
+  let count = await transition(slug);
+  if (count === "taken") {
+    // `firstFreeSlug` samples at most 200 same-prefix rows, so a family larger
+    // than that can hand back a slug that is in fact taken — and a plain retry
+    // resamples and fails the same way, which would let a squatted prefix wall
+    // off every later applicant whose name derives to it (PR #5042 security
+    // review, finding 2). One random suffix ends that: an ugly slug beats an
+    // application that cannot be submitted at all.
+    count = await transition(`${base}-${randomBytes(3).toString("hex")}`);
+  }
+  if (count === "taken") {
+    return {
+      ok: false,
+      error: { kind: "slug_taken", message: "slug already in use for this site" },
+    };
+  }
+  if (count === 0) {
+    // A concurrent submit won the race and already spent this draft.
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  // The Lead write reuses routeLead — never a duplicate persistence path — and
+  // happens at SUBMIT rather than at start, so an anonymous stranger cannot
+  // cause an operator notification by opening a draft they never finish.
+  //
+  // It runs AFTER the transition, and fails soft. Before the transition it
+  // would write a Lead (and mail the operator) for every submit that then lost
+  // the race or hit a taken slug — an application in the operator's pipeline
+  // with no listing behind it, and two Leads for the one submit that did land.
+  // After it, the worst case is a `requested` listing whose `leadId` is null,
+  // which the model allows and the weekly CSV sweep already skips explicitly.
+  // The submit itself has landed either way, and that is what the founder
+  // asked for; reporting it as a failure would be the wrong answer.
+  const leadResult = await routeLead(
+    {
+      kind: "submit",
+      siteId: draft.siteId,
+      source: "projects-apply",
+      email: draft.founderEmail,
+      payload: {
+        name: parsed.data.name,
+        oneLiner: parsed.data.oneLiner,
+        problem: parsed.data.problem,
+        product: parsed.data.product,
+        founderName: draft.founderName,
+        questions: parsed.data.questions,
+      },
+    },
+    sourceMeta,
+  );
+  if (leadResult.ok) {
+    await prisma.projectListing.update({
+      where: { id },
+      data: { leadId: leadResult.id },
+    });
+  } else {
+    logger.error(
+      { listingId: id, kind: leadResult.error.kind },
+      "[project-listings] the Lead write failed after a submitted listing already landed",
+    );
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
+  }
+
+  return {
+    ok: true,
+    id,
+    slug: row.slug!,
+    listing: toResponseRow(row, 0, new Date(), true),
+  };
+}
+
+function isUniqueViolation(err: unknown): boolean {
+  return (
+    err != null &&
+    typeof err === "object" &&
+    "code" in err &&
+    (err as { code: string }).code === "P2002"
+  );
+}
+
+// ─── List + get (tenant scope) ──────────────────────────────────────────────
+
+export async function listProjectListings(siteId: string): Promise<ProjectListing[]> {
+  const rows = await prisma.projectListing.findMany({
+    where: { siteId },
+    orderBy: { createdAt: "desc" },
+    select: PROJECT_LISTING_SELECT,
+  });
+  const counts = await attachWaitlistCounts(siteId, rows);
+  const now = new Date();
+  return rows.map((row) => toResponseRow(row, waitlistCountFor(row, counts), now, true));
+}
+
+export type GetProjectListingResult =
+  | { ok: true; value: ProjectListing }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+export async function getProjectListing(siteId: string, id: string): Promise<GetProjectListingResult> {
+  const row = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+  const counts = await attachWaitlistCounts(siteId, [row]);
+  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
+}
+
+// ─── The founder's own listings (auth scope; #5295) ─────────────────────────
+
+/**
+ * The listings the CALLING USER owns, newest first.
+ *
+ * The join is the owner link and ONLY the owner link:
+ * `ownerUserId === userId`, the scalar `listing-promotion.ts` stamps once that
+ * user's own email is verified, matches the row's `founderEmail`, and the row's
+ * site resolves to one of the user's own workspaces. `founderEmail` is NEVER
+ * compared here, at any stage — an un-linked listing that happens to carry the
+ * caller's address is not theirs until a promotion said so, and a read-time
+ * email match would reintroduce exactly the cross-founder capture the link
+ * exists to remove. (`flow-checkouts.ts` draws the same line for `Lead`.)
+ *
+ * No `siteId` parameter and no `currentSiteId()` scope, deliberately — and the
+ * reason is NOT that the two can never coincide. `siteIdForPublicKey`
+ * (`listing-config.ts`) does fall back to `currentSiteId()`, so a listing's
+ * `siteId` CAN be `AILK_SITE_ID` or the literal `"default"` on a single-tenant
+ * deployment. The reason is that the owner link is already the narrower scope:
+ * it is only ever stamped for a site inside the user's own tenancy
+ * (`listing-promotion.ts`, condition 3), so adding a site term could only
+ * remove rows the caller owns — and on the multi-tenant shape, where a
+ * listing's `siteId` is a WORKSPACE id rather than `AILK_SITE_ID`, it would
+ * remove all of them. The response omits `siteId` regardless, so no workspace
+ * id leaves the read.
+ *
+ * The one thing this gives up against the sibling `/me` routes: on a database
+ * shared by more than one site, a caller's rows from every such site come back
+ * together. They are all the caller's own rows, which is why that is acceptable
+ * here and not a disclosure.
+ *
+ * No verified-email re-check either. `flow-checkouts.ts` performs one as
+ * defence in depth beside its email-matching sibling
+ * (`waitlist-signups.ts`, where the gate is load-bearing because the match IS
+ * an email). Here the link is the proof, and it was only issuable under
+ * verification — so a re-check adds no safety, while failing a caller whose
+ * address later changed to an unverified one would wrongly hide the rows they
+ * already proved they own.
+ *
+ * `waitlistCount` is resolved PER SITE: the count is keyed by
+ * `(siteId, experimentKey)`, and a founder may own listings in more than one of
+ * their own workspaces, so counting them all under one site id would report
+ * another site's number.
+ *
+ * An empty array for a caller who owns nothing is the normal answer, not an
+ * error.
+ */
+export async function listMyProjectListings(userId: string): Promise<ProjectListing[]> {
+  const rows = await prisma.projectListing.findMany({
+    where: { ownerUserId: userId },
+    orderBy: { createdAt: "desc" },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (rows.length === 0) return [];
+
+  const rowsBySite = new Map<string, ProjectListingRow[]>();
+  for (const row of rows) {
+    const forSite = rowsBySite.get(row.siteId);
+    if (forSite) forSite.push(row);
+    else rowsBySite.set(row.siteId, [row]);
+  }
+  const countsBySite = new Map<string, Map<string, number>>();
+  await Promise.all(
+    [...rowsBySite].map(async ([siteId, siteRows]) => {
+      countsBySite.set(siteId, await attachWaitlistCounts(siteId, siteRows));
+    }),
+  );
+
+  const now = new Date();
+  // `featuredEnabled: true` — the founder's own row, like the operator's
+  // dashboard row, reports the flag as stored. It is the PUBLIC shelf the
+  // site's config switch governs, not what the row's owner may see.
+  return rows.map((row) =>
+    toResponseRow(
+      row,
+      waitlistCountFor(row, countsBySite.get(row.siteId) ?? new Map()),
+      now,
+      true,
+    ),
+  );
+}
+
+// ─── Patch (tenant scope; the featured flag) ───────────────────────────────
+
+export type SetListingFeaturedResult =
+  | { ok: true; value: ProjectListing }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+/**
+ * Set the operator's `featured` flag (#5033 D6).
+ *
+ * This is the only non-status write the PATCH route makes. STATUS
+ * transitions do not come through here at all — since the lifecycle
+ * collapsed to five states with `closed` computed, `requested -> active |
+ * rejected` is the only transition there is, and `decideListing` owns it for
+ * both the PATCH route and the Slack button. The old transition table (which
+ * also carried `approved -> live` and `live -> closed`) has no states left to
+ * describe.
+ */
+export async function setListingFeatured(
+  siteId: string,
+  id: string,
+  featured: boolean,
+): Promise<SetListingFeaturedResult> {
+  const updated = await prisma.projectListing.updateMany({
+    where: { id, siteId },
+    data: { featured },
+  });
+  if (updated.count === 0) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const counts = await attachWaitlistCounts(siteId, [row]);
+  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
+}
+
+// ─── Patch (tenant scope; the operator's copy edit) ─────────────────────────
+
+/**
+ * The five PUBLISHED copy fields an operator copy edit may rewrite.
+ *
+ * The set is deliberately narrow. `questions` is IN because its prompts and
+ * option labels render on the public page, which is precisely where abusive
+ * language would land. `name` is OUT because the slug is derived from it at
+ * submit and stored, so editing it would desync the public URL from the name.
+ * `url`, `product`, `commitment`, `teamComposition`, `address` and
+ * `founderCompany` are OUT because they are facts rather than copy — a wrong
+ * fact is a question to the founder or a reject, not an edit. `anythingElse`
+ * is OUT because it is a note to the reviewer and never renders.
+ *
+ * The request body is derived from the SAME package schema these keys name
+ * (`projectListingApplicationFieldsSchema`) at the route boundary, so every
+ * bound the application itself carries — the word caps, the fixed FAQ count,
+ * the question refinements — holds here for free.
+ */
+export type ProjectListingCopyEdit = Pick<
+  ProjectListingDraftPatchInput,
+  "headline" | "oneLiner" | "problem" | "faqs" | "questions"
+>;
+
+/**
+ * The WHERE terms that admit a copy edit: `requested`, or `active` as the row
+ * actually READS.
+ *
+ * `draft` is the applicant's own, held through the resume token, and stays
+ * theirs. `rejected` is terminal. `closed` is the awkward one, because nothing
+ * stores it: `computeListingStatus` derives it from a stored `active` whose
+ * window has elapsed, so scoping on the stored string alone would leave every
+ * closed listing editable. These three terms are that function's three
+ * accepting branches, transcribed — a featured row (window-exempt, #5036 D6b),
+ * or a window still in force. A non-featured row with a null or elapsed window
+ * matches none of them and is refused, exactly as it reads.
+ *
+ * `now` is a parameter so the one instant the caller renders the response
+ * against is the same instant the write is guarded by.
+ *
+ * This lives in the WHERE clause rather than in a read-then-write check, so a
+ * concurrent decision cannot slip the row out of the editable set between the
+ * check and the write — the same compare-and-swap discipline
+ * `patchProjectListingDraft` and `decideListing` use.
+ */
+function copyEditableWhere(now: Date): Prisma.ProjectListingWhereInput[] {
+  return [
+    { status: "requested" },
+    { status: "active", featured: true },
+    { status: "active", windowEndsAt: { gt: now } },
+  ];
+}
+
+export type PatchListingCopyResult =
+  | { ok: true; value: ProjectListing }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+/**
+ * Rewrite a listing's published copy, preserving what the applicant submitted.
+ *
+ * The third review outcome beside approve and reject: a listing whose copy
+ * needs a trim was previously publishable only exactly as written, because the
+ * legal transitions out of `requested` are `active` and `rejected`, there is no
+ * route back to `draft`, and `patchProjectListingDraft` is scoped to the
+ * applicant's own resume token.
+ *
+ * `submittedCopy` is WRITE-ONCE, on the first edit only. The read below is what
+ * resolves the pre-edit copy; it is NOT the write's guard, which stays the
+ * status-scoped `updateMany` — the same compare-and-swap shape
+ * `patchProjectListingDraft` and `decideListing` use. Because that read is one
+ * consistent snapshot, a row it saw with a null `submittedCopy` also carries
+ * the copy as the applicant submitted it, so two concurrent first edits write
+ * the same snapshot value rather than racing to a different one. Nothing
+ * clears the column, so the submitted copy stays recoverable for the life of
+ * the row.
+ *
+ * DELIBERATELY silent on the notification surfaces, unlike a decision. No
+ * founder email is sent, and the application's Slack card is not re-rendered,
+ * so a card posted before an edit keeps showing the pre-edit copy. Both are the
+ * decision path's concerns (`sendListingDecisionEmail`, `postListingApplication`)
+ * and neither is touched here. Worth revisiting if operators start editing
+ * before deciding often enough that the card misleads.
+ *
+ * The three audit columns are WRITE-ONLY at present: nothing reads them back,
+ * because the tenant read's response contract is `.strict()` and surfacing them
+ * would mean widening it. "Recoverable" therefore means recoverable from the
+ * row, not through an API.
+ *
+ * PII boundary: as everywhere else in this module, nothing here is logged.
+ */
+export async function patchListingCopy(
+  siteId: string,
+  id: string,
+  copy: ProjectListingCopyEdit,
+  editedBy: string,
+): Promise<PatchListingCopyResult> {
+  const before = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: {
+      submittedCopy: true,
+      headline: true,
+      oneLiner: true,
+      problem: true,
+      faqs: true,
+      questions: true,
+    },
+  });
+  if (!before) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const now = new Date();
+  const updated = await prisma.projectListing.updateMany({
+    where: { id, siteId, OR: copyEditableWhere(now) },
+    data: {
+      // Only the keys the operator actually sent are written; an absent key is
+      // `undefined`, which Prisma omits from the UPDATE, so trimming the
+      // headline cannot blank the FAQs.
+      ...(copy.headline !== undefined && { headline: copy.headline }),
+      ...(copy.oneLiner !== undefined && { oneLiner: copy.oneLiner }),
+      ...(copy.problem !== undefined && { problem: copy.problem }),
+      ...(copy.faqs !== undefined && { faqs: copy.faqs as unknown as Prisma.InputJsonValue }),
+      ...(copy.questions !== undefined && {
+        questions: copy.questions as unknown as Prisma.InputJsonValue,
+      }),
+      ...(before.submittedCopy === null && {
+        submittedCopy: {
+          headline: before.headline,
+          oneLiner: before.oneLiner,
+          problem: before.problem,
+          faqs: before.faqs,
+          questions: before.questions,
+        } as unknown as Prisma.InputJsonValue,
+      }),
+      copyEditedAt: now,
+      copyEditedBy: editedBy,
+    },
+  });
+  if (updated.count === 0) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const row = await prisma.projectListing.findFirst({
+    where: { id, siteId },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (!row) {
+    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
+  }
+
+  const counts = await attachWaitlistCounts(siteId, [row]);
+  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), now, true) };
+}
+
+// ─── Public read (anonymous) ────────────────────────────────────────────────
+
+/**
+ * The page-render read (#4998 AC4, reshaped by #5033): every `active` row for
+ * the site, the THREE newest by `decidedAt` first, then the rest by
+ * `waitlistCount` desc, then `decidedAt` desc. `founderEmail` never leaves
+ * this function.
+ *
+ * Rows whose window has elapsed are returned and read `closed` — computed,
+ * per row, against one instant, with no job having run. They are not filtered
+ * out: a consumer partitions its shelves on the status it is handed, and a
+ * listing that quietly vanished at midnight would be a worse answer than one
+ * that says it is closed.
+ */
+export async function publicProjectListings(siteId: string): Promise<ProjectListingPublic[]> {
+  const listingConfig = await listingConfigFor(siteId);
+  const rows = await prisma.projectListing.findMany({
+    where: { siteId, status: "active" },
+    select: PROJECT_LISTING_SELECT,
+  });
+  const counts = await attachWaitlistCounts(siteId, rows);
+  const withCounts = rows.map((row) => ({ row, waitlistCount: waitlistCountFor(row, counts) }));
+
+  const decidedAtMs = (row: ProjectListingRow): number => row.decidedAt?.getTime() ?? -Infinity;
+
+  const newestFirst = [...withCounts].sort((a, b) => decidedAtMs(b.row) - decidedAtMs(a.row));
+  const top3 = newestFirst.slice(0, 3);
+  const top3Ids = new Set(top3.map((t) => t.row.id));
+
+  const rest = withCounts
+    .filter((t) => !top3Ids.has(t.row.id))
+    .sort((a, b) => {
+      if (b.waitlistCount !== a.waitlistCount) return b.waitlistCount - a.waitlistCount;
+      return decidedAtMs(b.row) - decidedAtMs(a.row);
+    });
+
+  const now = new Date();
+  return [...top3, ...rest].map(({ row, waitlistCount }) => {
+    const { founderEmail: _founderEmail, ...publicRow } = toResponseRow(
+      row,
+      waitlistCount,
+      now,
+      listingConfig.featuredEnabled,
+    );
+    // #5285 — the `public`-visibility answers ONLY. An `operator-only` answer
+    // is something a site asked for its own triage, and a founder who was
+    // told it would not be published has to be right about that; an answer
+    // whose id the site no longer declares is dropped for the same reason,
+    // because "no declaration" cannot be read as "public" on the read that
+    // publishes. The tenant dashboard and the review payload are the audience
+    // that sees the rest, and they do not come through here.
+    return {
+      ...publicRow,
+      siteAnswers: publicSiteAnswers(publicRow.siteAnswers, listingConfig.siteAnswers),
+    };
+  });
+}