create-ailk 0.21.0 → 0.23.0

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -23,9 +23,19 @@ jest.mock("../../lib/prisma.js");
 
 // ─── Mock: email (external boundary) ─────────────────────────────────────────
 const mockSendLeadNotification = jest.fn();
+const mockSendPurchaseConfirmationEmail = jest.fn();
 jest.mock("@working-theory/email", () => ({
   sendLeadNotification: (...args: unknown[]) =>
     mockSendLeadNotification(...args),
+  sendPurchaseConfirmationEmail: (...args: unknown[]) =>
+    mockSendPurchaseConfirmationEmail(...args),
+}));
+
+// ─── Mock: the plan-offerings lister (a content read) ────────────────────────
+const mockListPlanOfferings = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- plan-offerings.ts is the workspace's content-adapter read (the database adapter, an external boundary), the same seam routes/leads/__tests__/magnet-completion.test.ts mocks.
+jest.mock("../plan-offerings.js", () => ({
+  listPlanOfferings: (...args: unknown[]) => mockListPlanOfferings(...args),
 }));
 
 // ─── Import after mocks ───────────────────────────────────────────────────────
@@ -34,10 +44,21 @@ import * as os from "os";
 import * as path from "path";
 
 import { logger } from "@working-theory/observability";
+import {
+  ACCOUNT_TERMS_PURPOSE_ID,
+  CONSENT_LEAD_SOURCE_LIST,
+  consentPurposeById,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+} from "@working-theory/validation";
 
 import { MOCK_PERSON_ID } from "../../lib/__mocks__/prisma.js";
+import {
+  armConsentLedger,
+  type ConsentLedgerDouble,
+} from "../../lib/__tests__/consent-ledger-double.js";
 import { prisma } from "../../lib/prisma.js";
 import { routeLead } from "../lead-routing";
+import * as consentService from "../consent";
 import * as personService from "../person";
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -141,7 +162,9 @@ describe("routeLead", () => {
 
   // ── 2. DB down → fallback engages → persisted:file ───────────────────────
   it("DB down → file fallback → persisted:file", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+    (prisma.lead.create as jest.Mock).mockRejectedValue(
+      new Error("connection refused"),
+    );
 
     const result = (await routeLead(leadInput, sourceMeta)) as Extract<
       RouteLeadResult,
@@ -367,9 +390,12 @@ describe("routeLead", () => {
     const inputForService = {
       ...inputWithoutId,
       // Re-attach as a plain unknown property so Zod's strict() can reject it.
-      ...({"id": inputWithExtraId.id} as Record<string, unknown>),
+      ...({ id: inputWithExtraId.id } as Record<string, unknown>),
     } as Parameters<typeof routeLead>[0];
-    const result = (await routeLead(inputForService, sourceMeta)) as Extract<RouteLeadResult, { ok: false }>;
+    const result = (await routeLead(inputForService, sourceMeta)) as Extract<
+      RouteLeadResult,
+      { ok: false }
+    >;
 
     expect(result.ok).toBe(false);
     expect(result.error.kind).toBe("invalid_input");
@@ -433,7 +459,9 @@ describe("routeLead", () => {
 
       const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
       expect(data.siteId).toBe("wksp_00000000-0000-7000-8000-000000000001");
-      expect(data.workspaceId).toBe("wksp_00000000-0000-7000-8000-000000000001");
+      expect(data.workspaceId).toBe(
+        "wksp_00000000-0000-7000-8000-000000000001",
+      );
     });
   });
 
@@ -456,10 +484,10 @@ describe("routeLead", () => {
       );
       (prisma.lead.create as jest.Mock).mockRejectedValue(constraintErr);
 
-      const result = (await routeLead(
-        leadInput,
-        sourceMeta,
-      )) as Extract<RouteLeadResult, { ok: false }>;
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: false }
+      >;
 
       expect(result.ok).toBe(false);
       expect(result.error.kind).toBe("persist_failed");
@@ -475,10 +503,10 @@ describe("routeLead", () => {
       );
       (prisma.lead.create as jest.Mock).mockRejectedValue(checkErr);
 
-      const result = (await routeLead(
-        leadInput,
-        sourceMeta,
-      )) as Extract<RouteLeadResult, { ok: false }>;
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: false }
+      >;
 
       expect(result.ok).toBe(false);
       expect(result.error.kind).toBe("persist_failed");
@@ -489,15 +517,17 @@ describe("routeLead", () => {
     it("a bare SQLSTATE 23502 in the error message also re-raises as persist_failed", async () => {
       const before = await listTmpDirFiles();
       const notNullErr = Object.assign(
-        new Error("null value in column \"workspace_id\" violates not-null constraint (23502)"),
+        new Error(
+          'null value in column "workspace_id" violates not-null constraint (23502)',
+        ),
         {},
       );
       (prisma.lead.create as jest.Mock).mockRejectedValue(notNullErr);
 
-      const result = (await routeLead(
-        leadInput,
-        sourceMeta,
-      )) as Extract<RouteLeadResult, { ok: false }>;
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: false }
+      >;
 
       expect(result.ok).toBe(false);
       expect(result.error.kind).toBe("persist_failed");
@@ -512,10 +542,10 @@ describe("routeLead", () => {
         new Error("connection refused"),
       );
 
-      const result = (await routeLead(
-        leadInput,
-        sourceMeta,
-      )) as Extract<RouteLeadResult, { ok: true }>;
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
 
       expect(result.ok).toBe(true);
       expect(result.persisted).toBe("file");
@@ -542,14 +572,17 @@ describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () =>
     (prisma.subscriber.create as jest.Mock).mockRejectedValue(
       Object.assign(new Error("Unique constraint failed"), { code: "P2002" }),
     );
-    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({ id: "sub_1" });
+    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({
+      id: "sub_1",
+    });
 
     await routeLead(
       { ...subscribeInput, email: "dupe@example.com" },
       sourceMeta,
     );
 
-    const { where } = (prisma.subscriber.findUnique as jest.Mock).mock.calls[0][0];
+    const { where } = (prisma.subscriber.findUnique as jest.Mock).mock
+      .calls[0][0];
     expect(where.workspaceId).toBe(subscribeInput.siteId);
     expect(where.siteId_email).toEqual({
       siteId: subscribeInput.siteId,
@@ -588,7 +621,10 @@ describe("#6730 — routeLead delivery modes", () => {
     tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-delivery-test-"));
     process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_1" });
-    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
+    mockSendLeadNotification.mockResolvedValue({
+      ok: true,
+      messageId: "msg-1",
+    });
   });
 
   afterEach(async () => {
@@ -646,7 +682,10 @@ describe("#6730 — routeLead delivery modes", () => {
       });
 
       const result = await routeLead(leadInput, sourceMeta);
-      expect(result).toMatchObject({ ok: false, error: { kind: "delivery_failed" } });
+      expect(result).toMatchObject({
+        ok: false,
+        error: { kind: "delivery_failed" },
+      });
     });
 
     it("a callback is delivered by email too — carrying the name and number to call", async () => {
@@ -669,7 +708,10 @@ describe("#6730 — routeLead delivery modes", () => {
 
     it("a newsletter subscribe is refused with config_missing — a signup needs a database", async () => {
       const result = await routeLead(subscribeInput, sourceMeta);
-      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(result).toMatchObject({
+        ok: false,
+        error: { kind: "config_missing" },
+      });
       expect(prisma.subscriber.create).not.toHaveBeenCalled();
       expect(mockSendLeadNotification).not.toHaveBeenCalled();
     });
@@ -683,7 +725,10 @@ describe("#6730 — routeLead delivery modes", () => {
     it("refuses with config_missing before any write", async () => {
       const result = await routeLead(leadInput, sourceMeta);
 
-      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(result).toMatchObject({
+        ok: false,
+        error: { kind: "config_missing" },
+      });
       expect(prisma.lead.create).not.toHaveBeenCalled();
       expect(mockSendLeadNotification).not.toHaveBeenCalled();
       expect(await listFiles()).toEqual([]);
@@ -694,13 +739,18 @@ describe("#6730 — routeLead delivery modes", () => {
     beforeEach(() => {
       process.env.DATABASE_URL = "postgres://test";
       process.env.NODE_ENV = "production";
-      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+      (prisma.lead.create as jest.Mock).mockRejectedValue(
+        new Error("connection refused"),
+      );
     });
 
     it("no email vars → persist_failed, and the non-durable file fallback is not attempted", async () => {
       const result = await routeLead(leadInput, sourceMeta);
 
-      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(result).toMatchObject({
+        ok: false,
+        error: { kind: "persist_failed" },
+      });
       expect(await listFiles()).toEqual([]);
     });
 
@@ -719,11 +769,16 @@ describe("#6730 — routeLead delivery modes", () => {
 
     it("a newsletter signup is never emailed — persist_failed", async () => {
       Object.assign(process.env, EMAIL_ENV);
-      (prisma.subscriber.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+      (prisma.subscriber.create as jest.Mock).mockRejectedValue(
+        new Error("connection refused"),
+      );
 
       const result = await routeLead(subscribeInput, sourceMeta);
 
-      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(result).toMatchObject({
+        ok: false,
+        error: { kind: "persist_failed" },
+      });
       expect(mockSendLeadNotification).not.toHaveBeenCalled();
     });
 
@@ -735,7 +790,10 @@ describe("#6730 — routeLead delivery modes", () => {
       });
 
       const result = await routeLead(leadInput, sourceMeta);
-      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(result).toMatchObject({
+        ok: false,
+        error: { kind: "persist_failed" },
+      });
     });
   });
 
@@ -743,7 +801,9 @@ describe("#6730 — routeLead delivery modes", () => {
     it("DB down in test → persisted:file", async () => {
       process.env.DATABASE_URL = "postgres://test";
       process.env.NODE_ENV = "test";
-      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+      (prisma.lead.create as jest.Mock).mockRejectedValue(
+        new Error("connection refused"),
+      );
 
       const result = await routeLead(leadInput, sourceMeta);
       expect(result).toMatchObject({ ok: true, persisted: "file" });
@@ -951,6 +1011,140 @@ describe("#7869 — routeLead with an idempotency key", () => {
   });
 });
 
+// ─── #8730, #9130 — a keyed consent-bearing lead replays ─────────────────────
+//
+// The route writes `payload.consent` on every request, its `acceptedAt` that
+// request's receive time, so a retry's payload differs from the stored one
+// there and nowhere else. The replay comparison leaves it out for EVERY
+// consent-bearing source — iterating the list, so a source added to it later
+// cannot be gated by the route yet compared here.
+describe("#8730, #9130 — routeLead replays a keyed consent-bearing lead", () => {
+  const KEY = "fixture-retry-0000-0000-9130";
+  const STORED_ID = "lead_00000000-0000-7000-8000-000000009131";
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "AILK_INBOX_FALLBACK_DIR",
+    "LEAD_CAPTURE_FILE",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  let tmpDir: string;
+
+  const consentAt = (acceptedAt: string) => ({
+    statement: "I accept the terms.",
+    acceptedAt,
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-consent-replay-"));
+    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
+    process.env.DATABASE_URL = "postgres://stub";
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_new" });
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
+  });
+
+  afterEach(async () => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  it("covers every consent-bearing source, the job application included", () => {
+    expect(CONSENT_LEAD_SOURCE_LIST).toContain("flow:job-application");
+  });
+
+  it.each(CONSENT_LEAD_SOURCE_LIST)(
+    "%s — a retry whose only difference is the server-written payload.consent replays the stored lead",
+    async (source) => {
+      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+        id: STORED_ID,
+        email: "visitor@example.com",
+        source,
+        payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
+      });
+
+      const result = await routeLead(
+        {
+          kind: "submit",
+          siteId: "site-abc",
+          source,
+          email: "visitor@example.com",
+          payload: { name: "Jamie", consent: consentAt("2026-10-18T12:00:00.000Z") },
+        },
+        sourceMeta,
+        { idempotencyKey: KEY },
+      );
+
+      expect(result).toMatchObject({ ok: true, replayed: true, id: STORED_ID });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    },
+  );
+
+  it.each(CONSENT_LEAD_SOURCE_LIST)(
+    "%s — a retry with a different form field is still a conflict",
+    async (source) => {
+      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+        id: STORED_ID,
+        email: "visitor@example.com",
+        source,
+        payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
+      });
+
+      const result = await routeLead(
+        {
+          kind: "submit",
+          siteId: "site-abc",
+          source,
+          email: "visitor@example.com",
+          payload: { name: "Someone else", consent: consentAt("2026-10-18T12:00:00.000Z") },
+        },
+        sourceMeta,
+        { idempotencyKey: KEY },
+      );
+
+      expect(result).toEqual({
+        ok: false,
+        error: { kind: "idempotency_conflict", message: "idempotency key reused" },
+      });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+    },
+  );
+
+  it("a source outside the list still compares payload.consent", async () => {
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+      id: STORED_ID,
+      email: "visitor@example.com",
+      source: "flow:quiz",
+      payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
+    });
+
+    const result = await routeLead(
+      {
+        kind: "submit",
+        siteId: "site-abc",
+        source: "flow:quiz",
+        email: "visitor@example.com",
+        payload: { name: "Jamie", consent: consentAt("2026-10-18T12:00:00.000Z") },
+      },
+      sourceMeta,
+      { idempotencyKey: KEY },
+    );
+
+    expect(result).toMatchObject({ ok: false, error: { kind: "idempotency_conflict" } });
+  });
+});
+
 // ─── #852 D6 — every submitted lead carries its Person ──────────────────────
 //
 // The Person step runs through the shared mock's `person` delegate, whose
@@ -967,14 +1161,20 @@ describe("#852 — the lead's Person (AC-3)", () => {
   let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
   const LEAD_ID = "lead_00000000-0000-7000-8000-000000000852";
   const createData = () =>
-    jest.mocked(prisma.lead.create).mock.calls[0]?.[0].data as Record<string, unknown>;
+    jest.mocked(prisma.lead.create).mock.calls[0]?.[0].data as Record<
+      string,
+      unknown
+    >;
   const personDelegate = () => ({
     findFirst: jest.mocked(prisma.person.findFirst),
     createMany: jest.mocked(prisma.person.createMany),
     updateMany: jest.mocked(prisma.person.updateMany),
   });
   const personCalls = () =>
-    Object.values(personDelegate()).reduce((n, fn) => n + fn.mock.calls.length, 0);
+    Object.values(personDelegate()).reduce(
+      (n, fn) => n + fn.mock.calls.length,
+      0,
+    );
   let warn: jest.SpyInstance;
   let error: jest.SpyInstance;
 
@@ -987,9 +1187,16 @@ describe("#852 — the lead's Person (AC-3)", () => {
     process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
     process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
-    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-852" });
-    warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined as never);
-    error = jest.spyOn(logger, "error").mockImplementation(() => undefined as never);
+    mockSendLeadNotification.mockResolvedValue({
+      ok: true,
+      messageId: "msg-852",
+    });
+    warn = jest
+      .spyOn(logger, "warn")
+      .mockImplementation(() => undefined as never);
+    error = jest
+      .spyOn(logger, "error")
+      .mockImplementation(() => undefined as never);
   });
 
   afterEach(() => {
@@ -1003,21 +1210,33 @@ describe("#852 — the lead's Person (AC-3)", () => {
 
   it("a submit writes the Person findOrCreatePerson returned for (siteId, email)", async () => {
     const result = await routeLead(
-      { ...leadInput, email: "Test@Example.com", payload: { name: "Tess", message: "hi" } },
+      {
+        ...leadInput,
+        email: "Test@Example.com",
+        payload: { name: "Tess", message: "hi" },
+      },
       sourceMeta,
     );
 
     expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
     expect(personDelegate()["findFirst"]).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { workspaceId: "site-abc", email: "test@example.com" } }),
+      expect.objectContaining({
+        where: { workspaceId: "site-abc", email: "test@example.com" },
+      }),
+    );
+    expect(createData()).toEqual(
+      expect.objectContaining({ personId: MOCK_PERSON_ID }),
     );
-    expect(createData()).toEqual(expect.objectContaining({ personId: MOCK_PERSON_ID }));
   });
 
   // ── #8435 D5 (AC-3) — subscribers and callbacks link to their Person ─────
   const LINKED = {
     ok: true as const,
-    value: { personId: MOCK_PERSON_ID as never, created: false, billing: "unchanged" as const },
+    value: {
+      personId: MOCK_PERSON_ID as never,
+      created: false,
+      billing: "unchanged" as const,
+    },
   };
   const findSpies: jest.SpyInstance[] = [];
   const spyFind = () => {
@@ -1029,54 +1248,88 @@ describe("#852 — the lead's Person (AC-3)", () => {
     while (findSpies.length > 0) findSpies.pop()?.mockRestore();
   });
   const subscriberData = () =>
-    jest.mocked(prisma.subscriber.create).mock.calls[0]?.[0].data as Record<string, unknown>;
+    jest.mocked(prisma.subscriber.create).mock.calls[0]?.[0].data as Record<
+      string,
+      unknown
+    >;
   const callbackData = () =>
-    jest.mocked(prisma.callback.create).mock.calls[0]?.[0].data as Record<string, unknown>;
+    jest.mocked(prisma.callback.create).mock.calls[0]?.[0].data as Record<
+      string,
+      unknown
+    >;
 
   it("a subscribe calls findOrCreatePerson(siteId, { email }) once and writes that personId", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: "subscr_x" });
+    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
+      id: "subscr_x",
+    });
     const find = spyFind().mockResolvedValue(LINKED);
     await routeLead(subscribeInput, sourceMeta);
     expect(find).toHaveBeenCalledTimes(1);
-    expect(find).toHaveBeenCalledWith("site-abc", { email: "subscriber@example.com" });
-    expect(subscriberData()).toEqual(expect.objectContaining({ personId: MOCK_PERSON_ID }));
+    expect(find).toHaveBeenCalledWith("site-abc", {
+      email: "subscriber@example.com",
+    });
+    expect(subscriberData()).toEqual(
+      expect.objectContaining({ personId: MOCK_PERSON_ID }),
+    );
   });
 
   it("a subscribe whose Person is invalid_email writes personId: null and one person-skipped warn with no email", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: "subscr_x" });
+    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
+      id: "subscr_x",
+    });
     jest
       .spyOn(personService, "findOrCreatePerson")
       .mockResolvedValueOnce({ ok: false, error: { kind: "invalid_email" } });
     const result = await routeLead(subscribeInput, sourceMeta);
     expect(result).toMatchObject({ ok: true, id: "subscr_x", persisted: "db" });
-    expect(subscriberData()).toEqual(expect.objectContaining({ personId: null }));
-    const skipped = warn.mock.calls.filter(([fields]) => (fields as { event?: string }).event === "person-skipped");
+    expect(subscriberData()).toEqual(
+      expect.objectContaining({ personId: null }),
+    );
+    const skipped = warn.mock.calls.filter(
+      ([fields]) => (fields as { event?: string }).event === "person-skipped",
+    );
     expect(skipped).toHaveLength(1);
     expect(JSON.stringify(warn.mock.calls)).not.toContain("example.com");
   });
 
   it("a subscribe whose Person step fails (internal_error or a throw) answers exactly like a linked one", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({ id: "subscr_x" });
+    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
+      id: "subscr_x",
+    });
     const find = spyFind().mockResolvedValue(LINKED);
     const linked = await routeLead(subscribeInput, sourceMeta);
     jest.mocked(prisma.subscriber.create).mockClear();
 
-    find.mockResolvedValueOnce({ ok: false, error: { kind: "internal_error" } });
+    find.mockResolvedValueOnce({
+      ok: false,
+      error: { kind: "internal_error" },
+    });
     const failed = await routeLead(subscribeInput, sourceMeta);
     expect(failed).toEqual(linked);
-    expect(subscriberData()).toEqual(expect.objectContaining({ personId: null }));
-    expect(error.mock.calls.map(([fields]) => fields)).toContainEqual({ event: "person-failed", siteId: "site-abc" });
+    expect(subscriberData()).toEqual(
+      expect.objectContaining({ personId: null }),
+    );
+    expect(error.mock.calls.map(([fields]) => fields)).toContainEqual({
+      event: "person-failed",
+      siteId: "site-abc",
+    });
     jest.mocked(prisma.subscriber.create).mockClear();
 
     find.mockRejectedValueOnce(new Error("boom"));
     const thrown = await routeLead(subscribeInput, sourceMeta);
     expect(thrown).toEqual(linked);
-    expect(subscriberData()).toEqual(expect.objectContaining({ personId: null }));
+    expect(subscriberData()).toEqual(
+      expect.objectContaining({ personId: null }),
+    );
   });
 
   it("a duplicate subscribe (P2002) makes no second Person call", async () => {
-    (prisma.subscriber.create as jest.Mock).mockRejectedValue(Object.assign(new Error("dup"), { code: "P2002" }));
-    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({ id: "subscr_existing" });
+    (prisma.subscriber.create as jest.Mock).mockRejectedValue(
+      Object.assign(new Error("dup"), { code: "P2002" }),
+    );
+    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({
+      id: "subscr_existing",
+    });
     const find = spyFind().mockResolvedValue(LINKED);
     const result = await routeLead(subscribeInput, sourceMeta);
     expect(result).toMatchObject({ ok: true, id: "subscr_existing" });
@@ -1087,7 +1340,11 @@ describe("#852 — the lead's Person (AC-3)", () => {
     (prisma.callback.create as jest.Mock).mockResolvedValue({ id: "callbk_x" });
     const find = spyFind().mockResolvedValue(LINKED);
     await routeLead(
-      { ...callbackInput, phone: "+1 415 555 0123", payload: { email: "c@x.io" } },
+      {
+        ...callbackInput,
+        phone: "+1 415 555 0123",
+        payload: { email: "c@x.io" },
+      },
       sourceMeta,
     );
     expect(find).toHaveBeenCalledWith("site-abc", {
@@ -1095,27 +1352,32 @@ describe("#852 — the lead's Person (AC-3)", () => {
       name: "Alice",
       contact: { telephone: "+14155550123" },
     });
-    expect(callbackData()).toEqual(expect.objectContaining({ personId: MOCK_PERSON_ID }));
+    expect(callbackData()).toEqual(
+      expect.objectContaining({ personId: MOCK_PERSON_ID }),
+    );
   });
 
   it.each([
     ["no payload.email", { notes: "urgent" }],
     ["a numeric payload.email", { email: 12345 }],
-  ])("a callback with %s makes no person delegate call and writes no personId key", async (_label, payload) => {
-    (prisma.callback.create as jest.Mock).mockResolvedValue({ id: "callbk_x" });
-    await routeLead({ ...callbackInput, payload }, sourceMeta);
-    expect(personCalls()).toBe(0);
-    expect(Object.keys(callbackData())).not.toContain("personId");
-  });
+  ])(
+    "a callback with %s makes no person delegate call and writes no personId key",
+    async (_label, payload) => {
+      (prisma.callback.create as jest.Mock).mockResolvedValue({
+        id: "callbk_x",
+      });
+      await routeLead({ ...callbackInput, payload }, sourceMeta);
+      expect(personCalls()).toBe(0);
+      expect(Object.keys(callbackData())).not.toContain("personId");
+    },
+  );
 
   // ── #8435 D5 (AC-4) — a submit's explicit contact ────────────────────────
   it("a submit with options.contact.name passes that name over payload.name, and the normalized contact", async () => {
     const find = spyFind().mockResolvedValue(LINKED);
-    await routeLead(
-      { ...leadInput, payload: { name: "Bob" } },
-      sourceMeta,
-      { contact: { name: "Ann", givenName: "Ann", phone: "+1 (415) 555-0123" } },
-    );
+    await routeLead({ ...leadInput, payload: { name: "Bob" } }, sourceMeta, {
+      contact: { name: "Ann", givenName: "Ann", phone: "+1 (415) 555-0123" },
+    });
     expect(find).toHaveBeenCalledWith("site-abc", {
       email: "test@example.com",
       name: "Ann",
@@ -1128,7 +1390,10 @@ describe("#852 — the lead's Person (AC-3)", () => {
   it("a submit with no options.contact passes payload.name and no contact, as before", async () => {
     const find = spyFind().mockResolvedValue(LINKED);
     await routeLead({ ...leadInput, payload: { name: "Bob" } }, sourceMeta);
-    expect(find).toHaveBeenCalledWith("site-abc", { email: "test@example.com", name: "Bob" });
+    expect(find).toHaveBeenCalledWith("site-abc", {
+      email: "test@example.com",
+      name: "Bob",
+    });
   });
 
   it("an invalid_email Person result writes the lead with personId: null and one person-skipped warn with no email", async () => {
@@ -1141,9 +1406,15 @@ describe("#852 — the lead's Person (AC-3)", () => {
 
     expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
     expect(createData()).toEqual(expect.objectContaining({ personId: null }));
-    const skipped = warn.mock.calls.filter(([fields]) => (fields as { event?: string }).event === "person-skipped");
+    const skipped = warn.mock.calls.filter(
+      ([fields]) => (fields as { event?: string }).event === "person-skipped",
+    );
     expect(skipped).toHaveLength(1);
-    expect(skipped[0]![0]).toEqual({ event: "person-skipped", kind: "invalid_email", siteId: "site-abc" });
+    expect(skipped[0]![0]).toEqual({
+      event: "person-skipped",
+      kind: "invalid_email",
+      siteId: "site-abc",
+    });
     expect(JSON.stringify(warn.mock.calls)).not.toContain("example.com");
   });
 
@@ -1165,18 +1436,30 @@ describe("#852 — the lead's Person (AC-3)", () => {
     const ok = await routeLead(leadInput, sourceMeta);
     jest.mocked(prisma.lead.create).mockClear();
     mockSendLeadNotification.mockClear();
-    personDelegate()["findFirst"]!.mockRejectedValueOnce(new Error("relation \"people\" does not exist"));
+    personDelegate()["findFirst"]!.mockRejectedValueOnce(
+      new Error('relation "people" does not exist'),
+    );
 
     const failed = await routeLead(leadInput, sourceMeta);
 
     // The answer is the same as a successful capture, apart from the internal
     // `personId` (#8438 D11) the route never puts on a wire.
     expect(failed).toEqual({ ...ok, personId: null });
-    expect(failed).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db", email: { ok: true } });
+    expect(failed).toMatchObject({
+      ok: true,
+      id: LEAD_ID,
+      persisted: "db",
+      email: { ok: true },
+    });
     expect(createData()).toEqual(expect.objectContaining({ personId: null }));
-    const lines = error.mock.calls.filter(([fields]) => (fields as { event?: string }).event === "person-failed");
+    const lines = error.mock.calls.filter(
+      ([fields]) => (fields as { event?: string }).event === "person-failed",
+    );
     expect(lines).toHaveLength(1);
-    expect(lines[0]![0]).toEqual({ event: "person-failed", siteId: "site-abc" });
+    expect(lines[0]![0]).toEqual({
+      event: "person-failed",
+      siteId: "site-abc",
+    });
     expect(JSON.stringify(error.mock.calls)).not.toContain("test@example.com");
   });
 });
@@ -1187,7 +1470,11 @@ describe("#852 — the lead's Person (AC-3)", () => {
 // paid checkout lead a registered spoke's server posted with the session id
 // as its key. Every other lead makes no plan call; a failing plan step never
 // changes the lead's result.
-describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
+// #8793 D1 — a marked checkout lead HOLDS its plan: it never writes a
+// Person's plan, logs `held` (or `skipped` for an offering that is no key),
+// and the plan is released only at the Person's verified first link
+// (`person.test.ts`, `checkout-plan.test.ts`).
+describe("#7877 — the checkout lead holds the plan (AC-5; #8793 D1, AC-7)", () => {
   const ENV_KEYS = [
     "DATABASE_URL",
     "NODE_ENV",
@@ -1204,7 +1491,11 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     siteId: WS,
     source: "web",
     email: "cleo@x.io",
-    payload: { site: "wendi", page: "checkout", offering: "wendi_retainer" } as Record<string, unknown>,
+    payload: {
+      site: "wendi",
+      page: "checkout",
+      offering: "wendi_retainer",
+    } as Record<string, unknown>,
   };
   let setPlan: jest.SpyInstance;
   let info: jest.SpyInstance;
@@ -1220,10 +1511,19 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
     (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
     (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-7877" });
-    setPlan = jest.spyOn(personService, "setPersonPlanOffering").mockResolvedValue("set");
-    info = jest.spyOn(logger, "info").mockImplementation(() => undefined as never);
-    error = jest.spyOn(logger, "error").mockImplementation(() => undefined as never);
+    mockSendLeadNotification.mockResolvedValue({
+      ok: true,
+      messageId: "msg-7877",
+    });
+    setPlan = jest
+      .spyOn(personService, "setPersonPlanOffering")
+      .mockResolvedValue("set");
+    info = jest
+      .spyOn(logger, "info")
+      .mockImplementation(() => undefined as never);
+    error = jest
+      .spyOn(logger, "error")
+      .mockImplementation(() => undefined as never);
   });
 
   afterEach(() => {
@@ -1240,31 +1540,61 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     [...info.mock.calls, ...error.mock.calls]
       .map(([fields]) => fields as Record<string, unknown>)
       .filter((fields) => fields.event === "checkout-plan");
+  /** Every `checkout-plan` line is logged at `info`, never at `error`. */
+  const infoPlanLines = () =>
+    info.mock.calls
+      .map(([fields]) => fields as Record<string, unknown>)
+      .filter((fields) => fields.event === "checkout-plan");
+  /** The lead's answer, as it was before #8793. */
+  const answered = {
+    ok: true,
+    id: LEAD_ID,
+    personId: MOCK_PERSON_ID,
+    persisted: "db",
+    email: { ok: true, messageId: "msg-7877" },
+  };
 
-  it("a live spoke checkout lead sets the plan to the offering minus the <site>_ prefix", async () => {
-    const result = await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(setPlan).toHaveBeenCalledTimes(1);
-    expect(setPlan).toHaveBeenCalledWith(WS, MOCK_PERSON_ID, "retainer");
-    expect(planLines()).toEqual([{ event: "checkout-plan", outcome: "set", siteId: WS }]);
+  it("a live spoke checkout lead holds the plan: no plan write, one held line", async () => {
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(result).toEqual(answered);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(jest.mocked(prisma.person.updateMany)).not.toHaveBeenCalled();
+    expect(infoPlanLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
+    expect(planLines()).toEqual(infoPlanLines());
   });
 
-  it("a bare slug offering is taken as it is", async () => {
+  it("a bare slug offering is held as it is", async () => {
     await routeLead(
-      { ...checkoutLead, payload: { ...checkoutLead.payload, offering: "retainer" } },
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, offering: "retainer" },
+      },
       spokeMeta,
       { idempotencyKey: KEY },
     );
-    expect(setPlan).toHaveBeenCalledWith(WS, MOCK_PERSON_ID, "retainer");
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
   });
 
   it("a positive integer amountTotal still qualifies", async () => {
     await routeLead(
-      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: 4900 } },
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, amountTotal: 4900 },
+      },
       spokeMeta,
       { idempotencyKey: KEY },
     );
-    expect(setPlan).toHaveBeenCalledTimes(1);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toEqual([
+      { event: "checkout-plan", outcome: "held", siteId: WS },
+    ]);
   });
 
   it.each([
@@ -1278,16 +1608,27 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     ],
     [
       "a negative amountTotal",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: -5 } },
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, amountTotal: -5 },
+      },
       spokeMeta,
       KEY,
     ],
-    ["a key that is not a session id", checkoutLead, spokeMeta, "abcdefghijklmnop"],
+    [
+      "a key that is not a session id",
+      checkoutLead,
+      spokeMeta,
+      "abcdefghijklmnop",
+    ],
     ["no key", checkoutLead, spokeMeta, undefined],
     ["source contact", { ...checkoutLead, source: "contact" }, spokeMeta, KEY],
     [
       "page contact",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, page: "contact" } },
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, page: "contact" },
+      },
       spokeMeta,
       KEY,
     ],
@@ -1313,18 +1654,27 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
   // checkout (`Lead.spokeCheckout`): the plan rule's own predicate, plus "not
   // relayed". An unmarked create names no `spokeCheckout` key at all.
   const createData = () =>
-    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<string, unknown>;
+    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<
+      string,
+      unknown
+    >;
 
-  it("a live spoke checkout lead is created with spokeCheckout true and still sets the plan once", async () => {
+  it("a live spoke checkout lead is created with spokeCheckout true and holds the plan once", async () => {
     await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
     expect(createData()).toMatchObject({ spokeCheckout: true });
-    expect(setPlan).toHaveBeenCalledTimes(1);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toHaveLength(1);
   });
 
-  it("the same lead relayed for a visitor is created with no spokeCheckout key and still sets the plan", async () => {
-    await routeLead(checkoutLead, { ...spokeMeta, relayed: true }, { idempotencyKey: KEY });
+  it("the same lead relayed for a visitor is created with no spokeCheckout key and holds no plan", async () => {
+    await routeLead(
+      checkoutLead,
+      { ...spokeMeta, relayed: true },
+      { idempotencyKey: KEY },
+    );
     expect(createData()).not.toHaveProperty("spokeCheckout");
-    expect(setPlan).toHaveBeenCalledTimes(1);
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planLines()).toEqual([]);
   });
 
   it.each([
@@ -1338,16 +1688,27 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
     ],
     [
       "a negative amountTotal",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: -5 } },
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, amountTotal: -5 },
+      },
       spokeMeta,
       KEY,
     ],
-    ["a key that is not a session id", checkoutLead, spokeMeta, "abcdefghijklmnop"],
+    [
+      "a key that is not a session id",
+      checkoutLead,
+      spokeMeta,
+      "abcdefghijklmnop",
+    ],
     ["no key", checkoutLead, spokeMeta, undefined],
     ["source contact", { ...checkoutLead, source: "contact" }, spokeMeta, KEY],
     [
       "page contact",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, page: "contact" } },
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, page: "contact" },
+      },
       spokeMeta,
       KEY,
     ],
@@ -1357,24 +1718,48 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
       spokeMeta,
       KEY,
     ],
-  ] as const)("no spokeCheckout key in the create data for %s", async (_label, input, meta, key) => {
-    await routeLead(
-      input as typeof checkoutLead,
-      meta,
-      key === undefined ? {} : { idempotencyKey: key },
-    );
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    expect(createData()).not.toHaveProperty("spokeCheckout");
-  });
+  ] as const)(
+    "no spokeCheckout key in the create data for %s",
+    async (_label, input, meta, key) => {
+      await routeLead(
+        input as typeof checkoutLead,
+        meta,
+        key === undefined ? {} : { idempotencyKey: key },
+      );
+      expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+      expect(createData()).not.toHaveProperty("spokeCheckout");
+    },
+  );
 
   it("an offering that is not a key after the strip logs skipped and makes no plan call", async () => {
-    await routeLead(
-      { ...checkoutLead, payload: { ...checkoutLead.payload, offering: "Wendi_Retainer!" } },
+    const result = await routeLead(
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, offering: "Wendi_Retainer!" },
+      },
       spokeMeta,
       { idempotencyKey: KEY },
     );
+    expect(result).toEqual(answered);
     expect(setPlan).not.toHaveBeenCalled();
-    expect(planLines()).toEqual([{ event: "checkout-plan", outcome: "skipped", siteId: WS }]);
+    expect(infoPlanLines()).toEqual([
+      { event: "checkout-plan", outcome: "skipped", siteId: WS },
+    ]);
+    expect(planLines()).toEqual(infoPlanLines());
+  });
+
+  it("no checkout-plan line names an email, an offering or a key", async () => {
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    expect(planLines()).toHaveLength(1);
+    for (const line of planLines()) {
+      expect(line).not.toHaveProperty("email");
+      expect(line).not.toHaveProperty("offering");
+      expect(line).not.toHaveProperty("key");
+    }
+    const logged = JSON.stringify(planLines());
+    expect(logged).not.toContain("retainer");
+    expect(logged).not.toContain("cleo@x.io");
+    expect(logged).not.toContain(KEY);
   });
 
   it("a replayed key writes nothing and sets nothing", async () => {
@@ -1384,27 +1769,892 @@ describe("#7877 — the checkout lead sets the plan (AC-5)", () => {
       source: checkoutLead.source,
       payload: checkoutLead.payload,
     });
-    const result = await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
     expect(result).toMatchObject({ ok: true, replayed: true, id: LEAD_ID });
     expect(prisma.lead.create).not.toHaveBeenCalled();
     expect(setPlan).not.toHaveBeenCalled();
   });
+});
+
+describe("#8757 D14 — a spoke checkout's purchase email and Inbox message (AC-11)", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+    "AILK_DELIVERABLE_EMAIL_FROM",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008757";
+  const WS = "wksp_00000000-0000-7000-8000-000000008757";
+  const KEY = "cs_live_d14Purchase"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8757 AC-11), not a credential
+  const ORIGIN = "https://spoke.example";
+  const spokeMeta = { ...sourceMeta, viaSpoke: true };
+  const checkoutLead = {
+    kind: "submit" as const,
+    siteId: WS,
+    source: "web",
+    email: "Cleo@X.io",
+    payload: {
+      site: "wendi",
+      page: "checkout",
+      offering: "wendi_retainer",
+      amountTotal: 4900,
+      currency: "usd",
+    } as Record<string, unknown>,
+  };
+  // The lead table's count — the per-recipient cap's one read. The shared
+  // prisma double does not carry it, so this suite arranges it.
+  const leadCount = jest.fn();
+  let setPlan: jest.SpyInstance;
+  let info: jest.SpyInstance;
+  let error: jest.SpyInstance;
+
+  /** Let the fired (void) email step run to its end. */
+  const settle = async () => {
+    for (let i = 0; i < 5; i += 1)
+      await new Promise((resolve) => setImmediate(resolve));
+  };
+  const interactionCreates = () =>
+    jest.mocked(prisma.interaction.create).mock.calls;
+  const emailCalls = () => mockSendPurchaseConfirmationEmail.mock.calls;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    process.env.DATABASE_URL = "postgres://stub";
+    delete process.env.NODE_ENV;
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    delete process.env.AILK_DELIVERABLE_EMAIL_FROM;
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
+    Object.assign(prisma.lead, { count: leadCount });
+    leadCount.mockReset().mockResolvedValue(1);
+    jest
+      .mocked(prisma.interaction.create)
+      .mockResolvedValue({ id: "intx_1" } as never);
+    mockSendLeadNotification.mockResolvedValue({
+      ok: true,
+      messageId: "msg-8757",
+    });
+    mockSendPurchaseConfirmationEmail.mockResolvedValue({
+      ok: true,
+      messageId: "msg-buy",
+    });
+    mockListPlanOfferings.mockResolvedValue([
+      { key: "retainer", name: "Retainer", type: "service" },
+    ]);
+    setPlan = jest
+      .spyOn(personService, "setPersonPlanOffering")
+      .mockResolvedValue("set");
+    info = jest
+      .spyOn(logger, "info")
+      .mockImplementation(() => undefined as never);
+    error = jest
+      .spyOn(logger, "error")
+      .mockImplementation(() => undefined as never);
+  });
+
+  afterEach(() => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    Reflect.deleteProperty(prisma.lead, "count");
+    setPlan.mockRestore();
+    info.mockRestore();
+    error.mockRestore();
+  });
+
+  it("the first write sends one purchase email with the spoke's account link and writes one Inbox message", async () => {
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+
+    expect(emailCalls()).toHaveLength(1);
+    const [email] = emailCalls()[0] as [Record<string, string>];
+    expect(email).toMatchObject({
+      to: "Cleo@X.io",
+      fromAddress: "noreply@example.com",
+      subject: "Your purchase",
+      cta: "Open your account",
+      accountLink: `${ORIGIN}/api/hub-session/sign-in?next=%2Faccount&email=Cleo%40X.io`,
+    });
+    expect(email.body).toContain("Retainer");
+    expect(email.body).toContain("$49.00");
+
+    expect(interactionCreates()).toHaveLength(1);
+    const [{ data }] = interactionCreates()[0] as [
+      { data: Record<string, unknown> },
+    ];
+    expect(data).toEqual({
+      workspaceId: WS,
+      personId: MOCK_PERSON_ID,
+      channel: "member",
+      direction: "outbound",
+      subject: "Your purchase",
+      body: email.body,
+      createdBy: "system:checkout",
+    });
+    expect(mockListPlanOfferings).toHaveBeenCalledWith(WS);
+  });
+
+  it("an offering that is not listed is named 'your purchase' in both, never the raw string", async () => {
+    await routeLead(
+      {
+        ...checkoutLead,
+        payload: { ...checkoutLead.payload, offering: "wendi_<b>Mystery</b>" },
+      },
+      spokeMeta,
+      { idempotencyKey: KEY, accountOrigin: ORIGIN },
+    );
+    await settle();
+    const [email] = emailCalls()[0] as [Record<string, string>];
+    const [{ data }] = interactionCreates()[0] as [
+      { data: Record<string, string> },
+    ];
+    for (const body of [email.body, data.body]) {
+      expect(body).toContain("your purchase");
+      expect(body).not.toContain("Mystery");
+      expect(body).not.toContain("wendi_");
+    }
+  });
+
+  it.each([
+    [
+      "the lister fails",
+      () => mockListPlanOfferings.mockResolvedValueOnce({ failed: "Error" }),
+    ],
+    [
+      "the lister throws",
+      () => mockListPlanOfferings.mockRejectedValueOnce(new Error("down")),
+    ],
+  ])(
+    "when %s, the offering is 'your purchase' and both still go out",
+    async (_label, arrange) => {
+      arrange();
+      await routeLead(checkoutLead, spokeMeta, {
+        idempotencyKey: KEY,
+        accountOrigin: ORIGIN,
+      });
+      await settle();
+      expect(emailCalls()).toHaveLength(1);
+      expect(interactionCreates()).toHaveLength(1);
+      const [{ data }] = interactionCreates()[0] as [
+        { data: Record<string, string> },
+      ];
+      expect(data.body).toContain("your purchase");
+    },
+  );
+
+  it("a listed name holding a bidi override comes out with it stripped", async () => {
+    mockListPlanOfferings.mockResolvedValue([
+      { key: "retainer", name: "Re\u202Etainer\u0007", type: "service" },
+    ]);
+    await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    const [email] = emailCalls()[0] as [Record<string, string>];
+    const [{ data }] = interactionCreates()[0] as [
+      { data: Record<string, string> },
+    ];
+    for (const body of [email.body, data.body]) {
+      expect(body).toContain("Retainer");
+       
+      // The two code points by name, not in a regex: a scaffold's standalone
+      // lint refuses a control character in a regular expression.
+      expect(body).not.toContain("\u202E");
+      expect(body).not.toContain("\u0007");
+    }
+  });
+
+  it("with no amount, the body names the offering alone", async () => {
+    const { amountTotal: _a, currency: _c, ...payload } = checkoutLead.payload;
+    await routeLead({ ...checkoutLead, payload }, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    const [{ data }] = interactionCreates()[0] as [
+      { data: Record<string, string> },
+    ];
+    expect(data.body).toBe("Thanks for your purchase of Retainer.");
+  });
+
+  it("a Stripe special-case currency (ISK) leaves the amount out rather than misstate it", async () => {
+    await routeLead(
+      {
+        ...checkoutLead,
+        payload: {
+          ...checkoutLead.payload,
+          amountTotal: 990000,
+          currency: "isk",
+        },
+      },
+      spokeMeta,
+      { idempotencyKey: KEY, accountOrigin: ORIGIN },
+    );
+    await settle();
+    const [{ data }] = interactionCreates()[0] as [
+      { data: Record<string, string> },
+    ];
+    expect(data.body).toBe("Thanks for your purchase of Retainer.");
+  });
+
+  it("an offering read that outlasts its budget names 'your purchase' and does not hold the lead", async () => {
+    mockListPlanOfferings.mockReturnValue(new Promise(() => undefined));
+    const started = Date.now();
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    expect(Date.now() - started).toBeLessThan(4000);
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+    const [{ data }] = interactionCreates()[0] as [
+      { data: Record<string, string> },
+    ];
+    expect(data.body).toContain("your purchase");
+  }, 10_000);
+
+  it("with no account origin, the email carries no link", async () => {
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    await settle();
+    expect(emailCalls()).toHaveLength(1);
+    expect(emailCalls()[0]?.[0]).not.toHaveProperty("accountLink");
+    expect(interactionCreates()).toHaveLength(1);
+  });
+
+  it("a replay of the same Idempotency-Key makes neither", async () => {
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+      id: LEAD_ID,
+      email: checkoutLead.email,
+      source: checkoutLead.source,
+      payload: checkoutLead.payload,
+    });
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, replayed: true });
+    expect(emailCalls()).toHaveLength(0);
+    expect(interactionCreates()).toHaveLength(0);
+  });
+
+  it.each([
+    ["a test-mode checkout lead", spokeMeta, "cs_test_d14Purchase"],
+    ["a relayed checkout lead", { ...spokeMeta, relayed: true }, KEY],
+    ["an anonymous (non-spoke) lead", sourceMeta, KEY],
+  ] as const)("%s makes neither", async (_label, meta, key) => {
+    const result = await routeLead(checkoutLead, meta, {
+      idempotencyKey: key,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, persisted: "db" });
+    expect(emailCalls()).toHaveLength(0);
+    expect(interactionCreates()).toHaveLength(0);
+  });
+
+  it("a lead with no Person makes neither", async () => {
+    const find = jest
+      .spyOn(personService, "findOrCreatePerson")
+      .mockResolvedValue({
+        ok: false,
+        error: { kind: "invalid_email" },
+      } as never);
+    try {
+      const result = await routeLead(checkoutLead, spokeMeta, {
+        idempotencyKey: KEY,
+        accountOrigin: ORIGIN,
+      });
+      await settle();
+      expect(result).toMatchObject({ ok: true, persisted: "db" });
+      expect(emailCalls()).toHaveLength(0);
+      expect(interactionCreates()).toHaveLength(0);
+    } finally {
+      find.mockRestore();
+    }
+  });
+
+  it("with five marked leads for the address in the last day, the sixth sends no email and still writes the message", async () => {
+    const now = Date.now();
+    leadCount.mockResolvedValue(6); // the five before, and this one
+    await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(emailCalls()).toHaveLength(0);
+    expect(interactionCreates()).toHaveLength(1);
+    const [{ where }] = leadCount.mock.calls[0] as [
+      { where: Record<string, unknown> },
+    ];
+    expect(where).toMatchObject({
+      workspaceId: WS,
+      spokeCheckout: true,
+      email: { equals: "Cleo@X.io", mode: "insensitive" },
+    });
+    const since = (where.createdAt as { gte: Date }).gte.getTime();
+    expect(now - since).toBeGreaterThanOrEqual(24 * 60 * 60 * 1000 - 1000);
+    expect(now - since).toBeLessThanOrEqual(24 * 60 * 60 * 1000 + 5000);
+  });
+
+  it("with more than 50 marked leads in the workspace in the last hour, no email (any address) and the message is still written", async () => {
+    const now = Date.now();
+    // The recipient count first, then the workspace's hourly count.
+    leadCount.mockResolvedValueOnce(1).mockResolvedValueOnce(51);
+    await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(emailCalls()).toHaveLength(0);
+    expect(interactionCreates()).toHaveLength(1);
+    const [{ where }] = leadCount.mock.calls[1] as [
+      { where: Record<string, unknown> },
+    ];
+    expect(where).toMatchObject({ workspaceId: WS, spokeCheckout: true });
+    expect(where).not.toHaveProperty("email");
+    const since = (where.createdAt as { gte: Date }).gte.getTime();
+    expect(now - since).toBeGreaterThanOrEqual(60 * 60 * 1000 - 1000);
+    expect(now - since).toBeLessThanOrEqual(60 * 60 * 1000 + 5000);
+  });
+
+  it("with exactly 50 in the hour, the email still goes", async () => {
+    leadCount.mockResolvedValueOnce(1).mockResolvedValueOnce(50);
+    await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(emailCalls()).toHaveLength(1);
+  });
+
+  it("with five in the day including this one, the email still goes", async () => {
+    leadCount.mockResolvedValue(5);
+    await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(emailCalls()).toHaveLength(1);
+  });
+
+  it.each([
+    [
+      "the Inbox write throws",
+      () =>
+        jest
+          .mocked(prisma.interaction.create)
+          .mockRejectedValueOnce(new Error("down")),
+    ],
+    [
+      "the cap read throws",
+      () => leadCount.mockRejectedValueOnce(new Error("down")),
+    ],
+    [
+      "the email send rejects",
+      () =>
+        mockSendPurchaseConfirmationEmail.mockRejectedValueOnce(
+          new Error("down"),
+        ),
+    ],
+  ])(
+    "a purchase step that fails (%s) never changes the lead's answer",
+    async (_label, arrange) => {
+      arrange();
+      const result = await routeLead(checkoutLead, spokeMeta, {
+        idempotencyKey: KEY,
+        accountOrigin: ORIGIN,
+      });
+      await settle();
+      expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+      expect(setPlan).not.toHaveBeenCalled();
+      const logged = JSON.stringify([...info.mock.calls, ...error.mock.calls]);
+      expect(logged).not.toContain("Cleo@X.io");
+      expect(logged).not.toContain("retainer");
+    },
+  );
+
+  it("with no sender configured, no email is sent and the message is still written", async () => {
+    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
+    await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+      accountOrigin: ORIGIN,
+    });
+    await settle();
+    expect(emailCalls()).toHaveLength(0);
+    expect(interactionCreates()).toHaveLength(1);
+  });
+});
+
+describe("#8778 — a spoke checkout's terms grant", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008778";
+  const WS = "wksp_00000000-0000-7000-8000-000000008778";
+  const KEY = "cs_live_g8778Grant"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8778), not a credential
+  const ACCOUNT_TERMS = consentPurposeById(
+    SITE_CONSENT_CONFIG_DEFAULTS,
+    ACCOUNT_TERMS_PURPOSE_ID,
+  )!;
+  const STAMP = `${ACCOUNT_TERMS_PURPOSE_ID}@${ACCOUNT_TERMS.policyVersion}`;
+  const spokeMeta = { ...sourceMeta, viaSpoke: true };
+  const checkoutLead = {
+    kind: "submit" as const,
+    siteId: WS,
+    source: "web",
+    email: "Cleo@X.io",
+    payload: {
+      site: "wendi",
+      page: "checkout",
+      offering: "wendi_retainer",
+      amountTotal: 4900,
+      currency: "usd",
+      checkoutSession: KEY,
+      termsAccepted: STAMP,
+    } as Record<string, unknown>,
+  };
+  const leadCount = jest.fn();
+  let double: ConsentLedgerDouble;
+  let setPlan: jest.SpyInstance;
+  let info: jest.SpyInstance;
+  let error: jest.SpyInstance;
+
+  /** The ledger double, plus the per-session replay read it does not model. */
+  function armLedger(): void {
+    double = armConsentLedger(prisma);
+    const ledgerRead = (prisma.$queryRaw as jest.Mock).getMockImplementation()!;
+    (prisma.$queryRaw as jest.Mock).mockImplementation(
+      (strings: TemplateStringsArray, ...values: unknown[]) => {
+        if (strings.join("?").includes(`"source" = 'checkout'`)) {
+          const [workspaceId, personId, purposeId, sessionId] =
+            values as string[];
+          return Promise.resolve(
+            double.ledger
+              .filter(
+                (r) =>
+                  r.workspaceId === workspaceId &&
+                  r.personId === personId &&
+                  r.purposeId === purposeId &&
+                  r.source === "checkout" &&
+                  r.sourceRef === sessionId,
+              )
+              .map(() => ({ found: 1 })),
+          );
+        }
+        return ledgerRead(strings, ...values);
+      },
+    );
+  }
+
+  const consentLines = () =>
+    [...info.mock.calls, ...error.mock.calls]
+      .map(([obj]) => obj as Record<string, unknown>)
+      .filter((obj) => obj?.["event"] === "checkout-consent");
+
+  const settle = async () => {
+    for (let i = 0; i < 5; i += 1)
+      await new Promise((resolve) => setImmediate(resolve));
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    process.env.DATABASE_URL = "postgres://stub";
+    delete process.env.NODE_ENV;
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
+    Object.assign(prisma.lead, { count: leadCount });
+    leadCount.mockReset().mockResolvedValue(1);
+    jest
+      .mocked(prisma.interaction.create)
+      .mockResolvedValue({ id: "intx_1" } as never);
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "m" });
+    mockSendPurchaseConfirmationEmail.mockResolvedValue({
+      ok: true,
+      messageId: "m2",
+    });
+    mockListPlanOfferings.mockResolvedValue([]);
+    setPlan = jest
+      .spyOn(personService, "setPersonPlanOffering")
+      .mockResolvedValue("set");
+    info = jest
+      .spyOn(logger, "info")
+      .mockImplementation(() => undefined as never);
+    error = jest
+      .spyOn(logger, "error")
+      .mockImplementation(() => undefined as never);
+    armLedger();
+  });
+
+  afterEach(() => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    Reflect.deleteProperty(prisma.lead, "count");
+    for (const fn of [
+      prisma.$transaction,
+      prisma.$executeRaw,
+      prisma.$queryRaw,
+      prisma.consentGrant.createMany,
+      prisma.consentVisitorLink.createMany,
+    ]) {
+      (fn as jest.Mock).mockReset();
+    }
+    setPlan.mockRestore();
+    info.mockRestore();
+    error.mockRestore();
+  });
+
+  it("a lead whose session accepted the current terms writes one dated checkout grant for the buyer's Person", async () => {
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+
+    expect(double.ledger).toHaveLength(1);
+    const [row] = double.ledger;
+    expect(row).toMatchObject({
+      workspaceId: WS,
+      subjectType: "person",
+      subjectId: MOCK_PERSON_ID,
+      personId: MOCK_PERSON_ID,
+      purposeId: ACCOUNT_TERMS_PURPOSE_ID,
+      granted: true,
+      source: "checkout",
+      sourceRef: KEY,
+      policyVersion: ACCOUNT_TERMS.policyVersion,
+      locale: "en",
+    });
+    expect(row!.createdAt).toBeInstanceOf(Date);
+    expect(consentLines()).toEqual([
+      expect.objectContaining({ outcome: "recorded", siteId: WS }),
+    ]);
+    // #8793 D1 — the grant is written; the plan is held, never set here.
+    expect(setPlan).not.toHaveBeenCalled();
+  });
 
   it.each([
-    ["throws", () => setPlan.mockRejectedValueOnce(new Error("down"))],
-    ["answers not_found", () => setPlan.mockResolvedValueOnce("not_found")],
-  ])("a plan step that %s answers exactly like a success, with one failed line naming no offering, email or key", async (_label, arrange) => {
-    const ok = await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    info.mockClear();
-    error.mockClear();
-    arrange();
-    const failed = await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    expect(failed).toEqual(ok);
-    expect(failed).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(planLines()).toEqual([{ event: "checkout-plan", outcome: "failed", siteId: WS }]);
+    ["termsAccepted: null (the box was not accepted)", null, "consent_absent"],
+    ["no termsAccepted key (an older spoke)", undefined, "consent_absent"],
+    ["an older version's stamp", `${ACCOUNT_TERMS_PURPOSE_ID}@1`, "terms_unstamped"],
+    ["another purpose's stamp", "wt_platform_terms@1", "terms_unstamped"],
+    ["a non-string value", true, "terms_unstamped"],
+  ])("a lead with %s writes no grant", async (_label, terms, outcome) => {
+    const { termsAccepted: _t, ...rest } = checkoutLead.payload;
+    const payload = terms === undefined ? rest : { ...rest, termsAccepted: terms };
+    const result = await routeLead({ ...checkoutLead, payload }, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+    expect(double.ledger).toHaveLength(0);
+    expect(consentLines()).toEqual([expect.objectContaining({ outcome })]);
+  });
+
+  it("a replayed spoke webhook (the same Idempotency-Key and body) writes no second grant", async () => {
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    expect(double.ledger).toHaveLength(1);
+
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+      id: LEAD_ID,
+      email: checkoutLead.email,
+      source: checkoutLead.source,
+      payload: checkoutLead.payload,
+    });
+    const replay = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    await settle();
+    expect(replay).toMatchObject({ ok: true, replayed: true });
+    expect(double.ledger).toHaveLength(1);
+  });
+
+  it("a redelivery whose stored body predates termsAccepted is a replay, not a conflict, and writes no grant", async () => {
+    const { termsAccepted: _t, ...storedPayload } = checkoutLead.payload;
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+      id: LEAD_ID,
+      email: checkoutLead.email,
+      source: checkoutLead.source,
+      payload: storedPayload,
+    });
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, replayed: true });
+    expect(double.ledger).toHaveLength(0);
+  });
+
+  it("a redelivery that differs in any other payload key is still a conflict", async () => {
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
+      id: LEAD_ID,
+      email: checkoutLead.email,
+      source: checkoutLead.source,
+      payload: { ...checkoutLead.payload, amountTotal: 1 },
+    });
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    expect(result).toMatchObject({
+      ok: false,
+      error: { kind: "idempotency_conflict" },
+    });
+  });
+
+  it("a second write for a session whose grant the Person already holds writes none (the store's own guard)", async () => {
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    // The lead row lost (the lookup misses), the ledger kept: the grant is
+    // still written at most once per Person and session.
+    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+    await settle();
+    expect(double.ledger).toHaveLength(1);
+    expect(consentLines().map((l) => l["outcome"])).toEqual([
+      "recorded",
+      "unchanged",
+    ]);
+  });
+
+  it.each([
+    ["a test-mode checkout lead", spokeMeta, "cs_test_g8778Grant"],
+    ["a relayed checkout lead", { ...spokeMeta, relayed: true }, KEY],
+    ["an anonymous (non-spoke) lead", sourceMeta, KEY],
+  ] as const)("%s writes no grant", async (_label, meta, key) => {
+    const result = await routeLead(checkoutLead, meta, { idempotencyKey: key });
+    await settle();
+    expect(result).toMatchObject({ ok: true, persisted: "db" });
+    expect(double.ledger).toHaveLength(0);
+    expect(consentLines()).toEqual([]);
+  });
+
+  it("a lead with no Person writes no grant", async () => {
+    const find = jest
+      .spyOn(personService, "findOrCreatePerson")
+      .mockResolvedValue({
+        ok: false,
+        error: { kind: "invalid_email" },
+      } as never);
+    try {
+      await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
+      await settle();
+      expect(double.ledger).toHaveLength(0);
+    } finally {
+      find.mockRestore();
+    }
+  });
+
+  it("a ledger write that fails never changes the lead's answer, and logs no address or Person id", async () => {
+    (prisma.consentGrant.createMany as jest.Mock).mockRejectedValueOnce(
+      new Error("down Cleo@X.io"),
+    );
+    const result = await routeLead(checkoutLead, spokeMeta, {
+      idempotencyKey: KEY,
+    });
+    await settle();
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+    expect(consentLines()).toEqual([
+      expect.objectContaining({ outcome: "failed", errName: "Error" }),
+    ]);
     const logged = JSON.stringify([...info.mock.calls, ...error.mock.calls]);
-    expect(logged).not.toContain("retainer");
-    expect(logged).not.toContain("cleo@x.io");
-    expect(logged).not.toContain(KEY);
+    expect(logged).not.toContain("Cleo@X.io");
+    expect(logged).not.toContain(MOCK_PERSON_ID);
+  });
+});
+
+describe("#8932 D7 — the per-Organization webhook's Offerings checkout lead (AC-5)", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008932";
+  const WS = "wksp_00000000-0000-7000-8000-000000008932";
+  const OTHER_WS = "wksp_00000000-0000-7000-8000-000000008933";
+  const SESSION = "cs_live_a8932Offerings"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8932 AC-5), not a credential
+  const KEY = `stripe-offerings ${SESSION}`;
+  const ACCOUNT_TERMS = consentPurposeById(
+    SITE_CONSENT_CONFIG_DEFAULTS,
+    ACCOUNT_TERMS_PURPOSE_ID,
+  )!;
+  const STAMP = `${ACCOUNT_TERMS_PURPOSE_ID}@${ACCOUNT_TERMS.policyVersion}`;
+  /** The input the webhook builds (D6) — the offering is the record's full key. */
+  const offeringsLead = {
+    kind: "submit" as const,
+    siteId: WS,
+    source: "web",
+    email: "buyer@example.com",
+    payload: {
+      page: "checkout",
+      offering: "growth_monthly",
+      site: WS,
+      amountTotal: 4900,
+      currency: "usd",
+      termsAccepted: STAMP,
+    } as Record<string, unknown>,
+  };
+  const webhookMeta = {
+    ip: "203.0.113.9",
+    userAgent: "Stripe/1.0",
+    receivedAt: "2026-10-18T00:00:00.000Z",
+  };
+  const twin = { idempotencyKey: KEY, offeringsCheckout: true as const };
+  const leadCount = jest.fn();
+  let setPlan: jest.SpyInstance;
+  let consent: jest.SpyInstance;
+  let info: jest.SpyInstance;
+  let error: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    process.env.DATABASE_URL = "postgres://stub";
+    delete process.env.NODE_ENV;
+    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
+    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
+    Object.assign(prisma.lead, { count: leadCount });
+    leadCount.mockReset().mockResolvedValue(1);
+    jest
+      .mocked(prisma.interaction.create)
+      .mockResolvedValue({ id: "intx_1" } as never);
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "m" });
+    mockSendPurchaseConfirmationEmail.mockResolvedValue({ ok: true, messageId: "m2" });
+    mockListPlanOfferings.mockResolvedValue([]);
+    setPlan = jest.spyOn(personService, "setPersonPlanOffering").mockResolvedValue("set");
+    consent = jest
+      .spyOn(consentService, "recordCheckoutConsent")
+      .mockResolvedValue("recorded");
+    info = jest.spyOn(logger, "info").mockImplementation(() => undefined as never);
+    error = jest.spyOn(logger, "error").mockImplementation(() => undefined as never);
+  });
+
+  afterEach(() => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    Reflect.deleteProperty(prisma.lead, "count");
+    setPlan.mockRestore();
+    consent.mockRestore();
+    info.mockRestore();
+    error.mockRestore();
+  });
+
+  const createData = () =>
+    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<string, unknown>;
+  const planLines = () =>
+    [...info.mock.calls, ...error.mock.calls]
+      .map(([fields]) => fields as Record<string, unknown>)
+      .filter((fields) => fields?.["event"] === "checkout-plan");
+  const planWrites = () =>
+    jest
+      .mocked(prisma.person.updateMany)
+      .mock.calls.filter(([args]) => "planOffering" in ((args as { data?: object }).data ?? {}));
+
+  it("creates one marked lead on the prefixed key, holds the full key and grants consent on the bare session id", async () => {
+    const result = await routeLead(offeringsLead, webhookMeta, twin);
+    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
+    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+    expect(createData()).toMatchObject({
+      spokeCheckout: true,
+      idempotencyKey: KEY,
+      payload: expect.objectContaining({ offering: "growth_monthly" }),
+    });
+    expect(planLines()).toEqual([{ event: "checkout-plan", outcome: "held", siteId: WS }]);
+    expect(consent).toHaveBeenCalledTimes(1);
+    expect(consent).toHaveBeenCalledWith(
+      expect.objectContaining({ workspaceId: WS, sessionId: SESSION }),
+    );
+    expect(setPlan).not.toHaveBeenCalled();
+    expect(planWrites()).toEqual([]);
+  });
+
+  it.each([
+    ["without offeringsCheckout", offeringsLead, { idempotencyKey: KEY }],
+    [
+      "an offering the grammar refuses",
+      { ...offeringsLead, payload: { ...offeringsLead.payload, offering: "growth_quarterly" } },
+      twin,
+    ],
+    [
+      "a site that is another workspace",
+      { ...offeringsLead, payload: { ...offeringsLead.payload, site: OTHER_WS } },
+      twin,
+    ],
+    ["a test-mode session key", offeringsLead, { ...twin, idempotencyKey: "stripe-offerings cs_test_a1" }],
+    ["the bare session id as the key", offeringsLead, { ...twin, idempotencyKey: SESSION }],
+    ["source contact", { ...offeringsLead, source: "contact" }, twin],
+    [
+      "page contact",
+      { ...offeringsLead, payload: { ...offeringsLead.payload, page: "contact" } },
+      twin,
+    ],
+  ] as const)("creates an unmarked lead and holds nothing for %s", async (_label, input, options) => {
+    const result = await routeLead(input as typeof offeringsLead, webhookMeta, options);
+    expect(result).toMatchObject({ ok: true, persisted: "db" });
+    expect(createData()).not.toHaveProperty("spokeCheckout");
+    expect(planLines()).toEqual([]);
+    expect(consent).not.toHaveBeenCalled();
+    expect(prisma.interaction.create).not.toHaveBeenCalled();
+    expect(planWrites()).toEqual([]);
+  });
+
+  it("leaves a spoke checkout lead marked exactly as before", async () => {
+    await routeLead(
+      {
+        kind: "submit",
+        siteId: WS,
+        source: "web",
+        email: "cleo@x.io",
+        payload: { site: "wendi", page: "checkout", offering: "wendi_retainer" },
+      },
+      { ...webhookMeta, viaSpoke: true },
+      { idempotencyKey: "cs_live_a1B2c3" }, // gitleaks:allow -- a synthetic Checkout Session id shape, not a credential
+    );
+    expect(createData()).toMatchObject({ spokeCheckout: true });
+    expect(consent).not.toHaveBeenCalledWith(expect.objectContaining({ sessionId: SESSION }));
+  });
+
+  it("the verified first link releases the full lookup key into the Person's plan", async () => {
+    setPlan.mockRestore();
+    jest.mocked(prisma.lead.findMany).mockResolvedValue([
+      { email: offeringsLead.email, payload: offeringsLead.payload },
+    ] as never);
+    jest.mocked(prisma.person.updateMany).mockResolvedValue({ count: 1 } as never);
+    const outcome = await personService.releaseHeldCheckoutPlan(
+      WS,
+      MOCK_PERSON_ID,
+      "usr_buyer_8932",
+      "buyer@example.com",
+    );
+    expect(outcome).toBe("set");
+    expect(prisma.person.updateMany).toHaveBeenCalledWith(
+      expect.objectContaining({ data: { planOffering: "growth_monthly" } }),
+    );
   });
 });