create-ailk 0.23.0 → 0.24.0

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -50,7 +50,7 @@ jest.mock("../../../lib/prisma.js", () => ({
     },
     user: { findUnique: jest.fn() },
     projectListing: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
+    waitlistScore: { groupBy: jest.fn() },
   },
 }));
 
@@ -258,9 +258,16 @@ function installFixtureMocks(): void {
     },
   );
 
-  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId: string; experimentKey: string } }) =>
-      Promise.resolve(WAITLIST_COUNTS[where.siteId]?.[where.experimentKey] ?? 0),
+  (prisma.waitlistScore.groupBy as jest.Mock).mockImplementation(
+    ({ where }: { where: { siteId: string; experimentKey: { in: string[] } } }) =>
+      Promise.resolve(
+        where.experimentKey.in
+          .filter((experimentKey) => (WAITLIST_COUNTS[where.siteId]?.[experimentKey] ?? 0) > 0)
+          .map((experimentKey) => ({
+            experimentKey,
+            _count: { _all: WAITLIST_COUNTS[where.siteId]![experimentKey] },
+          })),
+      ),
   );
 }
 
@@ -378,7 +385,7 @@ describe("GET /v1/project-listings/me — the empty case is not a refusal", () =
   it("no waitlist count is read when the caller owns nothing", async () => {
     await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
 
-    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+    expect(prisma.waitlistScore.groupBy).not.toHaveBeenCalled();
   });
 });
 
@@ -419,13 +426,17 @@ describe("GET /v1/project-listings/me — the response shape", () => {
     // One shared site id would have reported 0 for one of them.
     expect(byId["prjl_ada_one"]).toBe(7);
     expect(byId["prjl_ada_two"]).toBe(3);
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
+      by: ["experimentKey"],
       // #6258 AC-6 — the fenced read now filters the CONSTRAINED column beside
       // `siteId`; the two are equal by the workspace_site_agree CHECK.
-      where: { siteId: SITE_A, workspaceId: SITE_A, experimentKey: "atlas-waitlist" },
+      where: { siteId: SITE_A, workspaceId: SITE_A, experimentKey: { in: ["atlas-waitlist"] } },
+      _count: { _all: true },
     });
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      where: { siteId: SITE_B, workspaceId: SITE_B, experimentKey: "atlas-two-waitlist" },
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
+      by: ["experimentKey"],
+      where: { siteId: SITE_B, workspaceId: SITE_B, experimentKey: { in: ["atlas-two-waitlist"] } },
+      _count: { _all: true },
     });
   });
 

package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts

@@ -61,7 +61,7 @@ jest.mock("../../../lib/prisma.js", () => ({
     projectListing: { findMany: jest.fn() },
     siteListingConfig: { findUnique: jest.fn() },
     waitlistExperiment: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
+    waitlistScore: { groupBy: jest.fn() },
   },
 }));
 
@@ -236,9 +236,13 @@ function installFixtureMocks(): void {
   // count is keyed on the `experimentKey` the listing already holds, so the
   // id-to-key hop this route used to make is gone. A test below asserts it
   // stays gone.
-  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
-    ({ where }: { where: { experimentKey: string } }) =>
-      Promise.resolve(COUNTS_BY_KEY[where.experimentKey] ?? 0),
+  (prisma.waitlistScore.groupBy as jest.Mock).mockImplementation(
+    ({ where }: { where: { experimentKey: { in: string[] } } }) =>
+      Promise.resolve(
+        where.experimentKey.in
+          .filter((experimentKey) => (COUNTS_BY_KEY[experimentKey] ?? 0) > 0)
+          .map((experimentKey) => ({ experimentKey, _count: { _all: COUNTS_BY_KEY[experimentKey] } })),
+      ),
   );
 }
 
@@ -413,10 +417,17 @@ describe("GET /v1/project-listings/public", () => {
 
     it("counts the waitlist through the listing's own experimentKey, in one hop", async () => {
       await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
+      expect(prisma.waitlistScore.groupBy).toHaveBeenCalledTimes(1);
+      expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
+        by: ["experimentKey"],
         // #6258 AC-6 — the fenced read now filters the CONSTRAINED column
         // beside `siteId`; the two are equal by the workspace_site_agree CHECK.
-        where: { siteId: SITE, workspaceId: SITE, experimentKey: "exp-newest" },
+        where: {
+          siteId: SITE,
+          workspaceId: SITE,
+          experimentKey: { in: expect.arrayContaining(["exp-newest"]) },
+        },
+        _count: { _all: true },
       });
       // The id-to-key translation read is gone with #5036 D6d.
       expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();

package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts

@@ -885,7 +885,7 @@ describe("a captured draft answers its listicle's Application fields (#7521 AC-2
       ({ where }: { where: Record<string, unknown> }) =>
         Promise.resolve(flows.filter((f) => matches(f, where))),
     );
-    (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+    (prisma.waitlistScore.groupBy as jest.Mock).mockResolvedValue([]);
     app = Fastify();
     await app.register(startProjectListingRoute);
     await app.register(patchProjectListingDraftRoute);

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-flow-checkout.test.ts

@@ -179,6 +179,7 @@ describe("AC-1 — completed stamps the row once, guarded, beside the legacy tas
     });
     expect(prisma.user.findFirst).toHaveBeenCalledWith({
       where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
+      select: { id: true },
     });
     expect(prisma.user.findUnique).not.toHaveBeenCalled();
   });

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-site-filter.test.ts

@@ -200,6 +200,7 @@ function expectHandledAsToday() {
   expect(prisma.callback.updateMany).toHaveBeenCalledTimes(1);
   expect(prisma.user.findFirst).toHaveBeenCalledWith({
     where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
+    select: { id: true },
   });
   expect(foreignSiteLogs()).toHaveLength(0);
 }

package/templates/apps/api/src/routes/webhooks/stripe.ts

@@ -1279,6 +1279,7 @@ async function upsertBillingIdentity(
         billingProvider: "stripe",
         billingCustomerId: customerId,
       },
+      select: { id: true },
     });
 
     if (existingByBilling) {
@@ -1424,6 +1425,7 @@ async function upsertOrgBillingIdentity(
         billingProvider: "stripe",
         billingCustomerId: customerId,
       },
+      select: { id: true },
     });
 
     if (existingByBilling && existingByBilling.id === organizationId) {

package/templates/apps/api/src/server.ts

@@ -246,6 +246,11 @@ const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
 // #8171 D8 — the workspace's Requests read (the inbound member rows), the
 // SAME scope.
 const WORKSPACES_REQUESTS = "./routes/workspaces/requests.js";
+// #9254 DD5 — the workspace's Callbacks read (request-and-confirm rows), the
+// SAME scope.
+const WORKSPACES_CALLBACKS = "./routes/workspaces/callbacks.js";
+// #9287 DD2 — the owner's Start, Get and Extend trial, the SAME scope.
+const WORKSPACES_TRIAL = "./routes/workspaces/trial.js";
 // #7877 D11 — the member reads: auth only, under the SAME module predicate.
 const MEMBER_PIECES = "./routes/member/pieces.js";
 const MEMBER_MESSAGES = "./routes/member/messages.js";
@@ -372,6 +377,16 @@ const SLICE_PLUGINS = {
     specifier: WORKSPACES_REQUESTS,
     load: () => import(WORKSPACES_REQUESTS),
   },
+  // #9254 DD5 — the Callbacks read, the SAME scope.
+  workspaceCallbackRoutes: {
+    specifier: WORKSPACES_CALLBACKS,
+    load: () => import(WORKSPACES_CALLBACKS),
+  },
+  // #9287 DD2 — the trial routes, the SAME scope.
+  workspaceTrialRoutes: {
+    specifier: WORKSPACES_TRIAL,
+    load: () => import(WORKSPACES_TRIAL),
+  },
   workspacePlanRoutes: {
     specifier: WORKSPACES_PLAN,
     load: () => import(WORKSPACES_PLAN),
@@ -1340,6 +1355,16 @@ export async function build() {
         await tenantScope.register(
           await sliceRoutePlugin("workspaceRequestRoutes"),
         );
+        // #9254 DD5 — the Callbacks read: the request-and-confirm rows the
+        // Inbox lists under Interested, behind `inbox-read`.
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceCallbackRoutes"),
+        );
+        // #9287 DD2 — Start, Get and Extend trial, behind `billing-manage`
+        // (the owner alone; never an agent).
+        await tenantScope.register(
+          await sliceRoutePlugin("workspaceTrialRoutes"),
+        );
         await tenantScope.register(
           await sliceRoutePlugin("workspacePlanRoutes"),
         );

package/templates/apps/api/src/services/__tests__/abandon-email.test.ts

@@ -29,7 +29,16 @@ jest.mock("@working-theory/observability", () => ({
 }));
 
 import { prisma } from "../../lib/prisma.js";
-import { runAbandonEmailSweep } from "../abandon-email";
+import {
+  ABANDON_CANDIDATE_PAGE_SIZE,
+  runAbandonEmailSweep,
+} from "../abandon-email";
+
+// `flowSession.updateMany` — the dark-mode batch stamp (#9249) — is not on
+// the shared double; installed here the way lead-routing.test.ts installs
+// `lead.count`.
+const mockFlowSessionUpdateMany = jest.fn();
+Object.assign(prisma.flowSession, { updateMany: mockFlowSessionUpdateMany });
 
 // ─── Fixtures ─────────────────────────────────────────────────────────────────
 
@@ -183,15 +192,16 @@ describe("runAbandonEmailSweep", () => {
     (prisma.flowSession.findMany as jest.Mock).mockResolvedValue([
       sessionRow(),
     ]);
-    (prisma.flowSession.update as jest.Mock).mockResolvedValue({});
+    mockFlowSessionUpdateMany.mockResolvedValue({ count: 1 });
 
     const result = await runAbandonEmailSweep({ now: NOW });
 
     expect(mockSendAbandonEmail).not.toHaveBeenCalled();
-    expect(prisma.flowSession.update).toHaveBeenCalledWith({
-      where: { id: SESSION_ID },
+    expect(mockFlowSessionUpdateMany).toHaveBeenCalledWith({
+      where: { id: { in: [SESSION_ID] }, abandonEmailStatus: null },
       data: { abandonEmailStatus: "dark", abandonEmailAt: NOW },
     });
+    expect(prisma.flowSession.update).not.toHaveBeenCalled();
     expect(result).toMatchObject({
       ok: true,
       summary: {
@@ -205,6 +215,113 @@ describe("runAbandonEmailSweep", () => {
     });
   });
 
+  // ── #9249 — dark mode stamps the whole candidate set in ONE updateMany ──
+
+  it("dark mode stamps N≥3 candidates with exactly one flowSession.updateMany, never a per-row update", async () => {
+    const ids = ["flsess_a", "flsess_b", "flsess_c"];
+    (prisma.flowDefinition.findMany as jest.Mock).mockResolvedValue([
+      flowDefRow({
+        abandonEmail: {
+          mode: "dark",
+          delayMinutes: 30,
+          copy: { subject: en("Still interested?"), body: en("Come back!") },
+        },
+      }),
+    ]);
+    (prisma.flowSession.findMany as jest.Mock).mockResolvedValue(
+      ids.map((id) => sessionRow({ id })),
+    );
+    mockFlowSessionUpdateMany.mockResolvedValue({ count: ids.length });
+
+    const result = await runAbandonEmailSweep({ now: NOW });
+
+    expect(mockFlowSessionUpdateMany).toHaveBeenCalledTimes(1);
+    expect(mockFlowSessionUpdateMany).toHaveBeenCalledWith({
+      // The `abandonEmailStatus: null` guard keeps a row stamped concurrently
+      // from being re-stamped — the same term the candidate read selects on.
+      where: { id: { in: ids }, abandonEmailStatus: null },
+      data: { abandonEmailStatus: "dark", abandonEmailAt: NOW },
+    });
+    expect(prisma.flowSession.update).not.toHaveBeenCalled();
+    expect(mockSendAbandonEmail).not.toHaveBeenCalled();
+    // Per-candidate audit logging is unchanged — one line per session.
+    expect(
+      mockLoggerInfo.mock.calls.filter(
+        ([fields]) => fields.outcome === "dark" && fields.mode === "dark",
+      ),
+    ).toHaveLength(ids.length);
+    // Summary counters report the same numbers as the per-row stamps did.
+    expect(result).toEqual({
+      ok: true,
+      summary: { scanned: 3, selected: 3, dark: 3, sent: 0, failed: 0, skipped: 0 },
+    });
+  });
+
+  it("dark mode with no candidates issues no updateMany at all", async () => {
+    (prisma.flowDefinition.findMany as jest.Mock).mockResolvedValue([
+      flowDefRow({
+        abandonEmail: {
+          mode: "dark",
+          delayMinutes: 30,
+          copy: { subject: en("Still interested?"), body: en("Come back!") },
+        },
+      }),
+    ]);
+    (prisma.flowSession.findMany as jest.Mock).mockResolvedValue([]);
+
+    const result = await runAbandonEmailSweep({ now: NOW });
+
+    expect(mockFlowSessionUpdateMany).not.toHaveBeenCalled();
+    expect(prisma.flowSession.update).not.toHaveBeenCalled();
+    expect(result).toEqual({
+      ok: true,
+      summary: { scanned: 0, selected: 0, dark: 0, sent: 0, failed: 0, skipped: 0 },
+    });
+  });
+
+  // ── #9249 — the candidate read is paged ──────────────────────────────────
+
+  it("pages the candidate read with take: ABANDON_CANDIDATE_PAGE_SIZE and processes exactly one page per run", async () => {
+    expect(ABANDON_CANDIDATE_PAGE_SIZE).toBeGreaterThan(0);
+    (prisma.flowDefinition.findMany as jest.Mock).mockResolvedValue([
+      flowDefRow({
+        abandonEmail: {
+          mode: "dark",
+          delayMinutes: 30,
+          copy: { subject: en("Still interested?"), body: en("Come back!") },
+        },
+      }),
+    ]);
+    // The database honours `take`: a run with more candidates than the page
+    // sees exactly one page of them. The rest stay `abandonEmailStatus: null`
+    // and are selected by the next run.
+    const page = Array.from({ length: ABANDON_CANDIDATE_PAGE_SIZE }, (_, i) =>
+      sessionRow({ id: `flsess_${i}` }),
+    );
+    (prisma.flowSession.findMany as jest.Mock).mockResolvedValue(page);
+    mockFlowSessionUpdateMany.mockResolvedValue({ count: page.length });
+
+    const result = await runAbandonEmailSweep({ now: NOW });
+
+    expect(prisma.flowSession.findMany).toHaveBeenCalledTimes(1);
+    expect(prisma.flowSession.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ take: ABANDON_CANDIDATE_PAGE_SIZE }),
+    );
+    // No second read within the run — the remainder is the next run's.
+    expect(mockFlowSessionUpdateMany).toHaveBeenCalledTimes(1);
+    expect(mockFlowSessionUpdateMany.mock.calls[0][0].where.id.in).toHaveLength(
+      ABANDON_CANDIDATE_PAGE_SIZE,
+    );
+    expect(result).toMatchObject({
+      ok: true,
+      summary: {
+        scanned: ABANDON_CANDIDATE_PAGE_SIZE,
+        selected: ABANDON_CANDIDATE_PAGE_SIZE,
+        dark: ABANDON_CANDIDATE_PAGE_SIZE,
+      },
+    });
+  });
+
   // ── AC2 — enabled mode: selected + sent ──────────────────────────────────
 
   it("enabled mode calls sendAbandonEmail and stamps abandonEmailStatus:'sent'", async () => {

package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts

@@ -144,6 +144,16 @@ describe("fulfillDeliverable", () => {
     );
   });
 
+  it("selects only the id on the legacy DeliverableAsset lookup, never the bytes blob (#9248)", async () => {
+    await fulfillDeliverable(baseInput({ segment: "small" }));
+
+    // `DeliverableAsset.bytes` is the file itself; this read exists only to
+    // learn the row's id, so the query must name that one column.
+    const [[args]] = (prisma.deliverableAsset.findUnique as jest.Mock).mock
+      .calls as [[{ select?: Record<string, unknown> }]];
+    expect(args.select).toEqual({ id: true });
+  });
+
   it("resolves the OTHER segment's entry when segment differs (two-segment divergence, AC1)", async () => {
     (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue({
       id: "dasset_00000000-0000-7000-8000-0000000000a2",

package/templates/apps/api/src/services/__tests__/person.test.ts

@@ -55,6 +55,7 @@ import {
   setOwnPersonContact,
   setPersonPlanOffering,
   stampPersonUser,
+  stripeCustomerDashboardUrl,
   updatePersonContact,
 } from "../person";
 
@@ -1174,3 +1175,30 @@ describe("resolveMemberPersonId releases a held plan on a fresh link only (#8793
     expect(log.warn).not.toHaveBeenCalled();
   });
 });
+
+describe("stripeCustomerDashboardUrl (#9349 DD5, AC-9)", () => {
+  it("builds the live and the test Dashboard links", () => {
+    expect(stripeCustomerDashboardUrl("cus_ABC123", "live")).toBe(
+      "https://dashboard.stripe.com/customers/cus_ABC123",
+    );
+    expect(stripeCustomerDashboardUrl("cus_ABC123", "test")).toBe(
+      "https://dashboard.stripe.com/test/customers/cus_ABC123",
+    );
+  });
+
+  it("refuses an id outside the cus_ grammar or over 255 characters", () => {
+    for (const id of [
+      "cus_a/../../settings",
+      "cus_",
+      "acct_1",
+      "cus_a?x=1",
+      "cus_a#x",
+      `cus_${"a".repeat(252)}`,
+    ]) {
+      expect(stripeCustomerDashboardUrl(id, "live")).toBeNull();
+    }
+    expect(
+      stripeCustomerDashboardUrl(`cus_${"a".repeat(251)}`, "live"),
+    ).not.toBeNull();
+  });
+});

package/templates/apps/api/src/services/__tests__/plan-offerings.test.ts

@@ -200,6 +200,8 @@ const ENV_KEYS = [
   "AILK_LEAD_NOTIFICATION_TO",
   "AILK_LEAD_NOTIFICATION_FROM",
   "AILK_DELIVERABLE_EMAIL_FROM",
+  "AILK_ENABLED_MODULES",
+  "STRIPE_ENV_ORGANIZATION_ID",
 ] as const;
 let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
 
@@ -208,6 +210,10 @@ beforeEach(async () => {
   saved = {};
   for (const k of ENV_KEYS) saved[k] = process.env[k];
   process.env.DATABASE_URL = "postgres://stub";
+  // With the multi-tenant module and no STRIPE_ENV_ORGANIZATION_ID nobody owns the
+  // environment key (#9285 AC-8), so "no connection" stays no connection here.
+  process.env.AILK_ENABLED_MODULES = "multi-tenant";
+  delete process.env.STRIPE_ENV_ORGANIZATION_ID;
   delete process.env.NODE_ENV;
   delete process.env.AILK_LICENSE_KEY;
   process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";

package/templates/apps/api/src/services/__tests__/project-listings.counts.test.ts

@@ -0,0 +1,202 @@
+// oss: false
+/**
+ * @file project-listings.counts.test.ts
+ *
+ * #9243 — `attachWaitlistCounts` counts waitlist scores with ONE
+ * `waitlistScore.groupBy` per call, however many distinct experiment keys the
+ * rows carry, and `publicProjectListings` — the anonymous page-render read —
+ * bounds its `findMany` with a `take`. Both are the AC evidence for audit HIGH
+ * #1 (docs/audits/query-efficiency-audit-2026-10-19.md): the per-key
+ * `count()` loop and the unbounded public read.
+ *
+ * Mock pattern follows `project-listings.fence.test.ts` (jest.fn() doubles on
+ * `lib/prisma.js`).
+ */
+import { LISTING_DIRECTORY_MAX_ENTRIES } from "@working-theory/validation";
+
+import {
+  listProjectListings,
+  publicProjectListings,
+} from "../project-listings.js";
+
+// Boundary mocks — `project-listings.ts`'s import chain reaches the Resend
+// client and the licence check; neither is exercised by the reads under test.
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest
+    .fn()
+    .mockResolvedValue({ ok: true, messageId: "msg-test" }),
+  sendDeliverableEmail: jest
+    .fn()
+    .mockResolvedValue({ ok: true, messageId: "msg-test" }),
+}));
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "free",
+    plan: null,
+    features: [],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../lib/prisma.js", () => ({
+  prisma: {
+    projectListing: { findMany: jest.fn() },
+    siteListingConfig: { findUnique: jest.fn() },
+    waitlistScore: { count: jest.fn(), groupBy: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../lib/prisma.js";
+
+const SITE = "wksp_00000000-0000-7000-8000-000000000001";
+const EXPERIMENT_A = "ailk-founder-diagnostic";
+const EXPERIMENT_B = "ailk-agency-waitlist";
+const EXPERIMENT_C = "ailk-studio-waitlist";
+
+function listingRow(
+  id: string,
+  experimentKey: string | null,
+): Record<string, unknown> {
+  return {
+    id,
+    siteId: SITE,
+    workspaceId: SITE,
+    leadId: null,
+    slug: `slug-${id}`,
+    name: "Acme",
+    headline: null,
+    oneLiner: null,
+    problem: null,
+    solution: null,
+    url: null,
+    product: null,
+    commitment: null,
+    teamComposition: null,
+    faqs: null,
+    anythingElse: null,
+    address: null,
+    addressLine1: null,
+    addressLine2: null,
+    addressCity: null,
+    addressRegion: null,
+    addressPostalCode: null,
+    addressCountry: null,
+    questions: null,
+    siteAnswers: null,
+    windowDays: null,
+    founderName: null,
+    founderFirstName: null,
+    founderLastName: null,
+    founderEmail: null,
+    founderPhone: null,
+    founderCompany: null,
+    emailVerifiedAt: null,
+    logoMarkUrl: null,
+    logoWordmarkUrl: null,
+    featured: false,
+    status: "active",
+    consentAt: new Date("2026-09-01T00:00:00.000Z"),
+    decidedAt: new Date("2026-09-02T00:00:00.000Z"),
+    decidedBy: null,
+    issueUrl: null,
+    experimentKey,
+    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-09-01T00:00:00.000Z"),
+  };
+}
+
+/** The shape `prisma.waitlistScore.groupBy({ by: ["experimentKey"], _count: { _all: true } })` returns. */
+function grouped(
+  experimentKey: string,
+  count: number,
+): { experimentKey: string; _count: { _all: number } } {
+  return { experimentKey, _count: { _all: count } };
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  (prisma.siteListingConfig.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.waitlistScore.groupBy as jest.Mock).mockResolvedValue([]);
+  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(0);
+});
+
+describe("attachWaitlistCounts — one waitlistScore query per call (#9243 AC-1)", () => {
+  it("three distinct experiment keys across four rows → exactly ONE groupBy, no count()", async () => {
+    (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
+      listingRow("plst_a", EXPERIMENT_A),
+      listingRow("plst_b", EXPERIMENT_B),
+      listingRow("plst_c", EXPERIMENT_C),
+      listingRow("plst_d", EXPERIMENT_A),
+    ]);
+    (prisma.waitlistScore.groupBy as jest.Mock).mockResolvedValue([
+      grouped(EXPERIMENT_A, 5),
+      grouped(EXPERIMENT_B, 2),
+    ]);
+
+    const rows = await listProjectListings(SITE);
+
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledTimes(1);
+    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+    expect(
+      (prisma.waitlistScore.groupBy as jest.Mock).mock.calls[0]![0],
+    ).toEqual({
+      by: ["experimentKey"],
+      // fence: workspaceId === siteId beside siteId, by value (#6258 AC-6),
+      // and every DISTINCT key in one `in` — no per-key fan-out.
+      where: {
+        siteId: SITE,
+        workspaceId: SITE,
+        experimentKey: { in: [EXPERIMENT_A, EXPERIMENT_B, EXPERIMENT_C] },
+      },
+      _count: { _all: true },
+    });
+
+    const countsById = new Map(rows.map((r) => [r.id, r.waitlistCount]));
+    expect(countsById.get("plst_a")).toBe(5);
+    expect(countsById.get("plst_d")).toBe(5);
+    expect(countsById.get("plst_b")).toBe(2);
+    // A key with ZERO score rows is absent from a GROUP BY result; it reads 0,
+    // exactly the value the per-key `count()` produced for it.
+    expect(countsById.get("plst_c")).toBe(0);
+  });
+
+  it("no listing carries an experimentKey → no waitlistScore read is issued at all", async () => {
+    (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
+      listingRow("plst_a", null),
+    ]);
+
+    const rows = await listProjectListings(SITE);
+
+    expect(prisma.waitlistScore.groupBy).not.toHaveBeenCalled();
+    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+    expect(rows[0]!.waitlistCount).toBe(0);
+  });
+});
+
+describe("publicProjectListings — the anonymous read is bounded (#9243 AC-2)", () => {
+  it("passes a take; more active listings than the bound returns exactly the bound", async () => {
+    const overBound = Array.from(
+      { length: LISTING_DIRECTORY_MAX_ENTRIES + 1 },
+      (_, i) => listingRow(`plst_${i}`, EXPERIMENT_A),
+    );
+    // Honour `take` the way the database would, so an unbounded read is the
+    // failure this test sees rather than one the double hides.
+    (prisma.projectListing.findMany as jest.Mock).mockImplementation(
+      ({ take }: { take?: number }) =>
+        Promise.resolve(overBound.slice(0, take)),
+    );
+
+    const result = await publicProjectListings(SITE);
+
+    expect(
+      (prisma.projectListing.findMany as jest.Mock).mock.calls[0]![0].take,
+    ).toBe(LISTING_DIRECTORY_MAX_ENTRIES);
+    expect(result).toHaveLength(LISTING_DIRECTORY_MAX_ENTRIES);
+    // Still one count query for the whole bounded page.
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledTimes(1);
+  });
+});