create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/server.ts

@@ -1,1882 +1,142 @@
 /**
- * AI Launch Kit API Server
- *
- * Local-only backend for auth (sessions, API tokens) stored in the customer DB.
- * Business-data proxying has been removed; AILK-native routes will be added
- * in subsequent issues.
- *
- * This file exports a build() function for both:
- * - Vercel serverless deployment (api/index.ts)
+ * AI Launch Kit API Server — the boot's composition (#9564 D5).
+ *
+ * The server is `@working-theory/api` (#9563 D8 PR 1): the base routes,
+ * services, middleware and stores, and `buildServer({ modules, topology,
+ * config })`, live in the package. This file is what a site owns: it loads
+ * the six module objects and hands them to the package, which registers
+ * every row of the registration table whose predicate holds over the
+ * registered set — the modules `AILK_ENABLED_MODULES` selects whose claim
+ * read answered `claimed` (#9565 D4/D5). The route table a build serves is
+ * the one it served before the move (`src/__tests__/registration-table.test.ts`).
+ *
+ * Exports the same zero-argument `build()` for both:
+ * - Vercel serverless deployment (api/index.ts → src/vercel-handler.ts)
  * - Local development (src/index.ts)
+ *
+ * ONE MODULE-LEVEL CONSTANT PER MODULE OBJECT — the #5304 form. The specifier
+ * is never written at the `import()` call site, so `tsc` does not resolve it
+ * and the public and keyless trees, which carry no module file, still
+ * compile; it IS a module-level constant dereferenced into `import()`, so
+ * `@vercel/nft` constant-propagates it and the deployed artifact carries the
+ * file. `scripts/enumerate-slice-specifiers.ts` and
+ * `scripts/check-slice-reachability.ts` re-measure both properties on every
+ * run. Every load site routes through `loadSlice()` so a bundled build says
+ * so at boot rather than failing mute (#5334; `apps/api/CLAUDE.md` § Deploy
+ * path). All six are loaded and passed on every boot (#9565 D5): the
+ * selection is `AILK_ENABLED_MODULES`, read by the package, and the claim is
+ * each package's own licence read — a passed module that is not selected
+ * registers nothing.
+ *
+ * Each `./modules/<name>.ts` file is a one-statement `// oss: false` re-export
+ * of `module: ApiModule` from `@working-theory/api-<name>` — the paid package
+ * that owns the routes, the plugin map and the claim read.
  */
-import cors from "@fastify/cors";
-import rateLimit from "@fastify/rate-limit";
-import { logger } from "@working-theory/observability";
-import Fastify from "fastify";
-import type {
-  FastifyPluginAsync,
-  FastifyPluginCallback,
-  FastifyReply,
-  FastifyRequest,
-} from "fastify";
-
-import { config } from "./config/index.js";
-import { isModuleEnabled, servedModules } from "./config/modules.js";
-import { redactLogPath, registerErrorSerializer } from "./lib/error-serializer.js";
-import { validateLeadCaptureDir } from "./lib/lead-capture-store.js";
-import { registerLicenseKeyStore } from "./lib/license-key-store.js";
-import { requireCommerceClaim } from "./lib/require-commerce-claim.js";
-import { assertSiteAliasResolves } from "./lib/site.js";
-import { loadSlice } from "./lib/slice-load.js";
-import { authPreHandlerPlugin } from "./middleware/auth.js";
-import { defaultTenantPreHandlerPlugin } from "./middleware/default-tenant.js";
-import {
-  rateLimitMiddleware,
-  buildTrustedKeyDigests,
-  DEFAULT_SCHEDULE_PER_KEY_PER_MINUTE,
-  DEFAULT_PER_IP_PER_MINUTE_STRICT,
-  DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
-  resolveRateLimitIdentity,
-  SITE_KEY_IDENTITY_PREFIX,
-  siteKeyReader,
-} from "./middleware/rate-limit.js";
-import { openapiRoutes } from "./openapi/index.js";
-import {
-  deriveRootEndpoints,
-  REGISTERED_ROUTES_DECORATOR,
-  API_VERSION,
-  apiDescription,
-  apiDisplayName,
-  resolveApiIdentity,
-} from "./openapi/spec.js";
-import type { RegisteredRoute } from "./openapi/surface-drift.js";
-import { exampleAeoRoute, scoreAeoRoute } from "./routes/aeo/index.js";
 import {
-  hubSignInClientRoutes,
-  hubSignInPublicRoutes,
-  hubSignInSessionRoutes,
-} from "./routes/auth/hub-sign-in.js";
-import { tokenRoutes } from "./routes/auth/tokens.js";
-import { transactionalEmailRoute } from "./routes/auth/transactional-email.js";
-import { userRoutes } from "./routes/auth/user.js";
-import {
-  consentAccountRoutes,
-  consentCookieRoute,
-  consentSignUpRoute,
-  consentUnsubscribeRoute,
-} from "./routes/consent/index.js";
-import { getPageRoute } from "./routes/content/get-page.js";
-import { listPagesRoute } from "./routes/content/list-pages.js";
-import { listTypesRoute } from "./routes/content/list-types.js";
-import { offeringsRoute } from "./routes/content/offerings.js";
-import { pricingRoute } from "./routes/content/pricing.js";
-import {
-  CONTENT_RATE_LIMIT_AUTH,
-  CONTENT_RATE_LIMIT_UNAUTH,
-  CONTENT_RATE_LIMIT_WINDOW,
-} from "./routes/content/rate-limit.js";
-import { searchContentRoute } from "./routes/content/search.js";
-import {
-  shownOfferingsRoute,
-  type ShownOfferingsRouteOptions,
-} from "./routes/content/shown-offerings.js";
-import {
-  leadCallbackRoute,
-  leadCaptureStatusRoute,
-  leadSubmitRoute,
-  leadSubscribeRoute,
-} from "./routes/leads/index.js";
-import { leadListRoute } from "./routes/leads/list.js";
-import { requestRoutes } from "./routes/requests/index.js";
-import {
-  registerTestAuthRoute,
-  shouldMountTestAuth,
-} from "./routes/test/auth/session.js";
-import { consentLinkSecretConfigured } from "./services/consent.js";
-import { stripeCatalogSourceFor } from "./services/offerings/source.js";
-import { resolveCallerSite } from "./services/public-site-resolver.js";
+  buildServer,
+  config,
+  OPTIONAL_MODULES,
+  type ApiHub,
+  type ApiModule,
+  type OptionalModule,
+} from "@working-theory/api";
+import { loadSlice } from "@working-theory/api/lib/slice-load.js";
+import { logger } from "@working-theory/observability";
+import type { FastifyInstance } from "fastify";
 
 /**
- * What a request looks like in a log line — Fastify's own default shape, minus
- * the QUERY STRING (#5970 security review).
- *
- * Exported so the property can be asserted directly rather than inferred from
- * a captured line, because the thing it protects is easy to regress silently:
- * pino's stock `req` serializer logs `req.raw.url` verbatim, and a route may
- * carry its credential there. `GET /v1/requests/:id/confirm?token=…` does,
- * since a link in an email has nowhere else to put one, and that token is live
- * for seven days and mints a chargeable Stripe artifact.
- *
- * Nothing that identifies a request is lost: a route parameter such as `:id`
- * lives in the PATH and survives. Only the secret after `?` is dropped.
- *
- * Path segments that are themselves credentials or identifiers — a `cs_…`
- * Checkout Session id (#6084 D14), a `lead_…` id (#6216 D11), a `person_…` id
- * (#8438 SEC-8438-10) and a webhook connection token (#8932 D10) — are
- * redacted by `redactLogPath` (`lib/error-serializer.ts`), the ONE path
- * redactor this serializer and the global error handler share, so a request
- * line and an error line can never disagree about what a path may carry.
- * Fastify's automatic "incoming request" line is emitted by its internal hook
- * BEFORE any route hook can intervene, so no route-level discipline can fix
- * it; this is the only place that can.
+ * The hub package (#9571 D5), the same specifier-constant form as the module
+ * objects below: `tsc` never resolves it, so the public tree — which carries
+ * no `packages-paid/` — still compiles, and `@vercel/nft` traces it.
+ * INSTALLED means the package's manifest (its `./package.json` export)
+ * resolves from this composition; the manifest imports nothing, so a
+ * not-found there is exactly "the package is absent". Any error loading the
+ * package itself — a missing transitive dependency, an untraced file — is
+ * rethrown and stops the boot: a broken install never boots as a deployment
+ * with no hub (SEC-9571-5).
  */
-export function requestLogSerializer(request: FastifyRequest) {
-  return {
-    method: request.method,
-    url: redactLogPath(request.url),
-    host: request.hostname,
-    remoteAddress: request.ip,
-  };
+const HUB_PACKAGE = "@working-theory/api-hub";
+const HUB_MANIFEST = "@working-theory/api-hub/package.json";
+
+const MODULE_NOT_FOUND_CODES = new Set(["ERR_MODULE_NOT_FOUND", "MODULE_NOT_FOUND"]);
+
+async function loadInstalledHub(): Promise<ApiHub | undefined> {
+  try {
+    await import(HUB_MANIFEST, { with: { type: "json" } });
+  } catch (error) {
+    const code = (error as { code?: unknown } | null | undefined)?.code;
+    if (typeof code === "string" && MODULE_NOT_FOUND_CODES.has(code)) return undefined;
+    throw error;
+  }
+  const mod = (await import(HUB_PACKAGE)) as { hub?: ApiHub };
+  if (!mod.hub) {
+    throw new Error(`hub export missing from ${HUB_PACKAGE}`);
+  }
+  return mod.hub;
 }
 
-/**
- * Fastify's default 404, with the logged path redacted (#8932 SEC-8932-10).
- * The default handler logs `Route METHOD:URL not found` with the raw URL in
- * the message, where `requestLogSerializer` never reaches, so a mis-pasted
- * webhook URL — a trailing slash, a double slash, an extra segment — would
- * log its connection token on every Stripe retry. The answer is the default
- * one, byte for byte; only the log line changes.
- */
-export function notFoundHandler(request: FastifyRequest, reply: FastifyReply) {
-  const { method, url = "" } = request.raw;
-  request.log.info(`Route ${method}:${redactLogPath(url)} not found`);
-  return reply.code(404).send({
-    message: `Route ${method}:${url} not found`,
-    error: "Not Found",
-    statusCode: 404,
-  });
-}
+const MULTI_TENANT_MODULE = "./modules/multi-tenant.js";
+const WORKSPACE_MODULE = "./modules/workspace.js";
+const SCHEDULING_MODULE = "./modules/scheduling.js";
+const SIGNAL_COLLECTORS_MODULE = "./modules/signal-collectors.js";
+const COMMERCE_MODULE = "./modules/commerce.js";
+const CONTENT_WRITE_MODULE = "./modules/content-write.js";
 
 /**
- * Paid-module SLICE entry points, keyed by the export each branch needs
- * (#5182).
- *
- * Every value here names a file the OSS strip removes. A shipping file may not
- * name a stripped file in ANY import form (spec D1): `import()` defers
- * EVALUATION, not RESOLUTION, so `tsc` resolves a string-literal specifier
- * whether or not the `isModuleEnabled()` branch containing it can ever run. The
- * ten literal `await import()` calls that used to sit at these call sites were
- * therefore ten TS2307 errors on the public tree, and the static
- * `./middleware/tenant.js` import was an eleventh — measured on a stripped
- * tree, not argued.
- *
- * Keeping the specifier off the `import()` call site is what defeats that
- * resolution, and the INDIRECTION — not the type of the value — is what does
- * the work. WHICH FORM of indirection is not free, and #5304 is the correction:
- * reading the specifier out of a TABLE, as this file did until then, hid it
- * from the deploy-time file tracer as well as from `tsc`, so the files were
- * compiled and never shipped. The form below — a module-level constant
- * dereferenced into `import()` — is unresolvable to `tsc` and traceable to
- * `@vercel/nft`, the only pair of properties that satisfies both the strip and
- * the deployment. S1's `isModuleEnabled()` gate is unchanged and still decides
- * whether the branch runs; `AILK_ENABLED_MODULES` unset still means every
- * module on, so a default build registers exactly what it registered before.
- *
- * This mechanism is sound here because `apps/api` is a `tsc`-only surface with
- * no bundler. It is NOT sound in `packages/ui`: webpack cannot statically
- * analyse a non-literal `import()` either, and compiles it to an async context
- * with no members, so the module silently fails to load on the tree that HAS
- * it. See the note above the imports in `packages/ui/src/sections/SectionRenderer.tsx`.
- *
- * BUNDLING `apps/api` IS NOT A SUPPORTED DEPLOY PATH, and that is a property of
- * the analysers rather than a posture (#5334). esbuild bundles a dynamic
- * `import()` only when its argument is a string literal at the call site —
- * exactly the predicate `tsc` resolves on, and exactly the one the strip
- * forbids. So no expression shape can satisfy both, and in a bundled build
- * these specifiers survive verbatim and resolve against the BUNDLE OUTPUT
- * directory instead of their source module's: `"./list.js"` in
- * `routes/project-listings/index.ts` becomes `dist/list.js` and is not there.
- * esbuild does not warn. `build()` then throws during CONSTRUCTION, so every
- * route 500s rather than one — measured in production, nine hours of total API
- * outage on a consuming site. The supported path is what the scaffold ships:
- * plain `tsc` output traced by `@vercel/node` (`apps/api/vercel.json`,
- * `framework: null`). If you are syncing this file into a repo that bundles,
- * that is the constraint you have just inherited; `apps/api/CLAUDE.md`
- * § Deploy path says what to do instead. Every load site below routes through
- * `loadSlice()` so a bundled build says so at boot rather than failing mute.
- *
- * `./routes/project-listings/index.js` carries two independent load paths on
- * purpose: its five anonymous-surface exports are reached below through
- * `PROJECT_LISTINGS_INDEX` / `SLICE_PLUGINS`, now that signal-collectors gates
- * their registration (D4), while the tenant scope's own `import()` of the same
- * specifier stays a literal — the file is a MIXED directory that always ships
- * (multi-tenant's `TENANT_HANDLERS` table lives in the same file), so a literal
- * there resolves fine on every tree regardless of module selection.
- */
-/**
- * One module-level constant per slice module. The call sites below read the
- * loader out of `SLICE_PLUGINS`; the specifier itself is never written at an
- * `import()` call site, which is what keeps `tsc` from resolving it (#5182 D1).
- *
- * The constant is not a style choice — it is the mechanism (#5304 D3).
- * `@vercel/nft` constant-propagates a module-level binding into `import()` and
- * emits the file; it cannot evaluate a table lookup or a for-of destructure,
- * which is what the previous `Record<string, string>` shape forced it to do.
- * So the old shape was invisible to the DEPLOY tracer as well as to `tsc`, the
- * files went untraced and unshipped, and `build()` threw ERR_MODULE_NOT_FOUND
- * on the first slice it reached — measured in production, nine hours of total
- * API outage on a consuming site. Both analysers are re-measured on every run
- * by `scripts/__tests__/enumerate-slice-specifiers.test.ts`, and
- * `scripts/check-slice-reachability.ts` fails when any specifier here stops
- * being traced.
- */
-const WORKSPACES_INDEX = "./routes/workspaces/index.js";
-const WORKSPACES_SESSIONS = "./routes/workspaces/sessions.js";
-const WORKSPACES_CONFIG = "./routes/workspaces/config.js";
-const WORKSPACES_GENERAL = "./routes/workspaces/general.js";
-const WORKSPACES_MEMBERS = "./routes/workspaces/members.js";
-// #6216 — a SIBLING specifier registered in the SAME workspace/multi-tenant
-// scope as WORKSPACES_GENERAL/WORKSPACES_MEMBERS below, not the
-// multi-tenant-only family WORKSPACES_MEETINGS/WORKSPACES_CONFIG sit in.
-const WORKSPACES_MESSAGES = "./routes/workspaces/messages.js";
-// #7535 — the Inbox submissions and subscribers reads, siblings of
-// WORKSPACES_MESSAGES in the same workspace/multi-tenant scope.
-const WORKSPACES_SUBMISSIONS = "./routes/workspaces/submissions.js";
-// #9170 — the Inbox orders read, the SAME scope.
-const WORKSPACES_ORDERS = "./routes/workspaces/orders.js";
-const WORKSPACES_SUBSCRIBERS = "./routes/workspaces/subscribers.js";
-// #852 D8 — the People reads (the workspace's clients), the SAME scope.
-const WORKSPACES_PEOPLE = "./routes/workspaces/people.js";
-// #7877 D9 — a client's pieces, plan and outbound messages, and the
-// workspace's piece stages: the writes owners, admins and (#8514) members
-// make, the SAME scope.
-const WORKSPACES_PIECES = "./routes/workspaces/pieces.js";
-const WORKSPACES_PLAN = "./routes/workspaces/plan.js";
-const WORKSPACES_MESSAGES_OUT = "./routes/workspaces/messages-out.js";
-// #8171 D8 — the workspace's Requests read (the inbound member rows), the
-// SAME scope.
-const WORKSPACES_REQUESTS = "./routes/workspaces/requests.js";
-// #7877 D11 — the member reads: auth only, under the SAME module predicate.
-const MEMBER_PIECES = "./routes/member/pieces.js";
-const MEMBER_MESSAGES = "./routes/member/messages.js";
-// #8169 D9 — the Phase 1 member reads. Five under the SAME predicate; the two
-// that reach services/scheduling/ under scheduling && (workspace ||
-// multi-tenant), because only the scheduling module delivers that directory.
-const MEMBER_PURCHASES = "./routes/member/purchases.js";
-const MEMBER_APPOINTMENTS = "./routes/member/appointments.js";
-const MEMBER_ARTIFACTS = "./routes/member/artifacts.js";
-const MEMBER_REQUEST_FORM = "./routes/member/request-form.js";
-const MEMBER_BILLING = "./routes/member/billing.js";
-const MEMBER_MEETING_TYPES = "./routes/member/meeting-types.js";
-const MEMBER_AVAILABILITY = "./routes/member/availability.js";
-// #8170 D11 — the member writes. Four under the tenancy predicate (the
-// message POST rides MEMBER_MESSAGES); the booking, which reaches
-// services/scheduling/, under scheduling && (workspace || multi-tenant).
-const MEMBER_REQUESTS = "./routes/member/requests.js";
-const MEMBER_ARTIFACT_REVIEW = "./routes/member/artifact-review.js";
-const MEMBER_PROFILE = "./routes/member/profile.js";
-const MEMBER_DELETION_REQUEST = "./routes/member/deletion-request.js";
-const MEMBER_BOOKINGS = "./routes/member/bookings.js";
-// #8438 D6 — the member's own consents, under the tenancy predicate beside the
-// other member routes. D8 — the Admin owner's consents to Working Theory,
-// under multi-tenant alone (the module that contributes the Admin app).
-const MEMBER_CONSENTS = "./routes/member/consents.js";
-// #8515 D13 — the client's onboarding read and write, under the tenancy
-// predicate beside the request-quote pair.
-const MEMBER_ONBOARDING = "./routes/member/onboarding.js";
-const CONSENT_PLATFORM = "./routes/consent/platform.js";
-// #3591 PR-B — the agent seat's management routes and an agent's own
-// context, siblings of WORKSPACES_MEMBERS in the same workspace/multi-tenant
-// scope.
-const WORKSPACES_AGENTS = "./routes/workspaces/agents.js";
-// #6183 S9b — a SEPARATE specifier from WORKSPACES_CONFIG: this route is
-// registered under isModuleEnabled("scheduling") alone, never the
-// workspace/multi-tenant scope config.js shares with general.js/members.js
-// (see config.ts's own header for why).
-const WORKSPACES_MEETINGS = "./routes/workspaces/meetings.js";
-const WORKSPACES_CONTENT = "./routes/workspaces/content.js";
-const ASSETS_UPLOAD = "./routes/assets/upload.js";
-const ASSETS_READ = "./routes/assets/read.js";
-const ASSETS_MANAGE = "./routes/assets/manage.js";
-const BILLING_INDEX = "./routes/billing/index.js";
-const WORKSPACES_OFFERINGS = "./routes/workspaces/offerings.js";
-const WAITLIST_EXPERIMENTS_INDEX = "./routes/waitlist-experiments/index.js";
-const SCHEDULE_INDEX = "./routes/schedule/index.js";
-const FLOWS_INDEX = "./routes/flows/index.js";
-const DELIVERABLES_INDEX = "./routes/deliverables/index.js";
-const PROJECT_LISTINGS_INDEX = "./routes/project-listings/index.js";
-const SLACK_INDEX = "./routes/slack/index.js";
-const WAITLIST_SIGNUPS_INDEX = "./routes/waitlist-signups/index.js";
-const CHECKOUT_INDEX = "./routes/checkout/index.js";
-const WEBHOOKS_INDEX = "./routes/webhooks/index.js";
-const FLOW_CHECKOUTS_INDEX = "./routes/flow-checkouts/index.js";
-const SUBSCRIPTION_INDEX = "./routes/subscription/index.js";
-const RECOMMENDER_INDEX = "./routes/flows/recommender.js";
-const MAGNETS_INDEX = "./routes/magnets/index.js";
-
-/**
- * Paid-module SLICE entry points, keyed by the export each branch needs.
- *
- * `specifier` is carried alongside `load` for the drift message below, and both
- * read the SAME constant, so the two can never disagree. `load` is what runs:
- * an arrow closing over that constant, which is the only shape both analysers
+ * `specifier` is carried alongside `load` for `loadSlice()`'s diagnostic, and
+ * both read the SAME constant, so the two can never disagree. `load` is what
+ * runs: an arrow closing over that constant, the only shape both analysers
  * treat as intended — unresolvable to `tsc`, traceable to `nft`.
  */
-const SLICE_PLUGINS = {
-  workspaceContextRoutes: {
-    specifier: WORKSPACES_INDEX,
-    load: () => import(WORKSPACES_INDEX),
-  },
-  workspaceSessionRoutes: {
-    specifier: WORKSPACES_INDEX,
-    load: () => import(WORKSPACES_INDEX),
-  },
-  sessionRoutes: {
-    specifier: WORKSPACES_SESSIONS,
-    load: () => import(WORKSPACES_SESSIONS),
-  },
-  workspaceConfigRoutes: {
-    specifier: WORKSPACES_CONFIG,
-    load: () => import(WORKSPACES_CONFIG),
-  },
-  workspaceGeneralRoutes: {
-    specifier: WORKSPACES_GENERAL,
-    load: () => import(WORKSPACES_GENERAL),
-  },
-  workspaceMembersRoutes: {
-    specifier: WORKSPACES_MEMBERS,
-    load: () => import(WORKSPACES_MEMBERS),
-  },
-  // #6216 — the Inbox message API, the SAME scope as the two above.
-  workspaceMessageRoutes: {
-    specifier: WORKSPACES_MESSAGES,
-    load: () => import(WORKSPACES_MESSAGES),
-  },
-  // #7535 — the Inbox submissions and subscribers reads, the SAME scope.
-  workspaceSubmissionRoutes: {
-    specifier: WORKSPACES_SUBMISSIONS,
-    load: () => import(WORKSPACES_SUBMISSIONS),
-  },
-  // #9170 — the Inbox orders read, the SAME scope.
-  workspaceOrderRoutes: {
-    specifier: WORKSPACES_ORDERS,
-    load: () => import(WORKSPACES_ORDERS),
-  },
-  workspaceSubscriberRoutes: {
-    specifier: WORKSPACES_SUBSCRIBERS,
-    load: () => import(WORKSPACES_SUBSCRIBERS),
-  },
-  // #852 D8 — the People list and Person record, the SAME scope.
-  workspacePeopleRoutes: {
-    specifier: WORKSPACES_PEOPLE,
-    load: () => import(WORKSPACES_PEOPLE),
-  },
-  // #7877 D9 — the member area's operator routes (owners, admins and, since
-  // #8514, members), the SAME scope.
-  workspacePieceRoutes: {
-    specifier: WORKSPACES_PIECES,
-    load: () => import(WORKSPACES_PIECES),
-  },
-  // #8171 D8 — the Requests read, the SAME scope.
-  workspaceRequestRoutes: {
-    specifier: WORKSPACES_REQUESTS,
-    load: () => import(WORKSPACES_REQUESTS),
-  },
-  workspacePlanRoutes: {
-    specifier: WORKSPACES_PLAN,
-    load: () => import(WORKSPACES_PLAN),
-  },
-  workspaceOutboundMessageRoutes: {
-    specifier: WORKSPACES_MESSAGES_OUT,
-    load: () => import(WORKSPACES_MESSAGES_OUT),
-  },
-  // #7877 D11 — the member reads, in authScope under the same predicate.
-  memberPieceRoutes: {
-    specifier: MEMBER_PIECES,
-    load: () => import(MEMBER_PIECES),
-  },
-  memberMessageRoutes: {
-    specifier: MEMBER_MESSAGES,
-    load: () => import(MEMBER_MESSAGES),
+const MODULE_OBJECTS: Record<
+  OptionalModule,
+  { specifier: string; load: () => Promise<unknown> }
+> = {
+  "multi-tenant": {
+    specifier: MULTI_TENANT_MODULE,
+    load: () => import(MULTI_TENANT_MODULE),
   },
-  // #8169 D9 — the Phase 1 member reads, in authScope beside the two above.
-  memberPurchaseRoutes: {
-    specifier: MEMBER_PURCHASES,
-    load: () => import(MEMBER_PURCHASES),
+  workspace: {
+    specifier: WORKSPACE_MODULE,
+    load: () => import(WORKSPACE_MODULE),
   },
-  memberAppointmentRoutes: {
-    specifier: MEMBER_APPOINTMENTS,
-    load: () => import(MEMBER_APPOINTMENTS),
+  scheduling: {
+    specifier: SCHEDULING_MODULE,
+    load: () => import(SCHEDULING_MODULE),
   },
-  memberArtifactRoutes: {
-    specifier: MEMBER_ARTIFACTS,
-    load: () => import(MEMBER_ARTIFACTS),
+  "signal-collectors": {
+    specifier: SIGNAL_COLLECTORS_MODULE,
+    load: () => import(SIGNAL_COLLECTORS_MODULE),
   },
-  memberRequestFormRoutes: {
-    specifier: MEMBER_REQUEST_FORM,
-    load: () => import(MEMBER_REQUEST_FORM),
+  commerce: {
+    specifier: COMMERCE_MODULE,
+    load: () => import(COMMERCE_MODULE),
   },
-  memberBillingRoutes: {
-    specifier: MEMBER_BILLING,
-    load: () => import(MEMBER_BILLING),
+  "content-write": {
+    specifier: CONTENT_WRITE_MODULE,
+    load: () => import(CONTENT_WRITE_MODULE),
   },
-  // The two that reach services/scheduling/ (scheduling-owned, D9).
-  memberMeetingTypeRoutes: {
-    specifier: MEMBER_MEETING_TYPES,
-    load: () => import(MEMBER_MEETING_TYPES),
-  },
-  memberAvailabilityRoutes: {
-    specifier: MEMBER_AVAILABILITY,
-    load: () => import(MEMBER_AVAILABILITY),
-  },
-  // #8170 D11 — the member writes, in authScope beside the reads.
-  memberRequestRoutes: {
-    specifier: MEMBER_REQUESTS,
-    load: () => import(MEMBER_REQUESTS),
-  },
-  // #8515 D13 — the onboarding read and write.
-  memberOnboardingRoutes: {
-    specifier: MEMBER_ONBOARDING,
-    load: () => import(MEMBER_ONBOARDING),
-  },
-  memberArtifactReviewRoutes: {
-    specifier: MEMBER_ARTIFACT_REVIEW,
-    load: () => import(MEMBER_ARTIFACT_REVIEW),
-  },
-  memberProfileRoutes: {
-    specifier: MEMBER_PROFILE,
-    load: () => import(MEMBER_PROFILE),
-  },
-  memberDeletionRequestRoutes: {
-    specifier: MEMBER_DELETION_REQUEST,
-    load: () => import(MEMBER_DELETION_REQUEST),
-  },
-  // #8438 D6 — the member's own consents, the SAME scope as the writes above.
-  memberConsentRoutes: {
-    specifier: MEMBER_CONSENTS,
-    load: () => import(MEMBER_CONSENTS),
-  },
-  // #8438 D8 — the owner's consents to Working Theory (multi-tenant only).
-  consentPlatformRoutes: {
-    specifier: CONSENT_PLATFORM,
-    load: () => import(CONSENT_PLATFORM),
-  },
-  // The one that reaches services/scheduling/ (scheduling-owned, D11).
-  memberBookingRoutes: {
-    specifier: MEMBER_BOOKINGS,
-    load: () => import(MEMBER_BOOKINGS),
-  },
-  // #3591 PR-B — the agent seat, the SAME scope.
-  workspaceAgentRoutes: {
-    specifier: WORKSPACES_AGENTS,
-    load: () => import(WORKSPACES_AGENTS),
-  },
-  // #6183 S9b — registered in the scheduling scope, not the
-  // workspace/multi-tenant scope its siblings above share.
-  workspaceMeetingsRoutes: {
-    specifier: WORKSPACES_MEETINGS,
-    load: () => import(WORKSPACES_MEETINGS),
-  },
-  workspaceContentRoutes: {
-    specifier: WORKSPACES_CONTENT,
-    load: () => import(WORKSPACES_CONTENT),
-  },
-  workspaceAssetUploadRoute: {
-    specifier: ASSETS_UPLOAD,
-    load: () => import(ASSETS_UPLOAD),
-  },
-  publicAssetReadRoute: {
-    specifier: ASSETS_READ,
-    load: () => import(ASSETS_READ),
-  },
-  workspaceAssetManageRoutes: {
-    specifier: ASSETS_MANAGE,
-    load: () => import(ASSETS_MANAGE),
-  },
-  billingRoutes: {
-    specifier: BILLING_INDEX,
-    load: () => import(BILLING_INDEX),
-  },
-  // #8926 D1 — the workspace Offerings routes, multi-tenant only.
-  workspaceOfferingsRoutes: {
-    specifier: WORKSPACES_OFFERINGS,
-    load: () => import(WORKSPACES_OFFERINGS),
-  },
-  waitlistExperimentRoutes: {
-    specifier: WAITLIST_EXPERIMENTS_INDEX,
-    load: () => import(WAITLIST_EXPERIMENTS_INDEX),
-  },
-  listAvailabilityRoute: {
-    specifier: SCHEDULE_INDEX,
-    load: () => import(SCHEDULE_INDEX),
-  },
-  getEventMetaRoute: {
-    specifier: SCHEDULE_INDEX,
-    load: () => import(SCHEDULE_INDEX),
-  },
-  createBookingRoute: {
-    specifier: SCHEDULE_INDEX,
-    load: () => import(SCHEDULE_INDEX),
-  },
-  // #6183 S9b D2/D12 — the enabled-meeting-slugs public read; same
-  // specifier as the three anonymous schedule routes above (§ D6's
-  // precedent, no new SLICE_PLUGINS specifier constant needed).
-  meetingTypesRoute: {
-    specifier: SCHEDULE_INDEX,
-    load: () => import(SCHEDULE_INDEX),
-  },
-  // #8843 D1 — the meetings read; same specifier as its schedule siblings.
-  listMeetingsRoute: {
-    specifier: SCHEDULE_INDEX,
-    load: () => import(SCHEDULE_INDEX),
-  },
-  // #6085 — the tenant-guarded appointments read; same specifier as the
-  // three anonymous schedule routes above (§ D6, no new SLICE_PLUGINS
-  // specifier constant needed).
-  listAppointmentsRoute: {
-    specifier: SCHEDULE_INDEX,
-    load: () => import(SCHEDULE_INDEX),
-  },
-  getFlowRoute: {
-    specifier: FLOWS_INDEX,
-    load: () => import(FLOWS_INDEX),
-  },
-  submitFlowStepRoute: {
-    specifier: FLOWS_INDEX,
-    load: () => import(FLOWS_INDEX),
-  },
-  getFlowAggregateRoute: {
-    specifier: FLOWS_INDEX,
-    load: () => import(FLOWS_INDEX),
-  },
-  // #7876 D1 — a spoke seeds its declared flows; off until
-  // AILK_SPOKE_FLOW_SEED (the route answers 403 flow_seed_disabled).
-  putFlowDefinitionRoute: {
-    specifier: FLOWS_INDEX,
-    load: () => import(FLOWS_INDEX),
-  },
-  // #6157 — the tenant-scoped magnet Admin authoring surface. ONE plugin,
-  // ONE specifier (D2): all four routes register through this one entry.
-  magnetRoutes: {
-    specifier: MAGNETS_INDEX,
-    load: () => import(MAGNETS_INDEX),
-  },
-  deliverableDownloadRoute: {
-    specifier: DELIVERABLES_INDEX,
-    load: () => import(DELIVERABLES_INDEX),
-  },
-  // #8848 D5 — an ungated file's bytes, in its own `deliverableopen` scope.
-  deliverableOpenRoute: {
-    specifier: DELIVERABLES_INDEX,
-    load: () => import(DELIVERABLES_INDEX),
-  },
-  projectListingStartRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  projectListingDraftPatchRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  projectListingSubmitRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  // #5407 — the resume link's verification write. Anonymous surface,
-  // module-conditional (signal-collectors, D-48) like its four siblings.
-  projectListingVerifyEmailRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  projectListingPublicRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  // #7521 — the landing-page directory read; its own rate-limited scope below.
-  projectListingDirectoryRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  projectListingMeRoute: {
-    specifier: PROJECT_LISTINGS_INDEX,
-    load: () => import(PROJECT_LISTINGS_INDEX),
-  },
-  slackActionsRoute: {
-    specifier: SLACK_INDEX,
-    load: () => import(SLACK_INDEX),
-  },
-  waitlistSignupRoutes: {
-    specifier: WAITLIST_SIGNUPS_INDEX,
-    load: () => import(WAITLIST_SIGNUPS_INDEX),
-  },
-  // Commerce (D-47, #5364), re-cut by D-64 (#5796). `checkoutRoutes` and
-  // `webhooksRoutes` are the base-tree PRIMITIVES now: they register
-  // UNCONDITIONALLY and gate at call time on the `commerce` license claim
-  // (lib/require-commerce-claim.ts), so they are no longer slice-gated even
-  // though they still load through this table. `flowCheckoutRoutes` and the
-  // two recommender entries below stay module-conditional (isModuleEnabled
-  // "commerce") — they are commerce OVERLAY, not primitives.
-  checkoutRoutes: {
-    specifier: CHECKOUT_INDEX,
-    load: () => import(CHECKOUT_INDEX),
-  },
-  webhooksRoutes: {
-    specifier: WEBHOOKS_INDEX,
-    load: () => import(WEBHOOKS_INDEX),
-  },
-  flowCheckoutRoutes: {
-    specifier: FLOW_CHECKOUTS_INDEX,
-    load: () => import(FLOW_CHECKOUTS_INDEX),
-  },
-  // #6038 — the buyer-scoped subscription-status route pair (the
-  // update-your-card banner's read + portal handoff). Commerce OVERLAY,
-  // same posture as flowCheckoutRoutes immediately above.
-  subscriptionRoutes: {
-    specifier: SUBSCRIPTION_INDEX,
-    load: () => import(SUBSCRIPTION_INDEX),
-  },
-  saveRecommendationRoute: {
-    specifier: RECOMMENDER_INDEX,
-    load: () => import(RECOMMENDER_INDEX),
-  },
-  checkoutRecommendationRoute: {
-    specifier: RECOMMENDER_INDEX,
-    load: () => import(RECOMMENDER_INDEX),
-  },
-} satisfies Record<string, { specifier: string; load: () => Promise<unknown> }>;
-
-type SlicePluginName = keyof typeof SLICE_PLUGINS;
+};
 
 /**
- * Load one slice route plugin. Every entry above is a `FastifyPluginAsync`
- * export, which is the cast's whole content — `import(nonLiteral)` yields
- * `any`, so this boundary is the load-bearing line and names the exact shape
- * rather than spreading `any` into `register()`.
- *
- * Throws rather than skipping if the export is missing: the branch only runs
- * when the module is declared enabled, so an absent export is a build/packaging
- * fault to surface at boot, not a condition to degrade through.
- */
-async function sliceRoutePlugin(
-  name: SlicePluginName,
-): Promise<FastifyPluginAsync> {
-  const { specifier, load } = SLICE_PLUGINS[name];
-  const mod = (await loadSlice(specifier, load)) as Record<
-    string,
-    FastifyPluginAsync | undefined
-  >;
-  const plugin = mod[name];
-  if (!plugin) {
-    throw new Error(`slice export ${name} missing from ${specifier}`);
-  }
-  return plugin;
-}
-
-/**
- * The multi-tenant preHandler plugin — the one slice entry that is not a
- * route plugin. `FastifyPluginCallback`, registered with no options
- * (apps/api/src/middleware/tenant.ts:83).
- */
-async function tenantPreHandlerSlicePlugin(): Promise<FastifyPluginCallback> {
-  const specifier: string = "./middleware/tenant.js";
-  const mod = (await loadSlice(specifier, () => import(specifier))) as {
-    tenantPreHandlerPlugin?: FastifyPluginCallback;
-  };
-  const plugin = mod.tenantPreHandlerPlugin;
-  if (!plugin) {
-    throw new Error(
-      "slice export tenantPreHandlerPlugin missing from " + specifier,
-    );
-  }
-  return plugin;
-}
-
-/**
- * The tenant guard THIS build runs (#5677). Exactly one of the two, never
- * both: the multi-tenant module's `resolveActiveTenant` guard when the module
- * is enabled, and the base-build default-workspace guard
- * (`middleware/default-tenant.ts`) otherwise.
- *
- * Precedence, not parallelism. On a build WITH the module this returns the
- * identical plugin every tenant scope registered before, so multi-tenant
- * resolution and behavior are unchanged. On a build without it, the base guard
- * resolves the seeded default Workspace (`database/tenancy.ts`) under the same
- * default-deny posture — which is what makes the already-built review
- * dashboard reachable at Pro instead of leaving its routes unregistered.
- *
- * The base guard is a STATIC import, not a slice load: it always ships.
- */
-async function tenantPreHandlerForBuild(): Promise<FastifyPluginCallback> {
-  return isModuleEnabled("multi-tenant")
-    ? await tenantPreHandlerSlicePlugin()
-    : defaultTenantPreHandlerPlugin;
-}
-
-/**
- * The commerce boot-time key admission — the one other slice entry that is
- * not a route plugin, mirroring `tenantPreHandlerSlicePlugin()` above (D3).
- * `lib/stripe.ts` is commerce-owned (D5) and its `admitApiStripeKey` is the
- * sole `apps/api` reach into the Stripe SDK wrapper package, so it can no
- * longer be a static import (spec D1) once the module is stripped. The
- * widened `const specifier: string` annotation is what defeats `tsc`
- * resolution, exactly as it does above.
- *
- * #8450 D4: called with NO argument, so the admission covers the same
- * `process.env` key `getStripeClient()` later reads. `STRIPE_MODE` unset is
- * today's sandbox-only check; only a restricted live key beside
- * `STRIPE_MODE=live` on a production build comes back `"live"`.
- */
-async function admitCommerceStripeKey(): Promise<"test" | "live"> {
-  const specifier: string = "./lib/stripe.js";
-  const mod = (await loadSlice(specifier, () => import(specifier))) as {
-    admitApiStripeKey?: () => "test" | "live";
-  };
-  const admitApiStripeKeyFn = mod.admitApiStripeKey;
-  if (!admitApiStripeKeyFn) {
-    throw new Error("slice export admitApiStripeKey missing from " + specifier);
-  }
-  return admitApiStripeKeyFn();
-}
-
-/**
- * #6889 (SEC-02 of the #6876 security review) — make the checkout route's
- * posture observable. POST /v1/checkout/sessions admits a caller without
- * X-Internal-Auth when OSS_API_INTERNAL_SECRET is unset. With FRONTEND_URL
- * unset in production, the trusted-origin list (#7395) holds only
- * AILK_TRUSTED_ORIGINS — with that unset too, CORS and cookie writes refuse
- * every browser origin and the redirect lock (#6877) answers 500
- * config-error to that caller. Both stay optional (OSS standalone compat), so
- * this only ever WARNS — once per unset variable, and only in production.
- * FRONTEND_URL is read from the raw environment because `config.FRONTEND_URL`
- * carries a localhost default.
- */
-function warnOnUnsetProductionProtections(): void {
-  // #8438 D9 — AILK_CONSENT_LINK_SECRET is optional, but a value shorter than
-  // 32 bytes is a misconfiguration worth an error at boot: it is treated as
-  // unset, so no unsubscribe link can be minted or honored. Never the value.
-  if (
-    process.env["AILK_CONSENT_LINK_SECRET"] !== undefined &&
-    process.env["AILK_CONSENT_LINK_SECRET"] !== "" &&
-    !consentLinkSecretConfigured()
-  ) {
-    logger.error(
-      "[startup] AILK_CONSENT_LINK_SECRET is set but shorter than 32 bytes — treated as unset; no unsubscribe link can be minted or honored",
-    );
-  }
-  if (config.NODE_ENV !== "production") return;
-  if (!process.env["FRONTEND_URL"]) {
-    logger.warn(
-      "[startup] FRONTEND_URL not set in production — CORS, cookie-authenticated writes and checkout redirects trust only AILK_TRUSTED_ORIGINS; with neither set, all three refuse every browser origin and checkout answers 500 config-error to any caller admitted without X-Internal-Auth",
-    );
-  }
-  if (!process.env["OSS_API_INTERNAL_SECRET"]) {
-    logger.warn(
-      "[startup] OSS_API_INTERNAL_SECRET not set in production — the checkout route admits callers without X-Internal-Auth",
-    );
-  }
-}
-
-/**
- * Build Fastify server instance (for serverless or standalone)
+ * Build the Fastify server (for serverless or standalone): the six module
+ * objects, handed to `@working-theory/api`, which selects and claims.
  * @returns Configured Fastify instance ready for requests
  */
-export async function build() {
-  // Startup-time validation: fail fast if LEAD_CAPTURE_FILE points at a missing directory.
-  await validateLeadCaptureDir();
-
-  warnOnUnsetProductionProtections();
-
-  // #6155 D6 — the site-alias workspace assertion (ownership brief § Layer
-  // 2, AC-5): resolves + asserts once at startup that AILK_SITE_ID (or its
-  // "default" fallback) names a real workspace, throwing when it does not —
-  // the same catch-log-exit(1) path index.ts already runs on this throws
-  // loud rather than serving empty lists. Carve-out: with no DATABASE_URL
-  // configured, it logs a warning and returns instead of throwing (a
-  // database-less dev boot).
-  await assertSiteAliasResolves();
-
-  // #6677 DD-6 — the renewed licence key's durable home: with a database,
-  // one deployment-wide SiteSetting row, so a redeploy keeps the key this
-  // site renewed. Never throws; without DATABASE_URL the file store stays.
-  await registerLicenseKeyStore();
-
-  // Runtime key admission (#8450 D4): refuse, before any webhook or checkout
-  // call can exercise it, every live Stripe key this process cannot vouch
-  // for — all of them unless STRIPE_MODE=live sits beside a restricted live
-  // key on a production build. UNCONDITIONAL since D-64 (#5796): the
-  // commerce primitives and lib/stripe.ts are base tree now, so the key's
-  // presence — not a module flag — is the whole question. A build with no
-  // STRIPE_SECRET_KEY has nothing to admit.
-  let stripeMode: "test" | "live" = "test";
-  if (config.STRIPE_SECRET_KEY) {
-    stripeMode = await admitCommerceStripeKey();
-    logger.info({ stripeMode }, "[startup] stripe key admitted");
+export async function build(): Promise<FastifyInstance> {
+  const modules: ApiModule[] = [];
+  for (const name of OPTIONAL_MODULES) {
+    const { specifier, load } = MODULE_OBJECTS[name];
+    const mod = (await loadSlice(specifier, load)) as { module?: ApiModule };
+    if (!mod.module) {
+      throw new Error(`module export missing from ${specifier}`);
+    }
+    modules.push(mod.module);
   }
-
-  // trustProxy: true (#4730) — the Vercel serverless handler
-  // (apps/api/api/index.ts) bridges every request through Fastify's
-  // `.inject()` rather than a real socket, so `req.socket.remoteAddress`
-  // (the trustProxy:false default) is a meaningless simulated value, not
-  // the caller's address. With trustProxy enabled, req.ip instead resolves
-  // from `X-Forwarded-For` (the header Vercel's own edge sets on every
-  // inbound request) via Fastify's built-in proxy-addr parsing — reading
-  // the LEFTMOST address in a multi-hop chain, i.e. the address farthest
-  // from this process. This is what lets the per-scope rate limiter
-  // (middleware/rate-limit.ts) key on a real visitor's IP instead of a
-  // constant fallback or a shared intermediary's egress IP (see the flows/
-  // leads/aeo/schedule scopes below).
-  //
-  // Trade-off: X-Forwarded-For is caller-suppliable to anyone hitting this
-  // API directly (there is no fixed, allowlistable upstream proxy — this
-  // API's actual "proxies" are arbitrary consumer web functions), so a
-  // direct caller can still spoof a fresh identity per request. Per-IP
-  // rate limiting on these anonymous surfaces is a best-effort abuse
-  // deterrent, not a hard security boundary; this trades a small amount of
-  // spoof-resistance for correctness on the overwhelmingly common path
-  // (server-action-forwarded traffic), which was previously broken for
-  // every caller.
-  const server = Fastify({
-    logger: {
-      // The request serializer drops the QUERY STRING (#5970 security review,
-      // finding 1). Fastify's default `req` serializer logs `req.raw.url`
-      // verbatim, so any route whose credential rides in the query string
-      // writes that credential into the API's own log on every single request
-      // — including the automatic "incoming request" line, which is emitted by
-      // Fastify's internal hook before any route-level hook can intervene.
-      //
-      // `GET /v1/requests/:id/confirm?token=…` is exactly such a route: the
-      // token IS the authorization, it is live for seven days, and holding it
-      // is enough to read a requester's name and phone and to mint a Payment
-      // Link on the site's own Stripe account. `Referrer-Policy: no-referrer`
-      // on that route exists to keep the token out of a THIRD PARTY's logs;
-      // this keeps it out of ours, which is the larger hole of the two.
-      //
-      // The shape is otherwise Fastify's own default, minus the query: a log
-      // consumer reading `method` + `url` + `remoteAddress` sees what it
-      // always saw. Nothing that identifies a REQUEST is lost — `:id` is in
-      // the path and survives; only the secret after `?` is dropped.
-      serializers: { req: requestLogSerializer },
-    },
-    trustProxy: true,
-  });
-
-  // The hub's forwarding-key digests (#7394 DD-2), parsed once from
-  // AILK_VISITOR_FORWARD_KEYS and shared by the global ceiling and the leads
-  // scope below, so both limiters apply one identity rule. A keyed spoke's
-  // lead write is counted per visitor (`x-ailk-visitor-ip`); everything else
-  // keys on `req.ip`. Unset → `[]`, which believes no forwarded visitor. The
-  // parse warns by entry position only, never an entry's value.
-  const visitorForwardKeyDigests = buildTrustedKeyDigests(
-    process.env.AILK_VISITOR_FORWARD_KEYS,
-    (msg) => server.log.warn(msg),
-  );
-
-  // #8805 — the sign-up evidence read's site key, verified once per request
-  // and shared by the global ceiling and the `signupevidence` scope below. A
-  // registered, unrevoked spoke key (`resolveCallerSite`, the registry lookup
-  // every spoke-aware route uses) is counted per key; a malformed, unknown or
-  // revoked one, or none, keeps `req.ip`. It decides the bucket only — the
-  // route still serves `resolveSiteWorkspaceId()`.
-  const signUpEvidenceSiteKey = siteKeyReader(async (req) => {
-    const caller = await resolveCallerSite(req);
-    return caller.kind === "spoke" ? caller.spokeId : null;
-  });
-
-  // Collect the route table this server registers (#5314).
-  //
-  // Installed here — after `Fastify()` and before the first `register()` — so
-  // no route can precede it: a root-instance `onRoute` hook fires for every
-  // route added afterwards in ANY encapsulated child scope, which is what lets
-  // one hook see the auth, tenant, webhooks, leads, flows, aeo and schedule
-  // scopes without touching any of them.
-  //
-  // HEAD is dropped: Fastify synthesises it from every GET, so publishing it
-  // would describe routes no handler declared.
-  //
-  // The table lives on THIS instance, not in module state, so two servers
-  // built concurrently in one process cannot corrupt each other's — see the
-  // note on `readRegisteredRoutes` in openapi/spec.ts for the concrete race.
-  // The decorator holds the array by reference and the hook pushes into it, so
-  // every reader sees the current contents without re-publishing.
-  const registeredRoutes: RegisteredRoute[] = [];
-  server.decorate(REGISTERED_ROUTES_DECORATOR, registeredRoutes);
-  server.addHook("onRoute", (route) => {
-    const methods = Array.isArray(route.method) ? route.method : [route.method];
-    for (const method of methods) {
-      if (method === "HEAD") continue;
-      registeredRoutes.push({ method, url: route.url });
-    }
-  });
-
-  // Register error serializer — maps internal exceptions to generic strings
-  // so connection strings, hostnames, stack traces, and SDK error details
-  // never reach the client. Full detail still goes to pino at error level.
-  registerErrorSerializer(server);
-  server.setNotFoundHandler(notFoundHandler);
-
-  // Register CORS — public read API + the trusted browser origins (#7395).
-  // `origin` is ALWAYS a copy of `config.TRUSTED_ORIGINS`, the frozen list
-  // config/index.ts resolves once at startup from FRONTEND_URL and
-  // AILK_TRUSTED_ORIGINS (no `*`, no wildcard host). @fastify/cors echoes a
-  // request's Origin only on an exact match against that array, and writes no
-  // allow-origin header otherwise; an empty list means no cross-origin caller.
-  // Never pass `true`, a function, a RegExp or a delegator here, and never set
-  // a per-route `cors` option: with `credentials: true`, reflecting any origin
-  // would let any website read credentialed responses (security review M1).
-  // Same-origin and non-browser callers are unaffected.
-  //
-  // `methods` is EXPLICIT because @fastify/cors defaults it to `GET,HEAD,POST`
-  // (its own `defaultOptions`), which is narrower than the surface this server
-  // registers (#5397). With only `origin` + `credentials` passed, the preflight
-  // for `PATCH /v1/project-listings/drafts/:id` answered
-  // `access-control-allow-methods: GET, HEAD, POST`, so a browser refused every
-  // draft save on a split-origin deploy — a site could create a listing draft
-  // and never save one. The list below is the union of the methods the route
-  // table actually serves (GET/POST/PATCH/PUT/DELETE — `/v1/auth/tokens/:id`,
-  // `/v1/content/:type/:slug`, `/v1/user/data/:key`, the workspace-config PUTs),
-  // plus HEAD (Fastify synthesises it from every GET) and OPTIONS (the plugin's
-  // own wildcard preflight route). `cors.test.ts` re-derives that union from the
-  // live route table on every run, so a route added in a NEW method fails there
-  // rather than silently becoming unreachable from a browser.
-  //
-  // This widens WHICH METHODS the allowed origins may use, never WHO is allowed:
-  // `origin` and `credentials` are untouched.
-  //
-  // `allowedHeaders` is deliberately left unset: null means @fastify/cors
-  // reflects the request's `Access-Control-Request-Headers`, so `authorization`
-  // and `content-type` pass without this file having to maintain a list that
-  // silently drops a header a future route needs.
-  await server.register(cors, {
-    origin: [...config.TRUSTED_ORIGINS],
-    credentials: true,
-    methods: ["GET", "HEAD", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-  });
-
-  // Register rate limiting — applied globally with the unauth ceiling. The
-  // limiter is in-memory by default, which suits a single Vercel function /
-  // single-process dev server; multi-instance deployments will need a
-  // Redis store, swappable here without changing route code.
-  //
-  // `keyGenerator` (#7394 DD-7): a keyed spoke's lead write counts against its
-  // visitor's own ceiling here too, or a spoke whose visitors share one
-  // egress IP would still be capped at this limit in total. For every other
-  // request it returns `req.ip`, the plugin's own default key.
-  //
-  // #8805: a sign-up evidence read with a verified site key is keyed
-  // `site,<spokeId>` and let through here — its scope's per-key ceiling is
-  // its one limit, so an anonymous caller spoofing the web's egress address
-  // cannot spend it, and many web instances behind that address share no
-  // IP bucket.
-  await server.register(rateLimit, {
-    max: CONTENT_RATE_LIMIT_UNAUTH,
-    timeWindow: CONTENT_RATE_LIMIT_WINDOW,
-    keyGenerator: async (req) => {
-      const siteId = await signUpEvidenceSiteKey(req);
-      return siteId === null
-        ? resolveRateLimitIdentity(req, visitorForwardKeyDigests).identity
-        : `${SITE_KEY_IDENTITY_PREFIX}${siteId}`;
-    },
-    allowList: (_req, key) =>
-      typeof key === "string" && key.startsWith(SITE_KEY_IDENTITY_PREFIX),
-  });
-
-  // Health check
-  server.get("/health", async () => ({
-    status: "healthy",
-    timestamp: new Date().toISOString(),
-  }));
-
-  // Root endpoint — introduces this deployment as the SITE it serves, not as
-  // the kit it was built with (#5307). `_site.mdx` is read once per process;
-  // a site without one degrades to a neutral name, never to the kit's.
-  //
-  // `modules` (#7501) is the optional modules whose routes this build
-  // registers, computed once here — before any route registers — so the index
-  // reports what registered rather than re-reading the env per request. The
-  // Admin reads it to hide the surfaces whose module is off.
-  const modules = servedModules();
-  server.get("/", async () => {
-    const identity = resolveApiIdentity();
-    return {
-      name: apiDisplayName(identity),
-      version: API_VERSION,
-      description: apiDescription(identity),
-      modules,
-      // Derived from the routes this process actually registered (#5314),
-      // not a hand-maintained literal. The literal listed 11 endpoints against
-      // 68 registered routes, omitted `/v1/project-listings/public` and
-      // `/v1/billing/usage`, advertised `DELETE /v1/auth/tokens` at a path
-      // that 404s (the route is `/v1/auth/tokens/:id`), and named two billing
-      // routes on builds where the multi-tenant module registers neither.
-      // Same mechanism now covers commerce (D-47, #5364): checkout, the
-      // Stripe webhook, the flow-checkouts read and the two recommender
-      // routes are derived exactly like the billing routes above and
-      // disappear from this list on a build where `commerce` is off, rather
-      // than advertising a route that 404s.
-      //
-      // Read at REQUEST time, so `ready()` has fired and the set is complete
-      // even though this handler is registered before most routes.
-      endpoints: deriveRootEndpoints(registeredRoutes),
-    };
-  });
-
-  // Register authenticated routes — the dual-mode preHandler (#587) runs in
-  // this sub-scope so unauthenticated callers never reach token / user data
-  // handlers. Cookie-first, Bearer-fallback; see middleware/auth.ts.
-  await server.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, {
-      trustedOrigins: config.TRUSTED_ORIGINS,
-    });
-    await authScope.register(tokenRoutes);
-    await authScope.register(userRoutes);
-
-    // The hub signs in its spokes (#7894 D5) — `codes` and `me`. Auth only,
-    // NOT tenant-guarded: a person signing in to a spoke has no tenant here.
-    // Unconditional, like the leads inbox read below: a spoke's sign-in is not
-    // a module. `codes` answers a cookie session only; `me` the hub credential
-    // only (both enforced in the route). The credential's own admission is the
-    // preHandler's hub-credential branch (D6).
-    await authScope.register(hubSignInSessionRoutes);
-
-    // #8765 D5 — the caller's account-level sign-up agreements. Auth only,
-    // NOT tenant-guarded: the agreement is about the `User` row, read and
-    // written in the deployment's own site workspace whatever site asks.
-    // Unconditional — auth and consent are never-gate surfaces — and both
-    // are in `HUB_SESSION_ROUTES`, so a spoke reaches them with its member's
-    // credential (the account layout's interstitial, D7).
-    await authScope.register(consentAccountRoutes);
-
-    // Tenant-context routes (multi-tenant module) — auth only. They
-    // establish/inspect the active workspace, so the tenant guard does not
-    // apply to them; each enforces membership in the service layer.
-    // Module-conditional (S1, #5088): without the multi-tenant module there
-    // is no workspace concept to switch or inspect.
-    if (isModuleEnabled("multi-tenant")) {
-      await authScope.register(
-        await sliceRoutePlugin("workspaceContextRoutes"),
-      );
-      // #8438 D8 — the Admin owner's consents to Working Theory. Auth only,
-      // NOT tenant-guarded (the owner role is checked inside the route), and
-      // deliberately NOT in `HUB_SESSION_ROUTES`: a cookie session only.
-      await authScope.register(await sliceRoutePlugin("consentPlatformRoutes"));
-    }
-
-    // The leads INBOX read (#5678) — auth only, NOT tenant-guarded, for the
-    // same reason as the three reads below: the tenant scope is registered
-    // only when the multi-tenant module is present, and lead capture is a
-    // never-gate surface at EVERY level, so reading a lead back cannot be
-    // gated on a module either. Registered unconditionally — it is the one
-    // route in this scope with no `isModuleEnabled()` gate. Identity is
-    // `request.userId`; the scope is resolved from the caller's own
-    // memberships by `services/leads-inbox.ts` through
-    // `services/owner-workspaces.ts`'s `resolveOwnerWorkspaces`, never from a
-    // request parameter.
-    await authScope.register(leadListRoute);
-
-    // Respondent signup read (#4731) — auth only, NOT tenant-guarded: a
-    // respondent has no workspace membership and the tenant guard is
-    // default-deny. Identity is request.userId; the service re-checks
-    // User.emailVerified before any Lead read. Module-conditional
-    // (signal-collectors, D-48): the waitlist instrument's respondent half.
-    if (isModuleEnabled("signal-collectors")) {
-      await authScope.register(await sliceRoutePlugin("waitlistSignupRoutes"));
-    }
-
-    // Respondent checkouts read (#4984) — the same posture as the signup
-    // read above: auth only, NOT tenant-guarded. Identity is request.userId;
-    // the only join is the lead-promotion link (never an email match).
-    // Module-conditional (commerce, D-47): the `/account` Purchases panel
-    // already degrades to its empty state with no code change when this is
-    // absent (`SKIPPED_STATUSES` covers 404 — spec §4.2).
-    if (isModuleEnabled("commerce")) {
-      await authScope.register(await sliceRoutePlugin("flowCheckoutRoutes"));
-    }
-
-    // The update-your-card banner's read + portal handoff (#6038) — the
-    // same posture as flow-checkouts immediately above: auth only, NOT
-    // tenant-guarded (a subscriber has no workspace membership). Identity is
-    // request.userId; GET is cookie-or-bearer, POST refuses bearer callers
-    // (D3.1). Module-conditional (commerce, D8): the account page's
-    // subscription-status read already degrades to "no banner" with no code
-    // change when this is absent (SKIPPED_STATUSES covers 404 — spec §4.2).
-    if (isModuleEnabled("commerce")) {
-      await authScope.register(await sliceRoutePlugin("subscriptionRoutes"));
-    }
-
-    // The founder's OWN listings read (#5295) — the same posture again: auth
-    // only, NOT tenant-guarded, because a founder is not a workspace member
-    // and the tenant guard is default-deny. Identity is request.userId; the
-    // only join is the owner link (ProjectListing.ownerUserId, stamped by
-    // services/listing-promotion.ts), never an email match. The tenant-scoped
-    // listing routes below keep their owner|admin floor untouched — this route
-    // is additive, not a relaxation of that floor. Registered here rather than
-    // inside the multi-tenant scope so a founder can read their own rows on a
-    // build without the module; the static `/me` path takes router precedence
-    // over the tenant scope's parametric `/v1/project-listings/:id`, exactly as
-    // the already-shipped static `/v1/project-listings/public` does.
-    // Module-conditional (signal-collectors, D-48 / D4): the listing
-    // instrument's founder-read half; not severable from the four anonymous
-    // listing routes below (same static barrel, D4).
-    if (isModuleEnabled("signal-collectors")) {
-      await authScope.register(await sliceRoutePlugin("projectListingMeRoute"));
-    }
-
-    // The member reads (#7877 D11) — auth only, NOT tenant-guarded: a client
-    // holds no membership (and an agent, which reaches only tenant-guarded
-    // routes, is refused 403 by the preHandler). Each handler resolves the
-    // caller through `memberCaller` and the workspace from the calling
-    // spoke's key, never a request value. Registered under the SAME module
-    // predicate as every routes/workspaces/* route, at the exact URLs the
-    // preHandler's `HUB_SESSION_ROUTES` admits a hub credential on.
-    if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
-      await authScope.register(await sliceRoutePlugin("memberPieceRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberMessageRoutes"));
-      // #8169 D9 — the Phase 1 member reads, under the same predicate.
-      await authScope.register(await sliceRoutePlugin("memberPurchaseRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberAppointmentRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberArtifactRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberRequestFormRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberBillingRoutes"));
-      // #8170 D11 — the member writes, under the same predicate.
-      await authScope.register(await sliceRoutePlugin("memberRequestRoutes"));
-      // #8515 D13 — the onboarding pair, under the same predicate.
-      await authScope.register(await sliceRoutePlugin("memberOnboardingRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberArtifactReviewRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberProfileRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberDeletionRequestRoutes"));
-      // #8438 D6 — the member's own consents, under the same predicate.
-      await authScope.register(await sliceRoutePlugin("memberConsentRoutes"));
-    }
-    // #8169 D9 — the two member reads that reach services/scheduling/, which
-    // only the scheduling module delivers: a scaffold with a tenancy module
-    // and no scheduling carries neither file, and one with scheduling and no
-    // tenancy module registers neither.
-    if (
-      isModuleEnabled("scheduling") &&
-      (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant"))
-    ) {
-      await authScope.register(await sliceRoutePlugin("memberMeetingTypeRoutes"));
-      await authScope.register(await sliceRoutePlugin("memberAvailabilityRoutes"));
-      // #8170 D11 — the member booking, under the same predicate.
-      await authScope.register(await sliceRoutePlugin("memberBookingRoutes"));
-    }
-
-    // Tenant-guarded domain routes (multi-tenant module) — the tenant
-    // preHandler (default-deny guard, see middleware/tenant.ts) runs after
-    // auth for every route in this inner scope. No domain handler executes
-    // without request.tenant, and without the multi-tenant module there is
-    // no tenant concept at all — the whole scope is module-conditional
-    // (S1, #5088), so an OSS build that excludes multi-tenant registers
-    // none of it.
-    if (isModuleEnabled("multi-tenant")) {
-      await authScope.register(async (tenantScope) => {
-        await tenantScope.register(await tenantPreHandlerSlicePlugin());
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceSessionRoutes"),
-        );
-        await tenantScope.register(await sliceRoutePlugin("sessionRoutes"));
-        // Org-billing routes (#3701) — org-scoped read + Stripe customer-portal.
-        await tenantScope.register(await sliceRoutePlugin("billingRoutes"));
-        // The workspace Offerings routes (#8926 D1) — the Library → Offerings
-        // tab's read and its selection write, beside the billing routes that
-        // write the Stripe connection they need.
-        await tenantScope.register(await sliceRoutePlugin("workspaceOfferingsRoutes"));
-      });
-    }
-
-    // REVIEW-SURFACE routes — a sibling tenant scope, gated on EITHER module
-    // (#5677). The waitlist operator dashboard and the project-listings
-    // dashboard were registered inside the multi-tenant scope above, which was
-    // too narrow: `signal-collectors` (Pro) is the module that SELLS the
-    // instruments these routes read back — flows, deliverables, project
-    // listings, waitlist experiments — so a Pro customer could collect
-    // submissions and not read them. That was an accident of registration
-    // scope, not a pricing decision (#5677). Widening the gate is the
-    // correction.
-    //
-    // This is a REGISTRATION change, not a tenant-isolation change. The scope
-    // registers `tenantPreHandlerForBuild()`, which on a multi-tenant build is
-    // byte-for-byte the guard these two route plugins already ran behind, and
-    // on a build without the module is the base-build guard with the same
-    // default-deny posture over the seeded default Workspace. Each plugin
-    // registers exactly once — they live here and nowhere else, so the scopes
-    // cannot collide on a path — and every OTHER route in the scope above
-    // (workspaceSessionRoutes, sessionRoutes, billingRoutes) stays
-    // multi-tenant-only: those are Organization/Workspace administration, not
-    // a site's own submissions.
-    if (
-      isModuleEnabled("multi-tenant") ||
-      isModuleEnabled("signal-collectors")
-    ) {
-      await authScope.register(async (tenantScope) => {
-        await tenantScope.register(await tenantPreHandlerForBuild());
-        // Waitlist operator-dashboard read API (#4665 D7, B0) — tenant-scoped
-        // list/comparison/signups reads over A1's waitlist-experiment rows.
-        await tenantScope.register(
-          await sliceRoutePlugin("waitlistExperimentRoutes"),
-        );
-        // Project-listings dashboard (#4998) — tenant-scoped list/get/patch
-        // over the founder's-application-row lifecycle.
-        const { projectListingTenantRoutes } =
-          await import("./routes/project-listings/index.js");
-        await tenantScope.register(projectListingTenantRoutes);
-      });
-    }
-
-    // The magnet Admin authoring surface (#6157 S5c) — its OWN sibling
-    // tenant scope (D3), not a line inside the review-surface scope above:
-    // its module-exclusion row stays its own, and the scope can be read,
-    // moved or gated without disturbing `waitlistExperimentRoutes` /
-    // `projectListingTenantRoutes`. Gated `multi-tenant || signal-collectors`
-    // (D4), VERBATIM the review-surface expression above — not narrowed to
-    // `(multi-tenant || signal-collectors) && <tenancy module>`, which would
-    // put the magnet surface out of reach of `marketing-site` (the Pro
-    // flagship template, which takes `signal-collectors` WITHOUT
-    // `multi-tenant`). The delivery is brought up to the gate instead
-    // (`packages/create-ailk/src/module-architecture.ts` D14/D15/D16), the
-    // same correction #5677 already made once for this exact scope.
-    if (
-      isModuleEnabled("multi-tenant") ||
-      isModuleEnabled("signal-collectors")
-    ) {
-      await authScope.register(async (tenantScope) => {
-        await tenantScope.register(await tenantPreHandlerForBuild());
-        await tenantScope.register(await sliceRoutePlugin("magnetRoutes"));
-      });
-    }
-
-    // The appointments read (#6085, brief H7) — a sibling tenant scope,
-    // gated on `scheduling` alone (§ D6). NOT the anonymous schedule scope
-    // below (`isModuleEnabled("scheduling")`'s OTHER site, § 1.9/§ D6): a
-    // prospect booking a call has no account, so that scope carries no
-    // auth preHandler, and mounting this read there would publish every
-    // attendee's name and email to the internet. `tenantPreHandlerForBuild()`
-    // is the SAME default-deny guard the review-surface scope above uses —
-    // on a build with no `multi-tenant` module it fails closed unless
-    // `AILK_OPERATOR_EMAIL` is pinned (`middleware/default-tenant.ts`).
-    //
-    // The meetings config route (#6183 S9b) shares this exact scope and
-    // gate, for the same reason: its GET reaches
-    // apps/api/src/services/scheduling/ (D24's listEventTypes join), which
-    // is undeliverable to a scaffold without this module — see
-    // routes/workspaces/meetings.ts's own header.
-    if (isModuleEnabled("scheduling")) {
-      await authScope.register(async (tenantScope) => {
-        await tenantScope.register(await tenantPreHandlerForBuild());
-        await tenantScope.register(await sliceRoutePlugin("listAppointmentsRoute"));
-        await tenantScope.register(await sliceRoutePlugin("workspaceMeetingsRoutes"));
-      });
-    }
-
-    // Workspace SETTINGS routes — a sibling tenant scope, gated on EITHER
-    // module (#5371 D2). The site-config routes were registered inside the
-    // multi-tenant scope above, which was too narrow: nothing in their logic
-    // is multi-tenant-specific, and since Phase 2 `resolveActiveTenant`
-    // resolves a single-tenant session's TenantContext from the default
-    // Organization/Workspace exactly like a multi-tenant one. Widening the
-    // gate is the correction; duplicating the route file would encode the
-    // original mis-scoping twice.
-    //
-    // This is a REGISTRATION change, not a tenant-isolation change: the scope
-    // registers its own `tenantPreHandlerForBuild()`, the same default-deny
-    // guard the scopes above use. The remaining routes in the multi-tenant
-    // scope above (workspaceSessionRoutes, sessionRoutes, billingRoutes) stay
-    // multi-tenant-only.
-    //
-    // #5677's selector fixes ONE of this scope's two stripped-scaffold
-    // problems and not the other, so do not read it as making a
-    // `--modules workspace` scaffold work. It removes the guard's dependency
-    // on `./middleware/tenant.js` (a multi-tenant slice file, which threw
-    // ERR_MODULE_NOT_FOUND during construction). The three route plugins
-    // below are still reached through slice loads, and
-    // `routes/workspaces/config.ts` remains a multi-tenant `ownedFiles` entry
-    // — `general.ts` and `members.ts` are workspace-owned, `config.ts` is not
-    // — so that scaffold still has no `routes/workspaces/` directory and
-    // still throws here. Fixing it is the same one-line class of change #5677
-    // made for the review surface: co-own `config.ts` under `workspace` in
-    // MODULE_SLICES. Out of scope for #5677, which owns the review surface.
-    //
-    // A build with BOTH modules enabled registers each of the three route
-    // plugins exactly once: they live here and nowhere else, so the two
-    // scopes cannot collide on a path.
-    if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
-      await authScope.register(async (tenantScope) => {
-        await tenantScope.register(await tenantPreHandlerForBuild());
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceConfigRoutes"),
-        );
-        // The Pro workspace module's own two routes (#5371): the workspace
-        // name, and the read-only member roster.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceGeneralRoutes"),
-        );
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceMembersRoutes"),
-        );
-        // The Inbox message API (#6216 S7e) — the SAME scope, the SAME
-        // default-deny guard: list, item read, and the handled stamp.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceMessageRoutes"),
-        );
-        // The Inbox submissions and subscribers reads (#7535) — the SAME
-        // scope and guard: every flow completion and waitlist signup (list,
-        // item read, handled stamp), and the read-only newsletter signups.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceSubmissionRoutes"),
-        );
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceSubscriberRoutes"),
-        );
-        // The Inbox orders read (#9170) — the SAME scope and guard: the
-        // workspace's purchases (list, item read), behind `inbox-read`.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceOrderRoutes"),
-        );
-        // The People reads (#852 D8) — the SAME scope and guard: the
-        // workspace's clients and one Person with its derived timeline,
-        // behind `people-read` (owner, admin, a granted agent).
-        await tenantScope.register(
-          await sliceRoutePlugin("workspacePeopleRoutes"),
-        );
-        // The member area's operator routes (#7877 D9) — the SAME scope and
-        // guard: a client's pieces, plan and outbound messages, and the
-        // workspace's declared piece stages. Writes need `people-write`
-        // (owner, admin; never an agent).
-        await tenantScope.register(
-          await sliceRoutePlugin("workspacePieceRoutes"),
-        );
-        // #8171 D8 — the Requests read: the inbound member rows, behind
-        // `inbox-read`; the content only to a role holding `people-read`.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceRequestRoutes"),
-        );
-        await tenantScope.register(
-          await sliceRoutePlugin("workspacePlanRoutes"),
-        );
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceOutboundMessageRoutes"),
-        );
-        // The agent seat (#3591 PR-B) — the SAME scope and guard: owners and
-        // admins list, add, re-key and switch off agents (`agents-manage`),
-        // and an agent reads its own context at GET /v1/agent/context.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceAgentRoutes"),
-        );
-        // The asset store's MANAGE routes — list, PATCH, DELETE (#6093 D16).
-        // Registered HERE, in the plain tenant scope, and NOT inside the
-        // upload's own nested strict-rate-limit scope below: a JSON
-        // list/patch/delete has no 20 MB body to bound, and inheriting that
-        // per-IP ceiling would throttle the Admin's own list against its
-        // siblings.
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceAssetManageRoutes"),
-        );
-        // The workspace asset store's upload half (#5854). It belongs in THIS
-        // scope and not beside the public routes below, because the two
-        // refusals its AC names — no granted tenant, and a `:workspaceId` that
-        // is not the session's — are `tenantPreHandlerForBuild()`'s to make,
-        // before any handler runs and so before any write. Its raw-body parser
-        // and its `onRequest` size/type hook are declared INSIDE that plugin,
-        // so they encapsulate to it and reach neither the public read below nor
-        // any sibling here.
-        //
-        // Its own rate-limit scope, at the strict per-IP ceiling the leads and
-        // scheduling scopes use (#5854 security review round 1, MEDIUM). Auth
-        // and tenant are `preHandler`s, so an UNAUTHENTICATED caller still
-        // reaches the parser and can make the server buffer up to 20 MB before
-        // the 401. `rateLimitMiddleware` is an `onRequest` hook, so scoping it
-        // here is what bounds how often that can be done — the cap bounds one
-        // body, this bounds the rate. Nested so the ceiling applies to the
-        // upload alone and not to the config/general/members siblings above.
-        await tenantScope.register(async (assetUploadScope) => {
-          assetUploadScope.register(rateLimitMiddleware, {
-            perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-          });
-          await assetUploadScope.register(
-            await sliceRoutePlugin("workspaceAssetUploadRoute"),
-          );
-        });
-      });
-    }
-
-    // The editor's tenant-guarded content-write surface (#5853, roadmap D4).
-    // Its OWN sibling scope (D9) — not nested inside the workspace/multi-tenant
-    // scope above, so its module-exclusion row stays its own. The gate is
-    // `content-write` AND a tenancy module: the route file imports
-    // `lib/tenant-db.ts`, which only the `workspace` / `multi-tenant` slices
-    // deliver, so a scaffold enabling `content-write` without either would
-    // throw ERR_MODULE_NOT_FOUND at build() — the exact defect
-    // `tools/lint-slice-registration.ts` (required in CI) refuses. D9's
-    // "content-write alone" premise was falsified by that lint on PR #5921;
-    // the path itself is workspace-scoped (`/v1/workspaces/:workspaceId/…`),
-    // so requiring a tenancy module is coherent, not a narrowing.
-    // `tenantPreHandlerForBuild()` still selects the base-build
-    // default-workspace guard on a `workspace`-only build. The plugin is
-    // registered here and nowhere else, so no scope can collide on a path.
-    //
-    // The module flags are read ONCE, here, at build time (D10): on a build
-    // that excludes them the routes are never registered and Fastify's own 404
-    // answers — no auth, no tenant resolution, no handler-level
-    // `isModuleEnabled`.
-    if (
-      isModuleEnabled("content-write") &&
-      (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant"))
-    ) {
-      await authScope.register(async (tenantScope) => {
-        // D12: the authenticated ceiling (600/min), scope-local. The global
-        // limiter above is the unauth 60/min, which an autosaving editor would
-        // trip against its own user.
-        await tenantScope.register(rateLimit, {
-          max: CONTENT_RATE_LIMIT_AUTH,
-          timeWindow: CONTENT_RATE_LIMIT_WINDOW,
-        });
-        await tenantScope.register(await tenantPreHandlerForBuild());
-        await tenantScope.register(
-          await sliceRoutePlugin("workspaceContentRoutes"),
-        );
-      });
-    }
-  });
-
-  // Public routes — no auth required.
-  //
-  // The workspace asset store's READ half (#5854), under the SAME predicate as
-  // its upload above rather than unconditionally: with no upload path in the
-  // build it would be a permanent 404 advertised on both self-description
-  // surfaces. It cannot join the block above — that block is nested in
-  // `authScope`, and an `<img src>` carries no session.
-  if (isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")) {
-    await server.register(await sliceRoutePlugin("publicAssetReadRoute"));
-  }
-  await server.register(listTypesRoute);
-  // Before `listPagesRoute`: `search`, `offerings`, `pricing` and
-  // `shown-offerings` must never be read as a `:type`.
-  await server.register(searchContentRoute);
-  // The Organization's Stripe catalog source (#8922), so a stale snapshot
-  // refreshes on the service's bounded, never-forced path (#8924 D7, #9124;
-  // the bounds are `refreshWorkspaceSnapshot`'s). The two agent twins read
-  // the shown set through the same read with these same options, so all
-  // three refresh together (#8933 D5).
-  const shownSetRouteOptions: ShownOfferingsRouteOptions = {
-    sourceFor: stripeCatalogSourceFor,
-  };
-  await server.register(offeringsRoute, shownSetRouteOptions);
-  await server.register(pricingRoute, shownSetRouteOptions);
-  await server.register(shownOfferingsRoute, shownSetRouteOptions);
-  await server.register(listPagesRoute);
-  await server.register(getPageRoute);
-  // The hub's sign-in page names the spoke that sent a visitor (#8790 D2):
-  // a public read of one client's name + origin from the registry. No auth —
-  // the visitor is signed out by definition when the page asks.
-  await server.register(hubSignInPublicRoutes);
-  // Checkout launcher + reader — commerce PRIMITIVES (D-64, #5796; the GET
-  // added by #6084). Registered UNCONDITIONALLY and gated at CALL time on
-  // the JWT `commerce` claim, the same posture content-write has
-  // (requirePaidTier above), so adding commerce to a live site is a licence
-  // change and lands no files on its repo. Without the claim the gate
-  // answers the module-disabled 404 — byte-identical to the build that
-  // never registered the route. `checkoutRoutes` (`routes/checkout/index.ts`)
-  // registers BOTH `POST /v1/checkout/sessions` and
-  // `GET /v1/checkout/sessions/:id` — the GET in its own nested,
-  // rate-limited sub-scope (D16), so this preHandler applies to both while
-  // the GET's own limiter applies to it alone.
-  //
-  // #8450 § 9 SEC-14 — a LIVE process gives both routes their own per-IP
-  // `checkout` bucket on top of the global limiter, because live, the public
-  // GET spends one read of the shared live Stripe account per request. It
-  // lowers the per-IP ceiling per instance (the POST's from the global 20 to
-  // 10; the POST and GET now also share one count); like every limiter here
-  // it is in-memory, so it does not bound the total across serverless
-  // instances. `onRequest`, so it counts before the claim gate. Accepted
-  // residual: a server-side caller — apps/web's server actions, an MCP host's
-  // `purchase` tool — puts all its buyers on its own egress IP, so they share
-  // one bucket; `AILK_RATE_LIMIT_CHECKOUT_PER_MINUTE` raises the ceiling. A
-  // test-mode process registers nothing new.
-  await server.register(async (checkoutScope) => {
-    if (stripeMode === "live") {
-      await checkoutScope.register(rateLimitMiddleware, {
-        scope: "checkout",
-        perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-      });
-    }
-    checkoutScope.addHook("preHandler", requireCommerceClaim);
-    await checkoutScope.register(await sliceRoutePlugin("checkoutRoutes"));
-  });
-  // Request-and-confirm (#5970, D-67 / SUB-100) — the tenant's confirm form
-  // and the Payment Link it mints. A money path, so it sits INSIDE the
-  // commerce claim (DECISION-LOG D-63; D-67 assigns request-and-confirm to
-  // the Commerce rung rather than exempting it), and the gate is applied by
-  // COMPOSITION here — the checkout scope above, line for line. That is what
-  // lets the route files themselves read no licence claim at all (#5970 AC-4).
-  //
-  // Rate-limited at the leads scope's own strict value: the confirm link is
-  // unauthenticated (the token IS the credential), so it belongs on the same
-  // footing as the anonymous surface that mails it. Note the same caveat
-  // `server.ts` records elsewhere — `trustProxy` is on, so an IP limiter is
-  // evadable; the bound that actually holds is per ROW, one live credential
-  // per request, spent on use.
-  await server.register(async (requestsScope) => {
-    requestsScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-    });
-    // `requireCommerceClaim` short-circuits with `reply.send`, so a wrapper is
-    // the only place the unclaimed case can be OBSERVED: the preHandler ends
-    // the request before any handler runs, and the gate itself logs only on
-    // `undetermined` (`lib/require-commerce-claim.ts`).
-    //
-    // Spec D3 names this line as one of two bounds on the residual it
-    // discloses — a site configured for request-and-confirm but carrying no
-    // `commerce` claim emails a tenant a confirm link that answers 404. The
-    // spec puts the log in the route, where it cannot be emitted; this is the
-    // registration, which is where it can (#5970 acceptance review, advisory
-    // 4). Without it the misconfiguration is visible only in the tenant's
-    // inbox, which is the one place the operator is not looking.
-    requestsScope.addHook("preHandler", async (request, reply) => {
-      await requireCommerceClaim(request, reply);
-      if (reply.sent) {
-        request.log.warn(
-          { outcome: "confirm_link_unclaimed", path: request.routeOptions.url },
-          "request-confirm: a confirm link was opened on a site without the commerce claim",
-        );
-      }
-    });
-    await requestsScope.register(requestRoutes);
-  });
-  // Deliverable download — a capability-token URL (#3961 D5); the token
-  // itself is the sole gate, so no auth preHandler applies. Module-conditional
-  // (signal-collectors, D-48): gated PDFs and reports.
-  if (isModuleEnabled("signal-collectors")) {
-    await server.register(await sliceRoutePlugin("deliverableDownloadRoute"));
-    // #8848 D5 — the ungated file read, anonymous and keyed by slug, so it
-    // gets its OWN encapsulated scope: `rateLimitMiddleware` breaks
-    // encapsulation, so it is never installed on the grant route's
-    // registration above, whose budget stays as it is. With the hub's
-    // forward-key digests (the route is on FORWARDED_VISITOR_ROUTES), a
-    // site's proxied reads are counted per visitor (SEC-8848-C).
-    await server.register(async (deliverableOpenScope) => {
-      deliverableOpenScope.register(rateLimitMiddleware, {
-        perIpPerMinute: 60,
-        scope: "deliverableopen",
-        trustedKeyDigests: visitorForwardKeyDigests,
-      });
-      await deliverableOpenScope.register(await sliceRoutePlugin("deliverableOpenRoute"));
-    });
-  }
-
-  // Webhooks routes — raw-body parser scoped to this sub-router only so the
-  // global JSON parser on all other routes is unaffected.
-  await server.register(async (webhooksScope) => {
-    webhooksScope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    // Slack's block_actions payload arrives as a urlencoded `payload` form
-    // field (#4999) — raw buffer here too, so the signature is verified over
-    // the EXACT bytes Slack signed, never a re-serialized parse.
-    webhooksScope.addContentTypeParser(
-      "application/x-www-form-urlencoded",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    // Stripe webhook receiver + customer mapping — commerce PRIMITIVES
-    // (D-64, #5796), registered UNCONDITIONALLY alongside checkout above.
-    // NO `requireCommerceClaim` preHandler here, deliberately: D3 puts
-    // signature verification BEFORE the claim check, so the handler itself
-    // consults `hasCommerceClaim()` once the signature is settled — a signed
-    // event on an unclaimed site is acked 200 and dropped rather than
-    // retried forever, while an unsigned body gets the module-disabled 404.
-    // See routes/webhooks/README.md § Commerce claim.
-    await webhooksScope.register(await sliceRoutePlugin("webhooksRoutes"));
-    // Project-listing operator decision (Slack Approve/Reject) — the "hand an
-    // operator a decision" half of D-48's grouping sentence. Module-conditional
-    // (signal-collectors).
-    if (isModuleEnabled("signal-collectors")) {
-      await webhooksScope.register(await sliceRoutePlugin("slackActionsRoute"));
-    }
-  });
-
-  // Auth transactional-email relay (#5962 § D3) — its OWN scope, deliberately
-  // OUTSIDE `authScope`: the caller is `apps/web`'s Better Auth callbacks
-  // acting for an anonymous visitor who is by definition not signed in, so an
-  // auth preHandler in front of it would reject every legitimate call. The
-  // gate is the HMAC signature over the raw body plus the 300 s replay window,
-  // both verified inside the handler.
-  //
-  // Raw-body parser scoped to this sub-router only, for the same reason
-  // `webhooksScope` carries one: the signature must be checked over the EXACT
-  // bytes the caller signed, never a re-serialized parse.
-  //
-  // `DEFAULT_PER_IP_PER_MINUTE_STRICT` (10/min) — the constant `leadsScope`
-  // below already uses for its anonymous surface. It is defence in depth, not
-  // the control: an unsigned body never reaches a send, and per-victim volume
-  // is bounded by `lib/auth-email-budget.ts`.
-  await server.register(async (authEmailScope) => {
-    authEmailScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-    });
-    authEmailScope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    await authEmailScope.register(transactionalEmailRoute);
-  });
-
-  // The hub signs in its spokes (#7894 D5) — `token` and `revoke`. Their OWN
-  // scope, deliberately OUTSIDE `authScope`: the caller is a spoke's server,
-  // authenticated by its client secret AND its spoke key inside the service,
-  // not by a person's session — an auth preHandler in front would reject every
-  // legitimate call. `scope: "hubsignin"` namespaces the buckets (the scope
-  // name admits no hyphen). The per-IP limit keys on `req.ip` under
-  // `trustProxy`, so it is a backstop only; the control is the per-client
-  // bucket the service keys on the VERIFIED client (SEC-7894-8).
-  await server.register(async (hubSignInScope) => {
-    hubSignInScope.register(rateLimitMiddleware, {
-      perIpPerMinute: 60,
-      scope: "hubsignin",
-    });
-    await hubSignInScope.register(hubSignInClientRoutes);
-  });
-
-  // Lead-capture status (#6730 D4) — a cheap read the web page makes before
-  // choosing the form or the contact email. Top level, NOT in `leadsScope`:
-  // the web server's single egress IP already spends that scope's strict
-  // 10/min on form submissions. The global unauth ceiling above applies.
-  await server.register(leadCaptureStatusRoute);
-
-  // The consent floor (#8438 D5, D9) — the cookie banner's log and the
-  // unsubscribe landing. Top level, outside every module gate: consent
-  // logging is part of the never-gated privacy floor. Each is in its OWN
-  // rate-limited scope (`consent`, `unsubscribe`) so filling one never blocks
-  // the other; with a forward key set, a spoke's visitors are counted one by
-  // one (both routes are on FORWARDED_VISITOR_ROUTES). Without one, the
-  // server's own IP is the bucket — the posture of the lead routes. Neither
-  // is behind `authScope`: the caller is a visitor, or a person in their mail.
-  await server.register(async (consentScope) => {
-    consentScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-      scope: "consent",
-      trustedKeyDigests: visitorForwardKeyDigests,
-    });
-    await consentScope.register(consentCookieRoute);
-  });
-  await server.register(async (unsubscribeScope) => {
-    unsubscribeScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-      scope: "unsubscribe",
-      trustedKeyDigests: visitorForwardKeyDigests,
-    });
-    await unsubscribeScope.register(consentUnsubscribeRoute);
-  });
-  // #8765 D2 — the sign-up agreements' evidence, beside the consent floor:
-  // anonymous, outside every module gate (sign-up and consent are never-gate
-  // surfaces). Its own scope, `signupevidence`, so an anonymous burst never
-  // shares a bucket with the cookie banner's log (SEC-8765-D). Its main
-  // caller is the web's own server, whose cache keeps it to one call a minute
-  // per enabled locale per instance. #8805: a call with a verified site key
-  // is counted per key (DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
-  // AILK_RATE_LIMIT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE), never per IP; any
-  // other call keeps 10 a minute per IP.
-  await server.register(async (signUpEvidenceScope) => {
-    signUpEvidenceScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-      perKeyPerMinute: DEFAULT_SIGNUPEVIDENCE_PER_KEY_PER_MINUTE,
-      scope: "signupevidence",
-      siteKeyOf: signUpEvidenceSiteKey,
-    });
-    await signUpEvidenceScope.register(consentSignUpRoute);
-  });
-
-  // Leads routes — rate-limit middleware scoped to this sub-router. Own
-  // default (10/min, pre-#4730) rather than inheriting the wider
-  // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was
-  // never meant to loosen abuse protection here).
-  //
-  // `scope: "leads"` (#7394): this scope's buckets are its own, not shared
-  // with the other scopes' bare-IP count, and AILK_RATE_LIMIT_LEADS_PER_MINUTE
-  // (and ..._PER_KEY_PER_MINUTE, default 300) override the code values. With
-  // `trustedKeyDigests`, a keyed spoke's three lead writes are counted per
-  // forwarded visitor; the project-listing routes below still key on `req.ip`.
-  await server.register(async (leadsScope) => {
-    leadsScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-      scope: "leads",
-      trustedKeyDigests: visitorForwardKeyDigests,
-    });
-    await leadsScope.register(leadSubmitRoute);
-    await leadsScope.register(leadSubscribeRoute);
-    await leadsScope.register(leadCallbackRoute);
-    // Project-listings anonymous surface (#4998, reshaped by #5036) — the
-    // three-operation draft lifecycle plus the public page-render read, all
-    // on the same rate-limited, identity-blind posture as the leads routes
-    // above. Module-conditional (signal-collectors, D-48): the listing
-    // instrument's application-lifecycle half.
-    //
-    // Do NOT read that rate limit as a bound on anonymous draft creation. It
-    // keys on `req.ip`, and `trustProxy` is on (see the note at the top of this
-    // file), so a caller reaching the API directly can vary
-    // `X-Forwarded-For` and get a fresh budget per request. That is a
-    // pre-existing property of the limiter, not of these routes; what these
-    // routes do is keep the cost of an unbounded call small — the Lead write
-    // with its operator notification waits for `submit` (PR #5042 security
-    // review, finding 4).
-    //
-    // `start` DOES now send one email (#5406, the founder's resume link), so
-    // the older form of this note — "`start` writes one row and sends
-    // nothing" — no longer holds. That send is opt-in per site, and where it
-    // is on it is bounded in the send path rather than per IP
-    // (`services/project-listing-resume-email.ts`), precisely because this IP
-    // limiter cannot carry the weight of an outbound-mail decision. Two bounds,
-    // both counted in the database so they hold across instances: PER RECIPIENT
-    // (PR #5411 security review, finding 1) and, since #5414, PER SITE across
-    // every recipient — the residual the first one left, and the one that
-    // decides whether a flood can cost the site its sending domain.
-    if (isModuleEnabled("signal-collectors")) {
-      await leadsScope.register(
-        await sliceRoutePlugin("projectListingStartRoute"),
-      );
-      await leadsScope.register(
-        await sliceRoutePlugin("projectListingDraftPatchRoute"),
-      );
-      await leadsScope.register(
-        await sliceRoutePlugin("projectListingSubmitRoute"),
-      );
-      // #5407 — the resume link's verification write. Anonymous, and gated
-      // on the resume token AND the nonce that only the resume email
-      // carries, so it belongs in the same rate-limited scope as the other
-      // three.
-      await leadsScope.register(
-        await sliceRoutePlugin("projectListingVerifyEmailRoute"),
-      );
-      await leadsScope.register(
-        await sliceRoutePlugin("projectListingPublicRoute"),
-      );
-    }
-  });
-
-  // The listicle directory read (#7521 D3) — anonymous, keyed by the public
-  // site key, and rendered by the web server on every page view of a landing
-  // page. Its OWN scope, NOT `leadsScope`: that scope's 10/min per IP would be
-  // spent by the web server's SSR reads from one egress address, and the
-  // directory would vanish past ~10 views a minute (SEC-7521-D1). 120/min,
-  // overridable by AILK_RATE_LIMIT_DIRECTORY_PER_MINUTE (#7394's named-scope
-  // rule); the web side memoises each landing page for 30 s per process.
-  // Module-conditional (signal-collectors, D-48), so a build without the
-  // module has no `/directory` and the web extension's read gets a 404.
-  await server.register(async (directoryScope) => {
-    directoryScope.register(rateLimitMiddleware, {
-      perIpPerMinute: 120,
-      scope: "directory",
-    });
-    if (isModuleEnabled("signal-collectors")) {
-      await directoryScope.register(
-        await sliceRoutePlugin("projectListingDirectoryRoute"),
-      );
-    }
-  });
-
-  // Flows routes — anonymous surface; rate-limit middleware scoped to this
-  // sub-router, matching the leads scope above (#3956 D4 Clarifications:
-  // "follows whatever the existing anonymous /v1/leads/* routes do today").
-  // Keeps the wider, env-var-driven default (#4730 — see
-  // apps/api/src/routes/flows/README.md § Rate limit) — this is the ONE
-  // scope #4730's bump was actually sized for; unchanged by #5111.
-  await server.register(async (flowsScope) => {
-    flowsScope.register(rateLimitMiddleware);
-    // Flow engine reads (#3956) — module-conditional (signal-collectors,
-    // D-48). The scope itself and its rate limiter above stay unconditional
-    // (D2) — commerce's recommender routes below need them too.
-    if (isModuleEnabled("signal-collectors")) {
-      await flowsScope.register(await sliceRoutePlugin("getFlowRoute"));
-      await flowsScope.register(await sliceRoutePlugin("submitFlowStepRoute"));
-      await flowsScope.register(
-        await sliceRoutePlugin("getFlowAggregateRoute"),
-      );
-      await flowsScope.register(
-        await sliceRoutePlugin("putFlowDefinitionRoute"),
-      );
-    }
-    // The recommender's email-moment routes (#4841) — same anonymous,
-    // rate-limited posture as the three above. Module-conditional (commerce,
-    // D-47): the recommender leaves Pro flows and moves to commerce whole.
-    if (isModuleEnabled("commerce")) {
-      await flowsScope.register(
-        await sliceRoutePlugin("saveRecommendationRoute"),
-      );
-      await flowsScope.register(
-        await sliceRoutePlugin("checkoutRecommendationRoute"),
-      );
-    }
-  });
-
-  // AEO score routes (#4666) — anonymous surface, same posture as the flows
-  // scope above: a waitlist respondent has no account. Rate-limited because
-  // each call fans out to the respondent's own site (an external fetch), the
-  // same reason the schedule scope below is rate-limited for a third party.
-  // Own default (10/min, pre-#4730) — see the leads scope's comment above
-  // (#5111, DEF-004).
-  await server.register(async (aeoScope) => {
-    aeoScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-    });
-    await aeoScope.register(scoreAeoRoute);
-    await aeoScope.register(exampleAeoRoute);
-  });
-
-  // Schedule routes (#4416) — anonymous surface, same posture as the flows
-  // and leads scopes above: a prospect booking a call has no account, and the
-  // calLink in the request names the event, so there is no tenant scope to
-  // bind. Rate-limited because each call fans out to a third-party provider.
-  // Own default (10/min, pre-#4730) — see the leads scope's comment above
-  // (#5111, DEF-004). Module-conditional (S1, #5088): the scheduling module
-  // owns this whole route set, so an OSS build that excludes it registers
-  // neither the routes nor their imports.
-  //
-  // `scope: "schedule"` with `trustedKeyDigests` (#7633, the relay's security
-  // review): a site's same-origin relay sends every visitor's availability
-  // and booking call from its own server, so with the forwarding key each
-  // visitor is counted separately, and the key as a whole is capped at
-  // DEFAULT_SCHEDULE_PER_KEY_PER_MINUTE. The scope's buckets are its own,
-  // and AILK_RATE_LIMIT_SCHEDULE_PER_MINUTE / ..._PER_KEY_PER_MINUTE override
-  // the code values, as the leads scope's do.
-  if (isModuleEnabled("scheduling")) {
-    await server.register(async (scheduleScope) => {
-      scheduleScope.register(rateLimitMiddleware, {
-        perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-        scope: "schedule",
-        trustedKeyDigests: visitorForwardKeyDigests,
-        perKeyPerMinute: DEFAULT_SCHEDULE_PER_KEY_PER_MINUTE,
-      });
-      await scheduleScope.register(
-        await sliceRoutePlugin("listAvailabilityRoute"),
-      );
-      await scheduleScope.register(await sliceRoutePlugin("getEventMetaRoute"));
-      await scheduleScope.register(
-        await sliceRoutePlugin("createBookingRoute"),
-      );
-      // #6183 S9b D2/D12 — the enabled-meeting-slugs public read. Same scope
-      // as the three routes above: it inherits the module gate and the
-      // strict per-IP rate limit (§9 SEC-4).
-      await scheduleScope.register(
-        await sliceRoutePlugin("meetingTypesRoute"),
-      );
-      // #8843 D1 — the meetings read: the same gate and per-IP limit.
-      await scheduleScope.register(
-        await sliceRoutePlugin("listMeetingsRoute"),
-      );
-    });
-  }
-
-  // Test-auth route — triple-gated (NODE_ENV !== production AND
-  // AILK_TEST_AUTH_ENABLED === 'true' AND AILK_TEST_AUTH_USER_ALLOWLIST
-  // non-empty). When any gate fails, the route is never registered and
-  // Fastify returns its default 404 — the surface NEVER advertises itself
-  // in production. See #517 / docs/internal/roadmaps/e2e-testing-roadmap.md.
-  if (shouldMountTestAuth()) {
-    await server.register(registerTestAuthRoute);
-    server.log.warn(
-      "test-auth route MOUNTED — only safe in dev/test environments",
-    );
-  }
-
-  await server.register(openapiRoutes);
-
-  return server;
+  const hub = await loadInstalledHub();
+  // One line at boot, never a key (#9571 D5); `artifact-boots:check` asserts
+  // the traced artifact reads `installed`.
+  logger.info({ hub: hub ? "installed" : "absent" }, "[boot] hub package");
+  if (hub === undefined) return buildServer({ modules, topology: "hub", config });
+  return buildServer({ modules, topology: "hub", config, hub });
 }