create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -1,2660 +0,0 @@
-/**
- * @file lead-routing.test.ts
- * @description Unit tests for the lead-routing service (ADR 0009 D3 service-layer pattern).
- *
- * External dependency boundaries mocked:
- *   - @working-theory/database (via moduleNameMapper → prisma-client.js mock; prisma singleton via __mocks__/prisma.ts)
- *   - @working-theory/email sendLeadNotification
- *
- * Internal modules run real:
- *   - apps/api/src/services/enrichment-shim — real; @working-theory/license catches + returns lead unchanged
- *   - apps/api/src/lib/file-fallback — real; uses AILK_INBOX_FALLBACK_DIR temp dir set per test
- *   - apps/api/src/lib/prisma — uses __mocks__/prisma.ts (manual mock via jest.mock without factory)
- */
-
-import type { RouteLeadResult } from "../lead-routing";
-
-// ─── Mock: Prisma ─────────────────────────────────────────────────────────────
-// lib/prisma.ts is a thin wrapper that instantiates PrismaClient (external DB
-// boundary). The manual mock at src/lib/__mocks__/prisma.ts provides a full
-// in-memory stub — this call auto-resolves to that file.
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-// ─── Mock: email (external boundary) ─────────────────────────────────────────
-const mockSendLeadNotification = jest.fn();
-const mockSendPurchaseConfirmationEmail = jest.fn();
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: (...args: unknown[]) =>
-    mockSendLeadNotification(...args),
-  sendPurchaseConfirmationEmail: (...args: unknown[]) =>
-    mockSendPurchaseConfirmationEmail(...args),
-}));
-
-// ─── Mock: the plan-offerings lister (a content read) ────────────────────────
-const mockListPlanOfferings = jest.fn();
-// eslint-disable-next-line no-restricted-syntax -- plan-offerings.ts is the workspace's content-adapter read (the database adapter, an external boundary), the same seam routes/leads/__tests__/magnet-completion.test.ts mocks.
-jest.mock("../plan-offerings.js", () => ({
-  listPlanOfferings: (...args: unknown[]) => mockListPlanOfferings(...args),
-}));
-
-// ─── Import after mocks ───────────────────────────────────────────────────────
-import * as fs from "fs/promises";
-import * as os from "os";
-import * as path from "path";
-
-import { logger } from "@working-theory/observability";
-import {
-  ACCOUNT_TERMS_PURPOSE_ID,
-  CONSENT_LEAD_SOURCE_LIST,
-  consentPurposeById,
-  SITE_CONSENT_CONFIG_DEFAULTS,
-} from "@working-theory/validation";
-
-import { MOCK_PERSON_ID } from "../../lib/__mocks__/prisma.js";
-import {
-  armConsentLedger,
-  type ConsentLedgerDouble,
-} from "../../lib/__tests__/consent-ledger-double.js";
-import { prisma } from "../../lib/prisma.js";
-import { routeLead } from "../lead-routing";
-import * as consentService from "../consent";
-import * as personService from "../person";
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-const sourceMeta = {
-  ip: "127.0.0.1",
-  userAgent: "jest",
-  receivedAt: new Date().toISOString(),
-};
-
-const leadInput = {
-  kind: "submit" as const,
-  siteId: "site-abc",
-  source: "contact",
-  email: "test@example.com",
-  payload: { message: "hello" },
-};
-
-const subscribeInput = {
-  kind: "subscribe" as const,
-  siteId: "site-abc",
-  email: "subscriber@example.com",
-  source: "footer",
-};
-
-const callbackInput = {
-  kind: "callback" as const,
-  siteId: "site-abc",
-  name: "Alice",
-  phone: "+15551234567",
-  payload: { notes: "urgent" },
-};
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-describe("routeLead", () => {
-  let tmpDir: string;
-
-  beforeAll(async () => {
-    // Real file-fallback module uses AILK_INBOX_FALLBACK_DIR for writes.
-    // Point it at a temp dir so tests remain hermetic.
-    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-lead-test-"));
-    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-  });
-
-  afterAll(async () => {
-    delete process.env.AILK_INBOX_FALLBACK_DIR;
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  });
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    // Default: DB up, email up
-    (prisma.lead.create as jest.Mock).mockResolvedValue({
-      id: "lead_00000000-0000-7000-8000-0000000000c1",
-      siteId: "site-abc",
-      source: "contact",
-      email: "test@example.com",
-      payload: {},
-      createdAt: new Date(),
-    });
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: "subscr_00000000-0000-7000-8000-0000000000c2",
-      siteId: "site-abc",
-      email: "subscriber@example.com",
-      source: "footer",
-      createdAt: new Date(),
-    });
-    (prisma.callback.create as jest.Mock).mockResolvedValue({
-      id: "callbk_00000000-0000-7000-8000-0000000000c3",
-      siteId: "site-abc",
-      name: "Alice",
-      phone: "+15551234567",
-      payload: {},
-      createdAt: new Date(),
-    });
-    mockSendLeadNotification.mockResolvedValue({
-      ok: true,
-      messageId: "msg-123",
-    });
-    // Set required env
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-  });
-
-  afterEach(() => {
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-  });
-
-  // ── 1. Happy path lead — DB up, email up ──────────────────────────────────
-  it("happy path lead — returns ok:true with persisted:db and email:ok", async () => {
-    const result = await routeLead(leadInput, sourceMeta);
-
-    expect(result).toMatchObject({
-      ok: true,
-      id: "lead_00000000-0000-7000-8000-0000000000c1",
-      persisted: "db",
-      email: { ok: true, messageId: "msg-123" },
-    });
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-  });
-
-  // ── 2. DB down → fallback engages → persisted:file ───────────────────────
-  it("DB down → file fallback → persisted:file", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(
-      new Error("connection refused"),
-    );
-
-    const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.persisted).toBe("file");
-    // Verify a file was actually written to the temp dir
-    const files = await fs.readdir(tmpDir);
-    expect(files.length).toBeGreaterThan(0);
-  });
-
-  // ── 3. DB down + fallback fails → persist_failed ─────────────────────────
-  it("DB down + fallback fails → ok:false persist_failed", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("db error"));
-    // Point fallback at a nonexistent dir so mkdir fails
-    process.env.AILK_INBOX_FALLBACK_DIR = "/nonexistent-ailk-test-dir/inbox";
-
-    const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: false }
-    >;
-
-    // Restore good temp dir for other tests
-    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("persist_failed");
-  });
-
-  // ── 4. Email down → persist succeeds, email error returned ───────────────
-  it("email failure does NOT roll back DB write — returns ok:true with email error", async () => {
-    mockSendLeadNotification.mockResolvedValue({
-      ok: false,
-      error: { kind: "send_failed", message: "timeout" },
-    });
-
-    const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.persisted).toBe("db");
-    expect(result.email).toMatchObject({
-      ok: false,
-      error: "send_failed: timeout",
-    });
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1); // DB write happened
-  });
-
-  // ── 5. Resend env unset → email skipped ──────────────────────────────────
-  it("AILK_LEAD_NOTIFICATION_TO unset → email skipped with reason env_unset", async () => {
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-
-    const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.email).toMatchObject({ skipped: true, reason: "env_unset" });
-    expect(mockSendLeadNotification).not.toHaveBeenCalled();
-  });
-
-  it("config_missing from Resend → email coerced to skipped:resend_key_unset", async () => {
-    mockSendLeadNotification.mockResolvedValue({
-      ok: false,
-      error: { kind: "config_missing", message: "RESEND_API_KEY not set" },
-    });
-
-    const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.email).toMatchObject({
-      skipped: true,
-      reason: "resend_key_unset",
-    });
-  });
-
-  // ── 6. Subscribe duplicate (P2002) → sentinel id, email skipped:duplicate ─
-  it("subscribe duplicate P2002 → ok:true with email.skipped.reason duplicate", async () => {
-    const p2002 = Object.assign(new Error("Unique constraint"), {
-      code: "P2002",
-    });
-    (prisma.subscriber.create as jest.Mock).mockRejectedValue(p2002);
-    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({
-      id: "existing-sub-id",
-      siteId: "site-abc",
-      email: "subscriber@example.com",
-    });
-
-    const result = (await routeLead(subscribeInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.id).toBe("existing-sub-id");
-    expect(result.persisted).toBe("db");
-    expect(result.email).toMatchObject({ skipped: true, reason: "duplicate" });
-    expect(mockSendLeadNotification).not.toHaveBeenCalled();
-  });
-
-  it("subscribe duplicate P2002 with lookup miss → sentinel id duplicate-no-id", async () => {
-    const p2002 = Object.assign(new Error("Unique constraint"), {
-      code: "P2002",
-    });
-    (prisma.subscriber.create as jest.Mock).mockRejectedValue(p2002);
-    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = (await routeLead(subscribeInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.id).toBe("duplicate-no-id");
-    expect(result.email).toMatchObject({ skipped: true, reason: "duplicate" });
-  });
-
-  // ── 7. Validation failure → invalid_input ────────────────────────────────
-  it("malformed input (missing email) → ok:false invalid_input", async () => {
-    const bad = {
-      kind: "submit" as const,
-      siteId: "site",
-      source: "contact",
-      email: "not-an-email",
-      payload: {},
-    };
-
-    const result = (await routeLead(bad, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: false }
-    >;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("invalid_input");
-  });
-
-  // ── 8. PII non-leak — log spy never sees email/phone/name/payload ─────────
-  it("PII non-leak — log output never contains email, phone, name, or payload values", async () => {
-    const logLines: string[] = [];
-    const infoSpy = jest
-      .spyOn(console, "info")
-      .mockImplementation((...args) => {
-        logLines.push(args.map(String).join(" "));
-      });
-    const warnSpy = jest
-      .spyOn(console, "warn")
-      .mockImplementation((...args) => {
-        logLines.push(args.map(String).join(" "));
-      });
-    const logSpy = jest.spyOn(console, "log").mockImplementation((...args) => {
-      logLines.push(args.map(String).join(" "));
-    });
-
-    await routeLead(leadInput, sourceMeta);
-    await routeLead(callbackInput, sourceMeta);
-
-    const combined = logLines.join("\n");
-
-    // PII values must not appear in any log output
-    expect(combined).not.toContain("test@example.com");
-    expect(combined).not.toContain("+15551234567");
-    expect(combined).not.toContain("Alice");
-    // payload values must not appear
-    expect(combined).not.toContain("hello");
-    expect(combined).not.toContain("urgent");
-
-    infoSpy.mockRestore();
-    warnSpy.mockRestore();
-    logSpy.mockRestore();
-  });
-
-  // ── Callback happy path ───────────────────────────────────────────────────
-  it("callback happy path → persisted:db", async () => {
-    const result = (await routeLead(callbackInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: true }
-    >;
-
-    expect(result.ok).toBe(true);
-    expect(result.id).toBe("callbk_00000000-0000-7000-8000-0000000000c3");
-    expect(result.persisted).toBe("db");
-    expect(prisma.callback.create).toHaveBeenCalledTimes(1);
-  });
-
-  // ── routeLead never throws ────────────────────────────────────────────────
-  it("routeLead never throws even when all dependencies fail", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("db down"));
-    // Point fallback at a bad dir so file write also fails
-    process.env.AILK_INBOX_FALLBACK_DIR = "/nonexistent-ailk-test-dir-2/inbox";
-
-    // Should not throw — returns ok:false instead
-    await expect(routeLead(leadInput, sourceMeta)).resolves.toBeDefined();
-
-    // Restore
-    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-  });
-
-  // ── Regression: HIGH-1 — extra field in input must not be passed through ──
-  // The route handler must NOT spread unknown fields from the request body into
-  // the service call. The service's Zod validation via .strict() must reject
-  // unknown keys; the id field is controlled server-side only.
-  it("regression HIGH-1: input with extra 'id' field is rejected by strict schema validation", async () => {
-    const inputWithExtraId = {
-      kind: "submit" as const,
-      siteId: "site-abc",
-      source: "contact",
-      email: "test@example.com",
-      payload: { message: "hello" },
-      id: "attacker-supplied-id", // extra field — must be rejected by .strict()
-    };
-
-    // .strict() on leadSubmitSchema rejects unknown keys → invalid_input
-    // Omit the extra `id` field from the type so only one cast is needed.
-    const { id: _id, ...inputWithoutId } = inputWithExtraId;
-    const inputForService = {
-      ...inputWithoutId,
-      // Re-attach as a plain unknown property so Zod's strict() can reject it.
-      ...({ id: inputWithExtraId.id } as Record<string, unknown>),
-    } as Parameters<typeof routeLead>[0];
-    const result = (await routeLead(inputForService, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: false }
-    >;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("invalid_input");
-    // The DB must not have been called with an attacker-supplied id
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-  });
-
-  // ── Regression: MEDIUM-4 — CRLF injection in siteId must be rejected ─────
-  // siteId is constrained to /^[a-zA-Z0-9._-]+$/ which excludes \r\n.
-  it("regression MEDIUM-4: CRLF injection in siteId returns invalid_input", async () => {
-    const inputWithCrlf = {
-      kind: "subscribe" as const,
-      siteId: "x\r\nBcc: attacker@x.com", // header injection attempt
-      email: "victim@example.com",
-      source: "footer",
-    };
-
-    const result = (await routeLead(inputWithCrlf, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: false }
-    >;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("invalid_input");
-    expect(prisma.subscriber.create).not.toHaveBeenCalled();
-  });
-
-  // ── #6203/#6254 — the workspaceId stamp is ALWAYS a copy of siteId ────────
-  //
-  // routeLead(kind: "submit") has FOUR callers in this repo, and as of
-  // #6254 ALL FOUR resolve `siteId` to a real `wksp_<uuidv7>` workspace id
-  // before calling in — the three that once passed an unresolved alias
-  // (flow-engine.ts, recommender-capture.ts, project-listings.ts's
-  // submitProjectListingDraft) now resolve it themselves
-  // (`resolveSiteWorkspaceId()` / `resolveWorkspaceIdForAlias()`,
-  // `apps/api/src/lib/site.ts`). `workspaceId` is NOT NULL as of
-  // database/migrations/20260922120000_tenancy_fence, so `persistToDb` can
-  // no longer stamp `null` for an unresolved alias the way #6203 once did —
-  // it copies `siteId` unconditionally, and a caller that still somehow
-  // passed an unresolved alias hits the pre-existing
-  // `leads_workspace_id_format` CHECK loudly (via the AC-11 re-raise this
-  // file's other describe block proves) instead of landing a
-  // silently-unfenced row.
-  describe("the workspaceId stamp copies siteId unconditionally (#6203, #6254)", () => {
-    it("workspaceId is always the SAME value as siteId, whatever shape siteId carries", async () => {
-      await routeLead(leadInput, sourceMeta); // leadInput.siteId === "site-abc"
-
-      expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-      const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
-      expect(data.siteId).toBe("site-abc");
-      expect(data.workspaceId).toBe("site-abc");
-    });
-
-    it("a workspace-shaped siteId (the routes/leads/index.ts path) stamps workspaceId to the SAME value", async () => {
-      const resolvedInput = {
-        ...leadInput,
-        siteId: "wksp_00000000-0000-7000-8000-000000000001",
-      };
-
-      await routeLead(resolvedInput, sourceMeta);
-
-      const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
-      expect(data.siteId).toBe("wksp_00000000-0000-7000-8000-000000000001");
-      expect(data.workspaceId).toBe(
-        "wksp_00000000-0000-7000-8000-000000000001",
-      );
-    });
-  });
-
-  // #6254 AC-11 (spec D6, SEC-02) — a constraint violation (the new
-  // `leads_workspace_site_agree` CHECK, or the pre-existing NOT NULL) must
-  // never be swallowed into the file fallback and a silent `ok:true`: it
-  // means OUR OWN derivation produced a row Postgres itself refuses, which
-  // is a bug to surface, not an outage to degrade through. A GENUINE
-  // infrastructure failure (the existing "DB down → file fallback" test
-  // above, a plain `Error("connection refused")` that carries none of the
-  // signals below) must still take the file fallback, unchanged.
-  describe("a constraint violation re-raises as a deliberate error, never a silent success (#6254 AC-11)", () => {
-    const listTmpDirFiles = () => fs.readdir(tmpDir);
-
-    it("a Prisma-mapped class-23 code (e.g. P2011, null constraint) returns ok:false persist_failed WITHOUT engaging the file fallback", async () => {
-      const before = await listTmpDirFiles();
-      const constraintErr = Object.assign(
-        new Error("Null constraint violation on the field: (`workspace_id`)"),
-        { code: "P2011" },
-      );
-      (prisma.lead.create as jest.Mock).mockRejectedValue(constraintErr);
-
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: false }
-      >;
-
-      expect(result.ok).toBe(false);
-      expect(result.error.kind).toBe("persist_failed");
-      // No file was written — the fallback was never attempted.
-      const after = await listTmpDirFiles();
-      expect(after).toEqual(before);
-    });
-
-    it("a raw SQLSTATE the message carries (no Prisma-mapped code — the new CHECK constraint's own shape) returns ok:false persist_failed WITHOUT engaging the file fallback", async () => {
-      const before = await listTmpDirFiles();
-      const checkErr = new Error(
-        'new row for relation "leads" violates check constraint "leads_workspace_site_agree"',
-      );
-      (prisma.lead.create as jest.Mock).mockRejectedValue(checkErr);
-
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: false }
-      >;
-
-      expect(result.ok).toBe(false);
-      expect(result.error.kind).toBe("persist_failed");
-      const after = await listTmpDirFiles();
-      expect(after).toEqual(before);
-    });
-
-    it("a bare SQLSTATE 23502 in the error message also re-raises as persist_failed", async () => {
-      const before = await listTmpDirFiles();
-      const notNullErr = Object.assign(
-        new Error(
-          'null value in column "workspace_id" violates not-null constraint (23502)',
-        ),
-        {},
-      );
-      (prisma.lead.create as jest.Mock).mockRejectedValue(notNullErr);
-
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: false }
-      >;
-
-      expect(result.ok).toBe(false);
-      expect(result.error.kind).toBe("persist_failed");
-      const after = await listTmpDirFiles();
-      expect(after).toEqual(before);
-    });
-
-    it("a genuine outage (no class-23 signal) still takes the file fallback — persisted:file, not persist_failed", async () => {
-      // Regression guard for the branch above: an ordinary connection error
-      // must not be misclassified as a constraint violation.
-      (prisma.lead.create as jest.Mock).mockRejectedValue(
-        new Error("connection refused"),
-      );
-
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: true }
-      >;
-
-      expect(result.ok).toBe(true);
-      expect(result.persisted).toBe("file");
-    });
-  });
-});
-
-// ─── #6257 — the fence: every fenced read carries workspaceId ───────────────
-
-/**
- * Unit C2's contract for this service (#6257 AC-1/AC-2). `routeLead`'s one
- * READ is the duplicate-subscriber lookup on the P2002 arm. `input.siteId` is
- * the resolved workspace id at every caller (the same guarantee the three
- * `create` sites above stamp on), so the lookup is scoped by it rather than
- * resolving a second time.
- */
-describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    process.env.DATABASE_URL = "postgres://test";
-  });
-
-  it("scopes the existing-subscriber read by the caller's resolved workspace id", async () => {
-    (prisma.subscriber.create as jest.Mock).mockRejectedValue(
-      Object.assign(new Error("Unique constraint failed"), { code: "P2002" }),
-    );
-    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({
-      id: "sub_1",
-    });
-
-    await routeLead(
-      { ...subscribeInput, email: "dupe@example.com" },
-      sourceMeta,
-    );
-
-    const { where } = (prisma.subscriber.findUnique as jest.Mock).mock
-      .calls[0][0];
-    expect(where.workspaceId).toBe(subscribeInput.siteId);
-    expect(where.siteId_email).toEqual({
-      siteId: subscribeInput.siteId,
-      email: "dupe@example.com",
-    });
-  });
-});
-
-// ─── #6730 D1/D2 — success only for a durable row or an accepted email ───────
-
-describe("#6730 — routeLead delivery modes", () => {
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "RESEND_API_KEY",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-    "AILK_INBOX_FALLBACK_DIR",
-    "LEAD_CAPTURE_FILE",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  let tmpDir: string;
-  const listFiles = () => fs.readdir(tmpDir);
-
-  const EMAIL_ENV = {
-    RESEND_API_KEY: "re_test",
-    AILK_LEAD_NOTIFICATION_TO: "owner@example.com",
-    AILK_LEAD_NOTIFICATION_FROM: "noreply@example.com",
-  };
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    for (const k of ENV_KEYS) delete process.env[k];
-    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-delivery-test-"));
-    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_1" });
-    mockSendLeadNotification.mockResolvedValue({
-      ok: true,
-      messageId: "msg-1",
-    });
-  });
-
-  afterEach(async () => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  });
-
-  describe("email delivery (the three email vars, no DATABASE_URL, production)", () => {
-    beforeEach(() => {
-      Object.assign(process.env, EMAIL_ENV, { NODE_ENV: "production" });
-    });
-
-    it("an accepted email → ok:true persisted:email with an email- id; no Prisma, no file fallback", async () => {
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: true }
-      >;
-
-      expect(result).toMatchObject({
-        ok: true,
-        persisted: "email",
-        email: { ok: true, messageId: "msg-1" },
-      });
-      expect(result.id).toMatch(/^email-/);
-      expect(result.id).toMatch(/^[a-z0-9_-]{8,64}$/i);
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-      expect(await listFiles()).toEqual([]);
-      expect(mockSendLeadNotification).toHaveBeenCalledTimes(1);
-    });
-
-    it("a refused email → ok:false delivery_failed (never reported as sent)", async () => {
-      mockSendLeadNotification.mockResolvedValue({
-        ok: false,
-        error: { kind: "provider_error", message: "rejected" },
-      });
-
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: false }
-      >;
-
-      expect(result.ok).toBe(false);
-      expect(result.error.kind).toBe("delivery_failed");
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-      expect(await listFiles()).toEqual([]);
-    });
-
-    it("a skipped email (provider reports the key missing) → delivery_failed", async () => {
-      mockSendLeadNotification.mockResolvedValue({
-        ok: false,
-        error: { kind: "config_missing", message: "RESEND_API_KEY not set" },
-      });
-
-      const result = await routeLead(leadInput, sourceMeta);
-      expect(result).toMatchObject({
-        ok: false,
-        error: { kind: "delivery_failed" },
-      });
-    });
-
-    it("a callback is delivered by email too — carrying the name and number to call", async () => {
-      const result = await routeLead(
-        { ...callbackInput, preferredTime: "mornings" },
-        sourceMeta,
-      );
-      expect(result).toMatchObject({ ok: true, persisted: "email" });
-      expect(prisma.callback.create).not.toHaveBeenCalled();
-      const arg = mockSendLeadNotification.mock.calls[0][0];
-      expect(arg.lead.payload).toMatchObject({
-        name: "Alice",
-        phone: "+15551234567",
-        preferredTime: "mornings",
-        notes: "urgent",
-      });
-      // No visitor address to reply to — never an empty Reply-To.
-      expect(arg.replyToOverride).toBe("owner@example.com");
-    });
-
-    it("a newsletter subscribe is refused with config_missing — a signup needs a database", async () => {
-      const result = await routeLead(subscribeInput, sourceMeta);
-      expect(result).toMatchObject({
-        ok: false,
-        error: { kind: "config_missing" },
-      });
-      expect(prisma.subscriber.create).not.toHaveBeenCalled();
-      expect(mockSendLeadNotification).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("production with neither a database nor the email vars", () => {
-    beforeEach(() => {
-      process.env.NODE_ENV = "production";
-    });
-
-    it("refuses with config_missing before any write", async () => {
-      const result = await routeLead(leadInput, sourceMeta);
-
-      expect(result).toMatchObject({
-        ok: false,
-        error: { kind: "config_missing" },
-      });
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-      expect(mockSendLeadNotification).not.toHaveBeenCalled();
-      expect(await listFiles()).toEqual([]);
-    });
-  });
-
-  describe("inbox delivery in production with the database failing (not a constraint)", () => {
-    beforeEach(() => {
-      process.env.DATABASE_URL = "postgres://test";
-      process.env.NODE_ENV = "production";
-      (prisma.lead.create as jest.Mock).mockRejectedValue(
-        new Error("connection refused"),
-      );
-    });
-
-    it("no email vars → persist_failed, and the non-durable file fallback is not attempted", async () => {
-      const result = await routeLead(leadInput, sourceMeta);
-
-      expect(result).toMatchObject({
-        ok: false,
-        error: { kind: "persist_failed" },
-      });
-      expect(await listFiles()).toEqual([]);
-    });
-
-    it("email vars set and the send accepted → persisted:email", async () => {
-      Object.assign(process.env, EMAIL_ENV);
-
-      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-        RouteLeadResult,
-        { ok: true }
-      >;
-
-      expect(result).toMatchObject({ ok: true, persisted: "email" });
-      expect(result.id).toMatch(/^email-/);
-      expect(await listFiles()).toEqual([]);
-    });
-
-    it("a newsletter signup is never emailed — persist_failed", async () => {
-      Object.assign(process.env, EMAIL_ENV);
-      (prisma.subscriber.create as jest.Mock).mockRejectedValue(
-        new Error("connection refused"),
-      );
-
-      const result = await routeLead(subscribeInput, sourceMeta);
-
-      expect(result).toMatchObject({
-        ok: false,
-        error: { kind: "persist_failed" },
-      });
-      expect(mockSendLeadNotification).not.toHaveBeenCalled();
-    });
-
-    it("email vars set but the send refused → persist_failed", async () => {
-      Object.assign(process.env, EMAIL_ENV);
-      mockSendLeadNotification.mockResolvedValue({
-        ok: false,
-        error: { kind: "provider_error", message: "rejected" },
-      });
-
-      const result = await routeLead(leadInput, sourceMeta);
-      expect(result).toMatchObject({
-        ok: false,
-        error: { kind: "persist_failed" },
-      });
-    });
-  });
-
-  describe("inbox delivery outside production keeps today's file fallback", () => {
-    it("DB down in test → persisted:file", async () => {
-      process.env.DATABASE_URL = "postgres://test";
-      process.env.NODE_ENV = "test";
-      (prisma.lead.create as jest.Mock).mockRejectedValue(
-        new Error("connection refused"),
-      );
-
-      const result = await routeLead(leadInput, sourceMeta);
-      expect(result).toMatchObject({ ok: true, persisted: "file" });
-      expect((await listFiles()).length).toBeGreaterThan(0);
-    });
-  });
-});
-
-// ── #7869 — the Idempotency-Key on submit (spec D3–D5, D10 cases 9–14) ──────
-//
-// Cases 9–13 run on `inbox` delivery (DATABASE_URL set), where the key is
-// honoured; case 14 drops DATABASE_URL to prove a non-inbox delivery ignores
-// it. A keyed create that loses the race throws P2002 and is answered from a
-// re-read of the winner.
-describe("#7869 — routeLead with an idempotency key", () => {
-  const KEY = "fixture-retry-0000-0000-0001";
-  const WINNER_ID = "lead_00000000-0000-7000-8000-00000000f001";
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_INBOX_FALLBACK_DIR",
-    "LEAD_CAPTURE_FILE",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  let tmpDir: string;
-
-  const p2002 = () =>
-    Object.assign(
-      new Error(
-        "Unique constraint failed on the fields: (`workspace_id`,`idempotency_key`)",
-      ),
-      { code: "P2002" },
-    );
-  const keyWhere = (workspaceId: string) => ({
-    where: { workspaceId_idempotencyKey: { workspaceId, idempotencyKey: KEY } },
-    select: { id: true, email: true, source: true, payload: true },
-  });
-  const createData = () =>
-    jest.mocked(prisma.lead.create).mock.calls[0]?.[0].data as Record<
-      string,
-      unknown
-    >;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    for (const k of ENV_KEYS) delete process.env[k];
-    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-idem-test-"));
-    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-    process.env.DATABASE_URL = "postgres://stub";
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_new" });
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-    mockSendLeadNotification.mockResolvedValue({
-      ok: true,
-      messageId: "msg-1",
-    });
-  });
-
-  afterEach(async () => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  });
-
-  it("case 9 — a P2002 race whose winner matches answers the winner's id: no fallback, no persist_failed, no notification, no capture record", async () => {
-    // Positive control first: a keyed create with no race writes exactly one
-    // line to the capture file, so the negative assertion below is load-bearing.
-    const controlFile = path.join(tmpDir, "control.jsonl");
-    process.env.LEAD_CAPTURE_FILE = controlFile;
-    const control = await routeLead(leadInput, sourceMeta, {
-      idempotencyKey: KEY,
-    });
-    expect(control).toMatchObject({
-      ok: true,
-      id: "lead_db_new",
-      persisted: "db",
-    });
-    expect(
-      (await fs.readFile(controlFile, "utf8")).trim().split("\n"),
-    ).toHaveLength(1);
-    expect(createData()).toMatchObject({ idempotencyKey: KEY });
-
-    jest.clearAllMocks();
-    const raceFile = path.join(tmpDir, "race.jsonl");
-    process.env.LEAD_CAPTURE_FILE = raceFile;
-    (prisma.lead.create as jest.Mock).mockRejectedValue(p2002());
-    (prisma.lead.findUnique as jest.Mock)
-      .mockResolvedValueOnce(null) // the pre-write lookup misses
-      .mockResolvedValueOnce({
-        id: WINNER_ID,
-        email: leadInput.email,
-        source: leadInput.source,
-        payload: { ...leadInput.payload },
-      });
-    const before = await fs.readdir(tmpDir);
-
-    const result = await routeLead(leadInput, sourceMeta, {
-      idempotencyKey: KEY,
-    });
-
-    expect(result).toEqual({
-      ok: true,
-      replayed: true,
-      id: WINNER_ID,
-      persisted: "db",
-      email: { skipped: true, reason: "idempotent_replay" },
-    });
-    expect(prisma.lead.findUnique).toHaveBeenNthCalledWith(
-      2,
-      keyWhere(leadInput.siteId),
-    );
-    expect(mockSendLeadNotification).not.toHaveBeenCalled();
-    await expect(fs.access(raceFile)).rejects.toThrow();
-    expect(await fs.readdir(tmpDir)).toEqual(before); // no file fallback
-  });
-
-  it("case 10 — a P2002 race whose winner carries a different email is idempotency_conflict", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(p2002());
-    (prisma.lead.findUnique as jest.Mock)
-      .mockResolvedValueOnce(null)
-      .mockResolvedValueOnce({
-        id: WINNER_ID,
-        email: "someone-else@example.com",
-        source: leadInput.source,
-        payload: leadInput.payload,
-      });
-
-    const result = await routeLead(leadInput, sourceMeta, {
-      idempotencyKey: KEY,
-    });
-
-    expect(result).toEqual({
-      ok: false,
-      error: {
-        kind: "idempotency_conflict",
-        message: "idempotency key reused",
-      },
-    });
-    expect(mockSendLeadNotification).not.toHaveBeenCalled();
-  });
-
-  it("case 11 — a P2002 race whose re-read finds nothing takes the existing persist_failed path", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(p2002());
-
-    const result = (await routeLead(leadInput, sourceMeta, {
-      idempotencyKey: KEY,
-    })) as Extract<RouteLeadResult, { ok: false }>;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("persist_failed");
-    expect(prisma.lead.findUnique).toHaveBeenCalledTimes(2);
-  });
-
-  it("case 12 — a P2002 with no key passed is persist_failed, as today, with no key lookup", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(p2002());
-
-    const result = (await routeLead(leadInput, sourceMeta)) as Extract<
-      RouteLeadResult,
-      { ok: false }
-    >;
-
-    expect(result.ok).toBe(false);
-    expect(result.error.kind).toBe("persist_failed");
-    expect(prisma.lead.findUnique).not.toHaveBeenCalled();
-    expect(createData()).not.toHaveProperty("idempotencyKey");
-  });
-
-  it("case 13 — a lookup that throws still reaches the create (the existing path)", async () => {
-    (prisma.lead.findUnique as jest.Mock).mockRejectedValue(
-      new Error("connection reset"),
-    );
-
-    const result = await routeLead(leadInput, sourceMeta, {
-      idempotencyKey: KEY,
-    });
-
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    expect(result).toMatchObject({
-      ok: true,
-      id: "lead_db_new",
-      persisted: "db",
-    });
-  });
-
-  it("case 14 — a non-inbox delivery ignores the key: no lookup, no key on the create, the existing file path", async () => {
-    delete process.env.DATABASE_URL; // `local` delivery outside production
-    (prisma.lead.create as jest.Mock).mockRejectedValue(
-      new Error("connection refused"),
-    );
-
-    const result = await routeLead(leadInput, sourceMeta, {
-      idempotencyKey: KEY,
-    });
-
-    expect(prisma.lead.findUnique).not.toHaveBeenCalled();
-    expect(createData()).not.toHaveProperty("idempotencyKey");
-    expect(result).toMatchObject({ ok: true, persisted: "file" });
-  });
-});
-
-// ─── #8730, #9130 — a keyed consent-bearing lead replays ─────────────────────
-//
-// The route writes `payload.consent` on every request, its `acceptedAt` that
-// request's receive time, so a retry's payload differs from the stored one
-// there and nowhere else. The replay comparison leaves it out for EVERY
-// consent-bearing source — iterating the list, so a source added to it later
-// cannot be gated by the route yet compared here.
-describe("#8730, #9130 — routeLead replays a keyed consent-bearing lead", () => {
-  const KEY = "fixture-retry-0000-0000-9130";
-  const STORED_ID = "lead_00000000-0000-7000-8000-000000009131";
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_INBOX_FALLBACK_DIR",
-    "LEAD_CAPTURE_FILE",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  let tmpDir: string;
-
-  const consentAt = (acceptedAt: string) => ({
-    statement: "I accept the terms.",
-    acceptedAt,
-  });
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    for (const k of ENV_KEYS) delete process.env[k];
-    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-consent-replay-"));
-    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-    process.env.DATABASE_URL = "postgres://stub";
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_new" });
-    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
-  });
-
-  afterEach(async () => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    await fs.rm(tmpDir, { recursive: true, force: true });
-  });
-
-  it("covers every consent-bearing source, the job application included", () => {
-    expect(CONSENT_LEAD_SOURCE_LIST).toContain("flow:job-application");
-  });
-
-  it.each(CONSENT_LEAD_SOURCE_LIST)(
-    "%s — a retry whose only difference is the server-written payload.consent replays the stored lead",
-    async (source) => {
-      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-        id: STORED_ID,
-        email: "visitor@example.com",
-        source,
-        payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
-      });
-
-      const result = await routeLead(
-        {
-          kind: "submit",
-          siteId: "site-abc",
-          source,
-          email: "visitor@example.com",
-          payload: { name: "Jamie", consent: consentAt("2026-10-18T12:00:00.000Z") },
-        },
-        sourceMeta,
-        { idempotencyKey: KEY },
-      );
-
-      expect(result).toMatchObject({ ok: true, replayed: true, id: STORED_ID });
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-      expect(mockSendLeadNotification).not.toHaveBeenCalled();
-    },
-  );
-
-  it.each(CONSENT_LEAD_SOURCE_LIST)(
-    "%s — a retry with a different form field is still a conflict",
-    async (source) => {
-      (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-        id: STORED_ID,
-        email: "visitor@example.com",
-        source,
-        payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
-      });
-
-      const result = await routeLead(
-        {
-          kind: "submit",
-          siteId: "site-abc",
-          source,
-          email: "visitor@example.com",
-          payload: { name: "Someone else", consent: consentAt("2026-10-18T12:00:00.000Z") },
-        },
-        sourceMeta,
-        { idempotencyKey: KEY },
-      );
-
-      expect(result).toEqual({
-        ok: false,
-        error: { kind: "idempotency_conflict", message: "idempotency key reused" },
-      });
-      expect(prisma.lead.create).not.toHaveBeenCalled();
-    },
-  );
-
-  it("a source outside the list still compares payload.consent", async () => {
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: STORED_ID,
-      email: "visitor@example.com",
-      source: "flow:quiz",
-      payload: { name: "Jamie", consent: consentAt("2026-01-01T00:00:00.000Z") },
-    });
-
-    const result = await routeLead(
-      {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "flow:quiz",
-        email: "visitor@example.com",
-        payload: { name: "Jamie", consent: consentAt("2026-10-18T12:00:00.000Z") },
-      },
-      sourceMeta,
-      { idempotencyKey: KEY },
-    );
-
-    expect(result).toMatchObject({ ok: false, error: { kind: "idempotency_conflict" } });
-  });
-});
-
-// ─── #852 D6 — every submitted lead carries its Person ──────────────────────
-//
-// The Person step runs through the shared mock's `person` delegate, whose
-// `findFirst` default resolves one fixed Person (`MOCK_PERSON_ID`). Lead
-// capture is a never-gate surface: an unstorable address or a failed step
-// writes the lead with `personId: null` and changes nothing else.
-describe("#852 — the lead's Person (AC-3)", () => {
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  const LEAD_ID = "lead_00000000-0000-7000-8000-000000000852";
-  const createData = () =>
-    jest.mocked(prisma.lead.create).mock.calls[0]?.[0].data as Record<
-      string,
-      unknown
-    >;
-  const personDelegate = () => ({
-    findFirst: jest.mocked(prisma.person.findFirst),
-    createMany: jest.mocked(prisma.person.createMany),
-    updateMany: jest.mocked(prisma.person.updateMany),
-  });
-  const personCalls = () =>
-    Object.values(personDelegate()).reduce(
-      (n, fn) => n + fn.mock.calls.length,
-      0,
-    );
-  let warn: jest.SpyInstance;
-  let error: jest.SpyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    process.env.DATABASE_URL = "postgres://stub";
-    delete process.env.NODE_ENV;
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
-    mockSendLeadNotification.mockResolvedValue({
-      ok: true,
-      messageId: "msg-852",
-    });
-    warn = jest
-      .spyOn(logger, "warn")
-      .mockImplementation(() => undefined as never);
-    error = jest
-      .spyOn(logger, "error")
-      .mockImplementation(() => undefined as never);
-  });
-
-  afterEach(() => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    warn.mockRestore();
-    error.mockRestore();
-  });
-
-  it("a submit writes the Person findOrCreatePerson returned for (siteId, email)", async () => {
-    const result = await routeLead(
-      {
-        ...leadInput,
-        email: "Test@Example.com",
-        payload: { name: "Tess", message: "hi" },
-      },
-      sourceMeta,
-    );
-
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(personDelegate()["findFirst"]).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { workspaceId: "site-abc", email: "test@example.com" },
-      }),
-    );
-    expect(createData()).toEqual(
-      expect.objectContaining({ personId: MOCK_PERSON_ID }),
-    );
-  });
-
-  // ── #8435 D5 (AC-3) — subscribers and callbacks link to their Person ─────
-  const LINKED = {
-    ok: true as const,
-    value: {
-      personId: MOCK_PERSON_ID as never,
-      created: false,
-      billing: "unchanged" as const,
-    },
-  };
-  const findSpies: jest.SpyInstance[] = [];
-  const spyFind = () => {
-    const spy = jest.spyOn(personService, "findOrCreatePerson");
-    findSpies.push(spy);
-    return spy;
-  };
-  afterEach(() => {
-    while (findSpies.length > 0) findSpies.pop()?.mockRestore();
-  });
-  const subscriberData = () =>
-    jest.mocked(prisma.subscriber.create).mock.calls[0]?.[0].data as Record<
-      string,
-      unknown
-    >;
-  const callbackData = () =>
-    jest.mocked(prisma.callback.create).mock.calls[0]?.[0].data as Record<
-      string,
-      unknown
-    >;
-
-  it("a subscribe calls findOrCreatePerson(siteId, { email }) once and writes that personId", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: "subscr_x",
-    });
-    const find = spyFind().mockResolvedValue(LINKED);
-    await routeLead(subscribeInput, sourceMeta);
-    expect(find).toHaveBeenCalledTimes(1);
-    expect(find).toHaveBeenCalledWith("site-abc", {
-      email: "subscriber@example.com",
-    });
-    expect(subscriberData()).toEqual(
-      expect.objectContaining({ personId: MOCK_PERSON_ID }),
-    );
-  });
-
-  it("a subscribe whose Person is invalid_email writes personId: null and one person-skipped warn with no email", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: "subscr_x",
-    });
-    jest
-      .spyOn(personService, "findOrCreatePerson")
-      .mockResolvedValueOnce({ ok: false, error: { kind: "invalid_email" } });
-    const result = await routeLead(subscribeInput, sourceMeta);
-    expect(result).toMatchObject({ ok: true, id: "subscr_x", persisted: "db" });
-    expect(subscriberData()).toEqual(
-      expect.objectContaining({ personId: null }),
-    );
-    const skipped = warn.mock.calls.filter(
-      ([fields]) => (fields as { event?: string }).event === "person-skipped",
-    );
-    expect(skipped).toHaveLength(1);
-    expect(JSON.stringify(warn.mock.calls)).not.toContain("example.com");
-  });
-
-  it("a subscribe whose Person step fails (internal_error or a throw) answers exactly like a linked one", async () => {
-    (prisma.subscriber.create as jest.Mock).mockResolvedValue({
-      id: "subscr_x",
-    });
-    const find = spyFind().mockResolvedValue(LINKED);
-    const linked = await routeLead(subscribeInput, sourceMeta);
-    jest.mocked(prisma.subscriber.create).mockClear();
-
-    find.mockResolvedValueOnce({
-      ok: false,
-      error: { kind: "internal_error" },
-    });
-    const failed = await routeLead(subscribeInput, sourceMeta);
-    expect(failed).toEqual(linked);
-    expect(subscriberData()).toEqual(
-      expect.objectContaining({ personId: null }),
-    );
-    expect(error.mock.calls.map(([fields]) => fields)).toContainEqual({
-      event: "person-failed",
-      siteId: "site-abc",
-    });
-    jest.mocked(prisma.subscriber.create).mockClear();
-
-    find.mockRejectedValueOnce(new Error("boom"));
-    const thrown = await routeLead(subscribeInput, sourceMeta);
-    expect(thrown).toEqual(linked);
-    expect(subscriberData()).toEqual(
-      expect.objectContaining({ personId: null }),
-    );
-  });
-
-  it("a duplicate subscribe (P2002) makes no second Person call", async () => {
-    (prisma.subscriber.create as jest.Mock).mockRejectedValue(
-      Object.assign(new Error("dup"), { code: "P2002" }),
-    );
-    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({
-      id: "subscr_existing",
-    });
-    const find = spyFind().mockResolvedValue(LINKED);
-    const result = await routeLead(subscribeInput, sourceMeta);
-    expect(result).toMatchObject({ ok: true, id: "subscr_existing" });
-    expect(find).toHaveBeenCalledTimes(1);
-  });
-
-  it("a callback with payload.email and a spaced phone links its Person, carrying the E.164 telephone", async () => {
-    (prisma.callback.create as jest.Mock).mockResolvedValue({ id: "callbk_x" });
-    const find = spyFind().mockResolvedValue(LINKED);
-    await routeLead(
-      {
-        ...callbackInput,
-        phone: "+1 415 555 0123",
-        payload: { email: "c@x.io" },
-      },
-      sourceMeta,
-    );
-    expect(find).toHaveBeenCalledWith("site-abc", {
-      email: "c@x.io",
-      name: "Alice",
-      contact: { telephone: "+14155550123" },
-    });
-    expect(callbackData()).toEqual(
-      expect.objectContaining({ personId: MOCK_PERSON_ID }),
-    );
-  });
-
-  it.each([
-    ["no payload.email", { notes: "urgent" }],
-    ["a numeric payload.email", { email: 12345 }],
-  ])(
-    "a callback with %s makes no person delegate call and writes no personId key",
-    async (_label, payload) => {
-      (prisma.callback.create as jest.Mock).mockResolvedValue({
-        id: "callbk_x",
-      });
-      await routeLead({ ...callbackInput, payload }, sourceMeta);
-      expect(personCalls()).toBe(0);
-      expect(Object.keys(callbackData())).not.toContain("personId");
-    },
-  );
-
-  // ── #8435 D5 (AC-4) — a submit's explicit contact ────────────────────────
-  it("a submit with options.contact.name passes that name over payload.name, and the normalized contact", async () => {
-    const find = spyFind().mockResolvedValue(LINKED);
-    await routeLead({ ...leadInput, payload: { name: "Bob" } }, sourceMeta, {
-      contact: { name: "Ann", givenName: "Ann", phone: "+1 (415) 555-0123" },
-    });
-    expect(find).toHaveBeenCalledWith("site-abc", {
-      email: "test@example.com",
-      name: "Ann",
-      contact: { givenName: "Ann", telephone: "+14155550123" },
-    });
-    // the lead's payload is the raw answers, unchanged
-    expect(createData()["payload"]).toEqual({ name: "Bob" });
-  });
-
-  it("a submit with no options.contact passes payload.name and no contact, as before", async () => {
-    const find = spyFind().mockResolvedValue(LINKED);
-    await routeLead({ ...leadInput, payload: { name: "Bob" } }, sourceMeta);
-    expect(find).toHaveBeenCalledWith("site-abc", {
-      email: "test@example.com",
-      name: "Bob",
-    });
-  });
-
-  it("an invalid_email Person result writes the lead with personId: null and one person-skipped warn with no email", async () => {
-    // `leadInputSchema`'s email check refuses most unstorable addresses before
-    // this step, so the Person result is stubbed to reach the branch.
-    jest
-      .spyOn(personService, "findOrCreatePerson")
-      .mockResolvedValueOnce({ ok: false, error: { kind: "invalid_email" } });
-    const result = await routeLead(leadInput, sourceMeta);
-
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(createData()).toEqual(expect.objectContaining({ personId: null }));
-    const skipped = warn.mock.calls.filter(
-      ([fields]) => (fields as { event?: string }).event === "person-skipped",
-    );
-    expect(skipped).toHaveLength(1);
-    expect(skipped[0]![0]).toEqual({
-      event: "person-skipped",
-      kind: "invalid_email",
-      siteId: "site-abc",
-    });
-    expect(JSON.stringify(warn.mock.calls)).not.toContain("example.com");
-  });
-
-  it("an internal_error Person result is the same never-gate path as a throwing delegate", async () => {
-    jest
-      .spyOn(personService, "findOrCreatePerson")
-      .mockResolvedValueOnce({ ok: false, error: { kind: "internal_error" } });
-    const result = await routeLead(leadInput, sourceMeta);
-
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(createData()).toEqual(expect.objectContaining({ personId: null }));
-    expect(error.mock.calls.map(([fields]) => fields)).toContainEqual({
-      event: "person-failed",
-      siteId: "site-abc",
-    });
-  });
-
-  it("a Person step that fails writes the lead with personId: null, logs person-failed with no email, and answers like a successful capture", async () => {
-    const ok = await routeLead(leadInput, sourceMeta);
-    jest.mocked(prisma.lead.create).mockClear();
-    mockSendLeadNotification.mockClear();
-    personDelegate()["findFirst"]!.mockRejectedValueOnce(
-      new Error('relation "people" does not exist'),
-    );
-
-    const failed = await routeLead(leadInput, sourceMeta);
-
-    // The answer is the same as a successful capture, apart from the internal
-    // `personId` (#8438 D11) the route never puts on a wire.
-    expect(failed).toEqual({ ...ok, personId: null });
-    expect(failed).toMatchObject({
-      ok: true,
-      id: LEAD_ID,
-      persisted: "db",
-      email: { ok: true },
-    });
-    expect(createData()).toEqual(expect.objectContaining({ personId: null }));
-    const lines = error.mock.calls.filter(
-      ([fields]) => (fields as { event?: string }).event === "person-failed",
-    );
-    expect(lines).toHaveLength(1);
-    expect(lines[0]![0]).toEqual({
-      event: "person-failed",
-      siteId: "site-abc",
-    });
-    expect(JSON.stringify(error.mock.calls)).not.toContain("test@example.com");
-  });
-});
-
-// ─── #7877 D10 — a spoke's checkout lead sets the Person's plan (AC-5) ──────
-//
-// The plan step runs only after this request's own `lead.create`, for a LIVE,
-// paid checkout lead a registered spoke's server posted with the session id
-// as its key. Every other lead makes no plan call; a failing plan step never
-// changes the lead's result.
-// #8793 D1 — a marked checkout lead HOLDS its plan: it never writes a
-// Person's plan, logs `held` (or `skipped` for an offering that is no key),
-// and the plan is released only at the Person's verified first link
-// (`person.test.ts`, `checkout-plan.test.ts`).
-describe("#7877 — the checkout lead holds the plan (AC-5; #8793 D1, AC-7)", () => {
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  const LEAD_ID = "lead_00000000-0000-7000-8000-000000007877";
-  const WS = "wksp_00000000-0000-7000-8000-000000007877";
-  const KEY = "cs_live_a1B2c3"; // gitleaks:allow -- a synthetic Checkout Session id shape (#7877 AC-5), not a credential
-  const spokeMeta = { ...sourceMeta, viaSpoke: true };
-  const checkoutLead = {
-    kind: "submit" as const,
-    siteId: WS,
-    source: "web",
-    email: "cleo@x.io",
-    payload: {
-      site: "wendi",
-      page: "checkout",
-      offering: "wendi_retainer",
-    } as Record<string, unknown>,
-  };
-  let setPlan: jest.SpyInstance;
-  let info: jest.SpyInstance;
-  let error: jest.SpyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    process.env.DATABASE_URL = "postgres://stub";
-    delete process.env.NODE_ENV;
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-    mockSendLeadNotification.mockResolvedValue({
-      ok: true,
-      messageId: "msg-7877",
-    });
-    setPlan = jest
-      .spyOn(personService, "setPersonPlanOffering")
-      .mockResolvedValue("set");
-    info = jest
-      .spyOn(logger, "info")
-      .mockImplementation(() => undefined as never);
-    error = jest
-      .spyOn(logger, "error")
-      .mockImplementation(() => undefined as never);
-  });
-
-  afterEach(() => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    setPlan.mockRestore();
-    info.mockRestore();
-    error.mockRestore();
-  });
-
-  const planLines = () =>
-    [...info.mock.calls, ...error.mock.calls]
-      .map(([fields]) => fields as Record<string, unknown>)
-      .filter((fields) => fields.event === "checkout-plan");
-  /** Every `checkout-plan` line is logged at `info`, never at `error`. */
-  const infoPlanLines = () =>
-    info.mock.calls
-      .map(([fields]) => fields as Record<string, unknown>)
-      .filter((fields) => fields.event === "checkout-plan");
-  /** The lead's answer, as it was before #8793. */
-  const answered = {
-    ok: true,
-    id: LEAD_ID,
-    personId: MOCK_PERSON_ID,
-    persisted: "db",
-    email: { ok: true, messageId: "msg-7877" },
-  };
-
-  it("a live spoke checkout lead holds the plan: no plan write, one held line", async () => {
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    expect(result).toEqual(answered);
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(jest.mocked(prisma.person.updateMany)).not.toHaveBeenCalled();
-    expect(infoPlanLines()).toEqual([
-      { event: "checkout-plan", outcome: "held", siteId: WS },
-    ]);
-    expect(planLines()).toEqual(infoPlanLines());
-  });
-
-  it("a bare slug offering is held as it is", async () => {
-    await routeLead(
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, offering: "retainer" },
-      },
-      spokeMeta,
-      { idempotencyKey: KEY },
-    );
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(planLines()).toEqual([
-      { event: "checkout-plan", outcome: "held", siteId: WS },
-    ]);
-  });
-
-  it("a positive integer amountTotal still qualifies", async () => {
-    await routeLead(
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, amountTotal: 4900 },
-      },
-      spokeMeta,
-      { idempotencyKey: KEY },
-    );
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(planLines()).toEqual([
-      { event: "checkout-plan", outcome: "held", siteId: WS },
-    ]);
-  });
-
-  it.each([
-    ["an anonymous lead (viaSpoke false)", checkoutLead, sourceMeta, KEY],
-    ["a test-mode session key", checkoutLead, spokeMeta, "cs_test_a1B2c3"],
-    [
-      "amountTotal 0",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: 0 } },
-      spokeMeta,
-      KEY,
-    ],
-    [
-      "a negative amountTotal",
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, amountTotal: -5 },
-      },
-      spokeMeta,
-      KEY,
-    ],
-    [
-      "a key that is not a session id",
-      checkoutLead,
-      spokeMeta,
-      "abcdefghijklmnop",
-    ],
-    ["no key", checkoutLead, spokeMeta, undefined],
-    ["source contact", { ...checkoutLead, source: "contact" }, spokeMeta, KEY],
-    [
-      "page contact",
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, page: "contact" },
-      },
-      spokeMeta,
-      KEY,
-    ],
-    [
-      "a numeric offering",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, offering: 42 } },
-      spokeMeta,
-      KEY,
-    ],
-  ] as const)("no plan call for %s", async (_label, input, meta, key) => {
-    const result = await routeLead(
-      input as typeof checkoutLead,
-      meta,
-      key === undefined ? {} : { idempotencyKey: key },
-    );
-    expect(result).toMatchObject({ ok: true, persisted: "db" });
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(jest.mocked(prisma.person.updateMany)).not.toHaveBeenCalled();
-    expect(planLines()).toEqual([]);
-  });
-
-  // #8185 — the hub stores its conclusion that a lead is a spoke's live paid
-  // checkout (`Lead.spokeCheckout`): the plan rule's own predicate, plus "not
-  // relayed". An unmarked create names no `spokeCheckout` key at all.
-  const createData = () =>
-    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<
-      string,
-      unknown
-    >;
-
-  it("a live spoke checkout lead is created with spokeCheckout true and holds the plan once", async () => {
-    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    expect(createData()).toMatchObject({ spokeCheckout: true });
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(planLines()).toHaveLength(1);
-  });
-
-  it("the same lead relayed for a visitor is created with no spokeCheckout key and holds no plan", async () => {
-    await routeLead(
-      checkoutLead,
-      { ...spokeMeta, relayed: true },
-      { idempotencyKey: KEY },
-    );
-    expect(createData()).not.toHaveProperty("spokeCheckout");
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(planLines()).toEqual([]);
-  });
-
-  it.each([
-    ["an anonymous lead (viaSpoke false)", checkoutLead, sourceMeta, KEY],
-    ["a test-mode session key", checkoutLead, spokeMeta, "cs_test_a1B2c3"],
-    [
-      "amountTotal 0",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, amountTotal: 0 } },
-      spokeMeta,
-      KEY,
-    ],
-    [
-      "a negative amountTotal",
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, amountTotal: -5 },
-      },
-      spokeMeta,
-      KEY,
-    ],
-    [
-      "a key that is not a session id",
-      checkoutLead,
-      spokeMeta,
-      "abcdefghijklmnop",
-    ],
-    ["no key", checkoutLead, spokeMeta, undefined],
-    ["source contact", { ...checkoutLead, source: "contact" }, spokeMeta, KEY],
-    [
-      "page contact",
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, page: "contact" },
-      },
-      spokeMeta,
-      KEY,
-    ],
-    [
-      "a numeric offering",
-      { ...checkoutLead, payload: { ...checkoutLead.payload, offering: 42 } },
-      spokeMeta,
-      KEY,
-    ],
-  ] as const)(
-    "no spokeCheckout key in the create data for %s",
-    async (_label, input, meta, key) => {
-      await routeLead(
-        input as typeof checkoutLead,
-        meta,
-        key === undefined ? {} : { idempotencyKey: key },
-      );
-      expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-      expect(createData()).not.toHaveProperty("spokeCheckout");
-    },
-  );
-
-  it("an offering that is not a key after the strip logs skipped and makes no plan call", async () => {
-    const result = await routeLead(
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, offering: "Wendi_Retainer!" },
-      },
-      spokeMeta,
-      { idempotencyKey: KEY },
-    );
-    expect(result).toEqual(answered);
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(infoPlanLines()).toEqual([
-      { event: "checkout-plan", outcome: "skipped", siteId: WS },
-    ]);
-    expect(planLines()).toEqual(infoPlanLines());
-  });
-
-  it("no checkout-plan line names an email, an offering or a key", async () => {
-    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    expect(planLines()).toHaveLength(1);
-    for (const line of planLines()) {
-      expect(line).not.toHaveProperty("email");
-      expect(line).not.toHaveProperty("offering");
-      expect(line).not.toHaveProperty("key");
-    }
-    const logged = JSON.stringify(planLines());
-    expect(logged).not.toContain("retainer");
-    expect(logged).not.toContain("cleo@x.io");
-    expect(logged).not.toContain(KEY);
-  });
-
-  it("a replayed key writes nothing and sets nothing", async () => {
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: LEAD_ID,
-      email: checkoutLead.email,
-      source: checkoutLead.source,
-      payload: checkoutLead.payload,
-    });
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    expect(result).toMatchObject({ ok: true, replayed: true, id: LEAD_ID });
-    expect(prisma.lead.create).not.toHaveBeenCalled();
-    expect(setPlan).not.toHaveBeenCalled();
-  });
-});
-
-describe("#8757 D14 — a spoke checkout's purchase email and Inbox message (AC-11)", () => {
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-    "AILK_DELIVERABLE_EMAIL_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008757";
-  const WS = "wksp_00000000-0000-7000-8000-000000008757";
-  const KEY = "cs_live_d14Purchase"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8757 AC-11), not a credential
-  const ORIGIN = "https://spoke.example";
-  const spokeMeta = { ...sourceMeta, viaSpoke: true };
-  const checkoutLead = {
-    kind: "submit" as const,
-    siteId: WS,
-    source: "web",
-    email: "Cleo@X.io",
-    payload: {
-      site: "wendi",
-      page: "checkout",
-      offering: "wendi_retainer",
-      amountTotal: 4900,
-      currency: "usd",
-    } as Record<string, unknown>,
-  };
-  // The lead table's count — the per-recipient cap's one read. The shared
-  // prisma double does not carry it, so this suite arranges it.
-  const leadCount = jest.fn();
-  let setPlan: jest.SpyInstance;
-  let info: jest.SpyInstance;
-  let error: jest.SpyInstance;
-
-  /** Let the fired (void) email step run to its end. */
-  const settle = async () => {
-    for (let i = 0; i < 5; i += 1)
-      await new Promise((resolve) => setImmediate(resolve));
-  };
-  const interactionCreates = () =>
-    jest.mocked(prisma.interaction.create).mock.calls;
-  const emailCalls = () => mockSendPurchaseConfirmationEmail.mock.calls;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    process.env.DATABASE_URL = "postgres://stub";
-    delete process.env.NODE_ENV;
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    delete process.env.AILK_DELIVERABLE_EMAIL_FROM;
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-    Object.assign(prisma.lead, { count: leadCount });
-    leadCount.mockReset().mockResolvedValue(1);
-    jest
-      .mocked(prisma.interaction.create)
-      .mockResolvedValue({ id: "intx_1" } as never);
-    mockSendLeadNotification.mockResolvedValue({
-      ok: true,
-      messageId: "msg-8757",
-    });
-    mockSendPurchaseConfirmationEmail.mockResolvedValue({
-      ok: true,
-      messageId: "msg-buy",
-    });
-    mockListPlanOfferings.mockResolvedValue([
-      { key: "retainer", name: "Retainer", type: "service" },
-    ]);
-    setPlan = jest
-      .spyOn(personService, "setPersonPlanOffering")
-      .mockResolvedValue("set");
-    info = jest
-      .spyOn(logger, "info")
-      .mockImplementation(() => undefined as never);
-    error = jest
-      .spyOn(logger, "error")
-      .mockImplementation(() => undefined as never);
-  });
-
-  afterEach(() => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    Reflect.deleteProperty(prisma.lead, "count");
-    setPlan.mockRestore();
-    info.mockRestore();
-    error.mockRestore();
-  });
-
-  it("the first write sends one purchase email with the spoke's account link and writes one Inbox message", async () => {
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-
-    expect(emailCalls()).toHaveLength(1);
-    const [email] = emailCalls()[0] as [Record<string, string>];
-    expect(email).toMatchObject({
-      to: "Cleo@X.io",
-      fromAddress: "noreply@example.com",
-      subject: "Your purchase",
-      cta: "Open your account",
-      accountLink: `${ORIGIN}/api/hub-session/sign-in?next=%2Faccount&email=Cleo%40X.io`,
-    });
-    expect(email.body).toContain("Retainer");
-    expect(email.body).toContain("$49.00");
-
-    expect(interactionCreates()).toHaveLength(1);
-    const [{ data }] = interactionCreates()[0] as [
-      { data: Record<string, unknown> },
-    ];
-    expect(data).toEqual({
-      workspaceId: WS,
-      personId: MOCK_PERSON_ID,
-      channel: "member",
-      direction: "outbound",
-      subject: "Your purchase",
-      body: email.body,
-      createdBy: "system:checkout",
-    });
-    expect(mockListPlanOfferings).toHaveBeenCalledWith(WS);
-  });
-
-  it("an offering that is not listed is named 'your purchase' in both, never the raw string", async () => {
-    await routeLead(
-      {
-        ...checkoutLead,
-        payload: { ...checkoutLead.payload, offering: "wendi_<b>Mystery</b>" },
-      },
-      spokeMeta,
-      { idempotencyKey: KEY, accountOrigin: ORIGIN },
-    );
-    await settle();
-    const [email] = emailCalls()[0] as [Record<string, string>];
-    const [{ data }] = interactionCreates()[0] as [
-      { data: Record<string, string> },
-    ];
-    for (const body of [email.body, data.body]) {
-      expect(body).toContain("your purchase");
-      expect(body).not.toContain("Mystery");
-      expect(body).not.toContain("wendi_");
-    }
-  });
-
-  it.each([
-    [
-      "the lister fails",
-      () => mockListPlanOfferings.mockResolvedValueOnce({ failed: "Error" }),
-    ],
-    [
-      "the lister throws",
-      () => mockListPlanOfferings.mockRejectedValueOnce(new Error("down")),
-    ],
-  ])(
-    "when %s, the offering is 'your purchase' and both still go out",
-    async (_label, arrange) => {
-      arrange();
-      await routeLead(checkoutLead, spokeMeta, {
-        idempotencyKey: KEY,
-        accountOrigin: ORIGIN,
-      });
-      await settle();
-      expect(emailCalls()).toHaveLength(1);
-      expect(interactionCreates()).toHaveLength(1);
-      const [{ data }] = interactionCreates()[0] as [
-        { data: Record<string, string> },
-      ];
-      expect(data.body).toContain("your purchase");
-    },
-  );
-
-  it("a listed name holding a bidi override comes out with it stripped", async () => {
-    mockListPlanOfferings.mockResolvedValue([
-      { key: "retainer", name: "Re\u202Etainer\u0007", type: "service" },
-    ]);
-    await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    const [email] = emailCalls()[0] as [Record<string, string>];
-    const [{ data }] = interactionCreates()[0] as [
-      { data: Record<string, string> },
-    ];
-    for (const body of [email.body, data.body]) {
-      expect(body).toContain("Retainer");
-       
-      // The two code points by name, not in a regex: a scaffold's standalone
-      // lint refuses a control character in a regular expression.
-      expect(body).not.toContain("\u202E");
-      expect(body).not.toContain("\u0007");
-    }
-  });
-
-  it("with no amount, the body names the offering alone", async () => {
-    const { amountTotal: _a, currency: _c, ...payload } = checkoutLead.payload;
-    await routeLead({ ...checkoutLead, payload }, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    const [{ data }] = interactionCreates()[0] as [
-      { data: Record<string, string> },
-    ];
-    expect(data.body).toBe("Thanks for your purchase of Retainer.");
-  });
-
-  it("a Stripe special-case currency (ISK) leaves the amount out rather than misstate it", async () => {
-    await routeLead(
-      {
-        ...checkoutLead,
-        payload: {
-          ...checkoutLead.payload,
-          amountTotal: 990000,
-          currency: "isk",
-        },
-      },
-      spokeMeta,
-      { idempotencyKey: KEY, accountOrigin: ORIGIN },
-    );
-    await settle();
-    const [{ data }] = interactionCreates()[0] as [
-      { data: Record<string, string> },
-    ];
-    expect(data.body).toBe("Thanks for your purchase of Retainer.");
-  });
-
-  it("an offering read that outlasts its budget names 'your purchase' and does not hold the lead", async () => {
-    mockListPlanOfferings.mockReturnValue(new Promise(() => undefined));
-    const started = Date.now();
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    expect(Date.now() - started).toBeLessThan(4000);
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    const [{ data }] = interactionCreates()[0] as [
-      { data: Record<string, string> },
-    ];
-    expect(data.body).toContain("your purchase");
-  }, 10_000);
-
-  it("with no account origin, the email carries no link", async () => {
-    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    await settle();
-    expect(emailCalls()).toHaveLength(1);
-    expect(emailCalls()[0]?.[0]).not.toHaveProperty("accountLink");
-    expect(interactionCreates()).toHaveLength(1);
-  });
-
-  it("a replay of the same Idempotency-Key makes neither", async () => {
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: LEAD_ID,
-      email: checkoutLead.email,
-      source: checkoutLead.source,
-      payload: checkoutLead.payload,
-    });
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, replayed: true });
-    expect(emailCalls()).toHaveLength(0);
-    expect(interactionCreates()).toHaveLength(0);
-  });
-
-  it.each([
-    ["a test-mode checkout lead", spokeMeta, "cs_test_d14Purchase"],
-    ["a relayed checkout lead", { ...spokeMeta, relayed: true }, KEY],
-    ["an anonymous (non-spoke) lead", sourceMeta, KEY],
-  ] as const)("%s makes neither", async (_label, meta, key) => {
-    const result = await routeLead(checkoutLead, meta, {
-      idempotencyKey: key,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, persisted: "db" });
-    expect(emailCalls()).toHaveLength(0);
-    expect(interactionCreates()).toHaveLength(0);
-  });
-
-  it("a lead with no Person makes neither", async () => {
-    const find = jest
-      .spyOn(personService, "findOrCreatePerson")
-      .mockResolvedValue({
-        ok: false,
-        error: { kind: "invalid_email" },
-      } as never);
-    try {
-      const result = await routeLead(checkoutLead, spokeMeta, {
-        idempotencyKey: KEY,
-        accountOrigin: ORIGIN,
-      });
-      await settle();
-      expect(result).toMatchObject({ ok: true, persisted: "db" });
-      expect(emailCalls()).toHaveLength(0);
-      expect(interactionCreates()).toHaveLength(0);
-    } finally {
-      find.mockRestore();
-    }
-  });
-
-  it("with five marked leads for the address in the last day, the sixth sends no email and still writes the message", async () => {
-    const now = Date.now();
-    leadCount.mockResolvedValue(6); // the five before, and this one
-    await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(emailCalls()).toHaveLength(0);
-    expect(interactionCreates()).toHaveLength(1);
-    const [{ where }] = leadCount.mock.calls[0] as [
-      { where: Record<string, unknown> },
-    ];
-    expect(where).toMatchObject({
-      workspaceId: WS,
-      spokeCheckout: true,
-      email: { equals: "Cleo@X.io", mode: "insensitive" },
-    });
-    const since = (where.createdAt as { gte: Date }).gte.getTime();
-    expect(now - since).toBeGreaterThanOrEqual(24 * 60 * 60 * 1000 - 1000);
-    expect(now - since).toBeLessThanOrEqual(24 * 60 * 60 * 1000 + 5000);
-  });
-
-  it("with more than 50 marked leads in the workspace in the last hour, no email (any address) and the message is still written", async () => {
-    const now = Date.now();
-    // The recipient count first, then the workspace's hourly count.
-    leadCount.mockResolvedValueOnce(1).mockResolvedValueOnce(51);
-    await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(emailCalls()).toHaveLength(0);
-    expect(interactionCreates()).toHaveLength(1);
-    const [{ where }] = leadCount.mock.calls[1] as [
-      { where: Record<string, unknown> },
-    ];
-    expect(where).toMatchObject({ workspaceId: WS, spokeCheckout: true });
-    expect(where).not.toHaveProperty("email");
-    const since = (where.createdAt as { gte: Date }).gte.getTime();
-    expect(now - since).toBeGreaterThanOrEqual(60 * 60 * 1000 - 1000);
-    expect(now - since).toBeLessThanOrEqual(60 * 60 * 1000 + 5000);
-  });
-
-  it("with exactly 50 in the hour, the email still goes", async () => {
-    leadCount.mockResolvedValueOnce(1).mockResolvedValueOnce(50);
-    await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(emailCalls()).toHaveLength(1);
-  });
-
-  it("with five in the day including this one, the email still goes", async () => {
-    leadCount.mockResolvedValue(5);
-    await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(emailCalls()).toHaveLength(1);
-  });
-
-  it.each([
-    [
-      "the Inbox write throws",
-      () =>
-        jest
-          .mocked(prisma.interaction.create)
-          .mockRejectedValueOnce(new Error("down")),
-    ],
-    [
-      "the cap read throws",
-      () => leadCount.mockRejectedValueOnce(new Error("down")),
-    ],
-    [
-      "the email send rejects",
-      () =>
-        mockSendPurchaseConfirmationEmail.mockRejectedValueOnce(
-          new Error("down"),
-        ),
-    ],
-  ])(
-    "a purchase step that fails (%s) never changes the lead's answer",
-    async (_label, arrange) => {
-      arrange();
-      const result = await routeLead(checkoutLead, spokeMeta, {
-        idempotencyKey: KEY,
-        accountOrigin: ORIGIN,
-      });
-      await settle();
-      expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-      expect(setPlan).not.toHaveBeenCalled();
-      const logged = JSON.stringify([...info.mock.calls, ...error.mock.calls]);
-      expect(logged).not.toContain("Cleo@X.io");
-      expect(logged).not.toContain("retainer");
-    },
-  );
-
-  it("with no sender configured, no email is sent and the message is still written", async () => {
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-      accountOrigin: ORIGIN,
-    });
-    await settle();
-    expect(emailCalls()).toHaveLength(0);
-    expect(interactionCreates()).toHaveLength(1);
-  });
-});
-
-describe("#8778 — a spoke checkout's terms grant", () => {
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008778";
-  const WS = "wksp_00000000-0000-7000-8000-000000008778";
-  const KEY = "cs_live_g8778Grant"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8778), not a credential
-  const ACCOUNT_TERMS = consentPurposeById(
-    SITE_CONSENT_CONFIG_DEFAULTS,
-    ACCOUNT_TERMS_PURPOSE_ID,
-  )!;
-  const STAMP = `${ACCOUNT_TERMS_PURPOSE_ID}@${ACCOUNT_TERMS.policyVersion}`;
-  const spokeMeta = { ...sourceMeta, viaSpoke: true };
-  const checkoutLead = {
-    kind: "submit" as const,
-    siteId: WS,
-    source: "web",
-    email: "Cleo@X.io",
-    payload: {
-      site: "wendi",
-      page: "checkout",
-      offering: "wendi_retainer",
-      amountTotal: 4900,
-      currency: "usd",
-      checkoutSession: KEY,
-      termsAccepted: STAMP,
-    } as Record<string, unknown>,
-  };
-  const leadCount = jest.fn();
-  let double: ConsentLedgerDouble;
-  let setPlan: jest.SpyInstance;
-  let info: jest.SpyInstance;
-  let error: jest.SpyInstance;
-
-  /** The ledger double, plus the per-session replay read it does not model. */
-  function armLedger(): void {
-    double = armConsentLedger(prisma);
-    const ledgerRead = (prisma.$queryRaw as jest.Mock).getMockImplementation()!;
-    (prisma.$queryRaw as jest.Mock).mockImplementation(
-      (strings: TemplateStringsArray, ...values: unknown[]) => {
-        if (strings.join("?").includes(`"source" = 'checkout'`)) {
-          const [workspaceId, personId, purposeId, sessionId] =
-            values as string[];
-          return Promise.resolve(
-            double.ledger
-              .filter(
-                (r) =>
-                  r.workspaceId === workspaceId &&
-                  r.personId === personId &&
-                  r.purposeId === purposeId &&
-                  r.source === "checkout" &&
-                  r.sourceRef === sessionId,
-              )
-              .map(() => ({ found: 1 })),
-          );
-        }
-        return ledgerRead(strings, ...values);
-      },
-    );
-  }
-
-  const consentLines = () =>
-    [...info.mock.calls, ...error.mock.calls]
-      .map(([obj]) => obj as Record<string, unknown>)
-      .filter((obj) => obj?.["event"] === "checkout-consent");
-
-  const settle = async () => {
-    for (let i = 0; i < 5; i += 1)
-      await new Promise((resolve) => setImmediate(resolve));
-  };
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    process.env.DATABASE_URL = "postgres://stub";
-    delete process.env.NODE_ENV;
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-    Object.assign(prisma.lead, { count: leadCount });
-    leadCount.mockReset().mockResolvedValue(1);
-    jest
-      .mocked(prisma.interaction.create)
-      .mockResolvedValue({ id: "intx_1" } as never);
-    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "m" });
-    mockSendPurchaseConfirmationEmail.mockResolvedValue({
-      ok: true,
-      messageId: "m2",
-    });
-    mockListPlanOfferings.mockResolvedValue([]);
-    setPlan = jest
-      .spyOn(personService, "setPersonPlanOffering")
-      .mockResolvedValue("set");
-    info = jest
-      .spyOn(logger, "info")
-      .mockImplementation(() => undefined as never);
-    error = jest
-      .spyOn(logger, "error")
-      .mockImplementation(() => undefined as never);
-    armLedger();
-  });
-
-  afterEach(() => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    Reflect.deleteProperty(prisma.lead, "count");
-    for (const fn of [
-      prisma.$transaction,
-      prisma.$executeRaw,
-      prisma.$queryRaw,
-      prisma.consentGrant.createMany,
-      prisma.consentVisitorLink.createMany,
-    ]) {
-      (fn as jest.Mock).mockReset();
-    }
-    setPlan.mockRestore();
-    info.mockRestore();
-    error.mockRestore();
-  });
-
-  it("a lead whose session accepted the current terms writes one dated checkout grant for the buyer's Person", async () => {
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-
-    expect(double.ledger).toHaveLength(1);
-    const [row] = double.ledger;
-    expect(row).toMatchObject({
-      workspaceId: WS,
-      subjectType: "person",
-      subjectId: MOCK_PERSON_ID,
-      personId: MOCK_PERSON_ID,
-      purposeId: ACCOUNT_TERMS_PURPOSE_ID,
-      granted: true,
-      source: "checkout",
-      sourceRef: KEY,
-      policyVersion: ACCOUNT_TERMS.policyVersion,
-      locale: "en",
-    });
-    expect(row!.createdAt).toBeInstanceOf(Date);
-    expect(consentLines()).toEqual([
-      expect.objectContaining({ outcome: "recorded", siteId: WS }),
-    ]);
-    // #8793 D1 — the grant is written; the plan is held, never set here.
-    expect(setPlan).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ["termsAccepted: null (the box was not accepted)", null, "consent_absent"],
-    ["no termsAccepted key (an older spoke)", undefined, "consent_absent"],
-    ["an older version's stamp", `${ACCOUNT_TERMS_PURPOSE_ID}@1`, "terms_unstamped"],
-    ["another purpose's stamp", "wt_platform_terms@1", "terms_unstamped"],
-    ["a non-string value", true, "terms_unstamped"],
-  ])("a lead with %s writes no grant", async (_label, terms, outcome) => {
-    const { termsAccepted: _t, ...rest } = checkoutLead.payload;
-    const payload = terms === undefined ? rest : { ...rest, termsAccepted: terms };
-    const result = await routeLead({ ...checkoutLead, payload }, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(double.ledger).toHaveLength(0);
-    expect(consentLines()).toEqual([expect.objectContaining({ outcome })]);
-  });
-
-  it("a replayed spoke webhook (the same Idempotency-Key and body) writes no second grant", async () => {
-    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    expect(double.ledger).toHaveLength(1);
-
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: LEAD_ID,
-      email: checkoutLead.email,
-      source: checkoutLead.source,
-      payload: checkoutLead.payload,
-    });
-    const replay = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    await settle();
-    expect(replay).toMatchObject({ ok: true, replayed: true });
-    expect(double.ledger).toHaveLength(1);
-  });
-
-  it("a redelivery whose stored body predates termsAccepted is a replay, not a conflict, and writes no grant", async () => {
-    const { termsAccepted: _t, ...storedPayload } = checkoutLead.payload;
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: LEAD_ID,
-      email: checkoutLead.email,
-      source: checkoutLead.source,
-      payload: storedPayload,
-    });
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, replayed: true });
-    expect(double.ledger).toHaveLength(0);
-  });
-
-  it("a redelivery that differs in any other payload key is still a conflict", async () => {
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue({
-      id: LEAD_ID,
-      email: checkoutLead.email,
-      source: checkoutLead.source,
-      payload: { ...checkoutLead.payload, amountTotal: 1 },
-    });
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    expect(result).toMatchObject({
-      ok: false,
-      error: { kind: "idempotency_conflict" },
-    });
-  });
-
-  it("a second write for a session whose grant the Person already holds writes none (the store's own guard)", async () => {
-    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    // The lead row lost (the lookup misses), the ledger kept: the grant is
-    // still written at most once per Person and session.
-    await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-    await settle();
-    expect(double.ledger).toHaveLength(1);
-    expect(consentLines().map((l) => l["outcome"])).toEqual([
-      "recorded",
-      "unchanged",
-    ]);
-  });
-
-  it.each([
-    ["a test-mode checkout lead", spokeMeta, "cs_test_g8778Grant"],
-    ["a relayed checkout lead", { ...spokeMeta, relayed: true }, KEY],
-    ["an anonymous (non-spoke) lead", sourceMeta, KEY],
-  ] as const)("%s writes no grant", async (_label, meta, key) => {
-    const result = await routeLead(checkoutLead, meta, { idempotencyKey: key });
-    await settle();
-    expect(result).toMatchObject({ ok: true, persisted: "db" });
-    expect(double.ledger).toHaveLength(0);
-    expect(consentLines()).toEqual([]);
-  });
-
-  it("a lead with no Person writes no grant", async () => {
-    const find = jest
-      .spyOn(personService, "findOrCreatePerson")
-      .mockResolvedValue({
-        ok: false,
-        error: { kind: "invalid_email" },
-      } as never);
-    try {
-      await routeLead(checkoutLead, spokeMeta, { idempotencyKey: KEY });
-      await settle();
-      expect(double.ledger).toHaveLength(0);
-    } finally {
-      find.mockRestore();
-    }
-  });
-
-  it("a ledger write that fails never changes the lead's answer, and logs no address or Person id", async () => {
-    (prisma.consentGrant.createMany as jest.Mock).mockRejectedValueOnce(
-      new Error("down Cleo@X.io"),
-    );
-    const result = await routeLead(checkoutLead, spokeMeta, {
-      idempotencyKey: KEY,
-    });
-    await settle();
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(consentLines()).toEqual([
-      expect.objectContaining({ outcome: "failed", errName: "Error" }),
-    ]);
-    const logged = JSON.stringify([...info.mock.calls, ...error.mock.calls]);
-    expect(logged).not.toContain("Cleo@X.io");
-    expect(logged).not.toContain(MOCK_PERSON_ID);
-  });
-});
-
-describe("#8932 D7 — the per-Organization webhook's Offerings checkout lead (AC-5)", () => {
-  const ENV_KEYS = [
-    "DATABASE_URL",
-    "NODE_ENV",
-    "AILK_LEAD_NOTIFICATION_TO",
-    "AILK_LEAD_NOTIFICATION_FROM",
-  ] as const;
-  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
-  const LEAD_ID = "lead_00000000-0000-7000-8000-000000008932";
-  const WS = "wksp_00000000-0000-7000-8000-000000008932";
-  const OTHER_WS = "wksp_00000000-0000-7000-8000-000000008933";
-  const SESSION = "cs_live_a8932Offerings"; // gitleaks:allow -- a synthetic Checkout Session id shape (#8932 AC-5), not a credential
-  const KEY = `stripe-offerings ${SESSION}`;
-  const ACCOUNT_TERMS = consentPurposeById(
-    SITE_CONSENT_CONFIG_DEFAULTS,
-    ACCOUNT_TERMS_PURPOSE_ID,
-  )!;
-  const STAMP = `${ACCOUNT_TERMS_PURPOSE_ID}@${ACCOUNT_TERMS.policyVersion}`;
-  /** The input the webhook builds (D6) — the offering is the record's full key. */
-  const offeringsLead = {
-    kind: "submit" as const,
-    siteId: WS,
-    source: "web",
-    email: "buyer@example.com",
-    payload: {
-      page: "checkout",
-      offering: "growth_monthly",
-      site: WS,
-      amountTotal: 4900,
-      currency: "usd",
-      termsAccepted: STAMP,
-    } as Record<string, unknown>,
-  };
-  const webhookMeta = {
-    ip: "203.0.113.9",
-    userAgent: "Stripe/1.0",
-    receivedAt: "2026-10-18T00:00:00.000Z",
-  };
-  const twin = { idempotencyKey: KEY, offeringsCheckout: true as const };
-  const leadCount = jest.fn();
-  let setPlan: jest.SpyInstance;
-  let consent: jest.SpyInstance;
-  let info: jest.SpyInstance;
-  let error: jest.SpyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    saved = {};
-    for (const k of ENV_KEYS) saved[k] = process.env[k];
-    process.env.DATABASE_URL = "postgres://stub";
-    delete process.env.NODE_ENV;
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: LEAD_ID });
-    (prisma.lead.findUnique as jest.Mock).mockResolvedValue(null);
-    Object.assign(prisma.lead, { count: leadCount });
-    leadCount.mockReset().mockResolvedValue(1);
-    jest
-      .mocked(prisma.interaction.create)
-      .mockResolvedValue({ id: "intx_1" } as never);
-    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "m" });
-    mockSendPurchaseConfirmationEmail.mockResolvedValue({ ok: true, messageId: "m2" });
-    mockListPlanOfferings.mockResolvedValue([]);
-    setPlan = jest.spyOn(personService, "setPersonPlanOffering").mockResolvedValue("set");
-    consent = jest
-      .spyOn(consentService, "recordCheckoutConsent")
-      .mockResolvedValue("recorded");
-    info = jest.spyOn(logger, "info").mockImplementation(() => undefined as never);
-    error = jest.spyOn(logger, "error").mockImplementation(() => undefined as never);
-  });
-
-  afterEach(() => {
-    for (const k of ENV_KEYS) {
-      if (saved[k] === undefined) delete process.env[k];
-      else process.env[k] = saved[k];
-    }
-    Reflect.deleteProperty(prisma.lead, "count");
-    setPlan.mockRestore();
-    consent.mockRestore();
-    info.mockRestore();
-    error.mockRestore();
-  });
-
-  const createData = () =>
-    (prisma.lead.create as jest.Mock).mock.calls[0][0].data as Record<string, unknown>;
-  const planLines = () =>
-    [...info.mock.calls, ...error.mock.calls]
-      .map(([fields]) => fields as Record<string, unknown>)
-      .filter((fields) => fields?.["event"] === "checkout-plan");
-  const planWrites = () =>
-    jest
-      .mocked(prisma.person.updateMany)
-      .mock.calls.filter(([args]) => "planOffering" in ((args as { data?: object }).data ?? {}));
-
-  it("creates one marked lead on the prefixed key, holds the full key and grants consent on the bare session id", async () => {
-    const result = await routeLead(offeringsLead, webhookMeta, twin);
-    expect(result).toMatchObject({ ok: true, id: LEAD_ID, persisted: "db" });
-    expect(prisma.lead.create).toHaveBeenCalledTimes(1);
-    expect(createData()).toMatchObject({
-      spokeCheckout: true,
-      idempotencyKey: KEY,
-      payload: expect.objectContaining({ offering: "growth_monthly" }),
-    });
-    expect(planLines()).toEqual([{ event: "checkout-plan", outcome: "held", siteId: WS }]);
-    expect(consent).toHaveBeenCalledTimes(1);
-    expect(consent).toHaveBeenCalledWith(
-      expect.objectContaining({ workspaceId: WS, sessionId: SESSION }),
-    );
-    expect(setPlan).not.toHaveBeenCalled();
-    expect(planWrites()).toEqual([]);
-  });
-
-  it.each([
-    ["without offeringsCheckout", offeringsLead, { idempotencyKey: KEY }],
-    [
-      "an offering the grammar refuses",
-      { ...offeringsLead, payload: { ...offeringsLead.payload, offering: "growth_quarterly" } },
-      twin,
-    ],
-    [
-      "a site that is another workspace",
-      { ...offeringsLead, payload: { ...offeringsLead.payload, site: OTHER_WS } },
-      twin,
-    ],
-    ["a test-mode session key", offeringsLead, { ...twin, idempotencyKey: "stripe-offerings cs_test_a1" }],
-    ["the bare session id as the key", offeringsLead, { ...twin, idempotencyKey: SESSION }],
-    ["source contact", { ...offeringsLead, source: "contact" }, twin],
-    [
-      "page contact",
-      { ...offeringsLead, payload: { ...offeringsLead.payload, page: "contact" } },
-      twin,
-    ],
-  ] as const)("creates an unmarked lead and holds nothing for %s", async (_label, input, options) => {
-    const result = await routeLead(input as typeof offeringsLead, webhookMeta, options);
-    expect(result).toMatchObject({ ok: true, persisted: "db" });
-    expect(createData()).not.toHaveProperty("spokeCheckout");
-    expect(planLines()).toEqual([]);
-    expect(consent).not.toHaveBeenCalled();
-    expect(prisma.interaction.create).not.toHaveBeenCalled();
-    expect(planWrites()).toEqual([]);
-  });
-
-  it("leaves a spoke checkout lead marked exactly as before", async () => {
-    await routeLead(
-      {
-        kind: "submit",
-        siteId: WS,
-        source: "web",
-        email: "cleo@x.io",
-        payload: { site: "wendi", page: "checkout", offering: "wendi_retainer" },
-      },
-      { ...webhookMeta, viaSpoke: true },
-      { idempotencyKey: "cs_live_a1B2c3" }, // gitleaks:allow -- a synthetic Checkout Session id shape, not a credential
-    );
-    expect(createData()).toMatchObject({ spokeCheckout: true });
-    expect(consent).not.toHaveBeenCalledWith(expect.objectContaining({ sessionId: SESSION }));
-  });
-
-  it("the verified first link releases the full lookup key into the Person's plan", async () => {
-    setPlan.mockRestore();
-    jest.mocked(prisma.lead.findMany).mockResolvedValue([
-      { email: offeringsLead.email, payload: offeringsLead.payload },
-    ] as never);
-    jest.mocked(prisma.person.updateMany).mockResolvedValue({ count: 1 } as never);
-    const outcome = await personService.releaseHeldCheckoutPlan(
-      WS,
-      MOCK_PERSON_ID,
-      "usr_buyer_8932",
-      "buyer@example.com",
-    );
-    expect(outcome).toBe("set");
-    expect(prisma.person.updateMany).toHaveBeenCalledWith(
-      expect.objectContaining({ data: { planOffering: "growth_monthly" } }),
-    );
-  });
-});