create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/services/project-listings.ts

@@ -1,2085 +0,0 @@
-/**
- * NOT marked `oss: false` (D-48/#5366 escalation — see
- * `routes/project-listings/me.ts`'s header comment): imported by
- * `routes/project-listings/{start,patch-draft,submit,public,me}.ts`, each of
- * which ships unconditionally because `routes/project-listings/index.ts`'s
- * multi-tenant literal `import()` forces it. Registration of the routes that
- * call into this service stays gated (`isModuleEnabled("signal-collectors")`).
- *
- * @file project-listings.ts
- * @description The founder's-application-row service (#4998, reshaped by
- * #5036) — writes, reads, and transitions `ProjectListing` (ADR 0009 D3
- * service-layer convention, mirroring `lead-routing.ts` and
- * `waitlist-dashboard.ts`).
- *
- * The single anonymous create became THREE operations when the application
- * became a ten-step form that saves as it goes (#5036 D1):
- *
- *   start   name + email + consent -> a `draft` row and a resume token
- *   patch   merges a partial payload; asserts no completeness
- *   submit  validates the WHOLE application, `draft` -> `requested`
- *
- * Validation therefore moved from write-time to submit-time, and that is why
- * every application field is nullable on the row: a half-filled draft is a
- * legitimate row, and only `submit` asserts it is finished.
- *
- * `submitProjectListingDraft` calls `routeLead` (kind `submit`, source
- * `projects-apply`) for the Lead write — never a duplicate Lead-shaped insert.
- * The Lead is written at SUBMIT rather than at start: the founder's contact
- * details are already captured on the listing row itself at step one, so a
- * Lead at step one adds no capture, and what it DOES add is an operator
- * notification email per abandoned first step on an anonymous route (PR #5042
- * security review, finding 4). Every tenant read/write
- * is scoped by `siteId` (`request.tenant.workspaceId`) — there is no
- * client-supplied site id on any tenant route. `waitlistCount` joins THROUGH
- * `experimentId` (`WaitlistExperiment.id` -> `.key` -> `WaitlistScore.experimentKey`,
- * scoped by `siteId`), 0 when a listing carries no `experimentKey`.
- *
- * PII boundary: this module never logs `founderEmail`, `founderName`, or
- * `questions` — the same discipline `lead-routing.ts` documents. The resume
- * token is never logged either, at any level: it is the ONLY credential on
- * the anonymous draft surface.
- */
-
-import { createHash, randomBytes } from "node:crypto";
-
-import type { Prisma } from "@working-theory/database";
-import {
-  DEFAULT_WORKSPACE_SLUG,
-  resolveSentinelWorkspaceRow,
-} from "@working-theory/database/tenancy";
-import { logger } from "@working-theory/observability";
-import {
-  clampWindowDays,
-  buildProjectListingDraftPatchSchema,
-  buildProjectListingSubmitSchema,
-  composeAddressLine,
-  composeFounderName,
-  flowAddressValueSchema,
-  flowConfigSchema,
-  listicleSiteAnswerQuestions,
-  listingProfile,
-  publicSiteAnswers,
-  withListicleQuestions,
-  LISTING_DIRECTORY_MAX_ENTRIES,
-  LISTING_ENTRY_TYPE_DEFAULT,
-  PROJECT_LISTING_CONCURRENT_LIMIT,
-  PROJECT_LISTING_NON_TERMINAL_STATUSES,
-  RESERVED_FLOW_SLUGS,
-} from "@working-theory/validation";
-import type {
-  FlowAddressValue,
-  FlowConfig,
-  ListingDirectoryResponse,
-  ListingEntryPublic,
-  ListingSiteAnswersConfig,
-  ProjectListing,
-  ProjectListingDraftPatchInput,
-  ProjectListingFaqs,
-  ProjectListingPublic,
-  ProjectListingQuestions,
-  ProjectListingStartInput,
-} from "@working-theory/validation";
-
-import { prisma } from "../lib/prisma.js";
-
-import {
-  consentConfigForSite,
-  MAX_CONSENT_KEYS,
-  recordConsent,
-  recordLegacyConsent,
-  requiredConsentUnmet,
-} from "./consent.js";
-import { routeLead, type SourceMeta } from "./lead-routing.js";
-import { listingConfigFor } from "./listing-config.js";
-
-// ─── The computed lifecycle state ───────────────────────────────────────────
-
-type ProjectListingStatus = ProjectListing["status"];
-
-/**
- * Resolve a row's LIFECYCLE status from its STORED status (#5033 D3).
- *
- * `closed` is the one state nothing writes. An `active` listing whose window
- * end has passed reads `closed`, here, on every read, with no job having run.
- * Storing it instead would need a scheduler whose failure leaves expired
- * listings publicly open — a silent, wrong-way failure. This makes that
- * unrepresentable.
- *
- * A FEATURED row is exempt (#5036 D6b). The operator's own products become
- * listing rows carrying `featured: true`, and such a row is not a time-boxed
- * validation experiment: it has no meaningful window and must not vanish from
- * the shelf because a date passed. Its `windowEndsAt` may be null, and it
- * reads `active` either way.
- *
- * A null window on a NON-featured `active` row is an ERROR, not a licence to
- * stay open forever: every real listing is time-boxed by design, and the whole
- * point of computing `closed` rather than storing it is that an expired
- * listing cannot linger. It is logged and read `closed` — failing toward the
- * closed shelf rather than toward a publicly-open listing nothing bounds.
- * `draft`, `requested` and `rejected` rows legitimately carry no window and
- * are not touched by any of this.
- */
-export function computeListingStatus(
-  storedStatus: string,
-  windowEndsAt: Date | null,
-  now: Date,
-  featured: boolean,
-): ProjectListingStatus {
-  if (storedStatus !== "active") return storedStatus as ProjectListingStatus;
-  if (featured) return "active";
-  if (windowEndsAt === null) {
-    logger.error(
-      { kind: "active_listing_without_window" },
-      "[project-listings] a non-featured active listing carries no window end; reading it closed",
-    );
-    return "closed";
-  }
-  return windowEndsAt.getTime() <= now.getTime() ? "closed" : "active";
-}
-
-// ─── Slug derivation (#5033 D2) ─────────────────────────────────────────────
-
-/** The `name`-derived slug's length cap. */
-const SLUG_MAX_LENGTH = 48;
-
-/** The slug a name with no alphanumeric content falls back to before suffixing. */
-const SLUG_FALLBACK = "listing";
-
-/**
- * Derive a slug from a listing `name`: lowercase, every non-alphanumeric run
- * to a single hyphen, trimmed of leading/trailing hyphens, truncated to 48.
- * A name carrying no alphanumerics at all (the payload allows it — `name` is
- * only bounded by length) falls back to `listing`, which the site-scoped
- * suffixing below then disambiguates like any other collision.
- */
-export function deriveListingSlug(name: string): string {
-  const base = name
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, SLUG_MAX_LENGTH)
-    .replace(/-+$/, "");
-  return base.length > 0 ? base : SLUG_FALLBACK;
-}
-
-/**
- * The most same-prefix slugs one create will read before giving up.
- *
- * The collision read is a prefix scan, and `base` derives from a fully
- * caller-controlled `name` on an ANONYMOUS route — a one-character name makes
- * the prefix match most of the site's slugs, and every accepted application
- * adds another row to that family. Unbounded, the cost of a create would grow
- * with the number of listings an attacker had already filed. Bounded, a
- * pathological family degrades to the same `slug_taken` 409 a genuine race
- * already produces, rather than to an ever-slower table scan.
- */
-const SLUG_COLLISION_SCAN_LIMIT = 200;
-
-/**
- * The most active rows the anonymous page-render read returns (#9243). No
- * consumer in this repo names a shelf size, so the bound is the one the other
- * anonymous listing read already carries — the directory's
- * `LISTING_DIRECTORY_MAX_ENTRIES` — rather than a second number to keep in step.
- */
-const PUBLIC_LISTINGS_MAX_ROWS = LISTING_DIRECTORY_MAX_ENTRIES;
-
-/**
- * The first free slug for `base` on this site. Uniqueness is already scoped
- * `@@unique([siteId, slug])`, so the suffix is too: a second "Atlas" on this
- * site becomes `atlas-2` even if `atlas` is taken on another.
- *
- * Two concurrent creates of the same name can still both resolve the same
- * free slug and race to the insert; the loser hits the unique constraint and
- * is reported as `slug_taken`, exactly as it was when the client supplied the
- * slug itself.
- *
- * #8661 D4 — a listing's slug becomes its diagnostic flow's slug on approval,
- * so the standard magnets' reserved slugs are treated as taken: a project
- * named "Contact" is stored at `contact-2`.
- */
-async function firstFreeSlug(siteId: string, base: string): Promise<string> {
-  const rows = await prisma.projectListing.findMany({
-    where: { siteId, slug: { startsWith: base } },
-    select: { slug: true },
-    take: SLUG_COLLISION_SCAN_LIMIT,
-  });
-  const taken = new Set<string | null>([...RESERVED_FLOW_SLUGS, ...rows.map((r) => r.slug)]);
-  if (!taken.has(base)) return base;
-
-  // Bounded by `taken.size + 1` iterations — one of the first `n` candidates
-  // is necessarily free.
-  let suffix = 2;
-  while (taken.has(`${base}-${suffix}`)) suffix += 1;
-  return `${base}-${suffix}`;
-}
-
-// ─── Row shape ──────────────────────────────────────────────────────────────
-
-const PROJECT_LISTING_SELECT = {
-  id: true,
-  siteId: true,
-  leadId: true,
-  slug: true,
-  name: true,
-  oneLiner: true,
-  problem: true,
-  solution: true,
-  url: true,
-  product: true,
-  commitment: true,
-  teamComposition: true,
-  faqs: true,
-  anythingElse: true,
-  address: true,
-  // #5279 — the structured parts beside the display string.
-  addressLine1: true,
-  addressLine2: true,
-  addressCity: true,
-  addressRegion: true,
-  addressPostalCode: true,
-  addressCountry: true,
-  questions: true,
-  // #5285 — the site's own answers, and the window the applicant asked for.
-  // `windowDays` rides the select because `submit` re-validates the assembled
-  // application, and `requestedWindowDays` is one of its fields now.
-  siteAnswers: true,
-  windowDays: true,
-  founderName: true,
-  // #5407 — the name parts beside the composed display string, the phone, and
-  // the resume-link verification stamp.
-  founderFirstName: true,
-  founderLastName: true,
-  founderEmail: true,
-  founderPhone: true,
-  emailVerifiedAt: true,
-  founderCompany: true,
-  headline: true,
-  logoMarkUrl: true,
-  logoWordmarkUrl: true,
-  featured: true,
-  status: true,
-  consentAt: true,
-  decidedAt: true,
-  decidedBy: true,
-  issueUrl: true,
-  experimentKey: true,
-  windowEndsAt: true,
-  createdAt: true,
-  updatedAt: true,
-} as const satisfies Prisma.ProjectListingSelect;
-
-type ProjectListingRow = Prisma.ProjectListingGetPayload<{
-  select: typeof PROJECT_LISTING_SELECT;
-}>;
-
-/**
- * The structured address parts of a row, or null (#5279).
- *
- * Exported because `project-listing-decision.ts` renders the same row shape
- * and must answer the same way — two readers guessing separately at what
- * "has parts" means is exactly how one of them starts emitting a half-filled
- * object.
- *
- * The rule is the composite's REQUIRED set: the five non-optional parts are
- * all present, or there are no parts. `addressLine2` is optional in the
- * fieldset, so it rides along when present and is simply absent when not. A
- * row written before #5279 has all six columns null and answers null here —
- * never a partial object reconstructed from `address`, which nothing in this
- * repo parses.
- *
- * `.safeParse` rather than a cast: these are six nullable TEXT columns, and
- * the emitted object must satisfy `flowAddressValueSchema` or the row fails
- * its own response schema downstream. A shape that somehow does not (a
- * `country` that is not an alpha-2 code, say) answers null rather than
- * putting an invalid address on the PUBLIC read.
- */
-export function addressPartsFromRow(row: {
-  addressLine1: string | null;
-  addressLine2: string | null;
-  addressCity: string | null;
-  addressRegion: string | null;
-  addressPostalCode: string | null;
-  addressCountry: string | null;
-}): FlowAddressValue | null {
-  if (
-    row.addressLine1 === null ||
-    row.addressCity === null ||
-    row.addressRegion === null ||
-    row.addressPostalCode === null ||
-    row.addressCountry === null
-  ) {
-    return null;
-  }
-  const parsed = flowAddressValueSchema.safeParse({
-    addressLine1: row.addressLine1,
-    ...(row.addressLine2 !== null && { addressLine2: row.addressLine2 }),
-    city: row.addressCity,
-    region: row.addressRegion,
-    postalCode: row.addressPostalCode,
-    country: row.addressCountry,
-  });
-  return parsed.success ? parsed.data : null;
-}
-
-/**
- * The site-answers object of a row, or null (#5285).
- *
- * Exported for the same reason `addressPartsFromRow` is: the operator's
- * decision payload renders the same row shape and must answer the same way.
- *
- * The column is `Json?`, so Prisma types it as `JsonValue` — an array, a
- * number and a string all satisfy it. Only ever written by
- * `draftUpdateData` from a body the site's own declarations validated, so a
- * row holding anything else is a row somebody wrote around this service.
- * A non-object answers null rather than being cast: a value of the wrong
- * SHAPE reaching the response schema would fail the whole read, and one
- * malformed row must not take a listing page down.
- *
- * Non-string members are dropped for the same reason — the store is
- * `Record<string, string>`, and what is handed back has to actually be one.
- */
-export function siteAnswersFromRow(value: Prisma.JsonValue | null): Record<string, string> | null {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-  return Object.fromEntries(
-    Object.entries(value).filter(
-      (entry): entry is [string, string] => typeof entry[1] === "string",
-    ),
-  );
-}
-
-/**
- * `now` is passed rather than read inside so one read renders every row of a
- * list against a single instant. `featuredEnabled` is the site's config
- * switch (#5033 D6): where a site has not enabled a featured shelf, the flag
- * never surfaces. The tenant dashboard passes `true` — an operator manages
- * the flag and must see what they set.
- */
-function toResponseRow(
-  row: ProjectListingRow,
-  waitlistCount: number,
-  now: Date,
-  featuredEnabled: boolean,
-): ProjectListing {
-  return {
-    id: row.id,
-    siteId: row.siteId,
-    leadId: row.leadId,
-    slug: row.slug,
-    name: row.name,
-    headline: row.headline,
-    oneLiner: row.oneLiner,
-    problem: row.problem,
-    solution: row.solution,
-    url: row.url,
-    product: row.product as ProjectListing["product"],
-    commitment: row.commitment as ProjectListing["commitment"],
-    teamComposition: row.teamComposition as ProjectListing["teamComposition"],
-    faqs: row.faqs as unknown as ProjectListingFaqs | null,
-    anythingElse: row.anythingElse,
-    address: row.address,
-    addressParts: addressPartsFromRow(row),
-    founderName: row.founderName,
-    founderFirstName: row.founderFirstName,
-    founderLastName: row.founderLastName,
-    founderEmail: row.founderEmail,
-    founderPhone: row.founderPhone,
-    // #5407 — the operator's verification filter at review. Null means "no
-    // opening of the resume link recorded", never "verification failed".
-    emailVerifiedAt: row.emailVerifiedAt ? row.emailVerifiedAt.toISOString() : null,
-    founderCompany: row.founderCompany,
-    questions: row.questions as unknown as ProjectListingQuestions | null,
-    logoMarkUrl: row.logoMarkUrl,
-    logoWordmarkUrl: row.logoWordmarkUrl,
-    // #5285 — UNFILTERED here, deliberately. This row shape serves the tenant
-    // dashboard and the founder's own draft read, both of which are entitled
-    // to every answer. The PUBLIC read is the one that must not carry an
-    // `operator-only` answer, and it narrows this through `publicSiteAnswers`
-    // in `publicProjectListings` — one filter, on the one read that publishes.
-    siteAnswers: siteAnswersFromRow(row.siteAnswers),
-    featured: featuredEnabled && row.featured,
-    // The row's OWN flag decides the closed exemption (#5036 D6b), not the
-    // site's `featuredEnabled` switch: that switch governs whether the flag
-    // SURFACES on a read, not whether the listing is time-boxed.
-    status: computeListingStatus(row.status, row.windowEndsAt, now, row.featured),
-    consentAt: row.consentAt.toISOString(),
-    decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
-    decidedBy: row.decidedBy,
-    issueUrl: row.issueUrl,
-    experimentKey: row.experimentKey,
-    windowEndsAt: row.windowEndsAt ? row.windowEndsAt.toISOString() : null,
-    waitlistCount,
-    createdAt: row.createdAt.toISOString(),
-    updatedAt: row.updatedAt.toISOString(),
-  };
-}
-
-/**
- * `waitlistCount` per row, keyed by `experimentKey`.
- *
- * Since #5036 D6d the listing stores the experiment's KEY rather than its id,
- * and that key is the same string `WaitlistScore.experimentKey` holds — so the
- * `WaitlistExperiment` read that existed purely to translate one into the
- * other is gone. ONE `WaitlistScore.groupBy` over every DISTINCT key remains
- * (#9243): one read across every returned row (`waitlist-dashboard.ts`'s
- * discipline), however many experiments the page carries — the per-key
- * `count()` fan-out this replaced ran on the anonymous public read.
- */
-async function attachWaitlistCounts(
-  siteId: string,
-  rows: readonly Pick<ProjectListingRow, "experimentKey">[],
-): Promise<Map<string, number>> {
-  const experimentKeys = [
-    ...new Set(rows.map((r) => r.experimentKey).filter((v): v is string => v != null)),
-  ];
-  if (experimentKeys.length === 0) return new Map();
-
-  // fence: workspaceId === the scope id this query already filters siteId by
-  // (workspace_site_agree CHECK, 20260922120000_tenancy_fence). Filtering the
-  // CONSTRAINED column makes the scope correct by construction; the format
-  // CHECK makes a raw alias match nothing rather than by accident.
-  //
-  // What that id IS depends on the caller, and only two of the six are
-  // route-resolved: `listProjectListings` and `getProjectListing` receive
-  // `tenant.workspaceId`, so for them this is an isolation control.
-  // `listMyProjectListings` and the two `publicProjectListings` call sites
-  // pass a ProjectListing row's OWN `siteId`, so for them it is a
-  // CONSISTENCY control — the count agrees with the row it is reported
-  // against — exactly as `project-listing-decision.ts#waitlistCountFor`
-  // spells out (#6258 § 1.6 / § 5 D8, security review L-2).
-  //
-  // A key with no score rows is absent from a GROUP BY result; `waitlistCountFor`
-  // reads it as 0, the same value the per-key `count()` produced.
-  const grouped = await prisma.waitlistScore.groupBy({
-    by: ["experimentKey"],
-    where: { siteId, workspaceId: siteId, experimentKey: { in: experimentKeys } },
-    _count: { _all: true },
-  });
-  return new Map(grouped.map((g) => [g.experimentKey, g._count._all]));
-}
-
-function waitlistCountFor(
-  row: Pick<ProjectListingRow, "experimentKey">,
-  counts: Map<string, number>,
-): number {
-  return row.experimentKey ? (counts.get(row.experimentKey) ?? 0) : 0;
-}
-
-// ─── The founder's key (#5036 D7) ──────────────────────────────────────────
-
-/**
- * Normalize the email a founder is counted under.
- *
- * Trim and lowercase, so `Ada@Example.com ` and `ada@example.com` are one
- * founder rather than two. Postgres text equality is case-sensitive, so
- * without this the concurrent-listing limit is evaded by holding down shift.
- *
- * Deliberately NOT stripping plus-tags: `ada+two@example.com` still counts as
- * a different founder. Plus-addressing is a legitimate, widely-used feature
- * and treating it as evasion would refuse real applicants; closing that gap
- * properly needs a verified email, which this anonymous surface does not have.
- */
-function normalizeFounderEmail(email: string): string {
-  return email.trim().toLowerCase();
-}
-
-/**
- * How long an unsubmitted draft occupies one of a founder's two slots
- * (#5036 D7).
- *
- * Drafts MUST count, or the limit is evaded by never submitting. But
- * `founderEmail` is unverified on an anonymous surface, so anyone can open a
- * draft in a stranger's name — and a draft that counted forever would let two
- * anonymous requests lock a named founder out of ever applying, with no
- * operator remedy (there is no route that deletes a listing; PR #5042 security
- * review, finding 1).
- *
- * Bounding the window keeps D7's intent — an application in progress holds a
- * slot, so not submitting evades nothing — while making that lockout expire on
- * its own. Fourteen days is far longer than a ten-step form takes and far
- * shorter than "forever".
- *
- * This bounds the QUOTA impact, not retention: an abandoned draft still holds
- * the founder's name, email and address in the table. A retention sweep is a
- * separate unit and is not in this change.
- */
-const DRAFT_HOLDS_A_SLOT_DAYS = 14;
-
-// ─── The resume token (#5036 D1) ───────────────────────────────────────────
-
-/**
- * The token's entropy, in bytes. 256 bits — the same floor the repo's other
- * capability tokens carry, and far beyond guessing at any request rate the
- * `leadsScope` rate limiter permits.
- */
-const RESUME_TOKEN_BYTES = 32;
-
-/**
- * Mint an opaque resume token. Returned to the caller EXACTLY once, at
- * `start`: only its digest is stored, so the server cannot hand it back a
- * second time and an attacker who reads the table still cannot present one.
- */
-function mintResumeToken(): string {
-  return randomBytes(RESUME_TOKEN_BYTES).toString("base64url");
-}
-
-/**
- * What the column holds. A plain sha-256 with no salt and no stretching is
- * correct here and a KDF would not be: the input is 256 bits of CSPRNG output,
- * not a human-chosen secret, so there is no dictionary to precompute and
- * nothing for a work factor to slow down.
- */
-function hashResumeToken(token: string): string {
-  return createHash("sha256").update(token).digest("hex");
-}
-
-// ─── The email-verification nonce (#5407) ──────────────────────────────────
-
-/**
- * Mint the nonce that PROVES the founder read mail sent to `founderEmail`.
- *
- * WHY A SECOND CREDENTIAL EXISTS AT ALL, since the obvious design is to reuse
- * the resume token the emailed link already carries. That design cannot work:
- * `start` returns the resume token in its own 201 body, to whoever posted the
- * form. The emailed link is a SECOND COPY of a credential the applicant
- * already holds, so keying verification on it would let two HTTP calls — open
- * a draft under a stranger's address, take the token out of the response,
- * present it back — forge the stamp with no mailbox involved. Found by this
- * change's own security review, before it shipped.
- *
- * This nonce closes that because of where it does NOT go. It is minted here,
- * digested into `emailVerifyNonceHash`, and returned to exactly one caller —
- * `start`, which hands it to `sendListingResumeLink` and to nothing else. It
- * is in no response body, no log line, and no browser that filled the form.
- * The only way to hold it is to have read the email.
- *
- * Same 256 bits as the resume token, for the same reason.
- */
-function mintVerifyNonce(): string {
-  return randomBytes(RESUME_TOKEN_BYTES).toString("base64url");
-}
-
-/**
- * What `emailVerifyNonceHash` holds. The same plain sha-256 as
- * `hashResumeToken`, for the same reason — the input is CSPRNG output, not a
- * human-chosen secret — and kept as its own function rather than aliased so
- * no call site has to read "resume token" while meaning the nonce.
- */
-function hashVerifyNonce(nonce: string): string {
-  return createHash("sha256").update(nonce).digest("hex");
-}
-
-/**
- * Resolve the ONE draft a token grants access to (#5036 D1).
- *
- * Both the id and the token's digest are in the `where`, so a valid token
- * presented against a different listing's id resolves to nothing: a token is
- * bound to one listing and grants access to no other. `status: "draft"` is in
- * there too — `submit` clears the digest, so a token that leaks after
- * submission is inert twice over.
- *
- * The comparison is an equality test on a 256-bit digest inside Postgres.
- * There is no application-level secret compare to make constant-time, and no
- * practical timing signal in matching digests of that width.
- */
-async function findDraftByToken(
-  id: string,
-  resumeToken: string,
-): Promise<ProjectListingRow | null> {
-  return prisma.projectListing.findFirst({
-    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
-    select: PROJECT_LISTING_SELECT,
-  });
-}
-
-// ─── start (POST, anonymous) ────────────────────────────────────────────────
-
-/**
- * `start` has one failure mode of its own to report (#5275): a `consents`
- * map that does not GRANT every purpose the site's registry marks required —
- * declined, or simply absent. The legacy literal says the founder consented;
- * a `false` (or nothing) beside it for the required purpose says they did
- * not — the body contradicts itself, and the row must not be created on it
- * (it would go on to publish the founder's address against a recorded
- * decline, or with no evidence row at all). An oversized map is the same
- * 400. Everything else is as before: the site's config falls back to the
- * platform defaults rather than erroring, and a Prisma failure is a 500
- * through the framework. The Lead write — the step that used to give this
- * operation a `persist_failed`/`config_missing` surface — moved to `submit`.
- */
-export type StartProjectListingDraftResult =
-  | {
-      ok: true;
-      id: string;
-      resumeToken: string;
-      /**
-       * #5407 — the email-verification nonce, for the RESUME-EMAIL BUILDER
-       * and for nothing else.
-       *
-       * A sibling of the result rather than a field of anything the route
-       * hands to a response schema, deliberately (lesson 05): `start`'s 201
-       * body is `projectListingStartResponseSchema`, which is `.strict()` and
-       * carries `id` and `resumeToken` only. That route's request and
-       * response shapes are a declared hard floor and are unchanged — this
-       * value reaches `sendListingResumeLink` from the route's local
-       * variable and never touches the wire.
-       */
-      verifyNonce: string;
-    }
-  | { ok: false; error: { kind: "invalid_input"; message: string } }
-  // #6203 — the resolved `siteId` names no workspace this database holds.
-  // Distinct from `invalid_input` (a body problem): this is a server-side
-  // tenancy misconfiguration, and the route answers 503, never 400.
-  | { ok: false; error: { kind: "tenant_unresolved"; message: string } };
-
-/**
- * Resolves an ALREADY-RESOLVED `siteId` (never a caller-supplied string — see
- * `startProjectListingDraft`'s own header) to its workspace id (#6203).
- *
- * Mirrors `apps/api/src/lib/site.ts`'s `resolveSiteWorkspaceId()` — the SAME
- * two-branch alias mapping the #6203 migration's own backfill `CASE`
- * encodes: the literal alias `"default"` resolves to the seeded sentinel
- * workspace IFF that row exists and hangs off the sentinel Organization;
- * any other alias resolves only by exact `workspaces.id` equality. Kept
- * LOCAL and PARAMETERIZED rather than reusing `resolveSiteWorkspaceId()`
- * directly: that function is hardwired to `currentSiteId()`
- * (`AILK_SITE_ID`), while a `ProjectListing`'s `siteId` can legitimately
- * name a DIFFERENT site under a multi-key deployment
- * (`listing-config.ts#siteIdForPublicKey`'s `SiteListingConfig.publicKey`
- * path) — the workspace stamped here must correspond to the SAME site the
- * row's own `siteId` already names, not the deployment's default. NOT
- * memoized (unlike `resolveSiteWorkspaceId()`): a different `siteId` per
- * call means the sentinel-only cache that function keeps would be wrong
- * here.
- */
-async function resolveWorkspaceIdForSite(siteId: string): Promise<string | null> {
-  if (siteId === DEFAULT_WORKSPACE_SLUG) {
-    const row = await resolveSentinelWorkspaceRow(prisma);
-    return row?.id ?? null;
-  }
-  const row = await prisma.workspace.findUnique({ where: { id: siteId } });
-  return row ? siteId : null;
-}
-
-/**
- * #6314 — resolve the capturing listicle magnet, SERVER-SIDE, from the slug
- * the body named.
- *
- * All four terms in ONE query, and only `slug` came from the caller:
- * `siteId` and `workspaceId` are the value `startProjectListingDraft` has
- * already resolved from the site's PUBLIC KEY (`siteIdForPublicKey`, then
- * `resolveWorkspaceIdForSite`), never from the body. `@@unique([siteId,
- * slug])` makes the match at most one row.
- *
- * `kind: "listicle"` is LOAD-BEARING, not cosmetic: without it a visitor
- * could name a contact or newsletter magnet's slug — both are public path
- * segments — and file an application against it.
- *
- * NO `status` term, deliberately. A magnet can be flipped `live -> draft`
- * while a visitor is mid-application, and dropping attribution on that flip
- * would silently punish the operator's own edit. The cost is bounded: a draft
- * magnet's slug is the operator's own, the resulting row lands only in that
- * operator's own workspace, and the Applications wire row carries `status`
- * so a never-submitted row stays legible as one.
- *
- * Returns `unresolved` for a slug that names nothing, names another
- * workspace's magnet, or names a magnet of the wrong kind — those three are
- * deliberately indistinguishable, and all three write NULL.
- *
- * `failed` is a FOURTH outcome and is NOT one of them: the lookup itself threw.
- * It also writes NULL, so the wire is unchanged, but the caller must not
- * describe it as "no such magnet" — during a database incident that would send
- * an operator hunting a magnet-configuration problem that does not exist. This
- * function has already logged the accurate line by the time it returns `failed`.
- */
-type CapturingFlowResolution =
-  | { kind: "resolved"; id: string }
-  | { kind: "unresolved" }
-  | { kind: "failed" };
-
-async function resolveCapturingFlowId(
-  workspaceId: string,
-  slug: string,
-): Promise<CapturingFlowResolution> {
-  try {
-    const row = await prisma.flowDefinition.findFirst({
-      where: {
-        slug,
-        // Both scope terms, both from the value resolved above. They are equal
-        // by the `flow_definitions_workspace_site_agree` CHECK the fence added;
-        // carrying both is what makes the scope explicit at the query rather
-        // than implied by a constraint a future migration could move.
-        siteId: workspaceId,
-        workspaceId,
-        kind: "listicle",
-      },
-      select: { id: true },
-    });
-    return row === null ? { kind: "unresolved" } : { kind: "resolved", id: row.id };
-  } catch (err) {
-    // The lookup is OPTIONAL attribution on a never-gate anonymous route: an
-    // unavailable read (statement timeout, connection blip) must degrade
-    // exactly like a slug that names nothing — NULL, and the application is
-    // kept — rather than turn into a 500 that loses a real founder's
-    // submission. Both outcomes are NULL on the row, so this line is the only
-    // thing that tells an operator "lookup failed" from "no such magnet".
-    // PII-SAFE, same idiom as the unresolved-slug line below: routing
-    // metadata plus the caught error; never the founder's identity, the
-    // resume token or the verify nonce (none is in scope here).
-    logger.warn(
-      { workspaceId, capturedByFlowSlug: slug, err },
-      "[project-listings] capturedByFlowSlug lookup failed; application stored unattributed",
-    );
-    return { kind: "failed" };
-  }
-}
-
-/**
- * Create a `draft` from step one — the founder's name, email and consent.
- *
- * `siteId` is a PARAMETER, not a field of `input` (#5048 D2). The payload
- * names the site by its public key and the route resolves it through
- * `siteIdForPublicKey` before calling here, so no request body carries a
- * tenant identifier and nothing a caller sends can choose which site an
- * application is filed against.
- *
- * The site's own terms are read SERVER-SIDE and stamped now, so a listing is
- * granted the terms that were in force when it applied; nothing in `input`
- * can reach them. The applicant's *requested* window is clamped here, not
- * rejected, because a founder who could post their own bound could post an
- * unbounded one.
- *
- * No slug yet: it is derived from `name` at SUBMIT (#5033 D2), which is the
- * first moment a name exists.
- *
- * WORKSPACE STAMP (#6203). The row's `workspaceId` is resolved from `siteId`
- * itself (`resolveWorkspaceIdForSite` above) — never a client-supplied
- * value, and never a fixed deployment default. An unresolved result rejects
- * the write before any row is created (spec AC-4).
- */
-export async function startProjectListingDraft(
-  siteId: string,
-  input: ProjectListingStartInput,
-): Promise<StartProjectListingDraftResult> {
-  const workspaceId = await resolveWorkspaceIdForSite(siteId);
-  if (workspaceId === null) {
-    return {
-      ok: false,
-      error: {
-        kind: "tenant_unresolved",
-        message: "This site is not configured to accept applications.",
-      },
-    };
-  }
-
-  const { requestedWindowDays } = input;
-  // #5407 — the NOT NULL display column. `composeFounderName` builds it from
-  // the PARTS wherever both are written (even beside a `founderName` the body
-  // also sent, so the stored line and the stored parts can never disagree),
-  // and stores a line sent on its own verbatim. ONE WAY ONLY: nothing here or
-  // anywhere else derives parts back out of a line. The schema has already
-  // refused a body carrying neither shape, so this always produces a string.
-  const founderName = composeFounderName(input);
-  const founderEmail = normalizeFounderEmail(input.founderEmail);
-
-  const listingConfig = await listingConfigFor(siteId);
-  const windowDays = clampWindowDays(requestedWindowDays, listingConfig);
-
-  // #5275 — refuse BEFORE the row exists: a required purpose not granted
-  // (declined or absent) is a body that contradicts its own `consent: true`,
-  // and an oversized map is not a form's answer.
-  const consentConfig = await consentConfigForSite(siteId);
-  if (input.consents) {
-    if (Object.keys(input.consents).length > MAX_CONSENT_KEYS) {
-      return {
-        ok: false,
-        error: {
-          kind: "invalid_input",
-          message: `consents carries more than ${MAX_CONSENT_KEYS} purposes`,
-        },
-      };
-    }
-    const unmet = requiredConsentUnmet(consentConfig, input.consents);
-    if (unmet !== undefined) {
-      return {
-        ok: false,
-        error: {
-          kind: "invalid_input",
-          message: `required consent purpose "${unmet}" was not granted`,
-        },
-      };
-    }
-  }
-
-  const resumeToken = mintResumeToken();
-  // #5407 — minted on EVERY draft, whether or not the site sends the resume
-  // email. `start` cannot know: the send is decided asynchronously inside
-  // `sendListingResumeLink`, against the site's own config. A site running no
-  // resume email therefore stores a nonce nobody is ever handed, and nothing
-  // on that row can ever verify — which is the correct outcome rather than a
-  // gap, because no one has read anything at that address.
-  const verifyNonce = mintVerifyNonce();
-  // #5275 — the row and its grant record land in ONE transaction: from here
-  // on `consentAt` and the ConsentGrant row are stamped by the SAME
-  // affirmative act, and a grant write that fails takes the row with it
-  // rather than stranding a "consented" listing with no evidence (security
-  // review, Medium 2). A body carrying `consents` records the wording the
-  // founder read (resolved server-side from the same registry the renderer
-  // used, D7); a body carrying only the legacy `consent: true` literal
-  // records one grant marked unrecoverable (D11) rather than today's
-  // wording, which nobody was shown.
-  const consents = input.consents;
-  const locale = input.locale ?? "en";
-  // #6314 — the capturing magnet, resolved SERVER-SIDE from the slug the body
-  // named. Only runs when the key is present, so an existing caller costs
-  // nothing; when it is, it is one probe of `@@unique([siteId, slug])`.
-  const capture =
-    input.capturedByFlowSlug === undefined
-      ? undefined
-      : await resolveCapturingFlowId(workspaceId, input.capturedByFlowSlug);
-  const capturedByFlowId = capture?.kind === "resolved" ? capture.id : null;
-  const row = await prisma.$transaction(async (tx) => {
-    const created = await tx.projectListing.create({
-      data: {
-        // #6254 AC-3/AC-6/AC-10 — the RESOLVED workspace id, not the raw
-        // `siteId` parameter: `project_listings` now requires
-        // `workspace_id = site_id`
-        // (database/migrations/20260922120000_tenancy_fence), and this
-        // column is the isolation key every downstream reader (including
-        // `submitProjectListingDraft`'s `routeLead` call) reads back as
-        // `draft.siteId`. `siteId` (the public-facing param, possibly the
-        // raw `"default"` alias) is still used above to look up
-        // `listingConfigFor`/`consentConfigForSite` — those are independent,
-        // unfenced reads keyed on the site concept, not this row.
-        siteId: workspaceId,
-        // #6203 — the isolation key, resolved above from this SAME siteId.
-        workspaceId,
-        founderName,
-        // #5407 — the parts as sent, beside the composed line. Absent where a
-        // caller sent only a display line, which is the shape every row
-        // written before #5407 carries; nothing here ever splits that line.
-        ...(input.founderFirstName !== undefined && {
-          founderFirstName: input.founderFirstName,
-        }),
-        ...(input.founderLastName !== undefined && {
-          founderLastName: input.founderLastName,
-        }),
-        founderEmail,
-        ...(input.founderPhone !== undefined && { founderPhone: input.founderPhone }),
-        status: "draft",
-        consentAt: new Date(),
-        resumeTokenHash: hashResumeToken(resumeToken),
-        emailVerifyNonceHash: hashVerifyNonce(verifyNonce),
-        windowDays,
-        // #6314 — WRITE-ONCE, and only here. `draftUpdateData` never learns
-        // this key, so no patch body and no submit can re-attribute a draft
-        // to a different magnet after the fact — not by its holder, and not
-        // by anyone who obtains its resume token.
-        ...(capturedByFlowId !== null && { capturedByFlowId }),
-      },
-      select: { id: true },
-    });
-    const subject = { siteId, subjectType: "project_listing", subjectId: created.id };
-    // #8438 D3 — a listing names no magnet slug (ProjectListing carries no
-    // link to its flow), so `magnet` would be unprovable: the source is `api`.
-    if (consents) {
-      await recordConsent(
-        { ...subject, personId: null, source: "api", locale, config: consentConfig, consents },
-        tx,
-      );
-    } else {
-      await recordLegacyConsent({ ...subject, source: "api", config: consentConfig }, tx);
-    }
-    return created;
-  });
-
-  // #6314 — an unresolved slug is the operator's ONLY signal, precisely
-  // because the response deliberately carries none (a distinguishable error
-  // would be a cross-workspace magnet-slug oracle on an anonymous route).
-  // Without this line, a mis-wired or stale consuming site yields a
-  // permanently empty Applications list an operator cannot tell from "no
-  // applications yet".
-  //
-  // PII-SAFE, in this route family's existing idiom: routing metadata only.
-  // Never `founderEmail`, `founderName`, the resume token or the verify
-  // nonce — the last two never leave this function except inside the email.
-  // ONLY the `unresolved` outcome, never `failed`. Both store NULL and both
-  // return the same 201, but only one of them establishes "no listicle magnet
-  // of that slug in this site". Asserting it on the throw path would put a
-  // false magnet-configuration signal into the log during a database incident,
-  // which is exactly when an operator is grepping for a cause. `failed` has its
-  // own, accurate line, emitted inside `resolveCapturingFlowId`.
-  if (capture?.kind === "unresolved") {
-    logger.warn(
-      {
-        siteId,
-        listingId: row.id,
-        capturedByFlowSlug: input.capturedByFlowSlug,
-      },
-      "[project-listings] capturedByFlowSlug resolved to no listicle magnet in this site; application stored unattributed",
-    );
-  }
-
-  return { ok: true, id: row.id, resumeToken, verifyNonce };
-}
-
-// ─── verify-email (POST, anonymous, nonce-gated) ───────────────────────────
-
-/**
- * THE NONCE HAS NO EXPIRY, and shares the resume token's lifetime exactly: it
- * lives until `submit` clears both digests, and an unsubmitted draft is never
- * swept (`DRAFT_HOLDS_A_SLOT_DAYS` bounds the QUOTA a draft occupies, not the
- * row). A resume email sitting in a mailbox for a year still verifies that
- * draft a year later.
- *
- * That is acceptable rather than overlooked, and for one reason: the same
- * message carries the resume token, so anyone who can read it can already
- * resume and submit the draft outright. A TTL would have to cover both
- * credentials to mean anything, and that is a change to #5048's resume
- * contract rather than to this column.
- *
- * It is also NOT cleared on a successful stamp — the fallback read below
- * needs it to answer a repeat call idempotently.
- */
-export type VerifyProjectListingDraftEmailResult =
-  | { ok: true; value: { id: string; emailVerifiedAt: Date } }
-  | { ok: false; error: { kind: "not_found"; message: string } };
-
-/**
- * Record that somebody who can read mail at `founderEmail` opened this
- * draft's emailed link (#5407).
- *
- * THE PRECISION IN THAT SENTENCE IS DELIBERATE. It is evidence about the
- * ADDRESS, not about the person driving the draft. Whoever posted `start`
- * chose the address and holds the resume token, so an attacker can open a
- * draft under a stranger's address and the platform will mail that stranger a
- * link; if they click it, the attacker's draft is stamped. Binding the stamp
- * to the application's CONTENT, or to `ownerUserId`, is what would close that,
- * and neither is in this issue. What the stamp rules out is the case it was
- * built for: a stamp obtained with no mailbox involved at all.
- *
- * WHAT IT PROVES, and why it takes TWO credentials. The caller must present
- * both the draft's resume token and its verification NONCE, and only the
- * second one carries the proof:
- *
- *   - the RESUME TOKEN says "you opened this draft". `start` returns it in
- *     its own 201 body, so anyone who posted the form has it. On its own it
- *     proves nothing about an address, and a design that stamped on it alone
- *     would be forgeable in two HTTP calls — open a draft under a stranger's
- *     address, take the token out of the response, present it back. That is
- *     the design this one replaced, caught by its own security review.
- *   - the NONCE says "you read mail sent to `founderEmail`". It is minted at
- *     `start`, digested onto the row, and handed to nothing but
- *     `sendListingResumeLink`. It is in no response body and no log line, and
- *     the only place it exists outside this server is the `?verify=`
- *     parameter of the link inside the email.
- *
- * The token stays in the guard anyway: it costs one term in a `where` and it
- * means a nonce that somehow leaked alone still opens nothing.
- *
- * What it does NOT say is who the founder is. `ownerUserId` (#5295) is the
- * column that carries an identity claim and still needs a signed-in user
- * whose own address the auth system verified.
- *
- * WRITE-ONCE, BY COMPARE-AND-SWAP. `emailVerifiedAt: null` is in the `where`,
- * so the stamp is the atomic transition and two concurrent openings of the
- * same link produce one stamp between them rather than a last-writer-wins
- * race. A repeat opening reads back the FIRST stamp, so the call is
- * idempotent in its effect and in its answer. It is not indistinguishable —
- * a repeat answers an older timestamp than "now" — and does not need to be:
- * only a holder of both credentials can make the call at all, and they are
- * the one person entitled to know when their own link was first opened.
- *
- * ONE ANSWER FOR EVERY FAILURE. A wrong token, a wrong nonce, a credential
- * bound to a different listing, an unknown id and an already-submitted row
- * are all `not_found` — exactly what `patch` and `submit` answer. The
- * anonymous surface must not distinguish "exists but not yours" from "does
- * not exist", and a verification route least of all: its whole input is a
- * guessable-in-principle id and two secrets, so a distinguishable response
- * would turn it into an oracle for which drafts exist and, worse, into a
- * nonce-guessing feedback channel.
- *
- * Neither credential is ever logged, returned, or compared in application
- * code — only their sha-256 digests reach the query.
- */
-export async function verifyProjectListingDraftEmail(
-  id: string,
-  resumeToken: string,
-  verifyNonce: string,
-): Promise<VerifyProjectListingDraftEmailResult> {
-  const guard = {
-    id,
-    status: "draft",
-    resumeTokenHash: hashResumeToken(resumeToken),
-    emailVerifyNonceHash: hashVerifyNonce(verifyNonce),
-  };
-  const emailVerifiedAt = new Date();
-
-  const stamped = await prisma.projectListing.updateMany({
-    where: { ...guard, emailVerifiedAt: null },
-    data: { emailVerifiedAt },
-  });
-  if (stamped.count > 0) return { ok: true, value: { id, emailVerifiedAt } };
-
-  // Zero rows means one of two things, and they answer differently: the draft
-  // is already stamped (idempotent success, carrying the FIRST stamp), or the
-  // credentials do not open this draft (`not_found`). This read is what tells
-  // them apart, and it is gated by the same four terms the write was — so it
-  // cannot report a draft the caller's credentials do not open.
-  const row = await prisma.projectListing.findFirst({
-    where: guard,
-    select: { id: true, emailVerifiedAt: true },
-  });
-  if (row?.emailVerifiedAt) {
-    return { ok: true, value: { id: row.id, emailVerifiedAt: row.emailVerifiedAt } };
-  }
-  return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-}
-
-// ─── patch (PATCH, anonymous, token-gated) ──────────────────────────────────
-
-export type PatchProjectListingDraftResult =
-  | { ok: true; value: ProjectListing }
-  | {
-      ok: false;
-      error:
-        | { kind: "not_found"; message: string }
-        | { kind: "invalid_input"; message: string };
-    };
-
-/**
- * What `draftUpdateData` cannot read off the patch body (#5285).
- *
- * Both members are the SERVER's, and that is why they are a second argument
- * rather than two more payload fields: `windowDays` is the applicant's
- * request already clamped against the site's own maximum, and
- * `storedSiteAnswers` is what is on the row, which the merge needs and a
- * request body must never be able to supply.
- */
-interface DraftUpdateContext {
-  /** The clamped window, when the patch asked for one. */
-  windowDays?: number;
-  /** The answers already stored, for the merge. */
-  storedSiteAnswers?: Record<string, string>;
-}
-
-/**
- * Translate a validated partial application into a Prisma update.
- *
- * Only the keys the caller actually sent are written: an absent key is
- * `undefined`, which Prisma omits from the UPDATE, so patching one field
- * cannot blank the nine the founder filled in on earlier steps.
- *
- * #5279 — THIS IS WHERE THE DISPLAY ADDRESS IS COMPOSED, and the only place.
- * `address` is a union of the legacy display STRING and the structured PARTS
- * (`flowAddressValueSchema`), and the two branches write different columns:
- *
- *   string → `address` verbatim, no part column touched. A founder who typed
- *            a line gets that line stored exactly as typed, and a draft
- *            written before #5279 keeps patching as it always did.
- *   parts  → the six part columns, PLUS `address` composed from them by
- *            `composeAddressLine`.
- *
- * The derivation runs ONE WAY ONLY. Nothing anywhere derives parts from a
- * line: address parsing guesses, and a wrong guess silently corrupts the
- * party identification a listing's privacy notice points at (#5036 D6), with
- * nothing on the row to mark it as invented.
- */
-function draftUpdateData(
-  patch: ProjectListingDraftPatchInput,
-  context: DraftUpdateContext,
-): Prisma.ProjectListingUpdateInput {
-  return {
-    ...(patch.name !== undefined && { name: patch.name }),
-    ...(patch.headline !== undefined && { headline: patch.headline }),
-    ...(patch.oneLiner !== undefined && { oneLiner: patch.oneLiner }),
-    ...(patch.problem !== undefined && { problem: patch.problem }),
-    ...(patch.solution !== undefined && { solution: patch.solution }),
-    ...(patch.url !== undefined && { url: patch.url }),
-    ...(patch.product !== undefined && { product: patch.product }),
-    ...(patch.commitment !== undefined && { commitment: patch.commitment }),
-    ...(patch.teamComposition !== undefined && { teamComposition: patch.teamComposition }),
-    ...(patch.faqs !== undefined && { faqs: patch.faqs as unknown as Prisma.InputJsonValue }),
-    ...(patch.anythingElse !== undefined && { anythingElse: patch.anythingElse }),
-    ...(patch.address !== undefined &&
-      (typeof patch.address === "string"
-        ? { address: patch.address }
-        : {
-            address: composeAddressLine(patch.address),
-            addressLine1: patch.address.addressLine1,
-            addressLine2: patch.address.addressLine2 ?? null,
-            addressCity: patch.address.city,
-            addressRegion: patch.address.region,
-            addressPostalCode: patch.address.postalCode,
-            addressCountry: patch.address.country,
-          })),
-    ...(patch.founderCompany !== undefined && { founderCompany: patch.founderCompany }),
-    ...(patch.questions !== undefined && {
-      questions: patch.questions as unknown as Prisma.InputJsonValue,
-    }),
-    ...(patch.logoMarkUrl !== undefined && { logoMarkUrl: patch.logoMarkUrl }),
-    ...(patch.logoWordmarkUrl !== undefined && {
-      logoWordmarkUrl: patch.logoWordmarkUrl,
-    }),
-    // #5285 — the applicant's REQUEST, already clamped by the caller against
-    // the site's own `maxWindowDays`. It is written to `windowDays`, the same
-    // column `start` writes, because there is one window per listing and the
-    // screen that asks for it is the site's choice of screen, not a second
-    // field. Clamped and not refused, for the reason `startProjectListingDraft`
-    // gives: a founder who could post their own bound could post an unbounded
-    // one.
-    ...(context.windowDays !== undefined && { windowDays: context.windowDays }),
-    // #5285 — MERGED, never replaced. A founder patches one screen at a time,
-    // so a body carrying screen four's two answers must not blank screen
-    // two's. The incoming keys win; everything already stored is carried.
-    // Every incoming id was checked against the site's declarations by the
-    // compiled patch schema, so nothing undeclared can enter here.
-    ...(patch.siteAnswers !== undefined && {
-      siteAnswers: {
-        ...context.storedSiteAnswers,
-        ...patch.siteAnswers,
-      } as Prisma.InputJsonValue,
-    }),
-  };
-}
-
-/**
- * The site-answer declarations a CAPTURED draft is checked against (#7521 D2):
- * the site's own, plus the eligible Application fields of the LIVE listicle
- * that captured it (`listicleSiteAnswerQuestions`). A draft listicle accepts
- * no answers (SEC-7521-B1).
- *
- * Fails CLOSED: a missing listicle or a config that no longer parses logs at
- * warn and answers the site's declarations alone, so an id nobody declared
- * is still a 400.
- */
-async function capturedDraftSiteAnswers(
-  siteId: string,
-  listingId: string,
-  capturedByFlowId: string,
-  siteDeclared: ListingSiteAnswersConfig,
-): Promise<ListingSiteAnswersConfig> {
-  const listicle = await prisma.flowDefinition.findFirst({
-    where: {
-      id: capturedByFlowId,
-      siteId,
-      workspaceId: siteId,
-      kind: "listicle",
-      status: "live",
-    },
-    select: { config: true },
-  });
-  const config = listicle ? flowConfigSchema.safeParse(listicle.config) : null;
-  if (!config?.success) {
-    logger.warn(
-      { siteId, listingId },
-      "[project-listings] a captured draft's listicle is not live or its config does not parse; accepting the site's own answers only",
-    );
-    return siteDeclared;
-  }
-  return withListicleQuestions(siteDeclared, listicleSiteAnswerQuestions(config.data));
-}
-
-/**
- * Merge a partial application into a draft and hand back the merged row.
- *
- * Enforces NO completeness — that is `submit`'s job alone, and the split is
- * the whole point of the lifecycle. Returning the merged row is what makes a
- * step's save verifiable by the client that wrote it.
- */
-export async function patchProjectListingDraft(
-  id: string,
-  resumeToken: string,
-  body: unknown,
-): Promise<PatchProjectListingDraftResult> {
-  // The word caps are the SITE's (#5048 D6), so the body cannot be validated
-  // until the draft's site is known. This read resolves that and nothing
-  // else — it is not the write's guard, which stays the compare-and-swap
-  // below. A caller holding no valid token never gets past it, so a bad token
-  // still answers `not_found` before any body is inspected.
-  const owner = await prisma.projectListing.findFirst({
-    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
-    // #5285 — `siteAnswers` rides this read because the write MERGES into it
-    // (a founder patches one screen at a time). It is still not the write's
-    // guard: the compare-and-swap below is, and a concurrent patch of a
-    // DIFFERENT screen can still lose its answers to this one, exactly as it
-    // can already lose a column. The store is one row's worth of one
-    // founder's own form, not a shared document.
-    //
-    // #7521 D2 — `capturedByFlowId` rides it too: a draft a listicle captured
-    // may answer that listicle's own Application fields.
-    select: { siteId: true, siteAnswers: true, capturedByFlowId: true },
-  });
-  if (!owner) {
-    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-  }
-
-  const listingConfig = await listingConfigFor(owner.siteId);
-  const siteAnswers =
-    owner.capturedByFlowId === null
-      ? listingConfig.siteAnswers
-      : await capturedDraftSiteAnswers(
-          owner.siteId,
-          id,
-          owner.capturedByFlowId,
-          listingConfig.siteAnswers,
-        );
-  const parsed = buildProjectListingDraftPatchSchema(
-    listingConfig.wordCaps,
-    listingConfig.collectedFields,
-    siteAnswers,
-  ).safeParse(body);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      error: {
-        kind: "invalid_input",
-        message: parsed.error.issues[0]?.message ?? "invalid input",
-      },
-    };
-  }
-  const patch: ProjectListingDraftPatchInput = parsed.data;
-
-  const stored = siteAnswersFromRow(owner.siteAnswers);
-  const context: DraftUpdateContext = {
-    // THE CLAMP, and the reason `requestedWindowDays` is safe to accept from
-    // an anonymous body at all (#5285). The site's `maxWindowDays` is read
-    // server-side and caps everything; the payload carries a REQUEST. A
-    // founder who could post their own bound could post an unbounded one, and
-    // this is the only place a patched window reaches a column.
-    ...(patch.requestedWindowDays !== undefined && {
-      windowDays: clampWindowDays(patch.requestedWindowDays, listingConfig),
-    }),
-    // What is on the row already, so the merge below adds to it rather than
-    // replacing it. It comes from the ROW and never from the body.
-    ...(stored !== null && { storedSiteAnswers: stored }),
-  };
-
-  // A GUARDED `updateMany`, not a read-then-write: the token check and the
-  // write are one statement, so a concurrent `submit` cannot flip the row to
-  // `requested` in between and let this patch land on an application the
-  // operator is already reviewing (PR #5042 security review, finding 3). The
-  // same compare-and-swap shape `submit` and `decideListing` already use.
-  const updated = await prisma.projectListing.updateMany({
-    where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
-    data: draftUpdateData(patch, context),
-  });
-  if (updated.count === 0) {
-    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-  }
-
-  const row = await prisma.projectListing.findFirst({
-    where: { id },
-    select: PROJECT_LISTING_SELECT,
-  });
-  if (!row) {
-    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-  }
-
-  return { ok: true, value: toResponseRow(row, 0, new Date(), true) };
-}
-
-// ─── submit (POST, anonymous, token-gated) ──────────────────────────────────
-
-export type SubmitProjectListingDraftResult =
-  | { ok: true; id: string; slug: string; listing: ProjectListing }
-  | {
-      ok: false;
-      error:
-        | { kind: "not_found"; message: string }
-        | { kind: "incomplete"; message: string; missingFields: string[] }
-        | { kind: "listing_limit_reached"; message: string }
-        | { kind: "slug_taken"; message: string };
-    };
-
-/**
- * The application, assembled from the stored row for `submit` to validate.
- *
- * Narrowed to the site's COLLECTED fields (#5048 D5). The built submit schema
- * is `.strict()` over exactly that set, so a stored value for a field the site
- * does not collect would otherwise fail as an unrecognised key — which is the
- * right shape for a REQUEST body and the wrong one for a row that may carry a
- * value written before the site narrowed its step set.
- */
-function applicationFromRow(
-  row: ProjectListingRow,
-  collectedFields: readonly string[],
-): Record<string, unknown> {
-  const collected = new Set(collectedFields);
-  const all: Record<string, unknown> = {
-    name: row.name,
-    headline: row.headline,
-    oneLiner: row.oneLiner,
-    problem: row.problem,
-    ...(row.url !== null && { url: row.url }),
-    product: row.product,
-    commitment: row.commitment,
-    teamComposition: row.teamComposition,
-    faqs: row.faqs,
-    ...(row.anythingElse !== null && { anythingElse: row.anythingElse }),
-    address: row.address,
-    ...(row.founderCompany !== null && { founderCompany: row.founderCompany }),
-    questions: row.questions,
-    // #5285/#5096 — the four fields that became writable. Each is optional in
-    // the application schema, so a row that never carried one simply omits it
-    // and `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
-    // `windowDays` the row actually holds, not what was asked for: the
-    // request is not stored anywhere, and re-asserting it would be asserting
-    // a number nothing ever agreed to.
-    ...(row.logoMarkUrl !== null && { logoMarkUrl: row.logoMarkUrl }),
-    ...(row.logoWordmarkUrl !== null && { logoWordmarkUrl: row.logoWordmarkUrl }),
-    ...(row.windowDays !== null && { requestedWindowDays: row.windowDays }),
-    ...(row.solution !== null && { solution: row.solution }),
-  };
-  return Object.fromEntries(
-    Object.entries(all).filter(([key]) => collected.has(key)),
-  );
-}
-
-/**
- * Count the founder's OTHER non-terminal listings on this site (#5036 D7).
- *
- * Drafts count. A limit drafts escaped would be evaded by never submitting,
- * which is exactly the state a ten-step form leaves a founder in by default.
- *
- * The stored-status filter is a first pass, not the answer: `closed` is
- * computed, so an `active` row whose window has elapsed is terminal and must
- * not count. `computeListingStatus` is the one place that knows this, and
- * consulting it here is the same discipline the CSV sweep learned in #5033.
- */
-async function countOtherNonTerminalListings(
-  siteId: string,
-  founderEmail: string,
-  exceptId: string,
-): Promise<number> {
-  const now = new Date();
-  const draftCutoff = new Date(now.getTime() - DRAFT_HOLDS_A_SLOT_DAYS * 24 * 60 * 60 * 1000);
-
-  const rows = await prisma.projectListing.findMany({
-    where: {
-      siteId,
-      founderEmail,
-      id: { not: exceptId },
-      OR: [
-        // Every non-terminal state except `draft`, which the clause below
-        // handles on its own terms. Derived from the shared constant rather
-        // than typed out, so a fifth non-terminal state is counted the day it
-        // is added.
-        {
-          status: {
-            in: PROJECT_LISTING_NON_TERMINAL_STATUSES.filter((s) => s !== "draft"),
-          },
-        },
-        // A draft holds a slot only while it is live — see
-        // `DRAFT_HOLDS_A_SLOT_DAYS`. It still counts, so not submitting evades
-        // nothing; it just stops counting once the application is plainly
-        // abandoned, which is what keeps an unverified email from locking a
-        // named founder out permanently.
-        { status: "draft", createdAt: { gt: draftCutoff } },
-      ],
-    },
-    select: { status: true, windowEndsAt: true, featured: true },
-  });
-  return rows.filter(
-    (r) => computeListingStatus(r.status, r.windowEndsAt, now, r.featured) !== "closed",
-  ).length;
-}
-
-/**
- * Validate the whole application and move the row `draft` -> `requested`.
- *
- * Three things happen here and nowhere else: completeness is asserted (an
- * incomplete draft comes back with the offending fields NAMED, so the form can
- * send the founder to the step that owns each one); the concurrent-listing
- * limit binds; and the slug is derived, which is the first moment a `name`
- * exists to derive it from.
- *
- * The transition write is a GUARDED `updateMany` on `status: "draft"`, so two
- * concurrent submits of the same draft cannot both succeed — the loser reads
- * as `not_found`, the same answer a spent token gets. The token's digest is
- * cleared in that same write: a token that leaks after submission grants
- * nothing.
- *
- * The Lead write and the Slack post are both side effects of that committed
- * transition and both fail soft, in that order — never before it, or a submit
- * that lost the race would still have put an application in the operator's
- * pipeline with no listing behind it.
- */
-export async function submitProjectListingDraft(
-  id: string,
-  resumeToken: string,
-  sourceMeta: SourceMeta,
-): Promise<SubmitProjectListingDraftResult> {
-  const draft = await findDraftByToken(id, resumeToken);
-  if (!draft) {
-    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-  }
-
-  // #5048 D5 — completeness derives from the site's CONFIGURED collected-field
-  // set, never from a fixed schema. Steps are individually optional, so a
-  // field whose step the site never rendered was never asked for; requiring it
-  // would refuse a valid application naming a question the founder never saw.
-  //
-  // The set comes from the site's own server-side `SiteListingConfig`. It is
-  // never read from the request: a caller that could post its own required-
-  // field set could post an empty one and submit a blank listing.
-  const listingConfig = await listingConfigFor(draft.siteId);
-  const submitSchema = buildProjectListingSubmitSchema(
-    listingConfig.wordCaps,
-    listingConfig.collectedFields,
-  );
-  const parsed = submitSchema.safeParse(
-    applicationFromRow(draft, listingConfig.collectedFields),
-  );
-  if (!parsed.success) {
-    const missingFields = [
-      ...new Set(parsed.error.issues.map((issue) => String(issue.path[0]))),
-    ].sort();
-    return {
-      ok: false,
-      error: {
-        kind: "incomplete",
-        message: `application is incomplete: ${missingFields.join(", ")}`,
-        missingFields,
-      },
-    };
-  }
-
-  const concurrent = await countOtherNonTerminalListings(
-    draft.siteId,
-    draft.founderEmail,
-    draft.id,
-  );
-  if (concurrent >= PROJECT_LISTING_CONCURRENT_LIMIT) {
-    return {
-      ok: false,
-      error: {
-        kind: "listing_limit_reached",
-        message: `a founder may hold at most ${PROJECT_LISTING_CONCURRENT_LIMIT} listings at once`,
-      },
-    };
-  }
-
-  // `name` may be absent from the picked schema if a site does not collect it
-  // (#5048 D5), so the slug derives from the ROW rather than from the parsed
-  // payload. A site that collects no name has none to derive from, and the
-  // founder's own name is the only other stable string on the row.
-  const base = deriveListingSlug(draft.name ?? draft.founderName);
-  const slug = await firstFreeSlug(draft.siteId, base);
-
-  const transition = async (candidate: string): Promise<number | "taken"> => {
-    try {
-      const updated = await prisma.projectListing.updateMany({
-        where: { id, status: "draft" },
-        // #5407 — the verification nonce is cleared here too, for the reason
-        // the resume-token digest is: a credential that leaks after the draft
-        // stops being a draft is inert twice over.
-        data: {
-          status: "requested",
-          slug: candidate,
-          resumeTokenHash: null,
-          emailVerifyNonceHash: null,
-        },
-      });
-      return updated.count;
-    } catch (err) {
-      if (isUniqueViolation(err)) return "taken";
-      throw err;
-    }
-  };
-
-  let count = await transition(slug);
-  if (count === "taken") {
-    // `firstFreeSlug` samples at most 200 same-prefix rows, so a family larger
-    // than that can hand back a slug that is in fact taken — and a plain retry
-    // resamples and fails the same way, which would let a squatted prefix wall
-    // off every later applicant whose name derives to it (PR #5042 security
-    // review, finding 2). One random suffix ends that: an ugly slug beats an
-    // application that cannot be submitted at all.
-    count = await transition(`${base}-${randomBytes(3).toString("hex")}`);
-  }
-  if (count === "taken") {
-    return {
-      ok: false,
-      error: { kind: "slug_taken", message: "slug already in use for this site" },
-    };
-  }
-  if (count === 0) {
-    // A concurrent submit won the race and already spent this draft.
-    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-  }
-
-  // The Lead write reuses routeLead — never a duplicate persistence path — and
-  // happens at SUBMIT rather than at start, so an anonymous stranger cannot
-  // cause an operator notification by opening a draft they never finish.
-  //
-  // It runs AFTER the transition, and fails soft. Before the transition it
-  // would write a Lead (and mail the operator) for every submit that then lost
-  // the race or hit a taken slug — an application in the operator's pipeline
-  // with no listing behind it, and two Leads for the one submit that did land.
-  // After it, the worst case is a `requested` listing whose `leadId` is null,
-  // which the model allows and the weekly CSV sweep already skips explicitly.
-  // The submit itself has landed either way, and that is what the founder
-  // asked for; reporting it as a failure would be the wrong answer.
-  const leadResult = await routeLead(
-    {
-      kind: "submit",
-      siteId: draft.siteId,
-      source: "projects-apply",
-      email: draft.founderEmail,
-      payload: {
-        name: parsed.data.name,
-        oneLiner: parsed.data.oneLiner,
-        problem: parsed.data.problem,
-        product: parsed.data.product,
-        founderName: draft.founderName,
-        questions: parsed.data.questions,
-      },
-    },
-    sourceMeta,
-  );
-  if (leadResult.ok) {
-    await prisma.projectListing.update({
-      where: { id },
-      data: { leadId: leadResult.id },
-    });
-  } else {
-    logger.error(
-      { listingId: id, kind: leadResult.error.kind },
-      "[project-listings] the Lead write failed after a submitted listing already landed",
-    );
-  }
-
-  const row = await prisma.projectListing.findFirst({
-    where: { id },
-    select: PROJECT_LISTING_SELECT,
-  });
-  if (!row) {
-    return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
-  }
-
-  return {
-    ok: true,
-    id,
-    slug: row.slug!,
-    listing: toResponseRow(row, 0, new Date(), true),
-  };
-}
-
-function isUniqueViolation(err: unknown): boolean {
-  return (
-    err != null &&
-    typeof err === "object" &&
-    "code" in err &&
-    (err as { code: string }).code === "P2002"
-  );
-}
-
-// ─── List + get (tenant scope) ──────────────────────────────────────────────
-
-export async function listProjectListings(siteId: string): Promise<ProjectListing[]> {
-  const rows = await prisma.projectListing.findMany({
-    where: { siteId },
-    orderBy: { createdAt: "desc" },
-    select: PROJECT_LISTING_SELECT,
-  });
-  const counts = await attachWaitlistCounts(siteId, rows);
-  const now = new Date();
-  return rows.map((row) => toResponseRow(row, waitlistCountFor(row, counts), now, true));
-}
-
-export type GetProjectListingResult =
-  | { ok: true; value: ProjectListing }
-  | { ok: false; error: { kind: "not_found"; message: string } };
-
-export async function getProjectListing(siteId: string, id: string): Promise<GetProjectListingResult> {
-  const row = await prisma.projectListing.findFirst({
-    where: { id, siteId },
-    select: PROJECT_LISTING_SELECT,
-  });
-  if (!row) {
-    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
-  }
-  const counts = await attachWaitlistCounts(siteId, [row]);
-  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
-}
-
-// ─── The founder's own listings (auth scope; #5295) ─────────────────────────
-
-/**
- * The listings the CALLING USER owns, newest first.
- *
- * The join is the owner link and ONLY the owner link:
- * `ownerUserId === userId`, the scalar `listing-promotion.ts` stamps once that
- * user's own email is verified, matches the row's `founderEmail`, and the row's
- * site resolves to one of the user's own workspaces. `founderEmail` is NEVER
- * compared here, at any stage — an un-linked listing that happens to carry the
- * caller's address is not theirs until a promotion said so, and a read-time
- * email match would reintroduce exactly the cross-founder capture the link
- * exists to remove. (`flow-checkouts.ts` draws the same line for `Lead`.)
- *
- * No `siteId` parameter and no `currentSiteId()` scope, deliberately — and the
- * reason is NOT that the two can never coincide. `siteIdForPublicKey`
- * (`listing-config.ts`) does fall back to `currentSiteId()`, so a listing's
- * `siteId` CAN be `AILK_SITE_ID` or the literal `"default"` on a single-tenant
- * deployment. The reason is that the owner link is already the narrower scope:
- * it is only ever stamped for a site inside the user's own tenancy
- * (`listing-promotion.ts`, condition 3), so adding a site term could only
- * remove rows the caller owns — and on the multi-tenant shape, where a
- * listing's `siteId` is a WORKSPACE id rather than `AILK_SITE_ID`, it would
- * remove all of them. The response omits `siteId` regardless, so no workspace
- * id leaves the read.
- *
- * The one thing this gives up against the sibling `/me` routes: on a database
- * shared by more than one site, a caller's rows from every such site come back
- * together. They are all the caller's own rows, which is why that is acceptable
- * here and not a disclosure.
- *
- * No verified-email re-check either. `flow-checkouts.ts` performs one as
- * defence in depth beside its email-matching sibling
- * (`waitlist-signups.ts`, where the gate is load-bearing because the match IS
- * an email). Here the link is the proof, and it was only issuable under
- * verification — so a re-check adds no safety, while failing a caller whose
- * address later changed to an unverified one would wrongly hide the rows they
- * already proved they own.
- *
- * `waitlistCount` is resolved PER SITE: the count is keyed by
- * `(siteId, experimentKey)`, and a founder may own listings in more than one of
- * their own workspaces, so counting them all under one site id would report
- * another site's number.
- *
- * An empty array for a caller who owns nothing is the normal answer, not an
- * error.
- */
-export async function listMyProjectListings(userId: string): Promise<ProjectListing[]> {
-  const rows = await prisma.projectListing.findMany({
-    where: { ownerUserId: userId },
-    orderBy: { createdAt: "desc" },
-    select: PROJECT_LISTING_SELECT,
-  });
-  if (rows.length === 0) return [];
-
-  const rowsBySite = new Map<string, ProjectListingRow[]>();
-  for (const row of rows) {
-    const forSite = rowsBySite.get(row.siteId);
-    if (forSite) forSite.push(row);
-    else rowsBySite.set(row.siteId, [row]);
-  }
-  const countsBySite = new Map<string, Map<string, number>>();
-  await Promise.all(
-    [...rowsBySite].map(async ([siteId, siteRows]) => {
-      countsBySite.set(siteId, await attachWaitlistCounts(siteId, siteRows));
-    }),
-  );
-
-  const now = new Date();
-  // `featuredEnabled: true` — the founder's own row, like the operator's
-  // dashboard row, reports the flag as stored. It is the PUBLIC shelf the
-  // site's config switch governs, not what the row's owner may see.
-  return rows.map((row) =>
-    toResponseRow(
-      row,
-      waitlistCountFor(row, countsBySite.get(row.siteId) ?? new Map()),
-      now,
-      true,
-    ),
-  );
-}
-
-// ─── Patch (tenant scope; the featured flag) ───────────────────────────────
-
-export type SetListingFeaturedResult =
-  | { ok: true; value: ProjectListing }
-  | { ok: false; error: { kind: "not_found"; message: string } };
-
-/**
- * Set the operator's `featured` flag (#5033 D6).
- *
- * This is the only non-status write the PATCH route makes. STATUS
- * transitions do not come through here at all — since the lifecycle
- * collapsed to five states with `closed` computed, `requested -> active |
- * rejected` is the only transition there is, and `decideListing` owns it for
- * both the PATCH route and the Slack button. The old transition table (which
- * also carried `approved -> live` and `live -> closed`) has no states left to
- * describe.
- */
-export async function setListingFeatured(
-  siteId: string,
-  id: string,
-  featured: boolean,
-): Promise<SetListingFeaturedResult> {
-  const updated = await prisma.projectListing.updateMany({
-    where: { id, siteId },
-    data: { featured },
-  });
-  if (updated.count === 0) {
-    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
-  }
-
-  const row = await prisma.projectListing.findFirst({
-    where: { id, siteId },
-    select: PROJECT_LISTING_SELECT,
-  });
-  if (!row) {
-    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
-  }
-
-  const counts = await attachWaitlistCounts(siteId, [row]);
-  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
-}
-
-// ─── Patch (tenant scope; the operator's copy edit) ─────────────────────────
-
-/**
- * The five PUBLISHED copy fields an operator copy edit may rewrite.
- *
- * The set is deliberately narrow. `questions` is IN because its prompts and
- * option labels render on the public page, which is precisely where abusive
- * language would land. `name` is OUT because the slug is derived from it at
- * submit and stored, so editing it would desync the public URL from the name.
- * `url`, `product`, `commitment`, `teamComposition`, `address` and
- * `founderCompany` are OUT because they are facts rather than copy — a wrong
- * fact is a question to the founder or a reject, not an edit. `anythingElse`
- * is OUT because it is a note to the reviewer and never renders.
- *
- * The request body is derived from the SAME package schema these keys name
- * (`projectListingApplicationFieldsSchema`) at the route boundary, so every
- * bound the application itself carries — the word caps, the fixed FAQ count,
- * the question refinements — holds here for free.
- */
-export type ProjectListingCopyEdit = Pick<
-  ProjectListingDraftPatchInput,
-  "headline" | "oneLiner" | "problem" | "faqs" | "questions"
->;
-
-/**
- * The WHERE terms that admit a copy edit: `requested`, or `active` as the row
- * actually READS.
- *
- * `draft` is the applicant's own, held through the resume token, and stays
- * theirs. `rejected` is terminal. `closed` is the awkward one, because nothing
- * stores it: `computeListingStatus` derives it from a stored `active` whose
- * window has elapsed, so scoping on the stored string alone would leave every
- * closed listing editable. These three terms are that function's three
- * accepting branches, transcribed — a featured row (window-exempt, #5036 D6b),
- * or a window still in force. A non-featured row with a null or elapsed window
- * matches none of them and is refused, exactly as it reads.
- *
- * `now` is a parameter so the one instant the caller renders the response
- * against is the same instant the write is guarded by.
- *
- * This lives in the WHERE clause rather than in a read-then-write check, so a
- * concurrent decision cannot slip the row out of the editable set between the
- * check and the write — the same compare-and-swap discipline
- * `patchProjectListingDraft` and `decideListing` use.
- */
-function copyEditableWhere(now: Date): Prisma.ProjectListingWhereInput[] {
-  return [
-    { status: "requested" },
-    { status: "active", featured: true },
-    { status: "active", windowEndsAt: { gt: now } },
-  ];
-}
-
-export type PatchListingCopyResult =
-  | { ok: true; value: ProjectListing }
-  | { ok: false; error: { kind: "not_found"; message: string } };
-
-/**
- * Rewrite a listing's published copy, preserving what the applicant submitted.
- *
- * The third review outcome beside approve and reject: a listing whose copy
- * needs a trim was previously publishable only exactly as written, because the
- * legal transitions out of `requested` are `active` and `rejected`, there is no
- * route back to `draft`, and `patchProjectListingDraft` is scoped to the
- * applicant's own resume token.
- *
- * `submittedCopy` is WRITE-ONCE, on the first edit only. The read below is what
- * resolves the pre-edit copy; it is NOT the write's guard, which stays the
- * status-scoped `updateMany` — the same compare-and-swap shape
- * `patchProjectListingDraft` and `decideListing` use. Because that read is one
- * consistent snapshot, a row it saw with a null `submittedCopy` also carries
- * the copy as the applicant submitted it, so two concurrent first edits write
- * the same snapshot value rather than racing to a different one. Nothing
- * clears the column, so the submitted copy stays recoverable for the life of
- * the row.
- *
- * DELIBERATELY silent on the notification surfaces, unlike a decision. No
- * founder email is sent, and the application's Slack card is not re-rendered,
- * so a card posted before an edit keeps showing the pre-edit copy. Both are the
- * decision path's concerns (`sendListingDecisionEmail`, `postListingApplication`)
- * and neither is touched here. Worth revisiting if operators start editing
- * before deciding often enough that the card misleads.
- *
- * The three audit columns are WRITE-ONLY at present: nothing reads them back,
- * because the tenant read's response contract is `.strict()` and surfacing them
- * would mean widening it. "Recoverable" therefore means recoverable from the
- * row, not through an API.
- *
- * PII boundary: as everywhere else in this module, nothing here is logged.
- */
-export async function patchListingCopy(
-  siteId: string,
-  id: string,
-  copy: ProjectListingCopyEdit,
-  editedBy: string,
-): Promise<PatchListingCopyResult> {
-  const before = await prisma.projectListing.findFirst({
-    where: { id, siteId },
-    select: {
-      submittedCopy: true,
-      headline: true,
-      oneLiner: true,
-      problem: true,
-      faqs: true,
-      questions: true,
-    },
-  });
-  if (!before) {
-    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
-  }
-
-  const now = new Date();
-  const updated = await prisma.projectListing.updateMany({
-    where: { id, siteId, OR: copyEditableWhere(now) },
-    data: {
-      // Only the keys the operator actually sent are written; an absent key is
-      // `undefined`, which Prisma omits from the UPDATE, so trimming the
-      // headline cannot blank the FAQs.
-      ...(copy.headline !== undefined && { headline: copy.headline }),
-      ...(copy.oneLiner !== undefined && { oneLiner: copy.oneLiner }),
-      ...(copy.problem !== undefined && { problem: copy.problem }),
-      ...(copy.faqs !== undefined && { faqs: copy.faqs as unknown as Prisma.InputJsonValue }),
-      ...(copy.questions !== undefined && {
-        questions: copy.questions as unknown as Prisma.InputJsonValue,
-      }),
-      ...(before.submittedCopy === null && {
-        submittedCopy: {
-          headline: before.headline,
-          oneLiner: before.oneLiner,
-          problem: before.problem,
-          faqs: before.faqs,
-          questions: before.questions,
-        } as unknown as Prisma.InputJsonValue,
-      }),
-      copyEditedAt: now,
-      copyEditedBy: editedBy,
-    },
-  });
-  if (updated.count === 0) {
-    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
-  }
-
-  const row = await prisma.projectListing.findFirst({
-    where: { id, siteId },
-    select: PROJECT_LISTING_SELECT,
-  });
-  if (!row) {
-    return { ok: false, error: { kind: "not_found", message: "Project listing not found" } };
-  }
-
-  const counts = await attachWaitlistCounts(siteId, [row]);
-  return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), now, true) };
-}
-
-// ─── Public read (anonymous) ────────────────────────────────────────────────
-
-/**
- * The public order (#5033): the THREE newest by `decidedAt` first, then the
- * rest by `waitlistCount` desc, then `decidedAt` desc. One function, so the
- * project read and the directory read (#7521 D3) cannot order differently.
- */
-function orderPublicListings<T extends { row: { id: string; decidedAt: Date | null }; waitlistCount: number }>(
-  withCounts: readonly T[],
-): T[] {
-  const decidedAtMs = (row: T["row"]): number => row.decidedAt?.getTime() ?? -Infinity;
-
-  const newestFirst = [...withCounts].sort((a, b) => decidedAtMs(b.row) - decidedAtMs(a.row));
-  const top3 = newestFirst.slice(0, 3);
-  const top3Ids = new Set(top3.map((t) => t.row.id));
-
-  const rest = withCounts
-    .filter((t) => !top3Ids.has(t.row.id))
-    .sort((a, b) => {
-      if (b.waitlistCount !== a.waitlistCount) return b.waitlistCount - a.waitlistCount;
-      return decidedAtMs(b.row) - decidedAtMs(a.row);
-    });
-
-  return [...top3, ...rest];
-}
-
-/**
- * The page-render read (#4998 AC4, reshaped by #5033, bounded by #9243): the
- * newest-decided `PUBLIC_LISTINGS_MAX_ROWS` `active` rows for the site, the
- * THREE newest by `decidedAt` first, then the rest by `waitlistCount` desc,
- * then `decidedAt` desc. `founderEmail` never leaves this function.
- *
- * Rows whose window has elapsed are returned and read `closed` — computed,
- * per row, against one instant, with no job having run. They are not filtered
- * out: a consumer partitions its shelves on the status it is handed, and a
- * listing that quietly vanished at midnight would be a worse answer than one
- * that says it is closed.
- */
-export async function publicProjectListings(siteId: string): Promise<ProjectListingPublic[]> {
-  const listingConfig = await listingConfigFor(siteId);
-  const rows = await prisma.projectListing.findMany({
-    where: { siteId, status: "active" },
-    // Same window as the directory read: with a `take`, the rows kept must be
-    // chosen, and "newest decided first, NULLS LAST" is the order the public
-    // shelf leads with anyway.
-    orderBy: [{ decidedAt: { sort: "desc", nulls: "last" } }, { id: "asc" }],
-    take: PUBLIC_LISTINGS_MAX_ROWS,
-    select: PROJECT_LISTING_SELECT,
-  });
-  const counts = await attachWaitlistCounts(siteId, rows);
-  const withCounts = rows.map((row) => ({ row, waitlistCount: waitlistCountFor(row, counts) }));
-
-  const now = new Date();
-  return orderPublicListings(withCounts).map(({ row, waitlistCount }) => {
-    // #5407 — `founderPhone` and `emailVerifiedAt` leave here with
-    // `founderEmail`. `projectListingPublicSchema` omits all three and
-    // `sendValidated` re-parses `.strict()`, so a key that stopped being
-    // dropped here would 500 the public read rather than quietly publishing a
-    // founder's phone number — which is the failure mode worth having.
-    const {
-      founderEmail: _founderEmail,
-      founderPhone: _founderPhone,
-      emailVerifiedAt: _emailVerifiedAt,
-      ...publicRow
-    } = toResponseRow(
-      row,
-      waitlistCount,
-      now,
-      listingConfig.featuredEnabled,
-    );
-    // #5285 — the `public`-visibility answers ONLY. An `operator-only` answer
-    // is something a site asked for its own triage, and a founder who was
-    // told it would not be published has to be right about that; an answer
-    // whose id the site no longer declares is dropped for the same reason,
-    // because "no declaration" cannot be read as "public" on the read that
-    // publishes. The tenant dashboard and the review payload are the audience
-    // that sees the rest, and they do not come through here.
-    return {
-      ...publicRow,
-      siteAnswers: publicSiteAnswers(publicRow.siteAnswers, listingConfig.siteAnswers),
-    };
-  });
-}
-
-// ─── Directory read (anonymous, #7521) ──────────────────────────────────────
-
-/** Only what the directory maps — no contact column is ever read here. */
-const DIRECTORY_LISTING_SELECT = {
-  id: true,
-  slug: true,
-  name: true,
-  headline: true,
-  oneLiner: true,
-  url: true,
-  logoMarkUrl: true,
-  founderCompany: true,
-  founderName: true,
-  siteAnswers: true,
-  featured: true,
-  status: true,
-  decidedAt: true,
-  windowEndsAt: true,
-  experimentKey: true,
-  capturedByFlowId: true,
-} as const satisfies Prisma.ProjectListingSelect;
-
-/**
- * A landing page's directory (#7521 D3): the entry type of the live listicle
- * that names `landingPage`, and that page's ACCEPTED entries — every `active`
- * listing (an elapsed one reads `closed`, as on `/public`) captured by a live
- * listicle naming it, at most the 200 most recently accepted, in the public
- * order. `null` when no live listicle of this site names the page, which is
- * almost every page.
- *
- * Each entry carries the generic directory shape, never the project-shaped
- * row: name, summary, links, and a `profile` built at read time from the
- * capturing listicle's CURRENT Application fields (`listingProfile`, D4).
- * Contact columns never leave this function.
- *
- * Two live listicles naming one page both contribute entries; the
- * earlier-created one supplies the entry type.
- */
-export async function listingDirectoryFor(
-  siteId: string,
-  landingPage: string,
-  locale: string | undefined,
-): Promise<ListingDirectoryResponse> {
-  // fence: siteId and workspaceId both — the value `siteIdForPublicKey`
-  // resolved from the public key, never from the request.
-  const listicles = await prisma.flowDefinition.findMany({
-    where: { siteId, workspaceId: siteId, kind: "listicle", status: "live", landingPage },
-    orderBy: [{ createdAt: "asc" }, { id: "asc" }],
-    select: { id: true, config: true },
-  });
-  if (listicles.length === 0) return null;
-
-  const configs = new Map<string, FlowConfig | null>();
-  for (const listicle of listicles) {
-    const parsed = flowConfigSchema.safeParse(listicle.config);
-    if (!parsed.success) {
-      logger.warn(
-        { siteId, flowId: listicle.id },
-        "[project-listings] a live listicle's config does not parse; its entries publish with no profile",
-      );
-    }
-    configs.set(listicle.id, parsed.success ? parsed.data : null);
-  }
-  const entryType =
-    configs.get(listicles[0]!.id)?.listing?.entryType ?? LISTING_ENTRY_TYPE_DEFAULT;
-
-  const listingConfig = await listingConfigFor(siteId);
-  const rows = await prisma.projectListing.findMany({
-    where: {
-      siteId,
-      workspaceId: siteId,
-      status: "active",
-      capturedByFlowId: { in: listicles.map((l) => l.id) },
-      slug: { not: null },
-    },
-    // NULLS LAST: Postgres sorts NULL first on DESC, so an undecided row
-    // would otherwise take a slot in the window ahead of an accepted one.
-    orderBy: [{ decidedAt: { sort: "desc", nulls: "last" } }, { id: "asc" }],
-    take: LISTING_DIRECTORY_MAX_ENTRIES,
-    select: DIRECTORY_LISTING_SELECT,
-  });
-  const counts = await attachWaitlistCounts(siteId, rows);
-  const withCounts = rows.map((row) => ({ row, waitlistCount: waitlistCountFor(row, counts) }));
-
-  const now = new Date();
-  const entries = orderPublicListings(withCounts).map(
-    ({ row, waitlistCount }): ListingEntryPublic => {
-      const config = row.capturedByFlowId ? configs.get(row.capturedByFlowId) : null;
-      return {
-        id: row.id,
-        slug: row.slug!,
-        name: row.headline ?? row.name ?? row.founderCompany ?? row.founderName,
-        summary: row.oneLiner,
-        url: row.url,
-        logoMarkUrl: row.logoMarkUrl,
-        featured: listingConfig.featuredEnabled && row.featured,
-        status:
-          computeListingStatus(row.status, row.windowEndsAt, now, row.featured) === "closed"
-            ? "closed"
-            : "active",
-        windowEndsAt: row.windowEndsAt ? row.windowEndsAt.toISOString() : null,
-        decidedAt: row.decidedAt ? row.decidedAt.toISOString() : null,
-        waitlistCount,
-        profile: config
-          ? listingProfile(
-              config,
-              siteAnswersFromRow(row.siteAnswers),
-              locale ?? config.defaultLocale,
-              listingConfig.siteAnswers.questions,
-            )
-          : [],
-      };
-    },
-  );
-
-  return { landingPage, entryType, entries };
-}