create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/app/[locale]/case-studies/page.tsx

@@ -1,37 +1,49 @@
 // Case Studies list page. Reads CaseStudiesList MDX via the content adapter and emits
 // a JSON-LD CollectionPage via the dispatcher.
-import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
+// It lists every CaseStudy page through one generated card section (#10121,
+// apps/web/lib/hub-children.tsx — the /alternatives and /templates shape).
+import type {
+  getMdxSlugs as defaultGetMdxSlugs,
+  getMdxSource as defaultGetMdxSource,
+  getPageSections as defaultGetPageSections,
+} from "@working-theory/page-renderer";
 import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
 import type { Metadata } from "next";
 import type { ReactElement } from "react";
 
+import { type HubConfig, hubPageInput } from "../../../lib/hub-children";
+
 interface Props {
   params: Promise<{ locale: string }>;
   getMdxSource?: typeof defaultGetMdxSource;
+  getPageSections?: typeof defaultGetPageSections;
+  getMdxSlugs?: typeof defaultGetMdxSlugs;
 }
 
+const HUB: HubConfig = {
+  listType: "CaseStudiesList",
+  slug: "case-studies",
+  childType: "CaseStudy",
+  linkLabel: "Read the case study",
+  sectionId: "case-study-cards",
+  body: "mdx-body",
+};
+
 export async function generateMetadata({
   params,
 }: Pick<Props, "params">): Promise<Metadata> {
   const { locale } = await params;
-  return renderPageMetadata({
-    type: "CaseStudiesList",
-    slug: "case-studies",
-    locale,
-  });
+  return renderPageMetadata({ type: "CaseStudiesList", slug: "case-studies", locale });
 }
 
 export default async function Page({
   params,
-  getMdxSource,
+  ...loaders
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
   return renderPage({
     type: "CaseStudiesList",
     slug: "case-studies",
-    locale,
-    translationsNamespace: "case-studies",
-    bodyMode: "mdx-body",
-    ...(getMdxSource !== undefined && { getMdxSource }),
+    ...(await hubPageInput(HUB, locale, loaders)),
   });
 }

package/templates/apps/web/app/[locale]/checkout/__tests__/thank-you-account.test.tsx

@@ -36,7 +36,9 @@ const mockVisitor = { ip: "203.0.113.7" };
 jest.mock("next/headers", () => ({
   __esModule: true,
   headers: jest.fn(async () => ({
-    get: (name: string) => (name === "x-forwarded-for" ? mockVisitor.ip : null),
+    // #9967 D1 — the limiter reads only the edge-set address, on Vercel.
+    get: (name: string) =>
+      name === "x-vercel-forwarded-for" ? mockVisitor.ip : null,
   })),
 }));
 
@@ -73,10 +75,18 @@ async function linkHref(
   return href;
 }
 
+const priorVercel = process.env.VERCEL;
+
 beforeEach(() => {
   mockRead.mockReset();
   __resetRateLimit();
   mockVisitor.ip = "203.0.113.7";
+  process.env.VERCEL = "1";
+});
+
+afterAll(() => {
+  if (priorVercel === undefined) delete process.env.VERCEL;
+  else process.env.VERCEL = priorVercel;
 });
 
 describe("the thank-you page's account link (#8757 D13, AC-9)", () => {

package/templates/apps/web/app/[locale]/clients/__tests__/page-renderer-migration.test.tsx

@@ -79,7 +79,7 @@ describe("ClientsPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Our Clients","description":"Companies that trust us.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Organization"}]}}</script><main id="main"><div><h1>Our Clients</h1><p data-testid="clients-description" class="mt-block-tight text-lead">Companies that trust us.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Our Clients","description":"Companies that trust us.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Organization"}]}}</script><main id="main"><div><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></div></main>"`,
     );
   });
 });

package/templates/apps/web/app/[locale]/consent.actions.ts

@@ -13,7 +13,17 @@
  * Neither ever throws to the client — Banner's `onAccept`/`onReject` are
  * plain `() => void`, and the banner island already hides itself locally;
  * a failed write here is logged and nothing more. Neither writes
- * `ailk-consent` — the island owns that cookie, unchanged (C3).
+ * `ailk-consent` — the island owns that cookie, unchanged (C3). The visitor
+ * id is signed with a secret the site already holds (#8556; the order is in
+ * `lib/consent-visitor.ts`), so a production site with none of
+ * `BETTER_AUTH_SECRET`, `AILK_HUB_SESSION_SECRET` or `AILK_SPOKE_KEY` makes
+ * `ensureConsentVisitor` throw: the choice is logged as failed and not
+ * recorded, and `ailk-consent` still governs.
+ *
+ * Before the write each runs a per-visitor limit (#9967 D2): 20 choices per
+ * 10 minutes per visitor, the shared wider bucket for one whose address is
+ * unreadable. A refused choice makes no hub call and is logged; the visitor's
+ * own `ailk-consent` cookie still governs.
  */
 
 import { consent, visitorForwardHeaders } from "@working-theory/api-client";
@@ -21,12 +31,38 @@ import { cookies, headers } from "next/headers";
 import { getLocale } from "next-intl/server";
 
 import { ensureConsentVisitor } from "../../lib/consent-visitor";
+import { takeVisitorLimit } from "../../src/lib/rate-limit";
+
+const CHOICE_LIMIT = 20;
+const CHOICE_WINDOW_MS = 10 * 60_000;
+/** Outside a request scope there is no address: the shared bucket. */
+const NO_HEADERS = { get: () => null };
 
 async function recordChoice(choice: "accepted" | "declined"): Promise<void> {
   try {
     const cookieStore = await cookies();
     const visitorId = ensureConsentVisitor(cookieStore);
 
+    let requestHeaders: Awaited<ReturnType<typeof headers>> | undefined;
+    try {
+      requestHeaders = await headers();
+    } catch {
+      // No request scope to read — the shared bucket, no forwarding headers.
+    }
+    if (
+      !takeVisitorLimit(
+        "consent",
+        requestHeaders ?? NO_HEADERS,
+        CHOICE_LIMIT,
+        CHOICE_WINDOW_MS,
+      ).allowed
+    ) {
+      console.error("[consent.actions] record cookie choice refused", {
+        outcome: "rate_limited",
+      });
+      return;
+    }
+
     let locale = "en";
     try {
       locale = await getLocale();
@@ -36,13 +72,15 @@ async function recordChoice(choice: "accepted" | "declined"): Promise<void> {
 
     let init: { headers: Record<string, string> } | undefined;
     try {
-      const forwarded = visitorForwardHeaders(
-        await headers(),
-        process.env.AILK_VISITOR_FORWARD_KEY,
-      );
+      const forwarded = requestHeaders
+        ? visitorForwardHeaders(
+            requestHeaders,
+            process.env.AILK_VISITOR_FORWARD_KEY,
+          )
+        : undefined;
       if (forwarded) init = { headers: forwarded };
     } catch {
-      // No request scope to read — record with no forwarding headers.
+      // A forwarding read that throws — record with no forwarding headers.
     }
 
     const body = { visitorId, choice, locale };

package/templates/apps/web/app/[locale]/contact/__tests__/ConversationalIntakeWrapper.test.tsx

@@ -17,7 +17,7 @@
  *   per turn with an increasing `turnIndex`, plus one terminal call tagging
  *   the outcome.
  */
-import { act, fireEvent, render, screen } from "@testing-library/react";
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
 
 jest.mock("next-intl", () => ({
   useTranslations: () => (key: string) => key,
@@ -106,7 +106,7 @@ function answer(text: string): void {
 }
 
 describe("ConversationalIntakeWrapper — completion (AC1)", () => {
-  it("submits through the existing lead-capture endpoint's api-client surface", () => {
+  it("submits through the existing lead-capture endpoint's api-client surface", async () => {
     mockSubmit.mockResolvedValue({
       ok: true,
       body: { id: "lead_abc123", persisted: "db" },
@@ -125,8 +125,8 @@ describe("ConversationalIntakeWrapper — completion (AC1)", () => {
     advanceThinking(); // turn 4 (terms) revealed
     acceptTerms();
     advanceThinking(); // completion revealed, onComplete fires
-
-    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    // The action awaits its bot check (#9255) before the write.
+    await waitFor(() => expect(mockSubmit).toHaveBeenCalledTimes(1));
     const body = mockSubmit.mock.calls[0][0] as {
       source: string;
       email: string;

package/templates/apps/web/app/[locale]/contact/__tests__/contact.actions.test.ts

@@ -18,10 +18,21 @@ import { captureLeadAction } from "../contact.actions.js";
 
 // Mock @working-theory/api-client. `visitorForwardHeaders` stays real (#7394)
 // so AC-9 compares the action's `init` with the helper's own output.
+// #9255 — the write bot check's verdict. `checkBotId` reads Vercel's
+// request context, which jest has none of, so every case decides it here.
+const checkBotIdMock = jest.fn();
+jest.mock("botid/server", () => ({
+  checkBotId: (...args: unknown[]) => checkBotIdMock(...args),
+}));
+
 jest.mock("@working-theory/api-client", () => ({
   leads: {
     submit: jest.fn(),
   },
+  // #9171 — a `checkout` magnet's lookup key comes from the shown set.
+  offerings: {
+    shown: jest.fn(),
+  },
   visitorForwardHeaders: jest.requireActual("@working-theory/api-client")
     .visitorForwardHeaders,
 }));
@@ -53,9 +64,9 @@ jest.mock("next-intl/server", () => {
   };
 });
 
-// #8757 D11 — a `checkout` magnet redirects after the write. Next's
-// `redirect()` throws NEXT_REDIRECT; the mock throws the same way so a case
-// can read the target and prove nothing ran after it.
+// #9171 — a `checkout` magnet never calls Next's `redirect()`: a Server
+// Action redirect is fetched as RSC, which the buy route refuses. The mock
+// throws NEXT_REDIRECT as Next does, so a stray call fails its case.
 const mockRedirect = jest.fn((url: string): never => {
   throw new Error(`NEXT_REDIRECT:${url}`);
 });
@@ -65,21 +76,19 @@ jest.mock("next/navigation", () => ({
 }));
 
 let mockSignInProvider: "site" | "hub" | "none" = "site";
-let mockTopology: "hub" | "spoke" = "spoke";
-// eslint-disable-next-line no-restricted-syntax -- #507: SIGN_IN_PROVIDER and TOPOLOGY are generated per-build constants (#8757 D8, D11), not runtime inputs; no env or HTTP surface selects them.
+// eslint-disable-next-line no-restricted-syntax -- #507: SIGN_IN_PROVIDER is a generated per-build constant (#8757 D8), not a runtime input; no env or HTTP surface selects it.
 jest.mock("../../../../lib/topology.generated", () => ({
   __esModule: true,
   get SIGN_IN_PROVIDER() {
     return mockSignInProvider;
   },
-  get TOPOLOGY() {
-    return mockTopology;
-  },
 }));
 
-import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { leads, offerings, visitorForwardHeaders } from "@working-theory/api-client";
+import { workspaceShownSetSchema } from "@working-theory/validation";
 import { headers } from "next/headers";
 const mockSubmit = leads.submit as jest.Mock;
+const mockShown = offerings.shown as jest.Mock;
 const mockHeaders = headers as jest.Mock;
 
 afterEach(() => {
@@ -612,7 +621,22 @@ describe("captureLeadAction — the built-in form's source (#8747)", () => {
 
 describe("captureLeadAction — the per-visitor limit (#8747)", () => {
   const visitor = (ip: string) => ({
-    get: (name: string) => (name === "x-forwarded-for" ? ip : null),
+    get: (name: string) => (name === "x-vercel-forwarded-for" ? ip : null),
+  });
+  // On Vercel, where the edge-set address is read; the bot check has its own suite.
+  const ENV_KEYS = ["VERCEL", "AILK_BOT_CHECK"] as const;
+  const priorEnv = new Map(ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  beforeEach(() => {
+    process.env.VERCEL = "1";
+    process.env.AILK_BOT_CHECK = "off";
+  });
+
+  afterEach(() => {
+    for (const [name, value] of priorEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
   });
 
   it("admits 30 posts from one visitor in ten minutes, and refuses the 31st without calling the API", async () => {
@@ -633,17 +657,27 @@ describe("captureLeadAction — the per-visitor limit (#8747)", () => {
     expect(mockSubmit).toHaveBeenCalledTimes(30);
   });
 
-  it("with no readable address, the limit is skipped rather than shared", async () => {
-    mockHeaders.mockResolvedValue({ get: () => null });
+  it("with no readable address, every post shares one bucket at ten times the limit, never skipped (#9967)", async () => {
+    // A client-sent x-forwarded-for is no address: it changes on every post.
+    let n = 0;
+    mockHeaders.mockImplementation(async () => {
+      n += 1;
+      return { get: (name: string) => (name === "x-forwarded-for" ? `10.0.${n >> 8}.${n & 255}` : null) };
+    });
     mockSubmit.mockResolvedValue({ ok: true, body: { id: "lead_1", persisted: "db" } });
 
-    for (let i = 0; i < 31; i += 1) {
+    for (let i = 0; i < 300; i += 1) {
       expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toEqual({
         kind: "success",
         name: expect.any(String),
       });
     }
-    expect(mockSubmit).toHaveBeenCalledTimes(31);
+    expect(mockSubmit).toHaveBeenCalledTimes(300);
+
+    const refused = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(refused).toMatchObject({ kind: "error", message: expect.any(String) });
+    expect(mockSubmit).toHaveBeenCalledTimes(300);
   });
 
   it("another visitor keeps its own budget", async () => {
@@ -786,7 +820,16 @@ describe("captureLeadAction — the account link (#8757 D8)", () => {
   });
 });
 
-describe("captureLeadAction — a checkout magnet redirects after the write (#8757 D11, AC-8)", () => {
+describe("captureLeadAction — a checkout magnet answers the Offerings buy route after the write (#8757 D11, #9171)", () => {
+  // The shown-set read is shared for 15 seconds per instance, so each case
+  // starts a minute past the last one's window.
+  let clock = Date.now();
+  let now: jest.SpyInstance<number, []>;
+  beforeEach(() => {
+    clock += 60_000;
+    now = jest.spyOn(Date, "now").mockReturnValue(clock);
+  });
+
   function answers(next: unknown): void {
     mockSubmit.mockResolvedValueOnce({
       ok: true,
@@ -794,18 +837,135 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
     });
   }
 
-  it("next: checkout, retainer → Next's redirect to /api/checkout/retainer, after exactly one write", async () => {
+  /** A shown set in `state`: one `plan` carrying a Price per `period`. */
+  function shownSet(
+    periods: readonly ("monthly" | "yearly" | "once")[],
+    plan = "retainer",
+    state = "current",
+  ): unknown {
+    return workspaceShownSetSchema.partial({ workspaceId: true, organizationId: true }).parse({
+      productIds: [`prod_${plan}`],
+      recommended: { plan: null, addon: null },
+      offerings: [
+        {
+          productId: `prod_${plan}`,
+          plan,
+          name: plan,
+          description: null,
+          marketingFeatures: [],
+          unitLabel: null,
+          note: null,
+          termsNote: null,
+          ailkGroup: "plan",
+          ailkOrder: null,
+          prices: periods.map((period) => ({
+            priceId: `price_${plan}_${period}`,
+            lookupKey: `${plan}_${period}`,
+            plan,
+            period,
+            interval: { monthly: "month", yearly: "year", once: null }[period],
+            amount: 4900,
+            currency: "usd",
+          })),
+          recommended: false,
+        },
+      ],
+      state,
+      snapshotAt: "2026-10-26T00:00:00.000Z",
+    });
+  }
+
+  afterEach(() => {
+    mockShown.mockReset();
+    now.mockRestore();
+  });
+
+  /** The shown-set read answers `body` (the api-client's unwrapped 2xx). */
+  function shows(body: unknown): void {
+    mockShown.mockResolvedValueOnce({ ok: true, status: 200, body });
+  }
+
+  it("next: checkout, retainer → the success state carries /api/offerings/checkout/retainer_monthly, after exactly one write", async () => {
     answers({ completion: "checkout", checkoutOffering: "retainer" });
+    shows({ status: "shown", shownSet: shownSet(["monthly", "yearly"]) });
 
-    await expect(captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).rejects.toThrow(
-      "NEXT_REDIRECT:/api/checkout/retainer",
-    );
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
+      kind: "success",
+      name: "Jane Smith",
+      redirect: "/api/offerings/checkout/retainer_monthly",
+    });
     expect(mockSubmit).toHaveBeenCalledTimes(1);
-    expect(mockRedirect).toHaveBeenCalledTimes(1);
-    expect(mockRedirect).toHaveBeenCalledWith("/api/checkout/retainer");
     expect(mockSubmit.mock.invocationCallOrder[0]!).toBeLessThan(
-      mockRedirect.mock.invocationCallOrder[0]!,
+      mockShown.mock.invocationCallOrder[0]!,
     );
+    // The form navigates; never a Server Action redirect, and never the retired route.
+    expect(mockRedirect).not.toHaveBeenCalled();
+  });
+
+  it("one shown-set read serves every submit within 15 seconds", async () => {
+    const checkout = { completion: "checkout", checkoutOffering: "retainer" };
+    answers(checkout);
+    answers(checkout);
+    answers(checkout);
+    shows({ status: "shown", shownSet: shownSet(["monthly"]) });
+    shows({ status: "shown", shownSet: shownSet(["yearly"]) });
+    const submit = () => captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+
+    expect(await submit()).toMatchObject({ redirect: "/api/offerings/checkout/retainer_monthly" });
+    now.mockReturnValue(clock + 14_999);
+    expect(await submit()).toMatchObject({ redirect: "/api/offerings/checkout/retainer_monthly" });
+    expect(mockShown).toHaveBeenCalledTimes(1);
+    now.mockReturnValue(clock + 15_000);
+    expect(await submit()).toMatchObject({ redirect: "/api/offerings/checkout/retainer_yearly" });
+    expect(mockShown).toHaveBeenCalledTimes(2);
+  });
+
+  it.each([
+    [["yearly", "once"], "retainer_yearly"],
+    [["once"], "retainer_once"],
+  ] as const)(
+    "the key /pricing's card links first: shown %j → %s",
+    async (periods, lookupKey) => {
+      answers({ completion: "checkout", checkoutOffering: "retainer" });
+      shows({ status: "shown", shownSet: shownSet(periods) });
+
+      expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toMatchObject({
+        redirect: `/api/offerings/checkout/${lookupKey}`,
+      });
+    },
+  );
+
+  it.each([
+    ["a plan the shown set does not show", () => shows({ status: "shown", shownSet: shownSet(["monthly"], "growth") })],
+    ["an unconnected site", () => shows({ status: "unconnected" })],
+    ["a shown set that is not current", () => shows({ status: "shown", shownSet: shownSet(["monthly"], "retainer", "expired") })],
+    ["a non-2xx read", () => mockShown.mockResolvedValueOnce({ ok: false, status: 503, body: null })],
+    ["a thrown read", () => mockShown.mockRejectedValueOnce(new Error("network"))],
+  ] as const)("%s → exactly { kind: success } and no buy route", async (_label, read) => {
+    answers({ completion: "checkout", checkoutOffering: "retainer" });
+    read();
+
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
+      kind: "success",
+      name: expect.any(String),
+    });
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    expect(mockRedirect).not.toHaveBeenCalled();
+  });
+
+  it("a read with no answer within 5 seconds → exactly { kind: success } and no buy route", async () => {
+    jest.useFakeTimers({ doNotFake: ["nextTick", "setImmediate", "queueMicrotask", "Date"] });
+    try {
+      answers({ completion: "checkout", checkoutOffering: "retainer" });
+      mockShown.mockReturnValueOnce(new Promise(() => {}));
+
+      const result = captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+      await jest.advanceTimersByTimeAsync(5_000);
+      expect(await result).toStrictEqual({ kind: "success", name: expect.any(String) });
+      expect(mockRedirect).not.toHaveBeenCalled();
+    } finally {
+      jest.useRealTimers();
+    }
   });
 
   it.each([
@@ -816,24 +976,26 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
       { ok: false, status: 503, body: { error: "lead_capture_not_configured" } },
       "unavailable",
     ],
-  ] as const)("a failed write (%s) → { kind: %s } and no redirect", async (_label, response, kind) => {
+  ] as const)("a failed write (%s) → { kind: %s } and no buy route", async (_label, response, kind) => {
     mockSubmit.mockResolvedValueOnce(response);
 
     const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
     expect(result).toMatchObject({ kind });
+    expect(mockShown).not.toHaveBeenCalled();
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 
-  it("a thrown write → { kind: unavailable } and no redirect", async () => {
+  it("a thrown write → { kind: unavailable } and no buy route", async () => {
     mockSubmit.mockRejectedValueOnce(new Error("network"));
 
     const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
     expect(result).toMatchObject({ kind: "unavailable" });
+    expect(mockShown).not.toHaveBeenCalled();
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 
   it.each(["../x", "/evil", "Retainer", "has_underscore", "a".repeat(41), ""])(
-    "checkoutOffering %j → exactly { kind: success } and no redirect",
+    "checkoutOffering %j → exactly { kind: success }, no shown-set read and no buy route",
     async (checkoutOffering) => {
       answers({ completion: "checkout", checkoutOffering });
 
@@ -841,27 +1003,12 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
         kind: "success",
         name: expect.any(String),
       });
+      expect(mockShown).not.toHaveBeenCalled();
       expect(mockRedirect).not.toHaveBeenCalled();
     },
   );
 
-  it("a build that is not a spoke (no standard checkout) → exactly { kind: success } and no redirect", async () => {
-    mockTopology = "hub";
-    try {
-      answers({ completion: "checkout", checkoutOffering: "retainer" });
-
-      expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
-        kind: "success",
-        name: expect.any(String),
-      });
-      expect(mockSubmit).toHaveBeenCalledTimes(1);
-      expect(mockRedirect).not.toHaveBeenCalled();
-    } finally {
-      mockTopology = "spoke";
-    }
-  });
-
-  it("an invite still answers the account link and never redirects", async () => {
+  it("an invite still answers the account link and no buy route", async () => {
     answers({ completion: "invite" });
 
     const result = await captureLeadAction(
@@ -869,6 +1016,86 @@ describe("captureLeadAction — a checkout magnet redirects after the write (#87
       makeFormData({ ...VALID_FIELDS, email: "a@b.example" }),
     );
     expect(result).toMatchObject({ kind: "success", next: { label: "Track this in your account" } });
+    expect(mockShown).not.toHaveBeenCalled();
     expect(mockRedirect).not.toHaveBeenCalled();
   });
 });
+
+// #9255 D4 — the write bot check runs after the honeypot, the consent and
+// the schema, immediately before the write (spec
+// docs/specs/9255-an-edge-bot-challenge-in-spec.md §5.1 AC-2).
+describe("captureLeadAction — the write bot check (#9255)", () => {
+  const BOT = { isHuman: false, isBot: true, isVerifiedBot: false, bypassed: false };
+  const HUMAN = { ...BOT, isHuman: true, isBot: false };
+  const BOT_ENV_KEYS = ["VERCEL", "AILK_BOT_CHECK", "AILK_BOOKING_BOT_CHECK"] as const;
+  const priorBotEnv = new Map(BOT_ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  let botLogSpies: jest.SpyInstance[] = [];
+
+  beforeEach(() => {
+    checkBotIdMock.mockReset();
+    for (const name of BOT_ENV_KEYS) delete process.env[name];
+    process.env.VERCEL = "1";
+    botLogSpies = [
+      jest.spyOn(console, "warn").mockImplementation(() => undefined),
+      jest.spyOn(console, "error").mockImplementation(() => undefined),
+    ];
+  });
+
+  afterEach(() => {
+    for (const [name, value] of priorBotEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+    for (const spy of botLogSpies) spy.mockRestore();
+  });
+
+  const OK = { ok: true, body: { id: "lead_abc123", persisted: "db" } };
+
+  it("a bot gets the generic error, and nothing is sent", async () => {
+    checkBotIdMock.mockResolvedValue(BOT);
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+    expect(result).toStrictEqual({ kind: "error", message: "Something went wrong, please try again." });
+    expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("a check that fails is unavailable, and nothing is sent", async () => {
+    checkBotIdMock.mockRejectedValue(new Error("boom"));
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+    expect(result).toStrictEqual({ kind: "unavailable" });
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("a human sends exactly what the check off sends", async () => {
+    checkBotIdMock.mockResolvedValue(HUMAN);
+    mockSubmit.mockResolvedValue(OK);
+    delete process.env.VERCEL;
+    await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS));
+    process.env.VERCEL = "1";
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toMatchObject({
+      kind: "success",
+    });
+    expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+    expect(mockSubmit).toHaveBeenCalledTimes(2);
+    expect(mockSubmit.mock.calls[1]).toEqual(mockSubmit.mock.calls[0]);
+  });
+
+  it("a filled honeypot answers success with no check", async () => {
+    checkBotIdMock.mockResolvedValue(BOT);
+    const result = await captureLeadAction(
+      INITIAL_STATE,
+      makeFormData({ ...VALID_FIELDS, ailk_hp: "spam" }),
+    );
+    expect(result).toEqual({ kind: "success" });
+    expect(checkBotIdMock).not.toHaveBeenCalled();
+  });
+
+  it("a post without consent answers the consent error with no check", async () => {
+    checkBotIdMock.mockResolvedValue(BOT);
+    const { consent: _consent, ...unticked } = VALID_FIELDS;
+    const result = await captureLeadAction(INITIAL_STATE, makeFormData(unticked));
+    expect(result).toEqual({ kind: "error", fieldErrors: { consent: expect.any(String) } });
+    expect(checkBotIdMock).not.toHaveBeenCalled();
+  });
+});