create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/routes/project-listings/__tests__/drafts.test.ts

@@ -62,11 +62,16 @@ jest.mock("@working-theory/license", () => ({
   }),
 }));
 
+import { logger } from "@working-theory/observability";
 import {
   resolveConsentStatement,
   SITE_CONSENT_CONFIG_DEFAULTS,
 } from "@working-theory/validation";
 
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
 import {
@@ -118,6 +123,48 @@ const START_PAYLOAD = {
   consent: true,
 };
 
+/**
+ * #6314 — the magnets `capturedByFlowSlug` may name. The resolve runs against
+ * the RESOLVED workspace id (`resolveWorkspaceIdForSite(SITE_ID)`), which this
+ * suite's `mockWorkspaceExists(prisma, SITE_ID)` makes `SITE_ID` itself.
+ */
+const WS_OTHER = "wksp_00000000-0000-7000-8000-0000000000bb";
+const LISTICLE_ID = "flow_00000000-0000-7000-8000-0000000000d1";
+const FOREIGN_LISTICLE_ID = "flow_00000000-0000-7000-8000-0000000000d2";
+const CONTACT_FLOW_ID = "flow_00000000-0000-7000-8000-0000000000d3";
+
+const FLOW_DEFINITION_ROWS: Row[] = [
+  {
+    id: LISTICLE_ID,
+    siteId: SITE_ID,
+    workspaceId: SITE_ID,
+    slug: "founder-list",
+    kind: "listicle",
+    status: "live",
+  },
+  // A listicle magnet of ANOTHER workspace. Its slug is a public path segment,
+  // so a stranger can name it — the resolve's `siteId`/`workspaceId` terms are
+  // what make naming it inert.
+  {
+    id: FOREIGN_LISTICLE_ID,
+    siteId: WS_OTHER,
+    workspaceId: WS_OTHER,
+    slug: "other-list",
+    kind: "listicle",
+    status: "live",
+  },
+  // A NON-listicle magnet in THIS workspace: the `kind: "listicle"` term in
+  // the resolve is what stops an application being filed against it.
+  {
+    id: CONTACT_FLOW_ID,
+    siteId: SITE_ID,
+    workspaceId: SITE_ID,
+    slug: "contact-us",
+    kind: "contact",
+    status: "live",
+  },
+];
+
 /** Everything the ten steps after step one collect. */
 const COMPLETE_APPLICATION = {
   name: "My Project",
@@ -162,6 +209,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
 
@@ -215,6 +269,7 @@ function installStore(): void {
         headline: null,
         logoMarkUrl: null,
         logoWordmarkUrl: null,
+        solution: null,
         featured: false,
         decidedAt: null,
         decidedBy: null,
@@ -261,6 +316,16 @@ function installStore(): void {
   (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
     ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
   );
+
+  // #6314 — the capturing-magnet resolve. Honours EVERY term the service
+  // passes, so a resolve that dropped `workspaceId` or `kind` would match a
+  // row it must not and fail the assertions below.
+  (prisma.flowDefinition.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(
+        FLOW_DEFINITION_ROWS.find((row) => matches(row, where)) ?? null,
+      ),
+  );
 }
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
@@ -479,6 +544,253 @@ describe("the draft lifecycle (#5036 D1)", () => {
     expect(data[0]!["statement"]).not.toContain("You agree to being contacted");
   });
 
+  // ── #6314 — the capturing magnet, written at START ────────────────────────
+
+  it("AC-5: a capturedByFlowSlug naming a live listicle magnet of the resolved site writes that magnet's ID, and the response body is byte-unchanged", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+    });
+    expect(res.statusCode).toBe(201);
+    // The hard-floor response contract does not move: `{ id, resumeToken }`
+    // and nothing else. The column is NEVER echoed back to the anonymous
+    // caller (spec § 9 SEC-12).
+    expect(Object.keys(res.json().data).sort()).toEqual(["id", "resumeToken"]);
+
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // D1 — ALL FOUR terms in ONE query, and only the slug came from the body.
+    const call = (prisma.flowDefinition.findFirst as jest.Mock).mock
+      .calls[0]?.[0] as { where: Record<string, unknown> };
+    expect(call.where).toEqual({
+      slug: "founder-list",
+      siteId: SITE_ID,
+      workspaceId: SITE_ID,
+      kind: "listicle",
+    });
+  });
+
+  it("a start body carrying NO capturedByFlowSlug writes NULL, and makes no resolve query at all", async () => {
+    await startDraft(app);
+    expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+    expect(prisma.flowDefinition.findFirst).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["names nothing at all", "no-such-magnet"],
+    ["names ANOTHER workspace's listicle magnet", "other-list"],
+    ["names a NON-listicle magnet in this workspace", "contact-us"],
+  ])(
+    "AC-6: a capturedByFlowSlug that %s writes NULL and still returns a 201 indistinguishable from a body that named no slug",
+    async (_label, slug) => {
+      const withSlug = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: slug },
+      });
+      expect(withSlug.statusCode).toBe(201);
+      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+
+      // Indistinguishable on the wire from the no-slug case: same status, same
+      // key set, same envelope. A distinguishable error would turn this
+      // anonymous route into a cross-workspace magnet-slug oracle (SEC-02).
+      const withoutSlug = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: START_PAYLOAD,
+      });
+      expect(withoutSlug.statusCode).toBe(withSlug.statusCode);
+      expect(Object.keys(withoutSlug.json().data).sort()).toEqual(
+        Object.keys(withSlug.json().data).sort(),
+      );
+    },
+  );
+
+  it("AC-13: an UNRESOLVED slug is logged, PII-safe — routing metadata only, never the founder's identity or either credential", async () => {
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: {
+          ...START_PAYLOAD,
+          capturedByFlowSlug: "no-such-magnet",
+        },
+      });
+      expect(res.statusCode).toBe(201);
+
+      const call = warn.mock.calls.find(
+        (c) =>
+          typeof c[0] === "object" &&
+          c[0] !== null &&
+          "capturedByFlowSlug" in (c[0] as Record<string, unknown>),
+      );
+      expect(call).toBeDefined();
+      const meta = call![0] as Record<string, unknown>;
+      // Routing metadata ONLY. Silence here is what would make a stale or
+      // mis-wired consuming site produce a permanently empty Applications list
+      // indistinguishable from "no applications yet" (SEC-03).
+      expect(Object.keys(meta).sort()).toEqual([
+        "capturedByFlowSlug",
+        "listingId",
+        "siteId",
+      ]);
+      const serialized = JSON.stringify(meta);
+      expect(serialized).not.toContain("ada@example.com");
+      expect(serialized).not.toContain("Ada Founder");
+      expect(serialized).not.toContain(rows[0]!["resumeTokenHash"]);
+      expect(serialized).not.toContain(rows[0]!["emailVerifyNonceHash"]);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("AC-6: a capturedByFlowSlug lookup that THROWS degrades like an unresolvable slug — 201, NULL attribution, and a PII-safe warn distinct from the unresolved line", async () => {
+    (prisma.flowDefinition.findFirst as jest.Mock).mockRejectedValueOnce(
+      new Error("statement timeout"),
+    );
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(res.statusCode).toBe(201);
+      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+
+      const call = warn.mock.calls.find(
+        (c) => typeof c[1] === "string" && c[1].includes("lookup failed"),
+      );
+      expect(call).toBeDefined();
+      const meta = call![0] as Record<string, unknown>;
+      expect(Object.keys(meta).sort()).toEqual([
+        "capturedByFlowSlug",
+        "err",
+        "workspaceId",
+      ]);
+      // `JSON.stringify` cannot see an Error's NON-ENUMERABLE own properties —
+      // `message` and `stack` among them — so stringifying `meta` alone would
+      // pass whatever the error held and assert nothing. Pull them out by name.
+      const err = meta["err"] as Error;
+      const serialized = [
+        JSON.stringify(meta),
+        err?.message ?? "",
+        err?.stack ?? "",
+      ].join("\n");
+      expect(serialized).not.toContain("ada@example.com");
+      expect(serialized).not.toContain("Ada Founder");
+
+      // The real guarantee is STRUCTURAL, not this assertion: the catch wraps
+      // only the `findFirst`, whose scope holds no founder field at all. This
+      // check is a tripwire over that property, never the proof of it.
+      const line = call![1] as string;
+      expect(line).toContain("lookup failed");
+      expect(line).not.toContain("resolved to no listicle magnet");
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("a lookup that THROWS does NOT also emit the unresolved-slug line — during a DB incident that would be a false magnet-configuration signal", async () => {
+    (prisma.flowDefinition.findFirst as jest.Mock).mockRejectedValueOnce(
+      new Error("statement timeout"),
+    );
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(res.statusCode).toBe(201);
+      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+
+      const messages = warn.mock.calls.map((c) => String(c[1] ?? ""));
+      // Exactly one line, and it is the accurate one. The throw never
+      // established that no such magnet exists.
+      expect(
+        messages.filter((m) => m.includes("resolved to no listicle magnet")),
+      ).toHaveLength(0);
+      expect(messages.filter((m) => m.includes("lookup failed"))).toHaveLength(1);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("a RESOLVED slug logs nothing — the warn line is the unresolved case's signal, not a per-application line", async () => {
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(
+        warn.mock.calls.filter(
+          (c) =>
+            typeof c[0] === "object" &&
+            c[0] !== null &&
+            "capturedByFlowSlug" in (c[0] as Record<string, unknown>),
+        ),
+      ).toHaveLength(0);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("AC-7: capturedByFlowId is WRITE-ONCE — no patch and no submit changes it, and no patch body can reach it", async () => {
+    const { id, resumeToken } = (await (async () => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(res.statusCode).toBe(201);
+      return res.json().data as { id: string; resumeToken: string };
+    })());
+
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // A patch that tries to name the column outright is a `.strict()` 400 —
+    // the key is not on any patch schema, so no body can reach the column.
+    const injected = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { capturedByFlowId: FOREIGN_LISTICLE_ID },
+    });
+    expect(injected.statusCode).toBe(400);
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // A legitimate patch leaves it untouched.
+    const patched = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { name: "My Project" },
+    });
+    expect(patched.statusCode).toBe(200);
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // And so does submit.
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const submitted = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+      headers: bearer(resumeToken),
+    });
+    expect(submitted.statusCode).toBe(200);
+    expect(rows[0]!["status"]).toBe("requested");
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+  });
+
   // ── patch ──
 
   it("patch: a SINGLE-field patch round-trips", async () => {
@@ -884,3 +1196,42 @@ describe("the draft lifecycle (#5036 D1)", () => {
     await logging.close();
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/project-listings/__tests__/founder-identity.test.ts

@@ -56,6 +56,10 @@ import Fastify from "fastify";
 import type { FastifyInstance } from "fastify";
 
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
 import { startProjectListingRoute } from "../start.js";
@@ -184,6 +188,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
   resumeEmailEnabled = true;
@@ -254,6 +265,7 @@ function installStore(): void {
       headline: null,
       logoMarkUrl: null,
       logoWordmarkUrl: null,
+      solution: null,
       featured: false,
       decidedAt: null,
       decidedBy: null,
@@ -794,3 +806,42 @@ describe("the resume link's email verification (#5407)", () => {
     });
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -136,6 +136,7 @@ function row(fixture: ListingFixture) {
     headline: "Atlas",
     logoMarkUrl: null,
     logoWordmarkUrl: null,
+    solution: null,
     featured: false,
     status: "requested",
     consentAt: fixture.createdAt,
@@ -419,10 +420,12 @@ describe("GET /v1/project-listings/me — the response shape", () => {
     expect(byId["prjl_ada_one"]).toBe(7);
     expect(byId["prjl_ada_two"]).toBe(3);
     expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      where: { siteId: SITE_A, experimentKey: "atlas-waitlist" },
+      // #6258 AC-6 — the fenced read now filters the CONSTRAINED column beside
+      // `siteId`; the two are equal by the workspace_site_agree CHECK.
+      where: { siteId: SITE_A, workspaceId: SITE_A, experimentKey: "atlas-waitlist" },
     });
     expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      where: { siteId: SITE_B, experimentKey: "atlas-two-waitlist" },
+      where: { siteId: SITE_B, workspaceId: SITE_B, experimentKey: "atlas-two-waitlist" },
     });
   });
 

package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts

@@ -129,6 +129,7 @@ function makeRow(overrides: Partial<Record<string, unknown>>) {
     headline: null,
     logoMarkUrl: null,
     logoWordmarkUrl: null,
+    solution: null,
     featured: false,
     consentAt: new Date("2026-08-01T00:00:00.000Z"),
     issueUrl: null,
@@ -413,7 +414,9 @@ describe("GET /v1/project-listings/public", () => {
     it("counts the waitlist through the listing's own experimentKey, in one hop", async () => {
       await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
       expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-        where: { siteId: SITE, experimentKey: "exp-newest" },
+        // #6258 AC-6 — the fenced read now filters the CONSTRAINED column
+        // beside `siteId`; the two are equal by the workspace_site_agree CHECK.
+        where: { siteId: SITE, workspaceId: SITE, experimentKey: "exp-newest" },
       });
       // The id-to-key translation read is gone with #5036 D6d.
       expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();

package/templates/apps/api/src/routes/project-listings/__tests__/resume-email.test.ts

@@ -57,6 +57,10 @@ jest.mock("@working-theory/observability", () => ({
   },
 }));
 
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { startProjectListingRoute } from "../start.js";
 
@@ -108,6 +112,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
   storedConfig = null;
@@ -516,6 +527,11 @@ describe("the resume email's send (#5406)", () => {
     let capSite = 0;
     beforeEach(() => {
       resolvedSiteId = `site-cap-${++capSite}`;
+      // #6335 — this describe files each test against a FRESH site, so the
+      // existence statement follows `resolvedSiteId` rather than pinning
+      // `SITE_ID`. Still keyed on the requested id: every other one
+      // resolves to nothing.
+      mockWorkspaceExists(prisma, resolvedSiteId);
       storedConfig = { resumeEmail: { ...RESUME_EMAIL_ON, maxSendsPerHour: 3 } };
     });
 
@@ -600,6 +616,9 @@ describe("the resume email's send (#5406)", () => {
 
       // A second site, its own config row, its own empty budget.
       const OTHER_SITE = "site-2";
+      // #6335 — named explicitly, beside this test's own site: the draft is
+      // filed against OTHER_SITE, so its workspace must resolve too.
+      mockWorkspaceExists(prisma, resolvedSiteId, OTHER_SITE);
       (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
         ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
           if (where.publicKey !== undefined) {
@@ -812,3 +831,42 @@ describe("the resume email's send (#5406)", () => {
     expect(logged).not.toContain("hello@samhenry.org");
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});