create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/routes/leads/index.ts

@@ -5,16 +5,32 @@
  *   POST /v1/leads/submit    — lead submission (contact form / inquiry)
  *   POST /v1/leads/subscribe — newsletter subscription
  *   POST /v1/leads/callback  — callback request (phone-back)
+ *
+ * TENANT RESOLUTION (#6203, spec §10.4 operator ruling — reverses this
+ * file's former byte-unchanged posture). `siteId` used to be taken VERBATIM
+ * from the request body (`body["siteId"] as string`) — an anonymous, no-
+ * ownership-check value (`packages/validation/src/schemas/leads.ts`'s
+ * `safeSiteIdString` permits a `wksp_<uuidv7>`-shaped literal). Every
+ * capture kind now resolves its tenant SERVER-SIDE, via
+ * `resolveSiteWorkspaceId()` (`lib/site.ts`) — the SAME alias -> workspace
+ * resolution `currentSiteId()`/`AILK_SITE_ID` already drive throughout this
+ * app, unconditional on the content adapter — and a client-posted `siteId`
+ * is IGNORED entirely: it can no longer place a row anywhere. An unresolved
+ * result (no DATABASE_URL, or the alias names no workspace this database
+ * holds) is a 503 before any write is attempted — never a guess. See
+ * `lead-routing.ts`'s own header for the persistence-side half.
  */
 
 import { track } from "@working-theory/analytics/server";
 import type { FastifyPluginAsync } from "fastify";
 
+import { currentSiteId, resolveSiteWorkspaceId } from "../../lib/site.js";
 import {
   type LeadKind,
   type RouteLeadInput,
   routeLead,
 } from "../../services/lead-routing.js";
+import { sendRequestConfirmLink } from "../../services/request-confirm.js";
 
 /**
  * Read a named string field from the body, falling back to the same-named
@@ -42,17 +58,22 @@ function liftString(
  * `email`/`name`/`phone` out of `payload` (see liftString above) reads by
  * explicit field name only — it does not spread `payload`'s other keys, so
  * the same discipline holds. `payload` itself is passed through unchanged.
+ *
+ * `siteId` is the RESOLVED `workspaceId` (#6203) — never `body["siteId"]`.
+ * A body-supplied `siteId` is read nowhere in this function; a client that
+ * posts one has it silently ignored, never honoured.
  */
 function buildInput(
   kind: LeadKind,
   body: Record<string, unknown>,
+  workspaceId: string,
 ): RouteLeadInput {
   const payload = (body["payload"] ?? {}) as Record<string, unknown>;
 
   if (kind === "submit") {
     return {
       kind,
-      siteId: body["siteId"] as string,
+      siteId: workspaceId,
       source: body["source"] as string,
       email: liftString(body, payload, "email"),
       payload,
@@ -61,14 +82,14 @@ function buildInput(
   if (kind === "subscribe") {
     return {
       kind,
-      siteId: body["siteId"] as string,
+      siteId: workspaceId,
       email: liftString(body, payload, "email"),
       source: body["source"] as string,
     };
   }
   return {
     kind,
-    siteId: body["siteId"] as string,
+    siteId: workspaceId,
     name: liftString(body, payload, "name"),
     phone: liftString(body, payload, "phone"),
     ...(body["preferredTime"] !== undefined && {
@@ -99,7 +120,46 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         receivedAt: new Date().toISOString(),
       };
 
-      const result = await routeLead(buildInput(kind, body), sourceMeta);
+      // #6203 — resolve the tenant SERVER-SIDE before any write is
+      // attempted. Two branches, deliberately different:
+      //
+      //  - No DATABASE_URL: the zero-config OSS file-fallback deployment.
+      //    There is no `workspaces` table to resolve against (and
+      //    `assertSiteAliasResolves()` already skips its own boot check for
+      //    exactly this reason), so the "resolved" value here is the site
+      //    ALIAS itself (`currentSiteId()`) — the same value the file
+      //    fallback would have carried before this unit. Never a rejection:
+      //    that would break lead capture for every zero-config scaffold.
+      //  - DATABASE_URL set: resolve via `resolveSiteWorkspaceId()`, the
+      //    SAME alias -> workspace resolution `currentSiteId()` already
+      //    drives everywhere else in this app. `null` here is a genuine
+      //    misconfiguration `build()` already refuses to boot past
+      //    (`assertSiteAliasResolves()`) — reaching it at request time is
+      //    the residual case that startup check cannot catch (a workspace
+      //    deleted after boot, a transient read), and it fails closed the
+      //    same way: reject, never guess (spec AC-4).
+      let workspaceId: string;
+      if (!process.env.DATABASE_URL) {
+        workspaceId = currentSiteId();
+      } else {
+        const resolved = await resolveSiteWorkspaceId();
+        if (resolved === null) {
+          request.log.error(
+            { kind },
+            "lead capture: DATABASE_URL is set but the site alias resolves to no workspace",
+          );
+          return reply.status(503).send({
+            error: "tenant_unresolved",
+            message: "This site is not configured to accept submissions.",
+          });
+        }
+        workspaceId = resolved;
+      }
+
+      const result = await routeLead(
+        buildInput(kind, body, workspaceId),
+        sourceMeta,
+      );
 
       if (!result.ok) {
         if (result.error.kind === "invalid_input") {
@@ -110,7 +170,7 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         if (result.error.kind === "persist_failed") {
           // Do not surface internal error detail — log it server-side only
           request.log.error(
-            { kind, siteId: body["siteId"], error: result.error.message },
+            { kind, siteId: workspaceId, error: result.error.message },
             "lead persist_failed",
           );
           return reply.status(503).send({ error: "persist_failed" });
@@ -131,7 +191,7 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
             : "error";
       request.log.info(
         {
-          siteId: body["siteId"],
+          siteId: workspaceId,
           kind,
           ip: sourceMeta.ip,
           persisted: result.persisted,
@@ -140,6 +200,35 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         "lead routed",
       );
 
+      // Request-and-confirm (#5970): mint the tenant's one-time confirm
+      // credential and email them the link. Fire-and-forget and `void`-
+      // returning, so the 201 below stays independent of both Resend and that
+      // write — the request is already persisted by this point, and a send
+      // that fails must never turn a captured lead into an error.
+      //
+      // Callback only: `submit` and `subscribe` have no confirm step. The
+      // service itself no-ops (with a logged reason) when the feature is not
+      // configured, which is the default.
+      // `result.persisted === "db"` for the same reason `lead-routing.ts`
+      // consults it (#5970 security review round 3, M1): the credential is
+      // minted by an update on the `callbacks` row, so a FILE-FALLBACK id
+      // would match nothing and the operator would be left with no email at
+      // all. On that path the generic notification is sent instead, which is
+      // what keeps "exactly one" true in both directions.
+      if (kind === "callback" && result.persisted === "db") {
+        const callbackInput = buildInput(kind, body, workspaceId) as Extract<
+          RouteLeadInput,
+          { kind: "callback" }
+        >;
+        sendRequestConfirmLink(result.id, {
+          name: callbackInput.name,
+          phone: callbackInput.phone,
+          ...(callbackInput.preferredTime !== undefined && {
+            preferredTime: callbackInput.preferredTime,
+          }),
+        });
+      }
+
       // Fire-and-forget: track() never throws; no need to hold the response.
       void track("lead-captured", {
         source: body["source"] as string | undefined,
@@ -148,13 +237,11 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         ] as string | undefined,
       });
 
-      return reply
-        .status(201)
-        .send({
-          id: result.id,
-          persisted: result.persisted,
-          email: result.email,
-        });
+      return reply.status(201).send({
+        id: result.id,
+        persisted: result.persisted,
+        email: result.email,
+      });
     });
   };
 }

package/templates/apps/api/src/routes/project-listings/__tests__/configured-application.test.ts

@@ -74,6 +74,10 @@ import {
 } from "@working-theory/validation";
 
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
 import { startProjectListingRoute } from "../start.js";
@@ -181,6 +185,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
   configData = null;
@@ -239,6 +250,7 @@ function installStore(): void {
       headline: null,
       logoMarkUrl: null,
       logoWordmarkUrl: null,
+      solution: null,
       featured: false,
       decidedAt: null,
       decidedBy: null,
@@ -573,3 +585,42 @@ describe("the site's own application config (#5048 D5/D6)", () => {
     });
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/project-listings/__tests__/drafts.test.ts

@@ -62,11 +62,16 @@ jest.mock("@working-theory/license", () => ({
   }),
 }));
 
+import { logger } from "@working-theory/observability";
 import {
   resolveConsentStatement,
   SITE_CONSENT_CONFIG_DEFAULTS,
 } from "@working-theory/validation";
 
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
 import {
@@ -118,6 +123,48 @@ const START_PAYLOAD = {
   consent: true,
 };
 
+/**
+ * #6314 — the magnets `capturedByFlowSlug` may name. The resolve runs against
+ * the RESOLVED workspace id (`resolveWorkspaceIdForSite(SITE_ID)`), which this
+ * suite's `mockWorkspaceExists(prisma, SITE_ID)` makes `SITE_ID` itself.
+ */
+const WS_OTHER = "wksp_00000000-0000-7000-8000-0000000000bb";
+const LISTICLE_ID = "flow_00000000-0000-7000-8000-0000000000d1";
+const FOREIGN_LISTICLE_ID = "flow_00000000-0000-7000-8000-0000000000d2";
+const CONTACT_FLOW_ID = "flow_00000000-0000-7000-8000-0000000000d3";
+
+const FLOW_DEFINITION_ROWS: Row[] = [
+  {
+    id: LISTICLE_ID,
+    siteId: SITE_ID,
+    workspaceId: SITE_ID,
+    slug: "founder-list",
+    kind: "listicle",
+    status: "live",
+  },
+  // A listicle magnet of ANOTHER workspace. Its slug is a public path segment,
+  // so a stranger can name it — the resolve's `siteId`/`workspaceId` terms are
+  // what make naming it inert.
+  {
+    id: FOREIGN_LISTICLE_ID,
+    siteId: WS_OTHER,
+    workspaceId: WS_OTHER,
+    slug: "other-list",
+    kind: "listicle",
+    status: "live",
+  },
+  // A NON-listicle magnet in THIS workspace: the `kind: "listicle"` term in
+  // the resolve is what stops an application being filed against it.
+  {
+    id: CONTACT_FLOW_ID,
+    siteId: SITE_ID,
+    workspaceId: SITE_ID,
+    slug: "contact-us",
+    kind: "contact",
+    status: "live",
+  },
+];
+
 /** Everything the ten steps after step one collect. */
 const COMPLETE_APPLICATION = {
   name: "My Project",
@@ -162,6 +209,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
 
@@ -215,6 +269,7 @@ function installStore(): void {
         headline: null,
         logoMarkUrl: null,
         logoWordmarkUrl: null,
+        solution: null,
         featured: false,
         decidedAt: null,
         decidedBy: null,
@@ -261,6 +316,16 @@ function installStore(): void {
   (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
     ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
   );
+
+  // #6314 — the capturing-magnet resolve. Honours EVERY term the service
+  // passes, so a resolve that dropped `workspaceId` or `kind` would match a
+  // row it must not and fail the assertions below.
+  (prisma.flowDefinition.findFirst as jest.Mock).mockImplementation(
+    ({ where }: { where: Record<string, unknown> }) =>
+      Promise.resolve(
+        FLOW_DEFINITION_ROWS.find((row) => matches(row, where)) ?? null,
+      ),
+  );
 }
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
@@ -479,6 +544,253 @@ describe("the draft lifecycle (#5036 D1)", () => {
     expect(data[0]!["statement"]).not.toContain("You agree to being contacted");
   });
 
+  // ── #6314 — the capturing magnet, written at START ────────────────────────
+
+  it("AC-5: a capturedByFlowSlug naming a live listicle magnet of the resolved site writes that magnet's ID, and the response body is byte-unchanged", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+    });
+    expect(res.statusCode).toBe(201);
+    // The hard-floor response contract does not move: `{ id, resumeToken }`
+    // and nothing else. The column is NEVER echoed back to the anonymous
+    // caller (spec § 9 SEC-12).
+    expect(Object.keys(res.json().data).sort()).toEqual(["id", "resumeToken"]);
+
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // D1 — ALL FOUR terms in ONE query, and only the slug came from the body.
+    const call = (prisma.flowDefinition.findFirst as jest.Mock).mock
+      .calls[0]?.[0] as { where: Record<string, unknown> };
+    expect(call.where).toEqual({
+      slug: "founder-list",
+      siteId: SITE_ID,
+      workspaceId: SITE_ID,
+      kind: "listicle",
+    });
+  });
+
+  it("a start body carrying NO capturedByFlowSlug writes NULL, and makes no resolve query at all", async () => {
+    await startDraft(app);
+    expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+    expect(prisma.flowDefinition.findFirst).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["names nothing at all", "no-such-magnet"],
+    ["names ANOTHER workspace's listicle magnet", "other-list"],
+    ["names a NON-listicle magnet in this workspace", "contact-us"],
+  ])(
+    "AC-6: a capturedByFlowSlug that %s writes NULL and still returns a 201 indistinguishable from a body that named no slug",
+    async (_label, slug) => {
+      const withSlug = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: slug },
+      });
+      expect(withSlug.statusCode).toBe(201);
+      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+
+      // Indistinguishable on the wire from the no-slug case: same status, same
+      // key set, same envelope. A distinguishable error would turn this
+      // anonymous route into a cross-workspace magnet-slug oracle (SEC-02).
+      const withoutSlug = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: START_PAYLOAD,
+      });
+      expect(withoutSlug.statusCode).toBe(withSlug.statusCode);
+      expect(Object.keys(withoutSlug.json().data).sort()).toEqual(
+        Object.keys(withSlug.json().data).sort(),
+      );
+    },
+  );
+
+  it("AC-13: an UNRESOLVED slug is logged, PII-safe — routing metadata only, never the founder's identity or either credential", async () => {
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: {
+          ...START_PAYLOAD,
+          capturedByFlowSlug: "no-such-magnet",
+        },
+      });
+      expect(res.statusCode).toBe(201);
+
+      const call = warn.mock.calls.find(
+        (c) =>
+          typeof c[0] === "object" &&
+          c[0] !== null &&
+          "capturedByFlowSlug" in (c[0] as Record<string, unknown>),
+      );
+      expect(call).toBeDefined();
+      const meta = call![0] as Record<string, unknown>;
+      // Routing metadata ONLY. Silence here is what would make a stale or
+      // mis-wired consuming site produce a permanently empty Applications list
+      // indistinguishable from "no applications yet" (SEC-03).
+      expect(Object.keys(meta).sort()).toEqual([
+        "capturedByFlowSlug",
+        "listingId",
+        "siteId",
+      ]);
+      const serialized = JSON.stringify(meta);
+      expect(serialized).not.toContain("ada@example.com");
+      expect(serialized).not.toContain("Ada Founder");
+      expect(serialized).not.toContain(rows[0]!["resumeTokenHash"]);
+      expect(serialized).not.toContain(rows[0]!["emailVerifyNonceHash"]);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("AC-6: a capturedByFlowSlug lookup that THROWS degrades like an unresolvable slug — 201, NULL attribution, and a PII-safe warn distinct from the unresolved line", async () => {
+    (prisma.flowDefinition.findFirst as jest.Mock).mockRejectedValueOnce(
+      new Error("statement timeout"),
+    );
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(res.statusCode).toBe(201);
+      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+
+      const call = warn.mock.calls.find(
+        (c) => typeof c[1] === "string" && c[1].includes("lookup failed"),
+      );
+      expect(call).toBeDefined();
+      const meta = call![0] as Record<string, unknown>;
+      expect(Object.keys(meta).sort()).toEqual([
+        "capturedByFlowSlug",
+        "err",
+        "workspaceId",
+      ]);
+      // `JSON.stringify` cannot see an Error's NON-ENUMERABLE own properties —
+      // `message` and `stack` among them — so stringifying `meta` alone would
+      // pass whatever the error held and assert nothing. Pull them out by name.
+      const err = meta["err"] as Error;
+      const serialized = [
+        JSON.stringify(meta),
+        err?.message ?? "",
+        err?.stack ?? "",
+      ].join("\n");
+      expect(serialized).not.toContain("ada@example.com");
+      expect(serialized).not.toContain("Ada Founder");
+
+      // The real guarantee is STRUCTURAL, not this assertion: the catch wraps
+      // only the `findFirst`, whose scope holds no founder field at all. This
+      // check is a tripwire over that property, never the proof of it.
+      const line = call![1] as string;
+      expect(line).toContain("lookup failed");
+      expect(line).not.toContain("resolved to no listicle magnet");
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("a lookup that THROWS does NOT also emit the unresolved-slug line — during a DB incident that would be a false magnet-configuration signal", async () => {
+    (prisma.flowDefinition.findFirst as jest.Mock).mockRejectedValueOnce(
+      new Error("statement timeout"),
+    );
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(res.statusCode).toBe(201);
+      expect(rows[0]!["capturedByFlowId"] ?? null).toBeNull();
+
+      const messages = warn.mock.calls.map((c) => String(c[1] ?? ""));
+      // Exactly one line, and it is the accurate one. The throw never
+      // established that no such magnet exists.
+      expect(
+        messages.filter((m) => m.includes("resolved to no listicle magnet")),
+      ).toHaveLength(0);
+      expect(messages.filter((m) => m.includes("lookup failed"))).toHaveLength(1);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("a RESOLVED slug logs nothing — the warn line is the unresolved case's signal, not a per-application line", async () => {
+    const warn = jest.spyOn(logger, "warn").mockImplementation(() => undefined);
+    try {
+      await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(
+        warn.mock.calls.filter(
+          (c) =>
+            typeof c[0] === "object" &&
+            c[0] !== null &&
+            "capturedByFlowSlug" in (c[0] as Record<string, unknown>),
+        ),
+      ).toHaveLength(0);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it("AC-7: capturedByFlowId is WRITE-ONCE — no patch and no submit changes it, and no patch body can reach it", async () => {
+    const { id, resumeToken } = (await (async () => {
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/project-listings",
+        payload: { ...START_PAYLOAD, capturedByFlowSlug: "founder-list" },
+      });
+      expect(res.statusCode).toBe(201);
+      return res.json().data as { id: string; resumeToken: string };
+    })());
+
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // A patch that tries to name the column outright is a `.strict()` 400 —
+    // the key is not on any patch schema, so no body can reach the column.
+    const injected = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { capturedByFlowId: FOREIGN_LISTICLE_ID },
+    });
+    expect(injected.statusCode).toBe(400);
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // A legitimate patch leaves it untouched.
+    const patched = await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: { name: "My Project" },
+    });
+    expect(patched.statusCode).toBe(200);
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+
+    // And so does submit.
+    await app.inject({
+      method: "PATCH",
+      url: `/v1/project-listings/drafts/${id}`,
+      headers: bearer(resumeToken),
+      payload: COMPLETE_APPLICATION,
+    });
+    const submitted = await app.inject({
+      method: "POST",
+      url: `/v1/project-listings/drafts/${id}/submit`,
+      headers: bearer(resumeToken),
+    });
+    expect(submitted.statusCode).toBe(200);
+    expect(rows[0]!["status"]).toBe("requested");
+    expect(rows[0]!["capturedByFlowId"]).toBe(LISTICLE_ID);
+  });
+
   // ── patch ──
 
   it("patch: a SINGLE-field patch round-trips", async () => {
@@ -884,3 +1196,42 @@ describe("the draft lifecycle (#5036 D1)", () => {
     await logging.close();
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});