# Company intake and environment promotion

## What a visitor shares

A signed-in visitor can optionally submit a reviewed request from Meet Zora. The site keeps one owner-linked copy so the visitor can track it and writes one minimal company-queue projection in the same database batch. The projection contains a random queue ID, a one-way digest of the request UUID for duplicate protection, category, the summary the visitor approved, an `awaiting_review` state, and creation time. It does not contain their name, account ID, profile, or conversation.

The submission requires an active Zora space and a current consent epoch. A late write after that space changes is rejected. The business/partnership category enters the sales queue. The visitor receives a queue receipt; that receipt does not claim the request has been assessed.

Deleting the saved space removes its profile, saved history, owner-linked requests and matching company projections in a D1 batch. Browser or AI provider records and backups are outside this database operation. The deployed development site has no company reviewer interface or external follow-up. New rows remain `awaiting_review`; never tell the visitor an employee or Star acted unless an actual review/action receipt exists.

## Verification run

Run `node scripts/check-company-intake.mjs`, `node scripts/check-space-privacy.mjs`, `node --experimental-strip-types scripts/check-development-policy.mjs`, and `node node_modules/typescript/bin/tsc --noEmit`. The company intake check applies the actual ordered SQLite migrations and verifies projection field minimization, category mapping, idempotency, consent-epoch fencing and deletion. The privacy check verifies the exact user-bound saved-history queries and migration chain.

## Promotion boundary

The development Site has a project-specific D1 database. Its source policy leaves the canonical local Zora gateway disabled. These checks do not demonstrate a company-owned production identity, live AI, authenticated staff queue, Python-runtime deployment, payment provider, broker connection or production rollback. Keep development and production users, databases and credentials separate. Promote only a reviewed source revision with its migration and rollback record, verified identity and provider boundaries, and release evidence.