Upsert My Company

Create or replace the signed-in account's company page.

200 on both create and update rather than 201 on create, matching PUT /api/profile: the client treats this as one "save" action, and branching its success handler on a status code gains it nothing that exists in the body does not already say.

Idempotent in the sense that matters: the editable row is looked up by user_id with origin null/claimed, so saving twice updates that one page and never overwrites an imported directory listing the same account may also own.

The handle check happens twice, on purpose

Once here against BOTH tables (handle_owner) and once in the database against this table's unique index. The first is the only thing that can catch a collision with a PERSON -- no index spans the two tables, see api.handles -- and it produces a clear 409 before anything is written. The second closes the race the first cannot: between the check and the INSERT, another company can take the name, and only the index is authoritative about that.

published_at is set once and never cleared

Stamped the first time is_public goes true, left alone on every later save, and deliberately NOT cleared when a page is unpublished. It answers "how long have they been here", which is a trust signal that survives a company taking its page down for a fortnight; clearing it would make a returning company look brand new, and re-publishing would then quietly mint a fresh founding date for an account that has been here two years.