Skip to main content

​
Fail closed for new consumption

Unknown usage is not zero usage. AI credit lookups reject malformed allowance rows; generation output budgets reject missing model prices and use the highest applicable output-token price. The technical output ceiling is 65,536 tokens, independent of available credits. Existing atomic AI reservation paths remain responsible for their full request budget and settlement; an output cap is not a substitute for input, tool, retry or media accounting. Workspace storage rejects missing object sizes, invalid limits and unsafe byte arithmetic. App-managed artifacts count toward upload capacity even when hidden from ordinary Drive browsing. Infrastructure delegates to the same shared storage implementation. If object sizes cannot be verified, the usage overview reports an accounting failure rather than a misleading zero. File listing and download paths remain separate and do not call the quota overview. When diagnosing a denied upload, verify object metadata and the quota RPC instead of adding an unlimited override. Capacity checks do not yet atomically reserve all concurrent signed uploads; final-object verification and provider reconciliation remain required before selling new storage/egress add-ons. Subscription provider lookup failure does not authorize creation of a duplicate Free subscription. Seat availability rejects failed counts, missing products and invalid purchased quantities. Active, trialing and past-due subscriptions use the existing seat policy. Readable existing data is preserved; new capacity changes must wait for accounting recovery. The Rust billing port mirrors these semantics but does not serve production traffic. Invitation acceptance assigns a Polar seat before exposing membership and stops when assignment fails. Polar rejects seat reductions below pending plus claimed assignments, so that provider operation protects in-flight assigned invitations beyond the local member-count check. See Polar seat management. Other membership paths and provider reconciliation still require coverage; this is not a claim of a shared database/provider transaction.

​
Provider catalog safety

Legacy product normalization recognizes one active fixed, Free or flat seat price. New paid self-serve purchases require a supported flat seat price; recognizing a legacy fixed product does not make it eligible for a new self-serve purchase. Ambiguous, graduated, invalid or non-USD subscription prices cannot be flattened into a misleading amount. Archived products can still be marked archived when they have no active price. Product IDs, intervals and pricing model must be explicitly bound before a catalog update; display names are not identifiers. These controls do not activate new prices, reduce existing AI grants, or implement a complete cross-product billing ledger. Use the commercial rollout runbook for versioned allowance changes, provider reconciliation and existing-customer notice.

​
Meeting lifecycle accounting

New rooms retain their first-admission deadline. Admitted legacy snapshots without a stored deadline end on observation because departed participants make their original start time unrecoverable. Legacy participant time before observation remains unknown and is marked as incomplete in the usage response and UI; it is never backfilled as a fabricated zero-cost history. Lobby approvals carry the room deadline. Successful provider publications that cannot be committed after a leave or room end are queued for durable cleanup. Cleanup completion removes only confirmed obligations and preserves newer usage counters and cleanup requests. The local server stops its sweep when stopped. Cleanup reads Cloudflare session state to recover missing legacy provider mids by local track name, and settles mixed close responses per mid. Unidentifiable tracks remain pending for investigation; they cannot prevent later sessions from closing. Room termination resets prior cleanup backoff. The lobby remains independently bounded while active capacity is full; host approval still enforces active limits. Provider contract: Cloudflare SFU Connection API.