> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tuturuuu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Usage accounting safety guards

> Failure behavior for AI budgets, storage capacity and subscription seats.

## Fail closed for new consumption

Unknown usage is not zero usage. AI credit lookups reject malformed allowance
rows; generation output budgets reject missing model prices and use the highest
applicable output-token price. The technical output ceiling is 65,536 tokens,
independent of available credits. Existing atomic AI reservation paths remain
responsible for their full request budget and settlement; an output cap is not
a substitute for input, tool, retry or media accounting.

Workspace storage rejects missing object sizes, invalid limits and unsafe byte
arithmetic. App-managed artifacts count toward upload capacity even when hidden
from ordinary Drive browsing. Infrastructure delegates to the same shared storage implementation.
If object sizes cannot be verified, the usage overview reports an accounting
failure rather than a misleading zero. File listing and download paths remain
separate and do not call the quota overview. When diagnosing a denied upload, verify object metadata and the quota RPC instead
of adding an unlimited override. Capacity checks do not yet atomically reserve
all concurrent signed uploads; final-object verification and provider reconciliation
remain required before selling new storage/egress add-ons.

Subscription provider lookup failure does not authorize creation of a duplicate
Free subscription. Seat availability rejects failed counts, missing products and
invalid purchased quantities. Active, trialing and past-due subscriptions use the
existing seat policy. Readable existing data is preserved; new capacity changes
must wait for accounting recovery. The Rust billing port mirrors these semantics
but does not serve production traffic. Invitation acceptance assigns a Polar seat
before exposing membership and stops when assignment fails. Polar rejects seat
reductions below pending plus claimed assignments, so that provider operation
protects in-flight assigned invitations beyond the local member-count check.
See [Polar seat management](https://polar.sh/docs/guides/seat-based-pricing).
Other membership paths and provider reconciliation still require coverage; this
is not a claim of a shared database/provider transaction.

## Provider catalog safety

Legacy product normalization recognizes one active fixed, Free or flat seat price.
New paid self-serve purchases require a supported flat seat price; recognizing a
legacy fixed product does not make it eligible for a new self-serve purchase.
Ambiguous, graduated, invalid or non-USD subscription prices cannot be flattened
into a misleading amount. Archived products can still be marked archived when
they have no active price. Product IDs, intervals and pricing model must be
explicitly bound before a catalog update; display names are not identifiers.

These controls do not activate new prices, reduce existing AI grants, or implement
a complete cross-product billing ledger. Use the commercial rollout runbook for
versioned allowance changes, provider reconciliation and existing-customer notice.

## Meeting lifecycle accounting

New rooms retain their first-admission deadline. Admitted legacy snapshots without
a stored deadline end on observation because departed participants make their
original start time unrecoverable. Legacy
participant time before observation remains unknown and is marked as incomplete
in the usage response and UI; it is never backfilled as a fabricated zero-cost history.
Lobby approvals carry the room deadline. Successful provider publications that
cannot be committed after a leave or room end are queued for durable cleanup.
Cleanup completion removes only confirmed obligations and preserves newer usage
counters and cleanup requests. The local server stops its sweep when stopped.

Cleanup reads Cloudflare session state to recover missing legacy provider mids by
local track name, and settles mixed close responses per mid. Unidentifiable tracks
remain pending for investigation; they cannot prevent later sessions from closing.
Room termination resets prior cleanup backoff. The lobby remains independently
bounded while active capacity is full; host approval still enforces active limits.
Provider contract: [Cloudflare SFU Connection API](https://developers.cloudflare.com/realtime/sfu/https-api/).