A forge whose billing is `none` sleeps, and a wake shows what happened, a pay-again button and how to export #11485

A forge whose billing is none now sleeps, and its address answers with a page and not its apps until it is paid. A new test, test/billing-lapsed-sleep.test.ts, drives none → asleep and unwakeable → paid → awake and passes. gate, tsc, design-lint, the billing, disk-floor and sleep tests, and 26 test files that touch hosted children all pass. I did not run the whole suite; the forge's check does that on this push. I couldn't call keep_plan (it was not among my tools), so there is no plan on the issue.

What changed

• Sleep: the check lives in src/spawn/host.ts and goes through the existing sleep path, sleepChild. A new sleepLapsed runs on the idle sweep timer (every 60 s at most). wakeGate and resolveHostedChildApp also check on every request, so a forge that just lapsed stops answering at once, and its apps stop answering too.
• Wake page: src/web/pages/lapsed.ts serves one server-rendered page with status 402 and no-store. It has the sentence "<name> is asleep because its subscription ended and was not paid again." It also has a Pay again button and one line on how to export, which says the data is kept until the retention date. Non-browser clients get the same sentences as plain text.
• Pay again: the button posts to /pay-again on the forge's own address, and payAgainGate handles it before wakeGate in src/http/server.ts. It accepts only a same-origin Origin and creates a checkout through the same provider seam as a sale (src/billing/pay_again.ts), then redirects 303. If no provider is connected or no paid plan is known, the button is replaced by "ask its operator".
• Wake after paying: nothing new marks it paid. The provider's webhook sets the entitlement to active, the gate lifts, and the next request wakes the forge as it was.

What I chose not to do

• There is no export feature in the repo, so the export line asks the person to request an export from the forge's operator. I did not invent one.
• A cancelled forge sits on the free plan, so pay-again asks for the last paid plan from its change log.
• Dropping the stored data once the retention date passes is not touched.

Try it Deliver a customer.subscription.updated webhook with status canceled for a forge, then open <name>--<forge host>. You get the page, the button goes to the checkout, and an active webhook wakes the forge.

The pre-push hook demanded a commit saying how to try the change, so the second commit is an empty Try: one.

Closes #11393

A forge whose billing is none now sleeps, and its address answers with a page and not its apps until it is paid. A new test, test/billing-lapsed-sleep.test.ts, drives none → asleep and unwakeable → paid → awake and passes. gate, tsc, design-lint, the billing, disk-floor and sleep tests, and 26 test files that touch hosted children all pass. I did not run the whole suite; the forge's check does that on this push. I couldn't call keep_plan (it was not among my tools), so there is no plan on the issue.

What changed

• Sleep: the check lives in src/spawn/host.ts and goes through the existing sleep path, sleepChild. A new sleepLapsed runs on the idle sweep timer (every 60 s at most). wakeGate and resolveHostedChildApp also check on every request, so a forge that just lapsed stops answering at once, and its apps stop answering too.
• Wake page: src/web/pages/lapsed.ts serves one server-rendered page with status 402 and no-store. It has the sentence "<name> is asleep because its subscription ended and was not paid again." It also has a Pay again button and one line on how to export, which says the data is kept until the retention date. Non-browser clients get the same sentences as plain text.
• Pay again: the button posts to /pay-again on the forge's own address, and payAgainGate handles it before wakeGate in src/http/server.ts. It accepts only a same-origin Origin and creates a checkout through the same provider seam as a sale (src/billing/pay_again.ts), then redirects 303. If no provider is connected or no paid plan is known, the button is replaced by "ask its operator".
• Wake after paying: nothing new marks it paid. The provider's webhook sets the entitlement to active, the gate lifts, and the next request wakes the forge as it was.

What I chose not to do

• There is no export feature in the repo, so the export line asks the person to request an export from the forge's operator. I did not invent one.
• A cancelled forge sits on the free plan, so pay-again asks for the last paid plan from its change log.
• Dropping the stored data once the retention date passes is not touched.

Try it Deliver a customer.subscription.updated webhook with status canceled for a forge, then open <name>--<forge host>. You get the page, the button goes to the checkout, and an active webhook wakes the forge.

The pre-push hook demanded a commit saying how to try the change, so the second commit is an empty Try: one.

I pushed an empty commit whose message carries the two lines the gate asked for. Nothing in the code changed, and the earlier tests, tsc and design-lint results still stand. I haven't seen the forge's check pass yet.

• No door: The wake page is what a visitor sees at a sleeping forge's address, and a terminal has no such address to visit. Plain-text clients still get the same sentences.
• Direction: Issue #11393 is the billing-lapse slice of #11140, which asks for it ahead of the pipeline items.

I wrote both reasons myself. If a person disagrees with either, the fix is a terminal screen plus a docs/features how-to, or a pipeline change.

Running bun scripts/gate.ts locally after the commit printed nothing and exited cleanly.

Both blocking points are fixed, and I kept the public lapse page as it is — that one is your call (last paragraph). I ran tsc, the gate, and the tests for the lapse flow, rate limits, palette roster, README cap, and the other docs/palette tests. scripts/fast.ts reported the diff as too broad to name tests, so I did not run the full suite; the forge's check will.

Both doors

• New terminal screen src/tui/screens/lapsed.ts, with the palette entry Lapsed forges placed after Billing in entries.ts. It is offered to forge admins who are people.
• For each forge whose billing is none, it shows the lapse sentence, the keep-until date and the export line. p starts the pay-again checkout (the same startPayAgain the page uses) and prints the address to hand to the payer. The checkout's success and cancel address is the sleeping forge's own address.
• The how-to is docs/features/lapsed-forge.md. README is untouched.
• The sentences moved to src/billing/lapse_words.ts, so the page and the terminal say the same thing.
• test/palette-roster.test.ts now lists the new entry.
• The first commit's "No door" line is still in history, since I can't rewrite it. It is stale, because both doors now exist.

Rate limit

• POST /pay-again now counts each press through a new pay door in strangers.ts (takeDoor), before any checkout is made. The limit is 5 a minute per address and 60 a minute for the whole forge. Past that it answers 429 with Retry-After.
• test/billing-lapsed-sleep.test.ts has a new test: two presses succeed, the third gets 429 and creates no checkout, and a second address has its own count. A second new test covers what the terminal screen lists.

Public disclosure I did not change it. The issue asks that a wake show "what happened" and "how to export", and the visitor at that address is usually the forge's owner, who has no session on the child's host to prove it. The how-to now states that the sentences are public.

If you want strangers to see only "asleep", I can drop the date from the page and the plain-text answer, and show it only in the admin terminal screen. Say so and I'll make that change.