Wundklar · tariff and access states

Payments stay disabled in v1: a platform admin sets the tariff and the product's trial, read-only and cancellation windows are modelled as access states on the care_service row of each Organization. Decision: ADR-0032; code: packages/api/src/features/org-settings.

States

created ──trial──► read_only ──► closed
   │                 ▲
   ├── tariff set during trial or read_only ──► active
   │                                               │
   │                                               └── cancellation ──► export_only ──► closed

trial — 30 days from Organization creation; the whole team can read and write.
read_only — 90 days after trial without a tariff; reads and exports are allowed, writes refuse with ORG_READ_ONLY.
active — a tariff was set during trial or read-only; the Organization works normally within its active-wound limit.
export_only — cancellation effective date (monthly: end of the current month; yearly: end of the period); only exports are allowed for 90 days, then closed.
closed — everything refuses except the Art. 15 export of the patient's own data.

A mutation whose occurredAt is before the state transition (within 48 h) is accepted even in read_only so offline work is never lost.

Active-wound limit

RN-02 counts wounds assessed in the last 30 days. Above the Organization's limit, documentation of existing wounds continues; after 14 days of being over-limit, new wounds fail with PLAN_LIMIT_EXCEEDED.

Enforcement

The clinical boundary (ADR-0031) enforces the state before role, scope and policy checks. Devices receive the current accessState in every sync.push, sync.pull and sync.snapshot response (sync protocol) so the mobile app can show the right banner, hide the primary action and keep offline captures queued.

Transitions

A daily job accessStates reads the care_service row and advances the state when the current date crosses a boundary (trial-ends-at, read-only-until, cancel-effective-at, export-until). Platform admins can set the tariff with orgSettings.adminSetTariff; the trail records the reason so an auditor can replay the lifecycle.

Trial, read-only and cancellation UI copy comes from the prototype's D-Settings and the service banner on D-Dashboard; the exact disclaimer strings are enforced by the copy guard packages/clinical.