# Wundklar · tariff and access states

Trial, read-only, export-only and closed states modelled on the care_service row, with payments disabled in v1.

Payments stay disabled in v1: a platform admin sets the tariff and the
product's trial, read-only and cancellation windows are modelled as
**access states** on the `care_service` row of each Organization. Decision:
[ADR-0032](/docs/adr/0032-care-service-tariff-and-access-states);
code:
[`packages/api/src/features/org-settings`](https://github.com/CarlosZiegler/wundklare/blob/main/packages/api/src/features/org-settings/org-settings.service.ts).

## States [#states]

```
created ──trial──► read_only ──► closed
   │                 ▲
   ├── tariff set during trial or read_only ──► active
   │                                               │
   │                                               └── cancellation ──► export_only ──► closed
```

- `trial` — 30 days from Organization creation; the whole team can read and
  write.
- `read_only` — 90 days after trial without a tariff; reads and exports are
  allowed, writes refuse with `ORG_READ_ONLY`.
- `active` — a tariff was set during trial or read-only; the Organization
  works normally within its active-wound limit.
- `export_only` — cancellation effective date (monthly: end of the current
  month; yearly: end of the period); only exports are allowed for 90 days,
  then `closed`.
- `closed` — everything refuses except the Art. 15 export of the
  patient's own data.

A mutation whose `occurredAt` is before the state transition (within 48 h)
is accepted even in `read_only` so offline work is never lost.

## Active-wound limit [#active-wound-limit]

RN-02 counts wounds assessed in the last 30 days. Above the Organization's
limit, documentation of existing wounds continues; after 14 days of being
over-limit, new wounds fail with `PLAN_LIMIT_EXCEEDED`.

## Enforcement [#enforcement]

The clinical boundary
([ADR-0031](/docs/adr/0031-one-clinical-authorization-boundary)) enforces
the state before role, scope and policy checks. Devices receive the current
`accessState` in every `sync.push`, `sync.pull` and `sync.snapshot`
response ([sync protocol](/docs/features/wundklar-sync)) so the mobile app
can show the right banner, hide the primary action and keep offline
captures queued.

## Transitions [#transitions]

A daily job `accessStates` reads the `care_service` row and advances the
state when the current date crosses a boundary (trial-ends-at,
read-only-until, cancel-effective-at, export-until). Platform admins can
set the tariff with `orgSettings.adminSetTariff`; the trail records the
reason so an auditor can replay the lifecycle.

Trial, read-only and cancellation UI copy comes from the prototype's
`D-Settings` and the service banner on `D-Dashboard`; the exact disclaimer
strings are enforced by the copy guard
[`packages/clinical`](https://github.com/CarlosZiegler/wundklare/blob/main/packages/clinical/package.json).