feat(billing): let people try the product before handing over a card

The trial now starts inside the product, at email verification, and Stripe
grants none at all: checkout creates a subscription that bills immediately.
Verifying an address is what buys the seven days, which is also the cheapest
abuse control there is.

An unexpired trial is treated as an entitlement the account already holds, so a
Stripe sync can add access but never retracts a trial that has not run out. That
matters most for the abandoned checkout: the resulting incomplete subscription
carries no trial_end, and writing it through would have erased the days the
account still had and locked it out.

Unpaid accounts are bounded by what they can cost us rather than by what they
can do: one workspace, one project, 3 GiB of direct uploads. YouTube imports,
share links, guests, comments and approvals stay unlimited, because those are
the parts worth trying and they cost nothing. isPaidTier() is the new seam;
hasBillingAccess() answers a different question now that access no longer
implies a card.

Signup CTAs, the pricing card, the comparison pages, the terms and the refund
policy all said the trial converts to a paid plan by itself. It no longer does,
so they say what happens instead. Settings and a banner name both dates that
matter: when the trial ends, and the fifteen days after that during which
nothing is deleted.

/admin/growth compares the two funnels on signup to paid within a fixed 30 day
window, not trial to paid. Dropping the card requirement multiplies trials, so
the old ratio can fall while more people actually pay, and reading it that way
would retire the change for the wrong reason.

tests/api/analytics-scoreboard.test.ts

@@ -8,7 +8,11 @@
 import { describe, expect, it, beforeEach, afterEach, vi } from 'vitest';
 import type { AcquisitionChannel, AnalyticsEventName } from '@prisma/client';
 import { db } from '@/lib/db';
-import { AT_RISK_SILENT_DAYS, getScoreboard } from '@/lib/analytics/scoreboard';
+import {
+  AT_RISK_SILENT_DAYS,
+  getCohortComparison,
+  getScoreboard,
+} from '@/lib/analytics/scoreboard';
 import { createUser } from '../factories';
 
 function daysAgo(days: number): Date {
@@ -153,3 +157,91 @@ describe('getScoreboard', () => {
     expect(busyRow?.valueEvents30).toBe(2);
   });
 });
+
+// The cohort comparison is another block of raw SQL, and the part most easily
+// got wrong is the observation window: a conversion that arrives two months
+// after signup belongs to neither cohort's score.
+describe('getCohortComparison', () => {
+  const CUTOVER = '2026-03-01T00:00:00.000Z';
+  const NOW = new Date('2026-05-01T00:00:00.000Z');
+
+  async function seedAccount(params: { createdAt: string; trialAt?: string; paidAt?: string }) {
+    const user = await createUser();
+    await db.user.update({
+      where: { id: user.id },
+      data: { createdAt: new Date(params.createdAt) },
+    });
+
+    if (params.trialAt) {
+      await seedEvent({
+        name: 'TRIAL_STARTED',
+        occurredAt: new Date(params.trialAt),
+        userId: user.id,
+      });
+    }
+    if (params.paidAt) {
+      await seedEvent({
+        name: 'SUBSCRIPTION_STARTED',
+        occurredAt: new Date(params.paidAt),
+        userId: user.id,
+      });
+    }
+
+    return user;
+  }
+
+  it('is null on a deployment that never named a switchover date', async () => {
+    vi.stubEnv('OPENFRAME_CARDLESS_TRIAL_LAUNCHED_AT', '');
+
+    expect(await getCohortComparison(NOW)).toBeNull();
+  });
+
+  it('splits accounts by the cutover and scores each within its 30 days', async () => {
+    vi.stubEnv('OPENFRAME_CARDLESS_TRIAL_LAUNCHED_AT', CUTOVER);
+
+    // Card first: one converted inside the window, one long after it.
+    await seedAccount({
+      createdAt: '2026-02-10T00:00:00.000Z',
+      paidAt: '2026-02-20T00:00:00.000Z',
+    });
+    await seedAccount({
+      createdAt: '2026-02-10T00:00:00.000Z',
+      paidAt: '2026-03-25T00:00:00.000Z',
+    });
+    // Cardless: both took the trial, one paid for it.
+    await seedAccount({
+      createdAt: '2026-03-10T00:00:00.000Z',
+      trialAt: '2026-03-10T00:00:00.000Z',
+      paidAt: '2026-03-20T00:00:00.000Z',
+    });
+    await seedAccount({
+      createdAt: '2026-03-15T00:00:00.000Z',
+      trialAt: '2026-03-15T00:00:00.000Z',
+    });
+    // Older than the matched window, and too new to have been observed yet.
+    await seedAccount({
+      createdAt: '2026-01-01T00:00:00.000Z',
+      paidAt: '2026-01-05T00:00:00.000Z',
+    });
+    await seedAccount({
+      createdAt: '2026-04-15T00:00:00.000Z',
+      paidAt: '2026-04-16T00:00:00.000Z',
+    });
+
+    const comparison = await getCohortComparison(NOW);
+
+    expect(comparison?.rows).toEqual([
+      expect.objectContaining({ cohort: 'CARD_FIRST', signups: 2, trials: 0, paid: 1 }),
+      expect.objectContaining({ cohort: 'CARDLESS', signups: 2, trials: 2, paid: 1 }),
+    ]);
+  });
+
+  it('reports both cohorts as empty rows rather than omitting them', async () => {
+    vi.stubEnv('OPENFRAME_CARDLESS_TRIAL_LAUNCHED_AT', CUTOVER);
+
+    const comparison = await getCohortComparison(NOW);
+
+    expect(comparison?.rows.map((row) => row.cohort)).toEqual(['CARD_FIRST', 'CARDLESS']);
+    expect(comparison?.rows.every((row) => row.signups === 0)).toBe(true);
+  });
+});

tests/api/email-verification.test.ts

@@ -96,6 +96,45 @@ describe('consumeVerificationToken', () => {
     expect(await db.verificationToken.count()).toBe(0);
   });
 
+  // Verification is where the free trial begins, which is what makes a proven
+  // address the price of admission rather than a formality.
+  it('starts the seven day trial on the account it verifies', async () => {
+    const user = await createUser({
+      email: '[email protected]',
+      emailVerified: null,
+      trialEndsAt: null,
+      billingTrialConsumedAt: null,
+    });
+    const token = await createVerificationToken('[email protected]');
+
+    await consumeVerificationToken(token);
+
+    const verified = await db.user.findUniqueOrThrow({ where: { id: user.id } });
+    expect(verified.billingTrialConsumedAt).toBeInstanceOf(Date);
+    const days =
+      (verified.trialEndsAt!.getTime() - verified.billingTrialConsumedAt!.getTime()) /
+      (24 * 60 * 60 * 1000);
+    expect(days).toBe(7);
+  });
+
+  it('does not hand a second trial to an account that already had one', async () => {
+    const consumedAt = new Date('2026-01-01T00:00:00.000Z');
+    const trialEndsAt = new Date('2026-01-08T00:00:00.000Z');
+    const user = await createUser({
+      email: '[email protected]',
+      emailVerified: null,
+      trialEndsAt,
+      billingTrialConsumedAt: consumedAt,
+    });
+    const token = await createVerificationToken('[email protected]');
+
+    await consumeVerificationToken(token);
+
+    const verified = await db.user.findUniqueOrThrow({ where: { id: user.id } });
+    expect(verified.trialEndsAt).toEqual(trialEndsAt);
+    expect(verified.billingTrialConsumedAt).toEqual(consumedAt);
+  });
+
   it('refuses a replayed token and keeps the original verification timestamp', async () => {
     const user = await createUser({ email: '[email protected]', emailVerified: null });
     const token = await createVerificationToken('[email protected]');

tests/api/projects.test.ts

@@ -14,6 +14,7 @@ import {
   addWorkspaceMember,
   createExpiredUser,
   createProject,
+  createSubscribedUser,
   createUser,
   createVideo,
   createWorkspace,
@@ -338,8 +339,10 @@ describe('POST /api/projects', () => {
     expect(stored.allowDownloads).toBe(false);
   });
 
+  // Subscribed rather than the default trial user: three projects is past the
+  // trial's ceiling, and this test is about slugs, not about billing.
   it('gives two projects with the same name distinct slugs', async () => {
-    const owner = await createUser();
+    const owner = await createSubscribedUser();
     const workspace = await createWorkspace({ ownerId: owner.id });
     signedInAs(owner);
 
@@ -355,6 +358,55 @@ describe('POST /api/projects', () => {
     expect(slugs.sort()).toEqual(['same-name', 'same-name-1', 'same-name-2']);
   });
 
+  it('refuses a second project while the owner is on a free trial', async () => {
+    const owner = await createUser();
+    const workspace = await createWorkspace({ ownerId: owner.id });
+    await createProject({ ownerId: owner.id, workspaceId: workspace.id, name: 'First' });
+    signedInAs(owner);
+
+    const response = await callRoute(
+      createProjectRoute,
+      apiRequest('/api/projects', { body: { name: 'Second', workspaceId: workspace.id } })
+    );
+
+    expect(response.status).toBe(403);
+    expect(await db.project.count()).toBe(1);
+  });
+
+  it('lets a paying owner past that ceiling', async () => {
+    const owner = await createSubscribedUser();
+    const workspace = await createWorkspace({ ownerId: owner.id });
+    await createProject({ ownerId: owner.id, workspaceId: workspace.id, name: 'First' });
+    signedInAs(owner);
+
+    const response = await callRoute(
+      createProjectRoute,
+      apiRequest('/api/projects', { body: { name: 'Second', workspaceId: workspace.id } })
+    );
+
+    expect(response.status).toBe(201);
+    expect(await db.project.count()).toBe(2);
+  });
+
+  // The ceiling belongs to the account being billed, so a workspace admin cannot
+  // spend somebody else's trial allowance either.
+  it('counts the ceiling against the workspace owner, not the caller', async () => {
+    const owner = await createUser();
+    const workspace = await createWorkspace({ ownerId: owner.id });
+    await createProject({ ownerId: owner.id, workspaceId: workspace.id, name: 'First' });
+    const admin = await createUser();
+    await addWorkspaceMember({ workspaceId: workspace.id, userId: admin.id, role: 'ADMIN' });
+    signedInAs(admin);
+
+    const response = await callRoute(
+      createProjectRoute,
+      apiRequest('/api/projects', { body: { name: 'Second', workspaceId: workspace.id } })
+    );
+
+    expect(response.status).toBe(403);
+    expect(await db.project.count()).toBe(1);
+  });
+
   it('honours an explicit PUBLIC visibility', async () => {
     const owner = await createUser();
     const workspace = await createWorkspace({ ownerId: owner.id });

tests/api/register.test.ts

@@ -351,6 +351,62 @@ describe('POST /api/auth/register', () => {
     expect(sentMail()).toEqual([]);
   });
 
+  it('refuses a disposable mailbox with 400 and stores nothing', async () => {
+    const response = await post({
+      name: 'Throwaway Person',
+      email: '[email protected]',
+      password: PASSWORD,
+    });
+
+    expect(response.status).toBe(400);
+    expect(await db.user.count()).toBe(0);
+  });
+
+  // The block exists to stop trial farming, which is a self-signup problem. An
+  // invited collaborator was vouched for by a paying customer, so refusing their
+  // address would break that customer's review instead.
+  it('accepts a disposable mailbox when an invitation vouches for it', async () => {
+    const scenario = await seedProject();
+    const invitation = await createInvitation({
+      invitedById: scenario.owner.id,
+      scope: 'PROJECT',
+      projectId: scenario.project.id,
+      email: '[email protected]',
+      role: 'COMMENTATOR',
+    });
+    signedOut();
+
+    const response = await callRoute(
+      register,
+      registerRequest({
+        name: 'Invited Guest',
+        email: '[email protected]',
+        password: PASSWORD,
+        invitationToken: invitation.token,
+      })
+    );
+
+    expect(response.status).toBe(201);
+    expect(await db.user.count()).toBe(2);
+  });
+
+  // SMTP is configured in .env.test, so registration alone proves nothing about
+  // the address and grants no trial. Verification is what starts the clock.
+  it('leaves the trial unstarted until the address has been verified', async () => {
+    const response = await post({
+      name: 'Unverified Person',
+      email: '[email protected]',
+      password: PASSWORD,
+    });
+
+    expect(response.status).toBe(201);
+    const created = await db.user.findUniqueOrThrow({
+      where: { email: '[email protected]' },
+    });
+    expect(created.trialEndsAt).toBeNull();
+    expect(created.billingTrialConsumedAt).toBeNull();
+  });
+
   it('reports the rate limit budget on a successful registration', async () => {
     const response = await post({
       name: 'Rate Limited',

tests/api/storage-quota.test.ts

@@ -27,6 +27,7 @@ import { signedInAs, signedOut } from '../helpers/session';
 import {
   createExpiredUser,
   createProject,
+  createSubscribedUser,
   createUploadReservation,
   createUser,
   createVersion,
@@ -59,9 +60,47 @@ describe('PLAN_STORAGE_LIMIT_BYTES', () => {
   });
 });
 
+// Everything else in this file bills a subscribed account, because the plan
+// ceiling and the advisory lock are what those tests are about. This block is
+// the other half: the same code paths, held to the trial ceiling instead.
+describe('the trial ceiling', () => {
+  it('reports the trial limit rather than the plan limit for a trial account', async () => {
+    const user = await createUser();
+
+    expect((await getUserStorageInfo(user.id)).limitBytes).toBe(BigInt(3) * GIB);
+  });
+
+  it('refuses an upload that a paying account of the same size would be allowed', async () => {
+    const trialUser = await createUser();
+    const paidUser = await createSubscribedUser();
+    const fourGiB = BigInt(4) * GIB;
+
+    expect((await enforceStorageQuota(trialUser.id, fourGiB))?.status).toBe(507);
+    expect(await enforceStorageQuota(paidUser.id, fourGiB)).toBeNull();
+  });
+
+  it('holds a reservation to the trial ceiling too, not only the plain check', async () => {
+    const user = await createUser();
+    await createUploadReservation({ billedUserId: user.id, sizeBytes: BigInt(2) * GIB });
+
+    const result = await reserveStorageQuota(user.id, BigInt(2) * GIB);
+
+    expect('error' in result).toBe(true);
+    expect((result as { error: Response }).error.status).toBe(507);
+  });
+
+  it('still lets a trial account upload inside its own ceiling', async () => {
+    const user = await createUser();
+
+    const result = await reserveStorageQuota(user.id, BigInt(1) * GIB);
+
+    expect('reservationId' in result).toBe(true);
+  });
+});
+
 describe('getUserTotalStorageBytes', () => {
   it('is zero for a user with nothing stored', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
 
     expect(await getUserTotalStorageBytes(user.id)).toBe(BigInt(0));
   });
@@ -93,7 +132,7 @@ describe('getUserTotalStorageBytes', () => {
 
   it('ignores assets billed to somebody else and non-R2 providers', async () => {
     const scenario = await seedProject();
-    const other = await createUser();
+    const other = await createSubscribedUser();
     const video = await createVideo({ projectId: scenario.project.id });
     await createVideoAsset({
       videoId: video.id,
@@ -121,9 +160,9 @@ describe('getUserTotalStorageBytes', () => {
   // Versions are billed through the workspace owner, not through the project
   // owner or the uploader, which is what the join in the raw SQL encodes.
   it('sums r2 video versions through the workspace owner', async () => {
-    const workspaceOwner = await createUser();
+    const workspaceOwner = await createSubscribedUser();
     const workspace = await createWorkspace({ ownerId: workspaceOwner.id });
-    const projectOwner = await createUser();
+    const projectOwner = await createSubscribedUser();
     const project = await createProject({
       ownerId: projectOwner.id,
       workspaceId: workspace.id,
@@ -146,7 +185,7 @@ describe('getUserTotalStorageBytes', () => {
   });
 
   it('counts active reservations and ignores expired ones', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({ billedUserId: user.id, sizeBytes: BigInt(1000) });
     await createUploadReservation({
       billedUserId: user.id,
@@ -158,7 +197,7 @@ describe('getUserTotalStorageBytes', () => {
   });
 
   it('adds the Bunny Stream bytes reported for the user', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     bunnyStorage({ [user.id]: 12_345 });
 
     expect(await getUserTotalStorageBytes(user.id)).toBe(BigInt(12_345));
@@ -167,7 +206,7 @@ describe('getUserTotalStorageBytes', () => {
 
 describe('getUserStorageInfo', () => {
   it('reports the percentage to two decimal places', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: BigInt(50) * GIB,
@@ -181,7 +220,7 @@ describe('getUserStorageInfo', () => {
   });
 
   it('clamps the percentage at 100 when usage exceeds the limit', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES * BigInt(3),
@@ -193,7 +232,7 @@ describe('getUserStorageInfo', () => {
 
 describe('enforceStorageQuota', () => {
   it('allows an upload that stays under the limit', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
 
     expect(await enforceStorageQuota(user.id, BigInt(1024))).toBeNull();
   });
@@ -201,7 +240,7 @@ describe('enforceStorageQuota', () => {
   // The route uses `>=`, so a user sitting exactly on the limit is blocked
   // rather than allowed one more byte.
   it('rejects an upload that lands exactly on the limit', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES - BigInt(1024),
@@ -213,7 +252,7 @@ describe('enforceStorageQuota', () => {
   });
 
   it('allows an upload one byte short of the limit', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES - BigInt(1024),
@@ -224,7 +263,7 @@ describe('enforceStorageQuota', () => {
 
   it('skips the check entirely when Stripe is disabled', async () => {
     vi.stubEnv('OPENFRAME_ENABLE_STRIPE', 'false');
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES,
@@ -236,7 +275,7 @@ describe('enforceStorageQuota', () => {
 
 describe('reserveStorageQuota', () => {
   it('writes a reservation row billed to the user with the requested size', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
 
     const result = await reserveStorageQuota(user.id, BigInt(4096));
 
@@ -250,7 +289,7 @@ describe('reserveStorageQuota', () => {
 
   it('returns a null reservation id and writes nothing when Stripe is disabled', async () => {
     vi.stubEnv('OPENFRAME_ENABLE_STRIPE', 'false');
-    const user = await createUser();
+    const user = await createSubscribedUser();
 
     const result = await reserveStorageQuota(user.id, BigInt(4096));
 
@@ -259,7 +298,7 @@ describe('reserveStorageQuota', () => {
   });
 
   it('refuses a reservation that would cross the limit and writes no row', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES - BigInt(1024),
@@ -289,7 +328,7 @@ describe('reserveStorageQuota', () => {
   });
 
   it('counts Bunny Stream bytes against the reservation', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     bunnyStorage({ [user.id]: Number(PLAN_STORAGE_LIMIT_BYTES - BigInt(1024)) });
 
     const result = await reserveStorageQuota(user.id, BigInt(2048));
@@ -299,7 +338,7 @@ describe('reserveStorageQuota', () => {
   });
 
   it('ignores an expired reservation when computing headroom', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES - BigInt(1024),
@@ -312,8 +351,8 @@ describe('reserveStorageQuota', () => {
   });
 
   it('does not let one user reservations reduce another user headroom', async () => {
-    const heavy = await createUser();
-    const light = await createUser();
+    const heavy = await createSubscribedUser();
+    const light = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: heavy.id,
       sizeBytes: PLAN_STORAGE_LIMIT_BYTES - BigInt(1024),
@@ -328,7 +367,7 @@ describe('reserveStorageQuota', () => {
   // start before either commits, so without serialisation both read the same
   // "used" figure, both see enough headroom, and the user ends up over quota.
   it('serialises two concurrent reservations so only one fits the remaining headroom', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     const used = PLAN_STORAGE_LIMIT_BYTES - BigInt(30) * GIB;
     await createUploadReservation({ billedUserId: user.id, sizeBytes: used });
     // 30 GiB of headroom, and each request wants 20 GiB.
@@ -358,7 +397,7 @@ describe('reserveStorageQuota', () => {
   });
 
   it('grants both concurrent reservations when there is room for both', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     const request = BigInt(20) * GIB;
 
     const results = await Promise.all([
@@ -372,7 +411,7 @@ describe('reserveStorageQuota', () => {
   });
 
   it('serialises five concurrent reservations, granting exactly the number that fit', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     const used = PLAN_STORAGE_LIMIT_BYTES - BigInt(50) * GIB;
     await createUploadReservation({ billedUserId: user.id, sizeBytes: used });
     const request = BigInt(20) * GIB;
@@ -394,8 +433,8 @@ describe('reserveStorageQuota', () => {
   // Different users hash to different advisory lock keys, so they must not
   // block each other.
   it('does not serialise reservations for different users', async () => {
-    const first = await createUser();
-    const second = await createUser();
+    const first = await createSubscribedUser();
+    const second = await createSubscribedUser();
     const request = BigInt(150) * GIB;
 
     const results = await Promise.all([
@@ -410,7 +449,7 @@ describe('reserveStorageQuota', () => {
 
 describe('releaseStorageReservation', () => {
   it('deletes the reservation and frees the headroom', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     const result = await reserveStorageQuota(user.id, BigInt(10) * GIB);
     const reservationId = 'reservationId' in result ? result.reservationId : null;
     expect(reservationId).toBeTruthy();
@@ -423,7 +462,7 @@ describe('releaseStorageReservation', () => {
   });
 
   it('is a no-op for a null id', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({ billedUserId: user.id, sizeBytes: BigInt(1) });
 
     await releaseStorageReservation(null);
@@ -434,8 +473,8 @@ describe('releaseStorageReservation', () => {
   // The billedUserId argument scopes the delete, so a caller cannot release
   // another user's reservation by guessing its id.
   it('refuses to delete a reservation belonging to a different billed user', async () => {
-    const owner = await createUser();
-    const attacker = await createUser();
+    const owner = await createSubscribedUser();
+    const attacker = await createSubscribedUser();
     const reservation = await createUploadReservation({
       billedUserId: owner.id,
       sizeBytes: BigInt(4096),
@@ -466,7 +505,7 @@ describe('GET /api/settings/storage', () => {
   });
 
   it('serialises the byte counts as strings so BigInt survives JSON', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createUploadReservation({
       billedUserId: user.id,
       sizeBytes: BigInt(20) * GIB,

tests/api/workspaces.test.ts

@@ -21,6 +21,7 @@ import {
   addWorkspaceMember,
   createExpiredUser,
   createProject,
+  createSubscribedUser,
   createUser,
   createVideo,
   createWorkspace,
@@ -145,8 +146,10 @@ describe('POST /api/workspaces', () => {
     expect(stored.ownerId).toBe(user.id);
   });
 
+  // Subscribed rather than the default trial user: three workspaces is past the
+  // trial's ceiling, and this test is about slugs, not about billing.
   it('gives same-named workspaces distinct slugs', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     signedInAs(user);
 
     for (let index = 0; index < 3; index += 1) {
@@ -221,8 +224,10 @@ describe('POST /api/workspaces', () => {
     expect(await db.workspace.count()).toBe(1);
   });
 
+  // The name has always promised a subscriber; it used to be handed a trial user,
+  // which passed only because nothing distinguished the two.
   it('lets a subscribed user create any number of workspaces', async () => {
-    const user = await createUser();
+    const user = await createSubscribedUser();
     await createWorkspace({ ownerId: user.id });
     await createWorkspace({ ownerId: user.id });
     signedInAs(user);
@@ -236,6 +241,20 @@ describe('POST /api/workspaces', () => {
     expect(await db.workspace.count()).toBe(3);
   });
 
+  it('refuses a second workspace while the owner is on a free trial', async () => {
+    const user = await createUser();
+    await createWorkspace({ ownerId: user.id });
+    signedInAs(user);
+
+    const response = await callRoute(
+      createWorkspaceRoute,
+      apiRequest('/api/workspaces', { body: { name: 'Second' } })
+    );
+
+    expect(response.status).toBe(403);
+    expect(await db.workspace.count()).toBe(1);
+  });
+
   it('lets a self-hosted instance with billing disabled create freely', async () => {
     vi.stubEnv('OPENFRAME_ENABLE_STRIPE', 'false');
     const expired = await createExpiredUser();