LISTENER-05 — Weekly Free listening quota and collaboration credits

[nicoechaniz]

Product decision — 2026-08-08

The former recurring two-hour daily schedule is replaced by a simpler account-bound usage quota.

Canonical policy

• Every registered ordinary-Free account receives 3 hours per personal cycle.
• The stable cycle anchor is the first server-authorized playback; cycles then repeat every exact 7 days from that anchor.
• Base time resets to 3 hours at each boundary and never rolls over.
• The separate 30-minute welcome listen and all schedule/time-zone selection are retired.
• Server time is authoritative. Page views and idle preparation do not start or consume a cycle.
• Intro and Beacon playback consume the same quota.
• Up to two devices remain supported; overlapping playback is charged once per account wall-clock second.
• Stop/idle ends metering; abandoned playback is bounded by lease expiry.
• Active canonical membership and the operator Free For All override remain non-metered. Founder price eligibility alone authorizes nothing.
• Future collaboration quests may add auditable, idempotent time grants with optional expiry and no PII; no quest engine is part of this slice.

Migration

• Add forward-only quota/grant persistence and a policy marker.
• Keep applied migrations and historical rows immutable, but do not maintain runtime compatibility with discarded pre-release policies.
• Daily-schedule and welcome APIs are removed and return 404; old clients/binaries are unsupported.
• Existing accounts receive a fresh first cycle on their first post-cutover playback; prior use is not charged retroactively.
• Recovery is stop/kill-switch and roll-forward repair; do not restore the retired policy.

Acceptance

• Atomic PostgreSQL accounting and fixed seven-day cadence from the first-play anchor.
• Exact 3-hour exhaustion, no base rollover and server-authoritative reset.
• One/two-device overlap, gaps, reconnect, eviction, crash/TTL and concurrent first-play coverage.
• No cycle/charge for GET, idle preparation, membership or FFA.
• Intro→Beacon is one continuous metered session without duplicate charge.
• Grants are bounded, auditable, idempotent, expiry-aware and cannot be client-created.
• UI shows server-synchronized remaining time/countdown and removes all daily schedule/welcome controls.
• No audio parameter, event runtime, LiveKit, payment or Proyección del Mito change.
• Exact weekly runtime deployed to isolated Listener with provenance, migration and smoke evidence.

Physical countdown/reset acceptance remains tracked in #216. Full release acceptance remains in #201.

Related: #216, #198, #201 and draft PR #203.

[nicoechaniz]

Product decision approved by Nico on 2026-08-07:

• Listener registration is required for ordinary Free access.
• Free grants one recurring two-hour listening window per day.
• On first entry, the person may choose “listen free now” (the current local time becomes the recurring start) or choose another timezone-aware start.
• The selected daily start remains fixed for a seven-day cooling period; authorization is server-authoritative and never trusts the browser clock.
• Active Founding Listener membership (initial offer USD 2) unlocks listening at any time. The saved Free window remains a separate access layer and must never fabricate paid membership or emit Purchase.
• The operator-controlled global Free for All switch remains independent for demos/public moments.
• Stream leases must be capped/reconciled at the Free window boundary.

Implementation assumption unless product review changes it: the cooling period is rolling seven days from selection, and “now” preserves the person’s local wall-clock start in a validated IANA timezone.

[nicoechaniz]

Implemented and deployed the ordinary Free listening-window vertical in d7ed952 (draft PR #203).

Evidence:

• 2-hour recurring daily window, rolling 7-day change lock, IANA timezone canonicalization and explicit DST policy (spring gaps advance; fall ambiguity uses first occurrence).
• Server-authoritative "now"; schedule state is separate from membership/commerce and cannot emit Purchase.
• Lease acquisition/heartbeat/manifest/drop-ins accept active Free windows and cap grants at the exact window boundary; schedule changes evict existing leases.
• Global Free for All remains independent and was restored after the signed-in smoke.
• Public edge exposes only the exact authenticated schedule endpoint; cross-origin POST is 403, anonymous GET is 401, test-login/internal/email-password remain 404.
• Gates: 1,082 tests passed, TypeScript, ESLint, production build, preview contracts, observability, frozen-audio and stream-origin CI all green.
• Isolated deployment health attests SHA d7ed952 and schema 20260807070000_early_bird_free_schedule.
• Synthetic auth-only staging flow selected "now", rendered "Free window active", acquired a stream lease bounded by activeEnd, and fetched a valid HLS manifest. FFA was then restored and anonymous lease returned 200.

No audio parameters/assets or event/live surfaces changed. Human Google callback acceptance is tracked with the identity work, not this schedule card.

[nicoechaniz]

Additional deployed runtime evidence: with FFA temporarily OFF, the new registered-free smoke exercised a unique synthetic account with a custom future UTC window, exact idempotent replay, 409 seven-day cooldown, and a second account with Listen now. Three devices acquired sequentially; the third displaced the oldest, its heartbeat returned 410 displaced, every lease expiry was at or before activeEnd, and the newest lease fetched a valid signed manifest. FFA was restored ON and anonymous lease returned 200. Reproducible script: scripts/early-birds-preview/registered-free-smoke.sh at aba2057; no real identity, membership, Purchase, payment or audio change.

[nicoechaniz]

Implemented and deployed to the isolated Listener as 808bf0e8fabfaec0b7ee6396fa078739f68f73d4 (schema 20260808160000_listener_weekly_quota, policy personal-7-day-v1). Fresh PostgreSQL 16 applied all 18 migrations; Founder + quota PG tests passed 9/9; final code checkpoint passed 1,396 tests / 28 standard skips, TypeScript, ESLint, build and frozen-audio. Deployed smoke proved first-play anchoring, three-hour allowance, two-device eviction, generation-bound manifests and 404 for retired daily/welcome APIs. No event or acoustic surface changed. Remaining physical countdown/reset acceptance is #216.