fix(billing): bound every ledger aggregate at the database and size the gate deadline for two

[waleedlatif1]

Summary

• Follow-up to fix(billing): let a slow ledger read finish instead of blocking execution at the singleflight default #8146, which bounded only the plain ledger sum. An independent audit of that change found the usage gate's producer runs other ledger aggregates that were still unbounded: the weekly-refresh scan for Pro and Team payers, and the per-member cap sum for organizations with member limits. For those payers the gate could still give up before the database ended the read, which was the failure fix(billing): let a slow ledger read finish instead of blocking execution at the singleflight default #8146 set out to remove
• Extracts one helper, readLedgerBounded, that runs a ledger aggregate in a transaction of its own under SET LOCAL statement_timeout = USAGE_LEDGER_STATEMENT_TIMEOUT_MS, and applies it to every aggregate over the usage ledger: the period sum, the workflow-run count, the source-subset sum, the per-user sum, both weekly-refresh scans, and the member-cap sum
• Sizes the gate's coalescing deadline for the producer's actual worst case: at most two ledger aggregates run in sequence (the payer's usage, then a member's cap), so the deadline is 2 × USAGE_LEDGER_STATEMENT_TIMEOUT_MS + 15 s, and the comment now states that invariant accurately
• Undoes the mock row re-ordering fix(billing): let a slow ledger read finish instead of blocking execution at the singleflight default #8146 added to the enterprise-provisioning test: with both reads bounded the same way their original order holds again

Type of Change

• Bug fix

Testing

• New helper test pins the bound is set inside one transaction on the given client before the read, and that read failures surface
• Every ledger aggregate has a test asserting it reads through the bounded transaction; removing the bound fails 7 tests
• Real-Postgres suites for the ledger and member limits pass against a local database (24 tests), exercising the transaction and SET LOCAL for real
• bun run lint, check:audits (47 audits), docs-manifest:check, type-check pass; 1,031 billing and admission tests pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 22, 2026 7:15pm UTC

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previously reported unbounded stamped-period aggregate is fixed and no new actionable issues remain.

Summary

This follow-up consistently applies a transaction-local statement timeout to payer ledger aggregates and allows the usage gate enough time for its worst-case sequence.

• Extracts readLedgerBounded to establish SET LOCAL statement_timeout before each aggregate.
• Routes period, workflow-count, source-subset, per-user, weekly-refresh, member-cap, and stamped-range aggregates through the helper.
• Expands the gate settlement deadline to cover two sequential bounded reads.
• Adds focused coverage for timeout ordering, error propagation, and each migrated aggregate.

Diagram

sequenceDiagram
  participant Caller
  participant Gate as Usage Gate
  participant DB as PostgreSQL
  Caller->>Gate: Request usage decision
  Gate->>DB: BEGIN
  Gate->>DB: SET LOCAL statement_timeout
  Gate->>DB: Aggregate payer usage
  DB-->>Gate: Usage result
  Gate->>DB: COMMIT
  opt Organization member cap applies
    Gate->>DB: BEGIN
    Gate->>DB: SET LOCAL statement_timeout
    Gate->>DB: Aggregate member usage
    DB-->>Gate: Member result
    Gate->>DB: COMMIT
  end
  Gate-->>Caller: Admission decision

Loading

_{Reviews (2) · Last reviewed commit: "fix(billing): bound the cycle-close per-..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}