Workspaces, Plans & Billing

Chronicler is free to run yourself and paid to have hosted. That single fact shapes the whole commercial layer, because every limit and every payment has to be optional. Turn billing off and the product still has to make complete sense. This area also went through a few naming passes before it settled, so it is worth reading for the words as much as the mechanics.

A workspace owns the worlds

A workspace is the single owner of a set of chronicles and the home for quota and cross-world roles. Every user gets a permanent personal workspace on signup, and shared workspaces are created deliberately and can invite members. A chronicle points at its owning workspace through one edge, so usage is attributed through that edge and re-attributes cleanly when a world is handed to a different workspace. A workspace is a management and attribution layer, not a hard wall between tenants, but the single owner edge is exactly what would let it harden into one later.

Four words, kept distinct

The money model turns on four words that early drafts kept blurring, so they are now pinned down.

A plan is a template of entitlements. An allocation is the live instance of a plan, owned by one user, holding that plan's entitlements and its credit ledgers; workspaces attach to an allocation to take its plan. A billing subscription is the real-world payment that grants a plan, and it exists only inside the hosted billing module. A grant is a permission row in access control, and nothing else. Keeping these separate is what lets the free self-host edition talk about plans and entitlements without ever mentioning a payment.

Assigning a plan snapshots its caps onto the allocation, so editing a plan later never silently moves a live tenant. Pushing that change out is an explicit migration a person decides to run.

A downgrade freezes growth, it never deletes

This is the decision most worth understanding. When a tenant moves to a smaller plan, or lets a payment lapse, or archives a world, Chronicler does not reach in and delete anything. It freezes growth at the write boundary. Reads, edits, and deletes all keep working, and only a write that adds to a metered quantity is refused. A person who stops paying still owns their data and can still get it out.

An archived chronicle goes dormant and stops counting against the resource cap, though its bytes keep counting against storage, because a disk costs money whether or not anyone is reading it. Bringing it back runs one capacity check, which removes any need for an artificial cool-off period.

Usage is counted, never stored

A metered number is counted at the moment of the write, never kept in a column that could quietly drift out of step with reality. Storage, seats, and resources are metered per workspace. A pooled measure like AI credits is a single number on the allocation that attached workspaces draw from, optionally under a per-workspace draw cap. A user's class in a workspace, their standing, is declared on their role rather than guessed from the permissions the role happens to hold, so editing a role can never silently reclassify someone and blow a cap. And a table always includes one free place, because someone has to run the game and that person is the customer, not an extra seat to charge for.

Money enters only the hosted edition

Billing is hosted-only, full stop. A self-host install has no payment provider and never asks for one. In the hosted edition a plan change becomes a first-class request with a clear yes-or-no outcome, and a fulfilment port decides how to satisfy it: the self-host adapter routes to admin approval, the hosted adapter opens a Stripe checkout and lets a webhook drive the request to done, with a reconcile chore as a backstop. A plan itself carries no price. The price is a sidecar the billing module fills in, so the core code never names a payment provider at all.

Where this connects

Standing and roles lean on Authorization, and the hosted billing module is one instance of the pattern in Modules and editions.