GOO-415 · local stack · 2026-10-28

Per-org credit rollover: what was proven

The admin switch on the customer detail page was clicked in a real browser, and the result was checked in the gateway, the database and the logs. The allocation change is proven against real Postgres by the service tests. Only the Stripe webhook hop in front of it could not run locally.

Which hops were exercised

Admin toggle Switch (browser)→ Next proxy route→ Gateway PATCH + admin auth→ organizations row→ Reload reads it back

Monthly renewal Stripe webhook → gateway→ go-credits handler→ AllocateMonthlyCredits→ credit_ledger rows

exercised end to end, this run service test real Postgres, called directly not run no Stripe key locally

Part A: the admin switch PASS

Signed in through a Clerk dev sign-in token as the platform admin, at /admin/customers/036bb424-47ab-42ee-ba4c-0bbbc28a83ec, viewport 1600×1000.

Step	Wire	Database
Page load	`GET …/organizations/036bb424…` 200, `"credit_rollover_enabled":false`	f	PASS
Click on	`PATCH …/credit-rollover {"enabled":true}` → 200 `{"message":"Credit rollover updated"}`	t (20:42:34 UTC)	PASS
Reload	GET returns `true`, switch `aria-checked="true"`	t	PASS
Click off	`PATCH …/credit-rollover {"enabled":false}` → 200	f (20:42:52 UTC)	PASS
Reload	GET returns `false`, switch `aria-checked="false"`	f	PASS

Customer header with the rollover switch off on first load — First load: off

Customer header with the rollover switch on after clicking — After clicking: on

Customer header with the rollover switch still on after a reload — After a reload: still on

Customer header with the rollover switch off after turning it off and reloading — Turned off, reloaded: off

Gateway audit lines, verbatim (`/tmp/main.log`)

{"time":"2026-10-28T04:42:34.434842+08:00","severity":"INFO","message":"[Admin] <platform-admin email> set credit_rollover_enabled=true for org 036bb424-47ab-42ee-ba4c-0bbbc28a83ec","logging.googleapis.com/labels":{"service":"main"}}
{"time":"2026-10-28T04:42:52.741535+08:00","severity":"INFO","message":"[Admin] <platform-admin email> set credit_rollover_enabled=false for org 036bb424-47ab-42ee-ba4c-0bbbc28a83ec","logging.googleapis.com/labels":{"service":"main"}}

Earlier API checks against the same gateway: {} → 400 (the field is required), an unknown org → 404, and the field appears in both the customer list and the detail response.

Part B: the renewal allocation SERVICE TEST

The plan was to post a fabricated invoice.payment_succeeded to go-credits for two throwaway orgs. It stopped before any allocation: go-credits registers its Stripe routes only when STRIPE_API_KEY is set (cmd/main.go:41-44, 90-91), and no local env file sets one, so /api/v1/stripe/webhook answers 404. Nothing was worked around, and the two throwaway orgs were deleted.

The allocation itself is covered by the two tests in subscription_allocate_test.go, run against the migrated local Postgres:

--- PASS: TestAllocateMonthlyCredits_IdempotentOnInvoiceKey (0.19s)
--- PASS: TestAllocateMonthlyCredits_RolloverKeepsBalance (0.06s)
PASS
ok  	github.com/goodtake-ai/deimos/services/go-credits/internal/services	0.599s

Case	Seed balance	Ledger written	New balance
Flag off (existing test)	100	`expiry` 100 → 0, then `credit` 0 → 1300; replay of the same invoice is a no-op	1300
Flag on (new test)	12.3456	no `expiry` row; `credit` 12.3456 → 1312.3456	1312.3456

Each of the new test's three assertions was shown to fail on its own target bug: the rollover branch removed, the grant row left at 0, and the returned balance left at the plan amount.

Changed after this run

The branch was rebased onto main before the PR. Main had added its own migration 139, so this one is now 140_org_credit_rollover; the content is unchanged.
Main's GOO-429 renewal email says the balance "has been reset" and that plan credits don't roll over. That is false for a rollover org, so a rolled-over renewal now sends the plain credits-added email instead (stripe_webhook_handler.go, RolledOver on the allocation result).
Both are checked by the allocation tests (now also asserting RolledOver) and main's email template tests, not by the browser run above.

Not covered

The Stripe webhook → gateway → go-credits handler hops for a renewal. Running them needs go-credits restarted with a Stripe key, even a dummy one.
The error toast when a save fails.
Production: turning the flag on for Whitecoat and Yeason is a manual admin step after deploy.

Cleanup, re-queried

The dev user's email and name, set only so the admin check would pass, are back to NULL.
The dev org's flag is back to false. No throwaway orgs, subscriptions or ledger rows remain.
The worktree's git status is identical to the snapshot taken before the run.