[jordan-gibbs]

A free account syncs on every device for its first week. After the week, one device keeps syncing and the others are paused. Paid plans are never paused. The rule ships off (SYNC_PLAN_GATE unset), so merging and deploying this changes nothing until the apps that explain the pause are out.

What it does

• Once the rule applies, every device except the kept one gets 403 sync_paused on the data plane (/relics, /relic/*, /tombstones, /waiting, /keyparams, /ai*, /blob*) and on /sync/socket. Reads are blocked too, because a second device that can still read gets half of sync. Account, device, billing, share and pairing routes stay open.
• The kept device is the first one to sync after the week, which is usually the computer. A request with no device id falls back to the most recently seen device. An account with only one device is never paused.
• POST /account/sync-device picks the kept device. Free accounts can switch once a week, and the first switch after the automatic pick is always allowed. It works with the rule off, too.
• GET /account adds sync_until, sync_device and sync_paused.
• accounts.sync_until overrides the sign-up week. Launch will use it to give existing two-device users extra time.
• The plan is cached per isolate for 60 seconds, so the check doesn't add a D1 read to every sync request.

Schema

Migration 0014_sync_plan.sql adds three nullable columns to accounts. It's metadata-only, with no backfill. Self-host gets the same columns through schema-upgrade.ts.

Docs

OpenAPI 1.4.0 and docs/api.md (error model, GET /account, the new route, the tier table).

Tests

• Worker: 305 passing, 15 of them new in test/syncplan.test.ts.
• Typecheck clean.
• Self-host smoke test passes.

🤖 Generated with Claude Code