- Ya
- 25 Agosti 2026, 16:29 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 1781b32
Creating an org and opening it are different events. An org can be created and left sitting, and one nobody has walked into must not have spent its evaluation — so creation seeds the trial pending again and entering is what starts the clock. The start moved into PostAuth***Service.create***Id, the single place a real session is minted. Login, the workspace picker, mobile device auth and the post-verification auto-session therefore all start it without each having to remember to, and a future entry path inherits the behaviour. Sudo sessions are excluded: enter-as and impersonation are an administrator opening somebody else's org, which is not the customer arriving and must not spend their trial. The explicit calls in SecurityController and SignInCompletionService are gone as redundant, and the latter no longer needs BillingSetupService at all. Org creation keeps one explicit call. It hands the owner a session before this commit runs, so that mint finds no subscription to start — billing is seeded afterCommit. The afterCommit ratchet caught that the call needed REQUIRES_NEW, without which the write would have been silently discarded and a new org's trial would never have started at all.