- Shipped
- September 3, 2026 at 4:28 AM UTC
- Author
- Kamo
- Commit
- 8dc3ea4
SecurityService answers /api/security/entitlements/me out of Redis with a 15-minute TTL, invalidated by messages on kamo.entitlements.invalidate. Every self-serve billing path publishes there when it changes a subscription; provisionCompSubscription never did. So a freshly comped organization went on being served its pre-comp answer for up to fifteen minutes, and the browser's own ~60s cache on top of that. The nav trial chip kept counting down, the upgrade offer kept advertising a discount, and the feature grants stayed on the trial's catalogue — all of it describing a subscription that no longer existed. The row was right; everything reading it was stale. Publish both keys. They answer different questions: SUBSCRIPTION reaches the licence holders, ORG reaches every member of the organization — and the trial banner is deliberately org-level, so a member holding no seat has a stale answer of their own to drop. The template is injected optionally and the publish never throws. A comp that provisioned correctly must not report failure because a cache could not be notified, and a service embedding this library without Redis must still be able to sell a subscription.