Usage Limit Plan Lifecycle
The current revision is the live pointer, the highest historical revision determines the next draft number, and a draft is an independent unpublished state. Revision ordering does not identify a draft.
| Operation | Result |
|---|---|
| Create | Create a Plan and draft v1; rules can initially be empty. |
| Edit | Reuse an existing draft; otherwise allocate historical maximum revision + 1. |
| Publish | Activate the actual draft. Published history becomes immutable. |
| Rollback | Activate the selected published record with its original ID, revision, title, description, and complete rules. No new revision or further Publish step. |
| Discard draft | Delete only actual draft records/rules; restore metadata from current and retain all published history. |
| Archive / restore | Change management visibility, preserving current, drafts, and existing route bindings. Restore and rollback are distinct operations. |
With published v1/v2/v3 and draft v4, moving live v3 → v1 preserves v4’s number, content, and rule IDs. Discard removes only v4; v2/v3 survive. Editing again can allocate v4, and publishing it makes live=v4. Archive/restore never reactivates the highest published revision. Discarded, never-published draft numbers may be reused.
Portal confirmation
Section titled “Portal confirmation”Choose Roll back to revision, select a published target, review its complete read-only snapshot (original publish time, title, description, and every rule) plus current-live-to-target differences, then select Confirm rollback to vN. Selection, preview, and cancellation never write. Failures retain the snapshot for inspection/retry. Current is disabled, but after switching to v1 you can still choose historical v3. A preserved draft is called out separately. Success completes configuration activation.
Configuration and usage windows
Section titled “Configuration and usage windows”Rollback does not reverse bills, usage events, used quota, wallet balances, subscriptions, or Plan Grants. It does not unbind routes, reset all windows, or delete usage accumulators. New policy reads after successful publish/rollback use current configuration; initialized windows retain their frozen snapshots.
For the same rule prefix and window, initialized limit_amount, action, webhook_event, and used quota are not overwritten. New windows initialize from restored live configuration. A lifetime window does not naturally rotate.
A removed historical rule that reappears can resume existing usage and frozen values when its original fields survive with the same prefix/window. Different prefixes or absent original fields can initialize a new accumulator. Neither universal reset nor universal continuity is guaranteed. Original rule IDs and limit keys are preserved, but selector, period, or timezone changes can still affect window identity. Plan-vs-route prefix collisions and normalized collisions within a Plan use distinct internal rule identities; these are not additional public configuration fields.
Failure and retry
Section titled “Failure and retry”Lifecycle commands serialize per Plan in transaction commit order. A failed cache refresh returns 503, committed=true, and the committed version. Read current first, then repeat rollback if that is still the intended target. Do not republish a published revision. If a client crashes or never retries, TTL only provides eventual expiry/backfill; a failed operation must not be presented as successful synchronization across instances.
In Portal, a committed publish failure reloads live state and prevents publishing the same revision again. Choose Retry current version sync on the Plan detail page, inspect the current published snapshot, then select Confirm sync for vN. This entry remains available after closing a dialog or reloading the page, including after a committed rollback failure. It calls rollback for the displayed current revision; it does not create a draft or reset usage. If the pre-submit read finds that current has changed, Portal displays the updated snapshot and requires confirmation again. Opening or cancelling never writes.