Membership ceilings now hold under concurrency

August 5, 2026

Plan ceilings were checked before the membership row was written, so two accepts arriving together could each see a free seat and both take it. The check and the write now happen together, and the request that loses is refused with the ceiling named rather than failing generically.

Re-enabling a member who had been disabled also skipped the check. It no longer does. Only active memberships count toward a ceiling, so restoring one has to ask for the seat like any other join.

A related fix: a membership is now counted against the ceiling it is actually checked against, rather than a different one that happened to be nearby in the code.