@@ -781,57 +781,70 @@ describe('linking a claimed license', () => {
     expect((await readLicense(license.licenseArn))?.organizationId).toBe(otherOrganizationId)
   })
 
-  it('refuses an organization paying Stripe for a self-serve plan, but not one on Enterprise', async () => {
-    async function organizationOnPlan(plan: string) {
+  it('refuses an organization with a live Stripe self-serve subscription, but not Enterprise or an abandoned checkout', async () => {
+    async function organizationWith(sub: { plan: string; status: string; bound: boolean }) {
       const planOwnerId = await createUser()
       const id = await createOrganization([{ userId: planOwnerId, role: 'owner' }])
       await db.insert(subscription).values({
         id: generateId(),
-        plan,
+        plan: sub.plan,
         referenceId: id,
-        status: 'active',
-        stripeSubscriptionId: `sub_${generateId()}`,
-        metadata: { plan, referenceId: id, seats: 10, monthlyPrice: 100 },
+        status: sub.status,
+        stripeSubscriptionId: sub.bound ? `sub_${generateId()}` : null,
+        metadata: { plan: sub.plan, referenceId: id, seats: 10, monthlyPrice: 100 },
       })
       return { id, planOwnerId }
     }
-    const onTeam = await organizationOnPlan('team_6000')
-    const onEnterprise = await organizationOnPlan('enterprise')
-    const refused = await createClaimedLicense()
-    const linked = await createClaimedLicense()
-    entitlementsByLicense.set(refused.licenseArn, [currentEntitlement()])
-    entitlementsByLicense.set(linked.licenseArn, [currentEntitlement()])
+    async function linkTo(organization: { id: string; planOwnerId: string }) {
+      const license = await createClaimedLicense()
+      entitlementsByLicense.set(license.licenseArn, [currentEntitlement()])
+      const refusal = await linkAwsMarketplaceLicense
+        .execute({
+          principal: createSessionPrincipal({ userId: organization.planOwnerId }),
+          input: {
+            ...CONTACT,
+            organizationId: organization.id,
+            licenseId: license.id,
+            claimToken: license.token,
+          },
+        })
+        .then(
+          () => null,
+          (error: unknown) => error
+        )
+      return { license, refusal }
+    }
 
-    const error = await rejection(
-      linkAwsMarketplaceLicense.execute({
-        principal: createSessionPrincipal({ userId: onTeam.planOwnerId }),
-        input: {
-          ...CONTACT,
-          organizationId: onTeam.id,
-          licenseId: refused.id,
-          claimToken: refused.token,
-        },
-      })
+    const trial = await linkTo(
+      await organizationWith({ plan: 'team_6000', status: 'trialing', bound: true })
     )
-    await linkAwsMarketplaceLicense.execute({
-      principal: createSessionPrincipal({ userId: onEnterprise.planOwnerId }),
-      input: {
-        ...CONTACT,
-        organizationId: onEnterprise.id,
-        licenseId: linked.id,
-        claimToken: linked.token,
-      },
+    const onEnterprise = await organizationWith({
+      plan: 'enterprise',
+      status: 'active',
+      bound: true,
     })
+    const enterprise = await linkTo(onEnterprise)
+    const abandoned = await organizationWith({
+      plan: 'team_6000',
+      status: 'incomplete',
+      bound: false,
+    })
+    const afterAbandoned = await linkTo(abandoned)
 
-    expect(error).toMatchObject({
+    expect(trial.refusal).toMatchObject({
       code: 'conflict',
       message: expect.stringMatching(/already pays/),
     })
-    expect(await readLicense(refused.licenseArn)).toMatchObject({
+    expect(await readLicense(trial.license.licenseArn)).toMatchObject({
       organizationId: null,
-      claimTokenHash: hashClaimToken(refused.token),
+      claimTokenHash: hashClaimToken(trial.license.token),
     })
-    expect((await readLicense(linked.licenseArn))?.organizationId).toBe(onEnterprise.id)
+    expect(enterprise.refusal).toBeNull()
+    expect(afterAbandoned.refusal).toBeNull()
+    expect((await readLicense(enterprise.license.licenseArn))?.organizationId).toBe(onEnterprise.id)
+    expect((await readLicense(afterAbandoned.license.licenseArn))?.organizationId).toBe(
+      abandoned.id
+    )
   })
 
   it('links under a newer active read without overwriting it with its own older one', async () => {
 
@@ -8,7 +8,20 @@ import {
   user,
 } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
-import { and, asc, count, desc, eq, inArray, isNotNull, isNull, lt, ne, or } from 'drizzle-orm'
+import {
+  and,
+  asc,
+  count,
+  desc,
+  eq,
+  inArray,
+  isNotNull,
+  isNull,
+  lt,
+  ne,
+  notInArray,
+  or,
+} from 'drizzle-orm'
 import type { EntitlementSummary } from '@/lib/billing/aws-marketplace/entitlements'
 import {
   AWS_MARKETPLACE_BUYER_NOTICE_EVENT,
@@ -21,7 +34,7 @@ import type {
   AwsMarketplaceProduct,
   AwsMarketplaceProducts,
 } from '@/lib/billing/aws-marketplace/products'
-import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
+import { TERMINAL_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import { enqueueOutboxEvent } from '@/lib/core/outbox/service'
 import type { DbTransaction } from '@/lib/db/types'
 
@@ -732,8 +745,9 @@ export async function linkLicenseForTeam(
 }
 
 /**
- * Whether the organization pays for a self-serve plan through Stripe. Enterprise is provisioned by
- * the team, who pause its collection for a Marketplace customer.
+ * Whether the organization has a live Stripe subscription to a self-serve plan: any it is bound to
+ * that has not finished, since a trial or a payment still pending turns into a charge. Enterprise
+ * is provisioned by the team, who pause its collection for a Marketplace customer.
  */
 export async function paysForSelfServePlan(
   tx: DbTransaction,
@@ -745,7 +759,8 @@ export async function paysForSelfServePlan(
     .where(
       and(
         eq(subscription.referenceId, organizationId),
-        inArray(subscription.status, [...ENTITLED_SUBSCRIPTION_STATUSES]),
+        isNotNull(subscription.stripeSubscriptionId),
+        notInArray(subscription.status, [...TERMINAL_SUBSCRIPTION_STATUSES]),
         ne(subscription.plan, 'enterprise')
       )
     )
 
@@ -25,7 +25,8 @@
 #      (the CloudFormation template creates it).
 #   4. An ACM certificate for the two hostnames below.
 #   5. Two Secrets in the install namespace (no secret ever goes in this file). The template's
-#      DatabasePasswordArn and CacheAuthTokenArn outputs hold the two passwords as plain strings:
+#      DatabasePasswordArn and CacheAuthTokenArn outputs are the ARNs of the Secrets Manager
+#      secrets holding the two passwords; read each password with:
 #        aws secretsmanager get-secret-value --secret-id <arn> --query SecretString --output text
 #        kubectl create secret generic sim-app-secrets --namespace sim \
 #          --from-literal=BETTER_AUTH_SECRET=$(openssl rand -hex 32) \
@@ -50,9 +51,9 @@ app:
     NEXT_PUBLIC_APP_URL: "https://sim.example.com" # EDIT: your public URL
     BETTER_AUTH_URL: "https://sim.example.com" # EDIT: same as NEXT_PUBLIC_APP_URL
     NEXT_PUBLIC_SOCKET_URL: "wss://sim-ws.example.com" # EDIT: the realtime hostname below
-    # The listing's product ID, which the Marketplace chart sets. Its presence turns on the AWS
-    # License Manager check.
-    AWS_MARKETPLACE_LICENSE_PRODUCT_SKU: "prod-xxxxxxxxxxxxx"
+    # The listing's product ID, which the Marketplace chart sets; rendered from this repository,
+    # set it to the product ID shown on the listing. Its presence turns on the License Manager check.
+    AWS_MARKETPLACE_LICENSE_PRODUCT_SKU: "prod-xxxxxxxxxxxxx" # EDIT
 
 realtime:
   replicaCount: 2