kill-switch guarantees + billing hardening

app/billing.py

@@ -143,6 +143,7 @@ async def handle_checkout_completed(db: AsyncSession, event: dict, *, origin: st
         if existing is not None:
             # retry/duplicate delivery — make sure it's on and linked, then stop
             existing.chatbot_enabled = True
+            existing.disabled_reason = ""
             if subscription_id:
                 existing.stripe_subscription_id = subscription_id
             await db.flush()
@@ -177,6 +178,39 @@ async def handle_checkout_completed(db: AsyncSession, event: dict, *, origin: st
     return {"status": "provisioned", "slug": slug, "email_sent": sent}
 
 
+def _as_id(value: object) -> str:
+    """A Stripe reference can come as the bare id or the expanded object."""
+    if isinstance(value, dict):
+        return value.get("id") or ""
+    return value if isinstance(value, str) else ""
+
+
+def _invoice_subscription_id(invoice: dict) -> str:
+    """Subscription id of an invoice event, across Stripe API versions.
+
+    Pre-Basil (< 2025-03-31) invoices carry a top-level "subscription"; newer
+    versions moved it to parent.subscription_details and onto each line item
+    (parent.subscription_item_details / line.subscription). Check them all.
+    """
+    sub = _as_id(invoice.get("subscription"))
+    if sub:
+        return sub
+    sub = _as_id(((invoice.get("parent") or {}).get("subscription_details") or {})
+                 .get("subscription"))
+    if sub:
+        return sub
+    for line in (invoice.get("lines") or {}).get("data") or []:
+        sub = _as_id(line.get("subscription"))
+        if sub:
+            return sub
+        line_parent = line.get("parent") or {}
+        for details in ("subscription_item_details", "subscription_details"):
+            sub = _as_id((line_parent.get(details) or {}).get("subscription"))
+            if sub:
+                return sub
+    return ""
+
+
 async def handle_subscription_event(db: AsyncSession, event: dict) -> dict:
     """Map subscription lifecycle to the chatbot master switch."""
     etype = event.get("type") or ""
@@ -191,13 +225,42 @@ async def handle_subscription_event(db: AsyncSession, event: dict) -> dict:
         return {"status": "unknown_customer"}
 
     if etype == "customer.subscription.deleted":
+        deleted_id = _as_id(obj.get("id"))
+        if (
+            deleted_id
+            and tenant.stripe_subscription_id
+            and deleted_id != tenant.stripe_subscription_id
+        ):
+            # Late delivery for an OLD subscription: the client already
+            # re-purchased (the tenant is linked to a newer one), so a stale
+            # cancel must never switch off a paying client.
+            log.info("stripe: stale subscription.deleted (%s) ignored for %s",
+                     deleted_id, tenant.slug)
+            return {"status": "stale_subscription", "slug": tenant.slug}
         tenant.chatbot_enabled = False
+        tenant.disabled_reason = "billing"
+        # Unlink the dead subscription: a late invoice.paid for it (Stripe does
+        # not guarantee event order) must never resurrect a canceled client.
+        tenant.stripe_subscription_id = ""
         await db.flush()
         log.info("stripe: subscription deleted -> chatbot OFF for %s", tenant.slug)
         return {"status": "disabled", "slug": tenant.slug}
     if etype == "invoice.paid":
         if not tenant.chatbot_enabled:
+            if tenant.disabled_reason == "admin":
+                # Manually paused by the owner — only the owner may re-enable.
+                log.info("stripe: invoice paid but %s is admin-paused; staying OFF",
+                         tenant.slug)
+                return {"status": "admin_paused", "slug": tenant.slug}
+            sub_id = _invoice_subscription_id(obj)
+            if not sub_id or sub_id != tenant.stripe_subscription_id:
+                # Late/out-of-order invoice for a subscription that is no
+                # longer this tenant's active one — do not resurrect.
+                log.info("stripe: invoice paid for %s ignored (subscription %r "
+                         "does not match)", tenant.slug, sub_id)
+                return {"status": "subscription_mismatch", "slug": tenant.slug}
             tenant.chatbot_enabled = True
+            tenant.disabled_reason = ""
             await db.flush()
             log.info("stripe: invoice paid -> chatbot ON for %s", tenant.slug)
         return {"status": "enabled", "slug": tenant.slug}

app/models.py

@@ -88,6 +88,10 @@ class Tenant(Base):
     # Master switch: admin can turn a client's chatbot off (e.g. non-payment)
     # without deleting the account. The widget hides and the chat stops replying.
     chatbot_enabled: Mapped[bool] = mapped_column(default=True)
+    # Why the switch is off: "" (on), "billing" (subscription lapsed) or
+    # "admin" (manually paused). A late Stripe invoice.paid may only undo a
+    # "billing" pause — it must never resurrect an admin-paused client.
+    disabled_reason: Mapped[str] = mapped_column(String(12), default="", server_default="")
     # Free-text instructions from the merchant appended to the system prompt
     # ("we are a consultancy, never quote delivery times", "your job is to sell
     # product X"...). Lets each business tune its assistant's behavior.

app/products/sync.py

@@ -122,8 +122,14 @@ async def sync_tenant(
 
 
 async def sync_all_tenants(db: AsyncSession) -> int:
-    """Sync every tenant that has Shopify connected. Returns tenants synced."""
-    tenants = (await db.execute(select(Tenant))).scalars().all()
+    """Sync every ACTIVE tenant that has Shopify connected. Returns tenants synced.
+
+    Paused tenants (``chatbot_enabled=False`` — e.g. payment lapsed) get zero
+    service, so their catalogs are not fetched or re-embedded either.
+    """
+    tenants = (
+        await db.execute(select(Tenant).where(Tenant.chatbot_enabled.is_(True)))
+    ).scalars().all()
     done = 0
     for tenant in tenants:
         if not tenant.shopify_shop:

app/routes/admin.py

@@ -209,6 +209,10 @@ async def put_tenant(
     fields = body.model_dump(
         exclude={"shopify_client_secret", "whatsapp_token"}, exclude_none=True
     )
+    if body.chatbot_enabled is not None:
+        # Track WHO turned the switch: an admin pause may only be undone by the
+        # admin — a late Stripe invoice.paid must not re-enable this tenant.
+        tenant.disabled_reason = "" if body.chatbot_enabled else "admin"
     await update_tenant(
         db,
         tenant,
@@ -547,9 +551,28 @@ async def wa_reply(
 
 @router.delete("/tenants/{slug}", dependencies=[Depends(require_admin)])
 async def delete_tenant(
-    slug: str, db: AsyncSession = Depends(get_session)
+    slug: str,
+    db: AsyncSession = Depends(get_session),
+    settings: Settings = Depends(get_settings),
 ) -> dict[str, bool]:
     tenant = await _require_tenant(db, slug)
+    # Cancel the client's Stripe subscription first (best-effort): a deleted
+    # tenant must never keep getting charged. Skipped when no key is configured
+    # (dev/tests); a Stripe failure never blocks the deletion itself.
+    if tenant.stripe_subscription_id and settings.stripe_secret_key:
+        import httpx
+
+        url = f"https://api.stripe.com/v1/subscriptions/{tenant.stripe_subscription_id}"
+        try:
+            async with httpx.AsyncClient(timeout=15.0) as client:
+                r = await client.delete(
+                    url, headers={"Authorization": f"Bearer {settings.stripe_secret_key}"}
+                )
+            log.info("stripe: canceled subscription %s for deleted tenant %s (%s)",
+                     tenant.stripe_subscription_id, tenant.slug, r.status_code)
+        except Exception:  # noqa: BLE001 - deletion must not depend on Stripe
+            log.exception("stripe cancel failed for %s; deleting tenant anyway",
+                          tenant.slug)
     # Explicitly remove children first (sqlite has no FK enforcement; Postgres
     # would cascade, but be explicit so both backends behave the same).
     await db.execute(delete(KnowledgeChunk).where(KnowledgeChunk.tenant_id == tenant.id))

app/routes/chat.py

@@ -63,6 +63,11 @@ async def _resolve_tenant(db: AsyncSession, slug: str | None, *, shop: str = "")
         tenant = await get_tenant_by_slug(db, slug)
         if tenant is not None:
             return tenant
+        if slug != DEFAULT_SLUG:
+            # An explicit slug that matches no tenant means a deleted/unknown
+            # client. NEVER fall back to default: their site still embeds the
+            # widget line and would keep a working bot at the owner's expense.
+            raise HTTPException(status_code=404, detail="unknown tenant")
     if shop:
         tenant = (
             await db.execute(select(Tenant).where(Tenant.shopify_shop == shop))
@@ -146,6 +151,10 @@ async def handoff_submit(
     """Public: the widget's 'talk to a human' contact form submits here. Stores
     the request (no SMTP needed) so the merchant follows up by email."""
     tenant = await _resolve_tenant(db, request.query_params.get("t"))
+    if not tenant.chatbot_enabled:
+        # Same gate as chat: a paused (non-paying) store must not keep
+        # harvesting leads (stored + emailed) through the contact form.
+        raise HTTPException(status_code=403, detail="chatbot disabled for this store")
     await create_handoff(
         db, tenant.id,
         name=body.name or "", email=body.email, message=body.message or "",

app/routes/portal.py

@@ -72,6 +72,16 @@ async def require_portal_tenant(
     return tenant
 
 
+def _require_active(tenant: Tenant) -> None:
+    """Resource-consuming actions (crawling, embedding, Shopify catalog pulls)
+    are paid by the owner: a paused tenant (``chatbot_enabled=False``, e.g.
+    payment lapsed) gets zero service here too, same rule as the chat itself.
+    The rest of the portal (leads, config) stays readable so the client can
+    come back and resubscribe."""
+    if not tenant.chatbot_enabled:
+        raise HTTPException(status_code=403, detail="chatbot disabled for this store")
+
+
 @router.get("", response_class=HTMLResponse)
 @router.get("/", response_class=HTMLResponse)
 async def portal_page() -> HTMLResponse:
@@ -170,6 +180,7 @@ async def portal_add_url(
     tenant: Tenant = Depends(require_portal_tenant),
     db: AsyncSession = Depends(get_session),
 ) -> SourceOut:
+    _require_active(tenant)
     src = await sources.add_url_source(db, tenant, body.location)
     await db.commit()
     return SourceOut.model_validate(src, from_attributes=True)
@@ -181,6 +192,7 @@ async def portal_add_file(
     tenant: Tenant = Depends(require_portal_tenant),
     db: AsyncSession = Depends(get_session),
 ) -> SourceOut:
+    _require_active(tenant)
     src = await sources.add_file_source(db, tenant, file.filename, await file.read())
     await db.commit()
     return SourceOut.model_validate(src, from_attributes=True)
@@ -202,6 +214,7 @@ async def portal_reindex(
     tenant: Tenant = Depends(require_portal_tenant),
     db: AsyncSession = Depends(get_session),
 ) -> dict[str, str]:
+    _require_active(tenant)
     await index.reindex_all(db, tenant_id=tenant.id)
     await db.commit()
     return {"status": "reindexed"}
@@ -212,6 +225,7 @@ async def portal_sync_products(
     tenant: Tenant = Depends(require_portal_tenant),
     db: AsyncSession = Depends(get_session),
 ) -> dict:
+    _require_active(tenant)
     from app.products import sync as product_sync
 
     res = await product_sync.sync_tenant(db, tenant)

app/routes/widget.py

@@ -123,12 +123,13 @@ async def widget_config(
     # Never cache: a store's branding/mode/starter changes must show on next load.
     response.headers["Cache-Control"] = "no-store, max-age=0"
     tenant = await get_tenant_by_slug(db, t)
-    if tenant is None and t != DEFAULT_SLUG:
-        # Match the chat's resolution (an unknown slug falls back to default), so
-        # branding and chat never disagree about which tenant a widget shows.
-        tenant = await get_tenant_by_slug(db, DEFAULT_SLUG)
     if tenant is None:
+        # Unknown/deleted slug (or missing default tenant): match the chat's
+        # resolution, which 404s for unknown slugs. enabled=False makes the
+        # widget render NOTHING even though the embed line is still on the
+        # deleted client's site.
         return {
+            "enabled": False,
             "brand_name": "Asistente",
             "brand_color": "#e8491d",
             "welcome": "¡Hola! ¿En qué puedo ayudarte?",

app/scheduler.py

@@ -12,11 +12,12 @@ import asyncio
 import logging
 from datetime import UTC, datetime, timedelta
 
-from sqlalchemy import select
+from sqlalchemy import or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.config import get_settings
 from app.db import get_sessionmaker
-from app.models import KnowledgeSource
+from app.models import KnowledgeSource, Tenant
 from app.rag import index
 from app.store import get_config, upsert_config
 
@@ -24,18 +25,36 @@ log = logging.getLogger(__name__)
 
 _KEY = "last_url_reindex"
 _PRODUCT_KEY = "last_product_sync"
+_BILLING_KEY = "last_billing_reconcile"
 REINDEX_EVERY = timedelta(days=7)
 PRODUCT_SYNC_EVERY = timedelta(days=1)  # catalog text changes more often than docs
+BILLING_RECONCILE_EVERY = timedelta(days=1)
 CHECK_EVERY_SECONDS = 6 * 3600
 FIRST_DELAY_SECONDS = 120  # let boot settle before the first check
 
+# Stripe subscription states that mean "this client is no longer paying".
+# past_due/incomplete are still recoverable, so they keep service for now.
+DEAD_SUBSCRIPTION_STATUSES = {"canceled", "unpaid", "incomplete_expired"}
+
 
 async def reindex_all_urls(db: AsyncSession) -> int:
-    """Re-fetch + re-embed every tenant's URL sources. File sources are static
-    so they're skipped. Per-tenant isolation is intact (each chunk keeps its
+    """Re-fetch + re-embed URL sources of ACTIVE tenants. File sources are
+    static so they're skipped, and paused tenants (chatbot_enabled=False, e.g.
+    payment lapsed) get zero service — their URLs are never crawled or
+    re-embedded. Legacy sources without a tenant (tenant_id NULL) keep
+    refreshing as before. Per-tenant isolation is intact (each chunk keeps its
     own tenant_id). Returns how many sources were refreshed."""
+    paused_ids = select(Tenant.id).where(Tenant.chatbot_enabled.is_(False))
     srcs = (
-        await db.execute(select(KnowledgeSource).where(KnowledgeSource.kind == "url"))
+        await db.execute(
+            select(KnowledgeSource).where(
+                KnowledgeSource.kind == "url",
+                or_(
+                    KnowledgeSource.tenant_id.is_(None),
+                    KnowledgeSource.tenant_id.not_in(paused_ids),
+                ),
+            )
+        )
     ).scalars().all()
     done = 0
     for src in srcs:
@@ -82,10 +101,80 @@ async def _maybe_sync_products() -> None:
         log.info("auto-synced product corpus for %d tenant(s)", n)
 
 
+async def reconcile_billing(db: AsyncSession) -> int:
+    """Safety net for missed Stripe webhooks: ask Stripe directly whether each
+    paying tenant's subscription is still alive, and switch off the ones that
+    are not (zero service for non-payers, same as the webhook would do).
+
+    Skipped entirely when no Stripe key is configured (dev/tests). A Stripe
+    error on one tenant is logged and never blocks the rest — a flaky network
+    must not crash the scheduler loop. Returns how many tenants were paused.
+    """
+    settings = get_settings()
+    if not settings.stripe_secret_key:
+        return 0
+    tenants = (
+        await db.execute(
+            select(Tenant).where(
+                Tenant.chatbot_enabled.is_(True),
+                Tenant.stripe_subscription_id != "",
+            )
+        )
+    ).scalars().all()
+    if not tenants:
+        return 0
+    import httpx
+
+    paused = 0
+    headers = {"Authorization": f"Bearer {settings.stripe_secret_key}"}
+    async with httpx.AsyncClient(timeout=15.0) as client:
+        for tenant in tenants:
+            url = f"https://api.stripe.com/v1/subscriptions/{tenant.stripe_subscription_id}"
+            try:
+                r = await client.get(url, headers=headers)
+                status = (r.json() or {}).get("status", "")
+            except Exception:  # noqa: BLE001 - one Stripe hiccup must not stop the rest
+                log.warning(
+                    "billing reconcile: Stripe check failed for tenant %s", tenant.slug,
+                    exc_info=True,
+                )
+                continue
+            if status in DEAD_SUBSCRIPTION_STATUSES:
+                tenant.chatbot_enabled = False
+                tenant.disabled_reason = "billing"
+                if status != "unpaid":
+                    # canceled/incomplete_expired are terminal: unlink the dead
+                    # subscription (same as the webhook) so a late invoice.paid
+                    # for it can never resurrect this tenant. "unpaid" stays
+                    # linked — actually paying it legitimately re-enables.
+                    tenant.stripe_subscription_id = ""
+                paused += 1
+                log.warning(
+                    "billing reconcile: subscription %s of tenant %s is %s -> chatbot off",
+                    tenant.stripe_subscription_id, tenant.slug, status,
+                )
+    await db.commit()
+    return paused
+
+
+async def _maybe_reconcile_billing() -> None:
+    async with get_sessionmaker()() as db:
+        now = datetime.now(UTC)
+        if not _due(await get_config(db, _BILLING_KEY) or {}, BILLING_RECONCILE_EVERY, now):
+            return
+        n = await reconcile_billing(db)
+        await upsert_config(db, _BILLING_KEY, {"at": now.isoformat()})
+        await db.commit()
+        if n:
+            log.warning("billing reconcile paused %d tenant(s)", n)
+
+
 async def run_periodic_reindex() -> None:
     await asyncio.sleep(FIRST_DELAY_SECONDS)
     while True:
-        for tick in (_maybe_reindex, _maybe_sync_products):
+        # Billing first: a tenant paused for non-payment must not get one
+        # last crawl/sync out of the very same tick.
+        for tick in (_maybe_reconcile_billing, _maybe_reindex, _maybe_sync_products):
             try:
                 await tick()
             except Exception:  # noqa: BLE001 - never let the loop die

app/static/widget.js

@@ -180,7 +180,7 @@
   }
 
   function build() {
-    if (cfg.enabled === false) return;  // admin disabled this store's chatbot
+    if (cfg.enabled !== true) return;  // fail closed: disabled/unknown/error -> render nothing
     injectStyles();
     var name = cfg.assistant_name || cfg.brand_name;
 

docs/IDEAS-2026-06-11.md

@@ -0,0 +1,103 @@
+# Informe de ideas — inteligencia y valor diferencial (2026-06-11)
+
+INFORME FINAL — TOP 10 IDEAS PARA ATENDYO (ponderación: impacto 45% / unicidad 30% / viabilidad 25%, media de 3 jueces)
+
+Repo base de todo: /Users/victorgomez/code/shopify-support-bot
+
+Nota previa de consolidación: los jueces detectaron duplicados. "Recuperador de carritos por WhatsApp" (7.48) y "Rescate de Carrito Conversacional" (7.50) son la misma feature — aquí van fusionadas en una sola entrada (quedándonos con el truco de demo del segundo). Igual con el trío back-in-stock (Aviso-Venta / Dinero en Espera / Avisos que Venden): se construye UNA vez, en su versión "Dinero en Espera". Esto libera hueco para Perfil España en el puesto 10.
+
+========================================
+TOP 10
+========================================
+
+1. DEMO INSTANTANEA "Mira cómo aprende tu tienda en 60 segundos" — 8.00 (I 9.0 / U 7.3 / F 7.0)
+Pitch: "Pega la URL de tu tienda y en un minuto hablas con un bot que ya se sabe tus productos, tus envíos y tus devoluciones — sin registrarte y sin tarjeta."
+Qué hace: campo público en atendyo.com; el prospecto pega su URL, el sistema crawlea web + catálogo Shopify narrando el progreso en español, y abre un chat funcional contra un tenant efímero que se autodestruye a las 48h. El enlace es compartible y captura el lead.
+Por qué no lo tiene nadie: Chatbase/Tidio exigen cuenta, créditos y setup DIY antes de que el bot sepa nada; los gigantes no pueden regalar ingestión anónima porque cada demo les cuesta dinero de OpenAI — tu coste marginal es ~0, y el "teatro de progreso" convierte la CPU lenta gratuita en parte del show.
+Build: reusa crawler BFS + chunker + fastembed + cold-start de productos casi tal cual; nuevo: tenant efímero con TTL (extender el purge RGPD), stream de progreso (SSE o polling), landing UI. OJO: presupuestar control de abuso (SSRF, límites de crawl, rate-limit duro para que no te quemen las keys gratuitas). 3-5 días.
+Es la única idea que fabrica prospectos en vez de asumirlos: con el cold email muerto, esto ES el funnel.
+
+2. QR MAGICO: el bot de TU tienda en TU WhatsApp — 8.00 (I 8.3 / U 8.3 / F 7.0)
+Pitch: "Escanea este código y el bot de tu propia tienda te contesta en tu WhatsApp de toda la vida — hoy, no dentro de un mes de implantación."
+Qué hace: al final de la demo instantánea, un QR abre wa.me a un número demo compartido de Atendyo con código prellenado (DEMO-tutienda); el webhook mapea el código al tenant efímero y el móvil del prospecto conversa con el bot de SU tienda, consultas de pedidos incluidas.
+Por qué no lo tiene nadie: Gorgias AI no corre en WhatsApp a ningún precio, Crisp lo encierra tras 95 USD/mes, Landbot lo vende como producto aparte de ~200 EUR/mes. Nadie puede meter un bot de WhatsApp funcionando para la tienda del propio prospecto en su bolsillo durante la demo. En España, el móvil vibrando con tu propio catálogo es lo que cierra la venta.
+Build: el cerebro WhatsApp completo ya existe (webhooks, dedup, sesiones, tools); nuevo: un número WABA demo propio, routing del keyword al tenant demo, limpieza TTL. La asincronía de WhatsApp (5-30s aceptables) esconde la CPU lenta. 2-3 días + alta del número en Meta.
+
+3. EL EXAMEN DEL BOT (boletín de notas de tu tienda) — 7.80 (I 8.0 / U 7.3 / F 8.0)
+Pitch: "Antes de cobrarte nada, el bot se examina delante de ti: 10 preguntas reales de clientes sobre TU tienda, respondidas con nota y con la fuente de cada respuesta."
+Qué hace: tras la ingesta (en la demo y como botón del portal), el LLM genera las 10 preguntas más probables desde el contenido crawleado, las responde por el pipeline normal y pinta un boletín: verde con fuente, ámbar "tu web no lo dice" con botón "añadir respuesta" que escribe directo en la base de conocimiento.
+Por qué no lo tiene nadie: Tidio tiene un Playground de una pregunta, Chatbase no tiene simulación bulk, Fin asume un help center maduro. Convertir la autoauditoría del bot en el artefacto de venta ("tu web no responde 3 de estas 10") es un movimiento consultivo que un self-serve gigante no va a hacer — y da al email outreach algo honesto que enviar.
+Build: una llamada de cascada para generar preguntas sobre los chunks RAG existentes; respuestas vía pipeline /chat; informe = página simple + plumbing de unresolved-questions ya existente. Corre async en CPU (resultados apareciendo uno a uno = más teatro). 2-3 días.
+
+4. RESCATE DE CARRITO POR WHATSAPP (fusión de las dos fichas de carrito) — 7.50
+Pitch: "Si el cliente pide su carrito y desaparece sin comprar, el bot le escribe solo al día siguiente con el carrito listo — y recupera la venta sin coste por mensaje."
+Qué hace: un job del scheduler escanea sesiones con cart_link sin pedido posterior; en WhatsApp manda UN solo nudge educado dentro de la ventana de servicio de 24h (coste Meta: 0 EUR), en web email Brevo si hay email capturado, o el widget retoma sesión al volver el visitante. Opt-in por tenant, copy editable, horas de silencio. Robar el truco del "modo demo": nudge a los 2 minutos en directo.
+Por qué no lo tiene nadie: la recuperación de carritos por WhatsApp cuesta 50-200 EUR/mes como producto separado (TextYess, CartsGuru); recovery originado en chat no existe en el set competitivo, y Tidio/Gorgias ni siquiera pueden iniciar mensajes en WhatsApp. Es la frase de ingresos que el comerciante español ya quiere comprar.
+Build: eventos products_shown/cart_link ya se registran, el envío WhatsApp ya existe; falta poll de pedidos (o webhook orders/paid) para supresión + job de nudge + toggle en portal. La parte oculta es el matching de identidad. ~1 semana.
+
+5. FACTURA CON NIF EN EL CHAT — 7.38 (la unicidad más alta de toda la lista: 9.0)
+Pitch: "Cuando un cliente pide factura con IVA, el bot le toma el NIF, lo valida al instante y te la deja lista para emitir — sin emails de ida y vuelta."
+Qué hace: tool nuevo: verifica el pedido (flujo existente), recoge conversacionalmente razón social + NIF/CIF/NIE + dirección fiscal, valida el checksum de forma determinista (~30 líneas, caza typos al momento) y te envía por Brevo un borrador de factura con líneas del pedido y desglose de IVA (21/10/4%).
+Por qué no lo tiene nadie: ningún chatbot del mercado sabe qué es un NIF. Es un dolor inexportablemente español que los gigantes jamás localizarán para un tier sub-50 EUR. Señal instantánea de "esto está hecho para tiendas como la mía" y diferenciador potente en el email frío.
+Build: validación determinista (coste cero), recogida conversacional reusa la maquinaria de confirmación/verificación, salida = email Brevo + fila FacturaRequest en el inbox de leads del portal. 4-6 días.
+
+6. INFORME "TU BOT SE PAGA SOLO" — 7.32
+Pitch: "Cada lunes recibes un WhatsApp: 'tu bot generó 437 EUR esta semana', con carritos recuperados y pedidos cerrados demostrados con datos de Shopify, no con humo."
+Qué hace: cart links pasan a ser redirects trackeados (/go/<token>), redenciones de códigos únicos y carritos recuperados se cruzan con pedidos Shopify, y un mensaje semanal al dueño reporta ventas asistidas en euros + carritos + alertas convertidas + top preguntas sin respuesta. Mismo dato en un tile "ventas asistidas" del portal. Consolidar aquí "Informe del Lunes" y "Mientras Dormías" (1-2 días extra de SQL) en UN solo mensaje de lunes con los euros arriba.
+Por qué no lo tiene nadie: todos los incumbentes reportan deflection/resoluciones — su unidad de facturación — nunca ingresos del comerciante; los dashboards de revenue viven en el tier de 360+ USD/mes de Gorgias. A 10 EUR/trimestre, UNA venta atribuida hace la frase de ROI incontestable y renueva sola.
+Build: endpoint /go + tabla de tokens, poll de pedidos, plantilla Brevo, reuso del ledger de analytics. ~1 semana. Aviso de los jueces: atribución honesta o nada — un euro inventado es peor que ninguno. Depende de que existan cart links y códigos: va DESPUÉS del rescate de carritos.
+
+7. EL RETO DEL DESCUENTO (modo a prueba de jetas) — 7.27
+Pitch: "Reta al bot: intenta sacarle un descuento que no existe o inventarte una política de devoluciones — no lo vas a conseguir."
+Qué hace: guard determinista de salida (misma filosofía que el confirm-gate existente): escanea respuestas buscando códigos/porcentajes fuera del allowlist del tenant y patrones de promesa de política, bloquea y reescribe a un honesto "no me consta, te paso con el dueño". En demo, contador en vivo de intentos bloqueados.
+Por qué no lo tiene nadie: tras el caso viral del 80% de descuento negociado, ningún vendor SMB se atreve a vender "intenta romperlo en directo" — pesadilla legal para Intercom/Zendesk e imposible para competidores prompt-only. Convierte el miedo nº1 en el argumento de cierre.
+Build: regex/string scan contra allowlist (create_cart_link ya sanea códigos), pase de reescritura, evento de analytics, banner demo. 1-2 días. Cautela unánime de los jueces: endurécelo de verdad antes de retar a nadie en público, y no uses la palabra "imposible" hasta que el guard la merezca.
+
+8. DINERO EN ESPERA (la versión a construir del trío back-in-stock) — 7.25 (viabilidad 9.0)
+Pitch: "Ve cuántos euros tienes esperando en productos agotados — y en cuanto repones, avisamos nosotros a cada cliente con su enlace de compra."
+Qué hace: card del portal que agrega los StockWatch ya capturados por producto ("8 personas esperan la camiseta azul M = 240 EUR"); el sync diario detecta la reposición y dispara por fin el email prometido con permalink add-to-cart, marcando StockWatch.notified.
+Por qué no lo tiene nadie: las apps standalone de back-in-stock cuestan 19-49 USD/mes ellas solas; nadie bundlea captura + dashboard de demanda en euros + recovery automático cerca de 10 EUR/trimestre. Y repara la promesa rota que el bot hace HOY ("te avisaremos" y nunca avisa) — el coste de no hacerlo es reputacional.
+Build: la idea de menor riesgo de toda la lista: captura y diff diario ya existen (app/products/sync.py, app/scheduler.py); falta el check de transición de inventario, cola Brevo respetando 300/día, flag notified y una card con suma de precios. 2-3 días.
+
+9. RESPUESTAS CON LEY (garantías y devoluciones según la ley española) — 7.17 (U 8.7)
+Pitch: "Tu bot responde sobre garantías y desistimiento citando la ley española de verdad — 3 años de garantía, 14 días de desistimiento — y jamás se inventa una política."
+Qué hace: corpus legal curado (RD-ley 7/2021: garantía de 3 años, desistimiento 14 días, gastos de devolución, matices Canarias/UE) precargado como RAG compartido en ES/CA/GL/EU, fusionado con la política propia de la tienda (la tienda gana, la ley es el suelo), citando artículo.
+Por qué no lo tiene nadie: ningún bot competidor sabe nada de derecho de consumo español; la demo lado a lado es demoledora (Chatbase inventa una política americana de 30 días, el tuyo cita el art. 120). Un vendor US jamás mantendrá contenido estatutario español para un micro-tier.
+Build: ~30 chunks Q&A por idioma en un namespace pgvector compartido consultado junto a los del tenant. 3-5 días de contenido + 1-2 de código. Condición de los jueces: una pasada de revisión jurídica real y disclaimer de responsabilidad antes de venderlo — una respuesta estatutaria errónea es responsabilidad tuya.
+
+10. PERFIL ESPAÑA: Bizum, contrareembolso y Canarias — 7.13
+Pitch: "Marca unas casillas — Bizum sí, contrareembolso no, Canarias con IGIC — y tu bot contesta esas preguntas eternas sin que escribas ni una FAQ."
+Qué hace: formulario estructurado en el portal (métodos de pago, zonas de envío con precio/días incl. Canarias/Baleares/Ceuta/Melilla, umbral de envío gratis) servido como tool determinista: "¿puedo pagar con Bizum?" o "¿enviáis a Canarias?" se responden exactos, nunca alucinados, con plantillas IGIC/DUA. El crawler pre-rellena detectando logos de pago en el checkout/footer.
+Por qué no lo tiene nadie: los bots US literalmente no saben que existe Bizum; los RAG-only lo responden de lo que pilló el crawl o se lo inventan. "Sabe lo de Canarias" es la prueba silenciosa de localización que ningún bot americano puede fingir. Conviene tratarlo como parte del onboarding done-for-you, no como feature suelta.
+Build: una columna JSON en Postgres + formulario + tool de lookup determinista que el orquestador ya sabe rutar; pre-fill = regex sobre páginas ya crawleadas. 4-5 días.
+
+Mención fuera por décimas (7.12): "Fuentes a la vista / Respuestas con recibo" (mismo feature en dos fichas): chips de fuente en cada respuesta + el camino honesto "esto no me consta". Dos días de trabajo que atacan el bloqueador de compra nº1 en cada respuesta de cada demo. Yo lo colaría igualmente en la primera semana — el metadata de chunk ya lleva la URL de origen.
+
+========================================
+LOS 3 QUE ENVIARIA PRIMERO (la historia coherente "esto no lo tiene nadie")
+========================================
+
+1º Demo instantánea -> 2º El examen del bot -> 3º QR mágico
+
+Son una sola máquina de adquisición en tres actos, y atacan tu cuello de botella real: tienes 0 clientes, 0 red y el cold email muerto. Todo lo demás de la lista necesita ser VISTO; estas tres son las únicas que fabrican el ser visto.
+
+El guion de venta queda así, de punta a punta sin intervención tuya:
+- El comerciante pega su URL (o la pegas tú y le mandas el enlace): en 60 segundos el bot se sabe su tienda. Nadie en el mercado deja ver eso antes de registrarse.
+- Acto seguido el bot se examina delante de él: "tu web no responde 3 de estas 10 preguntas" — el cierre consultivo que además justifica los 200 EUR de setup.
+- Escanea el QR y su propia tienda le contesta en SU WhatsApp mientras va en el metro. En España, eso cierra.
+
+Coste total: ~7-11 días de trabajo, marginal ~0 EUR, y cada pieza alimenta a la siguiente (el demo crea el tenant efímero que usan el examen y el QR). Además le da al pipeline de email parado algo honesto que enviar: no "compra mi bot" sino "tu web no responde estas 3 preguntas de tus clientes — míralo tú mismo, sin registro".
+
+Después de ese trío, la primera oleada de producto: Dinero en Espera (2-3 días, repara la mentira actual), Fuentes a la vista (2 días, confianza), Rescate de carritos (la feature de ingresos), y entonces el Informe "se paga solo" para que renueven.
+
+========================================
+3 IDEAS CON BUEN IMPACTO QUE RECHAZARIA (por ahora)
+========================================
+
+1. Tu Pedido Te Habla (avisos de envío proactivos por WhatsApp) — impacto 6.7, unicidad 7.3, pero viabilidad 4.7, la peor de las grandes. "Respondes a la notificación y el bot te contesta" es un foso real, pero exige WABA por tenant, aprobación de plantillas en Meta, opt-in en el checkout y facturación pass-through: un pantano operativo que un producto de 10 EUR/trimestre gestionado por una sola persona no puede absorber. Versión email primero; plantillas WhatsApp cuando haya clientes que lo pidan.
+
+2. El Bot Te Pregunta a Ti (teach-loop por WhatsApp del dueño) — impacto 6.7, la mejor encarnación de "un empleado, no un software", pero parsear la respuesta libre de un dueño distraído por WhatsApp hacia la pregunta pendiente correcta es exactamente donde los modelos gratuitos van a morir: una máquina de estados frágil que convierte respuestas mal enrutadas en conocimiento permanente equivocado. Mismo valor con un décimo del riesgo: el "Buzón de dudas"/gap-filler con magic link y borrador pre-redactado. Nota: hay CUATRO fichas de teach-loop en la lista; se construye UNA.
+
+3. Radar de Ventas Perdidas — unicidad 8.0 y la frase "la talla 42 te costó 540 EUR" es matadora… hasta que el clasificador de la cascada gratuita infla un número, el comerciante escéptico lo caza UNA vez y deja de creerse todos los demás números que le enseñas — incluido el informe de ROI, que es tu arma de renovación. Con tiendas de 30 pedidos/mes tampoco hay volumen para que las cifras signifiquen algo durante meses. V2 para cuando haya tráfico y un clasificador validado.
+
+Patrón general de los jueces que conviene grabarse: la lista contenía ~38 ideas reales disfrazadas de 44 (tres fichas de back-in-stock, dos de carritos, dos de citas de fuentes, dos de exit-intent, cuatro teach-loops). Cada duplicado se construye una vez y se cuenta una vez. Y la regla de oro para tu situación: primero lo que fabrica prospectos (el trío demo), luego lo que repara promesas rotas, luego lo que genera euros atribuibles, y solo al final lo que retiene — porque sin clientes no hay nada que retener.

migrations/versions/0018_disabled_reason.py

@@ -0,0 +1,31 @@
+"""Why a tenant's chatbot is off: "" | "billing" | "admin"
+
+Revision ID: 0018_disabled_reason
+Revises: 0017_custom_instructions
+Create Date: 2026-06-11
+
+Additive, Postgres-guarded. Tests use create_all.
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0018_disabled_reason"
+down_revision = "0017_custom_instructions"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    if op.get_bind().dialect.name != "postgresql":
+        return
+    op.execute(
+        "ALTER TABLE tenants ADD COLUMN IF NOT EXISTS disabled_reason VARCHAR(12) NOT NULL DEFAULT ''"
+    )
+
+
+def downgrade() -> None:
+    if op.get_bind().dialect.name != "postgresql":
+        return
+    op.execute("ALTER TABLE tenants DROP COLUMN IF EXISTS disabled_reason")

tests/products/test_corpus.py

@@ -90,6 +90,38 @@ async def test_sync_builds_corpus_idempotent_and_prunes(db_session):
     assert len(remaining) == 1
 
 
+async def test_sync_all_tenants_skips_paused_syncs_active(db_session, monkeypatch):
+    """A paused tenant (chatbot_enabled=False, e.g. stopped paying) must consume
+    zero sync resources — no client resolved, no rows written — while an active
+    tenant's catalog still gets indexed."""
+    active = await _tenant(db_session, "all-active")
+    paused = await _tenant(db_session, "all-paused")
+    paused.chatbot_enabled = False
+    await db_session.flush()
+
+    resolved_slugs: list[str] = []
+
+    def _fake_resolver(tenant):
+        resolved_slugs.append(tenant.slug)
+        return FakeCatalogClient([_node(1, "Manguera activa", desc="riego de jardín")])
+
+    monkeypatch.setattr(product_sync, "tenant_shopify_client", _fake_resolver)
+
+    done = await product_sync.sync_all_tenants(db_session)
+
+    assert done == 1  # exactly the active tenant was synced
+    assert resolved_slugs == ["all-active"]  # paused never even resolved a client
+
+    active_rows = (await db_session.execute(
+        select(ProductChunk).where(ProductChunk.tenant_id == active.id)
+    )).scalars().all()
+    assert len(active_rows) == 1 and active_rows[0].title == "Manguera activa"
+    paused_rows = (await db_session.execute(
+        select(ProductChunk).where(ProductChunk.tenant_id == paused.id)
+    )).scalars().all()
+    assert paused_rows == []  # nothing indexed for the paused tenant
+
+
 async def test_cross_language_semantic_retrieval(db_session):
     t = await _tenant(db_session, "store-cl")
     nodes = [

tests/routes/test_admin.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
+import httpx
 import pytest
+import respx
 
 AUTH = {"Authorization": "Bearer test-admin-token"}
 
@@ -109,6 +111,97 @@ async def test_delete_tenant(app_client):
     assert (await client.get("/admin/tenants/gone/sources", headers=AUTH)).status_code == 404
 
 
+async def test_admin_chatbot_switch_tracks_disabled_reason(app_client, db_session):
+    """Pausing from the admin marks the tenant 'admin' (so a Stripe payment can
+    never resurrect it); re-enabling clears the mark."""
+    from sqlalchemy import select
+
+    from app.models import Tenant
+
+    _app, client = app_client
+    await client.post("/admin/tenants", headers=AUTH, json={"slug": "pausada"})
+
+    r = await client.put(
+        "/admin/tenants/pausada", headers=AUTH, json={"chatbot_enabled": False}
+    )
+    assert r.status_code == 200 and r.json()["chatbot_enabled"] is False
+    db_session.expire_all()
+    t = (await db_session.execute(select(Tenant).where(Tenant.slug == "pausada"))).scalar_one()
+    assert t.chatbot_enabled is False
+    assert t.disabled_reason == "admin"
+
+    r2 = await client.put(
+        "/admin/tenants/pausada", headers=AUTH, json={"chatbot_enabled": True}
+    )
+    assert r2.status_code == 200 and r2.json()["chatbot_enabled"] is True
+    db_session.expire_all()
+    t = (await db_session.execute(select(Tenant).where(Tenant.slug == "pausada"))).scalar_one()
+    assert t.chatbot_enabled is True
+    assert t.disabled_reason == ""
+
+
+@respx.mock
+async def test_delete_tenant_cancels_stripe_subscription(app_client, db_session, monkeypatch):
+    """Deleting a paying client must also cancel their Stripe subscription so
+    they are never charged again for a service that no longer exists."""
+    from sqlalchemy import select
+
+    from app.config import get_settings
+    from app.models import Tenant
+
+    _app, client = app_client
+    monkeypatch.setattr(get_settings(), "stripe_secret_key", "sk_test_123")
+    await client.post("/admin/tenants", headers=AUTH, json={"slug": "depago"})
+    t = (await db_session.execute(select(Tenant).where(Tenant.slug == "depago"))).scalar_one()
+    t.stripe_subscription_id = "sub_del1"
+    await db_session.commit()
+
+    cancel = respx.delete("https://api.stripe.com/v1/subscriptions/sub_del1").mock(
+        return_value=httpx.Response(200, json={"id": "sub_del1", "status": "canceled"})
+    )
+    d = await client.delete("/admin/tenants/depago", headers=AUTH)
+    assert d.status_code == 200
+    assert d.json() == {"deleted": True}
+    # Stripe really was told to stop charging, with our key
+    assert cancel.called
+    assert cancel.calls.last.request.headers["Authorization"] == "Bearer sk_test_123"
+    db_session.expire_all()
+    rows = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "depago"))
+    ).scalars().all()
+    assert rows == []  # tenant existed above (scalar_one) and is now gone
+
+
+@respx.mock
+async def test_delete_tenant_survives_stripe_failure(app_client, db_session, monkeypatch):
+    """If Stripe is down, the cancel is best-effort: log and DELETE anyway —
+    the business goal is zero service for deleted clients, immediately."""
+    from sqlalchemy import select
+
+    from app.config import get_settings
+    from app.models import Tenant
+
+    _app, client = app_client
+    monkeypatch.setattr(get_settings(), "stripe_secret_key", "sk_test_123")
+    await client.post("/admin/tenants", headers=AUTH, json={"slug": "caida"})
+    t = (await db_session.execute(select(Tenant).where(Tenant.slug == "caida"))).scalar_one()
+    t.stripe_subscription_id = "sub_del2"
+    await db_session.commit()
+
+    cancel = respx.delete("https://api.stripe.com/v1/subscriptions/sub_del2").mock(
+        side_effect=httpx.ConnectError("stripe caido")
+    )
+    d = await client.delete("/admin/tenants/caida", headers=AUTH)
+    assert d.status_code == 200
+    assert d.json() == {"deleted": True}
+    assert cancel.called  # the cancel WAS attempted before deleting
+    db_session.expire_all()
+    rows = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "caida"))
+    ).scalars().all()
+    assert rows == []
+
+
 async def test_delete_tenant_purges_all_child_rows(app_client, db_session):
     """Deleting a client must remove EVERY tenant-scoped row (incl. the tables
     added after the endpoint was written: product corpus, analytics, watches),

tests/routes/test_killswitch.py

@@ -0,0 +1,191 @@
+"""Kill switch: a DELETED or PAUSED client must get ZERO service even though
+their website still embeds <script src=".../widget.js?t=slug" defer>.
+
+Regression for the critical hole where an unknown/deleted slug FELL BACK to the
+'default' tenant, keeping a fully working bot at the owner's LLM expense. Every
+test first proves the path WORKS while the tenant is alive/enabled (rows + LLM
+calls + emails happen), then deletes/pauses and asserts the exact same request
+is refused with nothing stored, no LLM call and no email.
+"""
+
+from __future__ import annotations
+
+from sqlalchemy import func, select
+
+import app.mailer as mailer
+from app.config import get_settings
+from app.deps import get_router
+from app.llm.base import ChatResult
+from app.models import ChatSession, Event, HandoffRequest
+
+AUTH = {"Authorization": "Bearer test-admin-token"}
+
+
+class RecordingRouter:
+    """Fake LLM router that records every call so tests can assert ZERO calls
+    happen for a deleted tenant (same dependency-override pattern as
+    tests/routes/test_simple_mode.py)."""
+
+    def __init__(self):
+        self.calls = []
+
+    async def chat(self, messages, tools, tier="large", temperature=None, order=None, tool_choice=None, max_tokens=None):
+        self.calls.append(messages)
+        return ChatResult(content="¡Hola! Soy el asistente.", tool_calls=[], finish_reason="stop")
+
+
+async def _count(db, model) -> int:
+    return (await db.execute(select(func.count()).select_from(model))).scalar_one()
+
+
+async def _setup_default_and(client, slug: str) -> None:
+    """A real 'default' tenant exists (the fallback target) plus the tenant
+    under test — so a fallback bug would SUCCEED, not 404 by accident."""
+    r = await client.post("/admin/tenants", headers=AUTH, json={"slug": "default"})
+    assert r.status_code == 201
+    r = await client.post("/admin/tenants", headers=AUTH, json={"slug": slug})
+    assert r.status_code == 201
+
+
+async def _delete(client, slug: str) -> None:
+    r = await client.delete(f"/admin/tenants/{slug}", headers=AUTH)
+    assert r.status_code == 200 and r.json()["deleted"] is True
+
+
+async def test_widget_config_deleted_slug_is_disabled_not_default(app_client):
+    _app, client = app_client
+    await _setup_default_and(client, "borrada")
+    await client.put(
+        "/admin/tenants/default", headers=AUTH, json={"brand_name": "Marca Default"}
+    )
+
+    # alive: the widget is enabled for the tenant
+    wc = (await client.get("/widget-config?t=borrada")).json()
+    assert wc["enabled"] is True
+
+    await _delete(client, "borrada")
+
+    # deleted: enabled flips to False and the DEFAULT tenant's branding is
+    # NOT served (the old bug returned default's fully-enabled config)
+    wc2 = (await client.get("/widget-config?t=borrada")).json()
+    assert wc2["enabled"] is False
+    assert wc2["brand_name"] != "Marca Default"
+
+
+async def test_chat_deleted_slug_404_no_rows_no_llm_call(app_client, db_session):
+    app, client = app_client
+    fake = RecordingRouter()
+    app.dependency_overrides[get_router] = lambda: fake
+    await _setup_default_and(client, "borrada")
+
+    # alive: the chat works through this very fake router and stores a session
+    ok = await client.post("/chat?t=borrada", json={"message": "hola"})
+    assert ok.status_code == 200
+    assert len(fake.calls) == 1
+    assert await _count(db_session, ChatSession) == 1
+
+    await _delete(client, "borrada")
+    assert await _count(db_session, ChatSession) == 0  # cascade wiped its data
+
+    # deleted: 404 (NOT a silent fallback to 'default'), nothing stored,
+    # and the LLM was never invoked again
+    r = await client.post("/chat?t=borrada", json={"message": "hola"})
+    assert r.status_code == 404
+    assert len(fake.calls) == 1
+    assert await _count(db_session, ChatSession) == 0
+    assert await _count(db_session, Event) == 0
+
+
+async def test_apps_chat_deleted_slug_404_even_with_valid_signature(app_client, db_session):
+    """The App Proxy entry point shares _resolve_tenant: an explicit deleted
+    slug 404s there too, even on a correctly signed request."""
+    import time
+
+    from app.shopify.proxy import compute_proxy_signature
+
+    app, client = app_client
+    fake = RecordingRouter()
+    app.dependency_overrides[get_router] = lambda: fake
+    await _setup_default_and(client, "borrada")
+    await _delete(client, "borrada")
+
+    params = {"shop": "x.myshopify.com", "path_prefix": "/apps/chat",
+              "t": "borrada", "timestamp": str(int(time.time()))}
+    params["signature"] = compute_proxy_signature(
+        params, get_settings().shopify_app_proxy_secret
+    )
+    r = await client.post("/apps/chat", params=params, json={"message": "hola"})
+    assert r.status_code == 404
+    assert fake.calls == []
+    assert await _count(db_session, ChatSession) == 0
+
+
+async def test_handoff_deleted_slug_404_zero_rows(app_client, db_session):
+    _app, client = app_client
+    await _setup_default_and(client, "borrada")
+
+    # alive: the form stores a lead
+    ok = await client.post(
+        "/handoff?t=borrada", json={"name": "Ana", "email": "a@x.com", "message": "info"}
+    )
+    assert ok.status_code == 200
+    assert await _count(db_session, HandoffRequest) == 1
+
+    await _delete(client, "borrada")
+    assert await _count(db_session, HandoffRequest) == 0  # cascade wiped the lead
+
+    # deleted: 404 and the lead is NOT stored for the default tenant either
+    r = await client.post(
+        "/handoff?t=borrada", json={"name": "Ana", "email": "a@x.com", "message": "info"}
+    )
+    assert r.status_code == 404
+    assert await _count(db_session, HandoffRequest) == 0
+
+
+async def test_handoff_paused_tenant_403_zero_rows_zero_emails(app_client, db_session, monkeypatch):
+    _app, client = app_client
+    r = await client.post("/admin/tenants", headers=AUTH, json={"slug": "morosa"})
+    assert r.status_code == 201
+    await client.put(
+        "/admin/tenants/morosa", headers=AUTH, json={"support_email": "dueno@morosa.com"}
+    )
+
+    # fake mailer (same pattern as tests/test_handoff.py) records every send
+    sent = []
+
+    async def fake_send(to, subject, body):
+        sent.append(to)
+        return True
+
+    monkeypatch.setattr(get_settings(), "smtp_host", "smtp.test")
+    monkeypatch.setattr(mailer, "default_sender", lambda _s: fake_send)
+
+    payload = {"name": "Lead", "email": "lead@x.com", "message": "quiero info"}
+
+    # enabled: the lead is stored AND emailed through this very fake
+    ok = await client.post("/handoff?t=morosa", json=payload)
+    assert ok.status_code == 200
+    assert await _count(db_session, HandoffRequest) == 1
+    assert sent == ["dueno@morosa.com"]
+
+    # admin pauses the tenant (stopped paying)
+    r = await client.put(
+        "/admin/tenants/morosa", headers=AUTH, json={"chatbot_enabled": False}
+    )
+    assert r.status_code == 200 and r.json()["chatbot_enabled"] is False
+
+    # paused: 403, no new row, no new email — the lead harvest stops
+    r = await client.post("/handoff?t=morosa", json=payload)
+    assert r.status_code == 403
+    assert await _count(db_session, HandoffRequest) == 1
+    assert sent == ["dueno@morosa.com"]
+
+
+def test_widget_js_gate_is_fail_closed():
+    """The embed must render NOTHING unless the backend positively says
+    enabled=true — any error/missing key must not show the widget."""
+    from pathlib import Path
+
+    js = (Path(__file__).resolve().parents[2] / "app" / "static" / "widget.js").read_text()
+    assert "cfg.enabled !== true" in js
+    assert "cfg.enabled === false" not in js  # the old fail-open gate is gone

tests/routes/test_portal.py

@@ -257,3 +257,70 @@ async def test_admin_sees_and_revokes_portal_token(app_client):
     rows2 = (await client.get("/admin/tenants", headers=AUTH)).json()
     payer2 = next(t for t in rows2 if t["slug"] == "payer")
     assert payer2["has_dashboard"] is False and payer2["dashboard_token"] == ""
+
+
+async def test_portal_resource_endpoints_blocked_for_paused_tenant(
+    app_client, db_session, monkeypatch
+):
+    """Zero service for a paused (non-paying) store: its portal token must not
+    trigger owner-paid work (catalog sync, reindex, source ingestion). The
+    active store is the positive control proving each patched path still runs."""
+    from sqlalchemy import select
+
+    from app.models import KnowledgeSource
+    from app.products import sync as product_sync
+    from app.rag import index as rag_index
+
+    synced_slugs: list[str] = []
+    reindexed_ids: list[int] = []
+
+    async def fake_sync_tenant(db, tenant, **kw):
+        synced_slugs.append(tenant.slug)
+        return {"status": "ok", "total": 0, "reembedded": 0, "removed": 0}
+
+    async def fake_reindex_all(db, *, tenant_id=None):
+        reindexed_ids.append(tenant_id)
+
+    async def fake_index_source(db, src):
+        src.status = "indexed"
+        return src
+
+    monkeypatch.setattr(product_sync, "sync_tenant", fake_sync_tenant)
+    monkeypatch.setattr(rag_index, "reindex_all", fake_reindex_all)
+    monkeypatch.setattr(rag_index, "index_source", fake_index_source)
+
+    _app, client = app_client
+    active, active_tok = await _tenant_with_token(db_session, "res-active")
+    paused, paused_tok = await _tenant_with_token(db_session, "res-paused")
+    paused.chatbot_enabled = False
+    await db_session.commit()
+    ah = {"Authorization": "Bearer " + active_tok}
+    ph = {"Authorization": "Bearer " + paused_tok}
+
+    # paused → 403 on every resource-consuming endpoint, nothing executed
+    assert (await client.post("/portal/api/products/sync", headers=ph)).status_code == 403
+    assert (await client.post("/portal/api/reindex", headers=ph)).status_code == 403
+    r_url = await client.post(
+        "/portal/api/sources/url", headers=ph, json={"location": "https://paused.com/faq"}
+    )
+    assert r_url.status_code == 403
+    r_file = await client.post(
+        "/portal/api/sources/file", headers=ph,
+        files={"file": ("faq.txt", b"hola", "text/plain")},
+    )
+    assert r_file.status_code == 403
+
+    # active → the very same endpoints still work (the gate is the only diff)
+    ok_sync = await client.post("/portal/api/products/sync", headers=ah)
+    assert ok_sync.status_code == 200 and ok_sync.json()["status"] == "ok"
+    ok_re = await client.post("/portal/api/reindex", headers=ah)
+    assert ok_re.status_code == 200 and ok_re.json() == {"status": "reindexed"}
+    ok_url = await client.post(
+        "/portal/api/sources/url", headers=ah, json={"location": "https://active.com/faq"}
+    )
+    assert ok_url.status_code == 201
+
+    assert synced_slugs == ["res-active"]  # paused never reached sync_tenant
+    assert reindexed_ids == [active.id]  # paused never reached reindex_all
+    rows = (await db_session.execute(select(KnowledgeSource))).scalars().all()
+    assert [s.tenant_id for s in rows] == [active.id]  # only active's source stored

tests/routes/test_simple_mode.py

@@ -38,11 +38,15 @@ async def test_widget_js_served(app_client):
     assert 'searchParams.get("t")' in body  # reads tenant from its own src
 
 
-async def test_widget_config_defaults_for_unknown_tenant(app_client):
+async def test_widget_config_unknown_tenant_is_disabled(app_client):
+    """An unknown/deleted slug must NOT fall back to default: the widget gets
+    enabled=False and renders nothing (the embed line may still be live)."""
     _app, client = app_client
     r = await client.get("/widget-config?t=nope")
     assert r.status_code == 200
     data = r.json()
+    assert data["enabled"] is False
+    # shape stays sane so the widget never breaks on missing keys
     assert data["brand_name"] and data["brand_color"] and data["welcome"]
 
 
@@ -80,7 +84,7 @@ async def test_widget_config_returns_whatsapp_number(app_client):
     )
     data = (await client.get("/widget-config?t=w1")).json()
     assert data["whatsapp_number"] == "+34 639 913 105"
-    # default tenant: empty → widget renders no button
+    # unknown tenant: disabled fallback carries an empty number → no button
     assert (await client.get("/widget-config?t=nope")).json()["whatsapp_number"] == ""
 
 

tests/routes/test_widget_mode.py

@@ -7,6 +7,7 @@ async def test_widget_config_defaults_chat_mode(app_client):
     _app, client = app_client
     cfg = (await client.get("/widget-config?t=nope")).json()
     assert cfg["widget_mode"] == "chat"
+    assert cfg["enabled"] is False  # unknown slug: fail closed, never default
 
 
 async def test_widget_mode_persists_per_tenant(app_client):

tests/test_billing.py

@@ -115,21 +115,192 @@ async def test_subscription_lifecycle_toggles_chatbot(db_session, monkeypatch):
         await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
     ).scalar_one()
     assert t.chatbot_enabled is True
+    assert t.disabled_reason == ""
 
-    # stops paying → Stripe cancels → chatbot OFF automatically
+    # stops paying → Stripe cancels → chatbot OFF, reason recorded, sub unlinked
     deleted = {"type": "customer.subscription.deleted",
                "data": {"object": {"customer": "cus_life", "id": "sub_456"}}}
     r = await billing.handle_subscription_event(db_session, deleted)
     assert r["status"] == "disabled"
     await db_session.refresh(t)
     assert t.chatbot_enabled is False
+    assert t.disabled_reason == "billing"
+    assert t.stripe_subscription_id == ""  # late invoices can't match it anymore
 
-    # pays again → chatbot back ON
-    paid = {"type": "invoice.paid", "data": {"object": {"customer": "cus_life"}}}
-    r2 = await billing.handle_subscription_event(db_session, paid)
-    assert r2["status"] == "enabled"
+    # buys again (new checkout, same customer) → chatbot back ON, state clean
+    out2 = await billing.handle_checkout_completed(
+        db_session, _checkout_event(customer="cus_life", sub="sub_789"), origin="https://x"
+    )
+    assert out2["status"] == "already_provisioned"
     await db_session.refresh(t)
     assert t.chatbot_enabled is True
+    assert t.disabled_reason == ""
+    assert t.stripe_subscription_id == "sub_789"
+
+
+def _paid_event(customer: str, sub_shape: dict | None = None) -> dict:
+    obj: dict = {"customer": customer}
+    if sub_shape:
+        obj.update(sub_shape)
+    return {"type": "invoice.paid", "data": {"object": obj}}
+
+
+async def _disabled_tenant(db_session, *, slug, customer, sub, reason) -> Tenant:
+    t = Tenant(slug=slug, name=slug, stripe_customer_id=customer,
+               stripe_subscription_id=sub, chatbot_enabled=False,
+               disabled_reason=reason)
+    db_session.add(t)
+    await db_session.commit()
+    return t
+
+
+def test_invoice_subscription_id_across_api_versions():
+    # pre-Basil: top-level, bare id or expanded object
+    assert billing._invoice_subscription_id({"subscription": "sub_a"}) == "sub_a"
+    assert billing._invoice_subscription_id({"subscription": {"id": "sub_b"}}) == "sub_b"
+    # Basil+: parent.subscription_details
+    assert billing._invoice_subscription_id(
+        {"parent": {"subscription_details": {"subscription": "sub_c"}}}
+    ) == "sub_c"
+    # Basil+: per line item
+    assert billing._invoice_subscription_id(
+        {"lines": {"data": [
+            {"parent": {"subscription_item_details": {"subscription": "sub_d"}}}
+        ]}}
+    ) == "sub_d"
+    assert billing._invoice_subscription_id(
+        {"lines": {"data": [{"subscription": "sub_e"}]}}
+    ) == "sub_e"
+    # no subscription anywhere (one-off invoice) → ""
+    assert billing._invoice_subscription_id({"lines": {"data": [{}]}}) == ""
+
+
+async def test_late_invoice_paid_after_cancel_does_not_resurrect(db_session, monkeypatch):
+    """Stripe does not guarantee event order: an invoice.paid generated before
+    the cancellation may arrive after it. It must NOT switch the tenant back on."""
+    async def fake_send(settings, to, subject, body, **kw):
+        return True
+
+    import app.mailer
+
+    monkeypatch.setattr(app.mailer, "send_email", fake_send)
+    out = await billing.handle_checkout_completed(
+        db_session, _checkout_event(customer="cus_late", sub="sub_late"), origin="https://x"
+    )
+    t = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
+    ).scalar_one()
+    deleted = {"type": "customer.subscription.deleted",
+               "data": {"object": {"customer": "cus_late", "id": "sub_late"}}}
+    assert (await billing.handle_subscription_event(db_session, deleted))["status"] == "disabled"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is False  # positively off before the late event
+
+    late = _paid_event("cus_late", {"subscription": "sub_late"})
+    r = await billing.handle_subscription_event(db_session, late)
+    assert r["status"] == "subscription_mismatch"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is False  # still off: canceled stays canceled
+    assert t.disabled_reason == "billing"
+
+
+async def test_stale_subscription_deleted_does_not_disable_repurchased_tenant(db_session, monkeypatch):
+    """Cancel + re-purchase, then the OLD subscription's deleted event arrives
+    late (Stripe does not guarantee order). It must NOT switch off the paying
+    client nor unlink its new subscription."""
+    async def fake_send(settings, to, subject, body, **kw):
+        return True
+
+    import app.mailer
+
+    monkeypatch.setattr(app.mailer, "send_email", fake_send)
+    out = await billing.handle_checkout_completed(
+        db_session, _checkout_event(customer="cus_re", sub="sub_old"), origin="https://x"
+    )
+    t = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == out["slug"]))
+    ).scalar_one()
+    # re-purchase: same customer, NEW subscription
+    out2 = await billing.handle_checkout_completed(
+        db_session, _checkout_event(customer="cus_re", sub="sub_new"), origin="https://x"
+    )
+    assert out2["status"] == "already_provisioned"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is True and t.stripe_subscription_id == "sub_new"
+
+    stale = {"type": "customer.subscription.deleted",
+             "data": {"object": {"customer": "cus_re", "id": "sub_old"}}}
+    r = await billing.handle_subscription_event(db_session, stale)
+    assert r["status"] == "stale_subscription"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is True  # the paying client keeps full service
+    assert t.disabled_reason == ""
+    assert t.stripe_subscription_id == "sub_new"  # the live link survived
+
+    # the CURRENT subscription's deleted event still disables, as always
+    real = {"type": "customer.subscription.deleted",
+            "data": {"object": {"customer": "cus_re", "id": "sub_new"}}}
+    r2 = await billing.handle_subscription_event(db_session, real)
+    assert r2["status"] == "disabled"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is False
+    assert t.disabled_reason == "billing"
+    assert t.stripe_subscription_id == ""
+
+
+async def test_invoice_paid_matching_subscription_reenables(db_session):
+    """A paid invoice for the tenant's CURRENT subscription lifts a billing
+    pause — across every Stripe API shape that carries the subscription id."""
+    shapes = [
+        ("viejo", {"subscription": "sub_m"}),
+        ("basil", {"parent": {"subscription_details": {"subscription": "sub_m"}}}),
+        ("lineas", {"lines": {"data": [
+            {"parent": {"subscription_item_details": {"subscription": "sub_m"}}}
+        ]}}),
+    ]
+    for slug, shape in shapes:
+        t = await _disabled_tenant(
+            db_session, slug=slug, customer=f"cus_{slug}", sub="sub_m", reason="billing"
+        )
+        r = await billing.handle_subscription_event(
+            db_session, _paid_event(f"cus_{slug}", shape)
+        )
+        assert r["status"] == "enabled", slug
+        await db_session.refresh(t)
+        assert t.chatbot_enabled is True, slug
+        assert t.disabled_reason == "", slug
+
+
+async def test_invoice_paid_mismatched_or_missing_subscription_stays_off(db_session):
+    t = await _disabled_tenant(
+        db_session, slug="desfase", customer="cus_mis", sub="sub_actual", reason="billing"
+    )
+    # wrong subscription id
+    r = await billing.handle_subscription_event(
+        db_session, _paid_event("cus_mis", {"subscription": "sub_OTRA"})
+    )
+    assert r["status"] == "subscription_mismatch"
+    # no subscription id at all (one-off invoice)
+    r2 = await billing.handle_subscription_event(db_session, _paid_event("cus_mis"))
+    assert r2["status"] == "subscription_mismatch"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is False
+    assert t.disabled_reason == "billing"
+
+
+async def test_admin_paused_tenant_stays_off_after_invoice_paid(db_session):
+    """Victor paused this client on purpose — a Stripe payment (even for the
+    right subscription) must never override the admin's decision."""
+    t = await _disabled_tenant(
+        db_session, slug="castigada", customer="cus_adm", sub="sub_adm", reason="admin"
+    )
+    r = await billing.handle_subscription_event(
+        db_session, _paid_event("cus_adm", {"subscription": "sub_adm"})
+    )
+    assert r["status"] == "admin_paused"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is False
+    assert t.disabled_reason == "admin"
 
 
 async def test_invoice_paid_before_checkout_is_safely_ignored(db_session):

tests/test_billing_reconcile.py

@@ -0,0 +1,198 @@
+"""Daily billing reconciliation: the scheduler asks Stripe for the truth so a
+single missed webhook can never leave a non-payer with service forever, and
+the weekly reindex must not spend crawl/embedding resources on paused tenants.
+"""
+
+from __future__ import annotations
+
+import httpx
+import respx
+from sqlalchemy import select
+
+from app.config import get_settings
+from app.models import KnowledgeSource, Tenant
+from app.scheduler import reconcile_billing, reindex_all_urls
+
+STRIPE_SUB_URL = "https://api.stripe.com/v1/subscriptions/{}"
+
+
+async def _paying_tenant(db, slug: str, sub_id: str, *, enabled: bool = True) -> Tenant:
+    t = Tenant(
+        slug=slug,
+        name=slug,
+        stripe_subscription_id=sub_id,
+        chatbot_enabled=enabled,
+        disabled_reason="",
+    )
+    db.add(t)
+    await db.commit()
+    return t
+
+
+@respx.mock
+async def test_canceled_subscription_pauses_tenant(db_session, monkeypatch):
+    """A canceled subscription found by the daily poll disables the tenant with
+    disabled_reason='billing' — exactly what the missed webhook would have done,
+    including unlinking the dead subscription so a late invoice.paid for it can
+    never resurrect the tenant."""
+    from app import billing
+
+    monkeypatch.setattr(get_settings(), "stripe_secret_key", "sk_test_123")
+    t = await _paying_tenant(db_session, "moroso", "sub_dead1")
+    t.stripe_customer_id = "cus_moroso"
+    await db_session.commit()
+    assert t.chatbot_enabled is True and t.disabled_reason == ""  # live before
+
+    route = respx.get(STRIPE_SUB_URL.format("sub_dead1")).mock(
+        return_value=httpx.Response(200, json={"id": "sub_dead1", "status": "canceled"})
+    )
+    paused = await reconcile_billing(db_session)
+
+    assert paused == 1
+    assert route.called  # Stripe really was consulted, with our key
+    assert route.calls.last.request.headers["Authorization"] == "Bearer sk_test_123"
+    db_session.expire_all()
+    t = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "moroso"))
+    ).scalar_one()
+    assert t.chatbot_enabled is False
+    assert t.disabled_reason == "billing"
+    assert t.stripe_subscription_id == ""  # unlinked, same as the webhook
+
+    # a late invoice.paid for the dead subscription must NOT resurrect it
+    late = {"type": "invoice.paid",
+            "data": {"object": {"customer": "cus_moroso", "subscription": "sub_dead1"}}}
+    r = await billing.handle_subscription_event(db_session, late)
+    assert r["status"] == "subscription_mismatch"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is False
+    assert t.disabled_reason == "billing"
+
+
+@respx.mock
+async def test_active_subscription_stays_enabled(db_session, monkeypatch):
+    """A paying client must NOT be touched: Stripe is consulted and the tenant
+    keeps full service (enabled, no disabled_reason)."""
+    monkeypatch.setattr(get_settings(), "stripe_secret_key", "sk_test_123")
+    await _paying_tenant(db_session, "alcorriente", "sub_ok1")
+
+    route = respx.get(STRIPE_SUB_URL.format("sub_ok1")).mock(
+        return_value=httpx.Response(200, json={"id": "sub_ok1", "status": "active"})
+    )
+    paused = await reconcile_billing(db_session)
+
+    assert paused == 0
+    assert route.called  # the check DID happen; staying enabled is a decision
+    db_session.expire_all()
+    t = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "alcorriente"))
+    ).scalar_one()
+    assert t.chatbot_enabled is True
+    assert t.disabled_reason == ""
+
+
+@respx.mock
+async def test_no_stripe_key_makes_no_http_calls(db_session, monkeypatch):
+    """Without a configured key (dev/tests) the reconcile is a no-op: zero HTTP
+    traffic and the tenant untouched."""
+    monkeypatch.setattr(get_settings(), "stripe_secret_key", "")
+    await _paying_tenant(db_session, "sinkey", "sub_nokey")
+
+    paused = await reconcile_billing(db_session)
+
+    assert paused == 0
+    assert len(respx.calls) == 0  # not a single request left the process
+    db_session.expire_all()
+    t = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "sinkey"))
+    ).scalar_one()
+    assert t.chatbot_enabled is True
+
+
+@respx.mock
+async def test_network_error_logged_and_other_tenants_still_checked(db_session, monkeypatch):
+    """Stripe failing for one tenant must not crash the tick nor shield the
+    next tenant: the dead one is still found and paused."""
+    monkeypatch.setattr(get_settings(), "stripe_secret_key", "sk_test_123")
+    await _paying_tenant(db_session, "conred", "sub_neterr")
+    await _paying_tenant(db_session, "muerto", "sub_dead2")
+
+    down = respx.get(STRIPE_SUB_URL.format("sub_neterr")).mock(
+        side_effect=httpx.ConnectError("stripe caido")
+    )
+    dead = respx.get(STRIPE_SUB_URL.format("sub_dead2")).mock(
+        return_value=httpx.Response(200, json={"id": "sub_dead2", "status": "unpaid"})
+    )
+    paused = await reconcile_billing(db_session)  # must not raise
+
+    assert paused == 1
+    assert down.called and dead.called  # both were attempted despite the error
+    db_session.expire_all()
+    survivor = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "conred"))
+    ).scalar_one()
+    assert survivor.chatbot_enabled is True  # unverifiable -> keep service
+    assert survivor.disabled_reason == ""
+    gone = (
+        await db_session.execute(select(Tenant).where(Tenant.slug == "muerto"))
+    ).scalar_one()
+    assert gone.chatbot_enabled is False
+    assert gone.disabled_reason == "billing"
+    # "unpaid" is recoverable: the link stays so actually paying the open
+    # invoice re-enables through the normal invoice.paid path
+    assert gone.stripe_subscription_id == "sub_dead2"
+
+
+async def test_reindex_skips_paused_tenants_sources(db_session, monkeypatch):
+    """The weekly reindex must crawl the ACTIVE tenant's URL source and never
+    touch the paused tenant's one (zero service includes zero crawling)."""
+    from app.rag import index
+
+    active = await _paying_tenant(db_session, "activo", "sub_a")
+    paused = await _paying_tenant(db_session, "pausado", "sub_p", enabled=False)
+    db_session.add_all([
+        KnowledgeSource(tenant_id=active.id, kind="url", name="a", location="https://a.example"),
+        KnowledgeSource(tenant_id=paused.id, kind="url", name="p", location="https://p.example"),
+        KnowledgeSource(tenant_id=active.id, kind="file", name="f", location="/tmp/f.pdf"),
+    ])
+    await db_session.commit()
+
+    indexed: list[str] = []
+
+    async def fake_index_source(db, src):
+        indexed.append(src.location)
+        src.status = "indexed"
+        return src
+
+    monkeypatch.setattr(index, "index_source", fake_index_source)
+    done = await reindex_all_urls(db_session)
+
+    # Positive: the active tenant's URL really was refreshed...
+    assert done == 1
+    assert indexed == ["https://a.example"]
+    # ...and the paused tenant's URL (and the static file) were not.
+    assert "https://p.example" not in indexed
+
+
+async def test_reindex_keeps_legacy_sources_without_tenant(db_session, monkeypatch):
+    """Pre-multitenant URL sources (tenant_id NULL) belong to no paused client
+    and must keep refreshing as before."""
+    from app.rag import index
+
+    db_session.add(
+        KnowledgeSource(tenant_id=None, kind="url", name="legacy", location="https://l.example")
+    )
+    await db_session.commit()
+
+    indexed: list[str] = []
+
+    async def fake_index_source(db, src):
+        indexed.append(src.location)
+        src.status = "indexed"
+        return src
+
+    monkeypatch.setattr(index, "index_source", fake_index_source)
+    done = await reindex_all_urls(db_session)
+
+    assert done == 1
+    assert indexed == ["https://l.example"]

tests/test_personalization_isolation.py

@@ -70,7 +70,10 @@ async def test_every_personalization_is_unique_per_account(app_client):
     assert cross["brand_name"] == "Beta Servicios"  # b_tok can't see alpha
 
 
-async def test_widget_config_unknown_tenant_is_generic_default(app_client):
+async def test_widget_config_unknown_tenant_is_disabled_generic(app_client):
+    """An unknown slug never leaks another tenant's branding AND is disabled
+    (no fallback to default: a deleted client must get zero service)."""
     _app, client = app_client
     wc = (await client.get("/widget-config?t=does-not-exist")).json()
+    assert wc["enabled"] is False
     assert wc["brand_name"] == "Asistente" and wc["starters"] == []