Free provisioning is bounded by a ceiling on the whole fleet
Sign-up was open and book creation was unlimited, so any caller could create unbounded real Fly machines and 1 GB volumes, billed to us.
Nothing on any provisioning path checked a quota. A per-org cap is bypassed by making a second org in the same request, and a per-user cap by one more sign-up. Each is correct about the object it names, and the caller picks the object — so the bound goes on the thing that is actually billed.
The check lives inside the provisioning function rather than at its call sites, so all three are covered by construction instead of by remembering. It runs before anything is created, so a refused request leaves no machine and no volume. And the count and the reservation are one transaction — the book row is the reservation — so two concurrent callers cannot both read the same total and both proceed.
It counts what Fly bills, not what the app considers live: a soft-deleted book keeps its volume, and a volume bills while it exists. Billing is exempt from the refusal but never from the tally. By the time fulfilment runs, Stripe has already charged the card, so refusing there would take money for nothing; the exceedance is logged loudly instead.