Class LicenseCounter

The licence counter of a standalone iiziServer (LICENSE-V2-DESIGN.md sections 6.1 to 6.3, 6.5 and 8.4; rulings R-6, R-19, LV-14, LV-15, LV-17, LV-19, RB-9 (a), T1-155): the users the server counts against its licence document's maxUsers, the verdict for a new user, and the daily peaks the license server is told at every REFRESH.

What is counted. Users - distinct user IDs of IZS.USERS with at least one AppSession after a successful sign-in (R-19, LV-14). ActiveUserSessions keeps them and asks this class for a verdict only for a user it does not count yet, so another session of a user, or a transfer, never counts twice. Sessions are counted for the daily statistics only. A standalone server has one document, so "per entitlement" is the server's count.

The verdict for a new user (6.3, LV-15). Up to maxUsers: allow. Above it, up to the ceiling maxUsers + max(1, maxUsers/10): allow with a warning - SEVERE in the log, a banner in ServerAdmin - and open a grace episode of 7 days from that sign-in, at most one per 30 days. Above the ceiling, or over the limit after the episode has run out: refuse. A document without maxUsers, or -1, has no limit; the development server has none (LV-21).

An unlicensed server (8.4, RB-9 (a)). 14 days after the licence stopped being valid - no document, or one expired, deactivated, revoked or not verifiable - every new sign-in would be refused, except sign-in to the ServerAdmin application, so that the operator can repair the licence. The 14 days run from the document's own end where it has one (expires, the entitlement's validTo, a trial's end), otherwise from when this server first saw the licence invalid.

This release observes only (LV-19, T1-155). The enforcement switch is a field that is off, set by nothing in the product and by no setting or system property (decision B5D-D-a): a verdict to refuse is logged as "would be refused" and the user is counted. The tests turn the switch on through setEnforcing(boolean) to prove the refusal path. Nobody already signed in is ever cut off, and the licence never shuts the server down: nothing here calls ILicenseCallback.onLicenseShutdown (LV-19).

Where it is stored. The grace episode's start, the start of an unlicensed period and the days not yet reported live in the local license file (IServerLicenseSystem.CounterState, wall-clock UTC, 2b.11), so a restart neither opens a second episode nor restarts the 14 days.

Locks. ActiveUserSessions calls in while holding its own monitor; this class guards its state with its own monitor and never calls the license system while holding it, and the license system's refresh thread reaches it only through getUsageDays() and onReported(long).