OverLimitEffect
The single answer to “what is an over-limit flag actually doing to this token?”
benecaster_tokens.is_over_limit is one boolean and it does not record the consequence. Two different things happen. A demoted token still resolves and still serves a feed — the public one — so the listener’s app keeps working and shows the free episodes. A locked token’s feed URL returns 410 and the listener receives nothing at all. Demotion is what happens to every paying token, and to every token under auto_upgrade; locking happens only to a free-tier token, only under cap enforcement.
Why this class exists rather than the rule being restated per surface. The Subscribers screen used to label every flagged token “Receiving public feed”, which for a locked listener is the one thing not happening to them — a podcaster whose listener reported a dead feed read that the feed was being served and stopped looking. The obvious fix was to publish is_free_tier and branch in the React component, which would have put the enforcement preference in the client and made a second copy of a rule that had already been got wrong once. Instead the outcome is computed here, once, and both the feed and the REST payload read it.