Past due is one field on the proxy, and the data stays put

Day 14 past due. Elsewhere, suspension is a status column every route has to check, plus a cron that eventually deletes the data because nobody wants to pay to keep it.

Here the customer's product lives in their container, and the container's proxy has a root policy. GET /api/v1/containers/{id}/proxy/settings returns default: "allow" and an ETag. Suspension is a PUT with If-Match: file:v7 and {"default": "deny"}. Every request that matches no group is refused at the proxy. The app didn't change. The SQLite file didn't move. The crons still run inside. Your admin group still matches its rule, so support can look at the box.

The card clears, you PUT allow, and they are back exactly where they left. An idle container costs you nothing to keep, so there is no reason to make suspension destructive.

Dunning stopped being a delete; it is a field on the proxy.