Discount codes are never cleared: `usePromoCode().clear` is dead code, so the code applies to every future checkout forever

[rajarshidattapy]

Severity: Medium (revenue leak + permanent UI artifact)
File: apps/web/hooks/use-promo-code.ts

Description

usePromoCode() returns { getDiscounts, clear }. Across the whole app, only
getDiscounts is ever called:

$ grep -rn "promoCode\." apps/web
apps/web/components/add-document/connections.tsx:335:      discounts: promoCode.getDiscounts(),
apps/web/components/add-document/index.tsx:347:           discounts: promoCode.getDiscounts(),
apps/web/components/add-document/index.tsx:449:           discounts: promoCode.getDiscounts(),
apps/web/components/integrations/plugins-detail.tsx:575:   discounts: promoCode.getDiscounts(),
apps/web/components/integrations-view.tsx:2850:           discounts: promoCode.getDiscounts(),
apps/web/components/onboarding-brain/step-sources.tsx:637: discounts: promoCode.getDiscounts(),
apps/web/components/settings/billing.tsx:703:              discounts: promoCode.getDiscounts(),
apps/web/components/settings/connections-mcp.tsx:557:      discounts: promoCode.getDiscounts(),

clear has zero call sites. Nothing ever removes sm.promoCode.org_<id> from
localStorage, and the stored code carries no expiry or use count.

Impact

Once a user lands on any page with ?discountCode=…:

1. Every subsequent checkout for that org gets the discount, indefinitely —
   including plan upgrades months later and any of the 8 unrelated checkout
   entry points above. A one-time promo becomes a permanent price cut.
2. The toast never goes away. PromoCodeHost re-fires it on every mount
   with duration: Number.POSITIVE_INFINITY and id: PROMO_TOAST_ID. Since
   clear() (the only toast.dismiss(PROMO_TOAST_ID) caller) is never
   invoked, "Discount code active — Code X will apply at checkout" sticks to the
   app forever.

Clearing localStorage by hand is the only escape.

Suggested fix

Call promoCode.clear() from the checkout onSuccess path (or wherever
attach/checkout resolves successfully) in each of the 8 call sites — or,
less repetitively, clear it centrally once the org's subscription state flips.
An expiry timestamp stored alongside the code would also bound the blast radius
if a clear is ever missed.

[linear-code]

ENG-1204

[rajarshidattapy]

Checked this against main (18a2dfb) before fixing — the premise doesn't hold. All eight checkout sites do call promoCode.clear():

add-document/connections.tsx:338      add-document/index.tsx:350
add-document/index.tsx:452            integrations/plugins-detail.tsx:578
integrations-view.tsx:2853            onboarding-brain/step-sources.tsx:640
settings/billing.tsx:706              settings/connections-mcp.tsx:560

Both the getDiscounts() and clear() calls landed together in d14b209 (#1523), so clear was never dead. The grep in the description only picked up the discounts: lines. That also disposes of the permanent-toast half of the report — clear() dismisses PROMO_TOAST_ID.

There is a real bug in that code, and it's the inverse: clear() fires the moment autumn.attach() resolves, which is before the user pays — attach only returns a Stripe payment URL. Abandon that checkout page and the code is already gone, with ?discountCode= stripped from the URL and no way to recover it.

#1568 fixes that: the code is spent when the org actually moves up a plan, not when attach resolves, and codes get a 30-day expiry so an unredeemed one stops applying to future checkouts (the leak this issue was worried about, which removing the eager clear would otherwise open up).

Closing as a false positive once #1568 lands.