06 · Operations and improvement

Money, retries, and repair.

The only confirmed operating number is the ceiling. Everything under it is a proposal you can still reject. The risks are written next to the mechanisms, not in a separate appendix.

A second delivery is not a second purchase

Queue redelivery increments a delivery count. A paid attempt is a browser session, a model call, or another metered fetch. If that attempt already settled, the worker reuses the result. If the provider timed out, the reservation stays. That open liability is not a deferral. Another paid call requires fresh admission. If that admission is rejected, the work is deferred and the original observation stays. Deferral does not pretend the page was refreshed.

Unresolved

Budget text proposes at most three deliveries of one job. Interface text proposes a dead letter after five. Both are proposals. Neither has been selected.

Figure

Does a redelivered job get permission to spend again?

Does a redelivered job get permission to spend again? A queue delivery is not a paid attempt. An uncertain timeout keeps its reservation. Another paid call needs fresh admission. A rejected admission defers the work. Each delivery increments the delivery count, not the paid-attempt count. A settled attempt id returns the stored result and does not call the provider. A timeout keeps the reservation. That open liability is not itself a deferral. Another paid call requires a fresh admission. Rejected admission defers the work and keeps the original observation. deliver settled uncertain another call rejected admitted QUEUE · ASYNC Job delivered Delivery count increases CHOICE Attempt on record? Idempotent attempt id STATE Reuse result No new provider call STATE Keep liability Timeout stays reserved GATE Fresh admission Required for another paid call STATE Defer Rejected admission. Data kept. EXTERNAL Paid attempt Fetch, browser, or model

Takeaway. A queue delivery is not a paid attempt. An uncertain timeout keeps its reservation. Another paid call needs fresh admission. A rejected admission defers the work.

Text equivalent

  1. Each delivery increments the delivery count, not the paid-attempt count.
  2. A settled attempt id returns the stored result and does not call the provider.
  3. A timeout keeps the reservation. That open liability is not itself a deferral.
  4. Another paid call requires a fresh admission.
  5. Rejected admission defers the work and keeps the original observation.

Status. Proposed correction to the 0.4.0 simulation. Budget controls also propose at most three queue deliveries per job. The interface note proposes a dead letter after five. Those two limits are not reconciled.

The ceiling and the proposed bands

Confirmed: recurring services may not exceed USD 50 in a month. Proposed: admit paid work while exposure is under USD 35, defer discretionary work from USD 35, stop new unreserved work at USD 40, and never admit the last USD 10. Discretionary work includes browser, model, and replay. The worked two-scraper sketch, 200 listings on each of two sources, expects USD 34.48, sets aside USD 10, and leaves USD 5.52 unreserved. That sketch is not an authorization and not a quote.

Exposure is the greater of the monthly forecast and the liabilities already accounted. A usage report may be exactly 24 hours old and still count as fresh. Before a reservation, exposure must be under USD 40. After the reservation it may equal USD 40. A forecast of 39 against accounted liabilities of 27 defers discretionary extraction. A forecast of 39.99 plus an essential capture of 0.01 can reserve up to exactly 40. Those examples are the proposed gate, simulated in the workbench. They place no provider order.

Figure

What happens as proposed spending approaches the confirmed ceiling?

What happens as proposed spending approaches the confirmed ceiling? The only confirmed number is USD 50 a month. The proposed bands admit paid work under USD 35, defer discretionary work from USD 35, stop new unreserved work at USD 40, and never admit the last USD 10. Below a proposed USD 35, bounded paid work can be reserved and admitted. From USD 35, browser, model and replay work waits. Essential capture may still be admitted up to USD 40. At USD 40, new unreserved paid work stops. Already reserved jobs may finish. The last USD 10 is an uncertainty reserve for tax, FX, late usage reports and overruns. Admission does not spend it. inside exposure rises envelope not spent CONFIRMED USD 50 ceiling Confirmed recurring services STATE USD 0–35 Admit after reserving the quote STATE USD 35–40 Discretionary work waits GATE At USD 40 No new unreserved paid work STATE USD 40–50 reserve Never admitted

Takeaway. The only confirmed number is USD 50 a month. The proposed bands admit paid work under USD 35, defer discretionary work from USD 35, stop new unreserved work at USD 40, and never admit the last USD 10.

Text equivalent

  1. Below a proposed USD 35, bounded paid work can be reserved and admitted.
  2. From USD 35, browser, model and replay work waits. Essential capture may still be admitted up to USD 40.
  3. At USD 40, new unreserved paid work stops. Already reserved jobs may finish.
  4. The last USD 10 is an uncertainty reserve for tax, FX, late usage reports and overruns. Admission does not spend it.

Status. Confirmed: the USD 50 recurring-service ceiling. Proposed: the 35 and 40 thresholds and the USD 10 reserve. Not a provider quote.

Figure

How is one paid request admitted, deferred, or reconciled?

How is one paid request admitted, deferred, or reconciled? Exposure is the greater of the monthly forecast and accounted liabilities. A usage report is acceptable at exactly 24 hours. Before admission, exposure must be under USD 40. After a reservation it may equal USD 40. Unconfirmed prices, or a usage report older than 24 hours, pause new paid work. Daily reconciliation replaces a reservation with the actual charge once. Forecast USD 39 against accounted USD 27 still defers a discretionary extraction. Exposure USD 39.99 plus a USD 0.01 essential capture may admit to exactly USD 40. Deferred work keeps accepted observations and their original observed time. ask no yes add quote classify wait essential or under 35 STATE Paid request Browser, model, replay, fetch CHOICE Prices and report fresh? Exactly 24 h is allowed STATE Pause Stale report or unpriced service STATE Exposure before Must be under USD 40 STATE Exposure after quote May equal USD 40 CHOICE Discretionary at 35? Browser, model, replay STATE Defer Keep observed_at GATE Admit and reserve Failed attempts still count

Takeaway. Exposure is the greater of the monthly forecast and accounted liabilities. A usage report is acceptable at exactly 24 hours. Before admission, exposure must be under USD 40. After a reservation it may equal USD 40.

Text equivalent

  1. Unconfirmed prices, or a usage report older than 24 hours, pause new paid work.
  2. Daily reconciliation replaces a reservation with the actual charge once.
  3. Forecast USD 39 against accounted USD 27 still defers a discretionary extraction.
  4. Exposure USD 39.99 plus a USD 0.01 essential capture may admit to exactly USD 40.
  5. Deferred work keeps accepted observations and their original observed time.

Status. Proposed gate, simulated in the workbench budget prototype. It does not place a provider order.

Improve the parser. Do not rewrite the sighting.

Repeated fallbacks on fictional Lumen captures become one proposal, imp_0003. It is not published to an issue tracker. The pinned bytes of cap_lum_0310 are replayed with pa_lumen_specgrid@1.0.0. observed_at stays 2026-10-10T03:31:55Z. The new claims go through the same accept path. They do not overwrite dec_0141.

Figure

How does a parser improve without changing when the source was seen?

How does a parser improve without changing when the source was seen? Repeated fallbacks become one proposal. A new adapter is replayed against the pinned artifact. The original observed time stays. Replay is not a freshness gain. Review case rc_0007 and four Lumen fallbacks group into imp_0003. The draft names the evidence, the expected value and a regression fixture, cap_lum_0310. The proposed adapter is pa_lumen_specgrid@1.0.0. It is not yet accepted software. Replay reads the stored bytes and records a before/after comparison. captured_at and observed_at do not move to the replay time. expected group fix area new version pin read bytes compare PERSON Reviewed case rc_0007 · dec_0141 STATE Repeated fallbacks Four fictional Lumen captures SERVICE One proposal imp_0003 OBJECT STORE Pinned fixture cap_lum_0310 bytes SERVICE Proposed adapter pa_lumen_specgrid@1.0.0 SERVICE Replay Same artifact, new version STATE Before and after observed_at unchanged

Takeaway. Repeated fallbacks become one proposal. A new adapter is replayed against the pinned artifact. The original observed time stays. Replay is not a freshness gain.

Text equivalent

  1. Review case rc_0007 and four Lumen fallbacks group into imp_0003.
  2. The draft names the evidence, the expected value and a regression fixture, cap_lum_0310.
  3. The proposed adapter is pa_lumen_specgrid@1.0.0. It is not yet accepted software.
  4. Replay reads the stored bytes and records a before/after comparison.
  5. captured_at and observed_at do not move to the replay time.

Status. Established improvement shape in the design. The Lumen draft imp_0003 is a fictional prototype and is not published to an issue tracker.

Rebuild beside history. Fence what you restored.

ADR-004 proposes a snapshot whose rows and cursor W match, a shadow projection with its own cursor and lease, and a cutover that swaps the live pointer before the lease drops. Events from an older history epoch are ignored. They are not relabeled as current. SPK-05 has not been run. The recovery screen in the workbench is a simulation.

The proposed Broadwater pilot outage items use this walkthrough as an acceptance gate. None of those items is passed. The pilot itself is not approved.

Figure

How can a projection be rebuilt without rewriting history?

How can a projection be rebuilt without rewriting history? A snapshot is safe only when its rows and committed cursor describe the same history. The shadow rebuild catches up on a separate cursor. Cutover swaps the live pointer. Events from an older history epoch are ignored, not relabeled. Live writes lock the cursor, then commit facts and the outbox together. An operator starts a rebuild. The export pins rows and cursor W under a lease. The shadow projection loads the snapshot, then applies the retained tail after W. Shadow progress never advances the live retention cursor. Cutover swaps the serving generation and the live cursor before the lease is released. A restored older epoch is fenced. Those events are terminally ignored. export load catch up swap fence DATABASE Live writer Lock cursor, then commit OBJECT STORE Pinned snapshot Rows and cursor W match SERVICE Shadow projection Own cursor and lease QUEUE · ASYNC Retained tail Ordered events after W GATE Cutover Swap pointer, then drop lease STATE Older epoch Ignored, never relabeled

Takeaway. A snapshot is safe only when its rows and committed cursor describe the same history. The shadow rebuild catches up on a separate cursor. Cutover swaps the live pointer. Events from an older history epoch are ignored, not relabeled.

Text equivalent

  1. Live writes lock the cursor, then commit facts and the outbox together.
  2. An operator starts a rebuild. The export pins rows and cursor W under a lease.
  3. The shadow projection loads the snapshot, then applies the retained tail after W.
  4. Shadow progress never advances the live retention cursor.
  5. Cutover swaps the serving generation and the live cursor before the lease is released.
  6. A restored older epoch is fenced. Those events are terminally ignored.

Status. Proposed (ADR-004). SPK-05 is not done. The workbench recovery screen is a simulation.

Risks that stay visible

  • The USD 50 ceiling is the only confirmed spend limit. Thresholds can move until Jonathan accepts them.
  • A hosted queue, database, or model is not running and must not be started from this package.
  • Duplicate delivery is safe only if the inbox and the attempt ledger behave as specified. That is untested on real PostgreSQL.
  • Human review hours are not in the USD 50. Ignoring them understates the operating load.

The register itself is in risk-register.md. Budget arithmetic is in budget-controls.md.

Implementation roadmap