# Proposed budget controls Generated from `assets/fixtures-cost.js`; calculations in `assets/cost.js`, admission demonstration in `assets/budget.js`. Nonfinal checkpoint 0.4.0. ## Confirmed ceiling; proposed launch Maximum USD 50/month in recurring service costs for the initial system. This accepts only the spending constraint, not other architectural proposals. Hosting, database, storage, queues, browser scraping, regional collectors, LLM extraction/review and every other required recurring service share this ceiling. Proposed: two scrapers, 200 listings each, refreshed daily. One regional host, a 16-hour/day database window and a priced service inventory must be validated before paid launch. All other architectural decisions remain open. | Monthly budget | USD | |---|---:| | Confirmed recurring-service ceiling | 50.00 | | Expected spending | 34.48 | | Fixed costs and provisions | 17.00 | | Variable services | 17.48 | | Headroom below ceiling | 15.52 | | Uncertainty reserve (not spending) | 10.00 | | Unreserved headroom | 5.52 | Human review: 7.84 hours/month, 117.6 cases; USD 470.40 imputed effort is separate. 12000 captures/month; 7.33 browser-hours; 588 extraction and 294 review attempts. These are unmeasured workload assumptions. ### Complete service inventory and qualifications ## name Hosting and APIs ## basis Workers Paid base plus usage ## provision USD 5 fixed base; usage after shared allowances ## name Database and storage ## basis Neon compute/storage; R2 artifacts ## provision Metered; active hours and retention are assumptions, not caps ## name Queues and browser scraping ## basis Queue deliveries and Browser Run time/daily peaks ## provision Metered; shared allowances must be reconciled ## name Regional collectors ## basis One shared host for two logical scrapers ## provision USD 10/month provisional, quote required ## name LLM extraction and review ## basis Separate bounded models and token budgets ## provision Metered; all attempts including retries count ## name Other required services ## basis Authentication, backup/restore, logs, monitoring, domains or proxies if needed ## provision USD 2/month provisional; itemized vendor quotes required. Do not assume a service fits this amount - Two logical scrapers share one regional host; two authorized real sources remain to be selected. Pantry & Pour is a fictional fixture, not a measured source. - 200 listings per source, one refresh per day, 30 days. Database: 0.25 CU for 480 hours (16 hours/day), 1 GB storage. Runtime and storage growth are unmeasured. - USD 10/month regional-host provision is a conservative allowance, not a provider quote. USD 2/month covers other required recurring services provisionally; availability at that price is not established. - Workers Paid base USD 5 is fully allocated to this app. Workers, Queues, R2 and Browser account-wide included usage is assumed available; never allocate it twice across apps. - An unused USD 10 uncertainty reserve covers tax/FX, reporting lag, storage growth and other overruns; it is not expected spending or a verified provider cap. - Before paid launch, price the complete service inventory including authentication, logs, monitoring, backups/restore and any needed proxies. If required costs exceed the provisions, resize or defer launch. Human review, implementation time, incident labor and existing operator equipment are outside recurring-service cash and remain separate. Paid backups, IdP, monitoring, domains, proxy subscriptions, tax and FX are not exempt: price any required amounts before launch or reserve conservatively; unpriced required services block admission. ### Launch sensitivity | Assumption | Services USD/month | Headroom USD | Human hours | |---|---:|---:|---:| | Expected launch | 34.48 | 15.52 | 7.84 | | Database active all month | 40.84 | 9.16 | 7.84 | | Parser failures double to 20% | 38.89 | 11.11 | 15.68 | | Both changes | 45.25 | 4.75 | 15.68 | | No shared account allowances | 44.18 | 5.82 | 7.84 | The 20% parser-failure sensitivity prices unconstrained demand (1,176 extractions and 588 reviews). Proposed quotas defer work beyond 700 / 350 attempts; freshness and completion would drop. Database and storage charges can continue while jobs pause. The no-allowance case exceeds the USD 40 operating envelope; confirm allocation or revise before admission. Larger scenarios are planning references outside the approved launch budget. ## Admission policy ### Bound scheduled collection Allow two sources, at most 200 listings each and no more than one scheduled refresh per listing per 24 hours. Reject larger schedules until a new budget is approved. ### Reserve before paid work In one durable transaction, validate limits and reserve a conservative maximum charge for the bounded attempt. Admission exposure is estimated committed charges + outstanding reservations + remaining fixed/service commitments + requested reservation + one USD 10 uncertainty reserve. Require exposure at most USD 50. ### Limit browser and models Cap browser work at 10 hours/month and two concurrent sessions. Limit extraction to 700 attempts/month with 6,000 input and 800 output tokens; review to 350 attempts with 4,000 input and 500 output tokens. Count failed requests and retries. Bound browser duration, output and request timeouts at the adapter. ### Bound retries and replay At most one extra fetch per capture, within 1,200 extra attempts/month; at most three queue deliveries per job. Replay allows 100 deterministic dry-run captures/month. Paid fallback requires its own reservation and quota. Stop retry storms; replay never advances observed_at. ### Constrain, then defer At USD 35 committed/forecast operating exposure, defer discretionary browser, LLM, replay and expansion. At the USD 40 operating envelope, reject any new unreserved paid work. USD 10 remains reserved for uncertainty. Alerts accompany these state changes; the shared admission gate enforces them. ### Reconcile liability Use idempotent job/reservation IDs. Replace a reservation with its actual charge exactly once; late or timed-out work keeps its reservation until reconciled. Fixed commitments move to committed charges, never count twice. Stale usage reports, unknown required prices or disputed allowances defer new work. Reserve using no allowances unless their remaining balance is confirmed. ### Preserve useful service Already reserved bounded work may finish. Essential persistence and limited serving of accepted data continue within reserved capacity. Keep evidence and accepted records, mark stale observations and deferred reasons, and retain original observation timestamps. Fixed hosting, database and storage bills can continue while collection is paused. ### Keep implementation small Use one monthly budget ledger with atomic row locking, an idempotent reservation table, fixed commitments and per-source counters at the existing dispatcher. Persist counters across restarts; roll months only after carrying unresolved liabilities. Reconcile provider usage at least daily; stop new paid work when reporting is older than 24 hours. This prototype simulates the gate; infrastructure enforcement and invoice bounds remain unverified. ## Limits ## sources 2 ## listings Per Source 200 ## refresh Hours 24 ## browser Hours 10 ## browser Concurrent 2 ## extractions 700 ## reviews 350 ## fetch Retries 1200 ## max Fetch Attempts 2 ## queue Deliveries 3 ## replays 100 ## extract Input 6000 ## extract Output 800 ## review Input 4000 ## review Output 500 Browser sessions additionally time out at 120 seconds in the demonstration. Actual tokenization and maximum response tokens must be enforced at the model adapter, before the paid request. No retry or LLM fallback bypasses the gate. ## Ledger invariants - Operating exposure = max(monthly forecast, committed charges + outstanding reservations + remaining fixed/service commitments). Add the uncertainty reserve exactly once. - Job IDs are idempotent. Quotas count admitted attempts even when they fail. Duplicate admission or settlement cannot spend twice. - A timeout retains liability. Settlement replaces the reservation with an actual charge. An overrun closes admission until prices are reconciled. - Fixed invoice IDs are idempotent; paying a fixed commitment moves it to committed charges without changing exposure. - All collectors, fallback and replay dispatch use one transactional ledger; production counters persist across process restart and carry unresolved liabilities across month boundaries. The demonstration is in-memory only. - Discretionary work defers at USD 35 exposure. All new paid work must fit the USD 40 operating envelope. Already reserved bounded jobs may finish. Essential persistence and limited serving consume reserved capacity; unbounded public traffic is not authorized by this model. ## Continue, pause and resume Keep accepted records and evidence. Serve the last accepted data within reserved capacity, with the original observation date, stale status and processing deferral reason. Pause optional browser sessions, LLM requests, replay and expansion first; do not automatically retry deferred work. Resume only after current usage, remaining commitments and prices reconcile within the envelope, with quota capacity available. A forecast change is a planning input, not proof of lower provider liability. ## Simulation boundary The demo begins with USD 10 in estimated charges so far, plus the launch fixed commitments and forecast. Its evidence switch simulates confirmed prices/allowances; it records no actual acceptance. It reserves bounded model tokens at fixture prices, plus USD 0.01 illustrative transport/storage per model, capture or replay attempt and USD 0.10 per browser session. These amounts do not establish production upper bounds. Replace them with measured conservative quotes including billing increments, retained storage, retry/delivery limits and required services before deployment. Application limits bound admitted work; provider invoices can lag and fixed or autonomous services can keep billing. There is no verified provider spending cap. The USD 50 budget is a constraint, not a guarantee. This is a review simulation, not deployed enforcement.