The split is deliberate and it worked: real tenants bill the paid API; everything synthetic bills the subscription (owner ruling 2026-07-31). Friday's failures hit ONLY test-property traffic — The Willows is a bench property, so those texts (including Fede's) rode the subscription pool the coding fleet also burns, and the fleet drained it. Camellia's real residents were on the paid key the whole time, which never passed 1% of its limits — production customers were never at risk. The real costs of the incident: bench/test traffic starves easily, and nothing made that legible until a human noticed an unanswered text.
Update Aug 15 evening: Fede does not want per-use charges — the bench-account fix is either one more subscription seat or a $0 pacing convention (test rigs and heavy coding sessions don't overlap); the patience-and-alerts PR makes the $0 option livable. His pick pending.
| # | Action | Payoff | Effort |
|---|---|---|---|
| 1 | Give bench + background lanes their own subscription account (or park them on the paid API in a test workspace)reliability | coding-fleet crunches stop starving demos, harnesses and QA lanes | 1 account + 1 PR |
| 2 | Workspaces as blast walls: production / CI+harnesses / background jobs, each with own key + limit | a runaway test hurts only tests | 2 min Console + 1 PR |
| 3 | Cache leaks — investigated, RETRACTEDcost | 1-hour caching is already on and above breakeven; the classifier prompt is too small to cache (its tokens are the incoming text bodies). No cost fix here — see below. | closed |
| 4 | 4pm daily review job: KILLED (Fede's order, Aug 15) — schedule paused with a do-not-unpause note | daily spike gone | done |
| 5 | Patience + alerts for texts when limits hit (built, in review) + release the 2 shelved texts | a busy minute delays a reply instead of losing it | done, pending merge |
| 6 | Housekeeping: merge duplicate "local-dev" workspaces, delete archived keys, label every caller's requests | future usage questions answer themselves | trickle |
| 7 | Decommission the old pipeline-test endpoint (journey harness, pipeline-lab, canary, 1 CI job depend on it) | closes the door the Friday harness burst walked through | own project, ticketed |
I flagged these from aggregate numbers; a code-level check (PR 5795) proved both wrong, so the record is corrected here rather than quietly. 1-hour caching has been live for Clara's loop since May; Thursday's 2.8 cache-reads-per-write is above the ~1.1 breakeven, i.e. it is already saving money. The classifier sends a 123-token fixed prompt plus the resident's text — the fixed part is far under the model's cacheable minimum, and the text bodies can never be cached; its 93M tokens are volume, not waste. The only real levers there are cheaper triage or skipping the call more often — a separate, small idea, not a leak.
Texts to Clara failed in bursts (9:44pm Thu, 9:21–10:42am, 4pm sharp) with "account rate limit." Burners on the shared subscription pool at those times: overnight coding-fleet CI work, the journey harness feeding the full pipeline every 3–5s for an hour, and the daily 4pm conversation-review job's 20-calls-in-2-seconds volley. Four texts (all test traffic — two Fede's, two the latency tester's) sat unanswered in the dead-letter shelf; an alarm did fire into #alerts but registered with no one. The patience-and-alerts package (fix 5) plus the account/workspace split (fixes 1–2) close every layer of this; the 4pm job is already killed.
① Create "propflow-production" and "ci-harnesses" workspaces + one key each → I wire everything. ② Rotate the admin key (it was pasted into a chat). ③ Optional: glance at Logs → 429s to see the starved account named.
PropFlow Docs