7. Hosted exposure — the one open liability

# 7. Hosted exposure — the one open liability

License carries no provider risk (BYOK). **Hosted does, and it is currently uncapped.** Revenue is
$25.96/mo against $4.79 of fixed COGS, leaving **$21.16/mo of provider headroom**.

**By persona** (their seeded Constellation, costed as *our* COGS):

| Persona | Provider/mo | Margin | % |
|---|---|---|---|
| Sam | $0.36 | +$20.80 | 80% |
| Tomás | $3.51 | +$17.65 | 68% |
| Dev | $7.69 | +$13.47 | 52% |
| Priya | $15.42 | +$5.74 | 22% |
| **Maya** | **$29.12** | **−$7.96** | **−31%** |

**Two problems, in order of severity.**

**1. The tail is unbounded.** Cadence, breadth, cycle count and fleet profile are all user-controlled,
and nothing stops a configuration like this:

| Config | Provider/mo | Margin |
|---|---|---|
| 3 domains, reference | $5.72 | +$15.44 |
| 8 domains, daily | $15.26 | +$5.90 |
| **8 dom × 10 cycles × exhaustive × hourly** | **$6,863** | **−$6,842** |

That last row is reachable through dropdowns and wipes out ~340 profitable operators. **Hosted needs an
allowance with a hard stop** — the flat-fee-plus-allowance model §5–6 already worked out. Suggested
shape: include ~$15/mo of provider spend (covers every persona but Maya), meter above it, and surface
the meter in Operations, which already computes the number.

**The hard stop exists at the runtime layer** (the billing half above is still open). Two weekly
ceilings — the instance's, and any one domain's (so a single runaway cannot silence the rest) — are the
Director's **stored** setting (Settings → Spend limits; `aux/meta.json` → `spendCeilings`, re-read per
gated run so a change needs no restart, with `MERIDIANS_SPEND_CAP_USD` /
`MERIDIANS_DOMAIN_SPEND_CAP_USD` surviving only as a first-boot default). Both are compared against
**actual trailing spend** — the last 7
days of the api-log priced by `calculateApiCost`, not the forward cadence estimate, which by
construction cannot see a run that costs more than it was projected to. At/over a ceiling, autonomous
Program runs no-op into `blocked(budget)` with the cadence still armed and visible; the ceiling never
refuses a person's explicit action, and never blocks free work (reminders, record sync). The verdict is
pure ([`spend-budget.ts`](../../../../../src/lib/core/economics/spend-budget.ts)); which scheduled operations spend
is a single table ([`scheduled-operations.ts`](../../../../../src/lib/core/program/scheduled-operations.ts)) that
defaults an unrecognised operation to *spending*. `read-diagnostics.budgetBlock` reports the last
refusal, so an out-of-money instance is distinguishable from an idle one.

**2. The flagship persona is the loss-maker.** Maya is the user the product is aimed at — she publishes,
evangelises, and justifies the category — and she is the only one underwater. Best user, worst margin.
Either the allowance pushes her to overage (fine, she can afford it and it is honest), or Hosted is
positioned away from heavy analysts and toward the Sam/Tomás/Dev band where it is 52–80%.

**A third, smaller leak: weekly billing costs 3.9% of revenue.** Stripe's $0.30 fixed fee is 5% of a
$5.99 charge and is paid 4.33×/month: **$2.23/mo vs $1.23 billed monthly** — $1.00 per operator per
month, ~$12k/yr at 1,000 operators. The "coffee a week" framing may well be worth it for conversion,
but it should be a deliberate trade.

---

Raw Markdown source