Spending Is a Decision, Not a Default

"The machine can pay again. It may not do so without a human saying, in so many words, 'yes, pay again.'"

Where the Free Paths End

Reconcile exhausts every free way to recover a result. Sometimes it comes up empty: no cache, no durable chunks, nothing in provider history. Now the only way forward is a fresh paid request. This is the fork the whole track has been protecting. The wrong move is to slip that paid request into the automatic path "to be helpful." The right move is to stop and hand the decision to a person.

The Explicit Opt-In

A second paid attempt happens only behind an explicit override — a flag a human sets on purpose, like an allow_paid_rerun that defaults to off. Without it, repair recovers for free or reports that a decision is needed; it never spends. With it, and only with it, the engine makes exactly one new paid call, deliberately and logged. The capability to pay is always there; the permission to pay is a separate, human-granted thing.

Capability Is Not Permission

This is the money discipline in one sentence: the machine having the ability to spend must never be the same as the machine being allowed to spend on its own. Every automatic retry that can cost money — credits, tokens, API quota, real currency — needs the same gate. Default to not spending, make the opt-in explicit and visible, and log the moment it fires. The gap between "can" and "may" is where trust in an autonomous tool lives.

Code

Default off; a human flips it on, on purpose·python

def repair(job: Job, *, allow_paid_rerun: bool = False) -> Resolution:
    free = reconcile(job)                 # ALWAYS try the free paths first
    if free.recovered:
        return free

    if not allow_paid_rerun:
        # The default. A human must explicitly opt in to spend again.
        return Resolution.needs_decision(job, hint="set allow_paid_rerun to re-pay")

    # Explicit, deliberate, logged: the ONE place a second charge can happen.
    audio = provider.synthesize(job.text, job.binding, job.settings)  # PAID again
    return Resolution.recovered(audio, cost=audio.credits)

Exercise

Find an automatic retry in a system you know that can consume something scarce — money, API quota, rate-limited tokens, compute minutes. Does it retry freely, or does it gate the costly attempt behind an explicit opt-in? If it retries freely, add the gate: default off, a named flag to allow it, and a log line when it fires. Describe the worst case the gate prevents.

Hint

Separate 'can the code do this?' from 'may the code do this without asking?' Anything that spends a finite, real resource belongs on the 'ask first' side of that line, with the default set to don't.