Financial readiness — what is proven, and what is not

Young, 2026-10-11: "Mira ensure our financial sound and ready for Heart Unit."

Measured, not assured. Everything below is from a command that ran. The gaps are named because a closeout that only lists wins is how V2's $0.00000 ledger read as truth for 30,721 attempts.

✅ 1. Spend is under control and stable

opencode stats --days 7 --cost --models
cost $11.60 · cached input 91.7%

opencode-go/longcat-2.5-preview-f…   2.8b   55.8k   $0.00
opencode/space-bunny-free             2b   71.9k   $0.00
opencode-go/qwen3.8-flash#default  309.3m   7.5k   $11.17

Down from $19.49 two days ago. Every remaining dollar is one model — qwen3.8-flash at $11.17, which the ledger now refuses to construct without a why_paid. The free tier is doing 4.8b tokens at $0.00.

For the Heart Unit this is the right posture: the GO free inventory is 2 models and ZEN's is 12, so a fleet that starts tomorrow has capacity before it touches a paid rung.

✅ 2. The cost controls are built and falsified

✅ 3. Backup and recovery — my stage, proven

9.4 ran into an empty root: 440 passed, registry byte-identical, no drift. Scheduled daily 03:30, --no-agent, and proven by a forced run. It has already caught two real defects: 2,600 lines on one disk, and the blocklist present in the working tree but absent from the backup.

🔴 GAP 1 — the ledger is not in the backup, and that is the one thing I own

operation/state/ is gitignored — declared disposable in STRUCTURE.md. It holds the task stores v3-tasks.db, {ace,alpha,atlas,echo,nova}-tasks.db, and every exit-proof-stage2-*.db.

So "the ledger survives a loss" (Stage 9.3) is only half true. The code is backed up; the rows are not.

This is defensible for a build — those tasks are disposable run state. It is not defensible on the day the Heart starts spending money, because the ledger is the record of what it spent.

What I will do: add operation/state/*.jsonl to the backup script — a cost ledger is append-only text and belongs in the second copy. The task .db files stay ignored.

🔴 GAP 2 — the ledger has never seen real data

operation/runtime/loop.py:454 records a CostRecord per attempt and observe.py:301 reads one back. The wiring is real. But no ledger file exists anywhere — so the record has never been exercised against a live cost.

I am not calling this a defect; I am calling it unproven. The first real Heart run is its first proof, and I would rather that be said now than discovered then.

🟡 GAP 3 — muse-spark's scope needs Min to dispatch, not me

Young ruled public-only and the blocklist enforces exactly that. Nothing for me to do — recorded so it isn't mistaken for an open financial question.

What "ready for the Heart Unit" actually means, on evidence

So: financially sound, yes. Financially proven, one gap short — and the gap is mine, named, and fixable in the morning rather than a risk discovered mid-flight.