safety layer: hard daily budget, user quotas, spend report, forgetme + privacy

2026-07-13 13:21:45 +02:00
parent f6c3e7d8e5
commit 02c989946b
11 changed files with 465 additions and 6 deletions
@@ -43,3 +43,13 @@ Decisions inside the set architecture. D-NNN, never renumbered.
  per message instead of appending: histories are capped at
  `history-limit` (~200-350 rows) and trims must be reflected;
  correctness over micro-optimization.
+- **D-012** — Budget spend is *estimated* from configured per-token/
+  per-image prices, not fetched from the billing API: deterministic,
+  testable, no extra scopes. Dashboard hard limits (FDB-001) stay the
+  outer safety net; this ledger is the inner, immediate one. User
+  image quota counts at grant time (reservation), global image spend
+  at generation time.
+- **D-013** — `!forgetme` v1 purges history rows only; the
+  single-string channel memory cannot be selectively cleaned. Full
+  fact-level erasure ships with FDB-007 structured memory — stated in
+  the user-facing confirmation, not hidden.