N12 · bounded cost model
Price the loop before the loop prices itself.
Use your own cost per attempt, attempt rate, concurrency, detection window and owner-approved loss budget. The result is arithmetic, not a safety verdict.
Control boundary
A budget cap is necessary, not sufficient.
A spend cap can stop monetary burn. It does not replace object binding, evidence-before-effect, external confirmation, retry semantics or recovery controls. Set a separate retry cap and stop condition for the actual workflow.