Cost, budget, and the ledger

Every finder and audit call runs through an admission controller that enforces the hard budgetGbp before any model call is dispatched. The audit's worst-case cost is reserved first, before any Luna finder call, so an unaffordable review refuses outright (stage: "admission") rather than spending on finders it cannot afford to conclude. Refused finder packs are listed in admissionRefusals and never consume any budget.

Retries are not free: each retry attempt is admitted against the remaining budget before it runs, and every admitted attempt is charged to the ledger. The reserve-first audit reservation stays one attempt's worst case, so the ordinary defaults keep working, while the hard ceiling still bounds the actual worst-case spend including retries. A retry refused by the remaining budget stops retrying: the finder pack downgrades or the audit defers rather than exceeding the ceiling (see "Retries, downgrades, and deferral" below).

Because admission refuses any finder pack beyond the ordinary budget, a gate reviewing a large task branch may need to raise --budget-gbp to admit more finder packs and so cover the full diff. The ordinary default deliberately forces refusals on multi-pack large reviews; lift the budget only for the runs that warrant the extra coverage.

metrics carries the cost accounting:

• ledger: one entry per admitted call, with lane, model, serviceTier, reasoningEffort, estimatedWorstCaseUsd, pricingTableVersion, and attempts. estimatedWorstCaseUsd is the total admitted for the call across its attempts, so a call that retried carries the summed worst case of each admitted attempt while attempts records the observed count.
• ledgerTotalEstimatedUsd: the sum of admitted worst-case estimates.
• budgetUsd, reservedAuditUsd, and spentUsd: the admission trail for this run.
• routingPolicy and pricingTableVersion: which routing policy and pricing snapshot produced this ledger.
• auditCandidateCount, overAuditCapCount, unknownAuditVerdictCount, and duplicateAuditVerdictCount: audit compaction and verdict-pairing tallies.
• lunaDowngradeCount and truncatedFiles: partial-coverage indicators.