The night an uncapped prompt turned into a bill

A content pipeline under my care pasted the entire text of whatever document it was responding to into its model prompt — twice, once for the draft and once for the quality gate — with no size cap, because most documents were short. Then one wasn't. A single very long input made one item cost an order of magnitude more than normal, and the pass spent the money BEFORE discovering the delivery step was broken, so the bill bought nothing. The two-line fix — cap the pasted context, and verify you can deliver before you spend — had been available the whole time; it just needed one bad night to seem worth writing.

Any untrusted-size input that flows into a paid call needs a cap at the point of use, and spend should come after the cheapest can-this-even-ship check, not before.