Offline operator job cost policy

The owner authorizes catalog descriptors, catalog embeddings, experimental evidence proposals and experimental evidence reviews as platform-funded operations. operator-job-policy.ts is the separate explicit pure registry for operator costs. User schema, pricing and wallet debits are unchanged; no synthetic user, database schema, serving flag or evidence version changes. The controller separately backported main's existing generation-enhance policy entry; operator operations are not added to the user billing registry.

The sole production provider-owning entrypoint is scripts/personalization-worker.ts. It reads DATABASE_URL and the existing provider key variables explicitly, without dotenv or application singleton imports. Every mode requires a direct/session-stable PostgreSQL URL: Neon -pooler hosts, known PgBouncer hosts and explicit transaction pooling options are rejected before connection. A custom proxy must preserve backend sessions, including for dry-run's read-only session setting. An apply-only session advisory lock prevents concurrent catalog jobs; contention stops before spend, and connection error/end aborts the active provider signal and prevents later calls/publication. No transaction spans provider work.

Pass --journal-path with a new absolute .jsonl filename in an existing durable operator directory outside Git. Parent paths are resolved before checking Git boundaries. Files are created exclusively with mode 0600; Windows operators must also provision private directory ACLs. Existing journals are never overwritten or resumed, and no implicit working-directory output is created. Dry-run remains read-only and creates neither journal nor lock. See the rollout examples.

Each attempt has three append-only, fsynced events:

1. begin: operation/policy, requested model, generated run/attempt IDs, timestamp. This must finish before dispatch; every retry is a distinct budgeted attempt.
2. usage: bounded provider token counts and reported USD cost, bounded actual model and model-match indication, and a hashed request ID. This is durable before model/output/evidence validation and does not imply acceptance.
3. outcome: accepted, rejected, unknown, or not-dispatched, separately recorded after local processing. Accepted means transport semantic validation; it does not claim the later catalog database write committed.

Absent/invalid usage and cost are null, never zero or an inferred dollar price. An actual-model mismatch retains its validated model ID and observed cost while rejecting the result. No credentials, source text, provider output, raw errors or arbitrary provider strings enter the journal. Request IDs are hashed. Records are bounded and a journal permits at most 600 attempts, matching the worker's cap.

A begin without usage, or usage without outcome, indicates an interrupted or unresolved attempt. Preserve the journal for operator reconciliation; never assume it was free or automatically replay it. Storage failures poison the journal and stop further spend. They are nonretryable and retain only a fixed primary failure code when provider processing also failed; finalizers do not overwrite exceptions. This local journal is not automatically uploaded or rolled into financial totals.

Both transports require a journal before real network dispatch. Tests use explicit in-memory callbacks with mocked providers. Static ownership tests pin registered operations and exact tracked callers, including the offline evaluator's pure validator-only import. Ignored research artifacts remain outside production entrypoints; this patch neither reruns nor changes frozen benchmark artifacts.