This candidate routes new long internal reviews through the existing prepaid payment adapter; deployment is tracked separately. The former x402 path allowed a 600-second model response while the signed authorization expired after 120 seconds. One retained failure was decoded as SignatureExpired(uint256). Prepaid delivery removes that mismatch without extending signatures or repeating prior requests. No public inference access is enabled.
A project-specific, operator-only recovery allocation can temporarily set maximumGlobalDay from 8 to 16 inclusive. It expires with its existing UTC-day allocation, preserves every historical counter and the global lifetime maximum of 32, and does not fund model use. Other projects keep the ordinary global-day ceiling. Invalid values invalidate the allocation. The agent has matching operator deployment settings NETWORK_REVIEW_RECOVERY_DAY and NETWORK_REVIEW_RECOVERY_LIMIT (8 through 16, otherwise 8). NETWORK_REVIEW_RECOVERY_PROJECTS is a comma-separated allowlist of one or two exact project IDs. Only those projects may use the additional agent capacity; all others retain eight. These settings grant no approval authority.
The planned delivery uses at most two further decisions and a dated ceiling of 10, only after the prior attempts are conclusively failed. Each remains subject to the existing 2-USDC per-call and 500-USDC lifetime payer limits, original proposal evidence, actual model decision and signature verification. There is no automatic retry, refill, counter reset or change to customer permissions.
The agent requires rail: surplus_credit before dispatch. Every explicit work-admission refusal before reservation keeps the same ID queued. A confirmed unique-index conflict on the shared active slot also defers; other database errors remain uncertain. It cannot replay a reserved or uncertain paid call. After the original delivery window, a payer-confirmed inactive uncertain execution terminates the review as failed with paymentHoldRetained: true. This releases only execution capacity; it creates neither an approval nor another purchase, and the payer ledger keeps the full unresolved exposure.
The review quote cannot shrink output or input. Unaffordable quotes fail unsigned. Native response/billing validation is unchanged. The relevant unchanged quote, response, policy and downstream keepalive sources are included for independent inspection. Operator quote ceilings below 2 USDC prevent readiness. Recovery limits accept only canonical decimal integers from 8 to 16 for the configured UTC date.
The daily counter is global across projects. Recovery projects may use a higher global-count ceiling; this does not reserve a per-project quota or guarantee admission. Unallocated projects still stop once that global count reaches eight. Queued work can wait for capacity until its authority or proposal window closes. Unresolved financial holds continue to count against the finite lifetime budget.