Cost envelope and delivery effort

All workload, storage and effort figures on this page are Estimated, not Measured. Prices are published USD rates checked on 2 November 2026, before tax, domain registration or account-wide usage from other projects. Nothing here provisions a paid service.

Pilot workload and application ceilings

Baseline assumption: 100 accounts × 150 alerts per month = 15,000 alerts. Stress envelope: 50,000 accepted alerts per billing month across both environments, maximum raw size 64 KiB. This is a proposed admission envelope; Owner approves pilot size separately.

Budget reservations live in primary D1 and use conditional atomic writes. Failed work does not refund a reservation until reconciliation proves the operation did not occur. Per-worker CPU limits bound an invocation; they are not account spending caps. Reserve a separate housekeeping margin of 1 million CPU ms and job capacity inside the monthly envelope. Query bounds and real metadata must validate the D1 estimates before pilot enablement.

When a cap is reached, new intake or recomputation pauses with an honest pending/unavailable state. Existing history remains accessible within the reserved read budget. Deletion remains operational through reserved capacity. Do not repeatedly enqueue overflow work for tomorrow.

Published price comparison

Estimated base total: US$5/month, assuming these allowances are available in the account and configured resources stay within the envelope. Included allowances are shared with other workloads. Before enabling the pilot, reconcile the whole account's usage, not only Optima's counters.

Sources: Workers pricing, D1 pricing, Queues pricing, R2 pricing.

Residual billing risk and stop procedure

Cloudflare provides no general account hard spending cap. Rejected API calls and mail still invoke Workers before application admission, and cleanup/monitoring also consume resources. Therefore these application limits do not guarantee a US$5 maximum during a flood or a bug. Uncontrolled ingress has no finite worst-case bill in this design.

Use provider-side rate controls where available, disable public signup during the pilot and reject unapproved tags early. Set a US$5 account budget alert and early usage alerts at 50% and 80% of each included allowance. Proposed monitor runs hourly; alert delivery and operator response can lag. A primary-D1 kill switch stops expensive writes and jobs. If ingress continues, the runbook removes the email route and disables the affected public Worker route. A kill switch inside a Worker alone cannot stop invocation charges.

The hard unresolved decision is whether the Owner accepts this residual Cloudflare exposure. If an absolute US$5 ceiling is mandatory, do not enable paid production intake until a separately approved provider-level containment approach exists. No extra paid service is silently added to solve it.

Effort by requirement

Ranges are Estimated engineer-days of focused implementation and checks, not elapsed dates or a commitment. They exclude waiting for issuer terms and pilot participants. Shared plumbing is charged once in the most relevant row.

A proposed 25% contingency yields about 53–92 engineer-days. This is not a schedule; team availability and review/test time determine calendar duration. The largest risk is incomplete reward evidence, not chart implementation. Do not trade away uncertainty or tenant isolation to meet an inferred deadline.