[HappyGamblingAddict]

…flow-safe (851-labs#143)

Fabricated uploads on 2026-10-05 stored rows with cost_usd up to 2.7e296 and 8.6e15 tokens through the normal CLI ingest, overflowed the public layout, and pushed sum(total_tokens) past int64 so /internal returned 500.

• Plausibility limits per usage_days row, for every CLI version: tokens are non-negative safe integers up to 1T per field; cost is finite, non-negative and at most min($1M, billable tokens x $0.002 + $250). Calibrated against legitimate prod rows (max 110.7B tokens, $131k, $60/M). Offending rows are dropped one by one, logged with user and device, and counted on the device (devices.rejected_usage_rows, shown on /internal). The response contract is unchanged.
• The cost freeze never keeps a stored cost above that ceiling.
• Usage aggregates use SQLite total() instead of sum(), which threw "integer overflow" past int64.
• www formatters compact large values ($1.2M, 4.5B) and cap absurd ones at

  $999T / >999T so they cannot stretch the layout.