Wedge four

Your worst day is on us

The defining resentment in this category is not price, it is unpredictability: a single bad deploy tripling the bill, credits that expire monthly, a per-contributor seat charge that grows with the team. Bucker treats that as a product constraint rather than a pricing page. Monitoring is flat and boring; only the AI lane is metered, and only on an artifact you could audit.

The promises, and the mechanism behind each

claim · 01Shipped
Your worst day is on us
A bad deploy that produces a million events is one issue. The storm estimator returns a literal zero for event overage and caps billable AI work at the number of distinct issues, so the maximum a storm can cost is one verified fix. It is arithmetic with a test around it, not a goodwill gesture you have to ask for.
claim · 02Shipped
Degrade, never drop silently
Past your quota, ingestion moves to deterministic stratified sampling on a stable key — deterministic so every shard agrees — keeping representative events per fingerprint rather than discarding the tail. Each degraded event is recorded with a reason, and the dashboard shows what was dropped and why in plain language.
claim · 03Shipped
Metered only on a verifiable artifact
A fix bills only if it reached verification tier A or B and carries a named human approver. Fuzzy outcome definitions degenerate into invoice disputes, so billability is a pure function over the certificate rather than a judgement call, and the invoice line links the artifact bundle it charged for.
claim · 04Shipped
No per-seat growth punishment
Human seats are unlimited on every tier including Free — and there is no seat-count field in the plan schema at all. The type is the literal string “unlimited”, so introducing a per-seat limit would require changing the type, and the suite asserts no per-seat price field has appeared.
claim · 05Shipped
No SSO tax, no per-unit upsells
Single sign-on and SCIM are on every paid tier. Cron monitors, uptime monitors, user feedback and session replay are on every tier including Free. Both are enforced by tests that fail the build if a flag is turned off, because “we would never do that” is not a mechanism.
claim · 06Shipped
Credits roll over
Unused verified-fix credits carry into the next month rather than evaporating on the first, and rollover credits are always spent before you are metered. The roll happens on every read of your subscription rather than on a nightly job, so an account that goes quiet for three months and comes back gets the same balance a scheduler would have produced. The balance is capped at three months of your allotment — an unbounded one lets a dormant account bank a year and spend it in a weekend, which is a cost shape we cannot underwrite. Credits do not expire, and we would rather put the cap here than have you discover it on an invoice.
claim · 07Shipped
Caps default on, and refuse before they bill
Spend caps are enabled on every tier by default, and the AI budget gate refuses to start a run that would exceed a hard cap rather than declining to bill for work already delivered. Budget is measured net of credit-backs, so a fix that regressed inside its durability window stops consuming your cap.

What this deployment cannot do

noteNot connected here

Nothing here has ever charged a card

A fact about this deployment rather than about the product. No payment provider is connected, so no card has ever been charged from here and no invoice has ever been issued. What is written and tested is the whole path up to the money: plan changes, proration quotes and invoice lines are computed and recorded, the quote you were shown is persisted — because “what did you quote me” is the first question in every billing dispute — and Stripe sits behind a payment interface that is told what to collect and never asked to work out how much. Its own proration is switched off and the money would move as invoice items copied verbatim from that quote, so a bill cannot disagree with the number that authorised it. A scheduled sweep re-meters a fix whose merge raced the meter and re-sends any line that never reached the provider, keyed on the line id so a retry cannot charge twice.

Connecting it is more than one value, and the order matters. The secret key alone is what decides whether a payment provider exists, so setting only that key flips every money-shaped response from “not connected on this deployment” to connected while a plan change still fails on a missing price id — a worse state than this one, because the honest message disappears and the failure does not. A deployment that means to bill needs the secret key, the webhook signing secret, and a price id for each tier it sells; a tier without one refuses that move and names the variable it wanted.

The anti-goals we wrote down first

See the numbers

The pricing page publishes the ladder, read from the same endpoint the product reads when it enforces your quota. Honeybadger wins deals by publishing a price while Sentry, Rollbar and Bugsnag obscure theirs; we would rather be on the first list.

Your worst day is on us

The promises, and the mechanism behind each