Generation is metered in credits.
The lifecycle: credits are reserved when a job is queued, settled at the real cost when it succeeds, and refunded in full if it fails. You are never charged for output you did not get.
Reserving up front is what stops concurrent requests overdrawing a balance.
The ledger is append-only — your balance is the sum of what actually happened, not a mutable number someone could edit.
Every button shows an estimate before you press it. Nothing spends credits silently.
Deduplication: an identical request within ten minutes reuses the earlier result and costs nothing. Same prompt, same seed, same settings — you get the same frame, so charging twice would be charging for nothing.