<!-- normative -->

# Hierarchical Budgets

Budgets govern money, tokens, model calls, tool calls, compute, elapsed deadlines, risk exposure, descendants, retries,
and concurrency.

## Budget concepts

- Limit: maximum authorised consumption.
- Reservation: capacity protected for expected work.
- Commitment: reservation assigned to an authorised action.
- Actual: measured consumption.
- Reclaimed: unused allocation returned.
- Protected reserve: capacity reserved for integration, validation, or contingency.
- Contingent exposure: possible future cost of retries or alternatives.

## MVP no-overcommitment invariant

For every budget and every applicable ancestor budget:

```text
actual consumption
+ active reservations not yet committed
+ active commitments not yet reconciled
+ protected reserves
<= authorised limit
```

A reservation protects capacity for a node or action class. A commitment assigns all or part of a reservation to one
authorised attempt. Capacity must not be counted simultaneously as both an active reservation and an active commitment.

The MVP prohibits overcommitment.

For a priced model call, the initial commitment is the hard maximum charge:

```text
maximum input tokens × input-token price
+ max_tokens × output-token price
+ fixed request charges
```

The executor must receive enforceable token limits. On observation receipt, actual usage is recorded, the commitment is
reconciled, and the unused difference is reclaimed atomically.

If actual cost can exceed the enforceable commitment, the executor is ineligible for the MVP.

## Ancestor accounting

Child consumption counts against every applicable ancestor budget but is recorded only once in the ledger. Ancestor
totals are projections over ledger entries, not additional charges.

## Ledger entry

```yaml
cost_entry:
  id: COST-001
  action_id: ACTION-091
  node_id: NODE-042
  ancestor_path:
    - NODE-001
    - NODE-008
    - NODE-042
  resource_type: MODEL_TOKENS
  executor_id: MODEL-003
  reason: VALIDATION
  amount: 1840
  status: ACTUAL
```

### Attempt accounting lifecycle

Attempt execution lifecycle and attempt accounting lifecycle are independent.

Accounting states are:

- `OPEN`
- `PROVISIONALLY_SETTLED`
- `FINALLY_SETTLED`

A terminal execution attempt may remain accounting-eligible.

When an attempt times out or is cancelled, its accounting lifecycle follows the [attempt accounting
lifecycle](control-plane.md#accounting-lifecycle) state machine in Control Plane.

A cost-only observation contains:

```yaml
attempt_cost_observation:
  attempt_id: ATTEMPT-002
  attempt_token: "opaque-single-use-token"
  actual:
    amount: 60
    units: COST_UNITS
  observed_at: "..."
  provider_usage_id: "..."
  payload_hash: "..."
```

For a commitment of 100 and an authoritative actual cost of 60, the ledger records actual consumption of 60 and
reclamation of 40.

A cost-only observation never reopens result, artefact, validation, or acceptance eligibility.

If authoritative usage does not arrive before the configured settlement deadline, the reducer records the full
outstanding commitment as actual cost and emits `ATTEMPT_COST_SETTLED_CONSERVATIVELY`. A later observation is retained
for audit but does not modify a finally settled ledger entry unless an explicit accounting-correction policy authorises
an append-only compensating entry.

## Required policies

The system must define:

- hard versus soft reservations;
- delegation and subdelegation;
- unused-allocation reclamation;
- overcommitment;
- shared-resource allocation;
- retry charging;
- failed-work charging;
- speculative-branch charging;
- cost-estimate overruns;
- protected validation and integration reserves;
- reallocation authority.

Safe initial defaults:

- overcommitment is prohibited;
- failed and timed-out attempts consume their actual measured cost;
- retries require a new commitment;
- speculative alternatives are each reserved, committed, and charged independently;
- ordinary execution cannot consume protected validation or integration reserves;
- child reservations cannot exceed unreserved parent capacity;
- unused reservations expire or are explicitly reclaimed to the parent;
- unused commitment is reclaimed when actual cost is recorded;
- cancellations reclaim unconsumed commitment after the executor's final cost observation;
- reservation, commitment, actual, and reclamation changes occur atomically with their events.

The term `allocation` is not used as a separate accounting category.