Spend caps

A hold before dispatch, and a stream that stops.

Before a request is dispatched, a hold is taken against the end user's wallet. The invariant is available = balance − hold, computed atomically — never assembled in application code.

Mid-stream

While a response streams, an accrual loop watches what it costs. When the hold is exhausted the upstream socket is closed and a terminal frame is written in the shape the inbound protocol expects.

{"error":{"code":"spend_cap_exceeded","reason":"hold exhausted mid-stream"}}

A stream that simply stops is indistinguishable from a network failure, and a client that cannot tell will retry. The terminal frame is what stops that.

The lifecycle

Step	What happens
`reserve`	Hold the worst-case cost on the wallet before dispatch
`stream`	Re-check accrued spend every 16 chunks and every 250 ms
`abort`	Close the upstream socket and send the terminal frame
`settle`	Release the hold, write the usage record, reconcile to the cent

← Keys and end users Bring your own key →