Core concepts
Spend caps
A hold before dispatch, and a stream that stops.
Before a request is dispatched, a hold is taken against the end user's wallet. The invariant is available = balance − hold, computed atomically, never assembled in application code.
Mid-stream
While a response streams, an accrual loop watches what it costs. When the hold is exhausted the upstream socket is closed and a terminal frame is written in the shape the inbound protocol expects.
json
A stream that simply stops is indistinguishable from a network failure, and a client that cannot tell will retry. The terminal frame is what stops that.
The lifecycle
| Step | What happens |
|---|---|
reserve | Hold the worst-case cost on the wallet before dispatch |
stream | Re-check accrued spend every 16 chunks and every 250 ms |
abort | Close the upstream socket and send the terminal frame |
settle | Release the hold, write the usage record, reconcile to the cent |