Reserve, Settle, Floor: Metering AI Spend as a First-Class Contract

The Founding Decision: Operator-Exempt, Fail-Closed

The SEO Command Center, the autonomous SEO platform we build inside Zyan (our software arm), pays two metered providers on its tenants' behalf: an LLM provider (Anthropic) for drafting, synthesis, and review, and a search-data provider (DataForSEO) for rank and research evidence. On July 16, 2026, before the first feature of the port landed, the metering model for both was ratified in one decision: operator-exempt, fail-closed. Outside tenants hard-block at zero credits: with no credits available, nothing is dispatched, and no exception is made. Our own tenant is metered identically but never blocked: the studio's delivery obligations cannot be halted by the studio's own meter, yet every dollar it spends is still recorded, because a meter whose operator is exempt from measurement is not an instrument but a blind spot.^[1]

The third clause of the decision looks administrative and turned out to be load-bearing: the USD-to-credit conversion rate is tunable configuration, not code. Rates change as provider pricing and margin decisions change, and a rate that can change while work is in flight creates a repricing hazard that one of the primitives below exists specifically to close. Every money seam that followed (reserve-before-egress, settle-in-finally, the under-charge floor) is a consequence of taking this one decision seriously.

The Contract Primitives

Reserve before egress. The engine we ported, roughly 46,000 lines of single-tenant code, arrived with a monthly budget gate that failed open: if the spend check errored, the call went out anyway. In the multi-tenant port, landed over July 16–17, 2026, that gate was deleted rather than patched. Its replacement reserves credits atomically before any provider call leaves the platform; a blocked reservation means nothing is dispatched. The distinction is one of polarity, not plumbing.^[2]

The rate is captured on the reservation. Because the USD-to-credit conversion is tunable, an operator retune mid-run could otherwise reprice work already in flight, charging a tenant tomorrow's rate for yesterday's dispatch. From the first version of the credit substrate, each reservation snapshots the conversion rate at reserve time and settles at that captured rate, whatever the config says later.

Settle in finally. Settlement code lives in the one construct no exit path can skip. Whether a metered call succeeds, returns a provider error, times out, or throws, every path through it terminates at the same settlement, which records what actually happened according to an explicit taxonomy:

• Parsed provider usage: settle at the actual observed cost.
• The provider answered with an error: settle at $0; a completed non-2xx response is proof nothing was billed.
• Dispatched but unresolved: the call left the platform and no parseable outcome was ever returned; settle at the estimate, never at zero.
• Never dispatched: settle at $0. This is the only full-refund case, and it must be provable, not assumed.

The third row is the under-charge floor, and it is the least intuitive primitive. When the true cost of a call is unknowable because the call was dispatched and simply never resolved, the comfortable instinct is to charge nothing and apologize. A zero floor, however, turns every ambiguous failure into a perpetual free retry: an agent that times out at the provider, receives a refund, and retries constitutes an unmetered spend loop disguised as error handling. The floor therefore charges the estimate whenever spend cannot be ruled out, and refunds fully only when non-dispatch is provable.

The double-settle guard. Settlement is exactly-once per reservation, enforced in the substrate rather than by caller discipline. The platform's own history supplies the motivating class: earlier in the record, a replayed completion callback re-ran a publish path end to end and doubled image spend that no reservation covered; duplicate effects from at-least-once delivery are not hypothetical.^[2]

Reserve at claim, not at enqueue. The newest refinement, adopted as long-running AI work moved into a durable job queue in mid-August 2026: for queued work, the reservation is taken when a worker claims the job, not when the job is enqueued. A queued job can legitimately wait (for an offline desktop runner, or for a retry window), and a job that never runs must not hold a tenant's money while it waits. The reservation brackets the actual spend window: reserve as late as possible, settle on every exit path, and give every ambiguous outcome an explicit rule.

The Bug Gallery

Zero-dispatch families tripping the floor (July 16–17, 2026). The floor doctrine produced its own first bug. In the search-data worker, some request families can legitimately resolve to zero dispatched calls: the batch assembles, and nothing in it requires dispatch. The freshly written under-charge floor, built to be suspicious of ambiguity, charged the estimate anyway, billing for work that provably was never dispatched. Pre-merge review flagged it as a blocker, and the fix sharpened the taxonomy rather than softening the floor: never-dispatched is the one provable full-refund case, and it must be handled as its own branch, not folded into "unknown."^[2]

The reservation reaper that would have pinned forever (July 18, 2026). A hard runtime kill between a committed reservation and its settlement strands the debit, and a stranded debit can hard-block a near-limit tenant indefinitely. The reaper exists for exactly this case: it sweeps reservations older than two hours and settles them at the reserved estimate, on the floor-doctrine grounds that the absence of a referent row is not proof of non-dispatch. The bug was in its candidate selection. The first implementation scanned the oldest fifty reservations; once the fifty oldest rows were all long-settled, the scan window filled with them permanently and never advanced, and every orphan behind the pin would have remained silently stranded forever. Review caught it before activation; the fix selects candidates by anti-join, considering only unsettled rows, so settled history can never occlude live debt.^[2]

The phantom-spend retry wedge (July 22–23, 2026). During the strategy-engine build, the adversarial review panel recorded a finding whose ledger entry carries a figure of roughly $13: a retry path that would have charged for work that never happened. It was caught and fixed pre-merge, so it never billed anyone. We are deliberately describing it at the level of certainty the record supports: the review ledger preserves the finding's headline figure and its class (spend recorded without corresponding provider work, reachable through a retry) but not a full narrative of the mechanism. We publish it anyway because the aggregate matters: across four weeks, nearly every wave's worst review finding was a money-path defect, and most of them, like this one, exist only in the review ledger precisely because they never reached production.^[2]

Fitted Engines and Timeout Arithmetic

Two independent incidents, sixteen days apart, taught the same lesson from opposite directions: a static timeout sitting next to a variable-latency model call is a money bug waiting for a configuration change.

July 28, 2026: the fitted-engine class. Flipping the platform's default model, a one-line configuration change, silently switched which model the strategy synthesis and review engines ran on. Those engines had been live-fitted to the old model: a 135-second execution ceiling and token envelopes tuned to the old model's emission rate. The new model emitted at a different rate, so every run deterministically hit the ceiling and failed, at full reservation cost, because a timed-out call is dispatched-but-unresolved and the floor correctly charges the estimate. The floor did its job; the fit was the defect. The engines are now pinned to their fitted models independently of the platform default.^[4]

August 13, 2026: the multiplication, not the constant. A daily topic-generation step made one model call that legitimately runs 20 to 90 seconds, placed under a 60-second timeout. Calls in the slow half of the distribution deterministically failed at full cost, and a blind retry doubled the damage to roughly 120 seconds of a scheduler tick budgeted at about 140, every day, while banking nothing. The same overrun is what starved the daily scheduler (then roughly a dozen steps) and degraded report freshness for five days; raw ingestion was unaffected and no data was lost, a forensic account we document separately in this index. The audit rule the incident produced: per-attempt timeout bounds are not aggregate bounds. Audit the multiplication (attempts times retries times call sites), not the constant.^[4]

The review of the proposed fix then caught the floor's mirror image. In the bounded fetcher, a deadline-refused retry that followed a received provider error returned nothing instead of the error response; settlement, unable to see the completed non-2xx answer, therefore charged the full estimate for a call the provider had answered and not billed. The rule pair is symmetric, and both halves are binding: never charge for spend that provably did not happen, and never treat unreadable spend as zero. The interim bounding fix itself was ultimately subsumed before shipping in that form: the durable job queue moved the call out of the scheduler entirely, which is the structural version of the same answer.^[2]

Where the Money Actually Goes

Instrumenting the contract end to end produced a cost anatomy we did not expect. A cloud content draft bills between $1.64 and $5.02, and the dominant term is not generation; it is roughly 1.6 million cache-read tokens. The drafting agent reads far more than it writes: site context, strategy documents, prior work, verification output. This is why, when we split models on August 4, 2026 (routing API-side lanes to a cheaper provider while the drafting agent stayed on a Claude tier), the writer-model switch alone saved little, and the API-lane rerouting accounted for the real savings. Optimizing the generation price of a workload dominated by reading is optimizing the small term.^[3]

The same instrumentation forced a subtraction. Automatic AI image generation was removed from the pipeline entirely on August 11, 2026, not because the images were deficient but because their spend was invisible to every budget guard by design: it flowed through a lane no reservation bracketed and no meter read. Under the contract's own logic, an unmeterable spend lane is not a feature with a cost problem; it is a hole. Hero images are now sourced keylessly from openly licensed catalogs, with attribution stamped, at zero provider spend.^[3]

The largest lever is not a lane at all but a venue. The local-first desktop lane, documented in its own milestone write-up in this index, executes drafting work on studio-owned machines under subscription pricing, bringing marginal draft cost to zero. We state the evidence base plainly: the economics rest on two fully measured runs plus provider list prices. On August 13, 2026, a health-content publisher's full draft executed on a studio desktop in seven minutes at $0.00 marginal cost; the following day a smaller cloud-fallback job metered $0.0585. Two runs constitute an existence proof with measured endpoints, not a distribution; the fleet-scale reliability data does not exist yet, and we say so.^[5]

Every Reliability Bug Is Eventually a Money Bug

Consider the gallery as a whole. A candidate-selection bug in a sweeper is a reliability bug until the rows it strands are debits. A timeout constant is an operations detail until every expiry settles a reservation at full estimate. A retry loop is resilience until the thing it retries is billed. In a conventional system these defects cost latency or freshness; in a system that autonomously spends money on every action, each one carries a dollar sign, and the conversion from reliability defect to billing defect is automatic. That is the general claim we take from these four weeks, and it is why the money path, rather than the agent code, carries the strongest invariants in the codebase: atomic reservation, captured rates, settlement no exit path can skip, floors with explicit polarity on every branch, and contract tests that pin all of it against regression.^[2]