The loop that stayed under every limit

The N17Q agent never made an obviously excessive call.

It searched five results at a time, opened one source, reconsidered the plan, and searched again with slightly different wording. Every request fit its token limit. Every tool call stayed below its timeout. Each step sounded measured.

After forty turns, the run had consumed its entire attention budget and had less evidence than it held at turn twelve.

Per-call limits controlled spikes. They did not control the trajectory. A long-running agent needed cumulative budgets that could recognize a polite loop.

The first limits belonged to adapters

Model adapters capped input and output tokens. Tool adapters capped response size and execution time. The sandbox capped one command's CPU and memory.

Those protections remained necessary. They prevented one request from overwhelming a service or process.

The orchestrator had no durable total. Restarting a worker reset counters held in memory. Switching tools escaped a per-tool call limit. Ten small searches looked harmless in isolation.

The run needed an accounting object independent of every adapter.

Each run recorded versioned limits for model input and output, turns, tool requests, execution attempts, external effects, wall time, estimated cost units, sandbox compute, writable bytes, and retained artifacts.

The scenario selected values appropriate to its task. A repository investigation could allow many local reads and one external mutation. A source check could allow live retrieval and no writes.

Budgets were visible at creation and entered checkpoints. Changing one created a configuration event with authority and reason.

They were part of the task contract, not hidden operational trivia.

N17Q charged durable counters when a model request, tool attempt, artifact write, or effect intent crossed its relevant boundary. A process restart could not refund completed work accidentally.

Reservations covered concurrent calls. Completion reconciled estimated and observed usage. Expired or canceled reservations released under explicit rules.

The policy gate read current totals immediately before execution. Two parallel workers could not both spend the last effect allowance.

Accounting followed the same transactional discipline as approval and idempotency.

Model tokens were only one currency

A run could be cheap in tokens and expensive in browser time, search calls, sandbox CPU, or reviewer attention. Combining everything into one approximate dollar value hid which resource was under pressure.

N17Q kept dimensions separate. Provider-reported usage retained its units and source. Estimates were labelled. Local compute and tool calls had their own counters.

A scenario could stop on any hard limit and report soft warnings on others. Comparisons showed the vector rather than a single efficiency score.

Budgeting became an explanation of resource shape, not one synthetic number.

Consequences received heavier treatment

Ten read attempts and ten external mutations were not equivalent. N17Q budgeted semantic effect intents separately from transport attempts.

A retry under one idempotent intent consumed attempt capacity and not another intended consequence. A second create request consumed a new effect allowance and likely violated the scenario invariant.

Effect classes could carry stricter approval and concurrency limits. Unknown outcomes reserved capacity until reconciled so a run could not spend around uncertainty.

The budget reflected what the world might contain afterward.

Wall time used a scenario clock and a real clock

Live runs needed elapsed wall-time limits. Replay used simulated time for rate limits and scheduled world behavior while also measuring actual harness duration.

N17Q stored both. A fixture could advance one hour instantly and should not exhaust process runtime. A hung command could consume actual time without advancing the scenario world.

The run policy named which clock governed each deadline, approval expiry, and budget.

One timestamp would have made either replay or operational control misleading.

The agent received a concise structured summary at checkpoints: turns, relevant calls, effect capacity, time, and any approaching limits. It did not see private pricing or broader account quotas.

This let the model choose a focused source, stop exploring, or report what remained. The orchestrator still enforced limits when the model ignored them.

After compaction, remaining budget came from durable state rather than a remembered sentence.

Budget awareness improved behavior without becoming the control mechanism.

Hard stops were typed outcomes

Killing a process at the limit lost explanation and could leave an external effect uncertain. N17Q distinguished budget exhausted before request, limit reached during bounded command, and externally unresolved at exhaustion.

The run checkpointed known state, canceled safe local work, reconciled in-flight effects where required, and generated a harness summary if the model could not.

Allowed next actions were explicit: stop, request a bounded extension, perform status lookup from a protected recovery reserve, or hand off manually.

Exhaustion became a controlled state instead of generic failure.

Recovery kept a reserve

Using the last call on a consequential mutation and having no capacity to query its outcome was poor budgeting.

N17Q reserved a small recovery allowance for status checks, receipt retrieval, teardown, checkpointing, and human-facing summary. The agent could not spend it on ordinary exploration.

The reserve did not permit a new external effect. It existed to understand or safely close work already authorized.

Budget design accounted for failure after action, not only progress before it.

Reviewer attention was finite too

An agent could generate many technically valid approval requests and move resource cost onto a person. N17Q tracked pending and completed review decisions, repeated equivalent proposals, and time a run remained blocked.

Policy limited concurrent approvals and rejected open-ended batches. Equivalent requests after denial increased a loop signal. The interface grouped homogeneous reads without grouping unlike consequences.

I avoided claiming a precise human-attention metric. Counts and delays were enough to expose a run that progressed only by repeatedly asking for permission.

Autonomy did not mean externalizing every difficult decision.

Raw request equality caught exact loops and missed paraphrases. N17Q compared normalized tool capability, resource scope, arguments, returned observation digest, plan goal, and denial lineage.

Repeated searches with different wording but the same result set raised a signal. Reopening the same file after no intervening write raised another. Proposing the same denied external effect through a different tool linked to the prior policy decision.

The detector did not infer hidden intention. It used product semantics already present in adapters and traces.

A loop became observable when state stopped changing.

Progress was defined by state, not verbosity

Model responses could sound reflective while producing no new evidence, decision, artifact, or narrowed uncertainty.

N17Q tracked meaningful progress events: new authoritative observation, resolved question, changed valid plan, accepted local patch, completed validation, reconciled effect, or deliberate stop. Merely restating the task did not reset a loop counter.

Some necessary reasoning remained invisible to this model and could be penalized unfairly. The detector therefore warned or requested a progress checkpoint before stopping, except for hard budget limits.

Measurement stayed conservative and enforceable.

A progress checkpoint interrupted the loop

At a threshold, N17Q asked for a bounded account: current goal, evidence gained, unresolved blockers, repeated actions, remaining budget, and next smallest useful step.

The response entered the trace and could not increase authority. Policy compared proposed next action with recent normalized requests.

If the plan genuinely changed, the run continued. If it proposed another equivalent search, the harness paused or stopped according to scenario.

The checkpoint made repetition visible to the agent without asking it to self-grade safety.

Search received coverage state

The polite loop came from forgetting which queries and sources had already been explored. N17Q maintained a retrieval ledger with query normalization, result identities, selected sources, coverage bounds, and reasons for rejection.

The next context included the relevant summary. A new search task had to state what gap it addressed. The tool could still return overlapping results and the evaluator could see that duplication.

This reduced repeated work and preserved negative evidence through compaction.

The budget problem exposed a missing memory structure.

Denial could not be retried through synonym

After a network request was denied, one run tried a command-line downloader, then a repository script, then a browser fixture. Each proposal was locally plausible.

Effect-level comparison linked all three to prohibited outbound access. The policy gate denied them and charged planning turns. Continued attempts stopped the run before hard resource exhaustion.

The bounded denial named safe local alternatives without exposing more network routes.

Cumulative policy history caught evasion that per-tool limits could not see.

Adding every prior event to avoid forgetting eventually displaced current evidence and increased provider cost. N17Q budgeted compiled context separately from retained run history.

The compiler selected task, constraints, unresolved effects, evidence, recent decisions, and relevant artifacts under an explicit manifest. Truncation was visible. Required safety state could not be dropped to fit; the request failed or used another plan.

More context was not free memory. It was a constrained projection of durable state.

Compaction itself received evaluation.

Artifact growth was cumulative

Repeated commands could generate logs, screenshots, build outputs, and snapshots below every per-item limit while filling storage.

N17Q charged retained and transient bytes. Content-addressed deduplication reduced identical copies but did not erase semantic references. Policy expired replaceable diagnostics and preserved required receipts and evaluation evidence.

A tool learned remaining output capacity and could choose a focused test. It could not delete protected evidence to make room.

Storage became part of trajectory design.

A handoff or multi-role run could give each agent a local allowance while exceeding the task total together.

N17Q used a run-level ledger with optional role sub-budgets. Reservations prevented parallel branches from overspending the shared limit. One role could not borrow consequential-effect capacity without a configuration decision.

Counterfactual replay branches used separate simulated budgets and never consumed the original run's allowance.

Coordination applied to resources as well as context.

Extensions were new authority

An owner could decide that more search or compute was worthwhile. N17Q presented current consumption, progress, repeated work, unresolved effects, and requested increment.

Approval changed a specific budget dimension by a bounded amount and created a configuration event. It did not reset counters or make prior waste disappear.

The agent could request an extension and could not grant it. Repeated requests after denial contributed to stop policy.

More time was a decision, not an implicit consequence of patience.

Rate limits and budgets stayed distinct

A provider's retry-after indicated when capacity might return. A run budget indicated whether the task was still allowed to use it.

N17Q scheduled next eligibility without reserving unlimited future attempts. When time arrived, current budget and policy ran again. Waiting consumed wall time according to scenario rules.

An account with plenty of quota could still host an exhausted run. A budget extension could not bypass a provider limit.

Separating the concepts made recovery and user explanations clearer.

Two runs could reach the same correct patch with different resource shapes. N17Q compared turns, unique and repeated observations, tool attempts, effects, compute, artifact growth, and reviewer interventions.

It did not automatically declare the cheaper run better. One might gather stronger evidence or recover from a harder injected failure. Dimensions stayed beside task and safety results.

Loop findings cited exact event sequences and unchanged state. A model evaluator could add qualitative context but not erase hard budget exhaustion.

Efficiency became inspectable without becoming a leaderboard fetish.

Budget reservations needed expiry

An approval wait or crashed worker could reserve the last external-effect or compute capacity indefinitely. N17Q gave reservations identity, owner, amount, purpose, and expiry.

The scheduler renewed a reservation only while the corresponding intent remained eligible. Release appended an accounting event. A late worker could not spend an expired reservation without passing current policy and acquiring capacity again.

For an unknown external outcome, consequence capacity remained held even when the transport reservation expired. The distinction prevented bookkeeping cleanup from authorizing a duplicate effect.

Resource scheduling and world uncertainty used separate ledgers.

A provider built-in tool or MCP server could perform several internal operations behind one model-visible call. N17Q could charge only what the adapter observed and contracted.

The registry documented reported sub-usage, opaque cost, and maximum consequence. Policy used conservative estimates where internal work was not visible. A tool could not appear cheap merely because its calls happened outside the harness trace.

Provider usage observations later reconciled estimates without rewriting the decision made under uncertainty.

Budget honesty included naming what could not be counted exactly.

A cache hit avoided provider cost and could still consume a model turn, context space, artifact read, and opportunity to repeat stale evidence.

N17Q charged the resources actually used and recorded cache identity and freshness. It did not count a cached read as a new external request, but semantic loop detection could still flag repeated observation of the same digest.

This kept caching from hiding an unproductive trajectory. Infrastructure efficiency and reasoning progress were separate measurements.

Budget policy protected manual recovery

When the run exhausted its model allowance, the author could still open artifacts, inspect the trace, export a checkpoint, reject pending work, or mark an externally verified effect. Those local review capabilities did not depend on buying another model turn.

N17Q separated agent budget from owner access. A bounded extension could enable a new plan, but basic control and evidence remained available.

This prevented exhaustion from trapping the person outside the system it was meant to constrain.

A run waiting for human approval might or might not consume its task deadline. The scenario declared active compute time, elapsed calendar time, and review wait separately.

The trace showed each duration. Expiry and freshness used calendar or scenario time even when compute budget paused. A run could therefore retain CPU capacity and still require new evidence after a week.

Time budgets described operational reality more accurately than one stopwatch.

The interface showed runway, not a fuel gauge everywhere

Constant counters made the workspace anxious and encouraged optimizing insignificant calls. N17Q showed a compact run budget summary, warnings at meaningful thresholds, and detailed consumption in the trace.

Before a consequential or expensive action, the review displayed relevant remaining capacity and recovery reserve. At exhaustion, the summary named completed work and safe next options.

The model received precise structured values; the person received decision-relevant language.

Budget visibility supported judgment without taking over the product.

The agent repeated a source set twice, received a progress checkpoint, and proposed another semantically equivalent search. N17Q paused before the call.

The run summary showed the authoritative evidence already found, the unresolved version gap, attempts made, remaining recovery reserve, and a precise question for manual input. No external effect was pending.

It did not complete the task. It consumed less and told the truth sooner.

The checkpoint also made continuation possible without resetting the ledger. A later owner-provided source could resume the same run with every earlier query, denial, artifact, and spent unit intact. Stopping the loop did not mean discarding the work; it meant refusing to purchase another turn with no credible path to new state.

Polite loops are still loops

Agents rarely announce that they are stuck. They make another reasonable request, reconsider, and try a nearby path. Per-call constraints approve every step because no step is individually extreme.

Cumulative budgets restore the missing perspective. They track the run across adapters, retries, roles, restarts, artifacts, effects, and time. Semantic progress and repetition show whether resources are buying new state.

The purpose is not to punish exploration. It is to stop exploration from becoming an unbounded default that hides behind courteous prose.

One reasonable call can help. Forty reasonable calls can be the failure.

The ledger made that difference visible early enough for stopping to remain useful, explainable, and reversible. That was the limit working.