LLM-agent budget overruns are a documented production failure class: a single retry loop can spend thousands of dollars before an operator notices, and the in-process integrity properties that would prevent it (no aliasing, no double-spend, no use-after-delegation of a cost-bearing value) are enforced, if at all, by ad-hoc wrappers rather than by the type system. Our central contribution is empirical: a catalog of 63 confirmed production incidents from 21 orchestration frameworks (2023-2026), each backed by a quoted GitHub issue and, where reported, a dollar loss, organized into an eight-cluster failure taxonomy (inter-rater Cohen's kappa = 0.837, N = 113), plus 47 supplementary structural entries. As one mitigation evaluated against this taxonomy, we build token-budgets, an 1,180-line Rust crate (no unsafe) that operationalizes affine ownership so that cloning, double-spending, or using a budget after delegating it are compile errors rather than runtime hazards an operator must remember to avoid. The dollar cap is runtime arithmetic under an estimator assumption; the affine layer makes that arithmetic non-bypassable. On single-agent workloads a 4-line Python counter matches the crate at 0/30 overshoot, so the distinguishing value is non-bypassability under operator error in multi-agent delegation: the delegation-fanout race documented in 11 incidents is rejected by the borrow checker at compile time, while the same pattern under asyncio overshoots 30/30 and three disciplined alternatives overshoot 0/30. Across five runtimes, three providers, and a temperature-stratified live-API test (N = 160), the approach reports zero cap violations and zero false refusals, at operational parity with concurrent work. Static over-reservation is 4-6x (2.11x adaptive). Binary-level cap-soundness on the running binary is left open.

翻译：LLM智能体预算超支问题是一种已记录的生产故障类型：单次重试循环可能在操作员察觉前耗费数千美元，而能够防止此类问题的进程内完整性属性（无别名引用、无双重支出、无授权后使用代价值）即使有所实现，也仅通过临时封装而非类型系统来保障。我们的核心贡献在于实证研究：基于2023-2026年间来自21个编排框架的63起经确认的生产事故，每起事故均附有GitHub问题引用及（如有报告）经济损失金额，构成了八类故障分类体系（评分者间Cohen's kappa=0.837，N=113）的编目，另含47条补充结构性条目。作为针对该分类体系的缓解方案评估，我们构建了token-budgets——一个1180行Rust代码包（无unsafe代码），通过实现仿射所有权机制，使得克隆、双重支出或在授权后继续使用预算的行为在编译期即被识别为错误，而非必须由操作员记忆回避的运行时风险。美元上限基于估算器假设进行运行时算术运算，而仿射层确保该算术逻辑不可绕过。在单智能体工作负载中，一个4行Python计数器与该代码包的表现相同（0/30超调），其独特价值在于多智能体授权场景下操作错误时的不可绕过性：在11起事故中记录的委托扇出竞争在编译期即被借用检查器拒绝，而相同架构在asyncio下的超调率为30/30，三种严格替代方案的超调率为0/30。经过五种运行时、三种服务商及温度分层实时API测试（N=160），该方法实现零上限违规与零误拒绝，运行效率与同期工作持平。静态超额预留率为4-6倍（自适应机制下为2.11倍）。运行中二进制程序的二进制级上限完备性验证仍为待解决问题。