用户看到研究 Agent 生成了一份报告，后台却可能经历多轮模型调用、工具执行、某次请求重试，以及一次没有返回完整用量的中断。页面显示“请求成功”之后，系统能回答这份报告到底消耗了多少资源吗？
在实际系统里，至少存在三本容易被误认为同一本的账：Run 预算约束还能做多少工作，模型物理尝试记录真实发起的请求及可观察 Token，个人 Credits按约定规则分配与展示已知用量。这三者有关联，却不能拿其中一项填补另一项的缺口。
我们最近在 ETF Agent 中加入了一个 P0 Shadow（影子）Credits 用量视图。它观察而不拦截现有研究，目标先是把身份、未知和可复核口径做对，而不是推出支付、计费或新额度门。
一、三种数字回答不同的问题
- Run request budget：真实含义：对特定 Run 允许多少次准入及阶段消耗；容易发生的误读：把请求准入次数当成 Token。
- Physical model attempt：真实含义：一次实际发往模型的物理 dispatch，以及对应的可观察 SDK 用量；容易发生的误读：把逻辑请求或 Langfuse span 当成唯一真实发送。
- Personal Credits：真实含义：当前用户月份下，按冻结费率规则计算的已知内部用量；容易发生的误读：把内部积分当作供应商发票或真实货币。
一条逻辑模型请求可能因 SDK 重试产生多个物理尝试。一次已保存的 SDK 聚合用量也未必能唯一拆分到这些尝试。若只根据最终返回值填账，既可能漏掉失败调用，也可能把重试合并成一笔不可靠的“精确费用”。
因此，原 Run 预算仍由自己的 Resource/Recovery owner 决定，个人 Credits 只被动观察其已确认的请求/尝试身份。个人页面上出现余额数字，并不授予额外研究权；Shadow 也不会因为用量超出计划额度就拒绝本次请求。
二、先知道是谁、哪次尝试，再谈价格
一次记账要能沿可信账户、原 Run、原 request debit 和物理 dispatch receipt 找回。这里最重要的区别是：请求预留与一次实际发送，不是同一个身份。
图中关系（文字对照）：
- 已认证账户 → 原运行。
- 原运行 → 请求准入。
- 请求准入 → 实际派发。
- 实际派发 → 尝试回执。
- 尝试回执 → 用量观察。
- 用量观察 → 固定计价规则。
- 固定计价规则 → 已知额度。
- 用量观察 → 覆盖范围未知。
- 已知额度 → 个人用量视图。
- 覆盖范围未知 → 个人用量视图。
模型 Gateway 的实际物理发送回调才可以产生对应 receipt。恢复读取旧调用、查询历史或展开观测结果，不会因为“重新看到一次数据”就造一个新的物理发送。一个原请求出现多个可证实的重试，则需要多条各自具有身份的尝试记录；无法证明物理重试身份的路径，宁可保持未覆盖也不分配虚构的序号。
账户身份同样不能从浏览器传入的 userId 直接信任。实际 self-view 读取已验证 session 对应的 owner scope，拒绝外部 owner filter；断开登录、账号禁用、session 变更或其他用户请求都不能继续展示前一个人的用量。
三、已知用量和 unknown 都是结果
Shadow 账本采用有版本的内部 tariff：收到 SDK 正式报告的输入与输出 Token 后，按当时冻结规则计算 Credits。不同调用的实际供应商价格、缓存折扣、未报告的隐藏用量，都不能靠产品 UI 猜出来。
下面是合成记账示例，不是实际账单，也不代表供应商费率：
{
"period": "2026-10",
"accountScope": "current-authenticated-user",
"mode": "shadow",
"knownCredits": "4.000",
"observedAttempts": 1,
"coverage": "partial",
"unknownReasons": ["unreported-retry"],
"wouldDeny": false
}
knownCredits 只能表示已知和已归因部分；coverage=partial 告诉读者还有未覆盖路径。金额采用十进制字符串，避免浏览器浮点四舍五入扭曲用量。如果诊断存储不可用，界面应写 unavailable，而不是展示 0 费用。
最容易误算的分支有三种：网络已经尝试发送但没有完整 usage；一段 SDK 聚合 usage 跨越多个物理重试，无法安全拆账；进程崩溃发生在发送之后、被动观察落库之前。它们都不能自动记为免费，也不能因未知费用就阻止原研究交付。
四、Shadow 和强制额度是刻意不同的阶段
在这个阶段，管理员通过受控本地操作为已有、已验证用户配置月份 allowance revision；重复相同操作意图返回原版本，参数冲突拒绝。用户可在原设置区查看自己的月份、已知 Credits、Token 和未覆盖情况。它没有公开充值、订阅、后台管理或者支付入口。
已知用量超过当前配置允许值时，系统可以计算一个 wouldDeny 模拟信号，但它不会改变 Run 资源管理的预算、Provider 容量准入、原模型调用、定时 Task 的预算或正文发布的实际决定。观察数据库失败也不会变成新的研究拦截门。这种非干扰性是 Shadow 的核心用途：先观察真实接缝，而不先押注一套并未证实完整的强制限额规则。
若将来增加真正拒绝发送的 Credits 准入，就必须独立设计原子预留、未知尝试隔离、恢复对账及所有适用路由，且证明失败不会扩大影响范围。不能把现在的 wouldDeny 切换成“硬拒绝”便宣称完成了金融级计费。
五、交付物已经能关联原请求，完整归因仍是下一步
用户真正可能想知道“这一份周报花了多少”，而不只是“这个月账户用了多少”。截至 2026 年 10 月 31 日，交付成本读取已能在原发布模块确认当前已结算版本后，关联其原 Main 请求及已观察物理尝试；文件则沿原产物身份和导出回执读取。它不依赖页面临时名称，也不按时间相近猜测归属。
这推进了请求与交付物之间的关联，却没有完成独占成本分摊。同一请求可能服务多个输出，视图明确不可相加，共享费用仍未分配；完整报告成本与供应商发票继续未知。它也不证明 Child 的发现被最终报告实际采用。
已有受控读取还验证了成本观察失败时，已保存交付仍可独立读取。此处进展属于交付成本模块，不扩大个人 Shadow Credits 的验证范围，也不产生支付或硬额度能力。关联、分摊和对账的区别，见Agent 生成一份报告，到底应该怎么算成本。
当前实现与验证限制
截至 2026 年 10 月 24 日，个人月份 allowance、Shadow 物理尝试观察、自用 API 和原设置页已经进入主干。两用户的认证浏览器路径已有独立验收记录；选定的请求/网关及账号接缝也有针对性工程验证。原 Task/Scheduler 的实际 PostgreSQL 非干扰性和整项 formal close 仍未完成，不把前述通过升级为完整计费资格。
这个阶段没有付款、自动扣款、真实供应商发票，也没有完整覆盖所有模型及嵌入/语义 Memory 等路线。本文不宣称节省 Token、降低成本或提供可对账的生产账单。
我们选择先让 unknown 有自己的位置，是因为可恢复的用量事实比一个看似完整的零账单更有价值。只有区分“允许做多少”“真正发出过什么”和“能够可靠计入多少”，长期运行的 Agent 才有机会在不牺牲原交付的前提下逐步建立可信的资源视图。
延伸阅读
Run 预算与约束治理解释研究额度与收尾保护；Langfuse 观测说明物理尝试与真实追踪的区别。本文聚焦个人 Shadow 账本，不与这两篇重复解释运行阶段。
更多案例见 ETF Agent Engineering Notes。欢迎为技术文集点一个 Star。
原文与交流
阅读原文 · ETF Agent 工程文集（欢迎 Star）。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Users saw the study Agent generate a report, but the backstage may experience multi-wheel model calls, tool execution, a request for retry, and an interruption that did not return full usage. When the page shows “request success”, can the system answer how much of this report consumes?
In the actual system, there are at least three accounts that can be misconstrued as the same: how much more can Run budget constraints be done, model physics attempts to record real initiated requests and observations, Token, personal Credits allocates and displays known usages according to agreed rules. These three are linked, but one cannot fill another.
We recently added a P0 ShadowCredits volume view to ETF Agent. It observes and does not intercept existing research, and aims first to match identity, unknown and reviewable calibres, rather than introducing payment, billing or new quota doors.
I. Three figures answer different questions
- Run request Bridget: Real meaning: how many times access and phase consumption are allowed for a given Run; easy to misread: the number of requests for access is considered Token.
- Physical model attempt: the true meaning: the physical dispatch of the actual sending to the model, and the observable amount of SDK; the easy error: the only real sending of logical requests or Langfuse span.
- Personal Credits: The true meaning: the known internal usage in the current user month, calculated in accordance with the freeze rate rule; the easy read: internal points are treated as invoices to suppliers or real currency.
A logical model request may result in multiple physical attempts due to SDK Z97Z. A saved SDK aggregate may not be the only split that comes to these attempts. If the account is filled only on the basis of the final return value, there may be either a failure to call or a combination of retry into an unreliable “accuracy cost”.
As a result, the original Run budget was still determined by its own Resources/Recovery owner that the individual Credits was only passively observing his confirmed request/attempted identity. The balance figures appear on the personal page and no additional research authority is granted; Shadow will not refuse this request because it is more than planned for quota.
We'll talk about the price.
A single account is to be recovered along a credible account, Run, former reQuest debit, and physical despatch. The most important difference here is that the request is reserved for one actual dispatch, not the same identity.
Relationships in figures (text contrasts):
- A certified account is running.
- The original run-in requests access.
- Request access to actual dispatch.
- Practically send a bang to try to come back.
- Try to back up the Quantum Watch.
- To observe the fixed price rule.
- Fixed pricing rules known to quota.
- I don't know how much to observe.
- Known quota → personal volume view.
- The coverage is unknown in the personal volume view.
The physical physical sendback of the model Gateway produces the corresponding receipt. Retrieving old calls, searching for history or conducting observations does not create a new physical dispatch by “revising data once again”. One original request contained multiple verifiable retrys, which required several separate records of attempts to identify each other; it was not possible to prove the physical retry identity path, preferring to keep uncovered and undistributed serial numbers.
The account identity can also not be passed into direct trust of userId from the browser. The actual self-view reads the validated session's owner scope, rejecting the external owner flyer; disconnects login, disables account numbers, releases or other user requests cannot continue to display the use of the former person.
III. Known uses and unknown are the result
The Shadow account book is based on a version of internal triff: Credits is calculated according to the then freeze rules after receiving input and output from SDK official reports. The prices of the different actual suppliers, the cache discount, and the unreported amounts of hidden use cannot be guessed by the product UI.
The following is an example of a composite bookkeeping, which is not an actual bill and does not represent a vendor rate:
{
"period": "2026-10",
"accountScope": "current-authenticated-user",
"mode": "shadow",
"knownCredits": "4.000",
"observedAttempts": 1,
"coverage": "partial",
"unknownReasons": ["unreported-retry"],
"wouldDeny": false
}
KnownCredits can only indicate the known and attributed part; coverage=partial tells readers that there are uncovered paths. The amount is used as a decimal string to avoid a distortion of the browser float. If the diagnostic storage is not available, the interface should be unviilable, not displaying 0 costs.
Three of the most easily miscalculated branches are: a network that has tried to send but is not complete usage; a section of SDK aggregating usage that crosses multiple physics retrys and cannot be safely closed; and a process collapse that occurs after delivery before passive observation goes down. Neither can they automatically be recorded as free of charge nor prevent the delivery of the original research because of unknown costs.
IV. Shadow and Forced quota are different stages.
At this stage, the administrator uses a controlled local operation for the existing and validated user configuration month; repeats the same operation with intent to return to the original version, and conflicts of parameters are rejected. Users can view their month, known Credits, Token and uncovered in the original settings. It does not disclose top up, subscriptions, back-office management or payment entrances.
When the amount is known to exceed the current configuration allowance, the system can calculate a wouldDeny simulation signal, but it will not change the budget for Run resource management, Provider capacity access, the original model call, the timing budget for Task, or the actual decision for text publish. Neither will the failure to observe the database become a new research interdiction door. This non-interference is the core use of Shadow: to observe the real seams without betting on a set of rules on mandatory limits that do not prove to be complete.
If Credits' real denial of access is to be increased in the future, it will be necessary to design the atomic reservation independently, the unknown attempt to isolate, restore the reconciliation and all applicable routes and prove that failure will not widen the reach. I can't replace the current one with a “hard refusal” to claim that I have completed a financial grade.
V. The delivery is linked to the original request and the full attribution remains next step
Users may really want to know “how much this weekly paper has cost” rather than “how much this month's account has spent”. As of October 31, 2026, the cost of delivery reading can be linked to the original Main request and observed physical attempt after the original publish module has confirmed the current settled version; the document is read with the original identity and export backhand. It does not rely on a temporary page name and does not guess attribution by proximity of time.
This advances the link between the request and the delivery, but does not achieve sole cost sharing. The same request may serve multiple outputs, the view is clear and incomparable, and the cost of sharing remains undistributed; full reporting costs and vendor invoices continue to be unknown. Nor does it prove that Child ' s discovery was actually used in the final report.
Controlled reading also validates cost observations when the saved delivery can still be read independently. Progress here is part of the delivery cost module, which does not extend the certification of individual Shadow Credits, nor does it generate payment or hard quota capability. For the difference between association, apportionment and reconciliation, see Agent producing a report and how the costs should be calculated.
Current realization and authentication limits
As of October 24, 2026, personal months allowance, Shadow physical attempt observation, self-used API and original settings pages had entered the backbone. The authentication browser path for both users is independently acceptance check; the selected request/link and account stitches are also validated for targeted engineering. The actual PostgreSQL of former Task/Scheduler has not been completed, nor has it been upgraded to full costing eligibility.
At this stage, there was no payment, automatic withholding, genuine supplier invoices, nor was there complete coverage of all models and embedding/sonymizing routes. This paper does not claim to have saved Token, reduced costs or provided bills of production that could be paid.
We chose to give unknown its place first, because the amount that can be restored is more valuable than a zero bill that looks complete. Only by distinguishing between what is allowed to be done, what is really sent out, and what can be reliably accounted for, will Agent, who is operating on a long-term basis, have the opportunity to build up a credible view of resources without sacrificing the original delivery.
Extended reading
Run Budget & Constraint Governance Interpretation Study quota and End-of-Term Protection; Langfuse observations illustrate the difference between physical attempts and true tracking. This document focuses on individual Shadow books and does not repeat the operational phase with these two articles.
For more examples see ETF Age Engineering Notes. Welcome to the collection of technical papers, Star.
Original language and communication
Read the original ETF Agent Engineering Collection (welcome Star).
Auto-fetched and translated by AI Atlas. All rights belong to the original author.