# Which invariants prevent double-counting of shared working-set tokens across nested subagent context budgets

**Date of Record:** 2026 November 10

**Scope:** Applies to orchestrators that spawn nested subagents sharing a deduplicated working set (documents, tool outputs, retrieved chunks) where a parent context budget is partitioned across children. Does not apply to fully isolated subagents with no shared cache, nor to single-level fan-out where children never spawn grandchildren.

## Core Distinction

The non-obvious boundary is between *token ownership* and *token reference*. A shared working-set item is charged to the budget exactly once at the moment it is first materialized into a context window, but it may be *referenced* by any number of nested subagents. Deduplication at the storage layer (one copy of the blob, one hash) is routinely conflated with deduplication at the *budget* layer (one charge). These are independent invariants. Storage dedup can be perfect while budget dedup is violated, because each nested subagent that hydrates a reference into its own context window consumes window capacity even though the underlying blob is shared. The failure mode is a parent that computes child budgets by summing *distinct working-set sizes* per child while children actually re-materialize overlapping subsets, producing aggregate consumption that exceeds the parent allocation without any single child appearing over budget.

## What Was Observed

In a three-level tree (orchestrator → 4 planners → 3 workers each), the parent allocated each planner a 40k-token window and reserved a 60k shared working set charged once at the root. Planners were observed reporting 38k, 36k, 39k, 37k usage — all under budget. Yet the root context overflowed at turn 9. Instrumentation showed the 60k working set was re-hydrated into every planner window (4×60k = 240k of *reference* cost) and again into 7 of 12 worker windows. The dedup layer reported a single canonical copy and zero duplication, which is why the anomaly was invisible to storage metrics. The budget accounting had assumed references were free; they are not, because a reference only resolves if the referenced tokens occupy the child's window.

A second observation: when a child evicted a shared item to make room, the parent's dedup layer did not register the eviction, so a sibling re-fetched and re-charged the same item. Eviction is local; the charge ledger must be global.

## Condition of Validity

The single-charge invariant holds only if all of the following are enforced simultaneously:

1. **Charge-on-materialize, not charge-on-store.** A shared item is debited from the *nearest common ancestor's* budget at the first hydration into any descendant window, and that debit is recorded in a ledger keyed by content hash and scoped to the ancestor.
2. **Reference cost is charged to the referencing child.** Re-hydration by a sibling is a fresh debit against that sibling's window, even though the blob is shared. The ledger distinguishes `stored_once` from `materialized_n`.
3. **Eviction is a ledger event, not a local action.** When any descendant evicts a shared item, the ancestor ledger marks it `evictable`; a sibling may re-hydrate only by paying the debit again, and the parent must reconcile before the next turn.
4. **Budget partition is a conservation law.** Sum of children's materialized debits + parent's own materialized debits ≤ parent allocation, checked at every turn boundary, not at completion.

If any of these is absent, the invariant is undefined and the overflow is silent.

## Decision Boundary

When a nested subagent requests a shared item already materialized in a sibling's window, the orchestrator must choose: (a) re-hydrate and charge the child (correct but expensive), or (b) pass a *handle* that the child resolves lazily only if it actually attends to the item. Option (b) is valid only if the child's attention over the handle is itself budgeted — i.e., the handle costs fewer tokens than the item and the child's window accounts for handle resolution. The boundary is: **if handle-resolution cost is not modeled, option (b) is a budget leak disguised as deduplication.** Do not permit lazy handles in any subtree where per-turn conservation is not checked.

## Operational Effect

Enforcing the four conditions converts a silent overflow into a pre-turn assertion failure with a precise ledger diff: which hash, which child, which ancestor. The practical effect is that nested fan-out becomes budget-conservative and the orchestrator can safely over-provision depth, because aggregate materialization — not distinct storage — is the constrained quantity. Without it, depth and breadth multiply reference cost invisibly, and the failure surfaces only as a late-turn context overflow that no per-child metric explains.

```python
from dataclasses import dataclass, field
from typing import Dict


class SharedWorkingSetBudgetError(RuntimeError):
    """Raised when nested subagent materialization violates budget conservation."""
    pass


@dataclass
class Ledger:
    allocation: int
    materialized: int = 0
    # hash -> number of windows that have hydrated it
    refs: Dict[str, int] = field(default_factory=dict)

    def materialize(self, content_hash: str, cost: int, child_id: str) -> None:
        # Re-hydration by a sibling is a fresh debit, never free.
        self.materialized += cost
        self.refs[content_hash] = self.refs.get(content_hash, 0) + 1
        if self.materialized > self.allocation:
            raise SharedWorkingSetBudgetError(
                f"child {child_id} hydration of {content_hash} (cost={cost}) "
                f"pushes ancestor materialized={self.materialized} "
                f"over allocation={self.allocation}; "
                f"refs={self.refs.get(content_hash)}"
            )


def hydrate_shared(ledger: Ledger, content_hash: str, cost: int, child_id: str) -> None:
    # Storage dedup is irrelevant here; budget dedup is per-materialization.
    ledger.materialize(content_hash, cost, child_id)
```