This post is about the structural tension between agentic AI and token billing. When a tool is paid by the token, every extra turn, every re-sent context, and every hidden sub-agent call is revenue. That is not a conspiracy; it is the business model. The result is a class of anti-patterns we are calling TokenTraps: design choices that make loops longer, contexts fatter, and halting signals weaker, all while the meter runs. We will survey the commercial landscape, contrast sub-agent orchestration with agent hives, argue that the right metaphor for long-running multi-agent work is an online game world rather than a linear notebook exchange, and show how the CatGame PI Archon is already wired to halt.

1. The TokenTrap is not a bug

A TokenTrap is any feature of an AI coding or dev platform that increases token consumption without a proportional, transparent increase in user value. It is not necessarily deliberate; sometimes it is just a lazy default. But the incentives are real. Under token-based billing, the platform's revenue is a function of total tokens consumed. The agent's behavior, in turn, is shaped by the architecture the platform provides. When that architecture lacks hard halting signals, the loop keeps running and the bill keeps growing.

This is not an accusation against any single vendor. It is a structural observation. In 2026, the major coding assistants moved from flat monthly seats to token-metered pricing [The New Stack]. Cursor, for example, is reported to charge a roughly 20% markup on the underlying API cost in addition to its subscription tiers, with enterprise contracts now driving the majority of its annualized revenue [Value Add VC]. PostHog open-sourced a billing model that passes LLM cost through at 1.0x with no markup, explicitly breaking from its own earlier 20% AI margin [UsageBox]. The spread between these two approaches is the entire discussion.

2. The commercial playbook: a survey

The following patterns show up across multiple platforms, often documented as features. We are listing them not as hidden conspiracies but as visible defaults that every user should audit. Each one has a distinct TokenTrap signal: a counter, a latency spike, or a context-size growth curve that gives it away.

Thoughtworks calls this the move from 'renting software' to 'buying raw compute capacity' [Thoughtworks]. The critical point is that the old SaaS contract had a ceiling; the new token contract has a throttle with no floor. When the agent is also the one pressing the throttle, the user is no longer the customer—they are the fuel.

3. The sub-agent tax

Sub-agents are useful for isolation. They give a task its own fresh context so that a big, messy search does not pollute the orchestrator. But the cost is real. Each sub-agent call re-sends its own system prompt and instructions. Each result is appended to the orchestrator's running context. If the result is long, the orchestrator pays for it on every subsequent turn. If the result is summarized, the summarizer itself is another model call. In either case, the token budget is being spent on coordination, not on the user's actual task.

Multi-AI Agent Patterns 2026 makes the distinction cleanly: sub-agents are a context-isolation mechanism; agent teams are for genuine parallelism [The Prompt Shelf]. If your tasks are not genuinely parallel, the team is just an expensive way to keep the notebook in the cloud.

The current CatGame PI route does not use sub-agents for routine local work. The Archon is the default reasoning layer; pi glm is the explicit specialist route. The human user, through the Crypt Keeper, is the one who authorizes each escalation. This is not a detail; it is the difference between a bounded agent and a runaway one.

4. Game worlds, not notebooks

Most multi-agent systems today are modeled as a chain of HTTP requests or a shared notebook passed from agent to agent. That model works for a few sequential handoffs. It does not work for a large hive. A big, long-running swarm of agents needs the same thing a multiplayer game needs: an authoritative world state that every agent can read, a stream of events that every agent can subscribe to, and a conflict-resolution rule that keeps copies converging.

The multiplayer-game literature has been solving this for decades. Netskip combines conflict-free replicated data types (CRDTs) with skip lists to give eventual consistency without a central server [doi.org/10.1016/j.cola.2025.101370]. Colyseus distributes game objects with weakly consistent read replicas and a single-copy write path [Colyseus, Bharambe et al.]. MASS explicitly separates world dynamics from view rendering and shows that a typed, authoritative shared state can scale to 1,024 concurrent players for 10,000 recurrent steps [arXiv:2608.06257].

The implication is that we should not expect the market to self-correct. The same way a free-to-play game monetizes attention, a token-billed agent monetizes turns. The architecture that protects the user is a hard, client-side budget and a world model that lets agents observe state without re-sending the entire conversation.

5. How the PI Archon halts

CatGame's local PI runtime is built around bounded loops from the start. The pi-daemon owns the inference context. The pi_agent binary runs a client-side tool loop. The Crypt Keeper issues the capability that lets either one start. The human user is the root of trust, not the model.

The bounds are real and they are in the code. The agent loop in pi/pi_agent.cpp is a for loop over config_.agent.max_turns; the default is 16, and our shipped config/tools/pi_agent.toml sets it to 8. The loop also checks !cancel_.is_cancelled() on every iteration, so a kill signal can abort the turn immediately. The timeout_seconds in the same config caps wall-clock time at 240 seconds.

The pi loop supervisor in scripts/lib/pi/pi-loop.sh is not a recursive daemon. It is a client-side queue worker: it waits in .cache/pi/loop/tasks/, processes each Markdown task once, and moves it to .cache/pi/loop/completed/. It has an explicit --interval, a bounded --write opt-in, and a pi loop stop command. The pi monitor tool shows daemon, loop, and Crypt status in one panel, so a runaway turn is visible before it becomes expensive.

This is the opposite of an unbounded recursive Archon. The Archon is provisioned by the Crypt Keeper, managed by the human, and halted by hard counters in the runtime. It is a governed capability, not a self-perpetuating process.

6. The five TokenTrap signals

We are proposing a small, portable signal board that any agent runtime can expose. Each signal is a predicate. The loop stops when any one of them is true. The signals are cheap to compute and hard to ignore because they live outside the model's stop_reason.

The bounded agentic loop pattern [AI Architect] formalizes this as five bounds plus an out-of-band kill switch. The Typed Tool-Loop Failure Detector pattern adds per-tool caps, so a thirty-call canvas-action burst is caught before the global budget is exhausted [Agent Patterns Catalog]. These patterns are stack-agnostic; the implementation belongs in the harness, not in the prompt.

7. Caveats and honest framing

Not every token spent is a TokenTrap. Some tasks are legitimately expensive. The point is transparency and control. A user should be able to see the turn counter, the model ID, the running token total, and the cost before the bill arrives. A platform that hides those signals is not 'more agentic'; it is less accountable.

Sub-agents are not evil. They are the right tool when the problem is genuinely parallel and the cost of context pollution is higher than the cost of coordination. The mistake is using them as the default shape for every task, especially under a billing model that rewards every extra call.

The game-world metaphor is also not a universal solution. Authoritative shared state introduces its own problems: consistency models, conflict resolution, permissions, and the cold-start problem of bootstrapping the world. But for large hives and long-running tasks, it is a better starting point than a chain of HTTP POSTs.

Finally, the references below are a snapshot of the 2026 landscape. Vendor pricing and features change. The structural observation—per-token profit creates an incentive for unbounded loops—does not.

8. References and cross-links

External sources
Hou, Wang, Zhao & Wang, When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents, arXiv:2607.01641, 2026. https://arxiv.org/abs/2607.01641
Sayed Ali et al., The Harness Effect: How Orchestration Design Sets the Token Economics of Enterprise Agentic AI, arXiv:2607.06906, 2026. https://arxiv.org/abs/2607.06906
Cai et al., MASS: Multiplayer World Models with Authoritative Shared State, arXiv:2608.06257, 2026. https://arxiv.org/abs/2608.06257
Paredes et al., Netskip: A novel architecture for consistent multiplayer videogame state, Journal of Computer Languages, 2025. https://doi.org/10.1016/j.cola.2025.101370
Bharambe, Pang & Seshan, Colyseus: A distributed architecture for online multiplayer games, NSDI 2006. https://www.usenix.org/conference/nsdi-06/colyseus-distributed-architecture-online-multiplayer-games
Anthropic, Building Multi-Agent Systems: When and How to Use Them. https://claude.com/blog/building-multi-agent-systems-when-and-how-to-use-them
MindStudio, Claude Code Agent Teams vs Sub-Agents. https://www.mindstudio.ai/blog/claude-code-agent-teams-vs-sub-agents
The Prompt Shelf, Multi-AI Agent Patterns: Sub-agents vs Agent Teams. https://thepromptshelf.dev/blog/multi-ai-agent-patterns-2026/
AI Architect, The Bounded Agentic Loop. https://aiarch.dev/patterns/bounded-agentic-loop
Agent Patterns Catalog, Typed Tool-Loop Failure Detector. https://www.agentpatternscatalog.org/patterns/typed-tool-loop-detector/
The New Stack, Cursor cuts prices and adds enterprise spend controls amid 'tokenomics' reckoning. https://thenewstack.io/cursor-pricing-token-billing/
Thoughtworks, The Dangers of Token Usage Billing. https://www.thoughtworks.com/en-us/insights/blog/generative-ai/dangers-token-usage-billing
UsageBox, Pass-Through, Markup, or Flat: How AI Products Decide to Rebill LLM Costs. https://usagebox.com/articles/ai-rebilling-pass-through-vs-markup-vs-flat-2026
Value Add VC, How Does Cursor Make Money. https://valueaddvc.com/blog/how-does-cursor-make-money-subscriptions-token-pricing-and-the-business-model-breakdown