Sprint 2: "make every number provably trustworthy, then integrate the next feature"

Focused research for the 2-hour sprint after the ~10× cost-accuracy fix (78ed19a: streaming dedup + Opus 4.8 = $5/$25 + per-message-day bucketing → now matches CodexBar to the dollar). Thesis: earn belief in the numbers, then ship the one feature that compounds that belief. Sources: agent-reach (Twitter/X · OpenCLI) + Anthropic pricing docs + models.dev/api.json, captured 2026-07-06. Tweet engagement is live and drifts ±; treated as order-of-magnitude signal.

Headline for the coordinator:

• Top-3 SOLIDIFY (most-likely-wrong numbers): ① Sonnet 5 rate — app hardcodes $3/$15, the live rate is $2/$10 (introductory through 2026-08-31, flips to $3/$15 on 2026-09-01) → every Sonnet cost is 50% too high today. ② Cache-miss$ / cache-"savings" — the flagship $23.6k is an upper bound, not avoidable waste (it charges unavoidable first-touch cache creation as "miss above the floor"), and it derives the 0.10×/1.25× multipliers instead of reading them. ③ Model-mismatch "est. overspend vs Sonnet" — reprices every tier at Sonnet (including already-cheaper Haiku legs), assumes equal token counts, and inherits ①'s wrong rate.
• models.dev verdict: Yes — adopt models.dev/api.json as the live source, but (a) bundle a verified snapshot as offline fallback, (b) stamp every cost "rates as of <date> · models.dev", (c) hardcode the one known dated transition (Sonnet 5 → $3/$15 on 2026-09-01) as an override, and (d) read each model's explicit cost.cache_read / cost.cache_write instead of deriving them. It already carries the values the app got wrong, and it's literally the catalog CodexBar caches.
• Highest-value next feature: Cost Provenance & Reconcile — the "Show the math" drawer. Every hero number expands to its inputs (model id · catalog rate · dated source · token split · the dedup applied · the arithmetic) plus a one-click reconcile to CodexBar/ccusage to the dollar. It scores highest on the given rubric (real pain × buildable-from-local × trust it adds), rides the W2 models.dev work, and is the moat: every incumbent shows a total; we show the total and prove it. Brain & Tool Ledger (W3) is the strongest net-new capability — do it right after, once every number can defend itself.

1. Which numbers power users want to TRUST and ACT on

The market splits cleanly: people can already see totals; what they lack is a total they can believe and a cause they can act on. Ranked by how load-bearing the number is for a decision:

1. Session / task cost, and "what did this run cost me." The canonical pain is the "$20 hey" — a "hey" that dragged 847,000 tokens of re-sent context and cost dinner-for-two. @mardehaym · ~375♥ · 154k views · <x.com/i/status/2073827260113506726>. The mechanic is the thing users must trust the app to price honestly: "every message resends the whole session — system prompt, tools, full chat history, all billed as input. caching discounts it, but once it expires you pay full price again." @sairahul1 · ~26♥ · <x.com/i/status/2074092347747365226>.
2. Daily / rolling burn — the number people watch against the 5-hour and weekly caps and the new credit meter. @theo, using ccusage: "10 days into my reactivated $200 sub … over $1,100 in inference … most of my usage is just auditing." ~1.6k♥ · <x.com/i/status/2064214943210324243>. He can see the total but not the waste inside it — exactly the gap.
3. Cache hit-rate — now framed as the cost lever by the most authoritative voice in the space. @brian_armstrong (Coinbase CEO) · ~6.1k♥ · 4.2M views · <x.com/i/status/2070670644577280109>: *"Cache misses are the easiest way to drive your cost up. … our cache hit rate went from 5% → 60% … The goal isn't fewer tokens used, it's fewer tokens wasted."* A trustworthy hit-rate (with an honest denominator) is directly actionable.
4. Per-model / per-task spend — because the biggest lever people get wrong is model choice. "You probably only need Fable 5 five-to-fifteen percent of the time. If you're using it for everything, that is almost 100% overkill." @rewind02 · ~25♥ · <x.com/i/status/2073139129055907930>. Mental model: Fable=what-to-build, Opus=how-to-build, Sonnet=build-it. @kunchenguid · ~92♥ · <x.com/i/status/2072825284081127684>.
5. Tokens-wasted (baggage vs work) — felt, screenshotted, but un-instrumented. "you are probably wasting 80% of your context window" @DataChaz (from RESEARCH_audit.md). This is the AUDIT pillar.

How the tools people already trust present cost — and why they're believed

• ccusage (ryoppippi, the incumbent CLI): totals per day/model from local JSONL. Trusted because (a) it reads the same files, nothing to configure; (b) pricing comes from the LiteLLM pricing file (a maintained, scheduled update pricing workflow) not hand-typed rates; (c) it deduplicates streaming by keeping the last entry per requestId — the exact class of bug this app just fixed; (d) social proof — @theo donated $500 to it (RESEARCH_audit.md §3.5). Source: <github.com/ryoppippi/ccusage>. The streaming double-count mechanic is documented in the wild: <github.com/matt1398/claude-devtools/issues/74> ("Claude Code writes multiple JSONL entries per API response during streaming, each with accumulating output_tokens … deduplicate by keeping only the last entry per requestId").
• CodexBar (steipete, menu bar): usage across many providers, totals only. Trusted because it caches a live pricing catalog (models.dev) rather than hardcoding — so it stays right as rates move. This app's north-star is "match CodexBar to the dollar," which is why adopting models.dev is the robustness move (§3).
• OpenUsage (robinebers, menu bar): shows remaining credits across Claude/Cursor/Codex/Grok. Trusted for balances; explicitly not a workflow-waste view.

What makes a usage number LOSE trust (the failure modes to engineer against)

• Streaming double-count. CC writes several assistant lines per message (same message.id
  • requestId, cumulative usage). Naïve summing inflated this app ~2.6×; it's the #1 documented overcount (issue #74 above). Fixed here (last-chunk-wins) — must stay fixed and be shown.
• Wrong / stale per-model rate. Using an older Opus's $15/$75 for Opus 4.8 ($5/$25) 3×-overcounted. The live version of this bug is Sonnet 5 (§2 ①). Even a benchmarking authority tripped on it: ArtificialAnalysis published Sonnet-5 cost-per-task using "standard $3/$15 pricing, however Anthropic [introductory $2/$10]…" @ArtificialAnlys · ~182♥ · <x.com/ArtificialAnlys/status/2072062595482456431>. If a benchmark shop hedges the rate, a dashboard that silently picks one loses trust the moment a user cross-checks their bill.
• Estimate presented as fact, with no denominator. A hero "$X wasted" that can't separate avoidable from unavoidable (first-touch cache writes, post-/compact cold reads) reads as inflated and gets dismissed. The lesson the app already encodes ("every hero number carries its denominator") is the antidote — apply it to cache-miss$ and mismatch-overspend (§2).
• Wrong time bucket. Attributing a message to the session's start-day instead of the message's day smears burn across days. Fixed here (per-message-day).
• Double-count across sources. Counting a subagent's cost both in its own row and folded into the parent, or counting the same session twice when mirrored from a second machine over Tailscale. (Secondary SOLIDIFY, below.)

2. What to SOLIDIFY — the numbers most likely to be subtly wrong

Verified the app's live rate table (Sources/MissionControlKit/Models.swift) and audit math (Sources/MissionControlKit/Audit.swift) against Anthropic's pricing page (<platform.claude.com/docs/en/docs/about-claude/pricing>) and models.dev/api.json.

① ★ Sonnet 5 rate — wrong today, and dated (HIGH confidence, concrete)

Models.swift hardcodes sonnet → ($3, $15). Anthropic's live rate is $2 / $10 ("introductory pricing … in effect through August 31, 2026, after which the standard $3/$15 takes effect"). So every Sonnet-5 session is priced ~50% too high right now, and the app will be ~33% too low if it isn't updated after Sep 1. models.dev/api.json already lists claude-sonnet-5 → input 2, output 10, cache_read 0.2, cache_write 2.5. This one rate contaminates four surfaces: session cost, cache savings, cache-miss$, and — worst — the model-mismatch "Sonnet-equivalent overspend" (③), which reprices frontier work at the Sonnet rate. Provably-correct fix: source the rate from the live catalog (§3) and hardcode the known transition (Sonnet 5 → $3/$15 on 2026-09-01) as an override so you're right even if the catalog lags. Verify against the pricing page's Sonnet-5 introductory note.

Note on the tokenizer: Opus 4.7+/Fable 5/Sonnet 5 use a newer tokenizer that emits ~30% more tokens for the same text. This affects token counts, not rates — the usage block already reports real tokens, so cost is unaffected. But the skill prompt-tax estimate (estimateTokens = chars/4, Audit.swift) under-counts by ~30% for these models; label it or bump the divisor for new-tokenizer tiers.

② ★ Cache-miss$ / cache-"savings" — the flagship, and an upper bound (HIGH — highest trust stakes)

cacheMissDollars = freshInput × 0.90 + cacheCreate × 1.15 (premium over the ~0.10× warm-read floor). Two trust risks on the number the whole AUDIT pillar rests on:

• It charges unavoidable first-touch as "miss." You must create a cache before you can hit it; the very first pass of any context is a cache write, not a miss. Summing cacheCreate × 1.15 into a "$ re-sent above the floor" headline implies an avoidability that first-touch writes don't have. The $23.6k figure is therefore an upper bound, not "money you could have saved."
• It derives the multipliers. 0.10× read and 1.25× write are correct for every current Anthropic model today (verified: read = 0.1× base, 5-min write = 1.25× base). But they're hand-coded, not read from the catalog — so they silently break if (a) a model ships different cache economics or (b) a 1-hour cache write (2× base) ever appears in the logs (CC uses 5-min today).

Provably-correct fix: (1) read each model's explicit cost.cache_read / cost.cache_write from models.dev (§3); (2) split the headline into "first-touch (unavoidable)" vs "re-sent after expiry / churn (the leak)" and always pin it to the cacheHitRate denominator — name the leak, never claim it was all avoidable. (Anthropic confirms the mechanic the number models: caching valid 5 min, then you pay full input again — <platform.claude.com/docs/en/docs/about-claude/pricing> §Prompt caching.)

③ ★ Model-mismatch "estimated overspend vs Sonnet" — the most assumption-laden dollar figure

mismatchCandidates computes overspend = s.cost − Σ perTier.cost(.sonnet) for frontier sessions with few edits/msgs. Three compounding softnesses:

• It reprices every tier's tokens at Sonnet, including legs already run on Haiku — which is cheaper than Sonnet — so repricing a Haiku leg "at Sonnet" raises its cost and distorts the delta. Only the fable/opus legs should be repriced.
• It assumes identical token counts on Sonnet; a weaker model often needs more tokens/retries, so a naive equal-count reprice overstates the saving (the very point @kunchenguid/@rewind02 make).
• It inherits ①'s wrong Sonnet rate → the whole ≈$181 is off until ① is fixed. It's correctly labeled "heuristic / est." (good), but as a dollars-attributed finding it's the one most likely to be challenged. Provably-correct fix: reprice only frontier legs, keep the "est." label with the assumption shown inline, and recompute after ①.

Secondary SOLIDIFY targets (verify, lower blast radius)

• Per-project rollups — subagent & cross-machine double-count. Subagents are separate .jsonl files; decide once whether their cost is attributed to the parent project, and never both count the subagent row and re-sum it into the parent. Over Tailscale, the same session mirrored from devcube must be de-duplicated by session id + machine so fleet totals don't double. (Audit.swift already guards several places with !s.isSubagent — audit the spend/rollup paths for the same care.)
• "Active now" / attention classification. BLOCKED (dangling tool_use >30s) vs RUNNING/IDLE hinges on wall-clock deltas and file freshness; a stale clock or a mirrored-file mtime can misclassify. Rule to make it provable: never say "active" without a real recent disk event, and show the actual age next to the state so the classification is auditable.
• Fast-mode & inference-geo blind spots. Opus 4.8 fast mode = $10/$50 (2× standard) but logs as plain claude-opus-4-8; US data-residency = 1.1× all categories. Both are invisible in the JSONL, so the app under-prices them — identically to CodexBar, so parity holds. Document it; don't chase it this sprint.

3. Web-sourced pricing — verdict on models.dev

Verdict: adopt [models.dev/api.json](https://models.dev/api.json`) as the live pricing source. It is the right robustness move over hardcoded rates — with four guardrails. Rationale, all verified 2026-07-06:

Why it's right

• It already carries the values the app got wrong or hand-typed. Cross-checked catalog vs Anthropic's own page vs the app:

  Model (id)	Anthropic docs (in/out · cache-w · cache-r)	models.dev api.json	App Models.swift	Verdict
  claude-opus-4-8	5 / 25 · 6.25 · 0.50	5 / 25 · 6.25 · 0.5	5 / 25 (0.10×/1.25×)	✓ match
  claude-sonnet-5	2 / 10 · 2.50 · 0.20 (→ 3/15 on 2026-09-01)	2 / 10 · 2.5 · 0.2	3 / 15	✗ app 50% high
  claude-haiku-4-5	1 / 5 · 1.25 · 0.10	1 / 5 · 1.25 · 0.1	1 / 5	✓ match
  claude-fable-5	10 / 50 · 12.50 · 1.00	10 / 50 · 12.5 · 1	10 / 50	✓ match

  Adopting the catalog auto-fixes ① and replaces the derived cache multipliers with the model's explicit cost.cache_read/cost.cache_write (fixes ②'s fragility).

• Keyed by exact model id (claude-opus-4-8) — exactly what Claude Code writes to message.model → direct lookup. Keep the existing ModelTier(raw:) substring matcher as the fallback for unknown/ brand-new ids.

• It's the same catalog CodexBar caches → tracking it is how you stay matched to CodexBar as rates move (Sonnet 5's Sep-1 flip is the first live test).

• Fields available per model: cost.{input,output,cache_read,cache_write,reasoning,…}, limit.{context,input,output}, release_date, last_updated, open_weights. TOML-in-repo, PR-updated, schema-validated (<github.com/sst/models.dev>). Also models.dev/catalog.json.

Gotchas (the four guardrails)

1. No dated / historical pricing. api.json is a single current snapshot + a per-model last_updated; it cannot retroactively price a July transcript at July rates once rates change, and it won't auto-flip Sonnet 5 to $3/$15 on Sep 1 unless they update promptly. Mitigation: cache the fetch with a date, render "rates as of <date> · models.dev", and hardcode the one known transition as an override. (This matches CodexBar's price-at-now behavior — acceptable and honest as long as it's stamped.)
2. Offline / first-run. Never block a cost render on a network fetch. Bundle a verified snapshot (the table above) as the fallback and refresh in the background. Never write ~/.claude.
3. Flat pricing is correct for current long context — don't add tier logic. Anthropic confirms Fable 5 / Opus 4.6-4.8 / Sonnet 5 bill the full 1M window at the standard per-token rate ("a 900k-token request is billed at the same per-token rate as a 9k-token request"). So the earlier worry about a >200K premium does not apply to the current lineup — models.dev's flat number is right. (Only a legacy model with a >200K tier, e.g. Sonnet 4.5, would need care; low risk for a live CC corpus.)
4. Fast-mode / inference-geo / new models not captured. The catalog lists standard rates; it won't know a session ran Opus fast ($10/$50) or US-residency (1.1×) — both invisible in the JSONL anyway, so you under-price identically to CodexBar (parity preserved; document it). For a model id newer than the cached catalog, fall back to the tier matcher + bundled default and flag "rate est."

Net: models.dev converts "hardcoded and already wrong ($3/$15 Sonnet)" into "live and correct," future-proofs the cache economics, and keeps the CodexBar tie. Adopt it with the snapshot fallback, dated stamp, and the Sep-1 override.

4. The single highest-value next feature

Ranked by the given rubric — real pain × buildable-from-local-data × trust it adds — and weighted by the sprint thesis (numbers must become provably trustworthy, not merely correct):

The pick: Cost Provenance & Reconcile — the "Show the math" drawer. Every hero number (session cost, daily burn, cache-miss$, mismatch-overspend) expands to its full derivation: the model id(s) used · the exact rate and "rates as of <date> · models.dev" · the token split (fresh / cache-create / cache-read / output) · the dedup that was applied (N raw streaming lines → M billed messages) · the arithmetic. Capped by a one-click reconcile: show Mission Control's today-total beside CodexBar / ccusage and assert they agree to the dollar (green when |Δ| < $0.01).

Why it's the highest-value integration this sprint:

• It cashes the thesis into something visible. "We fixed the 10× bug" is invisible; a drawer that proves each number, reconciled to the tool the user already trusts, is the durable trust guarantee.
• It's the positioning wedge. Every incumbent shows a total; ccusage/CodexBar/OpenUsage stop there. Mission Control already attributes waste to a cause — provenance makes the whole chain auditable, which is the "unlike a usage counter, it has an opinion — and shows its work" story.
• It rides the W2 work. models.dev-sourced dated rates are the pricing input; the drawer is the natural place the "rates as of <date>" stamp and the Sonnet-5 override surface. W2 and this feature are one motion.
• It back-stops ①–③. A visible per-number breakdown is how a wrong Sonnet rate or an inflated cache-miss headline gets caught next time — the feature and the solidification reinforce each other.

Do immediately after: the Brain & Tool Ledger (W3) — the strongest net-new capability (promote the gbrain/openclaw/lavish/browser-harness probes into per-session activity rows). It adds delight and reach, but ~no trust; it belongs after every number can defend itself, not before.

Appendix — citations

Power-user signal (X / agent-reach, ~likes at capture 2026-07-06):

• @mardehaym · ~375♥ · 154k views — the "$20 hey", 847k tokens on one message · <x.com/i/status/2073827260113506726>
• @brian_armstrong · ~6.1k♥ · 4.2M views — "cache misses are the easiest way to drive cost up"; hit-rate 5%→60%; "fewer tokens wasted" · <x.com/i/status/2070670644577280109>
• @theo · ~1.6k♥ — ccusage shows $1,100/10d; donated $500 to ccusage (RESEARCH_audit.md §3.5) · <x.com/i/status/2064214943210324243>
• @ArtificialAnlys · ~182♥ — Sonnet 5 cost-per-task on "$3/$15 pricing, however Anthropic [introductory $2/$10]" · <x.com/ArtificialAnlys/status/2072062595482456431>
• @rewind02 · ~25♥ — "Fable 5 five-to-fifteen percent … using it for everything is almost 100% overkill" · <x.com/i/status/2073139129055907930>
• @kunchenguid · ~92♥ — Fable=what / Opus=how / Sonnet=build mental model · <x.com/i/status/2072825284081127684>
• @sairahul1 · ~26♥ — "every message resends the whole session … once cache expires you pay full price again" · <x.com/i/status/2074092347747365226>

Docs & catalogs:

• Anthropic pricing (Sonnet 5 dated $2/$10→$3/$15; long-context flat @1M; cache 1.25×/0.1×; fast mode $10/$50) · <platform.claude.com/docs/en/docs/about-claude/pricing>
• models.dev (open model catalog; api.json / catalog.json; per-model cost.* + limit.* + last_updated) · <models.dev/> · repo <github.com/sst/models.dev>
• ccusage (LiteLLM pricing file; dedup last-per-requestId) · <github.com/ryoppippi/ccusage>
• Streaming double-count mechanic in the wild · <github.com/matt1398/claude-devtools/issues/74>

Cross-checked in-repo: Sources/MissionControlKit/Models.swift (rate table + cache math), Sources/MissionControlKit/Audit.swift (cache-miss / skill-tax / doctrine / mismatch findings), docs/RESEARCH_audit.md (§3.5 tooling frontier), AGENT_STATE.md (cost fix 78ed19a).