The claude-code backend read only `usage.input_tokens`, ignoring
`cache_creation_input_tokens` and `cache_read_input_tokens`. Measured on a
real call: 451 reported vs 34,585 actually consumed.

That number is not cosmetic. server.ts feeds it straight into
`gate.recordCompletion()`, so every per-origin tokens/day budget was
enforcing ~77x more than the consent card promised — and every wrapp surface
showing "tokens spent" understated by two orders of magnitude.

Cached input is still input: it is context the model processed and the
account was billed for. The OpenAI-shaped backends were already correct
(`prompt_tokens` is a total).

Paired with the correction, the default budget goes 200K -> 2M/day. One
decision-sized call measures ~26K tokens, so the old default was ~7 calls a
day; a wrapp that cold-opens would have burned a third of it before the user
typed anything. The gate is meant to stop runaway origins, not ordinary use.

Co-Authored-By: Claude <noreply@anthropic.com>

Pricing. The Autopilot page promised "Free, and there is no second tier"
while TOKENS.md documents a Pro subscription paying developers 75%. Rewritten
to the line CLOUD.md already states: your infra is free, our cloud is Pro —
we charge for infrastructure we run, never for AI access. Team Mode over your
own LAN or a self-hosted relay stays free; the hosted relay and encrypted
backup are Pro.

That rule then contradicted the catalogue, where 12 wrapps advertised a
different Pro made of power-user batch features ("batch shot lists",
"publish to a domain", "whole-site crawls") that cost us nothing to run and
which the stated principle makes free. All 13 pro lists are now the same
shape: a shared board plus encrypted backup.

Honesty. The hero mock showed three staged moves the product cannot generate
(outreach to 32 outfitters, calling a co-packer). movesFor() emits exactly
three shapes; the mock now uses them. Fabricating capability on a page whose
pitch is "revenue would need a connected store, so it says not connected"
undercuts the only thing being sold.

Redline pass (its real audit, run on the page): deduplicated the hero /
feature-01 / free-bullet triple, replaced the unbacked "Your data stays
yours" chip with two claims that are backed, and cut "Free core, forever"
from 4 uses to 1. Redline's "glossary card in a pricing slot" finding is
resolved by the slot now holding an actual plan.

Co-Authored-By: Claude <noreply@anthropic.com>

The harness only ever said yes. grant() approved everything asked for, health
was always green, and every tool call succeeded — so the entire class of "the
user declined" or "the daemon is down" was untested across the catalogue,
despite the wrapp skill explicitly warning that a wrapp must "read the
returned grant and handle partial approval".

Adds ?refuse=<mode>, opt-in per run so the default sweep is byte-identical:
  partial   only the first tool and first model survive the consent card
  tools     every tool unticked, models still granted
  connect   the user closes the card
  asleep    daemon installed but unreachable — fails at the TRANSPORT, not
            just in the health probe (flipping health alone let wrapps sail
            straight past it; Autopilot drafted a full slate against a daemon
            reporting "not running", which tested nothing)
  toolcall  full grant, but every tool INVOCATION fails at run time

Swept all 34 wrapps under `asleep`: 34/34 degrade cleanly — zero errors, no
hangs, every one falls back to a sensible pre-connect state. No bug found,
which is the point of running it.

Recorded while doing this: `partial` and `tools` cannot yet find anything,
because the harness's baseline grant is built from an EMPTY scope
(`GRANT = grant({})`) and the returning-user path never calls connect. So
every wrapp already runs with zero granted tools and the full default model
list, and the mock's stream ignores grants entirely. Making partial-approval
testable means seeding the grant from each wrapp's declared scope first —
a bigger change than a flag, and the real blocker.

Co-Authored-By: Claude <noreply@anthropic.com>

Cheap 80% of "seed real grants in the harness", which was the expensive fix I
reached for first. The harness cannot see a scope mistake at all: its grant is
fabricated from an empty scope and the responder ignores grants entirely. Rather
than re-architect that, read each wrapp's own source and compare what it CALLS
against what it DECLARES.

Catches the two documented gotchas: a tool used but not granted (Higgsfield's
whole-connector wildcard, WebSearch, WebFetch), and a model called that the scope
does not list (grants are exact-match).

Deliberately conservative. genImage() defined-but-never-called is template
plumbing, not a finding — several wrapps carry the helper unused, and counting
those would have produced a false positive on arcade, which is exactly what a
cruder grep did before this was written.

Result on the current catalogue: 42 sources, zero findings — every wrapp already
declares what it calls. Verified non-vacuous by injecting both failure kinds into
autopilot and confirming both fire.

This is a "you will be denied in production" check, never a security claim: the
gate is default-deny and enforced daemon-side, so these already fail loudly on a
developer's first real run. The lint just moves discovery to build time.

Not chained into `npm run build` on purpose — a lint that can abort a 36-entry
esbuild run is how builds get bypassed. Run it with `npm run lint:scope`.

Co-Authored-By: Claude <noreply@anthropic.com>