pan-wizard 3.29.0 → 3.31.0

package/pan-wizard-core/bin/lib/cost.cjs

@@ -30,8 +30,9 @@
  *   - hit rate: cache_read / (cache_read + input - cache_write) if any cache activity
  *
  * Rate table is approximate — real pricing comes from the provider's API.
- * Rates are US dollars per million tokens, indicative as of 2026-08. Users
- * can override with `.planning/config.json` → `cost.rates`.
+ * Rates are US dollars per million tokens, verified against each provider's
+ * pricing page on the date in RATES_VERIFIED_AT (below). Users can override with
+ * `.planning/config.json` → `cost.rates`.
  */
 
 const fs = require('fs');
@@ -45,66 +46,120 @@ const TOKENS_FILE = 'tokens.jsonl';
 /**
  * Default rate table ($ per million tokens).
  * Override per-model in config.json → cost.rates.
+ *
+ * `cache_write` is the five-minute cache write. `cache_write_1h` — Anthropic rows
+ * only — is the one-hour write, 2x base input on every current Claude model
+ * (pricing table "1h cache writes", read 2026-09-26). It prices the
+ * `cache_write_1h_tokens` a ledger row carries when the transcript recorded the
+ * lifetime split; a row without it, or a rate without `cache_write_1h`, bills every
+ * write at `cache_write` (market-ideas queue M13). OpenAI and Google report no
+ * lifetime split, so their rows carry none.
  */
 const DEFAULT_RATES = {
-  // Anthropic — verified against platform pricing 2026-09-10. Opus 4.6+/Opus 5 are
-  // $5/$25 (the old $15/$75 Opus pricing ended with the 4.5 generation). Cache
-  // rates follow Anthropic's convention: read ≈ 0.1× input, write ≈ 1.25× input —
-  // EXCEPT Fable 5.1, whose cache reads bill at 0.025× input ($0.25). Fable 5.1
-  // needs its own row: without it the family-prefix fallback priced its reads at
-  // the Fable 5 rate, 4× too high on the model the `fable`/`best` aliases resolve to
-  // (model-config, read 2026-09-10: neither Fable model is any plan's default), and
-  // cached re-reads are the bulk of PAN's traffic (ADR-0044).
-  'claude-fable-5-1':   { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5 },
-  'claude-fable-5':     { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
-  // Mythos 5.1 / Mythos 5 (limited availability) — platform.claude.com/docs/en/about-claude/pricing,
-  // read 2026-09-10: $10/$50; the page's cache footnote names Fable 5.1 AND Mythos 5.1 as
-  // the two models whose cache reads bill at 0.025× input; Mythos 5 follows the 0.1× rule.
-  // Added for reality check R7: resolveRate returned null for both ids.
-  'claude-mythos-5-1':  { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5 },
-  'claude-mythos-5':    { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
-  'claude-opus-5':      { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  'claude-opus-4-8':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  'claude-opus-4-7':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  'claude-opus-4-6':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  // Opus 4.5 (dated id claude-opus-4-5-20251101) — same pricing page, read 2026-09-10:
-  // $5/$25/$0.50/$6.25. Without this row the dated id had no family prefix to land on
-  // and priced as null (R7).
-  'claude-opus-4-5':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
+  // Anthropic — platform.claude.com/docs/en/about-claude/pricing, every row read
+  // 2026-09-23. Opus 4.6+/Opus 5 are $5/$25 (the old $15/$75 Opus pricing ended with
+  // the 4.5 generation). cache_write is the 5-minute write rate (1.25× input; the
+  // 1-hour write bills 2×, which the ledger does not split yet). Cache reads follow
+  // the 0.1× convention EXCEPT on three models the page footnotes: Fable 5.1 and
+  // Mythos 5.1 at 0.025× input, Opus 5.5 at 0.05×. Each needs its own row, because
+  // the family-prefix fallback would otherwise price it at its predecessor's reads.
+  // Fable 5.1 is what the `fable`/`best` aliases resolve to (model-config: neither
+  // Fable model is any plan's default); cached re-reads are the bulk of PAN's
+  // traffic (ADR-0044).
+  'claude-fable-5-1':   { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5, cache_write_1h: 20.0 },
+  'claude-fable-5':     { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5, cache_write_1h: 20.0 },
+  // Mythos 5.1 / Mythos 5 (limited availability): $10/$50; Mythos 5.1 reads at
+  // 0.025× input like Fable 5.1, Mythos 5 follows the 0.1× rule (R7).
+  'claude-mythos-5-1':  { input: 10.0, output: 50.0, cache_read: 0.25, cache_write: 12.5, cache_write_1h: 20.0 },
+  'claude-mythos-5':    { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5, cache_write_1h: 20.0 },
+  // Opus 5.5 (claude-opus-5-5, released 2026-09-22): $4 input / $20 output, 5-minute
+  // writes $5, cache hits $0.20 — the page prices its hits at 0.05× input. Claude
+  // Code 2.1.280 made it the default model on every plan (model-config, read
+  // 2026-09-23), so PAN's inherit tier now runs on it. Without this row the family
+  // prefix priced it as Opus 5: cache reads 2.5× high, the rest a quarter high
+  // (reality check 2026-09-22, R25). The models overview lists no dated snapshot —
+  // from the 4.6 generation on, the dateless id is canonical.
+  'claude-opus-5-5':    { input: 4.0,  output: 20.0, cache_read: 0.20, cache_write: 5.0, cache_write_1h: 8.0 },
+  'claude-opus-5':      { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25, cache_write_1h: 10.0 },
+  'claude-opus-4-8':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25, cache_write_1h: 10.0 },
+  'claude-opus-4-7':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25, cache_write_1h: 10.0 },
+  'claude-opus-4-6':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25, cache_write_1h: 10.0 },
+  // Opus 4.5 (dated id claude-opus-4-5-20251101): without this row the dated id had
+  // no family prefix to land on and priced as null (R7).
+  'claude-opus-4-5':    { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25, cache_write_1h: 10.0 },
   // Sonnet 5 is $2/$10: the launch price announced as introductory through
-  // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled
-  // (pricing page, read 2026-09-10). Lesson: never write down a pre-announced
-  // price — this row carried the future rate for a month and over-billed by half.
-  'claude-sonnet-5':    { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50 },
-  'claude-sonnet-4-6':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
-  // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929) — pricing page, read 2026-09-10:
-  // $3/$15/$0.30/$3.75 (the pre-Sonnet-5 rate; Sonnet 5 is $2/$10). R7.
-  'claude-sonnet-4-5':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
-  'claude-haiku-4-5':   { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25 },
-
-  // OpenAI — verified against published pricing 2026-08. Prompt caching is a 90%
-  // input discount with no separate write charge, so cache_write bills at the
-  // plain input rate. GPT-5.6 ships in three tiers; the bare `gpt-5.6` id prices
-  // as the Sol flagship, with tier-specific keys for Terra/Luna (longest-prefix
-  // match wins in resolveRate). Luna reflects the 2026-07-30 price cut.
-  'gpt-5.6':            { input: 5.0,  output: 30.0, cache_read: 0.5,  cache_write: 5.0 },
-  'gpt-5.6-terra':      { input: 2.0,  output: 12.0, cache_read: 0.2,  cache_write: 2.0 },
-  'gpt-5.6-luna':       { input: 0.20, output: 1.20, cache_read: 0.02, cache_write: 0.20 },
+  // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled.
+  // Lesson: never write down a pre-announced price — this row carried the future
+  // rate for a month and over-billed by half.
+  'claude-sonnet-5':    { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50, cache_write_1h: 4.0 },
+  'claude-sonnet-4-6':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75, cache_write_1h: 6.0 },
+  // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929): $3/$15/$0.30/$3.75 (R7).
+  'claude-sonnet-4-5':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75, cache_write_1h: 6.0 },
+  // Haiku 4.5: API id claude-haiku-4-5-20251001, alias claude-haiku-4-5.
+  'claude-haiku-4-5':   { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25, cache_write_1h: 2.0 },
+
+  // OpenAI — developers.openai.com/api/docs/pricing, Standard tier, short context
+  // (≤272K input tokens), read 2026-09-23. On the GPT-5.6 and GPT-6 families a cache
+  // write bills at 1.25× input IN PLACE of the input rate ("writes are not an
+  // additive fee"); GPT-5.5 charges no cache write ("-"), so its write tokens bill
+  // as plain input. Until 2026-09-22 this block said "no separate write charge" for
+  // every row, which had stopped being true — Terra and Luna writes were a fifth
+  // low (R27). Longest-prefix match lets each tier key win over a shorter one.
+  // GPT-6: Astra is the flagship; Sol and Luna were released 2026-09-22. Codex's
+  // config docs use gpt-6-sol as the default model and gpt-6-luna for lower-cost
+  // subagents (learn.chatgpt.com/docs/config-file/config-basic, /agent-configuration/subagents).
+  'gpt-6-astra':        { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
+  'gpt-6-sol':          { input: 2.0,  output: 10.0, cache_read: 0.2,  cache_write: 2.5 },
+  'gpt-6-luna':         { input: 0.10, output: 0.50, cache_read: 0.01, cache_write: 0.125 },
+  // GPT-5.6. The bare `gpt-5.6` id is an alias that "routes requests to GPT-5.6 Sol"
+  // (its model page, read 2026-09-23), so it carries Sol's row — not the $5/$30 it
+  // carried before, which no page listed. Sol's price is promotional "at least
+  // through November 21, 2026": re-read it after that date.
+  'gpt-5.6':            { input: 4.0,  output: 20.0, cache_read: 0.4,  cache_write: 5.0 },
+  'gpt-5.6-sol':        { input: 4.0,  output: 20.0, cache_read: 0.4,  cache_write: 5.0 },
+  'gpt-5.6-terra':      { input: 2.0,  output: 12.0, cache_read: 0.2,  cache_write: 2.5 },
+  'gpt-5.6-luna':       { input: 0.20, output: 1.20, cache_read: 0.02, cache_write: 0.25 },
+  // Priced only in the page's separate "Cyber models" table, not in the Standard tiers.
+  'gpt-5.6-cyber':      { input: 12.5, output: 75.0, cache_read: 1.25, cache_write: 15.625 },
   'gpt-5.5':            { input: 5.0,  output: 30.0, cache_read: 0.5,  cache_write: 5.0 },
 
-  // Google Gemini — published rates (per million tokens, approximate; users can override via config.json → cost.rates).
-  // Pro tiers use the <=200K-context tier; long-context calls may be billed at ~2x. Cache rates are Google's context-cache pricing (~25% of input rate).
+  // Google Gemini — ai.google.dev/gemini-api/docs/pricing, paid tier, text input,
+  // the ≤200K-token prompt tier where the page splits by length, read 2026-09-23.
+  // cache_read is the page's "context caching" price: 0.1× input on every row, not
+  // the 0.25× this block carried until 2026-09-22 (cache reads 2.5× high, R26). The
+  // tokens that CREATE a cache bill at the standard input price (Google Cloud's
+  // context-cache overview; the Gemini API pages list only cached-token and storage
+  // charges), so cache_write = input. Cache STORAGE bills per million tokens per
+  // HOUR, which a per-token table cannot carry: PAN's Gemini totals exclude it.
+  // The 3.6/3.7/3.8 Flash prices run "through December 31, 2026" and double from
+  // January 1, 2027 (the page states both) — re-read them after that date.
+  'gemini-3.8-flash':       { input: 0.75, output: 3.75, cache_read: 0.075, cache_write: 0.75 },
+  'gemini-3.7-flash':       { input: 0.75, output: 3.75, cache_read: 0.075, cache_write: 0.75 },
+  'gemini-3.6-flash':       { input: 0.75, output: 3.75, cache_read: 0.075, cache_write: 0.75 },
+  'gemini-3.5-flash':       { input: 1.50, output: 9.00, cache_read: 0.15,  cache_write: 1.50 },
+  'gemini-3.5-flash-lite':  { input: 0.30, output: 2.50, cache_read: 0.03,  cache_write: 0.30 },
+  // Shutdown announced for 2027-05-07 (deprecations page); replacement gemini-3.5-flash-lite.
+  'gemini-3.1-flash-lite':  { input: 0.25, output: 1.50, cache_read: 0.025, cache_write: 0.25 },
+  'gemini-3-flash-preview': { input: 0.50, output: 3.00, cache_read: 0.05,  cache_write: 0.50 },
+  // The page lists 3.1 Pro only as gemini-3.1-pro-preview; the bare id keeps the
+  // preview's row so records written under it stay priced.
+  'gemini-3.1-pro':         { input: 2.00, output: 12.0, cache_read: 0.20,  cache_write: 2.00 },
+  'gemini-3.1-pro-preview': { input: 2.00, output: 12.0, cache_read: 0.20,  cache_write: 2.00 },
+  // The 2.5 family is "not deprecated", but the models page limits access to users
+  // who have used it before — new projects cannot count on it (PAN's Google routing
+  // tiers moved off it, R28). Rows kept for the ledgers that recorded it.
+  'gemini-2.5-pro':         { input: 1.25, output: 10.0, cache_read: 0.125, cache_write: 1.25 },
+  'gemini-2.5-flash':       { input: 0.30, output: 2.50, cache_read: 0.03,  cache_write: 0.30 },
+  'gemini-2.5-flash-lite':  { input: 0.10, output: 0.40, cache_read: 0.01,  cache_write: 0.10 },
   // (gemini-1.5-pro removed 2026-06: retired model; records for it fall back to tier rates.)
-  'gemini-3.1-pro':         { input: 2.00, output: 12.0, cache_read: 0.50,   cache_write: 2.00 },
-  'gemini-3.1-pro-preview': { input: 2.00, output: 12.0, cache_read: 0.50,   cache_write: 2.00 },
-  'gemini-2.5-pro':         { input: 1.25, output: 10.0, cache_read: 0.3125, cache_write: 1.25 },
-  'gemini-2.5-flash':       { input: 0.30, output: 2.50, cache_read: 0.075,  cache_write: 0.30 },
-  'gemini-2.5-flash-lite':  { input: 0.10, output: 0.40, cache_read: 0.025,  cache_write: 0.10 },
-
-  // Tier fallbacks when model id is unknown (reasoning tracks current Opus pricing)
-  'reasoning': { input: 5.0,  output: 25.0, cache_read: 0.5,  cache_write: 6.25 },
-  'mid':       { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75 },
-  'fast':      { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25 },
+
+  // Tier fallbacks when the model id is unknown: reasoning tracks the default Opus
+  // (Opus 5.5 since 2026-09-22 — the model the inherit tier runs on for most users),
+  // mid the Sonnet the `sonnet` alias resolves to on the Anthropic API (Sonnet 5),
+  // fast Haiku 4.5.
+  'reasoning': { input: 4.0,  output: 20.0, cache_read: 0.20, cache_write: 5.0, cache_write_1h: 8.0 },
+  'mid':       { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50, cache_write_1h: 4.0 },
+  'fast':      { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25, cache_write_1h: 2.0 },
 };
 
 function metricsDir(cwd) {
@@ -128,29 +183,80 @@ function familyPrefixRate(rates, model) {
 
 // ─── Claude Code `modelPricing` as a rate source (2026-09) ──────────────────
 //
-// Claude Code ≥2.1.243 lets an organisation pin contracted per-model rates in
-// MANAGED settings — `modelPricing: { "<modelId>": { inputCostPer1MTokens,
-// outputCostPer1MTokens } }` (settings-reference, read 2026-09-10) — and prices
-// its own /usage with them. Honouring the same block keeps PAN's ledger on the
-// numbers the organisation actually pays. The shape carries no cache fields, so
-// cache rates are DERIVED: the family's own multipliers when DEFAULT_RATES knows
-// the family (Fable 5.1 reads bill at 0.025× input, not 0.1×), otherwise the
-// Anthropic convention (read 0.1×, write 1.25×).
+// Claude Code ≥2.1.242 lets an organisation report spend at contracted rates
+// through a MANAGED setting, and prices its own /usage, status line and
+// telemetry with it. Honouring the same block keeps PAN's ledger on the numbers
+// the organisation actually pays. The documented shape (settings-reference
+// `modelPricing`, read raw 2026-09-26):
+//
+//   modelPricing: {
+//     multiplier: 0.85,                      // optional, > 0 and ≤ 10
+//     overrides: {                           // optional
+//       "claude-sonnet-4-6": { input, output, cacheRead, cacheWrite }  // $/1M, each 0–10000, all four required
+//     }
+//   }
+//
+// `multiplier` "scales every cost Claude Code computes, whether or not an
+// overrides row covers it" — below 1 a discount, above 1 a chargeback markup
+// (2.1.271). It is applied on top of an override row's rates, and to the list
+// price of every model no row covers. Claude Code drops a row or a multiplier it
+// cannot parse and keeps the rest; PAN does the same.
+//
+// Until 2026-09-26 PAN parsed a different shape — `{ "<modelId>":
+// { inputCostPer1MTokens, outputCostPer1MTokens } }` with cache rates derived —
+// that the documentation does not describe; a real policy file matched nothing
+// and PAN priced at list price. (Market-ideas queue M2 found it while adding the
+// multiplier.)
 
 const round6 = (n) => Number(n.toFixed(6));
 
+const MODEL_PRICING_MAX_MULTIPLIER = 10;
+const MODEL_PRICING_MAX_RATE = 10000;
+
+// resolveRate reads this off a rates map to scale its built-in fallback. A
+// symbol, so Object.keys (the family-prefix match, `models check`) never sees it.
+const BUILTIN_MULTIPLIER = Symbol('pan.builtinRateMultiplier');
+
+/** The block's multiplier when it is a valid one, otherwise null. */
+function modelPricingMultiplier(modelPricing) {
+  if (!modelPricing || typeof modelPricing !== 'object' || !('multiplier' in modelPricing)) return null;
+  const raw = modelPricing.multiplier;
+  if (raw === null || raw === '' || typeof raw === 'boolean') return null;
+  const m = Number(raw);
+  return Number.isFinite(m) && m > 0 && m <= MODEL_PRICING_MAX_MULTIPLIER ? m : null;
+}
+
+const scaleRate = (rate, m) => ({
+  input: round6(rate.input * m),
+  output: round6(rate.output * m),
+  cache_read: round6(rate.cache_read * m),
+  cache_write: round6(rate.cache_write * m),
+  ...(typeof rate.cache_write_1h === 'number' ? { cache_write_1h: round6(rate.cache_write_1h * m) } : {}),
+});
+
+/**
+ * PAN rate rows for a managed `modelPricing` block's `overrides`, with the
+ * block's multiplier applied. A row missing any of the four rates, or holding
+ * one outside 0–10000, is dropped.
+ * @param {object|null} modelPricing - `{ multiplier?, overrides? }`
+ * @returns {Object<string, {input:number, output:number, cache_read:number, cache_write:number}>}
+ */
 function ratesFromModelPricing(modelPricing) {
   const out = {};
   if (!modelPricing || typeof modelPricing !== 'object' || Array.isArray(modelPricing)) return out;
-  for (const [id, p] of Object.entries(modelPricing)) {
+  const overrides = modelPricing.overrides;
+  if (!overrides || typeof overrides !== 'object' || Array.isArray(overrides)) return out;
+  const m = modelPricingMultiplier(modelPricing) || 1;
+  const valid = (v) => v !== null && v !== '' && typeof v !== 'boolean'
+    && Number.isFinite(Number(v)) && Number(v) >= 0 && Number(v) <= MODEL_PRICING_MAX_RATE;
+  for (const [id, p] of Object.entries(overrides)) {
     if (!p || typeof p !== 'object') continue;
-    const input = Number(p.inputCostPer1MTokens);
-    const output = Number(p.outputCostPer1MTokens);
-    if (!Number.isFinite(input) || !Number.isFinite(output) || input < 0 || output < 0) continue;
-    const fam = DEFAULT_RATES[id] || familyPrefixRate(DEFAULT_RATES, id);
-    const readMult = fam && fam.input > 0 ? fam.cache_read / fam.input : 0.1;
-    const writeMult = fam && fam.input > 0 ? fam.cache_write / fam.input : 1.25;
-    out[id] = { input, output, cache_read: round6(input * readMult), cache_write: round6(input * writeMult) };
+    if (![p.input, p.output, p.cacheRead, p.cacheWrite].every(valid)) continue;
+    // "cacheWrite covers both five-minute and one-hour cache writes."
+    out[id] = scaleRate({
+      input: Number(p.input), output: Number(p.output),
+      cache_read: Number(p.cacheRead), cache_write: Number(p.cacheWrite), cache_write_1h: Number(p.cacheWrite),
+    }, m);
   }
   return out;
 }
@@ -182,25 +288,35 @@ function loadManagedModelPricing(dir = managedSettingsDir()) {
       .sort()
       .map(f => path.join(dropIns, f)));
   } catch { /* no drop-in directory */ }
+  // Later files win: a later `multiplier` replaces an earlier one, and
+  // `overrides` merge per model id.
   let merged = null;
   for (const f of files) {
     let parsed;
     try { parsed = JSON.parse(fs.readFileSync(f, 'utf8')); } catch { continue; }
     const mp = parsed && typeof parsed === 'object' ? parsed.modelPricing : null;
-    if (mp && typeof mp === 'object' && !Array.isArray(mp)) merged = { ...(merged || {}), ...mp };
+    if (!mp || typeof mp !== 'object' || Array.isArray(mp)) continue;
+    merged = merged || {};
+    if ('multiplier' in mp) merged.multiplier = mp.multiplier;
+    if (mp.overrides && typeof mp.overrides === 'object' && !Array.isArray(mp.overrides)) {
+      merged.overrides = { ...(merged.overrides || {}), ...mp.overrides };
+    }
   }
   return merged;
 }
 
 // The rate table a cost computation actually sees. Precedence, highest first:
-//   1. `.planning/config.json → cost.rates` — PAN's explicit per-project override
-//   2. managed `modelPricing` — the organisation's contracted rates
-//   3. DEFAULT_RATES — resolveRate's own fallback when neither names the model
-// Returns undefined (not {}) when nothing overrides, so callers keep the exact
-// pre-2026-09 behaviour of passing no config rates.
+//   1. `.planning/config.json → cost.rates` — PAN's explicit per-project override,
+//      used exactly as written (the managed multiplier does not touch it)
+//   2. managed `modelPricing.overrides` — contracted rates, × the multiplier
+//   3. DEFAULT_RATES — resolveRate's own fallback, × the managed multiplier
+// Returns undefined (not {}) when nothing overrides and no multiplier applies, so
+// callers keep the exact pre-2026-09 behaviour of passing no config rates.
 function effectiveRates(config, managedPricing = loadManagedModelPricing()) {
   const rates = { ...ratesFromModelPricing(managedPricing), ...(config?.cost?.rates || {}) };
-  return Object.keys(rates).length > 0 ? rates : undefined;
+  const m = modelPricingMultiplier(managedPricing);
+  if (m !== null && m !== 1) rates[BUILTIN_MULTIPLIER] = m;
+  return Object.keys(rates).length > 0 || rates[BUILTIN_MULTIPLIER] ? rates : undefined;
 }
 
 function resolveRate(model, tier, configRates) {
@@ -217,6 +333,12 @@ function resolveRate(model, tier, configRates) {
     }
     if (tier && configRates[tier]) return configRates[tier];
   }
+  const builtin = builtinRate(model, tier);
+  const m = configRates ? configRates[BUILTIN_MULTIPLIER] : undefined;
+  return builtin && m ? scaleRate(builtin, m) : builtin;
+}
+
+function builtinRate(model, tier) {
   if (model && DEFAULT_RATES[model]) return DEFAULT_RATES[model];
   if (model) {
     const fam = familyPrefixRate(DEFAULT_RATES, model);
@@ -252,8 +374,13 @@ function computeCost(rec, configRates) {
   // outright. On a realistic row (30k input / 5k output / 200k cache read / 12k
   // cache write on Opus-5 rates) it reported $0.30 against a true $0.45 — a 33%
   // understatement, always in the direction of looking cheaper.
-  const usd = (input * rate.input + output * rate.output
-    + cacheRead * rate.cache_read + cacheWrite * rate.cache_write) / 1_000_000;
+  // The one-hour share of the writes, when the row recorded the lifetime split (M13),
+  // bills at the one-hour rate; the rest — and every write on a row or rate without
+  // the split — at `cache_write`.
+  const write1h = Math.min(cacheWrite, Math.max(0, Number(rec.cache_write_1h_tokens) || 0));
+  const rate1h = typeof rate.cache_write_1h === 'number' ? rate.cache_write_1h : rate.cache_write;
+  const usd = (input * rate.input + output * rate.output + cacheRead * rate.cache_read
+    + (cacheWrite - write1h) * rate.cache_write + write1h * rate1h) / 1_000_000;
   return Math.round(usd * 10000) / 10000;
 }
 
@@ -587,12 +714,22 @@ function cmdCostClear(cwd, raw) {
 
 // ─── Rate-table staleness ───────────────────────────────────────────────────
 
-// Date DEFAULT_RATES was last verified against published provider pricing.
-// Bump this whenever the table is re-verified; `models check` flags the table
-// once it is older than RATES_STALE_AFTER_DAYS (provider prices move faster
-// than PAN releases do).
-const RATES_VERIFIED_AT = '2026-09-10';
-const RATES_STALE_AFTER_DAYS = 180;
+// Date DEFAULT_RATES was last verified against published provider pricing — ALL
+// providers' pricing pages, not only Anthropic's (the 2026-09-10 bump covered the
+// Anthropic rows alone, and the Gemini and OpenAI rows it vouched for had never
+// matched their pages: reality check 2026-09-22, RC29). Bump it only when every
+// row has been read against its page that day.
+//
+// `models check` flags the table once it is older than RATES_STALE_AFTER_DAYS.
+// That window was half a year until 2026-09-22 (R38), which is longer than the
+// interval at which the lineup now moves: the default Claude model changed on
+// every plan inside twelve days of the last verification. Sixty days is the
+// review cadence the ecosystem reviews settled on. The calendar still cannot see
+// a default-model change inside the window — that is the job of the
+// documented-default-ids fixture test (tests/fixtures/documented-default-models.json,
+// R31), which fails the suite the day a documented default id has no exact row.
+const RATES_VERIFIED_AT = '2026-09-23';
+const RATES_STALE_AFTER_DAYS = 60;
 const RATE_TIERS = ['reasoning', 'mid', 'fast'];
 
 function checkRatesStaleness(now = new Date()) {
@@ -611,7 +748,16 @@ function checkRatesStaleness(now = new Date()) {
 function cmdModelsCheck(raw) {
   // Surface the managed rates too: an organisation that pins `modelPricing`
   // should be able to see that PAN found the block, not infer it from totals.
-  const result = { ...checkRatesStaleness(), managed_model_pricing: Object.keys(loadManagedModelPricing() || {}) };
+  const managed = loadManagedModelPricing();
+  const result = {
+    ...checkRatesStaleness(),
+    managed_model_pricing: Object.keys(ratesFromModelPricing(managed)),
+    managed_pricing_multiplier: modelPricingMultiplier(managed),
+  };
+  // A multiplier PAN cannot apply is reported, not silently dropped.
+  if (managed && 'multiplier' in managed && result.managed_pricing_multiplier === null) {
+    result.managed_pricing_multiplier_ignored = managed.multiplier;
+  }
   const human = result.stale
     ? `Rate table verified ${result.rates_verified_at} (${result.age_days} days ago) — STALE: re-verify provider pricing and bump RATES_VERIFIED_AT in cost.cjs`
     : `Rate table verified ${result.rates_verified_at} (${result.age_days} days ago) — OK`;

package/pan-wizard-core/bin/lib/frontmatter.cjs

@@ -89,8 +89,11 @@ function extractFrontmatter(content) {
   const frontmatter = {};
 
   // --- Frontmatter delimiter detection ---
-  // Match the first YAML block bounded by opening "---\n" and closing "\n---"
-  const match = content.match(/^---\n([\s\S]+?)\n---/);
+  // Match the first YAML block bounded by opening "---\n" and closing "\n---".
+  // CRLF and a leading BOM are normalised first: the LF-only match found no front
+  // matter at all in a CRLF file, so every reader saw an empty object.
+  const text = String(content == null ? '' : content).replace(/^\uFEFF/, '').replace(/\r\n/g, '\n');
+  const match = text.match(/^---\n([\s\S]+?)\n---/);
   if (!match) return frontmatter;
 
   const yaml = match[1];

package/pan-wizard-core/bin/lib/memory-optimize.cjs

@@ -214,17 +214,23 @@ function quarantinePath(cwd) {
  * restore an entry by hand. The file leads with a warning so it is never loaded
  * as trusted instruction memory.
  */
+const QUARANTINE_HEADER = '# Quarantined memory (DO NOT auto-load as instructions)\n\nEntries below were pulled out of standing memory during reconcile because they read like\ndirectives aimed at the agent (possible cross-generation prompt injection). They are\nNOT trusted instructions. Review each; restore to state.md by hand only if legitimate.\n';
+
 function appendQuarantine(cwd, entries, now) {
   if (!entries.length) return;
   const p = quarantinePath(cwd);
-  const fresh = !fs.existsSync(p);
   fs.mkdirSync(path.dirname(p), { recursive: true });
+  // Create the file with its warning header atomically (`wx` fails if it exists)
+  // instead of checking existsSync first: between that check and the append a
+  // concurrent reconcile could write the header twice, or skip it (CodeQL #46,
+  // js/file-system-race).
+  try {
+    fs.writeFileSync(p, QUARANTINE_HEADER, { encoding: 'utf-8', flag: 'wx' });
+  } catch (e) {
+    if (e.code !== 'EEXIST') throw e;
+  }
   const stamp = now || '(undated)';
-  const header = fresh
-    ? '# Quarantined memory (DO NOT auto-load as instructions)\n\nEntries below were pulled out of standing memory during reconcile because they read like\ndirectives aimed at the agent (possible cross-generation prompt injection). They are\nNOT trusted instructions. Review each; restore to state.md by hand only if legitimate.\n'
-    : '';
-  const block = `${header}\n## Quarantined ${stamp}\n\n${entries.join('\n')}\n`;
-  fs.appendFileSync(p, block, 'utf-8');
+  fs.appendFileSync(p, `\n## Quarantined ${stamp}\n\n${entries.join('\n')}\n`, 'utf-8');
 }
 
 /**

package/pan-wizard-core/bin/lib/memory-rebuild.cjs

@@ -10,8 +10,8 @@
  *
  * Three derived targets:
  *   1. AGENTS.md — the universal, cross-runtime tools memory. PAN owns exactly
- *      the marker-fenced `<!-- BEGIN/END PAN WIZARD -->` section (every runtime,
- *      including Copilot/.github, reads AGENTS.md natively). User content
+ *      the marker-fenced `<!-- BEGIN/END PAN WIZARD -->` section (Codex, Copilot and
+ *      OpenCode read AGENTS.md natively; Claude via the CLAUDE.md bridge; Gemini reads GEMINI.md by default). User content
  *      outside the markers is preserved byte-for-byte.
  *   2. CLAUDE.md — the Claude bridge (`@AGENTS.md` import), regenerated only
  *      when the Claude runtime is installed here.
@@ -126,7 +126,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
   const targets = [];
   const warnings = [];
 
-  // 1. AGENTS.md — universal PAN section (all runtimes read it natively).
+  // 1. AGENTS.md — universal PAN section (Claude Code reads it through the bridge in step 2).
   {
     const p = path.join(cwd, 'AGENTS.md');
     const existing = safeReadFile(p);
@@ -149,8 +149,15 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     const p = path.join(planningPath(cwd), 'state.md');
     const existing = safeReadFile(p);
     if (existing != null) {
-      const desired = syncStateFrontmatter(existing, cwd);
-      targets.push({ file: '.planning/state.md', ...rebuildFile(p, existing, desired, apply) });
+      let desired = null;
+      try {
+        desired = syncStateFrontmatter(existing, cwd);
+      } catch (err) {
+        // A state.md PAN refuses to re-derive (stacked front matter) is reported,
+        // never rewritten on a guess.
+        targets.push({ file: '.planning/state.md', action: 'refused', reason: err.message });
+      }
+      if (desired !== null) targets.push({ file: '.planning/state.md', ...rebuildFile(p, existing, desired, apply) });
     }
   }
 

package/pan-wizard-core/bin/lib/phase-report.cjs

@@ -724,8 +724,11 @@ function cmdReport(cwd, opts = {}, raw) {
   if (action === 'all') {
     const res = renderAllToDisk(cwd, { now });
     if (!res) return error('No phases found — nothing to report.');
+    // --open was parsed for `all` and never used; open the index it wrote, on the
+    // same only-when-written rule as the single-report actions.
+    const opened = opts.open && res.index.written ? openInBrowser(res.index.path) : false;
     return output(
-      { action, reports: res.reports, index: res.index },
+      { action, reports: res.reports, index: res.index, opened },
       raw,
       `generated ${res.reports.length} phase report(s)${res.index.path ? ' + index' : ''}`,
     );