A saving is not one count minus another.

A saving is shown by a record, and a record is only as strong as what its writer could know first-hand. This paper proposes a shape that keeps the attested fields apart from the received ones, and names the two traps in the cost half: the unit, and the cumulative stream.

A shape for a record, organised by what its writer was in a position to know.

// one delegated step, split by what the writer could know first-hand

attested   time · tenant · key.id      // it authenticated the caller
           model.requested           // this side chose and sent this string
           route.chosen              the switch decided it
           policy.id · policy.ver
           rule.or.score · version   // named and versioned, not the value alone
           refused · reason          no upstream saw this call at all
           endpoint.dialled          // which host, not where inference ran
           bytes.sent · bytes.back

received   model.returned            the upstream's account of itself
           usage.* + counted_by      upstream's counter, upstream's unit
           thinking.signature        verifiable by its issuer, opaque here

// what no field in this record establishes
"the model that answered"   // not a field this side is in a position to attest
what the call was billed    // the count is the upstream's, in the upstream's unit
a total from summed deltas  // the deltas are cumulative: the sum overstates

// the two model fields are never one field: their disagreement is the
// only substitution signal this record carries on its own

Collapsing the two names destroys the one disagreement such a record can surface by itself; kept apart, a substitution shows as two strings that differ, and two that agree still record only what the upstream said.

Then the cost half, where two traps sit. The first is the unit: counts on either side of a provider boundary come from different tokenizers under different rules about what is billable, so subtracting one from the other produces a number with no referent. This record has published a counting error of its own and printed the correction beside it: in Paper 001 of The Text Layer a published ratio had been computed with another vendor's tokenizer standing in for the vendor's own counter on both sides of it, alongside a per-page constant that counted the document's words twice.^[1] Naming the party that counted each figure does not make either checkable; it stops the two being added.

The second trap is in the stream. Anthropic's streaming documentation warns that "the token counts shown in the usage field of the message_delta event are cumulative".^[2] A switch that adds up what goes past records a running sum of running sums, so an operator proving a saving that way overstates the very spend the routing was meant to reduce.