PR #16922 final-head proof
Head: 3754b62c6c89735e3a0bfd80d87f985c68719774
Base: 1451e7cb23034d29774338608368a15d8845df36
Environment: headless Linux, Node 24.21.0.

Production UsageService + ProviderHostLive + real local filesystem.
Disposable provider homes only, asserted every persisted cache path is inside the probe home.
Synthetic native Claude transcript and deterministic HTTP model-rate fixture.
No real account rates or full app/client verification.

Fixture: 1,000,000 cache writes, of which 750,000 have 1h TTL.
5m fixture rate: $5/million. 1h fixture rate: $8/million.
Before (main arithmetic): $5.00.
After (production service): $7.25.
After transcript deletion + service recreation: $7.25, identical summary buckets.
V6 stored row: rateModelIndex remains column 11; 1h subset column 12 = 750000.
Probe exit 0: LIVE_USAGE_PROBE_PASS.

Focused verification:
117 tests passed across 8 suites; server and provider-core typechecks passed.
Targeted formatting passed. Lint passed with one existing unused layerTest warning.
Five exact-main negative controls failed on the missing behavior, then passed after restoration:
- mixed TTL/category pricing and reported total handling
- separate faster-tier rates
- migration reparses matching-size/mtime v5 Claude input
- cache roundtrip retains 1h subset alongside rateModel
- large projected transcript retains the subset
Literal v5 migration test also retains deleted history, leaves v5 bytes unchanged,
and proves persisted v6 survives deleting the remaining transcript and restarting.

Limits:
Custom cache-write overrides deliberately apply equally to both TTLs.
Deleted legacy transcripts cannot recover a TTL split never stored by v5.
No macOS, Windows, Electron desktop, iOS or Android runtime verification.