All of it. Every model, every surface, all the way back.

Four states, not two. Exact where the surface exposes an authoritative token counter an extractor can read. Estimated where no counter exists but enough content survives to reconstruct one. Dates only where activity is evidenced but nothing supports a token figure, so the surface records a bound and never a row. Unrecoverable where nothing survives that any client can read, which is recorded as absence rather than as a zero. The full register, surface by surface, with the basis for each classification, is in SURFACES.md. It puts the burden of proof where the evidence is: an exact token figure from a consumer subscription is the claim requiring evidence, not the default.

Provider-side web search and research steps, which run inside the provider's infrastructure and return a per-call marker rather than a count. Image and video services billed per generated asset, which have no token accounting unit at all. Chat products that expose no counter at any layer a client can read. Local inference not routed through a capture. And anything a retention policy or a reinstall already deleted. These are structural, not gaps waiting on an extractor, and SURFACES.md marks them as such.

One capture, for local inference through Ollama, plus documented dedupe conventions for several more. Beyond that the register grades every row by how strong the evidence behind it is. Reported means somebody read what a vendor publishes and nobody here has confirmed it against the product, so those rows carry a date; vendor reporting changes without announcing itself. Recognized is weaker still: the dashboard has a label and the repository asserts nothing. Promoting a row takes a verified dependency closure against the store it reads and a test proving an absent source reads as unavailable rather than as a measured zero. What is planned, and what has been ruled out permanently, is in ROADMAP.md.

No shipped command uploads anything. There is no backend and no cloud sync; receipts and the dataset live on your disk. Extractors read provider logs and usage APIs read-only and idempotently. Prompt and response text never enters the record at any point, because the schema has no field for it: extractors read counters, identifiers, and timestamps. Publishing any part of your record is a separate decision you make deliberately.

As far as the evidence survives, which is different for every surface and is not a setting. The record grows backwards as extractors recover history, and a request already counted is never counted twice. A day with nothing recovered stays absent rather than becoming a zero, so a sparse early history reads as a sparse early history rather than as a quiet period.

First, to be unambiguous: these are language model tokens, the units a model consumes reading and writing, not cryptocurrency tokens and not anything with a supply or a market. Nothing here is denominated in a currency of any kind. As for why not dollars: because the conversion is where the lying starts. Prices change, differ per tier, and go stale silently, so a dollar figure attached to a two-year-old row is a guess wearing a number's clothes. Tokens are what the provider counted at the time. There is no unit conversion to a currency anywhere in the schema or the code, by construction rather than as a display flag you could turn back on.

Yes, and it is deliberately not the default. The tool ships as a local unpublished record; publishing takes an explicit public-mode decision that says what is being published and at what resolution. Sam Rogers' AI usage is a real record published that way, and the demo on this site is synthetic data rendered by the same build.

Establish which of the four states the surface can reach, write the extractor read-only and idempotent, key its receipts so the reconciliation rules apply, and prove that an unreadable source is classified rather than swallowed. The steps are in SURFACES.md, the receipt schema in DATA_CONTRACT.md, and the contribution bar in CONTRIBUTING.md.