The audit met the real world, and the real world corrected the cost model
The audit workflow's first production run — a 40-page production wiki, 5 pages audited — validated the design in the wild: due-list selection (parse log.md → never-audited first → tie-break), covers-overlap clustering, the negative-space rule, the invariant sweep, the SHA-vs-line-drift discipline, and the strict journal grammar all executed correctly; 11 stale citations fixed, clean one-commit consent.
It also processed ~15× the modeled tokens (~100K/page, not ~5.1K). Root cause: the §7 cost model was calibrated on this repo's small covered files, but real audit cost is dominated by covered-file bytes, not page count — the production project's pages cover 2,000-line C# files; one covers 23 files.
Corrected model:
session tokens ≈ (Σ covered-file bytes read) / 4 × R(R ≈ 2–4)
where the bytes/4 floor is model-independent (all Claude models share the tokenizer) and the multiplier R is model-dependent (reasoning/thinking output + per-turn cache re-serve) — so a cheaper model that lowers R by skipping the negative-space enumeration buys a cheaper, less-sound audit.
Shipped: a byte-aware planning rule in references/audit.md Phase 0 (budget by covered bytes; lower K for heavy clusters — K is a cost dial, not a fixed 5); a dated §7 field correction in RESEARCH-AUDIT.md; a dated Correction on ADR-010. A cross-model × repo-size consumption benchmark (to decompose the floor from the multiplier) is recorded as a deferred roadmap item.
Docs/procedure only — no tooling change. The journal-clock design is unaffected; only the planning numbers move.