document the usage panel and what testing it would mean

it has never run: db:push has not been applied and neither process has been
restarted. docs/ai-usage-panel.md records where every number comes from and
why officer cannot derive any of them itself, the two things the live
payload settled (every model-scoped bucket is null while limits[] carries a
real fable window; the window is named by kind, never by the model name),
the measured costs, and the staleness rules — which are the part most likely
to be wrong, because they assert things about data they did not measure.

sixteen ordered tests in five groups. group C is the actual feature. test 10
is the one that would break silently: a refresh must not overwrite an
account it could not measure.

also records what the scan measurement found, since it decides the deferred
work — 74.7% of message ids appear in more than one transcript file, so
per-file aggregates cannot be summed and an incremental scan is not the
one-liner it looks like.

TODO.md gains an entry under "waiting on the owner to run it", beside plan
mode, which is also still unexercised.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TODO.md

@@ -447,6 +447,28 @@ outside the example's new README:
 
 ## Waiting on the owner to run it
 
+- [ ] **The AI usage panel has never run.** Landed 2026-08-18. Click the harness pill in the chat composer
+      and it shows Claude Code's own usage display — limits with countdowns, tokens by day and by model —
+      with one tab per Anthropic account, so a login you have switched away from still answers.
+
+      **Two things must happen before it does anything**: `bun db:push` (it adds `ai_provider_usage`) and
+      `pm2 restart officer officer-claude-code`. Neither has been run. Without the push the panel opens and
+      shows the signed-in account with no tabs, which is the designed degradation rather than a failure.
+
+      **`docs/ai-usage-panel.md` is the checklist** — sixteen ordered tests in five groups. Group C is the
+      feature: sign in as the second account and confirm the first one keeps its numbers and its countdown.
+      Test 10 is the one most likely to be wrong — a refresh must not overwrite an account it could not
+      measure, and that failure is silent.
+
+      Safe to leave untested. Everything is read-only except one fire-and-forget upsert at turn end, and the
+      pill was already an inert label before this. The one thing worth watching is `pm2 logs officer` during
+      a turn: the snapshot is `void`ed and swallows its own errors, so a persistent failure shows up only
+      there and as a row that never updates.
+
+      Shipped alongside it and also unexercised: the model dropdown no longer renders the literal string
+      `claude-code` for a chat that named no tier. That half needs `officer-claude-code` restarted, not just
+      `officer` — the parser in the sidecar is what emits it.
+
 - [ ] **Plan mode is live and has never been exercised.** Landed `1b811dfa` on 2026-08-17; all three
       processes were restarted the same evening, so the code IS running. Not one part of it has been used:
       not the toggle, not the plan card, not the round trip from the sidecar's pending promise to a browser