A multi-provider platform lives or dies by its catalog. If the price shown is stale or a retired model is still offered, every promise about transparency collapses. Three rules keep ours honest.

1. Prices are never edited in place

When a provider changes a price, we do not overwrite the old number. The old pricing row is closed with an end date and a new row starts — so every past billing record still points to the price that was true when the call ran. Your ledger from March still reconciles in July.

2. Retirements are enforced, not remembered

Providers announce model retirements; platforms forget them. ToRun records the retirement date the day it is announced, verified against the provider's official page. When the date arrives, routing stops offering the model — and anything you built on it has already suggested a successor.

3. Every capability claim is tested

"Supports vision" in a catalog is a claim; a routed request is proof. Capability rows are seeded from provider documentation and then exercised — a model that cannot actually deliver a capability gets the flag removed rather than a footnote added.

Why this is engineering, not paperwork

All three rules run as code paths, not wiki pages: pricing rows are time-bound records, retirement dates gate routing, capability flags drive model selection. Honesty that depends on someone remembering is not honesty — it is luck.