XERJ audited its own Rust engine and found a real unauthenticated process-abort DoS — reached for 10,533 tokens instead of the 1.8M it takes to read the source once. WordPress core — ~619k lines — was security-audited for ~26,000 tokens. Those two are measured on real code; the other two are functional proofs on small synthetic corpora — they show the shape works, not how fast. Every number traces to a walkthrough in the repo.
XERJ indexed its own engine — 197 files, ~201k lines — as a queryable AST and call graph, then found an unauthenticated POST /_sql stack-overflow that aborts the process. A call-graph recursion-cycle query grep cannot express. Yellow is the tokens to reach the finding; blue is what it costs to read the source once.
TOKEN ACCOUNTING, NOT A LATENCY BENCHMARK · SOURCES IN docs/case-studies/xerj-self-audit →
WordPress core is ~619k lines — ~26× a 200k-token context window. An agent indexed it as a queryable code graph and read only what queries surfaced. Yellow is the whole audit's token bill; blue is what it costs just to load the code once.
TOKEN ACCOUNTING, NOT A LATENCY BENCHMARK · SOURCES IN docs/case-studies/wordpress-security-audit →
"Of calls about wifi issues, how many are 2.4GHz vs 5GHz, and what are the key issues?" — asked by calltree.ai. Half retrieval, half analytics: normally two stores and an ETL. One XERJ POST /_search returns the slice, the breakdown, the metrics, and the evidence.
SPLIT STACK = OLAP + VECTOR STORE + ETL, OR TWO ROUND TRIPS IN ONE ENGINE · AGGS-BEARING kNN RUNS THE EXACT SCAN, NO SPEED CLAIM · BUCKETS COUNT THE RETRIEVED SLICE · k=80 IS THE REQUEST PARAMETER, NOT A MATCH COUNT · SOURCES IN docs/case-studies/calltree-analytics →
daily.dev's founder asked: can XERJ replicate automatically from Postgres? A logical-replication slot streams every INSERT, UPDATE, and DELETE into XERJ — no reindex jobs — and one hybrid query fuses BM25 + vector rankings server-side, replacing the tsvector + pgvector two-query app merge.
ARCHITECTURAL COUNT FROM THE RECORDED RUN · SOURCES IN docs/case-studies/daily-dev-postgres-cdc →
On code the model has not memorised, handing the same Claude Code a XERJ-retrieved reference makes it correct where memory fails — 21/21 vs 1/21 — at 1.5–2.7× fewer output tokens than native Claude Code grepping the source, across five languages. Red is answering from memory; yellow is XERJ-assisted. On memorised code, retrieval is honest overhead — and we say so.
SAME AGENT, ONE HIDDEN-TEST VERDICT · SYNTHETIC UNFAMILIAR-API CORPUS · SOURCES IN docs/case-studies/reference-coding →
Every walkthrough reproduces from the repo. Want it run against your codebase, your conversations, or your Postgres? Leave a work email and we'll set it up with you.