Before any agent ran, the ground truth was established by hand against the DuckDB. COMPUTE_WH metered 43.86 credits over four days — 53.2% of the account’s warehouse credits. Of those, 0.4751 were attributed to actual query work by QUERY_ATTRIBUTION_HISTORY. The remainder — 98.92% idle — was a warehouse billing for being awake. The mechanism, established in Part 1: a notebook container service with AUTO_SUSPEND_SECS = 0 polling around the clock, 37,399 inter-query gaps on COMPUTE_WH, only 120 of them (0.32%) exceeding the 60-second auto-suspend window. The warehouse never slept.

That is the target. Four configurations were then asked the same question: “Why is COMPUTE_WH so expensive?” Skilled agents get the database schema, unit conventions, and five investigative playbooks. Naive agents get one sentence. The cheap tier is Sonnet; the frontier tier is Opus — except for one trace (212343) where the model was set to “default” and the exact model version was not recorded. That run is labeled skilled (frontier) in the table and throughout this note; calling it Opus would assert something the trace does not confirm.

Skilled-Sonnet (trace 213316): $0.1885, 15 tool calls, 248 seconds, 2 errors. Correct. The playbook’s opening move — compare metered credits to attributed credits, then identify the query types keeping the warehouse awake — is exactly the causal model needed. The cheap model didn’t need to derive how Snowflake billing works from first principles. It needed to execute a competent investigation of a well-understood domain, and it did. Minor unit wobbles in savings estimates appear in the trace, consistent with the model executing playbook steps rather than reasoning from scratch. The production consequence: for recurring, well-understood question types, this cell is the answer. Fifteen tool calls. Under $0.20.

Skilled (frontier) (trace 212343): $0.4934, 26 tool calls, 402 seconds, 13 errors. Correct — the idle burn identified, the polling behaviour surfaced — but the culprit stayed vague. The skilled run’s playbook ends at “polling operations.” The frontier model executing that playbook stops where the playbook stops. It found the right answer faster than the naive frontier run but not more deeply. At 2.62× the cost of skilled-Sonnet ($0.4934 / $0.1885) and with 13 errors vs 2, this is the cell where you are paying for model capability and getting playbook execution.

Naive-Opus (trace 212903): $0.6992, 24 tool calls, 343 seconds, 8 errors. Correct, and the deepest root cause of any run. With no playbook to constrain its path, the frontier model did what no skilled run did: it pulled the most-repeated query texts and read them. There sat SYSTEM$NOTEBOOK_CONTAINER_PARAMS — the notebook-container heartbeat, one level deeper than my playbook’s vocabulary. It then proved the mechanism statistically: of 37,399 inter-query gaps, only 120 (0.32%) exceeded the 60-second suspend window. My playbook does not contain that gap analysis, because I had not thought to write it before this run. The unconstrained frontier run is how the playbooks grow.

Naive-Sonnet (trace 214051): $0.5504, 29 tool calls, 471 seconds, 6 errors. Wrong. This is the cell to examine.

Law 1: Skills substitute for model capability on known questions. Skilled-Sonnet delivered essentially the same answer as the frontier skilled run at 38% of the cost ($0.1885 / $0.4934 = 38.2%). The playbook’s first move is the causal model: compare metered to attributed credits; a large gap means idle burn; then identify what keeps the warehouse awake. The cheap model does not need to derive that from domain knowledge it may or may not have internalized. It executes the investigation competently, including arithmetic the playbook never spells out. For recurring, known question types, the production implication is direct: you do not pay frontier rates. You pay Sonnet rates.

Law 2: Model capability substitutes for skills on unknown questions. Naive-Opus had no map so it read the territory. It pulled query texts and found the notebook heartbeat function. It ran a gap distribution the playbook had not imagined. It discovered the mechanism one level deeper than the playbook’s vocabulary. The uncomfortable symmetry: both skilled runs — cheap model and frontier model alike — stopped at exactly the same depth. The depth where the playbook stops. Skills encode the known frontier; they cap discovery there, because you cannot write playbooks beyond what you already know. The unconstrained frontier run is not a control group. It is how the playbooks get updated.

Law 3: Cheap-and-naive produces confident wrong analysis with no formatting tell. This is the one that matters for deployment decisions, so the next section covers it fully.

Naive-Sonnet found real facts. The overwhelming majority of queries on COMPUTE_WH were repeats. Metadata operations dominated. It even speculated “likely from notebooks or BI tools.” It brushed against the right answer. Then it assembled those facts into a wrong causal model: each query incurs a minimum credit cost; volume is the main driver; large scans are secondary. Its recommendations — query caching, WHERE clauses — would have consumed an engineering sprint while the warehouse kept burning.

The damning detail is in the trace. Naive-Sonnet ran zero queries against the credit-attribution column. It never compared metered credits to attributed credits. It never computed the 98.92% idle figure. It invented a billing model where query volume costs money, because it lacked the domain knowledge to arrange the facts it found — and nobody had supplied it.

Note what this failure is not. It is not hallucination. It is not incompetence at SQL. Every number in its report is real. The failure is facts without a causal framework, delivered with the same fluent confidence and the same formatting as the correct answers in the other three cells. There is no hedging tell. There is no low-confidence qualifier. The only way to catch it is to know the domain well enough to check the claim — or to read the trace.

The trace is the only witness that doesn’t lie. Naive-Sonnet’s trace shows 29 tool calls and not one of them touches CREDITS_ATTRIBUTED_COMPUTE. Every dispute about what an agent actually did reduces to this: grep the JSONL.

A frame that made this concrete for several colleagues: the playbook is a senior engineer’s knowledge, written down. Skilled-Sonnet is a junior analyst with an excellent runbook — fast, cheap, reliable inside the runbook’s borders. Naive-Opus is a brilliant outside consultant with no context — expensive, slower, occasionally finds the thing nobody internal could. Naive-Sonnet is a junior analyst with no runbook working a domain they do not understand — and the analysis looks exactly like the correct one. Nobody staffs the last configuration knowingly. The grid says: with agents, you can deploy it by accident, and the per-run cost will tempt you to.

The directed-question setup is a controlled test — there is a known answer to converge on, and “correct” has a crisp definition. Real audits rarely work this way. Two harder questions followed this grid and each one changed what I thought I knew.

The first: what happens on a fully open-ended sweep — “find everything” — where there is no single answer and coverage matters more than depth? The second: how stable are these results run to run? On a directed question, the agents converged. On an open sweep, they did not. And on the stability question, I was wrong about something I had written down in my own analysis. Both of those are in Part 3.

One open verification item from this grid: the trace labeled 212343 ran with --model default. What model “default” resolved to at runtime is not recorded in the JSONL. The cost ($0.4934 for 26 calls, 402 seconds) is consistent with a frontier-tier model, but the exact model ID is unknown. That cell is labeled “skilled (frontier)” throughout this series rather than “skilled-Opus,” and the distinction matters when the series reaches the economics in Part 5.

Numbers in this note come from a seeded Crosshire trial Snowflake account — not a customer — snapshot 16–20 May 2026, approximately four days of metered data, re-derived against the same DuckDB the agents queried. Trace figures (cost, tool calls, duration, error counts) come from the nine on-disk JSONL files. Credit-to-dollar figures use the $3.00/credit Snowflake list rate, disclosed as an estimate. The model read every number; a human ratified every one before it shipped. — Crosshire