The Seams Are Where Plans Go Wrong
Retirement planning isn't one question — it's a dozen that answer each other. I went looking for a tool that handled all of them at once, found nine that each handle one, and built the thing that removes the seams.
I set out to answer what sounded like a single question: can this household retire on the date we’ve picked?
It isn’t a single question. It’s a dozen, and they answer each other.
When to claim Social Security depends on the widow’s math. How aggressively to convert to Roth depends on health-insurance cliffs, which depend on the same modified income the conversions generate. Whether to work one more year depends on a vesting schedule, on tax arbitrage, and on what that year actually buys the person who ends up living longest. Change the retirement date and every one of those answers moves.
Scattered tools each answer one of those questions well — against their own private assumptions. The seams between them are where plans quietly go wrong.
What already exists
Before building anything, I went looking. This is the honest survey, and I’d encourage anyone in the same position to go look for themselves rather than take my word for it — features and pricing drift, and this is a snapshot rather than a standing claim.
| Tool | What it does well | Why it wasn’t enough |
|---|---|---|
| Boldin (formerly NewRetirement) | The closest commercial analog — Monte Carlo, a Roth conversion explorer, Social Security timing, scenario planning. | Paid, with a free tier that functions as a teaser. No advisor audit, no equity compensation, and your data lives on their servers. |
| ProjectionLab | Genuinely lovely UI, tax-aware, models conversions well. | Paid; the free tier can’t save. Same structural gaps as Boldin. |
| Pralana | The deepest of the bunch on taxes, IRMAA, and conversion sequencing. | Paid, spreadsheet-souled, no account aggregation. |
| Empower Personal Dashboard | Free, aggregates accounts, runs a Monte Carlo. | Coarse models, no conversion pipeline, no guardrails. The “free” is paid for with advisor-upsell calls. |
| cFIREsim | Free historical-cycle simulator; even offers Guyton-Klinger variable spending. | Portfolio-only: no accounts, no taxes, no Social Security nuance, no healthcare. |
| FIRECalc | The original free historical-cycles tool. | Same portfolio-only scope, older still. |
| Open Social Security | Free, and the claiming optimizer — spousal, survivor, and RIB-LIM handled properly. | One cat, perfectly herded. Nothing else. |
| Bogleheads Retiree Portfolio Model | A free Excel model of shocking depth — conversions, IRMAA, year-by-year cash flows. | It’s a giant spreadsheet: steep learning curve, no sync, and levers that drift by hand. |
| Rich, Broke or Dead | Free, elegant Monte Carlo with a mortality overlay. | A single page — the best gut check on this list, and only a gut check. |
The free do-it-yourself equivalent is roughly: the Bogleheads spreadsheet, plus cFIREsim, plus Open Social Security, plus a custodian dashboard — stitched together by hand and kept in sync by discipline alone. That works. It exists as a hobby you maintain forever, with every tool’s assumptions quietly drifting apart from the others’.
That drift is the whole problem. Nobody is lying to you. Each tool is doing its job correctly, against a set of premises you can’t see, and no page anywhere is obligated to agree with any other page.
What I built instead
I built a household financial OS — single-tenant, self-hosted, and deliberately not a product. The organizing principle is a single household profile. Every planning lever — retirement date, spend, Social Security age, healthcare assumptions, savings cadence, the guardrails floor, life expectancies — lives in exactly one place, and every model reads from there.
Change the retirement date in settings, and the Monte Carlo, the Roth pipeline, the vesting forfeiture, and the healthcare phases all move in the same breath. No tool in that table does that across its own feature set, let alone across nine of them.
A few things follow from that decision:
Every computed figure declares its inputs. Two modules physically cannot hold two values for one quantity. That was the failure that killed my first attempt at this.
Unknown is a value, not a zero. If a component is missing, the total is Unknown and it names the missing part. It never silently interpolates, and it never quietly substitutes zero. This single rule has caught more real defects than any other.
Assumptions carry an authority or a stated rationale, and the schema refuses to store one without it. A number sitting in code that changes a verdict is treated as a bug even when the number happens to be right.
Nothing is ever edited or deleted. Every fact records both when it was true and when it was learned. Corrections supersede rather than overwrite, so any page can render as it would have looked at any past instant. A database trigger enforces this — including against the application’s own author.
The parts I couldn’t find anywhere, at any price
An audit of the advisor package. No commercial product cross-checks an advisor’s quarterly PDFs against independent models and verifies the fee base to the dollar. Advisor-sold tools won’t audit the hand that feeds them; DIY tools pretend advisors don’t exist. This does both jobs and shows its work.
Equity compensation wired to the retirement decision. Stock-plan portals and retirement planners are separate universes everywhere else. Sliding the retirement date here shows exactly which tranches you keep and which you forfeit — the golden handcuffs, weighed in dollars.
It reads the actual documents. The executed trust, the IRS transcripts, the W-2s, the advisor’s quarterly package, the insurance carrier’s own screens — transcribed into the model with integrity tests, so the plan runs on what the paper says rather than on what anyone remembers it saying. That habit alone has already corrected a balloon year, a misremembered fee rate, a standard deduction, a term-life expiry that was off by seven years, and a policy everyone had written off as unresolved.
Custody and candor. The data sits on hardware I own, and the assessments answer to no business model. That leaves the system free to say “you’re already financially free, stop optimizing” or “this proposal contradicts its own volatility assumption.” A tool with a subscription to protect, or assets to gather, structurally cannot say either.
What it isn’t
Being honest about the edges is part of the design, so:
- It’s built for one household. Single-tenant by design. Generalizing it is real work, deliberately not yet done.
- It’s simplified where simplification is safe — but it is simplified. The Monte Carlo taxes withdrawals with a flat gross-up rather than full brackets; the conversion model does the bracket math and the simulation borrows its verdict as an overlay. Returns are statistical, not historical sequences.
- Statutory tables are a snapshot. Brackets, FPL, IRMAA and Medicare figures are pinned to a tax year and held constant in real terms. A staleness alarm fires if they aren’t revisited, but law changes between updates are invisible to the model.
- Some numbers depend on outside services. Account sync, prices and fundamentals ride on third parties. The data is only as fresh as its sources, and a couple of feeds need a manual quarterly export.
- It is not advice. It’s analysis with provenance. Its own pages say so.
- Key-person risk is real. One person and one AI built and maintain it. The mitigation is deliberate — aggressive testing, a gated deploy, a planned frozen read-only mode — but it’s a bespoke instrument, not a supported product.
Who checks it
No CPA, fiduciary, or compliance department has signed off on any of this. What it has instead is a habit: every module’s approach and data bounced off people who know the subject, and a second reader in the house who brings more skepticism to it than I do.
Knowing a business is not the same as being diligent about your own, which is exactly why the vetting matters — the cobbler’s children go barefoot. A liability limit sitting well under the umbrella above it, in a house that knows better. A recycled ticker symbol. A fee rate everyone had wrong. All caught by checking.
What came out the other side is directionally accurate everywhere it matters, and specifically accurate in the places where precision is the point. The quality control isn’t a credential. It’s the habit of checking, and enough people doing it.
Why any of this generalizes
I’m writing this up rather than just quietly using the thing, because the interesting part isn’t the retirement math.
It’s that the discipline transfers. Any system that produces a number somebody will act on carries the same obligations: say where the number came from, refuse to invent one when the inputs are missing, and never let two parts of the system hold two answers to the same question. Most software fails all three, quietly, and looks fine doing it.
That’s a harder standard than it sounds, and it’s most of the reason this took the shape it did. A wrong number is worse than a missing one — and a system that can’t tell you which kind it just handed you is worse than both.