Fix inflated Codex Standard/Fast cost splits

[steipete]

Summary

Codex's canonical day/model totals already deduplicate fork ownership, but the post-#2776 read-time pricing path could still sum physical pricing rows and publish an inflated Standard/Fast split. This repair validates each CodexRowCostBreakdown against the canonical input-plus-output total before trusting it.

• Keep exact Standard/Fast costs and tokens when row ownership reconciles with the canonical total.
• When row-priced tokens exceed canonical usage (or their sum overflows), hide the split and price only the canonical input, cached-input, and output token classes.
• Reject the whole row-derived price, including Fast uplift from the same physical rows, so the former priority-surcharge leak cannot survive the fallback.
• Cover both paths with a real scanner fixture whose fork child is reduced from cumulative [150, 60, 15] usage to its owned [50, 20, 5] suffix before the report boundary is exercised.

Tests

• swift test --filter 'CostUsage|SpendDashboard' — 551 tests in 41 suites passed.
• swift test --filter 'CostUsageScannerForkSplitTests|CostUsageScannerPriorityTests' — 19 tests in 2 suites passed.
• swift build — passed.
• Task-scoped SwiftFormat, strict SwiftLint, parser-hash verification, and git diff --check — passed.
• Structured Codex autoreview — clean, no actionable findings.

make check currently reaches unrelated SwiftFormat findings inherited from main in the newly added Fireworks source and tests. No Fireworks cleanup is included here.

Credit

Reported by @1328189205. The initial fix and regression-test approach came from @Yuxin-Qiao in #2774.

Fixes #2754

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 8, 2026, 10:42 PM ET / August 9, 2026, 02:42 UTC.

ClawSweeper review

What this changes

The PR hides Codex Standard/Fast cost splits when physical fork rows exceed canonical daily usage, and falls back to canonical token-class pricing.

Regression provenance

Possible regression — probable (reproduction; reviewed change). No predecessor PR is attributed.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This owner-authored PR is still necessary and directly addresses the open fork-row pricing regression. The focused fixture covers both suppression of an inflated split and preservation of a reconciled split; no actionable patch defect was found.

Priority: P2
Reviewed head: e0c11f74119719ba947ff86fe6221d27a8439765

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The patch is focused, covers both invalid and reconciled fork-row paths, and has no discrete correctness finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This owner-authored PR includes focused scanner-fixture evidence; live account probing is not appropriate for this review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored PR includes focused scanner-fixture evidence; live account probing is not appropriate for this review.
Evidence reviewed	4 items	Proposed validation: The branch rejects a row-derived split when its Standard/Fast token sum overflows or exceeds the canonical input-plus-output total, then hides split fields. Regression coverage: The added fixture copies parent rows into a fork child, verifies the physical token total exceeds canonical usage, and asserts canonical cost with hidden Standard/Fast fields. Area provenance: Current report-time pricing behavior dates to the merged Codex pricing-race repair, providing the immediate feature-history ownership trail.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar converts local Codex session caches into canonical daily model totals and then produces spend reports. This report-boundary logic decides whether physical Standard/Fast pricing rows are safe to display or whether canonical pricing must be used instead.

flowchart LR
  A[Codex session cache] --> B[Canonical daily usage]
  A --> C[Physical pricing rows]
  B --> D[Cost report builder]
  C --> E[Validate row token total]
  E -->|Trusted| F[Show Standard/Fast split]
  E -->|Untrusted| G[Canonical token pricing]
  F --> H[Daily usage report]
  G --> H

Loading

Before merge

• Resolve merge risk (P1) - Existing fork-heavy caches will intentionally show lower, canonical cost estimates and no Standard/Fast breakdown after upgrade when their physical rows cannot reconcile with owned usage.
• Complete next step (P2) - The remaining action is normal owner/maintainer review of the intentional compatibility change; no autonomous repair is indicated.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production vs test delta	production +10 net, tests +177	The small reporting decision is accompanied by a dedicated scanner-level fork fixture.
Files affected	4 files changed	The implementation is limited to the cost report, focused tests, generated parser fingerprint, and release note.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #2754
Summary: This PR is the direct candidate repair for the open fork-row cost-split regression.

Members:

• canonical: Regression in v0.48.0: Standard/Fast cost split re-inflates deduplicated fork usage #2754 - The PR explicitly implements the issue’s requested protection against physical fork rows inflating a canonical daily total.
• superseded: Fix invalid Codex Standard/Fast cost splits #2774 - The closed unmerged PR proposed a similar split-validation direction; this owner-authored PR carries the remaining repair with a scanner fixture.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Accept the corrected report output (recommended)
   Merge with the documented upgrade effect that inconsistent existing cache splits are hidden and repriced from canonical usage.

Technical review

Best possible solution:

Land the narrow guardrail so reports never present a precise Standard/Fast split derived from copied fork rows while retaining exact splits that reconcile with canonical ownership.

Do we have a high-confidence way to reproduce the issue?

Yes. The added scanner fixture creates copied fork rows whose physical Standard/Fast token total exceeds the canonical daily total and exercises the report boundary.

Is this the best way to solve the issue?

Yes. Suppressing only unreconciled physical splits and falling back to the existing canonical token-class pricing path is the narrowest maintainable repair.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7ecdd46b8e10.

Labels

Label justifications:

• P2: This is a bounded correctness fix for inaccurate Codex cost estimates rather than an availability or data-loss incident.
• merge-risk: 🚨 compatibility: Merging intentionally changes displayed estimates and split details for existing fork-heavy caches.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored PR includes focused scanner-fixture evidence; live account probing is not appropriate for this review.

Evidence

What I checked:

• Proposed validation: The branch rejects a row-derived split when its Standard/Fast token sum overflows or exceeds the canonical input-plus-output total, then hides split fields. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift:1420, e0c11f741197)
• Regression coverage: The added fixture copies parent rows into a fork child, verifies the physical token total exceeds canonical usage, and asserts canonical cost with hidden Standard/Fast fields. (Tests/CodexBarTests/CostUsageScannerForkSplitTests.swift:8, e0c11f741197)
• Area provenance: Current report-time pricing behavior dates to the merged Codex pricing-race repair, providing the immediate feature-history ownership trail. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift:1415, 0aafe2b80563)
• Diff scope: The PR changes four files: 10 net production lines and 177 focused test lines, plus a generated parser fingerprint and release note. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift:1420, e0c11f741197)

Likely related people:

• steipete: Peter Steinberger authored the merged pricing-race repair that established this report-time pricing path and authored the current PR. (role: introduced current pricing-report behavior and recent area contributor; confidence: high; commits: 0aafe2b80563; files: Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift, Tests/CodexBarTests/CostUsagePricingRaceTests.swift)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-08-08T21:35:25.563Z sha 89df62b :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T21:51:03.663Z sha dd62240 :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T22:33:39.324Z sha dd62240 :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T23:41:17.188Z sha dd62240 :: needs maintainer review before merge. :: none
• reviewed 2026-08-09T01:22:19.978Z sha 383671a :: needs maintainer review before merge. :: none
• reviewed 2026-08-09T01:44:12.937Z sha 383671a :: needs maintainer review before merge. :: none

[steipete]

Landed. Verification: the trust check on CodexRowCostBreakdown rejects splits whose row-priced token total exceeds canonical fork-deduplicated usage, falling back to canonical token-class pricing, and the codexPrioritySurchargeNanos leak from the same physical rows is closed. Real fork-deduplicated scanner fixtures cover valid and invalid cases (551 CostUsage/SpendDashboard tests green); implemented on the post-#2776 price-on-read architecture. Report: @1328189205; initial fix and regression-test approach: @Yuxin-Qiao (#2774).