Fix Codex day cost blanked by trace-only priority turns

[olddonkey]

Problem

On a machine that uses Codex priority processing, the Codex cost card goes blank: Today shows —, recent days disappear from the 30-day chart, and the window total silently shrinks to the sum of the days that survived. On my install every day from 2026-08-13 on lost its cost while 2026-08-12 and earlier kept theirs — the 30d figure read $2,408 when roughly half the window was simply missing.

Root cause

codexPricingModeEvidence judges whether the retained rows own a (day, model) group by comparing them against the file's persisted standard/priority split. The two sides do not share a source:

• the persisted maps are rebuilt from the rows' own pricingMode (CostUsageStore+CodexCache.fileAggregates), and
• the report-side split (codexModeTokenMaps) additionally classifies a row as priority when its turnID appears in codexPriorityTurns, i.e. in ~/.codex/logs_2.sqlite.

So a turn the trace database reports as service_tier: priority after its rows were already persisted as standard reads as a row-ownership mismatch. The rows lose trust, the group falls back to codexAggregateCostUSD, and that returns nil for any model with a long-context tier (#2858 deliberately refuses to apply 200k-tier rates to a day aggregate — a day always exceeds the threshold). With every model on the day nil, entryCost is nil and the day vanishes from the menu, the chart and the total.

A single 300k-token session is enough: on 2026-08-22 one file contributed 189,156 trace-priority tokens against a persisted priority = 0, and that blanked the whole day's 258M tokens. The trace database only retains ~10 days, which is why the damage is always the most recent stretch and rolls forward daily.

Fix

Judge retention against both classifications and flag only a group that matches neither. A wrongly retained row set still fails both, because the persisted totals are canonical for the file (the existing persistedModeTotal == canonicalTotal guard) and tier classification never changes how many tokens the rows carry — so the fork-prefix protections from #2858 are untouched. Priority pricing itself still comes from the trace: the trusted row path prices those turns with the fast-tier rates, and the model breakdown keeps its standard/priority split.

Tests

• trace priority turns keep row ownership for rows persisted as standard — rows persisted as standard plus a trace-only priority turn: no mismatch, the day is priced from the rows (standard + fast-tier), and the assertion that codexAggregateCostUSD is nil for the day aggregate documents why distrusting the rows blanks the day.
• stale persisted mode split still invalidates row ownership — a mode split that neither classification reproduces still distrusts the rows and leaves the cost unavailable.
• All 16 tests in CostUsageScannerForkSplitTests pass, including every existing fork-split/pricing-evidence case.
• Full make check and make test green.

CodexParserHash changes because the file is inside the hashed set; the previous value is added to compatiblePredecessorParserHashes since neither the parser nor the persisted row shape changed, so existing caches are adopted instead of rebuilt.

Measured on a real store

Offline A/B over a pristine copy of my cost-usage.sqlite and a frozen copy of logs_2.sqlite (109 priority turns), rebuilding the report through buildCodexReportFromCache with the real codexPriorityTurns — no scan, nothing mutated, only the code under test changes:

	main	with this fix
mismatch groups in the window	17 (2026-08-13 … 08-22)	0
days priced 08-13 … 08-22	0 / 10	9 / 10
30-day total	$2,408.12	$4,139.48

The main column reproduces exactly what the shipped app showed in its menu. 2026-08-20 stays unpriced under both — that day's rows genuinely do not reconcile, which is the unresolvedRowGroups path and out of scope here.

🤖 Generated with Claude Code

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[olddonkey]

Changelog entry for the release flow (not added to CHANGELOG.md per docs/RELEASING.md):

- Codex: keep a day's cost when a turn's priority tier is only known from the trace database. The tier classification no longer reads as a row-ownership mismatch, so recent days stop disappearing from the cost card, the chart and the window total.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 23, 2026, 2:23 AM ET / 06:23 UTC.

ClawSweeper review

What this changes

The PR lets Codex cost reconciliation accept persisted row ownership when either stored pricing modes or trace-enriched priority modes match the canonical token split.

Merge readiness

✅ Ready for maintainer review

Keep open: this is a narrow, source-supported Codex cost-report repair with focused coverage and real-store A/B evidence; no blocking correctness or security defect was found.

Priority: P2
Reviewed head: 7a6a73d07326241e9afefadb16a2ff097cf202f7

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The patch has a clear causal model, a narrow implementation, focused positive and negative fixtures, and credible real-store output.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The PR body provides a redacted offline real-store A/B result using a frozen trace database and pristine cost store, showing the affected days and 30-day total recover after the change.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR body provides a redacted offline real-store A/B result using a frozen trace database and pristine cost store, showing the affected days and 30-day total recover after the change.
Evidence reviewed	5 items	Current-main behavior: Current main compares the persisted standard/priority split only with trace-enriched row modes, so a trace-only priority turn can mark an otherwise canonical row group mismatched. Narrow correction and regression coverage: The PR retains the canonical-total guard, accepts either mode classification, and adds both the trace-only-priority fixture and a stale-split negative case. Cache compatibility: The prior parser hash is explicitly accepted because the persisted row shape is unchanged, with an assertion covering store adoption without rebuild.
Findings	None	None.
Security	None	None.

Live Verification

Command: swift run codexbar cost --help

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

Assertions:

• FAIL expect_output: codexbar cost [--format text|json]

How this fits together

CodexBar reconciles persisted local Codex usage rows with aggregate token maps and optional priority-turn trace metadata before calculating costs. That result feeds the cost card, chart, CLI report, and rolling total.

flowchart LR
    A[Persisted Codex rows] --> D[Ownership reconciliation]
    B[Persisted mode totals] --> D
    C[Priority-turn trace] --> D
    D --> E{Matches stored or trace mode split?}
    E -->|Yes| F[Row-level pricing]
    E -->|No| G[Safe aggregate fallback]
    F --> H[Cost card, chart, and CLI]
    G --> H

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production versus test delta	production +19/-6, tests +143	Most of the change is focused regression coverage around a small reconciliation adjustment.
Files affected	5 files affected	The patch is limited to reconciliation, cache compatibility metadata, generated hash, and their tests.

Technical review

Best possible solution:

Keep row-level prices when canonical ownership agrees with either persisted or trace-enriched modes, while preserving aggregate fallback for splits that neither classification can reconcile.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: two persisted-standard rows with one trace-identified priority turn trigger the old mismatch, while the resulting aggregate is deliberately unpriceable above the long-context threshold.

Is this the best way to solve the issue?

Yes: comparing both classifications is the narrowest repair because it separates tier-label drift from row ownership while retaining the canonical-total and stale-split safeguards.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 27c7f334e3c4.

Labels

Label changes:

• add P2: The PR repairs incorrect Codex cost display and totals with limited blast radius and no availability or security impact.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides a redacted offline real-store A/B result using a frozen trace database and pristine cost store, showing the affected days and 30-day total recover after the change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body provides a redacted offline real-store A/B result using a frozen trace database and pristine cost store, showing the affected days and 30-day total recover after the change.

Label justifications:

• P2: The PR repairs incorrect Codex cost display and totals with limited blast radius and no availability or security impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body provides a redacted offline real-store A/B result using a frozen trace database and pristine cost store, showing the affected days and 30-day total recover after the change.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides a redacted offline real-store A/B result using a frozen trace database and pristine cost store, showing the affected days and 30-day total recover after the change.

Evidence

What I checked:

• Current-main behavior: Current main compares the persisted standard/priority split only with trace-enriched row modes, so a trace-only priority turn can mark an otherwise canonical row group mismatched. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+ReportReconciliation.swift:79, 27c7f334e3c4)
• Narrow correction and regression coverage: The PR retains the canonical-total guard, accepts either mode classification, and adds both the trace-only-priority fixture and a stale-split negative case. (Tests/CodexBarTests/CostUsageScannerForkSplitPricingEvidenceTests.swift:103, 7a6a73d07326)
• Cache compatibility: The prior parser hash is explicitly accepted because the persisted row shape is unchanged, with an assertion covering store adoption without rebuild. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageStore.swift:82, 7a6a73d07326)
• Related pricing-history provenance: The existing request-tier/fork-pricing safeguard dates to the merged commit that is included through v0.53.0; this PR addresses its distinct false-mismatch interaction. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+ReportReconciliation.swift:50, 4befde4bbdf0)
• Release status: No repository tag contains the proposed head, so the correction is not already shipped or present on current main. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+ReportReconciliation.swift:91, 7a6a73d07326)

Likely related people:

• Peter Steinberger: Current-main blame attributes the reconciliation surface to this area, and the earlier request-tier/fork-pricing fix is authored by him. (role: recent area contributor; confidence: high; commits: 4befde4bbdf0, 22a2168842a9; files: Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+ReportReconciliation.swift, Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.