Summary
This is a redacted real-world corpus report for the remaining cross-file work in #2037, not a separate root-cause claim.
A high-fanout Codex session produced dozens of child rollout files. The children replay parent token_count history with rewritten timestamps. In one verified parent/child pair, the child starts with 5,427 consecutive last_token_usage vectors that exactly match a contiguous section of the parent's immutable token stream. The copied prefix spans about 1.98 seconds in the child, so a same-second replay heuristic cannot remove it.
Environment
- macOS 26.2 (25C56), Apple Silicon
- Codex CLI 0.143.0
- CodexBar 0.42.0
- Local timezone: Asia/Shanghai
- Affected workload: Codex Ultra-style high-fanout subagents/forks
Redacted corpus shape
For one local day:
- 111 rollout JSONL files
- 22 root sessions
- 88 files with an explicit parent reference
- largest parent family: 46 child files
- second-largest parent family: 24 child files
For one sanitized parent/child pair:
parent token_count events: 12,273
child token_count events: 5,716
exact copied child-prefix events: 5,427
matched parent stream start index: 2,449
child replay duration: 1.983 seconds
The first and last matching vectors were compared using only the numeric fields in last_token_usage:
{
"input_tokens": 170483,
"cached_input_tokens": 167680,
"output_tokens": 244,
"reasoning_output_tokens": 87,
"total_tokens": 170727
}{
"input_tokens": 54031,
"cached_input_tokens": 52992,
"output_tokens": 199,
"reasoning_output_tokens": 0,
"total_tokens": 54230
}No prompt, response, account, session ID, filename, or local path was retained in this report.
Observed result
On this corpus, the released CodexBar scanner reported approximately:
Last 2 days: $7,634.61 / 21B tokens
The dollar value is included only as a symptom. I am not claiming a corrected bill amount here. The directly verified defect is that thousands of parent events appear again at the beginning of child files with rewritten timestamps.
Reproduction method
- Read only the first
session_meta record from each rollout.
- Map children to parents using
forked_from_id or source.subagent.thread_spawn.parent_thread_id.
- Read only
event_msg.payload.type == "token_count" records.
- Normalize each event to its numeric
last_token_usage vector, excluding the envelope timestamp.
- Compare the child prefix with contiguous sections of the referenced parent's immutable stream.
- The pair above produced an exact 5,427-event match before the child's new suffix began.
Expected behavior
- Copied parent history should have one owner across the fork family.
- A child should contribute only genuinely new usage after the copied prefix.
- If the parent is unavailable or ownership is ambiguous, the result should be marked incomplete/estimated rather than silently multiplying copied usage.
- Equal token vectors from distinct events must not be globally collapsed without provenance.
Relation to current main
I understand that #2082 adds bounded file-local containment and fixtures, while exact cross-file fork-family provenance remains open in #2037. This report is intended to provide the affected real-setup evidence requested there.
I can provide a generated numeric-only fixture derived from this pair, or run an instrumented CodexBar build against the frozen local corpus and return initial-scan plus cached repeat-scan summaries.
Summary
This is a redacted real-world corpus report for the remaining cross-file work in #2037, not a separate root-cause claim.
A high-fanout Codex session produced dozens of child rollout files. The children replay parent
token_counthistory with rewritten timestamps. In one verified parent/child pair, the child starts with 5,427 consecutivelast_token_usagevectors that exactly match a contiguous section of the parent's immutable token stream. The copied prefix spans about 1.98 seconds in the child, so a same-second replay heuristic cannot remove it.Environment
Redacted corpus shape
For one local day:
For one sanitized parent/child pair:
The first and last matching vectors were compared using only the numeric fields in
last_token_usage:{ "input_tokens": 170483, "cached_input_tokens": 167680, "output_tokens": 244, "reasoning_output_tokens": 87, "total_tokens": 170727 }{ "input_tokens": 54031, "cached_input_tokens": 52992, "output_tokens": 199, "reasoning_output_tokens": 0, "total_tokens": 54230 }No prompt, response, account, session ID, filename, or local path was retained in this report.
Observed result
On this corpus, the released CodexBar scanner reported approximately:
The dollar value is included only as a symptom. I am not claiming a corrected bill amount here. The directly verified defect is that thousands of parent events appear again at the beginning of child files with rewritten timestamps.
Reproduction method
session_metarecord from each rollout.forked_from_idorsource.subagent.thread_spawn.parent_thread_id.event_msg.payload.type == "token_count"records.last_token_usagevector, excluding the envelope timestamp.Expected behavior
Relation to current main
I understand that #2082 adds bounded file-local containment and fixtures, while exact cross-file fork-family provenance remains open in #2037. This report is intended to provide the affected real-setup evidence requested there.
I can provide a generated numeric-only fixture derived from this pair, or run an instrumented CodexBar build against the frozen local corpus and return initial-scan plus cached repeat-scan summaries.