fix(codex): resume interrupted warm cost scans

[steipete]

A timed warm Codex cost refresh could validate one file, discard the remaining current-window cursor, and mark the cache pending. The next wider request then rediscovered and requeued already-validated files. On large histories this repeats catch-up work and delays spend publication.

Save the unvalidated candidates before the existing lookback completion logic removes successful work. Preserve completed discovery and use the established same-ending-day scan range when compatible timed requests alternate between shorter and wider reports. Each report still renders its requested interval. The separate exact-inventory pass remains mandatory before publication.

The generated parser fingerprint changes because the shared scanner is a hash input. Native parsing and stored-row semantics are unchanged, so the immediate predecessor fingerprint is adopted through the existing compatibility mechanism, with adoption, receipt-invalidation, and zero-head-parse regression coverage.

Related to #3411. This fixes the independently reproduced timed-warm-refresh path; it deliberately does not close the broader managed-account report Peter kept open. Thanks @kesslerio for the report.

Validation:

• make check passed, including the regenerated parser hash.
• All 14 focused CostUsageBoundedProgressTests passed. They cover the lost cursor, alternating windows, preservation of older coverage, requested-range filtering, and the exact-validation gate.
• Local and committed-branch autoreview are clean through P2. The full suite exposed a byte-backlog admission regression in the first repair; limiting the new marker to non-forced timed warm scans fixed it. All 22 bounded-progress/fairness tests pass serially. Final full make test passed 1,033 selections across 87 groups, with one unrelated display-only settings group recovering on its single retry. Exact-head CI succeeded on 1fb4f893155f4192ed630908b80d2df5823bf15a.
• A separately compiled executable linked to the actual production core ran against 513 synthetic session files and a real SQLite cache. Before the fix, interrupting after one validation lost the cursor; the next pass rediscovered 512 files, including the validated first file. After the fix, the interrupted pass persists the other 512 files, the next pass records zero discovery visits, and draining the queue still leaves publication pending until exact validation. All phases retain 56,430 tokens.
• Real built CLI upgrade proof: the base binary created a cache with fingerprint 9ca89383b9957b07; the new binary adopted it as 7f00691fa96c78d1 while every owned session file was chmod 000. Both returned established coverage, 56,430 tokens, and the same USD 0.177498 total. Modes were restored and fixtures removed afterward. This proves compatible rows survive without reparsing source files.

The changelog line is collected in the batch's separate final notes PR.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 8, 2026, 12:55 AM ET / 04:55 UTC.

ClawSweeper review

What this changes

Preserve unfinished Codex cost scans across timed refreshes and compatible history windows, with regression tests and adoption of existing SQLite caches.

Merge readiness

✅ Ready for maintainer review

This remains a useful repair: current main does not retain unfinished timed-warm scan work. No blocking defects were found, and the owner's final verification addresses resume behavior and cache compatibility.

Priority: P2
Reviewed head: 1fb4f893155f4192ed630908b80d2df5823bf15a

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with meaningful regression coverage, reported runtime and upgrade verification, and no identified blocking defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The external-contributor proof gate does not apply to this OWNER-authored PR. The owner nevertheless reports production-core/SQLite resume verification and built-CLI cache-adoption results on the reviewed head; the related issue screenshots are historical context only.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The external-contributor proof gate does not apply to this OWNER-authored PR. The owner nevertheless reports production-core/SQLite resume verification and built-CLI cache-adoption results on the reviewed head; the related issue screenshots are historical context only.
Evidence reviewed	10 items	Applicable repository policy: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-notes paths were found under the affected source, tests, docs, or .agents trees. Applied focused-test, provider-isolation, and cache-safety guidance; no builds or tests were executed during this read-only review. Current main still lacks the warm-resume repair: Current main retains a scan range only when an active lookback state already exists. Its post-scan path goes directly to lookback finalization without adding unfinished warm-scan candidates. The introduced patch supplies those missing steps. Resume and publication boundaries: The patch retains compatible roots, timezone, and ending-day checks; records completed warm discovery; and queues deferred candidates before existing completion filtering. The new queue behavior excludes forced scans and byte-only scans. Finalization and exact-inventory publication checks remain intact.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar scans local Codex session files into a SQLite cost-history cache. Budgeted refreshes feed usage reports and the Spend Dashboard, which wait for validated inventory before publishing complete coverage.

flowchart TD
  A[Local session files] --> C[Budgeted cost scan]
  B[Requested history window] --> C
  C --> D{Work remains?}
  D -->|Yes| E[Save pending work in SQLite]
  E --> C
  D -->|No| F[Validate exact inventory]
  F --> G[Publish requested cost report]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +23 net lines; tests +110 net lines	The production growth is justified by preserving warm-scan progress, with focused scheduling and cache-adoption coverage.

Technical review

Best possible solution:

Reuse the existing durable scan queue and cache-adoption mechanism while preserving requested report windows and exact-inventory publication.

Do we have a high-confidence way to reproduce the issue?

Yes: interrupt a populated timed warm scan after one file, then alternate compatible narrow and wide history requests. Current-main source explains the lost queue, and the owner reports reproducing it with production core and SQLite; this reviewer did not execute it.

Is this the best way to solve the issue?

Yes: extending the existing queue lifecycle is a narrow repair, and the patch preserves forced-scan behavior, byte-only scheduling, report filtering, and cache compatibility.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 2a71b479a5d4.

Labels

Label justifications:

• P2: Repairs delayed cost-history publication for large session collections without changing core account or authentication behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this OWNER-authored PR. The owner nevertheless reports production-core/SQLite resume verification and built-CLI cache-adoption results on the reviewed head; the related issue screenshots are historical context only.

Evidence

What I checked:

• Applicable repository policy: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-notes paths were found under the affected source, tests, docs, or .agents trees. Applied focused-test, provider-isolation, and cache-safety guidance; no builds or tests were executed during this read-only review. (AGENTS.md:1, 1fb4f893155f)
• Current main still lacks the warm-resume repair: Current main retains a scan range only when an active lookback state already exists. Its post-scan path goes directly to lookback finalization without adding unfinished warm-scan candidates. The introduced patch supplies those missing steps. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift:6038, 2a71b479a5d4)
• Resume and publication boundaries: The patch retains compatible roots, timezone, and ending-day checks; records completed warm discovery; and queues deferred candidates before existing completion filtering. The new queue behavior excludes forced scans and byte-only scans. Finalization and exact-inventory publication checks remain intact. (Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift:6053, 1fb4f893155f)
• Focused regression coverage: Two added tests cover a 513-file warm scan interrupted after one attempt, preservation of the other 512 paths, zero rediscovery on resume, a separate exact-validation pass, retained older coverage, and requested-day filtering. (Tests/CodexBarTests/CostUsageBoundedProgressTests.swift:82, 1fb4f893155f)
• Stored-cache compatibility: The immediate predecessor fingerprint is added to the existing adoption allowlist. Reviewed coverage verifies unchanged stored snapshots and partial checkpoints, rejection of predecessor connection receipts after adoption, and zero session-head parses. No persisted field or SQL schema layout changes are introduced. (Tests/CodexBarTests/CostUsageStoreTests.swift:1100, 1fb4f893155f)
• Owner verification on the reviewed head: The supplied full body and owner comment fix(codex): resume interrupted warm cost scans #3490 (comment) report production-core execution with 513 synthetic files and real SQLite: 512 unfinished paths survive, resume performs zero discovery visits, and publication waits for exact validation. Built-CLI predecessor adoption retains 56,430 tokens and USD 0.177498 while session files are unreadable. The owner also reports make check, 1,033 full-suite selections, 22 focused scheduling tests, and successful CI on the pinned head. These are contributor-reported results, not commands executed by this reviewer. (1fb4f893155f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• estevecastells: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-08T03:49:02.606Z sha 06be625 :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T04:05:32.643Z sha 1fb4f89 :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T04:13:02.697Z sha 1fb4f89 :: needs maintainer review before merge. :: none

[steipete]

Maintainer verification complete on 1fb4f893155f4192ed630908b80d2df5823bf15a.

• make check passed; local and committed-branch autoreview are clean through P2. The final full make test passed 1,033 selections across 87 groups; one unrelated display-only settings group recovered on its single retry. The 22 bounded-progress/fairness tests also passed.
• A production-core executable and real SQLite cache reproduced the lost cursor across 513 synthetic files. The repaired timed warm pass preserves the 512 unfinished files, resumes with zero discovery visits, and still requires exact inventory validation before publishing established coverage. Every phase retains 56,430 tokens.
• The real built CLI adopted a predecessor cache from 9ca89383b9957b07 to 7f00691fa96c78d1 while its synthetic transcript files were unreadable. Established coverage, 56,430 tokens, and USD 0.177498 remained unchanged; file modes were restored afterward.
• CI run 34185523120 succeeded on this exact head. The earlier byte-backlog fairness regression was repaired before this head; no test or validation requirement was weakened.

Land-ready. Keep #3411 open for its broader managed-account report. Changelog is consolidated in #3491; no merge was performed here.