@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/update/supervised-recovery.mjs

@@ -0,0 +1,157 @@
+import { spawnSync } from "node:child_process";
+
+/**
+ * Manager-mediated runtime recovery after an update (#7043).
+ *
+ * When the service refresh after an update fails or leaves a non-viable manager, both update
+ * lanes used to fall straight back to a detached `ocx start`. That proxy answers, but launchd
+ * or systemd no longer owns it: a crash is not restarted, and the next `launchctl kickstart`
+ * races the detached process for the port. Before that fallback, the lanes now ask the manager
+ * to restart the job it already holds, and count it as recovered only when the serving proxy is
+ * provably the manager's process: the runtime record's PID is the manager's main PID, or that
+ * PID's direct child (the job execs the Node launcher, which runs the Bun proxy as its child).
+ *
+ * Plain synchronous ESM because `bin/ocx.mjs` runs under Node, cannot import TypeScript, and
+ * keeps straight-line control flow; `src/update/index.ts` composes the same pieces with its own
+ * asynchronous identity wait.
+ */
+
+/** Must match `LABEL` / `TASK` in src/service/state.ts; a test pins the pairing. */
+export const LAUNCHD_SERVICE_LABEL = "com.opencodex.proxy";
+export const SYSTEMD_SERVICE_UNIT = "opencodex-proxy";
+
+function positivePid(value) {
+  if (typeof value !== "string" || !/^\d+$/.test(value.trim())) return null;
+  const pid = Number(value.trim());
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+
+function defaultRun(file, args) {
+  // An armed test process must never reach the developer's real launchd or systemd job;
+  // same refusal as `assertLiveServiceManagerAllowed` for the TypeScript service layer.
+  if (process.env.OCX_TEST_HOME_GUARD === "1") {
+    return { ok: false, stdout: "", stderr: `refusing to run ${file} from an armed test process` };
+  }
+  // A bare SSH session has no user-bus address; systemd's user manager still lives at the
+  // conventional runtime directory (same fallback as the service layer's ensureUserBusEnv).
+  const env = file === "systemctl" && !process.env.XDG_RUNTIME_DIR && typeof process.getuid === "function"
+    ? { ...process.env, XDG_RUNTIME_DIR: `/run/user/${process.getuid()}` }
+    : process.env;
+  const result = spawnSync(file, args, { encoding: "utf8", timeout: 20_000, windowsHide: true, env });
+  if (result.error) {
+    // A timeout kills only the waiting client; the manager's queued job keeps running.
+    const timedOut = result.error.code === "ETIMEDOUT";
+    return { ok: false, stdout: "", stderr: String(result.error.message ?? ""), ...(timedOut ? { timedOut } : {}) };
+  }
+  return { ok: result.status === 0, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "").trim() };
+}
+
+function launchdTarget(uid) {
+  return `gui/${uid}/${LAUNCHD_SERVICE_LABEL}`;
+}
+
+/** `launchctl print` reports a running job as a `pid = <n>` line. */
+export function parseLaunchdJobPid(printOutput) {
+  const match = /^\s*pid\s*=\s*(\d+)\s*$/m.exec(String(printOutput ?? ""));
+  return positivePid(match?.[1]);
+}
+
+/** `systemctl show -p MainPID` prints `MainPID=<n>`; 0 means not running. */
+export function parseSystemdMainPid(showOutput) {
+  const match = /^MainPID=(\d+)\s*$/m.exec(String(showOutput ?? ""));
+  return positivePid(match?.[1]);
+}
+
+function resolve(deps) {
+  const platform = deps.platform ?? process.platform;
+  const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
+  return { platform, uid, run: deps.run ?? defaultRun };
+}
+
+/** Whether this platform has a manager this module can ask (launchd or systemd). */
+export function hasRestartableServiceManager(deps = {}) {
+  const { platform } = resolve(deps);
+  return platform === "darwin" || platform === "linux";
+}
+
+/**
+ * Ask the manager to restart the job in place. Never throws. `unsettled` means the client gave up
+ * waiting while the manager may still complete the restart: callers must not start a competing
+ * proxy on that answer.
+ */
+export function restartServiceManagerJob(deps = {}) {
+  const { platform, uid, run } = resolve(deps);
+  const result = platform === "darwin"
+    ? run("/bin/launchctl", ["kickstart", "-k", launchdTarget(uid)])
+    : platform === "linux"
+      ? run("systemctl", ["--user", "restart", SYSTEMD_SERVICE_UNIT])
+      : null;
+  if (result === null) return { ok: false, reason: "no launchd or systemd manager on this platform" };
+  if (result.timedOut) return { ok: false, unsettled: true, reason: "the service manager did not finish the restart in time" };
+  if (!result.ok) return { ok: false, reason: result.stderr.split("\n")[0] || "the service manager refused the restart" };
+  return { ok: true };
+}
+
+/** The manager's main PID for the job, or null when it reports none. Never throws. */
+export function readServiceManagerPid(deps = {}) {
+  const { platform, uid, run } = resolve(deps);
+  if (platform === "darwin") {
+    const printed = run("/bin/launchctl", ["print", launchdTarget(uid)]);
+    return printed.ok ? parseLaunchdJobPid(printed.stdout) : null;
+  }
+  if (platform === "linux") {
+    const shown = run("systemctl", ["--user", "show", "-p", "MainPID", SYSTEMD_SERVICE_UNIT]);
+    return shown.ok ? parseSystemdMainPid(shown.stdout) : null;
+  }
+  return null;
+}
+
+/** Parent PID of a process, or null when it cannot be read. Never throws. */
+export function readParentPid(pid, deps = {}) {
+  const { run } = resolve(deps);
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  const result = run("ps", ["-o", "ppid=", "-p", String(pid)]);
+  return result.ok ? positivePid(result.stdout) : null;
+}
+
+/**
+ * Whether the serving proxy is the manager's job. `parentPid` is consulted only when the
+ * serving PID is not the manager's own.
+ */
+export function supervisionVerdict({ servingPid, managerPid, parentPid }) {
+  if (!Number.isSafeInteger(servingPid) || servingPid <= 0) {
+    return { kind: "failed", reason: "the manager restarted the job but no proxy answered" };
+  }
+  if (!Number.isSafeInteger(managerPid) || managerPid <= 0) {
+    return { kind: "failed", reason: "the manager reports no running process for the job" };
+  }
+  if (servingPid === managerPid || parentPid(servingPid) === managerPid) {
+    return { kind: "supervised", managerPid, servingPid };
+  }
+  return { kind: "failed", reason: `the serving proxy (pid ${servingPid}) is not the manager's job (pid ${managerPid})` };
+}
+
+/**
+ * The serving PID to judge after a restart: a record still naming the pre-restart process is not
+ * evidence about the restarted one.
+ */
+export function freshServingPid(recordPid, staleRecordPid) {
+  return Number.isSafeInteger(recordPid) && recordPid > 0 && recordPid !== staleRecordPid ? recordPid : null;
+}
+
+/** The warning printed when an update had to leave a proxy the manager does not own. */
+export function unsupervisedRuntimeWarning(port) {
+  return [
+    `⚠️  The proxy on port ${port} is running UNSUPERVISED: the background service manager did not take it back after the update.`,
+    "   A crash will not be restarted, and a later service start can race it for the port.",
+    "   Run 'ocx service repair' to hand it back to the background service.",
+  ].join("\n");
+}
+
+/** The warning printed when the manager may still be restarting; no second proxy is started. */
+export function unsettledManagerWarning(port) {
+  return [
+    `⚠️  The service manager is still restarting the proxy on port ${port}; no second proxy was started.`,
+    "   Check it with 'ocx service status', and run 'ocx service repair' if it does not come back.",
+  ].join("\n");
+}

package/src/usage/cache-diagnostic.ts

@@ -294,11 +294,13 @@ export function appendFinalCacheDiagnostic(facts: CacheDiagnosticFinalFacts): vo
 
 const CACHE_DIAGNOSTIC_HOOK = Symbol.for("opencodex.cache-diagnostic.v1");
 interface CacheDiagnosticHooks {
+  enabled(): boolean;
   observeInbound(body: unknown, headers: Headers, source: PromptCacheKeySource): CacheDiagnosticDraft;
   rebind(body: unknown, draft: CacheDiagnosticDraft | undefined): void;
   finalize(facts: CacheDiagnosticFinalFacts): void;
 }
 (globalThis as Record<symbol, CacheDiagnosticHooks | undefined>)[CACHE_DIAGNOSTIC_HOOK] = {
+  enabled: isCacheDiagnosticEnabled,
   observeInbound,
   rebind: rebindCacheDiagnosticBodyAlias,
   finalize: appendFinalCacheDiagnostic,

package/src/usage/cost.ts

@@ -15,6 +15,7 @@ import {
   resolveMetadataProvider,
 } from "../generated/model-metadata";
 import type { AttemptTierOutcome, OcxUsage } from "../types";
+import type { PromptLengthPricing } from "../types/provider";
 import { canonicalFastTierMarker } from "../providers/fastwire";
 import { baseProviderLabel } from "../providers/label";
 import type { PersistedUsageAttempt, UsageStatus } from "./log";
@@ -79,6 +80,7 @@ export interface MatchedPrice {
   modelId: string;
   jawcodeProvider?: string;
   cost4: Cost4;
+  promptLengthPricing?: PromptLengthPricing;
   source: "jawcode" | "expected" | "user";
   sourceRef?: string;
   verifiedAt?: string;
@@ -97,6 +99,8 @@ export interface AttemptCostEstimate {
   priorityMultiplier?: number;
   /** Set when the published long-context rate was applied (#908). */
   contextTier?: ContextTierName;
+  /** User absolute rates selected for this attempt, separate from catalog tiers. */
+  customThresholdApplied?: true;
   /** The numeric estimate is a known floor because the exact Priority price is unavailable. */
   priorityLowerBound?: boolean;
 }
@@ -111,6 +115,8 @@ export interface CostEstimate {
   priorityMultiplier?: number;
   /** Set when any priced attempt used the published long-context rate (#908). */
   contextTier?: ContextTierName;
+  /** At least one request/attempt selected the user threshold rates. */
+  customThresholdApplied?: true;
   /** The aggregate is a known floor because every priced attempt is a lower bound. */
   priorityLowerBound?: boolean;
 }
@@ -343,6 +349,7 @@ function userOverlayMatch(
     modelId,
     cost4: overlay.cost4,
     source: "user",
+    ...(overlay.promptLengthPricing ? { promptLengthPricing: overlay.promptLengthPricing } : {}),
     sourceRef: overlay.source,
     verifiedAt: overlay.verifiedAt,
     status: "verified",
@@ -397,6 +404,15 @@ function vendorPrefixedCost(modelId: string): ReturnType<typeof findVendorCostBy
   return normalize(found.provider) === normalize(claimedVendor) ? found : undefined;
 }
 
+/**
+ * Only measured usage is priced. An `unreported` or `unsupported` row can still carry tokens — a
+ * combo whose first leg failed without usage keeps the second leg's — and pricing them reports an
+ * understated cost as if it were complete.
+ */
+export function isMeasuredStatus(usageStatus: UsageStatus): boolean {
+  return usageStatus === "reported" || usageStatus === "estimated";
+}
+
 function isEstimated(usage: OcxUsage, usageStatus: UsageStatus, priceStatus: ExpectedPriceStatus | "verified"): boolean {
   return usage.estimated === true || usageStatus === "estimated" || priceStatus === "verified-derived";
 }
@@ -475,8 +491,8 @@ function isConfirmedFast(tier?: ServiceTierInput): boolean {
 }
 
 /**
- * Apply the published long-context rate when raw prompt size crosses the vendor
- * threshold. Returns [effectiveCost4, tierName].
+ * Select user prompt-length rates, or apply the published context rule in automatic mode.
+ * Returns [effectiveCost4, catalogTier, priorityLowerBound, customThresholdApplied].
  *
  * `rawInputTokens` MUST be `usage.inputTokens` (total prompt size), never the
  * normalized billable input — normalization subtracts cache read/write, so a
@@ -486,13 +502,27 @@ function isConfirmedFast(tier?: ServiceTierInput): boolean {
  * API rows can stack the bands. xAI publishes neither a combined rate nor an exclusion,
  * so its long-context rate remains the known lower bound instead of inventing a stacked multiplier.
  */
-function applyContextTier(
+function applyPromptLengthPricing(
   cost4: Cost4,
   provider: string,
   modelId: string,
   rawInputTokens: number | undefined,
   tier?: ServiceTierInput,
-): [Cost4, ContextTierName | undefined, boolean] {
+  policy?: PromptLengthPricing,
+): [Cost4, ContextTierName | undefined, boolean, true?] {
+  // A user policy replaces the catalog rule on BOTH sides of its threshold.
+  // Keep custom provenance separate while honoring the published Priority relation.
+  if (policy?.mode === "flat") return [cost4, undefined, false];
+  if (policy?.mode === "custom") {
+    const crossed = rawInputTokens !== undefined && Number.isFinite(rawInputTokens)
+      && (policy.comparison === "gte"
+        ? rawInputTokens >= policy.thresholdTokens : rawInputTokens > policy.thresholdTokens);
+    if (!crossed) return [cost4, undefined, false];
+    const relation = findContextTier(provider, modelId)?.confirmedPriorityRelation;
+    const confirmedFast = isConfirmedFast(tier);
+    if (confirmedFast && relation === "exclusive") return [cost4, undefined, false];
+    return [policy.rates, undefined, confirmedFast && relation === "lower-bound", true];
+  }
   if (rawInputTokens === undefined) return [cost4, undefined, false];
   const rule = findContextTier(provider, modelId);
   if (!rule || !isLongContext(rule, rawInputTokens)) return [cost4, undefined, false];
@@ -520,9 +550,12 @@ function applyPriorityMultiplier(
   modelId: string,
   serviceTier?: ServiceTierInput,
   contextTier?: ContextTierName,
+  customThresholdApplied?: true,
 ): [Cost4, number] {
   if (canonicalFastTierMarker(tierScalar(serviceTier)) !== "priority") return [cost4, 1];
   if (contextTier && findContextTier(provider, modelId)?.confirmedPriorityRelation !== "stack") return [cost4, 1];
+  if (customThresholdApplied && isConfirmedFast(serviceTier)
+    && findContextTier(provider, modelId)?.confirmedPriorityRelation === "lower-bound") return [cost4, 1];
   const rule = findPriorityPricingRule(provider, modelId);
   if (rule?.requiresResponseConfirmation && !isConfirmedFast(serviceTier)) return [cost4, 1];
   const multiplier = rule?.multiplier ?? 1;
@@ -568,7 +601,7 @@ export function estimateAttemptCost(
   serviceTier?: ServiceTierInput,
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),
 ): AttemptCostEstimate | null {
-  if (!attempt.usage) return null;
+  if (!isMeasuredStatus(attempt.usageStatus) || !attempt.usage) return null;
   const tokens = normalizeCostTokens(attempt.usage);
   if (!tokens) return null;
   const price = resolveMatchedPrice(attempt.provider, attempt.model, overlays, userOverlays, attempt);
@@ -576,11 +609,11 @@ export function estimateAttemptCost(
   const attemptServiceTier = attempt.tierOutcome
     ? serviceTierContextFromOutcome(attempt.tierOutcome)
     : serviceTier;
-  const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
-    price.cost4, price.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier,
+  const [tieredCost4, contextTier, contextPriorityLowerBound, customThresholdApplied] = applyPromptLengthPricing(
+    price.cost4, price.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier, price.promptLengthPricing,
   );
   const [effectiveCost4, multiplier] = applyPriorityMultiplier(
-    tieredCost4, price.provider, attempt.model, attemptServiceTier, contextTier,
+    tieredCost4, price.provider, attempt.model, attemptServiceTier, contextTier, customThresholdApplied,
   );
   const priorityLowerBound = contextPriorityLowerBound
     || isOpenRouterPriorityLowerBound(price.provider, attempt.tierOutcome);
@@ -594,6 +627,7 @@ export function estimateAttemptCost(
     estimated: isEstimated(attempt.usage, attempt.usageStatus, price.status),
     ...(multiplier !== 1 ? { priorityMultiplier: multiplier } : {}),
     ...(contextTier ? { contextTier } : {}),
+    ...(customThresholdApplied ? { customThresholdApplied } : {}),
     ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
   };
 }
@@ -637,6 +671,7 @@ export function estimateComboCost(
       ? { priorityMultiplier: estimates.find(est => est.priorityMultiplier)?.priorityMultiplier }
       : {}),
     ...(estimates.some(est => est.contextTier) ? { contextTier: "long" as const } : {}),
+    ...(estimates.some(est => est.customThresholdApplied) ? { customThresholdApplied: true as const } : {}),
     ...(estimates.every(est => est.priorityLowerBound === true)
       ? { priorityLowerBound: true as const }
       : {}),
@@ -656,16 +691,16 @@ export function estimateRequestCost(
   overlays: readonly ExpectedPriceOverlay[] = EXPECTED_PRICE_OVERLAYS,
   userOverlays: readonly ExpectedPriceOverlay[] = activeUserCostOverlays(),
 ): CostEstimate | null {
-  if (!input.usage) return null;
+  if (!isMeasuredStatus(input.usageStatus) || !input.usage) return null;
   const tokens = normalizeCostTokens(input.usage);
   if (!tokens) return null;
   const price = resolveMatchedPrice(input.provider, input.model, overlays, userOverlays, input);
   if (!price) return null;
-  const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
-    price.cost4, price.provider, input.model, input.usage.inputTokens, input.serviceTier,
+  const [tieredCost4, contextTier, contextPriorityLowerBound, customThresholdApplied] = applyPromptLengthPricing(
+    price.cost4, price.provider, input.model, input.usage.inputTokens, input.serviceTier, price.promptLengthPricing,
   );
   const [effectiveCost4, multiplier] = applyPriorityMultiplier(
-    tieredCost4, price.provider, input.model, input.serviceTier, contextTier,
+    tieredCost4, price.provider, input.model, input.serviceTier, contextTier, customThresholdApplied,
   );
   const priorityLowerBound = contextPriorityLowerBound || isOpenRouterPriorityLowerBound(
     price.provider,
@@ -678,6 +713,7 @@ export function estimateRequestCost(
     estimated: isEstimated(input.usage, input.usageStatus, price.status),
     ...(multiplier !== 1 ? { priorityMultiplier: multiplier } : {}),
     ...(contextTier ? { contextTier } : {}),
+    ...(customThresholdApplied ? { customThresholdApplied } : {}),
     ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
   };
 }

package/src/usage/expected-prices.ts

@@ -10,6 +10,7 @@ import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
 export function pricingFamilyProvider(provider: string): string {
   return isAnthropicInstanceId(provider) ? "anthropic" : provider;
 }
+import type { PromptLengthPricing } from "../types/provider";
 
 /**
  * Expected-price overlay for models whose jawcode cost rows are missing or all-zero
@@ -46,6 +47,8 @@ export interface ExpectedPriceOverlay {
   provider: string;
   modelId: string;
   cost4: Cost4;
+  /** User-owned context policy; catalog rows leave this absent. */
+  promptLengthPricing?: PromptLengthPricing;
   source: string;
   verifiedAt: string;
   status: ExpectedPriceStatus;
@@ -88,6 +91,10 @@ const GEMINI_37_FLASH: Cost4 = { input: 0.75, output: 3.75, cacheRead: 0.075, ca
 // rising to $1.50 / $7.50 on 2027-01-01. A SEPARATE constant on purpose: equal today, but
 // aliasing them would silently drag 3.8 along if 3.7's row is ever re-verified differently.
 const GEMINI_38_FLASH: Cost4 = { input: 0.75, output: 3.75, cacheRead: 0.075, cacheWrite: 0 };
+// Gemini 4 Argon introductory paid-tier rate: $2 in / $10 out (thinking included) / $0.10 cached
+// per 1M through 2026-11-30, stepping up to $4 / $20 / $0.20 on 2026-12-01. Revisit this row
+// then. No free tier. Implicit caching only, so there is no per-token cache-write price.
+const GEMINI_4_ARGON: Cost4 = { input: 2, output: 10, cacheRead: 0.1, cacheWrite: 0 };
 const MINIMAX_M21_HIGHSPEED: Cost4 = { input: 0.6, output: 2.4, cacheRead: 0.03, cacheWrite: 0.375 };
 const KIMI_K3: Cost4 = { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3 };
 const KIMI_K27_CODE: Cost4 = { input: 0.95, output: 4, cacheRead: 0.19, cacheWrite: 0.95 };
@@ -200,6 +207,7 @@ export function cursorFastPriceSource(provider: string, modelId: string): string
 
 const GEMINI_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-07-22); cacheWrite=0: storage is billed per-hour, not per-token";
 const GEMINI_37_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-08-14); promotional rate through 2026-12-31, rises to 1.50/7.50 on 2027-01-01; cacheWrite=0: storage is billed per-hour, not per-token";
+const GEMINI_4_ARGON_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-10-14); introductory rate through 2026-11-30, rises to 4/20 (0.20 cached) on 2026-12-01; cacheWrite=0: implicit caching only";
 const GEMINI_38_PRICING = "https://ai.google.dev/gemini-api/docs/pricing (2026-09-03); promotional rate through 2026-12-31, rises to 1.50/7.50 on 2027-01-01; cacheWrite=0: storage is billed per-hour, not per-token";
 const MINIMAX_PRICING = "https://platform.minimax.io/docs/guides/pricing-paygo";
 const OPENAI_GPT56_PRICING = "https://developers.openai.com/api/docs/pricing";
@@ -346,6 +354,12 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // 3.7 Flash rides CCA, whose billing equivalence to the Developer API list price is
   // not published, so this is `verified-derived` rather than `verified`: the number is
   // proven, the claim that Antigravity charges it is inferred.
+  // Gemini 4 Argon on Antigravity (AI Ultra / Enterprise only): the picker id plus its three
+  // verified CCA wire ids. Billing equivalence to the API price is inferred.
+  { provider: "google-antigravity", modelId: "gemini-4-argon", cost4: GEMINI_4_ARGON, source: `derived: Gemini 4 Argon introductory rate through 2026-11-30 ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "gemini-4-argon-low", cost4: GEMINI_4_ARGON, source: `derived: gemini-4-argon ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "gemini-4-argon-medium", cost4: GEMINI_4_ARGON, source: `derived: gemini-4-argon ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
+  { provider: "google-antigravity", modelId: "gemini-4-argon-high", cost4: GEMINI_4_ARGON, source: `derived: gemini-4-argon ${GEMINI_4_ARGON_PRICING}`, verifiedAt: "2026-10-14", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gemini-3.8-flash", cost4: GEMINI_38_FLASH, source: `derived: Gemini 3.8 Flash promotional rate through 2026-12-31 ${GEMINI_38_PRICING}`, verifiedAt: "2026-09-03", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gemini-3.8-flash-low", cost4: GEMINI_38_FLASH, source: `derived: gemini-3.8-flash ${GEMINI_38_PRICING}`, verifiedAt: "2026-09-03", status: "verified-derived" },
   { provider: "google-antigravity", modelId: "gemini-3.8-flash-medium", cost4: GEMINI_38_FLASH, source: `derived: gemini-3.8-flash ${GEMINI_38_PRICING}`, verifiedAt: "2026-09-03", status: "verified-derived" },
@@ -403,6 +417,7 @@ export const EXPECTED_PRICE_OVERLAYS: readonly ExpectedPriceOverlay[] = [
   // Developer API row: the price IS published for this surface, so `verified`.
   { provider: "google", modelId: "gemini-3.7-flash", cost4: GEMINI_37_FLASH, source: GEMINI_37_PRICING, verifiedAt: "2026-08-14", status: "verified" },
   { provider: "google", modelId: "gemini-3.8-flash", cost4: GEMINI_38_FLASH, source: GEMINI_38_PRICING, verifiedAt: "2026-09-03", status: "verified" },
+  { provider: "google", modelId: "gemini-4-argon", cost4: GEMINI_4_ARGON, source: GEMINI_4_ARGON_PRICING, verifiedAt: "2026-10-14", status: "verified" },
   { provider: "google-antigravity", modelId: "gemini-3.1-pro-preview", cost4: GEMINI_31_PRO, source: GEMINI_PRICING, verifiedAt: "2026-07-20", status: "verified" },
   // Antigravity-bundled third-party models — derived from the underlying vendor's
   // official API price (Antigravity itself bills via subscription quota).

package/src/usage/ledger-retention.ts

@@ -22,6 +22,7 @@ import { closeSync, fstatSync, openSync, readSync, writeSync } from "node:fs";
 import { atomicWriteFileStreamed } from "../config/atomic-write";
 import {
   currentUsageLogRevision,
+  exactFileIdentity,
   usageLogIdentityKey,
   usageLogPath,
   usageLogRevisionKey,
@@ -127,7 +128,7 @@ export function enforceUsageLedgerSizeLimit(
   let sourceClosed = false;
   try {
     const opened = fstatSync(sourceFd);
-    if (Number(opened.size) !== captured.size || Number(opened.ino) !== captured.ino) {
+    if (Number(opened.size) !== captured.size || exactFileIdentity(sourceFd).ino !== captured.ino) {
       return { kind: "deferred", currentBytes: captured.size, reason: "revision-changed" };
     }
     const start = firstRowBoundary(sourceFd, Math.max(0, captured.size - target), captured.size);

package/src/usage/ledger-scanner.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
 import {
   currentUsageLogRevision,
+  exactFileIdentity,
   normalizePersistedUsageRow,
   usageLogIdentityKey,
   usageLogPath,
@@ -63,13 +64,13 @@ export class UsageLedgerRebuildRequiredError extends Error {
 
 function revisionFromStat(
   path: string,
+  fd: number,
   stat: ReturnType<typeof fstatSync>,
 ): UsageLogRevision {
   if (!stat.isFile()) throw new Error("usage log is not a regular file");
   return {
     path,
-    dev: Number(stat.dev),
-    ino: Number(stat.ino),
+    ...exactFileIdentity(fd),
     birthtimeMs: Number(stat.birthtimeMs),
     size: Number(stat.size),
     mtimeMs: Number(stat.mtimeMs),
@@ -276,7 +277,7 @@ export async function scanUsageLedgerCooperatively(
   let pendingLineBytes = 0;
 
   try {
-    const openedRevision = revisionFromStat(path, fstatSync(fd));
+    const openedRevision = revisionFromStat(path, fd, fstatSync(fd));
     const scanEnd = openedRevision.size;
     const openedIdentityKey = usageLogIdentityKey(openedRevision);
     if (options.expectedIdentityKey && options.expectedIdentityKey !== openedIdentityKey) {
@@ -391,7 +392,7 @@ export async function scanUsageLedgerCooperatively(
     }
 
     throwIfAborted(options.signal);
-    const endingRevision = revisionFromStat(path, fstatSync(fd));
+    const endingRevision = revisionFromStat(path, fd, fstatSync(fd));
     if (usageLogIdentityKey(endingRevision) !== openedIdentityKey) {
       throw rebuildRequired("identity_mismatch");
     }
@@ -417,7 +418,7 @@ export async function scanUsageLedgerCooperatively(
         line,
         options.signal,
       );
-      const verifiedFdRevision = revisionFromStat(path, fstatSync(fd));
+      const verifiedFdRevision = revisionFromStat(path, fd, fstatSync(fd));
       const verifiedPathRevision = currentUsageLogRevision();
       if (capturedDigest !== verifiedDigest) throw rebuildRequired("content_changed");
       if (!verifiedPathRevision

package/src/usage/log.ts

@@ -1163,8 +1163,12 @@ export function appendUsageEntry(entry: PersistedUsageEntry): void {
 
 export type UsageLogRevision = {
   path: string;
-  dev: number;
-  ino: number;
+  /**
+   * Exact decimal device and file id. NTFS file ids carry a sequence number in their
+   * high bits and routinely exceed 2^53, so a Number would let two files compare equal.
+   */
+  dev: string;
+  ino: string;
   birthtimeMs: number;
   size: number;
   mtimeMs: number;
@@ -1367,12 +1371,17 @@ function readExactly(fd: number, length: number, position: number): Buffer | nul
   return output;
 }
 
-function usageLogRevision(path: string, stat: ReturnType<typeof fstatSync>): UsageLogRevision {
+/** Exact dev/ino of an open file, read through bigint stats so large ids keep every bit. */
+export function exactFileIdentity(fd: number): { dev: string; ino: string } {
+  const exact = fstatSync(fd, { bigint: true });
+  return { dev: exact.dev.toString(), ino: exact.ino.toString() };
+}
+
+function usageLogRevision(path: string, fd: number, stat: ReturnType<typeof fstatSync>): UsageLogRevision {
   if (!stat.isFile()) throw new Error("usage log is not a regular file");
   return {
     path,
-    dev: Number(stat.dev),
-    ino: Number(stat.ino),
+    ...exactFileIdentity(fd),
     birthtimeMs: Number(stat.birthtimeMs),
     size: Number(stat.size),
     mtimeMs: Number(stat.mtimeMs),
@@ -1405,7 +1414,7 @@ export function currentUsageLogRevision(): UsageLogRevision | null {
   let fd: number | undefined;
   try {
     fd = openSync(path, "r");
-    return usageLogRevision(path, fstatSync(fd));
+    return usageLogRevision(path, fd, fstatSync(fd));
   } finally {
     if (fd !== undefined) closeSync(fd);
   }
@@ -1530,7 +1539,7 @@ async function readUsageEntriesFullCooperatively(
     if (prefixDigest === null) throw new Error("usage log changed while it was being read");
     return {
       entries: parsed.entries,
-      revision: usageLogRevision(path, stat),
+      revision: usageLogRevision(path, fd, stat),
       truncatedPrefixBytes,
       entriesTruncated: parsed.entriesDropped > 0,
       entriesDropped: parsed.entriesDropped,
@@ -1562,7 +1571,7 @@ async function readUsageEntriesIncrementally(
   try {
     fd = openSync(path, "r");
     const stat = fstatSync(fd);
-    const revision = usageLogRevision(path, stat);
+    const revision = usageLogRevision(path, fd, stat);
     if (usageLogIdentityKey(revision) !== retained.identityKey) return null;
     const size = Number(stat.size);
     // A shrink means truncation or replacement-in-place; the retained rows may no

package/src/usage/summary.ts

@@ -10,7 +10,7 @@ import {
   type PersistedUsageEntry,
   type UsageStatus,
 } from "./log";
-import { type AttemptCostEstimate, type CostEstimate, estimateAttemptCost, estimateRequestCost, serviceTierContext, type ServiceTierContext, tokensPerSecond } from "./cost";
+import { type AttemptCostEstimate, type CostEstimate, estimateAttemptCost, estimateRequestCost, isMeasuredStatus, serviceTierContext, type ServiceTierContext, tokensPerSecond } from "./cost";
 
 /**
  * Canonical range members. The warm-up loop in the management usage route
@@ -303,7 +303,10 @@ export function computeEntryCost(entry: PersistedUsageEntry): EntryCostInfo {
         isPriced = true;
       }
     }
-    return { tier, estimate: null, attemptEstimates, costTotal, isPriced };
+    // An unmeasured leg that may have generated billed tokens leaves the total unknown, not short.
+    const unknownCost = entry.attempts.some((attempt, index) =>
+      !attemptEstimates[index] && (!attempt.usage || !isMeasuredStatus(attempt.usageStatus)) && !spentNothing(attempt));
+    return { tier, estimate: null, attemptEstimates, costTotal, isPriced: isPriced && !unknownCost };
   }
   const estimate = estimateRequestCost({
     ...usageModelPriceOptions(entry, entry),
@@ -428,10 +431,6 @@ function blankTotals(): UsageSummaryTotals {
   };
 }
 
-function isMeasuredStatus(status: UsageStatus): boolean {
-  return status === "reported" || status === "estimated";
-}
-
 export interface UsageAttribution {
   requestId: string;
   provider: string;
@@ -814,14 +813,28 @@ function blankRequestCounts(): UsageRequestCounts {
   };
 }
 
+/**
+ * A usage-less attempt that provably cost nothing: it never reached upstream, or upstream refused it
+ * with an HTTP error before any output (providers do not bill a pre-generation 429/401/5xx). One
+ * whose stream began, aborted, or ended without a status may have generated billed tokens, so it
+ * stays an unknown cost. A request made only of such zeros carries neither fact and counts unpriced.
+ */
+function spentNothing(attempt: NonNullable<PersistedUsageEntry["attempts"]>[number] | undefined): boolean {
+  if (!attempt || attempt.usage) return false;
+  if (attempt.sendCount === 0 || attempt.locallyAnswered === true) return true;
+  return attempt.status >= 400 && attempt.streamAborted !== true && attempt.firstOutputMs === undefined;
+}
+
 function bumpRequestCounts(counts: UsageRequestCounts, facts: number, amount = 1): void {
   counts.requests += amount;
   const status = statusFromRequestFacts(facts);
   if (isMeasuredStatus(status)) counts.measuredRequests += amount;
   if (status === "reported") counts.reportedRequests += amount;
   else if (status === "estimated") counts.estimatedRequests += amount;
-  if ((facts & REQUEST_PRICED) !== 0) counts.pricedRequests += amount;
-  if ((facts & REQUEST_UNPRICED) !== 0) counts.unpricedRequests += amount;
+  // Unpriced dominates: one unpriceable part makes the request's cost unknown, and counting it
+  // on both sides overstated price coverage.
+  if ((facts & REQUEST_PRICED) !== 0 && (facts & REQUEST_UNPRICED) === 0) counts.pricedRequests += amount;
+  else counts.unpricedRequests += amount;
 }
 
 function mergeRequestCounts(target: UsageRequestCounts, source: UsageRequestCounts): void {
@@ -1557,7 +1570,7 @@ class StreamingUsageSummaryAccumulator implements UsageSummaryAccumulator {
         : costInfo.estimate;
       const ordinal = this.nextOrdinal++;
       const facts = requestStatusFact(attribution.usageStatus)
-        | (estimate ? REQUEST_PRICED : REQUEST_UNPRICED);
+        | (estimate ? REQUEST_PRICED : spentNothing(entry.attempts?.[index]) ? 0 : REQUEST_UNPRICED);
       const modelKey = this.addModelAttribution(partition, attribution, estimate, ordinal);
       modelFacts.set(modelKey, (modelFacts.get(modelKey) ?? 0) | facts);
       if (this.mode === "row-unique") {