instar 1.3.125 → 1.3.126

package/dist/providers/adapters/openai-codex/observability/sessionPaths.d.ts

@@ -28,25 +28,33 @@ export declare function findRolloutFileSync(threadId: string, codexHome?: string
 /**
  * List rollout files under $CODEX_HOME/sessions, newest first (by mtime).
  *
- * Codex partitions rollouts by date: `sessions/YYYY/MM/DD/rollout-*.jsonl`. A
- * busy account accumulates tens of thousands of these over time (one real
- * machine: 14k files / 1.4 GB). The previous implementation walked AND
- * `stat`ed EVERY file on every call before slicing to `limit`, which made
- * callers like `GET /codex/usage` and the TokenLedger scan take tens of
- * seconds (the route timed out) on a large history.
+ * Codex partitions rollouts by date: `sessions/YYYY/MM/DD/rollout-<ts>-<uuid>.jsonl`.
+ * A busy account accumulates tens of thousands of these (one real machine: 14k
+ * files / 1.4 GB). The original implementation `stat`ed EVERY file before
+ * slicing to `limit`; an interim fix narrowed that to the newest partitions but
+ * still `stat`ed every file in them (~3.6k on the same machine) — fast in a
+ * healthy process, but catastrophic when the server's event loop is CPU-starved
+ * (each `await fs.stat` needs a loop turn), which is exactly when `GET
+ * /codex/usage` timed out.
  *
- * This walks the date-partition directories in DESCENDING date order and
- * `stat`s only the rollout files in the newest partitions, stopping once it has
- * `limit` candidates (after covering >= MIN_PARTITIONS_SCANNED non-empty
- * partitions, so a day is never cut mid-way and the cross-midnight boundary is
- * covered). Work is bounded to the most-recent partitions instead of the entire
- * history. Trade-off: "newest by mtime" becomes "newest among the most-recent
- * date partitions, then by mtime" — for the rate-limit reader this is exact
- * (the account-wide windows are identical across any recently-active session),
- * and for the resume/token-ledger callers a session older than the scanned
- * partitions yet still the single most-recently-touched file is the only miss,
- * which is vanishingly rare in practice. A non-date-partitioned layout falls
- * back to the original full walk (correctness over speed).
+ * This avoids the per-file `stat` storm entirely:
+ *   1. Enumerate date-partition dirs newest-first; `readdir` (one syscall each,
+ *      NO per-file stat) the newest partitions to collect candidate PATHS until
+ *      we have >= `limit * STAT_OVERSCAN` of them AND have covered >=
+ *      MIN_PARTITIONS_SCANNED non-empty partitions.
+ *   2. Sort candidates DESCENDING by path — the zero-padded `YYYY/MM/DD` dir +
+ *      `rollout-<ISO-ish-ts>` filename make a lexicographic sort chronological
+ *      by CREATION time, no `stat` needed.
+ *   3. `stat` ONLY the top `limit * STAT_OVERSCAN` candidates for the
+ *      authoritative mtime, sort by mtime, return the newest `limit`.
+ *
+ * So a `limit`-8 call does ~32 `stat`s instead of ~3.6k. Trade-off: "newest by
+ * mtime" becomes "newest by mtime among the newest-created candidates" — exact
+ * for the rate-limit reader (account-wide windows are identical across any
+ * recently-active session); the only miss for the resume/token-ledger callers is
+ * a session whose creation is older than the newest `limit * STAT_OVERSCAN` yet
+ * is still the single most-recently-touched file — vanishingly rare. A
+ * non-date-partitioned layout falls back to the original full walk.
  */
 export declare function listAllRollouts(codexHome?: string, limit?: number): Promise<ReadonlyArray<{
     path: string;

package/dist/providers/adapters/openai-codex/observability/sessionPaths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionPaths.d.ts","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/sessionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvF;AAyDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,SAAM,GACV,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA0CzD"}
+{"version":3,"file":"sessionPaths.d.ts","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/sessionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvF;AA+DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,eAAe,CACnC,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,SAAM,GACV,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAoDzD"}

package/dist/providers/adapters/openai-codex/observability/sessionPaths.js

@@ -100,28 +100,41 @@ async function walkForUuid(root, uuid) {
 // early break, so the cross-midnight boundary (and a session that started
 // "yesterday" but is still the most recently active) is not missed.
 const MIN_PARTITIONS_SCANNED = 2;
+// `stat` only this multiple of `limit` candidate files — the newest by the
+// timestamp embedded in their filename — to resolve the authoritative
+// newest-by-mtime. A long-running session (older filename, newer mtime) is still
+// caught as long as it is among the newest `limit * STAT_OVERSCAN` created.
+const STAT_OVERSCAN = 4;
 /**
  * List rollout files under $CODEX_HOME/sessions, newest first (by mtime).
  *
- * Codex partitions rollouts by date: `sessions/YYYY/MM/DD/rollout-*.jsonl`. A
- * busy account accumulates tens of thousands of these over time (one real
- * machine: 14k files / 1.4 GB). The previous implementation walked AND
- * `stat`ed EVERY file on every call before slicing to `limit`, which made
- * callers like `GET /codex/usage` and the TokenLedger scan take tens of
- * seconds (the route timed out) on a large history.
+ * Codex partitions rollouts by date: `sessions/YYYY/MM/DD/rollout-<ts>-<uuid>.jsonl`.
+ * A busy account accumulates tens of thousands of these (one real machine: 14k
+ * files / 1.4 GB). The original implementation `stat`ed EVERY file before
+ * slicing to `limit`; an interim fix narrowed that to the newest partitions but
+ * still `stat`ed every file in them (~3.6k on the same machine) — fast in a
+ * healthy process, but catastrophic when the server's event loop is CPU-starved
+ * (each `await fs.stat` needs a loop turn), which is exactly when `GET
+ * /codex/usage` timed out.
  *
- * This walks the date-partition directories in DESCENDING date order and
- * `stat`s only the rollout files in the newest partitions, stopping once it has
- * `limit` candidates (after covering >= MIN_PARTITIONS_SCANNED non-empty
- * partitions, so a day is never cut mid-way and the cross-midnight boundary is
- * covered). Work is bounded to the most-recent partitions instead of the entire
- * history. Trade-off: "newest by mtime" becomes "newest among the most-recent
- * date partitions, then by mtime" — for the rate-limit reader this is exact
- * (the account-wide windows are identical across any recently-active session),
- * and for the resume/token-ledger callers a session older than the scanned
- * partitions yet still the single most-recently-touched file is the only miss,
- * which is vanishingly rare in practice. A non-date-partitioned layout falls
- * back to the original full walk (correctness over speed).
+ * This avoids the per-file `stat` storm entirely:
+ *   1. Enumerate date-partition dirs newest-first; `readdir` (one syscall each,
+ *      NO per-file stat) the newest partitions to collect candidate PATHS until
+ *      we have >= `limit * STAT_OVERSCAN` of them AND have covered >=
+ *      MIN_PARTITIONS_SCANNED non-empty partitions.
+ *   2. Sort candidates DESCENDING by path — the zero-padded `YYYY/MM/DD` dir +
+ *      `rollout-<ISO-ish-ts>` filename make a lexicographic sort chronological
+ *      by CREATION time, no `stat` needed.
+ *   3. `stat` ONLY the top `limit * STAT_OVERSCAN` candidates for the
+ *      authoritative mtime, sort by mtime, return the newest `limit`.
+ *
+ * So a `limit`-8 call does ~32 `stat`s instead of ~3.6k. Trade-off: "newest by
+ * mtime" becomes "newest by mtime among the newest-created candidates" — exact
+ * for the rate-limit reader (account-wide windows are identical across any
+ * recently-active session); the only miss for the resume/token-ledger callers is
+ * a session whose creation is older than the newest `limit * STAT_OVERSCAN` yet
+ * is still the single most-recently-touched file — vanishingly rare. A
+ * non-date-partitioned layout falls back to the original full walk.
  */
 export async function listAllRollouts(codexHome, limit = 100) {
     const root = path.join(codexHomeFromConfig(codexHome), 'sessions');
@@ -134,7 +147,9 @@ export async function listAllRollouts(codexHome, limit = 100) {
         all.sort((a, b) => b.mtime - a.mtime);
         return all.slice(0, limit);
     }
-    const out = [];
+    const statTarget = Math.max(limit, 1) * STAT_OVERSCAN;
+    // Phase 1: collect candidate PATHS (readdir only — no per-file stat).
+    const candidates = [];
     let partitionsWithFiles = 0;
     for (const dir of dayDirs) {
         let entries;
@@ -148,24 +163,30 @@ export async function listAllRollouts(codexHome, limit = 100) {
         for (const entry of entries) {
             if (!entry.startsWith('rollout-') || !entry.endsWith('.jsonl'))
                 continue;
-            const full = path.join(dir, entry);
-            let stat;
-            try {
-                stat = await fs.stat(full);
-            }
-            catch {
-                continue;
-            }
-            if (stat.isFile()) {
-                out.push({ path: full, mtime: stat.mtimeMs });
-                had = true;
-            }
+            candidates.push(path.join(dir, entry));
+            had = true;
         }
         if (had)
             partitionsWithFiles++;
-        if (out.length >= limit && partitionsWithFiles >= MIN_PARTITIONS_SCANNED)
+        if (candidates.length >= statTarget && partitionsWithFiles >= MIN_PARTITIONS_SCANNED)
             break;
     }
+    // Phase 2: sort by path descending (chronological by creation), keep the top.
+    candidates.sort((a, b) => (a > b ? -1 : a < b ? 1 : 0));
+    const top = candidates.slice(0, statTarget);
+    // Phase 3: stat ONLY the top candidates for authoritative mtime.
+    const out = [];
+    for (const full of top) {
+        let stat;
+        try {
+            stat = await fs.stat(full);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isFile())
+            out.push({ path: full, mtime: stat.mtimeMs });
+    }
     out.sort((a, b) => b.mtime - a.mtime);
     return out.slice(0, limit);
 }

package/dist/providers/adapters/openai-codex/observability/sessionPaths.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionPaths.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/sessionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,OAAO,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAkB;IAElB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,OAAO,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAkB;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7G,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7G,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAkB,EAClB,KAAK,GAAG,GAAG;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAExD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,GAAG,GAA2C,EAAE,CAAC;QACvD,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9C,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,GAAG;YAAE,mBAAmB,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK,IAAI,mBAAmB,IAAI,sBAAsB;YAAE,MAAM;IAClF,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CAAC,IAAY;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,OAAe;IACvD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAA2C;IACjF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"sessionPaths.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/sessionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,OAAO,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAkB;IAElB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,OAAO,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAkB;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7G,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7G,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,2EAA2E;AAC3E,sEAAsE;AACtE,iFAAiF;AACjF,4EAA4E;AAC5E,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAkB,EAClB,KAAK,GAAG,GAAG;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAExD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,GAAG,GAA2C,EAAE,CAAC;QACvD,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC;IAEtD,sEAAsE;IACtE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACzE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACvC,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,IAAI,GAAG;YAAE,mBAAmB,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,IAAI,mBAAmB,IAAI,sBAAsB;YAAE,MAAM;IAC9F,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAE5C,iEAAiE;IACjE,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CAAC,IAAY;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,OAAe;IACvD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAA2C;IACjF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.125",
+  "version": "1.3.126",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-30T22:08:54.842Z",
-  "instarVersion": "1.3.125",
+  "generatedAt": "2026-05-30T22:30:07.950Z",
+  "instarVersion": "1.3.126",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.125.md

@@ -4,59 +4,50 @@
 
 ## What Changed
 
-**Fixed the ROOT of duplicate agent-to-agent replies: `POST /messages/relay-agent`
-now responds at the accept boundary instead of after the session spawn.** The
-co-located inbound handler used to AWAIT `handleInboundMessage` — a session
-spawn/resume that routinely takes 9-30 s — before responding. But the sender
-(`MessageRouter.relay`) uses a 5-second fetch timeout and reads only whether the
-request succeeded. So whenever the receiver's spawn outran 5 s, the sender gave
-up, retried with a fresh message id, and the receiver spawned a SECOND session →
-a duplicate reply. The content-hash dedup shipped earlier is the symptom
-backstop; this removes the cause. The handler now responds `{ ok:true,
-accepted:true, threadline:{accepted:true, async:true} }` the instant the message
-is accepted + gated, and runs the spawn in the background. Everything that must
-happen first — the dedup, the reply-waiter resolution, and the warrants-reply
-gate (including its suppress short-circuit) — still runs synchronously before the
-response. Scoped to the co-located path; the cross-machine relay-funnel path
-(which has retry-on-error semantics to preserve) is tracked separately.
+**Fixed `GET /codex/usage` still timing out on a large codex history under server
+load — by not statting thousands of files.** The previous fix (v1.3.124) narrowed
+`listAllRollouts` to the newest date-partitions, but it still `await fs.stat`-ed
+every file in them — ~3,637 on a real account. That is fast in a healthy process,
+but when the server's event loop is CPU-starved (the log showed a ~14 s drift),
+those thousands of sequential awaited stats each wait for a starved loop turn and
+the route hangs for tens of seconds. (Other endpoints were fine — they do only a
+handful of awaits.) `listAllRollouts` now finds the newest rollouts WITHOUT the
+stat storm: it `readdir`s the newest partitions to collect candidate paths (one
+syscall per dir, no per-file stat), sorts them by the creation timestamp embedded
+in the filename, and `stat`s ONLY the newest `limit * 4` candidates (~32 for the
+usage reader) for the authoritative mtime. The returned newest-N is unchanged.
+This fixes all four callers of the helper at once.
 
 ## Summary of New Capabilities
 
-- No new capability — a robustness fix. Agent-to-agent messages on the same
-  machine no longer risk a duplicate reply when the receiver's session spawn is
-  slower than the sender's 5-second delivery timeout.
+- No new capability — a performance fix. `listAllRollouts` now does ~32 file
+  stats instead of ~3,637 on a large account, so codex usage/ledger/resume reads
+  stay fast even when the server is under heavy load.
 
 ## What to Tell Your User
 
-Agents talking to each other on the same machine no longer occasionally send the
-same reply twice. The cause was that a receiving agent waited until it had fully
-spun up a session — up to half a minute — before telling the sender the message
-arrived, but the sender only waits five seconds and would resend. Now the
-receiver acknowledges the moment the message is safely accepted and does the
-slow work in the background, so the sender never times out and never resends.
-Nothing changes for you; the real reply still arrives as before, just without the
-occasional duplicate.
+The codex usage check now answers instantly even on a heavy account AND when the
+machine is under heavy load. The earlier fix already stopped it from reading the
+whole history, but it still checked the timestamp of every recent log file — a
+few thousand of them — one at a time, which stalled when the server was
+overloaded. It now reads just the list of recent filenames, picks out the newest
+by the time in the name, and only checks the real timestamps of the few most
+recent. Nothing else changes.
 
 ## Evidence
 
-**Reproduction / root cause.** Confirmed in the code: the co-located sender
-`MessageRouter.relayToAgent` (`src/messaging/MessageRouter.ts:486-510`) wraps its
-POST to `/messages/relay-agent` in `AbortSignal.timeout(5000)` and returns only
-`response.ok`. The receiver's handler awaited `handleInboundMessage` (a 9-30 s
-session spawn) before responding, so any spawn over 5 s aborted the sender's
-fetch → the sender retried with a fresh `message.id`, which slips past the
-id-based relay dedup → a second spawn and a duplicate reply. (The 2026-05-30
-duplicate-reply incidents on the echo↔codey loop are this path.)
-
-**Before / after.** Before: the response is sent only after the full spawn. After:
-the response is `{accepted:true, async:true}` sent at the accept boundary, with
-the spawn running in the background. The rewritten integration test holds the
-background handler open and asserts the HTTP response returns while the handler
-is still mid-spawn (`router-start` present, `router-end` not yet) — i.e. the
-sender is no longer made to wait. The handler still runs to completion in the
-background (not dropped); a background rejection still yields HTTP 200; the
-reply-waiter resolution and the warrants-reply gate's suppress short-circuit stay
-green; the content-hash dedup suite and the keystone gate-before-spawn wiring
-test stay green. An independent second-pass reviewer audited the change (it
-touches inbound messaging) and confirmed correctness after one artifact-honesty
-correction.
+**Reproduction.** After deploying the first fix (v1.3.124) to a server with a
+14,277-file codex history, `GET /codex/usage` STILL returned a connection timeout
+(curl status 000 after 25 s) while `/tokens/summary` (0.19 s) and `/capabilities`
+(0.38 s) on the same server were fast. The server log showed the cause:
+`[SleepWakeDetector] Drift ~14s under load ratio 1.72 — CPU starvation`. The
+reader ran in 57 ms in an isolated process and 250 ms for 5 concurrent calls — so
+the slowness was not the reader's logic but its ~3,637 sequential `await fs.stat`
+calls colliding with a starved event loop (each stat callback waits for a loop
+turn).
+
+**Before / after.** Old: ~3,637 stats per call. New: against the same live
+14,277-file / 1.4 GB tree, a `limit`-8 call does **32 stats in 14 ms**, returning
+the same newest rollout. A unit test (`fs.stat` spy) asserts the bounded stat
+count for a 206-file / 42-partition fixture; the reader / TokenLedger / resume /
+canary suites stay green.

package/upgrades/1.3.126.md

@@ -0,0 +1,53 @@
+# Instar Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Fixed `GET /codex/usage` still timing out on a large codex history under server
+load — by not statting thousands of files.** The previous fix (v1.3.124) narrowed
+`listAllRollouts` to the newest date-partitions, but it still `await fs.stat`-ed
+every file in them — ~3,637 on a real account. That is fast in a healthy process,
+but when the server's event loop is CPU-starved (the log showed a ~14 s drift),
+those thousands of sequential awaited stats each wait for a starved loop turn and
+the route hangs for tens of seconds. (Other endpoints were fine — they do only a
+handful of awaits.) `listAllRollouts` now finds the newest rollouts WITHOUT the
+stat storm: it `readdir`s the newest partitions to collect candidate paths (one
+syscall per dir, no per-file stat), sorts them by the creation timestamp embedded
+in the filename, and `stat`s ONLY the newest `limit * 4` candidates (~32 for the
+usage reader) for the authoritative mtime. The returned newest-N is unchanged.
+This fixes all four callers of the helper at once.
+
+## Summary of New Capabilities
+
+- No new capability — a performance fix. `listAllRollouts` now does ~32 file
+  stats instead of ~3,637 on a large account, so codex usage/ledger/resume reads
+  stay fast even when the server is under heavy load.
+
+## What to Tell Your User
+
+The codex usage check now answers instantly even on a heavy account AND when the
+machine is under heavy load. The earlier fix already stopped it from reading the
+whole history, but it still checked the timestamp of every recent log file — a
+few thousand of them — one at a time, which stalled when the server was
+overloaded. It now reads just the list of recent filenames, picks out the newest
+by the time in the name, and only checks the real timestamps of the few most
+recent. Nothing else changes.
+
+## Evidence
+
+**Reproduction.** After deploying the first fix (v1.3.124) to a server with a
+14,277-file codex history, `GET /codex/usage` STILL returned a connection timeout
+(curl status 000 after 25 s) while `/tokens/summary` (0.19 s) and `/capabilities`
+(0.38 s) on the same server were fast. The server log showed the cause:
+`[SleepWakeDetector] Drift ~14s under load ratio 1.72 — CPU starvation`. The
+reader ran in 57 ms in an isolated process and 250 ms for 5 concurrent calls — so
+the slowness was not the reader's logic but its ~3,637 sequential `await fs.stat`
+calls colliding with a starved event loop (each stat callback waits for a loop
+turn).
+
+**Before / after.** Old: ~3,637 stats per call. New: against the same live
+14,277-file / 1.4 GB tree, a `limit`-8 call does **32 stats in 14 ms**, returning
+the same newest rollout. A unit test (`fs.stat` spy) asserts the bounded stat
+count for a 206-file / 42-partition fixture; the reader / TokenLedger / resume /
+canary suites stay green.

package/upgrades/side-effects/codex-rollout-scan-perf-v2.md

@@ -0,0 +1,55 @@
+# Side-Effects Review — stat only the newest-created candidates (perf v2)
+
+**Version / slug:** `codex-rollout-scan-perf-v2`
+**Date:** 2026-05-30
+**Author:** Echo (instar-dev agent)
+**Second-pass reviewer:** not required (pure read-path perf optimization; no block/allow/lifecycle/decision surface)
+
+## Summary of the change
+
+`listAllRollouts` no longer `stat`s every file in the newest date-partitions
+(~3,637 on the real machine). It collects candidate paths via `readdir` (no
+per-file stat), sorts them by the creation timestamp embedded in the path, and
+`stat`s ONLY the top `limit * STAT_OVERSCAN` (= 32 for the reader). Fixes
+`GET /codex/usage` still timing out after the v1 fix because ~3,637 sequential
+`await fs.stat`s are pathological under a CPU-starved event loop (server log:
+"Drift ~14s … CPU starvation"). 14,277-file tree: 32 stats / 14 ms (was ~3,637).
+
+## Decision-point inventory
+
+- No decision point. A read helper returns a file list; only the disk-scan
+  strategy changed.
+
+---
+
+## 1. Over-block / ## 2. Under-block
+No block/allow surface. The only "miss" is the documented trade-off (a session
+created older than the newest `limit*4` yet still the single most-recently-
+touched file) — irrelevant for the rate-limit reader (account-wide windows) and
+vanishingly rare for the other callers.
+
+## 3. Level-of-abstraction fit
+Correct — the shared helper, so all four callers (codex-usage reader, TokenLedger
+scan, resume index, canary) get the speedup from one change. The filename-as-
+creation-timestamp ordering is a property of the codex layout the helper already
+encodes.
+
+## 4. Signal vs authority compliance
+Compliant — no authority; a read-only reporter.
+
+## 5. Interactions
+- **Callers:** all pass a finite `limit` and want newest-N; the bounded-stat set
+  preserves that. `readdir` returns all names in one syscall (cheap); the
+  in-memory path sort of a few thousand strings is sub-ms.
+- **No writes / no races:** read-only; opens + closes its own handles.
+- **Robust under load:** the whole point — it now makes ~32 awaits instead of
+  ~3,637, so a starved event loop no longer makes the call hang.
+
+## 6. External surfaces
+- `GET /codex/usage` becomes responsive on a heavy account even when the server
+  is CPU-starved. Response shape/semantics unchanged.
+- No new route, no message.
+
+## 7. Rollback cost
+Trivial — revert the `listAllRollouts` body to the v1 form. No data, no
+migration.