Chronicle stays enabled after a Pro → Plus downgrade, consuming the smaller allowance in the background #36805

Environment: Codex Desktop on macOS, CLI 0.146.0

Summary

Chronicle was enabled while the account held a Pro plan. The account later reverted to
Plus. Chronicle remained enabled and kept generating screen-recording summaries at roughly
51 model calls per day, consuming the majority of the Plus weekly allowance before any
interactive work happened.

Feature enablement is stored client-side and is never reconciled against the server-side
entitlement:

Meanwhile the entitlement itself is correct server-side — decoding the id_token in
~/.codex/auth.json shows:

https://api.openai.com/auth.chatgpt_plan_type = plus

Nothing in the app surfaces the mismatch, and nothing disables the feature.

Reproduction

1. On a Pro plan, enable Chronicle (Settings → Personalization).
2. Let the plan revert to Plus.
3. Observe chronicle = true still present in ~/.codex/config.toml, and
   chronicle-consent-accepted = true in ~/.codex/.codex-global-state.json.
4. Observe new files continuing to appear in
   ~/.codex/memories/extensions/chronicle/resources/.

Evidence

Summary files written per day (from the retained window):

Per skills/chronicle/SKILL.md, the 10-minute summary is "updated every minute", so the
same rolling window is re-submitted to the model roughly ten times.

Secondary observation — backlog re-processing

On 2026-08-02 two passes covered the same period:

• 09:26–10:36 — 8 summaries, windows 09:14 → 10:24, ~12 min lag (expected)
• 15:34–16:17 — 24 summaries, all covering windows 09:33 → 10:30, lag of 313–362 minutes

The afternoon pass re-summarized an hour that had already been summarized that morning, at
1-minute granularity, roughly six hours late, while also processing live windows. This
occurred with no user interaction. It looks like duplicated work.

Why it matters

Chronicle's cost scales with hours of screen-on time, not with how much Codex is used. It
is effectively a fixed daily charge. On a Pro allowance that is unnoticeable; on Plus it
consumes most of the weekly quota before the user starts working.

It is also not diagnosable from inside the product:

• Chronicle runs record no tokens_used in state_5.sqlite's threads table
• They write no session rollout, so there is no audit trail
• The artifacts are pruned on a ~5-day rolling window, so history disappears
• Usage analytics attribute the consumption to an "Exec" bucket, which reads as
  user-configured non-interactive invocation

Identifying the cause required correlating several local SQLite stores, the raw rollout
JSONL, and a decoded entitlement token against a usage chart.

Suggested fixes

1. Reconcile client-side feature flags against server-side entitlement on plan change —
   disable Pro-gated features on downgrade, or at minimum surface a notice.
2. Record token usage for Chronicle runs so they appear in local usage accounting.
3. Investigate the backlog re-processing above.
4. Distinguish background platform work from user-initiated codex exec in usage
   analytics.

Privacy note

Chronicle summaries are detailed and persist indefinitely. Sampled files described
on-screen document contents, open browser tabs, desktop folder contents, and values read
out of config files. Worth considering a retention control and an obvious way to purge
them.