Update OpenAI pricing, Ultrafast and quota accounting (v1.6.0)

.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Type-check Sites and D1 bindings
         run: npm run typecheck --prefix sites-hub
       - name: Audit all Sites dependencies
-        run: npm audit --audit-level=low --prefix sites-hub
+        run: npm run audit:deps --prefix sites-hub
       - name: Build container
         run: docker build --tag codex-usage-dashboard:ci .
       - name: Verify relational storage and persistent Docker volume

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 1.6.0 — 2026-10-09
+
+- Add dated Ultrafast pricing for GPT-6 Astra and GPT-6.1 Sol: API and purchased credits use 6x Standard; included-subscription quota calibration uses 8x.
+- Correct the older Fast credit multiplier that conflated purchased credits with subscription consumption: 2x billing versus 2.5x quota weighting. Pre-September 30 speed factors remain explicitly reconstructed; this is a correction, not a new price cut.
+- Support observed Batch/Flex API cards for GPT-6 and GPT-5.6, with conservative October 9 coverage, and keep these tiers unsupported for Codex credits.
+- Add GPT-Rosalind Research with its explicit October 5 API billing boundary and observed credit card, plus the independently priced `chat-latest` API card without mapping it to a moving underlying model.
+- Preserve service tiers through collection, Mesh, relational summaries and calculation exports; distinguish Ultrafast in badges, search, history and premium summaries.
+
+Docker: `capitaine/codex-usage-dashboard:1.6.0` and `:latest` (Linux AMD64 and ARM64). Recreate containers with their existing configuration and storage volumes.
+
 ## 1.5.5 — 2026-09-30
 
 - Add GPT-6.1 Sol as a distinct model with dated API and Codex rates from September 29, including the lower cached-input price, cache writes, Fast and API long-context pricing.

Dockerfile

@@ -20,7 +20,7 @@ LABEL org.opencontainers.image.source="https://github.com/capisoft-lib/codex_usa
       org.opencontainers.image.licenses="AGPL-3.0-or-later" \
       org.opencontainers.image.title="Local Usage Dashboard for Codex" \
       org.opencontainers.image.description="Independent local dashboard for Codex usage, token activity, and cost estimates" \
-      org.opencontainers.image.version="1.5.5"
+      org.opencontainers.image.version="1.6.0"
 
 ENV NODE_ENV=production \
     HOST=0.0.0.0 \

README.md

@@ -6,7 +6,7 @@
 
 Local Usage turns the Codex session metadata stored on your computer into a fast, privacy-conscious usage dashboard. It can run entirely on one machine, or several machines can send signed, minimized usage snapshots to an optional central dashboard hosted with OpenAI Sites or on your own server.
 
-[**Stable release 1.5.5**](https://github.com/capisoft-lib/codex_usage/releases/tag/v1.5.5) · [Docker image 1.5.5](https://hub.docker.com/r/capitaine/codex-usage-dashboard) · [AGPL-3.0-or-later](LICENSE) · [Changelog](CHANGELOG.md) · [CI status](https://github.com/capisoft-lib/codex_usage/actions/workflows/ci.yml)
+[**Stable release 1.6.0**](https://github.com/capisoft-lib/codex_usage/releases/tag/v1.6.0) · [Docker image 1.6.0](https://hub.docker.com/r/capitaine/codex-usage-dashboard) · [AGPL-3.0-or-later](LICENSE) · [Changelog](CHANGELOG.md) · [CI status](https://github.com/capisoft-lib/codex_usage/actions/workflows/ci.yml)
 
 Setup guides: [deploy the central dashboard with OpenAI Sites](docs/sites-deployment.md) · [deploy the public Mesh ingress](docs/mesh-ingress.md) · [install a reporting agent](docs/reporting-agent.md)
 
@@ -163,7 +163,7 @@ The dashboard image runs as a non-root user with all Linux capabilities removed.
 The public Linux AMD64/ARM64 image is:
 
 ```text
-capitaine/codex-usage-dashboard:1.5.5
+capitaine/codex-usage-dashboard:1.6.0
 ```
 
 The 1.0.2 release is also mirrored at `ghcr.io/capisoft-lib/codex-usage-dashboard:1.0.2`.
@@ -172,7 +172,7 @@ On Windows PowerShell:
 
 ```powershell
 $codexData = Join-Path $env:USERPROFILE ".codex"
-$image = "capitaine/codex-usage-dashboard:1.5.5"
+$image = "capitaine/codex-usage-dashboard:1.6.0"
 
 docker pull $image
 docker volume create codex-usage-dashboard-storage
@@ -196,7 +196,7 @@ docker run -d `
 On macOS or Linux:
 
 ```bash
-IMAGE="capitaine/codex-usage-dashboard:1.5.5"
+IMAGE="capitaine/codex-usage-dashboard:1.6.0"
 
 docker pull "$IMAGE"
 docker volume create codex-usage-dashboard-storage
@@ -488,7 +488,7 @@ The dashboard derives two separate estimates from locally observed model calls.
 - **Codex credits** use the published ChatGPT Codex rate card. Each call inherits its recorded service tier, and known Fast/Priority calls receive the documented credit multiplier.
 - **API-equivalent cost** estimates what the same calls would have cost through the API. Standard prices, published API Fast rates, and long-context adjustments are applied independently from ChatGPT credit multipliers.
 - Both estimates select the rate applicable at each call's original timestamp from a shared, versioned catalog. Later price cuts do not reduce earlier consumption; late imports retain their historical rate.
-- GPT-6 Astra, Sol, Luna and GPT-6.1 Sol are supported with distinct model IDs, dated rates and API long-context rules. Sol 6.1 cached input costs $0.10 or 2.5 Codex credits per million tokens; its Fast purchased-credit billing is 2x and included-subscription quota weighting is 2.5x. Earlier periods retain their recorded factors.
+- GPT-6 Astra, Sol, Luna and GPT-6.1 Sol are supported with distinct model IDs, dated rates and API long-context rules. Fast uses 2x purchased credits and 2.5x included-subscription weighting. Astra and Sol 6.1 Ultrafast use 6x API/credits and 8x quota weighting, with independent dated availability. Historical speed factors before September 30 are explicitly reconstructed. Supported Batch/Flex API cards use a 50% discount from the October 9 observation; unsupported tiers remain unrated.
 - Unknown models, dates outside documented coverage and unsupported tiers remain visibly unrated and are excluded from totals. A reference API price is available only in explicitly selected custom simulation.
 - The pricing dialog includes historical/current/custom modes, sourced rate history, catalog verification status and an export of the applied calculation. Legacy custom browser prices are preserved for custom simulation.
 

docs/dependency-exceptions.md

@@ -0,0 +1,7 @@
+# Temporary development dependency exception
+
+`GHSA-vfj7-8cjw-p6xm` affects the recursive AST walkers in `braces` 3.0.3. On October 9, 2026 the [reviewed advisory](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) and npm registry report no patched release. It is used by development-time globbing through Micromatch/Fast Glob, the Sites framework build tools and the Next ESLint plugin. These inputs are repository-controlled file patterns. Do not run these tools on untrusted glob input. The dashboard's request handlers and dependency-free Docker runtime do not use this package.
+
+Until **October 23, 2026 at 00:00 UTC**, the Sites CI audit permits only this advisory on exactly version 3.0.3, only when every affected installed package and its dependency chain is marked development-only in the lockfile. Any other advisory, a production dependency, missing metadata, a changed version or an expired exception fails CI. The audit prints the accepted exception instead of claiming zero vulnerabilities. The separate Mesh audit retains its strict policy.
+
+`scripts/audit-dependencies.mjs` implements the narrow check; regression tests exercise expiry and rejected cases. Remove the exception when an upstream fix is available. Sharp and Source Map JS receive their available patches in this release.

docs/dockerhub-readme.md

@@ -6,7 +6,7 @@
 
 Local Usage turns the Codex session metadata stored on your computer into a fast, privacy-conscious usage dashboard. It can run entirely on one machine, or several machines can send signed, minimized usage snapshots to an optional central dashboard.
 
-[**Stable release 1.5.5**](https://github.com/capisoft-lib/codex_usage/releases/tag/v1.5.5) · [Docker image 1.5.5](https://hub.docker.com/r/capitaine/codex-usage-dashboard/tags) · [Source code](https://github.com/capisoft-lib/codex_usage) · [AGPL-3.0-or-later](https://github.com/capisoft-lib/codex_usage/blob/main/LICENSE) · [Changelog](https://github.com/capisoft-lib/codex_usage/blob/main/CHANGELOG.md) · [CI status](https://github.com/capisoft-lib/codex_usage/actions/workflows/ci.yml)
+[**Stable release 1.6.0**](https://github.com/capisoft-lib/codex_usage/releases/tag/v1.6.0) · [Docker image 1.6.0](https://hub.docker.com/r/capitaine/codex-usage-dashboard/tags) · [Source code](https://github.com/capisoft-lib/codex_usage) · [AGPL-3.0-or-later](https://github.com/capisoft-lib/codex_usage/blob/main/LICENSE) · [Changelog](https://github.com/capisoft-lib/codex_usage/blob/main/CHANGELOG.md) · [CI status](https://github.com/capisoft-lib/codex_usage/actions/workflows/ci.yml)
 
 ## Donate
 
@@ -22,29 +22,29 @@ If you like this project and want to support its ongoing development, you can [b
 - project, model, period, usage, and conversation filters;
 - nine interface languages.
 
-## New in 1.5.5
+## New in 1.6.0
 
-- GPT-6.1 Sol has distinct API and Codex credit rates, including its lower cached-input price.
-- Sol 6.1 Fast credit billing (2x) and included-subscription quota weighting (2.5x) are calculated separately.
+- Astra and Sol 6.1 Ultrafast are recognized, displayed and priced with dated eligibility.
+- Fast credit billing (2x) and quota weighting (2.5x), plus Ultrafast credit billing (6x) and quota weighting (8x), are calculated separately.
 - Recent releases added relational SQLite storage, faster history queries, and clearer loading and error states.
 
 ## Docker
 
 The public image supports Linux AMD64 and ARM64 and runs as a non-root user:
 
 ```text
-capitaine/codex-usage-dashboard:1.5.5
+capitaine/codex-usage-dashboard:1.6.0
 ```
 
 ```bash
-docker pull capitaine/codex-usage-dashboard:1.5.5
+docker pull capitaine/codex-usage-dashboard:1.6.0
 docker compose up -d
 ```
 
 Inspect the published multi-platform manifest and digest:
 
 ```text
-docker buildx imagetools inspect capitaine/codex-usage-dashboard:1.5.5
+docker buildx imagetools inspect capitaine/codex-usage-dashboard:1.6.0
 ```
 
 The published manifests include SBOM and provenance attestations. See the [full README](https://github.com/capisoft-lib/codex_usage#readme) for scoped read-only mounts, PowerShell/macOS/Linux commands, Compose configuration, and hardened deployment examples.

docs/pricing-history.md

@@ -1,8 +1,8 @@
 # Dated OpenAI pricing
 
-Research window: **2025-08-07 to 2026-09-30**, covering more than twelve months.
-Catalog: `public/pricing-catalog.js`, version `2026-09-30.1`.
-Last source review: 2026-09-30 (Europe/Paris). Next routine review: 2026-10-30.
+Research window: **2025-08-07 to 2026-10-09**, covering more than twelve months.
+Catalog: `public/pricing-catalog.js`, version `2026-10-09.1`.
+Last source review: 2026-10-09 (Europe/Paris). Next routine review: 2026-11-09.
 
 ## What the dashboard measures
 
@@ -43,9 +43,23 @@ The changelog also covers image, audio, video, tools and storage products. Examp
 
 The [API changelog](https://developers.openai.com/api/docs/changelog) dates `gpt-6.1-sol` to September 29. It is a distinct model, not an alias or a price change for `gpt-6-sol`. The [API card](https://developers.openai.com/api/docs/pricing) and [model card](https://developers.openai.com/api/docs/models/gpt-6.1-sol) give $2 / $0.10 / $10 per million input / cached input / output tokens, with $2.50 cache writes. Above 272K input tokens, the whole request uses 2x input/cache/write and 1.5x output; Fast stacks another 2x.
 
-The [Codex card](https://learn.chatgpt.com/docs/pricing#token-rates) gives 50 / 2.5 / 250 credits per million tokens, without a separate cache-write charge. The [speed documentation](https://learn.chatgpt.com/docs/agent-configuration/speed) distinguishes purchased-credit/Enterprise Fast billing (2x) from included-subscription consumption (2.5x). Sol 6.1 credit totals and exports use 2x; quota capacity calibration and forecasts use 2.5x. Earlier model periods retain their previously recorded factors; this addition does not backdate the current distinction across old history. Historical Fast observation gates remain September 23 even when the catalog review date advances.
+The [Codex card](https://learn.chatgpt.com/docs/pricing#token-rates) gives 50 / 2.5 / 250 credits per million tokens, without a separate cache-write charge. The [speed documentation](https://learn.chatgpt.com/docs/agent-configuration/speed) distinguishes purchased-credit/Enterprise Fast billing (2x) from included-subscription consumption (2.5x). Sol 6.1 credit totals and exports use 2x; quota capacity calibration and forecasts use 2.5x. This was initially scoped to Sol 6.1; the October 9 review below corrects the older models as well. Historical Fast observation gates remain September 23 even when the catalog review date advances.
 
-Rates are reviewed on September 30 and applied from the day-only launch boundary at 00:00 UTC on September 29; launch-day calls remain estimated. The date-suffixed ID is recognized, while undocumented moving aliases, private suffixes and unsupported Batch/Flex/Ultrafast tiers remain unrated.
+Rates are reviewed on September 30 and applied from the day-only launch boundary at 00:00 UTC on September 29; launch-day calls remain estimated. The date-suffixed ID is recognized, while undocumented moving aliases, private suffixes and tiers outside their independently documented coverage remain unrated.
+
+### October 9 review: service tiers and corrected credit accounting
+
+The [API changelog](https://developers.openai.com/api/docs/changelog) dates Astra Ultrafast to **September 29**, and Sol 6.1 Ultrafast to **October 8**. The [API rate card](https://developers.openai.com/api/docs/pricing) gives 6x Standard for both, including cached reads, cache writes and output. The full-request long-context factors still stack independently. Ultrafast is a `service_tier`, not another model ID. GPT-5.6 Sol's limited preview has no applicable public Ultrafast card in this review and remains unrated.
+
+The [Codex speed rules](https://learn.chatgpt.com/docs/agent-configuration/speed) and [credit card](https://learn.chatgpt.com/docs/pricing) distinguish Fast **2x purchased credits / 2.5x included usage** and Ultrafast **6x purchased credits / 8x included usage**. The prior catalog mixed the first pair for older models. This release corrects that assumption across supported Fast periods without changing base token rates or inventing a new price-cut date. Speed factors before the September 30 direct review remain reconstructed and increment the estimated-call count. For example, the former Astra Fast 97.5-credit estimate becomes 78 purchased credits for the same 39 Standard credits, while subscription calibration still uses 97.5. Old exported reports retain their original embedded rates and remain reproducible.
+
+Astra Ultrafast credit eligibility starts conservatively at the September 30 direct observation; its exact earlier Codex rollout hour was not established. Sol 6.1 credit eligibility uses the [October 8 launch](https://learn.chatgpt.com/docs/whats-new/october-5-9-2026). Launch/boundary days remain estimated. Ultrafast and Fast retain distinct call counts, premiums, profile badges and export buckets, including in SQL aggregates and quota forecasts.
+
+Batch/Flex API rates are supported only for the exact proportional GPT-6 and GPT-5.6 cards verified on October 9, at **0.5x**, including supported long context and cache writes. Earlier eligibility remains unknown and unrated. Other models, cards with rounding differences, and Codex credit/allowance usage do not inherit this discount.
+
+The September 8 API announcement explicitly says GPT-Rosalind Research billing begins **October 5**: its API period is free before that boundary, then $5 / $0.50 / $25. Its 125 / 12.5 / 625 credit card is observed from October 9; no earlier credit-free period is inferred. `chat-latest` has its own observed $5 / $0.50 / $30 API card from October 9 and is never aliased to its moving underlying model. Both have no undocumented speed or cache-write premiums.
+
+The GPT-6 Standard rates are unchanged. API usage-tier names (Build/Launch/Grow), plan availability, GPT-5.5's forthcoming Codex retirement and image-encoding fixes do not alter token charges. Voice duration, tools, images, regional uplifts and negotiated rates require measurements not present in these counters; this release does not invent them.
 
 ## Evidence, precision and missing history
 
@@ -60,11 +74,11 @@ Rates are reviewed on September 30 and applied from the day-only launch boundary
 
 ## GPT-6 and accounting boundaries
 
-For GPT-6 Astra, Sol, Luna and GPT-6.1 Sol API calls, prompts **strictly above 272,000 input tokens** apply 2x to input/cache and 1.5x to output for the whole request. API Fast applies another 2x. These API factors are not copied into the credit calculator. Sol 6.1 uses the distinct credit/subscription Fast factors described above; earlier periods retain their recorded factors.
+For GPT-6 Astra, Sol, Luna and GPT-6.1 Sol API calls, prompts **strictly above 272,000 input tokens** apply 2x to input/cache and 1.5x to output for the whole request. API Fast applies another 2x; supported Ultrafast applies 6x. These API context factors are not copied into the credit calculator. Credits and subscription quota weighting follow their distinct factors above.
 
 Input includes cached reads and cache writes, so ordinary fresh input is `inputTokens - cachedInputTokens - cacheWriteInputTokens`. The [official cache cost example](https://developers.openai.com/api/docs/guides/prompt-caching) confirms this accounting. Reasoning output is already part of output tokens and is not charged twice. Invalid/nonfinite counters and cache exceeding input are reported rather than coerced into a plausible amount. A missing published cached rate is `null`, not a free cache price.
 
-GPT-5.6 and Astra publish cache-write rates at 1.25x uncached input. Analyzer v8 preserves the optional `cache_write_input_tokens` observation as `cacheWriteInputTokens`. Measured writes are subtracted from ordinary input and charged once at the documented write rate, including API Fast/long-context factors. Older calls without this field remain distinguishable from observed zero writes and carry an unobserved-write count and estimated coverage when uncached input could contain writes. Tool fees, unobserved cache-write surcharges, regional processing uplifts, negotiated rates, Batch/Flex and other unobserved details are excluded or explicitly unsupported. Estimates are not exact invoices.
+GPT-5.6 and Astra publish cache-write rates at 1.25x uncached input. Analyzer v8 preserves the optional `cache_write_input_tokens` observation as `cacheWriteInputTokens`. Measured writes are subtracted from ordinary input and charged once at the documented write rate, including API Fast/long-context factors. Older calls without this field remain distinguishable from observed zero writes and carry an unobserved-write count and estimated coverage when uncached input could contain writes. Tool fees, unobserved cache-write surcharges, regional processing uplifts, negotiated rates and other unobserved details are excluded or explicitly unsupported. Estimates are not exact invoices.
 
 ## UI, migration and reproducibility