Codex forked sessions can double count replayed parent token history #1370

What happened?

Codex Desktop forked session logs can contain a copied prefix of the parent session history. The fork file has session_meta.payload.forked_from_id, then embeds the parent session metadata and replays the parent's historical token_count events with timestamps rewritten to the fork creation time.

ccusage codex daily currently treats those replayed token_count events as new usage. This can inflate the fork day and count the same parent usage again, especially when multiple archived fork snapshots are present.

I hit this locally with three archived fork snapshots of the same parent session. Each snapshot reported the same historical token sequence but under new timestamps, which made the daily total jump unexpectedly.

A fix PR is here: #1369

Steps to reproduce

1. Create a Codex session with two token_count events.
2. Create a forked Codex JSONL file that starts with a session_meta payload containing forked_from_id.
3. Copy the parent token_count events into the forked file, with timestamps rewritten to the fork creation second.
4. Add one real fork token_count event after the replay prefix.
5. Run ccusage codex daily --json or load the fixture through the Codex adapter.

The replayed parent events are counted again under the fork session/day.

Expected behavior

For forked Codex sessions, replayed parent token_count history should be skipped. Only the parent session's original events and real fork events after the replay prefix should be counted.

The existing thread-spawn subagent replay skipping path already handles a similar shape; forked sessions can reuse that logic when forked_from_id is present.

Version

20.0.14