v2.7.22: Stop Means Stop, Your Usage Numbers Add Up, and Every Model Is Current Again

Start with the one that will annoy you most, because it should.

If you pressed stop on a Codex employee, it kept working.

Not slowly. Not partially. The button did nothing at all, and nothing came back to tell you so. No error, no warning, no sign that the instruction had gone anywhere. You clicked, the interface accepted it, and your employee carried on with whatever it was doing as though you had never been there.

That is the worst category of bug in a product like this, because the whole promise of handing work to something autonomous is that you can take it back. A stop button that silently fails is worse than no stop button, since at least the absence of one tells you the truth.

It works now. And because there is no version of this where "it mostly works" is good enough, the failure mode changed too. Previously the instruction disappeared into a void that never answered. If the same thing were to break again in future, it will come back as a visible error rather than vanishing quietly.

Stopping now stops the work, not just the thinking

There was a second half to this, and it was almost as bad.

When you interrupted an employee mid-task, you ended its reasoning. You did not end the command it had already launched. So a process would keep running, sometimes for a long time, producing output for a turn that no longer existed and that nobody would ever read. You had stopped the employee. The work carried on without it.

Cancelling now ends that too. It asks the running process to close up properly first, and if it is still there a few seconds later, it stops being asked.

One deliberate limit worth naming: the employee's own execution environment is never killed, only the work it launched. Tearing down the environment would break the next thing you asked for, which would be a fairly poor trade for a tidier shutdown.

Your usage report was off by a factor of ninety-three

The usage report for 6 September announced 107 billion tokens for the day.

The real figure was 1.15 billion.

Almost all of the gap came from a single employee, which the report had running at 176 million tokens per incoming message. That number is the tell. No context window in existence comes anywhere near it, so anyone who looked closely could tell the report was describing something that had not happened. That is cold comfort if you looked at your usage, felt your stomach drop, and did not look closely.

The cause was a units problem, which is usually how these go. Codex reports a running total for a conversation, so each reading already contains everything before it. That figure was being written into a line that is supposed to hold the cost of one turn. Anything that then added those lines up counted every earlier turn again, and again, growing quadratically. Three turns of twenty thousand tokens each came out as a hundred and seventeen thousand rather than fifty-nine.

It now records the difference between one reading and the last, which is what a per-turn number is supposed to be. Checked on a live session, the same three turns went from 19,285, 38,670 and 59,352, each one swallowing the ones before it, to three steady readings of around twenty thousand. One turn's cost apiece.

There was a quieter error running alongside it in the opposite direction. Cached tokens were being reported as zero throughout, because the value was being looked up under a name nothing ever supplied. So the report was simultaneously inflating your totals and hiding a real component of them. Both are counted properly now.

How we know it is fixed this time

That is a fair question to ask after two bugs of this size in one release, so here is the honest answer.

Both calculations were pulled out into their own piece of code so they could be tested against what actually runs, rather than against a convenient copy of it that might quietly disagree. The tests use the real numbers from the incident and the real behaviour measured inside a running container, not invented examples.

More usefully, the tests were themselves tested, by deliberately putting the original bugs back to confirm the suite notices. It does. A test that has never been seen to fail is not evidence of anything, and this is the cheapest way to find out whether yours are real.

Your default model had quietly aged

Some housekeeping that is more consequential than it sounds.

The default Claude model was two generations behind. One direct API call was still pinned to a model from 2024. Two Gemini defaults were older than the version already in use elsewhere in the same codebase. If you never went into settings and chose explicitly, you were being served something older than you probably assumed. All of them now name the current version.

Two were left alone on purpose. One is a documented fallback that tries a billed model first and drops to one with free-tier quota, which is doing exactly what it should. The other is the guardrail judge, which runs on every single prompt, and where the model choice is a cost decision somebody made deliberately rather than something nobody noticed.

Separately, Codex has a new model available. GPT-6 Astra is now in the list, with its description read from the CLI's own model table rather than written from memory. The previous default stays the default. A handful of entries were deliberately left out, being internal experiments, one model two generations old, and one that is not a chat model at all.

Employees that were working without looking busy

On a cold container, your message waits briefly in a queue while the environment finishes starting. The employee was only marked busy once the turn genuinely began, which left a gap where it looked idle to you while somebody was very much waiting on it.

It is now marked busy the moment the message is accepted.

One window is still open, and it is worth saying so rather than letting you find it: between clicking send and the message arriving at a container that is still booting, the interface still shows idle. Closing that properly is a separate change and it has not been made yet.

Smaller things

White-label instances were missing their own logo and name in the mobile header and on the profile page, both of which had the default hard-coded. Your own mark appears in both now.

The file explorer has stopped showing you plumbing. HEARTBEAT.md is hidden, along with five other things found while looking: a backup of a file that was already hidden, some superseded portraits, a config file, an internal queue, and a second spelling of the temp folder.

The Kanban entry in the chat sidebar was the only one whose description came out clipped to a single line. Nothing was broken, nothing warned about it, it just rendered too short. The rest of the interface was checked for the same mistake and had none.

A new instance now creates its first account as John Doe rather than Admin User. Import Employee says "From an archive" instead of naming a file extension. Two em dashes were still hiding in the chat sidebar, on the free-period and out-of-credits lines, finishing a cleanup that started in 2.7.21. And Reset conversation is red again, reversing a decision from the week before.

Want to test the most advanced AI employees? Try it here: https://Geta.Team