@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/codex/catalog/configured-tiers.ts

@@ -0,0 +1,50 @@
+import { COMBO_NAMESPACE } from "../../combos";
+import type { ResolvedFastPolicy } from "../../providers/fastwire";
+import { catalogModelSlug, type CatalogModel, type RawEntry } from "./parsing";
+import { preserveOperatorUltraFastTiers } from "./operator-tiers";
+
+const MANAGED_ULTRAFAST = "opencodex_managed_ultrafast";
+
+/** Advertise Ultra Fast only when the eligible final wire explicitly maps that exact tier. */
+export function supportsConfiguredUltraFast(policy: ResolvedFastPolicy | undefined): boolean {
+  return policy?.eligibility === "eligible"
+    && policy.fastWire?.kind === "service-tier"
+    && policy.fastWire.canonicalToWire.ultrafast === "ultrafast";
+}
+
+/** Carry captured capability to the pure merge without treating persisted metadata as authority. */
+export function configuredUltraFastSlugs(models: readonly CatalogModel[]): ReadonlySet<string> {
+  const declarations = new Map<string, boolean>();
+  for (const model of models) {
+    const slug = catalogModelSlug(model);
+    const supported = model.provider !== COMBO_NAMESPACE && model.nativeAlias !== true
+      && model.supportsServiceTier === true && model.supportsUltraFastTier === true;
+    // A conflicting duplicate cannot lend its capability to the surviving row.
+    declarations.set(slug, supported && declarations.get(slug) !== false);
+  }
+  return new Set([...declarations].filter(([, supported]) => supported).map(([slug]) => slug));
+}
+
+/** Apply current configuration, or retain an independently supplied exact-row operator tier. */
+export function applyConfiguredUltraFast(
+  entry: RawEntry,
+  previous: RawEntry | undefined,
+  configured: boolean,
+  retainOperatorTier: boolean,
+): void {
+  // This marker only rejects stale generated metadata; it never authorizes a new tier.
+  const wasManaged = previous?.[MANAGED_ULTRAFAST] === entry.slug;
+  preserveOperatorUltraFastTiers(entry, wasManaged || configured ? undefined : previous, retainOperatorTier);
+  delete entry[MANAGED_ULTRAFAST];
+  if (!configured) return;
+  entry.service_tiers = [...(Array.isArray(entry.service_tiers) ? entry.service_tiers : []), {
+    id: "ultrafast",
+    name: "Ultra Fast",
+    description: "Higher speed and usage; provider access required",
+  }];
+  entry.additional_speed_tiers = [
+    ...(Array.isArray(entry.additional_speed_tiers) ? entry.additional_speed_tiers : []), "ultrafast",
+  ];
+  // Advertising a selectable capability does not opt the user into its increased usage.
+  entry[MANAGED_ULTRAFAST] = entry.slug;
+}

package/src/codex/catalog/effort.ts

@@ -204,6 +204,8 @@ export function applyCatalogModelMetadata(entry: RawEntry, model?: CatalogModel)
  * Two real sources exist and both are consulted here, in the same precedence the
  * writers use (`applyCatalogMetadata` runs first, the model's own fields
  * overwrite it): the `CatalogModel` and the generated jawcode metadata table.
+ * Vendor-ID fallback windows are estimates for client budgets, recorded separately rather
+ * than promoted to serving-provider assertions.
  * Reading only the model would silently drop every provider whose capabilities
  * live in that table.
  */
@@ -230,7 +232,8 @@ function stampCapabilityProvenance(entry: RawEntry, model: CatalogModel): void {
   entry.opencodex_capability_provenance = {
     provider: model.provider,
     model_id: model.id,
-    ...(contextWindow !== undefined ? { context_window: contextWindow } : {}),
+    ...(contextWindow !== undefined && !model.contextWindowInference ? { context_window: contextWindow } : {}),
+    ...(model.contextWindowInference ? { inferred_context_window: contextWindow, context_window_inference: { ...model.contextWindowInference } } : {}),
     ...(inputModalities !== undefined ? { input_modalities: [...inputModalities] } : {}),
     ...(Array.isArray(model.capabilities) && model.capabilities.length > 0
       ? { capabilities: [...model.capabilities] }
@@ -620,8 +623,8 @@ export function clampCatalogModelsToCodexSupport(models: RawEntry[], deps: Bundl
       removedEfforts: [...clamp.removedEfforts],
       affectedModels: [...clamp.affectedModels],
     };
-    for (const line of formatClampLogLines(diagnostic)) console.warn(line);
-    if (!deps.commandCandidates) persistEffortClamp(diagnostic, { configDir: deps.configDir });
+    const changed = deps.commandCandidates ? true : persistEffortClamp(diagnostic, { configDir: deps.configDir });
+    if (changed) for (const line of formatClampLogLines(diagnostic)) console.warn(line);
     deps.onEffortClamp?.(diagnostic);
   } else if (!deps.commandCandidates) {
     persistEffortClamp(null, { configDir: deps.configDir });

package/src/codex/catalog/metadata.ts

@@ -42,6 +42,7 @@ import { RESERVE_METADATA_SOURCE_FIELD } from "./reserve";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
   NATIVE_GPT6_CONTEXT,
+  NATIVE_GPT61_SOL_CONTEXT,
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MINOR_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
@@ -202,8 +203,9 @@ export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: n
   // the row's own ceiling rather than the GPT-5.6 family's measured 922,000.
   [NATIVE_GPT6_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
   [NATIVE_GPT6_LUNA_MODEL]: { ...NATIVE_GPT6_CONTEXT },
-  // GPT-6.1 Sol's row (openai/codex models.json after #49318) ships the same 272,000 / 872,000 pair.
-  [NATIVE_GPT61_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
+  // GPT-6.1 Sol's row (openai/codex models.json after #49318) ships 272,000 / 872,000, but OpenAI
+  // raised its Codex & Work default to 500,000 on 2026-10-11; the 872,000 ceiling is unchanged.
+  [NATIVE_GPT61_SOL_MODEL]: { ...NATIVE_GPT61_SOL_CONTEXT },
   // Astra Minor borrows Astra's row, so it inherits Astra's numbers. No account we hold can reach
   // it, so this is inheritance, not a measurement.
   [NATIVE_GPT6_ASTRA_MINOR_MODEL]: { ...NATIVE_GPT6_CONTEXT },

package/src/codex/catalog/model-hints.ts

@@ -1,5 +1,7 @@
+import { canInferVendorContext, vendorContextInference } from "./vendor-context";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { supportsConfiguredUltraFast } from "./configured-tiers";
 import { execFileSync } from "node:child_process";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -250,6 +252,7 @@ export function configuredReasoningSummarySupport(prov: OcxProviderConfig | unde
   return modelRecordValue(prov.modelReasoningSummaryDelivery, id) !== undefined ? true : undefined;
 }
 
+/** Reapply configured limits and captured wire capabilities without trusting stale discovery hints. */
 export function applyProviderConfigHints(
   name: string,
   prov: OcxProviderConfig,
@@ -309,7 +312,12 @@ export function applyProviderConfigHints(
   // owns catalog publication, including an explicit provider-level false.
   const supportsServiceTier = serviceTierSupportFromPolicy(fastPolicy);
   const {
+    contextWindowInference: _staleContextInference,
+    contextWindow: _previousContextWindow,
+    contextCap: previousContextCap,
+    contextCapped: previousContextCapped,
     supportsServiceTier: _staleServiceTier,
+    supportsUltraFastTier: _staleUltraFastTier,
     fastTierDescription: _staleFastTierDescription,
     providerAlias: _staleProviderAlias,
     suppressSyntheticMax: _staleSuppressSyntheticMax,
@@ -317,16 +325,23 @@ export function applyProviderConfigHints(
   } = model;
   // 已发现窗口只允许被配置值压低；缺窗口时，已开的 Context cap 就是实际窗口。
   const discoveredWindow = githubCopilotCatalogContextWindow(name, prov, model.id,
-    typeof model.contextWindow === "number" && model.contextWindow > 0 ? model.contextWindow : undefined);
+    !model.contextWindowInference && typeof model.contextWindow === "number" && model.contextWindow > 0 ? model.contextWindow : undefined);
   const projectedLimits = clampObservedModelLimits(staticPolicy.model, {
     ...(discoveredWindow !== undefined ? { contextWindow: discoveredWindow } : {}),
     ...(typeof model.maxInputTokens === "number" && model.maxInputTokens > 0 ? { maxInputTokens: model.maxInputTokens } : {}),
   });
+  const azureWindow = positiveSafeInteger(azureMetadata?.contextWindow);
+  const inferredWindow = projectedLimits.contextWindow === undefined && azureWindow === undefined && canInferVendorContext(name, prov)
+    ? vendorContextInference(model.id) : undefined;
   const hintedWindow = projectedLimits.contextWindow
-    ?? positiveSafeInteger(azureMetadata?.contextWindow)
+    ?? azureWindow
+    ?? inferredWindow?.contextWindow
     ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined);
   const hinted = {
     ...modelWithoutServiceTier,
+    ...(!model.contextWindowInference && previousContextCap !== undefined
+      ? { contextCap: previousContextCap, contextCapped: previousContextCapped } : {}),
+    ...(inferredWindow ? { contextWindowInference: inferredWindow } : {}),
     ...(displayName !== undefined ? { displayName } : {}),
     ...(providerAlias !== undefined ? { providerAlias } : {}),
     ...(hintedWindow !== undefined ? { contextWindow: hintedWindow } : {}),
@@ -343,6 +358,7 @@ export function applyProviderConfigHints(
     ...(typeof supportsReasoningSummaries === "boolean" ? { supportsReasoningSummaries } : {}),
     ...(typeof supportsVerbosity === "boolean" ? { supportsVerbosity } : {}),
     ...(typeof supportsServiceTier === "boolean" ? { supportsServiceTier } : {}),
+    supportsUltraFastTier: supportsConfiguredUltraFast(fastPolicy),
     ...(supportsServiceTier === true && fastPolicy.fastTierDescription !== undefined
       ? { fastTierDescription: fastPolicy.fastTierDescription }
       : {}),
@@ -431,7 +447,9 @@ export function suppressedSyntheticMaxCatalogSlugs(
   }
   return slugs;
 }
-export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai"]);
+// google-antigravity: the static lineup is an entitlement superset (Claude 5.5 and Gemini 4 Argon
+// are per-account), so a live roster that omits some of it is the expected case, not drift.
+export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai", "google-antigravity"]);
 
 export const CALLABLE_CONFIGURED_COMPATIBILITY_MODELS: Readonly<Record<string, ReadonlySet<string>>> = {
   // CodeBuddy's vendor defaults are real callable selectors — both the bundled manifests

package/src/codex/catalog/native-models.ts

@@ -44,7 +44,8 @@ export const NATIVE_GPT6_LUNA_MODEL = "gpt-6-luna";
  * SELF-DESCRIBED: its row is pinned verbatim in `src/codex/data/roster-pinned-models.json` from
  * openai/codex `codex-rs/models-manager/models.json` after #49318, which also made it the Codex
  * catalog default (priority 1). Ladder low..ultra with default effort low, and the GPT-6
- * 272,000 / 872,000 context pair. Ungated for the same owner decision as Sol and Luna.
+ * 272,000 / 872,000 context pair in that pinned row; the effective native default is now 500,000
+ * (NATIVE_GPT61_SOL_CONTEXT). Ungated for the same owner decision as Sol and Luna.
  */
 export const NATIVE_GPT61_SOL_MODEL = "gpt-6.1-sol";
 
@@ -62,11 +63,24 @@ export const NATIVE_GPT6_ASTRA_MINOR_MODEL = "gpt-6-astra-minor";
 /**
  * Context pair every GPT-6 native ships in its upstream row: a 272,000-token default window
  * against an 872,000-token ceiling (and input limit) reached only through the long-window opt-in.
- * The built-in GPT-6 rows and every configured native (below) inherit this one value.
+ * The built-in GPT-6 rows and every configured native (below) inherit this one value, except
+ * GPT-6.1 Sol, whose default window is NATIVE_GPT61_SOL_CONTEXT.
  */
 export const NATIVE_GPT6_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
   Object.freeze({ contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 });
 
+/**
+ * GPT-6.1 Sol through Codex & Work: OpenAI raised the default context from 272k to 500k
+ * (Tibo Sottiaux, 2026-10-11, https://x.com/thsottiaux/status/2109430343346581527), while
+ * overrides stay allowed and the model maximum is described as 1M. The bundled codex-rs row
+ * still reads 272,000 / 872,000, and built-in natives never take roster values, so the default
+ * lives here. The 872,000 ceiling (and input limit) is kept on purpose: the announcement does
+ * not say how "1M" maps onto the native window and input fields, and raising maxInputTokens
+ * would assert an input allowance nobody has measured. Overrides therefore clamp to 872,000.
+ */
+export const NATIVE_GPT61_SOL_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
+  Object.freeze({ ...NATIVE_GPT6_CONTEXT, contextWindow: 500_000 });
+
 /** Pinned row a configured native borrows its capability metadata from: the current Sol. */
 export const CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL = NATIVE_GPT61_SOL_MODEL;
 

package/src/codex/catalog/native-ultrafast.ts

@@ -0,0 +1,106 @@
+import type { RawEntry } from "./parsing";
+import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
+import { NATIVE_GPT6_ASTRA_MODEL, NATIVE_GPT61_SOL_MODEL } from "./native-models";
+
+/**
+ * The Ultrafast speed choice OpenAI documents for GPT-6 Astra and GPT-6.1 Sol
+ * (https://developers.openai.com/api/docs/guides/ultrafast-mode and
+ * https://learn.chatgpt.com/docs/agent-configuration/speed, checked 2026-10-13).
+ *
+ * The upstream bundled catalog lists only `priority` for both models; ChatGPT's live model
+ * list adds Ultrafast for eligible plans. Codex stops consulting that live list once
+ * `model_catalog_json` points at our generated catalog, so without this row the speed picker
+ * never offers Ultrafast. The `ultraFastTier` switch is the operator's statement that their
+ * plan is eligible; the description still says the tier requires one.
+ */
+export const NATIVE_ULTRAFAST_SERVICE_TIER: Readonly<{ id: string; name: string; description: string }> = Object.freeze({
+  id: "ultrafast",
+  name: "Ultrafast",
+  description: "Lower latency, increased usage; requires an eligible plan",
+});
+
+export const NATIVE_ULTRAFAST_MODELS: ReadonlySet<string> = new Set([NATIVE_GPT6_ASTRA_MODEL, NATIVE_GPT61_SOL_MODEL]);
+
+function isUltraFastId(value: unknown): boolean {
+  return typeof value === "string" && value.trim().toLowerCase() === "ultrafast";
+}
+
+function isUltraFastDescriptor(value: unknown): boolean {
+  return value !== null && typeof value === "object" && "id" in value && isUltraFastId((value as { id: unknown }).id);
+}
+
+/**
+ * Provenance marker naming the tier fields this module added to a row. Ownership is never
+ * inferred from a descriptor's text: an operator may have written the very same entry, and only
+ * a row carrying this marker has anything for the switch to withdraw.
+ */
+export const NATIVE_ULTRAFAST_PROVENANCE_FIELD = "opencodex_generated_service_tiers";
+type TierField = "service_tiers" | "additional_speed_tiers";
+
+function generatedFields(entry: RawEntry): Set<TierField> {
+  const raw = entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD];
+  const fields = new Set<TierField>();
+  if (Array.isArray(raw)) {
+    for (const value of raw) if (value === "service_tiers" || value === "additional_speed_tiers") fields.add(value);
+  }
+  return fields;
+}
+
+function isGeneratedDescriptor(value: unknown): boolean {
+  if (!isUltraFastDescriptor(value)) return false;
+  const tier = value as Record<string, unknown>;
+  return Object.keys(tier).length === 3
+    && tier.id === NATIVE_ULTRAFAST_SERVICE_TIER.id
+    && tier.name === NATIVE_ULTRAFAST_SERVICE_TIER.name
+    && tier.description === NATIVE_ULTRAFAST_SERVICE_TIER.description;
+}
+
+/** Bare native rows and trusted account-bound clones of the two Ultrafast models. */
+export function nativeUltraFastSlug(entry: RawEntry): string | undefined {
+  const slug = trustedAccountBoundNativeCatalogSlug(entry)
+    ?? (typeof entry.slug === "string" && !entry.slug.includes("/") ? entry.slug : undefined);
+  return slug !== undefined && NATIVE_ULTRAFAST_MODELS.has(slug) ? slug : undefined;
+}
+
+/**
+ * Add (enabled) or withdraw (disabled) the documented Ultrafast choice on an eligible native row.
+ *
+ * Enabling appends the descriptor to `service_tiers` and "ultrafast" to the deprecated
+ * `additional_speed_tiers` mirror, after the existing Fast tier and only when absent, and records
+ * each field it filled in the provenance marker. A repeated sync is a no-op and an
+ * operator-written Ultrafast entry wins. Disabling removes only what the marker names (and only
+ * the unedited generated descriptor), then drops the marker; rows without it are left as they
+ * are. The catalog default tier is never set.
+ */
+export function applyNativeUltraFastTier(entry: RawEntry, enabled: boolean): void {
+  const owned = generatedFields(entry);
+  if (nativeUltraFastSlug(entry) === undefined) {
+    delete entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD];
+    return;
+  }
+  const tiers = Array.isArray(entry.service_tiers) ? entry.service_tiers : undefined;
+  const speeds = Array.isArray(entry.additional_speed_tiers) ? entry.additional_speed_tiers : undefined;
+  if (enabled) {
+    if (!tiers?.some(isUltraFastDescriptor)) {
+      entry.service_tiers = [...(tiers ?? []), { ...NATIVE_ULTRAFAST_SERVICE_TIER }];
+      owned.add("service_tiers");
+    }
+    if (!speeds?.some(isUltraFastId)) {
+      entry.additional_speed_tiers = [...(speeds ?? []), NATIVE_ULTRAFAST_SERVICE_TIER.id];
+      owned.add("additional_speed_tiers");
+    }
+    if (owned.size > 0) entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD] = [...owned].sort();
+    return;
+  }
+  delete entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD];
+  if (owned.has("service_tiers") && tiers) {
+    const kept = tiers.filter(tier => !isGeneratedDescriptor(tier));
+    if (kept.length > 0) entry.service_tiers = kept;
+    else delete entry.service_tiers;
+  }
+  if (owned.has("additional_speed_tiers") && speeds) {
+    const kept = speeds.filter(speed => !isUltraFastId(speed));
+    if (kept.length > 0) entry.additional_speed_tiers = kept;
+    else delete entry.additional_speed_tiers;
+  }
+}

package/src/codex/catalog/parsing.ts

@@ -1,3 +1,4 @@
+import type { VendorContextInference } from "./vendor-context";
 import { isCodexControlPlaneModel } from "../control-plane-models";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -120,6 +121,8 @@ export interface CatalogModel {
   suppressSyntheticMax?: boolean;
   defaultReasoningEffort?: string;
   contextWindow?: number;
+  /** Bundled fallback only; never a serving-provider capability assertion. */
+  contextWindowInference?: VendorContextInference;
   maxInputTokens?: number;
   /** Model-scoped output-token ceiling; omitted when no authoritative value is known. */
   maxOutputTokens?: number;
@@ -139,6 +142,8 @@ export interface CatalogModel {
   supportsVerbosity?: boolean;
   /** Whether this exact routed model has a verified OpenAI-compatible service tier. */
   supportsServiceTier?: boolean;
+  /** Captured eligible service-tier wire explicitly maps ultrafast to ultrafast. */
+  supportsUltraFastTier?: boolean;
   /** Optional provider-specific copy for the advertised Fast tier. */
   fastTierDescription?: string;
   supportsReasoningSummaries?: boolean;

package/src/codex/catalog/provider-models.ts

@@ -53,6 +53,7 @@ import {
 import type { FastPolicyAuthority } from "../../providers/fastwire";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../../providers/registry";
 import { parseAntigravityAvailableModels, registerAntigravityDiscoveredWireModels } from "../../providers/antigravity-models";
+import { recordAntigravityAccountRoster } from "../../providers/antigravity-account-roster";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { effectiveModelAliases } from "../../providers/default-aliases";
@@ -807,6 +808,9 @@ export async function fetchProviderModelsWithAuth(
         provider: name,
         cacheGeneration,
       });
+      // Entitlement is per account (Claude 4.6 vs 5.5, Argon): remember what THIS account
+      // lists so account selection can prefer one that serves the requested model.
+      if (auth.oauthAccountId) recordAntigravityAccountRoster(name, auth.oauthAccountId, antigravity);
       if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
         return observed(withConfiguredRetention(configured), "degraded");
       }

package/src/codex/catalog/retained-sync.ts

@@ -1,4 +1,5 @@
 import { projectAntigravitySelectedModels } from "../../providers/antigravity-effort-families";
+import { configuredUltraFastSlugs } from "./configured-tiers";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { initializeConfigOwnership } from "../../lib/config-ownership";
@@ -509,6 +510,7 @@ function writeRetainedCatalogSync({
     : [];
   catalog.models = mergeCatalogEntriesFromObservedState({
     ultraFastTier: ultraFastTierEnabled(config),
+    configuredUltraFastSlugs: configuredUltraFastSlugs(orderedGoModels),
     modelPickerOrder,
     accountSelectors,
     catalogModels: catalogModelsForMerge,

package/src/codex/catalog/routed-gather.ts

@@ -1,5 +1,7 @@
+import { canInferVendorContext } from "./vendor-context";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { supportsConfiguredUltraFast } from "./configured-tiers";
 import { execFileSync } from "node:child_process";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -318,6 +320,7 @@ function boundCustomNativeReasoning(
   return bounded;
 }
 
+/** Gather discovered and custom rows under one captured provider policy, including speed capabilities. */
 async function gatherRoutedModelsUncached(
   config: OcxConfig,
   capture: GatherFlightCapture,
@@ -358,6 +361,7 @@ async function gatherRoutedModelsUncached(
       const policy = fastPolicyForModel(apiProvider.provider, model.id, apiProvider.name);
       const supported = serviceTierSupportFromPolicy(policy);
       if (supported !== undefined) model.supportsServiceTier = supported;
+      model.supportsUltraFastTier = supportsConfiguredUltraFast(policy);
       if (supported === true && policy.fastTierDescription !== undefined) model.fastTierDescription = policy.fastTierDescription;
     }
   }
@@ -467,7 +471,7 @@ async function gatherRoutedModelsUncached(
       ...inherited,
       catalogKind: CODEX_CUSTOM_MODEL_CATALOG_KIND,
       ...(typeof custom.contextWindow === "number" && custom.contextWindow > 0
-        ? { contextWindow: custom.contextWindow }
+        ? { contextWindow: custom.contextWindow, contextWindowInference: undefined }
         : {}),
       ...(Array.isArray(custom.inputModalities)
         ? { inputModalities: [...custom.inputModalities] }
@@ -654,6 +658,7 @@ async function gatherRoutedModelsUncached(
       ...(Array.isArray(cm.reasoningEfforts) ? { reasoningEfforts: [...cm.reasoningEfforts] } : {}),
       ...(cm.defaultReasoningEffort ? { defaultReasoningEffort: cm.defaultReasoningEffort } : {}),
       ...(typeof supportsServiceTier === "boolean" ? { supportsServiceTier } : {}),
+      supportsUltraFastTier: supportsConfiguredUltraFast(fastPolicy),
       ...(supportsServiceTier === true && fastPolicy?.fastTierDescription !== undefined
         ? { fastTierDescription: fastPolicy.fastTierDescription }
         : {}),
@@ -686,7 +691,8 @@ async function gatherRoutedModelsUncached(
       : undefined;
     const merged: CatalogModel = replaced ? {
       ...base,
-      ...(base.contextWindow === undefined && replaced.contextWindow !== undefined ? { contextWindow: replaced.contextWindow } : {}),
+      ...(base.contextWindow === undefined && replaced.contextWindow !== undefined
+        ? { contextWindow: replaced.contextWindow, ...(replaced.contextWindowInference ? { contextWindowInference: replaced.contextWindowInference, contextCap: replaced.contextCap, contextCapped: replaced.contextCapped } : {}) } : {}),
       ...(mergedMaxInput !== undefined ? { maxInputTokens: mergedMaxInput } : {}),
       ...(mergedMaxOutput !== undefined ? { maxOutputTokens: mergedMaxOutput } : {}),
       ...(base.autoCompactTokenLimit === undefined && replaced.autoCompactTokenLimit !== undefined
@@ -703,17 +709,29 @@ async function gatherRoutedModelsUncached(
       ...(base.codexToolMode === undefined && replaced.codexToolMode !== undefined ? { codexToolMode: replaced.codexToolMode } : {}),
       ...(base.capabilities === undefined && replaced.capabilities !== undefined ? { capabilities: replaced.capabilities } : {}),
     } : base;
+    // A custom-only model may never appear in /models or the provider's configured roster.
+    // Fill only its absent context; a full hint overlay would overwrite custom capabilities.
+    const customContextHints = merged.contextWindow === undefined && effectiveProvider && canInferVendorContext(cm.provider, effectiveProvider)
+      ? applyProviderConfigHints(cm.provider, effectiveProvider, { provider: cm.provider, id: cm.modelId },
+        providerContextCap(config, cm.provider), metadataModelIdCaseFoldByProvider.get(cm.provider),
+        undefined, metadataConfigDirByProvider.get(cm.provider))
+      : undefined;
+    const contextResolved: CatalogModel = customContextHints?.contextWindow !== undefined
+      ? { ...merged, contextWindow: customContextHints.contextWindow,
+        ...(customContextHints.contextWindowInference ? { contextWindowInference: customContextHints.contextWindowInference } : {}),
+        ...(customContextHints.contextCap !== undefined ? { contextCap: customContextHints.contextCap, contextCapped: customContextHints.contextCapped } : {}) }
+      : merged;
     // Catalog-advertised efforts are bounded whenever the model id is a pinned native
     // slug. Desktop validates that id, so a gateway such as YYLJ/gpt-6-astra still cannot
     // advertise none/minimal. Full native identity stays behind the alias predicate.
     const nativeEffortSource = hasNativeOpenAiCapabilityMetadata(cm.modelId);
     const reasoningBounded = nativeEffortSource
       ? boundCustomNativeReasoning(
-        merged,
+        contextResolved,
         nativeReasoningEfforts(cm.modelId),
         nativeAliasDefaultEffort ?? nativeDefaultReasoningEffort(cm.modelId),
       )
-      : merged;
+      : contextResolved;
     // Vision-sidecar coverage only: when the enriched provider's shared predicate matches
     // noVisionModels or text-without-image modelInputModalities, advertise image input so the
     // Codex app lets images reach the sidecar (#349/#344). Deliberately NOT the full

package/src/codex/catalog/vendor-context.ts

@@ -0,0 +1,82 @@
+import { listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import type { OcxProviderConfig } from "../../types";
+
+/** A bundled model-window estimate, not evidence of the serving gateway's capacity. */
+export interface VendorContextInference {
+  source: "vendor" | "aggregator";
+  provider: string;
+  modelId: string;
+  contextWindow: number;
+}
+
+// Capacity and price have different authorities: hosting vendors (Cerebras/Bedrock), Azure
+// and the Codex subscription table must not replace the original vendor's API window.
+const VENDORS = ["anthropic", "openai", "google", "moonshot", "minimax", "deepseek", "xai", "zai", "mistral", "xiaomi"];
+const AGGREGATORS = ["openrouter", "opencode-go"];
+// Snapshot names once, never consult the mutable registry after gather flight admission.
+const BUILTIN_NAMES = new Set(PROVIDER_REGISTRY.map(entry => entry.id.toLowerCase()));
+/**
+ * Opt-in only (#1073): an id-only custom row keeps the conservative fallback unless the
+ * operator sets `inferContextWindow: true`. Built-in names stay excluded even when set.
+ */
+export function canInferVendorContext(provider: string, config: Pick<OcxProviderConfig, "inferContextWindow"> | undefined): boolean {
+  return config?.inferContextWindow === true
+    && !BUILTIN_NAMES.has(provider.toLowerCase()) && !resolveMetadataProvider(provider);
+}
+
+const normalize = (id: string): string => id.toLowerCase().replaceAll(".", "-");
+type Candidate = VendorContextInference | null;
+
+/** Build a pure lookup; conflicting windows within one authority tier fail closed. */
+export function createVendorContextLookup(
+  vendors: readonly ModelMetadata[],
+  aggregators: readonly ModelMetadata[],
+): (id: string) => VendorContextInference | undefined {
+  const build = (rows: readonly ModelMetadata[], source: VendorContextInference["source"]) => {
+    const exact = new Map<string, Candidate>();
+    const normalized = new Map<string, Candidate>();
+    const add = (map: Map<string, Candidate>, id: string, value: VendorContextInference) => {
+      if (!map.has(id)) map.set(id, value);
+      else if (map.get(id)?.contextWindow !== value.contextWindow) map.set(id, null);
+    };
+    for (const row of rows) {
+      const window = row.contextWindow;
+      if (!Number.isSafeInteger(window) || window! <= 0 || row.id.startsWith("~")) continue;
+      const value: VendorContextInference = { source, provider: row.provider, modelId: row.id, contextWindow: window! };
+      const ids = source === "aggregator" ? [row.id, row.id.slice(row.id.lastIndexOf("/") + 1)] : [row.id];
+      for (const id of ids) {
+        if (!id) continue;
+        add(exact, id, value);
+        add(normalized, normalize(id), value);
+      }
+    }
+    return { exact, normalized };
+  };
+  const tiers = [build(vendors, "vendor"), build(aggregators, "aggregator")];
+  return rawId => {
+    const id = rawId.trim();
+    if (!id || id.startsWith("~")) return undefined;
+    for (const tier of tiers) {
+      // An exact spelling wins over its normalized alias. A conflicting key does not
+      // fall through to a lower-authority source and accidentally regain a larger window.
+      const map = tier.exact.has(id) ? tier.exact : tier.normalized;
+      const key = map === tier.exact ? id : normalize(id);
+      if (map.has(key)) {
+        const value = map.get(key);
+        return value ? { ...value } : undefined;
+      }
+    }
+    return undefined;
+  };
+}
+
+let lookup: ReturnType<typeof createVendorContextLookup> | undefined;
+export function vendorContextInference(modelId: string): VendorContextInference | undefined {
+  lookup ??= createVendorContextLookup(VENDORS.flatMap(listModelMetadata), AGGREGATORS.flatMap(listModelMetadata));
+  return lookup(modelId);
+}
+
+export function vendorContextWindow(modelId: string): number | undefined {
+  return vendorContextInference(modelId)?.contextWindow;
+}

package/src/codex/config-write-lock.ts

@@ -166,15 +166,21 @@ function canonicalFileIdentity(canonical: string): string | null {
 /** Capture before the first write; nested native children share the same recovery scope. */
 export function withConfigWriteRecovery<T>(
   configPath: string, held: LockHandle, run: () => T,
-  options: { refreshBeforeSpawn?: boolean; preimage?: Buffer } = {},
+  options: { refreshBeforeSpawn?: boolean; preimage?: Buffer; requireMatchingPreimage?: boolean } = {},
 ): T {
-  if (recoveries.has(held)) return run();
+  const nested = recoveries.get(held);
+  if (nested && !options.requireMatchingPreimage) return run();
   let canonical: string;
   try { canonical = assertConfigWriteDestination(configPath, held); }
   catch { throw new ConfigWriteDestinationChanged(); }
   const identity = canonicalFileIdentity(canonical);
   const preimage = identity === null ? null : readFileSync(canonical);
   if (canonicalFileIdentity(canonical) !== identity) throw new ConfigWriteDestinationChanged();
+  if (options.requireMatchingPreimage && (!options.preimage || !preimage?.equals(options.preimage))) {
+    throw new ConfigWriteDestinationChanged();
+  }
+  if (nested && (nested.canonical !== canonical || nested.identity !== identity)) throw new ConfigWriteDestinationChanged();
+  if (nested) return run();
   const recovery: ConfigWriteRecovery = {
     canonical, identity, preimage: options.preimage ?? preimage,
     refreshBeforeSpawn: options.refreshBeforeSpawn === true && options.preimage === undefined,
@@ -317,6 +323,38 @@ export function publishConfigWriteTarget<T>(
   });
 }
 
+export function removeConfigWriteEntry(configPath: string, held: LockHandle, path: string): void {
+  assertConfigWriteDestination(configPath, held);
+  watchConfigWriteTargets(held, [path]);
+  const watched = targets.get(held)!;
+  const expected = watched.get(path)!;
+  const current = destination(path);
+  if (expected.canonical !== current.canonical || expected.inode !== current.inode
+    || current.canonical !== join(realpathSync.native(dirname(resolve(path))), basename(resolve(path)))) {
+    throw new Error("Codex artifact destination changed; files and recovery evidence were preserved.");
+  }
+  if (expected.inode === null) return;
+
+  const entry = join(realpathSync.native(dirname(resolve(path))), basename(resolve(path)));
+  const identity = (file: { dev: bigint; ino: bigint }) => `${file.dev}:${file.ino}`;
+  const before = lstatSync(entry, { bigint: true });
+  if (before.isSymbolicLink() || !before.isFile() || identity(before) !== expected.inode) {
+    throw new Error("Codex artifact destination changed; files and recovery evidence were preserved.");
+  }
+  assertConfigWriteDestination(configPath, held);
+  const now = lstatSync(entry, { bigint: true });
+  if (now.isSymbolicLink() || !now.isFile() || identity(now) !== expected.inode) {
+    throw new Error("Codex artifact destination changed; files and recovery evidence were preserved.");
+  }
+  unlinkSync(entry);
+  assertConfigWriteDestination(configPath, held);
+  const after = destination(path);
+  if (after.inode !== null || after.canonical !== expected.canonical) {
+    throw new Error("Codex artifact destination changed; recovery evidence was preserved.");
+  }
+  watched.set(path, after);
+}
+
 export function configWriteLockFailureMessage(failure: Exclude<ConfigWriteAcquireResult, { ok: true }>): string {
   if (failure.error === "missing-parent") return `Codex configuration parent is missing or unresolved at ${failure.detail}; no files were changed.`;
   return failure.error === "unsafe"

package/src/codex/convergence.ts

@@ -1,4 +1,5 @@
 import { projectAntigravitySelectedModels } from "../providers/antigravity-effort-families";
+import { configuredUltraFastSlugs } from "./catalog/configured-tiers";
 import { join } from "node:path";
 import { sameCatalogHealPath } from "./catalog/heal-observation";
 
@@ -371,6 +372,7 @@ function prepareCatalog(
   );
   const mergedModels = mergeCatalogEntriesFromObservedState({
     ultraFastTier: ultraFastTierEnabled(config),
+    configuredUltraFastSlugs: configuredUltraFastSlugs(ordered),
     modelPickerOrder,
     accountSelectors,
     catalogModels,

package/src/codex/desktop-app/types.ts

@@ -51,6 +51,8 @@ export interface DesktopProcess {
   createdAt: string;
   /** Absolute executable path, used for membership and the shell predicate. */
   executable: string;
+  /** Windows-only private launch context; never included in restart results or logs. */
+  commandLine?: string;
 }
 
 export interface DesktopAppAdapter {