@iislee/opencodex 2.31.0 → 2.35.0

package/src/codex/auth-context.ts

@@ -29,7 +29,6 @@ import {
   entitledCodexAccountIdsForModel,
   isDirectCallerEntitledToCodexModel,
   resolveCodexModelEntitlements,
-  type CodexModelEntitlementSnapshot,
 } from "./model-entitlements";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "./catalog/native-models";
 import type { CodexCooldownSource, CodexQuotaScope } from "./routing";
@@ -334,9 +333,7 @@ export interface ResolveCodexAuthContextOptions {
   getMainAccountToken?: typeof getMainAccountToken;
   primeCodexPoolQuotas?: (config: OcxConfig, reason: string) => Promise<void>;
   /** Test seam for account-gated native model discovery. */
-  resolveCodexModelEntitlements?: (
-    config: Pick<OcxConfig, "codexAccounts">,
-  ) => Promise<CodexModelEntitlementSnapshot>;
+  resolveCodexModelEntitlements?: typeof resolveCodexModelEntitlements;
   /** Direct requests admitted with a proxy bearer substitute the stored native-main credential. */
   substituteMainCredentialForDirect?: boolean;
   /** Test seam for a Direct request's own forwarded ChatGPT credential. */
@@ -381,28 +378,34 @@ export async function resolveCodexAuthContext(
     return { kind: "main", accountId: null };
   }
   const affinityKey = fixedAccountId === undefined ? codexPoolAffinityKey(headers) : undefined;
-  const entitlementSnapshot = options.modelId && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)
-    ? await (options.resolveCodexModelEntitlements ?? resolveCodexModelEntitlements)(config)
-    : undefined;
-  const modelEligibleAccountIds = entitlementSnapshot
-    ? entitledCodexAccountIdsForModel(entitlementSnapshot, options.modelId)
-    : undefined;
   // Retained startup recovery makes the physical main identity ineligible. Routing
   // can still preserve service by selecting a healthy configured pool account.
   const nativeMainTrafficBlocked = isNativeMainTrafficBlocked();
   const selectionAdmission = options.beginCodexAccountSelection?.();
   const nativeMainReadsForbidden = nativeMainTrafficBlocked || selectionAdmission?.mainProfileDraining === true;
-  const selectionOptions = {
-    // Temporary switch drain keeps the candidate until the atomic claim rejects
-    // it. Retained recovery makes main wholly ineligible so pool routing continues.
-    nativeMainSelectionOnly: !nativeMainTrafficBlocked
-      && selectionAdmission?.mainProfileDraining === true,
-    isMainAccountTokenLive: options.isMainAccountTokenLive,
-    modelEligibleAccountIds,
-  };
   let accountId: string;
   const quotaScope = codexQuotaScopeForModel(options.modelId);
   try {
+    const excludeAccountIds = nativeMainReadsForbidden
+      ? new Set([MAIN_CODEX_ACCOUNT_ID])
+      : undefined;
+    const entitlementSnapshot = options.modelId && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)
+      ? await (options.resolveCodexModelEntitlements ?? resolveCodexModelEntitlements)(config, { excludeAccountIds })
+      : undefined;
+    const entitledAccountIds = entitlementSnapshot
+      ? entitledCodexAccountIdsForModel(entitlementSnapshot, options.modelId)
+      : undefined;
+    const modelEligibleAccountIds = entitledAccountIds
+      ? new Set([...entitledAccountIds].filter(candidate => !excludeAccountIds?.has(candidate)))
+      : undefined;
+    const selectionOptions = {
+      // Temporary switch drain keeps the candidate until the atomic claim rejects
+      // it. Retained recovery makes main wholly ineligible so pool routing continues.
+      nativeMainSelectionOnly: !nativeMainTrafficBlocked
+        && selectionAdmission?.mainProfileDraining === true,
+      isMainAccountTokenLive: options.isMainAccountTokenLive,
+      modelEligibleAccountIds,
+    };
     // A pre-drain selector reserves the native identity while reconciliation and
     // routing inspect it. Selectors arriving after the fence skip reconciliation
     // and may still route to non-main pool accounts without touching switch state.

package/src/codex/autostart-health.ts

@@ -154,3 +154,19 @@ export function startupHealthSummary(health: StartupHealth): string {
   if (health.serviceInstalled && !health.serviceViable) return `AT RISK after restart (installed service is disabled, stopped, or unhealthy; run '${command}')`;
   return `AT RISK after restart (no viable background service; run '${command}')`;
 }
+
+/**
+ * The routing/service/shim token `ocx doctor` prints under restart safety.
+ * Extracted so `ocx status` can show the same string rather than growing a
+ * second copy that drifts (#2411). Two management routes computing the same
+ * thing separately is exactly how #2457 happened.
+ */
+export function formatStartupRoutingDetail(health: StartupHealth): string {
+  const service = health.serviceViable
+    ? "viable"
+    : health.serviceInstalled ? "installed-but-unhealthy" : "absent";
+  const shim = health.shimHealthy
+    ? "healthy"
+    : health.shimInstalled ? "stale" : "absent";
+  return `routing=${health.routingKind}, service=${service}, shim=${shim}`;
+}

package/src/codex/catalog/aggregation.ts

@@ -13,6 +13,7 @@ import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, r
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { applyProviderContextCap, providerContextCap } from "../../providers/context-cap";
+import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../../providers/slug-codec";
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
@@ -154,8 +155,16 @@ export function deriveComboCatalogModel(
   // combo would have the same window even without the cap.
   const contextCapped = limitingMembers.every(member => member.contextCapped === true);
   const maxInputTokens = Math.min(
+    contextWindow,
     ...members.map(member => member.maxInputTokens ?? member.contextWindow!),
   );
+  const autoCompactTokenLimit = Math.min(
+    ...members.map(member => clampAutoCompactTokenLimit(
+      member.contextWindow!,
+      member.maxInputTokens,
+      member.autoCompactTokenLimit,
+    )),
+  );
   const defaultReasoningEffort = effectiveComboDefault(
     combo.defaultEffort,
     reasoningEfforts,
@@ -167,6 +176,7 @@ export function deriveComboCatalogModel(
     owned_by: COMBO_NAMESPACE,
     contextWindow,
     maxInputTokens,
+    autoCompactTokenLimit,
     ...(hasLimitingContextCapMetadata ? { contextCapped } : {}),
     inputModalities,
     reasoningEfforts,
@@ -183,6 +193,12 @@ export function deriveComboCatalogModel(
         ? { supportsServiceTier: false }
         : {}),
     ...(members.some(member => member.supportsReasoningSummaries === false) ? { supportsReasoningSummaries: false } : {}),
+    // A combo is only as capable as its least capable member. One member that cannot honour
+    // text.verbosity is enough to make the control a no-op for the whole combo, so the
+    // conservative false propagates — the same rule supportsReasoningSummaries uses above.
+    // Without this, routing a combo through an xAI or Kiro member re-advertised a control the
+    // upstream accepts and ignores.
+    ...(members.some(member => member.supportsVerbosity === false) ? { supportsVerbosity: false } : {}),
     ...(members.every(member => member.codexToolMode === "shell")
       ? { codexToolMode: "shell" as const }
       : {}),
@@ -210,6 +226,7 @@ export function comboCatalogWarningSignature(
       key,
       contextWindow: member?.contextWindow ?? null,
       maxInputTokens: member?.maxInputTokens ?? null,
+      autoCompactTokenLimit: member?.autoCompactTokenLimit ?? null,
       inputModalities: [...new Set(member?.inputModalities ?? [])].sort(),
       reasoningEfforts: [...new Set(member?.reasoningEfforts ?? [])].sort(),
       parallelToolCalls: member?.parallelToolCalls === true,
@@ -299,6 +316,7 @@ export function normalizedOpenAiApiSignature(model: CatalogModel): string {
     id: model.id,
     contextWindow: model.contextWindow ?? null,
     maxInputTokens: model.maxInputTokens ?? null,
+    autoCompactTokenLimit: model.autoCompactTokenLimit ?? null,
     inputModalities: [...new Set(model.inputModalities ?? [])].sort(),
     reasoningEfforts: [...new Set(model.reasoningEfforts ?? [])].sort(),
     ownedBy: model.owned_by ?? null,

package/src/codex/catalog/effort.ts

@@ -13,6 +13,7 @@ import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, r
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
+import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { routedSlug, slugEquals, slugsEquivalent } from "../../providers/slug-codec";
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
@@ -128,9 +129,23 @@ export function applyCatalogModelMetadata(entry: RawEntry, model?: CatalogModel)
   if (typeof resolvedContext === "number" && resolvedContext > 0) {
     entry.context_window = resolvedContext;
     entry.max_context_window = resolvedContext;
-    entry.auto_compact_token_limit = Math.min(
-      Math.floor(resolvedContext * 0.9),
-      model.maxInputTokens ?? Number.POSITIVE_INFINITY,
+    entry.auto_compact_token_limit = clampAutoCompactTokenLimit(
+      resolvedContext,
+      model.maxInputTokens,
+      model.autoCompactTokenLimit,
+    );
+  } else if (
+    typeof entry.context_window === "number"
+    && entry.context_window > 0
+    && typeof model.maxInputTokens === "number"
+    && model.maxInputTokens > 0
+  ) {
+    // A conservative routed fallback is not evidence for applying the optional soft policy,
+    // but a measured/configured input ceiling is still a hard bound. Compact before that
+    // ceiling even when the provider supplied no authoritative context window.
+    entry.auto_compact_token_limit = clampAutoCompactTokenLimit(
+      entry.context_window,
+      model.maxInputTokens,
     );
   }
   if (Array.isArray(model.inputModalities) && model.inputModalities.length > 0) {

package/src/codex/catalog/metadata.ts

@@ -14,6 +14,7 @@ import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, r
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "../../providers/registry";
 import { applyProviderContextCap, providerContextCap } from "../../providers/context-cap";
+import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { routedSlug, slugEquals, slugsEquivalent } from "../../providers/slug-codec";
 import { identifyRoutedModel } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
@@ -204,6 +205,8 @@ export interface NativeContextLimits {
   readonly providerWindow?: number;
   /** `providers.openai.modelContextWindows` — per-model, wins over `providerWindow`. */
   readonly modelWindows?: Readonly<Record<string, number>>;
+  /** `providers.openai.modelAutoCompactTokenLimits` — soft, lowering-only budgets. */
+  readonly modelAutoCompactTokenLimits?: Readonly<Record<string, number>>;
 }
 
 export type NativeContextLimitsInput = NativeContextLimits | number | undefined;
@@ -227,12 +230,18 @@ export function nativeContextLimits(
     const window = positiveInt(value);
     if (window !== undefined) modelWindows[slug] = window;
   }
+  const modelAutoCompactTokenLimits: Record<string, number> = {};
+  for (const [slug, value] of Object.entries(provider?.modelAutoCompactTokenLimits ?? {})) {
+    const budget = positiveInt(value);
+    if (budget !== undefined) modelAutoCompactTokenLimits[slug] = budget;
+  }
   return {
     ...(positiveInt(providerContextCap(config, OPENAI_CODEX_PROVIDER_ID)) !== undefined
       ? { cap: providerContextCap(config, OPENAI_CODEX_PROVIDER_ID) }
       : {}),
     ...(positiveInt(provider?.contextWindow) !== undefined ? { providerWindow: provider!.contextWindow } : {}),
     ...(Object.keys(modelWindows).length > 0 ? { modelWindows } : {}),
+    ...(Object.keys(modelAutoCompactTokenLimits).length > 0 ? { modelAutoCompactTokenLimits } : {}),
   };
 }
 
@@ -277,6 +286,21 @@ export function nativeOpenAiMaxInputTokens(slug: string, limits?: NativeContextL
   return window === undefined ? narrowed : Math.min(narrowed, window);
 }
 
+/** Effective native soft budget after every hard window/input limit is resolved. */
+export function nativeOpenAiAutoCompactTokenLimit(
+  slug: string,
+  limits?: NativeContextLimitsInput,
+): number | undefined {
+  const contextWindow = nativeOpenAiContextWindow(slug, limits);
+  if (contextWindow === undefined) return undefined;
+  const configured = positiveInt(asLimits(limits).modelAutoCompactTokenLimits?.[slug]);
+  return clampAutoCompactTokenLimit(
+    contextWindow,
+    nativeOpenAiMaxInputTokens(slug, limits),
+    configured,
+  );
+}
+
 export function nativeInputModalities(slug: string): string[] {
   const upstream = PINNED_NATIVE_CAPABILITY_ENTRIES.get(slug);
   if (Array.isArray(upstream?.input_modalities) && upstream!.input_modalities!.length > 0) {
@@ -387,7 +411,7 @@ export function desktopVisibleNativeSlugs(
   ]);
 }
 
-export function nativeModelRows(config: Pick<OcxConfig, "disabledModels" | "combos" | "providerContextCaps" | "providers">): Array<{ slug: string; disabled: boolean; contextWindow?: number; maxInputTokens?: number }> {
+export function nativeModelRows(config: Pick<OcxConfig, "disabledModels" | "combos" | "providerContextCaps" | "providers">): Array<{ slug: string; disabled: boolean; contextWindow?: number; maxInputTokens?: number; autoCompactTokenLimit?: number }> {
   const disabled = disabledNativeSlugs(config);
   const shadowed = configuredNativeAliasSlugs(config);
   // Both user levers, not just the cap: a per-model window set from the dashboard has to show
@@ -403,11 +427,13 @@ export function nativeModelRows(config: Pick<OcxConfig, "disabledModels" | "comb
     .filter(slug => !shadowed.has(slug)).map(slug => {
     const contextWindow = nativeOpenAiContextWindow(slug, limits);
     const maxInputTokens = nativeOpenAiMaxInputTokens(slug, limits);
+    const autoCompactTokenLimit = nativeOpenAiAutoCompactTokenLimit(slug, limits);
     return {
       slug,
       disabled: disabled.has(slug),
       ...(contextWindow !== undefined ? { contextWindow } : {}),
       ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
+      ...(autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
     };
   });
 }

package/src/codex/catalog/native-models.ts

@@ -3,6 +3,9 @@ export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
 
 /** Native ChatGPT/Codex ids whose availability is proven per authenticated account. */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
 ]);
 
@@ -58,8 +61,8 @@ export function nativeOpenAiCapabilitySourceSlug(slug: string): string {
  * discover it on a clean install.
  *
  * Availability is not static: catalog sync and Pool routing require the account's authenticated
- * `/models` roster to contain the slug. An unconfirmed or unentitled account never receives the
- * request. `disabledModels` remains the independent user visibility control.
+ * `/models` roster to contain account-gated slugs. An unconfirmed or unentitled account never
+ * receives the request. `disabledModels` remains the independent user visibility control.
  *
  * Devlog: 260816_codexrs_multiagent_v2_and_history_perf/011 §4-bis.
  */

package/src/codex/catalog/parsing.ts

@@ -31,7 +31,8 @@ import { redactSecretString } from "../../lib/redact";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 
 
-import { NATIVE_OPENAI_CONTEXT_OVERRIDES, SUPPORTED_NATIVE_OPENAI_SLUGS, UPSTREAM_NATIVE_ENTRIES, isNativeOpenAiCapabilityAliasModel, nativeMultiAgentVersion, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type NativeContextLimitsInput } from "./metadata";
+import { NATIVE_OPENAI_CONTEXT_OVERRIDES, SUPPORTED_NATIVE_OPENAI_SLUGS, UPSTREAM_NATIVE_ENTRIES, isNativeOpenAiCapabilityAliasModel, nativeMultiAgentVersion, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type NativeContextLimitsInput } from "./metadata";
+import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 
@@ -111,6 +112,8 @@ export interface CatalogModel {
   defaultReasoningEffort?: string;
   contextWindow?: number;
   maxInputTokens?: number;
+  /** Soft client compaction threshold; hard context/input limits remain authoritative. */
+  autoCompactTokenLimit?: number;
   contextCap?: number;
   contextCapped?: boolean;
   inputModalities?: string[];
@@ -149,6 +152,9 @@ export const JAWCODE_CATALOG_AUGMENT_PROVIDERS = new Set(["opencode-go", "deepse
 export const ROUTED_MODEL_COMPATIBILITY_EXCLUSIONS = new Set([
   // Issue #82: Zen Go /models advertises HY3, but Console Go rejects it as outside the lite list.
   "opencode-go/hy3-preview",
+  // Issue #2330: OpenCode Go models absent from current documentation or returning terminal HTTP 400 errors.
+  "opencode-go/mimo-v2-omni",
+  "opencode-go/mimo-v2-pro",
 ]);
 
 export function isRoutedModelCompatibilityExcluded(slug: string): boolean {
@@ -191,6 +197,8 @@ export function shouldExposeRoutedModel(model: CatalogModel): boolean {
 }
 
 export function readCodexCatalogPath(): string {
+  const home = activeCodexHome();
+  if (home) return readCodexCatalogPathForHome(home);
   try {
     const configPath = activeCodexConfigPath();
     if (existsSync(configPath)) {
@@ -202,6 +210,35 @@ export function readCodexCatalogPath(): string {
   return activeDefaultCatalogPath();
 }
 
+/** Resolve the configured catalog without consulting ambient CODEX_HOME again. */
+export function readCodexCatalogPathForHome(codexHome: string): string {
+  try {
+    const configPath = join(codexHome, "config.toml");
+    if (existsSync(configPath)) {
+      const toml = readFileSync(configPath, "utf-8");
+      const path = readRootTomlString(toml, "model_catalog_json");
+      if (path) return resolve(codexHome, path);
+    }
+  } catch { /* ignore */ }
+  return join(codexHome, "opencodex-catalog.json");
+}
+
+/**
+ * Read the configured auto-review model from the root of Codex's config.toml (issue #1225).
+ * Stamped onto catalog entries as `auto_review_model_override` during sync so the auto-review
+ * subagent uses the operator's chosen model across catalog regenerations.
+ */
+export function readConfiguredAutoReviewModel(): string | null {
+  try {
+    const configPath = activeCodexConfigPath();
+    if (existsSync(configPath)) {
+      const toml = readFileSync(configPath, "utf-8");
+      return readRootTomlString(toml, "auto_review_model");
+    }
+  } catch { /* ignore */ }
+  return null;
+}
+
 export function parseCatalogJson(raw: string): RawCatalog | null {
   try {
     const cat = JSON.parse(raw);
@@ -274,22 +311,6 @@ export function isNativeOpenAiEntry(entry: RawEntry): boolean {
   return typeof entry.slug === "string" && !entry.slug.includes("/");
 }
 
-/**
- * Auto-compaction threshold for a native row.
- *
- * The usual rule is 90% of the window, but a row whose input ceiling sits below that has to
- * clamp to the ceiling instead — otherwise the client keeps filling until upstream answers
- * `context_length_exceeded` and compaction never gets a chance to run. Native GPT-5.6 no
- * longer trips this (922,000 window, 829,800 at 90%), but the routed and API-key rows carry
- * the same family at a 1,050,000 window where 90% would be 945,000 — past the ceiling.
- */
-function nativeAutoCompactLimit(contextWindow: number, maxInputTokens: number | undefined, contextCap?: number): number {
-  const ninety = Math.floor(contextWindow * 0.9);
-  if (typeof maxInputTokens !== "number" || maxInputTokens <= 0) return ninety;
-  const cappedMaxInput = applyProviderContextCap(maxInputTokens, contextCap) ?? maxInputTokens;
-  return Math.min(ninety, cappedMaxInput, contextWindow);
-}
-
 /**
  * Narrow any already-resolved native window by the user levers.
  *
@@ -315,6 +336,9 @@ export function applyNativeOpenAiContextOverride(entry: RawEntry, limits?: Nativ
     ?? (isNativeOpenAiEntry(entry) ? entry.slug as string : undefined);
   if (!nativeSlug) return;
   const override = NATIVE_OPENAI_CONTEXT_OVERRIDES[nativeSlug];
+  // Captured before any override/cap rewrites the row: a retained compaction threshold only
+  // describes the window it arrived with.
+  const incomingContextWindow = typeof entry.context_window === "number" ? entry.context_window : undefined;
   if (override) {
     // Read the effective values through the accessors rather than re-deriving them from the
     // static table: this function used to apply only the provider cap, so a per-model window
@@ -322,11 +346,6 @@ export function applyNativeOpenAiContextOverride(entry: RawEntry, limits?: Nativ
     if (typeof override.contextWindow === "number") {
       const contextWindow = nativeOpenAiContextWindow(nativeSlug, limits) ?? override.contextWindow;
       entry.context_window = contextWindow;
-      entry.auto_compact_token_limit = nativeAutoCompactLimit(
-        contextWindow,
-        nativeOpenAiMaxInputTokens(nativeSlug, limits) ?? override.maxInputTokens,
-        undefined,
-      );
     }
     if (typeof override.maxContextWindow === "number") {
       const maxContextWindow = narrowNativeMaxContextWindow(nativeSlug, override.maxContextWindow, limits);
@@ -341,17 +360,43 @@ export function applyNativeOpenAiContextOverride(entry: RawEntry, limits?: Nativ
   const cappedContext = narrowNativeMaxContextWindow(nativeSlug, currentContext, limits);
   if (cappedContext !== currentContext && typeof cappedContext === "number") {
     entry.context_window = cappedContext;
-    entry.auto_compact_token_limit = nativeAutoCompactLimit(
-      cappedContext,
-      nativeOpenAiMaxInputTokens(nativeSlug, limits) ?? override?.maxInputTokens,
-      undefined,
-    );
   }
   const currentMax = typeof entry.max_context_window === "number" ? entry.max_context_window : undefined;
   const cappedMax = narrowNativeMaxContextWindow(nativeSlug, currentMax, limits);
   if (cappedMax !== currentMax) {
     entry.max_context_window = cappedMax;
   }
+  const effectiveContext = typeof entry.context_window === "number" && entry.context_window > 0
+    ? entry.context_window
+    : undefined;
+  if (effectiveContext !== undefined) {
+    const derivedAutoCompactTokenLimit = nativeOpenAiAutoCompactTokenLimit(nativeSlug, limits);
+    // Only trust a retained threshold that still describes THIS window. When sync corrects the
+    // window, the old number is an artifact of the old one: a 115_200 limit retained from a
+    // 128k row would pin a corrected 272k model to 42% of its real window and compact every
+    // long turn early. Lower-is-policy still holds whenever the window is unchanged.
+    const retainedDescribesCurrentContext = incomingContextWindow === undefined
+      || incomingContextWindow === effectiveContext;
+    const retainedAutoCompactTokenLimit = retainedDescribesCurrentContext
+      && isNativeOpenAiEntry(entry)
+      && typeof entry.auto_compact_token_limit === "number"
+      && Number.isSafeInteger(entry.auto_compact_token_limit)
+      && entry.auto_compact_token_limit > 0
+      ? entry.auto_compact_token_limit
+      : undefined;
+    // A smaller threshold retained from Codex is policy evidence too. Configuration may
+    // lower it further, but catalog sync must never replace it with a larger default.
+    const loweringAutoCompactTokenLimit = retainedAutoCompactTokenLimit === undefined
+      ? derivedAutoCompactTokenLimit
+      : derivedAutoCompactTokenLimit === undefined
+        ? retainedAutoCompactTokenLimit
+        : Math.min(retainedAutoCompactTokenLimit, derivedAutoCompactTokenLimit);
+    entry.auto_compact_token_limit = clampAutoCompactTokenLimit(
+      effectiveContext,
+      nativeOpenAiMaxInputTokens(nativeSlug, limits) ?? override?.maxInputTokens,
+      loweringAutoCompactTokenLimit,
+    );
+  }
 }
 
 export function ensureStrictCatalogFields(