@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.0

package/src/activities/codemode-dispatcher.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { bindMcpTelemetry, measureMcpPhase, withMcpCallIdentity } from "@opengeni/observability";
 import {
   AttemptToolApprovalRequiredError,
   AttemptToolCatalogStaleError,
@@ -16,6 +17,8 @@ import {
   CODEMODE_MAX_CONCURRENT_CALLS_PER_ATTEMPT,
   type CodemodeOperation,
   type SessionEvent,
+  type ToolDisplayMetadata,
+  type ToolFamily,
 } from "@opengeni/contracts";
 import {
   cancelQueuedCodemodeOperationsForAttempt,
@@ -70,6 +73,9 @@ export class CodemodeAttemptDispatcher {
     private readonly turnSignal?: AbortSignal,
     private readonly maxConcurrentCalls = CODEMODE_MAX_CONCURRENT_CALLS_PER_ATTEMPT,
     timings: CodemodeDispatcherTimings = {},
+    private readonly toolDisplayMetadata?: (modelName: string) => ToolDisplayMetadata | undefined,
+    /** Content-free analytics family for a catalog entry; event enrichment only. */
+    private readonly toolFamily?: (entry: AttemptToolCatalogEntry) => ToolFamily | null,
   ) {
     if (
       environment.catalog.accountId !== scope.accountId ||
@@ -107,7 +113,7 @@ export class CodemodeAttemptDispatcher {
       throw new Error("Codemode dispatcher cannot be restarted");
     this.unsubscribe = this.bus.subscribeRequests(
       codemodeDispatchSubject(this.scope.workspaceId, this.scope.attemptId),
-      async (payload) => {
+      bindMcpTelemetry(async (payload) => {
         const request = decodeCodemodeDispatchRequest(payload);
         if (request.catalogDigest !== this.environment.catalog.digest || this.closing) {
           return encodeCodemodeDispatchAck({
@@ -136,11 +142,11 @@ export class CodemodeAttemptDispatcher {
             claimLeaseMs: this.claimLeaseMs,
           });
           if (claim.status === "claimed") {
-            const execution = this.execute(claim.operation, claim.claimId, claim.reclaimed).finally(
-              () => {
-                this.inFlight.delete(request.operationId);
-              },
-            );
+            const execution = withMcpCallIdentity(claim.operation.operationId, () =>
+              this.execute(claim.operation, claim.claimId, claim.reclaimed),
+            ).finally(() => {
+              this.inFlight.delete(request.operationId);
+            });
             this.inFlight.set(request.operationId, execution);
             return encodeCodemodeDispatchAck({
               version: 1,
@@ -169,7 +175,7 @@ export class CodemodeAttemptDispatcher {
         } finally {
           this.pendingClaims -= 1;
         }
-      },
+      }),
     );
   }
 
@@ -248,7 +254,11 @@ export class CodemodeAttemptDispatcher {
       );
       return;
     }
-    if (!(await this.ensureToolCallCreated(operation, entry, reclaimed))) {
+    if (
+      !(await measureMcpPhase("event_persistence", () =>
+        this.ensureToolCallCreated(operation, entry, reclaimed),
+      ))
+    ) {
       await this.failBeforeExecution(
         operation.operationId,
         claimId,
@@ -351,6 +361,7 @@ export class CodemodeAttemptDispatcher {
         return true;
       }
     }
+    const toolFamily = this.toolFamily?.(entry) ?? null;
     try {
       const created = await appendAndPublishTurnEventsFenced(
         this.db,
@@ -371,9 +382,14 @@ export class CodemodeAttemptDispatcher {
             payload: {
               id: operation.operationId,
               name: entry.modelName,
+              display: this.toolDisplayMetadata?.(entry.modelName) ?? {
+                toolName: entry.identity.toolName,
+                ...(entry.title ? { title: entry.title } : {}),
+              },
               arguments: operation.arguments,
               origin: "codemode",
               subjectId: operation.caller.subjectId,
+              ...(toolFamily ? { toolFamily } : {}),
               raw: {
                 type: "codemode_call",
                 serverId: operation.identity.serverId,
@@ -411,6 +427,18 @@ export class CodemodeAttemptDispatcher {
           errorCode: string;
           errorMessage: string;
         },
+  ): Promise<void> {
+    return withMcpCallIdentity(operation.operationId, () =>
+      measureMcpPhase("event_persistence", () =>
+        this.persistSettlement(operation, claimId, settlement),
+      ),
+    );
+  }
+
+  private async persistSettlement(
+    operation: CodemodeOperation,
+    claimId: string,
+    settlement: Parameters<CodemodeAttemptDispatcher["settleWithOutput"]>[2],
   ): Promise<void> {
     const result = await settleCodemodeOperationWithOutput(this.db, {
       ...this.scope,

package/src/activities/codex-capacity.ts

@@ -3,6 +3,9 @@ import {
   fetchCodexUsageForAccount,
   getCodexCapacityWaitForSession,
   getXaiCapacityWaitForSession,
+  getClaudeCapacityWaitForSession,
+  resolveClaudeWaiterSubject,
+  reconcileClaudeCapacityWait as reconcileClaudeCapacityWaitDb,
   resolveXaiWaiterSubject,
   listCodexAccountStatuses,
   listPendingCodexCapacityWakeTargets,
@@ -16,6 +19,7 @@ import { refreshExhaustedXaiQuota } from "./xai-quota";
 import {
   authoritativeCodexCapacityResetAt,
   codexAccountNeedsLiveCapacityRefresh,
+  codexAccountServesModel,
   isCodexCredentialEligible,
   isCodexCredentialHealthy,
   selectCodexCredentialLeaseForTurn,
@@ -90,8 +94,14 @@ export async function signalPendingCodexCapacityWakeTargets(
 
 export function codexCapacityDecision<TPolicyScope = never, TUnavailableDiagnostic = never>(
   context: CodexCapacitySelectionContext<TPolicyScope, TUnavailableDiagnostic>,
+  now = new Date(),
 ): ReturnType<Parameters<typeof reconcileCodexCapacityWaitDb>[2]> {
-  const now = new Date();
+  context = {
+    ...context,
+    accounts: context.accounts.filter(
+      (account) => !context.modelId || codexAccountServesModel(account, context.modelId, now),
+    ),
+  };
   const selected = selectCodexCredentialLeaseForTurn({
     context,
     sessionId: context.sessionId,
@@ -114,8 +124,12 @@ export function codexCapacityDecision<TPolicyScope = never, TUnavailableDiagnost
       credentialId: selected.credentialId,
       diagnostic: {
         connectedCount: context.accounts.length,
-        eligibleCount: context.accounts.filter((account) => isCodexCredentialEligible(account, now))
-          .length,
+        eligibleCount: context.accounts.filter(
+          (account) =>
+            (account.id === selected.credentialId ||
+              !context.failedCredentialIds?.includes(account.id)) &&
+            isCodexCredentialEligible(account, now),
+        ).length,
       },
     };
   }
@@ -134,8 +148,7 @@ export function codexCapacityDecision<TPolicyScope = never, TUnavailableDiagnost
       account.status === "active" &&
       account.allocatorEnabled &&
       account.exhaustedKind === "quota" &&
-      account.exhaustedUntil !== null &&
-      account.exhaustedUntil > now,
+      account.exhaustedUntil !== null,
   );
   const policyAccount = capacityAccounts[0] ?? null;
   const mutationOnlyStatusBlock =
@@ -162,7 +175,7 @@ export function codexCapacityDecision<TPolicyScope = never, TUnavailableDiagnost
     kind: "unavailable",
     earliestResetAt: authoritativeReset,
     resetKind:
-      selected.decision.kind === "none" ||
+      (selected.decision.kind === "none" && !hasReconcilableQuotaCooldown && !authoritativeReset) ||
       selected.decision.kind === "allocatorDisabled" ||
       mutationOnlyStatusBlock
         ? "mutation_only"
@@ -191,6 +204,16 @@ export async function armAndReconcileCodexCapacityWait(
   options: { onArmed?: () => void } = {},
 ) {
   const armed = await armCodexCapacityWait(services.db, input);
+  if (armed.action === "stopped") {
+    options.onArmed?.();
+    await publishDurableSessionEvents(
+      services.bus,
+      input.workspaceId,
+      input.sessionId,
+      armed.events,
+    );
+    return armed;
+  }
   if (armed.action !== "waiting") return armed;
 
   options.onArmed?.();
@@ -219,8 +242,9 @@ export async function armAndReconcileCodexCapacityWait(
 async function refreshCapacityMetadata(
   services: ControlActivityServices,
   workspaceId: string,
+  turnId: string,
 ): Promise<void> {
-  const accounts = await listCodexAccountStatuses(services.db, workspaceId).catch(() => []);
+  const accounts = await listCodexAccountStatuses(services.db, workspaceId, turnId).catch(() => []);
   const now = new Date();
   const stale = accounts.filter(
     (account) =>
@@ -231,7 +255,14 @@ async function refreshCapacityMetadata(
   await refreshCodexUsageAndRepairCapacityWaiters(
     stale.map(
       (account) => () =>
-        fetchCodexUsageForAccount(services.db, services.settings, workspaceId, account.id),
+        fetchCodexUsageForAccount(
+          services.db,
+          services.settings,
+          workspaceId,
+          account.id,
+          undefined,
+          turnId,
+        ),
     ),
     () => signalPendingCodexCapacityWakeTargets(services, workspaceId),
   );
@@ -248,10 +279,18 @@ export function createCodexCapacityActivities(services: () => Promise<ControlAct
     const xaiWaiter = codexWaiter
       ? null
       : await getXaiCapacityWaitForSession(db, input.workspaceId, input.sessionId);
-    const waiter = codexWaiter ?? xaiWaiter;
+    const claudeWaiter =
+      codexWaiter || xaiWaiter
+        ? null
+        : await getClaudeCapacityWaitForSession(db, input.workspaceId, input.sessionId);
+    const waiter = codexWaiter ?? xaiWaiter ?? claudeWaiter;
     return waiter
       ? {
-          ...(xaiWaiter ? { provider: "xai" as const } : {}),
+          ...(xaiWaiter
+            ? { provider: "xai" as const }
+            : claudeWaiter
+              ? { provider: "claude" as const }
+              : {}),
           waiterId: waiter.id,
           generation: waiter.generation,
           // A capacity mutation may have committed while its Temporal signal
@@ -271,21 +310,17 @@ export function createCodexCapacityActivities(services: () => Promise<ControlAct
     input: ReconcileCodexCapacityWaitInput,
   ): Promise<ReconcileCodexCapacityWaitResult> {
     const resolved = await services();
-    if (input.provider === "xai") {
-      const current = await getXaiCapacityWaitForSession(
-        resolved.db,
-        input.workspaceId,
-        input.sessionId,
-      );
+    if (input.provider === "xai" || input.provider === "claude") {
+      const claude = input.provider === "claude";
+      const getWaiter = claude ? getClaudeCapacityWaitForSession : getXaiCapacityWaitForSession;
+      const resolveAuthority = claude ? resolveClaudeWaiterSubject : resolveXaiWaiterSubject;
+      const reconcile = claude ? reconcileClaudeCapacityWaitDb : reconcileXaiCapacityWaitDb;
+      const current = await getWaiter(resolved.db, input.workspaceId, input.sessionId);
       if (!current || current.id !== input.waiterId || current.generation !== input.generation) {
         return { action: "stale" };
       }
-      const authority = await resolveXaiWaiterSubject(
-        resolved.db,
-        input.workspaceId,
-        input.sessionId,
-      );
-      if (authority)
+      const authority = await resolveAuthority(resolved.db, input.workspaceId, input.sessionId);
+      if (authority && !claude)
         await refreshExhaustedXaiQuota({
           db: resolved.db,
           settings: resolved.settings,
@@ -296,7 +331,7 @@ export function createCodexCapacityActivities(services: () => Promise<ControlAct
           subjectId: authority.subjectId,
           authoritySnapshot: authority.snapshot,
         });
-      const result = await reconcileXaiCapacityWaitDb(resolved.db, {
+      const result = await reconcile(resolved.db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
         sessionId: input.sessionId,
@@ -314,7 +349,7 @@ export function createCodexCapacityActivities(services: () => Promise<ControlAct
       if (result.action === "waiting") {
         return {
           action: "waiting",
-          provider: "xai",
+          provider: input.provider,
           waiterId: result.waiter.id,
           generation: result.waiter.generation,
           nextCheckAt: result.waiter.nextCheckAt.toISOString(),
@@ -338,7 +373,7 @@ export function createCodexCapacityActivities(services: () => Promise<ControlAct
     if (boundedRefreshAttempted) {
       // This is a bounded secret-safe control-plane quota refresh. It creates no
       // turn, model call, user message, schedule, or entitlement action.
-      await refreshCapacityMetadata(resolved, input.workspaceId);
+      await refreshCapacityMetadata(resolved, input.workspaceId, current.blockedTurnId);
     }
     const result = await reconcileCodexCapacityWaitDb(
       resolved.db,

package/src/activities/codex-rotation.ts

@@ -1,3 +1,4 @@
+import { subscriptionAccountShardIndex } from "@opengeni/config";
 // Multi-account P3 — the PURE rotation ranker. Zero I/O: no provider calls, no
 // decrypts, no db. It consumes the already-loaded, metadata-only account list
 // (cached usage columns + the exhausted_until cooldown column) and returns the
@@ -12,23 +13,38 @@ import type {
   CodexLeaseAccountStatus,
   CodexPinSource,
 } from "@opengeni/db";
+import { codexPlanExcludesModel, connectionModelAllowed } from "@opengeni/db";
 
 export type CodexRotationAccount = CodexAccountStatus | CodexLeaseAccountStatus;
 
+/**
+ * Model-scoped allocation filter: user connection policy plus proven plan
+ * entitlement. A plan exclusion applies only until it expires (one request
+ * then re-probes the account) or a different plan is observed.
+ */
+export function codexAccountServesModel(
+  account: Pick<CodexRotationAccount, "allowedModelIds" | "planType" | "planEntitlementExclusion">,
+  modelId: string,
+  now: Date,
+): boolean {
+  return (
+    connectionModelAllowed(account.allowedModelIds, modelId) &&
+    !codexPlanExcludesModel(account, modelId, now)
+  );
+}
+
 /** Capacity metadata worth an authoritative live read before/all through an idle. */
 export function codexAccountNeedsLiveCapacityRefresh(
   account: Pick<
     CodexAccountStatus,
     "primaryUsedPercent" | "secondaryUsedPercent" | "exhaustedUntil" | "exhaustedKind"
   >,
-  now: Date,
+  _now: Date,
 ): boolean {
   return (
     (account.primaryUsedPercent ?? 0) >= CODEX_USAGE_EXHAUSTED_PCT ||
     (account.secondaryUsedPercent ?? 0) >= CODEX_USAGE_EXHAUSTED_PCT ||
-    (account.exhaustedKind === "quota" &&
-      account.exhaustedUntil !== null &&
-      account.exhaustedUntil > now)
+    (account.exhaustedKind === "quota" && account.exhaustedUntil !== null)
   );
 }
 
@@ -208,17 +224,6 @@ export function isCodexAccountEligible(acct: CodexRotationAccount, now: Date): b
   return isCodexCredentialEligible(acct, now);
 }
 
-/** Deterministic 32-bit FNV-1a over a UTF-16 code-unit stream. Pure, allocation-free. */
-function fnv1a32(input: string): number {
-  let hash = 0x811c9dc5;
-  for (let i = 0; i < input.length; i++) {
-    hash ^= input.charCodeAt(i);
-    // 32-bit FNV prime multiply via Math.imul; `>>> 0` keeps it unsigned.
-    hash = Math.imul(hash, 0x01000193);
-  }
-  return hash >>> 0;
-}
-
 /**
  * Session-sharded HOME account (AM-6): the deterministic account a session runs on
  * under the "sharded" strategy — `stableAccountList[ hash(sessionId) % N ]` over the
@@ -248,7 +253,7 @@ export function shardCredentialForSession(args: {
   if (eligibles.length === 0) {
     return null;
   }
-  const index = fnv1a32(sessionId) % eligibles.length;
+  const index = subscriptionAccountShardIndex(sessionId, eligibles.length);
   return eligibles[index]!.id;
 }
 
@@ -524,8 +529,19 @@ export function selectCodexCredentialLeaseForTurn<
   sessionLastCredentialId: string | null;
   now: Date;
 }): CodexTurnLeaseSelection {
-  const { accounts, activeCredentialId, rotationEnabled, rotationStrategy, existingCredentialId } =
+  const { activeCredentialId, rotationEnabled, rotationStrategy, existingCredentialId } =
     args.context;
+  if (args.context.failoverExhausted) {
+    return { credentialId: null, decision: { kind: "none" }, advanceActivePointer: false };
+  }
+  // User model policy and proven plan entitlement both remove an account for
+  // this model only. A plan exclusion is provider truth, never user policy; it
+  // becomes inert when a different plan is observed or its TTL elapses.
+  const accounts = args.context.modelId
+    ? args.context.accounts.filter((account) =>
+        codexAccountServesModel(account, args.context.modelId!, args.now),
+      )
+    : args.context.accounts;
   const failedCredentialIds = new Set(args.context.failedCredentialIds ?? []);
   // Normalized: rotation-enabled always behaves as sharded (see
   // effectiveRotationStrategy); the stored value is only ever legacy residue.
@@ -564,6 +580,9 @@ export function selectCodexCredentialLeaseForTurn<
     if (!pinned) {
       return { credentialId: null, decision: { kind: "none" }, advanceActivePointer: false };
     }
+    if (failedCredentialIds.has(pinned.id)) {
+      return { credentialId: null, decision: { kind: "none" }, advanceActivePointer: false };
+    }
     if (!pinned.allocatorEnabled) {
       return {
         credentialId: null,
@@ -633,6 +652,9 @@ export function selectCodexCredentialLeaseForTurn<
     if (!active) {
       return { credentialId: null, decision: { kind: "none" }, advanceActivePointer: false };
     }
+    if (failedCredentialIds.has(active.id)) {
+      return { credentialId: null, decision: { kind: "none" }, advanceActivePointer: false };
+    }
     if (!active.allocatorEnabled) {
       return {
         credentialId: null,

package/src/activities/context-compaction.ts

@@ -1,3 +1,4 @@
+import { readReasoningConfiguration } from "@opengeni/codex";
 import {
   applyContextCompaction,
   getActiveSessionHistoryItemsPaged,
@@ -8,7 +9,8 @@ import {
 import {
   EmptyCompactionSummaryError,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
-  SUMMARY_BUFFER_TOKENS,
+  compactionSummaryOutputTokens,
+  buildSummaryItem,
   buildCompactionReplacementHistory,
   buildRemoteV2ReplacementHistory,
   compactionThresholdTokens,
@@ -21,6 +23,7 @@ import {
   sanitizeHistoryItemsForModel,
   summarizeForCompaction,
   type CompactionItem,
+  type CompactionProviderRejection,
 } from "@opengeni/runtime";
 import { contextInputBudgetTokens, type Settings } from "@opengeni/config";
 import type { SessionEvent } from "@opengeni/contracts";
@@ -56,7 +59,13 @@ export type MaybeCompactResult =
  * Codex, call Codex `/codex/responses` with `compaction_trigger` and persist the
  * opaque compaction item. Fail closed — never silently fall back to portable.
  */
-export type CompactionSummarizer = (settings: Settings, input: CompactionItem[]) => Promise<string>;
+export type CompactionSummarizer = ((
+  settings: Settings,
+  input: CompactionItem[],
+) => Promise<string>) & {
+  /** Model-visible instructions and tool schemas outside the history estimate. */
+  estimatePrefixTokens?: () => number;
+};
 
 /** Returns the opaque Codex remote compaction v2 item. */
 export type RemoteCompactionV2Requester = (
@@ -79,7 +88,7 @@ export async function maybeCompactContext(
   // Injectable for tests; defaults to the real provider-aware model call.
   summarize: CompactionSummarizer = (s, m) =>
     summarizeForCompaction(s, m, {
-      maxOutputTokens: SUMMARY_BUFFER_TOKENS,
+      maxOutputTokens: compactionSummaryOutputTokens(s.contextWindowTokens),
     }),
   // Operator-forced (the /compact command): bypass the budget trigger and
   // compact now if there is anything to summarize. Structural guards still hold.
@@ -260,6 +269,12 @@ export async function settleFailedContextCompactionLandmark(
   options: {
     clearRequestedCompaction?: boolean;
     publishLiveEvents?: (events: SessionEvent[]) => Promise<void>;
+    /**
+     * Closed identifier record of a definitive provider rejection. Carried on
+     * the visible `compaction.skipped` landmark so the timeline can name the
+     * rejected field instead of offering a retry that cannot succeed.
+     */
+    providerRejection?: CompactionProviderRejection | null;
   } = {},
 ): Promise<Extract<MaybeCompactResult, { compacted: false }>> {
   const settled = await settleSkippedAfterStart(db, scope, options, "summarization_failed");
@@ -287,10 +302,12 @@ async function settleSkippedAfterStart(
   },
   options: {
     clearRequestedCompaction?: boolean;
+    providerRejection?: CompactionProviderRejection | null;
   },
   reason:
     | "no_history"
     | "replacement_not_smaller"
+    | "replacement_exceeds_model_budget"
     | "replacement_unchanged"
     | "summarization_failed",
 ): Promise<Extract<MaybeCompactResult, { compacted: false }>> {
@@ -304,6 +321,7 @@ async function settleSkippedAfterStart(
     // an operator `/compact` flag — auto/overflow never set one.
     requirePendingRequest: false,
     clearRequestedCompaction,
+    ...(options.providerRejection ? { providerRejection: options.providerRejection } : {}),
   });
   if (!skipped.recorded) {
     throw new TurnAttemptFencedError(
@@ -370,7 +388,10 @@ async function compactContextRemoteV2(
   );
   const estimatedTokensAfter = estimateTokens(await projectForWire(replacementHistory));
   const replacementFingerprint = compactionReplacementFingerprint(replacementHistory);
-  const tailItem = replacementHistory.at(-1);
+  const summaryIndex =
+    replacementHistory.length -
+    (readReasoningConfiguration(replacementHistory.at(-1) ?? {}) ? 2 : 1);
+  const tailItem = replacementHistory[summaryIndex];
   if (!tailItem) {
     throw new EmptyCompactionSummaryError({
       stage: "remote_v2_replacement",
@@ -384,7 +405,10 @@ async function compactContextRemoteV2(
     turnId: scope.turnId,
     expectedExecutionGeneration: scope.executionGeneration,
     expectedAttemptId: scope.attemptId,
-    replacementItems: replacementHistory.slice(0, -1),
+    replacementItems: replacementHistory.slice(0, summaryIndex),
+    ...(replacementHistory.length > summaryIndex + 1
+      ? { trailingItems: replacementHistory.slice(summaryIndex + 1) }
+      : {}),
     summaryItem: tailItem as Record<string, unknown>,
     ...(options.clearRequestedCompaction ? { clearRequestedCompaction: true } : {}),
     eventPayload: {
@@ -439,15 +463,29 @@ async function compactContextPortable(
   const summarized = await summarizeWithCodexOverflowTrimming(summarize, settings, items);
   const summaryBody = summarized.summaryBody;
   const retainedTokens = await retentionTokenCounts(canonicalItems, projectForWire);
+  const outputReserve = compactionSummaryOutputTokens(settings.contextWindowTokens);
+  const structuralBudget = Math.min(
+    contextInputBudgetTokens(settings) || settings.contextWindowTokens - outputReserve,
+    settings.contextWindowTokens - outputReserve,
+  );
+  const prefixTokens = Math.max(0, Math.ceil(summarize.estimatePrefixTokens?.() ?? 0));
+  const summaryTokens = estimateTokens([buildSummaryItem(summaryBody)]);
   const replacementHistory = buildCompactionReplacementHistory(
     canonicalItems,
     summaryBody,
     (item) => retainedTokens.get(item) ?? estimateTokens([item]),
+    Math.min(outputReserve, Math.max(0, structuralBudget - prefixTokens - summaryTokens)),
   );
   const estimatedTokensAfter = estimateTokens(await projectForWire(replacementHistory));
+  if (estimatedTokensAfter + prefixTokens > structuralBudget) {
+    return await settleSkippedAfterStart(db, scope, options, "replacement_exceeds_model_budget");
+  }
   const replacementFingerprint = compactionReplacementFingerprint(replacementHistory);
   const previousReplacementFingerprint = latestCompactionReplacementFingerprint(canonicalItems);
-  const summaryItem = replacementHistory.at(-1);
+  const summaryIndex =
+    replacementHistory.length -
+    (readReasoningConfiguration(replacementHistory.at(-1) ?? {}) ? 2 : 1);
+  const summaryItem = replacementHistory[summaryIndex];
   if (!summaryItem) {
     // Started already fanout; settle visibly so the landmark cannot stick on
     // "Compacting…". This is not an operator-request clear path.
@@ -466,7 +504,10 @@ async function compactContextPortable(
     turnId: scope.turnId,
     expectedExecutionGeneration: scope.executionGeneration,
     expectedAttemptId: scope.attemptId,
-    replacementItems: replacementHistory.slice(0, -1),
+    replacementItems: replacementHistory.slice(0, summaryIndex),
+    ...(replacementHistory.length > summaryIndex + 1
+      ? { trailingItems: replacementHistory.slice(summaryIndex + 1) }
+      : {}),
     summaryItem: summaryItem as Record<string, unknown>,
     ...(options.clearRequestedCompaction ? { clearRequestedCompaction: true } : {}),
     eventPayload: {
@@ -498,7 +539,7 @@ async function compactContextPortable(
   };
 }
 
-async function summarizeWithCodexOverflowTrimming(
+export async function summarizeWithCodexOverflowTrimming(
   summarize: CompactionSummarizer,
   settings: Settings,
   activeHistory: CompactionItem[],
@@ -509,17 +550,32 @@ async function summarizeWithCodexOverflowTrimming(
 }> {
   // Codex's estimator is intentionally coarse. Keep the explicit checkpoint
   // request below both the effective input window and the raw window minus the
-  // requested summary, then leave 15% estimator headroom. This changes only the
-  // temporary summarizer input; durable active history remains untouched until
-  // applyContextCompaction succeeds under the attempt fence.
-  const summaryAwareBudget = Math.max(0, settings.contextWindowTokens - SUMMARY_BUFFER_TOKENS);
+  // requested summary. Preserve the full portable history copy on the first
+  // call whenever it fits; only trim further after an actual provider overflow.
+  // Durable active history remains untouched until applyContextCompaction.
+  const summaryAwareBudget = Math.max(
+    0,
+    settings.contextWindowTokens - compactionSummaryOutputTokens(settings.contextWindowTokens),
+  );
   const configuredInputBudget = contextInputBudgetTokens(settings);
   const structuralBudget = Math.min(
     configuredInputBudget > 0 ? configuredInputBudget : summaryAwareBudget,
     summaryAwareBudget,
   );
-  const initialBudget = Math.floor(structuralBudget * 0.85);
+  const prefixTokens = Math.max(0, Math.ceil(summarize.estimatePrefixTokens?.() ?? 0));
+  const initialBudget = Math.max(0, structuralBudget - prefixTokens);
   let preparation = prepareCompactionPromptInput(activeHistory, initialBudget);
+  // A checkpoint prompt without source history cannot summarize that history.
+  // Do not let a plausible-sounding reply replace durable active context.
+  const requireHistory = () => {
+    if (activeHistory.length > 0 && preparation.input.length === 1) {
+      throw new EmptyCompactionSummaryError({
+        stage: "portable_input_budget",
+        reason: "no_history_fit",
+      });
+    }
+  };
+  requireHistory();
   try {
     return {
       summaryBody: await summarize(settings, preparation.input),
@@ -529,15 +585,16 @@ async function summarizeWithCodexOverflowTrimming(
   } catch (error) {
     if (!isContextWindowExceeded(error)) throw error;
     // The provider is more authoritative than the byte/4 estimate. Refit once
-    // to 70% of both the configured target and the actual prepared estimate;
+    // to 40% of both the available target and the actual prepared estimate;
     // then fail terminally with prior history intact. Never issue one failing
-    // request per oldest item. The production incident proved that the
-    // provider can count slightly more than twice the byte/4 estimate, so a
-    // half-size retry is the smallest honest bound for that observed skew.
+    // request per oldest item. The retry is bounded, not a guarantee: the
+    // provider can count slightly more than twice the byte/4 estimate. The
+    // prepared prefix has already been reserved from the available budget.
     const retryBudget = Math.floor(
-      Math.min(initialBudget * 0.5, preparation.estimatedInputTokens * 0.5),
+      Math.min(initialBudget * 0.4, preparation.estimatedInputTokens * 0.4),
     );
     preparation = prepareCompactionPromptInput(activeHistory, retryBudget);
+    requireHistory();
     return {
       summaryBody: await summarize(settings, preparation.input),
       preparation,