pi-openai-toolkit 0.22.0 → 0.22.2

package/README.md

@@ -56,13 +56,13 @@ Set `context.remoteCompaction.model` to use a separate producer on the same effe
 
 **Remote windows** require the native `openai-codex` provider with `openai-codex-responses`, or an `openai-responses` gateway implementing the protocol. Gateways require `compatibility.transport: "codex-gateway"` on the exact model entry. This setting does not add the capability to an ordinary compatible endpoint.
 
-Change `mode` in the example above to `remote-windows`. Eligible sessions expose `new_context`, `get_context_remaining`, `history`, and `notes`. Manual `/compact [instructions]` starts a checkpoint handoff: write notes successfully, then switch windows. Models without window capability use only the current local window projection: retired Remote Context history is not sent to the model or to a configured compaction producer. A no-summary local boundary preserves the persisted Remote Window / Context Session, so switching back to a supported model reuses the same window instead of opening a duplicate one. The legacy `leaveManagedMode` setting is retained for config compatibility but no longer triggers bulk close-out compaction.
+Change `mode` in the example above to `remote-windows`. Eligible sessions expose `new_context`, `get_context_remaining`, `history`, and `notes`. Manual `/compact [instructions]` starts a checkpoint handoff: write notes successfully, then switch windows. An existing effective window boundary survives model changes and switches to `remote-compaction` or `pi`: only the current local window is used, and retired Remote Context history is not sent to the model or a compaction producer. A no-summary local boundary preserves the persisted Remote Window / Context Session, so switching back to a supported model reuses the same window instead of opening a duplicate one. The legacy `leaveManagedMode` setting is retained for config compatibility but no longer triggers bulk close-out compaction.
 
 Remote windows use alpha endpoints that may change upstream. When switching models, the remote window remains persisted and reusable; see the [window lifecycle](docs/internals.md#rollover-lifecycle).
 
 ## Codex Fast
 
-Fast is OFF by default. In the terminal, run `/fast` to turn it ON, then run `/fast` again to turn it OFF. The status bar shows `Fast ON`, `Fast OFF`, or `Fast N/A` for an ineligible route. No Fast configuration is needed.
+Fast is OFF by default. Run `/fast` in Pi's terminal or a UI-backed RPC client such as pi-web to turn it ON, then run it again to turn it OFF. Notifications confirm changes; the status is `Fast ON`, `Fast OFF`, or `Fast N/A` for an ineligible route, with display placement controlled by the client. Print/JSON and headless commands cannot toggle Fast. No Fast configuration is needed.
 
 Supports native Codex and recognizable GPT/Codex models on compatible Responses gateways. The selection is saved only in the current session: reload/resume and `new_context` retain it; new or forked sessions start OFF. ON requests Fast, while OFF requests Standard, overriding an existing service-tier preference on eligible conversation requests without changing reasoning effort or configuration files.
 

package/README.zh.md

@@ -56,13 +56,13 @@ Toolkit 只读取一个全局配置文件，即使扩展安装在项目内也一
 
 **远程窗口**需要原生 `openai-codex` 提供商的 `openai-codex-responses` API，或支持相应协议的 `openai-responses` 网关。网关必须在精确模型下设置 `compatibility.transport: "codex-gateway"`；这一设置不会让普通兼容端点自动获得该能力。
 
-将上例的 `mode` 改为 `remote-windows` 后，符合条件的会话会提供 `new_context`、`get_context_remaining`、`history` 和 `notes`。手动 `/compact [instructions]` 会发起检查点交接：先成功写入 notes，再切换窗口。不具备窗口能力的模型只使用当前本地窗口投影：已经由 Remote Context 托管的旧窗口历史不会发送给该模型，也不会发送给配置的 compaction 模型。扩展会用一个不生成摘要的本地边界保留已持久化的 Remote Window / Context Session；切回支持窗口的模型时会复用同一个窗口，不会重复创建。旧配置中的 `leaveManagedMode` 仍会解析，但不再触发批量 close-out 压缩。
+将上例的 `mode` 改为 `remote-windows` 后，符合条件的会话会提供 `new_context`、`get_context_remaining`、`history` 和 `notes`。手动 `/compact [instructions]` 会发起检查点交接：先成功写入 notes，再切换窗口。切换模型或改用 `remote-compaction`、`pi` 模式后，已有的有效窗口边界仍然生效：只使用当前本地窗口，旧窗口历史不会发送给新模型或 compaction 模型。扩展会用一个不生成摘要的本地边界保留已持久化的 Remote Window / Context Session；切回支持窗口的模型时会复用同一个窗口，不会重复创建。旧配置中的 `leaveManagedMode` 仍会解析，但不再触发批量 close-out 压缩。
 
 远程窗口依赖 alpha 接口，上游可能随时调整。切换模型时远程窗口状态仍会持久化并可复用，详见[窗口生命周期](docs/internals.md#rollover-lifecycle)。
 
 ## Codex Fast
 
-Fast 默认关闭。在终端输入 `/fast` 开启，再输入一次 `/fast` 关闭。状态栏显示 `Fast ON`、`Fast OFF`，不适用的路由显示 `Fast N/A`。无需添加 Fast 配置。
+Fast 默认关闭。在 Pi 终端或 pi-web 等支持 UI 的 RPC 客户端中输入 `/fast` 开启，再输入一次关闭。切换结果通过通知确认；状态为 `Fast ON`、`Fast OFF`，不适用的路由为 `Fast N/A`，显示位置由客户端决定。print/JSON 和无 UI 模式不能切换 Fast。无需添加 Fast 配置。
 
 支持原生 Codex，以及兼容 Responses 网关中可识别的 GPT/Codex 模型。开关只保存在当前会话：reload、续聊和 `new_context` 保留状态，新建或 fork 的会话默认关闭。开启时请求 Fast，关闭时请求标准档，会覆盖符合条件的对话请求中原有的服务档位，但不改变 reasoning effort 或配置文件。
 

package/docs/configuration.md

@@ -56,7 +56,7 @@ Place `context` under `defaults` or an exact `models` entry.
 
 | Relative field | Default | Contract |
 | --- | --- | --- |
-| `mode` | `"remote-compaction"` | `"pi"` relinquishes Toolkit context management; `"remote-compaction"` uses the eligible Responses checkpoint path; `"remote-windows"` selects Codex windows where supported. |
+| `mode` | `"remote-compaction"` | `"pi"` delegates ordinary context management to Pi; `"remote-compaction"` uses the eligible Responses checkpoint path; `"remote-windows"` selects Codex windows where supported. |
 | `remoteCompaction.model` | `null` | Exact producer reference; `null` uses the active model. In `remote-compaction`, it selects the synthetic checkpoint producer on the same effective base URL. In active `remote-windows`, manual `/compact` temporarily selects it for notes checkpoint duty on the same backend/account. |
 | `remoteCompaction.inputSource` | `"legacy"` | `"legacy"` preserves session/raw-branch input; `"pi-context-hook"` opts into Pi's ordered context projection. Checkpoint provenance must match. |
 | `remoteCompaction.allowContinuityBreak` | `false` | Allow restarting from Pi context after a foreign compaction entry. It does not make malformed opaque checkpoints replayable. |
@@ -71,7 +71,7 @@ Ordinary remote compaction tries V2 first. One automatic standalone `/v1/respons
 
 Standalone success preserves the full canonical output window, including retained items, rather than treating retained assistant text as a summary. When actual remote attempts are exhausted, Toolkit warns that no encrypted checkpoint was produced and starts the existing native text-summary chain: the configured remote producer after a remote attempt, or `nativeFallback.model` when remote compaction is unavailable. `nativeFallback.enabled: false` disables only the configured-model tier; disabled/unset/same-model selections still permit Pi's default summary. Explicit summary-model failures and checkpoint-integrity failures cancel. OpenAI subscription-sharing OAuth can reject compaction; separately authenticating native Codex is a different route, not a way to reuse that grant. See the [wire contract](internals.md#remote-compaction-v2-wire-contract).
 
-Native Codex eligibility derives from the actual Pi provider/API. Gateways additionally need the exact transport opt-in below. `remote-windows` keeps the Remote Window state persisted when a model without window capability is selected: that model receives only the current local window, while retired/managed Remote Context history is excluded from live requests and compaction producers. A no-summary boundary preserves the marker for later reuse. A configured window model whose activation fails does not silently receive a summary fallback. Normal `new_context` keeps its persisted-notes, duplicate and cooldown gates. Synthetic Remote V2 producer/consumer identity and checkpoint provenance are unchanged. See [Toolkit internals](internals.md).
+Native Codex eligibility derives from the actual Pi provider/API. Gateways additionally need the exact transport opt-in below. An existing effective Remote Window boundary survives model and context-mode changes, including `remote-compaction`, `pi`, and legacy disabled/off settings. A non-window consumer receives only the current local window; retired Remote Context history is excluded from live requests and compaction producers. This local safety check does not activate Remote tools or protocol support. A no-summary boundary preserves the marker for later reuse. A configured window model whose activation fails does not silently receive a summary fallback. Normal `new_context` keeps its persisted-notes, duplicate and cooldown gates. Synthetic Remote V2 producer/consumer identity and checkpoint provenance are unchanged. See [Toolkit internals](internals.md).
 
 In active `remote-windows`, `/compact [instructions]` starts checkpoint duty rather than producing a summary. The selected model must authenticate to the same native backend/account or gateway credential/affinity domain, fit the projected window plus its output reserve, and retain the required permitted context tools. Invalid or unsuitable explicit targets are refused without switching to a fallback model. The entire handoff uses the initiating context-policy snapshot; no config or global Pi defaults are rewritten.
 

package/docs/internals.md

@@ -29,7 +29,7 @@ Selected invalid policy blocks dependent operations; unrelated model errors rema
 
 ### Codex Fast session control
 
-[src/codex-fast/extension.ts](../src/codex-fast/extension.ts) registers the human-only, no-argument `/fast` toggle and an owned `ctx.ui.setStatus()` item. Default OFF requests `service_tier: "default"`; ON requests `"priority"`, the Codex Fast wire value. The status is the local request preference, not verified server acceptance or latency. Fast can increase usage/cost. No config setting, model tool, credential probe, retry, new header, reasoning-effort change or custom footer is added.
+[src/codex-fast/extension.ts](../src/codex-fast/extension.ts) registers the human-only, no-argument `/fast` toggle and an owned `ctx.ui.setStatus()` item. The command accepts UI-backed TUI/RPC (including pi-web) and older UI contexts without `mode`; print/JSON and headless commands cannot toggle. Notifications confirm changes, while status rendering belongs to the client. Default OFF requests `service_tier: "default"`; ON requests `"priority"`, the Codex Fast wire value. The status is the local request preference, not verified server acceptance or latency. Fast can increase usage/cost. No config setting, model tool, credential probe, retry, new header, reasoning-effort change or custom footer is added.
 
 Native `openai-codex-responses` routes qualify. Non-official HTTP(S) `openai-responses` gateways qualify for recognizable GPT/Codex IDs or an existing exact Codex gateway identity, including a resolved virtual route. Unknown opaque aliases without that identity, Azure, other APIs and ordinary `api.openai.com` API-key routes remain untouched. A capability marker is not backend entitlement.
 
@@ -37,7 +37,7 @@ Version-1 `pi-openai-toolkit:codex-fast` custom entries contain only the owning
 
 The payload hook takes one selection snapshot and returns a new object only when a matching ordinary Responses request needs a tier change. Explicit OFF also overrides an existing Fast/Flex tier to Standard. Dedicated compaction shapes and malformed/foreign payloads are left unchanged. Fast loads after Web Search/image registration and before the final Astra effort pass, so its tier does not alter the pre-search cached extras used by separate search/image/compaction clients.
 
-Native Pi and Toolkit gateway WebSocket adapters already compare non-input body fields before incremental reuse. A changed `service_tier` invalidates the incompatible `previous_response_id` delta; the existing transport/retry logic is retained. Offline official-Pi fixtures in [test/pi-codex-fast.test.ts](../test/pi-codex-fast.test.ts) cover terminal command/status, actual native/gateway HTTP/WebSocket bodies, saved reopen/reload, fork isolation and continuation transitions. They do not establish live Fast availability.
+Native Pi and Toolkit gateway WebSocket adapters already compare non-input body fields before incremental reuse. A changed `service_tier` invalidates the incompatible `previous_response_id` delta; the existing transport/retry logic is retained. Offline official-Pi fixtures in [test/pi-codex-fast.test.ts](../test/pi-codex-fast.test.ts) cover TUI/RPC command/status/notifications, actual native/gateway HTTP/WebSocket bodies, saved reopen/reload, fork isolation and continuation transitions. They do not establish live Fast availability.
 
 ---
 
@@ -63,7 +63,7 @@ Coverage is never inferred from model names. A native session uses provider `ope
 
 The four Toolkit context tools are `new_context`, `get_context_remaining`, `history`, and `notes`. The canonical names live in [src/context-management/tool-contract.ts](../src/context-management/tool-contract.ts). A launcher that creates a Pi session for an exact `compaction.gatewayContextModels` model should union those names into an explicit `tools` allowlist before `createAgentSession`, unless the caller selected `noTools`/`--no-tools`; an explicit `excludeTools` entry remains authoritative and is never re-added. This package does not contain the `pi-subagent` or child-session launcher source, so the helper and contract here do not claim to modify that external layer.
 
-After registration, Pi's published registry is authoritative. Toolkit distinguishes `verified` (all four owned definitions), `excluded` (a readable registry contains none of them), `unverified` (a transient read or partial publication), and `conflict` (registration/API/ownership failure). Only `excluded` is a live-turn downgrade: `context_with_system` strips internal window markers, provider payload/header hooks return no-op results, and the lifecycle artifact records `context-tools-excluded`. Conflicts, unreadable/partial registries, malformed window state and missing gateway identity remain fail-closed for live provider requests.
+After registration, Pi's published registry is authoritative. Toolkit distinguishes `verified` (all four owned definitions), `excluded` (a readable registry contains none of them), `unverified` (a transient read or partial publication), and `conflict` (registration/API/ownership failure). Only `excluded` is a live-turn downgrade: `context_with_system` applies the safe local projection at any effective inherited window boundary and strips internal markers, provider payload/header hooks return no-op results, and the lifecycle artifact records `context-tools-excluded`. Without an owned boundary, ordinary child requests remain unchanged apart from marker filtering. Conflicts, unreadable/partial registries, malformed window state and missing gateway identity remain fail-closed for live provider requests.
 
 If a covered Remote Context session reaches `session_before_compact` without an active context runtime, the first compaction path is the configured `compaction.remoteCompactModel` through Remote V2. The active session model remains the checkpoint consumer; the configured remote model is only the compactor. If that model is missing/unusable, only an explicitly configured/enabled `nativeFallback.model` may run. Otherwise the hook cancels rather than silently invoking the active model or Pi's default compaction. This compaction fallback does not weaken the live-provider safety rules above.
 
@@ -110,7 +110,7 @@ State invariants the lifecycle code must keep honest:
 - Pi's canonical session projection is the source of effective history. Toolkit may further restrict that projection, but never reconstruct omitted or summarized messages from the raw branch. Boundary resolution uses projected source entries and the active branch's latest compaction; an older marker retained inside a newer compaction does not authorize dropping that compaction's summary.
 - Window identity and cleanup eligibility are separate. A persisted `codex-context-window` message restores identity after reload/fork, but its historical `trimPreviousWindow` flag is not an outstanding command. A newer native summary or opaque checkpoint supersedes old cleanup without erasing window identity. Missing or edited boundary evidence is never repaired by loading raw history.
 - Maintenance compaction and local-consumer detachment use the same effective-boundary rules. Only a safe current boundary can produce a no-summary compaction; obsolete cleanup must not move the retained start backwards or replace a newer summary/checkpoint. Preparation alone changes no durable state, and cancellation, retry and branch navigation are resolved from current evidence rather than callback acknowledgments. User manual `/compact` still follows the managed handoff below.
-- A non-window consumer receives only the effective current context, with the system/tool head preserved and internal window markers removed. When detachment is needed, no compaction producer receives retired Remote history. Once a later ordinary compaction owns effective context, the historical window does not suppress its summary or valid opaque replay. A genuinely new window can retire that checkpoint. Disabling opaque checkpoint generation through `responsesApis` does not disable required replay of an inherited checkpoint; an unsupported transport, authentication failure, or endpoint mismatch aborts the request instead of exposing its placeholder. The legacy `leaveManagedMode` setting remains compatible but does not start a bulk close-out from `model_select` or `agent_settled`.
+- An effective persisted window boundary belongs to the session, not the selected model or context mode. `context_with_system`, `before_provider_request`, and `session_before_compact` synchronize it before mode-specific exits, including `remote-compaction`, `pi`, and legacy disabled/off selections. A non-window consumer receives only the effective current context, with the current system/tool head preserved and internal markers removed; no Remote tools, metadata or affinity headers are activated by the local safety check. A pre-window opaque checkpoint cannot rehydrate retired history after local projection. When detachment is needed, the existing no-summary boundary runs before any configured, remote, native or Pi-default compaction producer. Once a later ordinary compaction owns effective context, the historical window does not suppress its summary or valid opaque replay. A genuinely new window can retire that checkpoint. Disabling opaque checkpoint generation through `responsesApis` does not disable required replay of an inherited checkpoint; an unsupported transport, authentication failure, or endpoint mismatch aborts the request instead of exposing its placeholder. The legacy `leaveManagedMode` setting remains compatible but does not start a bulk close-out from `model_select` or `agent_settled`.
 - Native text summarization delegates prompt construction, tool-result truncation, split-turn requests and output limits to Pi's `compact()`. Toolkit does not use character-count estimates to reject the configured summary model. If its resolution, authentication or summary generation fails, compaction is cancelled with the error and context is preserved; the active model is not an implicit retry target. Disabled/unset/same-model selections retain Pi's default path. Remote-window projection still excludes retired managed history before any producer call.
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "private": false,
   "type": "module",
   "engines": {

package/src/codex-fast/extension.ts

@@ -72,8 +72,8 @@ export function registerCodexFastExtension(
 	pi.registerCommand("fast", {
 		description: "Toggle Codex Fast for this session (default OFF; may increase usage/cost).",
 		handler: async (args, ctx) => {
-			if (!ctx.hasUI || (ctx.mode !== undefined && ctx.mode !== "tui")) {
-				notify(ctx, "/fast requires an interactive terminal.", "warning");
+			if (!ctx.hasUI || (ctx.mode !== undefined && ctx.mode !== "tui" && ctx.mode !== "rpc")) {
+				notify(ctx, "/fast requires an interactive UI (terminal or RPC).", "warning");
 				return;
 			}
 			if (args.trim()) { notify(ctx, "Usage: /fast (toggle ON/OFF)", "warning"); return; }

package/src/extension-runtime.ts

@@ -754,44 +754,42 @@ async function handleSessionBeforeCompact(
 	const resolved = contextOperation(dependencies.loadConfig, ctx);
 	if (resolved.invalidFeatures.some((feature) => ["context", "compatibility", "diagnostics"].includes(feature))) return { cancel: true };
 	const config = resolved.config.compaction;
-	if (!config.enabled) {
-		return undefined;
-	}
-
-	writeDebugArtifact(
-		"compaction-event",
-		{
-			event: "session_before_compact",
-			customInstructions: event.customInstructions,
-			preparation: {
-				tokensBefore: event.preparation.tokensBefore,
-				firstKeptEntryId: event.preparation.firstKeptEntryId,
-				previousSummaryPresent: Boolean(event.preparation.previousSummary),
-				messagesToSummarizeCount: event.preparation.messagesToSummarize.length,
-				turnPrefixMessagesCount: event.preparation.turnPrefixMessages.length,
+	if (config.enabled) {
+		writeDebugArtifact(
+			"compaction-event",
+			{
+				event: "session_before_compact",
+				customInstructions: event.customInstructions,
+				preparation: {
+					tokensBefore: event.preparation.tokensBefore,
+					firstKeptEntryId: event.preparation.firstKeptEntryId,
+					previousSummaryPresent: Boolean(event.preparation.previousSummary),
+					messagesToSummarizeCount: event.preparation.messagesToSummarize.length,
+					turnPrefixMessagesCount: event.preparation.turnPrefixMessages.length,
+				},
 			},
-		},
-		config,
-		ctx,
-	);
+			config,
+			ctx,
+		);
+	}
 
 	if (event.signal.aborted) {
 		return { cancel: true };
 	}
 
-	// Capability changes do not retire the persisted Remote session. Resolve its
-	// branch boundary before deciding whether any compactor may see this input.
-	if (config.contextManagement === "remote") {
-		try {
-			dependencies.contextWindows.synchronize(ctx);
-		} catch {
-			notifyRemoteContextFailure(ctx, "malformed-window-state");
-			return { cancel: true };
-		}
+	// Window ownership survives model-policy changes, including Pi/disabled mode.
+	// Resolve it before any ordinary or default compactor can receive this input.
+	try {
+		dependencies.contextWindows.synchronize(ctx);
+	} catch {
+		notifyRemoteContextFailure(ctx, "malformed-window-state");
+		return { cancel: true };
 	}
 
 	// Active and inactive covered Codex consumers retain their existing routing.
-	const contextModel = await resolveContextCapabilityModel(ctx);
+	const contextModel = config.enabled && config.contextManagement === "remote"
+		? await resolveContextCapabilityModel(ctx)
+		: undefined;
 	if (isCodexContextModel(contextModel, config)) {
 		if (await remoteContextActive(ctx, config, contextModel)) {
 			try {
@@ -821,17 +819,16 @@ async function handleSessionBeforeCompact(
 		);
 	}
 
-	if (config.contextManagement === "remote") {
-		try {
-			const detached = dependencies.contextWindows.prepareDetachedCompaction(event);
-			// A local consumer cannot summarize history owned by a Remote window,
-			// even through a configured Luna producer or Pi's default compactor.
-			if (detached) return detached;
-		} catch {
-			notifyRemoteContextFailure(ctx, "malformed-window-state");
-			return { cancel: true };
-		}
+	try {
+		const detached = dependencies.contextWindows.prepareDetachedCompaction(event);
+		// A local consumer cannot summarize history owned by a Remote window,
+		// even after switching modes or disabling Toolkit compaction.
+		if (detached) return detached;
+	} catch {
+		notifyRemoteContextFailure(ctx, "malformed-window-state");
+		return { cancel: true };
 	}
+	if (!config.enabled) return undefined;
 
 	// Resolve producer protocol policy from this operation's document, not a later disk read.
 	if (resolved.format === "v2" && config.remoteCompactModel) {
@@ -1020,26 +1017,22 @@ async function handleContextInternal(
 	const resolved = contextOperation(loadConfig, ctx);
 	requireContextPolicy(resolved, ctx);
 	const config = resolved.config.compaction;
-	if (!config.enabled) {
-		const visibleMessages = contextWindows.project(event.messages, "off");
-		return visibleMessages.length === event.messages.length && visibleMessages.every((message, index) => message === event.messages[index])
-			? undefined
-			: { messages: visibleMessages };
+	try {
+		contextWindows.synchronize(ctx);
+	} catch {
+		notifyRemoteContextFailure(ctx, "malformed-window-state");
+		reportPiContextHookFailure(ctx, "malformed-window-state");
+		ctx.abort();
+		return undefined;
 	}
 
 	let localMessages: AgentMessage[] | undefined;
 	let remoteReplayProjection = false;
-	if (config.contextManagement === "remote") {
+	// Disabled and intentionally downgraded runtimes never enter opaque replay,
+	// but still honor a window already owned by this session.
+	let localProjectionOnly = !config.enabled;
+	if (config.enabled && config.contextManagement === "remote") {
 		const contextModel = await resolveContextCapabilityModel(ctx);
-		try {
-			contextWindows.synchronize(ctx);
-		} catch {
-			notifyRemoteContextFailure(ctx, "malformed-window-state");
-			reportPiContextHookFailure(ctx, "malformed-window-state");
-			ctx.abort();
-			return undefined;
-		}
-
 		const remoteActive = await remoteContextActive(ctx, config, contextModel);
 		if (remoteActive) {
 			try {
@@ -1078,42 +1071,34 @@ async function handleContextInternal(
 		// downgrade; active Remote can replay a newer inherited checkpoint.
 		if (!remoteActive && isCodexContextModel(contextModel, config)) {
 			const registrationState = getContextToolRegistrationState();
-			if (isExcludedGatewayContext(contextModel, config, registrationState)) {
-				const visibleMessages = contextWindows.project(event.messages, "off");
-				return visibleMessages.length === event.messages.length && visibleMessages.every((message, index) => message === event.messages[index])
-					? undefined
-					: { messages: visibleMessages };
-			}
-			if (isCodexGatewayModel(contextModel, config.gatewayContextModels)) {
+			if (!isExcludedGatewayContext(contextModel, config, registrationState)
+				&& isCodexGatewayModel(contextModel, config.gatewayContextModels)) {
 				const reason = contextManagementFailureReason(registrationState);
 				notifyRemoteContextFailure(ctx, reason);
 				reportPiContextHookFailure(ctx, reason);
 				ctx.abort();
 				return undefined;
 			}
-			const visibleMessages = contextWindows.project(event.messages, "off");
-			return visibleMessages.length === event.messages.length && visibleMessages.every((message, index) => message === event.messages[index])
-				? undefined
-				: { messages: visibleMessages };
+			localProjectionOnly = true;
 		}
+	}
 
-		if (!remoteActive) {
-			try {
-				const projected = contextWindows.project(event.messages, "local");
-				localMessages = projected;
-				if (contextWindows.hasEffectiveWindow()) {
-					// This boundary owns earlier history, including any older Remote V2
-					// checkpoint. A local request must not replay that history back in.
-					return projected.length === event.messages.length && projected.every((message, index) => message === event.messages[index])
-						? undefined
-						: { messages: projected };
-				}
-			} catch (error) {
-				notifyRemoteContextFailure(ctx, "malformed-window-state");
-				reportPiContextHookFailure(ctx, error instanceof Error ? error.message : String(error));
-				ctx.abort();
-				return undefined;
+	if (!remoteReplayProjection) {
+		try {
+			const projected = contextWindows.project(event.messages, "local");
+			localMessages = projected;
+			if (localProjectionOnly || contextWindows.hasEffectiveWindow()) {
+				// A persisted boundary owns earlier history regardless of the selected
+				// mode. Neither disabled policy nor ordinary replay may expand it.
+				return projected.length === event.messages.length && projected.every((message, index) => message === event.messages[index])
+					? undefined
+					: { messages: projected };
 			}
+		} catch (error) {
+			notifyRemoteContextFailure(ctx, "malformed-window-state");
+			reportPiContextHookFailure(ctx, error instanceof Error ? error.message : String(error));
+			ctx.abort();
+			return undefined;
 		}
 	}
 
@@ -1199,6 +1184,13 @@ async function handleBeforeProviderRequest(
 	requireContextPolicy(resolved, ctx);
 	const toolkitConfig = resolved.config;
 	const config = toolkitConfig.compaction;
+	try {
+		contextWindows.synchronize(ctx);
+	} catch {
+		notifyRemoteContextFailure(ctx, "malformed-window-state");
+		ctx.abort();
+		return undefined;
+	}
 	if (!config.enabled) {
 		return undefined;
 	}
@@ -1206,15 +1198,6 @@ async function handleBeforeProviderRequest(
 	const contextModel = config.contextManagement === "remote"
 		? await resolveContextCapabilityModel(ctx)
 		: undefined;
-	if (config.contextManagement === "remote") {
-		try {
-			contextWindows.synchronize(ctx);
-		} catch {
-			notifyRemoteContextFailure(ctx, "malformed-window-state");
-			ctx.abort();
-			return undefined;
-		}
-	}
 	const remoteActive = config.contextManagement === "remote" && await remoteContextActive(ctx, config, contextModel);
 	let remotePayload: unknown;
 	if (remoteActive) {
@@ -1247,7 +1230,7 @@ async function handleBeforeProviderRequest(
 
 	// Do not reintroduce a pre-window opaque checkpoint after local projection.
 	// Request affinity/encrypted-output rewriting is reserved for active Remote.
-	if (config.contextManagement === "remote" && contextWindows.hasEffectiveWindow()) return undefined;
+	if (contextWindows.hasEffectiveWindow()) return undefined;
 
 	const branchEntries = ctx.sessionManager.getBranch();
 	const inherited = config.contextManagement === "remote" && contextWindows.hasSupersededWindow()