0.1.8 Beta1: Scope the Official context cost guard to Official models #303

Problem

CodexHub's managed overlay writes the Official model's global context guard into the top-level Codex config:

model_context_window = 272000
model_auto_compact_token_limit = 244800

The generated model catalog already advertises a third-party model such as deepseek-v4-flash:0731 with a 1,048,576 context window. Codex Desktop reads the top-level override at startup and does not rewrite it when the user switches models. As a result, the third-party model is capped at the Official guard (272000 * 95% = 258400) and is shown as roughly 258k instead of roughly 996k/1.0M.

This is a regression of the ownership boundary previously intended by #157. It is separate from #109's Official billing-policy decision: this ticket fixes configuration scope, not the Official budget value.

Decision

CodexHub must not create or retain a CodexHub-owned top-level model_context_window or model_auto_compact_token_limit in the managed config.toml overlay. The Official cost guard is enforced by the per-model Official catalog metadata and the Gateway's Official-route guard. Third-party models must remain governed by their own catalog metadata.

A top-level override that the user owns outside the CodexHub managed marker is not silently deleted. The implementation must surface a diagnostic that such an override still applies globally and can mask per-model context values.

Scope

• Update src-python/config_overlay.py overlay generation, migration, restore/disable behavior, and context-guard status so CodexHub-owned global overrides are removed and not reintroduced.
• Preserve the Official safe budget and Gateway guard semantics; do not weaken Official protection.
• Update any Rust/Tauri command state, frontend contract, labels, and Toast text that currently imply a global guard. The user-facing wording must say Official model long-context cost protection (or the exact localized equivalent), not a generic all-model cap.
• After catalog refresh, make the existing restart requirement explicit because Codex Desktop loads the catalog/config at startup.
• Keep user-authored unmanaged overrides intact, but expose the conflict state and its global scope.
• Add regression coverage for fresh apply, old managed overlay/backup migration, disable/restore, disconnected recovery, user-owned override conflict, and the protection switch.

Acceptance criteria

• Applying CodexHub with an Official default and a 1M third-party catalog produces a managed config with no CodexHub-owned top-level context/compact keys.
• A cold-start Desktop using the same catalog reports approximately 258.4k for Official and approximately 996k/1.0M for the 1,048,576 third-party model; switching models does not cross-contaminate the values.
• Existing old overlays/backups containing the managed keys migrate safely without deleting unrelated user settings; repeated apply/restore is idempotent.
• A user-authored top-level override is retained and reported as a global override conflict; it is never mistaken for a CodexHub-owned value.
• Official Gateway requests remain within the selected Official catalog budget, including when the guard is enabled or disabled.
• UI state/toasts clearly identify Official-only protection and the required Codex Desktop restart after catalog refresh.
• No product API, model catalog schema, third-party routing, or unrelated config semantics change.

Expected hotset

• src-python/config_overlay.py
• tests/test_config_overlay.py
• catalog refresh/context-guard Rust/Tauri commands and tests, if their state or wording is coupled
• frontend context-guard state/toast contract and tests, if applicable

Verification

python -m pytest -q tests/test_config_overlay.py
python -m pytest -q --ignore=tests/test_real_client_e2e.py
Push-Location src-tauri; cargo test --locked; cargo clippy --locked --all-targets -- -D warnings; Pop-Location
Push-Location frontend; npm run build; npm run test:ui-contract; Pop-Location
python scripts/report_quality_gates.py
git diff --check

Also perform the cold-start Codex Desktop 0.146 manual check described above and record sanitized evidence. Hosted CI / gate is required before merge.

Execution-Contract: v2

Verification-Class: strict

Manual-Evidence: Desktop 0.146 cold start with Official and 1M third-party model, switch in both directions, and catalog refresh/restart notice

Architecture-Decision: resolved — remove CodexHub-owned global context/compact overrides; keep unmanaged user overrides with an explicit conflict diagnostic

Review-Owner: orchestrator

Part of: 0.1.8 Beta1 stop-the-bleeding work; do not start #62/#65 from this ticket.