[AnthonyRonning]

Long Responses conversations need server-owned context compaction without discarding canonical history or changing the caller's main output allowance. Add encrypted, source-bound checkpoints behind the default-off responses_compaction flag, with an isolated legacy-window path for staged rollout and rollback.

Resolve existing account/plan/cohort policy once per logical Response and pin it across model selection, image preparation, tools and reactive recovery. Only explicit true selects compaction; disabled/missing/failed lookups select legacy. The scoped flag cache/timeout is 30 seconds/one second; generic flags are unchanged. Client controls cannot bypass the server gate. Archiving disables later admissions after cache expiry; active Responses keep their strategy and deadline.

Compaction normally starts at 80% of available input budget, or a caller-selected threshold. Completed tool exchanges can compact while current input and pending exchanges remain verbatim. Helpers use the selected model through existing attested streaming, usage, cancellation and terminal handling, preserving caller reasoning and native generation allowance. Publication validates source identity and coverage. Incremental summaries, retry suppression and fresh-source fitting checks preserve continuity through failures and model/context recovery.

The final correction keeps the current HTTP/acceptance architecture:

• Summary waiting before durable acceptance has a separate 60-second allowance. Fitting advisory work can use the existing complete original-prompt fallback; required work fails cleanly when exhausted. Acceptance clears this allowance, preserving the existing ten-minute execution deadline for later tools. This is not a hard bound on total database work or all time to first byte.
• Missing selected legacy rows discard the partial projection and refresh/retry once, preventing cross-batch deletion from producing partial tool history. Integrity failures remain strict. Caller output-room reservation remains intentional and the forwarded cap is unchanged.
• A scoped guard records actual dropped preaccept futures once. Acceptance metadata follows the durable transaction; accepted terminal/storage ownership remains unchanged. No orphan-recovery lifecycle was added.

Legacy reads avoid checkpoints/helpers and retain canonical rows/checkpoints across toggles. Batching projects/discards raw image-bearing payloads promptly; 128-row/8-MiB targets do not impose an aggregate transfer/memory cap. The additive checkpoint migration follows normal migration-before-binary release ordering; toggling needs no data conversion.

Metadata-only events cover mode/reason, outcomes, preparation time, helper usage, checkpoint work and legacy source reads. Prompts, summaries, outputs, ciphertext and raw errors are excluded. No Pi, SDK dependency, provider-routing or caller output-limit changes.

Validation at signed parent 27059eae, rebased onto 121a1cf4:

• Formatting, strict all-target/all-feature Clippy, and 1,075 unit tests passed; 54 default-ignored are separate.
• All 53 selected disposable-DB checks passed without skips, including 20 compaction persistence checks; migration redo and cleanup passed.
• The clean combined build with Research: show compaction progress and history dividers #1228 passed seven controlled cases and four actual DeepSeek cases, including on/off/on, canonical-history preservation, checkpoint reuse and default-off GET/DELETE. Accepted tool work completed after a deliberate hold exceeding the new 60-second allowance.
• Actual-model cases used an explicit trigger and preserved caller cap, not a reduced catalog window or a capacity benchmark. Clean source/binary provenance and bounded log-privacy checks were captured. Local flags were restored off and services stopped.

Draft for review. No merge, hosted flag change or Dev/Production deployment. Hosted edge/model behavior remains a release-validation step.