fix(#312): invalidate stale modelContextLimit on catalog miss (#313 + #314 combined)

[ranxianglei]

What

Completes the #314 fix (merged) with #313's fail-safe as the fallback path — the "ideal combined fix" from the review of both PRs.

Background

Issue #312: after switching models (e.g. 200K → 1M), a 50% emergency-compression threshold fired at ~26% real usage, because experimental.chat.messages.transform fires before system.transform in one request, and only the system hook writes state.modelContextLimit — so the first request after a switch computes every percentage against the previous model's window.

• fix: reconcile modelContextLimit on model switch (#312) #314 (merged) fixes this by reconciling the limit from a ${providerID}/${modelID} → limit catalog (seeded at init from /config/providers, recorded live by the system hook).
• Remaining gap: on a catalog miss (fresh instance + failed hydration + never-used model), the stale limit survived and the 切换模型导致上下水水平计算错误 #312 false positive still reproduced.

This PR

Records the identity pair (modelProviderID / modelID) alongside the limit whenever the system hook writes it, persisted and restored together. On a catalog miss the messages hook now compares the request's model against that identity:

catalog miss +	behavior
identity match	keep the limit — no needless blindness when the catalog simply lacks an entry for the current model
identity mismatch	invalidate (limit = undefined) — #313's fail-safe: never run percentage math against the wrong window
legacy state (no identity persisted)	treated as stale — one blind turn per upgraded session, same trade-off #313 accepted

undefined is already the natural fresh-session state (before the first system.transform), so all consumers (nudges, GC, batch-cleanup, adaptive growth) tolerate it by construction. The same request's system.transform refreshes the pair right after, so the blind window is a single turn at most.

Supersedes

• Closes fix: invalidate stale modelContextLimit on model switch (#312) #313 (its unconditional-invalidation approach is fully covered by the fallback path here; its tests are re-expressed in tests/model-switch-limits.test.ts).

Changes

• lib/state/types.ts — SessionState.modelProviderID/modelID (optional, persisted)
• lib/state/state.ts — init/reset/load keep the pair atomic with the limit
• lib/state/persistence.ts — serialize/restore the pair
• lib/hooks.ts — system hook records identity; messages hook: catalog hit → correct + record identity; miss + mismatch → invalidate
• tests — legacy-state invalidation, identity-mismatch invalidation, same-identity keep (emergency still fires at 130% of the real window), system-hook identity recording, persistence round-trip

Verification

• tsc --noEmit clean
• 991/991 tests pass (was 988; net +3)
• prettier-clean on all touched hunks (pre-existing format dirt elsewhere left untouched)

[github-actions]

📦 Built Plugin Artifact

Branch: fix/stale-limit-fallback (e6b7b90)

Option A — Install from npm PR tag (recommended)

opencode plugin opencode-acp@pr-315 --global

Each push to this PR publishes a new version under the pr-315 npm tag.

Option B — Install from GitHub

opencode plugin "github:ranxianglei/opencode-acp#fix/stale-limit-fallback" --global

Option C — Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf opencode-acp-pr315.tgz
cp -r package/dist ~/.cache/opencode/packages/opencode-acp@latest/node_modules/opencode-acp/dist

3. Restart opencode to pick up changes.

---

This comment is automatically updated on each push.