[codex] Filter legacy warning messages during compaction (#22243)

## Why

Older sessions can contain model-warning records persisted as `user`
messages, including the unified exec process-limit warning, the
`apply_patch`-via-`exec_command` warning, and the model-mismatch
high-risk cyber fallback warning. Those warnings are no longer produced
as conversation history items, but when old sessions compact they should
still be recognized as injected context rather than preserved as real
user turns.

## What changed

- Removed `record_model_warning` and the production paths that emitted
these warning messages into conversation history.
- Added `LegacyUnifiedExecProcessLimitWarning`,
`LegacyApplyPatchExecCommandWarning`, and `LegacyModelMismatchWarning`
contextual fragments that are used only for matching old persisted
messages.
- Registered the legacy fragments with contextual user message detection
so compaction filters them through the existing fragment path.
- Added focused compaction coverage for old warning messages being
dropped during compacted-history processing.

## Testing

- `cargo test -p codex-core warning`
- `just fix -p codex-core`

codex-rs/core/src/context/contextual_user_message.rs

@@ -6,6 +6,9 @@ use super::EnvironmentContext;
 use super::FragmentRegistration;
 use super::FragmentRegistrationProxy;
 use super::GoalContext;
+use super::LegacyApplyPatchExecCommandWarning;
+use super::LegacyModelMismatchWarning;
+use super::LegacyUnifiedExecProcessLimitWarning;
 use super::SkillInstructions;
 use super::SubagentNotification;
 use super::TurnAborted;
@@ -26,6 +29,15 @@ static SUBAGENT_NOTIFICATION_REGISTRATION: FragmentRegistrationProxy<SubagentNot
     FragmentRegistrationProxy::new();
 static GOAL_CONTEXT_REGISTRATION: FragmentRegistrationProxy<GoalContext> =
     FragmentRegistrationProxy::new();
+static LEGACY_UNIFIED_EXEC_PROCESS_LIMIT_WARNING_REGISTRATION: FragmentRegistrationProxy<
+    LegacyUnifiedExecProcessLimitWarning,
+> = FragmentRegistrationProxy::new();
+static LEGACY_APPLY_PATCH_EXEC_COMMAND_WARNING_REGISTRATION: FragmentRegistrationProxy<
+    LegacyApplyPatchExecCommandWarning,
+> = FragmentRegistrationProxy::new();
+static LEGACY_MODEL_MISMATCH_WARNING_REGISTRATION: FragmentRegistrationProxy<
+    LegacyModelMismatchWarning,
+> = FragmentRegistrationProxy::new();
 
 static CONTEXTUAL_USER_FRAGMENTS: &[&dyn FragmentRegistration] = &[
     &USER_INSTRUCTIONS_REGISTRATION,
@@ -35,6 +47,9 @@ static CONTEXTUAL_USER_FRAGMENTS: &[&dyn FragmentRegistration] = &[
     &TURN_ABORTED_REGISTRATION,
     &SUBAGENT_NOTIFICATION_REGISTRATION,
     &GOAL_CONTEXT_REGISTRATION,
+    &LEGACY_UNIFIED_EXEC_PROCESS_LIMIT_WARNING_REGISTRATION,
+    &LEGACY_APPLY_PATCH_EXEC_COMMAND_WARNING_REGISTRATION,
+    &LEGACY_MODEL_MISMATCH_WARNING_REGISTRATION,
 ];
 
 fn is_standard_contextual_user_text(text: &str) -> bool {

codex-rs/core/src/context/legacy_apply_patch_exec_command_warning.rs

@@ -0,0 +1,21 @@
+use super::ContextualUserFragment;
+
+// This warning is not produced anymore but fragment definition is used to filter messaged from old sessions
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct LegacyApplyPatchExecCommandWarning;
+
+impl ContextualUserFragment for LegacyApplyPatchExecCommandWarning {
+    const ROLE: &'static str = "user";
+    const START_MARKER: &'static str = "";
+    const END_MARKER: &'static str = "";
+
+    fn matches_text(text: &str) -> bool {
+        let trimmed = text.trim();
+        trimmed.starts_with("Warning: apply_patch was requested via ")
+            && trimmed.ends_with("Use the apply_patch tool instead of exec_command.")
+    }
+
+    fn body(&self) -> String {
+        String::new()
+    }
+}

codex-rs/core/src/context/legacy_model_mismatch_warning.rs

@@ -0,0 +1,21 @@
+use super::ContextualUserFragment;
+
+// This warning is not produced anymore but fragment definition is used to filter messaged from old sessions
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct LegacyModelMismatchWarning;
+
+impl ContextualUserFragment for LegacyModelMismatchWarning {
+    const ROLE: &'static str = "user";
+    const START_MARKER: &'static str = "";
+    const END_MARKER: &'static str = "";
+
+    fn matches_text(text: &str) -> bool {
+        text.trim().starts_with(
+            "Warning: Your account was flagged for potentially high-risk cyber activity",
+        )
+    }
+
+    fn body(&self) -> String {
+        String::new()
+    }
+}

codex-rs/core/src/context/legacy_unified_exec_process_limit_warning.rs

@@ -0,0 +1,21 @@
+use super::ContextualUserFragment;
+
+// This warning is not produced anymore but fragment definition is used to filter messaged from old sessions
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct LegacyUnifiedExecProcessLimitWarning;
+
+impl ContextualUserFragment for LegacyUnifiedExecProcessLimitWarning {
+    const ROLE: &'static str = "user";
+    const START_MARKER: &'static str = "";
+    const END_MARKER: &'static str = "";
+
+    fn matches_text(text: &str) -> bool {
+        text.trim().starts_with(
+            "Warning: The maximum number of unified exec processes you can keep open is",
+        )
+    }
+
+    fn body(&self) -> String {
+        String::new()
+    }
+}

codex-rs/core/src/context/mod.rs

@@ -12,6 +12,9 @@ mod goal_context;
 mod guardian_followup_review_reminder;
 mod hook_additional_context;
 mod image_generation_instructions;
+mod legacy_apply_patch_exec_command_warning;
+mod legacy_model_mismatch_warning;
+mod legacy_unified_exec_process_limit_warning;
 mod model_switch_instructions;
 mod network_rule_saved;
 mod permissions_instructions;
@@ -41,6 +44,9 @@ pub(crate) use goal_context::GoalContext;
 pub(crate) use guardian_followup_review_reminder::GuardianFollowupReviewReminder;
 pub(crate) use hook_additional_context::HookAdditionalContext;
 pub(crate) use image_generation_instructions::ImageGenerationInstructions;
+pub(crate) use legacy_apply_patch_exec_command_warning::LegacyApplyPatchExecCommandWarning;
+pub(crate) use legacy_model_mismatch_warning::LegacyModelMismatchWarning;
+pub(crate) use legacy_unified_exec_process_limit_warning::LegacyUnifiedExecProcessLimitWarning;
 pub(crate) use model_switch_instructions::ModelSwitchInstructions;
 pub(crate) use network_rule_saved::NetworkRuleSaved;
 pub use permissions_instructions::PermissionsInstructions;