v3.10.9: Antigravity context normalizer, Claude thinking fix, endpoint lockdown, cobra91 PR #4

Antigravity-only changes (no other providers touched):
- Production-only endpoints (cloudcode-pa.googleapis.com), sandbox blocked
- AntigravityContextNormalizer: bounded context for every request
- Simple message detector: 'hi' sends minimal payload
- Auto-reset polluted context (200+ items with simple msg)
- Claude thinking: maxOutputTokens=64000, snake_case config, VALIDATED toolConfig
- Claude budgets: low=8192, medium=16384, high=32768

z.ai/OpenRouter (cobra91 PR #4):
- Full OpenClaw attribution headers for z.ai
- X-OpenRouter-Cache header for OpenRouter

Other fixes:
- Linux Re-OAuth: load_oauth_secrets() undefined, now inline
- GLib.idle_add lambda truthy tuple fix
- Project discovery uses production endpoint

codex_launcher_lib.py

@@ -83,12 +83,22 @@ model_catalog_json = ""
 """
 
 CHANGELOG = [
-    ("3.10.8", "2026-05-25", [
-        "Re-OAuth: replaced deprecated OOB flow with PKCE + localhost callback",
-        "Project auto-discovery: validates project API enabled, searches alternatives if disabled",
-        "Windows GUI: _google_reoauth now uses PKCE + callback (was broken OOB paste)",
-        "Windows GUI: endpoint OAuth flow uses shared project discovery helper",
-        "Linux GUI: endpoint OAuth flow uses shared _oauth_discover_project helper",
+    ("3.10.9", "2026-05-25", [
+        "Antigravity: production-only endpoints (cloudcode-pa.googleapis.com), sandbox blocked unless ALLOW_ANTIGRAVITY_STAGING=1",
+        "Antigravity: 403 SERVICE_DISABLED falls through, 429 returns to client (no sandbox fallback)",
+        "AntigravityContextNormalizer: bounded context — simple messages send minimal payload",
+        "Simple message detector: 'hi' etc sends only user message, no tool history",
+        "Auto-reset polluted context: 200+ items with simple message resets to minimal",
+        "Duplicate user message removal, tool output budget (max 2 verbatim, rest summarized)",
+        "Hard limits: 20 contents, 120K/250K/500K char budgets",
+        "Claude thinking fix: maxOutputTokens=64000, snake_case thinking config, VALIDATED toolConfig",
+        "Claude budgets: low=8192, medium=16384, high=32768",
+        "All fixes scoped to OAUTH_PROVIDER==google-antigravity only",
+        "Project discovery uses production endpoint (not staging)",
+        "z.ai: full OpenClaw attribution headers (cobra91 PR #4)",
+        "OpenRouter: X-OpenRouter-Cache header (cobra91 PR #4)",
+        "Fix Linux Re-OAuth: load_oauth_secrets() was undefined",
+        "Fix GLib.idle_add lambda returning truthy tuple",
     ]),
     ("3.10.7", "2026-05-25", [
         "Prompt Enhancer: per-provider toggle to improve prompt clarity after compaction",