Codex Desktop leaks Model Set Context despite Memory disabled

Codex Desktop emitted a "# Model Set Context" block containing private user profile/memory-like entries in an assistant final response, even though memory is disabled.

Environment:

• Codex Desktop on Windows
• Memory disabled in ChatGPT/Codex settings
• Thread type: heartbeat automation / Codex Desktop thread
• Local isolated CODEX_HOME used

Observed:

• Assistant final response included a full "# Model Set Context" list.
• The leaked block was later found in local session JSONL logs.
• The local prompt-history copy in .codex-global-state.json was removable, but the original source of the injected Model Set Context appears upstream/product-side or stale context injection.
• This should not be surfaced to the user and should not be injected when Memory is disabled.

Expected:

• No user memory/profile context should be injected when Memory is disabled.
• Internal model context must never be emitted in assistant output.
• Heartbeat final responses should only emit the heartbeat XML/result, not hidden context.

<img width="844" height="1191" alt="Image" src="https://github.com/user-attachments/assets/35725e73-5902-441a-9d48-0f513bc80369" />

<img width="757" height="339" alt="Image" src="https://github.com/user-attachments/assets/b9663c8c-7e36-4763-901e-bc093678d5ef" />

<img width="710" height="74" alt="Image" src="https://github.com/user-attachments/assets/6e86a708-9a37-468a-9e6a-9a94d7a135d8" />

<img width="756" height="115" alt="Image" src="https://github.com/user-attachments/assets/936c2da3-f4a5-4b9a-9845-a41a753391ad" />

<img width="717" height="316" alt="Image" src="https://github.com/user-attachments/assets/0cd815c3-b148-410c-8284-2ef5a45ef02d" />