Tools administrators can change registered operational defaults at /admin/config-defaults without editing .env, rebuilding the Laravel config cache, or deploying code.
Registered runtime defaults are stored in the tools_defaults database table. For defaults that have an environment counterpart, the environment value is read only when the database entry is first bootstrapped. After that first insert, the database value is the runtime source of truth.
The admin page shows the registered key, current value, type, safe range, description, initial environment source when applicable, and whether that row was bootstrapped from the environment.
The first registered runtime defaults are:
openai.max_output_tokens_default - default output-token budget when a caller does not provide one.openai.recovery_min_output_tokens - minimum output-token budget for automatic recovery after an OpenAI max_output_tokens incomplete response.openai.recovery_max_output_tokens - maximum output-token budget for that recovery attempt.The historical OPENAI_MAX_TOKENS_CAP environment variable is now a bootstrap seed for openai.max_output_tokens_default; it is not the live runtime source after the database row exists. Per-request or service-specific values still take precedence where the caller explicitly supplies them.
Runtime token defaults support substantially larger values than the previous hard-coded 8,000-token ceiling. Operators should still choose budgets appropriate for the selected model and workload.
/admin/config-defaults requires an authenticated Tools administrator. GUI visibility is not the authorization boundary; the route itself requires administrator authorization.
Every changed value writes an independent tools_default_audit_logs record with the key, old value, new value, actor, timestamp, and correlation ID. Unexpected update failures are also sent through the always-on operational diagnostics path used for #toolsapi, without exposing credentials or secret configuration.
Saving a value clears the runtime-default cache immediately, so subsequent requests use the new value without a deployment.