A summarization stream terminated by a provider error is not fallback-authorized, so the session stays uncontinuable and repeats an internal retry-suppression marker

[code-yeongyu]

Bug

During automatic compaction the summarization stream ran for over 690 seconds. When it
finally failed, the session did not recover: every subsequent prompt ended with the raw
internal marker error senpi:no-turn-retry:Codex error: …, and the session could not be
continued.

What happens (traced on current main)

1. The summarization wall-clock budget is size-scaled: max(120s, 2ms × estimated input tokens),
   capped at 30 minutes (packages/coding-agent/src/core/compaction/stream-watchdog.ts).
   An input of ≥345k estimated tokens — normal for a ~1M-context model, whose summarization
   input may be 60% of the window — makes a 690s+ stream legal. The 300s idle watchdog never
   fires on a stream that keeps trickling deltas.
2. When the provider stream fails after partial output on a provider with a credential pool,
   the failure is rethrown as CredentialFailoverError with the senpi:no-turn-retry: prefix
   (any event after start counts as committed output).
3. That error class is not recognized by classifyRequiredCompactionFallbackFailure, so the
   deterministic compaction fallback — which exists exactly for "summarization did not
   complete" — never runs. It is not transient either, so the blocking compaction route
   rethrows it.
4. At the session layer the marker prefix disables both auto-retry and model fallback
   (agent-session.ts _isRetryableError / _isHardErrorFallbackEligible). The turn dies
   with the raw internal marker as the user-visible error.
5. Because compaction never applied, the context stays above the threshold, and the next
   prompt re-enters required compaction and fails identically — the marker error repeats on
   every attempt; nothing (including the circuit breaker, which only debits transient
   failures) interrupts the loop.

Expected

• Any terminal summarization failure on a required-compaction route applies the deterministic
  fallback checkpoint (retained-suffix safety checks unchanged) so the session continues.
• The user sees an actionable message ("compaction could not complete a provider summary;
  a deterministic checkpoint was applied"), never the internal senpi:no-turn-retry: marker.
• If no safe suffix exists, show the existing deterministic-fallback recovery guidance once,
  with the transcript unchanged.
• Total compaction wall time per turn stays bounded regardless of input size.

Environment

• CLI coding agent, current main; openai-codex provider (credential pool, 2+ keys),
  large-context model (~1M window), long session near the compaction threshold.

[code-yeongyu]

Fixed by #1745, merged as 75481aef560b269cfe2c4d88d73f7ef18d46166f.

The 690 seconds were legal. No watchdog failed to fire. The per-attempt summarization budget scales with input size and is clamped to a 30-minute ceiling, so a large session genuinely licenses a summary that long. The wedge was what happened after the stream died.

Root cause. classifyRequiredCompactionFallbackFailure was a four-class enumeration, and a summary stream terminated by a provider or credential fault matched none of them. Credential rotation rethrows every terminal outcome as a failover error and, once any event past start has reached the caller, prefixes the internal retry-suppression marker so a partially delivered turn is never replayed. That same marker disables session retry and model fallback. So required compaction applied no summary, authorized no deterministic fallback, and repeated identically on the next prompt because the context stayed above the threshold — while the user saw the internal marker as the error text.

What changed. Authorization now keys on the outcome, not on the marker: any failover error, any error carrying the marker, and a non-transient, non-refused summary request error with no structured failure kind all map to a new summarization-provider-failure kind, so the deterministic checkpoint is applied and the turn continues. User aborts, policy refusals, missing credentials and ordinary bugs deliberately stay unauthorized — this is not a blanket "always destroy context on failure" switch. Two further gaps closed: final settlement now rides inside the watchdog, so a provider whose iterator ends without a terminal event can no longer stall with no timer at all; and one compaction is bounded by a total wall-clock budget across every attempt and retry, which input size cannot raise, with each attempt clamped to what is left and no new attempt started past the deadline. Every compaction message built from an error has the internal marker stripped, and the user is told once, plainly, that a deterministic checkpoint was applied.

Evidence. RED first: 11 failed / 1 passed. GREEN after the fix: 12 passed, then 573 passed across the compaction suite. Test names map to the contracts: marker-bearing failover classified as a provider failure, non-transient request error likewise, aborts and refusals kept out of the destructive path, the blocking route recovering from both a marker throw and a non-transient stop, the user told plainly without the marker, the total budget independent of input size, and an exhausted total budget routed into the deterministic fallback. Run on a second machine in a disposable checkout that was removed and verified gone.

Relationship to the other compaction work. #1735 (thank you again) covers the pre-prompt route's classified failures and the later-safe-boundary scan; this change covers the unclassified terminal-error path that no route recovered from, plus the settlement hole and the missing total bound. They are complementary, and the review item raised on #1735 about the hard-cap gate still stands on its own.