Prevent incomplete compaction from replacing history

[Open-Squilla]

Scope

Failed compaction previously could persist an excerpt-based fallback that repeatedly embedded the old checkpoint. Once replay omitted the oversized result, raw active history could still be replaced. This change commits only complete model summaries whose final fitted replay and consumer request pass validation.

When summarization fails, automatic requests continue with unchanged context if it fits, then existing tool-result reduction and a protected, request-scoped history window. These temporary views preserve canonical messages and checkpoints. The UI distinguishes a saved summary from temporary history reduction, including after reconnect.

Scope boundary: shared prefix/suffix summary validation, source/commit consistency, request-budget recovery, failure classification, and UI state. Keep suffix optional and preserve current provider/model/config and request-prefix reuse.

Non-goals: rebuilding already damaged checkpoints, startup scanning, new database fields or public budget controls, async compaction, and KV graft.

Branch

Base branch: main

Validated base: a25b69670c7464994a828126f92132b7e0aec171. Main advanced to 14087d9cefa56ced625a08cdb5ec76404aa1b295 (Skill installation streaming, #1592) during final acceptance. The PR is conflict-free but behind that commit; the results below apply to the exact tested head, not an untested later merge.

Target exception: N/A

Issue

Linked issue: Fixes #1563

Release Note

Release note: Prevent failed compaction from replacing history with incomplete checkpoints; continue recoverable requests with temporary history reduction and report its status accurately.

Tests

Ruff: ruff check src tests passed. Mypy: all 1,598 source files passed.

Pytest: the final complete offline command passed with exit 0: 28,698 passed, 440 skipped, 74 deselected in 1,291.19 seconds. Existing offline markers and conditional skips were retained. This followed a 3,406-pass environment preflight; earlier interrupted environment-invalid runs are not counted as passing. Compaction/provider/runtime/manager/request-window/gateway regressions cover repeated failures, final rendering, stale sources, cancellation, timeout and message-count overflow. No-model fallback-success fixtures use a synthetic provider, and previously conditional assertions now require the successful path to execute.

Build: WebUI type checks, architecture checks and production build passed. Full frontend suite: 455 files, 6261 tests passed. The final wheel built successfully; all nine packaged model files match their declared sizes and SHA256 hashes, and the packaged WebUI entry plus its 12 referenced JS/CSS assets match the verified production build byte for byte. Source and environment fingerprints remained unchanged through full testing and packaging.

Regression tests: added

Notes: Python full acceptance uses an ordinary checkout with explicit source imports, an activated virtual-environment command path, the host HOME required by installer tests, and verified WebUI/model assets. Existing duplicate test-module names require importlib collection plus the test-root import path. Validation retains the public offline markers and does not weaken assertions or security checks. The implementation is platform neutral. Windows shard metadata uses the repository’s provisional floor for newly added files; local timings are not presented as Windows measurements.

The default test path remains offline, deterministic, credential-free, and safe for forks.

Hosted CI: final run 35080440689 passed for commit b7282e99eec81f1932700d402976f97c3a539f01: 38 successful jobs, 2 conditional skips, no failures. This includes Linux full-suite and Windows risk shards, frontend tests/build, and browser/desktop recovery gates.

Maintainer Live Check

Maintainer live check: yes

Surface: provider, browser, gateway

Real TokenRhythm and OpenRouter sessions run through the actual WebUI, gateway, runner, SQLite and HTTP observer. Both services passed normal prefix and suffix compaction, subsequent fact recall without repeating the facts, approximately 36k-character tool responses, summary-only injected failure followed by request-scoped reduction and real answers, service recovery with durable summary commit, and restart/reconnect recall. The final payload contains the active checkpoint exactly once and replay completeness is true. A protected oversized history case confirms one failed summary request with no second paid compaction attempt in the same turn. Injected 503 failures apply only to summary HTTP; they are explicitly separated from real provider responses. Missing cache/cost statistics remain unknown.

Maintainer-only note: contributors are not expected to provide secrets or run credentialed live checks. No credentials or runtime transcripts are included in this PR.

Safety

Canonical transcript/archive transactions, epoch/preimage checks and SQLite CAS remain authoritative. Temporary windows do not create durable summaries or advance archive boundaries. Protected current input or tool state that cannot fit produces an explicit error with stored history intact. A failed preflight cannot reset its deadline or gain another paid summary attempt through a different recovery entry in the same turn; a real runner/SQLite regression fails against the old Agent and passes with this guard. Final coverage checks cover extracted facts only and do not claim semantic losslessness.

No secrets, runtime state, private prompts, local artifacts, or implementation plans are committed.

Third-Party Origin

Third-party origin: inspired-by

Design principles were compared with DeepSeek Harness (MIT), DeepSeek Reasonix (MIT), Penguin Harness (Apache-2.0), CodeWhale (MIT), OpenCode (MIT), and OpenClaw (MIT). This is an implementation within existing OpenSquilla abstractions; no source, fixtures or prompt text were copied or vendored.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.

[github-actions]

Merge queue CI: success — run 35087540949, attempt 1.
Tested queue candidate: c785c604b7af9678350c6e0aef6d2d287eeef127. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 35094665278, attempt 1.
Tested queue candidate: 44ca500d71f023f863f33a24bae8bd718506c424. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.