Context overflow is not failure-proof: one persisted flag disables every recovery path, goal re-prompts a deterministic overflow, astra contextWindow overstates the 922k input cap

[code-yeongyu]

Summary

Session 01a07542-3b63-7cfb-9b87-4ea321e750a2 (omo, 2026-09-06 05:47Z → 09-07 01:40Z, openai/gpt-6-astra) grew from 440k to 916,628 prompt tokens with zero compactions, then died on Error Code context_too_large: Your input exceeds the context window of this model. The goal extension re-prompted the identical context three times in 30 s (each one failed the same way) until the user aborted and switched models by hand.

Nothing in the runtime defended the session. Every layer that should have kept it alive was either switched off by one flag or was measuring the wrong budget.

Root-cause chain (all verified on origin/main 5a23f6edf)

1. compaction.enabled=false is persisted globally by a per-session RPC command (origin)

• ~/.omo/agent/settings.json carries "compaction": {"enabled": false} since at least 2026-08-30 (absent in the 08-26 backup, present in every backup from 08-30 on).
• The only writer of that key is SettingsManager.setCompactionEnabled (packages/coding-agent/src/core/settings-manager.ts:1230), reached from AgentSession.setAutoCompactionEnabled (agent-session.ts:6723), which is what the RPC command set_auto_compaction calls (modes/rpc/connection-handler.ts:1339-1342).
• OmO Desktop relays its per-thread toggle omo.autoCompaction.set straight onto that RPC (apps/server/src/provider/omo/omoSessionStats.ts:145). One thread flipping its own toggle rewrites the machine-wide persisted setting and silently disables auto-compaction for every senpi/omo session on the host, forever.
• Field impact: since 08-30 this host recorded 30 provider overflow deaths across 40 session files (26x Anthropic prompt is too long at 985k-999k/1M on opus-5 and fable-5-1, 3x astra context_too_large, 1x sol) — all with zero compaction entries.

2. That one flag disables every recovery path, including emergency ones

• _getAutoCompactionReason returns undefined for overflow as well as threshold when !settings.enabled (agent-session.ts:2107-2110).
• _checkCompaction returns false at the top when !settings.enabled (:6177), so the one-shot overflow recovery (compact + retry, :6234-6262) never runs.
• _enforceCompactionBeforeProvider skips the hard reserve gate (window - reserve) when !settings.enabled (:6080); _enforceFinalProviderAdmission likewise (:6143).
• Result: "auto-compaction off" is implemented as "no compaction ever, even when the provider has already rejected the request". The session cannot make progress by any path other than a human running /compact or switching models.

3. Goal continuation re-prompts a deterministic failure

• didTerminalProviderErrorEndTurn (extensions/builtin/goal/terminal-provider-error.ts:22-28) treats any stopReason: "error" turn as a provider failure and afterProviderFailure → afterAgentSettled queues a providerRecovery continuation (monitor-continuation.ts:189-230).
• A context overflow is not transient: the same context is sent again and rejected again. Session evidence: #1320 error → #1322 goal-continuation → #1323 error → #1325 goal-continuation → #1326 error → #1328 goal-continuation → user abort.
• The PROVIDER_ERROR_BLOCKED_REASON mechanical block exists but only after a retry budget; overflow needs to block immediately with a reason that names compaction.

4. gpt-6-astra contextWindow: 1,050,000 overstates the real prompt budget by 128k

• OpenAI splits the window into a hard input cap and a separate output cap: astra = 922,000 input + 128,000 output; GPT-5 family = 272,000 + 128,000 (the request is rejected with context_too_large regardless of max_output_tokens).
• senpi uses model.contextWindow everywhere as the prompt budget (core shouldCompact, getContextUsage, hard valve, clampMaxTokensToContext). The generator even says so — packages/ai/scripts/generate-models.ts:400-408: "GPT-6 Astra ships the documented maximum (1,050,000 = 922,000 input + 128,000 output)" — and then ships 1,050,000 as contextWindow.
• The catalog already uses the input-cap convention for gpt-5.4/5.5/5.6-luna/terra (contextWindow: 272000), so astra is the inconsistent row. Codex's own models.json caps astra at 272k default / 872k max.
• Consequence even with compaction enabled: the core reserve gate sits at 1,033,616 and the scaled hard valve at ~1,000,848 — both above the provider's 922k cap, so the core paths can never fire before the provider rejects. The observed rejection (916,628 succeeded, +~14k tool results failed) matches the 922k cap exactly.

5. (Related, tracked separately) extension-triggered turns skip before_agent_start

sendCustomMessage({triggerTurn:true}) (goal continuations, task/monitor wakes) runs _enforceCompactionBeforeProvider + _promptAgent but never emitBeforeAgentStart, so the builtin adaptive threshold/valve does not evaluate on those turns (already noted 2026-09-03). Not causal here (the flag in #2 was off), but it narrows proactive compaction to user-typed turns in goal-driven sessions. Needs a design decision on what the hook receives for a non-user prompt; out of scope for this PR.

Ideal end state

1. set_auto_compaction (RPC) is session-scoped: it changes this session's behaviour and is reported back through get_state, but never rewrites the persisted global setting. The interactive /settings toggle keeps persisting (it is the settings editor).
2. compaction.enabled=false means no proactive compaction (threshold, speculative, idle, adaptive). Emergency paths stay armed: provider overflow → one-shot compact-and-retry; pre-prompt hard reserve gate; final admission gate. A session must never be able to reach a state where the only exit is a human.
3. Goal continuation never re-prompts after a turn ended by a context overflow that recovery did not fix; it records a mechanical block (context overflow ended the turn (compaction did not recover)) so the next user message resumes it.
4. gpt-6-astra catalog contextWindow = 922,000 (the input cap), consistent with the 272k rows and with the generator's own comment.

Tracking

• Issue filed with evidence (this)
• RED tests: overflow recovery + hard gates with compaction.enabled=false
• Fix: emergency compaction independent of enabled
• RED + fix: RPC set_auto_compaction session-scoped
• RED + fix: goal continuation blocks on unrecovered overflow
• Fix: astra contextWindow 922,000 (generator + regenerated catalog + tests)
• Changelog
• Remote bun test green (ascii box / mengmotaMac), typecheck + lint
• Reproduction: replay of the failing session shape passes on the fixed build
• PR merged; this issue updated with the SHA

Evidence pointers

• Session file: ~/.omo/agent/sessions/--Users-yeongyu-sisyphuslabs--/2026-09-06T05-47-49-987Z_01a07542-….jsonl (1335 events, 0 compaction entries; logs/compaction.log has 0 lines for the session id).
• Usage trajectory (prompt tokens = input + cacheRead): fix(terminal): keep monitor tools with native bash #393 438k → feat(compaction): optional compaction.model override + re-enable senpi compaction on SDK-native claude-sdk-oauth lanes #737 609k → fix(packaging): preserve codemode Babel closure #949 733k → docs(agents): correct the SENPI_BRAND scrub claim for Bun runtimes #1111 827k → feat(tui): add optional message timestamps #1206 887k → feat: make eval-only tool routing the default and add monitor to it #1314 916,628 → fix(claude-sdk-oauth): state host-tool denial as a fact, not an instruction #1320/test(ai): wait for the manual OAuth prompt before aborting the login #1323/fix(ttsr): interrupt within-message paragraph repetition #1326 context_too_large → TTSR paragraph-repeat detector misses near-repeat drift (exact hash match); needs normalized match gated by progress #1330 user abort → model switched.
• OpenAI split-budget reference: https://docs.blackbox.ai/api-reference/context-window-limits (272k input + 128k output for the GPT-5 family; context_length_exceeded, param: "input").

[code-yeongyu]

Progress (2026-09-07 02:30Z)

Branch fix/context-overflow-failure-proof (worktree off origin/main 5a23f6edf). Every layer landed as test-first commits; RED/GREEN observed on an ASCII box (bx_2pd6me2s, bun 1.4.0 / node 24, vitest under CI=1), never on the local machine.

Layer	Commits	RED (before fix)	GREEN (after fix)
Emergency overflow recovery ignores compaction.enabled=false	c6c0faf80 test, 83ede765e fix	1422-overflow-recovery-with-auto-compaction-disabled.test.ts: 2 failed / 1 passed (recovery never ran, reason undefined)	76/76 across the new file + agent-session-compaction, context-overflow-model-alias, pre-prompt-compaction-no-continue, post-compaction-tool-continuation-deadlock
set_auto_compaction session-scoped	d9b587459 test, 58b67a72f fix	1422-set-auto-compaction-session-scoped.test.ts: 2 failed (persisted settings.json rewritten)	108/108 incl. rpc-multi-session, agent-session-queue, interactive-mode-compaction
Goal blocks on unrecovered overflow	ac7e3bbc6 test, fcb3dcce2 fix	1422-goal-blocks-on-unrecovered-overflow.test.ts reproduced the loop: a continuation was queued after the overflow error	186/186 across the goal suites (goal-extension, goal-monitor-continuation, goal-modules, goal-store, verdict, cap-recovery, issue-506)
OpenAI input cap as contextWindow	generator + regenerated catalog (committing now)	openai-fast-models / gpt-6-astra-catalog pinned 1,050,000	catalog: astra/astra-fast/5.4-pro/5.5-pro → 922,000; gpt-5..5.4-nano → 272,000; Azure flagship overrides → 922,000; check:model-data valid

Design notes that changed while implementing:

• "Emergency" is defined precisely (core/compaction/stuck-overflow.ts): a provider overflow error, or a zero-output length stop that filled the window. A completed answer whose usage merely exceeds the window (z.ai-style silent overflow) stays under the flag — otherwise the existing continues to provider call 2 without compaction when compaction is disabled contract would have flipped for a turn that was not actually stuck.
• The goal guard runs before eligibility on every automatic path (immediate, monitorDelayed, userGrace, sessionStart, systemRecovery, providerRecovery), not just providerRecovery: the monitor-delayed backstop would otherwise re-prompt the same overflowed context later.
• Interactive /settings keeps persisting (it calls settingsManager.setCompactionEnabled itself); only AgentSession.setAutoCompactionEnabled (the RPC command's implementation) became an in-memory session override.

Still running: full packages/coding-agent vitest on the box; packages/ai suite is 2560 passed / 1 expectation updated (openai-fast-models 1,050,000 → 922,000) / 1 environment failure (codex-apply-patch-wire-schema cannot resolve @earendil-works/pi-tui without a build — re-running after packages/tui is built on the box).

Item 5 from the report (extension-triggered turns skip before_agent_start) is deliberately NOT in this PR: it needs a decision on what the hook receives for a non-user prompt (prompt presets and other extensions act on event.prompt). Tracked here as an open item.