@namzu/sdk 52.0.0 → 52.2.0

package/src/runtime/query/iteration/index.ts

@@ -15,7 +15,7 @@ import {
 } from '../../../constants/tools/index.js'
 import { withStreamedMessageIdentity } from '../../../manager/session/streamed-message-identity.js'
 import { renderSkillsSection } from '../../../persona/assembler.js'
-import { resolveProviderCapabilities } from '../../../provider/capabilities.js'
+import { modelReadsImages, resolveProviderCapabilities } from '../../../provider/capabilities.js'
 import { collectChatCompletion } from '../../../provider/collect-chat-completion.js'
 import { renderToolSchema } from '../../../registry/tool/schema.js'
 import { formatCompletionNotification } from '../../../scheduler/completion-inbox.js'
@@ -54,6 +54,7 @@ import { stableDigest } from '../../../utils/hash.js'
 import { generateMessageId } from '../../../utils/id.js'
 import { parseStructuredResultJson } from '../../../utils/structured-result-json.js'
 import { createCallbackInference } from '../callback-inference.js'
+import { SandboxAcquisitionStopped } from '../deferred-sandbox.js'
 import { deliverDurableInbound } from '../durable-inbound.js'
 import type { ToolCallOutcome } from '../executor.js'
 import { projectObservationContext } from '../observation-context.js'
@@ -80,17 +81,27 @@ import { runAdvisoryPhase } from './phases/advisory.js'
 import { runIterationCheckpoint } from './phases/checkpoint.js'
 import { compactionBreaker } from './phases/compaction-breaker.js'
 import {
+	AUTOMATIC_COMPACTION_FAILED,
+	OVERFLOW_RELIEF_LIMIT,
 	activeContextWindow,
+	clearCompactionErrorNote,
+	compactionErrorNote,
 	measureContext,
 	relieveOverflow,
 	runCompactionCheck,
+	stopOnRefill,
 } from './phases/compaction.js'
 import { runHandoffPause } from './phases/handoff.js'
 import type { IterationContext } from './phases/index.js'
 import { runPlanGate } from './phases/plan.js'
 import { runToolReview } from './phases/tool-review.js'
 import { refreshWorkingMemory, splitWorkingMemoryForRequest } from './phases/working-memory.js'
-import { streamWithProviderRejectedImageRecovery } from './provider-rejected-image.js'
+import {
+	type TextOnlyModelRecovery,
+	type TextOnlyModelRefusal,
+	streamWithProviderRejectedImageRecovery,
+} from './provider-rejected-image.js'
+import { type MediaRemoval, RequestRepair } from './request-repair.js'
 import {
 	type StepShaping,
 	appendWorkContext,
@@ -141,6 +152,11 @@ const CLOSING_RESPONSE_GUIDANCE =
 
 export { awaitedJobGraceMs, settleGraceMs } from './outstanding-work.js'
 
+/** One provider's model, as {@link IterationOrchestrator} remembers it. */
+function textOnlyKey(providerId: string, model: string): string {
+	return `${providerId}\u0000${model}`
+}
+
 export class IterationOrchestrator {
 	private ctx: IterationContext
 	private advisoryTurn:
@@ -188,6 +204,73 @@ export class IterationOrchestrator {
 	}
 	/** Rich tool blocks already reported; durable history is scanned every turn. */
 	private readonly warnedRichToolResults = new Set<string>()
+	/** What this run has learned about requests its provider rejects as invalid, and how to repair them. */
+	private readonly requestRepair = new RequestRepair({
+		debug: (message) => this.ctx.log.debug(message),
+		onMediaRemoved: (removal) => this.noteMediaRemoved(removal),
+		servedBy: () => this.ctx.servingMember?.(),
+	})
+	/**
+	 * Provider and model pairs that refused a request for holding an image; they
+	 * get none for the rest of the run. Keyed by both: one model id can be served
+	 * by two members of a fallback chain, and only the one that refused is known.
+	 */
+	private readonly textOnlyModels = new Set<string>()
+
+	/**
+	 * The member a request for `model` goes to first. A fallback chain keeps
+	 * serving from the member it last moved to, so that member, not the head,
+	 * is the one whose reading of images counts.
+	 */
+	private servingModel(model: string): { readonly providerId: string; readonly model: string } {
+		const serving = this.ctx.servingMember?.()
+		return {
+			providerId: serving?.providerId ?? this.ctx.provider.id,
+			model: serving?.model ?? model,
+		}
+	}
+
+	/** Whether a request for `model` may carry images: the driver's catalogue and this run's own evidence agree. */
+	private modelReadsImages(model: string): boolean {
+		const serving = this.servingModel(model)
+		return (
+			!this.textOnlyModels.has(textOnlyKey(serving.providerId, serving.model)) &&
+			modelReadsImages(this.ctx.provider, model)
+		)
+	}
+
+	/** What a request for `model` does when its model turns out to read text only. */
+	private textOnlyRecovery(model: string): TextOnlyModelRecovery {
+		return {
+			servedBy: () => this.servingModel(model),
+			onAccepted: (refused) => this.noteTextOnlyModel(refused),
+		}
+	}
+
+	/**
+	 * A provider refused a request for holding an image its model cannot read, and
+	 * the retry without images was accepted. Stop sending images to it, and say so
+	 * once, so the host can remember the model beyond this run.
+	 */
+	private async noteTextOnlyModel(refused: TextOnlyModelRefusal): Promise<void> {
+		const key = textOnlyKey(refused.providerId, refused.model ?? '')
+		if (this.textOnlyModels.has(key)) return
+		this.textOnlyModels.add(key)
+		const { providerId, model } = refused
+		this.ctx.log.warn('Capability mismatch: the model cannot read images', {
+			[GENAI.SYSTEM]: providerId,
+			[GENAI.REQUEST_MODEL]: model ?? '',
+		})
+		await this.ctx.emitEvent?.({
+			type: 'capability_warning',
+			turnId: this.ctx.recorder.turnId,
+			capability: 'vision',
+			contentSource: 'history',
+			providerId,
+			...(model !== undefined ? { model } : {}),
+			message: `Model '${model ?? 'unknown'}' on provider '${providerId}' refused a request that held an image, so images are left out of its requests. They stay in the conversation and are sent again to a model that reads them.`,
+		})
+	}
 	/**
 	 * The previous iteration held a `stopWhen` decision open for a worker.
 	 *
@@ -442,16 +525,19 @@ export class IterationOrchestrator {
 		// checkpoint names the message the turn is answering.
 		await this.ctx.checkpointMgr.markLoopStart?.(recorder)
 
-		// One context-overflow relief per *stuck point*, not per turn.
+		// Context-overflow relief is a two-rung ladder per *stuck point*, not per
+		// turn, as in the reference terminal (at most two reactive compactions per
+		// overflow): the first relief, then one deeper pass if the retry still
+		// overflows.
 		//
-		// The latch exists so that a second overflow immediately after a
-		// successful compaction — meaning the prompt is irreducible — stops
-		// instead of looping. It was never meant to disarm the mechanism for
-		// the rest of the turn, which is what a turn-scoped flag did: one
-		// relief at iteration 3 left iteration 40 to die on an overflow with
-		// obvious moves left. It is cleared by a turn that actually
-		// succeeded, which is the evidence that the turn is no longer stuck.
-		let overflowRelieved = false
+		// The limit exists so that an overflow that survives both rungs — an
+		// irreducible prompt — stops instead of looping. It was never meant to
+		// disarm the mechanism for the rest of the turn, which is what a
+		// turn-scoped flag did: one relief at iteration 3 left iteration 40 to die
+		// on an overflow with obvious moves left. The count is cleared by a turn
+		// that actually succeeded, which is the evidence that the turn is no
+		// longer stuck.
+		let overflowReliefs = 0
 		// The output cap a provider told us fits beside this prompt. One request's
 		// worth: it is cleared by a call that went through.
 		let outputCapOverride: number | undefined
@@ -814,6 +900,7 @@ export class IterationOrchestrator {
 						this.projectObservations(requestHistory),
 						this.ctx.turnConfig.maxRequestRichContentBytes ??
 							DEFAULT_MAX_REQUEST_RICH_CONTENT_BYTES,
+						{ imagesReadable: this.modelReadsImages(stepModel) },
 					)
 					appendWorkContext(shaping, messages, iterationNum, step)
 					if (closingDirective) messages.push(closingDirective)
@@ -989,6 +1076,8 @@ export class IterationOrchestrator {
 						stepMessageId,
 						{
 							onAccepted: (identity) => this.acceptProviderRejectedImage(identity),
+							textOnly: this.textOnlyRecovery(stepModel),
+							repair: this.requestRepair,
 						},
 						Boolean(
 							this.ctx.reviewAnswer || this.ctx.structuredOutput?.review || this.ctx.advisoryCtx,
@@ -1042,7 +1131,8 @@ export class IterationOrchestrator {
 
 					// The turn went through, so the turn is not sitting on an
 					// irreducible prompt any more. Re-arm relief for the next one.
-					overflowRelieved = false
+					overflowReliefs = 0
+					clearCompactionErrorNote(this.ctx)
 					outputCapOverride = undefined
 					if (response.finishReason !== 'length') this.outputContinuations = 0
 
@@ -1895,6 +1985,12 @@ export class IterationOrchestrator {
 					yield* this.ctx.drainPending()
 				} catch (err) {
 					const cancelled = this.ctx.abortController.signal.aborted
+					// A deferred sandbox that was cancelled or ran out of time. The
+					// turn settles it as `cancelled` / `timeout` in `query()`, which is
+					// not a failure of this iteration: it is recorded the way a turn
+					// stopped by its own abort or timeout is (a cancelled step, no
+					// error span), so the ledger and the stop reason agree.
+					const sandboxStopped = err instanceof SandboxAcquisitionStopped
 
 					// This iteration gets a step too, and it is the one the
 					// argument three hundred lines above was actually about.
@@ -1955,12 +2051,13 @@ export class IterationOrchestrator {
 							startedAt: stepStartedAt,
 							usageBefore,
 							costBefore,
-							unfinished: cancelled
-								? { finishReason: 'cancelled' }
-								: {
-										finishReason: 'error',
-										failure: describeStepFailure(err, this.ctx.provider.id),
-									},
+							unfinished:
+								cancelled || sandboxStopped
+									? { finishReason: 'cancelled' }
+									: {
+											finishReason: 'error',
+											failure: describeStepFailure(err, this.ctx.provider.id),
+										},
 						})
 					}
 
@@ -2020,22 +2117,58 @@ export class IterationOrchestrator {
 					}
 
 					if (
-						!overflowRelieved &&
 						!(err instanceof AnswerReviewFailure) &&
 						classifyProviderError(err, this.ctx.provider.id).code === 'context_length_exceeded'
 					) {
-						overflowRelieved = true
-						const shed = await relieveOverflow(this.ctx)
+						// The rapid-refill check comes first, before the first reactive relief
+						// of an overflow, as in the reference terminal. A relief that follows
+						// the previous compaction within the refill window counts toward the
+						// limit, so a tool that re-fills the window every time it is called
+						// stops the turn instead of being cleared and called again without end.
+						// The deeper rung of the same overflow is not counted again.
+						if (overflowReliefs === 0 && (await stopOnRefill(this.ctx))) {
+							if (iterationActivity) {
+								this.ctx.activityStore.fail(iterationActivity.id, toErrorMessage(err))
+							}
+							if (this.stopForCompactionBreaker()) break
+						}
+						// A rung that sheds too little to change the verdict is not worth a
+						// provider call; climb to the next one at once.
+						let shed = false
+						while (!shed && overflowReliefs < OVERFLOW_RELIEF_LIMIT) {
+							overflowReliefs++
+							shed = await relieveOverflow(this.ctx, { deeper: overflowReliefs > 1 })
+						}
 						if (shed) {
+							// Clearing results is a compaction too: only summaries and reducers
+							// recorded themselves, so a clear-only relief was invisible to the
+							// breaker.
+							compactionBreaker(this.ctx)?.recordCompaction(iterationNum)
 							this.ctx.log.info('Retrying the turn after relieving a context overflow', {
 								[NAMZU.TURN_ID]: recorder.turnId,
 								[NAMZU.ITERATION]: iterationNum,
+								'namzu.runtime.relief_rung': overflowReliefs,
 							})
 							if (iterationActivity) {
 								this.ctx.activityStore.complete(iterationActivity.id)
 							}
 							continue
 						}
+						// Out of rungs. The conversation is kept; say why compaction could not
+						// make room when it errored, as the reference does.
+						const cause = compactionErrorNote(this.ctx)
+						if (cause !== undefined && err instanceof Error) {
+							try {
+								err.message = `${err.message}${AUTOMATIC_COMPACTION_FAILED}${cause}`
+							} catch {
+								// A frozen error keeps its own message; the cause stays in the log.
+							}
+						}
+					}
+
+					if (sandboxStopped) {
+						if (iterationActivity) this.ctx.activityStore.complete(iterationActivity.id)
+						throw err
 					}
 
 					if (iterationActivity) {
@@ -2643,6 +2776,32 @@ export class IterationOrchestrator {
 			.some((t) => t.state !== 'completed' && t.state !== 'failed' && t.state !== 'canceled')
 	}
 
+	/** Media the provider could not process was left out of a request that then went through. */
+	private async noteMediaRemoved(removal: MediaRemoval): Promise<void> {
+		this.ctx.log.warn('Media the provider rejected was left out of the request', {
+			[GENAI.SYSTEM]: this.ctx.provider.id,
+			'namzu.request.media_removed': removal.count,
+		})
+		const noun = removal.count === 1 ? 'a file' : `${removal.count} files`
+		const it = removal.count === 1 ? 'it' : 'they'
+		await this.ctx.emitEvent?.({
+			type: 'capability_warning',
+			turnId: this.ctx.recorder.turnId,
+			capability: removal.kind === 'document' ? 'documents' : 'vision',
+			// The person's own latest attachment is named as such; a count limit is
+			// not a fault in any file.
+			contentSource: removal.current
+				? 'media-removed-current'
+				: removal.limit
+					? 'media-limit'
+					: 'media-removed',
+			providerId: this.ctx.provider.id,
+			message: removal.limit
+				? `The conversation holds more files than the provider accepts at once, so ${noun} (the oldest) ${removal.count === 1 ? 'was' : 'were'} left out of the request. The conversation still holds ${it}.`
+				: `The provider could not process ${noun}${removal.current ? ' attached to your latest message' : ' in this conversation'}, so ${it} ${removal.count === 1 ? 'was' : 'were'} left out of the request. The conversation still holds ${it}.`,
+		})
+	}
+
 	private async acceptProviderRejectedImage(identity: RequestImageIdentity): Promise<void> {
 		const repaired = markProviderRejectedImage(this.ctx.recorder.messages, identity)
 		if (repaired.count === 0) {
@@ -2700,6 +2859,7 @@ export class IterationOrchestrator {
 			const finalMessages = projectRequestRichContent(
 				this.projectObservations(finalHistory),
 				this.ctx.turnConfig.maxRequestRichContentBytes ?? DEFAULT_MAX_REQUEST_RICH_CONTENT_BYTES,
+				{ imagesReadable: this.modelReadsImages(model) },
 			)
 			appendWorkContext(this.stepShaping(), finalMessages, this.steps.length + 1, { model })
 			// The closing directive is the last thing the model reads: after
@@ -2746,8 +2906,13 @@ export class IterationOrchestrator {
 				signal: this.ctx.abortController.signal,
 			} satisfies import('../../../types/provider/index.js').ChatCompletionParams
 			const response = await collectChatCompletion(
-				streamWithProviderRejectedImageRecovery(this.ctx.provider, finalParams, (identity) =>
-					this.acceptProviderRejectedImage(identity),
+				streamWithProviderRejectedImageRecovery(
+					this.ctx.provider,
+					finalParams,
+					(identity) => this.acceptProviderRejectedImage(identity),
+					undefined,
+					this.textOnlyRecovery(model),
+					this.requestRepair,
 				),
 			)
 

package/src/runtime/query/iteration/phases/compaction-breaker.ts

@@ -3,9 +3,10 @@
  *
  * - Three failures in a row (a pass that ran and shed nothing): every one of
  *   them paid for a summary or a reducer call and left the history as it was,
- *   so a fourth would do the same. Compaction is skipped from then on and the
- *   turn carries on; a pass the provider forces by rejecting the prompt is not
- *   gated.
+ *   so a fourth would do the same. Proactive compaction is skipped from then on
+ *   and the turn carries on, silently as far as the person is concerned (a log
+ *   line and a `breaker_open` event, no sentence); a pass the provider forces
+ *   by rejecting the prompt is not gated, so the reactive ladder still runs.
  * - Three compactions in a row, each followed by the context filling back up
  *   within three iterations: something in the loop (a huge file read, a tool
  *   that prints without limit) refills the window faster than any summary can
@@ -27,12 +28,13 @@ export const COMPACTION_REFILL_ITERATIONS = 3
 /** Consecutive refills that stop the turn. */
 export const COMPACTION_REFILL_LIMIT = 3
 
-/** One short line, shown once, when the turn stops on refills. */
+/**
+ * One short line, shown once, when the turn stops on refills. It names the
+ * cause and a step that keeps the conversation: the reference terminal also
+ * offers to start over here, and Namzu never does.
+ */
 export const COMPACTION_REFILL_MESSAGE =
-	'The context filled up again right after being compacted, three times in a row. A file or tool output is probably too big for the window: read it in smaller parts, or start fresh with /clear.'
-/** One short line, shown once, when compaction stops after failures. */
-export const COMPACTION_FAILURE_MESSAGE =
-	'Automatic compaction stopped after three failed attempts. Run /compact yourself, or start fresh with /clear.'
+	'The context filled up again right after being compacted, three times in a row. A file being read or a tool output is probably too large for the context window. Try reading it in smaller parts.'
 
 export class CompactionBreaker {
 	private failures = 0

package/src/runtime/query/iteration/phases/compaction.ts

@@ -16,17 +16,14 @@ import { serializeState } from '../../../../compaction/serializer.js'
 import { buildCompactionMessage, isCompactionMessage } from '../../../../compaction/summary.js'
 import { estimateMessagesTokens } from '../../../../compaction/token-estimate.js'
 import { buildVerifiedSummaryWithBoundedProvider } from '../../../../compaction/verifier.js'
+import type { CompactionConfig } from '../../../../config/runtime.js'
 import { CHARS_PER_TOKEN } from '../../../../constants/limits.js'
 import { NAMZU } from '../../../../constants/telemetry/index.js'
 import { invariants } from '../../../../invariants/index.js'
 import { resolveTaskModel } from '../../../../model-router/task-router.js'
 import type { Message } from '../../../../types/message/index.js'
 import { applyLifecycleHookResults } from '../../plugin-hooks.js'
-import {
-	COMPACTION_FAILURE_MESSAGE,
-	COMPACTION_REFILL_MESSAGE,
-	compactionBreaker,
-} from './compaction-breaker.js'
+import { COMPACTION_REFILL_MESSAGE, compactionBreaker } from './compaction-breaker.js'
 import type { IterationContext } from './context.js'
 import { isWorkingMemoryMessage } from './working-memory.js'
 
@@ -223,6 +220,73 @@ export function measureContext(ctx: IterationContext): {
 	return { tokens: estimateTokens(ctx), source: 'estimate' }
 }
 
+/**
+ * Reactive compactions allowed for one overflow, as in the reference
+ * terminal: the first relief, then at most one deeper pass.
+ */
+export const OVERFLOW_RELIEF_LIMIT = 2
+
+/** Round-groups that must remain for the deeper pass to be worth running. */
+export const DEEPER_PASS_MIN_GROUPS = 3
+
+export interface OverflowReliefOptions {
+	/**
+	 * The second rung. Keep only the newest round-group verbatim instead of the
+	 * configured recent window (when at least {@link DEEPER_PASS_MIN_GROUPS}
+	 * groups remain), and clear oversized tool results even inside the recent
+	 * window, with the same placeholder and spill pointer a stale result gets.
+	 */
+	readonly deeper?: boolean
+}
+
+/**
+ * A round-group starts at each assistant message and runs to the next one, so
+ * its tool results stay with the call that made them. The newest group is the
+ * last assistant message and everything after it; the opening user messages
+ * ride with the first group.
+ */
+function roundGroups(messages: readonly Message[]): number {
+	let groups = 0
+	for (const message of messages) if (message.role === 'assistant') groups++
+	return groups
+}
+
+/**
+ * The deeper rung's configuration: no tool result protected, and a recent
+ * window no larger than the first rung's. With three or more groups the
+ * window shrinks to the newest group, but never grows past what the
+ * configuration already kept: a newest group bigger than that would make the
+ * "deeper" pass shed less than the first one.
+ */
+export function deepenConfig(
+	config: CompactionConfig,
+	messages: readonly Message[],
+): CompactionConfig {
+	let lastAssistant = -1
+	for (let i = messages.length - 1; i >= 0; i--) {
+		if (messages[i]?.role === 'assistant') {
+			lastAssistant = i
+			break
+		}
+	}
+	const deeper = { ...config, keepRecentToolResults: 0 }
+	if (lastAssistant < 0 || roundGroups(messages) < DEEPER_PASS_MIN_GROUPS) return deeper
+	const newest = messages.slice(lastAssistant)
+	if (config.keepRecentTokens !== undefined) {
+		return {
+			...deeper,
+			keepRecentTokens: Math.max(
+				1,
+				Math.min(config.keepRecentTokens, estimateMessagesTokens(newest)),
+			),
+		}
+	}
+	return {
+		...deeper,
+		keepRecentMessages: Math.max(1, Math.min(config.keepRecentMessages, newest.length)),
+	}
+}
+
 /**
  * Shed history because the PROVIDER said the prompt is too long.
  *
@@ -241,12 +305,18 @@ export function measureContext(ctx: IterationContext): {
  * @returns whether anything was actually shed. `false` means retrying would
  *   send the same prompt again, so the caller must not.
  */
-export async function relieveOverflow(ctx: IterationContext): Promise<boolean> {
+export async function relieveOverflow(
+	ctx: IterationContext,
+	options: OverflowReliefOptions = {},
+): Promise<boolean> {
+	// The cause belongs to the rung that is about to run: an earlier rung's
+	// summary failure must not be blamed for a later rung that compacted cleanly.
+	clearCompactionErrorNote(ctx)
 	const before = ctx.recorder.messages.length
 	const beforeChars = totalChars(ctx.recorder.messages)
 	const beforeTokens = estimateMessagesTokens(ctx.recorder.messages)
 
-	await runCompactionCheck(ctx, { force: true })
+	await runCompactionCheck(ctx, { force: true, ...(options.deeper ? { deeper: true } : {}) })
 
 	const shed = beforeChars - totalChars(ctx.recorder.messages)
 	const tokensShed = beforeTokens - estimateMessagesTokens(ctx.recorder.messages)
@@ -278,6 +348,31 @@ export async function relieveOverflow(ctx: IterationContext): Promise<boolean> {
 	return true
 }
 
+/**
+ * Why the last compaction attempt errored, kept for the turn so that when
+ * relief runs out the failure it ends on can say so, as the reference
+ * terminal's " · automatic compaction failed: <cause>" does.
+ */
+const compactionErrors = new WeakMap<object, string>()
+const MAX_COMPACTION_CAUSE_CHARS = 300
+/** The sentence the cause is appended with. */
+export const AUTOMATIC_COMPACTION_FAILED = ' · automatic compaction failed: '
+
+function noteCompactionError(ctx: IterationContext, error: unknown): void {
+	const text = error instanceof Error ? error.message : String(error)
+	if (text.length > 0) compactionErrors.set(ctx.recorder, text.slice(0, MAX_COMPACTION_CAUSE_CHARS))
+}
+
+/** The turn's last compaction error, or `undefined` when none errored. */
+export function compactionErrorNote(ctx: IterationContext): string | undefined {
+	return compactionErrors.get(ctx.recorder)
+}
+
+/** A turn that got through has nothing left to explain. */
+export function clearCompactionErrorNote(ctx: IterationContext): void {
+	compactionErrors.delete(ctx.recorder)
+}
+
 function totalChars(messages: readonly { content: unknown }[]): number {
 	let total = 0
 	for (const msg of messages) total += measureContentChars(msg.content)
@@ -335,8 +430,11 @@ async function declined(
 /**
  * The third refill in a row: stop the turn instead of compacting again.
  * Returns true when this pass must not run. Only with `circuitBreaker`.
+ * The loop also asks it before the first reactive relief of an overflow, as
+ * the reference terminal does (`rhr` runs first in its withheld-overflow
+ * handling), so a re-read loop made only of overflows is counted too.
  */
-async function stopOnRefill(ctx: IterationContext): Promise<boolean> {
+export async function stopOnRefill(ctx: IterationContext): Promise<boolean> {
 	const breaker = compactionBreaker(ctx)
 	if (!breaker) return false
 	// Already announced: the turn is on its way out; do not say it twice.
@@ -418,6 +516,7 @@ async function applyReducer(
 			'namzu.runtime.reason': reduction.reason,
 			'exception.message': message,
 		})
+		noteCompactionError(ctx, error)
 		await declined(ctx, 'reducer_threw', before, message)
 		return
 	}
@@ -549,7 +648,7 @@ interface CompactionPass {
 
 export async function runCompactionCheck(
 	ctx: IterationContext,
-	options?: { force?: boolean },
+	options?: { force?: boolean; deeper?: boolean },
 ): Promise<void> {
 	const pass: CompactionPass = {
 		attempted: false,
@@ -585,11 +684,12 @@ export async function runCompactionCheck(
 async function runCompactionCheckInner(
 	ctx: IterationContext,
 	pass: CompactionPass,
-	options?: { force?: boolean },
+	options?: { force?: boolean; deeper?: boolean },
 ): Promise<void> {
-	const config = ctx.compactionConfig
-	if (!config) return
-	if (config.strategy === 'disabled') return
+	const configured = ctx.compactionConfig
+	if (!configured) return
+	if (configured.strategy === 'disabled') return
+	const config = options?.deeper ? deepenConfig(configured, ctx.recorder.messages) : configured
 
 	const measured = measureContext(ctx)
 	const estimatedTokens = measured.tokens
@@ -616,11 +716,14 @@ async function runCompactionCheckInner(
 	const startAt = salience ? Math.min(config.softTarget ?? DEFAULT_SOFT_TARGET, trigger) : trigger
 	if (!options?.force && usage < startAt) return
 
-	// Three failed passes in a row: stop trying for the rest of the turn, and
-	// say so once. A pass the provider forced is never gated.
+	// Three failed passes in a row: stop proactive compaction for the rest of
+	// the turn. A pass the provider forced is never gated.
 	const breaker = compactionBreaker(ctx)
 	if (breaker?.failuresOpen && !options?.force) {
 		if (breaker.takeFailureNotice()) {
+			// Silent for the person, as in the reference terminal: a log line and the
+			// event for a host that wants it, but no sentence to show. Only the
+			// proactive pass stops; a real overflow still runs the reactive ladder.
 			ctx.log.warn('Compaction failed three times in a row — switched off for this turn', {
 				[NAMZU.TURN_ID]: ctx.recorder.turnId,
 			})
@@ -630,7 +733,6 @@ async function runCompactionCheckInner(
 				iteration: ctx.recorder.currentIteration,
 				cause: 'breaker_open',
 				messages: ctx.recorder.messages.length,
-				error: COMPACTION_FAILURE_MESSAGE,
 			})
 		}
 		return
@@ -851,25 +953,39 @@ async function runCompactionCheckInner(
 		// to a cheap model while the bill is written against the expensive one
 		// is a mistake with no symptom.
 		const compactionModel = resolveTaskModel('compaction', ctx.taskRouter, ctx.turnConfig.model)
-		compactedContent = await buildVerifiedSummaryWithBoundedProvider(
-			manager,
-			olderMessages as Message[],
-			ctx.provider,
-			config,
-			(usage) =>
-				ctx.recorder.accumulateUsage(usage, {
-					providerId: ctx.recorder.servingProviderId,
-					model: compactionModel,
-				}),
-			// The one model call a turn makes that the user never asked for. It
-			// reads a transcript and writes a summary, which is the cheapest
-			// thing a small model does well, and it fires on exactly the long
-			// runs where the primary model is most expensive. `taskRouter` had
-			// been accepted, validated and threaded through four types since it
-			// was added, and nothing ever consulted it.
-			compactionModel,
-			ctx.abortController.signal,
-		)
+		try {
+			compactedContent = await buildVerifiedSummaryWithBoundedProvider(
+				manager,
+				olderMessages as Message[],
+				ctx.provider,
+				config,
+				(usage) =>
+					ctx.recorder.accumulateUsage(usage, {
+						providerId: ctx.recorder.servingProviderId,
+						model: compactionModel,
+					}),
+				// The one model call a turn makes that the user never asked for. It
+				// reads a transcript and writes a summary, which is the cheapest
+				// thing a small model does well, and it fires on exactly the long
+				// runs where the primary model is most expensive. `taskRouter` had
+				// been accepted, validated and threaded through four types since it
+				// was added, and nothing ever consulted it.
+				compactionModel,
+				ctx.abortController.signal,
+			)
+		} catch (error) {
+			// The model step only ADDS to the extracted state, so a failed one (a
+			// timeout, a provider error, its own overflow after the ladder in the
+			// verifier ran out) is not a reason to leave the history as it is. Cancellation
+			// is the caller's, and still stops the pass.
+			if (ctx.abortController.signal.aborted) throw error
+			noteCompactionError(ctx, error)
+			ctx.log.warn('The compaction summary call failed — using the extracted state alone', {
+				[NAMZU.TURN_ID]: ctx.recorder.turnId,
+				'exception.message': error instanceof Error ? error.message : String(error),
+			})
+			compactedContent = serializeState(manager.getState())
+		}
 	} else {
 		compactedContent = serializeState(manager.getState())
 	}