Fixes #94391

Root cause

In-turn compaction on ~200K-token sessions silently failed because the outer aggregate wait was a hardcoded COMPACTION_RETRY_AGGREGATE_TIMEOUT_MS = 60_000 const inside runEmbeddedAttempt (src/agents/embedded-agent-runner/run/attempt.ts). On anthropic/claude-sonnet-4-6 the summary model call runs ~143–187s. The 60s outer wait fired first, marked the attempt incomplete, and discarded the result — even though the trajectory shows model.completed aborted=False externalAbort=False timedOut=False at 174s/143s/187s with valid output the provider had already been paid for.

Subsequent retries then collided with the still-running model call holding the session write lock (DEFAULT_SESSION_WRITE_LOCK_ACQUIRE_TIMEOUT_MS = 60s) and gave up — the "self-compounding retry storm" Path 2 in the issue.

The inner safety wrapper agents.defaults.compaction.timeoutSeconds (default 180s, configurable; reporter set 300s) already governs how long a single compaction model call may run. The outer aggregate wait was simply not wired to it.

Fix

Adopt the reporter's proposed approach: derive the outer aggregate-wait budget from the inner compaction model-call timeout instead of adding a new config surface.

• New helper resolveCompactionRetryAggregateTimeoutMs(compactionTimeoutMs) in compaction-retry-aggregate-timeout.ts returns max(60s floor, compactionTimeoutMs + 30s margin).
• attempt.ts already resolves compactionTimeoutMs = resolveCompactionTimeoutMs(params.config) earlier in the function for the lock-hold/grace logic; the new outer wait reuses that value, no extra plumbing.
• 60s historical floor preserved as a fallback when the inner timeout is missing/non-finite — installs that don't touch compaction.timeoutSeconds get the same behavior they had before.

Behavior matrix:

The +30s margin guarantees the inner safety timeout always fires first when a compaction call genuinely hangs — the outer wait never preempts a still-completing call (Path 1 cause), which in turn eliminates the lock contention next-retry sees (Path 2 effect).

Backwards compatibility

• No config schema change. agents.defaults.compaction.timeoutSeconds is already a documented public knob (used by compaction-safety-timeout.ts).
• Default install behavior changes from "60s outer wait abandons valid 150s+ compactions" to "210s outer wait waits for the inner cap to decide" — that is the intended fix; sessions that previously failed silently now succeed.
• isCompactionStillInFlight extension behavior is unchanged: while compaction is still running, the timer is restarted on each idle iteration just like before.

Cancellation on abandon

The reporter also flagged that abandoning the wait without cancelling the model call wastes the API call. The existing inner wrapper compactWithSafetyTimeout already wires through an AbortSignal that fires when the inner timeout trips, and that signal is threaded into the underlying compact() call. With this PR the outer wait now waits long enough for that inner signal to be the one that fires on a true hang, so abandons happen with a real cancel rather than the outer timer leaving the call orphaned. Wiring an explicit cancel into the outer aggregate-wait abandon path would require crossing the waitForCompactionRetry abstraction (it does not currently expose a cancel) and is left for a follow-up if that path proves still reachable in practice.

Tests

• New unit coverage in compaction-retry-aggregate-timeout.test.ts for resolveCompactionRetryAggregateTimeoutMs:
  • Floor when no/invalid inner timeout
  • Floor when inner timeout < 60s
  • Margin added on top of 180s default and 300s operator override
• Regression test mirroring the field repro from [Bug]: In-turn compaction silently fails on large sessions — hardcoded 60s aggregate wait abandons valid results, triggering a self-compounding retry storm #94391: compaction model call returning at 174s with compaction.timeoutSeconds=300 must no longer trip the 60s legacy budget; the wait must complete cleanly with timedOut=false.

pnpm vitest run src/agents/embedded-agent-runner/run/compaction-retry-aggregate-timeout.test.ts — 13 tests pass (was 8).

Related

• Bug: 180s compaction timeout is a single wall clock over the whole chunk pipeline with no partial-progress reuse, so a legitimately-long compaction fails identically every turn  #92043 — sibling family, different constant (EMBEDDED_COMPACTION_TIMEOUT_MS inner cap). Not a dup.
• fix(agents): scope compaction lock reentry to logical writer #88919 — lock mechanism PR, secondary; this fix removes the upstream cause (Path 1) that triggers the lock contention (Path 2) fix(agents): scope compaction lock reentry to logical writer #88919 targets independently.
• Feature: Configurable early auto-compaction threshold (don't wait until 200K tokens) #30411 — early compaction threshold; this PR's calibration data (174s at ~200K tokens) supports the discussion there.