fix(gateway): suppress hidden-only incomplete Codex turns

[LeonSGP43]

Closes #51628

Summary

• detect retry-exhausted hidden-reasoning-only Codex turns before gateway fallback text is emitted
• persist only the user turn for those incomplete gateway runs so collaboration threads do not ingest a fake assistant reply
• document safer Slack reasoning-effort guidance for Codex-backed peer-agent channels

Testing

• uv run --frozen pytest -q tests/gateway/test_incomplete_gateway_turns.py -o addopts=''
• uv run --frozen ruff check gateway/run.py tests/gateway/test_incomplete_gateway_turns.py
• git diff --check

[teknium1]

Thanks for targeting a real gateway/session-safety failure. The current patch needs rework against current main.

Problems

• agent/conversation_loop.py:4436 returns retry exhaustion with a non-empty final_response. gateway/run.py:2604 returns any non-empty response before the new classifier can run, and the proposed helper also rejects non-empty agent_result["final_response"]. The suppression path therefore cannot match the production result shape.
• tests/gateway/test_incomplete_gateway_turns.py fabricates final_response=None and mocks _run_agent, so it does not exercise that current path.
• The later #51628 reproduction reports Codex Responses stream did not emit a terminal response; the proposed exact matcher only recognizes remained incomplete after.

Suggested changes

• Classify this structured incomplete/no-visible-answer state before the non-empty fallback is returned, then add an end-to-end gateway persistence/delivery test using the current result shape.
• Cover the no-terminal-stream reproduction or use a provider-agnostic structured criterion.

Automated hermes-sweeper review.

[teknium1]

This predicate cannot match the current retry-exhaustion result: agent/conversation_loop.py:4436 sets this same diagnostic as a non-empty final_response, while the helper rejects non-empty final_response and the normalizer returns non-empty response at gateway/run.py:2604 before reaching this code. Please classify the structured incomplete/no-visible-output state before that early return and test the real result shape.

[teknium1]

Merged via PR #65062 — your commit was cherry-picked onto current main with your authorship preserved in git log (rebase merge). One substantive follow-up on top: the detector required final_response to be falsy, but the conversation loop returns the retry-exhaustion sentinel as BOTH final_response and error — so as written it never fired on real exhaustion turns. The hardened version recognizes the sentinel echo (and never suppresses a genuinely different final text), blanks it at the delivery site, and your test now exercises the real loop shape. The suppression + user-only persistence design was exactly right for the #51628 poisoning vector — thanks for the careful gateway work.