fix(gateway): bound the hygiene-compression turn-hold (salvage of #90845)

[kshitijk4poor]

Summary

A hygiene compression whose summary was still streaming could hold an arriving user turn indefinitely — the user saw a frozen bot. Salvage of #90845 by Machan-Army (2 commits, authorship preserved): the turn-hold is bounded (default 10s, now configurable); on expiry the turn proceeds uncompressed and the still-streaming summary is fence-protected in the background (a stale commit can never clobber newer turns).

Changes

• gateway/run.py: bounded turn-hold with commit-fence cancel/consume race handling; distinct HygieneTurnHoldExceeded path — AGENT_COMPRESSION_TURNHOLD provenance, deferral notice, NO failure-cooldown ladder (the fix(agent): do not let hygiene idle timeouts block in-agent compression #87011 "timed out/no output" contract stays truthful for real idle timeouts)
• Follow-ups (ours):
  • compression.hygiene_max_turn_hold_seconds registered in config_defaults (run.py already read it; the key was undiscoverable)
  • Turn-hold abandonment records a flat 60s retry-after — without it, sustained traffic re-spawned, held, and cancelled a fresh compressor on EVERY turn (per-turn summary-model token burn that never commits). Deliberately outside the x1/x3/x9 failure ladder; witness test asserts exactly that boundary (no streak increment, flat spacing, turn-hold reason)

Validation

test_session_hygiene + test_hygiene_failure_cooldown_ladder	47 passed
live smoke	turn-hold handler records flat retry, ladder unreachable from that path; key registered; provenance enum present
ruff	clean

Closes #90845.

Infographic

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

This is careful concurrency work: the bounded wait re-slices against the remaining turn-hold budget so a continuously-streaming worker can't skip past the check (gateway/run.py, slice computation ~L19800), expiry raises a distinct exception type, and the handler's cancel/consume fence race covers both directions (commit already in flight → consume; cancellable → release + defer cleanup). Keeping AGENT_COMPRESSION_TURNHOLD provenance out of the failure-cooldown ladder preserves the truthful #87011 contract, and the flat 60s retry-after is justified — without it, sustained traffic spawns+holds+cancels a compressor per turn, which is a real token-burn DoS on the summary model.

Two notes:

1. Bounded overshoot in the commit-in-flight branch. When the race lands with commit_in_flight=True, the handler awaits _hyg_future inline, so the turn can be held past _hyg_max_turn_hold_seconds by up-to-commit-duration (applying the summary + storage write). Probably acceptable — aborting mid-commit is worse — but a comment quantifying that overshoot at the await site would prevent someone later "fixing" it into a mid-commit cancellation.

2. New static bubble, un-localized. "ℹ️ Context compression deferred — summary still streaming…" is hardcoded English in the gateway user-facing path. feat(i18n): localize remaining gateway static bubbles #92338 (open now) is localizing exactly this string class via t(). Either route through the catalog here or add a follow-up note coordinating the key (gateway.session.compression_deferred-style) so Indonesian/Korean/etc. users don't get English-only copy the day after the i18n surface expands.

[Machan-Army]

@kshitijk4poor — thanks for salvaging this. Both reviewer points above are addressed in the patch below (applies cleanly on your branch head 28d21e2; verified: run.py parses, i18n key resolves, telegram format tests 42/42 green).

Point 1 — bounded overshoot: documented at the await site. The turn can exceed _hyg_max_turn_hold_seconds by up to commit duration; aborting mid-commit would corrupt the message-store transaction, so the overshoot is the cheaper failure mode. Comment says exactly that so nobody "fixes" it into a mid-commit cancellation later.

Point 2 — un-localized bubble: the ℹ️ Context compression deferred… message now routes through t() as gateway.compress.turnhold_deferred (en.yaml entry included; falls back to the English string until #92338's catalog translations land — t() degrades to the en catalog by design, so this is safe to take now).

From 4353fccfffada2475f4ba76de74d2c815101c170 Mon Sep 17 00:00:00 2001
From: Osham Wahab <osham@users.noreply.github.com>
Date: Sun, 23 Aug 2026 17:14:06 +0000
Subject: [PATCH] fix(gateway): document turn-hold commit overshoot + route
 deferred-notice through i18n (#92318 review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewer feedback on #92318:
1. Bounded overshoot in the commit-in-flight branch is now documented at
   the await site — the turn can exceed _hyg_max_turn_hold_seconds by up
   to commit duration, and aborting mid-commit would corrupt the
   message-store transaction. Prevents a future 'fix' into mid-commit
   cancellation.
2. The user-facing 'Context compression deferred' bubble now routes
   through t() as gateway.compress.turnhold_deferred (en.yaml entry
   added), coordinating with the i18n surface expanding in #92338 so
   non-English users don't get hardcoded English copy.
---
 gateway/run.py  | 15 +++++++++++----
 locales/en.yaml |  1 +
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/gateway/run.py b/gateway/run.py
index a2930483c..bc5c97c66 100644
--- a/gateway/run.py
+++ b/gateway/run.py
@@ -19878,6 +19878,15 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                                             if _cancelled is None:
                                                 await asyncio.sleep(0.025)
                                         if not _cancelled:
+                                            # NOTE: bounded overshoot by design.
+                                            # The turn can be held past
+                                            # _hyg_max_turn_hold_seconds by up to the
+                                            # commit duration (summary apply + storage
+                                            # write). Aborting mid-commit would corrupt
+                                            # the message-store transaction — the
+                                            # overshoot is the cheaper failure mode.
+                                            # Do NOT "fix" this into a mid-commit
+                                            # cancellation.
                                             _compressed, _ = await _hyg_future
                                         else:
                                             _hyg_commit_fence.release_cancelled_compression_lock()
@@ -19921,10 +19930,8 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                                                 session_entry.session_id,
                                                 time.monotonic() - _hyg_wait_started,
                                             )
-                                            _turnhold_msg = (
-                                                "ℹ️ Context compression deferred — "
-                                                "summary still streaming. "
-                                                "Continuing without compression this turn."
+                                            _turnhold_msg = t(
+                                                "gateway.compress.turnhold_deferred"
                                             )
                                             try:
                                                 _adapter = self._adapter_for_source(source)
diff --git a/locales/en.yaml b/locales/en.yaml
index b395fb99a..ade6e1f98 100644
--- a/locales/en.yaml
+++ b/locales/en.yaml
@@ -113,6 +113,7 @@ gateway:
     summary_failed:        "⚠️ Summary generation failed ({error}). {count} historical message(s) were removed and replaced with a placeholder; earlier context is no longer recoverable. Consider checking your auxiliary.compression model configuration."
     aborted:               "⚠️ Compression aborted ({error}). No messages were dropped — conversation is unchanged. Run /compress to retry, /reset for a clean session, or check your auxiliary.compression model configuration."
     aux_failed:            "ℹ️ Configured compression model `{model}` failed ({error}). Recovered using your main model — context is intact — but you may want to check `auxiliary.compression.model` in config.yaml."
+    turnhold_deferred:     "ℹ️ Context compression deferred — summary still streaming. Continuing without compression this turn."
     failed:                "Compression failed: {error}"
 
   debug:
-- 
2.47.3

If it's easier, the same commit lives on a branch — happy to open a PR against your fork, just say the word.

[kshitijk4poor]

Updated — all three review threads closed in one push:

1. Attribution CI failure root-caused and fixed: the original cherry-picked commits carried noreply@localhost author emails (from @Machan-Army's original fix(gateway): bound the hygiene-compression turn-hold so a streaming summary cannot freeze the turn #90845 branch), which the attribution checker can't map. Rewritten to 317197454+Machan-Army@users.noreply.github.com — authorship credit preserved in the NNN+ noreply form the checker auto-skips.

2. @Machan-Army's review patch applied as-is (thank you — it applied cleanly with git am): the bounded-overshoot NOTE at the await site (documenting that a commit-in-flight can hold the turn past _hyg_max_turn_hold_seconds by up to commit duration, and why aborting mid-commit is worse), and the deferred-notice bubble routed through t("gateway.compress.turnhold_deferred") with the en.yaml entry. Author credited as Osham Wahab with the CI-clean noreply form.

3. Verified on the assembled head (rebased, zero behind main): hygiene suites 47/47 (test_session_hygiene.py + test_hygiene_failure_cooldown_ladder.py), the i18n key resolves through the real agent.i18n.t path against a temp HERMES_HOME, gateway/run.py parses, ruff green on gateway/.

@Enough1122's both points are now addressed on-branch. Arming auto-merge (rebase).

[kshitijk4poor]

CI failure root-caused and fixed — my miss, good catch by the parity suite:

What failed: tests/agent/test_i18n.py::test_catalog_keys_match_english × 16 — the review patch added gateway.compress.turnhold_deferred to en.yaml only, and the catalog-parity contract requires every locale to carry the exact en key set. My local verification ran the hygiene suites and the key-resolution probe but not the i18n parity suite — the exact suite the change class touches.

Fix (amended into the i18n commit so every commit stays green): the key added to all 16 non-English catalogs with real translations (not English copies) — zh, zh-hant, ja, ko, de, es, fr, it, pt, ru, uk, tr, af, hu, ar, ga — following each catalog's existing compress: section conventions.

Verified: test_i18n.py 36/36 (was 16 failed), placeholder-parity included (no placeholders in this string); hygiene suites still 47/47; t('gateway.compress.turnhold_deferred', lang='ja') renders the Japanese string through the real path. Rebased on current main, pushed.

Re-arming auto-merge (rebase).