fix(coding-agent): recover required compaction loops - #679

[sisyphus-bot] Brutal review of PR #679. CI is green and the headline behaviors are pinned, but five independent review lanes plus lead-owned reproduction found concrete, reproducible defects that must be fixed before merge. Requesting changes.

Blocker 1 (P1, runtime): successful required-compaction recovery still rejects the originating prompt

• packages/coding-agent/src/core/agent-session.ts:1004-1009 stores _requiredCompactionAdmissionError when a queued continuation hits required compaction, but nothing clears it when the post-agent_end recovery is ACCEPTED and the queued continuation completes successfully. _promptAgent() (:1266-1271) then throws the stale error.
• Deterministic repro (2/2 runs, faux provider; steer queued mid-turn, inline compaction rejected once, recovery accepted): the queued continuation is persisted ("queued continuation completed", provider calls = 2, both queues empty) yet the originating session.prompt() still rejects with "Context remains above the compaction threshold because compaction did not complete".
• Requested change: clear the stored admission error when the recovery compaction is accepted and its queued continuation is scheduled/launched, plus a regression test at the post-compaction-recovery-bounds seam that queues the steer BEFORE the failed inline admission.

Blocker 2 (resource safety): deterministic fallback eagerly serializes retained messages unboundedly and executes accessors

• packages/coding-agent/src/core/extensions/builtin/compaction/deterministic-fallback.ts:45-55 (estimateConservativeTokens) materializes JSON.stringify(message) for every retained message with no size bound and no abort observation. Measured: one 32 MiB retained text message adds ~207 MiB peak memory, synchronously, exactly during required recovery.
• The same path invokes property getters on retained tool-call arguments (probe observed getterCalls: 2 from a crafted arguments object): persisted, attacker-influenceable data is executed-on-read during recovery sizing.
• Requested change: bound the estimator with early exit once the contextWindow - reserveTokens budget is exceeded, byte-count strings without whole-message serialization, and reject accessor-bearing/non-plain values instead of reading them.

Blocker 3 (test integrity): shipped guards are not pinned

• G1: moving the turn_end reset out of finally (skipping it on the lane-policy / degradation-recovery early returns) leaves the whole changed suite GREEN (48 files / 335 tests). The exact regression class this PR fixes is unprotected. Add a route-guards case that trips degradation recovery, fires turn_end, and asserts the next turn still admits compaction.
• G2: deleting the agent_start provenance clear (agent-session.ts:1593-1595) leaves coverage GREEN; a same-text provider error in a later run can inherit stale required-compaction provenance. Add a guards test: complete one real required-compaction run, then feed the identical provider error text in a fresh run and assert no spurious retry/compaction.
• C1: continues once after recovery clears the threshold queues only two faux responses while asserting three calls, so the final turn ends in an unasserted No more faux responses queued error. Queue a third response and assert its content.

Lane verdicts

• behavior (deep): P1 blocker 1, reproduced.
• safety (deep): blocker 2, measured (~207 MiB / 32 MiB input; accessor execution).
• test review: blockers G1/G2/C1, with sensitivity proofs that the reset, hard-cap order, and provenance gates ARE load-bearing (each deletion goes RED in the shipped tests).
• quality: PASS, no criterion-blocking findings.
• runtime QA lane: BLOCKED by harness-write failure, no runtime evidence; lead will run the isolated real-CLI QA after fixes.

Clean-worktree receipt at review time: git status --porcelain empty in /Users/yeongyu/local-workspaces/senpi/local-ignore/worktrees/pr-679-brutal-review. Evidence: local-ignore/qa-evidence/20260803-pr-679-brutal-review/ (reviewer reports + repro scripts).