Over-window session: historian fails on every idle with no backoff (exceeds_window bypasses the failure counter) and each failed attempt still creates a new hidden session #595

Short description

When a session grows past the historian model's context window, every incremental historian run fails immediately with producer_prompt_exceeds_window — retried on every idle marker with no backoff, because the admission-refused branch returns before incrementHistorianFailure and rolls back the retry-throttle reservation. Each failed attempt still creates a fresh hidden session. On hosts where hidden sessions can't be deleted at runtime (plain opencode serve / OpenChamber, #589) this floods the session list.

What happened?

Observed on 0.42.6 (running); mechanism verified in the 0.44.4 dist.

A long-running orchestrator session (1,929 messages, calibrated 236,700 tokens) exceeded the configured historian model's window (218,250). From then on:

• Every opencode idle marker on that session triggered an incremental historian run that fails instantly with producer_prompt_exceeds_window calibrated_tokens=236700 limit=218250 — 106 failed runs in ~64 minutes while the session was active (one every 15–30 s). The condition is permanent (the session only grows), so the historian never recovers.
• Each failed attempt correlates 1:1 with the creation of a new "Magic Context historian" hidden session (timestamps match exactly): 54 new hidden sessions in 15 minutes, 114 that day. Under OpenChamber (no runtime deletion) they all stay visible; even where deletion works, it's a create+delete churn per turn.

Code path (0.44.4 dist)

The producer_prompt_(exceeds_window|fit_unavailable) branch logs "historian producer admission refused", sets retainDrainReservationForRetryThrottle = false, calls rollbackDrainReservation(), and returns — before the incrementHistorianFailure / notifyHistorianIssue calls, which only run for other validation failures. So the most permanent failure class is exactly the one that bypasses the failure counter, the user-facing notice, and the retry throttle.

Suggestions

1. Treat admission-refused exceeds_window as permanent for the session: stop scheduling incremental retries (or gate retries behind an explicit trigger / config change), instead of re-firing on every idle.
2. Run the admission check before creating (or retiring) the hidden child, so a refused pass doesn't churn a session per attempt.
3. Consider a degrade path for over-window sessions — e.g. summarize a trailing prefix that fits the window — instead of refusing the whole pass forever.

Diagnostics

• historian_runs: 106 rows status=failed, error producer_prompt_exceeds_window calibrated_tokens=236700 limit=218250.
• subagent_invocations timestamps matching opencode idle session markers.
• Hidden-session time_created values matching the failed-run timestamps 1:1.

Plugin version

0.42.6 (observed behavior) / 0.44.4 (code analysis)

OpenCode version

2.0.18

Platform

linux x64

Client

OpenChamber 2.0.4 (web) against opencode serve