#125308 [Bug]: Long-running sessions become unbounded and un-compactable (projection size, memory-flush cost, transcript-byte fuse, Codex binding identity)

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

Summary

One violated invariant with several visible facets: a long-running session's context cost is neither bounded nor recoverable by compaction.

Codex continuity projections have no operator cap, so the rendered conversation payload is fully token-derived with no way to narrow it.
Pre-compaction memory-flush runs inherit the full conversational window and re-inject persona/workspace/skills context, making the protective checkpoint nearly as expensive as the turn it protects.
The transcript-byte preflight fuse measures the entire durable active path — which survives compaction — so once tripped it never clears; native harness compaction (which leaves the host transcript untouched) is allowed to satisfy a transcript_bytes preflight, leaving the fuse permanently tripped.
Native Codex compaction compares session bindings with a partial equality check and can clear/restore the wrong physical binding generation, or fall back to a different client while a retired-but-still-live app-server owns the thread.
Heartbeats cannot narrow skills/tools, so every heartbeat pays the full context surface.

Steps to reproduce

Run a long Codex-backed session past the transcript-byte preflight threshold.
Observe compaction being requested repeatedly while the byte fuse stays tripped (measurement includes pre-compaction history that compaction cannot remove).
Observe memory-flush turns consuming near-full-window input on each pre-compaction checkpoint.

Expected behavior

Bounded projections (operator-cappable), cheap bounded memory-flush checkpoints, a byte fuse measured over the replay window that clears after compaction, compaction routed to the surface that actually shrinks the measured bytes, and binding clear/restore that is generation-exact and refuses cross-client fallback while the owner is live.

Actual behavior

Unbounded projections; near-full-window flush turns; a permanently tripped byte fuse; binding clear/restore able to act on the wrong generation.

OpenClaw version

2026.8.1 (source checkout)

Operating system

Ubuntu 26.04 LTS (Linux 7.0.6-2-pve x86_64)

Install method

Local pnpm source build

Model

Observed with Codex app-server runtime models; facets 2-3 are runtime-independent.

Provider / routing chain

Codex app-server harness (openai) and embedded runtime.

Additional provider/model setup details

N/A

Logs

NOT_ENOUGH_INFO

Screenshots, recordings, and evidence

Each facet is traceable in source: token-only projection sizing in the Codex app-server projection builder; memory-flush runs inheriting full window in src/auto-reply/reply/agent-runner-memory.ts; whole-active-path measurement feeding the transcript_bytes preflight; partial binding equality in extensions/codex/src/app-server/session-binding.ts.

Impact and severity

Long sessions degrade into repeated expensive turns that compaction cannot recover, with occasional wrong-binding clears on Codex. A coherent fix exists on a local branch (configurable projection char cap, per-run context token budget pinning flushes to a bounded window, replay-window byte measurement bounded by the last compaction boundary, host-first preflight routing, generation-exact binding comparator with live-owner fallback refusal, heartbeat skills/tools narrowing); PR to follow — it is a large change (~85 files) and may be split for review.