… synthesis

Address P2 review finding on PR openclaw#75873: thread timedOutDuringToolExecution
through the two remaining timeout-handling branches in run.ts so a long
tool call doesn't trigger compaction/retry or surface a misleading
"Request timed out before a response was generated" payload before the
failover-policy exemption matters.

- run.ts:1250 (timeout-triggered compaction): tool-exec timeouts skip
  compaction. Compacting wouldn't help — the LLM already responded; the
  prompt wasn't the problem. It would only lose in-flight tool context.

- run.ts:2084 (generic timeout payload synthesis): tool-exec timeouts
  skip the synthesized "Request timed out before a response was generated"
  payload. The assistant did produce a response (a tool call that ran
  long); the partial tool output already in the session is the correct
  artifact to surface.

Also adds the missing CHANGELOG entry (P3 finding) under Unreleased/Fixes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… synthesis

Address P2 review finding on PR openclaw#75873: thread timedOutDuringToolExecution
through the two remaining timeout-handling branches in run.ts so a long
tool call doesn't trigger compaction/retry or surface a misleading
"Request timed out before a response was generated" payload before the
failover-policy exemption matters.

- run.ts:1250 (timeout-triggered compaction): tool-exec timeouts skip
  compaction. Compacting wouldn't help — the LLM already responded; the
  prompt wasn't the problem. It would only lose in-flight tool context.

- run.ts:2084 (generic timeout payload synthesis): tool-exec timeouts
  skip the synthesized "Request timed out before a response was generated"
  payload. The assistant did produce a response (a tool call that ran
  long); the partial tool output already in the session is the correct
  artifact to surface.

Also adds the missing CHANGELOG entry (P3 finding) under Unreleased/Fixes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…K back-compat

Address P2 review finding on PR openclaw#75873: EmbeddedRunAttemptResult is
re-exported as AgentHarnessAttemptResult in the plugin SDK
(src/plugin-sdk/agent-harness-runtime.ts:25), so making the new field
required would force every third-party harness to add a field it cannot
necessarily observe.

- types.ts: field is now optional with documentation explaining the
  back-compat contract.
- run.ts: destructure with `?? false` default at the runner boundary so
  internal failover-decision code can rely on a strict boolean.

Internal embedded-runner attempt code always sets the flag explicitly,
so this is purely a defensive default for the public SDK contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

P2: Remove the stray <<<<<<< HEAD marker on CHANGELOG.md:41 left over
from the rebase-conflict resolution. CI's check-no-conflict-markers.mjs
caught it as an actionlint failure.

P3: Add @simonusa attribution to the Unreleased fixes entry per
OpenClaw changelog policy.

Both findings from clawsweeper review on PR openclaw#75873.

… synthesis

Address P2 review finding on PR openclaw#75873: thread timedOutDuringToolExecution
through the two remaining timeout-handling branches in run.ts so a long
tool call doesn't trigger compaction/retry or surface a misleading
"Request timed out before a response was generated" payload before the
failover-policy exemption matters.

- run.ts:1250 (timeout-triggered compaction): tool-exec timeouts skip
  compaction. Compacting wouldn't help — the LLM already responded; the
  prompt wasn't the problem. It would only lose in-flight tool context.

- run.ts:2084 (generic timeout payload synthesis): tool-exec timeouts
  skip the synthesized "Request timed out before a response was generated"
  payload. The assistant did produce a response (a tool call that ran
  long); the partial tool output already in the session is the correct
  artifact to surface.

Also adds the missing CHANGELOG entry (P3 finding) under Unreleased/Fixes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…K back-compat

Address P2 review finding on PR openclaw#75873: EmbeddedRunAttemptResult is
re-exported as AgentHarnessAttemptResult in the plugin SDK
(src/plugin-sdk/agent-harness-runtime.ts:25), so making the new field
required would force every third-party harness to add a field it cannot
necessarily observe.

- types.ts: field is now optional with documentation explaining the
  back-compat contract.
- run.ts: destructure with `?? false` default at the runner boundary so
  internal failover-decision code can rely on a strict boolean.

Internal embedded-runner attempt code always sets the flag explicitly,
so this is purely a defensive default for the public SDK contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Address P2/P3 bot review on PR openclaw#62682:

[P2] Embedded run-budget timeouts misclassified — `opts.abortSignal` is
the caller-provided signal (HTTP disconnect, cron wrapper). It is NOT
the embedded runner's private `runAbortController` — when
`scheduleAbortTimer` fires and calls `abortRun(true)`, only the internal
controller is aborted with a TimeoutError. The previous patch's
`isTerminalAbort(opts.abortSignal)` check therefore missed the openclaw#60388
case entirely; the fallback chain still tried alternative models even
though the whole run's deadline had elapsed.

Two complementary changes address this:

(1) `EmbeddedRunAttemptResult.timedOutByRunBudget` flag — set explicitly
    in attempt.ts when the run-budget timer fires (NOT when LLM idle
    watchdog fires; that's still LLM-phase and benefits from fallback).
    Threaded through to failover-policy `shouldRotateAssistant`
    alongside the existing `timedOutDuringCompaction` and
    `timedOutDuringToolExecution` exemptions. Also gates the
    timeout-triggered compaction branch in run.ts (compacting wouldn't
    help — the deadline is exhausted). Optional in result type for
    public harness SDK back-compat (matches openclaw#75873 pattern).

(2) `isTerminalAbortFromError(err)` — new helper that mirrors the
    existing `isTerminalAbort(signal)` checks but reads the thrown
    error's `.cause` chain. Needed because `abortable()` wraps the
    embedded controller's TimeoutError in an outer AbortError, and the
    fallback layer only sees the thrown error (not the embedded
    controller's signal). Used in `runFallbackCandidate.catch` next to
    the existing signal check.

[P3] CHANGELOG entry added under Unreleased/Fixes.

Tests: 197/197 pass in failover-policy, assistant-failover,
model-fallback, and trajectory-metadata suites. New regression cases
cover: (a) thrown error with TimeoutError in cause chain rethrows; (b)
thrown error with ClientDisconnectError in cause chain rethrows; (c)
generic AbortError still falls back; (d) failover-policy exempts
run-budget timeouts both pre- and post-rotation.

Closes openclaw#60388.