Preserve sanitized upstream provider classification in fatal records

[danielkov]

Summary

When an openai-subscription retry budget is exhausted, the parent-visible error can retain a sanitized upstream classification such as service_unavailable_error/server_is_overloaded, but the schema-v2 fatal record collapses it to a generic retry_exhausted or response_failed classification.

Split from #35 after the underlying overload retry behavior was fixed by #32.

Current behavior

Fatal classification prioritizes the local exhaustion category and stores a generic message. The sanitized upstream type/code that explains why retries occurred is not retained as structured fatal data. This makes the on-disk diagnostic less useful than the transient provider classification already available earlier in the error path.

Desired behavior

Preserve both layers in fatal diagnostics:

• local terminal category, for example retry_exhausted; and
• sanitized upstream provider type/code, for example service_unavailable_error/server_is_overloaded.

Do not store the raw provider response, provider message text, prompts, headers, credentials, or other sensitive payload data. Keep field lengths bounded and classifications canonical.

Suggested coverage

• Exhaust retries after service_unavailable_error/server_is_overloaded and assert both local and upstream classifications.
• Assert unknown transient spellings remain bounded and sanitized.
• Assert raw provider bodies and sensitive message text never enter schema-v2 fatal JSON.
• Preserve compatibility for readers of existing fatal records when the persistent schema changes.

Environment

• Originally observed with Kit 0.1.96 on Darwin 25.6.0 arm64.
• Confirmed as a remaining gap on Kit 0.1.105 on Darwin 25.5.0 arm64.
• Surface: ACP; provider route: openai-subscription.

Related work

• ACP subagents terminate on repeated openai-subscription server overloads #35
• fix(provider): overhaul openai-subscription retry policy #32