feat: guard summaries against degenerate (garbage) backend output

Observed live: an overheated MI50 returns a single char repeated ("?????") as a
successful 200, which neither the timeout nor the exception fallback catches — so
a degraded GPU would silently save capped garbage gists. Validate each summary
call's output: flag text (>=24 non-space chars) whose most-common non-whitespace
char exceeds 50%, raise DegenerateOutput, and let the existing retry->cloud
fallback handle it. Real prose (top char <20%) won't false-positive; short output
is exempt; cloud garbage raises rather than looping.

Tests: _looks_degenerate flags repeated-char / passes real prose / ignores short;
degenerate MI50 output falls back to cloud; cloud garbage raises. 177 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015yrEb5qpPGv2FjyxrB7LLk

lyra/summary.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import sys
 import threading
 import time
+from collections import Counter
 from concurrent.futures import ThreadPoolExecutor, as_completed
 
 from lyra import config, llm, logbus, memory
@@ -28,6 +29,25 @@ MI50_ATTEMPTS = 2
 # MI50; 150s is headroom but bails a hung call fast so fallback isn't slow.
 SUMMARY_TIMEOUT = 150
 
+# Degenerate-output guard. A wedged local model (e.g. an overheated GPU) returns
+# a single character repeated ("?????") as a *successful* 200, which no timeout or
+# exception catches — so validate the text and treat junk as a failure. Real gists
+# are diverse prose; flag output whose most-common non-space char dominates. Short
+# outputs are exempt (nothing meaningful to judge).
+_DEGENERATE_MIN_CHARS = 24
+_DEGENERATE_CHAR_RATIO = 0.5
+
+
+class DegenerateOutput(RuntimeError):
+    """A backend returned junk (e.g. one char repeated) as a successful response."""
+
+
+def _looks_degenerate(text: str) -> bool:
+    stripped = "".join(text.split())
+    if len(stripped) < _DEGENERATE_MIN_CHARS:
+        return False
+    return max(Counter(stripped).values()) / len(stripped) > _DEGENERATE_CHAR_RATIO
+
 # Re-summarize a session once it has accumulated this many new raw exchanges.
 SUMMARIZE_AFTER = 20
 # Transcript budget per LLM call; longer sessions are chunked + merged. Cloud has
@@ -72,8 +92,11 @@ def _summarize_text(text: str, backend: Backend) -> str:
     ]
 
     def _call(be: Backend) -> str:
-        return llm.complete(messages, backend=be,
-                            max_tokens=SUMMARY_MAX_TOKENS, timeout=SUMMARY_TIMEOUT)
+        out = llm.complete(messages, backend=be,
+                           max_tokens=SUMMARY_MAX_TOKENS, timeout=SUMMARY_TIMEOUT)
+        if _looks_degenerate(out):
+            raise DegenerateOutput(f"{be} returned degenerate output ({len(out)} chars)")
+        return out
 
     # Try the primary backend a bounded number of times (each call fast-fails via
     # SUMMARY_TIMEOUT), with a short backoff for a transient blip / restarting GPU.